@bitkyc08/opencodex 2.59.0 → 2.60.0

package/src/cli/provider.ts

@@ -139,7 +139,7 @@ function handleList(args: string[]): void {
 // provider add
 // ---------------------------------------------------------------------------
 
-const ADD_USAGE = "Usage: ocx provider add <name> [--adapter <adapter>] [--base-url <url>] [--api-key <key>] [--api-key-transport <x-api-key|bearer>] [--default-model <model>] [--model <id> --text-only] [--allow-private-network] [--set-default] [--force] [--json] [--sync]";
+const ADD_USAGE = "Usage: ocx provider add <name> [--adapter <adapter>] [--base-url <url>] [--api-key <key>] [--api-key-transport <x-api-key|bearer>] [--default-model <model>] [--model <id> --text-only] [--google-tool-schema-policy <compatible|reject-lossy>] [--allow-private-network] [--set-default] [--force] [--json] [--sync]";
 
 async function handleAdd(args: string[]): Promise<void> {
   const name = args[0];
@@ -164,6 +164,7 @@ async function handleAdd(args: string[]): Promise<void> {
   const adapter = consumeFlagValue(restArgs, "--adapter");
   const baseUrl = consumeFlagValue(restArgs, "--base-url");
   const defaultModel = consumeFlagValue(restArgs, "--default-model");
+  const googleToolSchemaPolicy = consumeFlagValue(restArgs, "--google-tool-schema-policy");
   const textOnly = consumeFlag(restArgs, "--text-only");
   const capabilityModel = consumeFlagValue(restArgs, "--model");
   rejectUnknownArgs(restArgs, ADD_USAGE);
@@ -228,6 +229,17 @@ async function handleAdd(args: string[]): Promise<void> {
     }
     provConfig.apiKeyTransport = apiKeyTransport;
   }
+  if (googleToolSchemaPolicy !== undefined) {
+    if (googleToolSchemaPolicy !== "compatible" && googleToolSchemaPolicy !== "reject-lossy") {
+      console.error('Error: --google-tool-schema-policy must be "compatible" or "reject-lossy".');
+      process.exit(1);
+    }
+    if (provConfig.adapter !== "google") {
+      console.error("Error: --google-tool-schema-policy requires the google adapter.");
+      process.exit(1);
+    }
+    provConfig.googleToolSchemaPolicy = googleToolSchemaPolicy;
+  }
 
   const existingProvider = config.providers[name];
   if (existingProvider?.modelCapabilities !== undefined && provConfig.modelCapabilities === undefined) {

package/src/client/machine-api.ts

@@ -23,7 +23,7 @@ export interface MachineStatusV1 {
 export interface MachineApiDeps {
   sync: typeof syncConnectedClient;
   disconnect: typeof disconnectClient;
-  scheduleStandaloneRecycle: () => void;
+  scheduleStandaloneRecycle: (disconnectedTokenFingerprint: string) => void;
   hubReachability?: () => HubReachability;
   setHubReachability?: (value: HubReachability) => void;
 }
@@ -130,7 +130,7 @@ export async function handleMachineApi(
     }
     try {
       const result = await deps.disconnect(input.keepCatalog === undefined ? {} : { keepCatalog: input.keepCatalog });
-      deps.scheduleStandaloneRecycle();
+      deps.scheduleStandaloneRecycle(state.tokenFingerprint);
       return Response.json({ success: true, ...result }, { status: 202 });
     } catch (error) {
       return Response.json({ success: false, error: error instanceof Error ? error.message : "disconnect failed" }, { status: 409 });

package/src/client/machine-listener.ts

@@ -75,8 +75,8 @@ export function startMachineListener(
   const machineApiDeps: MachineApiDeps = {
     sync: deps.machineApi?.sync ?? syncConnectedClient,
     disconnect: deps.machineApi?.disconnect ?? disconnectClient,
-    scheduleStandaloneRecycle: deps.machineApi?.scheduleStandaloneRecycle ?? (() => {
-      void import("./runtime").then(module => module.scheduleStandaloneRecycle());
+    scheduleStandaloneRecycle: deps.machineApi?.scheduleStandaloneRecycle ?? (tokenFingerprint => {
+      void import("./runtime").then(module => module.scheduleStandaloneRecycle(tokenFingerprint));
     }),
     hubReachability: deps.machineApi?.hubReachability ?? (() => hubReachability),
     setHubReachability: deps.machineApi?.setHubReachability ?? (value => { hubReachability = value; }),

package/src/client/runtime.ts

@@ -4,6 +4,7 @@ import { loadConfig } from "../config";
 import { removePid, removeRuntimePort, writePid, writeRuntimePort } from "../config/process-state";
 import { installCrashGuards } from "../lib/crash-guard";
 import { selfLaunchArgv } from "../lib/self-launch-argv";
+import { loadServiceTokenFromFile, serviceApiTokenFingerprint } from "../lib/service-secrets";
 import { findAvailablePort } from "../server/ports";
 import { startMachineListener } from "./machine-listener";
 import { readClientConnectionState } from "./state";
@@ -17,7 +18,30 @@ function cleanup(): void {
   removeRuntimePort(process.pid);
 }
 
-export function scheduleStandaloneRecycle(): void {
+export function standaloneRecycleEnv(
+  env: NodeJS.ProcessEnv,
+  disconnectedTokenFingerprint: string,
+): NodeJS.ProcessEnv {
+  const childEnv = { ...env };
+  const admissionToken = childEnv.OPENCODEX_API_AUTH_TOKEN?.trim();
+  if (admissionToken && serviceApiTokenFingerprint(admissionToken) !== disconnectedTokenFingerprint) {
+    // A surviving env token shadows OCX_API_TOKEN_FILE entirely, so nothing below can
+    // reintroduce the disconnected token.
+    return childEnv;
+  }
+  if (admissionToken) delete childEnv.OPENCODEX_API_AUTH_TOKEN;
+  // The respawned `ocx start` loads OCX_API_TOKEN_FILE into OPENCODEX_API_AUTH_TOKEN when the
+  // env token is absent, so vet the file by content: drop the pointer when it is unreadable or
+  // holds the disconnected token, keep it when it holds a different operator credential.
+  if (!childEnv.OCX_API_TOKEN_FILE?.trim()) return childEnv;
+  const fileToken = loadServiceTokenFromFile(childEnv);
+  if (fileToken === null || serviceApiTokenFingerprint(fileToken) === disconnectedTokenFingerprint) {
+    delete childEnv.OCX_API_TOKEN_FILE;
+  }
+  return childEnv;
+}
+
+export function scheduleStandaloneRecycle(disconnectedTokenFingerprint: string): void {
   if (recycleScheduled) return;
   recycleScheduled = true;
   const timer = setTimeout(() => {
@@ -46,7 +70,7 @@ export function scheduleStandaloneRecycle(): void {
         detached: true,
         stdio: "ignore",
         windowsHide: true,
-        env: { ...process.env },
+        env: standaloneRecycleEnv(process.env, disconnectedTokenFingerprint),
       });
       child.unref();
     }

package/src/codex/account-store.ts

@@ -370,6 +370,23 @@ export function isCodexAccountGenerationLive(id: string, generation: number): bo
   return !!record?.credential && record.deletedAt == null && record.generation === generation;
 }
 
+/**
+ * The same verdict as {@link isCodexAccountGenerationLive}, over ONE store load.
+ *
+ * `readCodexAccountRecord` is `loadCodexAccountRecordStore()[id]`, so asking it per row
+ * reloads, reparses and renormalizes the whole file per row — the exact shape
+ * {@link loadCodexAccountRecordSnapshot} was added to avoid. The denial reader resolves
+ * several accounts in one synchronous pass on the request path, so it opens one checker and
+ * closes over the snapshot instead.
+ */
+export function beginCodexAccountGenerationLiveCheck(): (id: string, generation: number) => boolean {
+  const snapshot = loadCodexAccountRecordSnapshot();
+  return (id, generation) => {
+    const record = snapshot[id];
+    return !!record?.credential && record.deletedAt == null && record.generation === generation;
+  };
+}
+
 export function saveCodexAccountCredentialIfGeneration(
   id: string,
   generation: number,
@@ -596,6 +613,41 @@ function withCredentialMutationLockSync<T>(fn: () => T): T {
 }
 
 type CodexTokenResult = { accessToken: string; chatgptAccountId: string; generation: number };
+type CodexRefreshGenerationHandoff = (accountId: string, fromGeneration: number, toGeneration: number) => void;
+// var (hoisted, initialized to undefined) rather than const: a registrar reached
+// through an import cycle can register while this module body is still evaluating,
+// and the lazily created Set must be reachable rather than in the temporal dead zone.
+var refreshGenerationHandoffs: Set<CodexRefreshGenerationHandoff> | undefined;
+function refreshHandoffs(): Set<CodexRefreshGenerationHandoff> {
+  return refreshGenerationHandoffs ??= new Set();
+}
+
+/** Register process-local state that must follow a credential refresh generation. */
+export function registerCodexRefreshGenerationHandoff(handoff: CodexRefreshGenerationHandoff): () => void {
+  const set = refreshHandoffs();
+  set.add(handoff);
+  return () => set.delete(handoff);
+}
+
+/**
+ * Invoke every registered handoff for one committed `fromGeneration` to `toGeneration` move.
+ *
+ * Each listener runs independently and a throw is contained: by the time handoffs run the
+ * rotated credential is already persisted, so a failing listener must not reject the shared
+ * refresh promise (surviving waiters would see a refresh failure that never happened), must
+ * not starve the remaining listeners, and must not block plan reconciliation. The warning
+ * carries no account id or token material — the same scrub refresh error messages get.
+ */
+function dispatchRefreshGenerationHandoffs(accountId: string, fromGeneration: number, toGeneration: number): void {
+  for (const handoff of refreshHandoffs()) {
+    try {
+      handoff(accountId, fromGeneration, toGeneration);
+    } catch (error) {
+      console.warn("[codex-auth] a refresh generation handoff listener failed", error);
+    }
+  }
+}
+
 type CodexRefreshResult = CodexTokenResult & {
   credential?: CodexAccountCredentials;
   /**
@@ -1377,6 +1429,19 @@ async function resolveCodexToken(
    * committed result, for every waiter, including none.
    */
   const refreshPromise = fetchPromise.then(async (result): Promise<CodexRefreshResult> => {
+    // Generation-dependent completion belongs to the flight, not to its initiating
+    // request. The owner may stop waiting after a disconnect while this detached work
+    // still commits G+1; advance process-local affinities before any waiter observes
+    // the result (and even when there are no surviving waiters).
+    if (result.selfRefreshed) {
+      dispatchRefreshGenerationHandoffs(id, result.generation - 1, result.generation);
+      // A propagated alias committed at its OWN generation, so its affinities sit at
+      // alias.generation - 1: without this handoff they fail the exact-generation
+      // liveness check on the very next request that reads them.
+      for (const alias of result.propagatedAliases ?? []) {
+        dispatchRefreshGenerationHandoffs(alias.id, alias.generation - 1, alias.generation);
+      }
+    }
     await notePlanFromRefreshedAccessToken(id, result.accessToken, result.generation);
     // One settlement path for the whole flight: the refreshing account, then any dormant alias that
     // adopted the same rotated JWT. An alias holds the identical access token, so a changed

package/src/codex/auth-api/account-list.ts

@@ -82,9 +82,9 @@ export function mainQuotaWithCarriedResetCredits(
 /**
  * Why an account needs the operator. `missing_credential`, `refresh_failed`, and
  * `quota_unauthorized` are the three causes this surface tells apart on its own. `unauthorized`
- * and `forbidden` exist because the shared health projection may return them; today
- * `projectCodexAccountHealth` only ever produces `refresh_failed`, so accepting the full union
- * keeps this field correct if that projection widens rather than silently dropping a reason.
+ * and `forbidden` come from the shared health projection: `projectCodexAccountHealth` maps a
+ * stored verification failure's `http_status:401`/`http_status:403` to them, so the union has
+ * to accept every reason the projection can emit rather than silently dropping one.
  */
 export type CodexAccountReauthReason =
   | "missing_credential"
@@ -105,18 +105,26 @@ export function poolAccountDto(
   const plan = codexPlanValue(account.plan);
   const quota = quotaForPlan(quotaResult.quota, plan);
   const runtimeReauth = isAccountNeedsReauth(account.id);
+  const rawReauthReason: CodexAccountReauthReason | undefined = !hasCredential
+    ? "missing_credential"
+    : quotaResult.reauthReason;
   const needsReauth = !hasCredential || quotaResult.needsReauth || runtimeReauth;
-  const health = projectCodexAccountHealth({ accountId: account.id, needsReauth });
+  // An in-memory reauth mark carries no cause of its own, so it must not name one: passing
+  // a caller reason here would outrank the stored verdict's http_status inside the
+  // projection and hide unauthorized/forbidden until the mark is gone. With no caller
+  // reason the projection falls back to the persisted cause, then to refresh_failed.
+  const healthReason = rawReauthReason === "quota_unauthorized" || rawReauthReason === "missing_credential"
+    ? "unauthorized"
+    : rawReauthReason;
+  const health = projectCodexAccountHealth({
+    accountId: account.id,
+    needsReauth,
+    reauthReason: needsReauth ? healthReason : undefined,
+  });
   // `needsReauth` is an OR of three independent causes plus a persisted verdict resolved inside the
   // health projection. Emitting only the boolean is what left #4212's reporter guessing which
   // account took their model away and why, so name the cause they actually have to act on.
-  const reauthReason: CodexAccountReauthReason | undefined = !hasCredential
-    ? "missing_credential"
-    : runtimeReauth
-      ? "refresh_failed"
-      : quotaResult.needsReauth
-        ? "quota_unauthorized"
-        : health.status === "reauth_required" ? health.reason : undefined;
+  const reauthReason: CodexAccountReauthReason | undefined = rawReauthReason ?? (health.status === "reauth_required" ? health.reason : undefined);
   return {
     id: account.id,
     email: projectEmail(account.email, maskEmails) ?? account.email,

package/src/codex/auth-api/pool-quota-probe.ts

@@ -1,4 +1,4 @@
-import { capturePoolQuotaWriter, getValidCodexToken, isCodexAccountGenerationLive, forceRefreshCodexPoolToken, markCodexAccountValidated, markCodexAccountValidationFailed, readCodexAccountRecord, CodexCredentialGenerationConflictError, CodexCredentialRefreshLockTimeoutError, CodexCredentialRefreshBusyError, CodexCredentialRefreshStaleError, TokenRefreshError } from "../account-store";
+import { capturePoolQuotaWriter, getValidCodexToken, isCodexAccountGenerationLive, forceRefreshCodexPoolToken, markCodexAccountValidated, markCodexAccountValidationFailed, readCodexAccountRecord, isTerminalCodexPoolRefreshFailure, CodexCredentialGenerationConflictError, CodexCredentialRefreshLockTimeoutError, CodexCredentialRefreshBusyError, CodexCredentialRefreshStaleError, TokenRefreshError } from "../account-store";
 import type { PoolQuotaWriter } from "../quota-types";
 import { isValidWhamHistoryObservation, getAccountQuota, isCompleteCodexQuotaRecoverySnapshot, parseUsageQuota, setAccountQuotaFromParsed } from "../quota";
 import type { StoredAccountQuota, WhamUsageResponse } from "../quota";
@@ -46,6 +46,8 @@ export interface PoolQuotaResult {
   resetRefreshLineage?: ManualResetRefreshLineage;
   quota: StoredAccountQuota | null;
   needsReauth: boolean;
+  /** Failure source observed while obtaining the quota, when reauthentication is required. */
+  reauthReason?: "refresh_failed" | "quota_unauthorized";
   /** Credential generation whose cache or network result this DTO state belongs to. */
   credentialGeneration?: number;
   /** Present only when this call freshly parsed a WHAM usage response. */
@@ -178,7 +180,7 @@ export async function recoverPoolQuotaFrom401(ctx: {
     // the credential it condemned, so a late terminal response arriving after the operator
     // re-authenticated would quarantine the replacement.
     markAccountNeedsReauth(accountId, captureConfigGeneration(), rejectedGeneration);
-    return { quota: existing ?? null, needsReauth: true, credentialGeneration: rejectedGeneration };
+    return { quota: existing ?? null, needsReauth: true, reauthReason: "quota_unauthorized", credentialGeneration: rejectedGeneration };
   }
 
   const claim = claimQuotaRecovery(accountId, rejectedGeneration);
@@ -186,7 +188,7 @@ export async function recoverPoolQuotaFrom401(ctx: {
     // A lineage fenced by a TERMINAL refresh failure stays terminal. Without this, the
     // budget being used would make the next bare 401 report a dead credential as healthy.
     if (quotaRecoveryTerminalFor(accountId, rejectedGeneration)) {
-      return { quota: existing ?? null, needsReauth: true, credentialGeneration: rejectedGeneration };
+      return { quota: existing ?? null, needsReauth: true, reauthReason: "refresh_failed", credentialGeneration: rejectedGeneration };
     }
     // Otherwise: this lineage spent its attempt, another caller is mid-refresh, or a
     // transient failure is backing off. Report transient and let the next poll try —
@@ -225,8 +227,15 @@ export async function recoverPoolQuotaFrom401(ctx: {
     // A refresh that failed terminally is the one case where the credential really is gone.
     // Everything else is unknown, and unknown is not proof.
     if (e instanceof TokenRefreshError && isTerminalRefreshError(e)) {
+      // Persist the same verdict the token guardian writes: the in-memory mark dies with
+      // this process, and only the stored terminal failure keeps a cached listing from
+      // calling the dead grant healthy after a restart.
+      markCodexAccountValidationFailed(accountId, `refresh_${e.reason}`, {
+        expectedGeneration: rejectedGeneration,
+        terminal: true,
+      });
       markAccountNeedsReauth(accountId, captureConfigGeneration(), rejectedGeneration);
-      return { quota: existing ?? null, needsReauth: true, credentialGeneration: rejectedGeneration };
+      return { quota: existing ?? null, needsReauth: true, reauthReason: "refresh_failed", credentialGeneration: rejectedGeneration };
     }
     return { quota: existing ?? null, needsReauth: false, credentialGeneration: rejectedGeneration };
   }
@@ -258,7 +267,7 @@ export async function recoverPoolQuotaFrom401(ctx: {
       // let the next poll call a dead credential healthy. The evidence is about the
       // REFRESHED credential, which is what the replay used.
       markAccountNeedsReauth(accountId, writerGeneration, refreshed.generation);
-      return { quota: existing ?? null, needsReauth: true, credentialGeneration: refreshed.generation };
+      return { quota: existing ?? null, needsReauth: true, reauthReason: "quota_unauthorized", credentialGeneration: refreshed.generation };
     }
     return { quota: existing ?? null, needsReauth: false, credentialGeneration: refreshed.generation };
   }
@@ -399,9 +408,23 @@ export async function fetchFreshPoolAccountQuota(
         quotaProbeSkipped: true,
       }, quotaProbeEvidence);
     }
-    if (e instanceof TokenRefreshError) {
+    // Terminal means the grant itself is dead or missing; an `unknown` refresh failure (a
+    // token-endpoint 5xx, a transport blip) may clear, so it reports transient like the
+    // 401-recovery path instead of quarantining a healthy account (#2887). A revoked or
+    // expired grant is also written to the record as a terminal validation failure, the same
+    // verdict the token guardian persists: the in-memory mark dies with this process, and
+    // the stored verdict is what keeps a cached listing from calling the dead grant healthy
+    // after a restart.
+    if (isTerminalCodexPoolRefreshFailure(e)) {
+      if (e instanceof TokenRefreshError && isTerminalRefreshError(e)) {
+        markCodexAccountValidationFailed(accountId, `refresh_${e.reason}`, {
+          expectedGeneration: requestCredentialGeneration,
+          terminal: true,
+        });
+      }
+      markAccountNeedsReauth(accountId, captureConfigGeneration(), requestCredentialGeneration);
       return withQuotaProbeEvidence(
-        { quota: existing ?? null, needsReauth: true, credentialGeneration: requestCredentialGeneration },
+        { quota: existing ?? null, needsReauth: true, reauthReason: "refresh_failed", credentialGeneration: requestCredentialGeneration },
         quotaProbeEvidence,
       );
     }

package/src/codex/catalog/gather-capture.ts

@@ -100,8 +100,9 @@ import type {
   CatalogSourceEvidence,
   CatalogTrustedOpenAiApiPolicySnapshot,
 } from "../convergence-types";
-import { applyRegistryCapabilitySeedFill, modelCapabilities, modelInputModalities } from "./model-hints";
+import { modelCapabilities, modelInputModalities } from "./model-hints";
 import { configuredComboTargetModelsByProvider } from "./combo-member";
+import { resolveModelPolicy } from "../../providers/resolved-model-policy";
 
 /** Concurrent gatherRoutedModels callers with the same catalog identity share one live discovery.
  *  Keyed by gatherFlightKey so a different config cannot join or evict the wrong flight. */
@@ -344,8 +345,26 @@ export function captureProviderGather(
 ): CapturedProviderGather {
   const enriched = detachedClone(withCanonicalOpenAiForwardAuthDefault(name, configured));
   enrichProviderFromRegistry(name, enriched);
-  applyRegistryCapabilitySeedFill(name, enriched);
   const registryTransportMatch = providerMatchesRegistryTransport(name, enriched);
+  const registryEntry = registryTransportMatch ? getProviderRegistryEntry(name) : undefined;
+  const staticProvider = resolveModelPolicy({
+    providerName: name,
+    modelId: enriched.defaultModel ?? "__catalog_capture__",
+    provider: enriched,
+    registryEntry,
+    transportMatchedRegistry: registryTransportMatch,
+    ...(enriched.authMode ? { effectiveAuth: { authMode: enriched.authMode } } : {}),
+  }).provider;
+  for (const key of [
+    "modelContextWindows", "modelInputModalities", "modelMaxInputTokens", "modelMaxOutputTokens",
+    "modelReasoningEfforts", "modelSupportsReasoningSummaries",
+    "modelSupportsVerbosity", "modelSupportsServiceTier",
+  ] as const) {
+    if (staticProvider[key] !== undefined) enriched[key] = detachedClone(staticProvider[key]) as never;
+  }
+  // A present modelDefaultReasoningEfforts object is a whole-map catalog authority, including
+  // explicit {}. enrichProviderFromRegistry already preserves/fills that contract; replacing it
+  // with the resolver's per-key registry fill would turn "no configured default" into a seed default.
   const provider = recursivelyFreeze(enriched);
   const fastPolicyAuthority = captureFastPolicyAuthority(
     name,

package/src/codex/catalog/model-hints.ts

@@ -90,6 +90,7 @@ import type { CatalogModel } from "./parsing";
 import { disabledNativeSlugs, hasComboTargets, hasNativeOpenAiCapabilityMetadata, NATIVE_GPT56_MAX_INPUT_TOKENS, nativeContextLimits, nativeOpenAiCapabilityDisplayName, nativeDefaultReasoningEffort, nativeInputModalities, nativeOpenAiAutoCompactTokenLimit, nativeOpenAiContextWindow, nativeOpenAiMaxInputTokens, nativeOpenAiMaxOutputTokens, nativeOpenAiSlugs, nativeParallelToolCalls, nativeReasoningEfforts } from "./metadata";
 import { deriveComboCatalogModel, normalizedOpenAiApiSignature, openAiApiCollisionWarnings, replaceLastComboCatalogOmissions, warnUncataloguedComboOnce } from "./aggregation";
 import type { ComboCatalogOmission } from "./aggregation";
+import { clampObservedModelLimits, resolveModelPolicy } from "../../providers/resolved-model-policy";
 import type { CatalogGatherProviderAuthEvidence } from "./filesystem-evidence";
 import type {
   CatalogAdmissionSnapshot,
@@ -246,22 +247,6 @@ export function configuredReasoningSummarySupport(prov: OcxProviderConfig | unde
   return modelRecordValue(prov.modelReasoningSummaryDelivery, id) !== undefined ? true : undefined;
 }
 
-function configuredVerbositySupport(name: string, prov: OcxProviderConfig | undefined, id: string): boolean | undefined {
-  const explicit = prov ? modelRecordValue(prov.modelSupportsVerbosity, id) : undefined;
-  if (explicit !== undefined) return explicit;
-  if (!prov) return undefined;
-  void name;
-  // Provider-wide fallback for ids the per-model map does not enumerate — a live-discovered
-  // model would otherwise re-advertise a control the upstream accepts and ignores.
-  //
-  // Read from the PROVIDER CONFIG, never from PROVIDER_REGISTRY. A gather flight captures its
-  // registry authority up front and forbids any later registry read, so consulting the registry
-  // here made a custom-destination flight fall back to "configured" instead of serving its own
-  // discovery result (tests/codex-integration/codex-gather-authority.test.ts). `applyVerbosityDefaults` in
-  // providers/derive.ts materializes the registry default into the config at seed/enrich time.
-  return prov.supportsVerbosity;
-}
-
 export function applyProviderConfigHints(
   name: string,
   prov: OcxProviderConfig,
@@ -270,6 +255,15 @@ export function applyProviderConfigHints(
   metadataModelIdCaseFold?: boolean,
   effectiveAlias?: string | null,
 ): CatalogModel {
+  const staticPolicy = resolveModelPolicy({
+    providerName: name,
+    modelId: model.id,
+    provider: prov,
+    transportMatchedRegistry: false,
+    modelCapabilities: prov.modelCapabilities?.[model.id],
+    ...(prov.authMode ? { effectiveAuth: { authMode: prov.authMode } } : {}),
+    ...(effectiveAlias !== undefined ? { effectiveAlias } : {}),
+  });
   const displayName = configuredModelDisplayName(prov, model.id);
   // The alias decision is resolved once at flight admission (captureProviderGather) and threaded
   // through as `effectiveAlias`. Re-deriving it here would read PROVIDER_REGISTRY after admission,
@@ -279,11 +273,15 @@ export function applyProviderConfigHints(
   const providerAlias = typeof effectiveAlias === "string" || effectiveAlias === null
     ? effectiveAlias
     : model.providerAlias;
-  const configuredCap = configuredContextWindow(prov, model.id);
-  const configuredMaxInput = configuredMaxInputTokens(prov, model.id);
+  const configuredCap = staticPolicy.model.contextWindow ?? configuredContextWindow(prov, model.id);
+  const configuredMaxInput = staticPolicy.model.maxInputTokens;
   const maxOutputTokens = routedMaxOutputTokens(name, prov, model, model.id, metadataModelIdCaseFold);
   const configuredAutoCompact = configuredAutoCompactTokenLimit(prov, model.id);
-  let inputModalities = configuredInputModalities(prov, model.id);
+  // The resolver owns exact capability precedence and legacy exact/colon-family/case-fold fallback.
+  // Removing an exact capability row therefore returns this projection to legacy-map inference.
+  let inputModalities = staticPolicy.model.inputModalities
+    ? [...staticPolicy.model.inputModalities]
+    : undefined;
   // The shared vision-sidecar consumer predicate keeps catalog advertisement and request-time
   // planning aligned. The catalog must still advertise image input — the Codex app
   // gates attachments client-side on input_modalities, and a text-only entry would block images
@@ -297,10 +295,12 @@ export function applyProviderConfigHints(
   }
   const reasoningEfforts = configuredReasoningEfforts(prov, model.id);
   const suppressSyntheticMax = modelRecordValue(prov.modelSuppressSyntheticMax, model.id) === true;
-  const defaultReasoningEffort = modelRecordValue(prov.modelDefaultReasoningEfforts, model.id) ?? model.defaultReasoningEffort;
-  const supportsReasoningSummaries = configuredReasoningSummarySupport(prov, model.id);
-  const supportsVerbosity = configuredVerbositySupport(name, prov, model.id);
+  const defaultReasoningEffort = staticPolicy.model.defaultReasoningEffort ?? model.defaultReasoningEffort;
+  const supportsReasoningSummaries = staticPolicy.model.supportsReasoningSummaries;
+  const supportsVerbosity = staticPolicy.model.supportsVerbosity;
   const fastPolicy = fastPolicyForModel(prov, model.id, name);
+  // Frozen gather providers retain the captured Fast authority. That late/captured eligibility
+  // owns catalog publication, including an explicit provider-level false.
   const supportsServiceTier = serviceTierSupportFromPolicy(fastPolicy);
   const {
     supportsServiceTier: _staleServiceTier,
@@ -313,9 +313,12 @@ export function applyProviderConfigHints(
   const discoveredWindow = typeof model.contextWindow === "number" && model.contextWindow > 0
     ? model.contextWindow
     : undefined;
-  const hintedWindow = discoveredWindow !== undefined
-    ? (configuredCap !== undefined ? Math.min(discoveredWindow, configuredCap) : discoveredWindow)
-    : (configuredCap ?? (providerCap !== undefined ? resolveUnknownRoutedContextWindow(providerCap) : undefined));
+  const projectedLimits = clampObservedModelLimits(staticPolicy.model, {
+    ...(discoveredWindow !== undefined ? { contextWindow: discoveredWindow } : {}),
+    ...(typeof model.maxInputTokens === "number" && model.maxInputTokens > 0 ? { maxInputTokens: model.maxInputTokens } : {}),
+  });
+  const hintedWindow = projectedLimits.contextWindow
+    ?? (providerCap !== undefined ? resolveUnknownRoutedContextWindow(providerCap) : undefined);
   const hinted = {
     ...modelWithoutServiceTier,
     ...(displayName !== undefined ? { displayName } : {}),
@@ -326,9 +329,7 @@ export function applyProviderConfigHints(
     ...(suppressSyntheticMax ? { suppressSyntheticMax: true } : {}),
     ...(configuredMaxInput !== undefined
       ? {
-        maxInputTokens: typeof model.maxInputTokens === "number" && model.maxInputTokens > 0
-          ? Math.min(model.maxInputTokens, configuredMaxInput)
-          : configuredMaxInput,
+        maxInputTokens: projectedLimits.maxInputTokens ?? configuredMaxInput,
       }
       : {}),
     ...(maxOutputTokens !== undefined ? { maxOutputTokens } : {}),

package/src/codex/catalog/parsing.ts

@@ -803,6 +803,13 @@ export function normalizeRoutedCatalogEntry(
   delete entry.multi_agent_reasoning_effort;
   delete entry.use_responses_lite;
   delete entry.supports_websockets;
+  // Routed rows cloned from native templates must not inherit OpenAI-only experimental context
+  // delivery. Codex reads the flag as "this model accepts experimental context history" and drives
+  // its context-management cadence from it, so a third-party provider that never negotiated it gets
+  // a compact-after-every-step loop instead (observed on a routed DeepSeek row: 1,600+ compactions
+  // in a single thread). Nothing re-applies the field from provider metadata during this step, so
+  // the row leaves this normalization without it.
+  delete entry.supports_experimental_context;
   /*
    * Tier metadata is stripped from routed rows because a row cloned from a native template
    * would otherwise hand a third-party provider OpenAI's tiers.

package/src/codex/catalog/provider-models.ts

@@ -11,6 +11,7 @@ import {
   clearModelCache,
   clearProviderDiscoveryStatus,
   captureModelCacheGeneration,
+  observeModelCacheRevision,
   DEFAULT_MODEL_CACHE_TTL_MS,
   getFreshCached,
   getStaleCached,
@@ -108,6 +109,14 @@ import { captureProviderGather, materializeCapturedHeaders } from "./gather-capt
 export interface ProviderModelsResult {
   readonly models: CatalogModel[];
   readonly outcome: CatalogGatherProviderModelOutcome;
+  /**
+   * The provider's cache content revision as it stood when these rows were chosen.
+   *
+   * Sampled here rather than by the caller because only this point is synchronous with the
+   * choice. A caller reading it after its own await can observe a revision another flight
+   * published in between, and would then record these rows under that flight's identity.
+   */
+  readonly contentRevision: string;
 }
 export const refreshingModelsAuthResolver: ModelsAuthResolver = { kind: "refreshing" };
 
@@ -145,7 +154,11 @@ export async function fetchProviderModelsWithAuth(
   const observed = (
     models: CatalogModel[],
     state: CatalogGatherProviderModelOutcome["state"],
-  ): ProviderModelsResult => ({ models, outcome: { provider: name, state } });
+  ): ProviderModelsResult => ({
+    models,
+    outcome: { provider: name, state },
+    contentRevision: observeModelCacheRevision(name),
+  });
   // Capture before any credential refresh or outbound await. OAuth account changes clear this
   // generation, so a request started with the former account cannot later publish its result.
   const cacheGeneration = captureModelCacheGeneration(name);
@@ -372,7 +385,11 @@ export async function fetchProviderModelsWithAuth(
       ...(cursorFetch ? { fetch: cursorFetch } : {}),
     });
     if (liveResult.ok) {
-      const available = filterCursorConfiguredModelsByLiveDiscovery(configured, liveResult.models);
+      const available = filterCursorConfiguredModelsByLiveDiscovery(
+        configured,
+        liveResult.models,
+        liveResult.maxModeModels ?? [],
+      );
       const result = available.length > 0 ? available : configured;
       // Cache the discovery-filtered roster without combo retention so a later
       // gather can re-apply the current capture's retain set on read.

package/src/codex/catalog/retained-sync.ts

@@ -59,10 +59,12 @@ import {
   type CatalogWritePermit,
 } from "../catalog-write-serialization";
 import {
+  preparedBytesDifferFromDisk,
   publishHashedCodexCatalogBackup,
   publishLegacyCodexCatalogBackup,
   replaceActiveCodexCatalog,
   replaceCodexModelsCache,
+  type PreparedCatalogFileWrite,
 } from "../internal/catalog-writer";
 import { visibleCodexAccountSelectors } from "./account-models";
 import { ACCOUNT_GATED_NATIVE_OPENAI_MODELS, NATIVE_OPENAI_MODELS, NATIVE_RESERVE_MODEL } from "./native-models";
@@ -234,24 +236,6 @@ function revalidateRetainedCatalogSync(
   };
 }
 
-/**
- * Exact bytes currently on disk at `path`, or null when unreadable/absent.
- *
- * Deliberately a Buffer rather than a decoded string: `readFileSync(path, "utf8")`
- * substitutes U+FFFD for every invalid byte, so a file holding a raw 0x80 decodes
- * equal to prepared content holding a legitimately encoded U+FFFD. Comparing the
- * decoded strings would then classify a malformed catalog as identical, skip the
- * atomic repair write, and leave the corruption on disk while reporting
- * `catalogWritten: false`.
- */
-function currentCatalogFileContent(path: string): Buffer | null {
-  try {
-    return readFileSync(path);
-  } catch {
-    return null;
-  }
-}
-
 function pristineCatalogBytes(read: RetainedCatalogSyncRead): string | null {
   if (read.onDiskCatalog && !catalogHasRoutedEntries(read.onDiskCatalog)) {
     try {
@@ -558,15 +542,12 @@ function writeRetainedCatalogSync({
   // nothing about the catalog changed. Skipping the no-op write keeps both the mtime
   // and `catalogWritten` honest; `added` still reports the routed rows the catalog
   // carries, because they are on disk either way.
-  const onDiskBytes = currentCatalogFileContent(catalogPath);
-  if (onDiskBytes !== null && onDiskBytes.equals(Buffer.from(content, "utf8"))) {
+  const preparedCatalog: PreparedCatalogFileWrite = { path: catalogPath, content };
+  if (!preparedBytesDifferFromDisk(preparedCatalog)) {
     return { added, path: catalogPath, catalogWritten: false, comboOmissions };
   }
 
-  replaceActiveCodexCatalog(permit, owningCodexHome, {
-    path: catalogPath,
-    content,
-  });
+  replaceActiveCodexCatalog(permit, owningCodexHome, preparedCatalog);
   return {
     added,
     path: catalogPath,
@@ -713,10 +694,25 @@ export function invalidateCodexModelsCacheWithPermit(
       client_version: "0.0.0",
       models: [...models, ...observedAccountModels],
     };
-    replaceCodexModelsCache(permit, owningCodexHome, {
+    const preparedCache: PreparedCatalogFileWrite = {
       path: cachePath,
       content: `${JSON.stringify(wrapper, null, 2)}\n`,
-    });
+    };
+    // The same no-op rule the active catalog already applies (#1459), for the same
+    // reason and at the second writer that has to obey it.
+    //
+    // This function is what `refreshCodexModelCatalog` reports as `cacheSynced`, and
+    // `handleStart` ORs that into the stale-app-server warning. Rewriting identical
+    // bytes bumped this file's mtime and returned `true`, so on a start where the
+    // catalog reproduced byte-identically — the settled case — the warning still
+    // claimed "Disk catalog/cache were updated" and told the operator their Codex
+    // model list might be stale, when nothing on disk had changed and Codex held the
+    // same model set the file already described. Returning `false` here makes
+    // `cacheSynced` mean what its name and its consumers already assume, and what
+    // `pullRemoteCatalog` and the early returns in `refreshCodexModelCatalog`
+    // already assert: a write happened.
+    if (!preparedBytesDifferFromDisk(preparedCache)) return false;
+    replaceCodexModelsCache(permit, owningCodexHome, preparedCache);
     return true;
   } catch {
     return false;