@bitkyc08/opencodex 2.80.0 → 2.82.0

package/src/config/diagnostics.ts

@@ -1,3 +1,4 @@
+import { readExistingSpendSalt, spendPoolAliasesError, validatePoolAliasOwners } from "../lib/spend-pool-alias-validation";
 import { isSubagentModelEntry, rawSubagentModelForce } from "./subagent-models";
 import { protocolConfigSchema } from "./schema/config-schema";
 import { createHash } from "node:crypto";
@@ -7,13 +8,13 @@ import * as z from "zod/v4";
 import { compactionRecoveryConfigError } from "./schema/compaction-recovery";
 import { blockedModelRedirectsError } from "./schema/blocked-model-redirects";
 import type { OcxConfig } from "../types";
-import { parseAnthropicModelRoutes } from "../oauth/anthropic-model-routes";
+import { anthropicAccountPoolConfigError, anthropicOAuthInstanceConfigError, anthropicSidecarConfigError } from "./schema/anthropic-account-pool";
 import { configReasoningPinsConfigError } from "./provider-validation";
 import { loopbackCompanionAllowed } from "../codex/loopback-target";
 import { UPSTREAM_HOST_CIRCUIT_MAX_THRESHOLD } from "../codex/upstream-host-health";
 import { MAX_APP_OWNED_MEMORY_BUDGET_MB, MIN_APP_OWNED_MEMORY_BUDGET_MB } from "../lib/app-owned-memory";
 import { isMissingPathError } from "./atomic-write";
-import { getConfigPath } from "./paths";
+import { getConfigDir, getConfigPath } from "./paths";
 import { getDefaultConfig } from "./proxy-env";
 import { salvageConfigCandidate } from "./salvage";
 import {
@@ -81,6 +82,23 @@ export type ConfigDiagnostics = {
   warnings?: string[];
 };
 
+function rawPoolAliasesError(value: unknown): string | undefined {
+  const record = rawConfigRecord(value);
+  if (!record) return undefined;
+  const aliases = record.spendPoolAliases;
+  const shapeError = spendPoolAliasesError(aliases);
+  if (shapeError) return shapeError;
+  const mapping = rawConfigRecord(aliases);
+  if (!mapping || Object.keys(mapping).length === 0) return undefined;
+  const providers = rawConfigRecord(record.providers ?? {});
+  if (!providers) return "providers must be an object to validate spendPoolAliases";
+  const targetError = spendPoolAliasesError(aliases, Object.keys(providers));
+  if (targetError) return targetError;
+  const salt = readExistingSpendSalt(getConfigDir());
+  if (!salt) return "spendPoolAliases requires a safely readable existing spend salt";
+  return validatePoolAliasOwners(aliases, salt, Object.keys(providers));
+}
+
 export type ConfigFileSnapshot = {
   diagnostics: ConfigDiagnostics;
   /** Exact file contents, including a possible BOM, used as the optimistic revision. */
@@ -145,6 +163,9 @@ function validFileConfigDiagnostics(config: OcxConfig, rawParsed: unknown): Conf
   if (codexPoolWarning) warnings.push(codexPoolWarning);
   const spendWarning = malformedSpendWarning(rawParsed);
   if (spendWarning) warnings.push(spendWarning);
+  if (rawPoolAliasesError(rawParsed)) {
+    warnings.push("spendPoolAliases invalid: configured pool admission is refused until the mapping is corrected");
+  }
   const plaintextWarning = malformedPlaintextV2AgentMessagesWarning(rawParsed);
   if (plaintextWarning) warnings.push(plaintextWarning);
   if (syncDisabledReason) {
@@ -153,7 +174,7 @@ function validFileConfigDiagnostics(config: OcxConfig, rawParsed: unknown): Conf
   return {
     config: normalized,
     source: "file",
-    error: null,
+    error: anthropicOAuthInstanceConfigError(rawParsed) ?? anthropicAccountPoolConfigError(rawParsed) ?? anthropicSidecarConfigError(rawParsed) ?? null,
     ...(warnings.length > 0 ? { warnings } : {}),
   };
 }
@@ -655,19 +676,8 @@ export function validateConfigCandidate(value: unknown): { ok: true; config: Ocx
   if (protocols !== undefined && !protocolConfigSchema.safeParse(protocols).success) {
     return { ok: false, error: "schema_invalid: protocols: expected valid protocol policy and boolean rollout flags" };
   }
-  const rawAnthropicPool = rawConfigRecord(value)?.anthropicAccountPool;
-  const anthropicPool = rawConfigRecord(rawAnthropicPool);
-  if (rawAnthropicPool !== undefined && !anthropicPool) {
-    return { ok: false, error: "schema_invalid: anthropicAccountPool: must be an object" };
-  }
-  if (anthropicPool && Object.hasOwn(anthropicPool, "nativeMessages") && typeof anthropicPool.nativeMessages !== "boolean") {
-    return { ok: false, error: "schema_invalid: anthropicAccountPool.nativeMessages: must be a boolean" };
-  }
-  const routeValue = anthropicPool?.routes;
-  if (routeValue !== undefined) {
-    const parsed = parseAnthropicModelRoutes(routeValue);
-    if (!parsed.ok) return { ok: false, error: `schema_invalid: anthropicAccountPool.routes: ${parsed.error}` };
-  }
+  const anthropicError = anthropicOAuthInstanceConfigError(value) ?? anthropicAccountPoolConfigError(value) ?? anthropicSidecarConfigError(value);
+  if (anthropicError) return { ok: false, error: anthropicError };
   const boundaryError = blockedModelRedirectsError(value)
     ?? compactionRecoveryConfigError(value) ?? configReasoningPinsConfigError(value)
     ?? blankHostnameError(value)
@@ -679,6 +689,7 @@ export function validateConfigCandidate(value: unknown): { ok: true; config: Ocx
     ?? agentTaskRecoveryError(value)
     ?? quotaResetNotifyError(value)
     ?? catalogAutoRefreshError(value)
+    ?? (rawPoolAliasesError(value) ? "schema_invalid: spendPoolAliases: invalid pool identity mapping" : null)
     ?? spendError(value)
     ?? codexPoolError(value)
     ?? googleAntigravityStaticCatalogVersionError(value)

package/src/config/live-reconcile.ts

@@ -8,6 +8,7 @@ import {
   clearPendingConfigObjectChildDeletions,
   prepareConfigObjectChildDeletionRebase,
   clearPendingConfigTopLevelDeletions,
+  clearConfigTopLevelDeletionIntent,
   configHasRebaseProvenance,
   configRebaseDeletionKeys,
   CONFIG_REBASE_PROVENANCE_KEY,
@@ -42,6 +43,22 @@ const claudeCodeBaseline = new WeakMap<OcxConfig, unknown>();
  */
 const liveConfigBaseline = new WeakMap<OcxConfig, OcxConfig>();
 
+/** Adopt a committed manual selection without advancing unrelated live merge baselines. */
+export function adoptPersistedCodexAccountSelection(
+  config: OcxConfig,
+  persisted: Pick<OcxConfig, "activeCodexAccountId" | "activeCodexAccountPinned">,
+): void {
+  const keys = ["activeCodexAccountId", "activeCodexAccountPinned"] as const;
+  const baseline = liveConfigBaseline.get(config);
+  for (const key of keys) {
+    config[key] = persisted[key];
+    // Retain known absent keys: a later disk-only selection is a new edit, not stale intent.
+    if (baseline) baseline[key] = persisted[key];
+  }
+  clearConfigTopLevelDeletionIntent(config, keys);
+  if (baseline) clearConfigTopLevelDeletionIntent(baseline, keys);
+}
+
 /**
  * Adopt a committed discovery decision and its merge baseline as one synchronous step.
  * Visibility writers assign and save synchronously; any future writer yielding between

package/src/config/load-degrade.ts

@@ -1,8 +1,10 @@
+import { setCodexWsReuseAcrossTurns } from "./codex-ws-reuse-setting";
 import { isSubagentModelEntry, rawSubagentModelForce } from "./subagent-models";
 import { chmodSync, existsSync } from "node:fs";
 import { join } from "node:path";
 import { compactionRecoveryConfigError } from "./schema/compaction-recovery";
 import { blockedModelRedirectsError } from "./schema/blocked-model-redirects";
+import { anthropicSidecarConfigError } from "./schema/anthropic-account-pool";
 import {
   modelPinnedEffortsConfigError,
   pinnedReasoningEffortConfigError,
@@ -25,6 +27,7 @@ import { refreshConfigDerivedRegistries } from "./derived-registries";
 import { type OcxClaudeCodeConfig, type OcxConfig } from "../types";
 import {
   agentTaskRecoverySchema,
+  asideProfileSyncSchema,
   catalogAutoRefreshSchema,
   clientConnectionSchema,
   isUsableApiKeySecret,
@@ -123,6 +126,7 @@ export function warnDegradedCompactionRouting(rawParsed: unknown, validated: Ocx
  * the ratchet only ever moves down: a per-block call there costs a line the file does not have.
  */
 export function warnDegradedTopLevelOptIns(rawParsed: unknown, validated: OcxConfig): void {
+  setCodexWsReuseAcrossTurns(validated.codexWsReuseAcrossTurns === true);
   if (compactionRecoveryConfigError(rawParsed)) console.warn("⚠️  invalid compactionRecovery disabled; the original compaction failure is preserved");
   if (blockedModelRedirectsError(rawParsed)) console.warn("⚠️  invalid blockedModelRedirects ignored; provider routing remains available");
   const chatgptDesktop = chatgptDesktopConfigIssue(rawParsed);
@@ -130,6 +134,11 @@ export function warnDegradedTopLevelOptIns(rawParsed: unknown, validated: OcxCon
   warnDegradedStreamMode(rawParsed, validated);
   warnDegradedCompactionRouting(rawParsed, validated);
   warnDegradedMemoryModels(rawParsed, validated);
+  // The schema replaces a malformed policy with { allProfiles: false }, which silently turns every Aside profile off (#6757).
+  const asidePolicy = rawParsed && typeof rawParsed === "object" ? (rawParsed as Record<string, unknown>).asideProfileSync : undefined;
+  if (asidePolicy !== undefined && !asideProfileSyncSchema.safeParse(asidePolicy).success) {
+    console.warn("⚠️  config.json asideProfileSync is invalid — Aside profile sync falls back to all profiles off; fix the block or inspect `ocx integration client status --client aside`");
+  }
 }
 
 /**
@@ -160,6 +169,39 @@ export function warnDegradedMemoryModels(rawParsed: unknown, validated: OcxConfi
   }
 }
 
+/**
+ * Load-time degradation for helper `anthropicInstance` (loadConfig only). A malformed id, or one
+ * that conflicts with its block's backend or model, drops just that key with a warning, so the
+ * helper inherits the request's pool and every provider/key survives. Validated writes still
+ * reject the value and file diagnostics still report it from the raw document.
+ *
+ * Each location is checked in isolation, global blocks first, so a Claude override is judged
+ * against the already-degraded global block it inherits from. An override that owns no
+ * `anthropicInstance` of its own is left untouched: the conflicting key lives in the global
+ * block, which is valid on its own, and the inherited value is still a well-formed instance.
+ */
+export function sanitizeAnthropicSidecarInstanceForLoad(parsed: unknown): void {
+  const asRecord = (value: unknown): Record<string, unknown> | undefined =>
+    value && typeof value === "object" && !Array.isArray(value) ? value as Record<string, unknown> : undefined;
+  const root = asRecord(parsed);
+  if (!root) return;
+  for (const scope of ["global", "claude"] as const) {
+    const owner = scope === "global" ? root : asRecord(root.claudeCode);
+    for (const field of ["webSearchSidecar", "visionSidecar"] as const) {
+      const sidecar = asRecord(owner?.[field]);
+      if (!sidecar || !Object.hasOwn(sidecar, "anthropicInstance")) continue;
+      const probe = scope === "global"
+        ? { [field]: sidecar }
+        : { [field]: root[field], claudeCode: { [field]: sidecar } };
+      const error = anthropicSidecarConfigError(probe);
+      if (!error) continue;
+      delete sidecar.anthropicInstance;
+      // The message names a static path and reason only; the hand-edited value is never echoed.
+      console.warn(`⚠️  config.json ${error} — ignoring that anthropicInstance; the helper inherits the request's Anthropic pool`);
+    }
+  }
+}
+
 /**
  * Load-time degradation for `retryOn429` (loadConfig only): one hand-edited invalid optional
  * field (e.g. `attempts: 0` or a string) must not trip the whole provider schema and hide every

package/src/config/rebase-provenance.ts

@@ -141,6 +141,17 @@ export function clearPendingConfigTopLevelDeletions(config: OcxConfig): void {
   pendingTopLevelDeletions.delete(config);
 }
 
+/** A scoped durable adoption consumes only those fields' earlier deletion intent. */
+export function clearConfigTopLevelDeletionIntent(config: OcxConfig, keys: readonly (keyof OcxConfig)[]): void {
+  const pending = pendingTopLevelDeletions.get(config);
+  for (const key of keys) pending?.delete(key);
+  const parsed = parsedConfigRebaseDeletionKeys(config);
+  if (parsed === null) return;
+  for (const key of keys) parsed.delete(key);
+  if (parsed.size === 0) delete config.configRebaseProvenance;
+  else config.configRebaseProvenance = { version: 1, deletedTopLevelKeys: [...parsed].sort() };
+}
+
 export function clearPendingConfigObjectChildDeletions(config: OcxConfig): void {
   pendingObjectChildDeletions.delete(config);
 }

package/src/config/schema/anthropic-account-pool.ts

@@ -0,0 +1,143 @@
+import * as z from "zod/v4";
+import { parseAnthropicModelRoutes } from "../../oauth/anthropic-model-routes";
+import { isAnthropicInstanceId } from "../../providers/anthropic-instance-id";
+import { redactSecretString } from "../../lib/redact";
+
+/** Historical A load contract, shared verbatim with B: recover only the native preference. */
+export const anthropicAccountPoolSchema = z.object({
+  nativeMessages: z.boolean().optional().catch(false),
+}).passthrough().optional().catch(undefined);
+
+function record(value: unknown): Record<string, unknown> | undefined {
+  return value && typeof value === "object" && !Array.isArray(value)
+    ? value as Record<string, unknown> : undefined;
+}
+
+/** Write/diagnostic contract preserves A's historical nativeMessages and route validation. */
+function poolError(value: unknown, path: string): string | undefined {
+  if (value === undefined) return undefined;
+  const pool = record(value);
+  if (!pool) return `schema_invalid: ${path}: must be an object`;
+  if (Object.hasOwn(pool, "nativeMessages") && typeof pool.nativeMessages !== "boolean") {
+    return `schema_invalid: ${path}.nativeMessages: must be a boolean`;
+  }
+  if (pool.routes !== undefined) {
+    const parsed = parseAnthropicModelRoutes(pool.routes);
+    if (!parsed.ok) return `schema_invalid: ${path}.routes: ${parsed.error}`;
+  }
+  return undefined;
+}
+
+/** Inspect raw locations before the tolerant load schema can discard a malformed field. */
+export function anthropicAccountPoolConfigError(value: unknown): string | undefined {
+  const config = record(value);
+  const primaryError = poolError(config?.anthropicAccountPool, "anthropicAccountPool");
+  if (primaryError) return primaryError;
+  for (const [name, raw] of Object.entries(record(config?.providers) ?? {})) {
+    const provider = record(raw);
+    if (!provider || !Object.hasOwn(provider, "anthropicAccountPool")) continue;
+    const path = `providers.${redactSecretString(name)}.anthropicAccountPool`;
+    if (name !== "anthropic2") {
+      return `schema_invalid: ${path}: misplaced field; provider-local anthropicAccountPool is valid only on anthropic2 (anthropic uses the top-level field)`;
+    }
+    const error = poolError(provider.anthropicAccountPool, path);
+    if (error) return error;
+  }
+  return undefined;
+}
+
+/** Raw provenance validation runs before tolerant parsing and never adopts or edits a row. */
+export function anthropicOAuthInstanceConfigError(value: unknown): string | undefined {
+  const seen = new WeakSet<object>();
+  const inspect = (raw: unknown, location: string[]): string | undefined => {
+    if (!raw || typeof raw !== "object" || seen.has(raw)) return undefined;
+    seen.add(raw);
+    for (const [field, descriptor] of Object.entries(Object.getOwnPropertyDescriptors(raw))) {
+      const path = [...location, field];
+      if (field === "anthropicOAuthInstance") {
+        const label = redactSecretString(path.join("."));
+        if (!("value" in descriptor)) return `schema_invalid: ${label}: must be an own data property`;
+        if (location.length !== 2 || location[0] !== "providers" || location[1] !== "anthropic2") {
+          return `schema_invalid: ${label}: misplaced field; valid only on providers.anthropic2`;
+        }
+        if (descriptor.value !== "anthropic2") return `schema_invalid: ${label}: must be anthropic2`;
+        const row = Object.getOwnPropertyDescriptors(raw);
+        if (row.adapter?.value !== "anthropic" || row.authMode?.value !== "oauth") {
+          return `schema_invalid: ${label}: requires Anthropic adapter and OAuth authMode`;
+        }
+      }
+      if (!("value" in descriptor)) continue;
+      const error = inspect(descriptor.value, path);
+      if (error) return error;
+    }
+    seen.delete(raw);
+    return undefined;
+  };
+  return inspect(value, []);
+}
+
+/** Validate explicit helper identity without materializing an absent instance preference. */
+export function anthropicSidecarConfigError(value: unknown): string | undefined {
+  const config = record(value);
+  const claude = record(config?.claudeCode);
+  for (const [prefix, owner] of [["", config], ["claudeCode.", claude]] as const) {
+    for (const field of ["webSearchSidecar", "visionSidecar"] as const) {
+      const rawSidecar = record(owner?.[field]);
+      if (!rawSidecar) continue;
+      // Claude overrides inherit individual global fields, just like buildClaudeReplayConfig.
+      const sidecar = prefix ? { ...record(config?.[field]), ...rawSidecar } : rawSidecar;
+      if (!Object.hasOwn(sidecar, "anthropicInstance")) continue;
+      const path = `${prefix}${field}.anthropicInstance`;
+      if (!isAnthropicInstanceId(sidecar.anthropicInstance)) {
+        return `schema_invalid: ${path}: must be anthropic or anthropic2`;
+      }
+      // Web search defaults to OpenAI; vision's absent backend keeps its credential-based auto mode.
+      const backend = sidecar.backend === undefined
+        ? (field === "webSearchSidecar" ? "openai" : undefined) : sidecar.backend;
+      // An instance inherited from the global block is inert once the override's effective backend
+      // leaves Anthropic (the helper resolver only reads it for the Anthropic family), so it is not
+      // a conflict. An instance the override sets itself is still validated in full.
+      if (prefix && !Object.hasOwn(rawSidecar, "anthropicInstance") && backend !== undefined && backend !== "anthropic") continue;
+      const modelProvider = typeof sidecar.model === "string" && sidecar.model.includes("/")
+        ? sidecar.model.slice(0, sidecar.model.indexOf("/")) : undefined;
+      if (modelProvider && isAnthropicInstanceId(modelProvider) && modelProvider !== sidecar.anthropicInstance) {
+        return `schema_invalid: ${path}: conflicts with the model's Anthropic instance`;
+      }
+      if (backend !== undefined && backend !== "anthropic") {
+        return `schema_invalid: ${path}: requires an anthropic backend`;
+      }
+    }
+  }
+  return undefined;
+}
+
+/** Validate the effective settings before either management route mutates live state. */
+export function anthropicSidecarPatchError(
+  config: unknown,
+  patches: Record<string, unknown>,
+  claude = false,
+): string | undefined {
+  const source = record(config) ?? {};
+  const next = { ...source };
+  const owner = claude ? { ...record(source.claudeCode) } : next;
+  for (const field of ["webSearchSidecar", "visionSidecar"] as const) {
+    if (!Object.hasOwn(patches, field)) continue;
+    const patch = patches[field];
+    if (patch === null) { delete owner[field]; continue; }
+    const section = record(patch);
+    if (!section) continue; // Shape validation belongs to the route.
+    if (section.anthropicInstance !== undefined && section.anthropicInstance !== null
+      && !isAnthropicInstanceId(section.anthropicInstance)) {
+      return `${field}.anthropicInstance must be anthropic, anthropic2, or null`;
+    }
+    const settings = { ...record(owner[field]) };
+    for (const key of ["backend", "model", "anthropicInstance"] as const) {
+      if (section[key] === null || (key === "model" && section[key] === "")) delete settings[key];
+      else if (section[key] !== undefined) settings[key] = section[key];
+    }
+    if (claude && (Object.keys(section).length === 0 || Object.keys(settings).length === 0)) delete owner[field];
+    else owner[field] = settings;
+  }
+  if (claude) next.claudeCode = owner;
+  return anthropicSidecarConfigError(next);
+}

package/src/config/schema/config-schema.ts

@@ -1,5 +1,6 @@
 import { MAIN_ACCOUNT_HARD_LOCK_MIN_PERCENT } from "../../codex/quota-types";
 import * as z from "zod/v4";
+import { anthropicAccountPoolSchema } from "./anthropic-account-pool";
 import { compactionRecoverySchema } from "./compaction-recovery";
 import { blockedModelRedirectsSchema } from "./blocked-model-redirects";
 import {
@@ -298,6 +299,10 @@ export const configSchema = z.object({
   codexAccountAutoSwitchThresholds: z.unknown().optional().transform(salvageCodexAccountAutoSwitchThresholds),
   // An invalid optional preference must not discard providers or credential rows.
   codexAccountPriorityFailback: z.boolean().optional().catch(false),
+  // Absent or invalid keeps the sliding window on. Explicit false restores consecutive-only steering.
+  codexFailureWindow: z.boolean().optional().catch(undefined),
+  codexPinnedTransientPolicy: z.enum(["hold", "detour-new-threads"]).optional().catch("hold"),
+  codexWsReuseAcrossTurns: z.boolean().optional().catch(false),
   activeCodexAccountPinned: z.string().regex(CODEX_ACCOUNT_PIN_PATTERN).optional().catch(undefined),
   // A malformed hand edit must degrade to false without discarding providers, accounts,
   // or the exact selector map. Live writes remain strict.
@@ -327,7 +332,7 @@ export const configSchema = z.object({
   blockedModelRedirects: blockedModelRedirectsSchema.optional().catch(undefined),
   // Degrade malformed hand edits locally; candidate writes reject them before parsing.
   // An invalid native preference retains the legacy route instead of enabling native by default.
-  anthropicAccountPool: z.object({ nativeMessages: z.boolean().optional().catch(false) }).passthrough().optional().catch(undefined),
+  anthropicAccountPool: anthropicAccountPoolSchema,
   // Same degrade-don't-reject rationale as the fields above: a hand-edited
   // non-string must not trip the backup-and-defaults repair path. Unset then
   // takes the canonical sideband path (src/server/live.ts normalizeSidebandRoot).
@@ -350,6 +355,11 @@ export const configSchema = z.object({
       .map(row => apiKeyEntrySchema.parse(row) as OcxApiKeyEntry);
   }),
 }).passthrough().superRefine((config, ctx) => {
+  // Helper `anthropicInstance` is deliberately not refined here. A document-level issue would send
+  // loadConfig through salvage (which refuses pathless issues) to the backup-and-defaults path, so
+  // one hand-edited helper preference would hide every provider. Writes reject it explicitly in
+  // validateConfigCandidate, diagnostics report it from the raw file, and loadConfig drops only the
+  // offending key (sanitizeAnthropicSidecarInstanceForLoad).
   const claudeCode = (config as { claudeCode?: unknown }).claudeCode;
   if (claudeCode !== undefined && (!claudeCode || typeof claudeCode !== "object" || Array.isArray(claudeCode))) {
     ctx.addIssue({ code: "custom", path: ["claudeCode"], message: "claudeCode must be an object" });

package/src/config/schema/leaf-validators.ts

@@ -1,4 +1,5 @@
 import * as z from "zod/v4";
+import { anthropicAccountPoolSchema } from "./anthropic-account-pool";
 import { join } from "node:path";
 import { isValidProviderName } from "../provider-name";
 import {
@@ -285,6 +286,9 @@ const providerNoProxySchema = z.unknown().superRefine((value, ctx) => {
  * fields pass through (preserved for runtime extensions).
  */
 export const providerConfigSchema = z.object({
+  anthropicAccountPool: anthropicAccountPoolSchema,
+  // Raw diagnostics/writes reject malformed provenance; tolerant loads preserve the custom row.
+  anthropicOAuthInstance: z.literal("anthropic2").optional().catch(undefined),
   modelCapabilities: modelCapabilitiesSchema.optional(),
   modelContextTiers: z.unknown().superRefine((value, ctx) => {
     const error = contextTierRecordConfigError(value);

package/src/config.ts

@@ -172,6 +172,7 @@ import {
   sanitizeModelDisplayNamesForLoad,
   sanitizeAutoReviewForLoad,
   sanitizeRetryOn429ForLoad,
+  sanitizeAnthropicSidecarInstanceForLoad,
   sanitizeModelCostsForLoad,
   sanitizeCapabilityDeclarationsForLoad,
   warnInheritedFastWireConflicts,
@@ -226,6 +227,7 @@ export function loadConfig(): OcxConfig {
     sanitizeModelDisplayNamesForLoad(parsed);
     sanitizeAutoReviewForLoad(parsed);
     sanitizeRetryOn429ForLoad(parsed);
+    sanitizeAnthropicSidecarInstanceForLoad(parsed);
     sanitizeModelCostsForLoad(parsed);
     sanitizeCapabilityDeclarationsForLoad(parsed);
     const result = configSchema.safeParse(parsed);