@bitkyc08/opencodex 2.56.0 → 2.57.0

package/src/codex/auth-context.ts

@@ -39,7 +39,12 @@ import {
   pickAlternateCodexAccount,
   resolveCodexAccountForThreadDetailed,
   type CodexAffinityDecision,
+  type CodexThreadResolution,
+  type TransientProbeGrant,
 } from "./routing";
+// The half-open TRANSIENT-HOLD lease (#4701). Not the quota-cooldown probe lease imported from
+// ./routing above -- different module, different domain, and a request never holds both.
+import { releaseTransientProbe } from "../routing/probe-lease";
 import {
   codexConversationIdentity,
   recordCodexThreadLineage,
@@ -47,6 +52,7 @@ import {
   type CodexThreadLineage,
 } from "./lineage";
 import {
+  cachedDeniedCodexAccountIdsForModel,
   entitledCodexAccountIdsForModel,
   isDirectCallerEntitledToCodexModel,
   resolveCodexModelEntitlements,
@@ -202,6 +208,12 @@ export type CodexAuthContext =
       affinityDecision?: CodexAffinityDecision;
       /** Scope that owns `probeLeaseId`, when it is a scoped recovery probe. */
       probeQuotaScope?: CodexQuotaScope;
+      /**
+       * Set when this request is the ONE dispatch admitted to test an account held under a
+       * transient 5xx hold (#4701). Echo it into the upstream outcome so the trial is settled
+       * by the request that ran it, and release it on any path that never reaches upstream.
+       */
+      transientProbe?: TransientProbeGrant;
     }
   | {
       // Main Codex account participating in rotation: token injected from ~/.codex/auth.json
@@ -222,6 +234,8 @@ export type CodexAuthContext =
       probeLeaseId?: string;
       quotaScope?: CodexQuotaScope;
       probeQuotaScope?: CodexQuotaScope;
+      /** See `pool.transientProbe`. */
+      transientProbe?: TransientProbeGrant;
     };
 
 /** Probe lease carried by this context, when it holds one. */
@@ -234,11 +248,24 @@ export function codexProbeQuotaScope(ctx: CodexAuthContext | undefined): CodexQu
   return ctx?.kind === "pool" || ctx?.kind === "main-pool" ? ctx.probeQuotaScope : undefined;
 }
 
+/** The transient-hold recovery probe carried by this context, when it holds one (#4701). */
+export function codexTransientProbeGrant(ctx: CodexAuthContext | undefined): TransientProbeGrant | undefined {
+  return ctx?.kind === "pool" || ctx?.kind === "main-pool" ? ctx.transientProbe : undefined;
+}
+
 /**
  * Hand back a probe lease for a request that will not reach upstream. Safe to
  * call with a context that holds no lease.
+ *
+ * BOTH leases, deliberately. A context can carry the quota-cooldown probe or the transient-hold
+ * probe, and every one of the ~30 call sites that already hands back the first is a path where
+ * the second would leak too. Releasing them together is what makes those sites correct for the
+ * new lease without re-deriving the discard set by hand -- the failure mode being avoided is a
+ * held account nobody may probe because the request that held the trial went away quietly.
  */
 export function releaseCodexAuthContextProbeLease(ctx: CodexAuthContext | undefined): void {
+  const transientProbe = codexTransientProbeGrant(ctx);
+  if (transientProbe) releaseTransientProbe(transientProbe.lease);
   const leaseId = codexProbeLeaseId(ctx);
   if (!ctx || ctx.kind === "main" || !leaseId) return;
   if (ctx.probeQuotaScope) releaseCodexQuotaScopeProbeLease(ctx.accountId!, ctx.probeQuotaScope, leaseId);
@@ -424,6 +451,44 @@ export class CodexReserveHelperUnsupportedError extends CodexReserveUnavailableE
   }
 }
 
+/**
+ * Every account bound to this conversation is held after upstream failures, the recovery
+ * budget for this window is spent, and there is no detour left -- so this request is refused
+ * BEFORE any upstream I/O (#4701).
+ *
+ * This is not a quota cooldown, and the message below says so. It subclasses
+ * {@link CodexAccountCooldownError} for one reason: the deadline-carrying refusal has exactly
+ * one representation in this codebase, and roughly a dozen transports already map it to a 429
+ * with `Retry-After` and treat it as an expected terminal answer rather than a credential
+ * fault. Introducing a parallel type would mean either re-deriving that handling in every one
+ * of them or silently falling through to a 500 in the ones that were missed.
+ *
+ * What must NOT be inherited is the quota wording -- "cooling down", `ocx account
+ * clear-cooldown` -- because none of it describes a 5xx hold and following it would do
+ * nothing. {@link cooldownErrorMessage} therefore returns this class's own message verbatim,
+ * the same escape hatch {@link CodexMainAccountHardLockError} and
+ * {@link CodexReserveUnavailableError} already use.
+ *
+ * `cooldownUntil` carries the limiter's own change point, which is strictly in the future:
+ * either the moment the held account may next be probed or the moment the recovery window
+ * moves, whichever is later. A refusal that answered `now` would busy-loop the caller into
+ * the same load it just declined.
+ */
+export class CodexRecoveryWithheldError extends CodexAccountCooldownError {
+  /** The sibling still remembered for this thread, when one exists but is itself unusable. */
+  readonly detourAccountId?: string;
+
+  constructor(accountId: string, retryAt: number, detourAccountId?: string) {
+    super(accountId, retryAt);
+    this.name = "CodexRecoveryWithheldError";
+    this.detourAccountId = detourAccountId;
+    this.message = `Codex account (${cooldownAccountLabel(accountId)}) is held after repeated upstream`
+      + ` failures and the pool's recovery budget for this window is spent, so nothing was sent`
+      + ` upstream. Retry after ${new Date(retryAt).toISOString()}.`
+      + " This clears on its own as the account recovers; no cooldown to lift and no account to switch.";
+  }
+}
+
 export type CodexAuthPolicyConfig = Readonly<Pick<OcxConfig,
   "codexMainAccountHardLock" | "codexDesktopAuthless" | "runtimeRole" | "pausedCodexAccountIds"
 >>;
@@ -634,7 +699,12 @@ export function cooldownAccountLabel(accountId: string): string {
  * injected `openai_base_url` in config.toml.
  */
 export function cooldownErrorMessage(err: CodexAccountCooldownError, accountSelector?: string): string {
-  if (err instanceof CodexMainAccountHardLockError || err instanceof CodexReserveUnavailableError) return err.message;
+  if (err instanceof CodexMainAccountHardLockError
+    || err instanceof CodexReserveUnavailableError
+    // A transient-hold refusal is not a quota cooldown. Its own wording is the only accurate
+    // one, and the quota recovery advice below would send the operator after a cooldown that
+    // does not exist (#4701).
+    || err instanceof CodexRecoveryWithheldError) return err.message;
   const until = new Date(err.cooldownUntil).toISOString();
   const scopeLabels: Record<CodexQuotaScope, string> = {
     shared: "shared native quota", reserve: "Reserve quota",
@@ -717,6 +787,11 @@ export interface ResolveCodexAuthContextOptions {
   requestScopedMainCredential?: boolean;
   /** Test seam for a Direct request's own forwarded ChatGPT credential. */
   isDirectCallerEntitledToCodexModel?: (headers: Headers, modelId: string) => Promise<boolean>;
+  /**
+   * This request's conversation carries live uploaded-file references (#4778). Retains the bound
+   * account across a VOLUNTARY quota move; involuntary release is untouched.
+   */
+  retainAccountForUploadedFiles?: boolean;
 }
 
 export interface CodexAccountSelectionAdmission {
@@ -870,6 +945,15 @@ export async function resolveCodexAuthContext(
   // Why this request is on this account, carried to the request log so a move reads as an event
   // instead of something inferred from account labels across lines (#4546).
   let affinityDecision: CodexAffinityDecision | undefined;
+  // The half-open trial this request was granted, if it is the one allowed to test a held
+  // account. Declared out here because the release paths below and the returned context are on
+  // opposite sides of several throws (#4701).
+  let transientProbe: TransientProbeGrant | undefined;
+  const releaseTransientProbeGrant = (): void => {
+    if (!transientProbe) return;
+    releaseTransientProbe(transientProbe.lease);
+    transientProbe = undefined;
+  };
   // Retained startup recovery makes the physical main identity ineligible. Routing
   // can still preserve service by selecting a healthy configured pool account. A
   // request-owned bearer likewise cannot inspect or reconcile file-main state.
@@ -900,6 +984,23 @@ export async function resolveCodexAuthContext(
     const modelEligibleAccountIds = entitledAccountIds
       ? new Set([...entitledAccountIds].filter(candidate => !excludeAccountIds?.has(candidate)))
       : undefined;
+    // #4768: the flagships stay visible and never fail closed, so this is evidence routing may
+    // ORDER by, not evidence it may refuse on. Read synchronously from rosters discovery has
+    // already gathered -- no upstream fetch joins the request path for the most commonly
+    // requested models in the product -- and passed to selection as a preference that is dropped
+    // whenever honouring it would leave no candidate.
+    //
+    // Under the SAME exclusion the entitlement snapshot above uses. The reader validates each
+    // cached roster against the account's current credential, and for native main that is a
+    // synchronous read of the physical stored token -- exactly what this request is forbidden to
+    // touch while a profile switch drains it or while it is served by a request-owned credential.
+    // Excluding main here costs nothing: the preference is an ordering hint, so main becomes
+    // unknown rather than denied, and unknown leaves selection exactly as it was.
+    const deniedModelAccountIds = cachedDeniedCodexAccountIdsForModel(
+      options.modelId,
+      undefined,
+      { excludeAccountIds },
+    );
     const selectionOptions = {
       // Temporary switch drain keeps the candidate until the atomic claim rejects
       // it. Retained recovery makes main wholly ineligible so pool routing continues.
@@ -911,13 +1012,21 @@ export async function resolveCodexAuthContext(
         ? () => preserveRequestOwnedMainPin
         : options.isMainAccountTokenLive,
       modelEligibleAccountIds,
+      deniedModelAccountIds,
+      // Request-scoped and deliberately absent from `sharedStateSelectionOptions`: one
+      // conversation's attachments say nothing about where unrelated threads should be served.
+      retainAccountForUploadedFiles: options.retainAccountForUploadedFiles === true,
     };
     // A pre-drain selector reserves the native identity while reconciliation and
     // routing inspect it. Selectors arriving after the fence skip reconciliation
     // and may still route to non-main pool accounts without touching switch state.
     if (reserve && !nativeMainReadsForbidden && !selectionAdmission) throw new CodexMainProfileDrainingError();
     if (!nativeMainReadsForbidden) reconcileMainCodexAccountRuntimeState();
-    const resolution = fixedAccountId !== undefined
+    // Annotated, not inferred. The two literals below carry neither `affinity` nor
+    // `transientProbe`, so an inferred union makes `"k" in resolution` widen those reads to
+    // `unknown` and a discriminant narrowing fail outright. Contextually typing every branch to
+    // the resolver's own union is what lets the reads below stay total.
+    const resolution: CodexThreadResolution = fixedAccountId !== undefined
       ? { status: "selected" as const, accountId: fixedAccountId }
       : options.excludeAccountId
       ? (() => {
@@ -942,8 +1051,17 @@ export async function resolveCodexAuthContext(
           lineage,
         );
     if (resolution.status === "expired") throw new CodexThreadAffinityExpiredError(resolution.accountId);
+    // THE REFUSAL. Every candidate is held, the recovery budget is spent, and no detour is
+    // left -- so this request must not reach upstream at all. Returning the held account here
+    // is what #4701 is about: under a provider-wide 503 that is every bound request piling
+    // onto an account already known to be failing. Thrown before any credential is read, so
+    // nothing is sent and nothing is spent.
+    if (resolution.status === "withheld") {
+      throw new CodexRecoveryWithheldError(resolution.accountId, resolution.retryAt, resolution.detourAccountId);
+    }
     const selected = resolution.status === "selected" ? resolution.accountId : null;
-    affinityDecision = "affinity" in resolution ? resolution.affinity : undefined;
+    affinityDecision = resolution.affinity;
+    transientProbe = resolution.status === "selected" ? resolution.transientProbe : undefined;
     if (!selected) {
       // A retry that excluded a failed Pool account may still use the validated caller-owned
       // main credential. Treating every exclusion as if main itself had failed strands a healthy
@@ -1025,12 +1143,25 @@ export async function resolveCodexAuthContext(
         throw new CodexPoolAuthenticationError("Selected Codex account is unavailable");
       }
     }
+  } catch (cause) {
+    // Selection granted a trial and then a later policy check refused the account. The trial
+    // never runs, so hand it back instead of leaving the held account unprobeable until its
+    // deadline lapses (#4701).
+    releaseTransientProbeGrant();
+    throw cause;
   } finally {
     selectionAdmission?.release();
   }
   // Legacy selectors may retain an unusable account for actionable errors. A
   // deferred credential must never become request auth through that fallback.
-  assertCodexAccountValidationReady(accountId);
+  try {
+    assertCodexAccountValidationReady(accountId);
+  } catch (cause) {
+    // Nothing will reach upstream, so give the trial back instead of leaving the held account
+    // unprobeable until the lease deadline lapses (#4701).
+    releaseTransientProbeGrant();
+    throw cause;
+  }
   // Lazy prime: if the selected account has no quota yet, the pool is likely
   // unprimed (dashboard never opened, or startup prime was blocked). Kick a
   // best-effort prime so the NEXT routing decision has real scores. This never
@@ -1049,6 +1180,13 @@ export async function resolveCodexAuthContext(
   // a literal Retry-After reads very differently to a user than a reset-derived guess.
   const cooldown = getCodexQuotaHealthSnapshot(accountId, quotaScope);
   const cooldownUntil = cooldown?.cooldownUntil;
+  // A transient-hold trial and a quota cooldown cannot both describe this account:
+  // `isTransientOnlyAffinityBlock` refuses to recognise a transient hold on an account carrying
+  // quota health, so the cooldown branch below is unreachable while a trial is held. That is
+  // also why no request pays two recovery permits for one send. The release is defensive --
+  // should that invariant ever move, the trial is handed back rather than stranded behind a
+  // refusal that belongs to the other domain.
+  if (cooldownUntil && transientProbe) releaseTransientProbeGrant();
   // A cooled-down account never sends traffic, so upstream recovery can never be
   // observed and the cooldown outlives the real limit. Admit one probe per
   // interval; its outcome decides whether the cooldown ends (#433).
@@ -1089,6 +1227,7 @@ export async function resolveCodexAuthContext(
       if (token) mainQuotaWriter = observeSelectedMainCredential(token, mainQuotaWriter);
       assertMainAccountPolicy(policy);
     } catch (cause) {
+      releaseTransientProbeGrant();
       if (probeLeaseId && probeQuotaScope) releaseCodexQuotaScopeProbeLease(accountId, probeQuotaScope, probeLeaseId);
       else if (probeLeaseId) releaseCodexQuotaProbeLease(accountId, probeLeaseId);
       if (cause instanceof CodexMainAccountHardLockError) throw cause;
@@ -1099,15 +1238,23 @@ export async function resolveCodexAuthContext(
     }
     if (!token) {
       // Nothing will reach upstream, so give the probe back instead of burning it.
+      releaseTransientProbeGrant();
       if (probeLeaseId && probeQuotaScope) releaseCodexQuotaScopeProbeLease(accountId, probeQuotaScope, probeLeaseId);
       else if (probeLeaseId) releaseCodexQuotaProbeLease(accountId, probeLeaseId);
       throw new CodexPoolAuthenticationError(
         fixedAccountId !== undefined ? "Selected Codex account is unavailable" : undefined,
       );
     }
-    const reserveAuthorization = reserve
-      ? await authorizeReserveCredential(token, mainQuotaWriter, policy, options.signal, undefined, writerGeneration)
-      : undefined;
+    let reserveAuthorization: MainReserveAuthorization | undefined;
+    try {
+      reserveAuthorization = reserve
+        ? await authorizeReserveCredential(token, mainQuotaWriter, policy, options.signal, undefined, writerGeneration)
+        : undefined;
+    } catch (cause) {
+      // A Reserve refusal ends the request here, so the trial it was holding never runs.
+      releaseTransientProbeGrant();
+      throw cause;
+    }
     return {
       kind: "main-pool",
       accountId,
@@ -1121,6 +1268,7 @@ export async function resolveCodexAuthContext(
       ...(quotaScope ? { quotaScope } : {}),
       ...(probeLeaseId ? { probeLeaseId } : {}),
       ...(probeQuotaScope ? { probeQuotaScope } : {}),
+      ...(transientProbe ? { transientProbe } : {}),
     };
   }
 
@@ -1141,8 +1289,10 @@ export async function resolveCodexAuthContext(
       ...(probeLeaseId ? { probeLeaseId } : {}),
       ...(probeQuotaScope ? { probeQuotaScope } : {}),
       ...(affinityDecision ? { affinityDecision } : {}),
+      ...(transientProbe ? { transientProbe } : {}),
     };
   } catch (cause) {
+    releaseTransientProbeGrant();
     if (probeLeaseId && probeQuotaScope) releaseCodexQuotaScopeProbeLease(accountId, probeQuotaScope, probeLeaseId);
     else if (probeLeaseId) releaseCodexQuotaProbeLease(accountId, probeLeaseId);
     if (!options.signal?.aborted && shouldMarkAccountNeedsReauthForCodexAuthFailure(cause)) {

package/src/codex/catalog/aggregation.ts

@@ -34,7 +34,7 @@ import upstreamModelsSnapshot from "../data/upstream-models.json";
 
 
 import { catalogModelSlug } from "./parsing";
-import type { CatalogModel } from "./parsing";
+import type { CatalogModel, RawEntry } from "./parsing";
 
 export const openAiApiCollisionWarnings = new Set<string>();
 
@@ -222,6 +222,85 @@ export function safeCatalogWarningLabel(value: string): string {
     .slice(0, 200);
 }
 
+/**
+ * Keep the first row of each slug and drop the rest (#4730).
+ *
+ * First-win is the only answer that agrees with the ordering already decided upstream: the merge
+ * ranks rows, so its first occurrence is the row it chose. Distinct slugs are never touched — an
+ * alias row and the canonical routed row of the same provider model are two different public names
+ * and both survive — and a row without a string slug passes through untouched.
+ */
+export function dedupeCatalogEntriesBySlug(models: RawEntry[]): RawEntry[] {
+  const seen = new Set<string>();
+  const out: RawEntry[] = [];
+  for (const entry of models) {
+    if (typeof entry.slug !== "string") {
+      out.push(entry);
+      continue;
+    }
+    if (seen.has(entry.slug)) continue;
+    seen.add(entry.slug);
+    out.push(entry);
+  }
+  return out;
+}
+
+/**
+ * Every slug this proxy writes into the Codex catalog must appear exactly once (#4730).
+ *
+ * The cost of breaking it is the whole file: a slug-unique validating consumer refuses the catalog
+ * outright, so one duplicated row takes every model with it. A 2.56.0 report carried 507 rows for
+ * 72 unique slugs, every duplicate byte-identical, and Codex rejected the file as `source-invalid`.
+ *
+ * This is a write-boundary invariant rather than a repair of one producer, and that distinction is
+ * deliberate: the reported catalog is evidence that some emit path can double a row, but nothing in
+ * this tree has been shown to be that path, and a guard that only covered the producer someone
+ * guessed at would leave the file corruptible by the next one. Both writers that serialize a merged
+ * catalog call this as their LAST mutation — `writeRetainedCatalogSync` and the management
+ * convergence commit — so uniqueness holds for the exact bytes that land on disk.
+ *
+ * Ordering is load-bearing. Running the guard before the effort clamp would be unsound:
+ * `clampCatalogModelsToObservedCodexSupport` splices whole rows out when an exact-reserve ladder
+ * clamps empty, so dropping a later same-slug row first can leave the slug with no row at all once
+ * the surviving one is spliced.
+ *
+ * @param models - The finished row list, already clamped and finalized.
+ * @param warn - Whether to report on `console.warn`. The convergence path merges under
+ *   `warningPolicy: "suppress"` and stays silent for the same reason.
+ * @returns The original array when it was already unique, so an unchanged catalog stays a no-op
+ *   write; otherwise a first-win copy.
+ */
+export function enforceCatalogSlugUniqueness(models: RawEntry[], warn: boolean): RawEntry[] {
+  const deduped = dedupeCatalogEntriesBySlug(models);
+  if (deduped.length === models.length) return models;
+  if (warn) {
+    // A dropped row that differs from the kept one means two emit paths disagree about the same
+    // slug's content. First-win still stands, but the operator needs to see WHICH slugs diverged
+    // instead of silently losing data. The baseline is the row the dedupe actually keeps — the
+    // FIRST occurrence — so the reported divergence is measured against what lands on disk.
+    const keptBySlug = new Map<string, RawEntry>();
+    for (const entry of models) {
+      if (typeof entry.slug !== "string" || keptBySlug.has(entry.slug)) continue;
+      keptBySlug.set(entry.slug, entry);
+    }
+    const divergentSlugs = new Set<string>();
+    for (const entry of models) {
+      if (typeof entry.slug !== "string") continue;
+      const kept = keptBySlug.get(entry.slug);
+      if (kept && kept !== entry && JSON.stringify(kept) !== JSON.stringify(entry)) {
+        divergentSlugs.add(entry.slug);
+      }
+    }
+    const divergentNote = divergentSlugs.size > 0
+      ? `; divergent content on: ${[...divergentSlugs].slice(0, 5).map(safeCatalogWarningLabel).join(", ")}${divergentSlugs.size > 5 ? ", …" : ""}`
+      : "";
+    console.warn(
+      `[opencodex] catalog sync dropped ${models.length - deduped.length} duplicate slug row(s), keeping the first occurrence of each slug (#4730)${divergentNote}.`,
+    );
+  }
+  return deduped;
+}
+
 export function comboCatalogWarningSignature(
   combo: NormalizedComboConfig,
   members: readonly CatalogModel[],

package/src/codex/catalog/model-visibility.ts

@@ -290,6 +290,7 @@ export function filterCatalogVisibleModels(
   }
   return models.filter(m => {
     if (initialModelSelectionPending(config.providers[m.provider])) return false;
+    if (config.providers[m.provider]?.disabled === true) return false;
     const nativeAlias = m.provider === COMBO_NAMESPACE && m.nativeAlias === true;
     // disabledModels may be stored raw (canonical) or encoded (legacy UI writes).
     for (const stored of disabled) {

package/src/codex/catalog/remote.ts

@@ -113,12 +113,42 @@ function safeTimeout(value: number | undefined): number {
     ? Math.min(Math.floor(value), 120_000) : DEFAULT_TIMEOUT_MS;
 }
 
+/** Match Bun fetch's environment routing, not the broader WebSocket NO_PROXY grammar. */
+function catalogRequestUsesBunHttpProxy(url: URL): boolean {
+  if (url.protocol !== "http:") return false;
+  const proxy = process.env.http_proxy || process.env.HTTP_PROXY;
+  if (!proxy || proxy === '""' || proxy === "''") return false;
+  const hostname = url.hostname.toLowerCase();
+  const host = url.host.toLowerCase();
+  // Bun env_loader::is_no_proxy (1.4.2): lowercase wins unless empty, ASCII
+  // whitespace only, no scheme/path/wildcard/bracket/trailing-dot normalization.
+  const bypasses = process.env.no_proxy || process.env.NO_PROXY || "";
+  for (let entry of bypasses.split(",")) {
+    entry = entry.replace(/^[ \t\n\r\v\f]+|[ \t\n\r\v\f]+$/g, "")
+      .replace(/[A-Z]/g, letter => letter.toLowerCase());
+    if (entry === "*") return false;
+    if (entry.startsWith(".")) entry = entry.slice(1);
+    if (!entry) continue;
+    const hasPort = entry.startsWith("[")
+      ? entry.includes("]:")
+      : (entry.match(/:/g)?.length ?? 0) === 1;
+    if (hasPort ? host === entry : hostname === entry || hostname.endsWith(`.${entry}`)) return false;
+  }
+  return true;
+}
+
 export async function fetchRemoteCatalog(
   input: string,
   options: Pick<PullRemoteCatalogOptions, "token" | "timeoutMs" | "maxBytes" | "fetchImpl"> = {},
 ): Promise<{ document: RemoteCatalogDocument; content: string }> {
   const url = validateRemoteCatalogUrl(input);
   const token = validateToken(options.token);
+  if (catalogRequestUsesBunHttpProxy(url)) {
+    throw new RemoteCatalogError(
+      "insecure_http_refused",
+      "Loopback HTTP catalog requests must bypass outbound HTTP proxy routing",
+    );
+  }
   const headers = new Headers({ Accept: "application/json" });
   if (token !== undefined) headers.set("Authorization", `Bearer ${token}`);
   let response: Response;

package/src/codex/catalog/retained-sync.ts

@@ -51,7 +51,7 @@ import { bundledCatalogCacheState, loadBundledCodexCatalog } from "./bundled";
 import { isMultiAgentV2Enabled } from "../features";
 import { clampCatalogModelsToCodexSupport } from "./effort";
 import { filterCatalogVisibleModels, gatherRoutedModels, type CatalogGatherProviderModelOutcome } from "./provider-fetch";
-import { exactComboCatalogSlugs, type ComboCatalogOmission } from "./aggregation";
+import { dedupeCatalogEntriesBySlug, enforceCatalogSlugUniqueness, exactComboCatalogSlugs, type ComboCatalogOmission } from "./aggregation";
 import {
   withCatalogWriteSerialization,
   type CatalogWritePermit,
@@ -522,6 +522,9 @@ function writeRetainedCatalogSync({
   });
   clampCatalogModelsToCodexSupport(catalog.models);
   finalizeAutoReviewModelOverride(catalog.models, catalogModelsForMerge, config);
+  // Last mutation before serialization; see `enforceCatalogSlugUniqueness` for why the ordering
+  // against the effort clamp is load-bearing rather than cosmetic.
+  catalog.models = enforceCatalogSlugUniqueness(catalog.models, true);
 
   const added = goEntries.length + accountBoundEntries.length;
   const content = `${JSON.stringify(catalog, null, 2)}\n`;
@@ -553,6 +556,11 @@ function writeRetainedCatalogSync({
   };
 }
 
+// Re-exported so the #4730 unit regression keeps importing the guard from the sync module it
+// guards; the implementation lives in ./aggregation because the management convergence commit
+// is the second writer that has to apply the identical rule.
+export { dedupeCatalogEntriesBySlug };
+
 export async function syncCatalogModels(
   config: OcxConfig,
   options?: CodexCatalogSyncOptions,

package/src/codex/catalog/routed-gather.ts

@@ -420,6 +420,42 @@ async function gatherRoutedModelsUncached(
       if (!memberByKey.has(key)) memberByKey.set(key, synthetic);
     }
   }
+  // [Decision Log]
+  // - 목적과 의도: combo derivation must see the same explicit custom-model capabilities that the
+  //   final Models inventory publishes. Previously customModels were materialized only after this
+  //   map had already derived every combo, so one row could say image while its combo said text.
+  // - 기존 구현 및 제약 조건: provider/discovery rows remain the inheritance source, and native
+  //   OpenAI synthesis must run first so a sparse custom row cannot hide native hard limits.
+  // - 검토한 주요 대안: move the full custom-row materializer ahead of combos, or overlay only the
+  //   explicit custom fields onto this private derivation map after provider/native inheritance.
+  // - 선택한 방식: use the scoped post-inheritance overlay; the existing final materializer stays
+  //   the single owner of public custom-row construction and deduplication.
+  // - 다른 대안 대신 이 방식을 선택한 이유: moving the large materializer would reorder public
+  //   catalog production and warning behavior, while this map is already private to combo input.
+  // - 장점, 단점 및 영향: custom context/modality/reasoning/tool-mode declarations now constrain
+  //   their combos without widening unrelated rows; omitted fields retain provider/native limits.
+  for (const custom of config.customModels ?? []) {
+    const key = `${custom.provider}/${custom.modelId}`;
+    const inherited = memberByKey.get(key) ?? {
+      provider: custom.provider,
+      id: custom.modelId,
+      owned_by: custom.provider,
+    };
+    memberByKey.set(key, {
+      ...inherited,
+      catalogKind: CODEX_CUSTOM_MODEL_CATALOG_KIND,
+      ...(typeof custom.contextWindow === "number" && custom.contextWindow > 0
+        ? { contextWindow: custom.contextWindow }
+        : {}),
+      ...(Array.isArray(custom.inputModalities)
+        ? { inputModalities: [...custom.inputModalities] }
+        : {}),
+      ...(Array.isArray(custom.reasoningEfforts)
+        ? { reasoningEfforts: [...custom.reasoningEfforts] }
+        : {}),
+      ...(custom.codexToolMode !== undefined ? { codexToolMode: custom.codexToolMode } : {}),
+    });
+  }
   // Enriched (registry-hydrated) provider clones — shared by combo member synthesis and
   // custom-model vision-sidecar inheritance so both see the same merged registry view.
   const enrichedByName = new Map(activeProviders.map(provider => [provider.name, provider.provider]));
@@ -480,7 +516,8 @@ async function gatherRoutedModelsUncached(
   // with the same slug below, so that row's provider capability metadata is the inheritance source.
   const replacedByRoutedSlug = new Map(all.map(model => [routedSlug(model.provider, model.id), model]));
   const customModels = (config.customModels ?? []).map(cm => {
-    const rawProvider = config.providers[cm.provider];
+    const rawProvider = config.providers[cm.provider]?.disabled !== true
+      ? config.providers[cm.provider] : undefined;
     const effectiveProvider = enrichedByName.get(cm.provider) ?? rawProvider;
     // Registry routing backfills an omitted authMode on the built-in OpenAI provider to
     // forward. Keep the catalog projection on the same contract while still failing closed

package/src/codex/cli-install-provenance.ts

@@ -587,8 +587,14 @@ export async function inspectCodexCliInstall(
   const platform = deps.platform ?? process.platform;
   const candidate = observeCodexRuntimeCandidateReadOnly(deps);
   if (!candidate) {
+    // This slice reads no candidate or configuration file on Windows, so an
+    // absent proof-captured environment candidate does not establish that no
+    // Codex CLI exists: a persisted selection is simply never consulted there.
+    // Report the deferral that actually happened instead of the stronger claim
+    // that the candidate is unavailable. POSIX retains its existing result
+    // when no candidate is observed.
     return isWindowsPlatform(platform)
-      ? unknownWindowsReport("candidate_unavailable")
+      ? unknownWindowsReport("windows_inspection_deferred")
       : unknownReport("candidate_unavailable");
   }
 

package/src/codex/convergence.ts

@@ -49,7 +49,7 @@ import {
   orderForSubagents,
   } from "./catalog/sync";
   import { multiAgentV2EnabledFromConfigText } from "./features";
-  import { exactComboCatalogSlugs } from "./catalog/aggregation";
+  import { enforceCatalogSlugUniqueness, exactComboCatalogSlugs } from "./catalog/aggregation";
   import {
   isNativeAliasCatalogEntry,
   accountBoundNativeOpenAiSlugs,
@@ -386,7 +386,12 @@ function prepareCatalog(
       : null,
   );
   finalizeAutoReviewModelOverride(mergedModels, catalogModels, config);
-  catalog.models = mergedModels;
+  // The second writer of this file. A dashboard model toggle, a combo edit, or a Codex account
+  // login reaches `convergeCodexCatalog` and commits through `fixedCommit`, never through
+  // `writeRetainedCatalogSync`, so the #4730 uniqueness guard has to stand here too or the same
+  // `source-invalid` rejection returns by a different route. Silent because this merge runs under
+  // `warningPolicy: "suppress"`.
+  catalog.models = enforceCatalogSlugUniqueness(mergedModels, false);
   return catalog;
 }
 

package/src/codex/desktop-app/types.ts

@@ -116,11 +116,20 @@ export interface DesktopAppAdapter {
  *
  * `root` is expected to be `realpath`-resolved by discovery already.
  */
+function isMembershipSeparator(character: string): boolean {
+  // `/` separates on every platform this runs on, and Windows accepts it wherever it
+  // accepts `\`. `\` is only a separator where the host says so: it is a legal
+  // FILENAME character on POSIX, so admitting it there would reopen the sibling hole
+  // this function exists to close.
+  return character === "/" || (sep === "\\" && character === "\\");
+}
+
 export function isUnderRoot(executable: string, root: string): boolean {
   if (!executable || !root) return false;
   if (executable === root) return true;
-  const prefix = root.endsWith(sep) ? root : root + sep;
-  return executable.startsWith(prefix);
+  if (!executable.startsWith(root)) return false;
+  if (isMembershipSeparator(root[root.length - 1]!)) return true;
+  return isMembershipSeparator(executable[root.length] ?? "");
 }
 
 /**

package/src/codex/desktop-app/windows.ts

@@ -29,16 +29,16 @@ const SHELL_BASENAME = "chatgpt.exe";
 const POWERSHELL_PROBE_OPTIONS = { timeout: PROBE_TIMEOUT_MS, windowsHide: true } as const;
 
 /**
- * isUnderRoot prefixes with the host path.sep and is case-sensitive. Windows
+ * isUnderRoot checks a lexical path boundary and is case-sensitive. Windows
  * membership is case-insensitive, and this file is executed by Unix CI against
- * backslash paths, so both sides are folded onto the host separator first.
+ * mixed slash paths, so both slash forms are folded onto the host separator first.
  * The boundary itself — sibling `OpenAI.Codex-evil` must not match root
  * `OpenAI.Codex` — is still isUnderRoot's, which is why the PowerShell
  * StartsWith is only a cheap pre-filter.
  */
 function toHostMembershipPath(windowsPath: string): string {
   const lowered = windowsPath.toLowerCase();
-  return sep === "\\" ? lowered : lowered.replaceAll("\\", "/");
+  return lowered.replace(/[\\/]/g, sep);
 }
 
 function isMemberExecutable(executable: string, root: string): boolean {
@@ -91,10 +91,10 @@ function listPackageProcesses(exec: DesktopExec, install: DesktopAppInstall): De
   const literal = install.root.replace(/'/g, "''");
   const script = [
     "$ErrorActionPreference='SilentlyContinue'",
-    `$root = '${literal}'`,
+    `$root = '${literal}'.Replace('/', '\\')`,
     "$me = ([Security.Principal.WindowsIdentity]::GetCurrent()).Name",
     "Get-CimInstance Win32_Process -Filter \"Name='ChatGPT.exe'\" |",
-    "  Where-Object { $_.ExecutablePath -and $_.ExecutablePath.StartsWith($root, 'OrdinalIgnoreCase') } |",
+    "  Where-Object { $_.ExecutablePath -and $_.ExecutablePath.Replace('/', '\\').StartsWith($root, 'OrdinalIgnoreCase') } |",
     "  ForEach-Object {",
     "    $o = Invoke-CimMethod -InputObject $_ -MethodName GetOwner",
     "    if ($o -and $o.ReturnValue -eq 0 -and $o.User) {",