@bitkyc08/opencodex 2.86.0 → 2.88.0

package/src/config/diagnostics.ts

@@ -1,13 +1,16 @@
 import { readExistingSpendSalt, spendPoolAliasesError, validatePoolAliasOwners } from "../lib/spend-pool-alias-validation";
 import { isSubagentModelEntry, rawSubagentModelForce } from "./subagent-models";
+import { validRemainingQuotaAccountIds } from "../codex/account-use-remaining";
 import { protocolConfigSchema } from "./schema/config-schema";
 import { createHash } from "node:crypto";
 import { lstatSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import * as z from "zod/v4";
 import { compactionRecoveryConfigError } from "./schema/compaction-recovery";
+import { nativeReasoningRetentionConfigError } from "./schema/native-reasoning-retention";
 import { desktopCompatibilityConfigError } from "./schema/desktop-compatibility";
 import { blockedModelRedirectsError } from "./schema/blocked-model-redirects";
+import { mainAccountHardLockFallbackError } from "./schema/main-account-hard-lock-fallback";
 import type { OcxConfig } from "../types";
 import { anthropicAccountPoolConfigError, anthropicOAuthInstanceConfigError, anthropicSidecarConfigError } from "./schema/anthropic-account-pool";
 import { configReasoningPinsConfigError } from "./provider-validation";
@@ -18,6 +21,7 @@ import { isMissingPathError } from "./atomic-write";
 import { getConfigDir, getConfigPath } from "./paths";
 import { getDefaultConfig } from "./proxy-env";
 import { salvageConfigCandidate } from "./salvage";
+import { sanitizeOpenCodeOverridesForLoad } from "./opencode-wire-upgrade";
 import {
   sanitizeReasoningPinsForLoad,
   sanitizeRetryOn429ForLoad,
@@ -25,6 +29,7 @@ import {
   sanitizeModelCostsForLoad,
   sanitizeAutoReviewForLoad,
   degradedListenerWarnings,
+  degradedReasoningRetentionWarning,
   degradedCodexAccountPriorityWarnings,
   degradedCodexQuotaAutoRefreshWarning,
   normalizeApiKeyIds,
@@ -71,6 +76,7 @@ import {
   chatgptDesktopSchema,
   chatgptDesktopConfigIssue,
   compactionRoutingSchema,
+  reasoningRetentionSchema,
   skillsConfigSchema,
   memoryModelsSchema,
 } from "./schema/leaf-validators";
@@ -136,6 +142,8 @@ function validFileConfigDiagnostics(config: OcxConfig, rawParsed: unknown): Conf
   warnings.push(...degradedCodexAccountPriorityWarnings(rawParsed, normalized));
   warnings.push(...degradedListenerWarnings(rawParsed, normalized));
   if (blockedModelRedirectsError(rawParsed)) warnings.push("blockedModelRedirects ignored: expected a map of nonempty model keys to nonempty string targets");
+  if (nativeReasoningRetentionConfigError(rawParsed)) warnings.push("nativeReasoningRetention ignored: expected only optional boolean modelSwitch and accountSwitch fields; both remain off");
+  if (mainAccountHardLockFallbackError(rawParsed)) warnings.push("codexMainAccountHardLockFallback ignored: expected a nonblank model selector and an optional declared reasoningEffort");
   const quotaAutoRefreshWarning = degradedCodexQuotaAutoRefreshWarning(rawParsed, normalized);
   if (quotaAutoRefreshWarning) warnings.push(quotaAutoRefreshWarning);
   if (rawEffort !== undefined && !isClaudeSubagentEffort(rawEffort)) {
@@ -164,6 +172,8 @@ function validFileConfigDiagnostics(config: OcxConfig, rawParsed: unknown): Conf
   if (codexPoolWarning) warnings.push(codexPoolWarning);
   const spendWarning = malformedSpendWarning(rawParsed);
   if (spendWarning) warnings.push(spendWarning);
+  const retentionWarning = degradedReasoningRetentionWarning(rawParsed, normalized);
+  if (retentionWarning) warnings.push(retentionWarning);
   if (rawPoolAliasesError(rawParsed)) {
     warnings.push("spendPoolAliases invalid: configured pool admission is refused until the mapping is corrected");
   }
@@ -404,12 +414,15 @@ function codexAccountPrioritiesError(value: unknown): string | null {
   return null;
 }
 
-function codexAccountPriorityFailbackError(value: unknown): string | null {
+function codexAccountSelectionPreferencesError(value: unknown): string | null {
   const raw = rawConfigRecord(value);
-  if (!raw || !Object.hasOwn(raw, "codexAccountPriorityFailback")) return null;
-  const enabled = raw.codexAccountPriorityFailback;
-  if (enabled === undefined || typeof enabled === "boolean") return null;
-  return "schema_invalid: codexAccountPriorityFailback: must be a boolean or omitted";
+  if (!raw) return null;
+  for (const key of ["codexAccountPriorityFailback", "codexPreserveSignedInAccount"]) {
+    if (raw[key] !== undefined && typeof raw[key] !== "boolean") {
+      return `schema_invalid: ${key}: must be a boolean or omitted`;
+    }
+  }
+  return null;
 }
 
 /**
@@ -505,6 +518,12 @@ function creditCodexAccountIdsError(value: unknown): string | null {
   return "schema_invalid: creditCodexAccountIds: must be an array of account ids or omitted";
 }
 
+function remainingQuotaAccountIdsError(value: unknown): string | null {
+  const ids = rawConfigRecord(value)?.codexUseRemainingQuotaAccountIds;
+  return ids === undefined || validRemainingQuotaAccountIds(ids) ? null
+    : "schema_invalid: codexUseRemainingQuotaAccountIds: must be an array of Codex account ids or omitted";
+}
+
 function oauthOpenBrowserError(value: unknown): string | null {
   const raw = rawConfigRecord(value);
   if (!raw || !Object.hasOwn(raw, "oauthOpenBrowser")) return null;
@@ -681,6 +700,10 @@ export function validateConfigCandidate(value: unknown): { ok: true; config: Ocx
     return { ok: false, error: "schema_invalid: chatgptDesktop: requires an optional boolean appServerShim and no other fields" };
   }
   const compactionRouting = rawConfigRecord(value)?.compactionRouting;
+  const reasoningRetention = rawConfigRecord(value)?.reasoningRetention;
+  if (reasoningRetention !== undefined && !reasoningRetentionSchema.safeParse(reasoningRetention).success) {
+    return { ok: false, error: "schema_invalid: reasoningRetention: requires optional boolean enabled, maxContextPercent greater than 0 and at most 100 and/or positive integer maxTokens, with no other fields" };
+  }
   if (compactionRouting !== undefined && !compactionRoutingSchema.safeParse(compactionRouting).success) {
     return { ok: false, error: "schema_invalid: compactionRouting: requires a nonblank model, an optional valid reasoningEffort, and optional non-repeating triggers drawn from \"manual\" and \"auto\"" };
   }
@@ -695,6 +718,8 @@ export function validateConfigCandidate(value: unknown): { ok: true; config: Ocx
   const anthropicError = anthropicOAuthInstanceConfigError(value) ?? anthropicAccountPoolConfigError(value) ?? anthropicSidecarConfigError(value);
   if (anthropicError) return { ok: false, error: anthropicError };
   const boundaryError = blockedModelRedirectsError(value)
+    ?? nativeReasoningRetentionConfigError(value)
+    ?? mainAccountHardLockFallbackError(value)
     ?? compactionRecoveryConfigError(value) ?? desktopCompatibilityConfigError(value) ?? configReasoningPinsConfigError(value)
     ?? blankHostnameError(value)
     ?? (rawSubagentModelForce(value) !== undefined && !isSubagentModelEntry(rawSubagentModelForce(value)) ? "schema_invalid: claudeCode.subagentModelForce: expected a safe roster-style model id" : null)
@@ -710,7 +735,7 @@ export function validateConfigCandidate(value: unknown): { ok: true; config: Ocx
     ?? codexPoolError(value)
     ?? googleAntigravityStaticCatalogVersionError(value)
     ?? codexAccountPrioritiesError(value)
-    ?? codexAccountPriorityFailbackError(value)
+    ?? codexAccountSelectionPreferencesError(value)
     ?? poolCredentialGroupsError(value)
     ?? codexQuotaAutoRefreshError(value)
     ?? codexAccountPickerEnabledError(value)
@@ -719,6 +744,7 @@ export function validateConfigCandidate(value: unknown): { ok: true; config: Ocx
     ?? oauthOpenBrowserError(value)
     ?? showCodexCreditsError(value)
     ?? creditCodexAccountIdsError(value)
+    ?? remainingQuotaAccountIdsError(value)
     ?? runtimeRoleError(value)
     ?? remoteGuiConfigError(value)
     ?? clientConnectionConfigError(value)
@@ -740,6 +766,7 @@ export function validateConfigCandidate(value: unknown): { ok: true; config: Ocx
 export function configDiagnosticsFromRaw(raw: string): ConfigDiagnostics {
   try {
     const parsed = JSON.parse(raw.replace(/^\uFEFF/, ""));
+    sanitizeOpenCodeOverridesForLoad(parsed);
     sanitizeReasoningPinsForLoad(parsed);
     // Same degradation as loadConfig: a hand-edited invalid retryOn429 must not trip the
     // schema and send the caller a default-config fallback (the config command could then

package/src/config/live-reconcile.ts

@@ -1,4 +1,4 @@
-import type { OcxConfig, OcxProviderConfig } from "../types";
+import type { OcxConfig, OcxProviderConfig, ProviderCostOverlay } from "../types";
 import { configReasoningPinsConfigError } from "./provider-validation";
 import { adoptCustomModelCatalogMigration, projectCustomModelCatalogMigration } from "../codex/custom-model-catalog-migration";
 import { refreshPreservedProviderOwner } from "../usage/user-cost-overlays";
@@ -16,7 +16,7 @@ import {
 } from "./rebase-provenance";
 import { withConfigMutationLockSync, bumpGenerationForCooperatingConfigWrite } from "./mutation-lock";
 import { ConfigWritePublishedError, persistConfigUnlocked, readRawConfigJson } from "./persist-unlocked";
-import { configDiagnosticsFromRaw, readConfigDiagnostics } from "./diagnostics";
+import { configDiagnosticsFromRaw, readConfigDiagnostics, validateConfigCandidate } from "./diagnostics";
 import { normalizePersistedClaudeCode } from "./load-degrade";
 import { reconcileApiKeys } from "./api-key-reconcile";
 import { captureLiveTopologyBaseline, LIVE_TOPOLOGY_KEYS, projectLiveTopology } from "./live-topology";
@@ -61,6 +61,35 @@ export function adoptPersistedCodexAccountSelection(
   if (baseline) clearConfigTopLevelDeletionIntent(baseline, keys);
 }
 
+type ModelCostReplacement = { provider: string; modelId: string; cost: ProviderCostOverlay | null };
+const modelCostReplacements = new WeakMap<OcxConfig, ModelCostReplacement>();
+
+/** Explicit pricing PUT owns one whole row, even when its base tuple equals the baseline. */
+export function withModelCostRowReplacement(
+  config: OcxConfig, provider: string, modelId: string, cost: ProviderCostOverlay | null, save: () => void,
+): void {
+  const previous = modelCostReplacements.get(config);
+  const replacementCost = structuredClone(cost);
+  if (replacementCost?.promptLengthPricing?.mode === "automatic") delete replacementCost.promptLengthPricing;
+  modelCostReplacements.set(config, { provider, modelId, cost: replacementCost });
+  try { save(); }
+  finally {
+    if (previous) modelCostReplacements.set(config, previous);
+    else modelCostReplacements.delete(config);
+  }
+}
+
+function applyModelCostRowReplacement(config: OcxConfig): void {
+  const replacement = modelCostReplacements.get(config);
+  if (!replacement) return;
+  if (!Object.hasOwn(config.providers, replacement.provider)) throw new Error("pricing provider was removed before persistence");
+  const provider = config.providers[replacement.provider]!;
+  const costs = Object.assign(Object.create(null) as Record<string, ProviderCostOverlay>, provider.modelCosts ?? {});
+  if (replacement.cost === null) delete costs[replacement.modelId];
+  else costs[replacement.modelId] = structuredClone(replacement.cost);
+  provider.modelCosts = costs;
+}
+
 /**
  * Adopt a committed discovery decision and its merge baseline as one synchronous step.
  * Visibility writers assign and save synchronously; any future writer yielding between
@@ -483,6 +512,10 @@ export function saveConfigPreservingClaudeCode(config: OcxConfig): void {
   if (pinError) throw new Error(pinError);
   let published = false;
   const persist = (candidate: OcxConfig): void => {
+    if (modelCostReplacements.has(config)) {
+      const validation = validateConfigCandidate(candidate);
+      if (!validation.ok) throw new Error(validation.error);
+    }
     const changed = persistConfigUnlocked(candidate);
     published = true;
     if (changed) bumpGenerationForCooperatingConfigWrite();
@@ -544,6 +577,9 @@ export function saveConfigPreservingClaudeCode(config: OcxConfig): void {
       }
     }
     applyConfigObjectChildDeletions(config, childDeletions);
+    // Recursive three-way merging preserves sibling rows; explicit PUT/reset
+    // replaces only its model after merging, including absent policy fields.
+    applyModelCostRowReplacement(config);
     if (claudeCodeBaseline.has(config)) {
       if (onDisk !== undefined) {
         const baseline = claudeCodeBaseline.get(config);

package/src/config/load-degrade.ts

@@ -3,12 +3,15 @@ import { isSubagentModelEntry, rawSubagentModelForce } from "./subagent-models";
 import { chmodSync, existsSync } from "node:fs";
 import { join } from "node:path";
 import { compactionRecoveryConfigError } from "./schema/compaction-recovery";
+import { nativeReasoningRetentionConfigError } from "./schema/native-reasoning-retention";
 import { desktopCompatibilityConfigError } from "./schema/desktop-compatibility";
 import { blockedModelRedirectsError } from "./schema/blocked-model-redirects";
+import { mainAccountHardLockFallbackError } from "./schema/main-account-hard-lock-fallback";
 import { anthropicSidecarConfigError } from "./schema/anthropic-account-pool";
 import {
   modelPinnedEffortsConfigError,
   pinnedReasoningEffortConfigError,
+  autoReviewOverrideConfigError,
   autoReviewModelOverridesConfigError,
   autoReviewModelTargetConfigError,
   modelCapabilitiesConfigError,
@@ -131,10 +134,14 @@ export function warnDegradedCompactionRouting(rawParsed: unknown, validated: Ocx
  * the ratchet only ever moves down: a per-block call there costs a line the file does not have.
  */
 export function warnDegradedTopLevelOptIns(rawParsed: unknown, validated: OcxConfig): void {
+  if (nativeReasoningRetentionConfigError(rawParsed)) console.warn("⚠️  invalid nativeReasoningRetention disabled; model and account switch allowances remain off");
   setCodexWsReuseAcrossTurns(validated.codexWsReuseAcrossTurns === true);
+  const retentionWarning = degradedReasoningRetentionWarning(rawParsed, validated);
+  if (retentionWarning) console.warn(retentionWarning);
   if (compactionRecoveryConfigError(rawParsed)) console.warn("⚠️  invalid compactionRecovery disabled; the original compaction failure is preserved");
   if (desktopCompatibilityConfigError(rawParsed)) console.warn("Invalid desktopCompatibility startup preference ignored; no desktop compatibility service will start automatically.");
   if (blockedModelRedirectsError(rawParsed)) console.warn("⚠️  invalid blockedModelRedirects ignored; provider routing remains available");
+  if (mainAccountHardLockFallbackError(rawParsed)) console.warn("⚠️  invalid codexMainAccountHardLockFallback ignored; the main-account hard lock still refuses while blocked");
   const chatgptDesktop = chatgptDesktopConfigIssue(rawParsed);
   if (chatgptDesktop) console.warn(`⚠️  config.json ${chatgptDesktop} — the whole chatgptDesktop block is ignored, so the ChatGPT desktop integration reads as off`);
   warnDegradedStreamMode(rawParsed, validated);
@@ -147,6 +154,11 @@ export function warnDegradedTopLevelOptIns(rawParsed: unknown, validated: OcxCon
   }
 }
 
+export function degradedReasoningRetentionWarning(rawParsed: unknown, validated: OcxConfig): string | null {
+  if (rawConfigRecord(rawParsed)?.reasoningRetention === undefined || validated.reasoningRetention !== undefined) return null;
+  return "config.json reasoningRetention is invalid — reasoning retention is disabled";
+}
+
 /**
  * A malformed `memoryModels` phase disables that phase rather than failing the whole schema, so
  * say so once: silently keeping whatever route the phase already had — which may be the shadow
@@ -411,6 +423,11 @@ export function sanitizeModelCostsForLoad(parsed: unknown): void {
 export function sanitizeAutoReviewForLoad(parsed: unknown): void {
   if (!parsed || typeof parsed !== "object") return;
   const root = parsed as Record<string, unknown>;
+  if (root.autoReviewOverride !== undefined
+    && autoReviewOverrideConfigError(root.autoReviewOverride) !== null) {
+    console.warn("⚠️  config.json autoReviewOverride is invalid — ignoring the override");
+    delete root.autoReviewOverride;
+  }
   const providers = root.providers;
   if (!providers || typeof providers !== "object" || Array.isArray(providers)) return;
   for (const [name, providerValue] of Object.entries(providers as Record<string, unknown>)) {

package/src/config/opencode-wire-upgrade.ts

@@ -0,0 +1,54 @@
+import { OPENCODE_GO_LEGACY_NAME_PINS } from "../types/opencode-go";
+import { captureWireAdapterHardPins } from "../types/wire";
+import { declaredUnsupportedHostedTools, isHostedToolUnsupportedForModel } from "../responses/hosted-tool-policy";
+import { sanitizeOpenCodeZenOverridesForLoad } from "./opencode-zen-upgrade";
+
+function record(value: unknown): Record<string, unknown> | undefined {
+  return value !== null && typeof value === "object" && !Array.isArray(value)
+    ? value as Record<string, unknown> : undefined;
+}
+
+/** File reads alone repair overrides admitted before OpenCode's native-wire upgrade. */
+export function sanitizeOpenCodeOverridesForLoad(parsed: unknown): void {
+  sanitizeOpenCodeZenOverridesForLoad(parsed);
+  const providers = record(record(parsed)?.providers);
+  const provider = providers && Object.hasOwn(providers, "opencode-go")
+    ? record(providers["opencode-go"]) : undefined;
+  if (!provider) return;
+  // Use validation's destination/auth rules, including the Go preset's fixed URL.
+  const pins = captureWireAdapterHardPins("opencode-go", provider);
+  const newlyPinned = (model: string): boolean => Object.hasOwn(pins, model)
+    && !OPENCODE_GO_LEGACY_NAME_PINS.has(model);
+  const overrides = record(provider.modelAdapters) ?? {};
+  const preferences = record(provider.modelPreferHostedTools);
+  let preferencesChanged = false;
+  if (preferences) {
+    const unsupported = declaredUnsupportedHostedTools(provider as { unsupportedHostedTools?: readonly string[] });
+    for (const [model, tools] of Object.entries(preferences)) {
+      // Go's registry owns the old provider-wide Chat wire. Only an explicit
+      // Responses override could previously make these native models eligible.
+      if (!newlyPinned(model.trim()) || overrides[model] !== "openai-responses"
+        || !Array.isArray(tools) || tools.length === 0 || tools.some(tool => tool !== "image_generation")
+        || isHostedToolUnsupportedForModel(model, "image_generation", undefined, unsupported)) continue;
+      delete preferences[model];
+      preferencesChanged = true;
+    }
+    if (preferencesChanged && Object.keys(preferences).length === 0) delete provider.modelPreferHostedTools;
+  }
+  let overridesChanged = false;
+  for (const [model, adapter] of Object.entries(overrides)) {
+    // Leave malformed or previously incompatible preferences visible on every pass.
+    if (preferences && Object.hasOwn(preferences, model)) continue;
+    if (newlyPinned(model.trim()) && (adapter === "openai-chat" || adapter === "openai-responses")) {
+      delete overrides[model];
+      overridesChanged = true;
+    }
+  }
+  if (overridesChanged) {
+    if (Object.keys(overrides).length === 0) delete provider.modelAdapters;
+    console.warn("OpenCode Go native models now use their required APIs; obsolete Chat/Responses overrides were ignored while loading config.json.");
+  }
+  if (preferencesChanged) {
+    console.warn("OpenCode Go native models now use their required APIs; legacy Responses-only hosted-tool preferences were ignored while loading config.json.");
+  }
+}

package/src/config/opencode-zen-upgrade.ts

@@ -0,0 +1,53 @@
+import { openCodeZenBaseUrl, openCodeZenKeyBaseUrl, type OpenCodeZenDestination } from "../types/opencode-zen";
+import { declaredUnsupportedHostedTools, isHostedToolUnsupportedForModel } from "../responses/hosted-tool-policy";
+
+function record(value: unknown): Record<string, unknown> | undefined {
+  return value !== null && typeof value === "object" && !Array.isArray(value)
+    ? value as Record<string, unknown> : undefined;
+}
+
+function isNativeZenModel(model: string, provider: OpenCodeZenDestination): boolean {
+  const folded = model.trim().toLowerCase();
+  return folded.startsWith("claude-") || (folded.startsWith("gemini-") && openCodeZenBaseUrl(provider) !== undefined);
+}
+
+/** Repair legacy Zen wire overrides and dependent preferences in file-backed reads only. */
+export function sanitizeOpenCodeZenOverridesForLoad(parsed: unknown): void {
+  const providers = record(record(parsed)?.providers);
+  const provider = providers && Object.hasOwn(providers, "opencode-zen")
+    ? record(providers["opencode-zen"]) : undefined;
+  if (!provider || !openCodeZenKeyBaseUrl(provider)) return;
+  const overrides = record(provider.modelAdapters) ?? {};
+  const preferences = record(provider.modelPreferHostedTools);
+  let preferencesChanged = false;
+  if (preferences) {
+    const unsupported = declaredUnsupportedHostedTools(provider as { unsupportedHostedTools?: readonly string[] });
+    for (const [model, tools] of Object.entries(preferences)) {
+      // Capture the old wire before deleting overrides. An explicit non-Responses entry
+      // must not inherit a provider-wide Responses default for this migration.
+      const oldAdapter = Object.hasOwn(overrides, model) ? overrides[model] : provider.adapter;
+      if (!isNativeZenModel(model, provider) || oldAdapter !== "openai-responses"
+        || !Array.isArray(tools) || tools.length === 0 || tools.some(tool => tool !== "image_generation")
+        || isHostedToolUnsupportedForModel(model, "image_generation", undefined, unsupported)) continue;
+      delete preferences[model];
+      preferencesChanged = true;
+    }
+    if (preferencesChanged && Object.keys(preferences).length === 0) delete provider.modelPreferHostedTools;
+  }
+  let overridesChanged = false;
+  for (const [model, adapter] of Object.entries(overrides)) {
+    // Retain invalid preference/wire pairs so repeated normalization cannot admit them.
+    if (preferences && Object.hasOwn(preferences, model)) continue;
+    if (isNativeZenModel(model, provider) && (adapter === "openai-chat" || adapter === "openai-responses")) {
+      delete overrides[model];
+      overridesChanged = true;
+    }
+  }
+  if (overridesChanged) {
+    if (Object.keys(overrides).length === 0) delete provider.modelAdapters;
+    console.warn("OpenCode Zen Gemini and Claude models now use their native APIs; obsolete Chat/Responses overrides were ignored while loading config.json.");
+  }
+  if (preferencesChanged) {
+    console.warn("OpenCode Zen Gemini and Claude models now use their native APIs; legacy Responses-only hosted-tool preferences were ignored while loading config.json.");
+  }
+}

package/src/config/owner-registry.ts

@@ -24,21 +24,19 @@
  */
 
 import { createHash } from "node:crypto";
-import { chmodSync, existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, statSync, unlinkSync } from "node:fs";
+import { chmodSync, existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, realpathSync, statSync, unlinkSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { atomicWriteFileNoFollow } from "./atomic-write";
 import { getConfigDir } from "./paths";
-import { assertNotRealHomeUnderTest } from "../lib/test-home-guard";
+import { assertNotRealHomeUnderTest, isTestHomeGuardArmed } from "../lib/test-home-guard";
 import { hardenSecretDir } from "../lib/windows-secret-acl";
 
 const REGISTRY_DIR_NAME = "ocx-homes";
 /**
- * Test seam, not a user knob: os.homedir() resolves the passwd database on POSIX,
- * so rewriting HOME inside a test process cannot move the anchor and the armed
- * test-home guard would rightly refuse the write. Suites point this at their own
- * fixture home; production always leaves it unset so the default home stays the
- * one locator every sibling can find.
+ * Test seam, not a user knob. The sandbox pins this for inherited child environments;
+ * guarded callers without it use their selected config home. Production leaves it
+ * unset so the default home stays the one locator every sibling can find.
  */
 const REGISTRY_DIR_ENV = "OCX_OWNER_REGISTRY_DIR";
 const REGISTRY_ENTRY_SUFFIX = ".json";
@@ -60,8 +58,23 @@ function registryBaseDir(): string {
 /** The shared directory the registry lives under. */
 export function ownerRegistryDir(): string {
   const override = process.env[REGISTRY_DIR_ENV]?.trim();
-  if (override) return resolve(override);
-  return join(registryBaseDir(), REGISTRY_DIR_NAME);
+  const dir = override ? resolve(override)
+    : join(isTestHomeGuardArmed() ? getConfigDir() : registryBaseDir(), REGISTRY_DIR_NAME);
+  // Bun caches the startup home, so HOME rewrites cannot isolate this anchor.
+  // Check reads and removals too, including an inherited override or symlink that
+  // points back into the protected home. An unpinned guarded caller fails closed.
+  if (isTestHomeGuardArmed()) {
+    for (let ancestor = dir; ;) {
+      assertNotRealHomeUnderTest(ancestor);
+      // Follow an existing alias before walking parents; missing children reach
+      // their nearest existing ancestor on the next iterations.
+      try { ancestor = realpathSync.native(ancestor); } catch { /* not created yet */ }
+      const parent = dirname(ancestor);
+      if (parent === ancestor) break;
+      ancestor = parent;
+    }
+  }
+  return dir;
 }
 
 function registryEntryPath(dir: string, home: string): string {
@@ -76,14 +89,6 @@ function registryEntryPath(dir: string, home: string): string {
 export function registerOwnerRegistryHome(home: string): void {
   try {
     const dir = ownerRegistryDir();
-    // Guard every ancestor of the write target: an override that still resolves
-    // under the protected ~/.opencodex must not slip past the test home guard.
-    for (let ancestor = dir; ;) {
-      assertNotRealHomeUnderTest(ancestor);
-      const parent = dirname(ancestor);
-      if (parent === ancestor) break;
-      ancestor = parent;
-    }
     mkdirSync(dir, { recursive: true, mode: 0o700 });
     // This locator contains no secret, but its deterministic entry names must not
     // give another local user a place to plant a destination symlink. Refuse a

package/src/config/provider-validation.ts

@@ -1,4 +1,5 @@
 import { isCanonicalOpenAiForwardProvider } from "../providers/openai-tiers";
+import { resolveDshAccountMessagesUrl } from "../providers/dsh-account-destination";
 import { redactSecretString } from "../lib/redact";
 import {
   isValidModelDiscoveryModelId,
@@ -256,10 +257,11 @@ export function autoReviewModelTargetConfigError(
   field = "autoReviewModel",
   allowClear = false,
 ): string | null {
-  if (value === undefined || (allowClear && (value === null || value === ""))) return null;
+  if (value === undefined || (allowClear && value === null)) return null;
   if (typeof value !== "string") return `${field} must be a string`;
   const trimmed = value.trim();
-  if (!trimmed) return `${field} must be nonblank`;
+  // `allowClear` callers trim then delete, so whitespace-only is a clear, not a blank selector.
+  if (!trimmed) return allowClear ? null : `${field} must be nonblank`;
   if (trimmed.length > 1024 || AUTO_REVIEW_MODEL_CONTROL_CHARS.test(trimmed)) {
     return `${field} must be a catalog selector without whitespace or control characters`;
   }
@@ -271,6 +273,26 @@ export function isValidAutoReviewModel(value: unknown): value is string {
   return typeof value === "string" && autoReviewModelTargetConfigError(value) === null;
 }
 
+/**
+ * Validate the global auto-review override block the Models settings panel writes.
+ *
+ * `enabled` is optional so a save may carry only the model during an edit; `model` follows the
+ * same selector rules as the provider-scoped field, and an empty value clears the override.
+ */
+export function autoReviewOverrideConfigError(value: unknown, field = "autoReviewOverride"): string | null {
+  if (value === undefined || value === null) return null;
+  if (!value || typeof value !== "object" || Array.isArray(value)) return `${field} must be a plain object`;
+  const prototype = Object.getPrototypeOf(value);
+  if (prototype !== Object.prototype && prototype !== null) {
+    return `${field} must be a plain object with own properties`;
+  }
+  const block = value as Record<string, unknown>;
+  if (block.enabled !== undefined && typeof block.enabled !== "boolean") {
+    return `${field}.enabled must be a boolean`;
+  }
+  return autoReviewModelTargetConfigError(block.model, `${field}.model`, true);
+}
+
 /** Canonical model key used for map matching, duplicate detection, and route tombstones. */
 export function canonicalAutoReviewModelKey(modelId: string): string {
   return encodeRoutedModelId(modelId.trim());
@@ -390,6 +412,27 @@ export function modelAdapterRecordConfigError(
 }
 
 
+/**
+ * The `dsh-account` row owns the DeepSeek Harness account token, which every helper resolves by this
+ * provider name. Keeping the row on its own adapter and DeepSeek's Anthropic host means no generic
+ * helper (Anthropic sidecars, discovery, probes) can be pointed at another destination with it.
+ */
+export function credentialPinnedProviderConfigError(
+  providerName: string,
+  provider: { adapter?: unknown; baseUrl?: unknown },
+): string | null {
+  if (providerName !== "dsh-account") return null;
+  if (provider.adapter !== undefined && provider.adapter !== "dsh-account") {
+    return 'adapter must stay "dsh-account": its account token is pinned to that adapter';
+  }
+  if (typeof provider.baseUrl === "string") {
+    try { resolveDshAccountMessagesUrl(provider.baseUrl); } catch {
+      return "baseUrl must stay on https://api.deepseek.com/anthropic: its account token is pinned to that host";
+    }
+  }
+  return null;
+}
+
 function capabilityRecord(value: unknown): value is Record<string, unknown> {
   return value !== null && typeof value === "object" && !Array.isArray(value)
     && [Object.prototype, null].includes(Object.getPrototypeOf(value));

package/src/config/schema/config-schema.ts

@@ -1,9 +1,12 @@
 import { MAIN_ACCOUNT_HARD_LOCK_MIN_PERCENT } from "../../codex/quota-types";
+import { validRemainingQuotaAccountIds } from "../../codex/account-use-remaining";
 import * as z from "zod/v4";
 import { anthropicAccountPoolSchema } from "./anthropic-account-pool";
 import { compactionRecoverySchema } from "./compaction-recovery";
+import { nativeReasoningRetentionSchema } from "./native-reasoning-retention";
 import { desktopCompatibilitySchema } from "./desktop-compatibility";
 import { blockedModelRedirectsSchema } from "./blocked-model-redirects";
+import { mainAccountHardLockFallbackSchema } from "./main-account-hard-lock-fallback";
 import {
   agentTaskRecoverySchema,
   catalogAutoRefreshSchema,
@@ -29,7 +32,9 @@ import {
   CODEX_ACCOUNT_NAMESPACE_ACCOUNT_ID_COLLISION_ERROR,
   codexAccountNamespacesSchema,
   modelPinnedEffortsSchema,
+  autoReviewOverrideSchema,
   compactionRoutingSchema,
+  reasoningRetentionSchema,
   memoryModelSettingSchema,
   memoryModelsSchema,
   modelPreferHostedToolsConfigError,
@@ -49,6 +54,7 @@ import {
   providerHeadersConfigError,
   providerForwardClientHeadersConfigError,
   reasoningSummaryDeliveryRecordConfigError,
+  credentialPinnedProviderConfigError,
 } from "../provider-validation";
 import {
   CODEX_ACCOUNT_NAMESPACE_COMBO_ALIAS_COLLISION_ERROR,
@@ -190,9 +196,15 @@ export const configSchema = z.object({
     z.object({ enabled: z.literal(true), port: z.number().int().min(1).max(65535).optional() }),
   ]).optional().catch(undefined),
   providers: z.record(z.string(), providerConfigSchema),
+  // Models settings panel writes the global reviewer override; an invalid hand edit is
+  // stripped by load degradation so it cannot reject the providers that carry it.
+  autoReviewOverride: autoReviewOverrideSchema.optional(),
   modelPinnedEfforts: modelPinnedEffortsSchema.optional(),
   compactionRouting: compactionRoutingSchema.optional().catch(undefined),
   compactionRecovery: compactionRecoverySchema.optional().catch(undefined),
+  // A bad hand edit disables only this block; writes validate the catch-free leaf first.
+  reasoningRetention: reasoningRetentionSchema.optional().catch(undefined),
+  nativeReasoningRetention: nativeReasoningRetentionSchema.optional().catch(undefined),
   desktopCompatibility: desktopCompatibilitySchema.optional().catch(undefined),
   // A hand-edited malformed phase disables only that phase instead of rejecting
   // providers/apiKeys, matching the load-time degradation notice; the management write
@@ -207,6 +219,7 @@ export const configSchema = z.object({
     .catch(undefined),
   defaultProvider: z.string().min(1).default("openai"),
   defaultModelAliases: z.boolean().optional(),
+  preferModelAliasIds: z.boolean().optional().catch(false),
   // Malformed hand edits disable this opt-in projection without rejecting providers.
   cursorEffortRows: z.boolean().optional().catch(false),
   // Fast selectors default on; malformed hand edits disable them without rejecting providers.
@@ -221,6 +234,9 @@ export const configSchema = z.object({
     short: z.number().int().min(MAIN_ACCOUNT_HARD_LOCK_MIN_PERCENT).max(100).optional().catch(undefined),
     long: z.number().int().min(MAIN_ACCOUNT_HARD_LOCK_MIN_PERCENT).max(100).optional().catch(undefined),
   }).optional().catch(undefined),
+  // A malformed fallback section disables only the reroute, never the lock's refusal
+  // behavior; the management write boundary still rejects the bad value.
+  codexMainAccountHardLockFallback: mainAccountHardLockFallbackSchema.optional().catch(undefined),
   // #2999: a malformed hand edit falls back to auto detection rather than rejecting the config.
   nativeMainRefresh: z.enum(["codex", "opencodex"]).optional().catch(undefined),
   // Future versions remain opaque through passthrough-compatible whole-config saves.
@@ -292,6 +308,7 @@ export const configSchema = z.object({
   // so a hand-edited typo cannot trip the backup-and-defaults repair path; the write path rejects
   // it (creditCodexAccountIdsError in diagnostics).
   creditCodexAccountIds: z.array(z.string().regex(/^[a-zA-Z0-9._-]{1,64}$/)).optional().catch(undefined),
+  codexUseRemainingQuotaAccountIds: z.custom<string[]>(validRemainingQuotaAccountIds).optional().catch(undefined),
   // A malformed policy degrades to "no policy" rather than failing the parse, so a hand-edited
   // typo cannot trip the backup-and-defaults repair path and wipe providers or pool accounts.
   // Silently ignoring it would be its own trap, so the write path rejects it and loadConfig warns.
@@ -307,6 +324,7 @@ export const configSchema = z.object({
   codexAccountAutoSwitchThresholds: z.unknown().optional().transform(salvageCodexAccountAutoSwitchThresholds),
   // An invalid optional preference must not discard providers or credential rows.
   codexAccountPriorityFailback: z.boolean().optional().catch(false),
+  codexPreserveSignedInAccount: z.boolean().optional().catch(false),
   // Absent or invalid keeps the sliding window on. Explicit false restores consecutive-only steering.
   codexFailureWindow: z.boolean().optional().catch(undefined),
   codexPinnedTransientPolicy: z.enum(["hold", "detour-new-threads"]).optional().catch("hold"),
@@ -594,6 +612,10 @@ export const configSchema = z.object({
         message: modelAdaptersError,
       });
     }
+    const credentialPinError = credentialPinnedProviderConfigError(name, provider);
+    if (credentialPinError) {
+      ctx.addIssue({ code: "custom", path: ["providers", redactSecretString(name)], message: credentialPinError });
+    }
     const preferHostedToolsError = modelPreferHostedToolsConfigError(
       (provider as { modelPreferHostedTools?: unknown }).modelPreferHostedTools,
       "modelPreferHostedTools",