@iislee/opencodex 2.11.0 → 2.31.0

package/src/server/adapter-resolve.ts

@@ -1,11 +1,4 @@
-import { createAnthropicAdapter } from "../adapters/anthropic";
-import { createAzureAdapter } from "../adapters/azure";
-import { createCursorAdapter } from "../adapters/cursor";
-import { createGoogleAdapter } from "../adapters/google";
-import { createKiroAdapter } from "../adapters/kiro";
-import { createMimoFreeAdapter } from "../adapters/mimo-free";
-import { createOpenAIChatAdapter } from "../adapters/openai-chat";
-import { createResponsesPassthroughAdapter } from "../adapters/openai-responses";
+import { createRegisteredAdapter } from "../adapters/registry";
 import type { OcxProviderConfig } from "../types";
 import { isWirePinnedModel, MODEL_ADAPTER_OVERRIDE_ALLOWED, pinnedWireAdapter } from "../types";
 import { isCanonicalOpenAiForwardProvider } from "../providers/openai-tiers";
@@ -56,25 +49,5 @@ export function resolveWireProtocolOverride(
 
 /** Build the provider adapter for a resolved provider config. */
 export function resolveAdapter(providerConfig: OcxProviderConfig, cacheRetention?: "none" | "short" | "long") {
-  switch (providerConfig.adapter) {
-    case "openai-chat":
-      return createOpenAIChatAdapter(providerConfig);
-    case "anthropic":
-      return createAnthropicAdapter(providerConfig, cacheRetention);
-    case "openai-responses":
-      return createResponsesPassthroughAdapter(providerConfig);
-    case "google":
-      return createGoogleAdapter(providerConfig);
-    case "kiro":
-      return createKiroAdapter(providerConfig);
-    case "azure":
-    case "azure-openai":
-      return createAzureAdapter(providerConfig);
-    case "cursor":
-      return createCursorAdapter(providerConfig);
-    case "mimo-free":
-      return createMimoFreeAdapter(providerConfig);
-    default:
-      throw new Error(`Unknown adapter: ${providerConfig.adapter}`);
-  }
+  return createRegisteredAdapter(providerConfig, { cacheRetention });
 }

package/src/server/auth-cors.ts

@@ -4,18 +4,28 @@ import {
   apiKeyTransportConfigError,
   booleanRecordConfigError,
   modelAdapterRecordConfigError,
+  modelPreferHostedToolsConfigError,
   codexAutoStartEnabled,
+  nonBlankStringArrayConfigError,
   positiveIntegerConfigError,
   positiveIntegerRecordConfigError,
   providerBaseUrlConfigError,
   providerHeadersConfigError,
+  providerModelCostsConfigError,
   reasoningSummaryDeliveryRecordConfigError,
+  retryOn429PolicyConfigError,
+  requestPacingConfigError,
+  sanitizeModelCostsForDisplay,
+  upstreamHttpVersionConfigError,
 } from "../config";
 import { providerDestinationConfigError } from "../lib/destination-policy";
-import { getProviderRegistryEntry, providerCodexAccountMode, providerMatchesRegistryTransport, registryEntryForProviderDestination } from "../providers/registry";
+import { redactSecretString } from "../lib/redact";
+import { effectiveGoogleMode, getProviderRegistryEntry, providerCodexAccountMode, providerMatchesRegistryTransport, registryEntryForProviderDestination } from "../providers/registry";
 import { providerConfigSeed } from "../providers/derive";
 import type { OcxConfig, OcxProviderConfig } from "../types";
 import { openRouterRoutingConfigError } from "../providers/openrouter-routing";
+import { googleVertexLocationConfigError } from "../providers/google-vertex-location";
+import { xaiResponsesOptInState } from "../providers/xai-responses-opt-in";
 
 let _corsOrigin = "http://localhost:10100";
 export function setCorsOrigin(port: number): void { _corsOrigin = `http://localhost:${port}`; }
@@ -69,7 +79,7 @@ export function isSameOriginAsRequest(req: Request, origin: string): boolean {
   }
 }
 
-export function isAllowedRequestOrigin(req: Request, config: OcxConfig): boolean {
+export function isAllowedRequestOrigin(req: Request, config: RequestPolicyView): boolean {
   const origin = req.headers.get("Origin");
   if (!isApiAuthRequired(config)) {
     if (!isLoopbackRequestHost(req.headers.get("Host"))) return false;
@@ -78,17 +88,30 @@ export function isAllowedRequestOrigin(req: Request, config: OcxConfig): boolean
   return !origin || isLoopbackOriginValue(origin) || isSameOriginAsRequest(req, origin) || isExtraAllowedOrigin(origin, config);
 }
 
-function isExtraAllowedOrigin(origin: string, cfg: OcxConfig): boolean {
+function isExtraAllowedOrigin(origin: string, cfg: RequestPolicyView): boolean {
   if (!cfg.corsAllowOrigins?.length) return false;
+  const parsedOrigin = comparableOrigin(origin);
   return cfg.corsAllowOrigins.some(allowed => {
-    try {
-      return new URL(allowed).origin === new URL(origin).origin;
-    } catch {
-      return allowed === origin;
-    }
+    const parsedAllowed = comparableOrigin(allowed);
+    return parsedOrigin !== null && parsedAllowed !== null
+      ? parsedAllowed === parsedOrigin
+      : allowed === origin;
   });
 }
 
+function comparableOrigin(value: string): string | null {
+  try {
+    const parsed = new URL(value);
+    if (parsed.origin !== "null") return parsed.origin;
+    // WHATWG URL exposes authority-based custom schemes (for example browser
+    // extensions) as opaque `null` origins. Compare their scheme + authority so
+    // one allowlisted extension cannot admit every other opaque origin.
+    return parsed.host ? `${parsed.protocol}//${parsed.host}` : null;
+  } catch {
+    return null;
+  }
+}
+
 export function managementRequestOrigin(req: Request, config: OcxConfig): string | null {
   const host = req.headers.get("Host");
   const parsedHost = parseHttpHost(host);
@@ -119,17 +142,53 @@ export function browserSecurityHeaders(): Record<string, string> {
   };
 }
 
-export function corsHeaders(req?: Request, config?: OcxConfig): Record<string, string> {
+/**
+ * Baseline data-plane request headers. ChatGPT-Account-Id is required for browser/Electron
+ * ChatGPT & Codex App voice preflights (direct forward auth matches the bearer to this account
+ * id). The OpenAI-Alpha .. X-OAI-Attestation block covers GPT-Live voice protocol headers
+ * relayed by the /v1/live call-create path.
+ */
+const STATIC_ALLOWED_REQUEST_HEADERS =
+  "Content-Type, Authorization, X-OpenCodex-API-Key, X-Api-Key, Anthropic-Version, Anthropic-Beta, ChatGPT-Account-Id, OpenAI-Alpha, X-Session-Id, Session-Id, Thread-Id, Originator, X-OAI-Attestation";
+
+/**
+ * A fixed allow-list cannot enumerate vendor telemetry headers: the OpenAI and Anthropic
+ * browser SDKs send `X-Stainless-*` describing runtime and retry state, and the browser blocks
+ * the real request when the preflight omits even one of them (#1773).
+ *
+ * Echo what an already-allowed origin asked for, and fall back to the static list otherwise.
+ * The echo is deliberately gated on the origin check that ran first: this widens which headers
+ * an admitted caller may send, never which origins are admitted, and it grants nothing to an
+ * origin that would have been rejected anyway. Authentication is unchanged — the preflight
+ * itself carries no credential and produces no auth or account-pool side effect.
+ */
+function allowedRequestHeaders(req?: Request): string {
+  const requested = req?.headers.get("Access-Control-Request-Headers")?.trim();
+  if (!requested) return STATIC_ALLOWED_REQUEST_HEADERS;
+  const seen = new Set(STATIC_ALLOWED_REQUEST_HEADERS.split(",").map(h => h.trim().toLowerCase()));
+  const extra: string[] = [];
+  for (const raw of requested.split(",")) {
+    const name = raw.trim();
+    // Header names are case-insensitive on the wire, so normalize before de-duplicating;
+    // echo the caller's spelling for the ones we add.
+    if (!name || seen.has(name.toLowerCase())) continue;
+    seen.add(name.toLowerCase());
+    extra.push(name);
+  }
+  return extra.length === 0 ? STATIC_ALLOWED_REQUEST_HEADERS : `${STATIC_ALLOWED_REQUEST_HEADERS}, ${extra.join(", ")}`;
+}
+
+export function corsHeaders(req?: Request, config?: RequestPolicyView): Record<string, string> {
   const origin = req?.headers.get("Origin");
-  const allowOrigin = origin && req && config && isAllowedRequestOrigin(req, config) ? origin : _corsOrigin;
+  const originAllowed = Boolean(origin && req && config && isAllowedRequestOrigin(req, config));
+  const allowOrigin = originAllowed && origin ? origin : _corsOrigin;
   return {
     "Access-Control-Allow-Origin": allowOrigin,
     "Access-Control-Allow-Methods": "GET, POST, PUT, PATCH, DELETE, OPTIONS",
-    // ChatGPT-Account-Id is required for browser/Electron ChatGPT & Codex App voice preflights
-    // (direct forward auth matches the bearer to this account id). The OpenAI-Alpha .. X-OAI-Attestation
-    // block covers GPT-Live voice protocol headers relayed by the /v1/live call-create path.
-    "Access-Control-Allow-Headers": "Content-Type, Authorization, X-OpenCodex-API-Key, X-Api-Key, Anthropic-Version, Anthropic-Beta, ChatGPT-Account-Id, OpenAI-Alpha, X-Session-Id, Session-Id, Thread-Id, Originator, X-OAI-Attestation",
-    "Vary": "Origin",
+    "Access-Control-Allow-Headers": allowedRequestHeaders(originAllowed ? req : undefined),
+    // A response that varies by the request's headers must say so, or a shared cache can
+    // replay one client's allow-list to a client that asked for different headers.
+    "Vary": "Origin, Access-Control-Request-Headers",
     ...browserSecurityHeaders(),
   };
 }
@@ -143,7 +202,7 @@ export function managementCorsHeaders(req?: Request, config?: OcxConfig): Record
   return headers;
 }
 
-export function withCors(response: Response, req: Request, config: OcxConfig): Response {
+export function withCors(response: Response, req: Request, config: RequestPolicyView): Response {
   const headers = new Headers(response.headers);
   for (const [name, value] of Object.entries(corsHeaders(req, config))) {
     headers.set(name, value);
@@ -167,14 +226,18 @@ export function withManagementCors(response: Response, req: Request, config: Ocx
   });
 }
 
-export function jsonResponse(data: unknown, status = 200, req?: Request, config?: OcxConfig): Response {
+export function jsonResponse(data: unknown, status = 200, req?: Request, config?: RequestPolicyView): Response {
   return new Response(JSON.stringify(data), {
     status,
     headers: { "Content-Type": "application/json", ...corsHeaders(req, config) },
   });
 }
 
-export function configuredApiAuthToken(_config: OcxConfig): string | undefined {
+// The parameter is vestigial — the token has always come from the environment — but callers
+// pass a config, so keep accepting one. Typed as `unknown` rather than `OcxConfig` so a narrow
+// policy view can reach it too (#1102); widening to OcxConfig here would force every caller in
+// the admission path back to the full config.
+export function configuredApiAuthToken(_config?: unknown): string | undefined {
   const token = process.env.OPENCODEX_API_AUTH_TOKEN?.trim();
   return token || undefined;
 }
@@ -191,10 +254,37 @@ export function isLoopbackHostname(hostname: string | undefined): boolean {
   return normalized === "" || normalized === "localhost" || normalized === "127.0.0.1" || normalized === "::1" || normalized === "[::1]";
 }
 
-export function isApiAuthRequired(config: OcxConfig): boolean {
+export function isApiAuthRequired(config: Pick<OcxConfig, "hostname">): boolean {
   return !isLoopbackHostname(config.hostname);
 }
 
+/**
+ * The slice of config that decides admission and CORS, and nothing else (#1102).
+ *
+ * The unauthenticated loopback listener shares this process with the public one: same routing,
+ * same account pool, same drain. The only thing it must see differently is its own bind
+ * address, because `isApiAuthRequired` reads `hostname` and the shared config says "0.0.0.0".
+ *
+ * Two ways to express that were rejected. Passing the whole config with `hostname` rewritten
+ * and holding it for the listener's lifetime would go stale the moment the management API
+ * changes a setting. Adding an `allowUnauthenticated` parameter to the resolvers would create a
+ * callable admission bypass that the PUBLIC listener could also reach — the switch would exist
+ * on the wrong side of the boundary.
+ *
+ * So this type is deliberately narrow: it cannot masquerade as a business config, and a policy
+ * view that leaks into a routing path fails to typecheck rather than silently taking effect.
+ */
+export type RequestPolicyView = Pick<OcxConfig, "hostname" | "corsAllowOrigins" | "apiKeys">;
+
+/** Derive the per-request policy view for a listener. Cheap enough to build per request. */
+export function requestPolicyView(config: OcxConfig, bindHostname: string): RequestPolicyView {
+  return {
+    hostname: bindHostname,
+    ...(config.corsAllowOrigins ? { corsAllowOrigins: config.corsAllowOrigins } : {}),
+    ...(config.apiKeys ? { apiKeys: config.apiKeys } : {}),
+  };
+}
+
 export function assertServerAuthConfig(config: OcxConfig): void {
   const hasConfiguredDataCredential = !!configuredApiAuthToken(config)
     || (config.apiKeys ?? []).some(entry => !!entry.key.trim());
@@ -222,10 +312,20 @@ function secretEquals(actual: string, expected: string | undefined): boolean {
  * point at, and a sentinel string in the id would collide with a hand-edited
  * entry that happens to be named `loopback`.
  */
+/**
+ * HOW an admission credential was presented.
+ *
+ * The credential IDENTITY (which key matched) and its PRESENTATION (which header carried it)
+ * are different facts, and #1686 needs both: a proxy secret arriving as a bearer on the
+ * Responses transport is admissible, but only if the upstream credential is then guaranteed to
+ * be substituted. Collapsing the two is what made that flow unexpressible.
+ */
+export type DataPlaneAdmissionSource = "loopback" | "dedicated" | "bearer" | "x-api-key";
+
 export type DataPlaneAdmission =
-  | { kind: "configured"; keyId: string }
-  | { kind: "environment" }
-  | { kind: "loopback" };
+  | { kind: "configured"; keyId: string; source: DataPlaneAdmissionSource }
+  | { kind: "environment"; source: DataPlaneAdmissionSource }
+  | { kind: "loopback"; source: "loopback" };
 
 /**
  * Which admission secret `token` is, or null when it is none of them.
@@ -236,12 +336,16 @@ export type DataPlaneAdmission =
  * discarded, which is what makes per-key attribution possible without touching
  * the admission decision itself.
  */
-export function resolveDataPlaneAdmissionSecret(token: string, config: OcxConfig): DataPlaneAdmission | null {
+export function resolveDataPlaneAdmissionSecret(
+  token: string,
+  config: Pick<OcxConfig, "apiKeys">,
+  source: DataPlaneAdmissionSource = "dedicated",
+): DataPlaneAdmission | null {
   const actual = token.trim();
   if (!actual) return null;
-  if (secretEquals(actual, configuredApiAuthToken(config))) return { kind: "environment" };
+  if (secretEquals(actual, configuredApiAuthToken(config))) return { kind: "environment", source };
   for (const k of config.apiKeys ?? []) {
-    if (secretEquals(actual, k.key)) return { kind: "configured", keyId: k.id };
+    if (secretEquals(actual, k.key)) return { kind: "configured", keyId: k.id, source };
   }
   return null;
 }
@@ -288,8 +392,12 @@ export interface ApiAuthMatrixRow {
  * against every cell rather than reading the table back to itself.
  */
 export const AUTH_MATRIX: readonly ApiAuthMatrixRow[] = [
-  { endpoint: "/v1/responses", bearer: "rejected", dedicated: "required", xApiKey: "rejected" },
-  { endpoint: "/v1/chat/completions", bearer: "rejected", dedicated: "required", xApiKey: "rejected" },
+  // #1686: a bearer that is one of OUR admission secrets is now accepted here. It is safe
+  // because materializeCodexUpstreamAuth substitutes the stored main credential rather than
+  // forwarding it; a bearer that is NOT our secret stays unadmitted and remains Codex Direct
+  // passthrough, so the two bearer domains still never mix. `x-api-key` is still rejected.
+  { endpoint: "/v1/responses", bearer: "accepted", dedicated: "accepted", xApiKey: "rejected" },
+  { endpoint: "/v1/chat/completions", bearer: "accepted", dedicated: "accepted", xApiKey: "rejected" },
   { endpoint: "/v1/messages", bearer: "accepted", dedicated: "accepted", xApiKey: "accepted" },
   { endpoint: "/v1/models", bearer: "accepted", dedicated: "accepted", xApiKey: "accepted" },
 ];
@@ -324,22 +432,24 @@ export function validateForwardAdmissionCredential(headers: Headers, config: Ocx
  * Resolving form of `hasValidApiAuth`: identical header precedence, identical
  * decision, but it names the admission instead of collapsing it to a boolean.
  */
-export function resolveApiAuth(req: Request, config: OcxConfig): DataPlaneAdmission | null {
+export function resolveApiAuth(req: Request, config: RequestPolicyView): DataPlaneAdmission | null {
   // A loopback bind never reads a token at all, so there is no key to name.
-  if (!isApiAuthRequired(config)) return { kind: "loopback" };
-  const actual = req.headers.get("x-opencodex-api-key")?.trim()
-    || req.headers.get("authorization")?.replace(/^Bearer\s+/i, "").trim()
-    // Anthropic-SDK clients (Claude Code with ANTHROPIC_API_KEY) authenticate via x-api-key.
-    || req.headers.get("x-api-key")?.trim();
-  if (!actual) return null;
-  return resolveDataPlaneAdmissionSecret(actual, config);
+  if (!isApiAuthRequired(config)) return { kind: "loopback", source: "loopback" };
+  const dedicated = req.headers.get("x-opencodex-api-key")?.trim();
+  if (dedicated) return resolveDataPlaneAdmissionSecret(dedicated, config, "dedicated");
+  const bearer = req.headers.get("authorization")?.replace(/^Bearer\s+/i, "").trim();
+  if (bearer) return resolveDataPlaneAdmissionSecret(bearer, config, "bearer");
+  // Anthropic-SDK clients (Claude Code with ANTHROPIC_API_KEY) authenticate via x-api-key.
+  const apiKey = req.headers.get("x-api-key")?.trim();
+  if (apiKey) return resolveDataPlaneAdmissionSecret(apiKey, config, "x-api-key");
+  return null;
 }
 
-export function hasValidApiAuth(req: Request, config: OcxConfig): boolean {
+export function hasValidApiAuth(req: Request, config: RequestPolicyView): boolean {
   return resolveApiAuth(req, config) !== null;
 }
 
-export function requireApiAuth(req: Request, config: OcxConfig, _kind: "data-plane"): Response | null {
+export function requireApiAuth(req: Request, config: RequestPolicyView, _kind: "data-plane"): Response | null {
   if (hasValidApiAuth(req, config)) return null;
   return formatErrorResponse(401, "authentication_error", "opencodex API key required");
 }
@@ -349,16 +459,25 @@ export function requireApiAuth(req: Request, config: OcxConfig, _kind: "data-pla
  * Codex Direct. Remote binds must use the dedicated proxy header so the two bearer
  * domains can never be confused.
  */
-export function resolveResponsesApiAuth(req: Request, config: OcxConfig): DataPlaneAdmission | null {
-  if (!isApiAuthRequired(config)) return { kind: "loopback" };
-  // Dedicated header ONLY. `Authorization` on these transports may belong to
-  // Codex Direct passthrough, and the two bearer domains must stay unconfusable.
-  const actual = req.headers.get("x-opencodex-api-key")?.trim();
-  if (!actual) return null;
-  return resolveDataPlaneAdmissionSecret(actual, config);
+export function resolveResponsesApiAuth(req: Request, config: RequestPolicyView): DataPlaneAdmission | null {
+  if (!isApiAuthRequired(config)) return { kind: "loopback", source: "loopback" };
+  // The dedicated header still WINS, because it is unambiguous.
+  const dedicated = req.headers.get("x-opencodex-api-key")?.trim();
+  if (dedicated) return resolveDataPlaneAdmissionSecret(dedicated, config, "dedicated");
+  // #1686: a bearer may also be one of OUR admission secrets. Rejecting it outright meant a
+  // Codex client configured with `env_key` could not reach Direct at all. Admitting it is only
+  // safe because the upstream credential is then SUBSTITUTED rather than forwarded -- see
+  // materializeCodexUpstreamAuth. A bearer that is NOT our secret stays unadmitted here and
+  // remains Codex Direct passthrough, so the two bearer domains still never mix.
+  const bearer = req.headers.get("authorization")?.replace(/^Bearer\s+/i, "").trim();
+  if (bearer) return resolveDataPlaneAdmissionSecret(bearer, config, "bearer");
+  // `x-api-key` is deliberately NOT accepted on this transport.
+  return null;
 }
 
-export function requireResponsesApiAuth(req: Request, config: OcxConfig): Response | null {
+
+
+export function requireResponsesApiAuth(req: Request, config: RequestPolicyView): Response | null {
   if (resolveResponsesApiAuth(req, config)) return null;
   return formatErrorResponse(401, "authentication_error", "opencodex API key required");
 }
@@ -375,6 +494,42 @@ function sameCanonicalProviderSeed(actual: Record<string, unknown>, expected: Oc
   return actualKeys.every(key => JSON.stringify(actual[key]) === JSON.stringify((expected as unknown as Record<string, unknown>)[key]));
 }
 
+function positiveWindowValue(value: unknown): boolean {
+  return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+}
+
+/**
+ * Shape-check the two context overlays before the canonical seed comparison drops them.
+ *
+ * `null` means "clear this" and is normalized by the PATCH field mask, but this validator
+ * also runs for POST and reload, where a whole provider object lands on disk verbatim. A
+ * `null` surviving there would be a value no reader expects, so full objects must carry a
+ * real number or omit the field.
+ */
+function nativeContextOverlayError(raw: Record<string, unknown>): string | null {
+  if (Object.hasOwn(raw, "contextWindow") && !positiveWindowValue(raw.contextWindow)) {
+    return "provider openai contextWindow must be a positive safe integer";
+  }
+  if (Object.hasOwn(raw, "modelContextWindows")) {
+    const windows = raw.modelContextWindows;
+    if (typeof windows !== "object" || windows === null || Array.isArray(windows)) {
+      return "provider openai modelContextWindows must be a plain object";
+    }
+    for (const [model, value] of Object.entries(windows as Record<string, unknown>)) {
+      if (model.trim() === "") return "provider openai modelContextWindows keys must be nonblank model ids";
+      if (!positiveWindowValue(value)) {
+        return "provider openai modelContextWindows values must be positive safe integers";
+      }
+    }
+  }
+  return null;
+}
+
+/**
+ * Validate a provider object arriving at the management write boundary. Returns an error
+ * string, or null when the provider may be persisted. Caller-controlled names/fields are
+ * redacted and JSON-escaped so secrets never reach the response.
+ */
 export function providerManagementConfigError(name: unknown, provider: unknown): string | null {
   if (typeof name !== "string" || !provider || typeof provider !== "object" || Array.isArray(provider)) {
     return "provider must be a plain object";
@@ -392,7 +547,23 @@ export function providerManagementConfigError(name: unknown, provider: unknown):
       return "provider openai codexAccountMode must be pool or direct";
     }
     if (seed) seed.codexAccountMode = raw.codexAccountMode;
-    const canonical = seed && sameCanonicalProviderSeed(raw, seed);
+    const canonicalCandidate = { ...raw };
+    delete canonicalCandidate.responsesSnapshotRepair;
+    // modelCosts is a user-owned display overlay, not part of the canonical
+    // forward seed; it is validated separately below (providerModelCostsConfigError).
+    delete canonicalCandidate.modelCosts;
+    // requestPacing is a user-owned transport overlay, not part of the canonical seed.
+    delete canonicalCandidate.requestPacing;
+    // Context windows are the same kind of user-owned overlay as requestPacing: the operator
+    // narrowing what their own native rows advertise. They can only ever LOWER the measured
+    // window (see nativeOpenAiContextWindow), so admitting them cannot widen what the proxy
+    // claims. Validated first — this function also guards POST/reload, where nothing
+    // normalizes the shape afterwards, so a bad value would reach disk.
+    const contextOverlayError = nativeContextOverlayError(raw);
+    if (contextOverlayError) return contextOverlayError;
+    delete canonicalCandidate.contextWindow;
+    delete canonicalCandidate.modelContextWindows;
+    const canonical = seed && sameCanonicalProviderSeed(canonicalCandidate, seed);
     if (!canonical) {
       return `provider ${name} must equal the canonical built-in provider seed`;
     }
@@ -402,10 +573,34 @@ export function providerManagementConfigError(name: unknown, provider: unknown):
   const typed = provider as unknown as OcxProviderConfig;
   const baseUrlError = providerBaseUrlConfigError(typed.baseUrl);
   if (baseUrlError) return `provider ${name} ${baseUrlError}`;
+  if (effectiveGoogleMode(name, typed) === "vertex" && typed.location !== undefined) {
+    const locationError = googleVertexLocationConfigError(typed.location);
+    if (locationError) return `provider ${name} ${locationError}`;
+  }
   const destinationError = providerDestinationConfigError(name, typed);
   if (destinationError) return `provider ${name} ${destinationError}`;
   const headersError = providerHeadersConfigError(typed.headers);
   if (headersError) return `provider ${name} ${headersError}`;
+  const retryOn429Error = retryOn429PolicyConfigError(raw.retryOn429);
+  if (retryOn429Error) {
+    // The provider name is caller-controlled and can be token-shaped; redact and JSON-escape
+    // it before it reaches the management API response.
+    return `provider ${JSON.stringify(redactSecretString(name))} ${retryOn429Error}`;
+  }
+  const requestPacingError = requestPacingConfigError(raw.requestPacing);
+  if (requestPacingError) {
+    return `provider ${JSON.stringify(redactSecretString(name))} ${requestPacingError}`;
+  }
+  const upstreamHttpVersionError = upstreamHttpVersionConfigError(raw.upstreamHttpVersion);
+  if (upstreamHttpVersionError) {
+    return `provider ${JSON.stringify(redactSecretString(name))} ${upstreamHttpVersionError}`;
+  }
+  const modelCostsError = providerModelCostsConfigError(raw.modelCosts);
+  if (modelCostsError) {
+    // The provider name is caller-controlled and can be token-shaped; redact and JSON-escape
+    // it before it reaches the management API response (same rule as retryOn429 above).
+    return `provider ${JSON.stringify(redactSecretString(name))} ${modelCostsError}`;
+  }
   const apiKeyTransportError = apiKeyTransportConfigError(typed);
   if (apiKeyTransportError) return `provider ${name} ${apiKeyTransportError}`;
   const maxInputError = positiveIntegerRecordConfigError(raw.modelMaxInputTokens, "modelMaxInputTokens");
@@ -419,10 +614,25 @@ export function providerManagementConfigError(name: unknown, provider: unknown):
   if (reasoningSummaryDeliveryError) return `provider ${name} ${reasoningSummaryDeliveryError}`;
   const modelAdaptersError = modelAdapterRecordConfigError(raw.modelAdapters, "modelAdapters", name, typed);
   if (modelAdaptersError) return `provider ${name} ${modelAdaptersError}`;
+  const preferHostedToolsError = modelPreferHostedToolsConfigError(
+    raw.modelPreferHostedTools,
+    "modelPreferHostedTools",
+    name,
+    typed,
+  );
+  if (preferHostedToolsError) return `provider ${name} ${preferHostedToolsError}`;
+  if (raw.responsesSnapshotRepair !== undefined && typeof raw.responsesSnapshotRepair !== "boolean") {
+    return `provider ${name} responsesSnapshotRepair must be a boolean`;
+  }
   const defaultMaxOutputError = positiveIntegerConfigError(raw.defaultMaxOutputTokens, "defaultMaxOutputTokens");
   if (defaultMaxOutputError) return `provider ${name} ${defaultMaxOutputError}`;
   const maxOutputError = positiveIntegerRecordConfigError(raw.modelMaxOutputTokens, "modelMaxOutputTokens");
   if (maxOutputError) return `provider ${name} ${maxOutputError}`;
+  const structuredOutputOptOutError = nonBlankStringArrayConfigError(
+    raw.noStructuredOutputModels,
+    "noStructuredOutputModels",
+  );
+  if (structuredOutputOptOutError) return `provider ${name} ${structuredOutputOptOutError}`;
   const openRouterError = openRouterRoutingConfigError(typed);
   if (openRouterError) return `provider ${name} ${openRouterError}`;
   if (typed.authMode === "local") {
@@ -469,6 +679,7 @@ export function copyIfDefined<K extends keyof OcxProviderConfig>(
   if (value !== undefined) out[key as string] = value as unknown;
 }
 
+/** Public dashboard DTO for config.json: provider entries with secrets stripped and documented fields exposed (including `modelCosts`). */
 export function safeConfigDTO(config: OcxConfig): unknown {
   const providers: Record<string, Record<string, unknown>> = {};
   for (const [name, provider] of Object.entries(config.providers)) {
@@ -478,6 +689,9 @@ export function safeConfigDTO(config: OcxConfig): unknown {
       hasApiKey: !!provider.apiKey,
       hasHeaders: !!provider.headers && Object.keys(provider.headers).length > 0,
     };
+    if (name === "xai") {
+      dto.xaiResponsesOptInState = xaiResponsesOptInState(provider);
+    }
     for (const key of [
       "defaultModel",
       "disabled",
@@ -487,6 +701,7 @@ export function safeConfigDTO(config: OcxConfig): unknown {
       "keyOptional",
       "freeTier",
       "liveModels",
+      "requestPacing",
       "models",
       "contextWindow",
       "modelContextWindows",
@@ -496,17 +711,23 @@ export function safeConfigDTO(config: OcxConfig): unknown {
       "modelOpenRouterRouting",
       "reasoningEfforts",
       "modelReasoningEfforts",
+      "reasoningWireFormat",
       "noVisionModels",
       "noReasoningModels",
       "noTemperatureModels",
       "noTopPModels",
       "noPenaltyModels",
+      "noStructuredOutputModels",
+      "upstreamHttpVersion",
       "autoToolChoiceOnlyModels",
       "preserveReasoningContentModels",
+      "requiresReasoningPlaceholderModels",
       "escapeBuiltinToolNames",
     ] as const) {
       copyIfDefined(dto, provider, key);
     }
+    const modelCosts = sanitizeModelCostsForDisplay(provider.modelCosts);
+    if (modelCosts) dto.modelCosts = modelCosts;
     // Resolve the note by DESTINATION, not by name. A preset saved under a custom name is
     // still pointed at the same vendor route, and a usage restriction the user needs to see
     // must not disappear because the row was renamed. Prefer the same-name entry so an