@bitkyc08/opencodex 2.48.0 → 2.50.0

package/src/codex/catalog/provider-fetch.ts

@@ -52,12 +52,15 @@ import { CODEX_GPT5_IDENTITY_LINE } from "../../adapters/identity";
 import { filterCursorConfiguredModelsByLiveDiscovery } from "../../adapters/cursor/discovery";
 import { fetchCursorUsableModels } from "../../adapters/cursor/live-models";
 import { recordLiveCursorClaudeModels, recordLiveCursorMaxModeModels } from "../../adapters/cursor/catalog";
+import { fetchQoderModels } from "../../adapters/qoder/live-models";
+import { resolveQoderProfile } from "../../adapters/qoder/profiles";
 import { isCanonicalOpenAiForwardProvider, OPENAI_API_PROVIDER_ID, OPENAI_CODEX_PROVIDER_ID } from "../../providers/openai-tiers";
 import {
   COMBO_NAMESPACE,
   comboModelId,
   getCombo,
   listComboIds,
+  quotaInactiveReason,
   targetKey,
 } from "../../combos";
 import type { NormalizedComboConfig } from "../../combos/types";
@@ -77,6 +80,7 @@ import {
   type ProviderModelsApiItem,
   type ResolvedProviderModelDiscovery,
 } from "../../providers/model-discovery";
+import { extractGoogleAiStudioModelItems } from "../../providers/google-ai-studio-model-discovery";
 import { applyConfiguredHeadersLast, fetchOllamaShowEnrichment, ollamaShowEnrichable } from "../../providers/ollama-show";
 import upstreamModelsSnapshot from "../data/upstream-models.json";
 import { createAdmissionGate, ResourceAdmissionError, type AdmissionMetrics } from "../../lib/admission";
@@ -952,16 +956,21 @@ function comboMemberVendorMetadata(provider: string, modelId: string): ModelMeta
  */
 function vendorMetadataComboFallback(target: { provider: string; model: string }): ComboCatalogMemberFallback | undefined {
   const metadataProvider = resolveMetadataProvider(target.provider);
-  const metadata = metadataProvider ? comboMemberVendorMetadata(metadataProvider, target.model) : undefined;
+  // Custom OpenAI-compatible routes commonly retain the canonical OpenAI model id
+  // while using a provider name that has no metadata alias. Reuse only its effort
+  // ladder below; context/modality rows remain provider-owned.
+  const metadata = metadataProvider
+    ? comboMemberVendorMetadata(metadataProvider, target.model)
+    : comboMemberVendorMetadata("openai", target.model);
   if (!metadata) return undefined;
   return {
-    ...(typeof metadata.contextWindow === "number" && metadata.contextWindow > 0
+    ...(metadataProvider && typeof metadata.contextWindow === "number" && metadata.contextWindow > 0
       ? { contextWindow: metadata.contextWindow }
       : {}),
-    ...(typeof metadata.maxTokens === "number" && metadata.maxTokens > 0
+    ...(metadataProvider && typeof metadata.maxTokens === "number" && metadata.maxTokens > 0
       ? { maxOutputTokens: metadata.maxTokens }
       : {}),
-    ...(Array.isArray(metadata.input) && metadata.input.length > 0
+    ...(metadataProvider && Array.isArray(metadata.input) && metadata.input.length > 0
       ? { inputModalities: [...metadata.input] }
       : {}),
     ...(metadata.reasoning === true ? { reasoningEfforts: [...ROUTED_COMBO_MEMBER_REASONING_EFFORTS] } : {}),
@@ -1038,15 +1047,21 @@ export function resolveComboCatalogMember(
     && typeof existing.contextWindow === "number"
     && existing.contextWindow > 0
   ) {
-    const capped = applyProviderContextCap(existing.contextWindow, contextCap);
+    // Live discovery can explicitly say text-only even when configured routing
+    // supplies a vision sidecar. Apply the same provider hints used for thin
+    // rows before deriving a combo from this complete row.
+    const hinted = prov && isModelVisionSidecarConsumer(prov, existing.id)
+      ? applyProviderConfigHints(target.provider, prov, existing, contextCap, metadataModelIdCaseFold)
+      : existing;
+    const capped = applyProviderContextCap(hinted.contextWindow, contextCap);
     if (capped === undefined || capped === existing.contextWindow) {
-      return withFallbackMetadata(existing);
+      return withFallbackMetadata(hinted);
     }
-    const maxInput = typeof existing.maxInputTokens === "number" && existing.maxInputTokens > 0
-      ? Math.min(existing.maxInputTokens, capped)
+    const maxInput = typeof hinted.maxInputTokens === "number" && hinted.maxInputTokens > 0
+      ? Math.min(hinted.maxInputTokens, capped)
       : Math.min(fallback?.maxInputTokens ?? capped, capped);
     return withFallbackMetadata({
-      ...existing,
+      ...hinted,
       contextWindow: capped,
       maxInputTokens: maxInput,
       contextCap,
@@ -1387,6 +1402,51 @@ function modelInputModalities(
   return undefined;
 }
 
+/**
+ * A per-token rate exactly as a /models row publishes it, or undefined when the value is not a
+ * usable non-negative number. Providers ship these both as JSON numbers and as decimal strings —
+ * OpenRouter encodes free as the string `"0.00000000"` — so both shapes are accepted and nothing
+ * else is. The explicit numeric-shape test has to run BEFORE any coercion: `Number("")` and
+ * `Number(" ")` are both 0 and `Number(true)` is 1, so a bare `Number(value)` would classify a
+ * row with an empty price string as free.
+ */
+const DISCOVERED_PRICING_RATE_PATTERN = /^-?\d+(?:\.\d+)?(?:[eE][-+]?\d+)?$/;
+
+function discoveredPricingRate(value: unknown): number | undefined {
+  const numeric = typeof value === "number"
+    ? value
+    : typeof value === "string" && DISCOVERED_PRICING_RATE_PATTERN.test(value.trim())
+      ? Number(value.trim())
+      : undefined;
+  if (numeric === undefined || !Number.isFinite(numeric) || numeric < 0) return undefined;
+  return numeric;
+}
+
+/**
+ * Cost class for one discovered row, read from the provider's own `pricing` object (#3666).
+ *
+ * Fail closed. Only a complete pair of non-negative numeric rates classifies at all; a missing,
+ * one-sided, non-numeric, or negative rate is "unknown" and therefore excluded from a free-only
+ * filter. Showing a paid model under a Free filter spends the user's money, while hiding a free
+ * one costs a click.
+ *
+ * Two things that look like evidence and are not. A `:free` id suffix is an OpenRouter naming
+ * convention, not a price — Nous ships `:free` slugs on a provider whose `freeTier` is false on
+ * purpose. And the operator's own `modelCosts` overlay is an estimate they typed, not something
+ * the provider published, so a zeroed overlay never reaches this field either.
+ *
+ * Classification is on numeric zero and never on a unit conversion: OpenRouter quotes USD per
+ * token while the cost overlays and the jawcode bundle quote per 1M, and zero is zero in both.
+ */
+export function discoveredPricingStatus(item: ProviderModelsApiItem): "free" | "paid" | "unknown" {
+  const pricing = plainRecord(item.pricing) ?? plainRecord(plainRecord(item.metadata)?.pricing);
+  if (!pricing) return "unknown";
+  const prompt = discoveredPricingRate(pricing.prompt ?? pricing.input);
+  const completion = discoveredPricingRate(pricing.completion ?? pricing.output);
+  if (prompt === undefined || completion === undefined) return "unknown";
+  return prompt === 0 && completion === 0 ? "free" : "paid";
+}
+
 export function catalogHintsFromModelsApiItem(providerName: string, item: ProviderModelsApiItem): Partial<CatalogModel> {
   const metadata = plainRecord(item.metadata);
   const capabilityRecord = plainRecord(metadata?.capabilities) ?? plainRecord(item.capabilities);
@@ -1412,6 +1472,13 @@ export function catalogHintsFromModelsApiItem(providerName: string, item: Provid
       // supplying a recognized field changes behavior (#1797).
       plainRecord(item.meta)?.n_ctx,
       plainRecord(item.meta)?.n_ctx_train,
+      // A chained OpenCodex hub (and other re-serving gateways) reports the per-model
+      // window on the same capability record this function already reads for
+      // `max_output_tokens` below (#4032). Without it every routed row fell through to
+      // the 128k compatibility floor in parsing.ts while local forward rows kept their
+      // real values. Appended after the recognized fields for the same reason as the
+      // llama.cpp entries above: no provider that already resolves changes behavior.
+      capabilityRecord?.context_length,
     );
   const maxInputTokens = positiveSafeInteger(limits?.max_input_tokens, item.max_input_tokens);
   const maxOutputTokens = positiveSafeInteger(
@@ -1444,6 +1511,7 @@ export function catalogHintsFromModelsApiItem(providerName: string, item: Provid
       : undefined;
   const capabilities = modelCapabilities(item);
   const inputModalities = modelInputModalities(item, capabilities);
+  const pricingStatus = discoveredPricingStatus(item);
   return {
     ...(contextWindow && contextWindow > 0 ? { contextWindow } : {}),
     ...(maxInputTokens && maxInputTokens > 0 ? { maxInputTokens } : {}),
@@ -1451,6 +1519,11 @@ export function catalogHintsFromModelsApiItem(providerName: string, item: Provid
     ...(reasoningEfforts !== undefined ? { reasoningEfforts } : {}),
     ...(inputModalities ? { inputModalities } : {}),
     ...(capabilities ? { capabilities } : {}),
+    // Omitted when the classification is "unknown", following this function's existing
+    // contract that an unknown property is absent rather than present-and-empty. Callers
+    // that need to tell "provider published no prices" from "this build does not classify"
+    // call discoveredPricingStatus directly.
+    ...(pricingStatus !== "unknown" ? { pricingStatus } : {}),
   };
 }
 
@@ -1582,6 +1655,50 @@ async function fetchProviderModelsWithAuth(
       ? [...models, vertexDefaultSeed]
       : models
   );
+  if (prov.adapter === "qoder") {
+    if (!apiKey) return observed(configured, "degraded");
+    const profile = resolveQoderProfile(prov.baseUrl);
+    if (!profile) return observed(configured, "degraded");
+    // Qoder's model list is entitlement-specific. Bind cache reads/writes to an irreversible PAT
+    // fingerprint so an account switch cannot observe another account's roster, even if a caller
+    // bypasses the normal config mutation path that clears provider caches.
+    const authorityIdentity = createHash("sha256").update(apiKey).digest("hex");
+    const fresh = getFreshCached(name, ttlMs, Date.now(), authorityIdentity);
+    if (fresh) {
+      return observed(withConfiguredRetention(
+        applyConfigHintsToCachedModels(name, prov, fresh, contextCap, metadataModelIdCaseFold, captured.effectiveAlias),
+      ), "authoritative");
+    }
+    const scopedStale = getStaleCached(name, authorityIdentity);
+    if (isModelsFetchCoolingDown(name) && scopedStale) {
+      return observed(withConfiguredRetention(
+        applyConfigHintsToCachedModels(name, prov, scopedStale, contextCap, metadataModelIdCaseFold, captured.effectiveAlias),
+      ), "degraded");
+    }
+    const live = await fetchQoderModels(profile, apiKey);
+    if (live.ok) {
+      const discovered = live.models.map(id => ({
+        id,
+        provider: name,
+        ...catalogHintsFromProviderConfig(name, prov, id, contextCap, metadataModelIdCaseFold, captured.effectiveAlias),
+      }));
+      const forCache = withConfiguredRetention(discovered, { retainComboTargets: false });
+      if (!setCached(name, forCache, Date.now(), cacheGeneration, authorityIdentity)) {
+        return observed(withConfiguredRetention(configured), "degraded");
+      }
+      markProviderDiscoveryOk(name, live.models.length);
+      return observed(withConfiguredRetention(forCache, { warnDrops: true }), "authoritative");
+    }
+    if (isCurrentCacheGeneration()) {
+      markModelsFetchFailure(name);
+      markProviderDiscoveryFailed(name, { reason: "provider" });
+      console.warn(`[opencodex] Qoder model discovery for "${name}" failed [${live.error}]${live.detail ? `: ${live.detail}` : ""}; using stale/static catalog degradation.`);
+    }
+    const stale = getStaleCached(name, authorityIdentity);
+    return observed(withConfiguredRetention(
+      stale ? applyConfigHintsToCachedModels(name, prov, stale, contextCap, metadataModelIdCaseFold, captured.effectiveAlias) : configured,
+    ), "degraded");
+  }
   if (prov.adapter === "cursor") {
     if (!apiKey) return observed(configured, "degraded");
     // Cursor uses a bespoke GetUsableModels RPC (not /models), returning the full effort-suffixed
@@ -1807,7 +1924,14 @@ async function fetchProviderModelsWithAuth(
       markProviderDiscoveryOk(name, live.length);
       return observed(withConfiguredRetention(forCache, { warnDrops: true }), "authoritative");
     }
-    const extracted = extractProviderModelItems(bounded.value, discovery);
+    const googleAiStudio = effectiveGoogleMode(name, prov) === "ai-studio"
+      ? extractGoogleAiStudioModelItems(bounded.value, discovery.maxModels)
+      : undefined;
+    // Native /v1beta/models wins; a google row served by an OpenAI-compatible
+    // gateway keeps the generic data[] / top-level-array contract.
+    const extracted = googleAiStudio?.ok
+      ? googleAiStudio
+      : extractProviderModelItems(bounded.value, discovery);
     if (!extracted.ok) {
       const { models, fallback, shouldLog } = failedDiscoveryFallback({ reason: "invalid_response" });
       const diagnostic: Record<ModelDiscoveryResponseFailure, string> = {
@@ -2558,7 +2682,16 @@ async function gatherRoutedModelsUncached(
   return {
     models: models.map(model => {
       const displayName = aliasDisplayNames.get(`${model.provider}/${model.id}`);
-      return displayName && !model.displayName ? { ...model, displayName } : model;
+      // #1711: one stamping point for every row this gather produces — routed, combo, and custom
+      // alike — because it is the only place that has both the finished list and the config the
+      // quota rules need. A combo votes over its own targets; anything else votes over the single
+      // provider that would serve it.
+      const targets = model.provider === COMBO_NAMESPACE
+        ? config.combos?.[model.id]?.targets ?? []
+        : [{ provider: model.provider }];
+      const inactive = quotaInactiveReason(config, targets);
+      const named = displayName && !model.displayName ? { ...model, displayName } : model;
+      return inactive ? { ...named, quotaInactiveReason: inactive } : named;
     }),
     comboOmissions: localOmissions,
     providerAuthOutcomes: localProviderAuthOutcomes,

package/src/codex/catalog/sync.ts

@@ -99,6 +99,12 @@ export const PICKER_ORDER_PRIORITY_BASE = 1_000;
 // independent of display order. It does not freeze native advertisements. Absent on unmoved rows.
 export const SPAWN_PRIORITY_FIELD = "opencodex_spawn_priority";
 
+// OpenCodex-private catalog field: this row is listed but currently unable to serve (#1711).
+// Codex ignores unknown catalog fields (same as opencodex_catalog_kind and the spawn priority
+// above) and ensureStrictCatalogFields does not strip extras, so this is invisible to the native
+// picker and cannot change what Codex offers. It never touches `visibility`.
+export const CATALOG_INACTIVE_REASON_FIELD = "opencodex_inactive_reason";
+
 export type SpawnAgentSurface = "v1" | "v2";
 
 export type SubagentRosterExclusionReason =
@@ -383,6 +389,10 @@ export function deriveEntry(
       if (model) applyCatalogMetadata(e, model.provider, model.id, model.contextCap);
       applyCatalogModelMetadata(e, model);
       if (model?.catalogKind) e.opencodex_catalog_kind = model.catalogKind;
+      // Additive only. `visibility` is untouched: an inactive row must still be OFFERED, which is
+      // the whole point of #1711 — operator disable is what removes rows, and it stays a separate
+      // path from this one.
+      if (model?.quotaInactiveReason) e[CATALOG_INACTIVE_REASON_FIELD] = model.quotaInactiveReason;
     } else {
       applyNativeOpenAiContextOverride(e, contextCap);
       if (isGpt56NativeSlug(slug)) ensureGpt56ReasoningLevels(e);
@@ -430,6 +440,10 @@ export function deriveEntry(
   if (model && isRouted) applyCatalogMetadata(entry, model.provider, model.id, model.contextCap);
   applyCatalogModelMetadata(entry, model);
   if (model?.catalogKind) entry.opencodex_catalog_kind = model.catalogKind;
+  // Same additive stamp as the templated path above. A routed row that reaches the no-template
+  // fallback is still a served row, so omitting it here would make the field depend on whether a
+  // template happened to be cached — which is exactly what the regression test caught.
+  if (model?.quotaInactiveReason) entry[CATALOG_INACTIVE_REASON_FIELD] = model.quotaInactiveReason;
   if (!isRouted) applyNativeOpenAiContextOverride(entry, contextCap);
   return ensureStrictCatalogFields(normalizeServiceTiers(entry), {
     preserveExactInputModalities: preserveExact,

package/src/codex/inject.ts

@@ -31,6 +31,7 @@ import {
   resolveEffectiveUserIdentity,
 } from "./user-identity";
 import {
+  hasUnverifiedJournalBaseline,
   markJournalInjectedState,
   journaledInjectedOpenaiBaseUrl,
   journaledInjectedRealtimeWsBaseUrl,
@@ -174,6 +175,8 @@ export interface CodexRoutingTarget {
    * and is never weakened by this flag.
    */
   desktopAuthless?: boolean;
+  /** Select the dedicated provider identity so Codex owns compaction locally. */
+  clientCompaction?: boolean;
 }
 
 function validateCodexRoutingTarget(target: CodexRoutingTarget): CodexRoutingTarget {
@@ -197,14 +200,19 @@ function validateCodexRoutingTarget(target: CodexRoutingTarget): CodexRoutingTar
   return { ...target, baseUrl: `${parsed.origin}/v1` };
 }
 
-/** Provider-table form is used for non-loopback admission and for the authless Desktop opt-in. */
+/** Provider-table form is used when auth, admission, or compaction policy needs a dedicated provider. */
 function usesProviderTable(target: CodexRoutingTarget): boolean {
-  return target.requiresAdmissionToken || target.desktopAuthless === true;
+  return target.requiresAdmissionToken
+    || target.desktopAuthless === true
+    || target.clientCompaction === true;
 }
 
 export function standaloneCodexRoutingTarget(
   port: number,
-  config?: Pick<OcxConfig, "hostname" | "unauthenticatedLoopbackListener" | "codexDesktopAuthless">,
+  config?: Pick<
+    OcxConfig,
+    "hostname" | "unauthenticatedLoopbackListener" | "codexDesktopAuthless" | "codexClientCompaction"
+  >,
 ): CodexRoutingTarget {
   const loopback = config?.unauthenticatedLoopbackListener;
   const effectivePort = loopback?.enabled ? loopback.port : port;
@@ -217,6 +225,9 @@ export function standaloneCodexRoutingTarget(
     ...(config?.codexDesktopAuthless === true && !requiresAdmissionToken
       ? { desktopAuthless: true }
       : {}),
+    ...(config?.codexClientCompaction === true && !requiresAdmissionToken
+      ? { clientCompaction: true }
+      : {}),
   };
 }
 
@@ -833,7 +844,7 @@ function buildProfileFileForTarget(
   const host = new URL(origin).host;
   // Design B (loopback): the reference/fallback file documents the root override form.
   // Non-loopback keeps the legacy provider-table shape (built-in provider cannot carry
-  // the x-opencodex-api-key env header); the authless Desktop opt-in shares that shape.
+  // the x-opencodex-api-key env header); explicit Desktop policies share that shape.
   if (!usesProviderTable(target)) {
     const lines = [
       "# OpenCodex proxy fallback config (Design B)",
@@ -1014,11 +1025,37 @@ export async function injectCodexConfig(
     ? setRootModelCatalogPath(content, catalogPath)
     : stripOpencodexCatalogPath(content);
 
-  // Provider-table form: non-loopback admission (legacy) or the authless Desktop opt-in (#1107).
-  const legacyMode = usesProviderTable(routingTarget);
+  // Provider-table form: non-loopback admission or an explicit Desktop policy.
+  const providerTableMode = usesProviderTable(routingTarget);
+  // Client compaction is the one table form that must not orphan existing threads. It changes
+  // the DEFAULT provider to `opencodex`, but a thread already tagged `openai` keeps resolving
+  // to Codex's built-in entry, and without the root override that entry is api.openai.com —
+  // the thread would resume outside this proxy and outside configured routing. Keeping the
+  // marker-owned root override alongside the table fixes that at the source: codex builds its
+  // provider map as merge_configured_model_providers(built_in_model_providers(openai_base_url),
+  // model_providers), so the override lands on the built-in `openai` entry when the map is
+  // built, independent of which id is the default, and the merge leaves that entry alone for
+  // every id except the two Amazon Bedrock ones. With the managed override in place both
+  // entries point at this proxy. That is a guarantee about the line we own: when the user owns
+  // the root line we inject nothing, and the built-in entry keeps whatever destination they
+  // chose, so an `openai`-tagged thread follows their configuration rather than this proxy.
+  //
+  // Re-tagging history was the alternative and it cannot be made durable: the length-preserving
+  // first-line repair cannot grow "openai" into "opencodex" without pre-existing padding, and
+  // codex re-appends that stale first line whenever it writes git or memory-mode metadata.
+  //
+  // Authless is excluded on purpose: its whole point is a provider that carries
+  // requires_openai_auth = false, and admission-token forms cannot use the root key at all.
+  // Those two forms therefore keep their existing behaviour, forward-tagging resume history with
+  // originals backed up, and that includes the case where a user enables authless and client
+  // compaction together. Only the compaction-only form skips the history unit.
+  const keepRootOverrideAlongsideTable = providerTableMode
+    && routingTarget.clientCompaction === true
+    && routingTarget.desktopAuthless !== true
+    && routingTarget.requiresAdmissionToken !== true;
   let keptUserBaseUrl = false;
   let keptUserRealtimeWsBaseUrl = false;
-  if (legacyMode) {
+  if (providerTableMode) {
     // Legacy (non-loopback) injection: the built-in openai provider cannot carry the
     // x-opencodex-api-key env header, so keep the opencodex provider table + root re-tag.
     // The authless opt-in needs the same table because only a dedicated provider can carry
@@ -1030,6 +1067,14 @@ export async function injectCodexConfig(
       content.trimEnd() +
       "\n" +
       buildProviderTableBlockForTarget(routingTarget, websocketsEnabled(config ?? {}));
+    // 3) Keep existing `openai`-tagged threads reaching the proxy (see above). Ownership rules
+    // are the Design B ones: a user's own root line is never replaced.
+    if (keepRootOverrideAlongsideTable) {
+      content = stripInjectedOpenaiBaseUrl(content);
+      const rootFallback = setRootOpenaiBaseUrlForTarget(content, routingTarget);
+      content = rootFallback.content;
+      keptUserBaseUrl = rootFallback.keptUserBaseUrl;
+    }
   } else {
     // Design B (loopback): a single root override; codex keeps its native `openai` provider id
     // so thread history is never remapped. Any legacy form was already stripped above.
@@ -1149,6 +1194,24 @@ export async function injectCodexConfig(
     };
   }
 
+  const journalBaselineIsNative = (): boolean => {
+    // Value evidence survives an app rewrite that removes the ownership comments.
+    const journaledBaseUrl = journaledInjectedOpenaiBaseUrl({ readOnly: true });
+    const journaledRealtimeWsBaseUrl = journaledInjectedRealtimeWsBaseUrl({ readOnly: true });
+    const looksInjectedByValue =
+      (journaledBaseUrl !== null && rootTomlString(rawContent, "openai_base_url") === journaledBaseUrl)
+      || (journaledRealtimeWsBaseUrl !== null
+        && rootTomlString(rawContent, REALTIME_WS_BASE_URL_KEY) === journaledRealtimeWsBaseUrl);
+    return !hasInjectedCodexRouting(rawContent) && !looksInjectedByValue;
+  };
+  const readCurrentProfile = (): string | null => existsSync(CODEX_PROFILE_PATH)
+    ? readFileSync(CODEX_PROFILE_PATH, "utf-8")
+    : null;
+  const unverifiedJournalMessage = "Codex configuration was not written: the journal has no verified baseline for the current config/profile. Current files and the journal were preserved.";
+  if (!journalBaselineIsNative() && hasUnverifiedJournalBaseline(baselineContent, readCurrentProfile())) {
+    return { success: false, message: unverifiedJournalMessage };
+  }
+
   if (options.validateOnly) {
     return {
       success: true,
@@ -1157,31 +1220,29 @@ export async function injectCodexConfig(
   }
 
   const applyNativeArtifacts = (): void => {
-    // #1798 again: a Codex app rewrite keeps values and drops the ownership comments, so
-    // marker evidence alone would classify our own routed config as the user's native
-    // baseline and replace the real original snapshot. Value evidence from the journal
-    // (the URLs the last injection recorded writing) blocks that misclassification.
-    const journaledBaseUrl = journaledInjectedOpenaiBaseUrl();
-    const journaledRealtimeWsBaseUrl = journaledInjectedRealtimeWsBaseUrl();
-    const looksInjectedByValue =
-      (journaledBaseUrl !== null && rootTomlString(rawContent, "openai_base_url") === journaledBaseUrl)
-      || (journaledRealtimeWsBaseUrl !== null
-        && rootTomlString(rawContent, REALTIME_WS_BASE_URL_KEY) === journaledRealtimeWsBaseUrl);
     writeJournal({
-      currentStateIsNative: !hasInjectedCodexRouting(rawContent) && !looksInjectedByValue,
+      currentStateIsNative: journalBaselineIsNative(),
       configContent: baselineContent,
       owner: options.journalOwner,
     });
+    // A native snapshot may have been refreshed above. An older hashless routed snapshot
+    // must not gain the new injection's hash and later overwrite preserved user edits.
+    if (hasUnverifiedJournalBaseline(baselineContent, readCurrentProfile())) throw new Error(unverifiedJournalMessage);
     atomicWriteFile(CODEX_CONFIG_PATH, content);
     atomicWriteFile(CODEX_PROFILE_PATH, profileContent);
     markJournalInjectedState(content, profileContent, {
-      // A root override is ours only in loopback Design B when no user-owned value won.
-      injectedOpenaiBaseUrl: legacyMode || keptUserBaseUrl
+      // A root override is ours whenever we wrote one and no user-owned value won. That is
+      // loopback Design B, and now also the client-compaction form, which keeps the same
+      // marker-owned root line beside its provider table. Journaling it matters because the
+      // marker comment is not durable: the Codex app can reserialize config.toml and drop
+      // comments, and restore then has only the journaled value to tell our line from a user's
+      // (#1798). The other table forms never write the key, so they still record null.
+      injectedOpenaiBaseUrl: (providerTableMode && !keepRootOverrideAlongsideTable) || keptUserBaseUrl
         ? null
         : rootTomlString(content, "openai_base_url"),
       // The sideband override is ours only when we wrote it this pass (never in legacy mode,
       // never when the user owns either key).
-      injectedRealtimeWsBaseUrl: legacyMode || keptUserBaseUrl || keptUserRealtimeWsBaseUrl
+      injectedRealtimeWsBaseUrl: providerTableMode || keptUserBaseUrl || keptUserRealtimeWsBaseUrl
         ? null
         : rootTomlString(content, REALTIME_WS_BASE_URL_KEY),
       // This is the catalog artifact selected for this injection, even when config.toml
@@ -1318,7 +1379,11 @@ export async function injectCodexConfig(
   }
   // Legacy mode still forward-tags history so re-tagged threads stay listable. Design B needs
   // the opposite: a one-time migration of previously re-tagged threads BACK to openai (restore
-  // machinery; cheap no-op when there is nothing to migrate).
+  // machinery; cheap no-op when there is nothing to migrate). The client-compaction opt-in keeps
+  // the root override alongside its table precisely so it does NOT have to touch history: an
+  // existing `openai`-tagged thread still reaches this proxy through the built-in entry. So it
+  // skips this unit, and future-only means what it says — no provider metadata is rewritten and
+  // no `ocx1:` payload is touched.
   // History runs in a Worker under H, not on this thread.
   //
   // The three surfaces it touches — the SQLite rows, the backup manifest, and the
@@ -1331,8 +1396,8 @@ export async function injectCodexConfig(
     expectedDesiredEnabled: true,
     operation: deriveCodexHistoryOperation({
       direction: "apply",
-      resumeHistory: config?.syncResumeHistory !== false,
-      legacyMode,
+      resumeHistory: config?.syncResumeHistory !== false && !keepRootOverrideAlongsideTable,
+      legacyMode: providerTableMode,
     }),
   });
   // A blocked or failed unit is reported, not silently counted as zero work:
@@ -1363,17 +1428,42 @@ export async function injectCodexConfig(
   const ejected = (history as { ejectedRows?: number }).ejectedRows ?? 0;
   const migratedRows = (history.rows ?? 0) + ejected;
   const historyMessage =
-    config?.syncResumeHistory === false
+    keepRootOverrideAlongsideTable
+      ? (keptUserBaseUrl
+        ? `  Codex resume history: left unchanged; threads already tagged openai follow your configured root openai_base_url.\n`
+        : `  Codex resume history: left unchanged; existing threads keep reaching the proxy through the retained openai_base_url override.\n`)
+      : config?.syncResumeHistory === false
       ? `  Codex resume history: left unchanged (syncResumeHistory=false).\n`
       : history.failed
-        ? formatApplyHistoryFailure(historyOutcome, legacyMode)
-        : legacyMode
+        ? formatApplyHistoryFailure(historyOutcome, providerTableMode)
+        : providerTableMode
           ? `  Codex resume history: ${history.rows} thread(s) made visible for opencodex; originals backed up for restore.\n`
           : migratedRows > 0
             ? `  Codex resume history: restored original provider metadata for ${migratedRows} manifest-backed thread(s) (one-time).\n`
             : `  Codex resume history: no backed-up metadata pending; untracked routed history left unchanged.\n`;
-  // A user-owned root openai_base_url means we did NOT install routing — say so honestly
+  // A user-owned root openai_base_url means we did NOT install root routing — say so honestly
   // instead of claiming the proxy route is active (catalog/fast_mode were still written).
+  //
+  // The client-compaction form writes a provider table as well, so "nothing was injected" would
+  // misdescribe the file it just produced: new threads do use the injected table. Report that
+  // mixed result on its own terms, and never tell the operator to delete a setting of theirs.
+  // Ownership alone says nothing about destination: their line may already target this proxy.
+  if (keptUserBaseUrl && keepRootOverrideAlongsideTable) {
+    return {
+      success: true,
+      ...(nativeSubagentDefaultsWarning ? { nativeSubagentDefaultsWarning } : {}),
+      message:
+        `Injected opencodex as default provider into Codex config (client-side compaction mode; ChatGPT auth remains required).\n` +
+        `  Your root openai_base_url was left exactly as you set it, so opencodex did not add its own.\n` +
+        catalogMessage +
+        historyMessage +
+        managedDefaultsMessage +
+        `  New threads use the injected opencodex provider and route through the proxy.\n` +
+        `  Threads already tagged openai resolve through Codex's built-in provider, which your root openai_base_url points at.\n` +
+        `  No root URL change is required to enable client-side compaction for new threads.\n` +
+        `  Fallback: codex --profile opencodex (same behavior)`,
+    };
+  }
   if (keptUserBaseUrl) {
     return {
       success: true,
@@ -1391,7 +1481,9 @@ export async function injectCodexConfig(
   }
   const headline = routingTarget.desktopAuthless === true
     ? `Injected opencodex as default provider into Codex config (authless Desktop mode: requires_openai_auth = false).\n`
-    : legacyMode
+    : routingTarget.clientCompaction === true
+      ? `Injected opencodex as default provider into Codex config (client-side compaction mode; ChatGPT auth remains required).\n`
+    : providerTableMode
       ? `Injected opencodex as default provider into Codex config.\n`
       : `Pointed Codex's built-in openai provider at the opencodex proxy (openai_base_url + realtime sideband override).\n`;
   return {
@@ -1405,7 +1497,7 @@ export async function injectCodexConfig(
       `  All models now route through opencodex proxy (like OpenRouter).\n` +
       `  OpenAI models (gpt-5.5, etc.) are passed through to OpenAI.\n` +
       `  Custom models route to their configured providers.\n` +
-      (legacyMode
+      (providerTableMode
         ? `  Fallback: codex --profile opencodex (same behavior)`
         : `  Fallback reference: ${CODEX_PROFILE_PATH}`),
   };
@@ -1733,6 +1825,12 @@ export function skippedRestoreEnvelope(success: boolean, message: string): Codex
 function restoreCodexConfigInline(): CodexRestoreConfigResult {
   try {
     const journal = restoreJournalState();
+    if (journal.unverified) {
+      return {
+        state: "failed", changed: false, action: "failed",
+        message: "Codex journal recovery was not verified; current configuration files and the journal were preserved.",
+      };
+    }
     const restored = journal.configRestored
       ? { success: true, message: "Codex config restored from opencodex journal." }
       : removeCodexConfig({ preserveProfile: journal.profileRestored || journal.profileChanged });

package/src/codex/internal/catalog-writer.ts

@@ -16,6 +16,7 @@ import {
   forgetEphemeralSecretPath,
   hardenSecretPath,
 } from "../../lib/windows-secret-acl";
+import { resetCodexAppServerCatalogStateCache } from "../app-server-processes";
 
 export interface PreparedCatalogFileWrite {
   readonly path: string;
@@ -167,6 +168,7 @@ export function replaceActiveCodexCatalog(
 ): void {
   assertCatalogWritePermit(permit, owningCodexHome);
   atomicWriteFile(prepared.path, prepared.content, io);
+  resetCodexAppServerCatalogStateCache();
 }
 
 /** Atomically publish the catalog-path-keyed immutable backup without clobbering. */
@@ -200,4 +202,5 @@ export function replaceCodexModelsCache(
 ): void {
   assertCatalogWritePermit(permit, owningCodexHome);
   atomicWriteFile(prepared.path, prepared.content, io);
+  resetCodexAppServerCatalogStateCache();
 }