@bitkyc08/opencodex 2.53.0-preview.20260913 → 2.54.0-preview.20260914

package/src/codex/inject.ts

@@ -895,7 +895,13 @@ export function chooseCatalogPathForInjection(
 export interface CodexInjectResult {
   success: boolean;
   message: string;
-  /** Structured read-only history preflight refusal; never parsed from display text. */
+  /**
+   * Structured read-only history preflight refusal; never parsed from display text.
+   *
+   * On the apply direction this reports that the conversation-history relabel unit stood
+   * down while the config was still written, so a caller must not read it as a failure.
+   * The restore and remove directions still refuse outright and say so in `message`.
+   */
   historyPreflightFailureReason?: string;
   status?: "skipped";
   /** `hub-gated` is the hub-role gate (#4236), distinct from the user's own OFF switch. */
@@ -903,6 +909,12 @@ export interface CodexInjectResult {
   nativeSubagentDefaultsWarning?: string;
 }
 
+/**
+ * The one history preflight reason that is permanent rather than operational: Codex owns
+ * paginated rollout ordinals, so no retry makes the legacy relabel protocol available again.
+ */
+const HISTORY_RELABEL_STANDS_DOWN = "history_paginated_requires_native_writer";
+
 class CodexHistoryPreflightRefusal extends Error {}
 class CodexRestoreRefusal extends Error {
   constructor(readonly config: CodexRestoreConfigResult) {
@@ -929,7 +941,7 @@ export async function injectCodexConfig(
 ): Promise<CodexInjectResult> {
   try { return await injectCodexConfigImpl(port, config, options); }
   catch (error) {
-    if (error instanceof CodexHistoryPreflightRefusal) return { success: false, message: `Codex config injection refused: ${error.message}. Existing configuration and history were preserved.` };
+    if (error instanceof CodexHistoryPreflightRefusal) return { success: false, historyPreflightFailureReason: error.message, message: `Codex config injection refused: ${error.message}. Existing configuration and history were preserved.` };
     throw error;
   }
 }
@@ -1055,7 +1067,10 @@ async function injectCodexConfigImpl(
     journaledInjectedOpenaiBaseUrl({ readOnly: !!options.beforeClientWrite }),
     journaledInjectedRealtimeWsBaseUrl({ readOnly: !!options.beforeClientWrite }),
   );
-  if (hasOcxProviderTable(content)) {
+  // Whether this home already published the provider id that its thread rows may reference.
+  // Design B strips the table below; it may only stay stripped if those rows can be relabeled.
+  const hadOcxProviderTableOnDisk = hasOcxProviderTable(content);
+  if (hadOcxProviderTableOnDisk) {
     content = removeOcxSection(content);
   }
   content = removeProfileSection(content);
@@ -1190,16 +1205,56 @@ async function injectCodexConfigImpl(
       return "history_injection_preflight_unavailable";
     }
   };
-  const historyPreflightError = historyPreflight();
-  if (historyPreflightError) {
+  /*
+   * ONE refusal stands the relabel unit down instead of vetoing the config transition, and
+   * only because it is permanent. Codex allocates paginated rollout ordinals in its own
+   * writer, so `assertLegacyHistoryRecord` refuses every rollout on a current install and no
+   * amount of retrying changes that. While it vetoed the write, `model_catalog_json` never
+   * reached config.toml, so the app and the CLI both fell back to their built-in model list
+   * while `ocx sync` still reported success.
+   *
+   * Every other reason — an unreadable state database, a rollout whose identity changed, a
+   * preflight that could not run — describes a store that may well be relabelable on the next
+   * attempt. Treating those as a stand-down would record the transition as converged and
+   * suppress the relabel permanently, so they keep the hard refusal and the rollback.
+   */
+  /*
+   * Re-observed inside the artifact transaction. A store that migrates to paginated history
+   * mid-write retires the relabel unit, because the config half writes no history and rolling
+   * it back is what left every paginated home with no OpenCodex models. Any other reason is
+   * still treated as a failed transition so compensation can restore the pre-images.
+   */
+  const observeHistoryRefusalOrThrow = (known: string | null): string | null => {
+    if (known) return known;
+    const observed = historyPreflight();
+    if (observed && observed !== HISTORY_RELABEL_STANDS_DOWN) throw new CodexHistoryPreflightRefusal(observed);
+    return observed;
+  };
+  const observedHistoryRefusal = historyPreflight();
+  if (observedHistoryRefusal && observedHistoryRefusal !== HISTORY_RELABEL_STANDS_DOWN) {
     return {
       success: false,
-      historyPreflightFailureReason: historyPreflightError,
-      message: `Codex config injection refused: ${historyPreflightError}. `
+      historyPreflightFailureReason: observedHistoryRefusal,
+      message: `Codex config injection refused: ${observedHistoryRefusal}. `
         + "Existing provider definitions and conversation files were preserved. "
         + "Paginated history requires native-writer coordination; do not run legacy recovery or retry this transition blindly.",
     };
   }
+  let historyRelabelRefusal = observedHistoryRefusal;
+
+  /*
+   * Rows this home may have tagged `opencodex` resolve only through a provider table. Design B
+   * normally retires that table because the relabel migrates those rows back to `openai` in
+   * the same pass; with the relabel stood down, stripping it anyway would leave every such
+   * conversation pointing at a provider id that no longer exists. Keep what was already
+   * published, and keep it BEFORE the witness so the lock admits the bytes actually written.
+   */
+  if (historyRelabelRefusal && hadOcxProviderTableOnDisk && !providerTableMode) {
+    content = applyEol(
+      content.trimEnd() + "\n" + buildProviderTableBlockForTarget(routingTarget, websocketsEnabled(config ?? {})),
+      eol,
+    );
+  }
 
   /*
    * The witness, built from the FINAL bytes. Everything it hashes is either the
@@ -1286,14 +1341,14 @@ async function injectCodexConfigImpl(
   if (options.validateOnly) {
     return {
       success: true,
+      ...(historyRelabelRefusal ? { historyPreflightFailureReason: historyRelabelRefusal } : {}),
       message: "Codex config injection preflight passed; no files were changed.",
     };
   }
 
   const applyNativeArtifacts = (): void => {
     beforeHistoryArtifactCommitForTests?.(eligibility.kind);
-    const historyError = historyPreflight();
-    if (historyError) throw new CodexHistoryPreflightRefusal(historyError);
+    historyRelabelRefusal = observeHistoryRefusalOrThrow(historyRelabelRefusal);
     const preImages = captureCodexPreImages();
     try {
     historyArtifactStageForTests?.("after-preflight");
@@ -1329,9 +1384,7 @@ async function injectCodexConfigImpl(
     });
     historyArtifactStageForTests?.("after-artifacts");
     // Detect migration throughout the artifact transaction, not just at entry.
-    // This is compensation, not a native-writer lock or permission to append ordinals.
-    const finalHistoryError = historyPreflight();
-    if (finalHistoryError) throw new CodexHistoryPreflightRefusal(finalHistoryError);
+    historyRelabelRefusal = observeHistoryRefusalOrThrow(historyRelabelRefusal);
     } catch (error) {
       const compensated = restoreCodexPreImages(preImages);
       if (!compensated.complete) throw new CodexPartialWriteError(compensated.unrestored);
@@ -1487,15 +1540,19 @@ async function injectCodexConfigImpl(
   // serialized one of them and an opposite-direction process could overtake
   // through the other two. The operation is derived from admitted intent here and
   // handed down fixed; the Worker never takes a direction from its caller.
-  const historyOutcome = await runCodexHistoryJob({
-    ...resolveCodexHistoryJobTarget(),
-    expectedDesiredEnabled: true,
-    operation: deriveCodexHistoryOperation({
-      direction: "apply",
-      resumeHistory: config?.syncResumeHistory !== false && !keepRootOverrideAlongsideTable,
-      legacyMode: providerTableMode,
-    }),
-  });
+  // A stood-down relabel unit spawns no Worker: the preflight it would run first has
+  // already refused, and the config half is committed either way.
+  const historyOutcome: CodexHistoryJobOutcome = historyRelabelRefusal
+    ? { kind: "skipped" }
+    : await runCodexHistoryJob({
+      ...resolveCodexHistoryJobTarget(),
+      expectedDesiredEnabled: true,
+      operation: deriveCodexHistoryOperation({
+        direction: "apply",
+        resumeHistory: config?.syncResumeHistory !== false && !keepRootOverrideAlongsideTable,
+        legacyMode: providerTableMode,
+      }),
+    });
   // A blocked or failed unit is reported, not silently counted as zero work:
   // `failed` is what makes the caller's message say so.
   const history: { rows: number; files: number; failed?: true } =
@@ -1528,6 +1585,8 @@ async function injectCodexConfigImpl(
       ? (keptUserBaseUrl
         ? `  Codex resume history: left unchanged; threads already tagged openai follow your configured root openai_base_url.\n`
         : `  Codex resume history: left unchanged; existing threads keep reaching the proxy through the retained openai_base_url override.\n`)
+      : historyRelabelRefusal
+      ? `  ⚠️ Codex resume history: left to Codex's native writer (${historyRelabelRefusal}); existing threads keep the provider they are tagged with. Routing and the model catalog were still installed, so new threads reach the proxy.\n`
       : config?.syncResumeHistory === false
       ? `  Codex resume history: left unchanged (syncResumeHistory=false).\n`
       : history.failed
@@ -1548,6 +1607,7 @@ async function injectCodexConfigImpl(
     return {
       success: true,
       ...(nativeSubagentDefaultsWarning ? { nativeSubagentDefaultsWarning } : {}),
+      ...(historyRelabelRefusal ? { historyPreflightFailureReason: historyRelabelRefusal } : {}),
       message:
         `Injected opencodex as default provider into Codex config (client-side compaction mode; ChatGPT auth remains required).\n` +
         `  Your root openai_base_url was left exactly as you set it, so opencodex did not add its own.\n` +
@@ -1566,6 +1626,7 @@ async function injectCodexConfigImpl(
       ...(nativeSubagentDefaultsWarning
         ? { nativeSubagentDefaultsWarning }
         : {}),
+      ...(historyRelabelRefusal ? { historyPreflightFailureReason: historyRelabelRefusal } : {}),
       message:
         `⚠️ Codex routing NOT injected: your config already sets a root openai_base_url, and opencodex never overwrites a user-owned override.\n` +
         catalogMessage +
@@ -1585,6 +1646,7 @@ async function injectCodexConfigImpl(
   return {
     success: true,
     ...(nativeSubagentDefaultsWarning ? { nativeSubagentDefaultsWarning } : {}),
+    ...(historyRelabelRefusal ? { historyPreflightFailureReason: historyRelabelRefusal } : {}),
     message:
       headline +
       catalogMessage +

package/src/codex/sync.ts

@@ -19,7 +19,7 @@ export interface CodexSyncResult {
   /**
    * `skipped` is policy truth, never evidence that Codex was written.
    * `catalog-only` means an explicit sync refreshed the catalog/cache while
-   * config/history injection was skipped (OFF, externally owned, or protected history).
+   * config/history injection was skipped (integration OFF, or externally owned).
    */
   status: "applied" | "skipped" | "catalog-only" | "refused";
   ok: boolean;
@@ -51,8 +51,9 @@ export interface CodexSyncOptions {
    * Explicit `ocx sync` is also the refresh path for side profiles that consume
    * the OpenCodex catalog without injection. When set, the sync still refreshes
    * the catalog and models cache even if the Codex integration toggle is OFF or
-   * an external `model_provider` owns config.toml, or paginated history refuses
-   * injection. Config/history injection is skipped in those cases.
+   * an external `model_provider` owns config.toml. Config/history injection is
+   * skipped in those two cases. A paginated-history refusal is NOT one of them:
+   * the injector writes config and stands only its relabel unit down.
    */
   catalogEvenWhenNotInjected?: boolean;
 }
@@ -209,25 +210,12 @@ export async function syncModelsToCodex(
   // working catalog/cache into the partial result of an otherwise unnecessary refresh.
   const preflight = await deps.injectCodexConfig(p, config, { validateOnly: true });
   if (!preflight.success) {
-    // Explicit model refresh does not require legacy history relabeling. Keep the
-    // injector's refusal intact and publish only through the existing catalog owner.
-    // Unattended sync and other config/integrity refusals retain their hard failure.
-    if (catalogEvenWhenNotInjected
-      && preflight.historyPreflightFailureReason === "history_paginated_requires_native_writer") {
-      applyProxyEnv(config);
-      const refreshed = await refreshCatalogForSync(config, deps, undefined, log);
-      const ok = refreshed.refreshOutcome === "committed" && refreshed.catalogExists;
-      const message = ok
-        ? "Model catalog synchronized; Codex config and conversation history left unchanged because paginated history requires its native writer."
-        : "Model catalog refresh did not complete; Codex config and conversation history were left unchanged.";
-      reportCodexHomeTarget(log, deps.collectCodexHomeDiagnostic ?? collectOrcaCodexHomeDiagnostic);
-      return {
-        ...refreshed,
-        status: "catalog-only",
-        ok,
-        message,
-      };
-    }
+    // A paginated-history refusal used to be downgraded here to a `catalog-only` success.
+    // That is what made the model picker regression silent: the catalog file was rewritten
+    // and reported synchronized while config.toml kept no provider table and no catalog
+    // path, so Codex offered only its native models. The injector now writes config and
+    // stands the relabel unit down instead, so nothing reaches this branch for that reason
+    // and a surviving refusal is a real config/integrity failure again.
     log?.error(preflight.message);
     reportCodexHomeTarget(log, deps.collectCodexHomeDiagnostic ?? collectOrcaCodexHomeDiagnostic);
     return {
@@ -300,6 +288,12 @@ export async function syncModelsToCodex(
   }
   if (result.success) log?.log(result.message);
   else log?.error(result.message);
+  // The config was written; only the relabel unit stood down. Carry that as a warning so a
+  // caller reading the structured result sees it without parsing the display message.
+  if (result.success && result.historyPreflightFailureReason) {
+    const historyWarning = `Codex conversation-history relabel left to Codex's native writer: ${result.historyPreflightFailureReason}.`;
+    warning = warning ? `${warning} ${historyWarning}` : historyWarning;
+  }
   reportCodexHomeTarget(log, deps.collectCodexHomeDiagnostic ?? collectOrcaCodexHomeDiagnostic);
   const projectConfigWarnings = printProjectCodexConfigWarnings(log, { cwd: process.cwd() });
   return {

package/src/generated/compatibility-version.json

@@ -10,7 +10,7 @@
     },
     {
       "path": "package.json",
-      "sha256": "7a7865fff1b6d029ee2b16296a4fca48963a83b7cb2257b37a1398ad35bd4ec3"
+      "sha256": "a640f2216bdb5ae42aee20beb16d273e59e4b359f9953f1b6185fed066db5d78"
     },
     {
       "path": "scripts/model-metadata.source.json",
@@ -266,7 +266,7 @@
     },
     {
       "path": "src/adapters/devin.ts",
-      "sha256": "2700deb66978a5f20c553bb4d32d56d1645244862f50c6ca38fd806ccc9b244c"
+      "sha256": "15a82837e1d54e5de20b9ed37cb4f450534d907ecdaa08d29632787f7a38cd7c"
     },
     {
       "path": "src/adapters/devin/cloud-direct/auth.ts",
@@ -698,7 +698,7 @@
     },
     {
       "path": "src/cli/capabilities.ts",
-      "sha256": "543e2fc9fa9406253b246eaced033d2ffa6753897d1eb8315e709018b78c5ca2"
+      "sha256": "eb069b79507e91300e449987d5adfae9e5637a5f70141f204e6f1e6c7ea38526"
     },
     {
       "path": "src/cli/catalog-prewarm.ts",
@@ -706,7 +706,7 @@
     },
     {
       "path": "src/cli/catalog.ts",
-      "sha256": "05a9c86acbb1b88b08c667cc4ab56d59abb991cb7975e72d878e9ceb351b132d"
+      "sha256": "3ba859e525b04202b97abf62590c041984053db84510eb981a4910e7bcc3b43a"
     },
     {
       "path": "src/cli/claude-agent-startup-sync.ts",
@@ -754,11 +754,11 @@
     },
     {
       "path": "src/cli/dispatch.ts",
-      "sha256": "1a39f4e792df8b0a626142d867e38035e82b307eea70f8bf75b905a92d334a98"
+      "sha256": "3c52a4d65ac960dfbe25c89fa82fc770d171cda0f53f3a3e469823c6207e4f4b"
     },
     {
       "path": "src/cli/doctor.ts",
-      "sha256": "fa6a405bd00e4d00de038d3cffd99656978f836a6bc5135dcdeed65c7917d18a"
+      "sha256": "57e91bb3223ff95bde1c57b80a2674dbce8a4d403919a63a319ae4e2f96355bd"
     },
     {
       "path": "src/cli/effort.ts",
@@ -808,6 +808,10 @@
       "path": "src/cli/interactive-confirm.ts",
       "sha256": "9fdc081a5f8e7a8c74612371e044f34054151a20b9692c0fd81a2bb41e86f9e5"
     },
+    {
+      "path": "src/cli/internal-command.ts",
+      "sha256": "b8a181fb5276380bf322fe38d7fd0202a0e976491f3148bc357b485282132b57"
+    },
     {
       "path": "src/cli/lab.ts",
       "sha256": "1a9b3f10824fabd4c4bdb192a9a2dcaafd3f3aea6b840f46330e2202906aeda9"
@@ -858,12 +862,16 @@
     },
     {
       "path": "src/cli/registry.ts",
-      "sha256": "db8c95de3798b82efa6a32e6a3a934679e782ef8b063a581bf013336262f1eaf"
+      "sha256": "c4c80108b8746765f4e0a1d741d4605984788161bf5562ef4459201dc137b016"
     },
     {
       "path": "src/cli/remote-workspace.ts",
       "sha256": "1f3d9a38a6c8ade4b567f6d7b010e9d6e71691fabd9f393fdedfdf6958e93339"
     },
+    {
+      "path": "src/cli/restart-scope.ts",
+      "sha256": "3d0dcc412b9695b4cb83d7da06dcd38cba2b8bb1ed56e6c6d8977f752341699f"
+    },
     {
       "path": "src/cli/root.ts",
       "sha256": "19c8d84e3d829d07a9ac8e3115e0cd1a3f3fd7d04416aa8a4754a057104b1ee2"
@@ -1074,11 +1082,11 @@
     },
     {
       "path": "src/codex/app-server-processes.ts",
-      "sha256": "23a816702a01f0a694cd1592af5bb90e600d4423285693854f8de9c4f1c41ff6"
+      "sha256": "9e0d8d1ae92bbcb6cf82d16ebde3a06021e527a48100a78819a06ca0fe94478f"
     },
     {
       "path": "src/codex/app-server-restart-service.ts",
-      "sha256": "975b84bd6ce1b51e14081b44904605fec298bf386165466f8197570aa6cb2b27"
+      "sha256": "6217a77e951e1155cce05f1a662bf12d7cf558677082b5ee94805907e69f6579"
     },
     {
       "path": "src/codex/auth-api.ts",
@@ -1150,7 +1158,7 @@
     },
     {
       "path": "src/codex/catalog/provider-fetch.ts",
-      "sha256": "8a0e187a69235a2e32e94e430c3282917fb260510cf61b1448704bb9fdc8e7e2"
+      "sha256": "7e5b6be0ec07b69c74ccd4e47b9a340cf9b8503e4c84d7a73f229d2224342907"
     },
     {
       "path": "src/codex/catalog/remote.ts",
@@ -1162,7 +1170,7 @@
     },
     {
       "path": "src/codex/catalog/sync.ts",
-      "sha256": "99fd92002213d4203227c4e30fbc34539dbd56da2fca9e9a2246a483c1455b7d"
+      "sha256": "d337c2270cd82ba94ea963127b59613a9e3086722b7625f848b5f6c5380c9007"
     },
     {
       "path": "src/codex/cli-install-provenance.ts",
@@ -1210,7 +1218,31 @@
     },
     {
       "path": "src/codex/desktop-app-restart.ts",
-      "sha256": "ba997ce741bae049697337ef7687f88e891a204b3bb434c43860247b26c08c7b"
+      "sha256": "33fd530a45237e78f8829b49634d30b5e72e73c518a026b55d70c777f2f10ffc"
+    },
+    {
+      "path": "src/codex/desktop-app/darwin.ts",
+      "sha256": "535068797d57187eab4d3a004c13438d41fcb3300876eb7750d199d8e2e7b860"
+    },
+    {
+      "path": "src/codex/desktop-app/handoff.ts",
+      "sha256": "644c823f83223b12ba73aeb835ead89c3e8189a61f626a2db2353e87ff003748"
+    },
+    {
+      "path": "src/codex/desktop-app/linux.ts",
+      "sha256": "88038f9b068acf9a549aeebe8c590c798671a56c2d2ebbdc6fade0ba07440e5e"
+    },
+    {
+      "path": "src/codex/desktop-app/lock.ts",
+      "sha256": "c4e6fec7461b96a6397c7a06a3e8ae2741f7e9c3b13d1db36473e18b160d482d"
+    },
+    {
+      "path": "src/codex/desktop-app/types.ts",
+      "sha256": "7e42332e52ea3a3957b59df658785b37f87672f0445b03f73d9773f581dd5646"
+    },
+    {
+      "path": "src/codex/desktop-app/windows.ts",
+      "sha256": "8d5c2a333027d115456d61509e521402c178fa60b78e4a209efb0549a5d80b3a"
     },
     {
       "path": "src/codex/exec-invocation.ts",
@@ -1266,7 +1298,7 @@
     },
     {
       "path": "src/codex/inject.ts",
-      "sha256": "004f51a4801bcbf3960cbbae9492d5f78b2e0972d5eeb96b2880065b2cacee75"
+      "sha256": "8f7807baf60620b30d87c86eb4d03bc6769376dfb147baa97e2d5a682746af14"
     },
     {
       "path": "src/codex/injected-marker.ts",
@@ -1574,7 +1606,7 @@
     },
     {
       "path": "src/codex/sync.ts",
-      "sha256": "4a25143724a4d5cb67f43013999193956f7bdeab86c27e418ef13b95ce53905e"
+      "sha256": "4fac2a4db6165eda61d759765319329b49a2aa5a8ee14527dcf65d43c9c4fdc6"
     },
     {
       "path": "src/codex/transition-state.ts",
@@ -2414,7 +2446,7 @@
     },
     {
       "path": "src/lib/codex-restart-contract.ts",
-      "sha256": "25518ea4ef7f482da904bd862d165fc7cee19add6cead5ced5b1126362077a15"
+      "sha256": "f2738e9d2fd79c80430aaa1e6f77161f448ccfd81ab39cbb0bc6cdd6ed7d66fd"
     },
     {
       "path": "src/lib/config-ownership.ts",
@@ -3078,7 +3110,7 @@
     },
     {
       "path": "src/providers/registry.ts",
-      "sha256": "c7fe45c3b2feec2c0ef22bb60d3f4298f3cc10a958e1fa24d6d39f4b3afa3309"
+      "sha256": "db391a42721d43cd168dafe464bb1d3bb22cb6a935fe8679c58188a0b7fa9359"
     },
     {
       "path": "src/providers/request-pacing.ts",
@@ -3890,7 +3922,7 @@
     },
     {
       "path": "src/server/responses.ts",
-      "sha256": "b5a7c538e73c6c5d1245faae2a6a8968f16870796aa2c0bdbfb8e19fe2c95ed5"
+      "sha256": "35b3f0b37c659a523c63738ffc0367e38fd68f5d974a402b3fd35f039b9a3e87"
     },
     {
       "path": "src/server/responses/agent-task-recovery-cache.ts",
@@ -3954,7 +3986,7 @@
     },
     {
       "path": "src/server/responses/core.ts",
-      "sha256": "86b3fd2c9a95a7a254d51d763d1b0a1f123494cd306aa61fcaa83f41fe42f9fe"
+      "sha256": "dd6612bc2d46dbdc42f41c76bcd341216c4e66a9408fd2485cbb15631781875c"
     },
     {
       "path": "src/server/responses/empty-completion-guard.ts",
@@ -3962,7 +3994,7 @@
     },
     {
       "path": "src/server/responses/encrypted-payload.ts",
-      "sha256": "138eefb2fc1b63a89833251f6ab4c72b0cafc2cbbfaee53e4dd03b045c38f212"
+      "sha256": "90cb251bcdd11bbe0e8b63e0d4f59608db329afd23932b301763017f427ba0a2"
     },
     {
       "path": "src/server/responses/fetch-helpers.ts",
@@ -4254,7 +4286,7 @@
     },
     {
       "path": "src/types/provider.ts",
-      "sha256": "f82f54c45d6642c7d1f7fbd3dca08d5b711280568df54287241f70ddc5e59a8f"
+      "sha256": "be9b34e6587de2341a6a82fca69cead2017ecd3675736ebc6c2e46f70e84e221"
     },
     {
       "path": "src/types/request.ts",
@@ -4490,7 +4522,7 @@
     },
     {
       "path": "src/web-search/index.ts",
-      "sha256": "0140ad5bf2d78c550d782aa02e6c6f010d602ce94cd97c812a066a449e5b61a6"
+      "sha256": "dcc1d3fef00b97249b3905c34a6f4f7c5319f90db0a670275e95e58c408024dd"
     },
     {
       "path": "src/web-search/loop.ts",
@@ -4506,12 +4538,16 @@
     },
     {
       "path": "src/web-search/passthrough-bridge.ts",
-      "sha256": "3863f9d7b942aef4cf3cee7d81377121ac00bb9f68953f64ada524f32bf1ca0d"
+      "sha256": "82f2c355d6c5b8c4b557a5187aa71fc5b77396c1fe902bc50b79d62c03e9ab71"
     },
     {
       "path": "src/web-search/progress-stream.ts",
       "sha256": "0b743935e725b7bdfaf285ba973bb3fcc0faaca6225c8ba3113ce504af328126"
     },
+    {
+      "path": "src/web-search/sidecar-providers.ts",
+      "sha256": "ffbc26760250ec95779d0130d18df4d0b3ce45cfbc7a1c12b7f00ba8f1be90a3"
+    },
     {
       "path": "src/web-search/sources.ts",
       "sha256": "1b4d77d514dde268edbc3354192fe9c6edb623f977753506ef89aa77b61d6571"

package/src/lib/codex-restart-contract.ts

@@ -32,6 +32,19 @@ export interface CodexAppServerStateResponse {
   runningCount: number;
 }
 
+/**
+ * The desktop half of a restart. Scalar-only for the same reason as the rest of this
+ * contract: pid lists and a closed-vocabulary reason, never a command line or an OS
+ * error message, both of which routinely embed a path or a username.
+ */
+export interface CodexDesktopRestartSummary {
+  attempted: boolean;
+  stopped: number[];
+  surviving: number[];
+  relaunch: "started" | "skipped";
+  reason?: string;
+}
+
 /** POST response. All four arrays are pid lists — never command lines. */
 export interface CodexRestartResponse {
   success: boolean;
@@ -44,6 +57,12 @@ export interface CodexRestartResponse {
   surviving: number[];
   failed: number[];
   code: CodexRestartCode;
+  /**
+   * Absent on a proxy older than this change, which is why it is optional rather than
+   * required: this guard is a version-skew check the GUI runs, and a dashboard talking
+   * to an older proxy has to keep working.
+   */
+  desktopApp?: CodexDesktopRestartSummary;
 }
 
 const APP_SERVER_STATES: readonly string[] = ["fresh", "stale", "not_running", "unknown"];
@@ -103,6 +122,18 @@ export function isCodexRestartResponse(value: unknown): value is CodexRestartRes
   if ((code === "nothing_running" || code === "enumeration_unavailable") && stopped.length > 0) {
     return false;
   }
+  if ("desktopApp" in view && view.desktopApp !== undefined) {
+    const desktop = view.desktopApp;
+    if (typeof desktop !== "object" || desktop === null) return false;
+    const d = desktop as Record<string, unknown>;
+    if (typeof d.attempted !== "boolean") return false;
+    if (!isPidList(d.stopped) || !isPidList(d.surviving)) return false;
+    if (d.relaunch !== "started" && d.relaunch !== "skipped") return false;
+    if (d.reason !== undefined && typeof d.reason !== "string") return false;
+    // A started relaunch cannot have left anything behind: the ladder refuses to
+    // relaunch beside a survivor precisely so a second shell never appears.
+    if (d.relaunch === "started" && (d.surviving as number[]).length > 0) return false;
+  }
   return true;
 }
 

package/src/providers/registry.ts

@@ -683,10 +683,9 @@ const DEEPSEEK_V4_LEGACY_MODELS = ["deepseek-v4-flash"];
 const DEEPSEEK_NATIVE_THINKING_MODELS = ["deepseek-flash", "deepseek-v4-flash"];
 const DEEPSEEK_GATEWAY_THINKING_MODELS = ["deepseek-v4.1-flash", "deepseek-v4-flash"];
 /*
- * DeepSeek's experimental vision preview (released 2026-08-21, api-docs.deepseek.com):
- * text+image input on the V4 Flash base. DeepSeek positions it as a preview id;
- * the expectation is that vision merges into `deepseek-v4-flash` proper later,
- * at which point this id retires the same way deepseek-chat/reasoner did.
+ * DeepSeek's legacy vision preview id (released 2026-08-21). First-party probes
+ * in #4436 resolve it to image-capable `deepseek-flash`; retain the existing
+ * declarations because gateway support is specific to each served identifier.
  */
 const DEEPSEEK_VISION_PREVIEW_MODEL = "deepseek-v4-flash-vision-exp";
 /**
@@ -2165,9 +2164,8 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     // the list only as compatibility aliases so existing saved configs and requests
     // keep validating and routing (they previously mapped to v4-flash; devlog
     // _fin/260710_provider_hardening/002_research_cn.md). The current offerings are
-    // the V4 ids — defaultModel and the model-specific wiring above use them.
-    // deepseek-v4-flash-vision-exp: experimental vision preview (2026-08-21) —
-    // expected to merge into deepseek-v4-flash later; see DEEPSEEK_VISION_PREVIEW_MODEL.
+    // V4.1-Flash — defaultModel and the model-specific wiring below use its live id.
+    // Keep the legacy vision-preview alias; see DEEPSEEK_VISION_PREVIEW_MODEL.
     models: ["deepseek-chat", "deepseek-reasoner", ...DEEPSEEK_NATIVE_THINKING_MODELS, DEEPSEEK_VISION_PREVIEW_MODEL],
     // V4.1-Flash is the current first-party offering; `deepseek-v4-flash` now routes there
     // as a compatibility alias, so a new install should ask for the live id by name.
@@ -2175,7 +2173,10 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     // Official DeepSeek Codex setup (codex-deepseek-setup.sh) advertises 1,048,576
     // for both V4 models; the older 1,000,000 figure was a rounded approximation.
     modelContextWindows: { "deepseek-flash": 1_048_576, "deepseek-v4-flash": 1_048_576, [DEEPSEEK_VISION_PREVIEW_MODEL]: 1_048_576 },
-    modelInputModalities: { [DEEPSEEK_VISION_PREVIEW_MODEL]: ["text", "image"] },
+    modelInputModalities: {
+      "deepseek-flash": ["text", "image"],
+      [DEEPSEEK_VISION_PREVIEW_MODEL]: ["text", "image"],
+    },
     // DeepSeek documents both V4 models as native Responses API models adapted for Codex
     // (model table marks Responses API ✓ for flash and pro; the /responses reference lists
     // both ids as accepted `model` values — verified 2026-08-13 with the V4 Pro GA,
@@ -2245,10 +2246,10 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     modelReasoningEffortMap: Object.fromEntries(DEEPSEEK_NATIVE_THINKING_MODELS.map(id => [id, deepseekReasoningMapFor(id)])),
     modelSupportsReasoningSummaries: Object.fromEntries(DEEPSEEK_NATIVE_THINKING_MODELS.map(id => [id, true])),
     preserveReasoningContentModels: DEEPSEEK_NATIVE_THINKING_MODELS,
-    // Issue #88: every DeepSeek API model is text-only input (no image support upstream) — the
-    // vision sidecar describes attached images for them, and the catalog advertises image input
-    // on their behalf (same treatment as opencode-go's DeepSeek V4 entries above).
-    noVisionModels: ["deepseek-chat", "deepseek-reasoner", ...DEEPSEEK_NATIVE_THINKING_MODELS],
+    // #4436: first-party deepseek-flash accepts native images on Chat and Responses.
+    // Keep unprobed compatibility aliases on the #88 sidecar path. This must be fixed
+    // here: router enrichment unions this list with saved config, so config cannot remove it.
+    noVisionModels: ["deepseek-chat", "deepseek-reasoner", "deepseek-v4-flash"],
   },
   // llama-3.3-70b was deprecated by Cerebras on 2026-02-16. Evidence: devlog/_plan/260710_provider_hardening/003_research_aggregators.md.
   { id: "cerebras", label: "Cerebras", baseUrl: "https://api.cerebras.ai/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://cloud.cerebras.ai/platform/apikeys", defaultModel: "gpt-oss-120b" },