@bitkyc08/opencodex 2.79.0 → 2.81.0

package/src/config/schema/anthropic-account-pool.ts

@@ -0,0 +1,143 @@
+import * as z from "zod/v4";
+import { parseAnthropicModelRoutes } from "../../oauth/anthropic-model-routes";
+import { isAnthropicInstanceId } from "../../providers/anthropic-instance-id";
+import { redactSecretString } from "../../lib/redact";
+
+/** Historical A load contract, shared verbatim with B: recover only the native preference. */
+export const anthropicAccountPoolSchema = z.object({
+  nativeMessages: z.boolean().optional().catch(false),
+}).passthrough().optional().catch(undefined);
+
+function record(value: unknown): Record<string, unknown> | undefined {
+  return value && typeof value === "object" && !Array.isArray(value)
+    ? value as Record<string, unknown> : undefined;
+}
+
+/** Write/diagnostic contract preserves A's historical nativeMessages and route validation. */
+function poolError(value: unknown, path: string): string | undefined {
+  if (value === undefined) return undefined;
+  const pool = record(value);
+  if (!pool) return `schema_invalid: ${path}: must be an object`;
+  if (Object.hasOwn(pool, "nativeMessages") && typeof pool.nativeMessages !== "boolean") {
+    return `schema_invalid: ${path}.nativeMessages: must be a boolean`;
+  }
+  if (pool.routes !== undefined) {
+    const parsed = parseAnthropicModelRoutes(pool.routes);
+    if (!parsed.ok) return `schema_invalid: ${path}.routes: ${parsed.error}`;
+  }
+  return undefined;
+}
+
+/** Inspect raw locations before the tolerant load schema can discard a malformed field. */
+export function anthropicAccountPoolConfigError(value: unknown): string | undefined {
+  const config = record(value);
+  const primaryError = poolError(config?.anthropicAccountPool, "anthropicAccountPool");
+  if (primaryError) return primaryError;
+  for (const [name, raw] of Object.entries(record(config?.providers) ?? {})) {
+    const provider = record(raw);
+    if (!provider || !Object.hasOwn(provider, "anthropicAccountPool")) continue;
+    const path = `providers.${redactSecretString(name)}.anthropicAccountPool`;
+    if (name !== "anthropic2") {
+      return `schema_invalid: ${path}: misplaced field; provider-local anthropicAccountPool is valid only on anthropic2 (anthropic uses the top-level field)`;
+    }
+    const error = poolError(provider.anthropicAccountPool, path);
+    if (error) return error;
+  }
+  return undefined;
+}
+
+/** Raw provenance validation runs before tolerant parsing and never adopts or edits a row. */
+export function anthropicOAuthInstanceConfigError(value: unknown): string | undefined {
+  const seen = new WeakSet<object>();
+  const inspect = (raw: unknown, location: string[]): string | undefined => {
+    if (!raw || typeof raw !== "object" || seen.has(raw)) return undefined;
+    seen.add(raw);
+    for (const [field, descriptor] of Object.entries(Object.getOwnPropertyDescriptors(raw))) {
+      const path = [...location, field];
+      if (field === "anthropicOAuthInstance") {
+        const label = redactSecretString(path.join("."));
+        if (!("value" in descriptor)) return `schema_invalid: ${label}: must be an own data property`;
+        if (location.length !== 2 || location[0] !== "providers" || location[1] !== "anthropic2") {
+          return `schema_invalid: ${label}: misplaced field; valid only on providers.anthropic2`;
+        }
+        if (descriptor.value !== "anthropic2") return `schema_invalid: ${label}: must be anthropic2`;
+        const row = Object.getOwnPropertyDescriptors(raw);
+        if (row.adapter?.value !== "anthropic" || row.authMode?.value !== "oauth") {
+          return `schema_invalid: ${label}: requires Anthropic adapter and OAuth authMode`;
+        }
+      }
+      if (!("value" in descriptor)) continue;
+      const error = inspect(descriptor.value, path);
+      if (error) return error;
+    }
+    seen.delete(raw);
+    return undefined;
+  };
+  return inspect(value, []);
+}
+
+/** Validate explicit helper identity without materializing an absent instance preference. */
+export function anthropicSidecarConfigError(value: unknown): string | undefined {
+  const config = record(value);
+  const claude = record(config?.claudeCode);
+  for (const [prefix, owner] of [["", config], ["claudeCode.", claude]] as const) {
+    for (const field of ["webSearchSidecar", "visionSidecar"] as const) {
+      const rawSidecar = record(owner?.[field]);
+      if (!rawSidecar) continue;
+      // Claude overrides inherit individual global fields, just like buildClaudeReplayConfig.
+      const sidecar = prefix ? { ...record(config?.[field]), ...rawSidecar } : rawSidecar;
+      if (!Object.hasOwn(sidecar, "anthropicInstance")) continue;
+      const path = `${prefix}${field}.anthropicInstance`;
+      if (!isAnthropicInstanceId(sidecar.anthropicInstance)) {
+        return `schema_invalid: ${path}: must be anthropic or anthropic2`;
+      }
+      // Web search defaults to OpenAI; vision's absent backend keeps its credential-based auto mode.
+      const backend = sidecar.backend === undefined
+        ? (field === "webSearchSidecar" ? "openai" : undefined) : sidecar.backend;
+      // An instance inherited from the global block is inert once the override's effective backend
+      // leaves Anthropic (the helper resolver only reads it for the Anthropic family), so it is not
+      // a conflict. An instance the override sets itself is still validated in full.
+      if (prefix && !Object.hasOwn(rawSidecar, "anthropicInstance") && backend !== undefined && backend !== "anthropic") continue;
+      const modelProvider = typeof sidecar.model === "string" && sidecar.model.includes("/")
+        ? sidecar.model.slice(0, sidecar.model.indexOf("/")) : undefined;
+      if (modelProvider && isAnthropicInstanceId(modelProvider) && modelProvider !== sidecar.anthropicInstance) {
+        return `schema_invalid: ${path}: conflicts with the model's Anthropic instance`;
+      }
+      if (backend !== undefined && backend !== "anthropic") {
+        return `schema_invalid: ${path}: requires an anthropic backend`;
+      }
+    }
+  }
+  return undefined;
+}
+
+/** Validate the effective settings before either management route mutates live state. */
+export function anthropicSidecarPatchError(
+  config: unknown,
+  patches: Record<string, unknown>,
+  claude = false,
+): string | undefined {
+  const source = record(config) ?? {};
+  const next = { ...source };
+  const owner = claude ? { ...record(source.claudeCode) } : next;
+  for (const field of ["webSearchSidecar", "visionSidecar"] as const) {
+    if (!Object.hasOwn(patches, field)) continue;
+    const patch = patches[field];
+    if (patch === null) { delete owner[field]; continue; }
+    const section = record(patch);
+    if (!section) continue; // Shape validation belongs to the route.
+    if (section.anthropicInstance !== undefined && section.anthropicInstance !== null
+      && !isAnthropicInstanceId(section.anthropicInstance)) {
+      return `${field}.anthropicInstance must be anthropic, anthropic2, or null`;
+    }
+    const settings = { ...record(owner[field]) };
+    for (const key of ["backend", "model", "anthropicInstance"] as const) {
+      if (section[key] === null || (key === "model" && section[key] === "")) delete settings[key];
+      else if (section[key] !== undefined) settings[key] = section[key];
+    }
+    if (claude && (Object.keys(section).length === 0 || Object.keys(settings).length === 0)) delete owner[field];
+    else owner[field] = settings;
+  }
+  if (claude) next.claudeCode = owner;
+  return anthropicSidecarConfigError(next);
+}

package/src/config/schema/config-schema.ts

@@ -1,5 +1,6 @@
 import { MAIN_ACCOUNT_HARD_LOCK_MIN_PERCENT } from "../../codex/quota-types";
 import * as z from "zod/v4";
+import { anthropicAccountPoolSchema } from "./anthropic-account-pool";
 import { compactionRecoverySchema } from "./compaction-recovery";
 import { blockedModelRedirectsSchema } from "./blocked-model-redirects";
 import {
@@ -327,7 +328,7 @@ export const configSchema = z.object({
   blockedModelRedirects: blockedModelRedirectsSchema.optional().catch(undefined),
   // Degrade malformed hand edits locally; candidate writes reject them before parsing.
   // An invalid native preference retains the legacy route instead of enabling native by default.
-  anthropicAccountPool: z.object({ nativeMessages: z.boolean().optional().catch(false) }).passthrough().optional().catch(undefined),
+  anthropicAccountPool: anthropicAccountPoolSchema,
   // Same degrade-don't-reject rationale as the fields above: a hand-edited
   // non-string must not trip the backup-and-defaults repair path. Unset then
   // takes the canonical sideband path (src/server/live.ts normalizeSidebandRoot).
@@ -350,6 +351,11 @@ export const configSchema = z.object({
       .map(row => apiKeyEntrySchema.parse(row) as OcxApiKeyEntry);
   }),
 }).passthrough().superRefine((config, ctx) => {
+  // Helper `anthropicInstance` is deliberately not refined here. A document-level issue would send
+  // loadConfig through salvage (which refuses pathless issues) to the backup-and-defaults path, so
+  // one hand-edited helper preference would hide every provider. Writes reject it explicitly in
+  // validateConfigCandidate, diagnostics report it from the raw file, and loadConfig drops only the
+  // offending key (sanitizeAnthropicSidecarInstanceForLoad).
   const claudeCode = (config as { claudeCode?: unknown }).claudeCode;
   if (claudeCode !== undefined && (!claudeCode || typeof claudeCode !== "object" || Array.isArray(claudeCode))) {
     ctx.addIssue({ code: "custom", path: ["claudeCode"], message: "claudeCode must be an object" });

package/src/config/schema/leaf-validators.ts

@@ -1,4 +1,5 @@
 import * as z from "zod/v4";
+import { anthropicAccountPoolSchema } from "./anthropic-account-pool";
 import { join } from "node:path";
 import { isValidProviderName } from "../provider-name";
 import {
@@ -285,6 +286,9 @@ const providerNoProxySchema = z.unknown().superRefine((value, ctx) => {
  * fields pass through (preserved for runtime extensions).
  */
 export const providerConfigSchema = z.object({
+  anthropicAccountPool: anthropicAccountPoolSchema,
+  // Raw diagnostics/writes reject malformed provenance; tolerant loads preserve the custom row.
+  anthropicOAuthInstance: z.literal("anthropic2").optional().catch(undefined),
   modelCapabilities: modelCapabilitiesSchema.optional(),
   modelContextTiers: z.unknown().superRefine((value, ctx) => {
     const error = contextTierRecordConfigError(value);

package/src/config.ts

@@ -172,6 +172,7 @@ import {
   sanitizeModelDisplayNamesForLoad,
   sanitizeAutoReviewForLoad,
   sanitizeRetryOn429ForLoad,
+  sanitizeAnthropicSidecarInstanceForLoad,
   sanitizeModelCostsForLoad,
   sanitizeCapabilityDeclarationsForLoad,
   warnInheritedFastWireConflicts,
@@ -226,6 +227,7 @@ export function loadConfig(): OcxConfig {
     sanitizeModelDisplayNamesForLoad(parsed);
     sanitizeAutoReviewForLoad(parsed);
     sanitizeRetryOn429ForLoad(parsed);
+    sanitizeAnthropicSidecarInstanceForLoad(parsed);
     sanitizeModelCostsForLoad(parsed);
     sanitizeCapabilityDeclarationsForLoad(parsed);
     const result = configSchema.safeParse(parsed);