@bitkyc08/opencodex 2.21.0 → 2.22.0

package/src/providers/registry.ts

@@ -80,6 +80,11 @@ interface ProviderModelDiscoverySharedSpec {
   maxResponseBytes?: number;
   /** Optional lower raw-row ceiling; the process-wide hard ceiling still wins. */
   maxModels?: number;
+  /**
+   * If a valid extracted id starts with this prefix, strip it and re-validate the remainder.
+   * Empty/invalid remainders skip that row only.
+   */
+  stripIdPrefix?: string;
 }
 
 type ProviderModelDiscoveryLocation =
@@ -2467,6 +2472,7 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     // Cloudflare Workers AI: OpenAI-compatible endpoint. The base URL contains {account_id}
     // which must be resolved by the user at setup time. Model IDs use the @cf/ prefix.
     // Live-verified 2026-07-21 against https://developers.cloudflare.com/workers-ai/models/
+    // Official search is sibling to /ai/v1 (GET .../ai/models/search?format=openrouter).
     id: "cloudflare-workers-ai", label: "Cloudflare Workers AI",
     baseUrl: "https://api.cloudflare.com/client/v4/accounts/{account_id}/ai/v1",
     adapter: "openai-chat", authKind: "key", freeTier: true,
@@ -2481,6 +2487,13 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
       "@cf/zai-org/glm-5.2",
       "@cf/mistralai/mistral-small-3.1-24b-instruct",
     ],
+    liveModels: true,
+    modelDiscovery: {
+      path: "../models/search",
+      query: { format: "openrouter", per_page: "1000" },
+      stripIdPrefix: "workers-ai/",
+      maxModels: 256,
+    },
     note: "Workers AI · Free tier included · Account ID required in base URL",
   },
   // FREEZE 2026-07-10: /models was auth-gated under key login. OAuth device-flow + copilot_internal

package/src/providers/slug-codec.ts

@@ -29,6 +29,20 @@ export function encodeRoutedModelId(id: string): string {
   return id.includes("/") ? id.replaceAll("/", SLUG_ALIAS_SEPARATOR) : id;
 }
 
+/**
+ * True when `modelId` shares a Codex-facing encoded form with a different known id.
+ * That collision is what makes `provider/openai-gpt-5.5` decode to native `openai-gpt-5.5`
+ * while a custom `openai/gpt-5.5` row is still visible.
+ */
+export function encodedModelIdCollides(modelId: string, knownIds: Iterable<string>): boolean {
+  const encoded = encodeRoutedModelId(modelId);
+  for (const id of knownIds) {
+    if (id === modelId) continue;
+    if (encodeRoutedModelId(id) === encoded) return true;
+  }
+  return false;
+}
+
 /** Codex-facing routed slug: exactly one "/" — `<provider>/<encoded id>`. */
 export function routedSlug(provider: string, id: string): string {
   return `${provider}/${encodeRoutedModelId(id)}`;
@@ -51,6 +65,21 @@ export function decodeRoutedModelId(requested: string, knownIds: Iterable<string
   return aliasMatch ?? requested;
 }
 
+/**
+ * Decode a Codex-facing id, but fail when a custom slash id and another known id
+ * share the same encoded form. Write-time checks cannot cover a later live cache.
+ */
+export function decodeRoutedModelIdOrThrow(requested: string, knownIds: Iterable<string>): string {
+  const ids = [...knownIds];
+  const encodedRequested = encodeRoutedModelId(requested);
+  const matches = new Set<string>();
+  for (const id of ids) {
+    if (id === requested || encodeRoutedModelId(id) === encodedRequested) matches.add(id);
+  }
+  if (matches.size > 1) throw new Error(`ambiguous model id "${requested}"`);
+  return decodeRoutedModelId(requested, ids);
+}
+
 /** Does a stored config slug name this routed model, in either raw or encoded form? */
 export function slugEquals(stored: string, provider: string, id: string): boolean {
   return stored === `${provider}/${id}` || stored === routedSlug(provider, id);

package/src/router.ts

@@ -24,7 +24,7 @@ import {
   OPENAI_API_PROVIDER_ID,
   OPENAI_CODEX_PROVIDER_ID,
 } from "./providers/openai-tiers";
-import { decodeRoutedModelId, encodeRoutedModelId } from "./providers/slug-codec";
+import { decodeRoutedModelIdOrThrow, encodeRoutedModelId } from "./providers/slug-codec";
 import { getStaleCached } from "./codex/model-cache";
 import { codexAccountNamespaceEntries } from "./codex/account-namespaces";
 import {
@@ -87,9 +87,14 @@ const MODEL_PROVIDER_PATTERNS: Array<{ providerNames: string[]; prefixes: string
  * last-known-good live /models cache (may be empty on a cold start; decode then passes
  * unknown ids through unchanged for an honest upstream error).
  */
-export function knownModelIdsForProvider(provName: string, prov: OcxProviderConfig): string[] {
+export function knownModelIdsForProvider(
+  provName: string,
+  prov: OcxProviderConfig,
+  config?: Pick<OcxConfig, "customModels">,
+): string[] {
   const ids = new Set<string>();
   for (const id of prov.models ?? []) ids.add(id);
+  if (prov.defaultModel) ids.add(prov.defaultModel);
   const registry = providerMatchesRegistryTransportWithStaticGuards(provName, prov)
     ? PROVIDER_REGISTRY.find(entry => entry.id === provName)
     : undefined;
@@ -108,6 +113,9 @@ export function knownModelIdsForProvider(provName: string, prov: OcxProviderConf
     for (const id of Object.keys(map ?? {})) ids.add(id);
   }
   for (const cached of getStaleCached(provName) ?? []) ids.add(cached.id);
+  for (const model of config?.customModels ?? []) {
+    if (model.provider === provName && model.modelId) ids.add(model.modelId);
+  }
   return [...ids];
 }
 
@@ -610,7 +618,7 @@ function routeModelInternal(
     if (hasOwnProvider(config.providers, provName)) {
       const prov = config.providers[provName];
       if (prov.disabled === true) throw new Error(`Provider is disabled: ${provName}`);
-      const known = knownModelIdsForProvider(provName, prov);
+      const known = knownModelIdsForProvider(provName, prov, config);
       // Self-namespaced native id — the vendor segment equals the provider id, so the FULL ref is
       // itself a known model (e.g. orcarouter/auto). Route it whole instead of stripping to the
       // remainder, which would send a bare `auto` the upstream cannot resolve.
@@ -622,7 +630,7 @@ function routeModelInternal(
       return routeResult(
         provName,
         prov,
-        decodeRoutedModelId(modelId.slice(slash + 1), known),
+        decodeRoutedModelIdOrThrow(modelId.slice(slash + 1), known),
         "explicit-provider",
         "explicit-provider-namespace",
       );

package/src/routing/capability.ts

@@ -26,11 +26,12 @@ import { statSync } from "node:fs";
 import type { RouteCapabilityEvidence } from "./trace";
 
 type CatalogModelRow = {
+  /** Exact provider/native-id identity, from the provenance block. */
   provider: string;
   id: string;
+  /** Only values a real source asserted; never a strict-parser default. */
   contextWindow?: number;
   inputModalities?: string[];
-  reasoningEfforts?: string[];
   capabilities?: string[];
 };
 
@@ -52,23 +53,33 @@ function cachedCatalogModels(): CatalogModelRow[] {
     const catalog = readCatalog(path);
     const models = catalog?.models;
     if (!Array.isArray(models)) return [];
-    const rows = models
-      .filter((model): model is Record<string, unknown> & { id: string; provider: string } =>
-        typeof model === "object" && model !== null && typeof model.id === "string" && typeof model.provider === "string")
-      .map(model => ({
-        provider: model.provider,
-        id: model.id,
-        ...(typeof model.contextWindow === "number" ? { contextWindow: model.contextWindow } : {}),
-        ...(Array.isArray(model.inputModalities)
-          ? { inputModalities: model.inputModalities.filter((value): value is string => typeof value === "string") }
+    // Read ONLY `opencodex_capability_provenance` (written by
+    // applyCatalogModelMetadata). The row's own `context_window` and
+    // `input_modalities` always exist because ensureStrictCatalogFields fills them
+    // with compatibility defaults for Codex's strict parser, so reading them would
+    // turn "nobody asserted anything" into a confident `image: false` and a
+    // fabricated 128000 — the opposite of this module's contract. A row without
+    // provenance contributes nothing.
+    const rows = models.flatMap((model): CatalogModelRow[] => {
+      if (typeof model !== "object" || model === null) return [];
+      const provenance = (model as Record<string, unknown>).opencodex_capability_provenance;
+      if (typeof provenance !== "object" || provenance === null) return [];
+      const source = provenance as Record<string, unknown>;
+      if (typeof source.provider !== "string" || typeof source.model_id !== "string") return [];
+      return [{
+        provider: source.provider,
+        id: source.model_id,
+        ...(typeof source.context_window === "number" && source.context_window > 0
+          ? { contextWindow: source.context_window }
           : {}),
-        ...(Array.isArray(model.reasoningEfforts)
-          ? { reasoningEfforts: model.reasoningEfforts.filter((value): value is string => typeof value === "string") }
+        ...(Array.isArray(source.input_modalities)
+          ? { inputModalities: source.input_modalities.filter((value): value is string => typeof value === "string") }
           : {}),
-        ...(Array.isArray(model.capabilities)
-          ? { capabilities: model.capabilities.filter((value): value is string => typeof value === "string") }
+        ...(Array.isArray(source.capabilities)
+          ? { capabilities: source.capabilities.filter((value): value is string => typeof value === "string") }
           : {}),
-      }));
+      }];
+    });
     catalogCache = { path, mtimeMs, rows };
     return rows;
   } catch {
@@ -177,13 +188,17 @@ export function candidateCapabilityEvidence(
   // override.
   const tools = capabilities.includes("tools")
     || isNative
-    || (catalogRow === undefined && provider !== undefined && TOOL_CAPABLE_ADAPTERS.has(provider.adapter))
+    // The adapter protocol is positive evidence on its own. This was once gated
+    // on `catalogRow === undefined`, which was only safe while the catalog lookup
+    // never matched anything: once it matches, a row that simply does not
+    // enumerate "tools" would silently revoke tool support for every openai-chat
+    // and anthropic candidate.
+    || (provider !== undefined && TOOL_CAPABLE_ADAPTERS.has(provider.adapter))
     || provider?.parallelToolCalls === true
     || undefined;
 
   const reasoningEfforts = provider?.modelReasoningEfforts?.[modelId]
     ?? registryEntry?.modelReasoningEfforts?.[modelId]
-    ?? catalogRow?.reasoningEfforts
     ?? (isNative ? nativeReasoningEfforts(modelId) : undefined);
 
   const tierSupport = provider

package/src/server/index.ts

@@ -988,6 +988,7 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
             providerContextCap(config, OPENAI_CODEX_PROVIDER_ID),
             accountNativeSlugs,
             accountNativeSlugsBySelector,
+            config.keepNativeChatGptOnV1 === true,
           );
           return jsonResponse({
             models: applyNativeVisibility(

package/src/server/management/agent-settings-routes.ts

@@ -232,6 +232,7 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
       agentsMaxThreadsConflict: enabled && hasAgentsMaxThreads(),
       maxConcurrentThreadsPerSession: getLogicalMaxThreads(),
       multiAgentMode: config.multiAgentMode ?? "default",
+      keepNativeChatGptOnV1: config.keepNativeChatGptOnV1 === true,
       agentsEnabled: getAgentsEnabled(),
       agentsMaxDepth: getAgentsMaxDepth(),
       subagentDeveloperInstructions: getSubagentDeveloperInstructions(),
@@ -246,6 +247,7 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
       enabled?: unknown;
       maxConcurrentThreadsPerSession?: unknown;
       multiAgentMode?: unknown;
+      keepNativeChatGptOnV1?: unknown;
       agentsEnabled?: unknown;
       agentsMaxDepth?: unknown;
       subagentDeveloperInstructions?: unknown;
@@ -255,17 +257,21 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
     const wantsFlag = body.enabled !== undefined;
     const wantsThreads = body.maxConcurrentThreadsPerSession !== undefined;
     const wantsMode = body.multiAgentMode !== undefined;
+    const wantsKeepNative = body.keepNativeChatGptOnV1 !== undefined;
     const wantsAgentsEnabled = body.agentsEnabled !== undefined;
     const wantsMaxDepth = body.agentsMaxDepth !== undefined;
     const wantsSubagentInstructions = body.subagentDeveloperInstructions !== undefined;
     const wantsModeHintText = body.multiAgentModeHintText !== undefined;
-    if (!wantsFlag && !wantsThreads && !wantsMode && !wantsAgentsEnabled && !wantsMaxDepth && !wantsSubagentInstructions && !wantsModeHintText) {
-      return jsonResponse({ error: "body must set enabled, multiAgentMode, maxConcurrentThreadsPerSession, agentsEnabled, agentsMaxDepth, subagentDeveloperInstructions, and/or multiAgentModeHintText" }, 400);
+    if (!wantsFlag && !wantsThreads && !wantsMode && !wantsKeepNative && !wantsAgentsEnabled && !wantsMaxDepth && !wantsSubagentInstructions && !wantsModeHintText) {
+      return jsonResponse({ error: "body must set enabled, multiAgentMode, keepNativeChatGptOnV1, maxConcurrentThreadsPerSession, agentsEnabled, agentsMaxDepth, subagentDeveloperInstructions, and/or multiAgentModeHintText" }, 400);
     }
     if (wantsFlag && typeof body.enabled !== "boolean") return jsonResponse({ error: "body.enabled must be a boolean" }, 400);
     if (wantsMode && body.multiAgentMode !== "v1" && body.multiAgentMode !== "default" && body.multiAgentMode !== "v2") {
       return jsonResponse({ error: "body.multiAgentMode must be 'v1', 'default', or 'v2'" }, 400);
     }
+    if (wantsKeepNative && typeof body.keepNativeChatGptOnV1 !== "boolean") {
+      return jsonResponse({ error: "body.keepNativeChatGptOnV1 must be a boolean" }, 400);
+    }
     if (wantsThreads && (typeof body.maxConcurrentThreadsPerSession !== "number" || !Number.isInteger(body.maxConcurrentThreadsPerSession) || body.maxConcurrentThreadsPerSession < 1)) {
       return jsonResponse({ error: "body.maxConcurrentThreadsPerSession must be an integer >= 1" }, 400);
     }
@@ -333,6 +339,17 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
       saveConfigPreservingClaudeCode(config);
       warnings.push(`Multi-agent mode set to '${mode}'. Applies to new sessions.`);
     }
+    if (wantsKeepNative) {
+      if (body.keepNativeChatGptOnV1 === true) config.keepNativeChatGptOnV1 = true;
+      else delete config.keepNativeChatGptOnV1;
+      saveConfigPreservingClaudeCode(config);
+      const effectiveMode = mode ?? config.multiAgentMode ?? "default";
+      warnings.push(body.keepNativeChatGptOnV1 === true
+        ? (effectiveMode === "v2"
+          ? "ChatGPT-native models stay on v1 while other models use v2. Applies to new sessions."
+          : "keepNativeChatGptOnV1 is stored but inactive until multi-agent mode is v2. Applies to new sessions.")
+        : "ChatGPT-native models follow the selected v1/v2/base surface. Applies to new sessions.");
+    }
     // New-key scalar writes: each writer is individually atomic, so apply them in
     // sequence after the transition. A failure here is a persistence failure (the
     // writers' ok:false result or a throw from the underlying atomic write helper),
@@ -373,6 +390,7 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
       agentsMaxThreadsConflict: enabled && hasAgentsMaxThreads(),
       maxConcurrentThreadsPerSession: getLogicalMaxThreads(),
       multiAgentMode: config.multiAgentMode ?? "default",
+      keepNativeChatGptOnV1: config.keepNativeChatGptOnV1 === true,
       agentsEnabled: getAgentsEnabled(),
       agentsMaxDepth: getAgentsMaxDepth(),
       subagentDeveloperInstructions: getSubagentDeveloperInstructions(),

package/src/server/management/context.ts

@@ -1,5 +1,7 @@
 import type { OcxConfig } from "../../types";
 import type { NativeProfileApiDeps } from "../../codex/native-profile-api";
+import type { CodexLogGuardProtectionDeps } from "../../codex/log-guard/protection";
+import type { CodexLogGuardMaintenanceDeps } from "../../codex/log-guard/maintenance";
 import type { StartupHealth } from "../../codex/autostart-health";
 import type { StartupInstallAction } from "../startup-action-control";
 import type { ManagementPrincipal } from "../management-auth";
@@ -70,6 +72,19 @@ export interface ManagementApiDeps {
     performRestart: typeof performCodexRestart;
   };
   nativeProfileApi?: NativeProfileApiDeps;
+  /**
+   * Log Guard mutation seam. Production leaves this unset and therefore uses the
+   * owner-verified process enumerator, trusted L namespace and real config store.
+   * Route tests inject all three so they cannot depend on local Codex processes
+   * or create lock/config state outside the fixture.
+   */
+  codexLogGuardProtectionDeps?: CodexLogGuardProtectionDeps;
+  /**
+   * Log Guard maintenance seam. Production reuses the same fail-closed process
+   * enumerator and L namespace as Protect; route tests keep all maintenance
+   * state inside their temporary Codex home.
+   */
+  codexLogGuardMaintenanceDeps?: CodexLogGuardMaintenanceDeps;
 }
 
 

package/src/server/management/model-routes.ts

@@ -97,7 +97,8 @@ import { providerDestinationResolvedError } from "../../lib/destination-policy";
 import { enrichProviderFromCatalog, listKeyLoginProviders } from "../../oauth/key-providers";
 import { deriveProviderPresets } from "../../providers/derive";
 import { providerCodexAccountMode } from "../../providers/registry";
-import { routedSlug, slugEquals } from "../../providers/slug-codec";
+import { encodedModelIdCollides, routedSlug, slugEquals } from "../../providers/slug-codec";
+import { knownModelIdsForProvider } from "../../router";
 import { COMBO_NAMESPACE, comboDisabledModelSelectors, comboModelId, preservesPhysicalComboProvider } from "../../combos";
 import { clearProviderQuotaCache, fetchProviderQuotaReports } from "../../providers/quota";
 import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
@@ -376,7 +377,6 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
     const provider = typeof body.provider === "string" ? body.provider.trim() : "";
     const modelId = typeof body.modelId === "string" ? body.modelId.trim() : "";
     if (!provider || !modelId) return jsonResponse({ error: "provider and modelId are required" }, 400);
-    if (modelId.includes("/")) return jsonResponse({ error: "modelId must not contain /" }, 400);
     if (!isValidProviderName(provider)) return jsonResponse({ error: "invalid provider name" }, 400);
     if (!hasOwnProvider(config.providers, provider)) return jsonResponse({ error: "provider not configured" }, 404);
     const displayName = typeof body.displayName === "string" && body.displayName.trim() ? body.displayName.trim() : undefined;
@@ -394,6 +394,10 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
     if (existing.some(cm => routedSlug(cm.provider, cm.modelId) === newSlug)) {
       return jsonResponse({ error: "duplicate model" }, 409);
     }
+    const known = knownModelIdsForProvider(provider, config.providers[provider], config);
+    if (encodedModelIdCollides(modelId, known)) {
+      return jsonResponse({ error: "ambiguous model id" }, 409);
+    }
     const entry: OcxCustomModel = {
       id: randomUUID(),
       provider,
@@ -422,7 +426,6 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
     if (idx === -1) return jsonResponse({ error: "not found" }, 404);
     const cm = { ...list[idx] };
     if (typeof body.modelId === "string" && body.modelId.trim()) {
-      if (body.modelId.includes("/")) return jsonResponse({ error: "modelId must not contain /" }, 400);
       cm.modelId = body.modelId.trim();
     }
     if (body.displayName !== undefined) {
@@ -469,6 +472,12 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
     if (list.some((other, i) => i !== idx && routedSlug(other.provider, other.modelId) === updatedSlug)) {
       return jsonResponse({ error: "duplicate model" }, 409);
     }
+    const known = knownModelIdsForProvider(cm.provider, config.providers[cm.provider], {
+      customModels: list.filter((_, i) => i !== idx),
+    });
+    if (encodedModelIdCollides(cm.modelId, known)) {
+      return jsonResponse({ error: "ambiguous model id" }, 409);
+    }
     list[idx] = cm;
     config.customModels = list;
     persistConfig(config);

package/src/server/management/storage-log-guard-routes.ts

@@ -0,0 +1,186 @@
+import { resolveCodexHomeDir } from "../../codex/home";
+import {
+  compactCodexLogs,
+  type CodexLogGuardCompactionResult,
+} from "../../codex/log-guard/maintenance";
+import {
+  getCodexLogGuardProtectionStatus,
+  protectCodexLogs,
+  repairCodexLogGuardProtection,
+  unprotectCodexLogs,
+  type CodexLogGuardMutationResult,
+  type CodexLogGuardStatus,
+} from "../../codex/log-guard/protection";
+import { scanStorage } from "../../storage/scanner";
+import { jsonResponse } from "../auth-cors";
+import {
+  managementBodyTooLargeResponse,
+  readManagementJsonBody,
+} from "./body";
+import type { ManagementContext } from "./context";
+
+const INSPECTION_FAILED_MESSAGE = "Codex log inspection failed";
+
+function inspectionUnavailable(report: CodexLogGuardStatus): boolean {
+  return report.schema.state === "unavailable";
+}
+
+function mutationStatus(result: CodexLogGuardMutationResult): number {
+  if (result.ok) return 200;
+  switch (result.error) {
+    case "process_enumeration_failed":
+      return 503;
+    case "codex_running":
+    case "busy":
+    case "unsupported_schema":
+    case "trigger_collision":
+    case "unsafe_path":
+      return 409;
+    case "database_error":
+    case "config_write_failed":
+      return 500;
+  }
+}
+
+function compactStatus(result: CodexLogGuardCompactionResult): number {
+  if (result.ok) return 200;
+  switch (result.error) {
+    case "process_enumeration_failed":
+      return 503;
+    case "codex_running":
+    case "busy":
+    case "unsupported_schema":
+    case "auto_vacuum_not_incremental":
+    case "unsafe_path":
+    case "integrity_check_failed":
+      return 409;
+    case "database_error":
+      return 500;
+  }
+}
+
+function mutationResponse(
+  result: CodexLogGuardMutationResult,
+  ctx: ManagementContext,
+): Response {
+  return result.ok
+    ? jsonResponse(result.status, 200, ctx.req, ctx.config)
+    : jsonResponse({ error: result.error }, mutationStatus(result), ctx.req, ctx.config);
+}
+
+function compactResponse(
+  result: CodexLogGuardCompactionResult,
+  ctx: ManagementContext,
+): Response {
+  if (result.ok) {
+    return jsonResponse({ report: result.report }, 200, ctx.req, ctx.config);
+  }
+  return jsonResponse(
+    result.error === "integrity_check_failed"
+      ? { error: result.error, phase: result.phase }
+      : { error: result.error },
+    compactStatus(result),
+    ctx.req,
+    ctx.config,
+  );
+}
+
+async function readProtectMode(ctx: ManagementContext): Promise<"compat" | "quiet" | Response> {
+  let body: unknown;
+  try {
+    body = await readManagementJsonBody(ctx.req);
+  } catch (error) {
+    const tooLarge = managementBodyTooLargeResponse(error, ctx.req, ctx.config);
+    if (tooLarge) return tooLarge;
+    return jsonResponse({ error: "invalid_request" }, 400, ctx.req, ctx.config);
+  }
+  if (!body || typeof body !== "object" || Array.isArray(body)) {
+    return jsonResponse({ error: "invalid_request" }, 400, ctx.req, ctx.config);
+  }
+  const mode = (body as Record<string, unknown>).mode;
+  if (mode !== "compat" && mode !== "quiet") {
+    return jsonResponse({ error: "invalid_mode" }, 400, ctx.req, ctx.config);
+  }
+  return mode;
+}
+
+/** Codex Log Guard diagnostics plus explicit protection and maintenance mutations. */
+export async function handleStorageLogGuardRoutes(ctx: ManagementContext): Promise<Response | null> {
+  const { req, url, config, deps } = ctx;
+  const protectionDeps = deps.codexLogGuardProtectionDeps;
+
+  if (url.pathname === "/api/storage/codex-logs") {
+    if (req.method !== "GET") return null;
+    try {
+      const report = getCodexLogGuardProtectionStatus(protectionDeps);
+      if (inspectionUnavailable(report)) {
+        return jsonResponse({ error: "inspect_failed", message: INSPECTION_FAILED_MESSAGE }, 500, req, config);
+      }
+      return jsonResponse(report, 200, req, config);
+    } catch {
+      return jsonResponse({
+        error: "inspect_failed",
+        message: INSPECTION_FAILED_MESSAGE,
+      }, 500, req, config);
+    }
+  }
+
+  if (url.pathname === "/api/storage/codex-logs/protect") {
+    if (req.method !== "POST") return null;
+    const mode = await readProtectMode(ctx);
+    if (mode instanceof Response) return mode;
+    return mutationResponse(protectCodexLogs(mode, protectionDeps), ctx);
+  }
+
+  if (url.pathname === "/api/storage/codex-logs/unprotect") {
+    if (req.method !== "POST") return null;
+    return mutationResponse(unprotectCodexLogs(protectionDeps), ctx);
+  }
+
+  if (url.pathname === "/api/storage/codex-logs/repair") {
+    if (req.method !== "POST") return null;
+    return mutationResponse(repairCodexLogGuardProtection(protectionDeps), ctx);
+  }
+
+  if (url.pathname === "/api/storage/codex-logs/compact") {
+    if (req.method !== "POST") return null;
+    return compactResponse(compactCodexLogs(deps.codexLogGuardMaintenanceDeps), ctx);
+  }
+
+  if (url.pathname !== "/api/storage" || req.method !== "GET") return null;
+
+  // Keep the existing CODEX_HOME scan as the primary storage contract. The Log Guard
+  // report is attached separately so an external sqlite_home is visible without being
+  // silently folded into CODEX_HOME totals.
+  let storage;
+  try {
+    storage = scanStorage();
+  } catch {
+    const fallback = {
+      codexHome: resolveCodexHomeDir(),
+      generatedAt: Date.now(),
+      total: { bytes: 0, fileCount: 0 },
+      buckets: [],
+      error: "scan_failed",
+    };
+    try {
+      const report = getCodexLogGuardProtectionStatus(protectionDeps);
+      return inspectionUnavailable(report)
+        ? jsonResponse({ ...fallback, codexLogs: null, codexLogsError: "inspect_failed" }, 200, req, config)
+        : jsonResponse({ ...fallback, codexLogs: report }, 200, req, config);
+    } catch {
+      return jsonResponse({ ...fallback, codexLogs: null, codexLogsError: "inspect_failed" }, 200, req, config);
+    }
+  }
+
+  try {
+    const report = getCodexLogGuardProtectionStatus(protectionDeps);
+    return inspectionUnavailable(report)
+      ? jsonResponse({ ...storage, codexLogs: null, codexLogsError: "inspect_failed" }, 200, req, config)
+      : jsonResponse({ ...storage, codexLogs: report }, 200, req, config);
+  } catch {
+    // Log Guard inspection is auxiliary to the existing Storage page. A config/path
+    // resolution failure must not take the legacy read-only storage report down with it.
+    return jsonResponse({ ...storage, codexLogs: null, codexLogsError: "inspect_failed" }, 200, req, config);
+  }
+}

package/src/server/management-api.ts

@@ -59,6 +59,7 @@ import { applySystemEnvToggle } from "./system-env";
 import type { ManagementApiDeps } from "./management/context";
 import { handleConfigRoutes } from "./management/config-routes";
 import { handleLogsUsageRoutes } from "./management/logs-usage-routes";
+import { handleStorageLogGuardRoutes } from "./management/storage-log-guard-routes";
 import { handleRequestHistoryRoutes } from "./management/request-history-routes";
 import { handleRoutingAnalyticsRoutes } from "./management/routing-analytics-routes";
 import { handleProviderRoutes } from "./management/provider-routes";
@@ -209,6 +210,7 @@ export async function handleManagementAPI(
   let routed: Response | null;
   try {
     routed = (await handleConfigRoutes(ctx))
+    ??     (await handleStorageLogGuardRoutes(ctx))
     ??     (await handleLogsUsageRoutes(ctx))
     ??     (await handleRequestHistoryRoutes(ctx))
     ??     (await handleRoutingAnalyticsRoutes(ctx))
@@ -300,4 +302,4 @@ export async function handleManagementAPI(
 }
 
 
-export { buildClaudeDesktopState, fetchAllModels } from "./management/shared";
+export { buildClaudeDesktopState, fetchAllModels } from "./management/shared";

package/src/server/responses/core.ts

@@ -1080,6 +1080,19 @@ async function applyFinalRouteRequestNormalization(args: {
     }
   }
 
+  // Generic Responses clients (e.g. AI-SDK apps) omit `store`, but the canonical
+  // forward Codex backend rejects a native request without an explicit store:false.
+  // Default it only there — every other Responses upstream (key-auth providers and
+  // custom forward gateways) intentionally keeps the omitted-store server-side
+  // default for previous_response_id reuse — and never override an explicit value.
+  if (
+    isCanonicalOpenAiForwardProvider(route.provider)
+    && parsed._rawBody && typeof parsed._rawBody === "object"
+    && (parsed._rawBody as Record<string, unknown>).store === undefined
+  ) {
+    (parsed._rawBody as Record<string, unknown>).store = false;
+  }
+
   // Final selected model before virtual wire-model rewriting (Pro aliases).
   const finalSelectedModelId = route.modelId;
 

package/src/types.ts

@@ -596,7 +596,7 @@ export interface OcxCustomModel {
   id: string;
   /** 프로바이더 키 (기존 providers[name]) */
   provider: string;
-  /** 모델 슬러그 (프로바이더 접두사 없는 bare id) */
+  /** Native provider model id; slashes are allowed and encoded for Codex as provider/<hyphenated-id>. */
   modelId: string;
   /** 인간 가독 표시명 (선택, 슬래시 불가) */
   displayName?: string;
@@ -825,6 +825,11 @@ export interface OcxConfig {
    * - "v2": force ALL models to v2 surface (override upstream pins)
    */
   multiAgentMode?: "v1" | "default" | "v2";
+  /**
+   * When `multiAgentMode` is `"v2"`, keep ChatGPT-native catalog rows on v1.
+   * Routed parents get v2 tools; Sol/Terra can still spawn Grok/Claude (issue #92).
+   */
+  keepNativeChatGptOnV1?: boolean;
   /** Experimental, default-off ChatGPT recovery for encrypted V2 routed tasks. */
   agentTaskRecovery?: {
     enabled?: boolean;