@bitkyc08/opencodex 2.49.0 → 2.50.0

package/src/generated/compatibility-version.json

@@ -10,7 +10,7 @@
     },
     {
       "path": "package.json",
-      "sha256": "5bc0926e163c40faa5ac209af491a05a878c60071155a232ae2f13f06ffe04b9"
+      "sha256": "821357da544264585c2f62c54fb60fadea04818ae5581041014af343736ecf8d"
     },
     {
       "path": "scripts/model-metadata.source.json",
@@ -558,7 +558,7 @@
     },
     {
       "path": "src/claude/inbound.ts",
-      "sha256": "a580142aa40f8465c7bfa431e6a50f5f32109220c4ca3f9106305951ae66eca1"
+      "sha256": "c1717eeef2fc0a20b36e5b12f5d32146067e43bd8795b3f78fe9e27985dd4617"
     },
     {
       "path": "src/claude/model-info.ts",
@@ -578,11 +578,11 @@
     },
     {
       "path": "src/cli/account-api.ts",
-      "sha256": "be87c7dbe5d2eaa28d05548877d9de2210c2d91139973b0aaf2e473967045c33"
+      "sha256": "7d3cbd39c4044cebe42153c9a094e401ec20937b49aa801e335f9de0597b25a3"
     },
     {
       "path": "src/cli/account-auth.ts",
-      "sha256": "231b540bdfa6b7dc39d51af35b74e3f95a9073e851bd50a126e2da1456e563c1"
+      "sha256": "0c001076b7f2fbb9617e14536c826fb0505a4bfc8eaf84ddd24b68edf70901a9"
     },
     {
       "path": "src/cli/account-catalog-refresh.ts",
@@ -590,7 +590,7 @@
     },
     {
       "path": "src/cli/account-extended.ts",
-      "sha256": "238f1047c46cbce11c5dfe96440a4b4dba30e6b9936e59c6bebb5aef5dc95a4f"
+      "sha256": "c28be00939345f17711f12b04963dece4503be36a3020cd65fb021d4b41e98ab"
     },
     {
       "path": "src/cli/account-main.ts",
@@ -598,7 +598,7 @@
     },
     {
       "path": "src/cli/account.ts",
-      "sha256": "98dd1a0ae4119f22a089c82f2c87a18bdee60c3dc9947aeb6db5ec66c764c776"
+      "sha256": "03c2bce1515d967c1e72b487aba92fd927504412843f2f9cc33d5710d1168200"
     },
     {
       "path": "src/cli/agent-driven.ts",
@@ -622,7 +622,7 @@
     },
     {
       "path": "src/cli/capabilities.ts",
-      "sha256": "2235718ab012e8fbf362cc3fbeee57362a57ee8dc547d50781d470249c3ea19d"
+      "sha256": "c0fbd9cf3e0556ceee7d83298d3fd3873251a7079935f654154f9093f8cb487a"
     },
     {
       "path": "src/cli/catalog-prewarm.ts",
@@ -706,7 +706,7 @@
     },
     {
       "path": "src/cli/index.ts",
-      "sha256": "84292fbe9597cdf82cf1414eee204abc1c97acbaae42251eac5dca6dc77d8094"
+      "sha256": "4a74056517ee2b901e599f098d1e5a0109c81cf4d28dfb0284abd807a7e3c601"
     },
     {
       "path": "src/cli/init.ts",
@@ -746,7 +746,7 @@
     },
     {
       "path": "src/cli/models-runtime.ts",
-      "sha256": "ba7546ee6eae0aaabb730e4c2206364476fc42cf19c176a10c48a00f0537c2b6"
+      "sha256": "ec3a814a6ce176bf347c3d6ef869418bf04e9b450a54c932e2f94e0d573c4ffb"
     },
     {
       "path": "src/cli/models.ts",
@@ -754,7 +754,7 @@
     },
     {
       "path": "src/cli/observe.ts",
-      "sha256": "b76f55fe9e1074bcf7cf74b5d97502c95ebf05a8b966834cc51d715f4a2e7383"
+      "sha256": "7db16ad49b1992c5cfe8101438fefd007c87a9c4e9f99c31a4b860d8fa829875"
     },
     {
       "path": "src/cli/opencode.ts",
@@ -918,7 +918,7 @@
     },
     {
       "path": "src/clients/config-export/zcode.ts",
-      "sha256": "c3547c36a1e04b66d88add299d5c8465599ea3b6fd6266b25cd3c00afb52d757"
+      "sha256": "256aa37df1a6a9b2e9cc7f3d619c0a444574e1c32689f16d8ae0cc962f6b4485"
     },
     {
       "path": "src/clients/model-presentation.ts",
@@ -954,15 +954,15 @@
     },
     {
       "path": "src/codex/account-runtime-state.ts",
-      "sha256": "bdd1a6102161425879ad0f4b1be98de4c3453905fb0db709f1f1739bb623fd57"
+      "sha256": "a230c3d8df1c937f1a91f7e88435e26c558c9d03f6d2737219d8ff6d3e2105e5"
     },
     {
       "path": "src/codex/account-store.ts",
-      "sha256": "27786f63ee9887225ffeb4b6dd9a9e3592e89add7a3dbf4b190dbf5b4ceb1faa"
+      "sha256": "e94ecaf554d2e16f2f65bfc0a3f6d0e2f63f6c8b51b87fe3803a76b64c2140f3"
     },
     {
       "path": "src/codex/account-usability.ts",
-      "sha256": "17e0c8027b0f2e1c02968b35ff1c9df8c1e5f83dadc0a611ff0a6b35097a5b2f"
+      "sha256": "cb009ba8871728f785646f130e3b85ddef5492a64e8c464416713b4b9eb926d0"
     },
     {
       "path": "src/codex/admission.ts",
@@ -982,7 +982,7 @@
     },
     {
       "path": "src/codex/auth-api.ts",
-      "sha256": "f2c86fd0e076d48b6d86af7e2ce0a77defe8cb31417a5e608316844627b4e043"
+      "sha256": "f78ee1f7404f8bd7c9b2a46d4db074f9120520f5eeac9c8486a4998de6e4b311"
     },
     {
       "path": "src/codex/auth-collision.ts",
@@ -990,7 +990,7 @@
     },
     {
       "path": "src/codex/auth-context.ts",
-      "sha256": "1b197bfced301feeae8aeba753edd71a4d27cce74532de2c150f01e914ca02b1"
+      "sha256": "5d70de8e56d850f66f0659dea39d6d7591a1ec83f1b4c9337edca3b49e11146d"
     },
     {
       "path": "src/codex/autostart-health.ts",
@@ -1046,11 +1046,11 @@
     },
     {
       "path": "src/codex/catalog/parsing.ts",
-      "sha256": "2eb0e99950cda152047406bf4e565cf8014755e0223462678db8c7c6d5abd7b4"
+      "sha256": "f06a627708ab952feeaf550370b464449f7fbdaa61859a00c2260651b20a8c31"
     },
     {
       "path": "src/codex/catalog/provider-fetch.ts",
-      "sha256": "e1955c2d11ec5ef583cc043ffe74691f86bcb5b1c5ce827aee339319b5852d38"
+      "sha256": "fb45f0fe5cf54f0e6c877d5c3b83aa90f1619f0f00f597f1cae72832a849cf2e"
     },
     {
       "path": "src/codex/catalog/reserve.ts",
@@ -1058,7 +1058,7 @@
     },
     {
       "path": "src/codex/catalog/sync.ts",
-      "sha256": "f436b8cd48e820a45bca2cbf550e0fab33aa22daeac6db318d88ebe3aacace3b"
+      "sha256": "37a66df518be45ae7b629fe0077d272eed33256543a7a4c9aedac797676ffbc3"
     },
     {
       "path": "src/codex/cli-install-provenance.ts",
@@ -1154,7 +1154,7 @@
     },
     {
       "path": "src/codex/inject.ts",
-      "sha256": "6cce6973c257ef9da4de60f316bd83ed92f02249e4615ec6371938eb22de17f9"
+      "sha256": "f84dc232b611e1af2aff52aeb27047d91f7eb86373b7580d75b79a94f30c81cc"
     },
     {
       "path": "src/codex/injected-marker.ts",
@@ -1378,7 +1378,7 @@
     },
     {
       "path": "src/codex/quota-auto-refresh.ts",
-      "sha256": "4dd542d41e1b7e7a764ee6971f44f273b1d3177df5320f5a0fa61ea47fe1bc52"
+      "sha256": "bcc3d61092f99bfd14d51c1ec6b310a5ea7334417be94dd205c74bec7ec23da4"
     },
     {
       "path": "src/codex/quota-recovery-timing.ts",
@@ -1398,7 +1398,7 @@
     },
     {
       "path": "src/codex/quota.ts",
-      "sha256": "b304e6709217a051ba743565e32d76327f8ba2f46f7434bffe7c3bd59ec615cf"
+      "sha256": "9dfe98b8992781c38260fdfa538e57c6c263e509856cb3f51a436950ec320f02"
     },
     {
       "path": "src/codex/refresh.ts",
@@ -1478,7 +1478,7 @@
     },
     {
       "path": "src/combos/index.ts",
-      "sha256": "82177616fd1fc1e9bd8c8849565ec1e38229eea77ae4da14d3a99dca71a2b267"
+      "sha256": "94317ebd008b0c7e42077ae3786e121b100ef31b718b1c2d8049e8d19ed9e8e8"
     },
     {
       "path": "src/combos/request.ts",
@@ -1490,7 +1490,7 @@
     },
     {
       "path": "src/combos/resolve.ts",
-      "sha256": "30d60d32e5bb12939d04f57b042e75cc2f41016491b9f5237a986334106b56c5"
+      "sha256": "43d75a46bf2dd2a366ea2cca28ada43dc38379f302be4f56f5e666e8a8b4ec72"
     },
     {
       "path": "src/combos/types.ts",
@@ -1510,7 +1510,7 @@
     },
     {
       "path": "src/config.ts",
-      "sha256": "eeb83a88ac74bf583d7bcd269c94792c342ed9b99713ecf78af9d0ea8f378a5c"
+      "sha256": "faa09b5e5f510a73d5b0c0f905134de44e744d55ed97c13e3115a5ec55679e02"
     },
     {
       "path": "src/config/atomic-write.ts",
@@ -2282,7 +2282,7 @@
     },
     {
       "path": "src/lib/errors.ts",
-      "sha256": "73bbd2a7952639f11e24fdbb31c4bf983f88569f62e531441d060f00f2a78f0b"
+      "sha256": "747ec5cd5605aba968da6429eadb68460b3cb97ceebe8a788b5d07f84664d87a"
     },
     {
       "path": "src/lib/eventstream-decoder.ts",
@@ -2366,7 +2366,7 @@
     },
     {
       "path": "src/lib/privacy.ts",
-      "sha256": "6c92a50b0843ffa1ca8300a078309caca4ade94f38ae63aa701e9685ae33c617"
+      "sha256": "532cf8f9e52e8b25e3c4063ce1fe6d77c1e501900428d51a2e491f48fc8d0034"
     },
     {
       "path": "src/lib/process-control.ts",
@@ -2578,11 +2578,11 @@
     },
     {
       "path": "src/oauth/health.ts",
-      "sha256": "2af2cae20f57f47f44f8ba8c3b692ca384fb9776f2ea53d69b1929bcdc04db59"
+      "sha256": "2546c5f311b8b43a0fb45c4fe355c0dc6623d7f89b5cfab0382149c1fb61b5cb"
     },
     {
       "path": "src/oauth/index.ts",
-      "sha256": "c92e0a97f8de467d2ea570a8654fa53053ae4627d02d41e199d130e0961ac464"
+      "sha256": "89faf1fbeef4a91739c2d81668c539ea00385d7b098ccac5aef7e1e6ac9ea3f4"
     },
     {
       "path": "src/oauth/key-providers.ts",
@@ -2642,7 +2642,7 @@
     },
     {
       "path": "src/oauth/token-guardian.ts",
-      "sha256": "61ab6a126dfec880425247cbe1c09ae387777f5a44cadfd47a96f59b6faf3274"
+      "sha256": "903e5dad757dbe5bd13354e4d7b19a79faa9203095498e6c660b0436ea873271"
     },
     {
       "path": "src/oauth/types.ts",
@@ -2736,6 +2736,10 @@
       "path": "src/providers/github-copilot-transport.ts",
       "sha256": "78c11415c8423eaf89a5a4e5fe8cf46b55a6c13078cd035ba9662369f895954c"
     },
+    {
+      "path": "src/providers/google-ai-studio-model-discovery.ts",
+      "sha256": "4ee16b9712a50ec868010265f234b4d23c5082d761aeddfc051273b4eb5d3ce1"
+    },
     {
       "path": "src/providers/google-vertex-location.ts",
       "sha256": "0e30a1dfd3dafa742f710c38d1c856d3f016c9b9ac15e748edb6965b93c59a5e"
@@ -2826,7 +2830,7 @@
     },
     {
       "path": "src/providers/opencode-zen-rate-limit.ts",
-      "sha256": "4ee0c55013e77ed825188f998d422f263e8129436a63e811f98083725825e1eb"
+      "sha256": "053dcfa187711c4574cfecaca05f3ee13806305a5b3ac245a74be1114c5d4507"
     },
     {
       "path": "src/providers/openrouter-routing.ts",
@@ -2858,11 +2862,11 @@
     },
     {
       "path": "src/providers/quota.ts",
-      "sha256": "0cc9b4797d1379a2f359f3798da1488fd9ef2f0100ce31cf51b421c20619d9d7"
+      "sha256": "ecef71a71c015454d7f312f05554189de44f52186b4e44ffaf54f6819383a2ff"
     },
     {
       "path": "src/providers/registry.ts",
-      "sha256": "9e357da9353a7dd3f391a00d7d34dcd2c70aaf9d5c97b4b035e5ca38c70eb221"
+      "sha256": "beb685c12ef97b4d5cb103110dcffe9c40d4cc04d5d63a1cb1be81116598818d"
     },
     {
       "path": "src/providers/request-pacing.ts",
@@ -3142,7 +3146,7 @@
     },
     {
       "path": "src/server/auth-cors.ts",
-      "sha256": "4207131722b016c0ebe72b748030c52793d999b0c1d95d89afbed78b8e2a33a1"
+      "sha256": "e4d01945c08bfe8ddf055218d91a17bdd26d61fa9eaaf54ad2b6f00193c82a2b"
     },
     {
       "path": "src/server/background-lifecycle.ts",
@@ -3154,7 +3158,7 @@
     },
     {
       "path": "src/server/chat-completions.ts",
-      "sha256": "8de53d04358f5a89d212a2ee8452e706b54a5b8c953aa43dbfcd14135529f735"
+      "sha256": "178f4c7a88380167d9196a562841696fc5a320127821e51220ee497e7104e8ed"
     },
     {
       "path": "src/server/chat-native-sse.ts",
@@ -3162,11 +3166,11 @@
     },
     {
       "path": "src/server/chat-native.ts",
-      "sha256": "fdbbfd53a75ad52d19b8e76f7629c7f42009d5ab46f0924bd72444bab566d740"
+      "sha256": "f4a31b1f294c93b4ec52b5a7c0c3bd9e0bfe06bfe0ca03e0c6ae531712eda44e"
     },
     {
       "path": "src/server/claude-messages.ts",
-      "sha256": "436f9e4873b96f1e621869cee9ab6740a0f2de5d870dc10130c05bd2cea82fd9"
+      "sha256": "af6dd0884240cd8edf329634a03afb267f4d7107d3428a1f05700f37f0491062"
     },
     {
       "path": "src/server/direct-local-http.ts",
@@ -3210,11 +3214,11 @@
     },
     {
       "path": "src/server/images.ts",
-      "sha256": "20ff71b53ee07369c246c583c7ee18033732dd679b9094f968f2bdeaae957c08"
+      "sha256": "da1cf0777f53d56c74d2d3e9586ed2e4f2acda609b7c3544990a9595b84ecacd"
     },
     {
       "path": "src/server/index.ts",
-      "sha256": "451299336416e2ff2f3910cb50802fa0ecee2773f0d389b2110cf6b2f97137e0"
+      "sha256": "485181354cfaef0e86d2f28b2587458732898202180fc59b3fc1f3b58ac07554"
     },
     {
       "path": "src/server/lifecycle.ts",
@@ -3234,7 +3238,7 @@
     },
     {
       "path": "src/server/management-api.ts",
-      "sha256": "00fac5b108394373a9c270cd077899c256aa2180824a0bfb12900dcb4a6c9804"
+      "sha256": "d09313a12780ebaf2f23fa9c7a8b3dba3b3725bd5aba4971970860afb8fbbe21"
     },
     {
       "path": "src/server/management-auth.ts",
@@ -3302,7 +3306,7 @@
     },
     {
       "path": "src/server/management/logs-usage-routes.ts",
-      "sha256": "c7bf7c757e681dd322d62d0215e5a51fe7bbdd9e50319943f59c72305d477fa9"
+      "sha256": "ea333850428a1d55170bd10edbeda850ade63071ba90956402917a2cd8eb48bb"
     },
     {
       "path": "src/server/management/model-routes.ts",
@@ -3310,7 +3314,7 @@
     },
     {
       "path": "src/server/management/model-rows.ts",
-      "sha256": "8ec60364236862e4ad6f6a5f81abc6981b482663989d7b9aec3c14d0a524751f"
+      "sha256": "e4b54304d4488673b56b109b9ce7e09a6e9893801288c750f1efcc9b30f5c24f"
     },
     {
       "path": "src/server/management/native-integration-routes.ts",
@@ -3318,7 +3322,7 @@
     },
     {
       "path": "src/server/management/oauth-account-routes.ts",
-      "sha256": "32da2e55849e717b8e7024bd216969cb50f1b17b9c92afa5d713d4a0bc8abfa2"
+      "sha256": "2e35a9bda8cdb6807f6a83d55ec701602c1482469ef86c6b709e9c4cf9bb65a2"
     },
     {
       "path": "src/server/management/provider-capability-config.ts",
@@ -3326,7 +3330,7 @@
     },
     {
       "path": "src/server/management/provider-routes.ts",
-      "sha256": "a885d9ece03347ace5edef0ed18aceb705cea8fd9f031cbd33cb2baf43656a16"
+      "sha256": "8fee28f9ffab897af5352b1bcd4325d20f958aacc149ef6c47146c1a471dcbab"
     },
     {
       "path": "src/server/management/quota-reset-routes.ts",
@@ -3334,11 +3338,11 @@
     },
     {
       "path": "src/server/management/request-history-routes.ts",
-      "sha256": "cdc658830f272b3e92151c2cf0a1c2130618075972b9390bf8b263500aae4afb"
+      "sha256": "ad08207130fb23c0dfa30600bbfdd603c6b3a60d017a5b5cb8981dbfc77fd1af"
     },
     {
       "path": "src/server/management/route-registry.ts",
-      "sha256": "29358c978e83323ec6ad2b464befe3b039b1852b57beab97cdab851bef9a9662"
+      "sha256": "c45a547d396e70fa633831eb111ffb53140cea3a508e33219a647e93d1c99729"
     },
     {
       "path": "src/server/management/routing-analytics-routes.ts",
@@ -3358,7 +3362,7 @@
     },
     {
       "path": "src/server/management/shared.ts",
-      "sha256": "86c9c9e138d8d515ce18c93f3d934e27690595739cacc84cdb53f6df466387ac"
+      "sha256": "0111e4205d35487c8f5ec18245cfc682bb9a0fe7f925ef7b462c6a142d82e52e"
     },
     {
       "path": "src/server/management/sidebar-routes.ts",
@@ -3434,7 +3438,7 @@
     },
     {
       "path": "src/server/request-decompress.ts",
-      "sha256": "6068cb4b96389407e2c2c8cc37e769d8164541e8455663b0d256b593736cb204"
+      "sha256": "a631097fb0e50b92436e4117f6012aab020e35e31fcbe9fb744740d6a88fa6d2"
     },
     {
       "path": "src/server/request-log-conversation.ts",
@@ -3446,7 +3450,7 @@
     },
     {
       "path": "src/server/request-log.ts",
-      "sha256": "f79e0a04da04e6314001c418e3a4f70b7ca60c556763fdc3386724633bc8e9e9"
+      "sha256": "544bf0412e35f14b0135db94c50f23fb46af5dbcbaa3ab5b98104609488c563d"
     },
     {
       "path": "src/server/responses-custom-tool-repair.ts",
@@ -3542,7 +3546,7 @@
     },
     {
       "path": "src/server/responses/codex-ws-wire.ts",
-      "sha256": "4f535d963d929d18da8a6cf1febc86803641495d2f31799b5c5dadfe7729934e"
+      "sha256": "cc67da58a6537d57735eff313fa2d0895e442cbff9d0d978ce38bd19c806c716"
     },
     {
       "path": "src/server/responses/collaboration.ts",
@@ -3558,15 +3562,15 @@
     },
     {
       "path": "src/server/responses/compact.ts",
-      "sha256": "205d9eaf2ce0f7c3d1af3bd58f7e3167479deec2c3a99e3743747f4fcb205e91"
+      "sha256": "a3a401be4dc856910c883c7779d60fd76796288203c0ac46dd788a7755355c4b"
     },
     {
       "path": "src/server/responses/context-overflow.ts",
-      "sha256": "42774a8d6e557c406723cfa04f1a8c7e2e2114e8537f1d30adedea0b54503e22"
+      "sha256": "b04ec1c780f61c90b3e5cd38ee0497eb87090a83c84f245ac1bb54542088b775"
     },
     {
       "path": "src/server/responses/core.ts",
-      "sha256": "ee17e04a7f3b52284cedf60d4ec9282db586c17ca344022c379659afa64e981e"
+      "sha256": "6144aded39c1fc073cac4ef670ec13f6077cfe60dbf6a9f22c90035546f28e46"
     },
     {
       "path": "src/server/responses/empty-completion-guard.ts",
@@ -3598,7 +3602,7 @@
     },
     {
       "path": "src/server/responses/policy-fallback.ts",
-      "sha256": "c7aaf60bdc9dda04531e73135cafd44b390a71cf02a72ba9e8b737975f31a911"
+      "sha256": "ed880014626eed864489e29d03db4d1ffd7b6bb1f52a14613ac74b952f72571a"
     },
     {
       "path": "src/server/responses/responses-field-backfill.ts",
@@ -3622,7 +3626,7 @@
     },
     {
       "path": "src/server/search.ts",
-      "sha256": "0fc0fcf3582717ab6590476c73ae6337d682f975790f83305049f19d7bf4b8cd"
+      "sha256": "baac289b631692dbd829a50af80831d1d113d14d29f0961c1c4bb20e4f38f3d0"
     },
     {
       "path": "src/server/sse-frame-buffer.ts",
@@ -3678,7 +3682,7 @@
     },
     {
       "path": "src/service.ts",
-      "sha256": "551356304fafbd04596af28daf98c46c1adfa03981baa0826502e9cf15e15a39"
+      "sha256": "d90f9c15b37fa3f626f1c880a6785eeac76d4397cf4cd347c8262ea616979cd6"
     },
     {
       "path": "src/sidecar/auth.ts",
@@ -3762,19 +3766,19 @@
     },
     {
       "path": "src/types.ts",
-      "sha256": "e3a8d9646f6dbe5e71679af11e3781cf25c990645f0331017186a55543baf9c0"
+      "sha256": "4a8c13fbedde0ec6b3e0e1fab7980f561c7b710cfbd4e96c026b94cbe5530d6f"
     },
     {
       "path": "src/types/accounts.ts",
-      "sha256": "8037e50f3e8660279b085e3cf252a757ae01269925f96144ae972c5ac514bff0"
+      "sha256": "16d3698f4dfcbbd87b5fc8656f1624d54cb88133e73dd1df99c43db01338dff3"
     },
     {
       "path": "src/types/config.ts",
-      "sha256": "d63ab9f9bcb64e5e5b0525413c4b55d6febffbf1e0c07818fd825a465e0e0625"
+      "sha256": "39f899873043dab5819b4b4386551b13dd0ed7115ead693b85cad8e2abd38122"
     },
     {
       "path": "src/types/provider.ts",
-      "sha256": "6980e7b217040922d053cad623838436598c3d8387a5aad8d520a907c19e18ac"
+      "sha256": "b97e8bd5f3f82dae9cb246cc71772f61a6c5eb9644f2204da16e25ce7b0c19fb"
     },
     {
       "path": "src/types/request.ts",
@@ -3984,10 +3988,18 @@
       "path": "src/web-search/loop.ts",
       "sha256": "0cf6ba9bb8c26d6e6c4763e348464754539532acb7c3ec0ceee993c859d2bea6"
     },
+    {
+      "path": "src/web-search/ollama-executor.ts",
+      "sha256": "d092ffeb34e29264da3c4c70561f4910bb895c4250df8d92cde2284fbdc2d649"
+    },
     {
       "path": "src/web-search/parse.ts",
       "sha256": "d2511ca70abfdee209323c577c26c987aff791a1bf54d6615fe35916f4c44eca"
     },
+    {
+      "path": "src/web-search/passthrough-bridge.ts",
+      "sha256": "3863f9d7b942aef4cf3cee7d81377121ac00bb9f68953f64ada524f32bf1ca0d"
+    },
     {
       "path": "src/web-search/progress-stream.ts",
       "sha256": "0b743935e725b7bdfaf285ba973bb3fcc0faaca6225c8ba3113ce504af328126"

package/src/lib/errors.ts

@@ -209,6 +209,14 @@ export function classifyError(status: number, type: string, message: string): Oc
   if (type === "input_admission_refused") {
     return { message, type: "invalid_request_error", code: "input_admission_refused" };
   }
+  // A LOCAL inbound admission refusal (#3573) keeps its own code for the same reason as the
+  // preflight refusal above. #4112 gave the UPSTREAM 413 on this surface
+  // `context_length_exceeded`; without a distinct code here a client cannot tell a body the
+  // proxy never read from a turn the provider itself rejected, and only one of the two is
+  // fixed by raising `maxInboundBodyBytes`.
+  if (type === "inbound_body_too_large") {
+    return { message, type: "invalid_request_error", code: "inbound_body_too_large" };
+  }
   if (
     text.includes("context_length_exceeded") ||
     text.includes("context window") ||

package/src/lib/privacy.ts

@@ -10,6 +10,31 @@ export function maskEmail(value: string | null | undefined): string | null {
   return `${local[0]}***${local[local.length - 1]}@${domain}`;
 }
 
+/**
+ * Whether stored account emails are masked in management and CLI projections (#3859).
+ *
+ * Fail closed on every ambiguity: a missing config, a missing `privacy` block, and a missing or
+ * malformed `maskEmails` all mask. Only the literal boolean `false` unmasks, so a hand-edited
+ * `"false"` string or a typo cannot silently disclose an address. Callers read this once at the
+ * request boundary and pass the answer down — the projection helpers take a boolean rather than
+ * a config so that `getLoginStatus` stays free of config I/O.
+ */
+export function emailMaskingEnabled(config: { privacy?: { maskEmails?: boolean } } | null | undefined): boolean {
+  return config?.privacy?.maskEmails !== false;
+}
+
+/**
+ * Project a stored account email for a surface outside the proxy (#3859).
+ *
+ * One redaction decision for every call site, rather than each one forking on the flag: an
+ * unmasked projection still normalises an empty or absent address to `null`, so a consumer's
+ * "is there an email" test cannot start answering differently just because masking is off.
+ */
+export function projectEmail(value: string | null | undefined, mask: boolean): string | null {
+  if (!mask) return value ? value : null;
+  return maskEmail(value);
+}
+
 export function maskAccountId(value: string | null | undefined): string | null {
   if (!value) return null;
   const id = value.trim();

package/src/oauth/health.ts

@@ -1,7 +1,7 @@
 import { getCodexAccountHealthSnapshot, type CodexCooldownSource } from "../codex/routing";
 import { getAnthropicAccountHealthSnapshot } from "./anthropic-routing";
 import { isAccountNeedsReauth } from "../codex/account-runtime-state";
-import { getCodexAccountCredential, listCodexAccountIds } from "../codex/account-store";
+import { getCodexAccountCredential, listCodexAccountIds, readCodexAccountRecord } from "../codex/account-store";
 import { MAIN_CODEX_ACCOUNT_ID } from "../codex/main-account";
 import { readRuntimePort } from "../config/process-state";
 import { LOCAL_MANAGEMENT_READ_PATHS } from "../lib/local-management-capability";
@@ -15,7 +15,7 @@ export type OAuthAccountHealth =
   | { status: "healthy" }
   | { status: "cooldown"; until: string; reason: "rate_limit" | "quota" }
   | { status: "reauth_required"; reason: "unauthorized" | "forbidden" | "refresh_failed" }
-  | { status: "warning"; reason: "refresh_conflict" | "metadata_mismatch" | "stale_credentials" };
+  | { status: "warning"; reason: "refresh_conflict" | "metadata_mismatch" | "stale_credentials" | "validation_pending" };
 
 export type OAuthHealthLabel =
   | "Healthy"
@@ -24,7 +24,8 @@ export type OAuthHealthLabel =
   | "Reauthentication required"
   | "Refresh failed"
   | "Metadata mismatch"
-  | "Credential conflict";
+  | "Credential conflict"
+  | "Validation pending";
 
 /** Shared masked-id fallback when `maskAccountId` returns nullish. */
 export const MASKED_ACCOUNT_FALLBACK = "account-…????";
@@ -88,6 +89,9 @@ export function projectOAuthAccountHealth(input: {
 export const CODEX_REAUTH_ACTION = "reauthenticate via the dashboard Codex account pool";
 
 function actionFor(provider: string, health: OAuthAccountHealth): string | undefined {
+  if (health.status === "warning" && health.reason === "validation_pending") {
+    return "wait for quota recovery, then click Refresh quotas in the dashboard Codex account pool to finish validation";
+  }
   if (health.status === "reauth_required") {
     if (provider === "codex") return CODEX_REAUTH_ACTION;
     return `run \`ocx login ${provider}\``;
@@ -112,6 +116,8 @@ export function oauthHealthLabel(health: OAuthAccountHealth): OAuthHealthLabel {
       return health.reason === "refresh_failed" ? "Refresh failed" : "Reauthentication required";
     case "warning":
       switch (health.reason) {
+        case "validation_pending":
+          return "Validation pending";
         case "refresh_conflict":
           return "Credential conflict";
         case "metadata_mismatch":
@@ -198,11 +204,42 @@ export function projectCodexAccountHealth(input: {
   needsReauth: boolean;
   now?: number;
 }): OAuthAccountHealth {
+  // One read serves every verdict below. Each lookup re-reads and re-hardens the whole store
+  // file, and the main account lives in the native Codex auth file rather than the pool store,
+  // so a lookup for it could only ever miss.
+  const stored = input.accountId !== MAIN_CODEX_ACCOUNT_ID ? readCodexAccountRecord(input.accountId) : null;
+  const record = stored?.deletedAt == null ? stored : null;
+
+  // A successful quota read is not evidence that model authorization recovered.
+  // Preserve this guidance until validation succeeds or reauthentication replaces it.
+  const validationAuthFailed = record !== null
+    && record.codexValidationPending === true
+    && record.lastCodexValidationStatus === "failed"
+    && (record.lastCodexValidationError === "http_status:401" || record.lastCodexValidationError === "http_status:403");
+
+  // A persisted terminal verdict outranks the in-memory reauth flag rather than duplicating it:
+  // the flag lives in this process and a revoked grant does not. Without it, an account whose
+  // grant was revoked upstream keeps its login-time `lastCodexValidationStatus: "ok"` and every
+  // surface reports it healthy until someone tries to use it (#4120). Only a re-login clears the
+  // marker, so `reauth_required` is the accurate projection — and it is deliberately checked
+  // ahead of any cooldown, because telling an operator to wait out a rate limit on a credential
+  // that will never work again is a false promise.
+  const terminalGrantFailure = record !== null
+    && record.lastCodexValidationTerminal === true
+    && record.lastCodexValidationStatus === "failed";
+
+  const needsReauth = input.needsReauth || validationAuthFailed || terminalGrantFailure;
+
+  // Deferred validation is only worth reporting while the credential itself is still viable. A
+  // revoked grant needs a re-login, not a "Refresh quotas" click, so reauth is resolved first.
+  if (!needsReauth && record?.codexValidationPending) {
+    return { status: "warning", reason: "validation_pending" };
+  }
   const now = input.now ?? Date.now();
   const snap = getCodexAccountHealthSnapshot(input.accountId, now);
   return projectOAuthAccountHealth({
-    needsReauth: input.needsReauth,
-    reauthReason: input.needsReauth ? "refresh_failed" : undefined,
+    needsReauth,
+    reauthReason: needsReauth ? "refresh_failed" : undefined,
     cooldownUntilMs: snap?.cooldownUntil,
     cooldownReason: cooldownReasonFromSource(snap?.cooldownSource),
     now,
@@ -272,13 +309,11 @@ function collectLocalCodexEntries(now: number): OAuthHealthEntry[] {
     const hasPoolCredential = accountId !== MAIN_CODEX_ACCOUNT_ID && getCodexAccountCredential(accountId) !== null;
     if (!hasPoolCredential && !needsReauth && !snap) continue;
 
-    const health = projectOAuthAccountHealth({
-      needsReauth,
-      reauthReason: needsReauth ? "refresh_failed" : undefined,
-      cooldownUntilMs: snap?.cooldownUntil,
-      cooldownReason: cooldownReasonFromSource(snap?.cooldownSource),
-      now,
-    });
+    // Call the projector rather than inlining a second copy of it. This collector serves the CLI
+    // (`ocx status`, `ocx doctor`) while the dashboard DTO goes through projectCodexAccountHealth,
+    // and the duplicated body is exactly how the CLI would have kept reporting a revoked account
+    // as healthy after the dashboard stopped.
+    const health = projectCodexAccountHealth({ accountId, needsReauth, now });
     pushEntry(entries, "codex", accountId, health);
   }
   return entries;