@bitkyc08/opencodex 2.13.0 → 2.14.0

package/src/providers/registry.ts

@@ -237,6 +237,12 @@ export interface ProviderRegistryEntry {
   parallelToolCalls?: boolean;
   /** Opt this provider into forwarding prompt_cache_key (OpenAI-specific; strict backends reject it). */
   promptCacheKey?: boolean;
+  /**
+   * Opt-in: forward `service_tier` on the `/chat/completions` wire. Same hazard as
+   * `promptCacheKey` — an OpenAI-specific extension that strict gateways reject. Distinct from
+   * `supportsServiceTier`, which governs the Responses wire.
+   */
+  chatServiceTier?: boolean;
   autoToolChoiceOnlyModels?: string[];
   preserveReasoningContentModels?: string[];
   requiresReasoningPlaceholderModels?: string[];
@@ -427,38 +433,35 @@ const OPENCODE_ZEN_TEXT_ONLY_MODELS = [
   "deepseek-v4-flash-free",
 ];
 /*
- * DeepSeek's Codex ladder is low/high/max, and the two V4 models resolve it
- * DIFFERENTLY. From the official thinking-mode table (api-docs.deepseek.com,
- * EN and zh-cn agree, re-verified 2026-08-06):
+ * DeepSeek's Codex ladder is low/high/max. With the V4 Pro GA release
+ * (DeepSeek-V4-Pro-0813) the official thinking-mode table is IDENTICAL for both
+ * V4 models (api-docs.deepseek.com/guides/thinking_mode, verified 2026-08-13):
  *
  *   requested  | v4-flash | v4-pro
- *   low        | low      | high
+ *   low        | low      | low
+ *   medium     | high     | high
  *   high       | high     | high
- *   xhigh      | high     | max
+ *   xhigh      | high     | high
  *   max        | max      | max
  *
- * Two consequences (#1057):
+ * Before GA, Pro silently upgraded low->high and mapped xhigh->max (#1057-era
+ * table); the page's footnote about an early-August Pro mapping update landed
+ * with this GA, so Pro now advertises the same three real tiers as Flash.
+ *
+ * Two standing notes (#1057):
  *
  * - `xhigh` is a COMPATIBILITY ALIAS, not a native tier. It stays in the wire maps
  *   so existing requests and saved configs keep working, but it is not advertised.
- * - Pro does NOT honor `low` — the vendor silently upgrades it to `high`. So Pro
- *   advertises only the two levels it actually distinguishes. Advertising `low`
- *   there would put a tier in the picker that costs `high`, which is the same
- *   defect this fixes wearing a different value.
- *
- * The vendor page footnotes that Pro's mapping updates in early August 2026; as of
- * the re-verification above it had not changed. When it does, Pro gains `low` here.
- *
- * `medium` has no row in the vendor table — mapping it to `high` is OUR
- * compatibility choice for clients that only speak the OpenAI ladder.
+ * - `medium` has no row in the vendor table — mapping it to `high` is OUR
+ *   compatibility choice for clients that only speak the OpenAI ladder.
  */
 const DEEPSEEK_FLASH_THINKING_EFFORTS = ["low", "high", "max"];
-const DEEPSEEK_PRO_THINKING_EFFORTS = ["high", "max"];
+const DEEPSEEK_PRO_THINKING_EFFORTS = ["low", "high", "max"];
 const DEEPSEEK_PRO_REASONING_MAP: Record<string, string> = {
-  low: "high",
+  low: "low",
   medium: "high",
   high: "high",
-  xhigh: "max",
+  xhigh: "high",
   max: "max",
 };
 const DEEPSEEK_FLASH_REASONING_MAP: Record<string, string> = {
@@ -947,7 +950,9 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     // devlog/model_update/260709_model_refresh/001_xai_lineup.md.
     // grok-4.20-multi-agent-0309 is intentionally absent: the OAuth chat-completions
     // transport returns 400 ("Multi Agent requests are not allowed on chat completions").
-    models: ["grok-4.5", "grok-4.3", "grok-4.20-0309-reasoning", "grok-4.20-0309-non-reasoning", "grok-build-0.1", "grok-composer-2.5-fast"],
+    // 260813: grok-4.6 added per the new docs.x.ai/developers/grok-4-6 page; specs mirrored
+    // from grok-4.5 until the official capability/pricing tables settle.
+    models: ["grok-4.6", "grok-4.5", "grok-4.3", "grok-4.20-0309-reasoning", "grok-4.20-0309-non-reasoning", "grok-build-0.1", "grok-composer-2.5-fast"],
     defaultModel: "grok-4.5",
     // Vision lineup per docs.x.ai model-capabilities/images/understanding: the grok-4.x chat
     // models accept image input (JPEG/PNG, URL or base64). Without this the catalog leaves
@@ -956,6 +961,7 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     // the app blocks attachments client-side. grok-build-0.1 / grok-composer-2.5-fast stay out
     // (they are already listed in noVisionModels below).
     modelInputModalities: {
+      "grok-4.6": ["text", "image"],
       "grok-4.5": ["text", "image"],
       "grok-4.3": ["text", "image"],
       "grok-4.20-0309-reasoning": ["text", "image"],
@@ -966,10 +972,11 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     // reasoning_content as the top cause of prompt-cache misses on multi-turn conversations
     // (docs.x.ai prompt-caching/multi-turn, verified 2026-07-13 — devlog/_plan/260713_grok_caching).
     // Models that never emit reasoning simply have no thinking parts to replay (no-op).
-    preserveReasoningContentModels: ["grok-4.5", "grok-4.3", "grok-4.20-0309-reasoning"],
+    preserveReasoningContentModels: ["grok-4.6", "grok-4.5", "grok-4.3", "grok-4.20-0309-reasoning"],
     // grok-4.5 reasoning is always-on with low/medium/high control (no off tier upstream).
-    modelReasoningEfforts: { "grok-4.5": ["low", "medium", "high"] },
+    modelReasoningEfforts: { "grok-4.6": ["low", "medium", "high"], "grok-4.5": ["low", "medium", "high"] },
     modelContextWindows: {
+      "grok-4.6": 500_000,
       "grok-4.5": 500_000,
       "grok-4.3": 1_000_000,
       "grok-4.20-0309-reasoning": 1_000_000,
@@ -1414,8 +1421,10 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     // Official DeepSeek Codex setup (codex-deepseek-setup.sh) advertises 1,048,576
     // for both V4 models; the older 1,000,000 figure was a rounded approximation.
     modelContextWindows: { "deepseek-v4-flash": 1_048_576, "deepseek-v4-pro": 1_048_576 },
-    // DeepSeek documents V4-Flash as a native Responses API model adapted for Codex. The
-    // API id is `deepseek-v4-flash`; `DeepSeek-V4-Flash-0731` is a release/version label.
+    // DeepSeek documents both V4 models as native Responses API models adapted for Codex
+    // (model table marks Responses API ✓ for flash and pro; the /responses reference lists
+    // both ids as accepted `model` values — verified 2026-08-13 with the V4 Pro GA,
+    // version label DeepSeek-V4-Pro-0813).
     modelWireDefaults: {
       // Codex speaks Responses natively and DeepSeek ships a Codex-compatible
       // apply_patch tool on that wire, so a Responses inbound goes straight out with
@@ -1424,6 +1433,7 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
       // translating them into Responses would add a hop onto our newest upstream path
       // for no gain.
       "deepseek-v4-flash": { wire: "openai-responses", inbound: ["responses"] },
+      "deepseek-v4-pro": { wire: "openai-responses", inbound: ["responses"] },
     },
     // The #875-era bounded-JSON force (`modelResponsesUpstreamStreaming`) is retired
     // for this entry: the official guide documents a `response.completed` /
@@ -1438,7 +1448,7 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     // devlog/_plan/260807_deepseek_responses_streaming/000_plan.md.
     // Current official streams normally carry a real terminal; retain a narrow grace
     // repair for the historical shape that closes after a complete graph without one.
-    modelResponsesTerminalRepair: { "deepseek-v4-flash": { graceMs: 5_000 } },
+    modelResponsesTerminalRepair: { "deepseek-v4-flash": { graceMs: 5_000 }, "deepseek-v4-pro": { graceMs: 5_000 } },
     // DeepSeek's Responses route emits bare UUID item ids, which leave Codex
     // clients stuck on an uncommitted turn (#938). Client-facing only — raw
     // continuation snapshots keep the upstream ids.
@@ -2313,6 +2323,24 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     noVisionModels: OPENCODE_ZEN_TEXT_ONLY_MODELS,
   },
   { id: "xiaomi", label: "Xiaomi MiMo", baseUrl: "https://api.xiaomimimo.com/anthropic", adapter: "anthropic", authKind: "key", dashboardUrl: "https://xiaomimimo.com", defaultModel: "mimo-v2.5-pro" },
+  // Xiaomi's public OpenAI-compatible endpoint is a distinct transport from both the Anthropic
+  // preset above and the paid token-plan host below. Keep a separate fixed-destination contract
+  // so existing custom providers are never retargeted while the official route receives the
+  // strict reasoning ladder its validator enforces (#1483).
+  {
+    id: "xiaomi-mimo",
+    label: "Xiaomi MiMo (OpenAI Chat)",
+    baseUrl: "https://api.xiaomimimo.com/v1",
+    adapter: "openai-chat",
+    authKind: "key",
+    dashboardUrl: "https://platform.xiaomimimo.com/console/balance",
+    defaultModel: "mimo-v2.5",
+    models: ["mimo-v2.5"],
+    reasoningEfforts: ["low", "medium", "high"],
+    reasoningEffortMap: { xhigh: "high", max: "high", ultra: "high" },
+    preserveCustomDestination: true,
+    note: "Official Xiaomi MiMo OpenAI-compatible Chat endpoint. The upstream validator accepts reasoning_effort none/low/medium/high; higher Codex tiers are clamped to high.",
+  },
   { id: "kilo", label: "Kilo", baseUrl: "https://api.kilo.ai/api/gateway", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://kilo.ai" },
   {
     id: "mimo-free",

package/src/responses/state.ts

@@ -947,6 +947,27 @@ export function responseStateMetrics(): ResponseStateMetrics {
  * Cache completed output and max_output_tokens partial output for previous_response_id replay.
  * Content-filtered incomplete and failed output are not authoritative replay history.
  */
+/**
+ * Request bodies that must never enter the continuation cache.
+ *
+ * The cache is persisted to `responses-state.json`, so anything recorded here reaches disk.
+ * Encrypted-agent-task recovery decrypts task text into the request body and promises
+ * in-memory, TTL-bounded retention; recording that body would put the plaintext on disk with
+ * no TTL and break the promise.
+ *
+ * A WeakSet rather than a body field on purpose: `_rawBody` is serialized verbatim by the
+ * native passthrough, so any marker written into the body itself would be sent upstream.
+ * Marking is enforced once here rather than at each call site, because every recording path
+ * (streaming, non-streaming, passthrough, forced) funnels through `rememberResponseState` —
+ * a new call site cannot reintroduce the leak by forgetting a guard.
+ */
+const nonPersistableBodies = new WeakSet<object>();
+
+/** Bar this exact request body from the continuation cache, and therefore from disk. */
+export function markBodyNonPersistable(body: unknown): void {
+  if (body && typeof body === "object") nonPersistableBodies.add(body as object);
+}
+
 export function rememberResponseState(
   requestBody: unknown,
   response: { id?: unknown; output?: unknown; status?: unknown; incomplete_details?: unknown },
@@ -955,6 +976,7 @@ export function rememberResponseState(
 ): void {
   if (!requestBody || typeof requestBody !== "object" || Array.isArray(requestBody)) return;
   const request = requestBody as Record<string, unknown>;
+  if (nonPersistableBodies.has(request)) return;
   // `force` bypasses only the store:false skip: Codex sends `store:false` on every non-Azure
   // HTTP request (and WS inherits it), yet its WS turns still chain with previous_response_id.
   // The passthrough branch records with force so those chains can be expanded locally; the

package/src/router.ts

@@ -350,6 +350,7 @@ export function routedProviderConfig(providerName: string, provider: OcxProvider
     // opt-in, while an explicit user `false` keeps overriding registry `true`.
     ...(provider.parallelToolCalls === undefined && registryEntry.parallelToolCalls !== undefined ? { parallelToolCalls: registryEntry.parallelToolCalls } : {}),
     ...(provider.promptCacheKey === undefined && registryEntry.promptCacheKey !== undefined ? { promptCacheKey: registryEntry.promptCacheKey } : {}),
+    ...(provider.chatServiceTier === undefined && registryEntry.chatServiceTier !== undefined ? { chatServiceTier: registryEntry.chatServiceTier } : {}),
     ...(provider.reasoningWireFormat === undefined && registryEntry.reasoningWireFormat !== undefined
       ? { reasoningWireFormat: registryEntry.reasoningWireFormat }
       : {}),

package/src/server/claude-messages.ts

@@ -35,6 +35,12 @@ import { addFinalRequestLog, httpStatusForRequestLogTerminal, recordFirstOutput,
 import { conversationIdFromClaudeMetadata } from "./request-log-conversation";
 import { responseWithDeferredRequestLog } from "./relay";
 import { handleResponses } from "./responses";
+import {
+  isApiAuthRequired,
+  isDataPlaneAdmissionSecret,
+  isProxyAdmissionSecret,
+  type RequestPolicyView,
+} from "./auth-cors";
 import type { AdmissionLease } from "../lib/admission";
 import { tryClaimNativeMainProfileForTurn } from "../codex/native-main-admission";
 import { CODEX_MAIN_PROFILE_MAINTENANCE_MESSAGE } from "../codex/auth-context";
@@ -96,20 +102,54 @@ const PASSTHROUGH_STRIP_HEADERS = new Set([
   "accept-encoding", "x-opencodex-api-key", "origin",
 ]);
 
-function hasAnthropicNativeCredential(req: Request): boolean {
-  const bearer = req.headers.get("authorization")?.replace(/^Bearer\s+/i, "").trim() ?? "";
-  const apiKey = req.headers.get("x-api-key")?.trim() ?? "";
-  return bearer.startsWith("sk-ant-") || apiKey.startsWith("sk-ant-");
+function singleCredentialToken(name: "authorization" | "x-api-key", value: string | null): string | null {
+  const raw = value?.trim() ?? "";
+  // Fetch Headers comma-joins duplicate fields. Neither Anthropic credential format permits a
+  // comma, so treating a joined value as one token could hide an admission secret behind a real
+  // provider credential. Ambiguous credential headers fail closed.
+  if (!raw || raw.includes(",")) return null;
+  if (name === "authorization") {
+    const match = /^Bearer\s+(.+)$/i.exec(raw);
+    return match?.[1]?.trim() || null;
+  }
+  return raw;
+}
+
+function hasAnthropicNativeCredential(req: Request, config: OcxConfig): boolean {
+  const bearer = singleCredentialToken("authorization", req.headers.get("authorization"));
+  const apiKey = singleCredentialToken("x-api-key", req.headers.get("x-api-key"));
+  return (!!bearer && bearer.startsWith("sk-ant-") && !isProxyAdmissionSecret(bearer, config))
+    || (!!apiKey && apiKey.startsWith("sk-ant-") && !isProxyAdmissionSecret(apiKey, config));
 }
 
-function wantsNativePassthrough(req: Request, config: OcxConfig, model: unknown): model is string {
+function wantsNativePassthrough(
+  req: Request,
+  config: OcxConfig,
+  requestPolicy: RequestPolicyView,
+  model: unknown,
+): model is string {
   if (config.claudeCode?.nativePassthrough === false) return false;
   if (typeof model !== "string" || !/^(claude|anthropic)/i.test(model)) return false;
-  if (!hasAnthropicNativeCredential(req)) return false;
+  // Authorization and x-api-key both belong to the upstream on this branch. An exposed listener
+  // therefore requires the dedicated admission header even though the routed Messages surface
+  // keeps accepting all three legacy admission forms.
+  if (isApiAuthRequired(requestPolicy)) {
+    const dedicated = req.headers.get("x-opencodex-api-key")?.trim() ?? "";
+    if (!isDataPlaneAdmissionSecret(dedicated, config)) return false;
+  }
+  if (!hasAnthropicNativeCredential(req, config)) return false;
   // An alias or modelMap hit means the user asked for a ROUTED model: translate instead.
   return resolveInboundModel(model, config.claudeCode) === model;
 }
 
+function shouldForwardNativeHeader(name: string, value: string, config: OcxConfig): boolean {
+  const lowerName = name.toLowerCase();
+  if (PASSTHROUGH_STRIP_HEADERS.has(lowerName)) return false;
+  if (lowerName !== "authorization" && lowerName !== "x-api-key") return true;
+  const token = singleCredentialToken(lowerName, value);
+  return !!token && !isProxyAdmissionSecret(token, config);
+}
+
 /** Format a 32-hex cache key as a uuid-shaped session id (version/variant nibbles forced). */
 function uuidFromHex(hex32: string): string {
   const h = (hex32 + "0".repeat(32)).slice(0, 32);
@@ -330,7 +370,7 @@ async function anthropicNativePassthrough(
   }
   const headers = new Headers();
   req.headers.forEach((value, name) => {
-    if (!PASSTHROUGH_STRIP_HEADERS.has(name.toLowerCase())) headers.set(name, value);
+    if (shouldForwardNativeHeader(name, value, config)) headers.set(name, value);
   });
   headers.set("content-type", "application/json");
 
@@ -528,11 +568,12 @@ export async function handleClaudeMessages(
   config: OcxConfig,
   logCtx: RequestLogContext,
   logIds?: { requestId: string; start: number; turnAdmissionLease?: AdmissionLease },
+  requestPolicy: RequestPolicyView = config,
 ): Promise<Response> {
   const translatorBudget = createTranslatorBudget();
   try {
     return finalizeTranslatorBudgetResponse(
-      await handleClaudeMessagesWithBudget(req, config, logCtx, translatorBudget, logIds),
+      await handleClaudeMessagesWithBudget(req, config, logCtx, translatorBudget, logIds, requestPolicy),
       translatorBudget,
     );
   } catch (error) {
@@ -547,6 +588,7 @@ async function handleClaudeMessagesWithBudget(
   logCtx: RequestLogContext,
   translatorBudget: TranslatorBudget,
   logIds?: { requestId: string; start: number; turnAdmissionLease?: AdmissionLease },
+  requestPolicy: RequestPolicyView = config,
 ): Promise<Response> {
   logCtx.surface = "claude";
   const disabled = claudeInboundDisabled(config);
@@ -601,7 +643,7 @@ async function handleClaudeMessagesWithBudget(
       );
       if (claudeConversationId) logCtx.conversationId = claudeConversationId;
     }
-    if (isRec(anthropicBody) && wantsNativePassthrough(req, config, anthropicBody.model)) {
+    if (isRec(anthropicBody) && wantsNativePassthrough(req, config, requestPolicy, anthropicBody.model)) {
       return await anthropicNativePassthrough(req, config, logCtx, logIds, anthropicBody, "/v1/messages");
     }
     if (isRec(anthropicBody) && effortOverride) {
@@ -940,7 +982,11 @@ export function estimateClaudeRequestTokens(
   return Math.max(1, estimateTokens(parts.join("\n"), modelId) + attachmentTokens);
 }
 
-export async function handleClaudeCountTokens(req: Request, config: OcxConfig): Promise<Response> {
+export async function handleClaudeCountTokens(
+  req: Request,
+  config: OcxConfig,
+  requestPolicy: RequestPolicyView = config,
+): Promise<Response> {
   const disabled = claudeInboundDisabled(config);
   if (disabled) return disabled;
 
@@ -973,7 +1019,7 @@ export async function handleClaudeCountTokens(req: Request, config: OcxConfig):
     raw.model = model;
   }
   captureClaudeInbound("count_tokens", raw, resolveInboundModel(model, config.claudeCode), req.headers.get("anthropic-beta") ?? undefined);
-  if (wantsNativePassthrough(req, config, model)) {
+  if (wantsNativePassthrough(req, config, requestPolicy, model)) {
     return await anthropicNativePassthrough(req, config, { model, provider: "anthropic-native", surface: "claude" }, undefined, raw, "/v1/messages/count_tokens");
   }
   const inputTokens = estimateClaudeRequestTokens(raw, model);

package/src/server/direct-local-http.ts

@@ -219,7 +219,7 @@ function parseResponse(bytes: Buffer): Response {
 }
 
 /**
- * Fetch one local HTTP GET over a direct TCP connection.
+ * Fetch one bodyless local HTTP GET or POST over a direct TCP connection.
  *
  * Bun's global fetch and Bun 1.3's node:http compatibility layer can honor
  * HTTP(S)_PROXY. Local identity and capability probes must not expose headers
@@ -239,18 +239,22 @@ export async function directLocalHttpFetch(
 
   if (url.protocol !== "http:") throw new Error("direct local request must use HTTP");
   if (url.username || url.password) throw new Error("direct local request URL must not contain credentials");
-  if (method !== "GET" || body !== null) throw new Error("direct local request must be a bodyless GET");
+  if ((method !== "GET" && method !== "POST") || body !== null) {
+    throw new Error("direct local request must be a bodyless GET or POST");
+  }
   if (signal?.aborted) throw abortReason(signal);
 
   const headers = new Headers(init.headers ?? (input instanceof Request ? input.headers : undefined));
   headers.delete("proxy-authorization");
   headers.delete("proxy-connection");
+  if (method === "POST") headers.set("content-length", "0");
+  else headers.delete("content-length");
   headers.set("host", url.host);
   headers.set("connection", "close");
   const headerLines: string[] = [];
   headers.forEach((value, key) => { headerLines.push(`${key}: ${value}`); });
   const requestBytes = Buffer.from(
-    `GET ${url.pathname}${url.search} HTTP/1.1\r\n${headerLines.join("\r\n")}\r\n\r\n`,
+    `${method} ${url.pathname}${url.search} HTTP/1.1\r\n${headerLines.join("\r\n")}\r\n\r\n`,
     "latin1",
   );
   const parsedHostname = url.hostname.startsWith("[") && url.hostname.endsWith("]")

package/src/server/images.ts

@@ -499,6 +499,12 @@ export async function handleImages(
       headers,
       body: JSON.stringify(body),
       signal: linkedSignal.signal,
+      // Do not follow a cross-origin 3xx while carrying Codex credentials. Bun strips
+      // `Authorization` across origins but forwards nonstandard headers, so
+      // `chatgpt-account-id`, `session_id`, and `x-codex-turn-metadata` would reach the
+      // redirect target. Verified with a two-server probe. The Responses path and native
+      // compact already set this; the credential-bearing sidecars did not.
+      redirect: "manual",
     });
     const observed = await readImageResponseBytes(upstreamResponse, {
       maxBytes: IMAGES_RESPONSE_MAX_BYTES,

package/src/server/index.ts

@@ -195,6 +195,7 @@ import {
   createLocalAttestationSecret,
 } from "../lib/local-management-attestation";
 import { SYSTEM_RESTART_CAPABILITY_VERSION } from "../lib/system-restart-contract";
+import { LOCAL_PROVIDER_RELOAD_CAPABILITY_VERSION } from "../lib/local-provider-reload-contract";
 import { createReadinessGate, type ReadinessGate } from "./readiness";
 
 export const MAX_WS_FRAME_BYTES = 50 * 1024 * 1024;
@@ -478,9 +479,19 @@ export function consumeStartupCacheInvalidationWrite(): boolean {
   return wrote;
 }
 
+export function warnAgentTaskRecoveryStartup(config: {
+  agentTaskRecovery?: { enabled?: boolean };
+}): void {
+  if (config.agentTaskRecovery?.enabled !== true) return;
+  console.warn("⚠️  Experimental encrypted V2 task recovery is enabled.");
+  console.warn("   A scoped cache miss may send an additional authenticated request to ChatGPT and may consume quota or add latency; concurrent misses can share one request.");
+  console.warn("   Recovered model output is retained only in a bounded in-memory cache; exact fidelity is not guaranteed and the path depends on undocumented backend behavior.");
+}
+
 export function startServer(port?: number, deps: StartServerDeps = {}): Server<WsData> {
   const localAttestationSecret = deps.localAttestationSecret ?? createLocalAttestationSecret();
   const config = runAlibabaRegionStartupMigration(runOpenAiTierStartupMigration(loadConfig()));
+  warnAgentTaskRecoveryStartup(config);
   setLiveStateStoreConfig(config);
   applyProxyEnv(config);
   assertServerAuthConfig(config);
@@ -617,6 +628,13 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
     }
     if (path === "/v1/responses/compact") return req.method === "POST";
     if (path === "/v1/models") return req.method === "GET";
+    // Standalone realtime voice sessions (codex-rs thread/realtime/start, WebSocket
+    // transport) — a directly-spawned `codex app-server` needs these for desktop
+    // voice the same way it needs /v1/responses. WebSocket upgrades only; plain
+    // HTTP on these paths stays rejected.
+    if (path === "/v1/realtime" || path === "/v1/live") {
+      return req.headers.get("upgrade")?.toLowerCase() === "websocket";
+    }
     return false;
   }
 
@@ -804,6 +822,7 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
           pid: process.pid,
           port: healthPort,
           restartCapability: SYSTEM_RESTART_CAPABILITY_VERSION,
+          providerReloadCapability: LOCAL_PROVIDER_RELOAD_CAPABILITY_VERSION,
         }, 200, req, policy);
         const challenge = req.headers.get(LOCAL_ATTESTATION_CHALLENGE_HEADER);
         if (challenge) {
@@ -887,10 +906,12 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
           }
           throw error;
         }
-        const { applyNativeVisibility, buildCatalogEntries, configuredNativeAliasSlugs, desktopAllowlistSuppressedNativeSlugs, disabledNativeSlugs, exactComboCatalogSlugs, loadCatalogTemplate, NATIVE_OPENAI_MODELS, nativeOpenAiSlugs, nativeReasoningEfforts, nativeDefaultReasoningEffort, orderForSubagents, filterCatalogVisibleModels, shouldIncludeAccountBoundNativeOpenAi, shouldIncludeNativeOpenAi, uniqueCatalogModelsForRawPublicList, visibleCodexAccountSelectors, visibleNativeSlugs, desktopVisibleNativeSlugs } = await import("../codex/catalog");
+        const { accountBoundNativeOpenAiSlugsBySelector, applyNativeVisibility, buildCatalogEntries, configuredNativeAliasSlugs, desktopAllowlistSuppressedNativeSlugs, disabledNativeSlugs, exactComboCatalogSlugs, loadCatalogTemplate, NATIVE_OPENAI_MODELS, nativeOpenAiSlugs, nativeReasoningEfforts, nativeDefaultReasoningEffort, orderForSubagents, filterCatalogVisibleModels, shouldIncludeAccountBoundNativeOpenAi, shouldIncludeNativeOpenAi, uniqueCatalogModelsForRawPublicList, visibleCodexAccountSelectors, visibleNativeSlugs, desktopVisibleNativeSlugs } = await import("../codex/catalog");
         const includeNativeOpenAi = shouldIncludeNativeOpenAi(config);
         const includeAccountBoundNativeOpenAi = shouldIncludeAccountBoundNativeOpenAi(config);
-        const nativeSlugs = includeNativeOpenAi ? nativeOpenAiSlugs() : [];
+        const nativeSlugs = includeNativeOpenAi
+          ? nativeOpenAiSlugs()
+          : [];
         const disabledNatives = disabledNativeSlugs(config);
         const disabledModels = new Set(config.disabledModels ?? []);
         const shadowedNativeSlugs = configuredNativeAliasSlugs(config);
@@ -898,6 +919,12 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
         const accountSelectors = includeAccountBoundNativeOpenAi
           ? visibleCodexAccountSelectors(config)
           : [];
+        const accountNativeSlugsBySelector = includeAccountBoundNativeOpenAi
+          ? accountBoundNativeOpenAiSlugsBySelector(config)
+          : new Map<string, readonly string[]>();
+        const accountNativeSlugs = [...new Set(
+          [...accountNativeSlugsBySelector.values()].flatMap(slugs => [...slugs]),
+        )];
         const goEnabled = filterCatalogVisibleModels(goModels, config);
         const goOrdered = orderForSubagents(goEnabled, config.subagentModels);
         // Claude Code / Claude Desktop gateway model discovery (GET /v1/models with
@@ -945,7 +972,7 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
           // newly re-enabled native reappear under each selector before the next sync, while the
           // no-selector path keeps nativeOpenAiSlugs()'s existing visibility-sensitive behavior.
           const catalogNativeSlugs = accountSelectors.length > 0
-            ? NATIVE_OPENAI_MODELS
+            ? [...new Set([...NATIVE_OPENAI_MODELS, ...accountNativeSlugs])]
             : nativeSlugs;
           const entries = buildCatalogEntries(
             loadCatalogTemplate(),
@@ -959,12 +986,15 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
             suppressedBareNativeSlugs,
             new Set(),
             providerContextCap(config, OPENAI_CODEX_PROVIDER_ID),
+            accountNativeSlugs,
+            accountNativeSlugsBySelector,
           );
           return jsonResponse({
             models: applyNativeVisibility(
               entries,
               disabledModels,
               accountSelectors.length > 0,
+              new Set(accountNativeSlugs),
             ),
           }, 200, req, policy);
         }
@@ -1010,13 +1040,16 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
         const selectorNativeSlugs = accountSelectors.length > 0
           ? NATIVE_OPENAI_MODELS.filter(slug => !disabledNatives.has(slug))
           : [];
+        const bareSelectorNativeSlugs = accountSelectors.length > 0
+          ? selectorNativeSlugs
+          : [];
         const visibleNatives = includeNativeOpenAi
           ? accountSelectors.length > 0
-            ? selectorNativeSlugs.filter(slug => !shadowedNativeSlugs.has(slug))
+            ? bareSelectorNativeSlugs.filter(slug => !shadowedNativeSlugs.has(slug))
             : visibleNativeSlugs(config)
           : [];
         const visibleAccountNatives = accountSelectors.flatMap(selector =>
-          selectorNativeSlugs.flatMap(metadataId => {
+          (accountNativeSlugsBySelector.get(selector) ?? []).filter(metadataId => !disabledNatives.has(metadataId)).flatMap(metadataId => {
             const id = `${selector}/${metadataId}`;
             return disabledModels.has(id) ? [] : [{ id, metadataId }];
           })
@@ -1210,7 +1243,11 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
         if (!isAllowedRequestOrigin(req, policy)) {
           return withCors(anthropicErrorResponse(403, "cross-origin data-plane request blocked", "permission_error"), req, policy);
         }
-        return runAdmittedHttpTurn(req, policy, async () => withCors(await handleClaudeCountTokens(req, config), req, policy));
+        return runAdmittedHttpTurn(req, policy, async () => withCors(
+          await handleClaudeCountTokens(req, config, policy),
+          req,
+          policy,
+        ));
       }
 
       if (url.pathname === "/v1/messages" && req.method === "POST") {
@@ -1237,9 +1274,9 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
         // pre-translation stream + native passthrough callbacks) — do not re-wrap the
         // translated Anthropic stream here.
         return runAdmittedHttpTurn(req, policy, async turnAdmissionLease => withCors(
-          await handleClaudeMessages(req, config, logCtx, { requestId, start, turnAdmissionLease }),
+          await handleClaudeMessages(req, config, logCtx, { requestId, start, turnAdmissionLease }, policy),
           req,
-          config,
+          policy,
         ));
       }
 
@@ -1306,10 +1343,13 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
         });
       }
 
-      // Voice / Realtime sideband WebSocket: Frameless joins /v1/live/{callId}; Realtime v1 joins
-      // /v1/realtime?call_id= (or /v1/realtime/calls/{callId}). Transparent bidirectional relay.
+      // Voice / Realtime WebSocket relay. Sideband joins: Frameless /v1/live/{callId};
+      // Realtime v1 /v1/realtime?call_id= (or /v1/realtime/calls/{callId}). Standalone
+      // sessions (codex-rs thread/realtime/start, WebSocket transport — the desktop voice
+      // path): /v1/realtime?intent=quicksilver&model= and /v1/live?model=.
+      // Transparent bidirectional relay.
       const liveSidebandTarget = req.headers.get("upgrade")?.toLowerCase() === "websocket"
-        ? parseLiveSidebandTarget(url.pathname, url.searchParams)
+        ? parseLiveSidebandTarget(url.pathname, url.searchParams, url.search.replace(/^\?/, ""))
         : null;
       if (liveSidebandTarget) {
         if (isDraining()) {