@bitkyc08/opencodex 2.11.0 → 2.11.1

package/src/providers/registry.ts

@@ -1,6 +1,6 @@
 import type { CodexAccountMode, OcxProviderConfig } from "../types";
 import { KIRO_MODELS, KIRO_MODEL_CONTEXT_WINDOWS, KIRO_MODEL_REASONING_EFFORTS } from "./kiro-models";
-import { ANTIGRAVITY_MODELS, ANTIGRAVITY_MODEL_CONTEXT_WINDOWS, ANTIGRAVITY_MODEL_EFFORTS } from "./antigravity-models";
+import { ANTIGRAVITY_MODELS, ANTIGRAVITY_MODEL_CONTEXT_WINDOWS, ANTIGRAVITY_MODEL_EFFORTS, ANTIGRAVITY_MODEL_INPUT_MODALITIES } from "./antigravity-models";
 import type { ProviderBaseUrlChoice } from "./base-url-choices";
 import {
   QWEN_CLOUD_BASE_URL_CHOICES, QWEN_CLOUD_TOKEN_PLAN_BASE_URL,
@@ -1287,7 +1287,7 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
   // 2026-07-10: defaultModel is frozen pending Vertex-specific Tier-2 evidence; Gemini API
   // evidence from ai.google.dev does not establish Vertex publisher availability.
   { id: "google-vertex", label: "Google Vertex AI", adapter: "google", baseUrl: "https://aiplatform.googleapis.com", authKind: "key", dashboardUrl: "https://console.cloud.google.com/vertex-ai", defaultModel: "gemini-3-pro", googleMode: "vertex", jawcodeBundle: "google", extraMetadataAliases: ["gemini-vertex"] },
-  { id: "google-antigravity", label: "Google Antigravity", adapter: "google", baseUrl: "https://daily-cloudcode-pa.googleapis.com", authKind: "oauth", dashboardUrl: "https://antigravity.google", models: ANTIGRAVITY_MODELS, liveModels: false, defaultModel: "gemini-3.6-flash", modelContextWindows: ANTIGRAVITY_MODEL_CONTEXT_WINDOWS, modelReasoningEfforts: ANTIGRAVITY_MODEL_EFFORTS, googleMode: "cloud-code-assist", jawcodeBundle: "google", extraMetadataAliases: ["antigravity", "gemini-antigravity"] },
+  { id: "google-antigravity", label: "Google Antigravity", adapter: "google", baseUrl: "https://daily-cloudcode-pa.googleapis.com", authKind: "oauth", dashboardUrl: "https://antigravity.google", models: ANTIGRAVITY_MODELS, liveModels: true, defaultModel: "gemini-3.6-flash", modelContextWindows: ANTIGRAVITY_MODEL_CONTEXT_WINDOWS, modelInputModalities: ANTIGRAVITY_MODEL_INPUT_MODALITIES, modelReasoningEfforts: ANTIGRAVITY_MODEL_EFFORTS, googleMode: "cloud-code-assist", jawcodeBundle: "google", extraMetadataAliases: ["antigravity", "gemini-antigravity"] },
   { id: "azure-openai", label: "Azure OpenAI", adapter: "azure-openai", baseUrl: "https://{resource}.openai.azure.com/openai", authKind: "key", featured: true, dashboardUrl: "https://portal.azure.com" },
   { id: "ollama", label: "Ollama (local)", adapter: "openai-chat", baseUrl: "http://localhost:11434/v1", authKind: "local", allowPrivateNetworkByDefault: true, allowBaseUrlOverride: true, featured: true, note: "Local — key usually blank" },
   { id: "vllm", label: "vLLM (local)", adapter: "openai-chat", baseUrl: "http://localhost:8000/v1", authKind: "local", allowPrivateNetworkByDefault: true, allowBaseUrlOverride: true, featured: true, note: "Local — key usually blank" },
@@ -1299,11 +1299,22 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     adapter: "openai-chat",
     authKind: "key",
     dashboardUrl: "https://platform.deepseek.com/api_keys",
-    // deepseek-chat/deepseek-reasoner are upstream-deprecated at 2026-07-24 15:59 UTC;
-    // kept until then. Evidence: devlog/_plan/260710_provider_hardening/002_research_cn.md.
+    // Route DeepSeek's own catalog bundle so routed rebuilds restore the official
+    // context window from the vendored model-metadata bundle instead of falling
+    // back to the 128k strict-fields default (scripts/model-metadata.source.json,
+    // verified 2026-08-08).
+    jawcodeBundle: "deepseek",
+    // deepseek-chat/deepseek-reasoner were deprecated upstream on 2026-07-24 15:59 UTC;
+    // official identifiers are now deepseek-v4-flash / deepseek-v4-pro. They stay in
+    // the list only as compatibility aliases so existing saved configs and requests
+    // keep validating and routing (they previously mapped to v4-flash; devlog
+    // _fin/260710_provider_hardening/002_research_cn.md). The current offerings are
+    // the V4 ids — defaultModel and the model-specific wiring above use them.
     models: ["deepseek-chat", "deepseek-reasoner", ...DEEPSEEK_THINKING_MODELS],
     defaultModel: "deepseek-v4-flash",
-    modelContextWindows: { "deepseek-v4-flash": 1_000_000, "deepseek-v4-pro": 1_000_000 },
+    // Official DeepSeek Codex setup (codex-deepseek-setup.sh) advertises 1,048,576
+    // for both V4 models; the older 1,000,000 figure was a rounded approximation.
+    modelContextWindows: { "deepseek-v4-flash": 1_048_576, "deepseek-v4-pro": 1_048_576 },
     // DeepSeek documents V4-Flash as a native Responses API model adapted for Codex. The
     // API id is `deepseek-v4-flash`; `DeepSeek-V4-Flash-0731` is a release/version label.
     modelWireDefaults: {

package/src/providers/slug-codec.ts

@@ -56,12 +56,19 @@ export function slugEquals(stored: string, provider: string, id: string): boolea
   return stored === `${provider}/${id}` || stored === routedSlug(provider, id);
 }
 
+/** Stable key for the exact equivalence relation used by catalog/config slug matching. */
+export function slugEquivalenceKey(slug: string): string {
+  const slash = slug.indexOf("/");
+  return slash <= 0
+    ? JSON.stringify(["exact", slug])
+    : JSON.stringify([
+      "routed",
+      slug.slice(0, slash),
+      encodeRoutedModelId(slug.slice(slash + 1)),
+    ]);
+}
+
 /** Equivalence between two routed slugs regardless of raw/encoded mix. */
 export function slugsEquivalent(a: string, b: string): boolean {
-  if (a === b) return true;
-  const pa = a.indexOf("/");
-  const pb = b.indexOf("/");
-  if (pa <= 0 || pb <= 0) return false;
-  if (a.slice(0, pa) !== b.slice(0, pb)) return false;
-  return encodeRoutedModelId(a.slice(pa + 1)) === encodeRoutedModelId(b.slice(pb + 1));
+  return a === b || slugEquivalenceKey(a) === slugEquivalenceKey(b);
 }

package/src/reasoning-effort.ts

@@ -19,6 +19,28 @@ export function isCodexReasoningEffort(effort: string): boolean {
   return CODEX_REASONING_SET.has(effort);
 }
 
+/**
+ * Reasoning ladder accepted for the OpenAI vision sidecar. `ultra` is deliberately excluded:
+ * the vision describer is a single helper call, and `ultra` would be collapsed to `max` by the
+ * upstream client boundary anyway.
+ */
+export const VISION_REASONING_EFFORTS = ["low", "medium", "high", "xhigh", "max"] as const;
+export type VisionReasoningEffort = typeof VISION_REASONING_EFFORTS[number];
+
+/** True when `effort` is one of the vision sidecar's supported Responses reasoning levels. */
+export function isVisionReasoningEffort(effort: unknown): effort is VisionReasoningEffort {
+  return typeof effort === "string" && (VISION_REASONING_EFFORTS as readonly string[]).includes(effort);
+}
+
+/**
+ * Normalize a persisted/configured vision reasoning value. Invalid values (hand-edited config,
+ * stale files) degrade to `undefined` so the caller falls back to the documented default instead
+ * of forwarding an upstream-rejected effort.
+ */
+export function sanitizeVisionReasoning(effort: unknown): VisionReasoningEffort | undefined {
+  return isVisionReasoningEffort(effort) ? effort : undefined;
+}
+
 /** Position of `effort` in the Codex ladder (low=0 .. ultra=5), or -1 when not a ladder member. */
 export function codexEffortRank(effort: string): number {
   return CODEX_REASONING_ORDER.indexOf(effort);

package/src/router.ts

@@ -22,8 +22,6 @@ import {
 import { decodeRoutedModelId, encodeRoutedModelId } from "./providers/slug-codec";
 import { getStaleCached } from "./codex/model-cache";
 import { codexAccountNamespaceEntries } from "./codex/account-namespaces";
-import { getEffectiveActiveCodexAccountId } from "./codex/routing";
-import { getAccountSet } from "./oauth/store";
 import {
   buildRouteDecisionTrace,
   type RouteDecisionKind,
@@ -513,24 +511,6 @@ function routeModelInternal(
       quota: quotaEvidenceForCandidate({
         provider: candidate.provider,
         model: candidate.model,
-        ...(candidate.provider === OPENAI_CODEX_PROVIDER_ID
-          && providerCodexAccountMode(
-            OPENAI_CODEX_PROVIDER_ID,
-            config.providers[OPENAI_CODEX_PROVIDER_ID],
-          ) === "pool"
-          ? (() => {
-              const codexAccountId = getEffectiveActiveCodexAccountId(config);
-              return {
-                codexAccountId,
-                codexAccountPlan: codexAccountId
-                  ? config.codexAccounts?.find(account => account.id === codexAccountId)?.plan
-                  : undefined,
-              };
-            })()
-          : {}),
-        accountRef: candidate.provider === "anthropic"
-          ? getAccountSet("anthropic")?.activeAccountId
-          : undefined,
       }),
       cost: costEvidenceForCandidate({
         provider: candidate.provider,

package/src/routing/history/indexer.ts

@@ -76,6 +76,11 @@ export interface RequestHistoryPage {
 export const REQUEST_HISTORY_MAX_PAGE_SIZE = 100;
 export const REQUEST_HISTORY_DEFAULT_PAGE_SIZE = 50;
 export const REQUEST_HISTORY_INSERT_BATCH = 500;
+export const REQUEST_HISTORY_READ_CHUNK_BYTES = 64 * 1024;
+// The SQLite index is a disposable projection. Complete JSONL records above
+// this bound are omitted from the projection; the canonical usage.jsonl is
+// never truncated or rewritten by the indexer.
+export const REQUEST_HISTORY_MAX_RECORD_BYTES = 1024 * 1024;
 
 let db: Database | null = null;
 let dbPath = "";
@@ -190,24 +195,6 @@ INSERT OR IGNORE INTO requests (
   ?, ?, ?, ?, ?
 )`;
 
-function readCompleteTail(fd: number, fromOffset: number, size: number): { text: string; nextOffset: number } {
-  if (size <= fromOffset) return { text: "", nextOffset: fromOffset };
-  const length = size - fromOffset;
-  const buf = Buffer.allocUnsafe(length);
-  let offset = 0;
-  while (offset < length) {
-    const read = readSync(fd, buf, offset, length - offset, fromOffset + offset);
-    if (read === 0) throw new Error("usage log changed while indexing");
-    offset += read;
-  }
-  const newline = buf.lastIndexOf(0x0a);
-  if (newline < 0) return { text: "", nextOffset: fromOffset };
-  return {
-    text: buf.subarray(0, newline).toString("utf-8"),
-    nextOffset: fromOffset + newline + 1,
-  };
-}
-
 function parsedEntryFromLine(line: string): PersistedUsageEntry | null {
   if (!line.trim()) return null;
   try {
@@ -227,12 +214,11 @@ function parsedEntryFromLine(line: string): PersistedUsageEntry | null {
   return null;
 }
 
-function ingestText(dbHandle: Database, text: string): number {
-  if (!text) return 0;
-  const lines = text.split(/\r?\n/);
+function ingestSourceTail(dbHandle: Database, path: string, fromOffset: number): number {
   let inserted = 0;
   let pending: Array<Array<string | number | null>> = [];
   const insert = dbHandle.prepare(ROW_INSERT);
+  let fd: number | undefined;
   try {
     const commitBatch = () => {
       dbHandle.transaction((rows: Array<Array<string | number | null>>) => {
@@ -243,29 +229,55 @@ function ingestText(dbHandle: Database, text: string): number {
       })(pending);
       pending = [];
     };
-    for (const line of lines) {
-      const entry = parsedEntryFromLine(line);
-      if (!entry) continue;
+    const ingestLine = (line: Buffer) => {
+      const entry = parsedEntryFromLine(line.toString("utf-8"));
+      if (!entry) return;
       pending.push(extractRow(entry));
       if (pending.length >= REQUEST_HISTORY_INSERT_BATCH) commitBatch();
-    }
-    if (pending.length > 0) commitBatch();
-  } finally {
-    // Windows file locks: an unterminated prepared statement keeps the DB
-    // file busy after close (verified on Bun 1.3.14). Finalize always.
-    insert.finalize();
-  }
-  return inserted;
-}
+    };
 
-function ingestSourceTail(dbHandle: Database, path: string, fromOffset: number): number {
-  let fd: number | undefined;
-  try {
     fd = openSync(path, "r");
     const stat = fstatSync(fd);
-    const { text, nextOffset } = readCompleteTail(fd, fromOffset, Number(stat.size));
-    if (text.length === 0 && nextOffset === fromOffset) return 0;
-    const inserted = ingestText(dbHandle, text);
+    const size = Number(stat.size);
+    const readBuffer = Buffer.allocUnsafe(REQUEST_HISTORY_READ_CHUNK_BYTES);
+    let position = fromOffset;
+    let nextOffset = fromOffset;
+    let fragments: Buffer[] = [];
+    let fragmentBytes = 0;
+    let oversized = false;
+    while (position < size) {
+      const requested = Math.min(readBuffer.length, size - position);
+      const bytesRead = readSync(fd, readBuffer, 0, requested, position);
+      if (bytesRead === 0) throw new Error("usage log changed while indexing");
+      let lineStart = 0;
+      for (let index = 0; index < bytesRead; index++) {
+        if (readBuffer[index] !== 0x0a) continue;
+        const segment = readBuffer.subarray(lineStart, index);
+        if (!oversized && fragmentBytes + segment.length <= REQUEST_HISTORY_MAX_RECORD_BYTES) {
+          const line = fragments.length === 0
+            ? segment
+            : Buffer.concat([...fragments, segment], fragmentBytes + segment.length);
+          ingestLine(line);
+        }
+        fragments = [];
+        fragmentBytes = 0;
+        oversized = false;
+        lineStart = index + 1;
+        nextOffset = position + index + 1;
+      }
+      const remainder = readBuffer.subarray(lineStart, bytesRead);
+      if (!oversized && fragmentBytes + remainder.length <= REQUEST_HISTORY_MAX_RECORD_BYTES) {
+        // Copy because readBuffer is reused on the next iteration.
+        fragments.push(Buffer.from(remainder));
+        fragmentBytes += remainder.length;
+      } else if (remainder.length > 0) {
+        fragments = [];
+        fragmentBytes = 0;
+        oversized = true;
+      }
+      position += bytesRead;
+    }
+    if (pending.length > 0) commitBatch();
     const current = readIndexedMeta(dbHandle);
     setMeta(dbHandle, HISTORY_META_KEYS.indexedOffset, nextOffset);
     setMeta(dbHandle, HISTORY_META_KEYS.indexedRows, current.indexedRows + inserted);
@@ -275,6 +287,9 @@ function ingestSourceTail(dbHandle: Database, path: string, fromOffset: number):
     return inserted;
   } finally {
     if (fd !== undefined) closeSync(fd);
+    // Windows file locks: an unterminated prepared statement keeps the DB
+    // file busy after close (verified on Bun 1.3.14). Finalize always.
+    insert.finalize();
   }
 }
 

package/src/routing/quota.ts

@@ -12,63 +12,100 @@
  * carries an account reference (dry-run/evaluate), never invented.
  */
 
-import { codexQuotaWindowForPlan, getAccountQuota, isCodexQuotaExhausted } from "../codex/quota";
+import {
+  codexQuotaWindowForPlan,
+  getAccountQuota,
+  isCodexQuotaExhausted,
+  listAccountQuotas,
+} from "../codex/quota";
 import { getCachedProviderAccountQuota } from "../providers/quota";
 import type { RouteQuotaEvidence } from "./trace";
 
 export interface QuotaEvidenceInput {
   provider: string;
   model: string;
-  /** Opaque account reference for per-account quota sources. */
   accountRef?: string;
-  /** Codex pool account id (provider "openai"). */
   codexAccountId?: string;
-  /** The account's plan (provider "openai"); selects the governing quota window. */
   codexAccountPlan?: string;
 }
 
-/**
- * Assemble quota evidence from canonical local caches only (no network).
- * Unknown dimensions stay unknown - never zero.
- */
+export interface CodexPoolQuotaAccount {
+  accountId: string;
+  plan?: string;
+}
+
+function codexAccountQuotaEvidence(accountId: string, plan?: string): RouteQuotaEvidence {
+  const quota = getAccountQuota(accountId);
+  if (!quota) return { known: false };
+  const monthly = codexQuotaWindowForPlan(plan) === "monthly";
+  const percents = [
+    ...(monthly ? [] : [quota.weeklyPercent]),
+    quota.monthlyPercent,
+  ].filter((value): value is number => typeof value === "number" && Number.isFinite(value));
+  const maxPercent = percents.length > 0 ? Math.max(...percents) : undefined;
+  // Credits-only snapshots prove neither usage nor exhaustion. Unknown must not
+  // become healthy capacity merely because a cache row exists.
+  if (maxPercent === undefined) return { known: false };
+  const resets = [
+    ...(monthly ? [] : [quota.weeklyResetAt]),
+    quota.monthlyResetAt,
+  ].filter((value): value is number => typeof value === "number" && Number.isFinite(value))
+    .filter(value => value > Date.now());
+  return {
+    known: true,
+    headroom: Math.max(0, Math.min(1, 1 - maxPercent / 100)),
+    exhausted: isCodexQuotaExhausted(quota, plan),
+    ...(resets.length > 0 ? { resetAtMs: Math.min(...resets) } : {}),
+    source: "codex-pool",
+  };
+}
+
+export function codexPoolQuotaEvidence(accounts: readonly CodexPoolQuotaAccount[]): RouteQuotaEvidence {
+  if (accounts.length === 0) return { known: false };
+  const evidence = accounts.map(account => codexAccountQuotaEvidence(account.accountId, account.plan));
+  const known = evidence.filter(item => item.known);
+  if (known.length === 0) return { known: false };
+  const usable = known.filter(item => item.exhausted !== true);
+  if (usable.length > 0) {
+    const headrooms = usable.map(item => item.headroom)
+      .filter((value): value is number => typeof value === "number" && Number.isFinite(value));
+    return {
+      known: true,
+      exhausted: false,
+      ...(headrooms.length > 0 ? { headroom: Math.max(...headrooms) } : {}),
+      source: "codex-pool",
+    };
+  }
+  if (known.length < evidence.length) return { known: false };
+  const resets = known.map(item => item.resetAtMs)
+    .filter((value): value is number => typeof value === "number" && Number.isFinite(value));
+  return {
+    known: true,
+    exhausted: true,
+    headroom: 0,
+    ...(resets.length > 0 ? { resetAtMs: Math.min(...resets) } : {}),
+    source: "codex-pool",
+  };
+}
+
 export function quotaEvidenceForCandidate(input: QuotaEvidenceInput): RouteQuotaEvidence {
   if (input.provider === "openai" && input.codexAccountId) {
-    const quota = getAccountQuota(input.codexAccountId);
-    if (quota) {
-      // Go/Free accounts report a 30-day window only; weekly windows gate
-      // everything else. `codexQuotaWindowForPlan` is the single shared rule
-      // (parser, exhaustion, recovery), so select the plan-specific bars here
-      // too instead of always combining weekly + monthly.
-      const monthly = codexQuotaWindowForPlan(input.codexAccountPlan) === "monthly";
-      const percents = [
-        ...(monthly ? [] : [quota.weeklyPercent]),
-        quota.monthlyPercent,
-      ].filter((value): value is number => typeof value === "number" && Number.isFinite(value));
-      const maxPercent = percents.length > 0 ? Math.max(...percents) : undefined;
-      const resets = [
-        ...(monthly ? [] : [quota.weeklyResetAt]),
-        quota.monthlyResetAt,
-      ].filter((value): value is number => typeof value === "number" && Number.isFinite(value))
-        .filter(value => value > Date.now());
-      return {
-        known: true,
-        ...(maxPercent !== undefined
-          ? { headroom: Math.max(0, Math.min(1, 1 - maxPercent / 100)) }
-          : {}),
-        exhausted: isCodexQuotaExhausted(quota, input.codexAccountPlan),
-        ...(resets.length > 0 ? { resetAtMs: Math.min(...resets) } : {}),
-        source: "codex-pool",
-      };
+    // listAccountQuotas() is the reconciled quota snapshot: config-generation
+    // reconciliation prunes removed accounts. Other eligibility dimensions
+    // (pause/reauth/cooldown/soft-avoid) remain health/pool-selector concerns.
+    if (input.codexAccountPlan !== undefined) {
+      const pool = [...listAccountQuotas()].map(([accountId]) => ({
+        accountId,
+        ...(accountId === input.codexAccountId ? { plan: input.codexAccountPlan } : {}),
+      }));
+      if (pool.length > 1) return codexPoolQuotaEvidence(pool);
     }
+    return codexAccountQuotaEvidence(input.codexAccountId, input.codexAccountPlan);
   }
 
   if (input.provider === "anthropic" && input.accountRef) {
     const quota = getCachedProviderAccountQuota("anthropic", input.accountRef);
     if (quota) {
-      // Anthropic per-family buckets (e.g. Opus / Sonnet) are stricter than the
-      // broad account windows: fold the candidate model's matching bucket into
-      // headroom and exhaustion so a model-specific overage is not hidden by
-      // a healthy aggregate window.
       const family = anthropicFamilyWindow(input.model, quota.customWindows ?? []);
       const percents = [quota.fiveHourPercent, quota.weeklyPercent, quota.monthlyPercent, family?.percent]
         .filter((value): value is number => typeof value === "number" && Number.isFinite(value));
@@ -78,25 +115,16 @@ export function quotaEvidenceForCandidate(input: QuotaEvidenceInput): RouteQuota
         .filter(value => value > Date.now());
       return {
         known: true,
-        ...(maxPercent !== undefined
-          ? { headroom: Math.max(0, Math.min(1, 1 - maxPercent / 100)) }
-          : {}),
+        ...(maxPercent !== undefined ? { headroom: Math.max(0, Math.min(1, 1 - maxPercent / 100)) } : {}),
         exhausted: maxPercent !== undefined && maxPercent >= 100,
         ...(resets.length > 0 ? { resetAtMs: Math.min(...resets) } : {}),
         source: "provider-report",
       };
     }
   }
-
   return { known: false };
 }
 
-/**
- * Match the candidate model to an Anthropic per-family quota window. Window
- * labels from the provider probe are "Opus" / "Sonnet"; model ids carry the
- * family as a segment (e.g. `claude-opus-...`, `claude-sonnet-...`). Returns
- * undefined when no family window is cached or no label matches.
- */
 function anthropicFamilyWindow(
   model: string,
   windows: Array<{ label: string; percent?: number; resetAt?: number }>,
@@ -104,18 +132,11 @@ function anthropicFamilyWindow(
   const normalized = model.toLowerCase();
   for (const window of windows) {
     const family = window.label.trim().toLowerCase();
-    if (family && normalized.includes(family)) {
-      return window;
-    }
+    if (family && normalized.includes(family)) return window;
   }
   return undefined;
 }
 
-/**
- * Deterministic quota score in [0,1]: larger available headroom scores
- * higher; exhausted evidence scores 0. Unknown evidence returns null so the
- * caller can apply the profile's unknownEvidence policy.
- */
 export function quotaScore(evidence: RouteQuotaEvidence | undefined): number | null {
   if (!evidence || !evidence.known) return null;
   if (evidence.exhausted === true) return 0;

package/src/server/index.ts

@@ -204,6 +204,22 @@ function releaseLiveSidebandAdmission(ws: ServerWebSocket<WsData>): void {
   ws.data.liveTurnAdmissionLease = undefined;
 }
 
+/**
+ * Send one live-sideband frame to the upstream socket.
+ *
+ * Bun's `WebSocket.send` accepts `string | Blob | BufferSource`, but the DOM-lib
+ * `Buffer` can be backed by a `SharedArrayBuffer`, which `BufferSource` rejects.
+ * `Uint8Array.from` copies into a fresh `ArrayBuffer`-backed view, so a frame
+ * arriving from `node:buffer` still round-trips byte-for-byte.
+ */
+function sendUpstreamFrame(upstream: WebSocket, frame: string | Buffer): void {
+  if (typeof frame === "string") {
+    upstream.send(frame);
+    return;
+  }
+  upstream.send(Uint8Array.from(frame));
+}
+
 function finalizeLiveSideband(ws: ServerWebSocket<WsData>, upstream?: WebSocket): void {
   if (upstream && ws.data.liveUpstream !== upstream) return;
   if (ws.data.liveCloseFallback !== undefined) {
@@ -236,7 +252,10 @@ function armLiveSidebandCloseFallback(ws: ServerWebSocket<WsData>, upstream: Web
     // close event. That is still an observed CLOSED transport and is safe to
     // finalize. CONNECTING/CLOSING peers keep the lease so profile switching
     // fails at its own bounded drain deadline instead of racing live traffic.
-    if (upstream.readyState === WebSocket.CLOSED) finalizeLiveSideband(ws, upstream);
+    // The earlier CLOSED check narrowed `readyState` to 0|1|2 in the type
+    // system, but the socket can still transition to CLOSED (3) before this
+    // fallback fires; the cast keeps the runtime-identical check.
+    if ((upstream.readyState as number) === 3) finalizeLiveSideband(ws, upstream);
   }, LIVE_SIDEBAND_CLOSE_FALLBACK_MS);
 }
 
@@ -246,7 +265,9 @@ function closeLiveSideband(ws: ServerWebSocket<WsData>, code = 1000, reason = ""
   ws.data.livePending = undefined;
   ws.data.cancel = undefined;
   const upstream = ws.data.liveUpstream;
-  if (!upstream || upstream.readyState === WebSocket.CLOSED) {
+  // Bun's `WebSocket` type narrows `readyState` to 0|1|2 even though the DOM
+  // constant CLOSED is 3; the numeric literal is the runtime-identical check.
+  if (!upstream || upstream.readyState === 3) {
     finalizeLiveSideband(ws, upstream);
   } else {
     // The sideband holds a native-main admission lease. Do not release it just
@@ -299,7 +320,7 @@ function attachLiveSidebandUpstream(
     ws.data.livePending = undefined;
     for (const frame of pending) {
       try {
-        upstream.send(frame);
+        sendUpstreamFrame(upstream, frame);
       } catch {
         closeLiveSideband(ws, 1011, "upstream send failed");
         return;
@@ -794,12 +815,14 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
           }
           throw error;
         }
-        const { applyNativeVisibility, buildCatalogEntries, disabledNativeSlugs, exactComboCatalogSlugs, loadCatalogTemplate, NATIVE_OPENAI_MODELS, nativeOpenAiSlugs, nativeReasoningEfforts, nativeDefaultReasoningEffort, orderForSubagents, filterCatalogVisibleModels, shouldIncludeAccountBoundNativeOpenAi, shouldIncludeNativeOpenAi, uniqueCatalogModelsForRawPublicList, visibleCodexAccountSelectors, visibleNativeSlugs, desktopVisibleNativeSlugs } = await import("../codex/catalog");
+        const { applyNativeVisibility, buildCatalogEntries, configuredNativeAliasSlugs, desktopAllowlistSuppressedNativeSlugs, disabledNativeSlugs, exactComboCatalogSlugs, loadCatalogTemplate, NATIVE_OPENAI_MODELS, nativeOpenAiSlugs, nativeReasoningEfforts, nativeDefaultReasoningEffort, orderForSubagents, filterCatalogVisibleModels, shouldIncludeAccountBoundNativeOpenAi, shouldIncludeNativeOpenAi, uniqueCatalogModelsForRawPublicList, visibleCodexAccountSelectors, visibleNativeSlugs, desktopVisibleNativeSlugs } = await import("../codex/catalog");
         const includeNativeOpenAi = shouldIncludeNativeOpenAi(config);
         const includeAccountBoundNativeOpenAi = shouldIncludeAccountBoundNativeOpenAi(config);
         const nativeSlugs = includeNativeOpenAi ? nativeOpenAiSlugs() : [];
         const disabledNatives = disabledNativeSlugs(config);
         const disabledModels = new Set(config.disabledModels ?? []);
+        const shadowedNativeSlugs = configuredNativeAliasSlugs(config);
+        const suppressedBareNativeSlugs = desktopAllowlistSuppressedNativeSlugs(config);
         const accountSelectors = includeAccountBoundNativeOpenAi
           ? visibleCodexAccountSelectors(config)
           : [];
@@ -852,7 +875,7 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
           const catalogNativeSlugs = accountSelectors.length > 0
             ? NATIVE_OPENAI_MODELS
             : nativeSlugs;
-          const entries = buildCatalogEntries(loadCatalogTemplate(), catalogNativeSlugs, goOrdered, config.subagentModels, websocketsEnabled(config), maMode as "v1" | "default" | "v2", exactComboCatalogSlugs(config), accountSelectors);
+          const entries = buildCatalogEntries(loadCatalogTemplate(), catalogNativeSlugs, goOrdered, config.subagentModels, websocketsEnabled(config), maMode as "v1" | "default" | "v2", exactComboCatalogSlugs(config), accountSelectors, suppressedBareNativeSlugs);
           return jsonResponse({
             models: applyNativeVisibility(
               entries,
@@ -904,7 +927,9 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
           ? NATIVE_OPENAI_MODELS.filter(slug => !disabledNatives.has(slug))
           : [];
         const visibleNatives = includeNativeOpenAi
-          ? accountSelectors.length > 0 ? selectorNativeSlugs : visibleNativeSlugs(config)
+          ? accountSelectors.length > 0
+            ? selectorNativeSlugs.filter(slug => !shadowedNativeSlugs.has(slug))
+            : visibleNativeSlugs(config)
           : [];
         const visibleAccountNatives = accountSelectors.flatMap(selector =>
           selectorNativeSlugs.flatMap(metadataId => {
@@ -1312,7 +1337,7 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
             return;
           }
           try {
-            upstream.send(raw);
+            sendUpstreamFrame(upstream, raw);
           } catch {
             closeLiveSideband(ws, 1011, "upstream send failed");
           }