@bitkyc08/opencodex 2.48.0-preview.20260908 → 2.49.0

package/src/adapters/qoder/profiles.ts

@@ -0,0 +1,36 @@
+import { clearCodingAgentBinaryCache, resolveProfileByBaseUrl, type CodingAgentProviderProfile } from "../coding-agent/profile";
+
+/** Official Qoder CLI profile. Region variants are separate profiles and credentials. */
+export interface QoderProfile extends CodingAgentProviderProfile {
+  family: "qoder";
+}
+
+export const QODER_GLOBAL_PROFILE: QoderProfile = {
+  providerId: "qoder",
+  family: "qoder",
+  region: "global",
+  label: "Qoder",
+  canonicalBaseUrl: "https://qoder.com",
+  binaryCandidates: ["qoder", "qodercli"],
+  tokenEnv: "QODER_PERSONAL_ACCESS_TOKEN",
+  installHint: "npm install -g @qoder-ai/qodercli",
+  documentationUrl: "https://docs.qoder.com/cli/authentication",
+};
+
+export const QODER_CN_PROFILE: QoderProfile = {
+  providerId: "qoder-cn",
+  family: "qoder",
+  region: "cn",
+  label: "Qoder CN",
+  canonicalBaseUrl: "https://qoder.cn",
+  binaryCandidates: ["qodercn", "qoderclicn"],
+  tokenEnv: "QODERCN_PERSONAL_ACCESS_TOKEN",
+  installHint: "npm install -g @qodercn-ai/qoderclicn",
+  documentationUrl: "https://docs.qoder.cn/en/cli/authentication",
+};
+
+export const QODER_PROFILES: readonly QoderProfile[] = [QODER_GLOBAL_PROFILE, QODER_CN_PROFILE];
+export function resolveQoderProfile(baseUrl: string | undefined): QoderProfile | undefined {
+  return resolveProfileByBaseUrl(QODER_PROFILES, baseUrl) as QoderProfile | undefined;
+}
+export const clearQoderBinaryCache = clearCodingAgentBinaryCache;

package/src/adapters/registry.ts

@@ -2,6 +2,8 @@ import { createAnthropicAdapter } from "./anthropic";
 import { createAzureAdapter } from "./azure";
 import type { ProviderAdapter } from "./base";
 import { withClinePassDeepSeekV4ToolReplayCompatibility } from "./cline-pass-deepseek-v4-tool-replay";
+import { createCodeBuddyAdapter } from "./codebuddy/adapter";
+import { createQoderAdapter } from "./qoder/adapter";
 import { createCommandCodeAdapter } from "./command-code";
 import { createCursorAdapter } from "./cursor";
 import { createGoogleAdapter } from "./google";
@@ -20,6 +22,7 @@ export interface AdapterFactoryContext {
 }
 
 export type AdapterWire =
+  | "codebuddy"
   | "command-code"
   | "openai-chat"
   | "ollama-native"
@@ -53,6 +56,11 @@ type InheritedAdapterDefinition = {
 type AdapterDefinition = DirectAdapterDefinition | InheritedAdapterDefinition;
 
 export const ADAPTER_REGISTRY = {
+  codebuddy: {
+    wire: "codebuddy",
+    mutation: "codex-owned",
+    create: (provider: OcxProviderConfig, _context: AdapterFactoryContext) => createCodeBuddyAdapter(provider),
+  },
   "command-code": {
     wire: "command-code",
     mutation: "codex-owned",
@@ -108,6 +116,10 @@ export const ADAPTER_REGISTRY = {
     contractParent: "openai-chat",
     create: (provider: OcxProviderConfig, _context: AdapterFactoryContext) => createMimoFreeAdapter(provider),
   },
+  qoder: {
+    contractParent: "codebuddy",
+    create: (provider: OcxProviderConfig, _context: AdapterFactoryContext) => createQoderAdapter(provider),
+  },
 } as const satisfies Record<string, AdapterDefinition>;
 
 export type AdapterId = keyof typeof ADAPTER_REGISTRY;

package/src/adapters/responses-tool-schema.ts

@@ -1,8 +1,7 @@
-// Codex multi-agent v2 stamps a Responses-only `encrypted: true` marker on
-// collaboration tool schemas (openai/codex 5f4d06ef; issue #85). It is an
-// annotation for the ChatGPT backend only, so translated provider schemas must
-// drop it without removing properties or definitions literally named `encrypted`.
-const ENCRYPTED_MARKER_NAME_BAG_KEYS = new Set([
+// Keys whose *children's names* are caller-chosen rather than schema keywords, and keys whose
+// values are literal payloads rather than schemas. Shared by both strippers below: each one has
+// to tell "the keyword `x`" apart from "a property someone named `x`".
+const SCHEMA_NAME_BAG_KEYS = new Set([
   "properties",
   "patternProperties",
   "$defs",
@@ -11,9 +10,21 @@ const ENCRYPTED_MARKER_NAME_BAG_KEYS = new Set([
   "dependentSchemas",
   "dependentRequired",
 ]);
-const ENCRYPTED_MARKER_LITERAL_VALUE_KEYS = new Set(["const", "default", "enum", "examples"]);
+const SCHEMA_LITERAL_VALUE_KEYS = new Set(["const", "default", "enum", "examples"]);
+
+// These subtrees depend on property evaluation, polarity, branch selection or references.
+// Preserve their complete argument contract rather than guessing whether a local relaxation
+// remains a relaxation in the containing schema. The destination reports unsupported regexes.
+const PRESERVED_PATTERN_SUBTREES = new Set([
+  "patternProperties", "not", "oneOf", "if", "contains", "$defs", "definitions",
+]);
 
 /**
+ * Codex multi-agent v2 stamps a Responses-only `encrypted: true` marker on collaboration tool
+ * schemas (openai/codex 5f4d06ef; issue #85). It is an annotation for the ChatGPT backend only,
+ * so translated provider schemas must drop it without removing properties or definitions
+ * literally named `encrypted`.
+ *
  * The schema is caller-supplied, so its nesting depth is attacker-influenced. Native recursion
  * would turn a deep schema into a stack overflow that takes down the request path, so this walks
  * an explicit stack instead: depth costs heap, which is bounded and recoverable.
@@ -52,11 +63,11 @@ export function stripResponsesOnlyEncryptedMarker(node: unknown, inNameBag = fal
         // Inside a name bag every key is a caller-chosen name, so `encrypted` here is data.
         stack.push({ node: value, inNameBag: false, assign: v => { out[key] = v; } });
       } else if (key !== "encrypted") {
-        if (ENCRYPTED_MARKER_LITERAL_VALUE_KEYS.has(key)) {
+        if (SCHEMA_LITERAL_VALUE_KEYS.has(key)) {
           // Literal payloads are values, not schemas: an `encrypted` key inside them is data.
           out[key] = value;
         } else {
-          const childInNameBag = ENCRYPTED_MARKER_NAME_BAG_KEYS.has(key);
+          const childInNameBag = SCHEMA_NAME_BAG_KEYS.has(key);
           stack.push({ node: value, inNameBag: childInNameBag, assign: v => { out[key] = v; } });
         }
       }
@@ -65,3 +76,97 @@ export function stripResponsesOnlyEncryptedMarker(node: unknown, inNameBag = fal
 
   return result;
 }
+
+/**
+ * `\p{…}` is an escape only when the backslash introducing it is itself unescaped: in `\\p{2}`
+ * the pair is a literal backslash and the `p{2}` that follows is an ordinary quantified `p`,
+ * which Python compiles fine. Scanning for the raw substring would misread that as a property
+ * escape and discard a working pattern.
+ */
+function usesUnicodePropertyEscape(pattern: string): boolean {
+  for (let i = 0; i < pattern.length; i++) {
+    if (pattern[i] !== "\\") continue;
+    const next = pattern[i + 1];
+    if (next === "\\") {
+      i++;
+      continue;
+    }
+    if ((next === "p" || next === "P") && pattern[i + 2] === "{") return true;
+  }
+  return false;
+}
+
+/**
+ * Remove unsupported Unicode property escapes from scalar `pattern` constraints in ordinary
+ * positive schema positions. This keeps built-in Artifact tools usable on Python-re backends;
+ * the omitted constraint is not enforced by this proxy and tools must validate their inputs.
+ *
+ * Regex-keyed objects are preserved. Removing a matcher can lose evaluated-property annotations
+ * needed by an ancestor's unevaluatedProperties, even when the local object appears open.
+ * Negation, exclusive alternatives, conditions, contains and reusable definitions are also
+ * preserved: loosening a nested constraint can instead reject an input in those contexts.
+ * Unsupported patterns there remain the destination's validation responsibility.
+ *
+ * Returns `node` itself when nothing was dropped. Uses an explicit stack for caller-controlled
+ * nesting depth; the separate Responses-only encrypted-marker normalization is unchanged.
+ */
+export function stripUnicodePropertyPatterns(node: unknown, inNameBag = false): unknown {
+  type Assign = (value: unknown) => void;
+  interface Frame { node: unknown; inNameBag: boolean; assign: Assign }
+
+  let result: unknown;
+  let dropped = 0;
+  const stack: Frame[] = [{ node, inNameBag, assign: value => { result = value; } }];
+
+  while (stack.length > 0) {
+    const frame = stack.pop()!;
+    const current = frame.node;
+
+    if (Array.isArray(current)) {
+      const out: unknown[] = new Array(current.length);
+      frame.assign(out);
+      // Array items are schemas in their own right, never a name bag.
+      for (let i = current.length - 1; i >= 0; i--) {
+        stack.push({ node: current[i], inNameBag: false, assign: value => { out[i] = value; } });
+      }
+      continue;
+    }
+    if (!current || typeof current !== "object") {
+      frame.assign(current);
+      continue;
+    }
+
+    // A schema name may be `__proto__`; a null-prototype record keeps it as data.
+    const out: Record<string, unknown> = Object.create(null) as Record<string, unknown>;
+    frame.assign(out);
+
+    for (const [key, value] of Object.entries(current as Record<string, unknown>)) {
+      if (frame.inNameBag) {
+        // Inside a name bag every key is a caller-chosen name, so `pattern` here is a property
+        // name; its value is still a schema and is walked as one.
+        stack.push({ node: value, inNameBag: false, assign: v => { out[key] = v; } });
+        continue;
+      }
+      if (PRESERVED_PATTERN_SUBTREES.has(key)) {
+        out[key] = value;
+        continue;
+      }
+      if (key === "pattern" && typeof value === "string" && usesUnicodePropertyEscape(value)) {
+        dropped++;
+        continue;
+      }
+      if (SCHEMA_LITERAL_VALUE_KEYS.has(key)) {
+        // Literal payloads are values, not schemas: a `pattern` key inside them is data.
+        out[key] = value;
+        continue;
+      }
+      stack.push({
+        node: value,
+        inNameBag: SCHEMA_NAME_BAG_KEYS.has(key),
+        assign: v => { out[key] = v; },
+      });
+    }
+  }
+
+  return dropped === 0 ? node : result;
+}

package/src/cli/dispatch.ts

@@ -25,6 +25,7 @@ import { afterCatalogWriteHandleAppServers } from "../codex/app-server-processes
 import { normalizeUpdateChannel, runGuiUpdateWorker } from "../update/job";
 import { isJsonOption, takeFlag } from "./runtime-api";
 import type { ClientConnectionState } from "../client/state";
+import { OCX_NATIVE_REPLAY_RECOVERY_NOTE } from "../responses/compaction";
 
 export interface CliDispatchDeps {
   args: string[];
@@ -199,6 +200,7 @@ const commandRunners: Record<string, CommandRunner> = {
     }
     if (r.success) {
       console.log("Codex integration is OFF and plain `codex` now runs natively. Switch back with: ocx restore back");
+      console.log(`Note: ${OCX_NATIVE_REPLAY_RECOVERY_NOTE}`);
     } else {
       console.error("Plain `codex` was not fully restored. Inspect $CODEX_HOME/config.toml before using native Codex.");
     }

package/src/cli/doctor.ts

@@ -45,6 +45,9 @@ import {
   probeCodexCoordinatorNamespace,
   resolveEffectiveUserIdentity,
 } from "../codex/user-identity";
+import { isCanonicalOpenAiForwardProvider } from "../providers/openai-tiers-destination";
+import type { OcxProviderConfig } from "../types/provider";
+import { routedProviderConfig } from "../router";
 import { collectProjectCodexConfigWarnings, formatProjectCodexConfigWarningsForDoctor } from "../codex/project-config-warnings";
 import {
   collectLegacyCodexConfigKeyDiagnostics,
@@ -1000,6 +1003,41 @@ export function proxyDownRestartHint(input: {
   return `The ocx proxy is not running. ${uncleanExit}Codex/Claude clients pinned to 127.0.0.1:${input.port} fail with errors like "error sending request for url (http://127.0.0.1:${input.port}/v1/responses)". ${restart}`;
 }
 
+/** Explain the expected channel and latency trade-off for native ChatGPT routing. */
+export function chatgptPublicEndpointHint(
+  providers: Record<string, unknown> | undefined,
+): string | null {
+  const openai = providers?.openai;
+  if (!openai || typeof openai !== "object") {
+    return null;
+  }
+  // A disabled row never routes, so it must not be described as the route in use.
+  const configured = openai as OcxProviderConfig;
+  if (configured.disabled === true) {
+    return null;
+  }
+  // Classify the destination the router resolves, not the raw config text. Two things follow
+  // from the registry entry for the built-in `openai` id: a row that omits `authMode` still
+  // forwards, and a row carrying some other `baseUrl` has it discarded in favour of the
+  // canonical ChatGPT endpoint. Both keep using the public endpoint, so both want this hint;
+  // reading the raw row would have suppressed the first and misjudged the second.
+  //
+  // `routedProviderConfig` throws for an unresolved URL only when the registry entry allows a
+  // baseUrl override, which this entry does not, so no input reaches that path today. The guard
+  // is here because doctor is read-only diagnostics: a later registry change must not turn a
+  // diagnostic into a crash.
+  let routed: OcxProviderConfig;
+  try {
+    routed = routedProviderConfig("openai", configured);
+  } catch {
+    return null;
+  }
+  if (!isCanonicalOpenAiForwardProvider(routed)) {
+    return null;
+  }
+  return "ChatGPT-family requests use the public ChatGPT endpoint through this proxy, in both Pool and Direct modes. Eligible streaming turns dial the ChatGPT websocket transport (the same responses_websockets lane Codex CLI defaults to) and fall back to SSE over HTTP when a turn is not eligible - an unsupported Bun runtime, an oversized create frame, or a proxy route that cannot carry the socket - and local provider pacing can hold a request before it is dispatched at all. This hint classifies configuration only and measures nothing, so upstream queueing is one possible contributor to a slow first output: compare actual transport, pacing, network, and provider observations before concluding. service_tier=priority is a request preference: this backend can echo service_tier \"default\" even on turns it scheduled as priority (#2558), so the echoed response tier in request logs stays an observation with confirmation \"assumed\" and cannot confirm or deny the granted tier.";
+}
+
 export async function runDoctor(args: string[] = []): Promise<void> {
   if (args.includes("--fix-codex-runtime")) {
     const resolved = resolveCodexRuntime();
@@ -1330,6 +1368,8 @@ export async function runDoctor(args: string[] = []): Promise<void> {
 
   // Hints, not fixes.
   const hints: string[] = [];
+  const chatgptHint = chatgptPublicEndpointHint(doctorConfig.providers);
+  if (chatgptHint) hints.push(chatgptHint);
   const proxyDown = proxyDownRestartHint({
     proxyRunning: Boolean(live),
     port: live?.port ?? doctorConfig.port ?? 10100,

package/src/cli/effort.ts

@@ -2,6 +2,7 @@ import { loadConfig, saveConfig } from "../config";
 import {
   CODEX_REASONING_LEVELS,
   configuredReasoningEfforts,
+  isCodexReasoningEffort,
   isDeclaredReasoningEffort,
   mapReasoningEffort,
   reasoningEffortMapFor,
@@ -21,7 +22,7 @@ import {
 
 export const EFFORT_USAGE = `Usage:
   ocx effort [status] [--json]
-  ocx effort <low|medium|high|xhigh|max|ultra|none|minimal|-> [--json]
+  ocx effort <low|medium|high|xhigh|max|ultra|-> [--json]
   ocx effort set [--main <level|->] [--subagent <level|->] [--injection <level|->] [--json]
   ocx effort clear [--json]
   ocx effort model <provider/model|model> [--json]
@@ -33,13 +34,18 @@ function clearable(value: string | undefined): string | null | undefined {
   return value === "-" ? null : value;
 }
 
-function validateEffortLevel(level: string | null | undefined, label: string): string | null | undefined {
+function validateEffortLevel(
+  level: string | null | undefined,
+  label: string,
+  kind: "cap" | "injection",
+): string | null | undefined {
   if (level === undefined || level === null) return level;
   const trimmed = level.trim();
   if (trimmed === "-" || trimmed === "") return null;
-  if (!isDeclaredReasoningEffort(trimmed)) {
+  const valid = kind === "cap" ? isCodexReasoningEffort(trimmed) : isDeclaredReasoningEffort(trimmed);
+  if (!valid) {
     throw new CliUsageError(
-      `unknown reasoning effort "${trimmed}" for ${label} (allowed: ${CODEX_REASONING_LEVELS.map(l => l.effort).join(", ")}, none, minimal, -)`,
+      `unknown reasoning effort "${trimmed}" for ${label} (allowed: ${CODEX_REASONING_LEVELS.map(l => l.effort).join(", ")}${kind === "injection" ? ", none, minimal" : ""}, -)`,
       EFFORT_USAGE,
     );
   }
@@ -114,6 +120,15 @@ async function status(wantsJson: boolean, deps: RuntimeApiDeps): Promise<void> {
     data = getOfflineStatus();
   }
 
+  // Report the stored/runtime value exactly as the enforcement layer evaluates it.
+  // An ignored subagent field does not disable a valid main cap on that child.
+  const warnings = ([ ["effortCap", "--main"], ["subagentEffortCap", "--subagent"] ] as const)
+    .flatMap(([key, flag]) => {
+      const value = data[key];
+      if (value === null || isCodexReasoningEffort(value)) return [];
+      return [`${key}=${JSON.stringify(value)} is invalid and is not applied. Use: ocx effort set ${flag} <${CODEX_REASONING_LEVELS.map(l => l.effort).join("|")}|->.`];
+    });
+
   const lines = [
     `Reasoning effort status (${data.source === "runtime" ? "live proxy" : "offline config"}):`,
     `  Main agent effort cap:     ${data.effortCap ?? "(unset — no cap)"}`,
@@ -122,9 +137,10 @@ async function status(wantsJson: boolean, deps: RuntimeApiDeps): Promise<void> {
     "",
     "Supported Codex reasoning effort ladder:",
     ...CODEX_REASONING_LEVELS.map(l => `  - ${l.effort.padEnd(8)} ${l.description}`),
+    ...(warnings.length ? ["", "Warnings:", ...warnings.map(warning => `  ${warning}`)] : []),
   ];
 
-  printData(data, wantsJson, lines);
+  printData({ ...data, warnings }, wantsJson, lines);
 }
 
 async function setEffort(
@@ -136,9 +152,9 @@ async function setEffort(
   wantsJson: boolean,
   deps: RuntimeApiDeps,
 ): Promise<void> {
-  const validatedMain = validateEffortLevel(options.main, "--main");
-  const validatedSubagent = validateEffortLevel(options.subagent, "--subagent");
-  const validatedInjection = validateEffortLevel(options.injection, "--injection");
+  const validatedMain = validateEffortLevel(options.main, "--main", "cap");
+  const validatedSubagent = validateEffortLevel(options.subagent, "--subagent", "cap");
+  const validatedInjection = validateEffortLevel(options.injection, "--injection", "injection");
 
   if (validatedMain === undefined && validatedSubagent === undefined && validatedInjection === undefined) {
     throw new CliUsageError("at least one effort option (--main, --subagent, or --injection) is required", EFFORT_USAGE);

package/src/cli/help.ts

@@ -33,6 +33,8 @@ Usage:
   ocx restore back            Re-point codex at the running proxy (undo restore)
   ocx recover-history --legacy-openai --yes
                                Force all user-message opencodex rows to OpenAI (legacy recovery)
+  ocx recover-history --ocx-compaction <thread-id> --yes
+                               Back up and make one ocx1-compacted thread replayable by native Codex
   ocx uninstall               Remove service/shim/config and restore native Codex (alias: remove)
   ocx service [sub]           Run as a background service (default: install/update/start)
   ocx codex-shim <sub>        Auto-start proxy when \`codex\` launches (install|status|uninstall|remove)

package/src/cli/index.ts

@@ -1442,8 +1442,31 @@ async function handleStatus() {
 }
 
 async function handleRecoverHistory() {
+  if (args[1] === "--ocx-compaction") {
+    const threadId = args[2];
+    if (args.length !== 4 || !threadId || args[3] !== "--yes") {
+      console.error("Usage: ocx recover-history --ocx-compaction <thread-id> --yes");
+      console.error("This rewrites one rollout after saving a private byte-for-byte backup. Close that Codex thread before retrying.");
+      process.exit(1);
+    }
+    console.error("WARNING: this converts OpenCodeX-owned ocx1 compaction state into a plain summary for native Codex replay.");
+    try {
+      const { recoverOcxCompactionHistory } = await import("../codex/ocx-compaction-history");
+      const result = recoverOcxCompactionHistory({ threadId });
+      if (result.replaced === 0) {
+        console.log(`Thread ${threadId} has no repairable ocx1 compaction history; no files changed.`);
+        return;
+      }
+      console.log(`Recovered ${result.replaced} ocx1 compaction item(s) in thread ${threadId}.`);
+      console.log(`Backup: ${result.backupPath}`);
+      return;
+    } catch (error) {
+      console.error(`Recovery failed: ${error instanceof Error ? error.message : String(error)}`);
+      process.exit(1);
+    }
+  }
   if (args[1] !== "--legacy-openai") {
-    console.error("Usage: ocx recover-history --legacy-openai --yes");
+    console.error("Usage: ocx recover-history (--legacy-openai | --ocx-compaction <thread-id>) --yes");
     console.error("This force-relabels every user-message opencodex row to OpenAI, including legitimate dedicated-provider history. Back up first and use it only for pre-backup legacy recovery.");
     process.exit(1);
   }

package/src/cli/provider-runtime.ts

@@ -204,7 +204,8 @@ async function presets(argv: string[], deps: RuntimeApiDeps): Promise<void> {
   const rows = Array.isArray(result) ? result : result.providers ?? [];
   printData(result, wantsJson, rows.map(row => {
     const record = row as Record<string, unknown>;
-    return `${String(record.id ?? record.name ?? "?")}  ${String(record.label ?? record.adapter ?? "")}`.trimEnd();
+    const sponsor = record.sponsor ? `  (sponsor: ${String(record.sponsor)})` : "";
+    return `${String(record.id ?? record.name ?? "?")}  ${String(record.label ?? record.adapter ?? "")}${sponsor}`.trimEnd();
   }));
 }
 

package/src/cli/registry.ts

@@ -36,8 +36,8 @@ export const CLI_COMMANDS: CliCommandEntry[] = [
   },
   {
     name: "recover-history",
-    usage: "ocx recover-history --legacy-openai --yes",
-    summary: "Force all user-message opencodex rows to OpenAI for legacy recovery.",
+    usage: "ocx recover-history (--legacy-openai | --ocx-compaction <thread-id>) --yes",
+    summary: "Recover legacy provider metadata or one OpenCodeX-compacted thread for native replay.",
   },
   {
     name: "uninstall",

package/src/cli/system-command.ts

@@ -14,7 +14,7 @@ import {
 const USAGE = `Usage:
   ocx system [status] [--json]
   ocx system settings [--auto-start <on|off>] [--stream-mode <auto|legacy-tee|eager-relay>]
-      [--desktop-authless <on|off>] [--json]
+      [--desktop-authless <on|off>] [--client-compaction <on|off>] [--json]
   ocx system startup <health|install-service|install-shim> [--json]
   ocx system diagnostics [--json]
   ocx system sync [--json]
@@ -23,7 +23,11 @@ const USAGE = `Usage:
   ocx system codex-cli-update check [--json]
   ocx system update check [--channel <latest|preview>] [--json]
   ocx system update run [--channel <latest|preview>] [--restart <on|off>] --yes [--json]
-  ocx system update status <job-id> [--json]`;
+  ocx system update status <job-id> [--json]
+
+--client-compaction favors native replay portability for future compactions while
+keeping OpenCodeX routing active; the configured provider may process summaries
+and consume its quota.`;
 
 async function status(argv: string[], deps: RuntimeApiDeps): Promise<void> {
   const args = [...argv];
@@ -44,8 +48,10 @@ async function settings(argv: string[], deps: RuntimeApiDeps): Promise<void> {
   const autoStart = takeBooleanOption(args, "--auto-start");
   const streamMode = takeOption(args, "--stream-mode");
   const desktopAuthless = takeBooleanOption(args, "--desktop-authless");
+  const clientCompaction = takeBooleanOption(args, "--client-compaction");
   rejectArgs(args, USAGE);
-  if (autoStart === undefined && streamMode === undefined && desktopAuthless === undefined) {
+  if (autoStart === undefined && streamMode === undefined
+    && desktopAuthless === undefined && clientCompaction === undefined) {
     const result = await runtimeRequest("/api/settings", {}, deps);
     printData(result, wantsJson, summaryLines(result));
     return;
@@ -54,6 +60,7 @@ async function settings(argv: string[], deps: RuntimeApiDeps): Promise<void> {
     ...(autoStart !== undefined ? { codexAutoStart: autoStart } : {}),
     ...(streamMode !== undefined ? { streamMode } : {}),
     ...(desktopAuthless !== undefined ? { codexDesktopAuthless: desktopAuthless } : {}),
+    ...(clientCompaction !== undefined ? { codexClientCompaction: clientCompaction } : {}),
   };
   const result = await runtimeRequest("/api/settings", { method: "PUT", body: JSON.stringify(body) }, deps);
   printData(result, wantsJson, ["System settings updated."]);

package/src/cli/usage-report.ts

@@ -59,8 +59,11 @@ interface UsageReportInput {
 
 const MAX_MODEL_ROWS = 10;
 
-function terminalText(value: string): string {
-  return value.replace(/[\x00-\x1f\x7f-\x9f]/g, character => {
+function terminalText(value: unknown): string {
+  const text = typeof value === "string" ? value
+    : value === null || value === undefined ? ""
+    : typeof value === "number" || typeof value === "boolean" ? String(value) : "[invalid]";
+  return text.replace(/[\x00-\x1f\x7f-\x9f\u2028\u2029]/g, character => {
     const code = character.charCodeAt(0);
     return code <= 0x7f
       ? `\\x${code.toString(16).padStart(2, "0")}`
@@ -69,7 +72,8 @@ function terminalText(value: string): string {
 }
 
 function count(value: number | undefined): string {
-  return (value ?? 0).toLocaleString("en-US");
+  if (value === undefined || value === null) return "0";
+  return typeof value === "number" && Number.isFinite(value) ? value.toLocaleString("en-US") : "—";
 }
 
 /**
@@ -111,7 +115,7 @@ export function formatUsageReport(data: UsageReportInput): string[] {
       .filter(Boolean).join(" and ");
     lines.push(`No usage recorded for ${terminalText(what)} in this range.`);
     lines.push("Check the spelling against `ocx usage --json`, or widen --range.");
-    return lines;
+    return lines.map(terminalText);
   }
 
   const tokenSplit = [
@@ -185,5 +189,5 @@ export function formatUsageReport(data: UsageReportInput): string[] {
 
   lines.push("");
   lines.push("Not a billing receipt. Subscription usage or provider credits may apply instead.");
-  return lines;
+  return lines.map(terminalText);
 }

package/src/codex/account-lifecycle.ts

@@ -7,12 +7,13 @@ import {
 } from "../config";
 import { removeCodexAccountCredential } from "./account-store";
 import { clearAccountNeedsReauth } from "./account-runtime-state";
-import { getMainChatgptAccountId } from "./auth-collision";
+import { getMainChatgptAccountId, readCodexTokensResult } from "./auth-collision";
 import { MAIN_CODEX_ACCOUNT_ID, setMainAccountPlan } from "./main-account";
 import { clearAccountQuota } from "./quota";
 import { clearCodexUpstreamHealthForAccount, clearThreadAccountMapForAccount } from "./routing";
 import { invalidateCodexWebSocketsForAccount } from "./websocket-registry";
-import { clearMainAccountCredentialPresence, clearMainAccountInfoCache, observeMainQuotaIdentity } from "./main-account-cache";
+import { clearMainAccountCredentialPresence, clearMainAccountInfoCache, observeMainQuotaCredential, observeMainQuotaIdentity } from "./main-account-cache";
+import { extractAccountIdClaims } from "../oauth/chatgpt";
 import { forgetCodexAccountPause } from "./account-pause";
 import { clearCodexAccountPin, forgetCodexAccountPriority } from "./account-priority";
 import { forgetCodexQuotaAutoRefreshAccount } from "./quota-auto-refresh-state";
@@ -75,6 +76,38 @@ export function reconcileMainCodexAccountRuntimeState(): boolean {
   return true;
 }
 
+/**
+ * Rebuild the memory-only policy binding from a startup-owned, recovered auth path.
+ * The caller holds the native owner and exclusive claim; an incoming bearer is never evidence.
+ * A failed read creates no binding and cannot revoke a prior verified observation or its block.
+ * Only a valid replacement observation or confirmed account transition supersedes that evidence.
+ */
+export function initializeMainAccountPolicyBinding(authPath: string): boolean {
+  // Startup observes the pinned owned path inside the exclusive claim: bound the read so a
+  // replaced non-regular or oversized file cannot stall startup inside that claim.
+  const result = readCodexTokensResult(authPath, { bounded: true });
+  if (result.status !== "ok") return false;
+  const { tokens } = result;
+  if (typeof tokens.access_token !== "string" || !tokens.access_token
+    || typeof tokens.account_id !== "string" || !tokens.account_id) return false;
+  if (tokens.id_token != null && typeof tokens.id_token !== "string") return false;
+  const accountId = tokens.account_id;
+  // An owned file may contain an opaque bearer, but every decoded identity must agree —
+  // including the two account-id encodings within a single token.
+  const idTokenClaims = extractAccountIdClaims(tokens.id_token);
+  const accessTokenClaims = extractAccountIdClaims(tokens.access_token);
+  if (idTokenClaims.conflict || accessTokenClaims.conflict) return false;
+  const idTokenAccountId = idTokenClaims.accountId;
+  const accessTokenAccountId = accessTokenClaims.accountId;
+  if ((idTokenAccountId !== undefined && idTokenAccountId !== accountId)
+    || (accessTokenAccountId !== undefined && accessTokenAccountId !== accountId)) return false;
+  const previousAccountId = observedMainChatgptAccountId;
+  observedMainChatgptAccountId = accountId;
+  if (previousAccountId !== undefined && previousAccountId !== accountId) purgeMainCodexAccountRuntimeState();
+  observeMainQuotaIdentity(accountId);
+  return observeMainQuotaCredential(tokens.access_token, accountId) !== undefined;
+}
+
 /**
  * Apply a transaction-confirmed physical native-login change without waiting for
  * a later auth.json observation. The caller owns credential commit/rollback.

package/src/codex/auth-api.ts

@@ -241,12 +241,15 @@ function codexAccountPersistenceConflict(
 }
 
 /**
- * The exact label `parseUsageQuota` emits for the Codex Spark window (quota.ts).
+ * The exact labels `parseUsageQuota` emits for the Codex Spark windows (quota.ts).
  * Matching on the label rather than on "is a custom window" is load-bearing: the same array
  * carries Cursor's First-party models / API usage, Anthropic's Fable / Opus / Sonnet,
  * Antigravity's Gem / Cla, Kimi's subscription credits and a dozen dynamic provider meters.
  */
-const CODEX_SPARK_WINDOW_LABEL = "GPT-5.3-Codex-Spark Weekly";
+const CODEX_SPARK_WINDOW_LABELS = new Set([
+  "GPT-5.3-Codex-Spark 5h",
+  "GPT-5.3-Codex-Spark Weekly",
+]);
 
 /**
  * Drop the Spark window unless the operator asked for it (default hidden).
@@ -264,7 +267,7 @@ export function withSparkVisibility<T extends Omit<StoredAccountQuota, "updatedA
 ): T {
   if (!quota?.customWindows?.length) return quota;
   if (loadConfig().showCodexSparkQuota === true) return quota;
-  const kept = quota.customWindows.filter(window => window.label !== CODEX_SPARK_WINDOW_LABEL);
+  const kept = quota.customWindows.filter(window => !CODEX_SPARK_WINDOW_LABELS.has(window.label));
   if (kept.length === quota.customWindows.length) return quota;
   // An empty list is dropped rather than serialized: an absent field and an empty array should
   // not be two different ways of saying "no custom windows" on the wire.

package/src/codex/auth-collision.ts

@@ -6,6 +6,7 @@ import { resolveCodexHomeDir } from "./home";
 import { extractAccountId } from "../oauth/chatgpt";
 import { isSelectableCodexPoolAccount } from "./account-id";
 import { codexPlanKey } from "./plan";
+import { MAX_AUTH_BYTES, readBounded } from "./native-profile-store";
 
 export interface CodexTokens {
   access_token: string;
@@ -31,12 +32,21 @@ function hasErrnoCode(error: unknown, code: string): boolean {
 /**
  * Reads the Codex CLI credential file and classifies the outcome. Reads once instead of doing an
  * `existsSync` pre-check, so a file replaced between check and read cannot be misread as absent.
+ * An already-owned lifecycle may supply its pinned auth path instead of resolving ambient home.
+ * `bounded` opts into the native-profile bounded reader (regular file, size-capped, no-follow,
+ * non-blocking) for startup observation paths that run inside the owner claim; bounded violations
+ * classify as `unreadable`. Legacy callers keep the unbounded read.
  * Never returns or logs the raw error or any token material.
  */
-export function readCodexTokensResult(): CodexTokenReadResult {
+export function readCodexTokensResult(
+  authPath = join(resolveCodexHomeDir(), "auth.json"),
+  options?: { bounded?: boolean },
+): CodexTokenReadResult {
   let raw: string;
   try {
-    raw = readFileSync(join(resolveCodexHomeDir(), "auth.json"), "utf-8");
+    raw = options?.bounded === true
+      ? readBounded(authPath, MAX_AUTH_BYTES).toString("utf-8")
+      : readFileSync(authPath, "utf-8");
   } catch (error) {
     return { status: hasErrnoCode(error, "ENOENT") ? "missing" : "unreadable" };
   }