@yansigit/opencodex 2.33.0 → 2.35.0

package/src/codex/subagent-model-fallback.ts

@@ -7,7 +7,7 @@
  */
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
-import { hasOwnProvider } from "../config";
+import { hasOwnProvider, resolveSubagentCandidates } from "../config";
 import { isRateLimitOrQuotaFailureMessage } from "../lib/errors";
 import type { OcxParsedRequest, OcxConfig } from "../types";
 import { slugsEquivalent } from "../providers/slug-codec";
@@ -15,12 +15,12 @@ import { CODEX_HOME, getCodexHome } from "./paths";
 import { CODEX_UNKNOWN_USAGE_SCORE, getAccountQuota } from "./quota";
 import {
   canAcquireCodexQuotaProbeLease,
+  canAcquireCodexQuotaScopeProbeLease,
   codexQuotaScopeForModel,
   computeCodexUsageScore,
   getCodexQuotaHealthSnapshot,
   getEffectiveActiveCodexAccountId,
   getPoolAccountPlan,
-  isCodexAccountInCooldown,
 } from "./routing";
 import {
   isCodexAccountUsable,
@@ -38,6 +38,7 @@ import {
 import { routeModel, type RouteResult } from "../router";
 import { sweepExpiredOnWrite } from "../lib/state-store-sweeper";
 import { codexAccountNamespaceForModel } from "./account-namespace-match";
+import { ACCOUNT_GATED_NATIVE_OPENAI_MODELS } from "./catalog/native-models";
 import {
   getUpstreamHostHealth,
   normalizeUpstreamHostCircuitThreshold,
@@ -48,6 +49,15 @@ export const DEFAULT_SUBAGENT_MODEL_FALLBACK_POLL_MS = 60_000;
 const CODEX_FORWARD_ORIGIN = new URL(CODEX_FORWARD_BASE_URL).origin.toLowerCase();
 
 type SubagentQuotaPrimeFn = (config: OcxConfig, reason: string) => Promise<void>;
+/** Side-effect-free Pool account preview for one resolved fallback candidate. */
+export type SubagentPoolAccountPreview = (
+  modelId: string | undefined,
+  now: number,
+  modelEligibleAccountIds?: ReadonlySet<string>,
+) => string | null;
+export type SubagentModelEligibleAccountIds = (
+  modelId: string | undefined,
+) => ReadonlySet<string> | undefined;
 let subagentQuotaPrimeForTests: SubagentQuotaPrimeFn | null = null;
 let quotaPrimeInFlight: Promise<void> | null = null;
 
@@ -177,8 +187,15 @@ function resolveRouteFallbackAccountId(
   route: RouteResult | null,
   config: OcxConfig,
   accountId?: string | null,
+  now = Date.now(),
+  poolAccountPreview?: SubagentPoolAccountPreview,
+  modelEligibleAccountIds?: ReadonlySet<string>,
 ): string | null {
-  return route?.codexAccountId ?? resolvePoolFallbackAccountId(config, accountId);
+  if (route?.codexAccountId !== undefined) return route.codexAccountId;
+  if (route && isPoolCodexRoute(route) && poolAccountPreview) {
+    return poolAccountPreview(route.modelId, now, modelEligibleAccountIds);
+  }
+  return resolvePoolFallbackAccountId(config, accountId);
 }
 
 function isRoutableFallbackModel(model: string, config: OcxConfig): boolean {
@@ -237,33 +254,53 @@ export function isSubagentModelUnavailable(
   accountId?: string | null,
   now = Date.now(),
   accountUsabilityOptions?: CodexAccountUsabilityOptions,
+  poolAccountPreview?: SubagentPoolAccountPreview,
+  modelEligibleAccountIdsForModel?: SubagentModelEligibleAccountIds,
 ): boolean {
   if (isDisabledFallbackModel(model, config)) return true;
   if (!isRoutableFallbackModel(model, config)) return true;
   const route = tryRouteFallbackModel(config, model);
   if (!route || route.provider.disabled === true) return true;
-  if (isModelHealthBlocked(model, config, accountId, now)) return true;
+  const modelEligibleAccountIds = modelEligibleAccountIdsForModel?.(route.modelId);
+  const candidateAccountUsabilityOptions = modelEligibleAccountIds !== undefined
+    ? {
+        ...accountUsabilityOptions,
+        modelEligibleAccountIds,
+      }
+    : accountUsabilityOptions;
+  const resolvedAccountId = resolveRouteFallbackAccountId(
+    route,
+    config,
+    accountId,
+    now,
+    poolAccountPreview,
+    candidateAccountUsabilityOptions?.modelEligibleAccountIds,
+  );
+  if (isModelHealthBlocked(model, config, resolvedAccountId, now)) return true;
   if (!isPoolCodexRoute(route)) return false;
 
   // Pool candidates need a usable account. Derive requirement from the resolved
   // route (canonical openai defaults to pool even when codexAccountMode is omitted).
-  const resolvedAccountId = resolveRouteFallbackAccountId(route, config, accountId);
   if (!resolvedAccountId) return true;
   if (isCodexAccountPaused(config, resolvedAccountId)) return true;
-  if (!isCodexAccountUsable(config, resolvedAccountId, accountUsabilityOptions)) return true;
+  if (!isCodexAccountUsable(config, resolvedAccountId, candidateAccountUsabilityOptions)) return true;
   if (route.codexAccountId !== undefined) {
     // An account-qualified route is pinned and cannot consume Pool's recovery-probe
     // escape hatch. Honor both account-wide and model-scoped cooldowns so fallback
     // advances instead of selecting a candidate that exact auth will reject.
     const quotaScope = codexQuotaScopeForModel(route.modelId);
     if (getCodexQuotaHealthSnapshot(resolvedAccountId, quotaScope, now) !== null) return true;
-  } else if (
-    isCodexAccountInCooldown(resolvedAccountId, now)
-    && !canAcquireCodexQuotaProbeLease(resolvedAccountId, now)
-  ) {
-    return true;
+  } else {
+    const quotaScope = codexQuotaScopeForModel(route.modelId);
+    const cooldown = getCodexQuotaHealthSnapshot(resolvedAccountId, quotaScope, now);
+    if (cooldown !== null) {
+      const probeAvailable = cooldown.quotaScope
+        ? canAcquireCodexQuotaScopeProbeLease(resolvedAccountId, cooldown.quotaScope, now)
+        : canAcquireCodexQuotaProbeLease(resolvedAccountId, now);
+      if (!probeAvailable) return true;
+    }
   }
-  return isNativeModelQuotaExhausted(model, config, accountId, now);
+  return isNativeModelQuotaExhausted(model, config, resolvedAccountId, now);
 }
 
 export function selectAvailableSubagentModel(
@@ -275,8 +312,11 @@ export function selectAvailableSubagentModel(
   nativeFallbackOnly = false,
   accountUsabilityOptions?: CodexAccountUsabilityOptions,
   trailingFallback: readonly string[] = [],
+  poolAccountPreview?: SubagentPoolAccountPreview,
+  modelEligibleAccountIdsForModel?: SubagentModelEligibleAccountIds,
+  resolvedChain?: readonly string[],
 ): { model: string; rewritten: boolean; skipped: string[] } {
-  const chain = normalizedChain(primary, config, extraFallback, trailingFallback);
+  const chain = resolvedChain ?? normalizedChain(primary, config, extraFallback, trailingFallback);
   const skipped: string[] = [];
   for (const candidate of chain) {
     if (nativeFallbackOnly) {
@@ -286,7 +326,15 @@ export function selectAvailableSubagentModel(
         continue;
       }
     }
-    if (isSubagentModelUnavailable(candidate, config, accountId, now, accountUsabilityOptions)) {
+    if (isSubagentModelUnavailable(
+      candidate,
+      config,
+      accountId,
+      now,
+      accountUsabilityOptions,
+      poolAccountPreview,
+      modelEligibleAccountIdsForModel,
+    )) {
       skipped.push(candidate);
       continue;
     }
@@ -295,6 +343,71 @@ export function selectAvailableSubagentModel(
   return { model: primary, rewritten: false, skipped };
 }
 
+function isSubagentCandidateFailureMessage(message: string): boolean {
+  const normalized = String(message ?? "").trim();
+  if (!normalized) return false;
+  const lower = normalized.toLowerCase();
+  // Explicit client/transport errors must win over broad 5xx/network matches.
+  if (lower.includes("connection refused")) return false;
+  if (
+    lower.includes("invalid_request_error")
+    || lower.includes("invalid request")
+    || lower.includes("missing field")
+  ) return false;
+  const numericStatus = Number(normalized);
+  if (Number.isInteger(numericStatus) && numericStatus >= 500 && numericStatus < 600) return true;
+  if (isRateLimitOrQuotaFailureMessage(normalized)) return true;
+  if (lower.includes("stream closed before response.completed")) return true;
+  if (lower.includes("upstream json response stalled before completing")) return true;
+  if (lower.includes("etimedout") || lower.includes("timed out") || lower.includes("timeout")) return true;
+  if (lower.includes("fetch failed") || lower.includes("network error")) return true;
+  if (lower.includes("provider error 503") || lower.includes("service unavailable")) return true;
+  if (lower.includes("internal server error")) return true;
+  // Connection-refused is a legacy transport signal and is intentionally not a cooldown.
+  if (/provider error 5\d\d/.test(lower)) return true;
+  return false;
+}
+
+export function resolveSubagentSpawnRoleFromHeaders(headers: Headers): string | undefined {
+  const headerRole = headers.get("x-codex-agent-role")?.trim();
+  if (headerRole) return headerRole;
+  const turnMeta = headers.get("x-codex-turn-metadata");
+  if (!turnMeta) return undefined;
+  try {
+    const parsed = JSON.parse(turnMeta) as { agent_role?: unknown };
+    const role = parsed.agent_role;
+    return typeof role === "string" && role.trim() !== "" ? role.trim() : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+export function selectAvailableSubagentCandidate(
+  candidates: readonly string[],
+  config: OcxConfig,
+  accountId?: string | null,
+  now = Date.now(),
+  nativeFallbackOnly = false,
+  accountUsabilityOptions?: CodexAccountUsabilityOptions,
+): { model: string | null; skipped: string[] } {
+  const skipped: string[] = [];
+  for (const candidate of candidates) {
+    if (nativeFallbackOnly) {
+      const route = tryRouteFallbackModel(config, candidate);
+      if (!route || !isCanonicalOpenAiForwardProvider(route.provider)) {
+        skipped.push(candidate);
+        continue;
+      }
+    }
+    if (isSubagentModelUnavailable(candidate, config, accountId, now, accountUsabilityOptions)) {
+      skipped.push(candidate);
+      continue;
+    }
+    return { model: candidate, skipped };
+  }
+  return { model: null, skipped };
+}
+
 export function noteSubagentModelFailure(
   model: string,
   message: string,
@@ -304,7 +417,7 @@ export function noteSubagentModelFailure(
   ttlMs?: number,
 ): void {
   const interval = ttlMs ?? DEFAULT_SUBAGENT_MODEL_FALLBACK_POLL_MS;
-  if (!isRateLimitOrQuotaFailureMessage(message)) return;
+  if (!isSubagentCandidateFailureMessage(message)) return;
   const route = tryRouteFallbackModel(config, model);
   const poolScoped = !!route && isPoolCodexRoute(route);
   modelHealth.set(
@@ -507,6 +620,8 @@ export function recordSubagentQuotaFailureForThreadSpawn(
   noteSubagentModelFailure(model, String(message), config, accountId, now, pollIntervalMs(config));
 }
 
+export const recordSubagentFailureForThreadSpawn = recordSubagentQuotaFailureForThreadSpawn;
+
 export function applySubagentModelFallback(
   parsed: OcxParsedRequest,
   headers: Headers,
@@ -515,27 +630,52 @@ export function applySubagentModelFallback(
   now = Date.now(),
   nativeFallbackOnly = false,
   accountUsabilityOptions?: CodexAccountUsabilityOptions,
+  poolAccountPreview?: SubagentPoolAccountPreview,
+  modelEligibleAccountIdsForModel?: SubagentModelEligibleAccountIds,
+  resolvedFallbackChain?: readonly string[] | null,
 ): { from?: string; to?: string; skipped?: string[] } | null {
   if (!isThreadSpawnRequest(headers)) return null;
-  const tomlRoleFallback = resolveAgentModelFallbackForPrimary(
-    parsed.modelId,
-    getCodexHome(),
-    config.codexAccountNamespaces,
-  );
-  // Config-keyed chains are the supported per-role home (#1190); TOML `model_fallback`
-  // stays readable for backwards compatibility with homes written before Codex 0.146.
-  const configuredFallback = resolveConfiguredModelFallbackForPrimary(parsed.modelId, config);
-  const globalFallback = config.subagentModelFallback ?? [];
-  if (globalFallback.length === 0 && configuredFallback.length === 0 && tomlRoleFallback.length === 0) return null;
+
+  if (config.subagentCandidates !== undefined) {
+    const role = resolveSubagentSpawnRoleFromHeaders(headers);
+    const candidates = resolveSubagentCandidates(config, role ?? parsed.modelId);
+    if (candidates.length > 0) {
+      const requested = parsed.modelId;
+      const selection = selectAvailableSubagentCandidate(
+        candidates,
+        config,
+        accountId,
+        now,
+        nativeFallbackOnly,
+        accountUsabilityOptions,
+      );
+      if (selection.model && !slugsEquivalent(selection.model, requested)) {
+        rewriteParsedModel(parsed, selection.model);
+        return { from: requested, to: selection.model, skipped: selection.skipped };
+      }
+      if (selection.skipped.length > 0) {
+        return { from: requested, to: requested, skipped: selection.skipped };
+      }
+      return null;
+    }
+  }
+
+  const fallbackChain = resolvedFallbackChain === undefined
+    ? resolveSubagentFallbackChain(parsed, config)
+    : resolvedFallbackChain;
+  if (!fallbackChain) return null;
   const selection = selectAvailableSubagentModel(
     parsed.modelId,
     config,
-    configuredFallback,
+    [],
     accountId,
     now,
     nativeFallbackOnly,
     accountUsabilityOptions,
-    tomlRoleFallback,
+    [],
+    poolAccountPreview,
+    modelEligibleAccountIdsForModel,
+    fallbackChain,
   );
   if (!selection.rewritten) return selection.skipped.length > 0
     ? { from: parsed.modelId, to: parsed.modelId, skipped: selection.skipped }
@@ -545,6 +685,37 @@ export function applySubagentModelFallback(
   return { from, to: selection.model, skipped: selection.skipped };
 }
 
+/** Resolve the effective fallback chain once for one logical spawn request. */
+export function resolveSubagentFallbackChain(
+  parsed: OcxParsedRequest,
+  config: OcxConfig,
+): readonly string[] | null {
+  const tomlRoleFallback = resolveAgentModelFallbackForPrimary(
+    parsed.modelId,
+    getCodexHome(),
+    config.codexAccountNamespaces,
+  );
+  // Config-keyed chains are the supported per-role home (#1190); TOML `model_fallback`
+  // stays readable for backwards compatibility with homes written before Codex 0.146.
+  const configuredFallback = resolveConfiguredModelFallbackForPrimary(parsed.modelId, config);
+  const globalFallback = config.subagentModelFallback ?? [];
+  if (globalFallback.length === 0 && configuredFallback.length === 0 && tomlRoleFallback.length === 0) return null;
+  return normalizedChain(parsed.modelId, config, configuredFallback, tomlRoleFallback);
+}
+
+/** Whether the effective fallback chain crosses an account-gated native Pool model. */
+export function subagentFallbackNeedsModelEntitlements(
+  fallbackChain: readonly string[] | null,
+  config: OcxConfig,
+): boolean {
+  return fallbackChain?.some((candidate) => {
+    const route = tryRouteFallbackModel(config, candidate);
+    return !!route
+      && isPoolCodexRoute(route)
+      && ACCOUNT_GATED_NATIVE_OPENAI_MODELS.has(route.modelId);
+  }) === true;
+}
+
 export function subagentFallbackGuidanceText(config: OcxConfig): string {
   const chain = config.subagentModelFallback ?? [];
   if (chain.length === 0) return "";

package/src/codex/transition-state.ts

@@ -10,7 +10,17 @@
  * Design record: devlog/_fin/260804_codex_write_substrate/005_contract.md §1.
  */
 import { randomUUID } from "node:crypto";
-import { chmodSync, lstatSync, realpathSync } from "node:fs";
+import {
+  chmodSync,
+  closeSync,
+  fsyncSync,
+  linkSync,
+  lstatSync,
+  openSync,
+  realpathSync,
+  unlinkSync,
+} from "node:fs";
+import { basename, dirname, join } from "node:path";
 
 import { Database } from "bun:sqlite";
 
@@ -38,7 +48,7 @@ import {
 } from "./user-identity";
 
 export const CODEX_COORDINATOR_SCHEMA_VERSION = 1;
-const DURABLE_HISTORY_STATUSES = new Set(["converged", "pending", "running", "blocked", "unknown"]);
+const DURABLE_HISTORY_STATUSES = new Set(["adoption-pending", "converged", "pending", "running", "blocked", "unknown"]);
 const DURABLE_HISTORY_REASONS = new Set([
   "db-busy",
   "permission",
@@ -66,7 +76,7 @@ const CREATE_TRANSITION_TABLE = `
     history_pending_rows INTEGER,
     history_backup_entries INTEGER,
     updated_at TEXT NOT NULL,
-    CHECK (history_status IN ('converged', 'pending', 'running', 'blocked', 'unknown')),
+    CHECK (history_status IN ('adoption-pending', 'converged', 'pending', 'running', 'blocked', 'unknown')),
     CHECK (history_reason IS NULL OR history_reason IN
       ('db-busy', 'permission', 'unreadable', 'schema', 'timeout',
        'shutdown-cancelled', 'worker-died', 'overtaken', 'record-write-failed')),
@@ -75,14 +85,20 @@ const CREATE_TRANSITION_TABLE = `
     CHECK ((native_generation = 0 AND current_tx_id IS NULL)
         OR (native_generation > 0 AND length(trim(current_tx_id)) > 0)),
     CHECK ((native_generation = 0
+            AND history_status = 'unknown'
             AND history_tx_id IS NULL
             AND history_direction IS NULL
             AND history_authority_snapshot_id IS NULL)
+        OR (native_generation = 0
+            AND history_status = 'adoption-pending'
+            AND length(trim(history_tx_id)) > 0
+            AND history_direction IS NOT NULL
+            AND length(trim(history_authority_snapshot_id)) > 0)
         OR (native_generation > 0
             AND history_tx_id = current_tx_id
             AND history_direction IS NOT NULL
             AND length(trim(history_authority_snapshot_id)) > 0)),
-    CHECK (native_generation > 0 OR
+    CHECK (native_generation > 0 OR history_status = 'adoption-pending' OR
       (history_status = 'unknown'
        AND history_reason IS NULL
        AND history_attempts = 0
@@ -100,6 +116,15 @@ const INITIALIZE_TRANSITION_ROW = `
     history_backup_entries, updated_at
   ) VALUES (1, 0, NULL, 'unknown', NULL, 0, NULL, NULL, NULL, NULL, NULL, NULL, ?)`;
 
+const INITIALIZE_ADOPTION_ROW = `
+  INSERT INTO codex_transition_state (
+    singleton, native_generation, current_tx_id,
+    history_status, history_reason, history_attempts,
+    history_next_retry_at, history_tx_id, history_direction,
+    history_authority_snapshot_id, history_pending_rows,
+    history_backup_entries, updated_at
+  ) VALUES (1, 0, NULL, 'adoption-pending', NULL, 0, NULL, ?, ?, ?, NULL, NULL, ?)`;
+
 const SELECT_TRANSITION_ROW = `
   SELECT native_generation, current_tx_id,
          history_status, history_reason, history_attempts,
@@ -210,8 +235,15 @@ function rowToState(row: TransitionRow | null): CodexTransitionState {
 
   const generation = row.native_generation;
   if (generation === 0) {
-    if (row.current_tx_id !== null || row.history_tx_id !== null
-      || row.history_direction !== null || row.history_authority_snapshot_id !== null) {
+    const ordinaryInitial = row.history_status === "unknown"
+      && row.history_tx_id === null
+      && row.history_direction === null
+      && row.history_authority_snapshot_id === null;
+    const adoptionInitial = row.history_status === "adoption-pending"
+      && Boolean(row.history_tx_id?.trim())
+      && (row.history_direction === "apply" || row.history_direction === "remove")
+      && Boolean(row.history_authority_snapshot_id?.trim());
+    if (row.current_tx_id !== null || (!ordinaryInitial && !adoptionInitial)) {
       throw new CodexCoordinatorTransactionError("The initial coordinator row contains transition metadata.");
     }
   } else if (!row.current_tx_id?.trim()
@@ -234,13 +266,73 @@ function rowToState(row: TransitionRow | null): CodexTransitionState {
     nativeGeneration: generation,
     currentTxId: row.current_tx_id,
     history,
-    historySchedule: generation === 0 ? null : {
+    historySchedule: generation === 0 && row.history_status !== "adoption-pending" ? null : {
       direction: row.history_direction as "apply" | "remove",
       authoritySnapshotId: row.history_authority_snapshot_id as string,
     },
   };
 }
 
+export type CodexCoordinatorAdoptionCheckpoint = "temp-created" | "temp-committed" | "published";
+
+export interface CodexCoordinatorAdoptionOptions {
+  readonly direction: "apply" | "remove";
+  readonly onCheckpoint?: (checkpoint: CodexCoordinatorAdoptionCheckpoint) => void;
+}
+
+function fsyncPath(path: string): void {
+  const fd = openSync(path, "r");
+  try { fsyncSync(fd); } finally { closeSync(fd); }
+}
+
+function publishAdoptionDatabase(
+  finalDatabasePath: string,
+  options: CodexCoordinatorAdoptionOptions,
+): void {
+  const parent = dirname(finalDatabasePath);
+  const tempPath = join(parent, `.${basename(finalDatabasePath)}.adopt-${process.pid}-${randomUUID()}.tmp`);
+  let tempPresent = false;
+  try {
+    const fd = openSync(tempPath, "wx", 0o600);
+    closeSync(fd);
+    tempPresent = true;
+    options.onCheckpoint?.("temp-created");
+
+    const temp = new Database(tempPath, { readwrite: true, create: false });
+    try {
+      temp.exec("PRAGMA journal_mode = DELETE; BEGIN IMMEDIATE");
+      temp.exec(CREATE_TRANSITION_TABLE);
+      temp.query(INITIALIZE_ADOPTION_ROW).run(
+        randomUUID(),
+        options.direction,
+        randomUUID(),
+        new Date().toISOString(),
+      );
+      temp.exec(`PRAGMA user_version = ${CODEX_COORDINATOR_SCHEMA_VERSION}; COMMIT`);
+      readCodexCoordinatorState(temp);
+    } catch (error) {
+      try { temp.exec("ROLLBACK"); } catch { /* commit may already have completed */ }
+      throw error;
+    } finally {
+      temp.close();
+    }
+    fsyncPath(tempPath);
+    options.onCheckpoint?.("temp-committed");
+
+    linkSync(tempPath, finalDatabasePath);
+    options.onCheckpoint?.("published");
+    if (process.platform !== "win32") fsyncPath(parent);
+  } catch (error) {
+    if (errorCode(error) !== "EEXIST") throw error;
+  } finally {
+    if (tempPresent) {
+      try { unlinkSync(tempPath); } catch (error) {
+        if (errorCode(error) !== "ENOENT") throw error;
+      }
+    }
+  }
+}
+
 export function readCodexCoordinatorState(database: Database): CodexTransitionState {
   const row = database.query<TransitionRow, []>(SELECT_TRANSITION_ROW).get();
   return rowToState(row);
@@ -346,7 +438,10 @@ function createCapability(
   };
 }
 
-export function openCodexCoordinatorTransaction(finalDatabasePath: string): CodexCoordinatorTransactionController {
+export function openCodexCoordinatorTransaction(
+  finalDatabasePath: string,
+  adoption?: CodexCoordinatorAdoptionOptions,
+): CodexCoordinatorTransactionController {
   let database: Database | undefined;
   let transactionOpen = false;
   let closed = false;
@@ -389,6 +484,10 @@ export function openCodexCoordinatorTransaction(finalDatabasePath: string): Code
       if (errorCode(cause) !== "ENOENT") throw cause;
       databaseWasAbsent = true;
     }
+    if (databaseWasAbsent && adoption) {
+      publishAdoptionDatabase(finalDatabasePath, adoption);
+      databaseWasAbsent = false;
+    }
     database = new Database(finalDatabasePath, { create: true });
     if (databaseWasAbsent) {
       try { chmodSync(finalDatabasePath, 0o600); } catch { /* Windows applies ACLs in WP11. */ }

package/src/combos/types.ts

@@ -203,6 +203,16 @@ export function comboConfigIssues(
   }
 
   const body = raw as Record<string, unknown>;
+  if (typeof body.alias === "string") {
+    const alias = body.alias.toLowerCase();
+    for (const [providerName, provider] of Object.entries(providers)) {
+      if (provider.alias?.toLowerCase() === alias) {
+        issues.push({ path: ["alias"], message: `alias "${body.alias}" is already used by provider "${providerName}"` });
+      }
+      const model = Object.entries(provider.modelAliases ?? {}).find(([, value]) => value.toLowerCase() === alias);
+      if (model) issues.push({ path: ["alias"], message: `alias "${body.alias}" is already used by model "${providerName}/${model[0]}"` });
+    }
+  }
   if (body.strategy !== undefined
     && body.strategy !== "failover"
     && body.strategy !== "round-robin") {

package/src/compatibility/openai-responses.ts

@@ -9,7 +9,7 @@ const FIXTURE_ID = "openai-codex-forward-gpt56-sol-v1";
 export const OPENAI_CODEX_FORWARD_GPT56_SOL_MANIFEST = defineCompatibilityManifest({
   schemaVersion: 1,
   id: "openai.codex-forward.gpt-5-6-sol.responses",
-  version: "1.0.0",
+  version: "1.2.0",
   subject: {
     providerId: "openai",
     baseUrl: "https://chatgpt.com/backend-api/codex",
@@ -69,6 +69,38 @@ export const OPENAI_CODEX_FORWARD_GPT56_SOL_MANIFEST = defineCompatibilityManife
       limitation: "The field is removed before dispatch.",
       evidence: [{ kind: "fixture", id: FIXTURE_ID, assertionIds: ["metadata-removed"] }],
     },
+    {
+      id: "system-input-messages",
+      feature: "request.input.system_messages",
+      disposition: "translated",
+      summary: "Text-only input system messages are folded into top-level instructions.",
+      limitation: "The destination does not accept system-role input items; multimodal system messages stay unchanged rather than being dropped.",
+      evidence: [{ kind: "fixture", id: FIXTURE_ID, assertionIds: ["system-message-folded", "system-message-removed"] }],
+    },
+    {
+      id: "truncation",
+      feature: "request.truncation",
+      disposition: "unsupported",
+      summary: "The ChatGPT Codex forward route does not receive truncation.",
+      limitation: "The field is removed only for the canonical forward destination; public and custom Responses providers keep it.",
+      evidence: [{ kind: "fixture", id: FIXTURE_ID, assertionIds: ["truncation-removed"] }],
+    },
+    {
+      id: "prompt-cache-breakpoint",
+      feature: "request.prompt_cache_breakpoint",
+      disposition: "unsupported",
+      summary: "Client-only prompt cache breakpoint markers do not reach the forward backend.",
+      limitation: "Markers are removed recursively from input within bounded depth and node budgets.",
+      evidence: [{ kind: "fixture", id: FIXTURE_ID, assertionIds: ["prompt-cache-breakpoint-removed"] }],
+    },
+    {
+      id: "unstored-item-reference",
+      feature: "continuation.item_reference",
+      disposition: "degraded",
+      summary: "Unpersisted item references are omitted from store-false continuations.",
+      limitation: "The referenced item cannot exist at the backend when store is false; tool call_id pairs remain unchanged.",
+      evidence: [{ kind: "fixture", id: FIXTURE_ID, assertionIds: ["unstored-item-reference-removed"] }],
+    },
     {
       id: "prompt-cache-retention",
       feature: "request.prompt_cache_retention",

package/src/config/autonomous-remediation.ts

@@ -0,0 +1,21 @@
+export interface AutonomousRemediationConfig {
+  enabled: boolean;
+  instanceId?: string;
+  threshold: number;
+  rollingWindowMs: number;
+}
+
+const DEFAULT_THRESHOLD = 3;
+const DEFAULT_WINDOW_MS = 86_400_000;
+
+export function resolveAutonomousRemediationConfig(value: unknown): AutonomousRemediationConfig {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return { enabled: false, instanceId: undefined, threshold: DEFAULT_THRESHOLD, rollingWindowMs: DEFAULT_WINDOW_MS };
+  }
+  const input = value as Record<string, unknown>;
+  const enabled = input.enabled === true;
+  const instanceId = typeof input.instanceId === "string" && input.instanceId.trim() ? input.instanceId.trim() : undefined;
+  const threshold = typeof input.threshold === "number" && Number.isInteger(input.threshold) && input.threshold > 0 ? input.threshold : DEFAULT_THRESHOLD;
+  const rollingWindowMs = typeof input.rollingWindowMs === "number" && Number.isInteger(input.rollingWindowMs) && input.rollingWindowMs > 0 ? input.rollingWindowMs : DEFAULT_WINDOW_MS;
+  return { enabled, instanceId, threshold, rollingWindowMs };
+}

package/src/config/provider-validation.ts

@@ -212,3 +212,17 @@ export function modelAdapterRecordConfigError(
   }
   return null;
 }
+
+export function wsUpstreamConfigError(value: unknown): string | null {
+  if (value === undefined || value === null) return null;
+  if (typeof value !== "boolean") return "wsUpstream must be a boolean";
+  return null;
+}
+
+export function maxWsFrameBytesConfigError(value: unknown): string | null {
+  if (value === undefined || value === null) return null;
+  if (typeof value !== "number" || !Number.isFinite(value) || !Number.isInteger(value) || value <= 0) {
+    return "maxWsFrameBytes must be a positive finite integer";
+  }
+  return null;
+}