@bitkyc08/opencodex 2.86.0 → 2.87.0

package/src/config/opencode-wire-upgrade.ts

@@ -0,0 +1,54 @@
+import { OPENCODE_GO_LEGACY_NAME_PINS } from "../types/opencode-go";
+import { captureWireAdapterHardPins } from "../types/wire";
+import { declaredUnsupportedHostedTools, isHostedToolUnsupportedForModel } from "../responses/hosted-tool-policy";
+import { sanitizeOpenCodeZenOverridesForLoad } from "./opencode-zen-upgrade";
+
+function record(value: unknown): Record<string, unknown> | undefined {
+  return value !== null && typeof value === "object" && !Array.isArray(value)
+    ? value as Record<string, unknown> : undefined;
+}
+
+/** File reads alone repair overrides admitted before OpenCode's native-wire upgrade. */
+export function sanitizeOpenCodeOverridesForLoad(parsed: unknown): void {
+  sanitizeOpenCodeZenOverridesForLoad(parsed);
+  const providers = record(record(parsed)?.providers);
+  const provider = providers && Object.hasOwn(providers, "opencode-go")
+    ? record(providers["opencode-go"]) : undefined;
+  if (!provider) return;
+  // Use validation's destination/auth rules, including the Go preset's fixed URL.
+  const pins = captureWireAdapterHardPins("opencode-go", provider);
+  const newlyPinned = (model: string): boolean => Object.hasOwn(pins, model)
+    && !OPENCODE_GO_LEGACY_NAME_PINS.has(model);
+  const overrides = record(provider.modelAdapters) ?? {};
+  const preferences = record(provider.modelPreferHostedTools);
+  let preferencesChanged = false;
+  if (preferences) {
+    const unsupported = declaredUnsupportedHostedTools(provider as { unsupportedHostedTools?: readonly string[] });
+    for (const [model, tools] of Object.entries(preferences)) {
+      // Go's registry owns the old provider-wide Chat wire. Only an explicit
+      // Responses override could previously make these native models eligible.
+      if (!newlyPinned(model.trim()) || overrides[model] !== "openai-responses"
+        || !Array.isArray(tools) || tools.length === 0 || tools.some(tool => tool !== "image_generation")
+        || isHostedToolUnsupportedForModel(model, "image_generation", undefined, unsupported)) continue;
+      delete preferences[model];
+      preferencesChanged = true;
+    }
+    if (preferencesChanged && Object.keys(preferences).length === 0) delete provider.modelPreferHostedTools;
+  }
+  let overridesChanged = false;
+  for (const [model, adapter] of Object.entries(overrides)) {
+    // Leave malformed or previously incompatible preferences visible on every pass.
+    if (preferences && Object.hasOwn(preferences, model)) continue;
+    if (newlyPinned(model.trim()) && (adapter === "openai-chat" || adapter === "openai-responses")) {
+      delete overrides[model];
+      overridesChanged = true;
+    }
+  }
+  if (overridesChanged) {
+    if (Object.keys(overrides).length === 0) delete provider.modelAdapters;
+    console.warn("OpenCode Go native models now use their required APIs; obsolete Chat/Responses overrides were ignored while loading config.json.");
+  }
+  if (preferencesChanged) {
+    console.warn("OpenCode Go native models now use their required APIs; legacy Responses-only hosted-tool preferences were ignored while loading config.json.");
+  }
+}

package/src/config/opencode-zen-upgrade.ts

@@ -0,0 +1,52 @@
+import { openCodeZenBaseUrl } from "../types/opencode-zen";
+import { declaredUnsupportedHostedTools, isHostedToolUnsupportedForModel } from "../responses/hosted-tool-policy";
+
+function record(value: unknown): Record<string, unknown> | undefined {
+  return value !== null && typeof value === "object" && !Array.isArray(value)
+    ? value as Record<string, unknown> : undefined;
+}
+
+function isGeminiModel(model: string): boolean {
+  return model.trim().toLowerCase().startsWith("gemini-");
+}
+
+/** Repair legacy Zen wire overrides and dependent preferences in file-backed reads only. */
+export function sanitizeOpenCodeZenOverridesForLoad(parsed: unknown): void {
+  const providers = record(record(parsed)?.providers);
+  const provider = providers && Object.hasOwn(providers, "opencode-zen")
+    ? record(providers["opencode-zen"]) : undefined;
+  if (!provider || !openCodeZenBaseUrl(provider)) return;
+  const overrides = record(provider.modelAdapters) ?? {};
+  const preferences = record(provider.modelPreferHostedTools);
+  let preferencesChanged = false;
+  if (preferences) {
+    const unsupported = declaredUnsupportedHostedTools(provider as { unsupportedHostedTools?: readonly string[] });
+    for (const [model, tools] of Object.entries(preferences)) {
+      // Capture the old wire before deleting overrides. An explicit non-Responses entry
+      // must not inherit a provider-wide Responses default for this migration.
+      const oldAdapter = Object.hasOwn(overrides, model) ? overrides[model] : provider.adapter;
+      if (!isGeminiModel(model) || oldAdapter !== "openai-responses"
+        || !Array.isArray(tools) || tools.length === 0 || tools.some(tool => tool !== "image_generation")
+        || isHostedToolUnsupportedForModel(model, "image_generation", undefined, unsupported)) continue;
+      delete preferences[model];
+      preferencesChanged = true;
+    }
+    if (preferencesChanged && Object.keys(preferences).length === 0) delete provider.modelPreferHostedTools;
+  }
+  let overridesChanged = false;
+  for (const [model, adapter] of Object.entries(overrides)) {
+    // Retain invalid preference/wire pairs so repeated normalization cannot admit them.
+    if (preferences && Object.hasOwn(preferences, model)) continue;
+    if (isGeminiModel(model) && (adapter === "openai-chat" || adapter === "openai-responses")) {
+      delete overrides[model];
+      overridesChanged = true;
+    }
+  }
+  if (overridesChanged) {
+    if (Object.keys(overrides).length === 0) delete provider.modelAdapters;
+    console.warn("OpenCode Zen Gemini models now use the native Google API; obsolete Chat/Responses overrides were ignored while loading config.json.");
+  }
+  if (preferencesChanged) {
+    console.warn("OpenCode Zen Gemini models now use the native Google API; legacy Responses-only hosted-tool preferences were ignored while loading config.json.");
+  }
+}

package/src/config/owner-registry.ts

@@ -24,21 +24,19 @@
  */
 
 import { createHash } from "node:crypto";
-import { chmodSync, existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, statSync, unlinkSync } from "node:fs";
+import { chmodSync, existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, realpathSync, statSync, unlinkSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { atomicWriteFileNoFollow } from "./atomic-write";
 import { getConfigDir } from "./paths";
-import { assertNotRealHomeUnderTest } from "../lib/test-home-guard";
+import { assertNotRealHomeUnderTest, isTestHomeGuardArmed } from "../lib/test-home-guard";
 import { hardenSecretDir } from "../lib/windows-secret-acl";
 
 const REGISTRY_DIR_NAME = "ocx-homes";
 /**
- * Test seam, not a user knob: os.homedir() resolves the passwd database on POSIX,
- * so rewriting HOME inside a test process cannot move the anchor and the armed
- * test-home guard would rightly refuse the write. Suites point this at their own
- * fixture home; production always leaves it unset so the default home stays the
- * one locator every sibling can find.
+ * Test seam, not a user knob. The sandbox pins this for inherited child environments;
+ * guarded callers without it use their selected config home. Production leaves it
+ * unset so the default home stays the one locator every sibling can find.
  */
 const REGISTRY_DIR_ENV = "OCX_OWNER_REGISTRY_DIR";
 const REGISTRY_ENTRY_SUFFIX = ".json";
@@ -60,8 +58,23 @@ function registryBaseDir(): string {
 /** The shared directory the registry lives under. */
 export function ownerRegistryDir(): string {
   const override = process.env[REGISTRY_DIR_ENV]?.trim();
-  if (override) return resolve(override);
-  return join(registryBaseDir(), REGISTRY_DIR_NAME);
+  const dir = override ? resolve(override)
+    : join(isTestHomeGuardArmed() ? getConfigDir() : registryBaseDir(), REGISTRY_DIR_NAME);
+  // Bun caches the startup home, so HOME rewrites cannot isolate this anchor.
+  // Check reads and removals too, including an inherited override or symlink that
+  // points back into the protected home. An unpinned guarded caller fails closed.
+  if (isTestHomeGuardArmed()) {
+    for (let ancestor = dir; ;) {
+      assertNotRealHomeUnderTest(ancestor);
+      // Follow an existing alias before walking parents; missing children reach
+      // their nearest existing ancestor on the next iterations.
+      try { ancestor = realpathSync.native(ancestor); } catch { /* not created yet */ }
+      const parent = dirname(ancestor);
+      if (parent === ancestor) break;
+      ancestor = parent;
+    }
+  }
+  return dir;
 }
 
 function registryEntryPath(dir: string, home: string): string {
@@ -76,14 +89,6 @@ function registryEntryPath(dir: string, home: string): string {
 export function registerOwnerRegistryHome(home: string): void {
   try {
     const dir = ownerRegistryDir();
-    // Guard every ancestor of the write target: an override that still resolves
-    // under the protected ~/.opencodex must not slip past the test home guard.
-    for (let ancestor = dir; ;) {
-      assertNotRealHomeUnderTest(ancestor);
-      const parent = dirname(ancestor);
-      if (parent === ancestor) break;
-      ancestor = parent;
-    }
     mkdirSync(dir, { recursive: true, mode: 0o700 });
     // This locator contains no secret, but its deterministic entry names must not
     // give another local user a place to plant a destination symlink. Refuse a

package/src/config/provider-validation.ts

@@ -1,4 +1,5 @@
 import { isCanonicalOpenAiForwardProvider } from "../providers/openai-tiers";
+import { resolveDshAccountMessagesUrl } from "../providers/dsh-account-destination";
 import { redactSecretString } from "../lib/redact";
 import {
   isValidModelDiscoveryModelId,
@@ -256,10 +257,11 @@ export function autoReviewModelTargetConfigError(
   field = "autoReviewModel",
   allowClear = false,
 ): string | null {
-  if (value === undefined || (allowClear && (value === null || value === ""))) return null;
+  if (value === undefined || (allowClear && value === null)) return null;
   if (typeof value !== "string") return `${field} must be a string`;
   const trimmed = value.trim();
-  if (!trimmed) return `${field} must be nonblank`;
+  // `allowClear` callers trim then delete, so whitespace-only is a clear, not a blank selector.
+  if (!trimmed) return allowClear ? null : `${field} must be nonblank`;
   if (trimmed.length > 1024 || AUTO_REVIEW_MODEL_CONTROL_CHARS.test(trimmed)) {
     return `${field} must be a catalog selector without whitespace or control characters`;
   }
@@ -271,6 +273,26 @@ export function isValidAutoReviewModel(value: unknown): value is string {
   return typeof value === "string" && autoReviewModelTargetConfigError(value) === null;
 }
 
+/**
+ * Validate the global auto-review override block the Models settings panel writes.
+ *
+ * `enabled` is optional so a save may carry only the model during an edit; `model` follows the
+ * same selector rules as the provider-scoped field, and an empty value clears the override.
+ */
+export function autoReviewOverrideConfigError(value: unknown, field = "autoReviewOverride"): string | null {
+  if (value === undefined || value === null) return null;
+  if (!value || typeof value !== "object" || Array.isArray(value)) return `${field} must be a plain object`;
+  const prototype = Object.getPrototypeOf(value);
+  if (prototype !== Object.prototype && prototype !== null) {
+    return `${field} must be a plain object with own properties`;
+  }
+  const block = value as Record<string, unknown>;
+  if (block.enabled !== undefined && typeof block.enabled !== "boolean") {
+    return `${field}.enabled must be a boolean`;
+  }
+  return autoReviewModelTargetConfigError(block.model, `${field}.model`, true);
+}
+
 /** Canonical model key used for map matching, duplicate detection, and route tombstones. */
 export function canonicalAutoReviewModelKey(modelId: string): string {
   return encodeRoutedModelId(modelId.trim());
@@ -390,6 +412,27 @@ export function modelAdapterRecordConfigError(
 }
 
 
+/**
+ * The `dsh-account` row owns the DeepSeek Harness account token, which every helper resolves by this
+ * provider name. Keeping the row on its own adapter and DeepSeek's Anthropic host means no generic
+ * helper (Anthropic sidecars, discovery, probes) can be pointed at another destination with it.
+ */
+export function credentialPinnedProviderConfigError(
+  providerName: string,
+  provider: { adapter?: unknown; baseUrl?: unknown },
+): string | null {
+  if (providerName !== "dsh-account") return null;
+  if (provider.adapter !== undefined && provider.adapter !== "dsh-account") {
+    return 'adapter must stay "dsh-account": its account token is pinned to that adapter';
+  }
+  if (typeof provider.baseUrl === "string") {
+    try { resolveDshAccountMessagesUrl(provider.baseUrl); } catch {
+      return "baseUrl must stay on https://api.deepseek.com/anthropic: its account token is pinned to that host";
+    }
+  }
+  return null;
+}
+
 function capabilityRecord(value: unknown): value is Record<string, unknown> {
   return value !== null && typeof value === "object" && !Array.isArray(value)
     && [Object.prototype, null].includes(Object.getPrototypeOf(value));

package/src/config/schema/config-schema.ts

@@ -1,9 +1,12 @@
 import { MAIN_ACCOUNT_HARD_LOCK_MIN_PERCENT } from "../../codex/quota-types";
+import { validRemainingQuotaAccountIds } from "../../codex/account-use-remaining";
 import * as z from "zod/v4";
 import { anthropicAccountPoolSchema } from "./anthropic-account-pool";
 import { compactionRecoverySchema } from "./compaction-recovery";
+import { nativeReasoningRetentionSchema } from "./native-reasoning-retention";
 import { desktopCompatibilitySchema } from "./desktop-compatibility";
 import { blockedModelRedirectsSchema } from "./blocked-model-redirects";
+import { mainAccountHardLockFallbackSchema } from "./main-account-hard-lock-fallback";
 import {
   agentTaskRecoverySchema,
   catalogAutoRefreshSchema,
@@ -29,7 +32,9 @@ import {
   CODEX_ACCOUNT_NAMESPACE_ACCOUNT_ID_COLLISION_ERROR,
   codexAccountNamespacesSchema,
   modelPinnedEffortsSchema,
+  autoReviewOverrideSchema,
   compactionRoutingSchema,
+  reasoningRetentionSchema,
   memoryModelSettingSchema,
   memoryModelsSchema,
   modelPreferHostedToolsConfigError,
@@ -49,6 +54,7 @@ import {
   providerHeadersConfigError,
   providerForwardClientHeadersConfigError,
   reasoningSummaryDeliveryRecordConfigError,
+  credentialPinnedProviderConfigError,
 } from "../provider-validation";
 import {
   CODEX_ACCOUNT_NAMESPACE_COMBO_ALIAS_COLLISION_ERROR,
@@ -190,9 +196,15 @@ export const configSchema = z.object({
     z.object({ enabled: z.literal(true), port: z.number().int().min(1).max(65535).optional() }),
   ]).optional().catch(undefined),
   providers: z.record(z.string(), providerConfigSchema),
+  // Models settings panel writes the global reviewer override; an invalid hand edit is
+  // stripped by load degradation so it cannot reject the providers that carry it.
+  autoReviewOverride: autoReviewOverrideSchema.optional(),
   modelPinnedEfforts: modelPinnedEffortsSchema.optional(),
   compactionRouting: compactionRoutingSchema.optional().catch(undefined),
   compactionRecovery: compactionRecoverySchema.optional().catch(undefined),
+  // A bad hand edit disables only this block; writes validate the catch-free leaf first.
+  reasoningRetention: reasoningRetentionSchema.optional().catch(undefined),
+  nativeReasoningRetention: nativeReasoningRetentionSchema.optional().catch(undefined),
   desktopCompatibility: desktopCompatibilitySchema.optional().catch(undefined),
   // A hand-edited malformed phase disables only that phase instead of rejecting
   // providers/apiKeys, matching the load-time degradation notice; the management write
@@ -207,6 +219,7 @@ export const configSchema = z.object({
     .catch(undefined),
   defaultProvider: z.string().min(1).default("openai"),
   defaultModelAliases: z.boolean().optional(),
+  preferModelAliasIds: z.boolean().optional().catch(false),
   // Malformed hand edits disable this opt-in projection without rejecting providers.
   cursorEffortRows: z.boolean().optional().catch(false),
   // Fast selectors default on; malformed hand edits disable them without rejecting providers.
@@ -221,6 +234,9 @@ export const configSchema = z.object({
     short: z.number().int().min(MAIN_ACCOUNT_HARD_LOCK_MIN_PERCENT).max(100).optional().catch(undefined),
     long: z.number().int().min(MAIN_ACCOUNT_HARD_LOCK_MIN_PERCENT).max(100).optional().catch(undefined),
   }).optional().catch(undefined),
+  // A malformed fallback section disables only the reroute, never the lock's refusal
+  // behavior; the management write boundary still rejects the bad value.
+  codexMainAccountHardLockFallback: mainAccountHardLockFallbackSchema.optional().catch(undefined),
   // #2999: a malformed hand edit falls back to auto detection rather than rejecting the config.
   nativeMainRefresh: z.enum(["codex", "opencodex"]).optional().catch(undefined),
   // Future versions remain opaque through passthrough-compatible whole-config saves.
@@ -292,6 +308,7 @@ export const configSchema = z.object({
   // so a hand-edited typo cannot trip the backup-and-defaults repair path; the write path rejects
   // it (creditCodexAccountIdsError in diagnostics).
   creditCodexAccountIds: z.array(z.string().regex(/^[a-zA-Z0-9._-]{1,64}$/)).optional().catch(undefined),
+  codexUseRemainingQuotaAccountIds: z.custom<string[]>(validRemainingQuotaAccountIds).optional().catch(undefined),
   // A malformed policy degrades to "no policy" rather than failing the parse, so a hand-edited
   // typo cannot trip the backup-and-defaults repair path and wipe providers or pool accounts.
   // Silently ignoring it would be its own trap, so the write path rejects it and loadConfig warns.
@@ -307,6 +324,7 @@ export const configSchema = z.object({
   codexAccountAutoSwitchThresholds: z.unknown().optional().transform(salvageCodexAccountAutoSwitchThresholds),
   // An invalid optional preference must not discard providers or credential rows.
   codexAccountPriorityFailback: z.boolean().optional().catch(false),
+  codexPreserveSignedInAccount: z.boolean().optional().catch(false),
   // Absent or invalid keeps the sliding window on. Explicit false restores consecutive-only steering.
   codexFailureWindow: z.boolean().optional().catch(undefined),
   codexPinnedTransientPolicy: z.enum(["hold", "detour-new-threads"]).optional().catch("hold"),
@@ -594,6 +612,10 @@ export const configSchema = z.object({
         message: modelAdaptersError,
       });
     }
+    const credentialPinError = credentialPinnedProviderConfigError(name, provider);
+    if (credentialPinError) {
+      ctx.addIssue({ code: "custom", path: ["providers", redactSecretString(name)], message: credentialPinError });
+    }
     const preferHostedToolsError = modelPreferHostedToolsConfigError(
       (provider as { modelPreferHostedTools?: unknown }).modelPreferHostedTools,
       "modelPreferHostedTools",

package/src/config/schema/leaf-validators.ts

@@ -6,6 +6,7 @@ import {
   modelPinnedEffortsConfigError,
   pinnedReasoningEffortConfigError,
   modelDisplayNamesConfigError,
+  autoReviewOverrideConfigError,
   autoReviewModelOverridesConfigError,
   autoReviewModelTargetConfigError,
   normalizeNonBlankStringArray,
@@ -28,13 +29,14 @@ import {
   PROVIDER_WEB_SEARCH_BRIDGE_BACKENDS,
   UPSTREAM_HTTP_VERSION_VALUES,
   type OcxProviderConfig,
+  type OcxConfig,
   type FastWire,
   type ProviderCostOverlay,
 } from "../../types";
 import { fastWireDeclarationError } from "../../providers/fastwire";
 import { getProviderRegistryEntry, providerMatchesRegistryTransport, providerModelWireDefault } from "../../providers/registry";
 import { resolveOpenAiVirtualModel } from "../../providers/openai-virtual-models";
-import { COST4_RATE_KEYS, isValidCost4Rate } from "../../usage/user-cost-overlays";
+import { COST4_RATE_KEYS, isValidCost4Rate, isValidPromptLengthPricing, copyPromptLengthPricing } from "../../usage/user-cost-overlays";
 import { MAX_COST4_RATE } from "../../usage/expected-prices";
 import {
   DECLARABLE_HOSTED_TOOL_TYPES,
@@ -63,6 +65,12 @@ export const compactionRoutingSchema = z.object({
     .optional(),
 }).strict();
 
+export const reasoningRetentionSchema = z.object({
+  enabled: z.boolean().optional(),
+  maxContextPercent: z.number().gt(0).max(100).optional(),
+  maxTokens: z.number().int().positive().optional(),
+}).strict();
+
 /**
  * One phase of Codex's memory pipeline. A present phase must name a model: the GUI's "Off"
  * removes the phase instead of blanking it, so an empty entry would only ever come from a
@@ -133,12 +141,15 @@ const requestPacingSchema = z.object({
   minIntervalMs: z.number().int().min(1).max(3_600_000).optional(),
   maxConcurrentRequests: z.number().int().min(1).optional(),
   models: z.record(z.string().trim().min(1), requestPacingRuleSchema).optional(),
+  keySelection: z.enum(["active", "round-robin"]).optional(),
+  keys: requestPacingRuleSchema.optional(),
 }).strict().refine(value => value.enabled === false
   || value.requestsPerMinute !== undefined
   || value.minIntervalMs !== undefined
   || value.maxConcurrentRequests !== undefined
+  || value.keys !== undefined || value.keySelection === "round-robin"
   || (value.models !== undefined && Object.keys(value.models).length > 0), {
-  message: "enabled request pacing needs a provider rule or model override",
+  message: "enabled request pacing needs a provider, model, or key rule, or round-robin selection",
 });
 
 export function requestPacingConfigError(value: unknown): string | null {
@@ -257,6 +268,12 @@ const autoReviewModelOverridesSchema = z.unknown().superRefine((value, ctx) => {
   if (error) ctx.addIssue({ code: "custom", message: error });
 }).transform(value => normalizeAutoReviewModelOverrides(value));
 
+/** Global auto-review override block; a malformed hand edit is stripped by load degradation. */
+export const autoReviewOverrideSchema = z.unknown().superRefine((value, ctx) => {
+  const error = autoReviewOverrideConfigError(value, "autoReviewOverride");
+  if (error) ctx.addIssue({ code: "custom", message: error });
+}).transform(value => value as NonNullable<OcxConfig["autoReviewOverride"]>);
+
 const modelCapabilitiesSchema = z.unknown().superRefine((value, ctx) => {
   const error = modelCapabilitiesConfigError(value);
   if (error) ctx.addIssue({ code: "custom", message: error });
@@ -337,9 +354,12 @@ export const providerConfigSchema = z.object({
   preserveResponsesReasoningContent: z.boolean().optional(),
   preserveResponsesInputItemIds: z.boolean().optional(),
   preserveResponsesMessageMetadata: z.boolean().optional(),
+  projectResponsesLiteHostedSearchHistory: z.boolean().optional(),
   dropResponsesReasoningItems: z.boolean().optional(),
   modelReasoningEffortsAuthoritative: z.boolean().optional(),
   decodesNativeCompactionBlobs: z.boolean().optional(),
+  supportsNativeCompactionTrigger: z.boolean().optional(),
+  supportsNativeCompactEndpoint: z.boolean().optional(),
   allowEncryptedV2AgentTasks: z.boolean().optional(),
   allowPrivateNetwork: z.boolean().optional(),
   // Per-provider egress (#2894): absent inherits the global proxy decision, "direct"/null
@@ -423,7 +443,7 @@ export { providerRelativeSendPathConfigError } from "../provider-relative-send-p
 
 /**
  * Validate `providers.<name>.modelCosts`: a plain object keyed by exact model
- * id, each value a 4-tuple of non-negative finite USD-per-1M-token rates.
+ * id, each value four USD-per-1M-token rates and an optional prompt-length policy.
  * Returns null when valid/absent, else a human-readable error.
  */
 export function providerModelCostsConfigError(value: unknown, field = "modelCosts"): string | null {
@@ -443,25 +463,28 @@ export function providerModelCostsConfigError(value: unknown, field = "modelCost
     const rates = entry as Record<string, unknown>;
     for (const key of COST4_RATE_KEYS) {
       const rate = rates[key];
-      if (!isValidCost4Rate(rate)) {
+      if (!Object.hasOwn(rates, key) || !isValidCost4Rate(rate)) {
         return `${field}.${safeModelId}.${key} must be a non-negative finite number at most ${MAX_COST4_RATE} (USD per 1M tokens)`;
       }
     }
+    if (Object.hasOwn(rates, "promptLengthPricing") && !isValidPromptLengthPricing(rates.promptLengthPricing)) {
+      return `${field}.${safeModelId}.promptLengthPricing must be automatic, flat, or a complete custom policy with a positive safe-integer thresholdTokens, gt/gte comparison, and four valid rates`;
+    }
     // Reject unknown fields: a misplaced apiKey/apiKeyPool under a cost row
     // would otherwise be persisted and echoed verbatim by display paths that
     // mask only top-level provider secrets.
     const extraKeys = Object.keys(rates)
-      .filter((key) => !(COST4_RATE_KEYS as readonly string[]).includes(key));
+      .filter((key) => key !== "promptLengthPricing" && !(COST4_RATE_KEYS as readonly string[]).includes(key));
     if (extraKeys.length > 0) {
-      return `${field}.${safeModelId} has unexpected fields ${JSON.stringify(extraKeys.map(redactSecretString).join(", "))} — only input, output, cacheRead, and cacheWrite are allowed (USD per 1M tokens)`;
+      return `${field}.${safeModelId} has unexpected fields ${JSON.stringify(extraKeys.map(redactSecretString).join(", "))} — only input, output, cacheRead, cacheWrite, and promptLengthPricing are allowed (USD per 1M tokens)`;
     }
   }
   return null;
 }
 
 /**
- * Serialize `providers.<name>.modelCosts` for display: copy ONLY the four
- * numeric rate fields per model and DROP secret-shaped model ids, so a pasted
+ * Serialize `providers.<name>.modelCosts` for display: copy the four validated
+ * rates and complete validated policy and DROP secret-shaped model ids, so a pasted
  * API key in a key position cannot be echoed back by CLI/DTO display paths.
  * The result uses a null prototype so "__proto__" remains an own row.
  */
@@ -471,6 +494,7 @@ export function sanitizeModelCostsForDisplay(costs: unknown): Record<string, Pro
   for (const [modelId, entry] of Object.entries(costs)) {
     if (!entry || typeof entry !== "object" || Array.isArray(entry)) continue;
     const rates = entry as Record<string, unknown>;
+    if (Object.hasOwn(rates, "promptLengthPricing") && !isValidPromptLengthPricing(rates.promptLengthPricing)) continue;
     const input = rates.input;
     const output = rates.output;
     const cacheRead = rates.cacheRead;
@@ -484,7 +508,10 @@ export function sanitizeModelCostsForDisplay(costs: unknown): Record<string, Pro
       // Secret-shaped ids are DROPPED rather than mapped to "[REDACTED]" so
       // distinct rows cannot collapse into one placeholder key.
       if (redactSecretString(modelId) !== modelId) continue;
-      out[modelId] = { input, output, cacheRead, cacheWrite };
+      const policy = isValidPromptLengthPricing(rates.promptLengthPricing)
+        ? copyPromptLengthPricing(rates.promptLengthPricing) : undefined;
+      out[modelId] = { input, output, cacheRead, cacheWrite,
+        ...(policy ? { promptLengthPricing: policy } : {}) };
     }
   }
   return Object.keys(out).length > 0 ? out : undefined;
@@ -794,6 +821,8 @@ export const apiKeyEntrySchema = z.object({
   // rather than promoting it.
   allowedProviders: z.array(z.string().trim().min(1).max(256)).optional(),
   allowedModels: z.array(z.string().trim().min(1).max(256)).optional(),
+  // Not `.catch`ed for the same reason: a damaged value must not grant metered spend.
+  allowMeteredComboTargets: z.boolean().optional(),
 }).passthrough();
 
 /**

package/src/config/schema/main-account-hard-lock-fallback.ts

@@ -0,0 +1,26 @@
+import * as z from "zod/v4";
+import { pinnedReasoningEffortConfigError } from "../provider-validation";
+
+/**
+ * Extended settings of the main-account hard lock (`codexMainAccountHardLockFallback`):
+ * while the lock blocks, a qualifying Codex-native request reroutes to `model` instead of
+ * failing. The dashboard row keeps the configured model when the switch is off, so
+ * `enabled: false` is a remembered pause, not a cleared setting; an absent section, an
+ * absent model, and a malformed section all mean the same thing — the lock refuses,
+ * exactly as it does today.
+ */
+export const mainAccountHardLockFallbackSchema = z.object({
+  enabled: z.boolean().optional(),
+  model: z.string().refine(model => model.length > 0 && model === model.trim() && !/\s/.test(model)),
+  reasoningEffort: z.string().refine(value => pinnedReasoningEffortConfigError(value) === null).optional(),
+}).strict();
+
+/** Candidate writes must reject sections the read schema would silently discard. */
+export function mainAccountHardLockFallbackError(value: unknown): string | undefined {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return undefined;
+  const raw = (value as Record<string, unknown>).codexMainAccountHardLockFallback;
+  if (raw === undefined) return undefined;
+  return mainAccountHardLockFallbackSchema.safeParse(raw).success
+    ? undefined
+    : "schema_invalid: codexMainAccountHardLockFallback requires a nonblank model selector and an optional declared reasoningEffort";
+}

package/src/config/schema/native-reasoning-retention.ts

@@ -0,0 +1,26 @@
+import * as z from "zod/v4";
+import type { OcxConfig } from "../../types";
+
+/** Opt-in allowances for canonical ChatGPT reasoning replay; absence keeps existing cleanup. */
+export const nativeReasoningRetentionSchema = z.object({
+  modelSwitch: z.boolean().optional(),
+  accountSwitch: z.boolean().optional(),
+}).strict();
+
+export function nativeReasoningRetentionConfigError(value: unknown): string | null {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const retention = (value as Record<string, unknown>).nativeReasoningRetention;
+  return retention === undefined || nativeReasoningRetentionSchema.safeParse(retention).success
+    ? null : "schema_invalid: nativeReasoningRetention: accepts only optional boolean modelSwitch and accountSwitch fields";
+}
+
+/** Resolve malformed synthetic inputs the same way as degraded disk config: both off. */
+export function resolveNativeReasoningRetention(
+  config: Pick<OcxConfig, "nativeReasoningRetention">,
+): { modelSwitch: boolean; accountSwitch: boolean } {
+  const parsed = nativeReasoningRetentionSchema.safeParse(config.nativeReasoningRetention);
+  return {
+    modelSwitch: parsed.success && parsed.data.modelSwitch === true,
+    accountSwitch: parsed.success && parsed.data.accountSwitch === true,
+  };
+}

package/src/config.ts

@@ -162,6 +162,7 @@ import { persistConfigUnlocked, readRawConfigJson } from "./config/persist-unloc
 import { withConfigMutationLockSync, bumpGenerationForCooperatingConfigWrite } from "./config/mutation-lock";
 import { getDefaultConfig } from "./config/proxy-env";
 import { configSchema } from "./config/schema/config-schema";
+import { sanitizeOpenCodeOverridesForLoad } from "./config/opencode-wire-upgrade";
 import {
   hardenExistingSecret,
   normalizeApiKeyIds,
@@ -222,6 +223,7 @@ export function loadConfig(): OcxConfig {
   try {
     const raw = readFileSync(configPath, "utf-8").replace(/^\uFEFF/, "");
     const parsed = JSON.parse(raw);
+    sanitizeOpenCodeOverridesForLoad(parsed);
     sanitizeAliasesForLoad(parsed);
     sanitizeReasoningPinsForLoad(parsed);
     sanitizeModelDisplayNamesForLoad(parsed);