@bitkyc08/opencodex 2.13.0 → 2.14.0

package/src/codex/catalog/metadata.ts

@@ -4,6 +4,7 @@ import { copyFileSync, existsSync, mkdirSync, readFileSync, realpathSync } from
 import { delimiter, dirname, join, resolve } from "node:path";
 import { atomicWriteFile, expandUserPath, getConfigDir, websocketsEnabled } from "../../config";
 import { CODEX_CONFIG_PATH, CODEX_MODELS_CACHE_PATH, DEFAULT_CATALOG_PATH, readRootTomlString, resolveCodexConfigPath } from "../paths";
+import { codexAccountNamespaceEntries, isMainCodexAccountTarget } from "../account-namespaces";
 import { clearModelCache, DEFAULT_MODEL_CACHE_TTL_MS, getFreshCached, getStaleCached, isModelsFetchCoolingDown, markModelsFetchFailure, setCached } from "../model-cache";
 import { buildModelsRequest, resolveModelsAuthToken } from "../../oauth";
 import type { OcxConfig, OcxProviderConfig } from "../../types";
@@ -33,8 +34,8 @@ import upstreamModelsSnapshot from "../data/upstream-models.json";
 
 
 import type { RawEntry } from "./parsing";
-import { readCurrentCatalogOrCache, unique } from "./bundled";
-import { trustedAccountBoundNativeCatalogSlug } from "./account-models";
+import { readCurrentCatalogOrCache, readCurrentCodexCatalog, readCurrentCodexModelsCache, unique } from "./bundled";
+import { trustedAccountBoundNativeCatalogSlug, visibleCodexAccountSelectors } from "./account-models";
 import { CODEX_NATIVE_ALIAS_CATALOG_KIND } from "./kinds";
 import { NATIVE_OPENAI_MODELS, SUPPORTED_NATIVE_OPENAI_SLUGS } from "./native-models";
 export { CODEX_NATIVE_ALIAS_CATALOG_KIND } from "./kinds";
@@ -194,10 +195,35 @@ export function shouldIncludeNativeOpenAi(config: Pick<OcxConfig, "providers">):
   return !hasEnabledProvider || shouldIncludeAccountBoundNativeOpenAi(config);
 }
 
+type AccountSelectorConfig = Pick<
+  OcxConfig,
+  "codexAccounts" | "codexAccountNamespaces" | "codexAccountPickerEnabled"
+>;
+
+function mainAccountSelectors(config: AccountSelectorConfig): string[] {
+  const targets = new Map(codexAccountNamespaceEntries(config));
+  return visibleCodexAccountSelectors(config).filter(selector =>
+    isMainCodexAccountTarget(targets.get(selector) ?? ""));
+}
+
 /** Native slugs exposed to Claude Desktop show/export/apply (opt-out via claudeCode.desktopNativeModels). */
-export function desktopVisibleNativeSlugs(config: Pick<OcxConfig, "claudeCode" | "disabledModels" | "combos">): string[] {
+export function desktopVisibleNativeSlugs(
+  config: Pick<OcxConfig, "claudeCode" | "disabledModels" | "combos" | "providers"
+    | "codexAccounts" | "codexAccountNamespaces" | "codexAccountPickerEnabled">,
+): string[] {
   if (config.claudeCode?.desktopNativeModels === false) return [];
-  return visibleNativeSlugs(config);
+  const visible = visibleNativeSlugs(config);
+  if (!shouldIncludeAccountBoundNativeOpenAi(config)) return visible;
+  const qualified = [...accountBoundNativeOpenAiSlugsBySelector(config).entries()].flatMap(([selector, slugs]) =>
+    slugs
+      .filter(slug => !SUPPORTED_NATIVE_OPENAI_SLUGS.has(slug))
+      .map(slug => `${selector}/${slug}`),
+  );
+  const disabled = new Set(config.disabledModels ?? []);
+  return unique([
+    ...visible,
+    ...qualified.filter(slug => !disabled.has(slug) && !disabled.has(slug.slice(slug.indexOf("/") + 1))),
+  ]);
 }
 
 export function nativeModelRows(config: Pick<OcxConfig, "disabledModels" | "combos" | "providerContextCaps">): Array<{ slug: string; disabled: boolean; contextWindow?: number }> {
@@ -214,6 +240,7 @@ export function applyNativeVisibility(
   entries: RawEntry[],
   disabledModels: ReadonlySet<string>,
   hideBareNative = false,
+  observedNativeSlugs: ReadonlySet<string> = new Set(),
 ): RawEntry[] {
   for (const entry of entries) {
     if (isNativeAliasCatalogEntry(entry)) continue;
@@ -222,7 +249,7 @@ export function applyNativeVisibility(
     const nativeSlug = accountBoundSlug ?? slug;
     if (!nativeSlug
       || (!accountBoundSlug && slug.includes("/"))
-      || !SUPPORTED_NATIVE_OPENAI_SLUGS.has(nativeSlug)) continue;
+      || (!SUPPORTED_NATIVE_OPENAI_SLUGS.has(nativeSlug) && !observedNativeSlugs.has(nativeSlug))) continue;
     const disabled = disabledModels.has(nativeSlug)
       || (accountBoundSlug !== undefined && disabledModels.has(slug));
     entry.visibility = disabled || (!accountBoundSlug && hideBareNative)
@@ -259,6 +286,154 @@ export function nativeOpenAiSlugs(): string[] {
   return live.length > 0 ? unique([...live, ...DOCUMENTED_NATIVE_OPENAI_ADDITIONS]) : NATIVE_OPENAI_MODELS;
 }
 
+const ACCOUNT_BOUND_OPENAI_NATIVE_PREFIX = /^(?:gpt-|o1-|o3-|o4-)/;
+const ACCOUNT_BOUND_OBSERVED_NATIVE_MARKER = "opencodex_account_observed_native";
+const ACCOUNT_BOUND_OBSERVED_SELECTORS_MARKER = "opencodex_account_observed_selectors";
+
+function isAccountBoundOpenAiNativeSlug(slug: string): boolean {
+  return !slug.includes("/") && ACCOUNT_BOUND_OPENAI_NATIVE_PREFIX.test(slug);
+}
+
+/**
+ * Shape/plausibility filter for a candidate account-native row. **This is not a trust control.**
+ *
+ * It checks that a row carries the field shape a real Codex catalog row has, which rejects
+ * malformed and minimal hand-written rows. It cannot distinguish a genuine upstream observation
+ * from a complete row typed by hand into `$CODEX_HOME/models_cache.json`: there is no signature,
+ * source identity, or server attestation to check. A full-shape forged row is accepted, and
+ * `observedFullShapeRowIsAccepted` in tests/native-model-toggle.test.ts pins that so nobody
+ * later mistakes this predicate for a security boundary.
+ *
+ * That is acceptable here because the file is user-owned and written by Codex itself: anyone
+ * able to rewrite it can already edit `config.json` or run `ocx` directly, and `router.ts`
+ * accepts any bare `gpt-*` id under an account namespace regardless of this catalog. What the
+ * filter buys is that garbage rows do not get advertised through discovery — not that an
+ * advertised row is proven genuine.
+ */
+function hasNativeCatalogRowShape(entry: RawEntry): boolean {
+  const levels = entry.supported_reasoning_levels;
+  const messages = entry.model_messages;
+  return typeof entry.base_instructions === "string"
+    && entry.base_instructions.length > 0
+    && (typeof entry.comp_hash === "string" || entry.comp_hash === null)
+    && entry.shell_type === "shell_command"
+    && Array.isArray(levels)
+    && levels.length > 0
+    && levels.every(level => typeof level === "object" && level !== null
+      && typeof (level as { effort?: unknown }).effort === "string")
+    && typeof messages === "object"
+    && messages !== null
+    && !Array.isArray(messages);
+}
+
+function observedAccountBoundNativeSlug(entry: RawEntry): string | undefined {
+  const accountBound = trustedAccountBoundNativeCatalogSlug(entry);
+  const slug = accountBound ?? (typeof entry.slug === "string" ? entry.slug : "");
+  if (!isAccountBoundOpenAiNativeSlug(slug)
+    || entry.supported_in_api !== true
+    || !hasNativeCatalogRowShape(entry)
+    || (entry.visibility !== "list" && entry[ACCOUNT_BOUND_OBSERVED_NATIVE_MARKER] !== true)) {
+    return undefined;
+  }
+  return slug;
+}
+
+/**
+ * Return exact, previously observed account-native rows that are not in the static release set.
+ * The result is used only to carry a hidden observation across startup cache invalidation.
+ */
+export function observedAccountBoundNativeEntries(
+  observedEntries: readonly RawEntry[],
+): RawEntry[] {
+  const seen = new Set<string>();
+  return observedEntries.flatMap(entry => {
+    const slug = observedAccountBoundNativeSlug(entry);
+    // Only carry bare upstream observations across cache replacement. Account-qualified rows are
+    // already a projection of the current selector map and must not preserve private/stale labels.
+    if (!slug
+      || typeof entry.slug !== "string"
+      || entry.slug.includes("/")
+      || SUPPORTED_NATIVE_OPENAI_SLUGS.has(slug)
+      || seen.has(slug)) return [];
+    seen.add(slug);
+    return [structuredClone(entry)];
+  });
+}
+
+/**
+ * Native ids observed in the user's Codex catalog/cache for account-qualified discovery.
+ *
+ * Unknown ids are deliberately returned only to callers that build selector-qualified rows. The
+ * static bare set remains the source of truth for global/API-key discovery, while this preserves
+ * exact account-scoped ids such as `gpt-daybreak-blue-latest` until the static set catches up.
+ */
+export function accountBoundNativeOpenAiSlugs(
+  observedEntries: readonly RawEntry[] = [
+    ...(readCurrentCodexModelsCache()?.models ?? []),
+    // Existing generated rows are also safe to reuse after a process starts without a cache
+    // invalidation pass; bare user-authored catalog rows are intentionally not trusted here.
+    ...(readCurrentCodexCatalog()?.models ?? []).filter(entry =>
+      trustedAccountBoundNativeCatalogSlug(entry) !== undefined),
+  ],
+): string[] {
+  const observed = observedEntries.flatMap(entry => {
+    const slug = observedAccountBoundNativeSlug(entry);
+    return slug === undefined ? [] : [slug];
+  });
+  return unique([...NATIVE_OPENAI_MODELS, ...observed]);
+}
+
+/**
+ * Resolve account-native ids per public selector. Bare observations come from Codex's main
+ * catalog/cache, so they are eligible only for selectors that target the main account. A
+ * generated qualified row carries its own selector and never gets copied to an unrelated pool
+ * account. An explicit observation marker is public selector metadata only; private account ids
+ * never enter the catalog or cache.
+ */
+export function accountBoundNativeOpenAiSlugsBySelector(
+  config: AccountSelectorConfig,
+  observedEntries: readonly RawEntry[] = [
+    ...(readCurrentCodexModelsCache()?.models ?? []),
+    ...(readCurrentCodexCatalog()?.models ?? []).filter(entry =>
+      trustedAccountBoundNativeCatalogSlug(entry) !== undefined),
+  ],
+): ReadonlyMap<string, readonly string[]> {
+  const selectors = visibleCodexAccountSelectors(config);
+  const mainSelectors = new Set(mainAccountSelectors(config));
+  const result = new Map<string, Set<string>>(
+    selectors.map(selector => [selector, new Set(NATIVE_OPENAI_MODELS)]),
+  );
+  for (const entry of observedEntries) {
+    const slug = observedAccountBoundNativeSlug(entry);
+    if (slug === undefined || SUPPORTED_NATIVE_OPENAI_SLUGS.has(slug)) continue;
+    const generated = trustedAccountBoundNativeCatalogSlug(entry);
+    const generatedSelector = generated === undefined || typeof entry.slug !== "string"
+      ? undefined
+      : entry.slug.slice(0, entry.slug.indexOf("/"));
+    const markedSelectors = Array.isArray(entry[ACCOUNT_BOUND_OBSERVED_SELECTORS_MARKER])
+      ? entry[ACCOUNT_BOUND_OBSERVED_SELECTORS_MARKER].filter((value): value is string => typeof value === "string")
+      : [];
+    const eligible = generatedSelector !== undefined
+      ? (mainSelectors.has(generatedSelector) ? [generatedSelector] : [])
+      : markedSelectors.length > 0
+        ? markedSelectors.filter(selector => mainSelectors.has(selector))
+        : [...mainSelectors];
+    for (const selector of eligible) {
+      const rows = result.get(selector);
+      if (rows) rows.add(slug);
+    }
+  }
+  return new Map([...result.entries()].map(([selector, slugs]) => [selector, [...slugs]]));
+}
+
+/** Unknown native ids observed from Codex, excluding the static release set. */
+export function observedAccountBoundNativeOpenAiSlugs(
+  observedEntries?: readonly RawEntry[],
+): string[] {
+  const all = accountBoundNativeOpenAiSlugs(observedEntries);
+  return all.filter(slug => !SUPPORTED_NATIVE_OPENAI_SLUGS.has(slug));
+}
+
 function catalogNativeSlugs(): string[] {
   const cat = readCurrentCatalogOrCache();
   const models = cat?.models ?? [];

package/src/codex/catalog/parsing.ts

@@ -393,17 +393,18 @@ export function normalizeRoutedCatalogEntry(entry: RawEntry, parallelToolCalls =
   // Per-model routed opt-ins can be added once provider metadata exposes this capability.
   delete entry.supports_reasoning_summaries;
   const isCursorEntry = typeof entry.slug === "string" && entry.slug.startsWith("cursor/");
-  // Routed providers use opencodex sidecars and client-executed tool discovery. The sidecar
-  // runs through native gpt-5.4-mini, so image search is available and verbalized for text-only
-  // models. EXCEPT cursor: its runTurn transport bypasses the web-search plan entirely and
-  // rejects server search queries — advertising the tool would make models call into a void.
+  // `supports_search_tool` selects Codex's deferred tool-discovery surface; it is not the hosted
+  // web-search capability. OpenCodex can round-trip tool_search when a client sends it, but routed
+  // providers have no provider/model proof that Codex App plugins work through that deferred
+  // surface. Advertising it unconditionally hides the App's compatible direct MCP tools (#1522),
+  // so routed rows fail closed to direct discovery. The sidecar-backed hosted web-search metadata
+  // remains advertised independently for non-Cursor routes.
   if (isCursorEntry) {
     delete entry.web_search_tool_type;
-    entry.supports_search_tool = false;
   } else {
     entry.web_search_tool_type = "text_and_image";
-    entry.supports_search_tool = true;
   }
+  entry.supports_search_tool = false;
   // Cursor's transport already serializes overlapping tool calls into atomic Responses tool events.
   // Advertising parallel calls lets Codex send the same native capability bit it sends for OpenAI.
   // Opt-in providers (OcxProviderConfig.parallelToolCalls, e.g. xAI) advertise it too: the

package/src/codex/catalog/sync.ts

@@ -30,11 +30,12 @@ import { providerDestinationResolvedError } from "../../lib/destination-policy";
 import { redactSecretString } from "../../lib/redact";
 import upstreamModelsSnapshot from "../data/upstream-models.json";
 import { OPENAI_CODEX_PROVIDER_ID } from "../../providers/openai-tiers";
+import { codexAccountNamespaceEntries, isMainCodexAccountTarget } from "../account-namespaces";
 
 
 import { CODEX_CUSTOM_MODEL_CATALOG_KIND, CODEX_PROVIDER_MODEL_CATALOG_KIND, activeCodexModelsCachePath, applyCatalogMetadata, applyMultiAgentMode, applyNativeOpenAiContextOverride, applyRoutedCodexToolMode, catalogBackupPathFor, catalogHasRoutedEntries, catalogModelSlug, ensureStrictCatalogFields, findNativeTemplate, isDefaultCatalogPath, isRoutedModelCompatibilityExcluded, legacyCatalogBackupPath, normalizeRoutedCatalogEntry, normalizeServiceTiers, readCatalog, readCatalogBackup, readCodexCatalogPath, readNativeBaseline } from "./parsing";
 import type { CatalogModel, MultiAgentMode, RawCatalog, RawEntry } from "./parsing";
-import { applyNativeVisibility, CODEX_NATIVE_ALIAS_CATALOG_KIND, desktopAllowlistSuppressedNativeSlugs, disabledNativeSlugs, isNativeAliasCatalogEntry, isUnsupportedOpenAiNativeSlug, NATIVE_OPENAI_MODELS, shouldIncludeAccountBoundNativeOpenAi, shouldIncludeNativeOpenAi, shouldUpgradeToUpstreamEntry, SUPPORTED_NATIVE_OPENAI_SLUGS, upstreamNativeEntry } from "./metadata";
+import { accountBoundNativeOpenAiSlugs, accountBoundNativeOpenAiSlugsBySelector, applyNativeVisibility, CODEX_NATIVE_ALIAS_CATALOG_KIND, desktopAllowlistSuppressedNativeSlugs, disabledNativeSlugs, isNativeAliasCatalogEntry, isUnsupportedOpenAiNativeSlug, NATIVE_OPENAI_MODELS, observedAccountBoundNativeEntries, shouldIncludeAccountBoundNativeOpenAi, shouldIncludeNativeOpenAi, shouldUpgradeToUpstreamEntry, SUPPORTED_NATIVE_OPENAI_SLUGS, upstreamNativeEntry } from "./metadata";
 import {
   bundledCatalogCacheState,
   loadBundledCodexCatalog,
@@ -313,7 +314,7 @@ export function deriveEntry(
     slug, display_name: routedDisplayName(slug), description: desc,
     shell_type: "shell_command", visibility: "list", supported_in_api: true,
     priority, base_instructions: "You are a helpful coding assistant.",
-    ...(isRouted ? { web_search_tool_type: "text_and_image", supports_search_tool: true } : {}),
+    ...(isRouted ? { web_search_tool_type: "text_and_image", supports_search_tool: false } : {}),
   };
   if (isRouted) {
     applyRoutedCodexToolMode(entry);
@@ -346,6 +347,10 @@ export interface ObservedCatalogEntryBuildInput {
   readonly disabledNativeAccountSlugs: ReadonlySet<string>;
   readonly multiAgentV2Enabled: boolean;
   readonly openaiContextCap?: number;
+  /** Additional native ids to clone under account selectors, without creating bare rows. */
+  readonly accountNativeSlugs?: readonly string[];
+  /** Per-selector account ids; unknown observations must not be copied to unrelated accounts. */
+  readonly accountNativeSlugsBySelector?: ReadonlyMap<string, readonly string[]>;
 }
 
 /** Build entries with the process-observed Codex feature state. */
@@ -361,6 +366,8 @@ export function buildCatalogEntries(
   suppressedBareNativeSlugs: ReadonlySet<string> = new Set(),
   disabledNativeAccountSlugs: ReadonlySet<string> = new Set(),
   contextCap?: number,
+  accountNativeSlugs?: readonly string[],
+  accountNativeSlugsBySelector?: ReadonlyMap<string, readonly string[]>,
 ): RawEntry[] {
   return buildCatalogEntriesFromObservedState({
     template,
@@ -375,6 +382,8 @@ export function buildCatalogEntries(
     disabledNativeAccountSlugs,
     multiAgentV2Enabled: isMultiAgentV2Enabled(),
     openaiContextCap: contextCap,
+    accountNativeSlugs,
+    accountNativeSlugsBySelector,
   });
 }
 
@@ -392,6 +401,8 @@ export function buildCatalogEntriesFromObservedState({
   disabledNativeAccountSlugs,
   multiAgentV2Enabled,
   openaiContextCap,
+  accountNativeSlugs,
+  accountNativeSlugsBySelector,
 }: ObservedCatalogEntryBuildInput): RawEntry[] {
   // Codex's models-manager sorts by `priority` ASC and advertises the first 5 picker-visible
   // models to spawn_agent (sort_by_key(priority) + MAX_MODEL_OVERRIDES_IN_SPAWN_AGENT=5). Catalog
@@ -450,8 +461,16 @@ export function buildCatalogEntriesFromObservedState({
     emittedNativeAliases.add(nativeAlias);
     emittedNativeAliasSlugs.add(slug);
   }
+  const nativeEntriesBySlug = new Map(nativeEntries.map(entry => [String(entry.slug), entry] as const));
   for (const [selectorIndex, selector] of accountSelectors.entries()) {
-    for (const [nativeIndex, native] of nativeEntries.entries()) {
+    const selectorNativeSlugs = accountNativeSlugsBySelector?.get(selector)
+      ?? accountNativeSlugs
+      ?? gptSlugs;
+    const accountNativeEntries = selectorNativeSlugs.map(slug => (
+      nativeEntriesBySlug.get(slug)
+        ?? deriveEntry(template, slug, "OpenAI native model (Codex OAuth passthrough).", 9, undefined, new Set(), openaiContextCap)
+    ));
+    for (const [nativeIndex, native] of accountNativeEntries.entries()) {
       const nativeSlug = String(native.slug);
       if (disabledNativeAccountSlugs.has(nativeSlug)) continue;
       const e = JSON.parse(JSON.stringify(native)) as RawEntry;
@@ -785,6 +804,7 @@ export function mergeCatalogEntriesFromObservedState({
       && !(m.slug as string).includes("/")
       && m.owned_by !== COMBO_NAMESPACE
       && (policy.unsupportedNativeEntries === "preserve"
+        || policy.nativeBackfillSlugs.includes(m.slug as string)
         || !isUnsupportedOpenAiNativeSlug(m.slug as string)))
     .map(m => {
       const slug = m.slug as string;
@@ -936,6 +956,11 @@ export function mergeCatalogEntriesFromObservedState({
   }
 
   const managedEntries = [...finalRoutedEntries, ...alignedAccountBoundEntries];
+  const observedNativeSlugs = new Set(alignedAccountBoundEntries.flatMap(entry => {
+    const slug = trustedAccountBoundNativeCatalogSlug(entry);
+    return slug === undefined ? [] : [slug];
+  }));
+  for (const slug of policy.nativeBackfillSlugs) observedNativeSlugs.add(slug);
   const mergedEntries = [...native, ...managedEntries].map(m => {
     const normalized = normalizeServiceTiers(m);
     if (!isNativeAliasCatalogEntry(normalized)) applyNativeOpenAiContextOverride(normalized, openaiContextCap);
@@ -969,7 +994,7 @@ export function mergeCatalogEntriesFromObservedState({
   // clobber a hide flag back to list. Bare ids disable every account clone; qualified ids disable
   // only their generated account row.
   const versionedEntries = applyMultiAgentMode(
-    applyNativeVisibility(mergedEntries, disabledModels, alignedAccountBoundEntries.length > 0),
+    applyNativeVisibility(mergedEntries, disabledModels, alignedAccountBoundEntries.length > 0, observedNativeSlugs),
     multiAgentMode,
     multiAgentV2Enabled,
   );
@@ -1055,6 +1080,7 @@ interface RetainedCatalogSyncRead {
   readonly catalogPath: string;
   readonly catalog: RawCatalog;
   readonly onDiskCatalog: RawCatalog | null;
+  readonly modelsCache: RawCatalog | null;
   readonly evidence: string;
   /**
    * Process-local epochs, baselined AFTER our own gather rather than with the
@@ -1163,9 +1189,10 @@ function readRetainedCatalogSync(config: OcxConfig): RetainedCatalogSyncRead | n
   // merge source. Preservation must inspect the file that this sync is about to overwrite;
   // otherwise an empty/partial provider gather cannot see routed or user-native rows on disk.
   const onDiskCatalog = readCatalog(catalogPath);
+  const modelsCache = readCatalog(activeCodexModelsCachePath());
   const evidence = retainedCatalogSyncEvidence(config, catalogPath, catalog);
   // `processEvidence` is filled in after the provider await, not here.
-  return { catalogPath, catalog, onDiskCatalog, evidence, processEvidence: "" };
+  return { catalogPath, catalog, onDiskCatalog, modelsCache, evidence, processEvidence: "" };
 }
 
 function revalidateRetainedCatalogSync(
@@ -1181,6 +1208,7 @@ function revalidateRetainedCatalogSync(
     catalogPath,
     catalog: JSON.parse(JSON.stringify(prepared.catalog)) as RawCatalog,
     onDiskCatalog: readCatalog(catalogPath),
+    modelsCache: readCatalog(activeCodexModelsCachePath()),
     evidence,
     processEvidence: prepared.processEvidence,
   };
@@ -1283,6 +1311,20 @@ function writeRetainedCatalogSync({
   const accountSelectors = includeAccountBoundNativeOpenAi
     ? visibleCodexAccountSelectors(config)
     : [];
+  const observedAccountNativeEntries = [
+    ...(read.modelsCache?.models ?? []),
+    ...(onDiskCatalog?.models ?? []).filter(entry =>
+      trustedAccountBoundNativeCatalogSlug(entry) !== undefined),
+  ];
+  const accountNativeSlugs = accountSelectors.length > 0
+    ? accountBoundNativeOpenAiSlugs(observedAccountNativeEntries)
+    : [];
+  const accountNativeSlugsBySelector = accountSelectors.length > 0
+    ? accountBoundNativeOpenAiSlugsBySelector(config, observedAccountNativeEntries)
+    : new Map<string, readonly string[]>();
+  // Unknown account-native ids have no safe bare/global identity. They are only projected through
+  // the selector map above; the no-selector catalog remains the static native/API-key surface.
+  const observedNativeSlugs: string[] = [];
   const wsEnabled = websocketsEnabled(config);
   const multiAgentV2Enabled = isMultiAgentV2Enabled();
   const goEntries = buildCatalogEntriesFromObservedState({
@@ -1343,6 +1385,8 @@ function writeRetainedCatalogSync({
       disabledNativeAccountSlugs: new Set([...disabledNativeSlugs(config)].filter(slug => suppressedBareNativeSlugs.has(slug))),
       multiAgentV2Enabled,
       openaiContextCap,
+      accountNativeSlugs,
+      accountNativeSlugsBySelector,
     }).filter(entry => trustedAccountBoundNativeCatalogSlug(entry) !== undefined)
     : [];
   catalog.models = mergeCatalogEntriesFromObservedState({
@@ -1368,6 +1412,7 @@ function writeRetainedCatalogSync({
     openaiContextCap,
     policy: {
       ...CANONICAL_NATIVE_CATALOG_CONTENT_POLICY,
+      nativeBackfillSlugs: [...NATIVE_OPENAI_MODELS, ...observedNativeSlugs],
       warningPolicy: "emit",
     },
   });
@@ -1591,10 +1636,32 @@ export function invalidateCodexModelsCacheWithPermit(
     if (!existsSync(catalogPath)) return false;
     const catalog = JSON.parse(readFileSync(catalogPath, "utf8"));
     const models = catalog.models ?? catalog;
+    const currentCache = readCatalog(activeCodexModelsCachePath());
+    const existingSlugs = new Set(models.flatMap((entry: RawEntry) =>
+      typeof entry.slug === "string" ? [entry.slug] : []));
+    const currentConfig = loadConfig();
+    const mainSelectors = visibleCodexAccountSelectors(currentConfig).filter(selector => {
+      const target = new Map(codexAccountNamespaceEntries(currentConfig)).get(selector);
+      return isMainCodexAccountTarget(target ?? "");
+    });
+    const observedAccountModels = observedAccountBoundNativeEntries(currentCache?.models ?? [])
+      .filter(entry => {
+        const slug = typeof entry.slug === "string" ? entry.slug : "";
+        return !existingSlugs.has(slug);
+      })
+      .map(entry => ({
+        ...entry,
+        // Keep the observation in Codex's cache without advertising a new bare picker row. The
+        // next OpenCodex catalog sync consumes this marker and creates only selector-qualified
+        // rows for the currently configured public account selectors.
+        visibility: "hide",
+        opencodex_account_observed_native: true,
+        opencodex_account_observed_selectors: mainSelectors,
+      }));
     const wrapper = {
       fetched_at: "2000-01-01T00:00:00Z",
       client_version: "0.0.0",
-      models,
+      models: [...models, ...observedAccountModels],
     };
     replaceCodexModelsCache(permit, owningCodexHome, {
       path: activeCodexModelsCachePath(),

package/src/codex/catalog.ts

@@ -2,7 +2,7 @@
 // Public surface preserved exactly; importers keep using "src/codex/catalog".
 export { isMediaGenerationModelId, shouldExposeRoutedModel, readCodexCatalogPath, readCatalog, normalizeRoutedCatalogEntry, catalogModelSlug, filterSupportedNativeSlugs, catalogModelSupportsReasoningSummaries } from "./catalog/parsing";
 export type { CatalogModel, MultiAgentMode } from "./catalog/parsing";
-export { CODEX_NATIVE_ALIAS_CATALOG_KIND, NATIVE_OPENAI_MODELS, configuredNativeAliasSlugs, desktopAllowlistSuppressedNativeSlugs, isNativeAliasCatalogEntry, nativeOpenAiContextWindow, disabledNativeSlugs, visibleNativeSlugs, desktopVisibleNativeSlugs, nativeModelRows, applyNativeVisibility, upstreamNativeEntry, nativeOpenAiSlugs, listCatalogNativeSlugs, nativeInputModalities, nativeReasoningEfforts, nativeDefaultReasoningEffort, shouldIncludeAccountBoundNativeOpenAi, shouldIncludeNativeOpenAi } from "./catalog/metadata";
+export { accountBoundNativeOpenAiSlugs, accountBoundNativeOpenAiSlugsBySelector, CODEX_NATIVE_ALIAS_CATALOG_KIND, NATIVE_OPENAI_MODELS, configuredNativeAliasSlugs, desktopAllowlistSuppressedNativeSlugs, isNativeAliasCatalogEntry, nativeOpenAiContextWindow, disabledNativeSlugs, visibleNativeSlugs, desktopVisibleNativeSlugs, nativeModelRows, applyNativeVisibility, observedAccountBoundNativeEntries, observedAccountBoundNativeOpenAiSlugs, upstreamNativeEntry, nativeOpenAiSlugs, listCatalogNativeSlugs, nativeInputModalities, nativeReasoningEfforts, nativeDefaultReasoningEffort, shouldIncludeAccountBoundNativeOpenAi, shouldIncludeNativeOpenAi } from "./catalog/metadata";
 export { isSpawnableCodexCandidate, codexExecInvocation, loadBundledCodexCatalog, materializeBundledCodexCatalog, loadCatalogTemplate } from "./catalog/bundled";
 export { nativeEffortClamp, shouldApplyNativeEffortClamp, catalogModelEfforts, codexSupportedReasoningEfforts, clampedDefaultEffort, clampEntryToCodexSupportedEfforts, clampCatalogModelsToCodexSupport } from "./catalog/effort";
 export { applyProviderConfigHints, isDatedVariantId, filterCatalogVisibleModels, gatherRoutedModels, clearGatherRoutedModelsInflight, augmentRoutedModelsWithRegistryOpenAiApiRows, augmentRoutedModelsWithMetadata, resolveComboCatalogMember, configuredComboTargetModelsByProvider } from "./catalog/provider-fetch";

package/src/codex/convergence.ts

@@ -49,6 +49,8 @@ import {
   import { exactComboCatalogSlugs } from "./catalog/aggregation";
   import {
   isNativeAliasCatalogEntry,
+  accountBoundNativeOpenAiSlugs,
+  accountBoundNativeOpenAiSlugsBySelector,
   disabledNativeSlugs,
   desktopAllowlistSuppressedNativeSlugs,
   NATIVE_OPENAI_MODELS,
@@ -216,6 +218,7 @@ function prepareCatalog(
   baselineCatalogModels: readonly Readonly<Record<string, unknown>>[],
   degradedProviderNames: ReadonlySet<string>,
   nativeRecoverySources: readonly (readonly RawEntry[])[] = [],
+  observedAccountNativeEntries: readonly RawEntry[] = [],
 ): RawCatalog {
   const catalog = JSON.parse(JSON.stringify(source.catalog)) as RawCatalog;
   const template = findNativeTemplate(catalog);
@@ -232,6 +235,15 @@ function prepareCatalog(
   const accountSelectors = shouldIncludeAccountBoundNativeOpenAi(config)
     ? visibleCodexAccountSelectors(config)
     : [];
+  const accountNativeSlugs = accountSelectors.length > 0
+    ? accountBoundNativeOpenAiSlugs(observedAccountNativeEntries)
+    : [];
+  const accountNativeSlugsBySelector = accountSelectors.length > 0
+    ? accountBoundNativeOpenAiSlugsBySelector(config, observedAccountNativeEntries)
+    : new Map<string, readonly string[]>();
+  // Unknown account-native ids have no safe bare/global identity. They are only projected through
+  // selector-qualified rows when a live selector is configured.
+  const observedNativeSlugs: string[] = [];
   const disabledNative = disabledNativeSlugs(config);
   const nativeCatalogModels = mergeCatalogModelsWithNativeRecovery(
     active?.models ?? catalog.models ?? [],
@@ -265,6 +277,8 @@ function prepareCatalog(
       suppressedBareNativeSlugs,
       disabledNativeAccountSlugs: new Set([...disabledNative].filter(slug => suppressedBareNativeSlugs.has(slug))),
       multiAgentV2Enabled,
+      accountNativeSlugs,
+      accountNativeSlugsBySelector,
     }).filter(entry => trustedAccountBoundNativeCatalogSlug(entry) !== undefined);
   const gatheredProviderNames = new Set(enabledProviders.map(([name]) => name));
   const selectedModelsByProvider = new Map<string, ReadonlySet<string>>(
@@ -296,6 +310,7 @@ function prepareCatalog(
     suppressedBareNativeSlugs,
     policy: {
       ...CANONICAL_NATIVE_CATALOG_CONTENT_POLICY,
+      nativeBackfillSlugs: [...NATIVE_OPENAI_MODELS, ...observedNativeSlugs],
       warningPolicy: "suppress",
     },
   });
@@ -384,6 +399,11 @@ export async function gatherCodexCatalogCandidate(
         catalogFrom(keyedBackupBytes)?.models ?? [],
         catalogFrom(legacyBackupBytes)?.models ?? [],
       ],
+      [
+        ...(catalogFrom(cacheBytes)?.models ?? []),
+        ...(catalogFrom(activeBytes)?.models ?? []).filter(entry =>
+          trustedAccountBoundNativeCatalogSlug(entry) !== undefined),
+      ],
     );
     const preparedCatalogBytes = catalogBytes(preparedCatalog);
     const preparedCacheBytes = `${JSON.stringify({

package/src/codex/prompt-journal.ts

@@ -20,7 +20,7 @@
  * recovery sees a mismatch and overwrites their work with a stale image.
  */
 import { existsSync, mkdirSync, openSync, closeSync, fsyncSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
-import { dirname } from "node:path";
+import { dirname, resolve } from "node:path";
 import { createHash, randomBytes } from "node:crypto";
 import { forgetEphemeralSecretPath, hardenSecretPath, windowsSecretAclApplies } from "../lib/windows-secret-acl";
 
@@ -210,14 +210,40 @@ export type RecoveryOutcome =
   | { ok: true; action: "none" | "committed" | "rolled-back" }
   | { ok: false; error: "recovery_required"; detail: string };
 
+export interface RecoveryTargets {
+  configPath: string;
+  storePath: string;
+}
+
+/** Lexical path identity only: never resolve an untrusted journal path through the filesystem. */
+export function sameRecoveryPath(
+  recordedPath: string,
+  expectedPath: string,
+  platform: NodeJS.Platform = process.platform,
+): boolean {
+  const recorded = resolve(recordedPath);
+  const expected = resolve(expectedPath);
+  return platform === "win32"
+    ? recorded.toLowerCase() === expected.toLowerCase()
+    : recorded === expected;
+}
+
 /**
  * Run at service start and at every lock acquisition. Never from a read.
  *
  * A journal on disk means commit never happened, so the default is rollback.
  * The single exception is not a roll-forward: when BOTH targets already hold the
  * post-image the writes had finished and only the journal deletion was missing.
+ *
+ * The expected targets come from the active prompt-layer configuration, not
+ * from the journal. The envelope checksum detects accidental corruption, not a
+ * same-user forgery, so recovery binds the decoded record to those trusted
+ * paths before reading either target.
  */
-export function recoverIfNeeded(journalPath: string): RecoveryOutcome {
+export function recoverIfNeeded(
+  journalPath: string,
+  expectedTargets: RecoveryTargets,
+): RecoveryOutcome {
   const raw = readOrNull(journalPath);
   if (raw === null) return { ok: true, action: "none" };
 
@@ -230,11 +256,22 @@ export function recoverIfNeeded(journalPath: string): RecoveryOutcome {
     };
   }
 
-  const config = classify(readOrNull(record.configPath), record.preConfig, record.postConfig);
-  const store = classify(readOrNull(record.storePath), record.preStore, record.postStore);
+  if (
+    !sameRecoveryPath(record.configPath, expectedTargets.configPath)
+    || !sameRecoveryPath(record.storePath, expectedTargets.storePath)
+  ) {
+    return {
+      ok: false,
+      error: "recovery_required",
+      detail: `journal at ${journalPath} does not match the active prompt-layer paths; nothing was read from its targets`,
+    };
+  }
+
+  const config = classify(readOrNull(expectedTargets.configPath), record.preConfig, record.postConfig);
+  const store = classify(readOrNull(expectedTargets.storePath), record.preStore, record.postStore);
 
   if (config === "unknown" || store === "unknown") {
-    const which = config === "unknown" ? record.configPath : record.storePath;
+    const which = config === "unknown" ? expectedTargets.configPath : expectedTargets.storePath;
     return {
       ok: false,
       error: "recovery_required",
@@ -258,38 +295,38 @@ export function recoverIfNeeded(journalPath: string): RecoveryOutcome {
   // Revalidate each target immediately before its own restore: a target that
   // changed since the initial classification must not be overwritten.
   if (config === "post") {
-    if (classify(readOrNull(record.configPath), record.preConfig, record.postConfig) !== "post") {
+    if (classify(readOrNull(expectedTargets.configPath), record.preConfig, record.postConfig) !== "post") {
       return {
         ok: false,
         error: "recovery_required",
-        detail: `${record.configPath} changed after its first classification; refusing to overwrite it`,
+        detail: `${expectedTargets.configPath} changed after its first classification; refusing to overwrite it`,
       };
     }
     try {
-      restore(record.configPath, record.preConfigBytes);
+      restore(expectedTargets.configPath, record.preConfigBytes);
     } catch (error) {
       return {
         ok: false,
         error: "recovery_required",
-        detail: `rollback of ${record.configPath} failed mid-write: ${error instanceof Error ? error.message : String(error)}`,
+        detail: `rollback of ${expectedTargets.configPath} failed mid-write: ${error instanceof Error ? error.message : String(error)}`,
       };
     }
   }
   if (store === "post") {
-    if (classify(readOrNull(record.storePath), record.preStore, record.postStore) !== "post") {
+    if (classify(readOrNull(expectedTargets.storePath), record.preStore, record.postStore) !== "post") {
       return {
         ok: false,
         error: "recovery_required",
-        detail: `${record.storePath} changed after its first classification; refusing to overwrite it`,
+        detail: `${expectedTargets.storePath} changed after its first classification; refusing to overwrite it`,
       };
     }
     try {
-      restore(record.storePath, record.preStoreBytes);
+      restore(expectedTargets.storePath, record.preStoreBytes);
     } catch (error) {
       return {
         ok: false,
         error: "recovery_required",
-        detail: `rollback of ${record.storePath} failed mid-write: ${error instanceof Error ? error.message : String(error)}`,
+        detail: `rollback of ${expectedTargets.storePath} failed mid-write: ${error instanceof Error ? error.message : String(error)}`,
       };
     }
   }