@bitkyc08/opencodex 2.86.0 → 2.88.0

package/src/config/schema/leaf-validators.ts

@@ -6,6 +6,7 @@ import {
   modelPinnedEffortsConfigError,
   pinnedReasoningEffortConfigError,
   modelDisplayNamesConfigError,
+  autoReviewOverrideConfigError,
   autoReviewModelOverridesConfigError,
   autoReviewModelTargetConfigError,
   normalizeNonBlankStringArray,
@@ -28,13 +29,14 @@ import {
   PROVIDER_WEB_SEARCH_BRIDGE_BACKENDS,
   UPSTREAM_HTTP_VERSION_VALUES,
   type OcxProviderConfig,
+  type OcxConfig,
   type FastWire,
   type ProviderCostOverlay,
 } from "../../types";
 import { fastWireDeclarationError } from "../../providers/fastwire";
 import { getProviderRegistryEntry, providerMatchesRegistryTransport, providerModelWireDefault } from "../../providers/registry";
 import { resolveOpenAiVirtualModel } from "../../providers/openai-virtual-models";
-import { COST4_RATE_KEYS, isValidCost4Rate } from "../../usage/user-cost-overlays";
+import { COST4_RATE_KEYS, isValidCost4Rate, isValidPromptLengthPricing, copyPromptLengthPricing } from "../../usage/user-cost-overlays";
 import { MAX_COST4_RATE } from "../../usage/expected-prices";
 import {
   DECLARABLE_HOSTED_TOOL_TYPES,
@@ -63,6 +65,12 @@ export const compactionRoutingSchema = z.object({
     .optional(),
 }).strict();
 
+export const reasoningRetentionSchema = z.object({
+  enabled: z.boolean().optional(),
+  maxContextPercent: z.number().gt(0).max(100).optional(),
+  maxTokens: z.number().int().positive().optional(),
+}).strict();
+
 /**
  * One phase of Codex's memory pipeline. A present phase must name a model: the GUI's "Off"
  * removes the phase instead of blanking it, so an empty entry would only ever come from a
@@ -133,12 +141,15 @@ const requestPacingSchema = z.object({
   minIntervalMs: z.number().int().min(1).max(3_600_000).optional(),
   maxConcurrentRequests: z.number().int().min(1).optional(),
   models: z.record(z.string().trim().min(1), requestPacingRuleSchema).optional(),
+  keySelection: z.enum(["active", "round-robin"]).optional(),
+  keys: requestPacingRuleSchema.optional(),
 }).strict().refine(value => value.enabled === false
   || value.requestsPerMinute !== undefined
   || value.minIntervalMs !== undefined
   || value.maxConcurrentRequests !== undefined
+  || value.keys !== undefined || value.keySelection === "round-robin"
   || (value.models !== undefined && Object.keys(value.models).length > 0), {
-  message: "enabled request pacing needs a provider rule or model override",
+  message: "enabled request pacing needs a provider, model, or key rule, or round-robin selection",
 });
 
 export function requestPacingConfigError(value: unknown): string | null {
@@ -257,6 +268,12 @@ const autoReviewModelOverridesSchema = z.unknown().superRefine((value, ctx) => {
   if (error) ctx.addIssue({ code: "custom", message: error });
 }).transform(value => normalizeAutoReviewModelOverrides(value));
 
+/** Global auto-review override block; a malformed hand edit is stripped by load degradation. */
+export const autoReviewOverrideSchema = z.unknown().superRefine((value, ctx) => {
+  const error = autoReviewOverrideConfigError(value, "autoReviewOverride");
+  if (error) ctx.addIssue({ code: "custom", message: error });
+}).transform(value => value as NonNullable<OcxConfig["autoReviewOverride"]>);
+
 const modelCapabilitiesSchema = z.unknown().superRefine((value, ctx) => {
   const error = modelCapabilitiesConfigError(value);
   if (error) ctx.addIssue({ code: "custom", message: error });
@@ -337,9 +354,12 @@ export const providerConfigSchema = z.object({
   preserveResponsesReasoningContent: z.boolean().optional(),
   preserveResponsesInputItemIds: z.boolean().optional(),
   preserveResponsesMessageMetadata: z.boolean().optional(),
+  projectResponsesLiteHostedSearchHistory: z.boolean().optional(),
   dropResponsesReasoningItems: z.boolean().optional(),
   modelReasoningEffortsAuthoritative: z.boolean().optional(),
   decodesNativeCompactionBlobs: z.boolean().optional(),
+  supportsNativeCompactionTrigger: z.boolean().optional(),
+  supportsNativeCompactEndpoint: z.boolean().optional(),
   allowEncryptedV2AgentTasks: z.boolean().optional(),
   allowPrivateNetwork: z.boolean().optional(),
   // Per-provider egress (#2894): absent inherits the global proxy decision, "direct"/null
@@ -423,7 +443,7 @@ export { providerRelativeSendPathConfigError } from "../provider-relative-send-p
 
 /**
  * Validate `providers.<name>.modelCosts`: a plain object keyed by exact model
- * id, each value a 4-tuple of non-negative finite USD-per-1M-token rates.
+ * id, each value four USD-per-1M-token rates and an optional prompt-length policy.
  * Returns null when valid/absent, else a human-readable error.
  */
 export function providerModelCostsConfigError(value: unknown, field = "modelCosts"): string | null {
@@ -443,25 +463,28 @@ export function providerModelCostsConfigError(value: unknown, field = "modelCost
     const rates = entry as Record<string, unknown>;
     for (const key of COST4_RATE_KEYS) {
       const rate = rates[key];
-      if (!isValidCost4Rate(rate)) {
+      if (!Object.hasOwn(rates, key) || !isValidCost4Rate(rate)) {
         return `${field}.${safeModelId}.${key} must be a non-negative finite number at most ${MAX_COST4_RATE} (USD per 1M tokens)`;
       }
     }
+    if (Object.hasOwn(rates, "promptLengthPricing") && !isValidPromptLengthPricing(rates.promptLengthPricing)) {
+      return `${field}.${safeModelId}.promptLengthPricing must be automatic, flat, or a complete custom policy with a positive safe-integer thresholdTokens, gt/gte comparison, and four valid rates`;
+    }
     // Reject unknown fields: a misplaced apiKey/apiKeyPool under a cost row
     // would otherwise be persisted and echoed verbatim by display paths that
     // mask only top-level provider secrets.
     const extraKeys = Object.keys(rates)
-      .filter((key) => !(COST4_RATE_KEYS as readonly string[]).includes(key));
+      .filter((key) => key !== "promptLengthPricing" && !(COST4_RATE_KEYS as readonly string[]).includes(key));
     if (extraKeys.length > 0) {
-      return `${field}.${safeModelId} has unexpected fields ${JSON.stringify(extraKeys.map(redactSecretString).join(", "))} — only input, output, cacheRead, and cacheWrite are allowed (USD per 1M tokens)`;
+      return `${field}.${safeModelId} has unexpected fields ${JSON.stringify(extraKeys.map(redactSecretString).join(", "))} — only input, output, cacheRead, cacheWrite, and promptLengthPricing are allowed (USD per 1M tokens)`;
     }
   }
   return null;
 }
 
 /**
- * Serialize `providers.<name>.modelCosts` for display: copy ONLY the four
- * numeric rate fields per model and DROP secret-shaped model ids, so a pasted
+ * Serialize `providers.<name>.modelCosts` for display: copy the four validated
+ * rates and complete validated policy and DROP secret-shaped model ids, so a pasted
  * API key in a key position cannot be echoed back by CLI/DTO display paths.
  * The result uses a null prototype so "__proto__" remains an own row.
  */
@@ -471,6 +494,7 @@ export function sanitizeModelCostsForDisplay(costs: unknown): Record<string, Pro
   for (const [modelId, entry] of Object.entries(costs)) {
     if (!entry || typeof entry !== "object" || Array.isArray(entry)) continue;
     const rates = entry as Record<string, unknown>;
+    if (Object.hasOwn(rates, "promptLengthPricing") && !isValidPromptLengthPricing(rates.promptLengthPricing)) continue;
     const input = rates.input;
     const output = rates.output;
     const cacheRead = rates.cacheRead;
@@ -484,7 +508,10 @@ export function sanitizeModelCostsForDisplay(costs: unknown): Record<string, Pro
       // Secret-shaped ids are DROPPED rather than mapped to "[REDACTED]" so
       // distinct rows cannot collapse into one placeholder key.
       if (redactSecretString(modelId) !== modelId) continue;
-      out[modelId] = { input, output, cacheRead, cacheWrite };
+      const policy = isValidPromptLengthPricing(rates.promptLengthPricing)
+        ? copyPromptLengthPricing(rates.promptLengthPricing) : undefined;
+      out[modelId] = { input, output, cacheRead, cacheWrite,
+        ...(policy ? { promptLengthPricing: policy } : {}) };
     }
   }
   return Object.keys(out).length > 0 ? out : undefined;
@@ -794,6 +821,8 @@ export const apiKeyEntrySchema = z.object({
   // rather than promoting it.
   allowedProviders: z.array(z.string().trim().min(1).max(256)).optional(),
   allowedModels: z.array(z.string().trim().min(1).max(256)).optional(),
+  // Not `.catch`ed for the same reason: a damaged value must not grant metered spend.
+  allowMeteredComboTargets: z.boolean().optional(),
 }).passthrough();
 
 /**

package/src/config/schema/main-account-hard-lock-fallback.ts

@@ -0,0 +1,26 @@
+import * as z from "zod/v4";
+import { pinnedReasoningEffortConfigError } from "../provider-validation";
+
+/**
+ * Extended settings of the main-account hard lock (`codexMainAccountHardLockFallback`):
+ * while the lock blocks, a qualifying Codex-native request reroutes to `model` instead of
+ * failing. The dashboard row keeps the configured model when the switch is off, so
+ * `enabled: false` is a remembered pause, not a cleared setting; an absent section, an
+ * absent model, and a malformed section all mean the same thing — the lock refuses,
+ * exactly as it does today.
+ */
+export const mainAccountHardLockFallbackSchema = z.object({
+  enabled: z.boolean().optional(),
+  model: z.string().refine(model => model.length > 0 && model === model.trim() && !/\s/.test(model)),
+  reasoningEffort: z.string().refine(value => pinnedReasoningEffortConfigError(value) === null).optional(),
+}).strict();
+
+/** Candidate writes must reject sections the read schema would silently discard. */
+export function mainAccountHardLockFallbackError(value: unknown): string | undefined {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return undefined;
+  const raw = (value as Record<string, unknown>).codexMainAccountHardLockFallback;
+  if (raw === undefined) return undefined;
+  return mainAccountHardLockFallbackSchema.safeParse(raw).success
+    ? undefined
+    : "schema_invalid: codexMainAccountHardLockFallback requires a nonblank model selector and an optional declared reasoningEffort";
+}

package/src/config/schema/native-reasoning-retention.ts

@@ -0,0 +1,26 @@
+import * as z from "zod/v4";
+import type { OcxConfig } from "../../types";
+
+/** Opt-in allowances for canonical ChatGPT reasoning replay; absence keeps existing cleanup. */
+export const nativeReasoningRetentionSchema = z.object({
+  modelSwitch: z.boolean().optional(),
+  accountSwitch: z.boolean().optional(),
+}).strict();
+
+export function nativeReasoningRetentionConfigError(value: unknown): string | null {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const retention = (value as Record<string, unknown>).nativeReasoningRetention;
+  return retention === undefined || nativeReasoningRetentionSchema.safeParse(retention).success
+    ? null : "schema_invalid: nativeReasoningRetention: accepts only optional boolean modelSwitch and accountSwitch fields";
+}
+
+/** Resolve malformed synthetic inputs the same way as degraded disk config: both off. */
+export function resolveNativeReasoningRetention(
+  config: Pick<OcxConfig, "nativeReasoningRetention">,
+): { modelSwitch: boolean; accountSwitch: boolean } {
+  const parsed = nativeReasoningRetentionSchema.safeParse(config.nativeReasoningRetention);
+  return {
+    modelSwitch: parsed.success && parsed.data.modelSwitch === true,
+    accountSwitch: parsed.success && parsed.data.accountSwitch === true,
+  };
+}

package/src/config.ts

@@ -162,6 +162,7 @@ import { persistConfigUnlocked, readRawConfigJson } from "./config/persist-unloc
 import { withConfigMutationLockSync, bumpGenerationForCooperatingConfigWrite } from "./config/mutation-lock";
 import { getDefaultConfig } from "./config/proxy-env";
 import { configSchema } from "./config/schema/config-schema";
+import { sanitizeOpenCodeOverridesForLoad } from "./config/opencode-wire-upgrade";
 import {
   hardenExistingSecret,
   normalizeApiKeyIds,
@@ -222,6 +223,7 @@ export function loadConfig(): OcxConfig {
   try {
     const raw = readFileSync(configPath, "utf-8").replace(/^\uFEFF/, "");
     const parsed = JSON.parse(raw);
+    sanitizeOpenCodeOverridesForLoad(parsed);
     sanitizeAliasesForLoad(parsed);
     sanitizeReasoningPinsForLoad(parsed);
     sanitizeModelDisplayNamesForLoad(parsed);