@bitkyc08/opencodex 2.80.0 → 2.81.0

package/src/combos/jev-decision-contract.ts

@@ -10,11 +10,34 @@ export const JEV_DECISION_TIMEOUT_MAX_MS = 120_000;
 /** Decision deadline when a combo sets no `decisionTimeoutMs`. */
 export const JEV_DECISION_TIMEOUT_DEFAULT_MS = 4_000;
 
-/** Whether a self-hosted decision endpoint follows the documented Jev `/systemone` path. */
+/** HTTPS decision services may use any path; local cleartext keeps the `/systemone` contract. */
 export function isSystemOneEndpoint(baseUrl: string): boolean {
   try {
-    return new URL(baseUrl.trim()).pathname.replace(/\/+$/, "").endsWith("/systemone");
+    const raw = baseUrl.trim();
+    // URL drops empty delimiters ("?", "#", "@") and strips tab/CR/LF, so check the raw text first.
+    if (/[\u0000-\u001f\u007f]/.test(raw)) return false;
+    const authority = raw.replace(/^[a-z][a-z\d+.-]*:[/\\]*/i, "").split(/[/\\]/, 1)[0] ?? "";
+    if (/[?#]/.test(raw) || authority.includes("@")) return false;
+    const url = new URL(raw);
+    if (url.username || url.password || url.search || url.hash) return false;
+    // URL canonicalizes address literals; keep this import-free for the dashboard bundle.
+    const host = url.hostname;
+    const local = host === "localhost" || host === "[::1]"
+      || /^(?:(?:127|10)\.\d+|172\.(?:1[6-9]|2\d|3[01])|192\.168)\.\d+\.\d+$/.test(host)
+      || /^\[f[cd][\da-f]{2}:/.test(host) || /^\[::ffff:7f[\da-f]{2}:/.test(host);
+    return url.protocol === "https:"
+      || url.protocol === "http:" && local && url.pathname.replace(/\/+$/, "").endsWith("/systemone");
   } catch {
     return false;
   }
 }
+
+/**
+ * The URL a decision row is sent to. A `/systemone` path keeps its historical trailing-slash
+ * normalization; any other HTTPS path is the operator's exact endpoint.
+ */
+export function jevDecisionEndpointUrl(baseUrl: string): string {
+  const raw = baseUrl.trim();
+  const stripped = raw.replace(/\/+$/, "");
+  return stripped.endsWith("/systemone") ? stripped : raw;
+}

package/src/combos/jev.ts

@@ -10,6 +10,7 @@ import {
 } from "../providers/api-key-resolve";
 import { providerMatchesRegistryTransport } from "../providers/registry";
 import type { OcxComboDefaultEffort, OcxConfig, OcxProviderConfig } from "../types";
+import { jevDecisionEndpointUrl } from "./jev-decision-contract";
 import {
   isSystemOneEndpoint,
   JEV_DECISION_TIMEOUT_DEFAULT_MS,
@@ -676,7 +677,7 @@ function selfHostedApiKey(name: string, apiKey: string | undefined): string | un
  * only while the row still matches the registry transport, and the environment fallbacks exist
  * only for that URL. A retargeted `jev` row therefore keeps today's behavior instead of becoming a
  * custom destination. Any other id must be an enabled `jev-decision` row whose baseUrl is a
- * `/systemone` endpoint and which names its own model; only its own key may accompany it, so no
+ * full HTTPS decision endpoint (or a local HTTP `/systemone` endpoint) and names its own model; only its own key may accompany it, so no
  * TypeSafe credential can reach a self-hosted service. `undefined` means no usable decision
  * service (reported through the existing `missing_key` gate); `null` means the request's
  * destination scope refused it before any credential access.
@@ -709,7 +710,7 @@ function jevDecisionEndpoint(
     };
   }
   if (configured?.adapter !== "jev-decision" || typeof configured.baseUrl !== "string") return undefined;
-  const url = configured.baseUrl.trim().replace(/\/+$/, "");
+  const url = jevDecisionEndpointUrl(configured.baseUrl);
   if (!url || !isSystemOneEndpoint(url)) return undefined;
   // `jev-latest` is TypeSafe's model name; a self-hosted host must name its own.
   const model = configured.defaultModel?.trim() || configured.models?.[0]?.trim();

package/src/combos/types.ts

@@ -302,7 +302,7 @@ export function comboConfigIssues(
     } else if (!isSystemOneEndpoint(String(providers[decisionProvider]?.baseUrl ?? ""))) {
       issues.push({
         path: ["decisionProvider"],
-        message: `decisionProvider "${decisionProvider}" baseUrl must be the full decision endpoint ending in /systemone`,
+        message: `decisionProvider "${decisionProvider}" baseUrl must be a full HTTPS decision endpoint or an HTTP /systemone endpoint`,
       });
     } else if (options.requireUsableDecisionService && providers[decisionProvider]?.disabled === true) {
       issues.push({

package/src/config/diagnostics.ts

@@ -1,3 +1,4 @@
+import { readExistingSpendSalt, spendPoolAliasesError, validatePoolAliasOwners } from "../lib/spend-pool-alias-validation";
 import { isSubagentModelEntry, rawSubagentModelForce } from "./subagent-models";
 import { protocolConfigSchema } from "./schema/config-schema";
 import { createHash } from "node:crypto";
@@ -7,13 +8,13 @@ import * as z from "zod/v4";
 import { compactionRecoveryConfigError } from "./schema/compaction-recovery";
 import { blockedModelRedirectsError } from "./schema/blocked-model-redirects";
 import type { OcxConfig } from "../types";
-import { parseAnthropicModelRoutes } from "../oauth/anthropic-model-routes";
+import { anthropicAccountPoolConfigError, anthropicOAuthInstanceConfigError, anthropicSidecarConfigError } from "./schema/anthropic-account-pool";
 import { configReasoningPinsConfigError } from "./provider-validation";
 import { loopbackCompanionAllowed } from "../codex/loopback-target";
 import { UPSTREAM_HOST_CIRCUIT_MAX_THRESHOLD } from "../codex/upstream-host-health";
 import { MAX_APP_OWNED_MEMORY_BUDGET_MB, MIN_APP_OWNED_MEMORY_BUDGET_MB } from "../lib/app-owned-memory";
 import { isMissingPathError } from "./atomic-write";
-import { getConfigPath } from "./paths";
+import { getConfigDir, getConfigPath } from "./paths";
 import { getDefaultConfig } from "./proxy-env";
 import { salvageConfigCandidate } from "./salvage";
 import {
@@ -81,6 +82,23 @@ export type ConfigDiagnostics = {
   warnings?: string[];
 };
 
+function rawPoolAliasesError(value: unknown): string | undefined {
+  const record = rawConfigRecord(value);
+  if (!record) return undefined;
+  const aliases = record.spendPoolAliases;
+  const shapeError = spendPoolAliasesError(aliases);
+  if (shapeError) return shapeError;
+  const mapping = rawConfigRecord(aliases);
+  if (!mapping || Object.keys(mapping).length === 0) return undefined;
+  const providers = rawConfigRecord(record.providers ?? {});
+  if (!providers) return "providers must be an object to validate spendPoolAliases";
+  const targetError = spendPoolAliasesError(aliases, Object.keys(providers));
+  if (targetError) return targetError;
+  const salt = readExistingSpendSalt(getConfigDir());
+  if (!salt) return "spendPoolAliases requires a safely readable existing spend salt";
+  return validatePoolAliasOwners(aliases, salt, Object.keys(providers));
+}
+
 export type ConfigFileSnapshot = {
   diagnostics: ConfigDiagnostics;
   /** Exact file contents, including a possible BOM, used as the optimistic revision. */
@@ -145,6 +163,9 @@ function validFileConfigDiagnostics(config: OcxConfig, rawParsed: unknown): Conf
   if (codexPoolWarning) warnings.push(codexPoolWarning);
   const spendWarning = malformedSpendWarning(rawParsed);
   if (spendWarning) warnings.push(spendWarning);
+  if (rawPoolAliasesError(rawParsed)) {
+    warnings.push("spendPoolAliases invalid: configured pool admission is refused until the mapping is corrected");
+  }
   const plaintextWarning = malformedPlaintextV2AgentMessagesWarning(rawParsed);
   if (plaintextWarning) warnings.push(plaintextWarning);
   if (syncDisabledReason) {
@@ -153,7 +174,7 @@ function validFileConfigDiagnostics(config: OcxConfig, rawParsed: unknown): Conf
   return {
     config: normalized,
     source: "file",
-    error: null,
+    error: anthropicOAuthInstanceConfigError(rawParsed) ?? anthropicAccountPoolConfigError(rawParsed) ?? anthropicSidecarConfigError(rawParsed) ?? null,
     ...(warnings.length > 0 ? { warnings } : {}),
   };
 }
@@ -655,19 +676,8 @@ export function validateConfigCandidate(value: unknown): { ok: true; config: Ocx
   if (protocols !== undefined && !protocolConfigSchema.safeParse(protocols).success) {
     return { ok: false, error: "schema_invalid: protocols: expected valid protocol policy and boolean rollout flags" };
   }
-  const rawAnthropicPool = rawConfigRecord(value)?.anthropicAccountPool;
-  const anthropicPool = rawConfigRecord(rawAnthropicPool);
-  if (rawAnthropicPool !== undefined && !anthropicPool) {
-    return { ok: false, error: "schema_invalid: anthropicAccountPool: must be an object" };
-  }
-  if (anthropicPool && Object.hasOwn(anthropicPool, "nativeMessages") && typeof anthropicPool.nativeMessages !== "boolean") {
-    return { ok: false, error: "schema_invalid: anthropicAccountPool.nativeMessages: must be a boolean" };
-  }
-  const routeValue = anthropicPool?.routes;
-  if (routeValue !== undefined) {
-    const parsed = parseAnthropicModelRoutes(routeValue);
-    if (!parsed.ok) return { ok: false, error: `schema_invalid: anthropicAccountPool.routes: ${parsed.error}` };
-  }
+  const anthropicError = anthropicOAuthInstanceConfigError(value) ?? anthropicAccountPoolConfigError(value) ?? anthropicSidecarConfigError(value);
+  if (anthropicError) return { ok: false, error: anthropicError };
   const boundaryError = blockedModelRedirectsError(value)
     ?? compactionRecoveryConfigError(value) ?? configReasoningPinsConfigError(value)
     ?? blankHostnameError(value)
@@ -679,6 +689,7 @@ export function validateConfigCandidate(value: unknown): { ok: true; config: Ocx
     ?? agentTaskRecoveryError(value)
     ?? quotaResetNotifyError(value)
     ?? catalogAutoRefreshError(value)
+    ?? (rawPoolAliasesError(value) ? "schema_invalid: spendPoolAliases: invalid pool identity mapping" : null)
     ?? spendError(value)
     ?? codexPoolError(value)
     ?? googleAntigravityStaticCatalogVersionError(value)

package/src/config/load-degrade.ts

@@ -3,6 +3,7 @@ import { chmodSync, existsSync } from "node:fs";
 import { join } from "node:path";
 import { compactionRecoveryConfigError } from "./schema/compaction-recovery";
 import { blockedModelRedirectsError } from "./schema/blocked-model-redirects";
+import { anthropicSidecarConfigError } from "./schema/anthropic-account-pool";
 import {
   modelPinnedEffortsConfigError,
   pinnedReasoningEffortConfigError,
@@ -160,6 +161,39 @@ export function warnDegradedMemoryModels(rawParsed: unknown, validated: OcxConfi
   }
 }
 
+/**
+ * Load-time degradation for helper `anthropicInstance` (loadConfig only). A malformed id, or one
+ * that conflicts with its block's backend or model, drops just that key with a warning, so the
+ * helper inherits the request's pool and every provider/key survives. Validated writes still
+ * reject the value and file diagnostics still report it from the raw document.
+ *
+ * Each location is checked in isolation, global blocks first, so a Claude override is judged
+ * against the already-degraded global block it inherits from. An override that owns no
+ * `anthropicInstance` of its own is left untouched: the conflicting key lives in the global
+ * block, which is valid on its own, and the inherited value is still a well-formed instance.
+ */
+export function sanitizeAnthropicSidecarInstanceForLoad(parsed: unknown): void {
+  const asRecord = (value: unknown): Record<string, unknown> | undefined =>
+    value && typeof value === "object" && !Array.isArray(value) ? value as Record<string, unknown> : undefined;
+  const root = asRecord(parsed);
+  if (!root) return;
+  for (const scope of ["global", "claude"] as const) {
+    const owner = scope === "global" ? root : asRecord(root.claudeCode);
+    for (const field of ["webSearchSidecar", "visionSidecar"] as const) {
+      const sidecar = asRecord(owner?.[field]);
+      if (!sidecar || !Object.hasOwn(sidecar, "anthropicInstance")) continue;
+      const probe = scope === "global"
+        ? { [field]: sidecar }
+        : { [field]: root[field], claudeCode: { [field]: sidecar } };
+      const error = anthropicSidecarConfigError(probe);
+      if (!error) continue;
+      delete sidecar.anthropicInstance;
+      // The message names a static path and reason only; the hand-edited value is never echoed.
+      console.warn(`⚠️  config.json ${error} — ignoring that anthropicInstance; the helper inherits the request's Anthropic pool`);
+    }
+  }
+}
+
 /**
  * Load-time degradation for `retryOn429` (loadConfig only): one hand-edited invalid optional
  * field (e.g. `attempts: 0` or a string) must not trip the whole provider schema and hide every

package/src/config/schema/anthropic-account-pool.ts

@@ -0,0 +1,143 @@
+import * as z from "zod/v4";
+import { parseAnthropicModelRoutes } from "../../oauth/anthropic-model-routes";
+import { isAnthropicInstanceId } from "../../providers/anthropic-instance-id";
+import { redactSecretString } from "../../lib/redact";
+
+/** Historical A load contract, shared verbatim with B: recover only the native preference. */
+export const anthropicAccountPoolSchema = z.object({
+  nativeMessages: z.boolean().optional().catch(false),
+}).passthrough().optional().catch(undefined);
+
+function record(value: unknown): Record<string, unknown> | undefined {
+  return value && typeof value === "object" && !Array.isArray(value)
+    ? value as Record<string, unknown> : undefined;
+}
+
+/** Write/diagnostic contract preserves A's historical nativeMessages and route validation. */
+function poolError(value: unknown, path: string): string | undefined {
+  if (value === undefined) return undefined;
+  const pool = record(value);
+  if (!pool) return `schema_invalid: ${path}: must be an object`;
+  if (Object.hasOwn(pool, "nativeMessages") && typeof pool.nativeMessages !== "boolean") {
+    return `schema_invalid: ${path}.nativeMessages: must be a boolean`;
+  }
+  if (pool.routes !== undefined) {
+    const parsed = parseAnthropicModelRoutes(pool.routes);
+    if (!parsed.ok) return `schema_invalid: ${path}.routes: ${parsed.error}`;
+  }
+  return undefined;
+}
+
+/** Inspect raw locations before the tolerant load schema can discard a malformed field. */
+export function anthropicAccountPoolConfigError(value: unknown): string | undefined {
+  const config = record(value);
+  const primaryError = poolError(config?.anthropicAccountPool, "anthropicAccountPool");
+  if (primaryError) return primaryError;
+  for (const [name, raw] of Object.entries(record(config?.providers) ?? {})) {
+    const provider = record(raw);
+    if (!provider || !Object.hasOwn(provider, "anthropicAccountPool")) continue;
+    const path = `providers.${redactSecretString(name)}.anthropicAccountPool`;
+    if (name !== "anthropic2") {
+      return `schema_invalid: ${path}: misplaced field; provider-local anthropicAccountPool is valid only on anthropic2 (anthropic uses the top-level field)`;
+    }
+    const error = poolError(provider.anthropicAccountPool, path);
+    if (error) return error;
+  }
+  return undefined;
+}
+
+/** Raw provenance validation runs before tolerant parsing and never adopts or edits a row. */
+export function anthropicOAuthInstanceConfigError(value: unknown): string | undefined {
+  const seen = new WeakSet<object>();
+  const inspect = (raw: unknown, location: string[]): string | undefined => {
+    if (!raw || typeof raw !== "object" || seen.has(raw)) return undefined;
+    seen.add(raw);
+    for (const [field, descriptor] of Object.entries(Object.getOwnPropertyDescriptors(raw))) {
+      const path = [...location, field];
+      if (field === "anthropicOAuthInstance") {
+        const label = redactSecretString(path.join("."));
+        if (!("value" in descriptor)) return `schema_invalid: ${label}: must be an own data property`;
+        if (location.length !== 2 || location[0] !== "providers" || location[1] !== "anthropic2") {
+          return `schema_invalid: ${label}: misplaced field; valid only on providers.anthropic2`;
+        }
+        if (descriptor.value !== "anthropic2") return `schema_invalid: ${label}: must be anthropic2`;
+        const row = Object.getOwnPropertyDescriptors(raw);
+        if (row.adapter?.value !== "anthropic" || row.authMode?.value !== "oauth") {
+          return `schema_invalid: ${label}: requires Anthropic adapter and OAuth authMode`;
+        }
+      }
+      if (!("value" in descriptor)) continue;
+      const error = inspect(descriptor.value, path);
+      if (error) return error;
+    }
+    seen.delete(raw);
+    return undefined;
+  };
+  return inspect(value, []);
+}
+
+/** Validate explicit helper identity without materializing an absent instance preference. */
+export function anthropicSidecarConfigError(value: unknown): string | undefined {
+  const config = record(value);
+  const claude = record(config?.claudeCode);
+  for (const [prefix, owner] of [["", config], ["claudeCode.", claude]] as const) {
+    for (const field of ["webSearchSidecar", "visionSidecar"] as const) {
+      const rawSidecar = record(owner?.[field]);
+      if (!rawSidecar) continue;
+      // Claude overrides inherit individual global fields, just like buildClaudeReplayConfig.
+      const sidecar = prefix ? { ...record(config?.[field]), ...rawSidecar } : rawSidecar;
+      if (!Object.hasOwn(sidecar, "anthropicInstance")) continue;
+      const path = `${prefix}${field}.anthropicInstance`;
+      if (!isAnthropicInstanceId(sidecar.anthropicInstance)) {
+        return `schema_invalid: ${path}: must be anthropic or anthropic2`;
+      }
+      // Web search defaults to OpenAI; vision's absent backend keeps its credential-based auto mode.
+      const backend = sidecar.backend === undefined
+        ? (field === "webSearchSidecar" ? "openai" : undefined) : sidecar.backend;
+      // An instance inherited from the global block is inert once the override's effective backend
+      // leaves Anthropic (the helper resolver only reads it for the Anthropic family), so it is not
+      // a conflict. An instance the override sets itself is still validated in full.
+      if (prefix && !Object.hasOwn(rawSidecar, "anthropicInstance") && backend !== undefined && backend !== "anthropic") continue;
+      const modelProvider = typeof sidecar.model === "string" && sidecar.model.includes("/")
+        ? sidecar.model.slice(0, sidecar.model.indexOf("/")) : undefined;
+      if (modelProvider && isAnthropicInstanceId(modelProvider) && modelProvider !== sidecar.anthropicInstance) {
+        return `schema_invalid: ${path}: conflicts with the model's Anthropic instance`;
+      }
+      if (backend !== undefined && backend !== "anthropic") {
+        return `schema_invalid: ${path}: requires an anthropic backend`;
+      }
+    }
+  }
+  return undefined;
+}
+
+/** Validate the effective settings before either management route mutates live state. */
+export function anthropicSidecarPatchError(
+  config: unknown,
+  patches: Record<string, unknown>,
+  claude = false,
+): string | undefined {
+  const source = record(config) ?? {};
+  const next = { ...source };
+  const owner = claude ? { ...record(source.claudeCode) } : next;
+  for (const field of ["webSearchSidecar", "visionSidecar"] as const) {
+    if (!Object.hasOwn(patches, field)) continue;
+    const patch = patches[field];
+    if (patch === null) { delete owner[field]; continue; }
+    const section = record(patch);
+    if (!section) continue; // Shape validation belongs to the route.
+    if (section.anthropicInstance !== undefined && section.anthropicInstance !== null
+      && !isAnthropicInstanceId(section.anthropicInstance)) {
+      return `${field}.anthropicInstance must be anthropic, anthropic2, or null`;
+    }
+    const settings = { ...record(owner[field]) };
+    for (const key of ["backend", "model", "anthropicInstance"] as const) {
+      if (section[key] === null || (key === "model" && section[key] === "")) delete settings[key];
+      else if (section[key] !== undefined) settings[key] = section[key];
+    }
+    if (claude && (Object.keys(section).length === 0 || Object.keys(settings).length === 0)) delete owner[field];
+    else owner[field] = settings;
+  }
+  if (claude) next.claudeCode = owner;
+  return anthropicSidecarConfigError(next);
+}

package/src/config/schema/config-schema.ts

@@ -1,5 +1,6 @@
 import { MAIN_ACCOUNT_HARD_LOCK_MIN_PERCENT } from "../../codex/quota-types";
 import * as z from "zod/v4";
+import { anthropicAccountPoolSchema } from "./anthropic-account-pool";
 import { compactionRecoverySchema } from "./compaction-recovery";
 import { blockedModelRedirectsSchema } from "./blocked-model-redirects";
 import {
@@ -327,7 +328,7 @@ export const configSchema = z.object({
   blockedModelRedirects: blockedModelRedirectsSchema.optional().catch(undefined),
   // Degrade malformed hand edits locally; candidate writes reject them before parsing.
   // An invalid native preference retains the legacy route instead of enabling native by default.
-  anthropicAccountPool: z.object({ nativeMessages: z.boolean().optional().catch(false) }).passthrough().optional().catch(undefined),
+  anthropicAccountPool: anthropicAccountPoolSchema,
   // Same degrade-don't-reject rationale as the fields above: a hand-edited
   // non-string must not trip the backup-and-defaults repair path. Unset then
   // takes the canonical sideband path (src/server/live.ts normalizeSidebandRoot).
@@ -350,6 +351,11 @@ export const configSchema = z.object({
       .map(row => apiKeyEntrySchema.parse(row) as OcxApiKeyEntry);
   }),
 }).passthrough().superRefine((config, ctx) => {
+  // Helper `anthropicInstance` is deliberately not refined here. A document-level issue would send
+  // loadConfig through salvage (which refuses pathless issues) to the backup-and-defaults path, so
+  // one hand-edited helper preference would hide every provider. Writes reject it explicitly in
+  // validateConfigCandidate, diagnostics report it from the raw file, and loadConfig drops only the
+  // offending key (sanitizeAnthropicSidecarInstanceForLoad).
   const claudeCode = (config as { claudeCode?: unknown }).claudeCode;
   if (claudeCode !== undefined && (!claudeCode || typeof claudeCode !== "object" || Array.isArray(claudeCode))) {
     ctx.addIssue({ code: "custom", path: ["claudeCode"], message: "claudeCode must be an object" });

package/src/config/schema/leaf-validators.ts

@@ -1,4 +1,5 @@
 import * as z from "zod/v4";
+import { anthropicAccountPoolSchema } from "./anthropic-account-pool";
 import { join } from "node:path";
 import { isValidProviderName } from "../provider-name";
 import {
@@ -285,6 +286,9 @@ const providerNoProxySchema = z.unknown().superRefine((value, ctx) => {
  * fields pass through (preserved for runtime extensions).
  */
 export const providerConfigSchema = z.object({
+  anthropicAccountPool: anthropicAccountPoolSchema,
+  // Raw diagnostics/writes reject malformed provenance; tolerant loads preserve the custom row.
+  anthropicOAuthInstance: z.literal("anthropic2").optional().catch(undefined),
   modelCapabilities: modelCapabilitiesSchema.optional(),
   modelContextTiers: z.unknown().superRefine((value, ctx) => {
     const error = contextTierRecordConfigError(value);

package/src/config.ts

@@ -172,6 +172,7 @@ import {
   sanitizeModelDisplayNamesForLoad,
   sanitizeAutoReviewForLoad,
   sanitizeRetryOn429ForLoad,
+  sanitizeAnthropicSidecarInstanceForLoad,
   sanitizeModelCostsForLoad,
   sanitizeCapabilityDeclarationsForLoad,
   warnInheritedFastWireConflicts,
@@ -226,6 +227,7 @@ export function loadConfig(): OcxConfig {
     sanitizeModelDisplayNamesForLoad(parsed);
     sanitizeAutoReviewForLoad(parsed);
     sanitizeRetryOn429ForLoad(parsed);
+    sanitizeAnthropicSidecarInstanceForLoad(parsed);
     sanitizeModelCostsForLoad(parsed);
     sanitizeCapabilityDeclarationsForLoad(parsed);
     const result = configSchema.safeParse(parsed);