@bitkyc08/opencodex 2.84.0 → 2.87.0

package/src/types/config.ts

@@ -30,6 +30,11 @@ export interface OcxProtocolsConfig {
     managedMessagesNativeOAuth?: boolean;
     /** Chat and Messages clients are encoded directly from adapter events. */
     directEncoders?: boolean;
+    /**
+     * Chat requests to a concrete Google Antigravity route decode straight into the IR and are
+     * answered through the direct encoders, with no internal Responses body in either direction.
+     */
+    antigravityDirect?: boolean;
     /** Compare the dispatch plan with the observed path; never sends a second request. */
     shadowPlan?: boolean;
   };
@@ -344,6 +349,12 @@ export interface OcxApiKeyEntry {
    * that is the only point at which the model about to be billed is known.
    */
   allowedModels?: string[];
+  /**
+   * Lets this key reach combo targets marked `metered`. Absent means no: an issued key stops
+   * at the last unmetered target. The environment token never qualifies. A loopback bind
+   * reads no key; local operator consent is instead declared on the combo.
+   */
+  allowMeteredComboTargets?: boolean;
 }
 
 export interface OcxPendingApiKeyRotation {
@@ -564,6 +575,21 @@ export interface OcxConfig {
   };
   /** Enable the shipped model alias patterns for providers without an override. */
   defaultModelAliases?: boolean;
+  /**
+   * When `true`, the raw OpenAI-compatible `/v1/models` list publishes a safe alias (e.g.
+   * `SEK-glm-4.7-flash`) as the row `id` instead of `provider/nativeId`
+   * (e.g. `Seek/glm-4.7-flash`).  The original `provider/nativeId` moves to a
+   * new `native_id` field so clients that need it can still read it.
+   *
+   * **Default: `false`** — the historical `provider/nativeId` form remains the
+   * published `id`, and the alias is in the informational `alias_of` field.
+   *
+   * Codex (`client_version`) and Anthropic-specific discovery retain their own
+   * identities and are unchanged. Ambiguous or shadowed short aliases retain the
+   * qualified ID, as do aliases with unparseable synthetic Fast siblings.
+   * Existing requests using `provider/nativeId` continue to work unchanged.
+   */
+  preferModelAliasIds?: boolean;
   /**
    * Opt-in Cursor Private Inference compatibility rows. When true, `/v1/models`
    * adds `<base-id>--<effort>` selectors for reasoning-capable model ids absent
@@ -581,12 +607,13 @@ export interface OcxConfig {
   /**
    * Opt-in Ultra Fast service tier, default off.
    *
-   * This does NOT synthesize an `ultrafast` row: `src/codex/data/upstream-models.json`
-   * advertises only `priority`, and PR #2994 was closed precisely because a catalog row
-   * the wire cannot honor is a picker entry that lies. What the flag turns on is honesty
-   * about a tier the operator supplies themselves — the catalog stops stripping an
-   * `ultrafast` the user configured, and the request path names it instead of recording
-   * "no fast tier was requested".
+   * On native GPT-6 Astra and GPT-6.1 Sol rows (bare and account-bound), the flag adds the
+   * Ultrafast speed choice OpenAI documents for those two models, so the Codex picker offers
+   * it even though `model_catalog_json` replaces ChatGPT's live, plan-aware model list
+   * (`src/codex/catalog/native-ultrafast.ts`). On routed rows it still never invents a tier:
+   * it keeps an `ultrafast` the operator configured from being stripped on regeneration
+   * (PR #2994 was closed for adding one the wire could not honor). Turning it off withdraws
+   * the generated native tier on the next catalog write.
    */
   ultraFastTier?: boolean;
   /**
@@ -599,6 +626,22 @@ export interface OcxConfig {
   codexMainAccountHardLock?: boolean;
   /** Per-window percentages: short defaults to 90, long to 98; integers 80..100, short <= long. */
   codexMainAccountHardLockThresholds?: { short?: number; long?: number };
+  /**
+   * Extended hard-lock settings: while the lock blocks and no Codex account can serve a
+   * qualifying request, the request reroutes to `model` (with `reasoningEffort` when set)
+   * instead of failing. The lock itself stays on and releases on its own as before; an
+   * absent section or model means the refusal behavior is unchanged.
+   */
+  codexMainAccountHardLockFallback?: { enabled?: boolean; model?: string; reasoningEffort?: string };
+  /**
+   * Who refreshes the native main ChatGPT login in CODEX_HOME (#2999). "codex" asks the Codex
+   * binary through app-server `getAuthStatus` and never writes auth.json; "opencodex" keeps the
+   * guarded writer. Absent means "codex" when a Codex binary at or above the supported version
+   * is found, otherwise "opencodex". "codex" also falls back when no such binary exists.
+   */
+  nativeMainRefresh?: "codex" | "opencodex";
+  /** Use included quota to 100% for these accounts; preserves thresholds and credit-spending policy. */
+  codexUseRemainingQuotaAccountIds?: string[];
   /** Explicit top-level deletion intent used by stale whole-config rebases. */
   configRebaseProvenance?: OcxConfigRebaseProvenance | Record<string, unknown>;
   /** OpenAI provider-contract migration marker (v2 = single `openai` provider with account mode). */
@@ -770,6 +813,15 @@ export interface OcxConfig {
   };
   /** Opt-in failure-only recovery; never replaces the initial compaction model. */
   compactionRecovery?: { enabled: boolean; model: string; allowDevinInvalidArgument?: boolean };
+  /** Explicit opt-in (enabled === true), default off, for routed v1/v2 readable reasoning retention.
+   * Defaults: 20% of the compacting model's context window and 100,000 tokens (the smaller limit).
+   * Unknown windows use maxTokens alone; overflow is archived locally with a path notice.
+   * Native and opaque compaction output keep their existing protocols. */
+  reasoningRetention?: { enabled?: boolean; maxContextPercent?: number; maxTokens?: number };
+  /** Canonical ChatGPT reasoning replay allowances; both default off. */
+  nativeReasoningRetention?: { modelSwitch?: boolean; accountSwitch?: boolean };
+  /** Explicit opt-in; resumes Observe only using an existing trusted certificate and endpoints. */
+  desktopCompatibility?: { startOnProxyStart: boolean };
   /**
    * Destination model for Codex's own memory pipeline, per phase
    * (src/server/responses/memory-models.ts).
@@ -827,6 +879,19 @@ export interface OcxConfig {
    /** Optional override of intercepted source-model prefixes (default: gpt-6-luna, gpt-5.6-luna). */
    sourceModels?: string[];
  };
+  /**
+   * Global auto-review (approval reviewer) selector for every catalog row, written by the
+   * Models settings panel. During catalog sync OpenCodex stamps it as
+   * `auto_review_model_override` on rows that carry no provider-scoped stamp, so an enabled block
+   * wins over Codex's own root `auto_review_model`; disabling it restores that fallback.
+   * `autoReviewModel` keeps its precedence on its own provider's rows.
+   */
+  autoReviewOverride?: {
+    /** When true, the configured model replaces the reviewer on every unowned row. */
+    enabled?: boolean;
+    /** Public catalog selector in `provider/model` form; blank or absent clears the override. */
+    model?: string;
+  };
   /**
    * Optional map of blocked model IDs to their replacement model IDs.
    * When configured, incoming requests targeting a blocked model (including
@@ -1028,6 +1093,16 @@ export interface OcxConfig {
   cacheRetention?: "none" | "short" | "long";
   /** Web-search sidecar: route web_search for non-OpenAI models through a gpt-mini via ChatGPT passthrough. */
   webSearchSidecar?: OcxWebSearchSidecarConfig;
+  /**
+   * Advisor sidecar: an OpenCodex-owned expert consultation runtime. The proxy injects a synthetic
+   * `advisor` tool into routed worker turns, executes the configured expert model itself (loopback
+   * through the normal routing authority, so the advisor may be ANY routable provider/model), and
+   * reinjects the advice so the original worker continues. `policy: "preflight"` additionally
+   * attempts one automatic consultation per task without worker cooperation, once the task has
+   * produced orientation evidence. Task context is sent only after
+   * `contextSharingConsent` is the current version; `enabled` does not grant that consent.
+   */
+  advisor?: OcxAdvisorConfig;
   /** Vision sidecar: describe images via a gpt vision model so text-only models can "see" them. */
   visionSidecar?: OcxVisionSidecarConfig;
   /** /v1/images relay for codex's built-in image_gen tool. */
@@ -1182,6 +1257,8 @@ export interface OcxConfig {
   autoSwitchThreshold?: number;
   /** Opt-in: return bound quota-strategy tasks to recovered higher-priority accounts. */
   codexAccountPriorityFailback?: boolean;
+  /** Prefer other identities, reserving the current native sign-in as pool fallback. */
+  codexPreserveSignedInAccount?: boolean;
   /** New-session account rotation strategy for the Codex pool. Default quota (today's behaviour). */
   accountPoolStrategy?: OcxAccountPoolRotationStrategy | "reset-first";
   /** Successful new-session binds retained on one round-robin selection. Default 1; range 1..100. */
@@ -1313,10 +1390,18 @@ export interface OcxComboTarget {
    * see `OcxComboConfig.cooldownWaitPolicy` (#5691).
    */
   lastResort?: boolean;
+  /**
+   * Pay-per-use target (for example an API-key row behind subscription targets). Only the
+   * configured keys with `allowMeteredComboTargets: true`, or a loopback-only combo
+   * with `allowMeteredTargets: true`, may reach it.
+   */
+  metered?: boolean;
 }
 
 export interface OcxComboConfig {
   targets: OcxComboTarget[];
+  /** Operator consent for metered targets on a loopback-only proxy. Default false; public listeners still require key consent. */
+  allowMeteredTargets?: boolean;
   /** Ordered failover (default), round-robin, weighted random, least-used, or quota reset-window selection. */
   strategy?: OcxComboStrategy;
   /** Successful requests retained on one RR selection batch. Default 1; range 1..100. */
@@ -1552,6 +1637,39 @@ export interface OcxVisionSidecarConfig {
   timeoutMs?: number;
 }
 
+/**
+ * Advisor sidecar configuration. Automatic triggers require deterministic task evidence.
+ */
+export interface OcxAdvisorConfig {
+  /** Master switch. Default: false — the advisor stays off the request path entirely. */
+  enabled?: boolean;
+  /**
+   * The expert model consulted by the sidecar. Any model string the routing authority accepts:
+   * a bare native model ("gpt-6-astra"), an explicit "provider/model" ("anthropic/claude-...",
+   * "xai/grok-..."), or an account-qualified native model ("<namespace>/gpt-6-astra").
+   */
+  model?: string;
+  /** Reasoning effort for the advisor call. Validated against the canonical effort ladder. */
+  effort?: "low" | "medium" | "high" | "xhigh" | "max" | "ultra";
+  /**
+   * When the advisor is consulted. "manual" (default): only when the worker explicitly calls the
+   * synthetic `advisor` tool. "preflight": OpenCodex additionally attempts one automatic
+   * consultation per task once the task has produced orientation evidence (an assistant tool call
+   * or a tool result after the latest user message).
+   */
+  policy?: "manual" | "preflight" | "adaptive";
+  /** Adaptive task consultation attempts (manual + automatic). Integer 1–3, default 3. */
+  maxConsultationsPerTask?: number;
+  /** Advisor fetch timeout (ms). Default 120000. */
+  timeoutMs?: number;
+  /**
+   * Operator consent to send task conversation and tool results to the configured Advisor
+   * provider. Only `"v1"` is current. Absent or any other value means the runtime must not
+   * send task context. `enabled: true` does not grant this, and upgrades do not write it.
+   */
+  contextSharingConsent?: "v1";
+}
+
 export interface OcxWebSearchSidecarConfig {
   /** Explicit Anthropic account pool; unset inherits the request's instance. */
   anthropicInstance?: AnthropicInstanceId;

package/src/types/opencode-go.ts

@@ -0,0 +1,61 @@
+/** Exact-model protocols from https://opencode.ai/v2/docs/console/go/#endpoints (2026-10-15).
+ * Unknown models retain Chat. Responses entries are overridable registry defaults;
+ * the native wires are hard pins because modelAdapters cannot select those adapters.
+ */
+export const OPENCODE_GO_BASE_URL = "https://opencode.ai/zen/go/v1";
+
+export const OPENCODE_GO_MODEL_WIRES: Readonly<Record<string, "google" | "anthropic" | "openai-responses">> = Object.freeze({
+  "gemini-4-argon-contributor": "google",
+  "claude-haiku-5-5": "anthropic",
+  "minimax-m2.7": "anthropic",
+  "minimax-m3": "anthropic",
+  "qwen3.7-plus": "anthropic",
+  "qwen3.8-max": "anthropic",
+  "qwen3.8-flash": "anthropic",
+  "gpt-6-luna": "openai-responses",
+  "gpt-5.6-luna": "openai-responses",
+  "grok-4.6": "openai-responses",
+  "grok-4.7": "openai-responses",
+  "muse-spark-1.2-contributor": "openai-responses",
+  "muse-spark-1.3-contributor": "openai-responses",
+  // Retain previously supported Go models absent from the current endpoint table (#4847).
+  "minimax-m2.5": "anthropic",
+  "union-alpha": "anthropic",
+});
+
+/** Compatibility: these five pins predate destination scoping. New native pins require Go. */
+export const OPENCODE_GO_LEGACY_NAME_PINS: ReadonlySet<string> = new Set([
+  "claude-haiku-5-5", "minimax-m2.5", "minimax-m2.7", "minimax-m3", "union-alpha",
+]);
+
+export const OPENCODE_GO_RESPONSES_DEFAULTS = Object.freeze(Object.fromEntries(
+  Object.entries(OPENCODE_GO_MODEL_WIRES).filter(([, wire]) => wire === "openai-responses"),
+));
+
+export interface OpenCodeGoDestination {
+  readonly baseUrl?: unknown;
+  readonly authMode?: unknown;
+  readonly googleMode?: unknown;
+}
+
+/** A provider name alone must never authorize redirecting a credential to OpenCode. */
+export function isOpenCodeGoGeminiDestination(provider: OpenCodeGoDestination | undefined): boolean {
+  if (!provider || typeof provider.baseUrl !== "string") return false;
+  if (provider.authMode !== undefined && provider.authMode !== "key") return false;
+  if (provider.googleMode !== undefined && provider.googleMode !== "ai-studio") return false;
+  try {
+    const url = new URL(provider.baseUrl.trim());
+    return url.origin === "https://opencode.ai"
+      && !url.username && !url.password && !url.search && !url.hash
+      && ["/zen/go/v1", "/inference/go/v1"].includes(url.pathname.replace(/\/+$/, ""));
+  } catch {
+    return false;
+  }
+}
+
+/** Return the fixed Gemini endpoint only for the exact model and an eligible Go destination. */
+export function openCodeGoGeminiEndpoint(provider: OpenCodeGoDestination, modelId: string): string | undefined {
+  return Object.hasOwn(OPENCODE_GO_MODEL_WIRES, modelId) && OPENCODE_GO_MODEL_WIRES[modelId] === "google" && isOpenCodeGoGeminiDestination(provider)
+    ? `https://opencode.ai/inference/go/v1/models/${encodeURIComponent(modelId)}`
+    : undefined;
+}

package/src/types/opencode-zen.ts

@@ -0,0 +1,29 @@
+/** Fixed-key OpenCode Zen destinations exposing the native Gemini endpoint. */
+export interface OpenCodeZenDestination {
+  readonly baseUrl?: unknown;
+  readonly authMode?: unknown;
+  readonly googleMode?: unknown;
+}
+
+export function openCodeZenBaseUrl(provider: OpenCodeZenDestination | undefined): string | undefined {
+  if (!provider || typeof provider.baseUrl !== "string") return undefined;
+  if (provider.authMode !== undefined && provider.authMode !== "key") return undefined;
+  if (provider.googleMode !== undefined && provider.googleMode !== "ai-studio") return undefined;
+  try {
+    const url = new URL(provider.baseUrl.trim());
+    const pathname = url.pathname.replace(/\/+$/, "");
+    if (url.origin !== "https://opencode.ai" || url.username || url.password || url.search || url.hash) return undefined;
+    if (pathname !== "/zen/v1" && pathname !== "/inference/v1") return undefined;
+    return url.origin + pathname;
+  } catch {
+    return undefined;
+  }
+}
+
+/** Keep the selected destination; Zen omits AI Studio's /v1beta segment. */
+export function openCodeZenGeminiEndpoint(provider: OpenCodeZenDestination, modelId: string): string | undefined {
+  const baseUrl = openCodeZenBaseUrl(provider);
+  return baseUrl && modelId.toLowerCase().startsWith("gemini-")
+    ? baseUrl + "/models/" + encodeURIComponent(modelId)
+    : undefined;
+}

package/src/types/provider.ts

@@ -14,6 +14,8 @@ export interface ProviderApiKeySelection {
   entryId?: string;
   reference?: string;
   revision?: string;
+  /** Request-local allocation; does not replace the saved active key. */
+  distributed?: boolean;
 }
 
 export interface OpenRouterProviderRouting {
@@ -164,16 +166,25 @@ export interface ProviderWebSearchBridgeConfig {
   endpoint?: string;
 }
 
-/**
- * User-configured display price for one model (USD per 1M tokens).
- * Mirrors the `Cost4` shape used by the usage cost estimator; structurally
- * compatible so config rows can be lifted directly into price overlays.
- */
+/** Optional user-owned prompt-length policy; rates are USD per 1M tokens. */
+export type PromptLengthPricing =
+  | { mode: "automatic" }
+  | { mode: "flat" }
+  | {
+    mode: "custom";
+    thresholdTokens: number;
+    comparison: "gt" | "gte";
+    rates: { input: number; output: number; cacheRead: number; cacheWrite: number };
+  };
+
+/** Complete base rates for one model, with automatic pricing when policy is absent. */
 export interface ProviderCostOverlay {
   input: number;
   output: number;
   cacheRead: number;
   cacheWrite: number;
+  /** Absent means automatic vendor prompt-length pricing. */
+  promptLengthPricing?: PromptLengthPricing;
 }
 
 export interface RequestPacingRule {
@@ -190,6 +201,10 @@ export interface ProviderRequestPacingConfig extends RequestPacingRule {
   enabled: boolean;
   /** Exact upstream model-id overrides; other models inherit the provider rule. */
   models?: Record<string, RequestPacingRule>;
+  /** Normal request allocation, separate from cooldown recovery ordering. */
+  keySelection?: "active" | "round-robin";
+  /** Additional uniform limits per pool credential, across all models. */
+  keys?: RequestPacingRule;
 }
 
 export interface FastWire {
@@ -432,6 +447,11 @@ export interface OcxProviderConfig {
    * to extract turn provenance (#6220).
    */
   preserveResponsesMessageMetadata?: boolean;
+  /**
+   * Opt in to lossy hosted-search history notes on ordinary canonical Codex Lite requests.
+   * Default off; only literal true enables it, and non-Lite/native compact stay unchanged.
+   */
+  projectResponsesLiteHostedSearchHistory?: boolean;
   /**
    * Treat this provider's `modelReasoningEfforts` as authoritative at the wire, not only in the
    * catalog. Adapters that ship their own per-model effort table (currently `command-code`)
@@ -453,6 +473,10 @@ export interface OcxProviderConfig {
    * compaction blobs. Absent or false degrades foreign blobs to an opaque note.
    */
   decodesNativeCompactionBlobs?: boolean;
+  /** Accept native Responses v2 `input` compaction_trigger items. Responses adapter only. */
+  supportsNativeCompactionTrigger?: boolean;
+  /** Serve native Responses v1 /responses/compact. Responses adapter only; no auth authority. */
+  supportsNativeCompactEndpoint?: boolean;
   /**
    * Trust this direct key-auth Responses provider to consume or relay opaque encrypted
    * V2 agent tasks. OpenCodex does not decrypt, translate, or recover an eligible task.
@@ -622,6 +646,11 @@ export interface OcxProviderConfig {
   contextWindow?: number;
   /** Per-model fallback when context metadata is absent; otherwise caps the reported window. */
   modelContextWindows?: Record<string, number>;
+  /**
+   * Custom providers only, default off: fill a missing context window from bundled model-ID
+   * metadata before the Context cap / 128k fallback. An estimate, not verified relay capacity.
+   */
+  inferContextWindow?: boolean;
   /** Per-model Copilot upstream tier; only the github-copilot route sends it. */
   modelContextTiers?: Record<string, "default" | "long_context">;
   /** Model-specific Codex catalog input modalities, e.g. ["text"] or ["text", "image"]. */
@@ -639,6 +668,8 @@ export interface OcxProviderConfig {
    * Responses `max_output_tokens`. Adapters still let an explicit request win.
    */
   defaultMaxOutputTokens?: number;
+  /** Opt-in Azure Responses floor for explicit positive output budgets; may raise the caller cap. */
+  minMaxOutputTokens?: number;
   /** Model-specific fallback output token budgets. Exact/model-pattern entries beat the provider default. */
   modelMaxOutputTokens?: Record<string, number>;
   /**
@@ -705,12 +736,14 @@ export interface OcxProviderConfig {
     /** Kiro OAuth only: active serving requests per account, 1..100. */
     maxConcurrentPerAccount?: number;
     enabled?: boolean;
+    /** Opt-in process-local conversation ownership; requires proactive enablement. */
+    sessionAffinity?: "conversation" | "none";
     /**
      * Generic OAuth pool selection strategy (#695). Persisted through the pool-settings
      * contract. Consumed by the selector only while `pool.kernel` is on; with the flag off
      * it is still merely persisted, so omitted and set behave the same.
      */
-    strategy?: "quota" | "round-robin" | "fill-first" | "least-loaded";
+    strategy?: "quota" | "round-robin" | "fill-first" | "reset-first" | "least-loaded";
     /**
      * 0-100 usage percent at which fill-first advances off the active account (#695).
      * Read only under `pool.kernel` with `strategy: "fill-first"`; 80 when unset, matching

package/src/types/request.ts

@@ -2,6 +2,7 @@ import type { KiroOAuthMetadata } from "../oauth/types";
 import type { NativeReasoningOwner } from "../responses/reasoning-replay-cache";
 import type { OcxTool, OcxToolChoice } from "./tools";
 import type { TierDecision, TierObservationContext } from "./provider";
+import type { TranslatorBudget } from "../lib/translator-budget";
 
 /** Exact provider/credential namespace for process-local reasoning replay. */
 export interface OcxReasoningReplayIdentity {
@@ -62,6 +63,11 @@ export interface OcxParsedRequest {
   _nativeReasoningReplay?: ReadonlyMap<string, string>;
   _nativeReasoningBoundOwner?: NativeReasoningOwner;
   _nativeReasoningMint?: { owner?: NativeReasoningOwner };
+  /**
+   * The Claude client's typed Anthropic web tools, as declared. Only the anthropic adapter reads
+   * them, and only for api.anthropic.com; every other destination never sees them.
+   */
+  _anthropicServerTools?: readonly Record<string, unknown>[];
   /**
    * Boundary between replayed history and this turn's newly appended input. Usually the
    * items the proxy restored from local previous_response_id state; also set when the
@@ -92,11 +98,17 @@ export interface OcxParsedRequest {
   _cursorClientThreadId?: string;
   /** Conversation/provider/account/model-bound namespace for reasoning replay state. */
   _reasoningReplayScope?: OcxReasoningReplayScopeRef;
+  /** Trusted configuration snapshot; never read from the client's request body. */
+  _nativeReasoningRetention?: Readonly<{ modelSwitch: boolean; accountSwitch: boolean }>;
   /**
    * Set by bindRouteReasoningReplayScope after a proven serving-identity change, or by
    * prepareOpaqueBlobRecovery after an authoritative rejection; consumers strip replayed blobs.
    */
   _stripReasoningEncryptedContent?: boolean;
+  /** Native compaction remains nonportable even when reasoning-only retention is enabled. */
+  _stripNativeCompactionEncryptedContent?: boolean;
+  /** Retention kept reasoning ciphertext across a model/account change; arms streamed rejection recovery. */
+  _nativeReasoningRetainedAcrossRoute?: boolean;
   /**
    * Set when replayed reasoning item ids name items in a store this destination cannot read: by
    * prepareOpaqueBlobRecovery before the one recovery rebuild, and by bindRouteReasoningReplayScope
@@ -150,6 +162,8 @@ export interface OcxParsedRequest {
    * (see src/responses/compaction.ts).
    */
   _compactionRequest?: boolean;
+  /** Request-owned encoding of readable routed v2 retention; never used for native ciphertext. */
+  _compactionRetention?: { encode(summary: string): string; commit(): void };
   /** Manual compaction moved to another provider: summarize portably even on a canonical ChatGPT target. */
   _portableCompaction?: boolean;
   /**
@@ -164,6 +178,20 @@ export interface OcxParsedRequest {
    * provider-private continuation caches again on every later turn.
    */
   _contextCompactionBoundary?: boolean;
+  /**
+   * Core-owned registration slot for the optional advisor subsystem (src/advisor). Set per request
+   * by the sidecar planner, never at module load: the core Responses path only sees this
+   * structural shape, so an advisor-disabled install imports no advisor module. When present, the
+   * adapter delivery wraps the worker's event stream with it — the guard holds synthetic
+   * `advisor` tool calls, consults the configured expert model, and re-dispatches the worker.
+   */
+  _advisorGuard?: (options: {
+    parsed: OcxParsedRequest;
+    translatorBudget?: TranslatorBudget;
+    firstEvents: AsyncIterable<AdapterEvent>;
+    /** One bounded worker continuation re-dispatch (same machinery as the terminal guard). */
+    continuation: (parsed: OcxParsedRequest) => AsyncIterable<AdapterEvent> | Promise<AsyncIterable<AdapterEvent>>;
+  }) => AsyncGenerator<AdapterEvent>;
 }
 
 export interface OcxContext {
@@ -388,7 +416,9 @@ export interface OcxProviderContinuationState {
 
 export type AdapterEvent =
   | { type: "heartbeat"; replayUnsafe?: true; preflightReady?: true }
-  | { type: "text_delta"; text: string; phase?: OcxMessagePhase }
+  | { type: "text_delta"; text: string; phase?: OcxMessagePhase;
+      /** Complete documented Anthropic progress block: text remains signed thinking on replay. */
+      anthropicThinkingSignature?: string }
   | { type: "thinking_delta"; thinking: string }
   // Anthropic extended-thinking round-trip: signature_delta for the current thinking block, and
   // opaque redacted_thinking blocks. Both must be replayed verbatim or tool-use turns 400.
@@ -411,7 +441,11 @@ export type AdapterEvent =
   // output_item.added(in_progress) and end → the matching output_item.done(completed|failed) under
   // the SAME output index, so the activity animates instead of flashing completed instantly.
   | { type: "web_search_call_begin"; id: string }
-  | { type: "web_search_call_end"; id: string; queries: string[]; status?: "completed" | "failed"; sources?: OcxUrlCitation[] }
+  | {
+      type: "web_search_call_end"; id: string; queries: string[]; status?: "completed" | "failed"; sources?: OcxUrlCitation[];
+      /** Anthropic's server-side web_fetch (adapters/anthropic.ts): the opened page and its `web_fetch_tool_result` content, verbatim. */
+      fetch?: { url: string; result: unknown };
+    }
   | {
       type: "done";
       usage?: OcxUsage;
@@ -441,6 +475,8 @@ export type AdapterEvent =
       /** Responses error type and code when the adapter has a structured provider failure. */
       errorType?: string;
       code?: string;
+      /** Proxy-internal permission to consider API-key recovery; never serialized. */
+      apiKeyRecovery?: true;
       retryable?: boolean;
       /**
        * Proxy-internal, never serialized: the upstream failed the turn before producing text or a

package/src/types/tools.ts

@@ -25,6 +25,8 @@ export interface OcxTool {
   imageGeneration?: boolean;
   /** Synthetic video_gen tool: executed by the xAI video bridge sidecar. */
   videoGeneration?: boolean;
+  /** Synthetic advisor tool: the model's call is intercepted by the advisor sidecar (see src/advisor), never relayed to the client. */
+  advisor?: boolean;
 }
 
 /**

package/src/types/wire.ts

@@ -1,3 +1,6 @@
+import { isOpenCodeGoGeminiDestination, OPENCODE_GO_BASE_URL, OPENCODE_GO_MODEL_WIRES, OPENCODE_GO_LEGACY_NAME_PINS, type OpenCodeGoDestination } from "./opencode-go";
+import { openCodeZenBaseUrl, type OpenCodeZenDestination } from "./opencode-zen";
+
 /**
  * Accepted values for the per-provider upstream HTTP-version pin (#1668). Shared by the
  * zod load schema, the management write boundary (POST/PATCH), and the fetch runtime, so
@@ -40,35 +43,16 @@ export const MODEL_ADAPTER_OVERRIDE_ALLOWED: ReadonlySet<string> = new Set([
   "openai-responses",
 ]);
 
-/**
- * Providers whose listed model ids must be driven over the Anthropic wire even when
- * the provider's configured adapter says otherwise — the upstream only speaks
- * Anthropic for these models.
- */
-const ANTHROPIC_WIRE_MODELS: Record<string, ReadonlySet<string>> = {
-  "opencode-go": new Set([
-    "claude-haiku-5-5",
-    "minimax-m2.5",
-    "minimax-m2.7",
-    "minimax-m3",
-    // OpenCode's catalog identifies Union Alpha as @ai-sdk/anthropic while the
-    // provider defaults to OpenAI-compatible; direct Chat returns 500 and direct
-    // Messages reaches the session check (#4847).
-    "union-alpha",
-  ]),
-};
-
-function anthropicWireModelsForProvider(providerName: string): ReadonlySet<string> | undefined {
-  return Object.hasOwn(ANTHROPIC_WIRE_MODELS, providerName)
-    ? ANTHROPIC_WIRE_MODELS[providerName]
-    : undefined;
-}
-
-/** Detached provider-local hard-pin table for pure wire-policy resolution. */
-export function captureWireAdapterHardPins(providerName: string): Readonly<Record<string, string>> {
-  const models = anthropicWireModelsForProvider(providerName);
-  if (!models) return Object.freeze({});
-  return Object.freeze(Object.fromEntries([...models].map(modelId => [modelId, "anthropic"])));
+/** Native Go wire pins share the exact-model table with registry Responses defaults. */
+export function captureWireAdapterHardPins(providerName: string, provider?: WirePinProvider): Readonly<Record<string, string>> {
+  if (providerName !== "opencode-go") return Object.freeze({});
+  // The existing Go preset pins saved URLs to this endpoint before dispatch. Pure policy
+  // captures must use that same destination even when handed an unnormalized config row.
+  const destination = provider && { ...provider, baseUrl: OPENCODE_GO_BASE_URL };
+  return Object.freeze(Object.fromEntries(Object.entries(OPENCODE_GO_MODEL_WIRES).filter(([modelId, wire]) =>
+    (wire === "anthropic" && OPENCODE_GO_LEGACY_NAME_PINS.has(modelId))
+    || (wire !== "openai-responses" && isOpenCodeGoGeminiDestination(destination)),
+  )));
 }
 
 interface WirePinPrefixRule {
@@ -98,9 +82,7 @@ const WIRE_ADAPTER_PIN_PREFIXES: Readonly<Record<string, WirePinPrefixRule>> = O
 });
 
 /** Just enough of a provider config to tell whether it still points at the pinned endpoint. */
-export interface WirePinProvider {
-  readonly baseUrl?: unknown;
-}
+export interface WirePinProvider extends OpenCodeGoDestination, OpenCodeZenDestination {}
 
 function normalizedEndpoint(value: unknown): string | undefined {
   if (typeof value !== "string") return undefined;
@@ -112,7 +94,19 @@ function normalizedEndpoint(value: unknown): string | undefined {
   }
 }
 
+/**
+ * Providers whose adapter is their credential boundary: the adapter alone pins the destination and
+ * the auth header for an account token. No model may switch wires, whatever `baseUrl` or the row's
+ * own `adapter` says, because a generic wire would send that token as a Bearer key to the configured
+ * URL. The empty prefix covers every model id.
+ */
+const CREDENTIAL_PINNED_ADAPTERS: Readonly<Record<string, Readonly<Record<string, string>>>> = Object.freeze({
+  "dsh-account": Object.freeze({ "": "dsh-account" }),
+});
+
 function prefixPinsFor(providerName: string, provider: WirePinProvider | undefined): Readonly<Record<string, string>> | undefined {
+  if (Object.hasOwn(CREDENTIAL_PINNED_ADAPTERS, providerName)) return CREDENTIAL_PINNED_ADAPTERS[providerName];
+  if (providerName === "opencode-zen" && openCodeZenBaseUrl(provider)) return { "gemini-": "google" };
   if (!provider || !Object.hasOwn(WIRE_ADAPTER_PIN_PREFIXES, providerName)) return undefined;
   const rule = WIRE_ADAPTER_PIN_PREFIXES[providerName]!;
   return normalizedEndpoint(provider.baseUrl) === rule.endpoint ? rule.prefixes : undefined;
@@ -148,13 +142,11 @@ function prefixedWireAdapter(providerName: string, modelId: string, provider: Wi
  * adapter" would pass on the first pass and then let the override win on the second.
  */
 export function isWirePinnedModel(providerName: string, modelId: string, provider?: WirePinProvider): boolean {
-  return (anthropicWireModelsForProvider(providerName)?.has(modelId) ?? false)
-    || prefixedWireAdapter(providerName, modelId, provider) !== undefined;
+  return pinnedWireAdapter(providerName, modelId, provider) !== undefined;
 }
 
 /** The wire a pinned model must use, or undefined when the model is not pinned. */
 export function pinnedWireAdapter(providerName: string, modelId: string, provider?: WirePinProvider): string | undefined {
-  return anthropicWireModelsForProvider(providerName)?.has(modelId)
-    ? "anthropic"
-    : prefixedWireAdapter(providerName, modelId, provider);
+  const pins = captureWireAdapterHardPins(providerName, provider);
+  return Object.hasOwn(pins, modelId) ? pins[modelId] : prefixedWireAdapter(providerName, modelId, provider);
 }

package/src/types.ts

@@ -122,6 +122,7 @@ export type {
   ProviderWebSearchBridgeBackend,
   ProviderWebSearchBridgeConfig,
   ProviderCostOverlay,
+  PromptLengthPricing,
   RequestPacingRule,
   ProviderRequestPacingConfig,
   FastWire,

package/src/update/async-check.ts

@@ -51,7 +51,7 @@ export async function latestVersionAsync(
   installer: Installer,
   deps: AsyncLookupDeps = defaultDeps,
 ): Promise<string | null> {
-  if (installer === "source" || installer === "mise") return null;
+  if (installer === "source" || installer === "standalone" || installer === "mise") return null;
   let owner: PnpmGlobalOwner | null | undefined;
   try { owner = installer === "pnpm" ? await deps.ownerFn() : undefined; }
   catch { return null; }

package/src/update/badge.ts

@@ -44,11 +44,11 @@ export function readUpdateBadge(deps: UpdateBadgeDeps = defaultDeps): UpdateBadg
     latestVersion: null,
     channel,
     installer,
-    canUpdate: installer !== "source" && installer !== "mise",
+    canUpdate: installer !== "source" && installer !== "standalone" && installer !== "mise",
     unknown: true,
   };
   // A source checkout has nothing to compare against, so "unknown" is not useful there.
-  if (installer === "source" || current === "?" || isSourceBuildVersion(current)) {
+  if (installer === "source" || installer === "standalone" || current === "?" || isSourceBuildVersion(current)) {
     return { ...base, canUpdate: false, unknown: false };
   }