@bitkyc08/opencodex 2.24.0 → 2.24.2

package/src/generated/compatibility-version.json

@@ -10,7 +10,7 @@
     },
     {
       "path": "package.json",
-      "sha256": "82a2b976e7b6e80afbf2b72f446758665ef0c78c83adf116f1cad43f2cfbc34b"
+      "sha256": "6eddddb2ce07468a1c26f394225a047ae265a21e7457f38ad6500a62c2f63b66"
     },
     {
       "path": "scripts/model-metadata.source.json",
@@ -342,7 +342,7 @@
     },
     {
       "path": "src/claude/context-windows.ts",
-      "sha256": "41c66bc19175eace1d367f349a3311a691c3445d5b9f3f16fab7cd351939cb9c"
+      "sha256": "4c49d8efeec1d1060e9e61201370d4dce268b7826ca3fcff773d1d53c4c548b4"
     },
     {
       "path": "src/claude/desktop-3p-guard.ts",
@@ -354,7 +354,7 @@
     },
     {
       "path": "src/claude/desktop-3p.ts",
-      "sha256": "10bfcaa2f68521b6b2f93c33e3d622679a25f1e9cdebc28cb0c034f25ea12aa8"
+      "sha256": "2218e3b4ba35dab0bf53e6b400468daf6a59e886f06afe96dd083b755e6beed0"
     },
     {
       "path": "src/claude/desktop-health.ts",
@@ -378,7 +378,7 @@
     },
     {
       "path": "src/claude/model-info.ts",
-      "sha256": "f83181da3d11d47ebdbffcbbfbdfbc860ed2c296f30cdc36d1c7a3bec7061134"
+      "sha256": "8b087c12684e3e43100047227f04536321be5d2af3ca6e989693d09836fbf74f"
     },
     {
       "path": "src/claude/outbound.ts",
@@ -430,7 +430,7 @@
     },
     {
       "path": "src/cli/claude-desktop.ts",
-      "sha256": "5ee287b01b95b4e48e3fd6f444f2642289f849b3e843b87d502a2e125c298fdb"
+      "sha256": "edc5fcaf62acdeaafac905bbe84fb5527cbe38d4729d4e94cff29cb7b2b4bf2f"
     },
     {
       "path": "src/cli/claude.ts",
@@ -650,7 +650,7 @@
     },
     {
       "path": "src/codex/catalog-admission.ts",
-      "sha256": "7410dcb4e9ebfab045144d383d91655dc6be3c4fd3d57a8b2414fd1b2db6cb8d"
+      "sha256": "56409c9d41b58e990a35f8b4305ec58ff1ffad173e2a43a7ff0e0b671546b2ba"
     },
     {
       "path": "src/codex/catalog-refresh-status.ts",
@@ -662,7 +662,7 @@
     },
     {
       "path": "src/codex/catalog.ts",
-      "sha256": "0c76625e56687be734c75c6be80586e298d8cbb3c471707417708ee522afb5b8"
+      "sha256": "879afc5613a39b758e6e8f6f63d23cef0918ffb38e6f68dff1bc3f638278bd1a"
     },
     {
       "path": "src/codex/catalog/account-models.ts",
@@ -690,7 +690,7 @@
     },
     {
       "path": "src/codex/catalog/metadata.ts",
-      "sha256": "66d9f4c603a77d34ab44b11b9b4397cc53c6a1e88a4bfb47cbc2a6b25ef20fbc"
+      "sha256": "fc1cce8854a517f6c80ce137a02fb183c6710899f2a1d7536707c00ad56b4de6"
     },
     {
       "path": "src/codex/catalog/native-models.ts",
@@ -702,7 +702,7 @@
     },
     {
       "path": "src/codex/catalog/provider-fetch.ts",
-      "sha256": "cfd71e3d50149f8f04c4d272bb1dd42f1f26bbf276cabb13bb9f21fa5ebf7dc6"
+      "sha256": "bfb4a4c32de3a514190c8bf4fcb660312a64a8e7d32ef9ac83106f999f8c639d"
     },
     {
       "path": "src/codex/catalog/sync.ts",
@@ -782,7 +782,7 @@
     },
     {
       "path": "src/codex/injected-marker.ts",
-      "sha256": "20ea9be70b7dc48fc0be124ca0b4670ddbe75c9683dac96fa1cc3a8792af0f15"
+      "sha256": "b59a1864bc2a71dae6d0349386c137ad18ce402981f09f19fb881777fcc1556f"
     },
     {
       "path": "src/codex/integration-record.ts",
@@ -986,7 +986,7 @@
     },
     {
       "path": "src/codex/user-identity.ts",
-      "sha256": "e2cb675b208f7ad2fdd64c5d05d9c439511f786f3887ea5cb54d87b6fe7fe8a2"
+      "sha256": "9641f00a7213ea6cb85cdc38adcbab1615815ca1eda878d5bfc3513e023243c7"
     },
     {
       "path": "src/codex/warmup.ts",
@@ -1046,7 +1046,7 @@
     },
     {
       "path": "src/grok/sync.ts",
-      "sha256": "20b41bbcba0f876a376c69a0a00c953632869fcba7c2dd3b5f0b850b55b987ff"
+      "sha256": "a2afb3599a789276726867b559273d047b7e55a64f088ca81e4af49629e14d74"
     },
     {
       "path": "src/images/artifacts.ts",
@@ -1442,7 +1442,7 @@
     },
     {
       "path": "src/lab/projection/rebuild.ts",
-      "sha256": "ad3e71676d7c259b6b5993a87c5af367a7910fc86d228b37bc7cf10481eed21c"
+      "sha256": "9de9cfcd613634b5afa7ba8bbea7fc24327ff1fb103ae2c70c6f5475e70695c3"
     },
     {
       "path": "src/lab/projection/schema.ts",
@@ -1854,11 +1854,11 @@
     },
     {
       "path": "src/lib/windows-elevation.ts",
-      "sha256": "0dc9864f87be8eed6c8dff80bec938f73fa2836c9f606f0e81c4c020494a8850"
+      "sha256": "b0aab4ba8c7fe82e101669545881634ed75b59ca024522ad21e8c613c7a6cf99"
     },
     {
       "path": "src/lib/windows-secret-acl.ts",
-      "sha256": "6cbb7d5a6d9e5a1d73058af79ac02611e5cebc01fc49c7daf39ab8b0f9b41f53"
+      "sha256": "1e3d7e199fa0433ca778ba3ffae2c610bf2d1850ead39c8fa1d1a1b64881bc1c"
     },
     {
       "path": "src/lib/windows-text.ts",
@@ -2186,7 +2186,7 @@
     },
     {
       "path": "src/routing/capability.ts",
-      "sha256": "00606e95e636abd8612bb6825c6cb8c2a62ca1eb396ebebba64501f34cd0e060"
+      "sha256": "e4c7da723d461ac41b18cdf5d80085887a0b0e46917bcb4e012f52fc431475d0"
     },
     {
       "path": "src/routing/compatibility/assemble.ts",
@@ -2330,7 +2330,7 @@
     },
     {
       "path": "src/server/index.ts",
-      "sha256": "d3d1d19add61e536b9c1ede4676c5ef67a79ccc3e3e55302592d9f4228635d59"
+      "sha256": "1ceb408f13a9700fcdd78e112fe56c35956a0e1c3207f14477ca7f18358fa3b7"
     },
     {
       "path": "src/server/lifecycle.ts",
@@ -2350,7 +2350,7 @@
     },
     {
       "path": "src/server/management-api.ts",
-      "sha256": "6a5238bfda08e77c550185fc54e54214da3fe6b10d4264c13f263f3c67a76939"
+      "sha256": "b3e94bff1762950449552b416de10cbed72f12362dfa3c7c1f9bf043177ae1fc"
     },
     {
       "path": "src/server/management-auth.ts",
@@ -2358,7 +2358,7 @@
     },
     {
       "path": "src/server/management/agent-settings-routes.ts",
-      "sha256": "cf34cb29cc6e80b22b47bab31f5d6fc19e44e5604ba847ed0fbfdc500dd38136"
+      "sha256": "97487f7dadf5abae969085b6058f430fce0d309e8882eaeeedae078ccc6cafc9"
     },
     {
       "path": "src/server/management/api-access.ts",
@@ -2378,11 +2378,11 @@
     },
     {
       "path": "src/server/management/config-routes.ts",
-      "sha256": "90a3722a21edff368f0605300f2e4e2addcc3353ca5d2372d6df99e9ebe03fbd"
+      "sha256": "3a56198dbd3884707cd385a9c6b62a3c910741a0d7c576d9b30de3d7a8f86ddf"
     },
     {
       "path": "src/server/management/context.ts",
-      "sha256": "ee5a6bbd25f568425e75677d0ab11e16b4996096512599c37b785d18e6dfcb18"
+      "sha256": "1b5d01755283307260fb942f35bc23b2d22bb6108e00b3c4d75a56ec13780dff"
     },
     {
       "path": "src/server/management/integration-routes.ts",
@@ -2410,7 +2410,7 @@
     },
     {
       "path": "src/server/management/native-integration-routes.ts",
-      "sha256": "12ebeccbcffb49b3132d799bf7faa1534da4d7f5cf6c32a15c4b75b7e6eda7c7"
+      "sha256": "6c01497f98bc583ec2d76fe90e99f61076287c7a69f9dee67477ba60853e38e7"
     },
     {
       "path": "src/server/management/oauth-account-routes.ts",
@@ -2438,7 +2438,7 @@
     },
     {
       "path": "src/server/management/shared.ts",
-      "sha256": "111efaa480b344e3d0a0bff639c9946b4a5691c6ed02727dd929deffc532a938"
+      "sha256": "2ec68a5b6d334898762c729b07eb3b98a350a4cf52d3f4debe25eb359162e863"
     },
     {
       "path": "src/server/management/sidebar-routes.ts",
@@ -2566,7 +2566,7 @@
     },
     {
       "path": "src/server/responses/core.ts",
-      "sha256": "15210453413f7f152083a987226695faa7a373a36f97486353272df0143f60cc"
+      "sha256": "fbb0b59c9a67f10d97ec28ac48b7c2c168c7ec359f43c336a11913148ae1a11a"
     },
     {
       "path": "src/server/responses/empty-completion-guard.ts",
@@ -2582,7 +2582,7 @@
     },
     {
       "path": "src/server/responses/input-admission.ts",
-      "sha256": "b9536eb8dc3532c35ef65bd0a1f910e1e20db74e0ac6b581de529f4e60fd4120"
+      "sha256": "cb04a5dea34d8e997c842626bad39d02baf1c64e6bcf614227bf3d49a2270131"
     },
     {
       "path": "src/server/responses/pacing-overload.ts",
@@ -2630,7 +2630,7 @@
     },
     {
       "path": "src/server/system-env.ts",
-      "sha256": "4a501266f1b914fa83f0646f3679d38b0fdda8399bb01cc0451054d03b93dfe1"
+      "sha256": "b068365c21dbc6c92de920f9ebb3c771b9f82ecff0dfa315618923d748a93025"
     },
     {
       "path": "src/server/windows-tcp-drop.ts",

package/src/grok/sync.ts

@@ -6,9 +6,7 @@
  *
  * Deps are injectable (mirrors src/codex/sync.ts) so tests can run without a live proxy.
  */
-import { visibleNativeSlugs, filterCatalogVisibleModels, nativeOpenAiContextWindow, type CatalogModel } from "../codex/catalog";
-import { providerContextCap } from "../providers/context-cap";
-import { OPENAI_CODEX_PROVIDER_ID } from "../providers/openai-tiers";
+import { visibleNativeSlugs, filterCatalogVisibleModels, nativeContextLimits, nativeOpenAiContextWindow, type CatalogModel } from "../codex/catalog";
 import type { OcxConfig } from "../types";
 import { injectGrokConfig, type GrokInjectModel, type GrokInjectResult } from "./inject";
 
@@ -42,7 +40,7 @@ export async function syncGrokConfig(
       // default (200k) and understates models like gpt-5.6-sol, which is 372k. This is the same
       // accessor the dashboard's native rows use, so the two cannot disagree.
       ...visibleNativeSlugs(config).map(id => {
-        const contextWindow = nativeOpenAiContextWindow(id, providerContextCap(config, OPENAI_CODEX_PROVIDER_ID));
+        const contextWindow = nativeOpenAiContextWindow(id, nativeContextLimits(config));
         return { id, ...(contextWindow !== undefined ? { contextWindow } : {}) };
       }),
       ...routed.map(m => ({

package/src/lab/projection/rebuild.ts

@@ -122,6 +122,20 @@ export function rebuildLabProjection(configDir?: string): RebuildResult {
 
   const db = new Database(paths.sqlitePath);
   let transactionOpen = false;
+  // Every statement prepared below, so they can be finalized before the close.
+  //
+  // Bun keeps a prepared statement alive until it is finalized or garbage collected,
+  // and on Windows an unfinalized statement holds the database file open: `close()`
+  // leaves the handle, and `close(true)` throws "database is locked". A second
+  // rebuild then failed to unlink the previous projection with EBUSY, and the retry
+  // loop in `wipeSqlite` could only turn that into a slower failure. POSIX allows
+  // unlinking an open file, which is why this never surfaced there.
+  const prepared: Array<{ finalize(): void }> = [];
+  const prepare = (sql: string) => {
+    const statement = db.prepare(sql);
+    prepared.push(statement);
+    return statement;
+  };
   try {
     db.exec("PRAGMA journal_mode=DELETE;");
     db.exec("PRAGMA foreign_keys=OFF;");
@@ -129,50 +143,45 @@ export function rebuildLabProjection(configDir?: string): RebuildResult {
     transactionOpen = true;
     resetProjectionSchema(db);
 
-    db.prepare(
-      "INSERT OR REPLACE INTO schema_meta(key, value) VALUES (?, ?)",
-    ).run("schema_version", String(LAB_SQLITE_SCHEMA_VERSION));
-    db.prepare(
-      "INSERT OR REPLACE INTO schema_meta(key, value) VALUES (?, ?)",
-    ).run("projection_spec_version", LAB_PROJECTION_SPEC_VERSION);
-    db.prepare(
-      "INSERT OR REPLACE INTO schema_meta(key, value) VALUES (?, ?)",
-    ).run("built_at_ms", String(Date.now()));
+    const insertMeta = prepare("INSERT OR REPLACE INTO schema_meta(key, value) VALUES (?, ?)");
+    insertMeta.run("schema_version", String(LAB_SQLITE_SCHEMA_VERSION));
+    insertMeta.run("projection_spec_version", LAB_PROJECTION_SPEC_VERSION);
+    insertMeta.run("built_at_ms", String(Date.now()));
 
-    const insertCorruption = db.prepare(
+    const insertCorruption = prepare(
       "INSERT INTO corruption(kind, line_number, event_id, detail) VALUES (?, ?, ?, ?)",
     );
     for (const c of corruptions) {
       insertCorruption.run(c.kind, c.lineNumber ?? null, c.eventId ?? null, c.detail);
     }
 
-    const insertEvent = db.prepare(
+    const insertEvent = prepare(
       `INSERT INTO events(event_id, event_kind, recorded_at, producer, producer_version, payload_json, excluded, exclusion_reason)
        VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
     );
-    const insertSubject = db.prepare(
+    const insertSubject = prepare(
       `INSERT OR IGNORE INTO subjects(subject_id, subject_kind, subject_json) VALUES (?, ?, ?)`,
     );
-    const insertObs = db.prepare(
+    const insertObs = prepare(
       `INSERT INTO observations(
          event_id, subject_id, evidence_layer, suite_id, suite_version, suite_manifest_digest,
          scenario_id, scenario_version, scenario_manifest_digest, outcome, completed_at, execution_mode
        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
     );
-    const insertClaim = db.prepare(
+    const insertClaim = prepare(
       `INSERT INTO claims(
          event_id, subject_id, capability, polarity, source_manifest_digest,
          effective_at, recorded_at, supersedes_json, current, usable
        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
     );
-    const insertInv = db.prepare(
+    const insertInv = prepare(
       `INSERT INTO invalidations(event_id, reason, targets_json, recorded_at, applied) VALUES (?, ?, ?, ?, ?)`,
     );
-    const insertPurge = db.prepare(
+    const insertPurge = prepare(
       `INSERT INTO purges(event_id, target_event_ids_json, target_artifact_digests_json, purge_actions_json, recorded_at)
        VALUES (?, ?, ?, ?, ?)`,
     );
-    const insertArtifact = db.prepare(
+    const insertArtifact = prepare(
       `INSERT INTO artifacts(digest, artifact_class, media_type, byte_count, status, last_error)
        VALUES (?, ?, ?, ?, ?, ?)
        ON CONFLICT(digest) DO UPDATE SET
@@ -319,7 +328,7 @@ export function rebuildLabProjection(configDir?: string): RebuildResult {
       }
     }
 
-    const insertVerdict = db.prepare(
+    const insertVerdict = prepare(
       `INSERT INTO verdicts(
          projection_key, subject_id, evidence_layer, suite_id, suite_version, suite_manifest_digest,
          projection_spec_version, verdict, as_of, scenario_manifest_digests_json, claim_source_digest,
@@ -369,6 +378,15 @@ export function rebuildLabProjection(configDir?: string): RebuildResult {
     } catch {
       // Closing the disposable DB is still safe if pragma restoration fails.
     }
+    // Finalize before closing: an outstanding statement keeps the file open on
+    // Windows, and the next rebuild cannot unlink the projection it is replacing.
+    for (const statement of prepared) {
+      try {
+        statement.finalize();
+      } catch {
+        // A statement already finalized by an error path is not a rebuild failure.
+      }
+    }
     db.close();
     artifactStore.close();
   }

package/src/lib/windows-elevation.ts

@@ -175,7 +175,7 @@ export function assertTrustedSystemExecutableForTests(candidate: string, label:
   return assertTrustedSystemExecutable(candidate, label);
 }
 
-type ElevationExeOverrides = { powershell?: string; schtasks?: string; taskkill?: string };
+type ElevationExeOverrides = { powershell?: string; schtasks?: string; taskkill?: string; icacls?: string };
 let elevationExeOverridesForTests: ElevationExeOverrides | null = null;
 
 /**
@@ -220,6 +220,15 @@ export function resolveTrustedWindowsTaskkillExe(): string {
   return assertTrustedSystemExecutable(candidate, "taskkill.exe");
 }
 
+/** Absolute path to System32\\icacls.exe from a trusted system directory. */
+export function resolveTrustedWindowsIcaclsExe(): string {
+  if (elevationExeOverridesForTests?.icacls) {
+    return elevationExeOverridesForTests.icacls;
+  }
+  const candidate = join(resolveTrustedWindowsSystemDirectory(), "icacls.exe");
+  return assertTrustedSystemExecutable(candidate, "icacls.exe");
+}
+
 /** Stable machine-readable marker for a denied `schtasks /create`. Crosses the CLI→proxy boundary. */
 export const WINDOWS_SCHTASKS_CREATE_ACCESS_DENIED_MARKER =
   "OCX_ERROR_CODE=WINDOWS_SCHTASKS_CREATE_ACCESS_DENIED";

package/src/lib/windows-secret-acl.ts

@@ -31,6 +31,7 @@
 
 import { existsSync, statSync } from "node:fs";
 import { env, platform } from "node:process";
+import { resolveTrustedWindowsIcaclsExe } from "./windows-elevation";
 import {
   resolveCurrentWindowsPrincipal,
   resolveCurrentWindowsPrincipalAsync,
@@ -273,22 +274,55 @@ export interface IcaclsResult {
 type IcaclsRunner = (args: string[], timeoutMs: number) => IcaclsResult;
 type AsyncIcaclsRunner = (args: string[], timeoutMs: number) => Promise<IcaclsResult>;
 
+function resolveIcaclsExecutable(): string {
+  // Same authority as schtasks/powershell: never take icacls from PATH.
+  // A bun-shim or stripped PATH makes `icacls.exe` throw ENOENT, which used to
+  // surface as "filesystem may not support per-user NTFS ACLs".
+  return resolveTrustedWindowsIcaclsExe();
+}
+
+function spawnFailedResult(): IcaclsResult {
+  return { success: false, exitCode: null, timedOut: false, stdout: "" };
+}
+
+/**
+ * Spawn icacls asynchronously, or return null when the executable cannot be
+ * launched. The pipe/ignore stdio literals stay inferred here so `stdout` keeps
+ * its `ReadableStream` type instead of widening to the generic default.
+ */
+function trySpawnIcacls(args: string[]) {
+  try {
+    return Bun.spawn([resolveIcaclsExecutable(), ...args], {
+      stdin: "ignore",
+      stdout: "pipe",
+      stderr: "ignore",
+      windowsHide: true,
+    });
+  } catch {
+    return null;
+  }
+}
+
 function defaultIcaclsRunner(args: string[], timeoutMs: number): IcaclsResult {
   // Bun.spawnSync with windowsHide: Node execFileSync has hung under the GUI/proxy even
   // with windowsHide, and console-subsystem tools flash a visible window otherwise.
-  const result = Bun.spawnSync(["icacls.exe", ...args], {
-    stdin: "ignore",
-    stdout: "pipe",
-    stderr: "ignore",
-    timeout: timeoutMs,
-    windowsHide: true,
-  });
-  return {
-    success: result.success,
-    exitCode: result.exitCode,
-    timedOut: result.exitedDueToTimeout ?? false,
-    stdout: result.stdout ? result.stdout.toString() : "",
-  };
+  try {
+    const result = Bun.spawnSync([resolveIcaclsExecutable(), ...args], {
+      stdin: "ignore",
+      stdout: "pipe",
+      stderr: "ignore",
+      timeout: timeoutMs,
+      windowsHide: true,
+    });
+    return {
+      success: result.success,
+      exitCode: result.exitCode,
+      timedOut: result.exitedDueToTimeout ?? false,
+      stdout: result.stdout ? result.stdout.toString() : "",
+    };
+  } catch {
+    return spawnFailedResult();
+  }
 }
 
 /**
@@ -297,12 +331,8 @@ function defaultIcaclsRunner(args: string[], timeoutMs: number): IcaclsResult {
  * we still await process exit before classifying so settlement is confirmed.
  */
 async function defaultAsyncIcaclsRunner(args: string[], timeoutMs: number): Promise<IcaclsResult> {
-  const proc = Bun.spawn(["icacls.exe", ...args], {
-    stdin: "ignore",
-    stdout: "pipe",
-    stderr: "ignore",
-    windowsHide: true,
-  });
+  const proc = trySpawnIcacls(args);
+  if (!proc) return spawnFailedResult();
   let timedOutByUs = false;
   const timer = setTimeout(() => {
     timedOutByUs = true;

package/src/routing/capability.ts

@@ -13,11 +13,10 @@
 import type { OcxConfig } from "../types";
 import { isCanonicalOpenAiForwardProvider, OPENAI_CODEX_PROVIDER_ID } from "../providers/openai-tiers";
 import { serviceTierSupportForModel } from "../providers/service-tier";
-import { applyProviderContextCap, providerContextCap } from "../providers/context-cap";
 import { PROVIDER_REGISTRY } from "../providers/registry";
 import {
   nativeInputModalities,
-  nativeOpenAiContextWindow,
+  nativeContextLimits, nativeOpenAiContextWindow,
   nativeParallelToolCalls,
   nativeReasoningEfforts,
 } from "../codex/catalog/metadata";
@@ -164,11 +163,11 @@ export function candidateCapabilityEvidence(
     ?? provider?.contextWindow
     ?? registryEntry?.modelContextWindows?.[modelId]
     ?? catalogRow?.contextWindow
-    ?? (isNative ? nativeOpenAiContextWindow(modelId) : undefined);
-  // providerContextCaps.openai also ceilings native OpenAI rows (#1430), so routing
-  // evidence never contradicts a capped catalog entry.
+    ?? (isNative ? nativeOpenAiContextWindow(modelId, nativeContextLimits(config)) : undefined);
+  // Native rows go through the accessor (raise-to-ceiling + opt-in). Routed rows keep
+  // the raw value; a provider cap on openai must not invent a window they do not have.
   const contextWindow = isNative
-    ? applyProviderContextCap(rawContextWindow, providerContextCap(config, OPENAI_CODEX_PROVIDER_ID)) ?? rawContextWindow
+    ? (nativeOpenAiContextWindow(modelId, nativeContextLimits(config)) ?? rawContextWindow)
     : rawContextWindow;
 
   const modalities = provider?.modelInputModalities?.[modelId]

package/src/server/index.ts

@@ -50,7 +50,6 @@ import { runOpenAiTierStartupMigration } from "../providers/openai-tier-startup"
 import { runAlibabaRegionStartupMigration } from "../providers/alibaba-region-startup";
 import { runModelRenameStartupMigration } from "../providers/model-rename-startup";
 import { isCanonicalOpenAiForwardProvider, OPENAI_CODEX_PROVIDER_ID } from "../providers/openai-tiers";
-import { providerContextCap } from "../providers/context-cap";
 import { providerCodexAccountMode } from "../providers/registry";
 import type { StorageCleanupPolicy } from "../types";
 import { MAX_DECOMPRESSED_BODY_BYTES } from "./request-decompress";
@@ -906,7 +905,7 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
           }
           throw error;
         }
-        const { accountBoundNativeOpenAiSlugsBySelector, applyNativeVisibility, buildCatalogEntries, configuredNativeAliasSlugs, desktopAllowlistSuppressedNativeSlugs, disabledNativeSlugs, exactComboCatalogSlugs, loadCatalogTemplate, NATIVE_OPENAI_MODELS, nativeOpenAiSlugs, nativeReasoningEfforts, nativeDefaultReasoningEffort, orderForSubagents, filterCatalogVisibleModels, shouldIncludeAccountBoundNativeOpenAi, shouldIncludeNativeOpenAi, uniqueCatalogModelsForRawPublicList, visibleCodexAccountSelectors, visibleNativeSlugs, desktopVisibleNativeSlugs } = await import("../codex/catalog");
+        const { accountBoundNativeOpenAiSlugsBySelector, applyNativeVisibility, buildCatalogEntries, configuredNativeAliasSlugs, desktopAllowlistSuppressedNativeSlugs, disabledNativeSlugs, exactComboCatalogSlugs, loadCatalogTemplate, NATIVE_OPENAI_MODELS, nativeContextLimits, nativeOpenAiSlugs, nativeReasoningEfforts, nativeDefaultReasoningEffort, orderForSubagents, filterCatalogVisibleModels, shouldIncludeAccountBoundNativeOpenAi, shouldIncludeNativeOpenAi, uniqueCatalogModelsForRawPublicList, visibleCodexAccountSelectors, visibleNativeSlugs, desktopVisibleNativeSlugs } = await import("../codex/catalog");
         const includeNativeOpenAi = shouldIncludeNativeOpenAi(config);
         const includeAccountBoundNativeOpenAi = shouldIncludeAccountBoundNativeOpenAi(config);
         const nativeSlugs = includeNativeOpenAi
@@ -958,7 +957,7 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
             : idsParam === "desktop"
               ? "desktop3p" as const
               : (/^claude-code\//i.test(req.headers.get("user-agent") ?? "") ? "readable" as const : "desktop3p" as const);
-          const data = buildAnthropicModelInfos([...desktopVisibleNativeSlugs(config)], goOrdered, resolveAutoContext(config.claudeCode), idStyle, activeDesktop3pAlias, providerContextCap(config, OPENAI_CODEX_PROVIDER_ID));
+          const data = buildAnthropicModelInfos([...desktopVisibleNativeSlugs(config)], goOrdered, resolveAutoContext(config.claudeCode), idStyle, activeDesktop3pAlias, nativeContextLimits(config));
           return jsonResponse({ data }, 200, req, policy);
         }
         if (url.searchParams.has("client_version")) {
@@ -985,7 +984,7 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
             accountSelectors,
             suppressedBareNativeSlugs,
             new Set(),
-            providerContextCap(config, OPENAI_CODEX_PROVIDER_ID),
+            nativeContextLimits(config),
             accountNativeSlugs,
             accountNativeSlugsBySelector,
             config.keepNativeChatGptOnV1 === true,

package/src/server/management/agent-settings-routes.ts

@@ -1,7 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
 import type { CatalogModel } from "../../codex/catalog";
-import { catalogModelSlug, invalidateCodexModelsCache, nativeModelRows, uniqueCatalogModelsForPublicList } from "../../codex/catalog";
+import { catalogModelSlug, invalidateCodexModelsCache, nativeContextLimits, nativeModelRows, uniqueCatalogModelsForPublicList } from "../../codex/catalog";
 import {
   DEFAULT_SUBAGENT_MODELS,
   codexAutoStartEnabled,
@@ -207,7 +207,7 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
         current.apiKeys?.[0]?.key,
         "static",
         current.claudeCode.desktopProfile,
-        providerContextCap(current, OPENAI_CODEX_PROVIDER_ID),
+        nativeContextLimits(current),
       );
       if (result.written && result.fingerprint) {
         current.claudeCode = { ...current.claudeCode, desktopProfile: { ...current.claudeCode.desktopProfile, appliedFingerprint: result.fingerprint, appliedAt: new Date().toISOString() } };
@@ -886,7 +886,7 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
         latest.apiKeys?.[0]?.key,
         mode,
         state.profile,
-        providerContextCap(latest, OPENAI_CODEX_PROVIDER_ID),
+        nativeContextLimits(latest),
       );
       if (!result.written) return jsonResponse({ error: result.reason ?? "Claude Desktop apply failed", saved: true, path: result.path }, 500);
       // Persist applied fingerprint + timestamp so GUI can show saved-vs-applied state.
@@ -978,7 +978,7 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
       if (isDisabled(m.provider, m.id)) continue;
       aliases.push({ id: claudeCodeAlias(m.provider, m.id), display_name: `${m.id} (${m.provider})` });
     }
-    const contextWindows = buildClaudeContextWindows([...visibleNativeSlugs(config)], models, providerContextCap(config, OPENAI_CODEX_PROVIDER_ID));
+    const contextWindows = buildClaudeContextWindows([...visibleNativeSlugs(config)], models, nativeContextLimits(config));
     const webSearchOverride = config.claudeCode?.webSearchSidecar;
     const visionOverride = config.claudeCode?.visionSidecar;
     // Auto is a RESOLUTION, recomputed per request — never stored state. Detection is
@@ -1010,7 +1010,7 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
       classifierModel: config.claudeCode?.classifierModel ?? "",
       classifierFallbacks: config.claudeCode?.classifierFallbacks ?? [],
       systemEnv: config.claudeCode?.systemEnv === true,
-      autoConnectSupported: process.platform === "darwin",
+      autoConnectSupported: (ctx.deps.platform ?? process.platform) === "darwin",
       maxContextTokens: config.claudeCode?.maxContextTokens ?? null,
       alwaysEnableEffort: config.claudeCode?.alwaysEnableEffort === true,
       autoContext: config.claudeCode?.autoContext !== false,

package/src/server/management/config-routes.ts

@@ -1,7 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
 import type { CatalogModel } from "../../codex/catalog";
-import { catalogModelSlug, invalidateCodexModelsCache, nativeModelRows, uniqueCatalogModelsForPublicList } from "../../codex/catalog";
+import { catalogModelSlug, invalidateCodexModelsCache, nativeContextLimits, nativeModelRows, uniqueCatalogModelsForPublicList } from "../../codex/catalog";
 import {
   DEFAULT_SUBAGENT_MODELS,
   codexAutoStartEnabled,
@@ -173,7 +173,7 @@ async function syncEnabledClientIntegrations(
         config.apiKeys?.[0]?.key,
         "static",
         config.claudeCode?.desktopProfile,
-        providerContextCap(config, OPENAI_CODEX_PROVIDER_ID),
+        nativeContextLimits(config),
       );
       out.push(r.written
         ? { client: "claude-desktop", ok: true, changed: true }

package/src/server/management/context.ts

@@ -16,6 +16,8 @@ import type {
 } from "../../codex/app-server-restart-service";
 
 export interface ManagementApiDeps {
+  /** Platform seam for capability projections; does not alter host-level startup behavior. */
+  platform?: NodeJS.Platform;
   toggleCodexMultiAgentV2?: (enabled: boolean) => void;
   toggleDefaultModeRequestUserInput?: (enabled: boolean) => void;
   createManagementConvergeCodex?: (config: Readonly<OcxConfig>) => ConvergeCodex;

package/src/server/management/native-integration-routes.ts

@@ -18,7 +18,7 @@
  * 011 (Claude Code), 012 (Grok).
  */
 import { loadConfig, readRuntimePort, saveConfigPreservingClaudeCode } from "../../config";
-import { desktopVisibleNativeSlugs, filterCatalogVisibleModels, nativeOpenAiContextWindow, visibleNativeSlugs } from "../../codex/catalog";
+import { desktopVisibleNativeSlugs, filterCatalogVisibleModels, nativeContextLimits, nativeOpenAiContextWindow, visibleNativeSlugs } from "../../codex/catalog";
 import { providerContextCap } from "../../providers/context-cap";
 import { OPENAI_CODEX_PROVIDER_ID } from "../../providers/openai-tiers";
 import { inspectDesktop3pConfigLibrary, removeDesktop3pStandardPivot, writeDesktop3pConfig } from "../../claude/desktop-3p";
@@ -508,7 +508,7 @@ async function handleGrokToggle(ctx: ManagementContext): Promise<Response> {
         // Native slugs carry their context window: without it Grok falls back
         // to its own 200k default and understates a 372k model.
         ...visibleNativeSlugs(config).map(id => {
-          const contextWindow = nativeOpenAiContextWindow(id, providerContextCap(config, OPENAI_CODEX_PROVIDER_ID));
+          const contextWindow = nativeOpenAiContextWindow(id, nativeContextLimits(config));
           return { id, ...(contextWindow !== undefined ? { contextWindow } : {}) };
         }),
         ...routed.map(m => ({
@@ -663,7 +663,7 @@ async function handleClaudeDesktopToggle(ctx: ManagementContext): Promise<Respon
         latest.apiKeys?.[0]?.key,
         "static",
         latest.claudeCode?.desktopProfile,
-        providerContextCap(latest, OPENAI_CODEX_PROVIDER_ID),
+        nativeContextLimits(latest),
       );
       if (!result.written) return postCommitRefusal(500, "claude-desktop", "write_failed", "Claude Desktop apply failed.", { desiredEnabled: latestDesiredEnabled });
       return jsonResponse({