@bitkyc08/opencodex 2.60.0 → 2.61.0

package/src/clients/config-export/zcode-store.ts

@@ -0,0 +1,157 @@
+// ZCode personal provider store export.
+import type { ExportContext, ManagedContribution, ManagedFragment } from "./contracts";
+import { authoritativeContextWindow, inputModalitiesForClient, normalizeExportModels } from "./model-metadata";
+import { OPENCODE_PROVIDER_ID, LOOPBACK_API_KEY_PLACEHOLDER } from "./constants";
+import { formatSelectorConjunction } from "../../integrations/merge";
+
+/**
+ * The file ZCode 3.14 and later actually read their custom providers from.
+ *
+ * `v2/config.json` — the file {@link buildZcodeContribution} writes — is still
+ * parsed by this client, but only by a one-shot `importLegacy` hook that runs
+ * when this store is missing. The client creates the store on first launch, so
+ * on any install that has ever run the import is already spent and a later
+ * write to the old file is read by nobody (#5348).
+ *
+ * The shape below is the client's own, quoted from the report that opened
+ * #5348: it is what the client's `importLegacyPersonalProviderConfig` produced
+ * when it migrated this project's block, so it is observed output rather than a
+ * schema this project invented. Everything the client persists that we have not
+ * seen it derive from our block is deliberately absent — an omitted field is a
+ * field the client still owns.
+ */
+export const ZCODE_STORE_SCHEMA_VERSION = 1;
+
+/**
+ * `group` places the provider among the user's own personal providers rather
+ * than the builtin list the client ships and rewrites. `api.type` is the same
+ * choice `kind: "openai"` makes in the legacy block: the OpenAI Responses
+ * protocol, which is the only surface this proxy speaks natively.
+ */
+export const ZCODE_STORE_PROVIDER_GROUP = "standard-personal";
+export const ZCODE_STORE_API_TYPE = "openai-responses";
+export const ZCODE_STORE_PROVIDER_NAME = "OpenCodex";
+
+/** Where the store keeps one rule per provider, and one per (provider, model). */
+export const ZCODE_STORE_PROVIDER_RULES_PATH = ["config", "providerConfigRules", "providerRules"] as const;
+export const ZCODE_STORE_MODEL_RULES_PATH = ["config", "modelConfigRules", "providerModelRules"] as const;
+
+export interface ZcodeStoreProviderRule {
+  providerId: string;
+  enabled: true;
+  providerName: string;
+  config: {
+    group: string;
+    access: { apiKey: string };
+    api: { type: string; baseUrl: string };
+    personalModelIds: string[];
+    modelOrder: string[];
+  };
+}
+
+export interface ZcodeStoreModelRule {
+  providerId: string;
+  modelId: string;
+  config: { properties: { contextWindow: number } };
+}
+
+/**
+ * Is this document a store whose schema we can write?
+ *
+ * Only the one version whose shape has been observed. A store carrying any
+ * other `schemaVersion` — or none, or a document that is not an object — is a
+ * file we cannot merge into without asserting a nesting we have never seen,
+ * and a wrong assertion there does not fail loudly: it replaces the provider
+ * list the user keeps in the same file. The integration reports the write as
+ * ineffective in that case instead of guessing.
+ */
+export function zcodeStoreSchemaEstablished(parsed: unknown): boolean {
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return false;
+  return (parsed as Record<string, unknown>).schemaVersion === ZCODE_STORE_SCHEMA_VERSION;
+}
+
+/**
+ * The selector addressing one model rule, or null when the id cannot be spelled.
+ *
+ * A rule is identified by the PAIR, so both fields are named: a selector
+ * carrying only the model would match another provider's rule for the same
+ * model. The conjunction grammar reserves `,` and `]`, and a model id holding
+ * either cannot be addressed unambiguously — that row ships without its
+ * context window rather than with a selector that points somewhere else.
+ */
+function modelRuleSelector(modelId: string): string | null {
+  return formatSelectorConjunction([
+    { field: "providerId", value: OPENCODE_PROVIDER_ID },
+    { field: "modelId", value: modelId },
+  ]);
+}
+
+/** The rows this export publishes, filtered exactly as the legacy block filters them. */
+function storeModels(ctx: ExportContext): string[] {
+  const ids: string[] = [];
+  for (const model of normalizeExportModels(ctx.models)) {
+    if (inputModalitiesForClient("pi", model.inputModalities) === null) continue;
+    ids.push(model.namespaced);
+  }
+  return ids;
+}
+
+/**
+ * The provider rule the client reads, built from the same context the legacy
+ * block is built from.
+ *
+ * `baseUrl` carries the `/v1` root for the same reason the legacy block does:
+ * this client appends `/responses` for the Responses protocol, so requests land
+ * on `/v1/responses`. The serialized credential is always the non-secret
+ * loopback placeholder.
+ */
+export function buildZcodeStoreProviderRule(ctx: ExportContext): ZcodeStoreProviderRule {
+  const ids = storeModels(ctx);
+  return {
+    providerId: OPENCODE_PROVIDER_ID,
+    enabled: true,
+    providerName: ZCODE_STORE_PROVIDER_NAME,
+    config: {
+      group: ZCODE_STORE_PROVIDER_GROUP,
+      access: { apiKey: LOOPBACK_API_KEY_PLACEHOLDER },
+      api: { type: ZCODE_STORE_API_TYPE, baseUrl: `${ctx.baseUrl.replace(/\/v1\/?$/, "")}/v1` },
+      personalModelIds: ids,
+      /*
+       * The client persists the picker order separately from membership. Ours is
+       * the catalog order the rest of this export already sorts by, so a refresh
+       * that adds a model puts it where every other surface puts it.
+       */
+      modelOrder: [...ids],
+    },
+  };
+}
+
+/**
+ * Everything this project owns inside the store: one provider rule, plus one
+ * model rule per row that has an authoritative context window.
+ *
+ * A row without one ships no model rule at all, which is the same
+ * authoritative-window rule the legacy block follows — an emitted stand-in
+ * would be a guessed capability. Reasoning ladders have no counterpart here
+ * that this project has observed the client produce, so none is written.
+ */
+export function buildZcodeStoreContribution(ctx: ExportContext): ManagedContribution {
+  const fragments: ManagedFragment[] = [{
+    path: [...ZCODE_STORE_PROVIDER_RULES_PATH, `[providerId=${OPENCODE_PROVIDER_ID}]`],
+    value: buildZcodeStoreProviderRule(ctx),
+  }];
+  for (const model of normalizeExportModels(ctx.models)) {
+    if (inputModalitiesForClient("pi", model.inputModalities) === null) continue;
+    const contextWindow = authoritativeContextWindow(model.contextWindow);
+    if (contextWindow === undefined) continue;
+    const selector = modelRuleSelector(model.namespaced);
+    if (selector === null) continue;
+    const rule: ZcodeStoreModelRule = {
+      providerId: OPENCODE_PROVIDER_ID,
+      modelId: model.namespaced,
+      config: { properties: { contextWindow } },
+    };
+    fragments.push({ path: [...ZCODE_STORE_MODEL_RULES_PATH, selector], value: rule });
+  }
+  return { clientId: "zcode", fragments };
+}

package/src/clients/config-export.ts

@@ -35,6 +35,18 @@ export { OPENCODE_PROVIDER_ID, OPENCODE_CONFIG_SCHEMA, OPENCODE_API_KEY_ENV, OPE
 export { normalizeExportModels } from "./config-export/model-metadata";
 export type { OmpModelEntry, OmpProviderBlock, OmpGeneratedConfig } from "./config-export/omp";
 export type { ZcodeModelEntry, ZcodeProviderBlock, ZcodeGeneratedConfig } from "./config-export/zcode";
+export type { ZcodeStoreProviderRule, ZcodeStoreModelRule } from "./config-export/zcode-store";
+export {
+  ZCODE_STORE_SCHEMA_VERSION,
+  ZCODE_STORE_PROVIDER_GROUP,
+  ZCODE_STORE_API_TYPE,
+  ZCODE_STORE_PROVIDER_NAME,
+  ZCODE_STORE_PROVIDER_RULES_PATH,
+  ZCODE_STORE_MODEL_RULES_PATH,
+  buildZcodeStoreProviderRule,
+  buildZcodeStoreContribution,
+  zcodeStoreSchemaEstablished,
+} from "./config-export/zcode-store";
 export type { DshReasoningEffort, DshWireReasoningEffort, DshModelEntry, DshProviderBlock, DshGeneratedConfig } from "./config-export/dsh";
 export type { McodeProviderBlock, McodeModelEntry, McodeGeneratedConfig } from "./config-export/mcode";
 export type { RaycastAbility, RaycastAbilityName, RaycastModelEntry, RaycastProviderEntry, RaycastGeneratedConfig } from "./config-export/raycast";
@@ -447,6 +459,30 @@ export function zcodeConfigPath(env: OpencodeLaunchEnv = process.env, home: stri
   return join(zcodeHomeDir(env, home), "v2", "config.json");
 }
 
+/**
+ * The provider store a current ZCode reads, which is NOT the file above.
+ *
+ * ZCode 3.14 moved custom providers to `v2/provider_config.json` and left
+ * `v2/config.json` reachable only through a one-shot import that runs when the
+ * new file is missing. The client creates the new file on first launch, so on
+ * an install that has ever run, the import has already happened and never runs
+ * again — every later write to `v2/config.json` is read by nobody (#5348).
+ *
+ * This project does not write this file; it names it so the integration can
+ * tell whether its own write can still reach the client. The env override is
+ * ZCode's own (`ZCODE_PERSONAL_PROVIDER_CONFIG_FILE`), so an operator who
+ * relocated the store is measured against the file their client actually opens
+ * rather than the default location. A relative override is refused for the same
+ * reason `ZCODE_DATA_DIR` refuses one: we and the client would disagree about
+ * which file it names, and here that disagreement decides whether an apply is
+ * reported as effective.
+ */
+export function zcodeProviderStorePath(env: OpencodeLaunchEnv = process.env, home: string = homedir()): string {
+  const override = env.ZCODE_PERSONAL_PROVIDER_CONFIG_FILE?.trim();
+  if (override) return absoluteClientPath(override, home, "ZCODE_PERSONAL_PROVIDER_CONFIG_FILE");
+  return join(zcodeHomeDir(env, home), "v2", "provider_config.json");
+}
+
 /**
  * Prime Agent resolves its agent directory from `PRIME_AGENT_CODING_AGENT_DIR`
  * — the brand-derived spelling of the `PI_CODING_AGENT_DIR` that `ompAgentDir`

package/src/codex/app-server-processes.ts

@@ -786,6 +786,58 @@ function catalogStatusFromProcesses(
   return { state: stale ? "stale" : "fresh", processes: withStarts, catalogMtimeMs };
 }
 
+interface ComputedCodexAppServerCatalogStatus {
+  status: CodexAppServerCatalogStatus;
+  processes: CodexAppServerProcess[];
+}
+
+/**
+ * Compute one catalog-state observation while retaining the command lines from the
+ * same process enumeration. The public collector deliberately exposes only the
+ * identity and timestamp projection; post-write warning code also needs the matched
+ * process records, and re-enumerating there creates a race between classification and
+ * reporting (as well as a second expensive Windows CIM walk).
+ */
+function computeCodexAppServerCatalogStatus(
+  io: CodexAppServerProcessIo,
+): ComputedCodexAppServerCatalogStatus {
+  const platform = io.platform ?? process.platform;
+  const getuid = io.getuid ?? (() => {
+    try {
+      return typeof process.getuid === "function" ? process.getuid() : undefined;
+    } catch {
+      return undefined;
+    }
+  });
+  let snapshots: ProcessSnapshot[];
+  let enumerationFailed = false;
+  const enumerate = io.listSnapshots ?? (() => defaultListSnapshots(platform, getuid));
+  try {
+    snapshots = enumerate();
+  } catch {
+    // A failed process read is unknown, never proof that nothing is running.
+    snapshots = [];
+    enumerationFailed = true;
+  }
+  const processes = codexAppServerProcessesFromSnapshots(snapshots);
+  if (processes.length === 0) {
+    return {
+      processes,
+      status: enumerationFailed
+        ? { state: "unknown", processes: [], catalogMtimeMs: null }
+        : { state: "not_running", processes: [], catalogMtimeMs: null },
+    };
+  }
+  const catalogMtimeMs = (io.catalogMtimeMs ?? defaultCatalogMtimeMs)();
+  const starts = io.readStartMs
+    ? new Map(processes.map(proc => [proc.pid, io.readStartMs!(proc.pid)] as const))
+    : readProcessStartMsBatch(processes.map(proc => proc.pid), platform);
+  return {
+    processes,
+    status: catalogStatusFromProcesses(processes, catalogMtimeMs, starts),
+  };
+}
+
 // Short TTL: process listing + stat run once per window even under per-turn
 // guidance calls (#857).
 let catalogStateCache: { atMs: number; status: CodexAppServerCatalogStatus } | null = null;
@@ -889,41 +941,7 @@ export function collectCodexAppServerCatalogState(
     && now - catalogStateCache.atMs < catalogStateTtlMs(catalogStateCache.status.state)) {
     return catalogStateCache.status;
   }
-  const compute = (): CodexAppServerCatalogStatus => {
-    const platform = io.platform ?? process.platform;
-    const getuid = io.getuid ?? (() => {
-      try {
-        return typeof process.getuid === "function" ? process.getuid() : undefined;
-      } catch {
-        return undefined;
-      }
-    });
-    let snapshots: ProcessSnapshot[];
-    let enumerationFailed = false;
-    const enumerate = io.listSnapshots ?? (() => defaultListSnapshots(platform, getuid));
-    try {
-      snapshots = enumerate();
-    } catch {
-      // Enumeration failure must never read as "nothing running" — that would let
-      // positive model guidance through on guesswork (#857). The injected seam gets
-      // the same contract as the default path: whoever enumerates, a failure to read
-      // the process list is unknown, not an empty machine.
-      snapshots = [];
-      enumerationFailed = true;
-    }
-    const processes = codexAppServerProcessesFromSnapshots(snapshots);
-    if (processes.length === 0) {
-      return enumerationFailed
-        ? { state: "unknown", processes: [], catalogMtimeMs: null }
-        : { state: "not_running", processes: [], catalogMtimeMs: null };
-    }
-    const catalogMtimeMs = (io.catalogMtimeMs ?? defaultCatalogMtimeMs)();
-    const starts = io.readStartMs
-      ? new Map(processes.map(proc => [proc.pid, io.readStartMs!(proc.pid)] as const))
-      : readProcessStartMsBatch(processes.map(proc => proc.pid), platform);
-    return catalogStatusFromProcesses(processes, catalogMtimeMs, starts);
-  };
-  const status = compute();
+  const status = computeCodexAppServerCatalogStatus(io).status;
   if (fullyDefault) {
     catalogStateCache = { atMs: now, status };
   }
@@ -1228,16 +1246,30 @@ export function afterCatalogWriteHandleAppServers(
   options: AfterCatalogWriteAppServerOptions,
 ): AfterCatalogWriteAppServerResult {
   const excluded = new Set(options.excludePids ?? []);
+  const hint = STALE_CODEX_APP_SERVER_HINT;
+  if (!options.restart) {
+    // A running process is not necessarily stale. Classify the exact process
+    // enumeration that supplies the warning, and stay quiet when freshness cannot be
+    // established rather than presenting an unknown observation as a known mismatch.
+    const observed = computeCodexAppServerCatalogStatus(options.io ?? {});
+    const starts = new Map(observed.status.processes.map(process => [process.pid, process.startedAtMs]));
+    const catalogMtimeMs = observed.status.catalogMtimeMs;
+    const processes = observed.processes.filter(process => !excluded.has(process.pid));
+    const staleProcesses = catalogMtimeMs === null
+      ? []
+      : processes.filter(process => {
+        const startedAtMs = starts.get(process.pid);
+        return startedAtMs !== null && startedAtMs !== undefined && startedAtMs <= catalogMtimeMs;
+      });
+    if (staleProcesses.length === 0) return { processes, warned: false, hint };
+    options.log?.error(formatStaleCodexAppServerWarning(staleProcesses));
+    return { processes: staleProcesses, warned: true, hint };
+  }
   const processes = listCodexAppServerProcesses(options.io)
     .filter(process => !excluded.has(process.pid));
-  const hint = STALE_CODEX_APP_SERVER_HINT;
   if (processes.length === 0) {
     return { processes, warned: false, hint };
   }
-  if (!options.restart) {
-    options.log?.error(formatStaleCodexAppServerWarning(processes));
-    return { processes, warned: true, hint };
-  }
   options.log?.log(
     `Stopping Codex app-server process(es): ${processes.map(process => process.pid).join(", ")} `
     + "(active turns may be interrupted).",

package/src/codex/auth-api/login-flow.ts

@@ -226,9 +226,12 @@ export async function handleCodexAuthLoginStart(req: Request, config: OcxConfig,
     // machine. Opening it on the hub host is useless at best, and on a
     // headless host it fails. `deviceCode` is the same signal the generic
     // OAuth login route uses to make this decision.
+    // Reported to the caller rather than discarded (#5261): a login whose browser never opened
+    // is indistinguishable from one that did, so it reads as success while nothing happens.
+    let browserLaunch: "started" | "failed" | "skipped" = "skipped";
     if (result.url && !result.deviceCode && shouldOpenBrowserForLogin(body.openBrowser, runtimeConfig)) {
       const { openUrl } = await import("../../lib/open-url");
-      openUrl(result.url);
+      browserLaunch = (await openUrl(result.url)).status === "started" ? "started" : "failed";
     }
 
     (async () => {
@@ -488,6 +491,8 @@ export async function handleCodexAuthLoginStart(req: Request, config: OcxConfig,
       flowId,
       url: result.url,
       instructions: result.instructions,
+      // Never fatal: the URL is still a valid thing to open by hand, and the flow stays live.
+      browserLaunch,
       // Dropped before #3366: every device-code surface renders this field,
       // so withholding it left the GUI and CLI with no code to show.
       ...(result.deviceCode ? { deviceCode: result.deviceCode } : {}),

package/src/codex/autostart-health.ts

@@ -154,6 +154,34 @@ export function startupHealthSummary(health: StartupHealth): string {
   return action ? `${summary}; ${action}` : summary;
 }
 
+/**
+ * What to say at the end of setup, once routing is on disk and the autostart choice is made.
+ *
+ * #5261: applying the Codex integration does not install a background service, and on Windows
+ * the scheduled task that a separate install would create is logon-triggered rather than
+ * boot-triggered. So "routing written, nothing listening" is an ordinary state after a restart
+ * rather than a corruption — and the user is never told, because setup ends on a success line.
+ *
+ * A boot trigger is not the missing piece and would be a false reassurance. The task runs as
+ * the interactive user, so before logon there is no session for it to run in; making it truly
+ * pre-logon means a different principal and a different service backend, not another trigger.
+ * What is actually missing is that nobody says the dependency exists, which is cheap to fix and
+ * true on every platform.
+ *
+ * Reuses the existing health model rather than re-deriving the condition, so this cannot drift
+ * from what `ocx status` and `ocx doctor` report about the same install.
+ */
+export function injectedRoutingRestartWarningLines(health: StartupHealth): string[] {
+  if (health.status !== "at-risk") return [];
+  return [
+    // Deliberately not "nothing will restart the proxy": a healthy launcher shim does restart it,
+    // for CLI launches only, and is still at-risk. The summary line below says which case this is.
+    "⚠️  Codex routing is written to disk and survives a restart; keeping the proxy running is a separate matter.",
+    `   ${startupHealthSummary(health)}`,
+    "   While the proxy is down Codex cannot sign in or reach a model. 'ocx restore' undoes the routing without needing it.",
+  ];
+}
+
 function classifyStartupHealthSummary(health: StartupHealth): string {
   if (health.status === "native") return health.routingKind === "custom-remote"
     ? "custom remote Codex routing (no local restart dependency)"

package/src/codex/catalog/build-entries.ts

@@ -1,4 +1,4 @@
-import { CODEX_REASONING_LEVELS } from "../../reasoning-effort";
+import { CODEX_REASONING_LEVELS, type CodexReasoningLevel } from "../../reasoning-effort";
 import { clearModelCache } from "../model-cache";
 import { routedSlug, slugEquivalenceKey } from "../../providers/slug-codec";
 import { COMBO_NAMESPACE } from "../../combos";
@@ -872,7 +872,7 @@ export function mergeCatalogEntriesFromObservedState({
     // (luna: no ultra) stay intact.
     if (!freshCustomEntries.has(m) && !exactCombo && !reserveProjection && !String(e.slug ?? "").startsWith("opencode-go/")) {
       const levels = Array.isArray(e.supported_reasoning_levels)
-        ? e.supported_reasoning_levels as Array<{ effort?: string }>
+        ? e.supported_reasoning_levels as Array<Partial<CodexReasoningLevel>>
         : [];
       if (levels.length > 0
         && !suppressedSyntheticMaxSlugs.has(String(e.slug ?? ""))

package/src/codex/catalog/effort.ts

@@ -8,7 +8,7 @@ import { clearModelCache, DEFAULT_MODEL_CACHE_TTL_MS, getFreshCached, getStaleCa
 import { buildModelsRequest, resolveModelsAuthToken } from "../../oauth";
 import type { OcxConfig, OcxProviderConfig } from "../../types";
 import { modelInList } from "../../types";
-import { CODEX_REASONING_LEVELS, codexEffortRank, configuredReasoningEfforts, modelRecordValue, sanitizeCodexReasoningEfforts } from "../../reasoning-effort";
+import { CODEX_REASONING_LEVELS, codexEffortRank, configuredReasoningEfforts, modelRecordValue, sanitizeCodexReasoningEfforts, type CodexReasoningLevel } from "../../reasoning-effort";
 import { getModelMetadata, getModelMetadataCaseInsensitive, listModelMetadata, resolveMetadataProvider } from "../../generated/model-metadata";
 import { enrichProviderFromRegistry, shouldCaseFoldMetadataModelId } from "../../providers/derive";
 import { getProviderRegistryEntry } from "../../providers/registry";
@@ -286,7 +286,7 @@ export function isGpt56NativeSlug(slug: string): boolean {
 
 export function ensureGpt56ReasoningLevels(entry: RawEntry): void {
   const levels = Array.isArray(entry.supported_reasoning_levels)
-    ? entry.supported_reasoning_levels as Array<{ effort?: string }>
+    ? entry.supported_reasoning_levels as Array<Partial<CodexReasoningLevel>>
     : [];
   const out = [...levels];
   // max is a real native rung on the 5.6 family — always restored; ultra always advertised.
@@ -300,7 +300,7 @@ export function ensureGpt56ReasoningLevels(entry: RawEntry): void {
 
 export function ensureUltraReasoningLevel(entry: RawEntry): void {
   const levels = Array.isArray(entry.supported_reasoning_levels)
-    ? entry.supported_reasoning_levels as Array<{ effort?: string }>
+    ? entry.supported_reasoning_levels as Array<Partial<CodexReasoningLevel>>
     : [];
   if (levels.length === 0) return;
   const wanted = ["max", "ultra"];

package/src/codex/catalog/provider-models.ts

@@ -52,7 +52,7 @@ import { routedSlug, slugEquals, slugEquivalenceKey, slugsEquivalent } from "../
 import { CODEX_GPT5_IDENTITY_LINE } from "../../adapters/identity";
 import { filterCursorConfiguredModelsByLiveDiscovery } from "../../adapters/cursor/discovery";
 import { fetchCursorUsableModels } from "../../adapters/cursor/live-models";
-import { recordLiveCursorClaudeModels, recordLiveCursorMaxModeModels } from "../../adapters/cursor/catalog";
+import { cursorLiveRosterScope, recordLiveCursorClaudeModels, recordLiveCursorMaxModeModels } from "../../adapters/cursor/catalog";
 import { fetchQoderModels } from "../../adapters/qoder/live-models";
 import { resolveQoderProfile } from "../../adapters/qoder/profiles";
 import { fetchDevinUsableModels } from "../../adapters/devin/live-models";
@@ -289,15 +289,19 @@ export async function fetchProviderModelsWithAuth(
   }
   if (prov.adapter === "devin") {
     if (!apiKey) return observed(configured, "degraded");
-    const cachedDevin = getFreshCached(name, ttlMs);
+    // Devin's usable-model list is entitlement-specific. Bind cache reads/writes to an
+    // irreversible credential fingerprint so a credential switch cannot observe another
+    // account's roster or stale fallback (the Qoder precedent above).
+    const authorityIdentity = createHash("sha256").update(apiKey).digest("hex");
+    const cachedDevin = getFreshCached(name, ttlMs, Date.now(), authorityIdentity);
     if (cachedDevin) {
       return observed(
         withConfiguredRetention(applyConfigHintsToCachedModels(name, prov, cachedDevin)),
         "authoritative",
       );
     }
-    if (isModelsFetchCoolingDown(name)) {
-      const cooling = getStaleCached(name);
+    if (isModelsFetchCoolingDown(name, undefined, undefined, authorityIdentity)) {
+      const cooling = getStaleCached(name, authorityIdentity);
       return observed(
         withConfiguredRetention(
           cooling ? applyConfigHintsToCachedModels(name, prov, cooling) : configured,
@@ -339,17 +343,17 @@ export async function fetchProviderModelsWithAuth(
         } as CatalogModel;
       });
       const forCache = withConfiguredRetention(result, { retainComboTargets: false });
-      if (!setCached(name, forCache, Date.now(), cacheGeneration)) {
+      if (!setCached(name, forCache, Date.now(), cacheGeneration, authorityIdentity)) {
         return observed(withConfiguredRetention(configured), "degraded");
       }
       markProviderDiscoveryOk(name, liveResult.models.length);
       return observed(withConfiguredRetention(forCache), "authoritative");
     }
     if (isCurrentCacheGeneration()) {
-      markModelsFetchFailure(name);
+      markModelsFetchFailure(name, undefined, authorityIdentity);
       markProviderDiscoveryFailed(name, { reason: liveResult.error === "auth" ? "provider" : "invalid_response" });
     }
-    const stale = getStaleCached(name);
+    const stale = getStaleCached(name, authorityIdentity);
     return observed(
       withConfiguredRetention(stale ? applyConfigHintsToCachedModels(name, prov, stale) : configured),
       "degraded",
@@ -361,15 +365,19 @@ export async function fetchProviderModelsWithAuth(
     // variants this PLAN can use. Keep the base-model UX (the request builder appends the effort
     // suffix) but filter the static seed to the bases the account actually has — so models not on the
     // plan (e.g. claude-fable-5) drop out instead of failing ERROR_BAD_MODEL_NAME. Fall back to the seed.
-    const cachedCursor = getFreshCached(name, ttlMs);
+    // The roster is entitlement-specific, so the cache entry is bound to an irreversible
+    // credential fingerprint: a credential switch must not observe the previous account's
+    // plan roster, its stale fallback, or its failure cooldown suppression.
+    const authorityIdentity = createHash("sha256").update(apiKey).digest("hex");
+    const cachedCursor = getFreshCached(name, ttlMs, Date.now(), authorityIdentity);
     if (cachedCursor) {
       return observed(
         withConfiguredRetention(applyConfigHintsToCachedModels(name, prov, cachedCursor, undefined, metadataModelIdCaseFold, captured.effectiveAlias)),
         "authoritative",
       );
     }
-    if (isModelsFetchCoolingDown(name)) {
-      const cooling = getStaleCached(name);
+    if (isModelsFetchCoolingDown(name, undefined, undefined, authorityIdentity)) {
+      const cooling = getStaleCached(name, authorityIdentity);
       return observed(
         withConfiguredRetention(
           cooling ? applyConfigHintsToCachedModels(name, prov, cooling, undefined, metadataModelIdCaseFold, captured.effectiveAlias) : configured,
@@ -394,27 +402,28 @@ export async function fetchProviderModelsWithAuth(
       // Cache the discovery-filtered roster without combo retention so a later
       // gather can re-apply the current capture's retain set on read.
       const forCache = withConfiguredRetention(result, { retainComboTargets: false });
-      if (!setCached(name, forCache, Date.now(), cacheGeneration)) {
+      if (!setCached(name, forCache, Date.now(), cacheGeneration, authorityIdentity)) {
         return observed(withConfiguredRetention(configured), "degraded");
       }
       // Publish roster-derived state only for a discovery the cache accepted: a stale
       // in-flight capture (generation revoked by a credential/config change) must not
       // overwrite the spelling or Max-Mode evidence of the newer one.
-      recordLiveCursorClaudeModels(liveResult.models);
+      const liveRosterScope = { provider: name, key: cursorLiveRosterScope(prov.baseUrl, apiKey) };
+      recordLiveCursorClaudeModels(liveResult.models, liveRosterScope);
       // Live Max-Mode evidence feeds the umbrella resolver's ultra gate
       // (devlog 260828_cursor_umbrella_catalog; union with static evidence).
-      recordLiveCursorMaxModeModels(liveResult.maxModeModels ?? []);
+      recordLiveCursorMaxModeModels(liveResult.maxModeModels ?? [], liveRosterScope);
       markProviderDiscoveryOk(name, liveResult.models.length);
       return observed(withConfiguredRetention(forCache, { warnDrops: true }), "authoritative");
     }
     if (isCurrentCacheGeneration()) {
-      markModelsFetchFailure(name);
+      markModelsFetchFailure(name, undefined, authorityIdentity);
       markProviderDiscoveryFailed(name, { reason: "provider" });
       console.warn(
         `[opencodex] Cursor model discovery for "${name}" failed [${liveResult.error}]${liveResult.detail ? `: ${liveResult.detail}` : ""}; using stale/static catalog degradation.`,
       );
     }
-    const staleCursor = getStaleCached(name);
+    const staleCursor = getStaleCached(name, authorityIdentity);
     return observed(
       withConfiguredRetention(
         staleCursor ? applyConfigHintsToCachedModels(name, prov, staleCursor, undefined, metadataModelIdCaseFold, captured.effectiveAlias) : configured,

package/src/codex/catalog/retained-sync.ts

@@ -15,9 +15,9 @@ import {
   availableAccountGatedNativeModels,
   codexModelEntitlementStateForAccount,
   isCodexModelEntitlementSnapshotCurrent,
-  resolveCodexModelEntitlements,
   type CodexModelEntitlementSnapshot,
 } from "../model-entitlements";
+import { resolveAdmittedCodexModelEntitlements } from "../model-entitlement-admission";
 import { isAccountNeedsReauth } from "../account-runtime-state";
 import { codexRuntimeStatePath } from "../runtime";
 import {
@@ -601,7 +601,7 @@ export async function syncCatalogModels(
       comboOmissions,
       providerModelOutcomes,
     }),
-    resolveCodexModelEntitlements(config),
+    resolveAdmittedCodexModelEntitlements(config),
   ]);
   const committed = withCatalogWriteSerialization(owningCodexHome, permit => {
     // Desired state can flip OFF during the provider await above. The catalog

package/src/codex/convergence.ts

@@ -78,9 +78,9 @@ import {
   availableAccountGatedNativeModels,
   codexModelEntitlementStateForAccount,
   isCodexModelEntitlementSnapshotCurrent,
-  resolveCodexModelEntitlements,
   type CodexModelEntitlementSnapshot,
 } from "./model-entitlements";
+import { resolveAdmittedCodexModelEntitlements } from "./model-entitlement-admission";
 import { ACCOUNT_GATED_NATIVE_OPENAI_MODELS } from "./catalog/native-models";
 import { providerCodexAccountMode } from "../providers/registry";
 import { OPENAI_CODEX_PROVIDER_ID } from "../providers/openai-tiers";
@@ -434,7 +434,7 @@ export async function gatherCodexCatalogCandidate(
         providerModelOutcomes,
         discoveryPolicySnapshots: discoveryPolicies,
       }),
-      resolveCodexModelEntitlements(snapshot.config),
+      resolveAdmittedCodexModelEntitlements(snapshot.config),
     ]);
     const processLocal = processEvidence(source);
     const sourceEvidence = sealCatalogGatherEvidenceSession(session);

package/src/codex/history-provider.ts

@@ -335,6 +335,17 @@ class CodexHistoryIntegrityError extends Error {
  */
 export const HISTORY_RELABEL_STANDS_DOWN = "history_paginated_requires_native_writer";
 
+/**
+ * The narrower reason: a provider-table transition found an `openai`-tagged row Codex has
+ * already paginated. It is not a plain stand-down, because the transition also takes the root
+ * `openai_base_url` out, and that combination would send the conversation to Codex's built-in
+ * OpenAI endpoint rather than this proxy.
+ *
+ * A constant for the same reason as the one above: `src/codex/inject/paginated-openai-compat.ts`
+ * decides what to do about it, and a literal repeated in two files is how the pair drifts apart.
+ */
+export const HISTORY_PAGINATED_OPENAI_NEEDS_ROOT_OVERRIDE = "history_paginated_openai_requires_native_writer";
+
 function assertLegacyHistoryRecord(line: string): void {
   let value: unknown;
   try { value = JSON.parse(line); } catch { throw new CodexHistoryIntegrityError("history_rollout_record_invalid"); }
@@ -459,7 +470,7 @@ export function preflightCodexHistoryInjection(
       }
       assertLegacyHistoryWritable(row.rollout_path);
     }
-    if (foundPaginatedOpenaiRow) return "history_paginated_openai_requires_native_writer";
+    if (foundPaginatedOpenaiRow) return HISTORY_PAGINATED_OPENAI_NEEDS_ROOT_OVERRIDE;
     return foundPaginatedRow ? HISTORY_RELABEL_STANDS_DOWN : null;
   } catch (error) {
     return error instanceof CodexHistoryIntegrityError