@bitkyc08/opencodex 2.88.0 → 2.89.0

package/src/compatibility/index.ts

@@ -1,4 +1,5 @@
 import { OPENAI_CODEX_FORWARD_GPT56_SOL_MANIFEST } from "./openai-responses";
+import { OPENGATEWAY_KEY_GLM53_RESPONSES_MANIFEST } from "./opengateway-responses";
 import type { CompatibilityManifestV1 } from "./manifest";
 
 export {
@@ -16,9 +17,11 @@ export type {
   CompatibilitySubjectV1,
 } from "./manifest";
 export { OPENAI_CODEX_FORWARD_GPT56_SOL_MANIFEST } from "./openai-responses";
+export { OPENGATEWAY_KEY_GLM53_RESPONSES_MANIFEST } from "./opengateway-responses";
 
 export const COMPATIBILITY_MANIFESTS: readonly CompatibilityManifestV1[] = Object.freeze([
   OPENAI_CODEX_FORWARD_GPT56_SOL_MANIFEST,
+  OPENGATEWAY_KEY_GLM53_RESPONSES_MANIFEST,
 ]);
 
 export function getCompatibilityManifest(id: string): CompatibilityManifestV1 | undefined {

package/src/compatibility/openai-responses.ts

@@ -9,7 +9,7 @@ const FIXTURE_ID = "openai-codex-forward-gpt56-sol-v1";
 export const OPENAI_CODEX_FORWARD_GPT56_SOL_MANIFEST = defineCompatibilityManifest({
   schemaVersion: 1,
   id: "openai.codex-forward.gpt-5-6-sol.responses",
-  version: "1.3.0",
+  version: "1.4.0",
   subject: {
     providerId: "openai",
     baseUrl: "https://chatgpt.com/backend-api/codex",
@@ -117,5 +117,12 @@ export const OPENAI_CODEX_FORWARD_GPT56_SOL_MANIFEST = defineCompatibilityManife
       limitation: "The field is removed only for the canonical forward destination; public and custom Responses providers keep it.",
       evidence: [{ kind: "fixture", id: FIXTURE_ID, assertionIds: ["prompt-cache-options-removed"] }],
     },
+    {
+      id: "custom-tool-grammar",
+      feature: "request.custom_tools.grammar",
+      disposition: "passthrough",
+      summary: "A custom tool's grammar format, including its definition, reaches the backend unchanged.",
+      evidence: [{ kind: "fixture", id: FIXTURE_ID, assertionIds: ["custom-tool-grammar-preserved"] }],
+    },
   ],
 } as const);

package/src/compatibility/opengateway-responses.ts

@@ -0,0 +1,61 @@
+import { defineCompatibilityManifest } from "./manifest";
+
+const FIXTURE_ID = "opengateway-key-glm53-responses-v1";
+
+/**
+ * A routed Responses subject whose destination rejects native custom tools, so OpenCodex lowers
+ * them to functions before dispatch. The claims describe that local wire transformation only;
+ * they do not certify how the upstream model treats the lowered declaration.
+ */
+export const OPENGATEWAY_KEY_GLM53_RESPONSES_MANIFEST = defineCompatibilityManifest({
+  schemaVersion: 1,
+  id: "opengateway.key.glm-5-3-flash-ultrafast.responses",
+  version: "1.0.0",
+  subject: {
+    providerId: "opengateway",
+    baseUrl: "https://apis.opengateway.ai/v1",
+    adapterId: "openai-responses",
+    authMode: "key",
+    inboundProtocol: "responses",
+    upstreamProtocol: "openai-responses",
+    modelIds: ["z-ai/glm-5.3-flash-ultrafast"],
+  },
+  claims: [
+    {
+      id: "custom-tools",
+      feature: "request.custom_tools",
+      disposition: "translated",
+      summary: "Custom tool declarations are sent as functions that take one raw string input.",
+      limitation: "The destination rejects native custom tools, so each declaration is lowered to a function with a single required string parameter named input.",
+      evidence: [{ kind: "fixture", id: FIXTURE_ID, assertionIds: ["custom-tool-lowered-to-function"] }],
+    },
+    {
+      id: "custom-tool-grammar",
+      feature: "request.custom_tools.grammar",
+      disposition: "degraded",
+      summary: "The tool and its description survive, but its grammar does not reach the destination.",
+      limitation: "The format, including any grammar definition, is removed during lowering, so the upstream model is not constrained by it; only the string input type remains.",
+      evidence: [{
+        kind: "fixture",
+        id: FIXTURE_ID,
+        assertionIds: ["custom-tool-grammar-removed", "custom-tool-lowered-to-function"],
+      }],
+    },
+    {
+      id: "custom-tool-call-history",
+      feature: "continuation.custom_tool_call",
+      disposition: "translated",
+      summary: "Replayed custom tool calls are sent as function calls with the same call_id and name.",
+      limitation: "The raw input is wrapped as the JSON arguments object {\"input\": <raw input>}.",
+      evidence: [{ kind: "fixture", id: FIXTURE_ID, assertionIds: ["custom-tool-call-lowered"] }],
+    },
+    {
+      id: "custom-tool-output-history",
+      feature: "continuation.custom_tool_call_output",
+      disposition: "translated",
+      summary: "Replayed custom tool outputs are sent as function call outputs with the same call_id and output.",
+      limitation: "Only the item type changes from custom_tool_call_output to function_call_output.",
+      evidence: [{ kind: "fixture", id: FIXTURE_ID, assertionIds: ["custom-tool-output-lowered"] }],
+    },
+  ],
+} as const);

package/src/config/account-auto-pause-revisions.ts

@@ -0,0 +1,136 @@
+import * as z from "zod/v4";
+import { randomUUID } from "node:crypto";
+import { readFileSync } from "node:fs";
+import type { OcxConfig } from "../types";
+import { getConfigPath } from "./paths";
+
+type PolicyConfig = { providers?: unknown; accountAutoPausePolicyRevisions?: unknown };
+// fingerprint follows the live config; diskFingerprint follows the last observed disk state, so a
+// detached load compares disk with disk and still fences an observed external policy change.
+type Observed = { diskRevision: string; localGen: number; unknown: boolean; fingerprint: string; diskFingerprint: string };
+export type AccountAutoPauseFence = { configPath: string; diskRevision: string; localGen: number; threshold: number; route: string };
+const observed = new Map<string, Map<string, Observed>>();
+// One process-wide allocator for every new entry and every advance: a deleted and recreated name
+// can never reproduce an old {diskRevision, localGen} pair, even when both read "legacy".
+let nextGeneration = 0;
+const allocateGeneration = (): number => ++nextGeneration;
+function hasProvider(config: PolicyConfig | undefined, name: string): boolean {
+  const providers = record(config?.providers);
+  return !!providers && Object.hasOwn(providers, name);
+}
+const UUID = z.uuid();
+function record(value: unknown): Record<string, unknown> | undefined {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value as Record<string, unknown> : undefined;
+}
+function revisions(config: PolicyConfig): Record<string, string> | undefined | null {
+  const value = config.accountAutoPausePolicyRevisions;
+  if (value === undefined) return undefined;
+  const map = record(value);
+  return map && Object.values(map).every(v => typeof v === "string" && UUID.safeParse(v).success) ? map as Record<string, string> : null;
+}
+function revisionFor(map: Record<string, string> | undefined | null, name: string): string | undefined {
+  return map && Object.hasOwn(map, name) ? map[name] : undefined;
+}
+function provider(config: PolicyConfig, name: string): Record<string, unknown> | undefined {
+  const providers = record(config.providers);
+  return providers && Object.hasOwn(providers, name) ? record(providers[name]) : undefined;
+}
+function route(row: Record<string, unknown> | undefined): string {
+  return JSON.stringify([row?.baseUrl, row?.adapter, row?.authMode]);
+}
+export function accountAutoPauseFingerprint(row: unknown): string {
+  const p = record(row), policy = record(p?.accountAutoPause);
+  return JSON.stringify([!!p, policy?.enabled === true, policy?.consecutiveFailures ?? 2, p?.disabled === true, route(p)]);
+}
+export function snapshotAutoPauseFingerprints(config: PolicyConfig): Map<string, string> {
+  return new Map(Object.entries(record(config.providers) ?? {}).map(([name, row]) => [name, accountAutoPauseFingerprint(row)]));
+}
+/** Caller revisions never authorize a write. The literal pre-write file owns the epoch. */
+export function normalizeAccountAutoPauseRevisions(before: PolicyConfig | undefined, persisted: OcxConfig): void {
+  const old = revisions(before ?? {});
+  const names = new Set(Object.keys(old ?? {}));
+  for (const config of [before, persisted]) {
+    for (const [name, row] of Object.entries(record(config?.providers) ?? {})) {
+      if (record(row)?.accountAutoPause !== undefined) names.add(name);
+    }
+  }
+  // Records follow the providers that exist after disk-only preservation; a deleted provider's
+  // record is reclaimed and a recreated one is minted a fresh UUID.
+  const entries = [...names].filter(name => hasProvider(persisted, name)).map(name => [name, revisionFor(old, name)
+    && accountAutoPauseFingerprint(provider(before ?? {}, name)) === accountAutoPauseFingerprint(provider(persisted, name))
+    ? revisionFor(old, name)! : randomUUID()]);
+  if (entries.length) persisted.accountAutoPausePolicyRevisions = Object.fromEntries(entries);
+  else delete persisted.accountAutoPausePolicyRevisions;
+}
+/** Adopt disk epochs even when an external ABA left the effective policy unchanged. */
+export function observeAccountAutoPauseRevisions(config: PolicyConfig, disk: PolicyConfig = config, previous?: Map<string, string>): void {
+  const path = getConfigPath();
+  let entries = observed.get(path);
+  if (!entries) { entries = new Map(); observed.set(path, entries); }
+  const map = revisions(disk);
+  const names = new Set([...entries.keys(), ...Object.keys(record(config.providers) ?? {}), ...Object.keys(map ?? {})]);
+  for (const name of names) {
+    if (!hasProvider(config, name) && !hasProvider(disk, name)) { entries.delete(name); continue; }
+    const fingerprint = accountAutoPauseFingerprint(provider(config, name));
+    const old = entries.get(name);
+    const prior = previous?.get(name) ?? old?.fingerprint ?? fingerprint;
+    entries.set(name, { fingerprint, diskRevision: revisionFor(map, name) ?? "legacy", unknown: map === null,
+      diskFingerprint: accountAutoPauseFingerprint(provider(disk, name)),
+      localGen: !old || prior !== fingerprint ? allocateGeneration() : old.localGen });
+  }
+}
+/**
+ * A loaded snapshot adopts the disk epoch and compares its policy with the previously observed
+ * disk policy. Many callers read detached snapshots; comparing one with the live fingerprint would
+ * advance localGen on every live/snapshot difference. A disk-to-disk change still advances it.
+ */
+function adoptDiskAutoPauseRevisions(config: PolicyConfig): void {
+  const path = getConfigPath();
+  let entries = observed.get(path);
+  if (!entries) { entries = new Map(); observed.set(path, entries); }
+  const map = revisions(config);
+  for (const name of new Set([...entries.keys(), ...Object.keys(record(config.providers) ?? {}), ...Object.keys(map ?? {})])) {
+    if (!hasProvider(config, name)) { entries.delete(name); continue; }
+    const old = entries.get(name);
+    const diskRevision = revisionFor(map, name) ?? "legacy";
+    const diskFingerprint = accountAutoPauseFingerprint(provider(config, name));
+    entries.set(name, old
+      ? { ...old, diskRevision, unknown: map === null, diskFingerprint, localGen: old.diskFingerprint !== diskFingerprint ? allocateGeneration() : old.localGen }
+      : { fingerprint: diskFingerprint, diskFingerprint, diskRevision, unknown: map === null, localGen: allocateGeneration() });
+  }
+}
+/** Test inspection only: observed records for the current config path. */
+export function accountAutoPauseObservedSizeForTests(): number {
+  return observed.get(getConfigPath())?.size ?? 0;
+}
+/** Initial load is an observation, never a persistence operation. */
+export function observeLoadedAutoPauseConfig(config: OcxConfig): OcxConfig {
+  adoptDiskAutoPauseRevisions(config);
+  return config;
+}
+export function captureAccountAutoPauseFence(config: OcxConfig, name: string): AccountAutoPauseFence | undefined {
+  // Only a config path no load or save has observed may be seeded from the caller's object. Once a
+  // path is observed, a missing name means an authoritative observation removed it, and a stale
+  // live snapshot must not re-enroll it; adoption by load, reload or save is required.
+  if (!observed.has(getConfigPath())) observeAccountAutoPauseRevisions(config);
+  const state = observed.get(getConfigPath())?.get(name);
+  const p = provider(config, name), policy = record(p?.accountAutoPause);
+  const threshold = policy?.consecutiveFailures ?? 2;
+  if (!state || state.unknown || !p || p.disabled === true || policy?.enabled !== true || typeof threshold !== "number" || !Number.isInteger(threshold) || threshold < 1 || threshold > 100) return;
+  return { configPath: getConfigPath(), diskRevision: state.diskRevision, localGen: state.localGen, threshold, route: route(p) };
+}
+export function accountAutoPauseFenceIsLocal(name: string, fence: AccountAutoPauseFence): boolean {
+  const state = observed.get(fence.configPath)?.get(name);
+  return getConfigPath() === fence.configPath && !!state && !state.unknown
+    && state.diskRevision === fence.diskRevision && state.localGen === fence.localGen;
+}
+/** Must run inside the config mutation lock at the final persistence boundary. */
+export function accountAutoPauseFenceMatchesDisk(name: string, fence: AccountAutoPauseFence, fresh?: PolicyConfig): boolean {
+  if (!accountAutoPauseFenceIsLocal(name, fence)) return false;
+  try {
+    const disk = fresh ?? JSON.parse(readFileSync(fence.configPath, "utf8").replace(/^\uFEFF/, "")) as PolicyConfig;
+    const map = revisions(disk), p = provider(disk, name), policy = record(p?.accountAutoPause);
+    return map !== null && (revisionFor(map, name) ?? "legacy") === fence.diskRevision && !!p && p.disabled !== true
+      && policy?.enabled === true && (policy.consecutiveFailures ?? 2) === fence.threshold && route(p) === fence.route;
+  } catch { return false; }
+}

package/src/config/diagnostics.ts

@@ -21,6 +21,7 @@ import { isMissingPathError } from "./atomic-write";
 import { getConfigDir, getConfigPath } from "./paths";
 import { getDefaultConfig } from "./proxy-env";
 import { salvageConfigCandidate } from "./salvage";
+import { sanitizeRemovedOpenCodeFreeForLoad } from "./removed-opencode-free";
 import { sanitizeOpenCodeOverridesForLoad } from "./opencode-wire-upgrade";
 import {
   sanitizeReasoningPinsForLoad,
@@ -267,6 +268,16 @@ function upstreamHostCircuitThresholdError(value: unknown): string | null {
   return `schema_invalid: upstreamHostCircuitThreshold: must be an integer from 0 to ${UPSTREAM_HOST_CIRCUIT_MAX_THRESHOLD}`;
 }
 
+// The schema degrades an unknown codec to identity so a hand edit cannot break startup; a live write
+// or import must instead be refused, or it would report success and then drop the value (#7247).
+function upstreamRequestCompressionError(value: unknown): string | null {
+  const raw = rawConfigRecord(value);
+  if (!raw || !Object.hasOwn(raw, "upstreamRequestCompression")) return null;
+  const mode = raw.upstreamRequestCompression;
+  if (mode === undefined || mode === "off" || mode === "gzip" || mode === "zstd") return null;
+  return "schema_invalid: upstreamRequestCompression: must be \"off\", \"gzip\" or \"zstd\"";
+}
+
 function plaintextV2AgentMessagesError(value: unknown): string | null {
   return malformedPlaintextV2AgentMessagesWarning(value)
     ? "schema_invalid: plaintextV2AgentMessages: must be a boolean or omitted"
@@ -726,6 +737,7 @@ export function validateConfigCandidate(value: unknown): { ok: true; config: Ocx
     ?? claudeSubagentEffortError(value)
     ?? appOwnedMemoryBudgetError(value)
     ?? upstreamHostCircuitThresholdError(value)
+    ?? upstreamRequestCompressionError(value)
     ?? plaintextV2AgentMessagesError(value)
     ?? agentTaskRecoveryError(value)
     ?? quotaResetNotifyError(value)
@@ -766,6 +778,7 @@ export function validateConfigCandidate(value: unknown): { ok: true; config: Ocx
 export function configDiagnosticsFromRaw(raw: string): ConfigDiagnostics {
   try {
     const parsed = JSON.parse(raw.replace(/^\uFEFF/, ""));
+    sanitizeRemovedOpenCodeFreeForLoad(parsed);
     sanitizeOpenCodeOverridesForLoad(parsed);
     sanitizeReasoningPinsForLoad(parsed);
     // Same degradation as loadConfig: a hand-edited invalid retryOn429 must not trip the

package/src/config/live-reconcile.ts

@@ -1,3 +1,4 @@
+import { observeAccountAutoPauseRevisions, snapshotAutoPauseFingerprints } from "./account-auto-pause-revisions";
 import type { OcxConfig, OcxProviderConfig, ProviderCostOverlay } from "../types";
 import { configReasoningPinsConfigError } from "./provider-validation";
 import { adoptCustomModelCatalogMigration, projectCustomModelCatalogMigration } from "../codex/custom-model-catalog-migration";
@@ -18,6 +19,7 @@ import { withConfigMutationLockSync, bumpGenerationForCooperatingConfigWrite } f
 import { ConfigWritePublishedError, persistConfigUnlocked, readRawConfigJson } from "./persist-unlocked";
 import { configDiagnosticsFromRaw, readConfigDiagnostics, validateConfigCandidate } from "./diagnostics";
 import { normalizePersistedClaudeCode } from "./load-degrade";
+import { sanitizeRemovedOpenCodeFreeForLoad } from "./removed-opencode-free";
 import { reconcileApiKeys } from "./api-key-reconcile";
 import { captureLiveTopologyBaseline, LIVE_TOPOLOGY_KEYS, projectLiveTopology } from "./live-topology";
 
@@ -161,7 +163,9 @@ export function adoptPersistedProviderIntoLiveConfig(
   provider: OcxProviderConfig,
   persistedConfig?: OcxConfig,
 ): void {
+  const pauseBefore = snapshotAutoPauseFingerprints(config);
   config.providers[name] = structuredClone(provider);
+  observeAccountAutoPauseRevisions(config, persistedConfig ?? readRawConfigJson() ?? { accountAutoPausePolicyRevisions: null }, pauseBefore);
   const baseline = liveConfigBaseline.get(config);
   if (baseline) baseline.providers[name] = structuredClone(provider);
   if (persistedConfig) refreshPreservedProviderOwner(config, persistedConfig);
@@ -436,6 +440,7 @@ export function reconcileLiveConfigFromDisk(config: OcxConfig, persistedBaseline
   if (diagnostics.source === "fallback") {
     throw new Error(`OAuth config reconciliation failed: ${diagnostics.error ?? "invalid config file"}`);
   }
+  const pauseBefore = snapshotAutoPauseFingerprints(config);
   const persisted = diagnostics.config;
   const claudeGuardArmed = claudeCodeBaseline.has(config);
   const pendingLiveClaudeMutation = claudeGuardArmed
@@ -460,6 +465,7 @@ export function reconcileLiveConfigFromDisk(config: OcxConfig, persistedBaseline
     else config.claudeCode = structuredClone(persisted.claudeCode);
     claudeCodeBaseline.set(config, structuredClone(config.claudeCode));
   }
+  observeAccountAutoPauseRevisions(config, persisted, pauseBefore);
   // The reconciliation may have adopted a providers.<name>.modelCosts edit made
   // by a cooperating process while the OAuth login was pending; keep the overlay
   // registry (and the usage-cache overlay version) in sync with the live config.
@@ -526,6 +532,8 @@ export function saveConfigPreservingClaudeCode(config: OcxConfig): void {
     // One authoritative pre-write read feeds both the live-config reconciliation and
     // custom-model deletion migration. A second read could observe different bytes.
     const onDisk = readRawConfigJson();
+    sanitizeRemovedOpenCodeFreeForLoad(onDisk);
+    const pauseBefore = snapshotAutoPauseFingerprints(config);
     const baseline = liveConfigBaseline.get(config);
     let diskDeletedKeys = new Set<string>();
     let persistedSnapshot: OcxConfig | undefined;
@@ -576,6 +584,7 @@ export function saveConfigPreservingClaudeCode(config: OcxConfig): void {
         }
       }
     }
+    observeAccountAutoPauseRevisions(config, onDisk ?? config, pauseBefore);
     applyConfigObjectChildDeletions(config, childDeletions);
     // Recursive three-way merging preserves sibling rows; explicit PUT/reset
     // replaces only its model after merging, including absent policy fields.

package/src/config/persist-unlocked.ts

@@ -1,3 +1,4 @@
+import { normalizeAccountAutoPauseRevisions, observeAccountAutoPauseRevisions, snapshotAutoPauseFingerprints } from "./account-auto-pause-revisions";
 import { existsSync, readFileSync } from "node:fs";
 import { configReasoningPinsConfigError } from "./provider-validation";
 import type { OcxConfig } from "../types";
@@ -78,6 +79,8 @@ export function persistConfigUnlocked(config: OcxConfig): boolean {
   const persisted = withPreservedDiskOnlyProviders(config);
   if (provenanceProjection.configRebaseProvenance === undefined) delete persisted.configRebaseProvenance;
   else persisted.configRebaseProvenance = provenanceProjection.configRebaseProvenance;
+  normalizeAccountAutoPauseRevisions(rawBeforeWrite, persisted);
+  const beforeFingerprints = snapshotAutoPauseFingerprints(rawBeforeWrite ?? {});
   const bytes = JSON.stringify(persisted, null, 2) + "\n";
   let unchanged = false;
   try {
@@ -90,6 +93,7 @@ export function persistConfigUnlocked(config: OcxConfig): boolean {
   // the same bytes (e.g. before a proxy notification), and Logs/Usage must
   // adopt the overlay without waiting for a changed save or restart.
   let published = unchanged;
+  let observedPublication = false;
   try {
     if (!unchanged) {
       atomicWriteFile(configPath, bytes, undefined, { afterRename: () => { published = true; } });
@@ -97,10 +101,15 @@ export function persistConfigUnlocked(config: OcxConfig): boolean {
     }
     // Publication, not successful cache refresh, is the rollback boundary. A
     // byte-identical save already has the requested state on disk as well.
+    observeAccountAutoPauseRevisions(persisted, persisted, beforeFingerprints);
+    observedPublication = true;
     refreshConfigDerivedRegistries(persisted);
     return !unchanged;
   } catch (error) {
-    if (published) throw new ConfigWritePublishedError(error);
+    if (published) {
+      if (!observedPublication) observeAccountAutoPauseRevisions(persisted, persisted, beforeFingerprints);
+      throw new ConfigWritePublishedError(error);
+    }
     throw error;
   }
 }

package/src/config/removed-opencode-free.ts

@@ -0,0 +1,135 @@
+import { getDefaultConfig } from "./proxy-env";
+import { DESKTOP_FAMILIES } from "../claude/desktop-profile";
+
+const REMOVED_PROVIDER = "opencode-free";
+let warned = false;
+
+function record(value: unknown): Record<string, unknown> | undefined {
+  return value !== null && typeof value === "object" && !Array.isArray(value)
+    ? value as Record<string, unknown> : undefined;
+}
+
+/** Load-only projection, like the OpenCode wire upgrades: never rewrites config.json. */
+export function sanitizeRemovedOpenCodeFreeForLoad(parsed: unknown): void {
+  const config = record(parsed);
+  if (!config) return;
+  const providers = record(config.providers);
+  const retiredProviders = new Set([REMOVED_PROVIDER]);
+  const retiredRoutes = new Set<string>();
+  let changed = false;
+  if (providers) {
+    for (const [name, value] of Object.entries(providers)) {
+      const provider = record(value);
+      if (name !== REMOVED_PROVIDER && ![provider?.adapter, provider?.type, provider?.id, provider?.preset, record(provider?.preset)?.id, provider?.presetId, provider?.providerType].includes(REMOVED_PROVIDER)) continue;
+      retiredProviders.add(name);
+      if (typeof provider?.alias === "string") retiredProviders.add(provider.alias.trim());
+      delete providers[name];
+      changed = true;
+    }
+  }
+  const retired = (value: unknown): boolean => typeof value === "string"
+    && (retiredProviders.has(value.trim()) || retiredProviders.has(value.trim().split("/")[0]!) || retiredRoutes.has(value.trim()));
+
+  // Prune references in arrays/maps as well as structured provider/model targets. A decision
+  // model is required operator intent: disable that combo instead of choosing another service.
+  function prune(value: unknown, preserveContainer = false): unknown {
+    if (retired(value)) { changed = true; return undefined; }
+    if (Array.isArray(value)) return value.map(item => prune(item)).filter(item => item !== undefined);
+    const row = record(value);
+    if (!row) return value;
+    if (!preserveContainer && [row.provider, row.model, row.decisionModel, row.decisionProvider].some(retired)) {
+      changed = true;
+      return undefined;
+    }
+    const hadTargets = Array.isArray(row.targets) && row.targets.length > 0;
+    const hadCandidates = Array.isArray(row.candidates) && row.candidates.length > 0;
+    const hadSourceModels = Array.isArray(row.sourceModels) && row.sourceModels.length > 0;
+    for (const [key, child] of Object.entries(row)) {
+      // Descriptions and credential/transport data are not model references.
+      if (["note", "description", "displayName", "label", "modelProfile", "headers", "apiKey", "apiKeys", "baseUrl", "modelDisplayNames"].includes(key)) continue;
+      const next = retired(key) ? undefined : prune(child);
+      if (next === undefined) { delete row[key]; changed = true; }
+      else row[key] = next;
+    }
+    // Empty combos/profiles cannot pass schema validation or execute a request.
+    if ((hadTargets && Array.isArray(row.targets) && row.targets.length === 0)
+      || (hadCandidates && Array.isArray(row.candidates) && row.candidates.length === 0)
+      || (hadSourceModels && Array.isArray(row.sourceModels) && row.sourceModels.length === 0)) return undefined;
+    return row;
+  }
+
+  // Register removed public aliases before pruning remaining references, including a
+  // combo whose decision model points to another combo disabled later in the map.
+  let removedRoute: boolean;
+  do {
+    removedRoute = false;
+    for (const [section, namespace] of [["combos", "combo"], ["routingProfiles", "policy"]] as const) {
+      const routes = record(config[section]);
+      if (!routes) continue;
+      for (const [id, value] of Object.entries(routes)) {
+        const alias = record(value)?.alias;
+        if (prune(value) !== undefined) continue;
+        delete routes[id];
+        retiredRoutes.add(`${namespace}/${id}`);
+        if (typeof alias === "string") retiredRoutes.add(alias.trim());
+        changed = removedRoute = true;
+      }
+    }
+  } while (removedRoute);
+  // A retired default falls back to the standard built-in OAuth route, without moving a
+  // user's choice to a different billable provider. Preserve any configured OpenAI row.
+  if (retired(config.defaultProvider)) {
+    const defaults = getDefaultConfig();
+    config.providers = { ...defaults.providers, ...providers };
+    config.defaultProvider = defaults.defaultProvider;
+    changed = true;
+  }
+  const depletedFallbacks = new Set(Object.entries(record(config.subagentModelFallbackByModel) ?? {})
+    .filter(([, chain]) => Array.isArray(chain) && chain.some(retired)).map(([model]) => model));
+  const desktopProfile = record(record(config.claudeCode)?.desktopProfile);
+  const desktopAssignments = record(desktopProfile?.assignments);
+  const desktopDefaults = record(desktopProfile?.defaults);
+  const retiredDesktopRoute = Object.keys(desktopAssignments ?? {}).some(retired)
+    || Object.values(desktopDefaults ?? {}).some(retired);
+  if (retired(config.injectionModel)) {
+    delete config.syncCodexSubagentDefaults;
+    delete config.injectionEffort;
+  }
+  for (const [key, value] of Object.entries(config)) {
+    if (key === "providers" || !/model|provider|combo|routing|claudeCode|fallback|redirect|compaction|autoReview|advisor|tokenGuardian|images|codexRoleTiers|sidecar|shadowCallIntercept/i.test(key)) continue;
+    const next = prune(value, key === "claudeCode");
+    if (next === undefined) delete config[key];
+    else config[key] = next;
+  }
+  // Desktop defaults require a member of their family, or null for an empty family.
+  // Repair only profiles affected by this migration; unrelated invalid input still degrades.
+  if (retiredDesktopRoute && desktopAssignments && desktopDefaults) {
+    for (const family of DESKTOP_FAMILIES) {
+      const current = desktopDefaults[family];
+      if (typeof current === "string" && record(desktopAssignments[current])?.family === family) continue;
+      desktopDefaults[family] = Object.keys(desktopAssignments)
+        .filter(route => record(desktopAssignments[route])?.family === family).sort()[0] ?? null;
+    }
+  }
+  if (providers) {
+    for (const provider of Object.values(providers)) {
+      const row = record(provider);
+      if (!row) continue;
+      for (const key of ["defaultModel", "autoReviewModel", "autoReviewModelOverrides"]) {
+        const next = prune(row[key], key === "autoReviewModelOverrides");
+        if (next === undefined) delete row[key];
+        else row[key] = next;
+      }
+    }
+  }
+  const fallbacks = record(config.subagentModelFallbackByModel);
+  if (fallbacks) {
+    for (const [model, chain] of Object.entries(fallbacks)) {
+      if (depletedFallbacks.has(model) && Array.isArray(chain) && chain.length === 0) delete fallbacks[model];
+    }
+  }
+  if (changed && !warned) {
+    warned = true;
+    console.warn("opencode-free support was removed because every free model now returns 403 permission_denied under OpenCode's upstream free-tier gate (#7255); the entry and dependent references are disabled. Use opencode-go, or another provider such as opencode-zen or openrouter.");
+  }
+}

package/src/config/schema/account-auto-pause.ts

@@ -0,0 +1,14 @@
+import * as z from "zod/v4";
+import { ACCOUNT_PAUSE_REASONS } from "../../types/account-auto-pause";
+
+export const accountAutoPausePolicySchema = z.object({
+  enabled: z.boolean().optional(),
+  consecutiveFailures: z.number().int().min(1).max(100).optional(),
+}).strict();
+export const accountPauseDetailsSchema = z.object({
+  reason: z.enum(ACCOUNT_PAUSE_REASONS),
+  pausedAt: z.number().int().nonnegative(),
+}).strict();
+export const accountPauseStateSchema = z.record(z.string(), z.object({
+  revision: z.string(), details: accountPauseDetailsSchema.optional(),
+}).strict());

package/src/config/schema/config-schema.ts

@@ -1,6 +1,7 @@
 import { MAIN_ACCOUNT_HARD_LOCK_MIN_PERCENT } from "../../codex/quota-types";
 import { validRemainingQuotaAccountIds } from "../../codex/account-use-remaining";
 import * as z from "zod/v4";
+import { accountPauseStateSchema } from "./account-auto-pause";
 import { anthropicAccountPoolSchema } from "./anthropic-account-pool";
 import { compactionRecoverySchema } from "./compaction-recovery";
 import { nativeReasoningRetentionSchema } from "./native-reasoning-retention";
@@ -163,6 +164,9 @@ export const configSchema = z.object({
     .min(0)
     .optional()
     .catch(undefined),
+  // Opt-in outbound request compression (#7247). An unknown codec degrades to identity, matching
+  // the guards above: a hand-edit typo must not change what the proxy sends or refuse traffic.
+  upstreamRequestCompression: z.enum(["off", "gzip", "zstd"]).optional().catch(undefined),
   // Opt-in inbound body ceiling (#3573). An invalid hand edit degrades to the 256 MiB default
   // rather than failing the parse, matching the outbound guard above: a malformed number must
   // not change what the proxy admits. The hard ceiling is NOT enforced here — because of that
@@ -303,6 +307,17 @@ export const configSchema = z.object({
   // and the default label is emitted, rather than failing the parse or writing a config Codex
   // would refuse to load — the provider id routing depends on is never derived from it.
   codexProviderDisplayName: z.string().trim().min(1).max(128).optional().catch(undefined),
+  // Preserve an invalid marker: silently treating corrupt epochs as legacy would grant stale attempts authority.
+  accountAutoPausePolicyRevisions: z.record(z.string(), z.uuid()).nullable().optional().catch(null),
+  // Details are display-only; keep each usable resume revision and the separate paused-id authority.
+  codexAccountPauseState: z.preprocess(value => {
+    if (!value || typeof value !== "object" || Array.isArray(value)) return undefined;
+    return Object.fromEntries(Object.entries(value).flatMap(([id, row]) => {
+      if (!row || typeof row !== "object" || Array.isArray(row) || typeof row.revision !== "string") return [];
+      const parsed = accountPauseStateSchema.safeParse({ [id]: row });
+      return [[id, parsed.success ? parsed.data[id] : { revision: row.revision }]];
+    }));
+  }, accountPauseStateSchema.optional()),
   pausedCodexAccountIds: z.array(z.string().regex(/^[a-zA-Z0-9._-]{1,64}$/)).optional(),
   // A malformed allow-list degrades to "no account spends credits" rather than failing the parse,
   // so a hand-edited typo cannot trip the backup-and-defaults repair path; the write path rejects

package/src/config/schema/leaf-validators.ts

@@ -1,4 +1,5 @@
 import * as z from "zod/v4";
+import { accountAutoPausePolicySchema, accountPauseDetailsSchema } from "./account-auto-pause";
 import { anthropicAccountPoolSchema } from "./anthropic-account-pool";
 import { join } from "node:path";
 import { isValidProviderName } from "../provider-name";
@@ -303,6 +304,8 @@ const providerNoProxySchema = z.unknown().superRefine((value, ctx) => {
  * fields pass through (preserved for runtime extensions).
  */
 export const providerConfigSchema = z.object({
+  accountAutoPause: accountAutoPausePolicySchema.optional(),
+  apiKeyPool: z.array(z.object({ id: z.string(), key: z.string(), label: z.string().optional(), addedAt: z.number().optional(), disabled: z.boolean().optional(), pauseRevision: z.string().optional(), pauseDetails: accountPauseDetailsSchema.optional() }).passthrough()).optional(),
   anthropicAccountPool: anthropicAccountPoolSchema,
   // Raw diagnostics/writes reject malformed provenance; tolerant loads preserve the custom row.
   anthropicOAuthInstance: z.literal("anthropic2").optional().catch(undefined),
@@ -1020,12 +1023,16 @@ export const codexPoolSchema = z.object({
     actions: z.object({
       pause: z.boolean(),
       notify: z.boolean(),
+      desktop: z.boolean().optional(),
     }).strict(),
     windows: z.object({
       short: z.boolean(),
       weekly: z.boolean(),
     }).strict(),
   }).strict().superRefine((policy, ctx) => {
+    if (policy.actions.desktop === true && !policy.actions.notify) {
+      ctx.addIssue({ code: "custom", path: ["actions", "desktop"], message: "desktop low-quota notification requires notify" });
+    }
     if (!policy.enabled) return;
     if (!policy.actions.pause && !policy.actions.notify) {
       ctx.addIssue({ code: "custom", path: ["actions"], message: "enabled low-quota protection needs an action" });