@bitkyc08/opencodex 2.86.0 → 2.88.0

package/src/service/launchd.ts

@@ -11,7 +11,7 @@ import { BUN_RUNTIME_PATH_ENV, BUN_RUNTIME_SOURCE_ENV, durableBunRuntime, type D
 import { serviceApiTokenFilePath } from "../lib/service-secrets";
 import { recordOwnedConfigPath } from "../lib/config-ownership";
 import { writeServiceApiTokenFile, assertLiveServiceManagerAllowed } from "./guards";
-import { resolveServiceListenPort, buildServiceShellCommand, buildServiceLauncherShellCommand, installedServiceListenPort, resolvedProxyEnv } from "./health";
+import { resolveServiceListenPort, buildServiceShellCommand, buildServiceLauncherShellCommand, resolvedProxyEnv } from "./definition";
 import { SERVICE_MANAGED_ENV, LABEL, cliEntry, filterTransientServicePath, logPath, serviceStatePath, currentCodexSqliteHomeAbsolute, type ServiceInstallState, writeServiceInstallState, readServiceInstallState } from "./state";
 import { writeServiceDefinitionFile } from "./windows-ops";
 import { readTextOrNull } from "./windows-taskxml";
@@ -359,8 +359,11 @@ export function probeLaunchdLoadState(deps: {
   for (const domain of [`gui/${uid}`, `user/${uid}`]) {
     const printed = run(["print", `${domain}/${LABEL}`]);
     if (printed.status === 0) {
+      // Use this backend's plist, then the configured service port. Foreign artifacts
+      // can exist on macOS: systemdListenPort has no platform gate, so the general
+      // installed-artifact chain could incorrectly select a copied Linux unit's port.
       const expected = (deps.expectedCommand
-        ?? (() => expectedLaunchdCommand(installedServiceListenPort())))();
+        ?? (() => expectedLaunchdCommand(launchdListenPort() ?? resolveServiceListenPort())))();
       const printedText = `${printed.stdout}\n${printed.stderr}`;
       return {
         state: printedText.includes(expected) ? "loaded-current" : "loaded-stale",
@@ -382,8 +385,16 @@ export function probeLaunchdLoadState(deps: {
   return { state: "not-loaded" };
 }
 
-/** Up to ~5 × 200 ms, the launchd twin of the Windows scheduler settle delays. */
-const LAUNCHD_SETTLE_ATTEMPTS = 5;
+/**
+ * Up to 125 × 200 ms = 25 s: long enough for an evicted job to finish EXITING. Measured on
+ * macOS 26: `bootout` returns at once, the label stays registered (`state = SIGTERMed`) until
+ * the process exits, and `bootstrap` fails with 5 for that whole window. The proxy drains on
+ * SIGTERM (`shutdownTimeoutMs`, 5 s default) behind a launcher that waits for it, so a 1 s
+ * settle bootstrapped into that window, the retry and the rollback raced it too, and the old
+ * job then exited leaving nothing loaded. launchd SIGKILLs at its default `ExitTimeOut` of
+ * 20 s, which bounds this wait.
+ */
+const LAUNCHD_SETTLE_ATTEMPTS = 125;
 
 const LAUNCHD_SETTLE_DELAY_MS = 200;
 
@@ -769,6 +780,7 @@ export function restartLaunchdJob(deps: {
 export function startLaunchd(deps: {
   launchctl?: typeof runLaunchctl;
   matches?: typeof launchdJobMatchesPlist;
+  readPlist?: () => string;
 } = {}): void {
   const run = deps.launchctl ?? runLaunchctl;
   const p = plistPath();
@@ -778,16 +790,24 @@ export function startLaunchd(deps: {
   // already be bootstrapped from THIS plist, which is a no-op rather than an error.
   // `install` can assume a stale job (it just rewrote the plist); `start` cannot, and
   // throwing here would break `ocx service start` on every healthy service.
+  // A live job can outlast its deleted or unreadable plist. Only a readable
+  // definition can justify the no-op; use the same snapshot for port parsing.
+  let plist: string | null;
+  try { plist = (deps.readPlist ?? (() => readFileSync(p, "utf8")))(); }
+  catch { plist = null; }
+  // Match the same launchd-only port choice as probeLaunchdLoadState above.
   const live = (deps.matches ?? launchdJobMatchesPlist)(
-    expectedLaunchdCommand(installedServiceListenPort()),
+    expectedLaunchdCommand(launchdListenPort({ readPlist: () => plist ?? "" }) ?? resolveServiceListenPort()),
   );
-  if (live.loaded && live.matchesPlist) {
+  if (plist !== null && live.loaded && live.matchesPlist) {
     console.log("ℹ️  service was already loaded from the current plist; nothing to do.");
     return;
   }
   throw new Error(
     `launchctl could not load ${p}: ${loaded.stderr || "load reported failure"}\n`
-    + (live.loaded
+    + (plist === null
+      ? "The service plist is missing or unreadable. Run 'ocx service repair' to restore it."
+      : live.loaded
       ? `launchd is running an OLDER plist. Fix:\n  launchctl bootout ${launchdGuiDomain()}/${LABEL}\n  ocx service repair`
       : "The job is not loaded. Run 'ocx service repair' to reload it."),
   );

package/src/service/logging.ts

@@ -1,24 +1,81 @@
-import { closeSync, fstatSync, ftruncateSync, openSync, readSync, renameSync, writeSync } from "node:fs";
+import { closeSync, constants, fstatSync, fsyncSync, ftruncateSync, lstatSync, openSync, readSync, realpathSync, renameSync, statSync, writeSync, type BigIntStats } from "node:fs";
 import { formatWithOptions } from "node:util";
-import { dirname } from "node:path";
+import { basename, dirname, join } from "node:path";
 import { recordOwnedConfigPath } from "../lib/config-ownership";
 
 export const SERVICE_LOG_MAX_BYTES = 20 * 1024 * 1024;
 export const SERVICE_LOG_CHECK_INTERVAL_MS = 60_000;
 
+function regularLeaf(path: string): BigIntStats | undefined {
+  try {
+    const info = lstatSync(path, { bigint: true });
+    if (!info.isFile() || info.nlink !== 1n || info.ino === 0n) throw new Error("Unsafe service log leaf");
+    return info;
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined;
+    throw error;
+  }
+}
+
+function sameFile(left: BigIntStats | undefined, right: BigIntStats | undefined): boolean {
+  return left !== undefined && right !== undefined && left.dev === right.dev && left.ino === right.ino;
+}
+
+function matchesDescriptor(path: string, fd: number, expected: BigIntStats): boolean {
+  const info = fstatSync(fd, { bigint: true });
+  return info.isFile() && info.nlink === 1n && sameFile(expected, info)
+    && sameFile(info, regularLeaf(path));
+}
+
 /** Preserve the manager's open append descriptor; retain at most two bounded archives. */
-export function rotateServiceLog(path: string, maxBytes = SERVICE_LOG_MAX_BYTES): boolean {
+export function rotateServiceLog(requestedPath: string, maxBytes = SERVICE_LOG_MAX_BYTES): boolean {
   let source: number | undefined;
   let archive: number | undefined;
   try {
     if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) return false;
-    source = openSync(path, "r+");
-    const size = fstatSync(source).size;
-    if (size <= maxBytes) return false;
-    try { renameSync(`${path}.1`, `${path}.2`); } catch (error) {
-      if ((error as NodeJS.ErrnoException).code !== "ENOENT") return false;
+    // Resolve only the parent: exclusive creation through a Windows junction
+    // can report EEXIST for a missing leaf. Never resolve away a leaf symlink.
+    const parent = dirname(requestedPath);
+    const directory = statSync(parent, { bigint: true });
+    if (!directory.isDirectory() || directory.ino === 0n) return false;
+    const canonicalParent = realpathSync(parent);
+    const path = join(canonicalParent, basename(requestedPath));
+    const sameDirectory = () => {
+      const alias = statSync(parent, { bigint: true });
+      const canonical = statSync(canonicalParent, { bigint: true });
+      return alias.isDirectory() && canonical.isDirectory()
+        && sameFile(directory, alias) && sameFile(directory, canonical);
+    };
+    const matches = (suffix: string, fd: number, expected: BigIntStats) => sameDirectory()
+      && matchesDescriptor(`${path}${suffix}`, fd, expected)
+      && matchesDescriptor(`${requestedPath}${suffix}`, fd, expected);
+    if (!sameDirectory()) return false;
+    const original = regularLeaf(requestedPath);
+    if (!original) return false;
+    // Windows does not expose O_NOFOLLOW: descriptor/leaf identity checks still
+    // apply there. Do not reject legitimate junctions in the home path.
+    const guardedFlags = process.platform === "win32" ? 0 : constants.O_NOFOLLOW | constants.O_NONBLOCK;
+    source = openSync(path, constants.O_RDWR | guardedFlags);
+    if (!matches("", source, original)) return false;
+    const size = Number(fstatSync(source, { bigint: true }).size);
+    if (!Number.isSafeInteger(size) || size <= maxBytes) return false;
+    const previous = regularLeaf(`${path}.1`);
+    const oldest = regularLeaf(`${path}.2`);
+    if (!matches("", source, original)) return false;
+    if (previous) {
+      if (!sameFile(previous, regularLeaf(`${path}.1`))) return false;
+      const currentOldest = regularLeaf(`${path}.2`);
+      if (oldest ? !sameFile(oldest, currentOldest) : currentOldest !== undefined) return false;
+      if (!sameDirectory()) return false;
+      renameSync(`${path}.1`, `${path}.2`);
+      if (!sameFile(previous, regularLeaf(`${path}.2`))) return false;
     }
-    archive = openSync(`${path}.1`, "w", 0o600);
+    // Never truncate an existing archive, even if another rotation or a path
+    // replacement wins the gap after rename. Failure leaves the source intact.
+    if (!sameDirectory()) return false;
+    archive = openSync(`${path}.1`, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | guardedFlags, 0o600);
+    const created = fstatSync(archive, { bigint: true });
+    if (!matches(".1", archive, created)) return false;
     // A legacy unbounded file may be huge. Copy only its newest cap-sized tail,
     // using fixed memory, before truncating the original inode.
     const buffer = Buffer.alloc(Math.min(64 * 1024, maxBytes));
@@ -28,12 +85,18 @@ export function rotateServiceLog(path: string, maxBytes = SERVICE_LOG_MAX_BYTES)
       if (read === 0) return false;
       let written = 0;
       while (written < read) {
+        if (!matches(".1", archive, created)) return false;
         const count = writeSync(archive, buffer, written, read - written);
         if (count === 0) return false;
         written += count;
       }
       position += read;
     }
+    fsyncSync(archive);
+    // Revalidate both names and open objects at the destructive boundary. These
+    // checks detect observed replacement; they are not an atomic namespace lock.
+    if (!matches(".1", archive, created)
+      || !matches("", source, original)) return false;
     ftruncateSync(source, 0);
     return true;
   } catch {

package/src/service/repair.ts

@@ -6,7 +6,8 @@ import { randomUUID } from "node:crypto";
 import { defaultWinswEntry, installWinswService } from "../lib/winsw";
 import { resolveWindowsTaskDiagnosticUserId, diagnoseService } from "./diagnostics";
 import type { ServiceDiagnostic } from "./diagnostics";
-import { assertServiceEnvironmentMatchesInstall, assertServiceAuthEnvironment } from "./guards";
+import { assertServiceAuthEnvironment } from "./auth-preflight";
+import { assertServiceEnvironmentMatchesInstall } from "./guards";
 import { installLaunchd, restartLaunchdJob } from "./launchd";
 import type { LaunchdInstallOutcome } from "./launchd";
 import { TASK, writeServiceInstallState, serviceSourceDir, resolveServiceOwnership, serviceLauncherPathDiagnostic } from "./state";

package/src/service/state.ts

@@ -172,20 +172,19 @@ function defaultOpenCodexHome(): string {
 }
 
 export function serviceStatePathsForOpenCodexHome(opencodexHome: string): string[] {
-  return serviceStateFilesFor(opencodexHome, defaultOpenCodexHome());
+  // Bun caches the startup home: parallel workers inherit the wrapper's HOME even
+  // after the preload gives each one a sandbox. Tests must not share that mirror,
+  // including serial cases that select different OPENCODEX_HOME fixtures.
+  return serviceStateFilesFor(opencodexHome, isTestHomeGuardArmed() ? opencodexHome : defaultOpenCodexHome());
 }
 
 export function serviceStatePaths(): string[] {
   const paths = serviceStatePathsForOpenCodexHome(currentOpenCodexHome());
   if (!isTestHomeGuardArmed()) return paths;
   /*
-   * Under an armed test process the legacy default-home entry IS the developer's real
-   * `~/.opencodex/service-state.json`. It is there so an install made before
-   * OPENCODEX_HOME was set can still be found, but it means a test whose OPENCODEX_HOME
-   * points at a sandbox still writes their live install state — observed while building
-   * the launchd repair coverage: one case replaced the real record's codexHome and
-   * opencodexHome with temp-directory paths. Drop it rather than deny the write, so the
-   * sandbox path keeps working and the real one is simply not in the list.
+   * The test resolver omits the legacy mirror; still reject an explicit or fallback
+   * OPENCODEX_HOME that names the developer's real home. A missing fixture pin must
+   * never allow a test to read or replace their live service installation.
    *
    * The predicate is the guard's own, not a local `resolve()` compare: the guard
    * canonicalizes through `realpath`, and on macOS a sandbox under `/var/folders/...`

package/src/service/systemd.ts

@@ -8,7 +8,7 @@ import { BUN_RUNTIME_PATH_ENV, BUN_RUNTIME_SOURCE_ENV, durableBunRuntime, type D
 import { recordOwnedConfigPath } from "../lib/config-ownership";
 import { systemdProperty } from "../service-manager-probe";
 import { writeServiceApiTokenFile, sh } from "./guards";
-import { shellQuote, buildServiceShellCommand, buildServiceLauncherShellCommand, resolvedProxyEnv } from "./health";
+import { shellQuote, buildServiceShellCommand, buildServiceLauncherShellCommand, resolvedProxyEnv } from "./definition";
 import type { ServiceInstallCleanupOps } from "./orchestration";
 import { SERVICE_MANAGED_ENV, TASK, cliEntry, filterTransientServicePath, stableLauncherEntry, logPath, serviceStatePath, currentCodexSqliteHomeAbsolute, writeServiceInstallState } from "./state";
 import { writeServiceDefinitionFile } from "./windows-ops";

package/src/service/windows-guarded-manager.ts

@@ -29,7 +29,8 @@ import { cachedCurrentWindowsIdentity, resolveCurrentWindowsPrincipal, WINDOWS_P
 import { statusWinswRaw, winswExePath, WINSW_SERVICE_ID, type WinswStatus } from "../lib/winsw";
 import type { GuardedManagerStopped, GuardedManagerTarget } from "./guarded-manager-target";
 import { TASK, windowsLauncherVbsPath, windowsServiceScriptPath } from "./state";
-import { probeWindowsSchedulerTask, querySchtasks, windowsWscript, type WindowsSchedulerTaskProbe } from "./windows-scheduler";
+import { probeWindowsSchedulerTask, querySchtasks, type WindowsSchedulerTaskProbe } from "./windows-scheduler";
+import { windowsWscript } from "./windows-wscript";
 import { windowsTaskRegistrationHealthy, windowsTaskRegistrationRefreshableLegacy } from "./windows-taskxml";
 
 /** Runtime table of one Win32 process; a null parent means the chain is unreadable. */

package/src/service/windows-ops.ts

@@ -5,7 +5,7 @@ import { winswXmlPath } from "../lib/winsw";
 import { hardenSecretPath } from "../lib/windows-secret-acl";
 import { durableBunRuntime, type DurableBunRuntime } from "../lib/bun-runtime";
 import { assertSelectedRuntimeWritable, type RuntimePreflightDeps } from "../lib/bun-runtime-preflight";
-import { parseBakedListenPort } from "./health";
+import { parseBakedListenPort } from "./definition";
 import { windowsServiceScriptPath } from "./state";
 import { execFileSync } from "node:child_process";
 import { existsSync, mkdirSync, mkdtempSync, rmdirSync, unlinkSync } from "node:fs";

package/src/service/windows-scheduler.ts

@@ -1,7 +1,6 @@
 import { execFileSync } from "node:child_process";
 import { findLiveProxy } from "../server/proxy-liveness";
 import { existsSync, readFileSync } from "node:fs";
-import { join, resolve } from "node:path";
 import { randomUUID } from "node:crypto";
 import { ELEVATION_REQUEST_TIMEOUT_MS, OCX_ELEVATED_PROTOCOL_FAILED, raceWithTimeout, resolveTrustedWindowsSchtasksExe, startElevatedSchtasksCreateAndRun, runWindowsElevated, toWindowsSchtasksError, WindowsElevationError, type ElevatedSchedulerOutcome, type ElevatedSchtasksCreateAndRunExecution, type ElevatedSchtasksCreateAndRunResult } from "../lib/windows-elevation";
 import { statusWinswRaw } from "../lib/winsw";
@@ -10,9 +9,10 @@ import { isTestHomeGuardArmed } from "../lib/test-home-guard";
 import { TASK, windowsServiceScriptPath, windowsLauncherVbsPath, windowsTaskXmlPath, writeServiceInstallState } from "./state";
 import { buildWindowsSchtasksCreateArgs, windowsTaskRegistrationOwnedByAttempt, windowsTaskRegistrationHealthy } from "./windows-taskxml";
 import type { ExpectedWindowsTaskUserId } from "./windows-taskxml";
-import { win32 } from "node:path";
 import { WINSW_SERVICE_ID } from "../lib/winsw";
 
+export { windowsWscript } from "./windows-wscript";
+
 /**
  * Decode schtasks stdout. `/query /xml` emits UTF-16LE (often with BOM) because the
  * registered task document is UTF-16; reading that as UTF-8 makes every health check
@@ -69,11 +69,6 @@ function windowsSchtasks(): string {
   return resolveTrustedWindowsSchtasksExe();
 }
 
-export function windowsWscript(): string {
-  const candidate = join(process.env.SystemRoot ?? "C:\\Windows", "System32", "wscript.exe");
-  return existsSync(candidate) ? candidate : "wscript.exe";
-}
-
 let querySchtasksForTests: ((args: string[]) => string) | null = null;
 
 export function querySchtasks(args: string[]): string {

package/src/service/windows-taskxml.ts

@@ -1,14 +1,14 @@
 import { WINDOWS_WRAPPER_PROTOCOL_ENV, WINDOWS_WRAPPER_STAY_OUT_EXIT_CODE } from "./windows-wrapper-exit";
 import { readFileSync } from "node:fs";
 import { TASK, windowsServiceScriptPath, windowsLauncherVbsPath, windowsTaskXmlPath } from "./state";
-import { windowsWscript } from "./windows-scheduler";
+import { windowsWscript } from "./windows-wscript";
 import { join } from "node:path";
 import { BUN_RUNTIME_PATH_ENV, BUN_RUNTIME_SOURCE_ENV } from "../lib/bun-runtime";
 import { REAL_BUN_MIN_BYTES } from "../lib/bun-binary-validator.mjs";
 import { serviceApiTokenFilePath } from "../lib/service-secrets";
 import { windowsEnvIndirectBatchPathList, windowsEnvIndirectBatchValue } from "../lib/win-paths";
 import { cachedCurrentWindowsIdentity, resolveCurrentWindowsPrincipal, WINDOWS_PRINCIPAL_LOOKUP_TIMEOUT_MS } from "../lib/windows-user-principal";
-import { resolveServiceListenPort, resolvedProxyEnv } from "./health";
+import { resolveServiceListenPort, resolvedProxyEnv } from "./definition";
 import { cliEntry, filterTransientServicePath, serviceLogPath, currentCodexSqliteHomeAbsolute } from "./state";
 
 function windowsBatchValue(value: string): string {

package/src/service/windows-wscript.ts

@@ -0,0 +1,14 @@
+/**
+ * The `wscript.exe` the Task Scheduler XML must name.
+ *
+ * Leaf module on purpose: `windows-taskxml.ts` needs it to render the task document,
+ * and taking it from `windows-scheduler.ts` made the two one cyclic component.
+ * `windows-scheduler` owns the schtasks process surface, not this one path lookup.
+ */
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+
+export function windowsWscript(): string {
+  const candidate = join(process.env.SystemRoot ?? "C:\\Windows", "System32", "wscript.exe");
+  return existsSync(candidate) ? candidate : "wscript.exe";
+}

package/src/service.ts

@@ -13,8 +13,10 @@ export { acquireOwnershipMutationLease, withOwnershipMutationLease } from "./ser
 export type { ManagingCliRole, ManagingCliObservation, RegisteredManagingCliInvocation, ServiceTakeoverCompatibilityInput, ServiceTakeoverCompatibility } from "./service/ownership-compatibility";
 export { registeredManagingCliInvocation, assessServiceTakeoverCompatibility, sameServiceTakeoverCompatibility } from "./service/ownership-compatibility";
 export type { ServiceApiTokenOrigin, ProvisionedServiceApiToken } from "./service/guards";
-export { ServiceOwnershipError, isServiceOwnershipError, serviceEnvironmentOwnedHere, assertServiceEnvironmentMatchesInstall, serviceRetryCommand, assertNotAdminToken, assertServiceAuthEnvironment, writeServiceApiTokenFile, assertLiveServiceManagerAllowed } from "./service/guards";
-export { resolveServiceListenPort, installedServiceListenPort, SERVICE_INSTALL_HEALTH_MS, SERVICE_INSTALL_HEALTH_WINDOWS_MS, serviceInstallHealthMs, confirmServiceServing, reportServiceServing, resolvedProxyEnv } from "./service/health";
+export { ServiceOwnershipError, isServiceOwnershipError, serviceEnvironmentOwnedHere, assertServiceEnvironmentMatchesInstall, assertNotAdminToken, writeServiceApiTokenFile, assertLiveServiceManagerAllowed } from "./service/guards";
+export { serviceRetryCommand, assertServiceAuthEnvironment } from "./service/auth-preflight";
+export { resolveServiceListenPort, resolvedProxyEnv } from "./service/definition";
+export { installedServiceListenPort, SERVICE_INSTALL_HEALTH_MS, SERVICE_INSTALL_HEALTH_WINDOWS_MS, serviceInstallHealthMs, confirmServiceServing, reportServiceServing } from "./service/health";
 export type { LaunchdLoadState, LaunchdLoadProbe, LaunchdInstallOutcome } from "./service/launchd";
 export { buildPlist, reusePreviousPlistPathVariable, expectedLaunchdCommand, launchdListenPort, runLaunchctl, launchctlLoadFailed, launchdJobMatchesPlist, launchdEvictionTargets, probeLaunchdLoadState, installLaunchd, restartLaunchdJob, startLaunchd } from "./service/launchd";
 export { systemdListenPort, buildUnit, systemdNeedsDaemonReload, uninstallSystemd, systemdServiceInstallCleanupOps } from "./service/systemd";

package/src/sidecar/auth.ts

@@ -134,6 +134,8 @@ function findAnthropicAuthProvider(
     // its token path and the token guardian refuse an unmarked row of that name, so offering such a
     // custom row here would advertise credentials no helper executor will spend.
     if (providerName === "anthropic2") continue;
+    // The DSH account token is pinned to its own adapter and DeepSeek host; no helper may spend it.
+    if (providerName === "dsh-account") continue;
     if (provider.disabled === true) continue;
     if (provider.adapter !== "anthropic" || provider.authMode !== "oauth") continue;
     const set = getAccountSet(providerName);

package/src/types/config.ts

@@ -349,6 +349,12 @@ export interface OcxApiKeyEntry {
    * that is the only point at which the model about to be billed is known.
    */
   allowedModels?: string[];
+  /**
+   * Lets this key reach combo targets marked `metered`. Absent means no: an issued key stops
+   * at the last unmetered target. The environment token never qualifies. A loopback bind
+   * reads no key; local operator consent is instead declared on the combo.
+   */
+  allowMeteredComboTargets?: boolean;
 }
 
 export interface OcxPendingApiKeyRotation {
@@ -569,6 +575,21 @@ export interface OcxConfig {
   };
   /** Enable the shipped model alias patterns for providers without an override. */
   defaultModelAliases?: boolean;
+  /**
+   * When `true`, the raw OpenAI-compatible `/v1/models` list publishes a safe alias (e.g.
+   * `SEK-glm-4.7-flash`) as the row `id` instead of `provider/nativeId`
+   * (e.g. `Seek/glm-4.7-flash`).  The original `provider/nativeId` moves to a
+   * new `native_id` field so clients that need it can still read it.
+   *
+   * **Default: `false`** — the historical `provider/nativeId` form remains the
+   * published `id`, and the alias is in the informational `alias_of` field.
+   *
+   * Codex (`client_version`) and Anthropic-specific discovery retain their own
+   * identities and are unchanged. Ambiguous or shadowed short aliases retain the
+   * qualified ID, as do aliases with unparseable synthetic Fast siblings.
+   * Existing requests using `provider/nativeId` continue to work unchanged.
+   */
+  preferModelAliasIds?: boolean;
   /**
    * Opt-in Cursor Private Inference compatibility rows. When true, `/v1/models`
    * adds `<base-id>--<effort>` selectors for reasoning-capable model ids absent
@@ -605,6 +626,13 @@ export interface OcxConfig {
   codexMainAccountHardLock?: boolean;
   /** Per-window percentages: short defaults to 90, long to 98; integers 80..100, short <= long. */
   codexMainAccountHardLockThresholds?: { short?: number; long?: number };
+  /**
+   * Extended hard-lock settings: while the lock blocks and no Codex account can serve a
+   * qualifying request, the request reroutes to `model` (with `reasoningEffort` when set)
+   * instead of failing. The lock itself stays on and releases on its own as before; an
+   * absent section or model means the refusal behavior is unchanged.
+   */
+  codexMainAccountHardLockFallback?: { enabled?: boolean; model?: string; reasoningEffort?: string };
   /**
    * Who refreshes the native main ChatGPT login in CODEX_HOME (#2999). "codex" asks the Codex
    * binary through app-server `getAuthStatus` and never writes auth.json; "opencodex" keeps the
@@ -612,6 +640,8 @@ export interface OcxConfig {
    * is found, otherwise "opencodex". "codex" also falls back when no such binary exists.
    */
   nativeMainRefresh?: "codex" | "opencodex";
+  /** Use included quota to 100% for these accounts; preserves thresholds and credit-spending policy. */
+  codexUseRemainingQuotaAccountIds?: string[];
   /** Explicit top-level deletion intent used by stale whole-config rebases. */
   configRebaseProvenance?: OcxConfigRebaseProvenance | Record<string, unknown>;
   /** OpenAI provider-contract migration marker (v2 = single `openai` provider with account mode). */
@@ -783,6 +813,13 @@ export interface OcxConfig {
   };
   /** Opt-in failure-only recovery; never replaces the initial compaction model. */
   compactionRecovery?: { enabled: boolean; model: string; allowDevinInvalidArgument?: boolean };
+  /** Explicit opt-in (enabled === true), default off, for routed v1/v2 readable reasoning retention.
+   * Defaults: 20% of the compacting model's context window and 100,000 tokens (the smaller limit).
+   * Unknown windows use maxTokens alone; overflow is archived locally with a path notice.
+   * Native and opaque compaction output keep their existing protocols. */
+  reasoningRetention?: { enabled?: boolean; maxContextPercent?: number; maxTokens?: number };
+  /** Canonical ChatGPT reasoning replay allowances; both default off. */
+  nativeReasoningRetention?: { modelSwitch?: boolean; accountSwitch?: boolean };
   /** Explicit opt-in; resumes Observe only using an existing trusted certificate and endpoints. */
   desktopCompatibility?: { startOnProxyStart: boolean };
   /**
@@ -842,6 +879,19 @@ export interface OcxConfig {
    /** Optional override of intercepted source-model prefixes (default: gpt-6-luna, gpt-5.6-luna). */
    sourceModels?: string[];
  };
+  /**
+   * Global auto-review (approval reviewer) selector for every catalog row, written by the
+   * Models settings panel. During catalog sync OpenCodex stamps it as
+   * `auto_review_model_override` on rows that carry no provider-scoped stamp, so an enabled block
+   * wins over Codex's own root `auto_review_model`; disabling it restores that fallback.
+   * `autoReviewModel` keeps its precedence on its own provider's rows.
+   */
+  autoReviewOverride?: {
+    /** When true, the configured model replaces the reviewer on every unowned row. */
+    enabled?: boolean;
+    /** Public catalog selector in `provider/model` form; blank or absent clears the override. */
+    model?: string;
+  };
   /**
    * Optional map of blocked model IDs to their replacement model IDs.
    * When configured, incoming requests targeting a blocked model (including
@@ -1207,6 +1257,8 @@ export interface OcxConfig {
   autoSwitchThreshold?: number;
   /** Opt-in: return bound quota-strategy tasks to recovered higher-priority accounts. */
   codexAccountPriorityFailback?: boolean;
+  /** Prefer other identities, reserving the current native sign-in as pool fallback. */
+  codexPreserveSignedInAccount?: boolean;
   /** New-session account rotation strategy for the Codex pool. Default quota (today's behaviour). */
   accountPoolStrategy?: OcxAccountPoolRotationStrategy | "reset-first";
   /** Successful new-session binds retained on one round-robin selection. Default 1; range 1..100. */
@@ -1338,10 +1390,18 @@ export interface OcxComboTarget {
    * see `OcxComboConfig.cooldownWaitPolicy` (#5691).
    */
   lastResort?: boolean;
+  /**
+   * Pay-per-use target (for example an API-key row behind subscription targets). Only the
+   * configured keys with `allowMeteredComboTargets: true`, or a loopback-only combo
+   * with `allowMeteredTargets: true`, may reach it.
+   */
+  metered?: boolean;
 }
 
 export interface OcxComboConfig {
   targets: OcxComboTarget[];
+  /** Operator consent for metered targets on a loopback-only proxy. Default false; public listeners still require key consent. */
+  allowMeteredTargets?: boolean;
   /** Ordered failover (default), round-robin, weighted random, least-used, or quota reset-window selection. */
   strategy?: OcxComboStrategy;
   /** Successful requests retained on one RR selection batch. Default 1; range 1..100. */
@@ -1578,8 +1638,7 @@ export interface OcxVisionSidecarConfig {
 }
 
 /**
- * Advisor sidecar configuration. Kept deliberately small for PR1: no adaptive trigger knobs
- * (failedValidations / noProgressCycles / semanticClassifier) — those belong to a later PR.
+ * Advisor sidecar configuration. Automatic triggers require deterministic task evidence.
  */
 export interface OcxAdvisorConfig {
   /** Master switch. Default: false — the advisor stays off the request path entirely. */
@@ -1598,7 +1657,9 @@ export interface OcxAdvisorConfig {
    * consultation per task once the task has produced orientation evidence (an assistant tool call
    * or a tool result after the latest user message).
    */
-  policy?: "manual" | "preflight";
+  policy?: "manual" | "preflight" | "adaptive";
+  /** Adaptive task consultation attempts (manual + automatic). Integer 1–3, default 3. */
+  maxConsultationsPerTask?: number;
   /** Advisor fetch timeout (ms). Default 120000. */
   timeoutMs?: number;
   /**

package/src/types/opencode-go.ts

@@ -0,0 +1,61 @@
+/** Exact-model protocols from https://opencode.ai/v2/docs/console/go/#endpoints (2026-10-15).
+ * Unknown models retain Chat. Responses entries are overridable registry defaults;
+ * the native wires are hard pins because modelAdapters cannot select those adapters.
+ */
+export const OPENCODE_GO_BASE_URL = "https://opencode.ai/zen/go/v1";
+
+export const OPENCODE_GO_MODEL_WIRES: Readonly<Record<string, "google" | "anthropic" | "openai-responses">> = Object.freeze({
+  "gemini-4-argon-contributor": "google",
+  "claude-haiku-5-5": "anthropic",
+  "minimax-m2.7": "anthropic",
+  "minimax-m3": "anthropic",
+  "qwen3.7-plus": "anthropic",
+  "qwen3.8-max": "anthropic",
+  "qwen3.8-flash": "anthropic",
+  "gpt-6-luna": "openai-responses",
+  "gpt-5.6-luna": "openai-responses",
+  "grok-4.6": "openai-responses",
+  "grok-4.7": "openai-responses",
+  "muse-spark-1.2-contributor": "openai-responses",
+  "muse-spark-1.3-contributor": "openai-responses",
+  // Retain previously supported Go models absent from the current endpoint table (#4847).
+  "minimax-m2.5": "anthropic",
+  "union-alpha": "anthropic",
+});
+
+/** Compatibility: these five pins predate destination scoping. New native pins require Go. */
+export const OPENCODE_GO_LEGACY_NAME_PINS: ReadonlySet<string> = new Set([
+  "claude-haiku-5-5", "minimax-m2.5", "minimax-m2.7", "minimax-m3", "union-alpha",
+]);
+
+export const OPENCODE_GO_RESPONSES_DEFAULTS = Object.freeze(Object.fromEntries(
+  Object.entries(OPENCODE_GO_MODEL_WIRES).filter(([, wire]) => wire === "openai-responses"),
+));
+
+export interface OpenCodeGoDestination {
+  readonly baseUrl?: unknown;
+  readonly authMode?: unknown;
+  readonly googleMode?: unknown;
+}
+
+/** A provider name alone must never authorize redirecting a credential to OpenCode. */
+export function isOpenCodeGoGeminiDestination(provider: OpenCodeGoDestination | undefined): boolean {
+  if (!provider || typeof provider.baseUrl !== "string") return false;
+  if (provider.authMode !== undefined && provider.authMode !== "key") return false;
+  if (provider.googleMode !== undefined && provider.googleMode !== "ai-studio") return false;
+  try {
+    const url = new URL(provider.baseUrl.trim());
+    return url.origin === "https://opencode.ai"
+      && !url.username && !url.password && !url.search && !url.hash
+      && ["/zen/go/v1", "/inference/go/v1"].includes(url.pathname.replace(/\/+$/, ""));
+  } catch {
+    return false;
+  }
+}
+
+/** Return the fixed Gemini endpoint only for the exact model and an eligible Go destination. */
+export function openCodeGoGeminiEndpoint(provider: OpenCodeGoDestination, modelId: string): string | undefined {
+  return Object.hasOwn(OPENCODE_GO_MODEL_WIRES, modelId) && OPENCODE_GO_MODEL_WIRES[modelId] === "google" && isOpenCodeGoGeminiDestination(provider)
+    ? `https://opencode.ai/inference/go/v1/models/${encodeURIComponent(modelId)}`
+    : undefined;
+}

package/src/types/opencode-zen.ts

@@ -0,0 +1,35 @@
+/** Fixed-key OpenCode Zen destinations supporting native model protocols. */
+export interface OpenCodeZenDestination {
+  readonly baseUrl?: unknown;
+  readonly authMode?: unknown;
+  readonly googleMode?: unknown;
+}
+
+/** Match the official Zen destination and API-key authentication. */
+export function openCodeZenKeyBaseUrl(provider: OpenCodeZenDestination | undefined): string | undefined {
+  if (!provider || typeof provider.baseUrl !== "string") return undefined;
+  if (provider.authMode !== undefined && provider.authMode !== "key") return undefined;
+  try {
+    const url = new URL(provider.baseUrl.trim());
+    const pathname = url.pathname.replace(/\/+$/, "");
+    if (url.origin !== "https://opencode.ai" || url.username || url.password || url.search || url.hash) return undefined;
+    if (pathname !== "/zen/v1" && pathname !== "/inference/v1") return undefined;
+    return url.origin + pathname;
+  } catch {
+    return undefined;
+  }
+}
+
+/** Gemini's native endpoint applies only in AI Studio mode. */
+export function openCodeZenBaseUrl(provider: OpenCodeZenDestination | undefined): string | undefined {
+  if (provider?.googleMode !== undefined && provider.googleMode !== "ai-studio") return undefined;
+  return openCodeZenKeyBaseUrl(provider);
+}
+
+/** Keep the selected destination; Zen omits AI Studio's /v1beta segment. */
+export function openCodeZenGeminiEndpoint(provider: OpenCodeZenDestination, modelId: string): string | undefined {
+  const baseUrl = openCodeZenBaseUrl(provider);
+  return baseUrl && modelId.toLowerCase().startsWith("gemini-")
+    ? baseUrl + "/models/" + encodeURIComponent(modelId)
+    : undefined;
+}