@bitkyc08/opencodex 2.86.0 → 2.87.0

package/src/types/config.ts

@@ -349,6 +349,12 @@ export interface OcxApiKeyEntry {
    * that is the only point at which the model about to be billed is known.
    */
   allowedModels?: string[];
+  /**
+   * Lets this key reach combo targets marked `metered`. Absent means no: an issued key stops
+   * at the last unmetered target. The environment token never qualifies. A loopback bind
+   * reads no key; local operator consent is instead declared on the combo.
+   */
+  allowMeteredComboTargets?: boolean;
 }
 
 export interface OcxPendingApiKeyRotation {
@@ -569,6 +575,21 @@ export interface OcxConfig {
   };
   /** Enable the shipped model alias patterns for providers without an override. */
   defaultModelAliases?: boolean;
+  /**
+   * When `true`, the raw OpenAI-compatible `/v1/models` list publishes a safe alias (e.g.
+   * `SEK-glm-4.7-flash`) as the row `id` instead of `provider/nativeId`
+   * (e.g. `Seek/glm-4.7-flash`).  The original `provider/nativeId` moves to a
+   * new `native_id` field so clients that need it can still read it.
+   *
+   * **Default: `false`** — the historical `provider/nativeId` form remains the
+   * published `id`, and the alias is in the informational `alias_of` field.
+   *
+   * Codex (`client_version`) and Anthropic-specific discovery retain their own
+   * identities and are unchanged. Ambiguous or shadowed short aliases retain the
+   * qualified ID, as do aliases with unparseable synthetic Fast siblings.
+   * Existing requests using `provider/nativeId` continue to work unchanged.
+   */
+  preferModelAliasIds?: boolean;
   /**
    * Opt-in Cursor Private Inference compatibility rows. When true, `/v1/models`
    * adds `<base-id>--<effort>` selectors for reasoning-capable model ids absent
@@ -605,6 +626,13 @@ export interface OcxConfig {
   codexMainAccountHardLock?: boolean;
   /** Per-window percentages: short defaults to 90, long to 98; integers 80..100, short <= long. */
   codexMainAccountHardLockThresholds?: { short?: number; long?: number };
+  /**
+   * Extended hard-lock settings: while the lock blocks and no Codex account can serve a
+   * qualifying request, the request reroutes to `model` (with `reasoningEffort` when set)
+   * instead of failing. The lock itself stays on and releases on its own as before; an
+   * absent section or model means the refusal behavior is unchanged.
+   */
+  codexMainAccountHardLockFallback?: { enabled?: boolean; model?: string; reasoningEffort?: string };
   /**
    * Who refreshes the native main ChatGPT login in CODEX_HOME (#2999). "codex" asks the Codex
    * binary through app-server `getAuthStatus` and never writes auth.json; "opencodex" keeps the
@@ -612,6 +640,8 @@ export interface OcxConfig {
    * is found, otherwise "opencodex". "codex" also falls back when no such binary exists.
    */
   nativeMainRefresh?: "codex" | "opencodex";
+  /** Use included quota to 100% for these accounts; preserves thresholds and credit-spending policy. */
+  codexUseRemainingQuotaAccountIds?: string[];
   /** Explicit top-level deletion intent used by stale whole-config rebases. */
   configRebaseProvenance?: OcxConfigRebaseProvenance | Record<string, unknown>;
   /** OpenAI provider-contract migration marker (v2 = single `openai` provider with account mode). */
@@ -783,6 +813,13 @@ export interface OcxConfig {
   };
   /** Opt-in failure-only recovery; never replaces the initial compaction model. */
   compactionRecovery?: { enabled: boolean; model: string; allowDevinInvalidArgument?: boolean };
+  /** Explicit opt-in (enabled === true), default off, for routed v1/v2 readable reasoning retention.
+   * Defaults: 20% of the compacting model's context window and 100,000 tokens (the smaller limit).
+   * Unknown windows use maxTokens alone; overflow is archived locally with a path notice.
+   * Native and opaque compaction output keep their existing protocols. */
+  reasoningRetention?: { enabled?: boolean; maxContextPercent?: number; maxTokens?: number };
+  /** Canonical ChatGPT reasoning replay allowances; both default off. */
+  nativeReasoningRetention?: { modelSwitch?: boolean; accountSwitch?: boolean };
   /** Explicit opt-in; resumes Observe only using an existing trusted certificate and endpoints. */
   desktopCompatibility?: { startOnProxyStart: boolean };
   /**
@@ -842,6 +879,19 @@ export interface OcxConfig {
    /** Optional override of intercepted source-model prefixes (default: gpt-6-luna, gpt-5.6-luna). */
    sourceModels?: string[];
  };
+  /**
+   * Global auto-review (approval reviewer) selector for every catalog row, written by the
+   * Models settings panel. During catalog sync OpenCodex stamps it as
+   * `auto_review_model_override` on rows that carry no provider-scoped stamp, so an enabled block
+   * wins over Codex's own root `auto_review_model`; disabling it restores that fallback.
+   * `autoReviewModel` keeps its precedence on its own provider's rows.
+   */
+  autoReviewOverride?: {
+    /** When true, the configured model replaces the reviewer on every unowned row. */
+    enabled?: boolean;
+    /** Public catalog selector in `provider/model` form; blank or absent clears the override. */
+    model?: string;
+  };
   /**
    * Optional map of blocked model IDs to their replacement model IDs.
    * When configured, incoming requests targeting a blocked model (including
@@ -1207,6 +1257,8 @@ export interface OcxConfig {
   autoSwitchThreshold?: number;
   /** Opt-in: return bound quota-strategy tasks to recovered higher-priority accounts. */
   codexAccountPriorityFailback?: boolean;
+  /** Prefer other identities, reserving the current native sign-in as pool fallback. */
+  codexPreserveSignedInAccount?: boolean;
   /** New-session account rotation strategy for the Codex pool. Default quota (today's behaviour). */
   accountPoolStrategy?: OcxAccountPoolRotationStrategy | "reset-first";
   /** Successful new-session binds retained on one round-robin selection. Default 1; range 1..100. */
@@ -1338,10 +1390,18 @@ export interface OcxComboTarget {
    * see `OcxComboConfig.cooldownWaitPolicy` (#5691).
    */
   lastResort?: boolean;
+  /**
+   * Pay-per-use target (for example an API-key row behind subscription targets). Only the
+   * configured keys with `allowMeteredComboTargets: true`, or a loopback-only combo
+   * with `allowMeteredTargets: true`, may reach it.
+   */
+  metered?: boolean;
 }
 
 export interface OcxComboConfig {
   targets: OcxComboTarget[];
+  /** Operator consent for metered targets on a loopback-only proxy. Default false; public listeners still require key consent. */
+  allowMeteredTargets?: boolean;
   /** Ordered failover (default), round-robin, weighted random, least-used, or quota reset-window selection. */
   strategy?: OcxComboStrategy;
   /** Successful requests retained on one RR selection batch. Default 1; range 1..100. */
@@ -1578,8 +1638,7 @@ export interface OcxVisionSidecarConfig {
 }
 
 /**
- * Advisor sidecar configuration. Kept deliberately small for PR1: no adaptive trigger knobs
- * (failedValidations / noProgressCycles / semanticClassifier) — those belong to a later PR.
+ * Advisor sidecar configuration. Automatic triggers require deterministic task evidence.
  */
 export interface OcxAdvisorConfig {
   /** Master switch. Default: false — the advisor stays off the request path entirely. */
@@ -1598,7 +1657,9 @@ export interface OcxAdvisorConfig {
    * consultation per task once the task has produced orientation evidence (an assistant tool call
    * or a tool result after the latest user message).
    */
-  policy?: "manual" | "preflight";
+  policy?: "manual" | "preflight" | "adaptive";
+  /** Adaptive task consultation attempts (manual + automatic). Integer 1–3, default 3. */
+  maxConsultationsPerTask?: number;
   /** Advisor fetch timeout (ms). Default 120000. */
   timeoutMs?: number;
   /**

package/src/types/opencode-go.ts

@@ -0,0 +1,61 @@
+/** Exact-model protocols from https://opencode.ai/v2/docs/console/go/#endpoints (2026-10-15).
+ * Unknown models retain Chat. Responses entries are overridable registry defaults;
+ * the native wires are hard pins because modelAdapters cannot select those adapters.
+ */
+export const OPENCODE_GO_BASE_URL = "https://opencode.ai/zen/go/v1";
+
+export const OPENCODE_GO_MODEL_WIRES: Readonly<Record<string, "google" | "anthropic" | "openai-responses">> = Object.freeze({
+  "gemini-4-argon-contributor": "google",
+  "claude-haiku-5-5": "anthropic",
+  "minimax-m2.7": "anthropic",
+  "minimax-m3": "anthropic",
+  "qwen3.7-plus": "anthropic",
+  "qwen3.8-max": "anthropic",
+  "qwen3.8-flash": "anthropic",
+  "gpt-6-luna": "openai-responses",
+  "gpt-5.6-luna": "openai-responses",
+  "grok-4.6": "openai-responses",
+  "grok-4.7": "openai-responses",
+  "muse-spark-1.2-contributor": "openai-responses",
+  "muse-spark-1.3-contributor": "openai-responses",
+  // Retain previously supported Go models absent from the current endpoint table (#4847).
+  "minimax-m2.5": "anthropic",
+  "union-alpha": "anthropic",
+});
+
+/** Compatibility: these five pins predate destination scoping. New native pins require Go. */
+export const OPENCODE_GO_LEGACY_NAME_PINS: ReadonlySet<string> = new Set([
+  "claude-haiku-5-5", "minimax-m2.5", "minimax-m2.7", "minimax-m3", "union-alpha",
+]);
+
+export const OPENCODE_GO_RESPONSES_DEFAULTS = Object.freeze(Object.fromEntries(
+  Object.entries(OPENCODE_GO_MODEL_WIRES).filter(([, wire]) => wire === "openai-responses"),
+));
+
+export interface OpenCodeGoDestination {
+  readonly baseUrl?: unknown;
+  readonly authMode?: unknown;
+  readonly googleMode?: unknown;
+}
+
+/** A provider name alone must never authorize redirecting a credential to OpenCode. */
+export function isOpenCodeGoGeminiDestination(provider: OpenCodeGoDestination | undefined): boolean {
+  if (!provider || typeof provider.baseUrl !== "string") return false;
+  if (provider.authMode !== undefined && provider.authMode !== "key") return false;
+  if (provider.googleMode !== undefined && provider.googleMode !== "ai-studio") return false;
+  try {
+    const url = new URL(provider.baseUrl.trim());
+    return url.origin === "https://opencode.ai"
+      && !url.username && !url.password && !url.search && !url.hash
+      && ["/zen/go/v1", "/inference/go/v1"].includes(url.pathname.replace(/\/+$/, ""));
+  } catch {
+    return false;
+  }
+}
+
+/** Return the fixed Gemini endpoint only for the exact model and an eligible Go destination. */
+export function openCodeGoGeminiEndpoint(provider: OpenCodeGoDestination, modelId: string): string | undefined {
+  return Object.hasOwn(OPENCODE_GO_MODEL_WIRES, modelId) && OPENCODE_GO_MODEL_WIRES[modelId] === "google" && isOpenCodeGoGeminiDestination(provider)
+    ? `https://opencode.ai/inference/go/v1/models/${encodeURIComponent(modelId)}`
+    : undefined;
+}

package/src/types/opencode-zen.ts

@@ -0,0 +1,29 @@
+/** Fixed-key OpenCode Zen destinations exposing the native Gemini endpoint. */
+export interface OpenCodeZenDestination {
+  readonly baseUrl?: unknown;
+  readonly authMode?: unknown;
+  readonly googleMode?: unknown;
+}
+
+export function openCodeZenBaseUrl(provider: OpenCodeZenDestination | undefined): string | undefined {
+  if (!provider || typeof provider.baseUrl !== "string") return undefined;
+  if (provider.authMode !== undefined && provider.authMode !== "key") return undefined;
+  if (provider.googleMode !== undefined && provider.googleMode !== "ai-studio") return undefined;
+  try {
+    const url = new URL(provider.baseUrl.trim());
+    const pathname = url.pathname.replace(/\/+$/, "");
+    if (url.origin !== "https://opencode.ai" || url.username || url.password || url.search || url.hash) return undefined;
+    if (pathname !== "/zen/v1" && pathname !== "/inference/v1") return undefined;
+    return url.origin + pathname;
+  } catch {
+    return undefined;
+  }
+}
+
+/** Keep the selected destination; Zen omits AI Studio's /v1beta segment. */
+export function openCodeZenGeminiEndpoint(provider: OpenCodeZenDestination, modelId: string): string | undefined {
+  const baseUrl = openCodeZenBaseUrl(provider);
+  return baseUrl && modelId.toLowerCase().startsWith("gemini-")
+    ? baseUrl + "/models/" + encodeURIComponent(modelId)
+    : undefined;
+}

package/src/types/provider.ts

@@ -14,6 +14,8 @@ export interface ProviderApiKeySelection {
   entryId?: string;
   reference?: string;
   revision?: string;
+  /** Request-local allocation; does not replace the saved active key. */
+  distributed?: boolean;
 }
 
 export interface OpenRouterProviderRouting {
@@ -164,16 +166,25 @@ export interface ProviderWebSearchBridgeConfig {
   endpoint?: string;
 }
 
-/**
- * User-configured display price for one model (USD per 1M tokens).
- * Mirrors the `Cost4` shape used by the usage cost estimator; structurally
- * compatible so config rows can be lifted directly into price overlays.
- */
+/** Optional user-owned prompt-length policy; rates are USD per 1M tokens. */
+export type PromptLengthPricing =
+  | { mode: "automatic" }
+  | { mode: "flat" }
+  | {
+    mode: "custom";
+    thresholdTokens: number;
+    comparison: "gt" | "gte";
+    rates: { input: number; output: number; cacheRead: number; cacheWrite: number };
+  };
+
+/** Complete base rates for one model, with automatic pricing when policy is absent. */
 export interface ProviderCostOverlay {
   input: number;
   output: number;
   cacheRead: number;
   cacheWrite: number;
+  /** Absent means automatic vendor prompt-length pricing. */
+  promptLengthPricing?: PromptLengthPricing;
 }
 
 export interface RequestPacingRule {
@@ -190,6 +201,10 @@ export interface ProviderRequestPacingConfig extends RequestPacingRule {
   enabled: boolean;
   /** Exact upstream model-id overrides; other models inherit the provider rule. */
   models?: Record<string, RequestPacingRule>;
+  /** Normal request allocation, separate from cooldown recovery ordering. */
+  keySelection?: "active" | "round-robin";
+  /** Additional uniform limits per pool credential, across all models. */
+  keys?: RequestPacingRule;
 }
 
 export interface FastWire {
@@ -432,6 +447,11 @@ export interface OcxProviderConfig {
    * to extract turn provenance (#6220).
    */
   preserveResponsesMessageMetadata?: boolean;
+  /**
+   * Opt in to lossy hosted-search history notes on ordinary canonical Codex Lite requests.
+   * Default off; only literal true enables it, and non-Lite/native compact stay unchanged.
+   */
+  projectResponsesLiteHostedSearchHistory?: boolean;
   /**
    * Treat this provider's `modelReasoningEfforts` as authoritative at the wire, not only in the
    * catalog. Adapters that ship their own per-model effort table (currently `command-code`)
@@ -453,6 +473,10 @@ export interface OcxProviderConfig {
    * compaction blobs. Absent or false degrades foreign blobs to an opaque note.
    */
   decodesNativeCompactionBlobs?: boolean;
+  /** Accept native Responses v2 `input` compaction_trigger items. Responses adapter only. */
+  supportsNativeCompactionTrigger?: boolean;
+  /** Serve native Responses v1 /responses/compact. Responses adapter only; no auth authority. */
+  supportsNativeCompactEndpoint?: boolean;
   /**
    * Trust this direct key-auth Responses provider to consume or relay opaque encrypted
    * V2 agent tasks. OpenCodex does not decrypt, translate, or recover an eligible task.
@@ -712,12 +736,14 @@ export interface OcxProviderConfig {
     /** Kiro OAuth only: active serving requests per account, 1..100. */
     maxConcurrentPerAccount?: number;
     enabled?: boolean;
+    /** Opt-in process-local conversation ownership; requires proactive enablement. */
+    sessionAffinity?: "conversation" | "none";
     /**
      * Generic OAuth pool selection strategy (#695). Persisted through the pool-settings
      * contract. Consumed by the selector only while `pool.kernel` is on; with the flag off
      * it is still merely persisted, so omitted and set behave the same.
      */
-    strategy?: "quota" | "round-robin" | "fill-first" | "least-loaded";
+    strategy?: "quota" | "round-robin" | "fill-first" | "reset-first" | "least-loaded";
     /**
      * 0-100 usage percent at which fill-first advances off the active account (#695).
      * Read only under `pool.kernel` with `strategy: "fill-first"`; 80 when unset, matching

package/src/types/request.ts

@@ -2,6 +2,7 @@ import type { KiroOAuthMetadata } from "../oauth/types";
 import type { NativeReasoningOwner } from "../responses/reasoning-replay-cache";
 import type { OcxTool, OcxToolChoice } from "./tools";
 import type { TierDecision, TierObservationContext } from "./provider";
+import type { TranslatorBudget } from "../lib/translator-budget";
 
 /** Exact provider/credential namespace for process-local reasoning replay. */
 export interface OcxReasoningReplayIdentity {
@@ -62,6 +63,11 @@ export interface OcxParsedRequest {
   _nativeReasoningReplay?: ReadonlyMap<string, string>;
   _nativeReasoningBoundOwner?: NativeReasoningOwner;
   _nativeReasoningMint?: { owner?: NativeReasoningOwner };
+  /**
+   * The Claude client's typed Anthropic web tools, as declared. Only the anthropic adapter reads
+   * them, and only for api.anthropic.com; every other destination never sees them.
+   */
+  _anthropicServerTools?: readonly Record<string, unknown>[];
   /**
    * Boundary between replayed history and this turn's newly appended input. Usually the
    * items the proxy restored from local previous_response_id state; also set when the
@@ -92,11 +98,17 @@ export interface OcxParsedRequest {
   _cursorClientThreadId?: string;
   /** Conversation/provider/account/model-bound namespace for reasoning replay state. */
   _reasoningReplayScope?: OcxReasoningReplayScopeRef;
+  /** Trusted configuration snapshot; never read from the client's request body. */
+  _nativeReasoningRetention?: Readonly<{ modelSwitch: boolean; accountSwitch: boolean }>;
   /**
    * Set by bindRouteReasoningReplayScope after a proven serving-identity change, or by
    * prepareOpaqueBlobRecovery after an authoritative rejection; consumers strip replayed blobs.
    */
   _stripReasoningEncryptedContent?: boolean;
+  /** Native compaction remains nonportable even when reasoning-only retention is enabled. */
+  _stripNativeCompactionEncryptedContent?: boolean;
+  /** Retention kept reasoning ciphertext across a model/account change; arms streamed rejection recovery. */
+  _nativeReasoningRetainedAcrossRoute?: boolean;
   /**
    * Set when replayed reasoning item ids name items in a store this destination cannot read: by
    * prepareOpaqueBlobRecovery before the one recovery rebuild, and by bindRouteReasoningReplayScope
@@ -150,6 +162,8 @@ export interface OcxParsedRequest {
    * (see src/responses/compaction.ts).
    */
   _compactionRequest?: boolean;
+  /** Request-owned encoding of readable routed v2 retention; never used for native ciphertext. */
+  _compactionRetention?: { encode(summary: string): string; commit(): void };
   /** Manual compaction moved to another provider: summarize portably even on a canonical ChatGPT target. */
   _portableCompaction?: boolean;
   /**
@@ -173,6 +187,7 @@ export interface OcxParsedRequest {
    */
   _advisorGuard?: (options: {
     parsed: OcxParsedRequest;
+    translatorBudget?: TranslatorBudget;
     firstEvents: AsyncIterable<AdapterEvent>;
     /** One bounded worker continuation re-dispatch (same machinery as the terminal guard). */
     continuation: (parsed: OcxParsedRequest) => AsyncIterable<AdapterEvent> | Promise<AsyncIterable<AdapterEvent>>;
@@ -401,7 +416,9 @@ export interface OcxProviderContinuationState {
 
 export type AdapterEvent =
   | { type: "heartbeat"; replayUnsafe?: true; preflightReady?: true }
-  | { type: "text_delta"; text: string; phase?: OcxMessagePhase }
+  | { type: "text_delta"; text: string; phase?: OcxMessagePhase;
+      /** Complete documented Anthropic progress block: text remains signed thinking on replay. */
+      anthropicThinkingSignature?: string }
   | { type: "thinking_delta"; thinking: string }
   // Anthropic extended-thinking round-trip: signature_delta for the current thinking block, and
   // opaque redacted_thinking blocks. Both must be replayed verbatim or tool-use turns 400.
@@ -424,7 +441,11 @@ export type AdapterEvent =
   // output_item.added(in_progress) and end → the matching output_item.done(completed|failed) under
   // the SAME output index, so the activity animates instead of flashing completed instantly.
   | { type: "web_search_call_begin"; id: string }
-  | { type: "web_search_call_end"; id: string; queries: string[]; status?: "completed" | "failed"; sources?: OcxUrlCitation[] }
+  | {
+      type: "web_search_call_end"; id: string; queries: string[]; status?: "completed" | "failed"; sources?: OcxUrlCitation[];
+      /** Anthropic's server-side web_fetch (adapters/anthropic.ts): the opened page and its `web_fetch_tool_result` content, verbatim. */
+      fetch?: { url: string; result: unknown };
+    }
   | {
       type: "done";
       usage?: OcxUsage;

package/src/types/wire.ts

@@ -1,3 +1,6 @@
+import { isOpenCodeGoGeminiDestination, OPENCODE_GO_BASE_URL, OPENCODE_GO_MODEL_WIRES, OPENCODE_GO_LEGACY_NAME_PINS, type OpenCodeGoDestination } from "./opencode-go";
+import { openCodeZenBaseUrl, type OpenCodeZenDestination } from "./opencode-zen";
+
 /**
  * Accepted values for the per-provider upstream HTTP-version pin (#1668). Shared by the
  * zod load schema, the management write boundary (POST/PATCH), and the fetch runtime, so
@@ -40,35 +43,16 @@ export const MODEL_ADAPTER_OVERRIDE_ALLOWED: ReadonlySet<string> = new Set([
   "openai-responses",
 ]);
 
-/**
- * Providers whose listed model ids must be driven over the Anthropic wire even when
- * the provider's configured adapter says otherwise — the upstream only speaks
- * Anthropic for these models.
- */
-const ANTHROPIC_WIRE_MODELS: Record<string, ReadonlySet<string>> = {
-  "opencode-go": new Set([
-    "claude-haiku-5-5",
-    "minimax-m2.5",
-    "minimax-m2.7",
-    "minimax-m3",
-    // OpenCode's catalog identifies Union Alpha as @ai-sdk/anthropic while the
-    // provider defaults to OpenAI-compatible; direct Chat returns 500 and direct
-    // Messages reaches the session check (#4847).
-    "union-alpha",
-  ]),
-};
-
-function anthropicWireModelsForProvider(providerName: string): ReadonlySet<string> | undefined {
-  return Object.hasOwn(ANTHROPIC_WIRE_MODELS, providerName)
-    ? ANTHROPIC_WIRE_MODELS[providerName]
-    : undefined;
-}
-
-/** Detached provider-local hard-pin table for pure wire-policy resolution. */
-export function captureWireAdapterHardPins(providerName: string): Readonly<Record<string, string>> {
-  const models = anthropicWireModelsForProvider(providerName);
-  if (!models) return Object.freeze({});
-  return Object.freeze(Object.fromEntries([...models].map(modelId => [modelId, "anthropic"])));
+/** Native Go wire pins share the exact-model table with registry Responses defaults. */
+export function captureWireAdapterHardPins(providerName: string, provider?: WirePinProvider): Readonly<Record<string, string>> {
+  if (providerName !== "opencode-go") return Object.freeze({});
+  // The existing Go preset pins saved URLs to this endpoint before dispatch. Pure policy
+  // captures must use that same destination even when handed an unnormalized config row.
+  const destination = provider && { ...provider, baseUrl: OPENCODE_GO_BASE_URL };
+  return Object.freeze(Object.fromEntries(Object.entries(OPENCODE_GO_MODEL_WIRES).filter(([modelId, wire]) =>
+    (wire === "anthropic" && OPENCODE_GO_LEGACY_NAME_PINS.has(modelId))
+    || (wire !== "openai-responses" && isOpenCodeGoGeminiDestination(destination)),
+  )));
 }
 
 interface WirePinPrefixRule {
@@ -98,9 +82,7 @@ const WIRE_ADAPTER_PIN_PREFIXES: Readonly<Record<string, WirePinPrefixRule>> = O
 });
 
 /** Just enough of a provider config to tell whether it still points at the pinned endpoint. */
-export interface WirePinProvider {
-  readonly baseUrl?: unknown;
-}
+export interface WirePinProvider extends OpenCodeGoDestination, OpenCodeZenDestination {}
 
 function normalizedEndpoint(value: unknown): string | undefined {
   if (typeof value !== "string") return undefined;
@@ -112,7 +94,19 @@ function normalizedEndpoint(value: unknown): string | undefined {
   }
 }
 
+/**
+ * Providers whose adapter is their credential boundary: the adapter alone pins the destination and
+ * the auth header for an account token. No model may switch wires, whatever `baseUrl` or the row's
+ * own `adapter` says, because a generic wire would send that token as a Bearer key to the configured
+ * URL. The empty prefix covers every model id.
+ */
+const CREDENTIAL_PINNED_ADAPTERS: Readonly<Record<string, Readonly<Record<string, string>>>> = Object.freeze({
+  "dsh-account": Object.freeze({ "": "dsh-account" }),
+});
+
 function prefixPinsFor(providerName: string, provider: WirePinProvider | undefined): Readonly<Record<string, string>> | undefined {
+  if (Object.hasOwn(CREDENTIAL_PINNED_ADAPTERS, providerName)) return CREDENTIAL_PINNED_ADAPTERS[providerName];
+  if (providerName === "opencode-zen" && openCodeZenBaseUrl(provider)) return { "gemini-": "google" };
   if (!provider || !Object.hasOwn(WIRE_ADAPTER_PIN_PREFIXES, providerName)) return undefined;
   const rule = WIRE_ADAPTER_PIN_PREFIXES[providerName]!;
   return normalizedEndpoint(provider.baseUrl) === rule.endpoint ? rule.prefixes : undefined;
@@ -148,13 +142,11 @@ function prefixedWireAdapter(providerName: string, modelId: string, provider: Wi
  * adapter" would pass on the first pass and then let the override win on the second.
  */
 export function isWirePinnedModel(providerName: string, modelId: string, provider?: WirePinProvider): boolean {
-  return (anthropicWireModelsForProvider(providerName)?.has(modelId) ?? false)
-    || prefixedWireAdapter(providerName, modelId, provider) !== undefined;
+  return pinnedWireAdapter(providerName, modelId, provider) !== undefined;
 }
 
 /** The wire a pinned model must use, or undefined when the model is not pinned. */
 export function pinnedWireAdapter(providerName: string, modelId: string, provider?: WirePinProvider): string | undefined {
-  return anthropicWireModelsForProvider(providerName)?.has(modelId)
-    ? "anthropic"
-    : prefixedWireAdapter(providerName, modelId, provider);
+  const pins = captureWireAdapterHardPins(providerName, provider);
+  return Object.hasOwn(pins, modelId) ? pins[modelId] : prefixedWireAdapter(providerName, modelId, provider);
 }

package/src/types.ts

@@ -122,6 +122,7 @@ export type {
   ProviderWebSearchBridgeBackend,
   ProviderWebSearchBridgeConfig,
   ProviderCostOverlay,
+  PromptLengthPricing,
   RequestPacingRule,
   ProviderRequestPacingConfig,
   FastWire,

package/src/update/npm-invocation.mjs

@@ -95,12 +95,22 @@ export function resolveNpmCommand(
   return null;
 }
 
+function shellEnvValue(env, name) {
+  // Copying process.env loses Windows' case-insensitive property access. Keep
+  // the existing exact-key precedence; do not choose between conflicting aliases.
+  if (env[name] !== undefined) return env[name];
+  const values = new Set(Object.entries(env)
+    .filter(([key, value]) => key.toLowerCase() === name.toLowerCase() && value !== undefined)
+    .map(([, value]) => value));
+  return values.size === 1 ? values.values().next().value : undefined;
+}
+
 function systemCommandProcessor(env) {
-  const systemRoot = env.SystemRoot ?? env.windir;
+  const systemRoot = shellEnvValue(env, "SystemRoot") ?? shellEnvValue(env, "windir");
   if (systemRoot && win32.isAbsolute(systemRoot)) {
     return win32.join(systemRoot, "System32", "cmd.exe");
   }
-  const comSpec = env.ComSpec;
+  const comSpec = shellEnvValue(env, "ComSpec");
   return comSpec && win32.isAbsolute(comSpec) ? win32.resolve(comSpec) : null;
 }