@bitkyc08/opencodex 2.48.0 → 2.50.0

package/src/adapters/qoder/profiles.ts

@@ -0,0 +1,36 @@
+import { clearCodingAgentBinaryCache, resolveProfileByBaseUrl, type CodingAgentProviderProfile } from "../coding-agent/profile";
+
+/** Official Qoder CLI profile. Region variants are separate profiles and credentials. */
+export interface QoderProfile extends CodingAgentProviderProfile {
+  family: "qoder";
+}
+
+export const QODER_GLOBAL_PROFILE: QoderProfile = {
+  providerId: "qoder",
+  family: "qoder",
+  region: "global",
+  label: "Qoder",
+  canonicalBaseUrl: "https://qoder.com",
+  binaryCandidates: ["qoder", "qodercli"],
+  tokenEnv: "QODER_PERSONAL_ACCESS_TOKEN",
+  installHint: "npm install -g @qoder-ai/qodercli",
+  documentationUrl: "https://docs.qoder.com/cli/authentication",
+};
+
+export const QODER_CN_PROFILE: QoderProfile = {
+  providerId: "qoder-cn",
+  family: "qoder",
+  region: "cn",
+  label: "Qoder CN",
+  canonicalBaseUrl: "https://qoder.cn",
+  binaryCandidates: ["qodercn", "qoderclicn"],
+  tokenEnv: "QODERCN_PERSONAL_ACCESS_TOKEN",
+  installHint: "npm install -g @qodercn-ai/qoderclicn",
+  documentationUrl: "https://docs.qoder.cn/en/cli/authentication",
+};
+
+export const QODER_PROFILES: readonly QoderProfile[] = [QODER_GLOBAL_PROFILE, QODER_CN_PROFILE];
+export function resolveQoderProfile(baseUrl: string | undefined): QoderProfile | undefined {
+  return resolveProfileByBaseUrl(QODER_PROFILES, baseUrl) as QoderProfile | undefined;
+}
+export const clearQoderBinaryCache = clearCodingAgentBinaryCache;

package/src/adapters/registry.ts

@@ -2,6 +2,8 @@ import { createAnthropicAdapter } from "./anthropic";
 import { createAzureAdapter } from "./azure";
 import type { ProviderAdapter } from "./base";
 import { withClinePassDeepSeekV4ToolReplayCompatibility } from "./cline-pass-deepseek-v4-tool-replay";
+import { createCodeBuddyAdapter } from "./codebuddy/adapter";
+import { createQoderAdapter } from "./qoder/adapter";
 import { createCommandCodeAdapter } from "./command-code";
 import { createCursorAdapter } from "./cursor";
 import { createGoogleAdapter } from "./google";
@@ -20,6 +22,7 @@ export interface AdapterFactoryContext {
 }
 
 export type AdapterWire =
+  | "codebuddy"
   | "command-code"
   | "openai-chat"
   | "ollama-native"
@@ -53,6 +56,11 @@ type InheritedAdapterDefinition = {
 type AdapterDefinition = DirectAdapterDefinition | InheritedAdapterDefinition;
 
 export const ADAPTER_REGISTRY = {
+  codebuddy: {
+    wire: "codebuddy",
+    mutation: "codex-owned",
+    create: (provider: OcxProviderConfig, _context: AdapterFactoryContext) => createCodeBuddyAdapter(provider),
+  },
   "command-code": {
     wire: "command-code",
     mutation: "codex-owned",
@@ -108,6 +116,10 @@ export const ADAPTER_REGISTRY = {
     contractParent: "openai-chat",
     create: (provider: OcxProviderConfig, _context: AdapterFactoryContext) => createMimoFreeAdapter(provider),
   },
+  qoder: {
+    contractParent: "codebuddy",
+    create: (provider: OcxProviderConfig, _context: AdapterFactoryContext) => createQoderAdapter(provider),
+  },
 } as const satisfies Record<string, AdapterDefinition>;
 
 export type AdapterId = keyof typeof ADAPTER_REGISTRY;

package/src/adapters/responses-tool-schema.ts

@@ -1,8 +1,7 @@
-// Codex multi-agent v2 stamps a Responses-only `encrypted: true` marker on
-// collaboration tool schemas (openai/codex 5f4d06ef; issue #85). It is an
-// annotation for the ChatGPT backend only, so translated provider schemas must
-// drop it without removing properties or definitions literally named `encrypted`.
-const ENCRYPTED_MARKER_NAME_BAG_KEYS = new Set([
+// Keys whose *children's names* are caller-chosen rather than schema keywords, and keys whose
+// values are literal payloads rather than schemas. Shared by both strippers below: each one has
+// to tell "the keyword `x`" apart from "a property someone named `x`".
+const SCHEMA_NAME_BAG_KEYS = new Set([
   "properties",
   "patternProperties",
   "$defs",
@@ -11,9 +10,21 @@ const ENCRYPTED_MARKER_NAME_BAG_KEYS = new Set([
   "dependentSchemas",
   "dependentRequired",
 ]);
-const ENCRYPTED_MARKER_LITERAL_VALUE_KEYS = new Set(["const", "default", "enum", "examples"]);
+const SCHEMA_LITERAL_VALUE_KEYS = new Set(["const", "default", "enum", "examples"]);
+
+// These subtrees depend on property evaluation, polarity, branch selection or references.
+// Preserve their complete argument contract rather than guessing whether a local relaxation
+// remains a relaxation in the containing schema. The destination reports unsupported regexes.
+const PRESERVED_PATTERN_SUBTREES = new Set([
+  "patternProperties", "not", "oneOf", "if", "contains", "$defs", "definitions",
+]);
 
 /**
+ * Codex multi-agent v2 stamps a Responses-only `encrypted: true` marker on collaboration tool
+ * schemas (openai/codex 5f4d06ef; issue #85). It is an annotation for the ChatGPT backend only,
+ * so translated provider schemas must drop it without removing properties or definitions
+ * literally named `encrypted`.
+ *
  * The schema is caller-supplied, so its nesting depth is attacker-influenced. Native recursion
  * would turn a deep schema into a stack overflow that takes down the request path, so this walks
  * an explicit stack instead: depth costs heap, which is bounded and recoverable.
@@ -52,11 +63,11 @@ export function stripResponsesOnlyEncryptedMarker(node: unknown, inNameBag = fal
         // Inside a name bag every key is a caller-chosen name, so `encrypted` here is data.
         stack.push({ node: value, inNameBag: false, assign: v => { out[key] = v; } });
       } else if (key !== "encrypted") {
-        if (ENCRYPTED_MARKER_LITERAL_VALUE_KEYS.has(key)) {
+        if (SCHEMA_LITERAL_VALUE_KEYS.has(key)) {
           // Literal payloads are values, not schemas: an `encrypted` key inside them is data.
           out[key] = value;
         } else {
-          const childInNameBag = ENCRYPTED_MARKER_NAME_BAG_KEYS.has(key);
+          const childInNameBag = SCHEMA_NAME_BAG_KEYS.has(key);
           stack.push({ node: value, inNameBag: childInNameBag, assign: v => { out[key] = v; } });
         }
       }
@@ -65,3 +76,97 @@ export function stripResponsesOnlyEncryptedMarker(node: unknown, inNameBag = fal
 
   return result;
 }
+
+/**
+ * `\p{…}` is an escape only when the backslash introducing it is itself unescaped: in `\\p{2}`
+ * the pair is a literal backslash and the `p{2}` that follows is an ordinary quantified `p`,
+ * which Python compiles fine. Scanning for the raw substring would misread that as a property
+ * escape and discard a working pattern.
+ */
+function usesUnicodePropertyEscape(pattern: string): boolean {
+  for (let i = 0; i < pattern.length; i++) {
+    if (pattern[i] !== "\\") continue;
+    const next = pattern[i + 1];
+    if (next === "\\") {
+      i++;
+      continue;
+    }
+    if ((next === "p" || next === "P") && pattern[i + 2] === "{") return true;
+  }
+  return false;
+}
+
+/**
+ * Remove unsupported Unicode property escapes from scalar `pattern` constraints in ordinary
+ * positive schema positions. This keeps built-in Artifact tools usable on Python-re backends;
+ * the omitted constraint is not enforced by this proxy and tools must validate their inputs.
+ *
+ * Regex-keyed objects are preserved. Removing a matcher can lose evaluated-property annotations
+ * needed by an ancestor's unevaluatedProperties, even when the local object appears open.
+ * Negation, exclusive alternatives, conditions, contains and reusable definitions are also
+ * preserved: loosening a nested constraint can instead reject an input in those contexts.
+ * Unsupported patterns there remain the destination's validation responsibility.
+ *
+ * Returns `node` itself when nothing was dropped. Uses an explicit stack for caller-controlled
+ * nesting depth; the separate Responses-only encrypted-marker normalization is unchanged.
+ */
+export function stripUnicodePropertyPatterns(node: unknown, inNameBag = false): unknown {
+  type Assign = (value: unknown) => void;
+  interface Frame { node: unknown; inNameBag: boolean; assign: Assign }
+
+  let result: unknown;
+  let dropped = 0;
+  const stack: Frame[] = [{ node, inNameBag, assign: value => { result = value; } }];
+
+  while (stack.length > 0) {
+    const frame = stack.pop()!;
+    const current = frame.node;
+
+    if (Array.isArray(current)) {
+      const out: unknown[] = new Array(current.length);
+      frame.assign(out);
+      // Array items are schemas in their own right, never a name bag.
+      for (let i = current.length - 1; i >= 0; i--) {
+        stack.push({ node: current[i], inNameBag: false, assign: value => { out[i] = value; } });
+      }
+      continue;
+    }
+    if (!current || typeof current !== "object") {
+      frame.assign(current);
+      continue;
+    }
+
+    // A schema name may be `__proto__`; a null-prototype record keeps it as data.
+    const out: Record<string, unknown> = Object.create(null) as Record<string, unknown>;
+    frame.assign(out);
+
+    for (const [key, value] of Object.entries(current as Record<string, unknown>)) {
+      if (frame.inNameBag) {
+        // Inside a name bag every key is a caller-chosen name, so `pattern` here is a property
+        // name; its value is still a schema and is walked as one.
+        stack.push({ node: value, inNameBag: false, assign: v => { out[key] = v; } });
+        continue;
+      }
+      if (PRESERVED_PATTERN_SUBTREES.has(key)) {
+        out[key] = value;
+        continue;
+      }
+      if (key === "pattern" && typeof value === "string" && usesUnicodePropertyEscape(value)) {
+        dropped++;
+        continue;
+      }
+      if (SCHEMA_LITERAL_VALUE_KEYS.has(key)) {
+        // Literal payloads are values, not schemas: a `pattern` key inside them is data.
+        out[key] = value;
+        continue;
+      }
+      stack.push({
+        node: value,
+        inNameBag: SCHEMA_NAME_BAG_KEYS.has(key),
+        assign: v => { out[key] = v; },
+      });
+    }
+  }
+
+  return dropped === 0 ? node : result;
+}

package/src/claude/inbound.ts

@@ -150,10 +150,17 @@ function blockedSkillCallIds(messages: readonly unknown[], blocked: readonly str
 
 /**
  * Claude Code (observed 2026-07-11, real CLI smoke) sends `role:"system"` entries in
- * `messages` despite the published API having no system role. Map them to Responses
- * instructions text: the native ChatGPT backend rejects system message items in
- * `input` ("System messages are not allowed", verified live), so folding into
- * `instructions` is the only shape that works on every route.
+ * `messages` despite the published API having no system role. They are emitted as
+ * chronological `role:"developer"` input items, which keeps the timeline intact and
+ * leaves `instructions` owned solely by the top-level Anthropic `system` field.
+ *
+ * The original mapping folded them into `instructions` because the native ChatGPT
+ * backend rejects `role:"system"` items in `input` ("System messages are not allowed",
+ * verified live). That constraint is real and still respected — but it only rules out
+ * `system`, not `developer`, which every Responses route accepts. Folding meant each
+ * mid-conversation reminder mutated the prompt head, invalidating the upstream KV
+ * prefix and rotating the Desktop `prompt_cache_key` fallback below on every turn
+ * (#4148).
  */
 function systemMessageText(content: unknown): string {
   if (typeof content === "string") return content;
@@ -333,7 +340,12 @@ function translateAnthropicRequest(raw: unknown, cc: OcxClaudeCodeConfig | undef
     else if (msg.role === "assistant") assistantMessageToItems(msg.content, input, budget);
     else if (msg.role === "system") {
       const text = systemMessageText(msg.content);
-      if (text.length > 0) systemParts.push(text);
+      // Keep it where the client put it. `developer` is first-class in the Responses
+      // schema and survives parseRequest as a chronological message, where `system`
+      // would be re-hoisted back onto the system prompt and defeat the point.
+      if (text.length > 0) {
+        input.push({ type: "message", role: "developer", content: [{ type: "input_text", text }] });
+      }
     }
     else throw new AnthropicRequestError(`unsupported message role: ${String(msg.role)}`);
   }

package/src/cli/account-api.ts

@@ -18,10 +18,16 @@ export interface AccountRow {
   id: string;
   label?: string;
   email?: string;
-  plan?: string;
+  /**
+   * Subscription tier. `null` means this version looked and the provider did not report one;
+   * an absent key means the row's surface does not carry a tier at all (#3777).
+   */
+  plan?: string | null;
   masked?: string;
   active: boolean;
   needsReauth?: boolean;
+  /** Registered credential that is still excluded from routing until validation completes. */
+  validationPending?: boolean;
   /** Codex pool selection order, higher used earlier. Absent where ordering does not apply. */
   priority?: number;
   quota?: CodexQuotaDto | null;
@@ -237,6 +243,7 @@ interface CodexAccountDto {
   plan?: string;
   isMain?: boolean;
   needsReauth?: boolean;
+  health?: { reason?: string };
   priority?: number;
   quota?: CodexQuotaDto | null;
   quotaRefresh?: unknown;
@@ -263,10 +270,12 @@ export async function fetchCodexRows(
   baseUrl: string,
   forceRefresh = false,
   includeQuota = forceRefresh,
+  options: { refreshAction?: boolean } = {},
 ): Promise<FamilyRows> {
-  const accountsPath = `/api/codex-auth/accounts${forceRefresh ? "?refresh=1" : ""}`;
+  const refreshAction = options.refreshAction === true;
+  const accountsPath = `/api/codex-auth/accounts${refreshAction ? "/refresh" : forceRefresh ? "?refresh=1" : ""}`;
   const [accountsRes, activeRes] = await Promise.all([
-    apiJson(deps, baseUrl, "GET", accountsPath),
+    apiJson(deps, baseUrl, refreshAction ? "POST" : "GET", accountsPath),
     apiJson(deps, baseUrl, "GET", "/api/codex-auth/active"),
   ]);
   if (accountsRes.status !== 0 && accountsRes.status !== 200) {
@@ -300,6 +309,7 @@ export async function fetchCodexRows(
     plan: a.plan,
     active: a.id === activeId,
     needsReauth: a.needsReauth,
+    ...(a.health?.reason === "validation_pending" ? { validationPending: true } : {}),
     priority: typeof a.priority === "number" ? a.priority : 0,
     paused: a.paused === true,
     ...(includeQuota ? {
@@ -316,6 +326,8 @@ interface OAuthAccountDto {
   email?: string;
   active?: boolean;
   needsReauth?: boolean;
+  /** Always sent by the management route; explicitly `null` when the tier is unknown. */
+  plan?: string | null;
   quota?: CodexQuotaDto | null;
   quotaUnavailable?: boolean;
 }
@@ -346,6 +358,9 @@ async function fetchOAuthRows(
     email: a.email,
     active: a.active ?? a.id === activeId,
     needsReauth: a.needsReauth,
+    // Forward the server's answer verbatim, including `null`. Collapsing null to "absent" here
+    // would destroy the one distinction this field exists to make.
+    plan: a.plan ?? null,
     ...(a.quota !== undefined ? { quota: a.quota } : {}),
     ...(a.quotaUnavailable !== undefined ? { quotaUnavailable: a.quotaUnavailable } : {}),
   }));

package/src/cli/account-auth.ts

@@ -154,7 +154,14 @@ async function login(argv: string[], deps: RuntimeApiDeps): Promise<void> {
         {}, deps,
       );
       if (state.status === "done") {
-        printData({ ...state, modelSelection: modelSelectionNextSteps("openai") }, wantsJson, [`Logged in${state.email ? ` as ${String(state.email)}` : ""}.`, ...modelSelectionGuidance("openai")]);
+        if (state.validationPending === true) {
+          printData({ ...state, recoveryCommand: "ocx gui", recoveryAction: "After quota recovers, click Refresh quotas in the dashboard Codex account pool." }, wantsJson, [
+            "Account registered; validation pending (routing disabled).",
+            "After quota recovers, open 'ocx gui' and click Refresh quotas to complete validation.",
+          ]);
+        } else {
+          printData({ ...state, modelSelection: modelSelectionNextSteps("openai") }, wantsJson, [`Logged in${state.email ? ` as ${String(state.email)}` : ""}.`, ...modelSelectionGuidance("openai")]);
+        }
         if (!wantsJson) warnIfCodexCatalogRefreshPending(state);
         return;
       }

package/src/cli/account-extended.ts

@@ -264,6 +264,7 @@ function refreshLine(row: FamilyRows["rows"][number]): string {
   const quotaText = row.quota ? quotaParts(row.quota).join(" ") : "";
   parts.push(quotaText.length > 0 ? quotaText : "quota: unknown");
   if (row.needsReauth) parts.push("needs-reauth");
+  if (row.validationPending) parts.push("validation-pending (routing disabled; open 'ocx gui' and click Refresh quotas after recovery)");
   return parts.filter(Boolean).join(" ");
 }
 
@@ -339,7 +340,7 @@ export async function cmdRefresh(args: string[], deps: AccountDeps): Promise<num
     } else console.log(`no quota report available for ${name}`);
     return 0;
   }
-  const result = await fetchCodexRows(deps, baseUrl, true);
+  const result = await fetchCodexRows(deps, baseUrl, true, true, { refreshAction: true });
   const failed = familyFailure(result, `failed to refresh ${name}`);
   if (failed !== null) return failed;
   if (wantsJson) console.log(JSON.stringify({ accounts: result.rows }, null, 2));

package/src/cli/account.ts

@@ -99,6 +99,7 @@ function statusText(row: AccountRow): string {
   if (row.paused) parts.push("paused");
   if (row.active) parts.push(row.type === "codex" ? "selected" : "active");
   if (row.needsReauth) parts.push("needs-reauth");
+  if (row.validationPending) parts.push("validation-pending");
   return parts.join(" ");
 }
 

package/src/cli/capabilities.ts

@@ -219,6 +219,18 @@ export const CAPABILITIES: readonly Capability[] = [
       "`--quota` shows cached Codex windows (including 5h); `--refresh` bypasses the server TTL.",
     ],
   },
+  {
+    command: ["account", "refresh"],
+    summary: "Refresh account quotas without model validation; pending Codex accounts require dashboard consent.",
+    routes: [
+      { method: "POST", path: "/api/codex-auth/accounts/refresh" },
+      { method: "GET", path: "/api/provider-quotas" },
+    ],
+    flags: [{ name: "--json", value: "boolean", summary: "Emit the refresh result as JSON." }],
+    mutates: true,
+    json: "payload",
+    details: ["CLI/admin-token refreshes only observe usage. After quota recovery, a human must click Refresh quotas in the dashboard to authorize model validation. Do not mint a GUI session to work around this consent boundary."],
+  },
   {
     command: ["usage"],
     summary: "Token and estimated-cost report over a time range.",
@@ -307,12 +319,13 @@ export const CAPABILITIES: readonly Capability[] = [
   },
   {
     command: ["logs"],
-    summary: "Recent request log rows, filterable by provider, model, conversation, and status.",
+    summary: "Recent request log rows, filterable by provider, model, conversation, account, and status.",
     routes: [{ method: "GET", path: "/api/logs" }],
     flags: [
       { name: "--provider", value: "string", summary: "Restrict to one provider, matching failover attempts too." },
       { name: "--model", value: "string", summary: "Restrict to one model id, matching failover attempts too." },
       { name: "--conversation", value: "string", summary: "Restrict to one conversation id (`--conversationId` is accepted too)." },
+      { name: "--account", value: "string", summary: "Restrict to one account log label (`main`, `p<hex6>`, `o<hex6>`), matching failover attempts too." },
       { name: "--status", value: "string", summary: "An exact code (429) or a class (5xx)." },
       { name: "--limit", value: "number", summary: "Row cap; defaults to 200." },
       { name: "--follow", value: "boolean", summary: "Poll for new rows; add --jsonl to emit JSONL." },
@@ -324,6 +337,7 @@ export const CAPABILITIES: readonly Capability[] = [
     details: [
       "`--provider` and `--model` both match a failover attempt, so a request is findable by what actually served it, not only by what was asked for.",
       "Rows print `conv=<id>` when the entry carries one, so a conversation filter can be told apart from an empty result.",
+      "Rows print `acct=<label>` when the account is known, so an `--account` filter can be told apart from an empty result.",
       "`--follow` deduplicates by row id and cannot be combined with `--json`.",
     ],
   },

package/src/cli/dispatch.ts

@@ -25,6 +25,7 @@ import { afterCatalogWriteHandleAppServers } from "../codex/app-server-processes
 import { normalizeUpdateChannel, runGuiUpdateWorker } from "../update/job";
 import { isJsonOption, takeFlag } from "./runtime-api";
 import type { ClientConnectionState } from "../client/state";
+import { OCX_NATIVE_REPLAY_RECOVERY_NOTE } from "../responses/compaction";
 
 export interface CliDispatchDeps {
   args: string[];
@@ -199,6 +200,7 @@ const commandRunners: Record<string, CommandRunner> = {
     }
     if (r.success) {
       console.log("Codex integration is OFF and plain `codex` now runs natively. Switch back with: ocx restore back");
+      console.log(`Note: ${OCX_NATIVE_REPLAY_RECOVERY_NOTE}`);
     } else {
       console.error("Plain `codex` was not fully restored. Inspect $CODEX_HOME/config.toml before using native Codex.");
     }

package/src/cli/doctor.ts

@@ -45,6 +45,9 @@ import {
   probeCodexCoordinatorNamespace,
   resolveEffectiveUserIdentity,
 } from "../codex/user-identity";
+import { isCanonicalOpenAiForwardProvider } from "../providers/openai-tiers-destination";
+import type { OcxProviderConfig } from "../types/provider";
+import { routedProviderConfig } from "../router";
 import { collectProjectCodexConfigWarnings, formatProjectCodexConfigWarningsForDoctor } from "../codex/project-config-warnings";
 import {
   collectLegacyCodexConfigKeyDiagnostics,
@@ -1000,6 +1003,41 @@ export function proxyDownRestartHint(input: {
   return `The ocx proxy is not running. ${uncleanExit}Codex/Claude clients pinned to 127.0.0.1:${input.port} fail with errors like "error sending request for url (http://127.0.0.1:${input.port}/v1/responses)". ${restart}`;
 }
 
+/** Explain the expected channel and latency trade-off for native ChatGPT routing. */
+export function chatgptPublicEndpointHint(
+  providers: Record<string, unknown> | undefined,
+): string | null {
+  const openai = providers?.openai;
+  if (!openai || typeof openai !== "object") {
+    return null;
+  }
+  // A disabled row never routes, so it must not be described as the route in use.
+  const configured = openai as OcxProviderConfig;
+  if (configured.disabled === true) {
+    return null;
+  }
+  // Classify the destination the router resolves, not the raw config text. Two things follow
+  // from the registry entry for the built-in `openai` id: a row that omits `authMode` still
+  // forwards, and a row carrying some other `baseUrl` has it discarded in favour of the
+  // canonical ChatGPT endpoint. Both keep using the public endpoint, so both want this hint;
+  // reading the raw row would have suppressed the first and misjudged the second.
+  //
+  // `routedProviderConfig` throws for an unresolved URL only when the registry entry allows a
+  // baseUrl override, which this entry does not, so no input reaches that path today. The guard
+  // is here because doctor is read-only diagnostics: a later registry change must not turn a
+  // diagnostic into a crash.
+  let routed: OcxProviderConfig;
+  try {
+    routed = routedProviderConfig("openai", configured);
+  } catch {
+    return null;
+  }
+  if (!isCanonicalOpenAiForwardProvider(routed)) {
+    return null;
+  }
+  return "ChatGPT-family requests use the public ChatGPT endpoint through this proxy, in both Pool and Direct modes. Eligible streaming turns dial the ChatGPT websocket transport (the same responses_websockets lane Codex CLI defaults to) and fall back to SSE over HTTP when a turn is not eligible - an unsupported Bun runtime, an oversized create frame, or a proxy route that cannot carry the socket - and local provider pacing can hold a request before it is dispatched at all. This hint classifies configuration only and measures nothing, so upstream queueing is one possible contributor to a slow first output: compare actual transport, pacing, network, and provider observations before concluding. service_tier=priority is a request preference: this backend can echo service_tier \"default\" even on turns it scheduled as priority (#2558), so the echoed response tier in request logs stays an observation with confirmation \"assumed\" and cannot confirm or deny the granted tier.";
+}
+
 export async function runDoctor(args: string[] = []): Promise<void> {
   if (args.includes("--fix-codex-runtime")) {
     const resolved = resolveCodexRuntime();
@@ -1330,6 +1368,8 @@ export async function runDoctor(args: string[] = []): Promise<void> {
 
   // Hints, not fixes.
   const hints: string[] = [];
+  const chatgptHint = chatgptPublicEndpointHint(doctorConfig.providers);
+  if (chatgptHint) hints.push(chatgptHint);
   const proxyDown = proxyDownRestartHint({
     proxyRunning: Boolean(live),
     port: live?.port ?? doctorConfig.port ?? 10100,

package/src/cli/effort.ts

@@ -2,6 +2,7 @@ import { loadConfig, saveConfig } from "../config";
 import {
   CODEX_REASONING_LEVELS,
   configuredReasoningEfforts,
+  isCodexReasoningEffort,
   isDeclaredReasoningEffort,
   mapReasoningEffort,
   reasoningEffortMapFor,
@@ -21,7 +22,7 @@ import {
 
 export const EFFORT_USAGE = `Usage:
   ocx effort [status] [--json]
-  ocx effort <low|medium|high|xhigh|max|ultra|none|minimal|-> [--json]
+  ocx effort <low|medium|high|xhigh|max|ultra|-> [--json]
   ocx effort set [--main <level|->] [--subagent <level|->] [--injection <level|->] [--json]
   ocx effort clear [--json]
   ocx effort model <provider/model|model> [--json]
@@ -33,13 +34,18 @@ function clearable(value: string | undefined): string | null | undefined {
   return value === "-" ? null : value;
 }
 
-function validateEffortLevel(level: string | null | undefined, label: string): string | null | undefined {
+function validateEffortLevel(
+  level: string | null | undefined,
+  label: string,
+  kind: "cap" | "injection",
+): string | null | undefined {
   if (level === undefined || level === null) return level;
   const trimmed = level.trim();
   if (trimmed === "-" || trimmed === "") return null;
-  if (!isDeclaredReasoningEffort(trimmed)) {
+  const valid = kind === "cap" ? isCodexReasoningEffort(trimmed) : isDeclaredReasoningEffort(trimmed);
+  if (!valid) {
     throw new CliUsageError(
-      `unknown reasoning effort "${trimmed}" for ${label} (allowed: ${CODEX_REASONING_LEVELS.map(l => l.effort).join(", ")}, none, minimal, -)`,
+      `unknown reasoning effort "${trimmed}" for ${label} (allowed: ${CODEX_REASONING_LEVELS.map(l => l.effort).join(", ")}${kind === "injection" ? ", none, minimal" : ""}, -)`,
       EFFORT_USAGE,
     );
   }
@@ -114,6 +120,15 @@ async function status(wantsJson: boolean, deps: RuntimeApiDeps): Promise<void> {
     data = getOfflineStatus();
   }
 
+  // Report the stored/runtime value exactly as the enforcement layer evaluates it.
+  // An ignored subagent field does not disable a valid main cap on that child.
+  const warnings = ([ ["effortCap", "--main"], ["subagentEffortCap", "--subagent"] ] as const)
+    .flatMap(([key, flag]) => {
+      const value = data[key];
+      if (value === null || isCodexReasoningEffort(value)) return [];
+      return [`${key}=${JSON.stringify(value)} is invalid and is not applied. Use: ocx effort set ${flag} <${CODEX_REASONING_LEVELS.map(l => l.effort).join("|")}|->.`];
+    });
+
   const lines = [
     `Reasoning effort status (${data.source === "runtime" ? "live proxy" : "offline config"}):`,
     `  Main agent effort cap:     ${data.effortCap ?? "(unset — no cap)"}`,
@@ -122,9 +137,10 @@ async function status(wantsJson: boolean, deps: RuntimeApiDeps): Promise<void> {
     "",
     "Supported Codex reasoning effort ladder:",
     ...CODEX_REASONING_LEVELS.map(l => `  - ${l.effort.padEnd(8)} ${l.description}`),
+    ...(warnings.length ? ["", "Warnings:", ...warnings.map(warning => `  ${warning}`)] : []),
   ];
 
-  printData(data, wantsJson, lines);
+  printData({ ...data, warnings }, wantsJson, lines);
 }
 
 async function setEffort(
@@ -136,9 +152,9 @@ async function setEffort(
   wantsJson: boolean,
   deps: RuntimeApiDeps,
 ): Promise<void> {
-  const validatedMain = validateEffortLevel(options.main, "--main");
-  const validatedSubagent = validateEffortLevel(options.subagent, "--subagent");
-  const validatedInjection = validateEffortLevel(options.injection, "--injection");
+  const validatedMain = validateEffortLevel(options.main, "--main", "cap");
+  const validatedSubagent = validateEffortLevel(options.subagent, "--subagent", "cap");
+  const validatedInjection = validateEffortLevel(options.injection, "--injection", "injection");
 
   if (validatedMain === undefined && validatedSubagent === undefined && validatedInjection === undefined) {
     throw new CliUsageError("at least one effort option (--main, --subagent, or --injection) is required", EFFORT_USAGE);

package/src/cli/help.ts

@@ -33,6 +33,8 @@ Usage:
   ocx restore back            Re-point codex at the running proxy (undo restore)
   ocx recover-history --legacy-openai --yes
                                Force all user-message opencodex rows to OpenAI (legacy recovery)
+  ocx recover-history --ocx-compaction <thread-id> --yes
+                               Back up and make one ocx1-compacted thread replayable by native Codex
   ocx uninstall               Remove service/shim/config and restore native Codex (alias: remove)
   ocx service [sub]           Run as a background service (default: install/update/start)
   ocx codex-shim <sub>        Auto-start proxy when \`codex\` launches (install|status|uninstall|remove)

package/src/cli/index.ts

@@ -1428,9 +1428,13 @@ async function handleStatus() {
     }
   }
   const { collectOAuthHealthEntriesForCli, oauthLoginSummary } = await import("../oauth");
+  const { emailMaskingEnabled } = await import("../lib/privacy");
   const { formatOAuthHealthForStatus } = await import("./status-oauth");
   console.log(`   OAuth logins:`);
-  for (const e of oauthLoginSummary()) {
+  // The operator's own `privacy.maskEmails` decision applies to the CLI too: `ocx status` is not
+  // the dashboard, but it reads the same stored addresses, and a flag that only moved one of the
+  // two would leave the operator unable to tell which surface they had configured.
+  for (const e of oauthLoginSummary(emailMaskingEnabled(loadConfig()))) {
     console.log(`     ${e.provider.padEnd(10)} ${e.loggedIn ? `✓ logged in${e.email ? ` (${e.email})` : ""}` : "✗ not logged in"}`);
   }
   const oauthHealthBlock = formatOAuthHealthForStatus(await collectOAuthHealthEntriesForCli());
@@ -1442,8 +1446,31 @@ async function handleStatus() {
 }
 
 async function handleRecoverHistory() {
+  if (args[1] === "--ocx-compaction") {
+    const threadId = args[2];
+    if (args.length !== 4 || !threadId || args[3] !== "--yes") {
+      console.error("Usage: ocx recover-history --ocx-compaction <thread-id> --yes");
+      console.error("This rewrites one rollout after saving a private byte-for-byte backup. Close that Codex thread before retrying.");
+      process.exit(1);
+    }
+    console.error("WARNING: this converts OpenCodeX-owned ocx1 compaction state into a plain summary for native Codex replay.");
+    try {
+      const { recoverOcxCompactionHistory } = await import("../codex/ocx-compaction-history");
+      const result = recoverOcxCompactionHistory({ threadId });
+      if (result.replaced === 0) {
+        console.log(`Thread ${threadId} has no repairable ocx1 compaction history; no files changed.`);
+        return;
+      }
+      console.log(`Recovered ${result.replaced} ocx1 compaction item(s) in thread ${threadId}.`);
+      console.log(`Backup: ${result.backupPath}`);
+      return;
+    } catch (error) {
+      console.error(`Recovery failed: ${error instanceof Error ? error.message : String(error)}`);
+      process.exit(1);
+    }
+  }
   if (args[1] !== "--legacy-openai") {
-    console.error("Usage: ocx recover-history --legacy-openai --yes");
+    console.error("Usage: ocx recover-history (--legacy-openai | --ocx-compaction <thread-id>) --yes");
     console.error("This force-relabels every user-message opencodex row to OpenAI, including legitimate dedicated-provider history. Back up first and use it only for pre-backup legacy recovery.");
     process.exit(1);
   }