@bitkyc08/opencodex 2.54.0-preview.20260914 → 2.55.0-preview.20260914

package/src/chat/image-parts.ts

@@ -0,0 +1,151 @@
+/**
+ * Inbound Chat Completions image parts, recognized once for every consumer.
+ *
+ * Two call sites used to answer "does this body carry an image?" independently and
+ * gave different answers: the translated path understood Pi/MCP and Anthropic-shaped
+ * parts, while the native fast path's route-eligibility predicate matched only
+ * `image_url`. A text-only routed model therefore kept an image-bearing body and
+ * forwarded a non-OpenAI part verbatim to an OpenAI-compatible upstream.
+ *
+ * Normalization runs before route selection so the diversion decision and the
+ * forwarded wire see the same parts. This module deliberately imports nothing: it is
+ * shared by `src/chat/` and `src/server/` and must not create an edge between them.
+ */
+
+type Rec = Record<string, unknown>;
+
+function isRec(v: unknown): v is Rec {
+  return !!v && typeof v === "object" && !Array.isArray(v);
+}
+
+/**
+ * The image reference a Chat content part carries, as a URL or data URI.
+ *
+ * Accepts OpenAI `image_url` (string or `{url}`), Pi/MCP-style
+ * `{type:"image", data, mimeType}` (Aside read_file tool results), and
+ * Anthropic-shaped `{type:"image", source:{...}}` in both base64 and url form.
+ * Returns null for anything else — including a part with no usable reference, which
+ * must be left alone rather than turned into a claim of an attachment.
+ */
+export function chatImageUrlFromPart(part: Rec): string | null {
+  if (part.type === "image_url") {
+    const imageUrl = part.image_url;
+    if (typeof imageUrl === "string" && imageUrl.length > 0) return imageUrl;
+    if (isRec(imageUrl) && typeof imageUrl.url === "string" && imageUrl.url.length > 0) return imageUrl.url;
+    return null;
+  }
+  if (part.type === "image") {
+    const data = part.data;
+    if (typeof data === "string" && data.length > 0) {
+      if (data.startsWith("data:")) return data;
+      const media = typeof part.mimeType === "string" && part.mimeType.length > 0 ? part.mimeType
+        : typeof part.mediaType === "string" && part.mediaType.length > 0 ? part.mediaType
+        : "image/png";
+      return "data:" + media + ";base64," + data;
+    }
+    const source = part.source;
+    if (isRec(source)) {
+      if (source.type === "base64" && typeof source.data === "string" && source.data.length > 0) {
+        const media = typeof source.media_type === "string" && source.media_type.length > 0 ? source.media_type : "image/png";
+        return "data:" + media + ";base64," + source.data;
+      }
+      if (source.type === "url" && typeof source.url === "string" && source.url.length > 0) return source.url;
+    }
+  }
+  return null;
+}
+
+/** The fidelity hint a recognized part carries, when it is one the wire accepts. */
+export function chatImageDetailFromPart(part: Rec): "auto" | "low" | "high" | undefined {
+  const raw = isRec(part.image_url) ? part.image_url.detail : part.detail;
+  return raw === "auto" || raw === "low" || raw === "high" ? raw : undefined;
+}
+
+/**
+ * True when any `messages[].content[]` part carries a recognized image, in any of
+ * the accepted shapes. This is the predicate native-route eligibility depends on, so
+ * widening `chatImageUrlFromPart` widens the text-only diversion with it.
+ */
+export function chatBodyCarriesImage(rawBody: Rec): boolean {
+  const messages = rawBody.messages;
+  if (!Array.isArray(messages)) return false;
+  for (const message of messages) {
+    if (!isRec(message) || !Array.isArray(message.content)) continue;
+    for (const part of message.content) {
+      if (isRec(part) && chatImageUrlFromPart(part) !== null) return true;
+    }
+  }
+  return false;
+}
+
+/**
+ * Rewrite every recognized non-OpenAI image part into `image_url` form.
+ *
+ * Copy-on-write, and genuinely lazy: replacement arrays are allocated only after a
+ * part actually needs rewriting. An ordinary text or native-Chat request walks the
+ * messages and allocates nothing, and the original object reference is returned.
+ * An earlier revision mapped every message and content array eagerly and only then
+ * compared — identity was preserved, but the transient arrays were not, so the
+ * "only rewritten paths are rebuilt" claim was false for the common path.
+ *
+ * Every sibling part, every other message field and every top-level body field keep
+ * their exact value: the native path is a whitelist passthrough, so an incidental
+ * deep clone would itself be a behavior change.
+ *
+ * Each rewritten Pi/Anthropic base64 part costs one copy of its payload string,
+ * bounded by the inbound body limit `readChatBody` already enforces.
+ */
+export function normalizeChatImageParts(rawBody: Rec): Rec {
+  const messages = rawBody.messages;
+  if (!Array.isArray(messages)) return rawBody;
+  let nextMessages: unknown[] | undefined;
+  for (let messageIndex = 0; messageIndex < messages.length; messageIndex++) {
+    const message = messages[messageIndex];
+    if (!isRec(message) || !Array.isArray(message.content)) continue;
+    const content = message.content;
+    let nextContent: unknown[] | undefined;
+    for (let partIndex = 0; partIndex < content.length; partIndex++) {
+      const part = content[partIndex];
+      // Already-OpenAI parts are left byte-identical; only foreign shapes are rewritten.
+      if (!isRec(part) || part.type === "image_url") continue;
+      const url = chatImageUrlFromPart(part);
+      if (url === null) continue;
+      const detail = chatImageDetailFromPart(part);
+      nextContent ??= content.slice();
+      nextContent[partIndex] = { type: "image_url", image_url: { url, ...(detail ? { detail } : {}) } };
+    }
+    if (!nextContent) continue;
+    nextMessages ??= messages.slice();
+    nextMessages[messageIndex] = { ...message, content: nextContent };
+  }
+  return nextMessages ? { ...rawBody, messages: nextMessages } : rawBody;
+}
+
+/**
+ * True when a `role: "tool"` message carries a recognized image, in any accepted shape.
+ *
+ * Shape normalization alone does NOT make such a request safe on the native fast path.
+ * A standard Chat tool message accepts a string or text parts only — not `image_url` —
+ * so rewriting a Pi/Anthropic tool image into `image_url` still leaves an image part
+ * inside a tool message, which a standard-enforcing endpoint rejects.
+ *
+ * The translated openai-chat adapter already solves placement: it collects tool-result
+ * images and flushes them into a following `user` carrier after the complete paired
+ * tool-result batch. Diverting these requests there is narrower than reimplementing
+ * that carrier on the native path, and it leaves ordinary user images and text-only
+ * tool results on the native fast path untouched.
+ */
+export function chatBodyCarriesToolResultImage(rawBody: Rec): boolean {
+  const messages = rawBody.messages;
+  if (!Array.isArray(messages)) return false;
+  for (const message of messages) {
+    // The legacy `function` role carries a tool result under the same schema constraint,
+    // so it needs the same diversion.
+    if (!isRec(message) || (message.role !== "tool" && message.role !== "function")) continue;
+    if (!Array.isArray(message.content)) continue;
+    for (const part of message.content) {
+      if (isRec(part) && chatImageUrlFromPart(part) !== null) return true;
+    }
+  }
+  return false;
+}

package/src/chat/inbound.ts

@@ -5,6 +5,9 @@
  * Same translate-and-replay pattern as Claude Messages: the produced body must pass
  * responsesRequestSchema so routing/OAuth/pool/sidecars are inherited unchanged.
  */
+import { chatImageUrlFromPart } from "./image-parts";
+import { untranslatedChatInputMedia, untranslatedInputMediaMessage } from "../responses/input-media";
+
 export class ChatCompletionsRequestError extends Error {}
 
 type Rec = Record<string, unknown>;
@@ -25,7 +28,12 @@ export function assertChatCompletionsRoutingBody(raw: unknown): asserts raw is C
   }
 }
 
-const OUTPUT_CONFIG_EFFORTS = new Set(["minimal", "low", "medium", "high", "xhigh", "max", "ultra"]);
+// "none" is the runtime's disable sentinel, not an unknown value: src/reasoning-effort.ts
+// accepts it and maps it to "omit the reasoning parameter", and the Pi client export maps
+// Pi's "off" thinking level onto it (src/clients/config-export.ts). Dropping it here let a
+// provider default re-enable thinking the caller had explicitly turned off — and for the
+// Anthropic families that think by default, omission is not the same as disabled.
+const OUTPUT_CONFIG_EFFORTS = new Set(["none", "minimal", "low", "medium", "high", "xhigh", "max", "ultra"]);
 const OUTPUT_CONFIG_SUMMARIES = new Set(["auto", "concise", "detailed", "none"]);
 
 function contentToText(content: unknown): string {
@@ -45,38 +53,9 @@ function contentToText(content: unknown): string {
   return parts.join("\n");
 }
 
-function imageUrlFromPart(part: Rec): string | null {
-  if (part.type === "image_url") {
-    const imageUrl = part.image_url;
-    if (typeof imageUrl === "string" && imageUrl.length > 0) return imageUrl;
-    if (isRec(imageUrl) && typeof imageUrl.url === "string" && imageUrl.url.length > 0) return imageUrl.url;
-    return null;
-  }
-  // Agent clients whose native wire shape is not OpenAI's still send images over
-  // Chat Completions: Pi/MCP-style parts carry {type:"image", data, mimeType}
-  // (Aside read_file tool results), Anthropic-shaped clients carry a source
-  // object. Dropping either silently blinds a vision model, so normalize both
-  // to the URL/data-URI form the Responses pipeline already understands.
-  if (part.type === "image") {
-    const data = part.data;
-    if (typeof data === "string" && data.length > 0) {
-      if (data.startsWith("data:")) return data;
-      const media = typeof part.mimeType === "string" && part.mimeType.length > 0 ? part.mimeType
-        : typeof part.mediaType === "string" && part.mediaType.length > 0 ? part.mediaType
-        : "image/png";
-      return "data:" + media + ";base64," + data;
-    }
-    const source = part.source;
-    if (isRec(source)) {
-      if (source.type === "base64" && typeof source.data === "string" && source.data.length > 0) {
-        const media = typeof source.media_type === "string" && source.media_type.length > 0 ? source.media_type : "image/png";
-        return "data:" + media + ";base64," + source.data;
-      }
-      if (source.type === "url" && typeof source.url === "string" && source.url.length > 0) return source.url;
-    }
-  }
-  return null;
-}
+// Recognition moved to src/chat/image-parts.ts so the native fast path's
+// route-eligibility predicate and this translator cannot drift apart again.
+const imageUrlFromPart = chatImageUrlFromPart;
 
 function videoUrlFromPart(part: Rec): string | null {
   if (part.type !== "video_url") return null;
@@ -118,6 +97,31 @@ function userContentToBlocks(content: unknown): Rec[] {
   return blocks;
 }
 
+/**
+ * The assistant's prior thinking, as plaintext, from either Chat spelling.
+ *
+ * The outbound direction already reconstructs these for providers listed in
+ * `preserveReasoningContentModels` (src/adapters/openai-chat.ts), so a client
+ * replaying a turn sends them back. Dropping them here made the round trip lossy and
+ * left interleaved-thinking providers seeing a bare continuation.
+ *
+ * Only representable plaintext is read. No signature, encrypted payload or
+ * provider-issued item id is reconstructed — see the reasoning item built below.
+ */
+function assistantReasoningText(msg: Rec): string | undefined {
+  if (typeof msg.reasoning_content === "string" && msg.reasoning_content.length > 0) {
+    return msg.reasoning_content;
+  }
+  if (Array.isArray(msg.reasoning_details)) {
+    const segments: string[] = [];
+    for (const raw of msg.reasoning_details) {
+      if (isRec(raw) && typeof raw.text === "string" && raw.text.length > 0) segments.push(raw.text);
+    }
+    if (segments.length > 0) return segments.join("");
+  }
+  return undefined;
+}
+
 function assistantContentToBlocks(content: unknown): Rec[] {
   if (typeof content === "string") {
     return content.length > 0 ? [{ type: "output_text", text: content }] : [];
@@ -274,6 +278,13 @@ function resolveReasoningSummary(raw: Rec): string | undefined {
  */
 export function chatCompletionsToResponsesBody(raw: unknown): Rec {
   assertChatCompletionsRoutingBody(raw);
+  // Only the translated path reaches this function. Native Chat can retain its
+  // provider-specific file/audio blocks; projecting them here would discard them.
+  const unsupportedMedia = untranslatedChatInputMedia(raw);
+  if (unsupportedMedia) {
+    throw new ChatCompletionsRequestError(untranslatedInputMediaMessage(unsupportedMedia));
+  }
+
 
   const systemParts: string[] = [];
   const input: Rec[] = [];
@@ -295,11 +306,30 @@ export function chatCompletionsToResponsesBody(raw: unknown): Rec {
         break;
       }
       case "assistant": {
+        // A reasoning item precedes the assistant message it belongs to: the
+        // Responses assistant item schema admits only output content blocks, so there
+        // is no attachment point on the message itself, and the parser buffers a
+        // reasoning item and prepends it to the NEXT assistant message. Emitting it
+        // here keeps that adjacency intact.
+        const reasoningText = assistantReasoningText(msg);
+        if (reasoningText !== undefined) {
+          input.push({ type: "reasoning", content: [{ type: "reasoning_text", text: reasoningText }] });
+        }
         const blocks = assistantContentToBlocks(msg.content);
         if (blocks.length > 0) input.push({ type: "message", role: "assistant", content: blocks });
         if (msg.tool_calls !== undefined) toolCallsToItems(msg.tool_calls, input, knownNameByCallId);
         break;
       }
+      case "function": {
+        // Native eligibility diverts legacy image results too, but this translator
+        // has no legacy function_call/name pairing. Never silently discard them.
+        if (Array.isArray(msg.content) && msg.content.some(part => isRec(part) && imageUrlFromPart(part))) {
+          throw new ChatCompletionsRequestError(
+            "Legacy function-result image translation is not implemented. Use tool_calls and role:tool with tool_call_id.",
+          );
+        }
+        break;
+      }
       case "tool": {
         const callId = typeof msg.tool_call_id === "string" ? msg.tool_call_id
           : typeof msg.tool_use_id === "string" ? msg.tool_use_id
@@ -342,6 +372,13 @@ export function chatCompletionsToResponsesBody(raw: unknown): Rec {
   if (typeof maxTokens === "number") body.max_output_tokens = maxTokens;
   if (typeof raw.temperature === "number") body.temperature = raw.temperature;
   if (typeof raw.top_p === "number") body.top_p = raw.top_p;
+  // responsesRequestSchema accepts both, parser.ts reads them into
+  // options.presencePenalty/frequencyPenalty, and the openai-chat adapter writes them
+  // back to the wire. Only this first link was missing, so a Chat caller's penalties
+  // never reached a provider that supports them. Per-model noPenaltyModels opt-outs
+  // still apply at the adapter.
+  if (typeof raw.presence_penalty === "number") body.presence_penalty = raw.presence_penalty;
+  if (typeof raw.frequency_penalty === "number") body.frequency_penalty = raw.frequency_penalty;
   if (raw.stop !== undefined) body.stop = raw.stop;
   if (typeof raw.user === "string") body.user = raw.user;
   if (typeof raw.parallel_tool_calls === "boolean") body.parallel_tool_calls = raw.parallel_tool_calls;

package/src/cli/connect.ts

@@ -29,6 +29,8 @@ import {
   takeFlag,
   takeIntegerOption,
   takeOption,
+  terminalSafeError,
+  terminalSafeText,
   type RuntimeApiDeps,
 } from "./runtime-api";
 
@@ -40,6 +42,15 @@ export interface ClientCommandDeps extends RuntimeApiDeps {
 export interface ClientCatalogProbeDeps extends CatalogCompatibilityDeps {
   /** Injected in tests; defaults to reading the materialized client catalog off disk. */
   readCatalogBody?: () => string | null;
+  /**
+   * A Codex command the caller already resolved, handed over so readiness skips resolving it
+   * again. General `ocx status` resolves the full runtime for its diagnostics block; the resolver
+   * memo is keyed by discovery scope and holds one entry, so a priority-only readiness resolve
+   * and the full one miss each other and re-probe the same command with `--version` — up to eight
+   * seconds apiece. Passing the command across adds no cache state, and it cannot disagree with
+   * what status prints because it is the selection status is printing.
+   */
+  selectedCodexCommand?: string;
 }
 
 export const CONNECT_USAGE = `Usage:
@@ -101,11 +112,15 @@ function readInstalledCatalogBody(): string | null {
  * `codexSupportedReasoningEfforts()` with no deps reaches `resolveAndPersistCodexRuntime`, which
  * writes codex-runtime.json. `ocx status` deliberately resolves without persisting, and a
  * read-only diagnostics command should not start writing runtime selection state because a
- * readiness check was added to it. Handing the already-resolved command in as the only candidate
- * skips that path and reuses the resolve cache `ocx status` has usually already filled.
+ * readiness check was added to it. Stop at the first valid runtime, then hand only that command
+ * to the catalog probe: readiness does not consume alternative-runtime diagnostics. The resolver
+ * keeps this priority-only cache separate from the full discovery used by `ocx status`.
+ *
+ * A caller that has already resolved passes its selection in through `selectedCodexCommand` rather
+ * than paying for a second `--version` probe of the command it just resolved.
  */
-function observeLocalCodexEffortLadder(): ReadonlySet<string> | null {
-  const command = resolveCodexRuntime().runtime.command;
+function observeLocalCodexEffortLadder(selected?: string): ReadonlySet<string> | null {
+  const command = selected ?? resolveCodexRuntime({ discoverAlternatives: false }).runtime.command;
   return codexSupportedReasoningEfforts({ commandCandidates: () => [command] });
 }
 
@@ -117,7 +132,8 @@ function observeLocalCodexEffortLadder(): ReadonlySet<string> | null {
  * a single `ocx connect`.
  */
 function catalogObserver(deps: ClientCatalogProbeDeps | undefined): CatalogCompatibilityDeps {
-  return { supportedEfforts: deps?.supportedEfforts ?? observeLocalCodexEffortLadder };
+  const selected = deps?.selectedCodexCommand;
+  return { supportedEfforts: deps?.supportedEfforts ?? (() => observeLocalCodexEffortLadder(selected)) };
 }
 
 /** The stat half of the catalog verdict, shared by the status collector and `ocx connect`. */
@@ -212,7 +228,7 @@ function readinessLine(status: ClientConnectionStatus): string {
     : status.readiness === "incompatible"
       ? "not ready"
       : "unverified";
-  return `Local Codex CLI: ${label}${status.readinessReason ? ` (${status.readinessReason})` : ""}`;
+  return `Local Codex CLI: ${label}${status.readinessReason ? ` (${terminalSafeText(status.readinessReason)})` : ""}`;
 }
 
 export type ConnectCompletionReport = {
@@ -249,9 +265,10 @@ export function connectCompletionReport(
   if (readiness.kind === "unverified") {
     // Not a failure. A client with no observable Codex CLI is a working configuration, and the
     // write-time gate deliberately lets it through; saying so is the honest middle report.
-    return { lines: [connected, `Local Codex CLI: unverified (${readiness.reason}).`], failure: null };
+    return { lines: [connected, `Local Codex CLI: unverified (${terminalSafeText(readiness.reason)}).`], failure: null };
   }
-  const verdict = `Local Codex CLI: not ready (${readiness.reason})`;
+  const safeReason = terminalSafeText(readiness.reason);
+  const verdict = `Local Codex CLI: not ready (${safeReason})`;
   if (!selectedClients.includes("codex")) {
     return {
       lines: [connected, `${verdict} This connection selected ${selectedClients.join(", ")}, so nothing here launches Codex.`],
@@ -260,7 +277,7 @@ export function connectCompletionReport(
   }
   return {
     lines: [verdict, `The connection to ${connection.serverUrl} as key ${connection.apiKeyId} was saved; run 'ocx connect status' to see it.`],
-    failure: `client_not_ready: ${readiness.reason}`,
+    failure: `client_not_ready: ${safeReason}`,
   };
 }
 
@@ -344,6 +361,10 @@ async function runConnect(argv: string[], deps: ClientCommandDeps): Promise<void
     // production would let the gate fall back to its own probing, persisting default, so one
     // command could run two probes and act on two different ladders.
     catalogCompatibility: catalogObserver(deps.catalogProbeDeps),
+  }).catch((error: unknown) => {
+    // Compatibility refusals happen before the completion report and reach stderr.
+    // Keep the domain error untouched; render its message only at the CLI boundary.
+    throw terminalSafeError(error);
   });
   // The hub and the credential are proven at this point; the local runtime is not. Reporting
   // only the first half is what #4207 was filed for, so the catalog now on disk is checked

package/src/cli/dispatch.ts

@@ -28,7 +28,7 @@ import { restoreNativeCodexAsync } from "../codex/inject";
 import { stripGrokConfig } from "../grok/inject";
 import { handleRestartScopeAfterWrite, readRestartScope, type RestartScope } from "./restart-scope";
 import { normalizeUpdateChannel, runGuiUpdateWorker } from "../update/job";
-import { isJsonOption, takeFlag } from "./runtime-api";
+import { isJsonOption, takeFlag, terminalSafeError } from "./runtime-api";
 import type { ClientConnectionState } from "../client/state";
 import { OCX_NATIVE_REPLAY_RECOVERY_NOTE } from "../responses/compaction";
 
@@ -70,7 +70,7 @@ export function selectDefaultGuiUrl(
   probeHostname: (hostname: string | undefined) => string,
 ): string {
   const ingress = config.runtimeRole === "hub" ? config.hub?.managementIngress : undefined;
-  if (ingress?.enabled) return `http://localhost:${ingress.port}`;
+  if (ingress?.enabled) return `http://127.0.0.1:${ingress.port}`;
 
   const guiHost = probeHostname(live?.hostname ?? config.hostname);
   const hostname = guiHost === "127.0.0.1" ? "localhost" : guiHost;
@@ -405,7 +405,11 @@ const commandRunners: Record<string, CommandRunner> = {
         // types it as `number | string`; only a numeric code means anything here.
         return typeof process.exitCode === "number" ? process.exitCode : 0;
       } catch (error) {
-        console.error(`Connected sync failed without local fallback: ${error instanceof Error ? error.message : String(error)}`);
+        // The refresh path reaches the same hub catalog `ocx connect` validates, so a rejected
+        // reasoning level arrives here as hub-supplied text. Rendering it through the shared
+        // terminal boundary is what keeps the routine refresh from forging output; the domain
+        // error itself is left alone for callers that inspect it.
+        console.error(`Connected sync failed without local fallback: ${terminalSafeError(error).message}`);
         return 1;
       }
     }

package/src/cli/index.ts

@@ -732,6 +732,9 @@ function reportRestartFailure(result: Extract<ProxyRestartResult, { ok: false }>
     if (code === "restart_capability_unsupported") {
       console.error("❌ The running proxy predates process-bound restart support; no unsafe fallback was attempted.");
       console.error("   After confirming this home owns the proxy, run `ocx stop` and then `ocx start` once.");
+    } else if (code === "restart_version_skew") {
+      console.error("❌ The running proxy reports a different OpenCodex version than this CLI; restarting in place would respawn the old installation.");
+      console.error("   Run `ocx stop` and then `ocx start` from this installation instead.");
     } else {
       console.error("❌ Proxy restart request could not be confirmed; no fallback stop/start was attempted.");
     }

package/src/cli/runtime-api.ts

@@ -350,6 +350,31 @@ export function printData(value: unknown, wantsJson: boolean, lines?: string[]):
   else for (const line of lines) console.log(line);
 }
 
+/**
+ * Render untrusted diagnostic text without letting it control the operator's terminal. Catalog
+ * values are hub-supplied and surface on more than one CLI path -- first-time `ocx connect` and the
+ * connected `ocx sync` refresh both print them -- so the escaping sits beside `printData`, at the
+ * one boundary that already separates human output from structured output. Structured output keeps
+ * the exact value: escaping is a rendering decision for a tty, not a change to the data.
+ */
+export function terminalSafeText(value: string): string {
+  return value.replace(/[\x00-\x1f\x7f-\x9f\u2028\u2029]/g, character => {
+    const code = character.charCodeAt(0);
+    return code <= 0x7f
+      ? `\\x${code.toString(16).padStart(2, "0")}`
+      : `\\u${code.toString(16).padStart(4, "0")}`;
+  });
+}
+
+/**
+ * The same rendering for a failure about to be printed or rethrown. The original is kept as
+ * `cause` rather than discarded, so a caller that inspects the domain error still reads the exact
+ * message and fields it threw.
+ */
+export function terminalSafeError(error: unknown): Error {
+  return new Error(terminalSafeText(error instanceof Error ? error.message : String(error)), { cause: error });
+}
+
 /** Compact human view for safe management DTOs; JSON remains available for complete fidelity. */
 export function summaryLines(value: unknown, prefix = "", depth = 0): string[] {
   if (!value || typeof value !== "object" || depth > 1) return [`${prefix || "value"}: ${String(value)}`];

package/src/cli/status.ts

@@ -509,7 +509,27 @@ export async function collectStatus(): Promise<CliStatusView> {
     desiredEnabled: claudeDesktopIntegrationEnabled(config),
     policy: claudeDesktopPolicyHealth(probeClaudeDesktopPolicy()),
   };
-  const clientConnection = collectClientConnectionStatus();
+  const resolvedRuntime = (() => {
+    try {
+      return resolveCodexRuntime();
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      const redacted = redactUserPath(redactSecretString(message)).slice(0, 160);
+      return {
+        runtime: { command: "codex", version: null, source: "fallback" as const },
+        failures: [{
+          command: "codex",
+          source: "fallback" as const,
+          reason: `resolve threw: ${redacted}`,
+        }],
+        replacedConfigured: undefined,
+        newerAvailable: undefined,
+      };
+    }
+  })();
+  const clientConnection = collectClientConnectionStatus(Date.now(), undefined, {
+    selectedCodexCommand: resolvedRuntime.runtime.command,
+  });
   // Asked before the local probes below so a connected client's report is hub-sourced from its
   // first line. Bounded and failure-tolerant: an offline hub degrades the remoteHub block, it
   // does not fail `ocx status`.
@@ -567,24 +587,6 @@ export async function collectStatus(): Promise<CliStatusView> {
     routingKind: getCodexRoutingKind(),
   });
   const codexPlugins = diagnoseCodexBundledPlugins();
-  const resolvedRuntime = (() => {
-    try {
-      return resolveCodexRuntime();
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      const redacted = redactUserPath(redactSecretString(message)).slice(0, 160);
-      return {
-        runtime: { command: "codex", version: null, source: "fallback" as const },
-        failures: [{
-          command: "codex",
-          source: "fallback" as const,
-          reason: `resolve threw: ${redacted}`,
-        }],
-        replacedConfigured: undefined,
-        newerAvailable: undefined,
-      };
-    }
-  })();
   const lastClamp = loadLastEffortClamp();
   const clampActive = effortClampAppliesToRuntime(lastClamp, resolvedRuntime.runtime);
   const codexHome = collectOrcaCodexHomeDiagnostic();

package/src/cli/system-restart-client.ts

@@ -22,6 +22,8 @@ import {
   type LiveProxy,
 } from "../server/proxy-liveness";
 import type { ProxyRestartRequestOutcome } from "./tray-proxy";
+import { packageVersion } from "./help";
+import { computeVersionSkew } from "./version-skew";
 
 export const SYSTEM_RESTART_REQUEST_TIMEOUT_MS = 5_000;
 export const SYSTEM_RESTART_ATTESTATION_TIMEOUT_MS = 4_000;
@@ -32,12 +34,23 @@ export interface BoundSystemRestartDeps {
   findLive?: typeof findLiveProxy;
   createChallenge?: () => string;
   now?: () => number;
+  /** Invoking CLI version for the skew guard; defaults to this bundle's package version. */
+  cliVersion?: string;
 }
 
 function rejected(code: string): ProxyRestartRequestOutcome {
   return { accepted: false, uncertain: false, error: new Error(code) };
 }
 
+/** Own-bundle version for the skew comparison; an unreadable bundle is "cannot compare", not a crash. */
+function ownCliVersion(): string {
+  try {
+    return packageVersion();
+  } catch {
+    return "unknown";
+  }
+}
+
 function uncertain(code: string): ProxyRestartRequestOutcome {
   return { accepted: false, uncertain: true, error: new Error(code) };
 }
@@ -107,6 +120,18 @@ export async function requestBoundSystemRestart(
     return rejected("restart_capability_unsupported");
   }
 
+  // An in-place restart respawns the live process from its own installation
+  // (selfLaunchArgv in server/management/system-restart.ts), so a restart accepted
+  // from a different-version CLI would keep the OLD build serving while reporting
+  // success (#4522). Both sides already publish exactly the data doctor's skew
+  // diagnosis compares (packageVersion vs the /healthz version), so reuse that
+  // comparison and refuse before POST. Placeholder versions (unknown/0.0.0) are
+  // "cannot compare", not mismatch, and keep the existing behavior.
+  const proxyVersion = typeof body.version === "string" ? body.version : undefined;
+  if (computeVersionSkew(deps.cliVersion ?? ownCliVersion(), proxyVersion).skewed) {
+    return rejected("restart_version_skew");
+  }
+
   let observed: LiveProxy | null;
   try {
     observed = await (deps.findLive ?? findLiveProxy)({ deadlineAt, nowFn: now });

package/src/clients/config-export.ts

@@ -627,10 +627,20 @@ function opencodeProviderConnection(baseURL: string, config: OcxConfig): Opencod
  * override a default the user controls in opencodex. Variants are opt-in per selection,
  * which is the same reason we never emit `defaultModel` for MCode.
  *
- * `none` is dropped even when a ladder declares it. It is a valid *declared* effort, but the
- * chat ingress filters wire efforts against `OUTPUT_CONFIG_EFFORTS`, which has no `none`, so
- * selecting it would send no effort at all and silently fall back to the proxy default — a
- * selectable value that cannot do what its label says. Same call MCode makes for its picker.
+ * `none` is dropped even when a ladder declares it.
+ *
+ * The original reason no longer holds and is recorded here so it is not repeated: the chat
+ * ingress `OUTPUT_CONFIG_EFFORTS` allowlist DID omit `none`, so selecting it sent no effort
+ * at all and fell back to the proxy default. That allowlist now accepts `none` (audit F7),
+ * because it is the runtime's disable sentinel and dropping it let a provider default
+ * re-enable thinking a caller had turned off.
+ *
+ * The variant stays filtered anyway, deliberately and narrowly: emitting it would change
+ * what this exporter writes into a user's opencode config, and whether opencode's own
+ * picker round-trips `reasoningEffort: "none"` to the wire this proxy reads has not been
+ * verified here. Re-enabling it is a scoped follow-up that needs that check first, not a
+ * side effect of an ingress fix. MCode and ZCode filter `none` for their own separate
+ * reasons, documented at their call sites.
  */
 function opencodeEffortVariants(model: OpencodeCatalogModel): OpencodeModelVariant[] | undefined {
   if (model.reasoningEfforts === undefined) return undefined;

package/src/codex/app-server-processes.ts

@@ -524,6 +524,31 @@ function defaultListSnapshots(platform: NodeJS.Platform, getuid: () => number |
   return listUnixProcSnapshots(getuid());
 }
 
+export interface ListProcessSnapshotsOptions {
+  platform?: NodeJS.Platform;
+  getuid?: () => number | undefined;
+}
+
+/**
+ * Raw process snapshots for callers that need to match their own predicate.
+ *
+ * Throws on enumeration failure. That is the contract routing-adoption needs:
+ * a thrown read is "could not enumerate" and must never collapse to an empty
+ * list. listCodexAppServerProcesses maps the same failure to [] for the #476
+ * kill path, which would otherwise print a false adopted for #4550.
+ */
+export function listProcessSnapshots(options: ListProcessSnapshotsOptions = {}): ProcessSnapshot[] {
+  const platform = options.platform ?? process.platform;
+  const getuid = options.getuid ?? (() => {
+    try {
+      return typeof process.getuid === "function" ? process.getuid() : undefined;
+    } catch {
+      return undefined;
+    }
+  });
+  return defaultListSnapshots(platform, getuid);
+}
+
 export function listCodexAppServerProcesses(io: CodexAppServerProcessIo = {}): CodexAppServerProcess[] {
   const platform = io.platform ?? process.platform;
   const getuid = io.getuid ?? (() => {