@bitkyc08/opencodex 2.19.0 → 2.20.0

package/src/cli/registry.ts

@@ -216,8 +216,8 @@ export const CLI_COMMANDS: CliCommandEntry[] = [
   { name: "api-key", usage: "ocx api-key <list|create|remove> ...", summary: "Alias of ocx access key." },
   {
     name: "export",
-    usage: "ocx export --client <opencode|pi|omp|hermes|openclaw|kimi|gajae|dsh> [--json] [--out <path>] [--force]",
-    summary: "Print a client config (OpenCode, Pi, OMP, Hermes, OpenClaw, Kimi Code, Gajae Code, DeepSeek Harness) wired to the running proxy.",
+    usage: "ocx export --client <opencode|pi|omp|hermes|openclaw|kimi|gajae|dsh|mcode> [--json] [--out <path>] [--force]",
+    summary: "Print a client config (OpenCode, Pi, OMP, Hermes, OpenClaw, Kimi Code, Gajae Code, DeepSeek Harness, MiniMax Code) wired to the running proxy.",
     details: [
       "--json prints the generated document as JSON on stdout; use --out for the client's native format.",
       "--out <path> writes the native config there and refuses to replace an existing file without --force.",
@@ -282,6 +282,26 @@ export const CLI_COMMANDS: CliCommandEntry[] = [
       "Stop using `ocx opencode` and plain `opencode` behaves exactly as before.",
     ],
   },
+  {
+    name: "mcode",
+    usage: "ocx mcode [mcode args...]",
+    summary: "Launch MiniMax Code through its managed OpenCodex provider.",
+    details: [
+      "First connect the reversible file integration: ocx integration client enable --client mcode",
+      "The launcher verifies that custom_provider.opencodex targets the current loopback proxy before starting MCode.",
+      "Select custom_provider:opencodex/<model> from MCode's model picker.",
+    ],
+  },
+  {
+    name: "mmx",
+    usage: "ocx mmx text <chat|repl> [mmx args...]",
+    summary: "Launch MiniMax CLI text commands through the proxy.",
+    details: [
+      "Only the official MMX Anthropic-compatible text surface is proxied.",
+      "Use plain mmx for MiniMax-native image, video, speech, music, vision, search, quota, auth, config, file, and update commands.",
+      "The wrapper isolates ~/.mmx credentials and refuses --api-key/--base-url overrides.",
+    ],
+  },
   {
     name: "restart",
     usage: "ocx restart",

package/src/clients/config-export.ts

@@ -399,6 +399,23 @@ export function dshConfigPath(env: OpencodeLaunchEnv = process.env, home: string
   return join(dshHomeDir(env, home), "settings.yaml");
 }
 
+/**
+ * MiniMax Code stores runtime state under `MINIMAX_DATA_DIR`, then the legacy
+ * `MAVIS_DATA_DIR`, and finally `~/.minimax`. Relative overrides are refused
+ * because a background proxy and a foreground client can have different CWDs.
+ */
+export function mcodeHomeDir(env: OpencodeLaunchEnv = process.env, home: string = homedir()): string {
+  const primary = env.MINIMAX_DATA_DIR?.trim();
+  if (primary) return absoluteClientPath(primary, home, "MINIMAX_DATA_DIR");
+  const legacy = env.MAVIS_DATA_DIR?.trim();
+  if (legacy) return absoluteClientPath(legacy, home, "MAVIS_DATA_DIR");
+  return join(home, ".minimax");
+}
+
+export function mcodeConfigPath(env: OpencodeLaunchEnv = process.env, home: string = homedir()): string {
+  return join(mcodeHomeDir(env, home), "config.yaml");
+}
+
 /**
  * One proxy-routed model destined for a client config. Deliberately narrower than
  * `CatalogModel` so a serializer cannot reach for a field that does not survive the
@@ -438,7 +455,8 @@ export type ExportClientId =
   | "openclaw"
   | "kimi"
   | "gajae"
-  | "dsh";
+  | "dsh"
+  | "mcode";
 
 export interface ExportClientSpec {
   id: ExportClientId;
@@ -664,6 +682,15 @@ export interface PiModelEntry {
   input: string[];
   contextWindow?: number;
   maxTokens?: number;
+  /** Advertised when the catalog row carries a non-empty effort ladder. */
+  reasoning?: true;
+  /**
+   * Constrains pi's own level scale (minimal..max) to the declared ladder: members map to
+   * themselves, everything else is hidden (`null`). Without it pi would offer levels the
+   * ladder does not contain — harmless for provider-config ladders (the proxy clamps those
+   * at the wire) but a real 400 risk for custom-row ladders, which are advertisement-only.
+   */
+  thinkingLevelMap?: Record<string, string | null>;
 }
 
 export interface PiProviderBlock {
@@ -832,20 +859,45 @@ export interface DshGeneratedConfig {
   };
 }
 
+export interface McodeProviderBlock {
+  name: "OpenCodex";
+  kind: "custom";
+  enabled: true;
+  api: "anthropic-messages";
+  options: {
+    apiKey: string;
+    baseURL: string;
+    authMode: "api-key";
+  };
+  models: Record<string, Record<string, never>>;
+}
+
+export interface McodeGeneratedConfig {
+  custom_provider: Record<string, McodeProviderBlock>;
+}
+
 /**
  * Pi's `~/.pi/agent/models.json` shape. `models` is an ARRAY (identity lives in `id`),
  * unlike OpenCode's keyed object.
  *
- * Two fields are deliberately absent. `cost` requires all four price fields and we have
- * no price data at all, so emitting zeros would assert every routed model is free.
- * `reasoning` is a boolean in Pi while our catalog carries an effort list — mapping one
- * to the other would be a guess.
+ * Two fields were deliberately absent once. `cost` still is: it requires all four price
+ * fields and we have no price data at all, so emitting zeros would assert every routed
+ * model is free. `reasoning` used to be omitted because Pi's boolean and the catalog's
+ * effort ladder did not obviously map — but a NON-EMPTY ladder is the catalog's own
+ * statement that the model accepts reasoning parameters (adapters honor `reasoning_effort`),
+ * and an empty or absent ladder is the statement that it does not. Emitting `reasoning:
+ * true` exactly for rows with a ladder is therefore not a guess; it is what makes Pi's
+ * effort control appear for routed models at all. The export also emits a `thinkingLevelMap`
+ * that hides every pi level outside the declared ladder, so pi never offers (and sends) an
+ * effort the ladder does not contain — custom-row ladders are catalog advertisement only
+ * and get no wire clamp, so this map is what keeps pi honest for those. Users who need a
+ * different mapping can still hand-tune `thinkingLevelMap` afterwards.
  *
  * Pi's input enum IS verified: its documented model configuration accepts only
  * `text` and `image`, and a validation failure yields an EMPTY model config
  * rather than dropping the offending entry — one bad value costs every routed
- * model. The rest of this contract (omitting `cost` and `reasoning`) is still
- * ours rather than a claim about Pi's acceptance.
+ * model. The rest of this contract (omitting `cost`) is still ours rather than
+ * a claim about Pi's acceptance.
  */
 function buildPiClientConfig(ctx: ExportContext): PiGeneratedConfig {
   const models: PiModelEntry[] = [];
@@ -862,6 +914,21 @@ function buildPiClientConfig(ctx: ExportContext): PiGeneratedConfig {
       name: exportModelLabel(model),
       input,
     };
+    if (Array.isArray(model.reasoningEfforts) && model.reasoningEfforts.length > 0) {
+      entry.reasoning = true;
+      const efforts = model.reasoningEfforts;
+      entry.thinkingLevelMap = {
+        // pi's off level maps to the declared `none` sentinel (the proxy omits the
+        // reasoning parameter for it); hidden when the ladder does not declare none.
+        off: efforts.includes("none") ? "none" : null,
+        minimal: efforts.includes("minimal") ? "minimal" : null,
+        low: efforts.includes("low") ? "low" : null,
+        medium: efforts.includes("medium") ? "medium" : null,
+        high: efforts.includes("high") ? "high" : null,
+        xhigh: efforts.includes("xhigh") ? "xhigh" : null,
+        max: efforts.includes("max") ? "max" : efforts.includes("ultra") ? "ultra" : null,
+      };
+    }
     const context = authoritativeContextWindow(model.contextWindow);
     if (context !== undefined) {
       entry.contextWindow = context;
@@ -1115,6 +1182,32 @@ function buildDshClientConfig(ctx: ExportContext): DshGeneratedConfig {
   };
 }
 
+/**
+ * MiniMax Code's `provider add` command persists custom providers under
+ * `custom_provider.<id>`. Do not emit `defaultModel`: connecting a client must
+ * not silently replace the user's current model selection.
+ */
+function buildMcodeClientConfig(ctx: ExportContext): McodeGeneratedConfig {
+  const models: Record<string, Record<string, never>> = {};
+  for (const model of normalizeExportModels(ctx.models)) models[model.namespaced] = {};
+  return {
+    custom_provider: {
+      [OPENCODE_PROVIDER_ID]: {
+        name: "OpenCodex",
+        kind: "custom",
+        enabled: true,
+        api: "anthropic-messages",
+        options: {
+          apiKey: LOOPBACK_API_KEY_PLACEHOLDER,
+          baseURL: ctx.baseUrl.replace(/\/v1\/?$/, ""),
+          authMode: "api-key",
+        },
+        models,
+      },
+    },
+  };
+}
+
 /**
  * Per-client model counts, read back off the SERIALIZED document rather than
  * recomputed from the input rows: `modelsWithoutLimits` drives a GUI line about
@@ -1164,6 +1257,12 @@ function summarizeDsh(document: unknown): { modelCount: number; modelsWithoutLim
   return { modelCount: models.length, modelsWithoutLimits: models.filter(model => model.contextWindow === undefined).length };
 }
 
+function summarizeMcode(document: unknown): { modelCount: number; modelsWithoutLimits: number } {
+  const models = Object.values((document as McodeGeneratedConfig | undefined)?.custom_provider?.[OPENCODE_PROVIDER_ID]?.models ?? {});
+  // MCode's custom-provider schema does not expose per-model context limits.
+  return { modelCount: models.length, modelsWithoutLimits: 0 };
+}
+
 /** One fragment at `path`, built from this client's own document. */
 function singleFragment(clientId: ExportClientId, path: readonly string[], value: unknown): ManagedContribution {
   return { clientId, fragments: [{ path, value }] };
@@ -1220,6 +1319,11 @@ function buildDshContribution(ctx: ExportContext): ManagedContribution {
   return singleFragment("dsh", ["llm-pi-ai", "providers", OPENCODE_PROVIDER_ID], doc["llm-pi-ai"].providers[OPENCODE_PROVIDER_ID]);
 }
 
+function buildMcodeContribution(ctx: ExportContext): ManagedContribution {
+  const doc = buildMcodeClientConfig(ctx);
+  return singleFragment("mcode", ["custom_provider", OPENCODE_PROVIDER_ID], doc.custom_provider[OPENCODE_PROVIDER_ID]);
+}
+
 export const EXPORT_CLIENTS: Record<ExportClientId, ExportClientSpec> = {
   opencode: {
     id: "opencode",
@@ -1329,6 +1433,20 @@ export const EXPORT_CLIENTS: Record<ExportClientId, ExportClientSpec> = {
     buildContribution: buildDshContribution,
     loopbackOnly: true,
   },
+  mcode: {
+    id: "mcode",
+    filename: "mcode-config.yaml",
+    destination: env => mcodeConfigPath(env),
+    apiKeyEnv: "",
+    exportHint: "MiniMax Code reads a non-secret placeholder from config.yaml; loopback needs no key.",
+    build: buildMcodeClientConfig,
+    format: "yaml",
+    summarize: summarizeMcode,
+    buildContribution: buildMcodeContribution,
+    // MCode persists this credential and exposes no dedicated proxy-admission
+    // header field, so real keys are never serialized and remote binds refuse.
+    loopbackOnly: true,
+  },
 };
 
 export const EXPORT_CLIENT_IDS: readonly ExportClientId[] = Object.keys(EXPORT_CLIENTS) as ExportClientId[];

package/src/codex/app-server-processes.ts

@@ -10,7 +10,10 @@
 import { execFileSync } from "node:child_process";
 import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { isProcessAlive, waitForExit } from "../lib/process-control";
-import { resolveTrustedWindowsPowerShellExe } from "../lib/windows-elevation";
+import {
+  resolveTrustedWindowsPowerShellExe,
+  resolveTrustedWindowsTaskkillExe,
+} from "../lib/windows-elevation";
 import { readCodexCatalogPath } from "./catalog/parsing";
 
 export const STALE_CODEX_APP_SERVER_HINT =
@@ -83,6 +86,14 @@ export interface CodexAppServerProcessIo {
   listSnapshots?: () => ProcessSnapshot[];
   isAlive?: (pid: number) => boolean;
   kill?: (pid: number, signal: NodeJS.Signals) => void;
+  /** Windows termination seam: drives the taskkill branch without a real exec. */
+  execFile?: (file: string, args: readonly string[]) => void;
+  /**
+   * Signal seam for the Unix branch and the taskkill fallback. Without it,
+   * injecting `kill` bypasses defaultKillCodexAppServer entirely, so the
+   * fallback could never be observed.
+   */
+  processKill?: (pid: number, signal: NodeJS.Signals) => void;
   waitExit?: (pid: number, timeoutMs: number) => boolean;
   now?: () => number;
   readStartMs?: (pid: number) => number | null;
@@ -658,13 +669,57 @@ export interface RestartCodexAppServersResult {
   failed: Array<{ pid: number; error: string }>;
 }
 
+/**
+ * Platform-appropriate termination for a matched app-server.
+ *
+ * On Windows `process.kill(pid, "SIGTERM")` is not a graceful signal — it is an
+ * unconditional terminate of that one process, and it leaves the process tree
+ * behind. `taskkill /T /F` is therefore not an escalation there: the kill was
+ * hard either way, and `/T` adds the child cleanup that keeps an app-server's
+ * children from being orphaned when the window is closed without a quit
+ * affordance. That matters most on Windows precisely because there is no Ctrl+Q.
+ *
+ * The asymmetry with Unix is deliberate and must not be "fixed" into symmetry:
+ * on Unix, SIGTERM really is graceful, and following it with SIGKILL would ask a
+ * harsher consent than a restart click gives. Survivors are reported instead.
+ *
+ * The executable is resolved from a trusted system directory rather than PATH,
+ * matching how this file already resolves PowerShell — an unqualified
+ * `taskkill` is a hijack surface.
+ */
+function defaultKillCodexAppServer(
+  pid: number,
+  signal: NodeJS.Signals,
+  io: CodexAppServerProcessIo = {},
+): void {
+  const platform = io.platform ?? process.platform;
+  const signalProcess = io.processKill ?? ((target: number, sig: NodeJS.Signals) => {
+    process.kill(target, sig);
+  });
+  if (platform !== "win32") {
+    signalProcess(pid, signal);
+    return;
+  }
+  const exec = io.execFile ?? ((file: string, args: readonly string[]) => {
+    execFileSync(file, [...args], { stdio: "ignore", timeout: 5_000, windowsHide: true });
+  });
+  try {
+    exec(resolveTrustedWindowsTaskkillExe(), ["/PID", String(pid), "/T", "/F"]);
+  } catch {
+    // Fall back to the previous behavior rather than reporting a failure the old
+    // code would not have reported.
+    signalProcess(pid, signal);
+  }
+}
+
+
 /** Send SIGTERM to matched processes and wait briefly; never escalates to SIGKILL. */
 export function restartCodexAppServers(
   processes: readonly CodexAppServerProcess[] = listCodexAppServerProcesses(),
   io: CodexAppServerProcessIo = {},
 ): RestartCodexAppServersResult {
   const isAlive = io.isAlive ?? isProcessAlive;
-  const kill = io.kill ?? ((pid, signal) => { process.kill(pid, signal); });
+  const kill = io.kill ?? ((pid, signal) => { defaultKillCodexAppServer(pid, signal, io); });
   const wait = io.waitExit ?? waitForExit;
   const now = io.now ?? Date.now;
   const requested = processes.map(process => process.pid);

package/src/codex/app-server-restart-service.ts

@@ -0,0 +1,232 @@
+/**
+ * Dashboard-driven Codex app-server restart (#1046 follow-up).
+ *
+ * The defect: Codex builds a static model manager from the catalog once at
+ * app-server startup and never rereads the file, so an app-server that outlives a
+ * catalog write serves a roster that no longer exists on disk. Detection already
+ * existed and already fired — but it warns on stderr, and the thing keeping an SSH
+ * workspace's app-server alive is the Codex app, not a human at a terminal.
+ *
+ * This module is the consent boundary the startup path deliberately refuses to
+ * cross (see `warnIfStaleCodexAppServersAfterStartupWrite`): a login is not consent
+ * to interrupt an in-flight turn, but a dashboard click is.
+ *
+ * The route is a thin adapter over these two functions. Decisions live here so a
+ * test can drive every branch through {@link CodexRestartServiceIo} instead of
+ * mocking modules — a route test that could not stub this would really terminate
+ * the developer's own Codex.
+ *
+ * Plan and audit history: `devlog/_plan/260815_gui_codex_restart/010_phase1_backend_endpoint.md`.
+ */
+import {
+  collectCodexAppServerCatalogState,
+  listCodexAppServerProcesses,
+  readProcessStartMsBatch,
+  resetCodexAppServerCatalogStateCache,
+  restartCodexAppServers,
+} from "./app-server-processes";
+import type { CodexAppServerProcessIo } from "./app-server-processes";
+import type {
+  CodexAppServerStateResponse,
+  CodexRestartResponse,
+} from "../lib/codex-restart-contract";
+import { getServerListenPort } from "../server/lifecycle";
+
+export interface CodexRestartServiceIo {
+  /** Process-layer seam, forwarded to every app-server-processes call. */
+  processIo?: CodexAppServerProcessIo;
+  /** Catalog refresh seam. Resolves to whether a catalog or cache write happened. */
+  syncCatalog?: (port?: number) => Promise<boolean>;
+  /**
+   * Live listen port. `config.port` names the PREFERRED port; after a fallback
+   * start the bound port differs, and syncing the preferred one would point Codex
+   * at a dead listener (same reason the CLI startup path passes the live port).
+   */
+  listenPort?: () => number | undefined;
+  collectState?: typeof collectCodexAppServerCatalogState;
+  listProcesses?: typeof listCodexAppServerProcesses;
+  restart?: typeof restartCodexAppServers;
+  resetStateCache?: () => void;
+  /** Start-time reader used to re-confirm process identity before signalling. */
+  readStartMs?: (pids: readonly number[]) => Map<number, number | null>;
+}
+
+/**
+ * Thrown by the final identity gate when a pid no longer belongs to the process
+ * that was classified. restartCodexAppServers turns a kill throw into a `failed`
+ * entry, which is the honest outcome: nothing was signalled and the caller is told.
+ */
+class CodexAppServerIdentityChanged extends Error {
+  constructor(pid: number) {
+    super(`codex app-server identity changed before signal (pid ${pid})`);
+    this.name = "CodexAppServerIdentityChanged";
+  }
+}
+
+
+/**
+ * Single-flight latch. Two dashboard surfaces can each hold their own controller,
+ * so a user can press restart twice while the first request is still syncing the
+ * catalog. Without this, the second call re-signals processes the first already
+ * terminated and both report success — and it widens the window in which a pid can
+ * be recycled between classification and signalling.
+ */
+let inFlight: Promise<CodexRestartResponse> | null = null;
+
+export function readCodexAppServerState(
+  io: CodexRestartServiceIo = {},
+): CodexAppServerStateResponse {
+  const status = (io.collectState ?? collectCodexAppServerCatalogState)(io.processIo ?? {});
+  return { state: status.state, runningCount: status.processes.length };
+}
+
+export function performCodexRestart(
+  io: CodexRestartServiceIo = {},
+): Promise<CodexRestartResponse> {
+  if (inFlight) return inFlight;
+  const run = runCodexRestart(io).finally(() => {
+    inFlight = null;
+  });
+  inFlight = run;
+  return run;
+}
+
+/** Test hook: drop the single-flight latch between cases. */
+export function resetCodexRestartInFlightForTests(): void {
+  inFlight = null;
+}
+
+async function runCodexRestart(io: CodexRestartServiceIo): Promise<CodexRestartResponse> {
+  // Refresh the catalog FIRST. A user pressing "restart Codex" wants the new
+  // roster; stopping app-servers before the write would hand the replacement the
+  // same stale file it just lost.
+  let synced = false;
+  try {
+    const port = (io.listenPort ?? getServerListenPort)();
+    synced = await (io.syncCatalog ?? defaultSyncCatalog)(port);
+  } catch {
+    // A sync failure must not block the restart: an operator whose picker is stale
+    // still benefits from the app-server exiting and rereading whatever is on disk.
+  }
+
+  // The classifier memoizes for 5s when every io field is defaulted, so a reading
+  // taken before the write above would otherwise be replayed after it.
+  (io.resetStateCache ?? resetCodexAppServerCatalogStateCache)();
+  const before = (io.collectState ?? collectCodexAppServerCatalogState)(io.processIo ?? {});
+
+  const nothingToDo = (): CodexRestartResponse => ({
+    success: true,
+    stateBefore: before.state,
+    synced,
+    requested: [],
+    stopped: [],
+    surviving: [],
+    failed: [],
+    // Enumeration failure reads as `unknown`, never `not_running` (#857): a failed
+    // enumeration must not be reported as "nothing was running".
+    code: before.state === "unknown" ? "enumeration_unavailable" : "nothing_running",
+  });
+
+  // `unknown` is not only the empty enumeration-failure case: the classifier also
+  // returns it WITH processes when the catalog mtime or a start time is unreadable.
+  // In that state it has not established that any server predates the catalog, so
+  // signalling would kill a possibly-current app-server on a guess.
+  if (before.state === "unknown" || before.processes.length === 0) return nothingToDo();
+
+  // The classifier carries { pid, startedAtMs } and no command line, but
+  // restartCodexAppServers needs the full identity so it can refuse to signal a
+  // recycled pid. Re-list and intersect on pid rather than reconstructing an
+  // identity we never verified.
+  const classifiedStarts = new Map(
+    before.processes.map(entry => [entry.pid, entry.startedAtMs] as const),
+  );
+  const live = (io.listProcesses ?? listCodexAppServerProcesses)(io.processIo ?? {});
+  const candidates = live.filter(process => classifiedStarts.has(process.pid));
+
+  // A pid plus a command line is not an identity: a replacement app-server launched
+  // by the same Codex install has both. Re-read start times and drop any candidate
+  // whose process started after the reading we classified, so a recycled pid can
+  // never receive a signal meant for the process that held it.
+  const platform = io.processIo?.platform ?? process.platform;
+  const startsNow = candidates.length > 0
+    ? (io.readStartMs ?? (pids => readProcessStartMsBatch(pids, platform)))(
+      candidates.map(process => process.pid),
+    )
+    : new Map<number, number | null>();
+  const targets = candidates.filter(process => {
+    const classified = classifiedStarts.get(process.pid) ?? null;
+    const current = startsNow.get(process.pid) ?? null;
+    // An unreadable start time on either side means we cannot prove sameness.
+    if (classified === null || current === null) return false;
+    return classified === current;
+  });
+
+  if (targets.length === 0) {
+    // Every classified process exited, or the pid now belongs to a different
+    // process. Reporting "stopped" would claim credit for work this request did
+    // not do.
+    return {
+      success: true,
+      stateBefore: before.state,
+      synced,
+      requested: [],
+      stopped: [],
+      surviving: [],
+      failed: [],
+      code: "nothing_running",
+    };
+  }
+
+  // Final identity gate, applied at the moment of signalling rather than before it.
+  //
+  // restartCodexAppServers re-lists and compares pid+command-line immediately
+  // before SIGTERM, but a replacement app-server launched by the same Codex
+  // install has BOTH of those. The start time is the field that distinguishes
+  // them, and it is not part of that comparison, so the check above (done before
+  // the call) still leaves a window: the original can exit and a replacement can
+  // claim its pid in between.
+  //
+  // Wrapping `kill` closes the window: this runs inside restartCodexAppServers'
+  // own signalling loop, so the start time is re-read at the last possible moment.
+  // An unreadable start time refuses the signal — on a recycled pid, guessing
+  // costs the user the turn that is running right now.
+  const guardedProcessIo: CodexAppServerProcessIo = {
+    ...(io.processIo ?? {}),
+    kill: (pid, signal) => {
+      const classified = classifiedStarts.get(pid) ?? null;
+      const current = (io.readStartMs ?? (pids => readProcessStartMsBatch(pids, platform)))([pid])
+        .get(pid) ?? null;
+      if (classified === null || current === null || classified !== current) {
+        throw new CodexAppServerIdentityChanged(pid);
+      }
+      const send = io.processIo?.kill ?? ((target: number, sig: NodeJS.Signals) => {
+        process.kill(target, sig);
+      });
+      send(pid, signal);
+    },
+  };
+
+  const result = (io.restart ?? restartCodexAppServers)(targets, guardedProcessIo);
+  const clean = result.surviving.length === 0 && result.failed.length === 0;
+  return {
+    success: clean,
+    stateBefore: before.state,
+    synced,
+    requested: result.requested,
+    stopped: result.stopped,
+    surviving: result.surviving,
+    // Project { pid, error } down to pids: an OS error message can embed a path
+    // or the account name.
+    failed: result.failed.map(entry => entry.pid),
+    code: clean ? "stopped" : "partially_stopped",
+  };
+}
+
+async function defaultSyncCatalog(port?: number): Promise<boolean> {
+  const { syncModelsToCodex } = await import("./sync");
+  // `undefined` config takes syncModelsToCodex's own loadConfig() default; `null`
+  // log keeps this request path silent.
+  const result = await syncModelsToCodex(port, undefined, null);
+  return result.catalogWritten || result.cacheSynced;
+}
+

package/src/codex/catalog/aggregation.ts

@@ -129,9 +129,13 @@ export function deriveComboCatalogModel(
 ): CatalogModel | null {
   if (comboCatalogOmissionReason(combo, members) !== null) return null;
 
-  const inputModalities = intersectStrings(
+  const derivedInputModalities = intersectStrings(
     members.map(member => member.inputModalities ?? ["text"]),
   );
+  const inputModalities = combo.imageInput === "disabled"
+    ? derivedInputModalities.filter(modality => modality !== "image")
+    : derivedInputModalities;
+  if (inputModalities.length === 0) return null;
   // Unknown ladders (`undefined`) are wildcards for catalog derivation — same
   // boundary as the GUI picker. An explicit empty ladder still constrains.
   const advertisedLadders = members
@@ -173,6 +177,11 @@ export function deriveComboCatalogModel(
     ...(members.every(member => member.parallelToolCalls === true)
       ? { parallelToolCalls: true }
       : {}),
+    ...(members.every(member => member.supportsServiceTier === true)
+      ? { supportsServiceTier: true }
+      : members.some(member => member.supportsServiceTier === false)
+        ? { supportsServiceTier: false }
+        : {}),
     ...(members.some(member => member.supportsReasoningSummaries === false) ? { supportsReasoningSummaries: false } : {}),
   };
 }

package/src/codex/catalog/effort.ts

@@ -139,6 +139,15 @@ export function applyCatalogModelMetadata(entry: RawEntry, model?: CatalogModel)
   if (typeof model.supportsReasoningSummaries === "boolean") {
     entry.supports_reasoning_summaries = model.supportsReasoningSummaries;
   }
+  if (model.supportsServiceTier === true) {
+    entry.default_service_tier = null;
+    entry.service_tiers = [{
+      id: "priority",
+      name: "Fast",
+      description: "1.5x speed, increased usage",
+    }];
+    entry.additional_speed_tiers = ["fast"];
+  }
 }
 
 export function applyReasoningLevels(
@@ -153,8 +162,9 @@ export function applyReasoningLevels(
   // (no ultra->max client conversion) and codex-rs validates it by catalog membership,
   // so a missing max rung hard-fails spawn_agent effort overrides. The wire stays honest:
   // routed adapters clamp via clampToSupportedCodexEffort and natives via
-  // nativeEffortClamp (max -> the model's real top rung).
-  if (!preserveExact && efforts.length > 0) {
+  // nativeEffortClamp (max -> the model's real top rung). A `none`-only ladder is NOT
+  // reasoning-capable, so it must not grow synthetic top rungs.
+  if (!preserveExact && efforts.length > 0 && efforts.some(effort => effort !== "none" && effort !== "minimal")) {
     const additions: string[] = [];
     if (!efforts.includes("max")) additions.push("max");
     if (!efforts.includes("ultra")) additions.push("ultra");
@@ -177,7 +187,9 @@ export function applyReasoningLevels(
   }
   entry.default_reasoning_level = defaultOverride && efforts.includes(defaultOverride)
     ? defaultOverride
-    : efforts.includes("medium") ? "medium" : efforts.includes("high") ? "high" : efforts[0];
+    : efforts.includes("medium") ? "medium" : efforts.includes("high") ? "high"
+    // Sentinels never become the implicit default when real rungs are declared.
+    : efforts.find(effort => effort !== "none" && effort !== "minimal") ?? efforts[0];
 }
 
 export function isGpt56NativeSlug(slug: string): boolean {

package/src/codex/catalog/parsing.ts

@@ -123,6 +123,8 @@ export interface CatalogModel {
   codexForwardNativeCapabilityAlias?: boolean;
   /** Whether Codex may send Responses text.verbosity for this routed model. */
   supportsVerbosity?: boolean;
+  /** Whether this exact routed model has a verified OpenAI-compatible service tier. */
+  supportsServiceTier?: boolean;
   supportsReasoningSummaries?: boolean;
   /** Normalized upstream capability names retained for management/API consumers (#485 follow-up). */
   capabilities?: string[];
@@ -405,7 +407,7 @@ export function normalizeRoutedCatalogEntry(entry: RawEntry, parallelToolCalls =
   delete entry.service_tiers;
   delete entry.default_service_tier;
   // Routed rows cloned from native templates must not inherit OpenAI-only summary delivery.
-  // Per-model routed opt-ins can be added once provider metadata exposes this capability.
+  // Explicit provider/model metadata is re-applied after this normalization step.
   delete entry.supports_reasoning_summaries;
   const isCursorEntry = typeof entry.slug === "string" && entry.slug.startsWith("cursor/");
   // `supports_search_tool` selects Codex's deferred tool-discovery surface; it is not the hosted