@bitkyc08/opencodex 2.84.0 → 2.87.0

package/src/config/schema/config-schema.ts

@@ -1,8 +1,12 @@
 import { MAIN_ACCOUNT_HARD_LOCK_MIN_PERCENT } from "../../codex/quota-types";
+import { validRemainingQuotaAccountIds } from "../../codex/account-use-remaining";
 import * as z from "zod/v4";
 import { anthropicAccountPoolSchema } from "./anthropic-account-pool";
 import { compactionRecoverySchema } from "./compaction-recovery";
+import { nativeReasoningRetentionSchema } from "./native-reasoning-retention";
+import { desktopCompatibilitySchema } from "./desktop-compatibility";
 import { blockedModelRedirectsSchema } from "./blocked-model-redirects";
+import { mainAccountHardLockFallbackSchema } from "./main-account-hard-lock-fallback";
 import {
   agentTaskRecoverySchema,
   catalogAutoRefreshSchema,
@@ -28,7 +32,9 @@ import {
   CODEX_ACCOUNT_NAMESPACE_ACCOUNT_ID_COLLISION_ERROR,
   codexAccountNamespacesSchema,
   modelPinnedEffortsSchema,
+  autoReviewOverrideSchema,
   compactionRoutingSchema,
+  reasoningRetentionSchema,
   memoryModelSettingSchema,
   memoryModelsSchema,
   modelPreferHostedToolsConfigError,
@@ -48,6 +54,7 @@ import {
   providerHeadersConfigError,
   providerForwardClientHeadersConfigError,
   reasoningSummaryDeliveryRecordConfigError,
+  credentialPinnedProviderConfigError,
 } from "../provider-validation";
 import {
   CODEX_ACCOUNT_NAMESPACE_COMBO_ALIAS_COLLISION_ERROR,
@@ -83,6 +90,7 @@ export const protocolConfigSchema = z.object({
     managedMessagesNative: z.boolean().optional(),
     managedMessagesNativeOAuth: z.boolean().optional(),
     directEncoders: z.boolean().optional(),
+    antigravityDirect: z.boolean().optional(),
     shadowPlan: z.boolean().optional(),
   }).strict().optional(),
 }).strict();
@@ -124,6 +132,7 @@ export const configSchema = z.object({
         managedMessagesNative: false,
         managedMessagesNativeOAuth: false,
         directEncoders: fields.directEncoders === true,
+        antigravityDirect: fields.antigravityDirect === true,
         shadowPlan: fields.shadowPlan === true,
       },
     };
@@ -187,9 +196,16 @@ export const configSchema = z.object({
     z.object({ enabled: z.literal(true), port: z.number().int().min(1).max(65535).optional() }),
   ]).optional().catch(undefined),
   providers: z.record(z.string(), providerConfigSchema),
+  // Models settings panel writes the global reviewer override; an invalid hand edit is
+  // stripped by load degradation so it cannot reject the providers that carry it.
+  autoReviewOverride: autoReviewOverrideSchema.optional(),
   modelPinnedEfforts: modelPinnedEffortsSchema.optional(),
   compactionRouting: compactionRoutingSchema.optional().catch(undefined),
   compactionRecovery: compactionRecoverySchema.optional().catch(undefined),
+  // A bad hand edit disables only this block; writes validate the catch-free leaf first.
+  reasoningRetention: reasoningRetentionSchema.optional().catch(undefined),
+  nativeReasoningRetention: nativeReasoningRetentionSchema.optional().catch(undefined),
+  desktopCompatibility: desktopCompatibilitySchema.optional().catch(undefined),
   // A hand-edited malformed phase disables only that phase instead of rejecting
   // providers/apiKeys, matching the load-time degradation notice; the management write
   // boundary (validateConfigCandidate) still refuses the bad value through the shared,
@@ -203,6 +219,7 @@ export const configSchema = z.object({
     .catch(undefined),
   defaultProvider: z.string().min(1).default("openai"),
   defaultModelAliases: z.boolean().optional(),
+  preferModelAliasIds: z.boolean().optional().catch(false),
   // Malformed hand edits disable this opt-in projection without rejecting providers.
   cursorEffortRows: z.boolean().optional().catch(false),
   // Fast selectors default on; malformed hand edits disable them without rejecting providers.
@@ -217,6 +234,11 @@ export const configSchema = z.object({
     short: z.number().int().min(MAIN_ACCOUNT_HARD_LOCK_MIN_PERCENT).max(100).optional().catch(undefined),
     long: z.number().int().min(MAIN_ACCOUNT_HARD_LOCK_MIN_PERCENT).max(100).optional().catch(undefined),
   }).optional().catch(undefined),
+  // A malformed fallback section disables only the reroute, never the lock's refusal
+  // behavior; the management write boundary still rejects the bad value.
+  codexMainAccountHardLockFallback: mainAccountHardLockFallbackSchema.optional().catch(undefined),
+  // #2999: a malformed hand edit falls back to auto detection rather than rejecting the config.
+  nativeMainRefresh: z.enum(["codex", "opencodex"]).optional().catch(undefined),
   // Future versions remain opaque through passthrough-compatible whole-config saves.
   // Only version 1 grants deletion authority in the rebase path.
   configRebaseProvenance: z.unknown().optional(),
@@ -286,6 +308,7 @@ export const configSchema = z.object({
   // so a hand-edited typo cannot trip the backup-and-defaults repair path; the write path rejects
   // it (creditCodexAccountIdsError in diagnostics).
   creditCodexAccountIds: z.array(z.string().regex(/^[a-zA-Z0-9._-]{1,64}$/)).optional().catch(undefined),
+  codexUseRemainingQuotaAccountIds: z.custom<string[]>(validRemainingQuotaAccountIds).optional().catch(undefined),
   // A malformed policy degrades to "no policy" rather than failing the parse, so a hand-edited
   // typo cannot trip the backup-and-defaults repair path and wipe providers or pool accounts.
   // Silently ignoring it would be its own trap, so the write path rejects it and loadConfig warns.
@@ -301,6 +324,7 @@ export const configSchema = z.object({
   codexAccountAutoSwitchThresholds: z.unknown().optional().transform(salvageCodexAccountAutoSwitchThresholds),
   // An invalid optional preference must not discard providers or credential rows.
   codexAccountPriorityFailback: z.boolean().optional().catch(false),
+  codexPreserveSignedInAccount: z.boolean().optional().catch(false),
   // Absent or invalid keeps the sliding window on. Explicit false restores consecutive-only steering.
   codexFailureWindow: z.boolean().optional().catch(undefined),
   codexPinnedTransientPolicy: z.enum(["hold", "detour-new-threads"]).optional().catch("hold"),
@@ -588,6 +612,10 @@ export const configSchema = z.object({
         message: modelAdaptersError,
       });
     }
+    const credentialPinError = credentialPinnedProviderConfigError(name, provider);
+    if (credentialPinError) {
+      ctx.addIssue({ code: "custom", path: ["providers", redactSecretString(name)], message: credentialPinError });
+    }
     const preferHostedToolsError = modelPreferHostedToolsConfigError(
       (provider as { modelPreferHostedTools?: unknown }).modelPreferHostedTools,
       "modelPreferHostedTools",
@@ -678,6 +706,17 @@ export const configSchema = z.object({
         message: reasoningSummaryDeliveryError,
       });
     }
+    const minMaxOutputError = positiveIntegerConfigError(
+      (provider as { minMaxOutputTokens?: unknown }).minMaxOutputTokens,
+      "minMaxOutputTokens",
+    );
+    if (minMaxOutputError) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["providers", redactSecretString(name), "minMaxOutputTokens"],
+        message: minMaxOutputError,
+      });
+    }
     const defaultMaxOutputError = positiveIntegerConfigError(
       (provider as { defaultMaxOutputTokens?: unknown }).defaultMaxOutputTokens,
       "defaultMaxOutputTokens",

package/src/config/schema/desktop-compatibility.ts

@@ -0,0 +1,9 @@
+import * as z from "zod/v4";
+/** Startup resumes observation only. Certificate trust, app launch and Apply are never saved here. */
+export const desktopCompatibilitySchema = z.object({ startOnProxyStart: z.boolean() }).strict();
+export function desktopCompatibilityConfigError(value: unknown): string | null {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const setting = (value as Record<string, unknown>).desktopCompatibility;
+  return setting === undefined || desktopCompatibilitySchema.safeParse(setting).success
+    ? null : "schema_invalid: desktopCompatibility: requires only boolean startOnProxyStart";
+}

package/src/config/schema/leaf-validators.ts

@@ -6,6 +6,7 @@ import {
   modelPinnedEffortsConfigError,
   pinnedReasoningEffortConfigError,
   modelDisplayNamesConfigError,
+  autoReviewOverrideConfigError,
   autoReviewModelOverridesConfigError,
   autoReviewModelTargetConfigError,
   normalizeNonBlankStringArray,
@@ -28,13 +29,14 @@ import {
   PROVIDER_WEB_SEARCH_BRIDGE_BACKENDS,
   UPSTREAM_HTTP_VERSION_VALUES,
   type OcxProviderConfig,
+  type OcxConfig,
   type FastWire,
   type ProviderCostOverlay,
 } from "../../types";
 import { fastWireDeclarationError } from "../../providers/fastwire";
 import { getProviderRegistryEntry, providerMatchesRegistryTransport, providerModelWireDefault } from "../../providers/registry";
 import { resolveOpenAiVirtualModel } from "../../providers/openai-virtual-models";
-import { COST4_RATE_KEYS, isValidCost4Rate } from "../../usage/user-cost-overlays";
+import { COST4_RATE_KEYS, isValidCost4Rate, isValidPromptLengthPricing, copyPromptLengthPricing } from "../../usage/user-cost-overlays";
 import { MAX_COST4_RATE } from "../../usage/expected-prices";
 import {
   DECLARABLE_HOSTED_TOOL_TYPES,
@@ -63,6 +65,12 @@ export const compactionRoutingSchema = z.object({
     .optional(),
 }).strict();
 
+export const reasoningRetentionSchema = z.object({
+  enabled: z.boolean().optional(),
+  maxContextPercent: z.number().gt(0).max(100).optional(),
+  maxTokens: z.number().int().positive().optional(),
+}).strict();
+
 /**
  * One phase of Codex's memory pipeline. A present phase must name a model: the GUI's "Off"
  * removes the phase instead of blanking it, so an empty entry would only ever come from a
@@ -133,12 +141,15 @@ const requestPacingSchema = z.object({
   minIntervalMs: z.number().int().min(1).max(3_600_000).optional(),
   maxConcurrentRequests: z.number().int().min(1).optional(),
   models: z.record(z.string().trim().min(1), requestPacingRuleSchema).optional(),
+  keySelection: z.enum(["active", "round-robin"]).optional(),
+  keys: requestPacingRuleSchema.optional(),
 }).strict().refine(value => value.enabled === false
   || value.requestsPerMinute !== undefined
   || value.minIntervalMs !== undefined
   || value.maxConcurrentRequests !== undefined
+  || value.keys !== undefined || value.keySelection === "round-robin"
   || (value.models !== undefined && Object.keys(value.models).length > 0), {
-  message: "enabled request pacing needs a provider rule or model override",
+  message: "enabled request pacing needs a provider, model, or key rule, or round-robin selection",
 });
 
 export function requestPacingConfigError(value: unknown): string | null {
@@ -257,6 +268,12 @@ const autoReviewModelOverridesSchema = z.unknown().superRefine((value, ctx) => {
   if (error) ctx.addIssue({ code: "custom", message: error });
 }).transform(value => normalizeAutoReviewModelOverrides(value));
 
+/** Global auto-review override block; a malformed hand edit is stripped by load degradation. */
+export const autoReviewOverrideSchema = z.unknown().superRefine((value, ctx) => {
+  const error = autoReviewOverrideConfigError(value, "autoReviewOverride");
+  if (error) ctx.addIssue({ code: "custom", message: error });
+}).transform(value => value as NonNullable<OcxConfig["autoReviewOverride"]>);
+
 const modelCapabilitiesSchema = z.unknown().superRefine((value, ctx) => {
   const error = modelCapabilitiesConfigError(value);
   if (error) ctx.addIssue({ code: "custom", message: error });
@@ -331,14 +348,18 @@ export const providerConfigSchema = z.object({
   responseTierAuthoritative: z.boolean().optional(),
   fastEnabled: z.boolean().optional(),
   supportsServiceTier: z.boolean().optional(),
+  inferContextWindow: z.boolean().optional(),
   modelSupportsServiceTier: z.record(z.string().min(1), z.boolean()).optional(),
   modelSuppressSyntheticMax: z.record(z.string().min(1), z.boolean()).optional(),
   preserveResponsesReasoningContent: z.boolean().optional(),
   preserveResponsesInputItemIds: z.boolean().optional(),
   preserveResponsesMessageMetadata: z.boolean().optional(),
+  projectResponsesLiteHostedSearchHistory: z.boolean().optional(),
   dropResponsesReasoningItems: z.boolean().optional(),
   modelReasoningEffortsAuthoritative: z.boolean().optional(),
   decodesNativeCompactionBlobs: z.boolean().optional(),
+  supportsNativeCompactionTrigger: z.boolean().optional(),
+  supportsNativeCompactEndpoint: z.boolean().optional(),
   allowEncryptedV2AgentTasks: z.boolean().optional(),
   allowPrivateNetwork: z.boolean().optional(),
   // Per-provider egress (#2894): absent inherits the global proxy decision, "direct"/null
@@ -422,7 +443,7 @@ export { providerRelativeSendPathConfigError } from "../provider-relative-send-p
 
 /**
  * Validate `providers.<name>.modelCosts`: a plain object keyed by exact model
- * id, each value a 4-tuple of non-negative finite USD-per-1M-token rates.
+ * id, each value four USD-per-1M-token rates and an optional prompt-length policy.
  * Returns null when valid/absent, else a human-readable error.
  */
 export function providerModelCostsConfigError(value: unknown, field = "modelCosts"): string | null {
@@ -442,25 +463,28 @@ export function providerModelCostsConfigError(value: unknown, field = "modelCost
     const rates = entry as Record<string, unknown>;
     for (const key of COST4_RATE_KEYS) {
       const rate = rates[key];
-      if (!isValidCost4Rate(rate)) {
+      if (!Object.hasOwn(rates, key) || !isValidCost4Rate(rate)) {
         return `${field}.${safeModelId}.${key} must be a non-negative finite number at most ${MAX_COST4_RATE} (USD per 1M tokens)`;
       }
     }
+    if (Object.hasOwn(rates, "promptLengthPricing") && !isValidPromptLengthPricing(rates.promptLengthPricing)) {
+      return `${field}.${safeModelId}.promptLengthPricing must be automatic, flat, or a complete custom policy with a positive safe-integer thresholdTokens, gt/gte comparison, and four valid rates`;
+    }
     // Reject unknown fields: a misplaced apiKey/apiKeyPool under a cost row
     // would otherwise be persisted and echoed verbatim by display paths that
     // mask only top-level provider secrets.
     const extraKeys = Object.keys(rates)
-      .filter((key) => !(COST4_RATE_KEYS as readonly string[]).includes(key));
+      .filter((key) => key !== "promptLengthPricing" && !(COST4_RATE_KEYS as readonly string[]).includes(key));
     if (extraKeys.length > 0) {
-      return `${field}.${safeModelId} has unexpected fields ${JSON.stringify(extraKeys.map(redactSecretString).join(", "))} — only input, output, cacheRead, and cacheWrite are allowed (USD per 1M tokens)`;
+      return `${field}.${safeModelId} has unexpected fields ${JSON.stringify(extraKeys.map(redactSecretString).join(", "))} — only input, output, cacheRead, cacheWrite, and promptLengthPricing are allowed (USD per 1M tokens)`;
     }
   }
   return null;
 }
 
 /**
- * Serialize `providers.<name>.modelCosts` for display: copy ONLY the four
- * numeric rate fields per model and DROP secret-shaped model ids, so a pasted
+ * Serialize `providers.<name>.modelCosts` for display: copy the four validated
+ * rates and complete validated policy and DROP secret-shaped model ids, so a pasted
  * API key in a key position cannot be echoed back by CLI/DTO display paths.
  * The result uses a null prototype so "__proto__" remains an own row.
  */
@@ -470,6 +494,7 @@ export function sanitizeModelCostsForDisplay(costs: unknown): Record<string, Pro
   for (const [modelId, entry] of Object.entries(costs)) {
     if (!entry || typeof entry !== "object" || Array.isArray(entry)) continue;
     const rates = entry as Record<string, unknown>;
+    if (Object.hasOwn(rates, "promptLengthPricing") && !isValidPromptLengthPricing(rates.promptLengthPricing)) continue;
     const input = rates.input;
     const output = rates.output;
     const cacheRead = rates.cacheRead;
@@ -483,7 +508,10 @@ export function sanitizeModelCostsForDisplay(costs: unknown): Record<string, Pro
       // Secret-shaped ids are DROPPED rather than mapped to "[REDACTED]" so
       // distinct rows cannot collapse into one placeholder key.
       if (redactSecretString(modelId) !== modelId) continue;
-      out[modelId] = { input, output, cacheRead, cacheWrite };
+      const policy = isValidPromptLengthPricing(rates.promptLengthPricing)
+        ? copyPromptLengthPricing(rates.promptLengthPricing) : undefined;
+      out[modelId] = { input, output, cacheRead, cacheWrite,
+        ...(policy ? { promptLengthPricing: policy } : {}) };
     }
   }
   return Object.keys(out).length > 0 ? out : undefined;
@@ -793,6 +821,8 @@ export const apiKeyEntrySchema = z.object({
   // rather than promoting it.
   allowedProviders: z.array(z.string().trim().min(1).max(256)).optional(),
   allowedModels: z.array(z.string().trim().min(1).max(256)).optional(),
+  // Not `.catch`ed for the same reason: a damaged value must not grant metered spend.
+  allowMeteredComboTargets: z.boolean().optional(),
 }).passthrough();
 
 /**

package/src/config/schema/main-account-hard-lock-fallback.ts

@@ -0,0 +1,26 @@
+import * as z from "zod/v4";
+import { pinnedReasoningEffortConfigError } from "../provider-validation";
+
+/**
+ * Extended settings of the main-account hard lock (`codexMainAccountHardLockFallback`):
+ * while the lock blocks, a qualifying Codex-native request reroutes to `model` instead of
+ * failing. The dashboard row keeps the configured model when the switch is off, so
+ * `enabled: false` is a remembered pause, not a cleared setting; an absent section, an
+ * absent model, and a malformed section all mean the same thing — the lock refuses,
+ * exactly as it does today.
+ */
+export const mainAccountHardLockFallbackSchema = z.object({
+  enabled: z.boolean().optional(),
+  model: z.string().refine(model => model.length > 0 && model === model.trim() && !/\s/.test(model)),
+  reasoningEffort: z.string().refine(value => pinnedReasoningEffortConfigError(value) === null).optional(),
+}).strict();
+
+/** Candidate writes must reject sections the read schema would silently discard. */
+export function mainAccountHardLockFallbackError(value: unknown): string | undefined {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return undefined;
+  const raw = (value as Record<string, unknown>).codexMainAccountHardLockFallback;
+  if (raw === undefined) return undefined;
+  return mainAccountHardLockFallbackSchema.safeParse(raw).success
+    ? undefined
+    : "schema_invalid: codexMainAccountHardLockFallback requires a nonblank model selector and an optional declared reasoningEffort";
+}

package/src/config/schema/native-reasoning-retention.ts

@@ -0,0 +1,26 @@
+import * as z from "zod/v4";
+import type { OcxConfig } from "../../types";
+
+/** Opt-in allowances for canonical ChatGPT reasoning replay; absence keeps existing cleanup. */
+export const nativeReasoningRetentionSchema = z.object({
+  modelSwitch: z.boolean().optional(),
+  accountSwitch: z.boolean().optional(),
+}).strict();
+
+export function nativeReasoningRetentionConfigError(value: unknown): string | null {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const retention = (value as Record<string, unknown>).nativeReasoningRetention;
+  return retention === undefined || nativeReasoningRetentionSchema.safeParse(retention).success
+    ? null : "schema_invalid: nativeReasoningRetention: accepts only optional boolean modelSwitch and accountSwitch fields";
+}
+
+/** Resolve malformed synthetic inputs the same way as degraded disk config: both off. */
+export function resolveNativeReasoningRetention(
+  config: Pick<OcxConfig, "nativeReasoningRetention">,
+): { modelSwitch: boolean; accountSwitch: boolean } {
+  const parsed = nativeReasoningRetentionSchema.safeParse(config.nativeReasoningRetention);
+  return {
+    modelSwitch: parsed.success && parsed.data.modelSwitch === true,
+    accountSwitch: parsed.success && parsed.data.accountSwitch === true,
+  };
+}

package/src/config.ts

@@ -162,6 +162,7 @@ import { persistConfigUnlocked, readRawConfigJson } from "./config/persist-unloc
 import { withConfigMutationLockSync, bumpGenerationForCooperatingConfigWrite } from "./config/mutation-lock";
 import { getDefaultConfig } from "./config/proxy-env";
 import { configSchema } from "./config/schema/config-schema";
+import { sanitizeOpenCodeOverridesForLoad } from "./config/opencode-wire-upgrade";
 import {
   hardenExistingSecret,
   normalizeApiKeyIds,
@@ -222,6 +223,7 @@ export function loadConfig(): OcxConfig {
   try {
     const raw = readFileSync(configPath, "utf-8").replace(/^\uFEFF/, "");
     const parsed = JSON.parse(raw);
+    sanitizeOpenCodeOverridesForLoad(parsed);
     sanitizeAliasesForLoad(parsed);
     sanitizeReasoningPinsForLoad(parsed);
     sanitizeModelDisplayNamesForLoad(parsed);