@bitkyc08/opencodex 2.32.1 → 2.33.0

package/src/codex/catalog/provider-fetch.ts

@@ -41,6 +41,7 @@ import type { FastPolicyAuthority } from "../../providers/fastwire";
 import { effectiveGoogleMode, getProviderRegistryEntry, providerMatchesRegistryTransport } from "../../providers/registry";
 import { parseAntigravityAvailableModels, registerAntigravityDiscoveredWireModels } from "../../providers/antigravity-models";
 import { applyProviderContextCap, providerContextCap, resolveUnknownRoutedContextWindow } from "../../providers/context-cap";
+import { clampAutoCompactTokenLimit } from "../../providers/auto-compact-budget";
 import { routedSlug, slugEquals, slugEquivalenceKey, slugsEquivalent } from "../../providers/slug-codec";
 import { CODEX_GPT5_IDENTITY_LINE } from "../../adapters/identity";
 import { filterCursorConfiguredModelsByLiveDiscovery } from "../../adapters/cursor/discovery";
@@ -75,7 +76,7 @@ import { createAdmissionGate, ResourceAdmissionError, type AdmissionMetrics } fr
 
 import { CODEX_CUSTOM_MODEL_CATALOG_KIND, JAWCODE_CATALOG_AUGMENT_PROVIDERS, catalogModelSlug, shouldExposeRoutedModel } from "./parsing";
 import type { CatalogModel } from "./parsing";
-import { disabledNativeSlugs, hasComboTargets, isNativeOpenAiCapabilityAliasModel, NATIVE_GPT56_MAX_INPUT_TOKENS, nativeContextLimits, nativeDefaultReasoningEffort, nativeInputModalities, nativeOpenAiContextWindow, nativeOpenAiMaxInputTokens, nativeOpenAiSlugs, nativeParallelToolCalls, nativeReasoningEfforts } from "./metadata";
+import { disabledNativeSlugs, hasComboTargets, isNativeOpenAiCapabilityAliasModel, NATIVE_GPT56_MAX_INPUT_TOKENS, nativeContextLimits, nativeDefaultReasoningEffort, nativeInputModalities, nativeOpenAiAutoCompactTokenLimit, nativeOpenAiContextWindow, nativeOpenAiMaxInputTokens, nativeOpenAiSlugs, nativeParallelToolCalls, nativeReasoningEfforts } from "./metadata";
 import { deriveComboCatalogModel, normalizedOpenAiApiSignature, openAiApiCollisionWarnings, replaceLastComboCatalogOmissions, warnUncataloguedComboOnce } from "./aggregation";
 import type { ComboCatalogOmission } from "./aggregation";
 import type { CatalogGatherProviderAuthEvidence } from "./filesystem-evidence";
@@ -571,6 +572,7 @@ function providerCatalogFingerprint(name: string, prov: OcxProviderConfig): Reco
     ctx: prov.contextWindow ?? null,
     ctxW: prov.modelContextWindows ?? null,
     maxIn: prov.modelMaxInputTokens ?? null,
+    autoCompact: prov.modelAutoCompactTokenLimits ?? null,
     inMod: prov.modelInputModalities ?? null,
     re: prov.modelReasoningEfforts ?? null,
     defRe: prov.modelDefaultReasoningEfforts ?? null,
@@ -625,6 +627,17 @@ export function configuredMaxInputTokens(prov: OcxProviderConfig, id: string): n
   return typeof configured === "number" && configured > 0 ? configured : undefined;
 }
 
+export function configuredAutoCompactTokenLimit(
+  prov: OcxProviderConfig | undefined,
+  id: string,
+): number | undefined {
+  if (!prov) return undefined;
+  const configured = modelRecordValue(prov.modelAutoCompactTokenLimits, id);
+  return typeof configured === "number" && Number.isSafeInteger(configured) && configured > 0
+    ? configured
+    : undefined;
+}
+
 function configuredReasoningSummarySupport(prov: OcxProviderConfig | undefined, id: string): boolean | undefined {
   if (!prov) return undefined;
   const explicit = modelRecordValue(prov.modelSupportsReasoningSummaries, id);
@@ -636,6 +649,7 @@ export function applyProviderConfigHints(name: string, prov: OcxProviderConfig,
   void name;
   const configuredCap = configuredContextWindow(prov, model.id);
   const configuredMaxInput = configuredMaxInputTokens(prov, model.id);
+  const configuredAutoCompact = configuredAutoCompactTokenLimit(prov, model.id);
   let inputModalities = configuredInputModalities(prov, model.id);
   // Vision-sidecar coverage: `noVisionModels` marks models whose images the PROXY describes
   // (src/vision/index.ts). The catalog must still advertise image input for them — the Codex app
@@ -689,10 +703,31 @@ export function applyProviderConfigHints(name: string, prov: OcxProviderConfig,
     ...(prov.codexToolMode !== undefined ? { codexToolMode: prov.codexToolMode } : {}),
   };
   const capped = applyProviderContextCap(hinted.contextWindow, providerCap);
-  if (providerCap !== undefined && capped !== hinted.contextWindow) {
-    return { ...hinted, contextWindow: capped, contextCap: providerCap, contextCapped: true };
-  }
-  return providerCap !== undefined ? { ...hinted, contextCap: providerCap, contextCapped: false } : hinted;
+  const withCap = providerCap !== undefined
+    ? capped !== hinted.contextWindow
+      ? { ...hinted, contextWindow: capped, contextCap: providerCap, contextCapped: true }
+      : { ...hinted, contextCap: providerCap, contextCapped: false }
+    : hinted;
+  const contextWindow = typeof withCap.contextWindow === "number" && withCap.contextWindow > 0
+    ? withCap.contextWindow
+    : undefined;
+  const boundedMaxInput = typeof withCap.maxInputTokens === "number" && withCap.maxInputTokens > 0
+    ? (contextWindow !== undefined ? Math.min(withCap.maxInputTokens, contextWindow) : withCap.maxInputTokens)
+    : undefined;
+  const withHardBounds = boundedMaxInput !== undefined && boundedMaxInput !== withCap.maxInputTokens
+    ? { ...withCap, maxInputTokens: boundedMaxInput }
+    : withCap;
+  const softCandidates = [model.autoCompactTokenLimit, configuredAutoCompact]
+    .filter((value): value is number => typeof value === "number" && value > 0);
+  if (contextWindow === undefined || softCandidates.length === 0) return withHardBounds;
+  return {
+    ...withHardBounds,
+    autoCompactTokenLimit: clampAutoCompactTokenLimit(
+      contextWindow,
+      boundedMaxInput,
+      Math.min(...softCandidates),
+    ),
+  };
 }
 
 export function catalogHintsFromProviderConfig(name: string, prov: OcxProviderConfig, id: string, contextCap?: number): Partial<CatalogModel> {
@@ -719,6 +754,7 @@ interface ComboCatalogMemberFallback {
   readonly contextWindow?: number;
   /** Input ceiling when it is lower than the window (native GPT-5.6: 922k under 1.05M). */
   readonly maxInputTokens?: number;
+  readonly autoCompactTokenLimit?: number;
   readonly inputModalities?: readonly string[];
   readonly reasoningEfforts?: readonly string[];
 }
@@ -747,26 +783,33 @@ export function resolveComboCatalogMember(
   if (prov?.disabled === true) return undefined;
 
   const withFallbackMetadata = (member: CatalogModel): CatalogModel => {
-    if (!fallback) return member;
     const contextWindow = typeof member.contextWindow === "number" && member.contextWindow > 0
       ? member.contextWindow
       : undefined;
-    const addMaxInput = contextWindow !== undefined
+    const addMaxInput = fallback !== undefined && contextWindow !== undefined
       && !(typeof member.maxInputTokens === "number" && member.maxInputTokens > 0);
+    const effectiveMaxInput = addMaxInput
+      ? Math.min(fallback?.maxInputTokens ?? contextWindow!, contextWindow!)
+      : member.maxInputTokens;
+    const softCandidates = [member.autoCompactTokenLimit, fallback?.autoCompactTokenLimit]
+      .filter((value): value is number => typeof value === "number" && value > 0);
+    const autoCompactTokenLimit = contextWindow !== undefined && softCandidates.length > 0
+      ? clampAutoCompactTokenLimit(contextWindow, effectiveMaxInput, Math.min(...softCandidates))
+      : member.autoCompactTokenLimit;
+    const adjustAutoCompact = autoCompactTokenLimit !== member.autoCompactTokenLimit;
     const addModalities = (!Array.isArray(member.inputModalities) || member.inputModalities.length === 0)
-      && fallback.inputModalities !== undefined;
+      && fallback?.inputModalities !== undefined;
     const addReasoning = member.reasoningEfforts === undefined
-      && fallback.reasoningEfforts !== undefined;
-    if (!addMaxInput && !addModalities && !addReasoning) return member;
+      && fallback?.reasoningEfforts !== undefined;
+    if (!addMaxInput && !adjustAutoCompact && !addModalities && !addReasoning) return member;
     return {
       ...member,
       // Never claim a larger input budget than the window, and prefer the model's own
       // measured ceiling when the fallback carries one.
-      ...(addMaxInput
-        ? { maxInputTokens: Math.min(fallback.maxInputTokens ?? contextWindow!, contextWindow!) }
-        : {}),
-      ...(addModalities ? { inputModalities: [...fallback.inputModalities!] } : {}),
-      ...(addReasoning ? { reasoningEfforts: [...fallback.reasoningEfforts!] } : {}),
+      ...(addMaxInput ? { maxInputTokens: effectiveMaxInput } : {}),
+      ...(adjustAutoCompact && autoCompactTokenLimit !== undefined ? { autoCompactTokenLimit } : {}),
+      ...(addModalities ? { inputModalities: [...fallback!.inputModalities!] } : {}),
+      ...(addReasoning ? { reasoningEfforts: [...fallback!.reasoningEfforts!] } : {}),
     };
   };
 
@@ -847,6 +890,20 @@ export function resolveComboCatalogMember(
   const maxInputTokens = effectiveMaxInput !== undefined
     ? Math.min(effectiveMaxInput, contextWindow)
     : contextWindow;
+  const softCandidates = [
+    hinted.autoCompactTokenLimit,
+    base.autoCompactTokenLimit,
+    fallback?.autoCompactTokenLimit,
+    configuredAutoCompactTokenLimit(prov, target.model),
+  ].filter((value): value is number => typeof value === "number" && value > 0);
+  // A generic 128k synthesis is a catalog compatibility fallback, not evidence
+  // that a configured soft policy has an authoritative window to clamp against.
+  const hasAuthoritativeAutoCompactBasis = hintedContext !== undefined
+    || fallbackContext !== undefined
+    || contextCap !== undefined;
+  const autoCompactTokenLimit = hasAuthoritativeAutoCompactBasis && softCandidates.length > 0
+    ? clampAutoCompactTokenLimit(contextWindow, maxInputTokens, Math.min(...softCandidates))
+    : undefined;
 
   return {
     ...hinted,
@@ -854,6 +911,7 @@ export function resolveComboCatalogMember(
     ...(reasoningEfforts !== undefined ? { reasoningEfforts } : {}),
     contextWindow,
     maxInputTokens,
+    ...(autoCompactTokenLimit !== undefined ? { autoCompactTokenLimit } : {}),
     ...(fallbackCapped ? { contextCap, contextCapped: true as const } : {}),
   };
 }
@@ -1774,6 +1832,7 @@ async function gatherRoutedModelsUncached(
         // stay separate fields because routed/API rows of the same family run a wider window.
         // Falls back to the window for slugs with no separate ceiling.
         maxInputTokens: Math.min(nativeOpenAiMaxInputTokens(slug, openaiContextCap) ?? contextWindow, contextWindow),
+        autoCompactTokenLimit: nativeOpenAiAutoCompactTokenLimit(slug, openaiContextCap),
         inputModalities: nativeInputModalities(slug),
         reasoningEfforts: nativeReasoningEfforts(slug),
         ...(nativeParallelToolCalls(slug) ? { parallelToolCalls: true } : {}),
@@ -1790,18 +1849,23 @@ async function gatherRoutedModelsUncached(
   for (const id of listComboIds(config)) {
     const combo = getCombo(config, id);
     if (!combo) continue;
+    const comboNativeLimits = nativeContextLimits(config);
     const nativeContextWindow = combo.nativeAlias && combo.alias
-      ? nativeOpenAiContextWindow(combo.alias, nativeContextLimits(config))
+      ? nativeOpenAiContextWindow(combo.alias, comboNativeLimits)
       : undefined;
     const nativeAliasMaxInput = combo.nativeAlias && combo.alias
       ? (combo.alias.startsWith("gpt-5.6-") || combo.alias.includes("daybreak")
         ? NATIVE_GPT56_MAX_INPUT_TOKENS
         : nativeOpenAiMaxInputTokens(combo.alias) ?? nativeOpenAiContextWindow(combo.alias))
       : undefined;
+    const nativeAliasAutoCompact = combo.nativeAlias && combo.alias
+      ? nativeOpenAiAutoCompactTokenLimit(combo.alias, comboNativeLimits)
+      : undefined;
     const nativeAliasFallback = combo.nativeAlias && combo.alias && nativeContextWindow !== undefined
       ? {
         contextWindow: nativeContextWindow,
         ...(nativeAliasMaxInput !== undefined ? { maxInputTokens: nativeAliasMaxInput } : {}),
+        ...(nativeAliasAutoCompact !== undefined ? { autoCompactTokenLimit: nativeAliasAutoCompact } : {}),
         inputModalities: nativeInputModalities(combo.alias),
         reasoningEfforts: nativeReasoningEfforts(combo.alias),
       }
@@ -1864,9 +1928,23 @@ async function gatherRoutedModelsUncached(
     const nativeAliasMaxInputTokens = codexForwardNativeCapabilityAlias
       ? nativeOpenAiMaxInputTokens(cm.modelId, customNativeLimits)
       : undefined;
-    const customMaxInputTokens = nativeAliasMaxInputTokens !== undefined && customContextWindow !== undefined
-      ? Math.min(nativeAliasMaxInputTokens, customContextWindow)
-      : nativeAliasMaxInputTokens;
+    const configuredMaxInput = rawProvider
+      ? configuredMaxInputTokens(rawProvider, cm.modelId)
+      : undefined;
+    const hardMaxCandidates = [nativeAliasMaxInputTokens, configuredMaxInput]
+      .filter((value): value is number => typeof value === "number" && value > 0);
+    const customMaxInputTokens = hardMaxCandidates.length > 0
+      ? Math.min(
+        ...hardMaxCandidates,
+        ...(customContextWindow !== undefined ? [customContextWindow] : []),
+      )
+      : undefined;
+    const configuredAutoCompact = configuredAutoCompactTokenLimit(rawProvider, cm.modelId);
+    const customAutoCompactTokenLimit = codexForwardNativeCapabilityAlias
+      ? nativeOpenAiAutoCompactTokenLimit(cm.modelId, customNativeLimits)
+      : customContextWindow !== undefined && configuredAutoCompact !== undefined
+        ? clampAutoCompactTokenLimit(customContextWindow, customMaxInputTokens, configuredAutoCompact)
+        : undefined;
     const nativeAliasDefaultEffort = codexForwardNativeCapabilityAlias
       ? nativeDefaultReasoningEffort(cm.modelId)
       : undefined;
@@ -1887,6 +1965,7 @@ async function gatherRoutedModelsUncached(
         : codexForwardNativeCapabilityAlias ? { displayName: "Daybreak Blue" } : {}),
       ...(customContextWindow !== undefined ? { contextWindow: customContextWindow } : {}),
       ...(customMaxInputTokens !== undefined ? { maxInputTokens: customMaxInputTokens } : {}),
+      ...(customAutoCompactTokenLimit !== undefined ? { autoCompactTokenLimit: customAutoCompactTokenLimit } : {}),
       ...(cm.inputModalities
         ? { inputModalities: cm.inputModalities }
         : codexForwardNativeCapabilityAlias ? { inputModalities: nativeInputModalities(cm.modelId) } : {}),
@@ -1932,10 +2011,18 @@ async function gatherRoutedModelsUncached(
     // along when it is actually a member — otherwise a provider default like "xhigh" would
     // re-apply onto a narrower custom ladder and override the fallback in applyReasoningLevels.
     const effectiveLadder = base.reasoningEfforts ?? replaced?.reasoningEfforts;
+    const mergedMaxInputCandidates = [base.maxInputTokens, replaced?.maxInputTokens]
+      .filter((value): value is number => typeof value === "number" && value > 0);
+    const mergedMaxInput = mergedMaxInputCandidates.length > 0
+      ? Math.min(...mergedMaxInputCandidates)
+      : undefined;
     const merged: CatalogModel = replaced ? {
       ...base,
       ...(base.contextWindow === undefined && replaced.contextWindow !== undefined ? { contextWindow: replaced.contextWindow } : {}),
-      ...(base.maxInputTokens === undefined && replaced.maxInputTokens !== undefined ? { maxInputTokens: replaced.maxInputTokens } : {}),
+      ...(mergedMaxInput !== undefined ? { maxInputTokens: mergedMaxInput } : {}),
+      ...(base.autoCompactTokenLimit === undefined && replaced.autoCompactTokenLimit !== undefined
+        ? { autoCompactTokenLimit: replaced.autoCompactTokenLimit }
+        : {}),
       ...(base.inputModalities === undefined && replaced.inputModalities !== undefined ? { inputModalities: replaced.inputModalities } : {}),
       ...(base.reasoningEfforts === undefined && replaced.reasoningEfforts !== undefined ? { reasoningEfforts: replaced.reasoningEfforts } : {}),
       ...(base.defaultReasoningEffort === undefined && replaced.defaultReasoningEffort !== undefined
@@ -1952,14 +2039,36 @@ async function gatherRoutedModelsUncached(
     // (#349/#344). Deliberately NOT the full applyProviderConfigHints pass — custom rows are a
     // user override, so their explicit contextWindow / inputModalities / reasoning fields must be
     // preserved verbatim (the hint pass would cap context and overwrite modalities from registry).
+    const mergedContext = typeof merged.contextWindow === "number" && merged.contextWindow > 0
+      ? merged.contextWindow
+      : undefined;
+    const boundedMergedMaxInput = typeof merged.maxInputTokens === "number" && merged.maxInputTokens > 0
+      ? (mergedContext !== undefined ? Math.min(merged.maxInputTokens, mergedContext) : merged.maxInputTokens)
+      : undefined;
+    const mergedWithHardBounds = boundedMergedMaxInput !== undefined
+      && boundedMergedMaxInput !== merged.maxInputTokens
+      ? { ...merged, maxInputTokens: boundedMergedMaxInput }
+      : merged;
+    const mergedSoftCandidates = [mergedWithHardBounds.autoCompactTokenLimit, configuredAutoCompact]
+      .filter((value): value is number => typeof value === "number" && value > 0);
+    const mergedWithAutoCompact: CatalogModel = mergedContext !== undefined && mergedSoftCandidates.length > 0
+      ? {
+        ...mergedWithHardBounds,
+        autoCompactTokenLimit: clampAutoCompactTokenLimit(
+          mergedContext,
+          boundedMergedMaxInput,
+          Math.min(...mergedSoftCandidates),
+        ),
+      }
+      : mergedWithHardBounds;
     const enrichedProvider = enrichedByName.get(cm.provider) ?? rawProvider;
-    if (enrichedProvider && modelInList(enrichedProvider.noVisionModels, merged.id)) {
-      const current = merged.inputModalities ?? ["text"];
+    if (enrichedProvider && modelInList(enrichedProvider.noVisionModels, mergedWithAutoCompact.id)) {
+      const current = mergedWithAutoCompact.inputModalities ?? ["text"];
       if (!current.includes("image")) {
-        return { ...merged, inputModalities: [...current, "image"] };
+        return { ...mergedWithAutoCompact, inputModalities: [...current, "image"] };
       }
     }
-    return merged;
+    return mergedWithAutoCompact;
   });
   // Custom rows override discovered rows that encode to the same Codex-facing slug.
   const customKeys = new Set(customModels.map(c => routedSlug(c.provider, c.id)));
@@ -2015,7 +2124,15 @@ function augmentRoutedModelsWithCapturedOpenAiApiRows(
       ? Math.min(officialContext, userContext ?? officialContext, providerCap ?? officialContext)
       : undefined;
     const maxInputTokens = typeof officialMaxInput === "number"
-      ? Math.min(officialMaxInput, userMaxInput ?? officialMaxInput)
+      ? Math.min(
+        officialMaxInput,
+        userMaxInput ?? officialMaxInput,
+        contextWindow ?? officialMaxInput,
+      )
+      : undefined;
+    const configuredAutoCompact = configuredAutoCompactTokenLimit(configured, id);
+    const autoCompactTokenLimit = contextWindow !== undefined && configuredAutoCompact !== undefined
+      ? clampAutoCompactTokenLimit(contextWindow, maxInputTokens, configuredAutoCompact)
       : undefined;
     return {
       provider: OPENAI_API_PROVIDER_ID,
@@ -2023,6 +2140,7 @@ function augmentRoutedModelsWithCapturedOpenAiApiRows(
       owned_by: OPENAI_API_PROVIDER_ID,
       ...(contextWindow ? { contextWindow } : {}),
       ...(maxInputTokens ? { maxInputTokens } : {}),
+      ...(autoCompactTokenLimit !== undefined ? { autoCompactTokenLimit } : {}),
       ...(policy.modelInputModalities?.[id] ? { inputModalities: [...policy.modelInputModalities[id]!] } : {}),
       ...(policy.modelReasoningEfforts?.[id] ? { reasoningEfforts: [...policy.modelReasoningEfforts[id]!] } : {}),
     };

package/src/codex/catalog/sync.ts

@@ -1158,7 +1158,7 @@ export function mergeCatalogEntriesForSync(
       isNativeAliasCatalogEntry(entry) && typeof entry.slug === "string" ? [entry.slug] : []
     )),
   ),
-  openaiContextCap?: number,
+  openaiContextCap?: NativeContextLimitsInput,
   keepNativeChatGptOnV1 = false,
 ): RawEntry[] {
   // Retained for source compatibility with the original helper contract. Raw provider ids must

package/src/codex/convergence.ts

@@ -54,6 +54,7 @@ import {
   disabledNativeSlugs,
   desktopAllowlistSuppressedNativeSlugs,
   NATIVE_OPENAI_MODELS,
+  nativeContextLimits,
   shouldIncludeAccountBoundNativeOpenAi,
   shouldIncludeNativeOpenAi,
 } from "./catalog/metadata";
@@ -286,6 +287,7 @@ function prepareCatalog(
   // selector-qualified rows when a live selector is configured.
   const observedNativeSlugs: string[] = [];
   const disabledNative = disabledNativeSlugs(config);
+  const openaiContextCap = nativeContextLimits(config);
   const nativeCatalogModels = mergeCatalogModelsWithNativeRecovery(
     active?.models ?? catalog.models ?? [],
     [catalog.models ?? [], ...nativeRecoverySources],
@@ -304,6 +306,7 @@ function prepareCatalog(
     suppressedBareNativeSlugs,
     disabledNativeAccountSlugs: new Set(),
     multiAgentV2Enabled,
+    openaiContextCap,
   });
   const accountBoundEntries = accountSelectors.length === 0
     ? []
@@ -320,6 +323,7 @@ function prepareCatalog(
       disabledNativeAccountSlugs: new Set([...disabledNative].filter(slug => suppressedBareNativeSlugs.has(slug))),
       multiAgentV2Enabled,
       keepNativeChatGptOnV1: config.keepNativeChatGptOnV1 === true,
+      openaiContextCap,
       accountNativeSlugs,
       accountNativeSlugsBySelector,
     }).filter(entry => trustedAccountBoundNativeCatalogSlug(entry) !== undefined);
@@ -352,6 +356,7 @@ function prepareCatalog(
     includeNativeOpenAi,
     accountBoundEntries,
     suppressedBareNativeSlugs,
+    openaiContextCap,
     policy: {
       ...CANONICAL_NATIVE_CATALOG_CONTENT_POLICY,
       nativeBackfillSlugs: [...availableBareNativeSlugs, ...observedNativeSlugs],

package/src/codex/shim.ts

@@ -603,6 +603,47 @@ function backupPathFor(path: string): string {
   return ext ? `${path.slice(0, -ext.length)}.opencodex-real${ext}` : `${path}.opencodex-real`;
 }
 
+/**
+ * True when a Codex binary lives inside a version manager's install tree.
+ *
+ * These trees are rewritten in place on upgrade, which destroys both the shim
+ * and the sibling .opencodex-real backup it restores from (#2412). The tempting
+ * repair — adopt the newly installed binary as a fresh original — is wrong
+ * twice: it records a provenance that never happened, and the next upgrade wipes
+ * it again, so the repair silently un-repairs on the version manager's schedule.
+ *
+ * Scope is the three managers named in the report. nvm/fnm/npm-prefix are
+ * deliberately excluded: a false positive here refuses a restore that would
+ * otherwise be correct.
+ */
+export function isVersionManagerOwnedCodexPath(path: string): boolean {
+  const normalized = path.replace(/\\/g, "/").toLowerCase();
+  return normalized.includes("/mise/installs/")
+    || normalized.includes("/mise/shims/")
+    || normalized.includes("/.asdf/installs/")
+    || normalized.includes("/.asdf/shims/")
+    || normalized.includes("/.volta/");
+}
+
+/**
+ * Why auto-restore refused, in the operator's own terms. Auto-restore used to
+ * return a bare `{ status: "ineligible" }`, and the CLI warns only when a
+ * message is present, so `ocx start`, `ocx ensure`, and `ocx service repair` all
+ * reported success while routing quietly stayed native (#2412, the cause behind
+ * the misleading green status in #2411).
+ */
+function destroyedShimMessage(file: ShimFileState): string {
+  const wrapper = existsSync(file.wrapperPath)
+    ? isShim(file.wrapperPath) ? "present but unusable" : "present but not an opencodex shim"
+    : "missing";
+  const backup = existsSync(file.backupPath) ? "present" : "missing";
+  const base = `Codex autostart shim not restored: wrapper ${wrapper} at ${file.wrapperPath}; original backup ${backup} at ${file.backupPath}.`;
+  if (!isVersionManagerOwnedCodexPath(file.wrapperPath)) {
+    return `${base} Re-run 'ocx codex-shim install' once the Codex binary is stable.`;
+  }
+  return `${base} This Codex binary is owned by a version manager (mise/asdf/volta), so opencodex will not wrap it as a new original — the next upgrade would overwrite the shim and its backup again. Route through Codex instead with 'ocx start', and use 'ocx service install' for autostart.`;
+}
+
 function shQuote(value: string): string {
   return `'${value.replace(/'/g, "'\\''")}'`;
 }
@@ -2039,14 +2080,20 @@ export function autoRestoreCodexShim(options: {
     if (seen.has(file.wrapperPath)) return { status: "ineligible" };
     seen.add(file.wrapperPath);
     if (file.preserveOnly) {
-      if (!existsSync(file.backupPath) || existsSync(file.originalPath)) return { status: "ineligible" };
+      if (!existsSync(file.backupPath) || existsSync(file.originalPath)) {
+        return { status: "ineligible", message: destroyedShimMessage(file) };
+      }
       continue;
     }
-    if (!existsSync(file.wrapperPath) || !hasUsableBackingPath(file)) return { status: "ineligible" };
+    if (!existsSync(file.wrapperPath) || !hasUsableBackingPath(file)) {
+      return { status: "ineligible", message: destroyedShimMessage(file) };
+    }
     const probe = stableShimPathProbe(file.wrapperPath);
     if (!probe) return { status: "deferred" };
     if (probe.prefix.includes(SHIM_MARKER)) {
-      if (!isHealthyShimProbe(probe, state.platform)) return { status: "ineligible" };
+      if (!isHealthyShimProbe(probe, state.platform)) {
+        return { status: "ineligible", message: destroyedShimMessage(file) };
+      }
       if (state.platform !== "win32" && !isCurrentUnixShimProbe(probe)) {
         obsoleteShimProbes.set(file.wrapperPath, probe);
         continue;
@@ -2054,6 +2101,12 @@ export function autoRestoreCodexShim(options: {
       healthyCount += 1;
       continue;
     }
+    // A surviving backup would otherwise let the replacement path below wrap the
+    // version manager's NEW binary as a fresh original — the same adoption the
+    // missing-backup case refuses, arriving through the back door.
+    if (isVersionManagerOwnedCodexPath(file.wrapperPath)) {
+      return { status: "ineligible", message: destroyedShimMessage(file) };
+    }
     replacementProbes.set(file.wrapperPath, probe);
   }
 

package/src/config.ts

@@ -73,6 +73,7 @@ import {
   type ProviderCostOverlay,
 } from "./types";
 import { OPENAI_CODEX_PROVIDER_ID } from "./providers/openai-tiers";
+import { modelAutoCompactTokenLimitsConfigError } from "./providers/auto-compact-budget";
 import { fastWireDeclarationError, hasFastWireCapabilityConflict } from "./providers/fastwire";
 import {
   getProviderRegistryEntry,
@@ -866,6 +867,9 @@ const configSchema = z.object({
   defaultProvider: z.string().min(1).default("openai"),
   // A retry can be billable, so absence and malformed hand edits both stay off.
   emptyCompletionRetry: z.boolean().optional().catch(false),
+  // A malformed hand edit must not silently stop opening the browser: fall back
+  // to undefined, which resolves to the historical auto-open behavior.
+  oauthOpenBrowser: z.boolean().optional().catch(undefined),
   openaiProviderTierVersion: z.union([z.literal(1), z.literal(2)]).optional(),
   // Invalid hand edits must not discard an otherwise usable config.
   googleAntigravityStaticCatalogVersion: z.union([z.literal(1), z.literal(2)]).optional().catch(undefined),
@@ -1101,6 +1105,17 @@ const configSchema = z.object({
         message: maxInputError,
       });
     }
+    const autoCompactError = modelAutoCompactTokenLimitsConfigError(
+      (provider as { modelAutoCompactTokenLimits?: unknown }).modelAutoCompactTokenLimits,
+      { requireNativeIds: name === OPENAI_CODEX_PROVIDER_ID },
+    );
+    if (autoCompactError) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["providers", redactSecretString(name), "modelAutoCompactTokenLimits"],
+        message: autoCompactError,
+      });
+    }
     const reasoningSummariesError = booleanRecordConfigError(
       (provider as { modelSupportsReasoningSummaries?: unknown }).modelSupportsReasoningSummaries,
       "modelSupportsReasoningSummaries",
@@ -2040,6 +2055,14 @@ function emptyCompletionRetryError(value: unknown): string | null {
   return "schema_invalid: emptyCompletionRetry: must be a boolean or omitted";
 }
 
+function oauthOpenBrowserError(value: unknown): string | null {
+  const raw = rawConfigRecord(value);
+  if (!raw || !Object.hasOwn(raw, "oauthOpenBrowser")) return null;
+  const enabled = raw.oauthOpenBrowser;
+  if (enabled === undefined || typeof enabled === "boolean") return null;
+  return "schema_invalid: oauthOpenBrowser: must be a boolean or omitted";
+}
+
 /** Validate an in-memory config candidate without touching disk. Used by headless CLI import/set. */
 /**
  * Reject a loopback-listener port that collides with the proxy port (#1102).
@@ -2089,6 +2112,7 @@ export function validateConfigCandidate(value: unknown): { ok: true; config: Ocx
     ?? codexAccountPrioritiesError(value)
     ?? codexAccountPickerEnabledError(value)
     ?? emptyCompletionRetryError(value)
+    ?? oauthOpenBrowserError(value)
     ?? loopbackListenerPortError(value);
   if (boundaryError) return { ok: false, error: boundaryError };
   const result = configSchema.safeParse(value);