@bitkyc08/opencodex 2.42.0 → 2.43.0

package/src/codex/log-guard/inspect.ts

@@ -8,6 +8,8 @@ import {
   resolveCodexSqliteHome,
   type CodexSqliteHomeDeps,
 } from "../paths";
+export { hasCurrentLogsSchema } from "./inspect-schema";
+import { hasCurrentLogsTable, type ColumnRow } from "./inspect-schema";
 
 const IMMUTABLE_READONLY_FLAGS = constants.SQLITE_OPEN_READONLY | constants.SQLITE_OPEN_URI;
 const KNOWN_LOG_LEVELS = new Set(["TRACE", "DEBUG", "INFO", "WARN", "ERROR"]);
@@ -15,56 +17,6 @@ const KNOWN_LOG_LEVELS = new Set(["TRACE", "DEBUG", "INFO", "WARN", "ERROR"]);
 // alone; skipping all row aggregates above 64 MiB reduced /api/storage to 628ms.
 const MAX_SYNCHRONOUS_METRICS_DATABASE_BYTES = 64 * 1024 * 1024;
 
-interface CurrentLogColumn {
-  name: string;
-  type: string;
-  notnull: number;
-  defaultValue: string | null;
-  pk: number;
-}
-
-// Pinned to Codex logs migration 0002. Keep this schema private: inspection reports
-// compatibility, not column names, so sensitive payload-bearing fields never leak through
-// the management API. Any additive/rebuilt future schema is monitor-only until reviewed.
-const CURRENT_LOG_SCHEMA: readonly CurrentLogColumn[] = [
-  { name: "id", type: "INTEGER", notnull: 0, defaultValue: null, pk: 1 },
-  { name: "ts", type: "INTEGER", notnull: 1, defaultValue: null, pk: 0 },
-  { name: "ts_nanos", type: "INTEGER", notnull: 1, defaultValue: null, pk: 0 },
-  { name: "level", type: "TEXT", notnull: 1, defaultValue: null, pk: 0 },
-  { name: "target", type: "TEXT", notnull: 1, defaultValue: null, pk: 0 },
-  { name: "feedback_log_body", type: "TEXT", notnull: 0, defaultValue: null, pk: 0 },
-  { name: "module_path", type: "TEXT", notnull: 0, defaultValue: null, pk: 0 },
-  { name: "file", type: "TEXT", notnull: 0, defaultValue: null, pk: 0 },
-  { name: "line", type: "INTEGER", notnull: 0, defaultValue: null, pk: 0 },
-  { name: "thread_id", type: "TEXT", notnull: 0, defaultValue: null, pk: 0 },
-  { name: "process_uuid", type: "TEXT", notnull: 0, defaultValue: null, pk: 0 },
-  { name: "estimated_bytes", type: "INTEGER", notnull: 1, defaultValue: "0", pk: 0 },
-] as const;
-
-const CURRENT_LOG_TABLE_SQL = `CREATE TABLE logs (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  ts INTEGER NOT NULL,
-  ts_nanos INTEGER NOT NULL,
-  level TEXT NOT NULL,
-  target TEXT NOT NULL,
-  feedback_log_body TEXT,
-  module_path TEXT,
-  file TEXT,
-  line INTEGER,
-  thread_id TEXT,
-  process_uuid TEXT,
-  estimated_bytes INTEGER NOT NULL DEFAULT 0
-)`;
-
-const CURRENT_LOG_INDEX_SQL = {
-  idx_logs_ts: "CREATE INDEX idx_logs_ts ON logs(ts DESC, ts_nanos DESC, id DESC)",
-  idx_logs_thread_id: "CREATE INDEX idx_logs_thread_id ON logs(thread_id)",
-  idx_logs_thread_id_ts: "CREATE INDEX idx_logs_thread_id_ts ON logs(thread_id, ts DESC, ts_nanos DESC, id DESC)",
-  idx_logs_process_uuid_threadless_ts: `CREATE INDEX idx_logs_process_uuid_threadless_ts
-    ON logs(process_uuid, ts DESC, ts_nanos DESC, id DESC)
-    WHERE thread_id IS NULL`,
-} as const;
-
 export type CodexLogGuardCapabilityReason =
   | "database_missing"
   | "database_unreadable"
@@ -124,15 +76,6 @@ export interface CodexLogGuardInspection {
   };
 }
 
-interface ColumnRow {
-  cid: number;
-  name: string;
-  type: string;
-  notnull: number;
-  dflt_value: string | null;
-  pk: number;
-}
-interface SchemaObjectRow { name: string; type: string; sql: string | null }
 interface CountRow { n: number }
 interface LevelRow { level: string; rows: number }
 interface TargetCountRow { rows: number }
@@ -243,81 +186,6 @@ function unavailableInspection(): CodexLogGuardInspection {
   };
 }
 
-function normalizeDeclaredType(type: string): string {
-  return String(type ?? "").trim().toUpperCase();
-}
-
-function normalizeDefault(value: string | null): string | null {
-  return value === null ? null : String(value).trim();
-}
-
-function normalizeSchemaSql(sql: string | null | undefined): string {
-  return (sql ?? "").trim().replace(/;\s*$/, "").replace(/\s+/g, " ");
-}
-
-function sameColumns(columns: ColumnRow[]): boolean {
-  if (columns.length !== CURRENT_LOG_SCHEMA.length) return false;
-  return columns.every((column, index) => {
-    const expected = CURRENT_LOG_SCHEMA[index];
-    return column.cid === index
-      && column.name === expected.name
-      && normalizeDeclaredType(column.type) === expected.type
-      && Number(column.notnull) === expected.notnull
-      && normalizeDefault(column.dflt_value) === expected.defaultValue
-      && Number(column.pk) === expected.pk;
-  });
-}
-
-/**
- * The authoritative compatibility predicate: exact table SQL, exact column
- * metadata, and every canonical index.
- *
- * Exported because the mutation paths must apply the SAME test inside their
- * write transaction. They used to check column NAMES only, which is strictly
- * weaker than what the inspector reports, so a schema change landing between
- * the outer inspection and the locked write let Protect install a row-dropping
- * trigger and let Reclaim vacuum pages on a database the inspector classifies
- * as monitor-only. The lock serializes OpenCodex against itself; it does not
- * stop Codex or another SQLite writer, so that TOCTOU window is real.
- */
-export function hasCurrentLogsSchema(db: Database): boolean {
-  const columns = db.query<ColumnRow, []>("PRAGMA table_info(logs)").all();
-  return hasCurrentLogsTable(db, columns);
-}
-
-function hasCurrentLogsTable(db: Database, columns: ColumnRow[]): boolean {
-  const table = db.query<SchemaObjectRow, []>(
-    "SELECT name, type, sql FROM sqlite_schema WHERE name = 'logs' LIMIT 1",
-  ).get();
-  if (table?.type !== "table"
-    || !sameColumns(columns)
-    || normalizeSchemaSql(table.sql) !== normalizeSchemaSql(CURRENT_LOG_TABLE_SQL)) {
-    return false;
-  }
-
-  const indexes = db.query<SchemaObjectRow, []>(`
-    SELECT name, type, sql FROM sqlite_schema
-    WHERE name IN (
-      'idx_logs_ts',
-      'idx_logs_thread_id',
-      'idx_logs_thread_id_ts',
-      'idx_logs_process_uuid_threadless_ts'
-    )
-  `).all();
-  const byName = new Map(indexes.map(row => [row.name, row]));
-  for (const [name, expectedSql] of Object.entries(CURRENT_LOG_INDEX_SQL)) {
-    const row = byName.get(name);
-    if (row?.type !== "index" || normalizeSchemaSql(row.sql) !== normalizeSchemaSql(expectedSql)) {
-      return false;
-    }
-  }
-
-  // Extra indexes and triggers do not redefine the table contract. In particular,
-  // Protect intentionally installs OpenCodex-owned triggers and unrelated user triggers
-  // are supported, so compatibility is based on the canonical table plus required indexes.
-  return true;
-}
-
 function pragmaNumber(db: Database, pragma: "page_size" | "page_count" | "freelist_count"): number {
   const row = db.query<Record<string, number>, []>(`PRAGMA ${pragma}`).get();
   return Number(row?.[pragma] ?? 0);

package/src/codex/loopback-target.ts

@@ -0,0 +1,54 @@
+import type { OcxConfig } from "../types";
+import type { DataPlaneAdmission } from "../server/auth-cors";
+import { NATIVE_RESERVE_MODEL } from "./catalog/native-models";
+
+export const CODEX_RESERVE_HELPER_UNSUPPORTED_MESSAGE =
+  "Luna Reserve compatibility is only available as a conversation model, not a vision helper. Choose another vision model.";
+
+/** Callers classify the concrete destination as canonical forward before using this predicate. */
+export function isCodexReserveHelperUnsupported(
+  config: Pick<OcxConfig, "codexDesktopAuthless" | "runtimeRole">,
+  modelId: string,
+  admission: Pick<DataPlaneAdmission, "source"> | undefined,
+  terminalHelper: boolean,
+): boolean {
+  return terminalHelper && modelId === NATIVE_RESERVE_MODEL && isCodexReserveRequestEligible(config, admission);
+}
+
+/** Runtime authority comes from the receiving listener, not the catalog's injection target. */
+export function isCodexReserveRequestEligible(
+  config: Pick<OcxConfig, "codexDesktopAuthless" | "runtimeRole">,
+  admission: Pick<DataPlaneAdmission, "source"> | undefined,
+): boolean {
+  return config.codexDesktopAuthless === true && config.runtimeRole !== "client"
+    && admission?.source === "loopback";
+}
+
+/** Bind scope, not the dial address: wildcard listeners are never loopback-only. */
+export function isLoopbackHostname(hostname: string | undefined): boolean {
+  const normalized = (hostname ?? "127.0.0.1").trim().toLowerCase().replace(/\.$/, "");
+  return (
+    normalized === "" ||
+    normalized === "localhost" ||
+    normalized === "127.0.0.1" ||
+    normalized === "::1" ||
+    normalized === "[::1]"
+  );
+}
+
+export function shouldInjectApiAuthHeader(
+  config: Pick<OcxConfig, "hostname" | "unauthenticatedLoopbackListener"> | undefined,
+): boolean {
+  // The dedicated listener binds loopback and does not require an admission credential.
+  if (config?.unauthenticatedLoopbackListener?.enabled) return false;
+  return !isLoopbackHostname(config?.hostname);
+}
+
+/** Match standalone injection, never a remote client's independently supplied routing target. */
+export function isEffectiveCodexDesktopAuthless(
+  config: Pick<OcxConfig, "runtimeRole" | "hostname" | "unauthenticatedLoopbackListener" | "codexDesktopAuthless"> | undefined,
+): boolean {
+  return config?.codexDesktopAuthless === true
+    && config.runtimeRole !== "client"
+    && !shouldInjectApiAuthHeader(config);
+}

package/src/codex/main-account-cache.ts

@@ -1,4 +1,5 @@
-import type { StoredAccountQuota } from "./quota";
+import { createHash, createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import type { StoredAccountQuota } from "./quota-types";
 import { truncateRetainedUtf8 } from "../lib/admission";
 
 const MAX_DIAGNOSTIC_VALUE_BYTES = 8 * 1024;
@@ -16,6 +17,65 @@ export interface CachedMainAccountInfo extends MainAccountInfo {
 let cachedMainAccountInfo: CachedMainAccountInfo | null = null;
 let cachedMainCredentialPresence: boolean | null = null;
 let mainAccountIdentityGeneration = 0;
+let observedMainQuotaIdentityKey: string | undefined;
+const mainQuotaCredentialKey = randomBytes(32);
+let mainQuotaCredential: { bearerHmac: Buffer; writer: MainQuotaWriter } | undefined;
+let mainQuotaCredentialGeneration = 0;
+
+/** Process-local transition fence; no credential material or persisted identity. */
+export function getMainQuotaCredentialGeneration(): number { return mainQuotaCredentialGeneration; }
+
+export type MainQuotaWriter = Readonly<{ identityKey: string; identityGeneration: number }>;
+
+function mainQuotaIdentityKey(accountId: string): string {
+  return createHash("sha256").update("opencodex-main-quota-v1\0").update(accountId).digest("hex");
+}
+
+/** Only an existing owned physical-identity read may publish this observation. */
+export function observeMainQuotaIdentity(accountId: string): void {
+  if (!accountId) return;
+  const identityKey = mainQuotaIdentityKey(accountId);
+  if (identityKey === observedMainQuotaIdentityKey) return;
+  observedMainQuotaIdentityKey = identityKey;
+  mainAccountIdentityGeneration += 1;
+  mainQuotaCredential = undefined;
+  mainQuotaCredentialGeneration += 1;
+}
+
+export function captureMainQuotaWriter(accountId: string): MainQuotaWriter | undefined {
+  if (!accountId) return undefined;
+  const identityKey = mainQuotaIdentityKey(accountId);
+  if (identityKey !== observedMainQuotaIdentityKey) return undefined;
+  return { identityKey, identityGeneration: mainAccountIdentityGeneration };
+}
+
+/** Credential material must come from an already-owned read, never an incoming request. */
+export function observeMainQuotaCredential(accessToken: string, accountId: string): MainQuotaWriter | undefined {
+  const writer = captureMainQuotaWriter(accountId);
+  if (!accessToken || !writer) return undefined;
+  const bearerHmac = createHmac("sha256", mainQuotaCredentialKey).update(accessToken).digest();
+  if (!mainQuotaCredential || !isMainQuotaWriterLive(mainQuotaCredential.writer)
+    || !timingSafeEqual(bearerHmac, mainQuotaCredential.bearerHmac)) mainQuotaCredentialGeneration += 1;
+  mainQuotaCredential = { bearerHmac, writer };
+  return { ...writer };
+}
+
+export function matchesMainQuotaCredential(accessToken: string, effectiveAccountId: string | undefined): boolean {
+  const observed = mainQuotaCredential;
+  if (!accessToken || !effectiveAccountId || !observed || !isMainQuotaWriterLive(observed.writer)) return false;
+  if (mainQuotaIdentityKey(effectiveAccountId) !== observed.writer.identityKey) return false;
+  const candidate = createHmac("sha256", mainQuotaCredentialKey).update(accessToken).digest();
+  return timingSafeEqual(candidate, observed.bearerHmac);
+}
+
+export function isMainQuotaWriterLive(writer: MainQuotaWriter): boolean {
+  return writer.identityKey === observedMainQuotaIdentityKey
+    && writer.identityGeneration === mainAccountIdentityGeneration;
+}
+
+export function getObservedMainQuotaIdentityKey(): string | undefined {
+  return observedMainQuotaIdentityKey;
+}
 
 export function captureMainAccountIdentityGeneration(): number {
   return mainAccountIdentityGeneration;
@@ -40,6 +100,8 @@ export function setMainAccountInfoCache(value: CachedMainAccountInfo): void {
 export function clearMainAccountInfoCache(): void {
   cachedMainAccountInfo = null;
   mainAccountIdentityGeneration += 1;
+  mainQuotaCredential = undefined;
+  mainQuotaCredentialGeneration += 1;
 }
 
 /** Last physical credential presence observed while native-main ownership was held. */

package/src/codex/main-account-hard-lock.ts

@@ -0,0 +1,52 @@
+import type { OcxConfig } from "../types";
+import { getMainPolicyQuota } from "./quota";
+
+export const MAIN_ACCOUNT_HARD_LOCK_PERCENT = 99;
+
+export interface MainAccountHardLockStatus {
+  enabled: boolean;
+  state: "off" | "unknown" | "ready" | "blocked";
+  /** Unix milliseconds; absent when a blocking observation has no future reset. */
+  resetAt?: number;
+}
+
+type PolicyConfig = Pick<OcxConfig, "codexMainAccountHardLock">;
+
+function resetTimestamp(value: number | undefined): number | undefined {
+  if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) return undefined;
+  return value < 10_000_000_000 ? value * 1000 : value;
+}
+
+/** Observed admission policy, not a reservation of the account's remaining quota. */
+export function getMainAccountHardLockStatus(
+  config: PolicyConfig,
+  now = Date.now(),
+): MainAccountHardLockStatus {
+  if (config.codexMainAccountHardLock !== true) return { enabled: false, state: "off" };
+  const quota = getMainPolicyQuota();
+  if (!quota) return { enabled: true, state: "unknown" };
+  // Account window priority is deliberate: a 5h account uses that window, even if
+  // its weekly bar is higher. An unknown/expired selected window does not change the choice.
+  const hasShort = quota.shortPercent !== undefined || quota.shortResetAt !== undefined
+    || quota.shortWindowSeconds !== undefined;
+  const hasWeekly = quota.weeklyPercent !== undefined || quota.weeklyResetAt !== undefined;
+  const [percent, rawReset] = hasShort
+    ? [quota.shortPercent, quota.shortResetAt]
+    : hasWeekly ? [quota.weeklyPercent, quota.weeklyResetAt] : [quota.monthlyPercent, quota.monthlyResetAt];
+  const resetAt = resetTimestamp(rawReset);
+  // The routing score's unknown sentinel is 101. It is never a raw quota observation.
+  if (typeof percent !== "number" || !Number.isFinite(percent) || percent < 0 || percent > 100) {
+    return { enabled: true, state: "unknown" };
+  }
+  if (percent < MAIN_ACCOUNT_HARD_LOCK_PERCENT) return { enabled: true, state: "ready" };
+  return {
+    enabled: true,
+    state: "blocked",
+    // A predicted reset is not evidence of recovery. Only a fresh lower reading releases.
+    ...(resetAt !== undefined && resetAt > now ? { resetAt } : {}),
+  };
+}
+
+export function isMainAccountHardLocked(config: PolicyConfig, now = Date.now()): boolean {
+  return getMainAccountHardLockStatus(config, now).state === "blocked";
+}

package/src/codex/main-account.ts

@@ -57,6 +57,8 @@ type MainAuthJsonCredential = {
 export interface NativeMainRefreshDependencies {
   refreshToken?: (refreshToken: string, options: { signal: AbortSignal }) => Promise<OAuthCredentials>;
   signal?: AbortSignal;
+  /** Metadata-only refresh must not retract a concurrent traffic reauth quarantine. */
+  preserveReauth?: boolean;
 }
 
 export class MainAuthJsonChangedDuringRefreshError extends Error {
@@ -283,7 +285,7 @@ async function resolveMainAccountToken(
           throw new MainAccountTokenRefreshError(reason, { cause });
         }
         const result = persistRefreshedMainAuthJson(locked, refreshed);
-        clearAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID);
+        if (dependencies.preserveReauth !== true) clearAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID);
         return result;
       }),
       { waitMs: 30_000, signal },

package/src/codex/management-convergence.ts

@@ -1,4 +1,5 @@
 import type { OcxConfig } from "../types";
+import { resolvePendingInitialModelSelection } from "../providers/initial-model-selection-runtime";
 import { captureCatalogAdmissionSnapshot } from "./catalog-admission";
 import { convergeCodexCatalog } from "./convergence";
 import type {
@@ -152,6 +153,8 @@ export function createManagementConvergeCodex(
           catalogRefresh: unexpectedCatalogFailure(false),
         });
       }
+      // Registration choices are committed independently, before sealing catalog authority.
+      await resolvePendingInitialModelSelection(retainedConfig as OcxConfig);
       const snapshot = captureCatalogAdmissionSnapshot(retainedConfig);
       const result = await convergeCodexCatalog(snapshot, request, {
         onCommitBegin: () => { commitBegan = true; },

package/src/codex/model-entitlements.ts

@@ -149,6 +149,13 @@ export function compareClientVersionsForTests(left: string, right: string): numb
 }
 
 /** Numeric-segment comparison. Only used to pick the highest floor in a known-good set. */
+// Prerelease and build suffixes are deliberately NOT ordered. Splitting on [.+-] turns the
+// suffix into a non-finite segment that reads as 0, so `0.144.0-rc.1` sorts at or above
+// `0.144.0` rather than below it, the inverse of semver. That is tolerable because every
+// version this ranks against is a release version: the gated floor, the measured minimum, and
+// the snapshot's `minimal_client_version` rows. A prerelease runtime is therefore passed
+// through exactly as it was before the floor bound tier 2, so this is not a new hazard. Order
+// the suffix properly before reusing this anywhere a prerelease has to sort below its release.
 function compareClientVersions(left: string, right: string): number {
   const l = left.split(/[.+-]/).map(Number);
   const r = right.split(/[.+-]/).map(Number);
@@ -165,9 +172,10 @@ function compareClientVersions(left: string, right: string): number {
  *
  * 1. the inbound request's own `client_version` — the only value certainly describing the
  *    client being answered;
- * 2. the selected Codex runtime version, for background sync where no request exists.
- *    Retained sync refreshes runtime evidence before discovery, which is what makes this
- *    usable here; the persisted file itself carries no freshness guarantee.
+* 2. the selected Codex runtime version, for callers with no request of their own — but never
+ *    below `GATED_MODEL_CLIENT_VERSION_FLOOR`. Retained sync refreshes runtime evidence before
+ *    discovery, which is what makes this usable here; the persisted file itself carries no
+ *    freshness guarantee.
  * 3. the floor this build's own bundled roster records for the models being gated
  *    (`GATED_MODEL_CLIENT_VERSION_FLOOR`).
  *
@@ -178,6 +186,25 @@ function compareClientVersions(left: string, right: string): number {
  * snapshot states the gated models require, so asking under it is the narrowest question
  * that can still return them.
  *
+ * The floor binds tier 2 as well, and that is the whole of #3436. #3022 gave tier 3 the
+ * measured minimum but left tier 2 to speak for itself, so a host whose persisted runtime was
+ * REAL but OLD — 0.141.0 against a measured 0.144.0 — asked upstream under a version upstream
+ * filters on, got an honest roster with no gpt-5.6, and lost sol/terra/luna everywhere. That
+ * made an outdated CLI strictly worse than no CLI at all, since the runtime-less host already
+ * asked at the floor and kept its models. The clamp only ever raises: a runtime at or above
+ * the floor is preserved exactly, because a newer client can drive models the floor cannot
+ * name.
+ *
+ * Which tier answers is a question about WHICH QUESTION IS BEING ASKED, not about background
+ * versus request path — `isDirectCallerEntitledToCodexModel` and both authorization paths in
+ * `auth-context.ts` are inbound requests that reach tier 2 because they carry no version:
+ *
+ * - No inbound version: the caller is asking whether the ACCOUNT owns the model. Upstream
+ *   only incidentally filters that answer by version, so ask at no less than the floor.
+ * - An inbound version: the caller is asking what THAT CLIENT may use. Answer verbatim, even
+ *   when it is older than the floor. Clamping there would advertise rows the client told us
+ *   it cannot drive (#2548) and would turn an honest `unknown` into a cached `denied`.
+ *
  * There is deliberately no `0.0.0`-style fallback. A placeholder describes a client that
  * predates every gated model, which is what made upstream answer with an empty roster and
  * turned absent evidence into a manufactured confirmed negative (#2886).
@@ -195,7 +222,23 @@ export function resolveCodexEntitlementClientVersion(
   const selected = bypass
     ? readRuntimeVersion(loadRuntime)
     : memoizedPersistedRuntimeVersion(loadRuntime, options.now ?? Date.now());
-  return selected ?? GATED_MODEL_CLIENT_VERSION_FLOOR;
+  return raisedToGatedFloor(selected);
+}
+
+/**
+ * The gated floor as a lower bound rather than a fallback.
+ *
+ * Applied only on the way out of the resolver. `readRuntimeVersion` and
+ * `memoizedPersistedRuntimeVersion` keep reporting what is actually on disk, because
+ * `selectedVersion` is probe evidence that runtime identity, catalog cache keys,
+ * `X-Codex-Version` and install provenance all read for their own reasons. Clamping the
+ * persisted value itself would corrupt every one of them to fix one question.
+ */
+function raisedToGatedFloor(selected: string | null): string {
+  if (selected === null) return GATED_MODEL_CLIENT_VERSION_FLOOR;
+  return compareClientVersions(selected, GATED_MODEL_CLIENT_VERSION_FLOOR) >= 0
+    ? selected
+    : GATED_MODEL_CLIENT_VERSION_FLOOR;
 }
 const MODEL_ROSTER_TTL_MS = 5 * 60_000;
 
@@ -575,6 +618,13 @@ async function fetchAccountModels(
       return unconfirmedAccountModels(credential, clientVersion, now, { kind: "parsed-empty" });
     }
     const hasUnknownGatedAbsence = [...ACCOUNT_GATED_NATIVE_MODEL_MINIMUM_CLIENT_VERSIONS]
+      // Reachable only through tier 1, an inbound client_version below the floor. Every other
+      // resolution is now structurally >= every recorded minimum, because the floor is the max
+      // of the derived value and the same measured constant these minimums hold. So this is the
+      // escape hatch for a self-declared old client, not live protection on the background path:
+      // there, an absence really was asked for at an adequate version and is a denial. If
+      // upstream ever raises its true requirement above the measured constant, that constant is
+      // the only thing standing between an entitled account and a five-minute cached denial.
       .some(([modelId, minimum]) => (
         !models.has(modelId) && compareClientVersions(clientVersion, minimum) < 0
       ));

package/src/codex/project-config-warnings.ts

@@ -32,6 +32,8 @@ interface TomlDocument {
   sections: Map<string, Record<string, string>>;
 }
 
+type TomlMultilineDelimiter = '"""' | "'''";
+
 let diagnosticsCache: { at: number; warnings: ProjectCodexConfigWarning[] } | null = null;
 
 function hasInjectedOpenaiBaseUrl(content: string): boolean {
@@ -55,14 +57,102 @@ function parseTomlString(raw: string): string {
   return raw.slice(1, -1);
 }
 
+function multilineCloseIndex(
+  line: string,
+  delimiter: TomlMultilineDelimiter,
+  from: number,
+): number {
+  let index = line.indexOf(delimiter, from);
+  while (index >= 0 && delimiter === '"""') {
+    let backslashes = 0;
+    for (let cursor = index - 1; cursor >= 0 && line[cursor] === "\\"; cursor -= 1) {
+      backslashes += 1;
+    }
+    if (backslashes % 2 === 0) break;
+    index = line.indexOf(delimiter, index + delimiter.length);
+  }
+  return index;
+}
+
+/**
+ * Find a multiline TOML string that starts outside a comment or single-line string.
+ *
+ * This parser intentionally understands only the root/table subset needed by Codex
+ * diagnostics. It still has to skip multiline string bodies lexically: prose in
+ * `developer_instructions` can contain key-shaped examples or `[table]` snippets, and
+ * treating those examples as configuration changes the diagnostic's meaning.
+ */
+function multilineStateAfterLine(
+  line: string,
+  active: TomlMultilineDelimiter | null,
+): { active: TomlMultilineDelimiter | null; consumed: boolean } {
+  if (active) {
+    const close = multilineCloseIndex(line, active, 0);
+    if (close < 0) return { active, consumed: true };
+    const tail = multilineStateAfterLine(line.slice(close + active.length), null);
+    return {
+      active: tail.active,
+      consumed: true,
+    };
+  }
+
+  let quote: '"' | "'" | null = null;
+  let escaped = false;
+  let consumed = false;
+  for (let index = 0; index < line.length; index += 1) {
+    const character = line[index]!;
+    if (quote === '"') {
+      if (escaped) escaped = false;
+      else if (character === "\\") escaped = true;
+      else if (character === quote) quote = null;
+      continue;
+    }
+    if (quote === "'") {
+      if (character === quote) quote = null;
+      continue;
+    }
+    if (character === "#") return { active: null, consumed };
+
+    const delimiter: TomlMultilineDelimiter | null = line.startsWith('"""', index)
+      ? '"""'
+      : line.startsWith("'''", index)
+        ? "'''"
+        : null;
+    if (delimiter) {
+      consumed = true;
+      const close = multilineCloseIndex(line, delimiter, index + delimiter.length);
+      if (close < 0) return { active: delimiter, consumed: true };
+      index = close + delimiter.length - 1;
+      continue;
+    }
+    if (character === '"' || character === "'") quote = character;
+  }
+  return { active: null, consumed };
+}
+
 /** Lightweight TOML parse for root keys and [section] tables (Codex config shape). */
 export function parseTomlDocument(content: string): TomlDocument {
   const root: Record<string, string> = {};
   const sections = new Map<string, Record<string, string>>();
   let current = root;
+  let multiline: TomlMultilineDelimiter | null = null;
 
   for (const line of content.split("\n")) {
-    const table = line.match(/^\s*\[([^\]]+)\]\s*$/);
+    const wasMultiline = multiline !== null;
+    const multilineState = multilineStateAfterLine(line, multiline);
+    multiline = multilineState.active;
+    if (multilineState.consumed) {
+      // The declaration itself is still configuration even though its multiline VALUE must
+      // not be scanned as keys/tables. A legacy root key using a multiline value therefore
+      // remains visible to strict-config diagnostics; only the body is opaque.
+      if (!wasMultiline) {
+        const declaration = line.match(/^\s*([A-Za-z0-9_.-]+)\s*=\s*(?:"""|''')/);
+        if (declaration) current[declaration[1]!] = "";
+      }
+      continue;
+    }
+
+    const table = line.match(/^\s*\[([^\]]+)\]\s*(?:#.*)?$/);
     if (table) {
       const name = table[1]!.trim();
       const section = sections.get(name) ?? {};
@@ -422,4 +512,4 @@ export function printProjectCodexConfigWarnings(
     }
   }
   return warnings;
-}
+}