@genee/omp-opsx-addon 0.3.0 → 0.5.0

package/lib/pipe-push.ts

@@ -0,0 +1,467 @@
+// ── opsx pipe push ───────────────────────────────────────────────────
+// The push/injection layer ON TOP OF pipe-core. pipe-core owns the on-disk
+// protocol (`.omp/opsx/pipe/` layout, message structure, the four LLM tools,
+// the single shared `consume()` primitive). This module is a READ-ONLY
+// CONSUMER of that protocol:
+//
+//   fs.watch(mbox/) doorbell ──┐ (events may coalesce/drop — the watch is
+//   30s fallback tick ─────────┘  only a doorbell; readdir is the truth)
+//        → readdir + in-memory seen msg-id diff (idempotent)
+//        → read + validate candidate message files
+//        → pi.sendMessage(custom payload, { deliverAs, triggerTurn })
+//        → on success: core's consume() claims the file (atomic
+//          rename→read→delete + msg-id dedup). On inject failure the file
+//          is left untouched for the next scan (at-least-once).
+//
+// No self-built queue: steer/followUp/nextTurn ordering and idle wake-ups
+// are entirely the harness's native deliverAs/triggerTurn semantics.
+import { promises as fs, watch } from 'fs';
+import { join } from 'path';
+import type { ExtensionAPI, ExtensionContext } from '@oh-my-pi/pi-coding-agent';
+import {
+    pipeRootDir,
+    ensureLayouts,
+    normalizeDeliver,
+    consume,
+    type PipeMessage,
+    type DeliverMode,
+} from './pipe-core.js';
+
+// ── constants ────────────────────────────────────────────────────────
+
+/** Fallback scan cadence; the fs.watch doorbell normally fires instantly. */
+export const PUSH_TICK_MS = 30_000;
+
+/** customType for injected pipe messages (traceability, never user-spoofed). */
+export const PIPE_CUSTOM_TYPE = 'opsx-pipe';
+
+/** Process-global injector ownership: one push injector per process (the
+ *  primary session). Mirrors usage-poller's Symbol.for tick-owner claim —
+ *  subagent sessions also emit session_start in this process but must never
+ *  start their own watcher/injector. */
+const OWNER_KEY = Symbol.for('omp-opsx-addon.pipe-push.owner');
+
+// ── injectable seams (tests; production defaults) ────────────────────
+
+export type SendFn = (
+    payload: {
+        customType: string;
+        content: string;
+        display: boolean;
+        attribution: 'agent';
+        details: Record<string, unknown>;
+    },
+    options: { deliverAs: DeliverMode; triggerTurn: boolean },
+) => void | Promise<void>;
+
+/** Minimal structural surface over node/Bun FSWatcher used by the doorbell. */
+export interface WatchHandle {
+    close(): void;
+    on(event: 'error', cb: (err: unknown) => void): unknown;
+}
+
+export type WatchFactory = (path: string, opts: { recursive: boolean }, cb: () => void) => WatchHandle;
+
+const nodeWatchFactory: WatchFactory = (path, opts, cb) =>
+    watch(path, opts, () => cb()) as unknown as WatchHandle;
+
+let rootOverride: string | null = null;
+let watchOverride: WatchFactory | null = null;
+
+/** Test seam: redirect the pipe root (defaults to `<ctx.cwd>/.omp/opsx/pipe`). */
+export function _setRootForTest(root: string | null): void {
+    rootOverride = root;
+}
+
+/** Test seam: inject a fake fs.watch factory for deterministic degradation. */
+export function _setWatchFactoryForTest(factory: WatchFactory | null): void {
+    watchOverride = factory;
+}
+
+// ── pure helpers (unit-tested) ───────────────────────────────────────
+
+/**
+ * Fixed last-mile routing template (design D7): when `to.session` names a
+ * sub-agent inside the receiving broker, the injected text appends a hub
+ * relay instruction, `\n`-separated. Deterministic and exactly assertable.
+ */
+export function injectText(msg: PipeMessage): string {
+    return msg.to.session ? `${msg.body}\n经 hub send 转给 ${msg.to.session}` : msg.body;
+}
+
+/** Structural validation for a message parsed off disk. Mirrors the minimal
+ *  shape check core's consume() does; `deliver` is re-validated through
+ *  core's normalizeDeliver at injection time. */
+function isPipeMessage(value: unknown): value is PipeMessage {
+    if (!value || typeof value !== 'object') return false;
+    const m = value as Record<string, unknown>;
+    if (typeof m.id !== 'string' || typeof m.body !== 'string') return false;
+    if (!m.from || typeof m.from !== 'object') return false;
+    if (!m.to || typeof m.to !== 'object') return false;
+    const from = m.from as Record<string, unknown>;
+    const to = m.to as Record<string, unknown>;
+    return typeof from.broker === 'string' && typeof to.broker === 'string';
+}
+
+// ── per-broker runtime state ─────────────────────────────────────────
+
+interface PushState {
+    brokerId: string;
+    root: string;
+    /** Stop-injection flag; default false = injection enabled. */
+    muted: boolean;
+    watcher?: WatchHandle;
+    /** True once the watcher failed; the 30s tick then carries all scans. */
+    degraded: boolean;
+    tickTimer?: NodeJS.Timeout;
+    /** msg-ids already injected (idempotent diff against readdir). */
+    seen: Set<string>;
+    /** Coalesces concurrent doorbell/tick triggers into one scan chain. */
+    scanChain: Promise<unknown>;
+    stopped: boolean;
+}
+
+const states = new Map<string, PushState>();
+
+function getOwner(): string | undefined {
+    return (globalThis as Record<symbol, unknown>)[OWNER_KEY] as string | undefined;
+}
+
+function setOwner(brokerId: string | undefined): void {
+    (globalThis as Record<symbol, unknown>)[OWNER_KEY] = brokerId;
+}
+
+// ── injection ────────────────────────────────────────────────────────
+/**
+ * Inject one message via pi.sendMessage (custom entry, never spoofed as a
+ * human). deliver.mode maps 1:1 to deliverAs; triggerTurn is passed through;
+ * missing deliver defaults to followUp/true (core normalizeDeliver).
+ */
+async function injectMessage(msg: PipeMessage, send: SendFn): Promise<void> {
+    const deliver = normalizeDeliver(msg.deliver);
+    await Promise.resolve(
+        send(
+            {
+                customType: PIPE_CUSTOM_TYPE,
+                content: injectText(msg),
+                display: true,
+                attribution: 'agent',
+                details: {
+                    id: msg.id,
+                    from: msg.from,
+                    to: msg.to,
+                    ts: msg.ts,
+                    ...(msg.replyTo ? { replyTo: msg.replyTo } : {}),
+                    deliver,
+                },
+            },
+            { deliverAs: deliver.mode, triggerTurn: deliver.triggerTurn },
+        ),
+    );
+}
+
+// ── the one shared scan (watcher doorbell + fallback tick converge here) ─
+
+/**
+ * Scan this broker's mbox and inject every not-yet-seen message.
+ *
+ * Ordering (design D5): list → read/validate → inject → THEN claim via the
+ * single shared core `consume()` primitive. A failed injection leaves the
+ * file untouched (no claim this scan) so the next scan retries; a crash
+ * after injection but before claim redelivers at most once. When any
+ * candidate injection fails, the claim step is skipped entirely so failed
+ * files are never renamed away.
+ *
+ * Mute short-circuits BEFORE any filesystem read: no read, no inject, no
+ * consume — messages stay in the mbox for the pull tools to recover.
+ */
+export async function scanOnce(state: PushState, send: SendFn): Promise<{ scanned: number; injected: number }> {
+    if (state.stopped || state.muted) return { scanned: 0, injected: 0 };
+
+    const dir = join(state.root, 'mbox', state.brokerId);
+    const before = await listMessageIds(dir);
+    if (before === null) return { scanned: 0, injected: 0 }; // mailbox slot not created yet
+
+    const beforeSet = new Set(before);
+    const candidates = before.filter((id) => !state.seen.has(id)).sort();
+
+    let injected = 0;
+    /** Set only by INJECTION failures: those files must stay for retry.
+     *  Corrupt/unreadable files are NOT retentions — core's consume()
+     *  renames them aside and drops them, so they never block the claim. */
+    let injectFailed = false;
+
+    for (const id of candidates) {
+        const msg = await readMessage(join(dir, `${id}.json`));
+        if (!msg) continue; // corrupt: removed by the claim step, never injected
+        state.seen.add(id);
+        try {
+            await injectMessage(msg, send);
+            injected += 1;
+        } catch {
+            // Injection failed: do NOT claim — the file stays for the next
+            // scan, and the id is unmarked so it is retried.
+            state.seen.delete(id);
+            injectFailed = true;
+        }
+    }
+
+    // Claim via core's single consume() primitive. consume() claims the WHOLE
+    // slot (rename→read→delete for every .json), so:
+    //  1. an injection failure this scan skips the claim entirely (retry),
+    //  2. the claim runs only while the listing is STABLE — a file that
+    //     races in during the inject pass is swept unseen otherwise. When
+    //     names changed, the next scan injects the newcomer and claims once
+    //     settled (already-seen ids are not injected twice).
+    if (!injectFailed) {
+        const after = await listMessageIds(dir);
+        // Stable = the exact same name set as at scan start (no newcomer
+        // racing in, no pull-tool consumption racing out). Corrupt files
+        // count as settled: consume() drops them.
+        const stable = after !== null && after.length === before.length && after.every((id) => beforeSet.has(id));
+        if (stable) {
+            const claimed = await consume(state.root, state.brokerId);
+            for (const m of claimed) {
+                if (state.seen.has(m.id)) continue;
+                // Not injected because our own read failed transiently; the
+                // file is valid (consume parsed it) — deliver it now.
+                state.seen.add(m.id);
+                try {
+                    await injectMessage(m, send);
+                    injected += 1;
+                } catch {
+                    state.seen.delete(m.id);
+                }
+            }
+        }
+    }
+
+    return { scanned: candidates.length, injected };
+}
+
+/** List settled message ids in a broker mbox; null when the slot is absent. */
+async function listMessageIds(dir: string): Promise<string[] | null> {
+    try {
+        const names = await fs.readdir(dir);
+        return names.filter((n) => n.endsWith('.json')).map((n) => n.slice(0, -'.json'.length));
+    } catch {
+        return null;
+    }
+}
+
+/** Read + validate one message file; corrupt/unreadable → null. */
+async function readMessage(file: string): Promise<PipeMessage | null> {
+    try {
+        const parsed = JSON.parse(await fs.readFile(file, 'utf-8')) as unknown;
+        return isPipeMessage(parsed) ? parsed : null;
+    } catch {
+        return null;
+    }
+}
+
+function triggerScan(state: PushState, send: SendFn): void {
+    state.scanChain = state.scanChain
+        .then(() => scanOnce(state, send))
+        .catch(() => {
+            /* scan failures must never kill the timer/watcher chain */
+        });
+}
+
+// ── lifecycle ────────────────────────────────────────────────────────
+
+/**
+ * Start the push injector for the primary session of `ctx`. Idempotent per
+ * broker; no-ops for secondary sessions in a process that already has an
+ * owner (subagents emit session_start in-process but never inject).
+ */
+export async function startPipePush(
+    ctx: ExtensionContext,
+    send: SendFn,
+    opts?: { watchFactory?: WatchFactory; tickMs?: number },
+): Promise<void> {
+    const brokerId = ctx.sessionManager?.getSessionId?.() ?? '';
+    if (!brokerId || states.has(brokerId)) return;
+    const owner = getOwner();
+    if (owner && owner !== brokerId) return;
+
+    const root = rootOverride ?? pipeRootDir(ctx.cwd);
+    await ensureLayouts(root);
+    // Make sure our own slot exists before watching so doorbell events on
+    // newly-landed files fire in a directory that already exists.
+    await fs.mkdir(join(root, 'mbox', brokerId), { recursive: true });
+
+    const state: PushState = {
+        brokerId,
+        root,
+        muted: false,
+        degraded: false,
+        seen: new Set(),
+        scanChain: Promise.resolve(),
+        stopped: false,
+    };
+    states.set(brokerId, state);
+    setOwner(brokerId);
+
+    const tickMs = opts?.tickMs ?? PUSH_TICK_MS;
+    state.tickTimer = ctx.setInterval(() => triggerScan(state, send), tickMs);
+
+    // Doorbell: fs.watch over the whole mbox/ tree (recursive on macOS per
+    // the Bun/macOS spike). Construction failures (e.g. ENOENT) throw
+    // synchronously on Bun; error events arrive asynchronously. Either way
+    // we degrade to pure polling — the tick shares the exact same scan.
+    const factory = opts?.watchFactory ?? watchOverride ?? nodeWatchFactory;
+    try {
+        const watcher = factory(join(root, 'mbox'), { recursive: true }, () => triggerScan(state, send));
+        watcher.on('error', () => {
+            state.degraded = true;
+            try {
+                watcher.close();
+            } catch {
+                /* best-effort */
+            }
+        });
+        state.watcher = watcher;
+    } catch {
+        state.degraded = true;
+    }
+
+    // Immediate scan: drains a backlog after restart (crash-redelivery) and
+    // mirrors core's immediate heartbeat — never wait for the first tick.
+    triggerScan(state, send);
+}
+
+/** Stop the injector (session_shutdown): close watcher, clear managed timer. */
+export async function stopPipePush(ctx: ExtensionContext): Promise<void> {
+    const brokerId = ctx.sessionManager?.getSessionId?.() ?? '';
+    const state = brokerId ? states.get(brokerId) : undefined;
+    if (!state) return;
+    state.stopped = true;
+    states.delete(brokerId);
+    if (getOwner() === brokerId) setOwner(undefined);
+    try {
+        state.watcher?.close();
+    } catch {
+        /* best-effort */
+    }
+    if (state.tickTimer) ctx.clearTimer(state.tickTimer);
+    await state.scanChain.catch(() => {});
+}
+
+/** Set the stop-injection flag for a broker (the /opsx-pipe mute command). */
+export function setMuted(brokerId: string, muted: boolean): void {
+    const state = states.get(brokerId);
+    if (state) state.muted = muted;
+}
+
+export function isMuted(brokerId: string): boolean {
+    return states.get(brokerId)?.muted ?? false;
+}
+
+// ── plugin wiring ────────────────────────────────────────────────────
+
+export function registerPipePush(pi: ExtensionAPI): void {
+    pi.registerCommand('opsx-pipe', {
+        description:
+            '跨 broker pipe 推送开关：/opsx-pipe mute 翻转停注标志（默认注入开启，mute 后消息保留在 mbox 可用 opsx_pipe_recv/wait 拉取）；无参数显示当前状态。',
+        handler: async (args: string, ctx) => {
+            const brokerId = ctx.sessionManager?.getSessionId?.() ?? '';
+            const state = brokerId ? states.get(brokerId) : undefined;
+            const arg = args.trim();
+            if (arg === 'mute') {
+                if (!state) {
+                    // push 尚未初始化（session_start 未完成或启动失败）：不能谎报翻转结果
+                    pi.sendMessage(
+                        {
+                            customType: PIPE_CUSTOM_TYPE,
+                            content:
+                                '⚠️ opsx-pipe 推送尚未启动（初始化未完成或失败），停注开关暂不可用。到达的消息仍可通过 opsx_pipe_recv/opsx_pipe_wait 拉取。',
+                            display: true,
+                            attribution: 'agent',
+                        },
+                        { triggerTurn: false },
+                    );
+                    return;
+                }
+                state.muted = !state.muted;
+                pi.sendMessage(
+                    {
+                        customType: PIPE_CUSTOM_TYPE,
+                        content: state.muted
+                            ? '🔇 opsx-pipe 推送已停注（mute）：消息保留在 mbox，可用 opsx_pipe_recv/opsx_pipe_wait 拉取。再次 /opsx-pipe mute 恢复注入。'
+                            : '🔈 opsx-pipe 推送注入已开启。',
+                        display: true,
+                        attribution: 'agent',
+                    },
+                    { triggerTurn: false },
+                );
+                return;
+            }
+            pi.sendMessage(
+                {
+                    customType: PIPE_CUSTOM_TYPE,
+                    content: `opsx-pipe 状态：${state?.muted ? '🔇 已停注（mute）' : '🔈 注入开启'}${
+                        state?.degraded ? '；watcher 不可用，30s 兜底轮询中' : ''
+                    }。用法：/opsx-pipe mute 翻转停注开关。`,
+                    display: true,
+                    attribution: 'agent',
+                },
+                { triggerTurn: false },
+            );
+        },
+    });
+
+    pi.on('session_start', async (_event, ctx) => {
+        try {
+            await startPipePush(ctx, (payload, options) => pi.sendMessage(payload, options));
+        } catch {
+            /* pipe push is best-effort; never break session start */
+        }
+    });
+    pi.on('session_shutdown', async (_event, ctx) => {
+        try {
+            await stopPipePush(ctx);
+        } catch {
+            /* best-effort */
+        }
+    });
+}
+
+// ── test-only reset ──────────────────────────────────────────────────
+
+/** Test seam: clear all runtime state, ownership, and overrides. */
+export function _resetForTest(): void {
+    states.clear();
+    rootOverride = null;
+    watchOverride = null;
+    setOwner(undefined);
+}
+
+/** Test seam: inspect a broker's push state (degraded flag, seen set). */
+export function _getStateForTest(brokerId: string): PushState | undefined {
+    return states.get(brokerId);
+}
+
+/** Test seam: await the settled scan chain (doorbell/tick scans are async). */
+export async function _flushForTest(brokerId: string): Promise<void> {
+    const state = states.get(brokerId);
+    if (state) await state.scanChain.catch(() => {});
+}
+
+/** Test seam: create a quiescent push state (no timer/watcher/auto-scan) so
+ *  scanOnce logic can be driven deterministically without the lifecycle. */
+export async function _makeStateForTest(brokerId: string, cwd: string): Promise<PushState> {
+    const root = rootOverride ?? pipeRootDir(cwd);
+    await ensureLayouts(root);
+    await fs.mkdir(join(root, 'mbox', brokerId), { recursive: true });
+    const state: PushState = {
+        brokerId,
+        root,
+        muted: false,
+        degraded: true, // no watcher in this harness
+        seen: new Set(),
+        scanChain: Promise.resolve(),
+        stopped: false,
+    };
+    states.set(brokerId, state);
+    return state;
+}

package/lib/reachability-cache.ts

@@ -17,6 +17,7 @@
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { homedir } from 'node:os';
+import { getLogger } from './logger.js';
 
 // ── 缓存契约 ─────────────────────────────────────────────────────────────
 
@@ -132,7 +133,7 @@ export function writeReachabilityCache(cache: ReachabilityCacheFile): void {
     ensureDir(dirname(path));
     writeFileSync(path, JSON.stringify(cache, null, 2), 'utf-8');
   } catch (e) {
-    console.warn(`[omp-opsx-addon] failed to write reachability cache: ${e}`);
+    getLogger().warn(`[omp-opsx-addon] failed to write reachability cache: ${e}`);
   }
 }
 

package/lib/reachability-probe.ts

@@ -18,6 +18,7 @@ import { connect as tlsConnect } from 'node:tls';
 import type { TLSSocket } from 'node:tls';
 import type { Model, Api } from '@oh-my-pi/pi-catalog/types';
 import { resolveCursorAccessToken } from './cursor-auth.js';
+import { getLogger } from './logger.js';
 
 // ── 类型 ────────────────────────────────────────────────────────────────
 
@@ -424,7 +425,7 @@ export async function probeProviders(
 
   for (const s of settled) {
     if (s.status === 'rejected') {
-      console.warn(`[omp-opsx-addon] probe error: ${s.reason}`);
+      getLogger().warn(`[omp-opsx-addon] probe error: ${s.reason}`);
       continue;
     }
     const [provider, result] = s.value;
@@ -439,7 +440,7 @@ export async function probeProviders(
   }
 
   if (providerReasons.length > 0) {
-    console.warn(`[omp-opsx-addon] unreachable endpoints:\n  ${providerReasons.join('\n  ')}`);
+    getLogger().warn(`[omp-opsx-addon] unreachable endpoints:\n  ${providerReasons.join('\n  ')}`);
   }
 
   // 构建返回结果

package/lib/status-probe.ts

@@ -21,6 +21,7 @@
 import { REGION_BLOCK_TOKENS } from './reachability-probe.js';
 import { canonicalizeProvider } from './usage-resolver.js';
 import { markExhausted, markAvailable } from './provider-status.js';
+import { getLogger } from './logger.js';
 
 // ── 类型 ────────────────────────────────────────────────────────────────
 
@@ -269,14 +270,14 @@ export async function scheduleStatusProbes(opts: ScheduleOptions): Promise<numbe
       if (probeResult.class === 'exhausted' || probeResult.class === 'region-blocked') {
         markExhausted(probeResult.provider);
         written++;
-        console.info(`[omp-opsx-addon] status probe: ${canonical} -> ${probeResult.class}`);
+        getLogger().info(`[omp-opsx-addon] status probe: ${canonical} -> ${probeResult.class}`);
       } else if (probeResult.class === 'ok') {
         markAvailable(probeResult.provider);
         written++;
-        console.info(`[omp-opsx-addon] status probe: ${canonical} -> ok`);
+        getLogger().info(`[omp-opsx-addon] status probe: ${canonical} -> ok`);
       } else {
         // auth-error/model-not-found/network-error 不写状态
-        console.warn(
+        getLogger().warn(
           `[omp-opsx-addon] status probe: ${canonical} -> ${probeResult.class}${probeResult.detail ? ` (${probeResult.detail})` : ''}`,
         );
       }

package/lib/unified-config.ts

@@ -20,7 +20,11 @@
  *     which models the auto-selector may pick from.
  *   - `tiers`: list of `{ pattern, tier }` overrides for tier scoring.
  *   - `role_tiers`: `role → tier_name` map overriding the default expected
- *     tier (DEFAULT_ROLE_TIER in model-tiers).
+ *     tier (DEFAULT_ROLE_TIER in model-tiers) for the four opsx agents.
+ *   - `model_role_tiers`: `omp_role → tier_name | 'skip'` map controlling
+ *     which selector tier each OMP model role (default/smol/slow/vision/plan/
+ *     designer/commit/tiny/task/advisor + custom roles) follows after
+ *     /pick-model; `skip` excludes the role from the session overlay.
  */
 
 import { existsSync, readFileSync } from 'fs';
@@ -60,6 +64,8 @@ export interface OpsxYamlShape {
     model_allowlist?: string[];
     tiers?: TierOverride[];
     role_tiers?: Partial<Record<OpsxRole, TierName>>;
+    /** OMP model role → tier override; `skip` excludes the role from the overlay. Keys are arbitrary strings (custom roles allowed). */
+    model_role_tiers?: Record<string, string>;
     plan_providers?: string[];
     probe_enabled?: boolean;
     probe_timeout_ms?: number;
@@ -90,6 +96,8 @@ export interface ResolvedOpsxConfig {
     modelAllowlist: string[];
     tierOverrides: TierOverride[];
     roleTiers: Partial<Record<OpsxRole, TierName>>;
+    /** OMP model role → tier (or `'skip'`); drives the pick-model role overlay. */
+    ompRoleTiers: Record<string, TierName | 'skip'>;
     /** Provider ids that have monthly plan subscriptions. */
     planProviders: string[];
     warnings: string[];
@@ -217,6 +225,36 @@ export function parseRoleTiers(
     return out;
 }
 
+/**
+ * Validate `model_role_tiers` entries. Keys are OMP model role names
+ * (built-in OR custom — never checked against the built-in set); values
+ * must be a tier name or the sentinel `'skip'`. Invalid entries are dropped
+ * with a warning.
+ */
+export function parseOmpRoleTiers(
+    raw: unknown,
+    warn: (msg: string) => void,
+): Record<string, TierName | 'skip'> {
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return {};
+    const out: Record<string, TierName | 'skip'> = {};
+    for (const [role, v] of Object.entries(raw as Record<string, unknown>)) {
+        if (typeof v !== 'string') {
+            warn(`[omp-opsx-addon] model_role_tiers.${role}: expected tier name or 'skip', got ${typeof v}`);
+            continue;
+        }
+        if (v === 'skip') {
+            out[role] = 'skip';
+            continue;
+        }
+        if (!TIER_NAMES.includes(v as TierName)) {
+            warn(`[omp-opsx-addon] model_role_tiers.${role}: expected tier name or 'skip' (got "${v}"; use one of ${TIER_NAMES.join('/')})`);
+            continue;
+        }
+        out[role] = v as TierName;
+    }
+    return out;
+}
+
 /** Validate the model_allowlist (array of glob strings). */
 export function parseModelAllowlist(
     raw: unknown,
@@ -305,6 +343,7 @@ export function parseOpsxConfig(
         modelAllowlist: parseModelAllowlist(obj.model_allowlist, localWarn),
         tierOverrides: parseTierOverrides(obj.tiers, localWarn),
         roleTiers: parseRoleTiers(obj.role_tiers, localWarn),
+        ompRoleTiers: parseOmpRoleTiers(obj.model_role_tiers, localWarn),
         planProviders: sanitizePlanProviders(obj.plan_providers),
         warnings,
         probe_enabled: parseProbeBool(obj.probe_enabled, 'probe_enabled', true, localWarn),
@@ -357,6 +396,7 @@ function pickTopLevelKeys(raw: OpsxYamlShape): OpsxYamlShape {
         model_allowlist: raw.model_allowlist,
         tiers: raw.tiers,
         role_tiers: raw.role_tiers,
+        model_role_tiers: raw.model_role_tiers,
         plan_providers: raw.plan_providers,
         probe_enabled: raw.probe_enabled,
         probe_timeout_ms: raw.probe_timeout_ms,
@@ -448,6 +488,7 @@ export function readOpsxSettingsFromPaths(
     merged.model_allowlist = projectTop.model_allowlist ?? globalTop.model_allowlist;
     merged.tiers = projectTop.tiers ?? globalTop.tiers;
     merged.role_tiers = projectTop.role_tiers ?? globalTop.role_tiers;
+    merged.model_role_tiers = projectTop.model_role_tiers ?? globalTop.model_role_tiers;
     merged.plan_providers = projectTop.plan_providers ?? globalTop.plan_providers;
     merged.probe_enabled = projectTop.probe_enabled ?? globalTop.probe_enabled;
     merged.probe_timeout_ms = projectTop.probe_timeout_ms ?? globalTop.probe_timeout_ms;