@bitkyc08/opencodex 2.65.0 → 2.66.0-preview.20260925

package/src/client/runtime.ts

@@ -1,16 +1,20 @@
 import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
 import type { Server } from "bun";
 import { loadConfig } from "../config";
 import { removePid, removeRuntimePort, writePid, writeRuntimePort } from "../config/process-state";
 import { installCrashGuards } from "../lib/crash-guard";
 import { selfLaunchArgv } from "../lib/self-launch-argv";
 import { loadServiceTokenFromFile, serviceApiTokenFingerprint } from "../lib/service-secrets";
-import { findAvailablePort } from "../server/ports";
+import { findAvailablePort, PortUnavailableError } from "../server/ports";
+import { createClientLinkSupervisor, type ClientLinkSupervisor } from "./link-tunnel";
+import { clientLinkStatePath } from "./link-state";
 import { startMachineListener } from "./machine-listener";
-import { readClientConnectionState } from "./state";
+import { isLinkConnection, readClientConnectionState } from "./state";
 
 let activeServer: Server<unknown> | null = null;
 let activePort: number | null = null;
+let activeSupervisor: ClientLinkSupervisor | null = null;
 let recycleScheduled = false;
 
 function cleanup(): void {
@@ -45,56 +49,89 @@ export function scheduleStandaloneRecycle(disconnectedTokenFingerprint: string):
   if (recycleScheduled) return;
   recycleScheduled = true;
   const timer = setTimeout(() => {
-    const port = activePort;
-    try { activeServer?.stop(true); } catch { /* best effort */ }
-    cleanup();
-    // Recycling back to standalone after `ocx disconnect` must actually bring a standalone
-    // proxy back, under either launch shape.
-    //
-    // Unsupervised: spawn the replacement ourselves and exit 0.
-    //
-    // Supervised (`OCX_SERVICE=1`): do NOT spawn — the supervisor owns the process, and a
-    // second copy would fight it for the port. But exit 0 does not work either: the real
-    // supervisor configs are failure-only (systemd `Restart=on-failure`, WinSW
-    // `<onfailure action="restart"/>`, the Task Scheduler ERRORLEVEL loop), so a clean exit
-    // reads as "the service finished" and nothing restarts. The client stayed down until the
-    // operator noticed. Exit 1 is what those configs are watching for, and it is the same
-    // policy the dashboard recycle already uses (src/server/management/system-restart.ts).
-    //
-    // launchd's KeepAlive restarts on any exit, so it is correct under both branches.
-    if (process.env.OCX_SERVICE === "1") {
-      process.exit(1);
-    }
-    if (port) {
-      const child = spawn(process.execPath, selfLaunchArgv(["start", "--port", String(port)]), {
-        detached: true,
-        stdio: "ignore",
-        windowsHide: true,
-        env: standaloneRecycleEnv(process.env, disconnectedTokenFingerprint),
-      });
-      child.unref();
-    }
-    process.exit(0);
+    void recycleStandalone(disconnectedTokenFingerprint);
   }, 50);
   if (typeof timer === "object" && "unref" in timer) timer.unref();
 }
 
+async function recycleStandalone(disconnectedTokenFingerprint: string): Promise<void> {
+  const port = activePort;
+  try {
+    await activeSupervisor?.stop();
+  } catch (error) {
+    console.warn(`[client] link supervisor stop failed: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  activeSupervisor = null;
+  try {
+    activeServer?.stop(true);
+  } catch (error) {
+    console.warn(`[client] listener stop failed: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  cleanup();
+  // Recycling back to standalone after `ocx disconnect` must actually bring a standalone
+  // proxy back, under either launch shape.
+  //
+  // Unsupervised: spawn the replacement ourselves and exit 0.
+  //
+  // Supervised (`OCX_SERVICE=1`): do NOT spawn — the supervisor owns the process, and a
+  // second copy would fight it for the port. But exit 0 does not work either: the real
+  // supervisor configs are failure-only (systemd `Restart=on-failure`, WinSW
+  // `<onfailure action="restart"/>`, the Task Scheduler ERRORLEVEL loop), so a clean exit
+  // reads as "the service finished" and nothing restarts. The client stayed down until the
+  // operator noticed. Exit 1 is what those configs are watching for, and it is the same
+  // policy the dashboard recycle already uses (src/server/management/system-restart.ts).
+  //
+  // launchd's KeepAlive restarts on any exit, so it is correct under both branches.
+  if (process.env.OCX_SERVICE === "1") {
+    process.exit(1);
+  }
+  if (port) {
+    const child = spawn(process.execPath, selfLaunchArgv(["start", "--port", String(port)]), {
+      detached: true,
+      stdio: "ignore",
+      windowsHide: true,
+      env: standaloneRecycleEnv(process.env, disconnectedTokenFingerprint),
+    });
+    child.unref();
+  }
+  process.exit(0);
+}
+
 export async function startClientRuntime(
   options: { port?: number; block?: boolean } = {},
 ): Promise<void> {
   const state = readClientConnectionState();
   if (state.kind !== "connected") throw new Error(`client runtime refused: client state is ${state.kind}`);
   const config = loadConfig();
-  const preferred = options.port ?? config.port ?? 10100;
-  const port = await findAvailablePort(preferred, "127.0.0.1", {
-    preferRetryMs: options.port === undefined ? 750 : 5_000,
-    preferRetryIntervalMs: 50,
-    allowEphemeralFallback: options.port === undefined,
-  });
+  const linkMode = isLinkConnection(state.value);
+  if (linkMode && (!Number.isInteger(config.port) || config.port < 1 || config.port > 65535)) {
+    throw new Error("link mode requires a valid local config port");
+  }
+  const preferred = linkMode ? config.port : options.port ?? config.port ?? 10100;
+  let port: number;
+  try {
+    port = await findAvailablePort(preferred, "127.0.0.1", {
+      preferRetryMs: options.port === undefined ? 750 : 5_000,
+      preferRetryIntervalMs: 50,
+      allowEphemeralFallback: linkMode ? false : options.port === undefined,
+    });
+  } catch (error) {
+    if (linkMode && error instanceof PortUnavailableError) {
+      throw new Error(`link mode needs port ${config.port}; free it or change port`, { cause: error });
+    }
+    throw error;
+  }
   const server = startMachineListener(port, { state: state.value });
   const boundPort = server.port ?? port;
   activeServer = server;
   activePort = boundPort;
+  const supervisor = linkMode && existsSync(clientLinkStatePath())
+    ? createClientLinkSupervisor({
+      onLinkEnded: () => scheduleStandaloneRecycle(state.value.tokenFingerprint),
+    })
+    : null;
+  activeSupervisor = supervisor;
+  supervisor?.start();
   installCrashGuards();
   writePid(process.pid);
   writeRuntimePort({ pid: process.pid, port: boundPort, hostname: "127.0.0.1" });
@@ -103,10 +140,22 @@ export async function startClientRuntime(
   const shutdown = () => {
     if (shuttingDown) return;
     shuttingDown = true;
-    try { server.stop(true); } finally {
-      cleanup();
-      process.exit(0);
-    }
+    void (async () => {
+      try {
+        await supervisor?.stop();
+      } catch (error) {
+        console.warn(`[client] link supervisor stop failed: ${error instanceof Error ? error.message : String(error)}`);
+      }
+      activeSupervisor = null;
+      try {
+        server.stop(true);
+      } catch (error) {
+        console.warn(`[client] listener stop failed: ${error instanceof Error ? error.message : String(error)}`);
+      } finally {
+        cleanup();
+        process.exit(0);
+      }
+    })();
   };
   process.on("SIGINT", shutdown);
   process.on("SIGTERM", shutdown);

package/src/client/state.ts

@@ -26,6 +26,10 @@ export type ClientConnectionState =
   | { kind: "invalid"; reason: string }
   | { kind: "mismatched"; reason: string };
 
+export function isLinkConnection(c: OcxClientConnectionConfig | undefined): boolean {
+  return c?.transport === "link";
+}
+
 const pendingConnectPath = (): string => join(getConfigDir(), "client-connect-pending");
 
 /** Validate pending ownership; an optional fingerprint restricts it to that exact key. */

package/src/codex/catalog/build-entries.ts

@@ -783,6 +783,10 @@ export function mergeCatalogEntriesFromObservedState({
     }
     const slug = String(entry.slug);
     if (!isOcxAuthoredRoutedEntry(entry) || isNativeAliasCatalogEntry(entry)) continue;
+    // The builder no longer copies a template's comp_hash onto routed rows (#5796), but a row
+    // kept from disk may still carry one. Custom rows, Codex-forward aliases included, never
+    // reach this loop: they are rebuilt from config.
+    entry.comp_hash = "opencodex";
     const featuredRank = featuredRankOf(slug);
     entry.priority = featuredRank !== undefined
       ? featuredRank * priorityStride

package/src/codex/catalog/derive-entry.ts

@@ -144,6 +144,11 @@ export function deriveEntry(
         delete e.context_window;
         delete e.max_context_window;
         delete e.auto_compact_token_limit;
+        // Nor its comp_hash (#5796). Codex compacts a thread whenever the recorded value
+        // changes, and the template is whichever native row a rebuild found first, so an
+        // inherited value moves with rebuild order. Left unset, normalization gives every
+        // routed row the same "opencodex" marker.
+        delete e.comp_hash;
       }
       if (typeof e.base_instructions === "string") {
         // Proxy-neutral: keep the GPT-5/OpenAI disclaimer but never advertise the opencodex proxy

package/src/codex/catalog/parsing.ts

@@ -36,6 +36,7 @@ import { clampAutoCompactTokenLimit } from "../../providers/auto-compact-budget"
 import { trustedAccountBoundNativeCatalogSlug } from "./account-models";
 import { CODEX_NATIVE_ALIAS_CATALOG_KIND } from "./kinds";
 import { NATIVE_GPT6_ASTRA_MODEL } from "./native-models";
+import { recordOwnedConfigPath } from "../../lib/config-ownership";
 
 export function legacyCatalogBackupPath(): string {
   return join(getConfigDir(), "catalog-backup.json");
@@ -969,14 +970,17 @@ export function catalogHasRoutedEntries(catalog: RawCatalog | null): boolean {
 }
 
 export function writePristineCatalogBackup(backupPath: string, catalogPath: string, catalog: RawCatalog): void {
+  // An existing name is not evidence of ownership; keep pre-ledger/user backups unclaimed.
   if (existsSync(backupPath)) return;
   const onDisk = readCatalog(catalogPath);
   if (onDisk && !catalogHasRoutedEntries(onDisk)) {
     copyFileSync(catalogPath, backupPath);
+    recordOwnedConfigPath(getConfigDir(), backupPath);
     return;
   }
   if (!catalogHasRoutedEntries(catalog)) {
     atomicWriteFile(backupPath, JSON.stringify(catalog, null, 2) + "\n");
+    recordOwnedConfigPath(getConfigDir(), backupPath);
   }
 }
 

package/src/codex/catalog/retained-sync.ts

@@ -1,6 +1,7 @@
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
-import { loadConfig, websocketsEnabled } from "../../config";
+import { initializeConfigOwnership } from "../../lib/config-ownership";
+import { getConfigDir, loadConfig, websocketsEnabled } from "../../config";
 import { shouldSyncCodexOnStart } from "../desired-state";
 import { legacyCustomModelCatalogSlugs } from "../custom-model-catalog-migration";
 import { getCodexHome } from "../paths";
@@ -289,6 +290,8 @@ function writeRetainedCatalogSync({
     // (later syncs would otherwise overwrite it with featured-modified priorities).
     const pristine = pristineCatalogBytes(read);
     if (pristine !== null) {
+      // Initialize metadata while the root is empty; never pre-claim the hashed path.
+      initializeConfigOwnership(getConfigDir());
       publishHashedCodexCatalogBackup(permit, owningCodexHome, {
         path: catalogBackupPathFor(catalogPath),
         content: pristine,

package/src/codex/desktop-switches.ts

@@ -1,5 +1,6 @@
 import type { OcxConfig } from "../types";
 import { shouldSyncCodexOnStart } from "./desired-state";
+import { tomlString } from "./paths";
 import {
   isEffectiveCodexClientCompaction,
   isEffectiveCodexDesktopAuthless,
@@ -11,7 +12,7 @@ export type CodexDesktopSwitchInertReason =
 
 export interface CodexDesktopSwitchState {
   stored: boolean;
-  effective: boolean;
+  effective: boolean | null;
   inertReason?: CodexDesktopSwitchInertReason;
 }
 
@@ -19,6 +20,8 @@ export type CodexDesktopSwitchApplyReason =
   | "not_requested"
   | "proxy_not_running"
   | "integration_disabled"
+  | "external_provider"
+  | "ownership_undetermined"
   | "write_lock_busy"
   | "injection_refused";
 
@@ -35,7 +38,7 @@ export interface CodexDesktopSwitchReport {
   codexDesktopAuthless: CodexDesktopSwitchState;
   codexClientCompaction: CodexDesktopSwitchState;
   apply: CodexDesktopSwitchApply;
-  authSource: { presentsCodexAccount: boolean; summary: string };
+  authSource: { presentsCodexAccount: boolean | null; summary: string };
 }
 
 type DesktopSwitchConfig = Pick<
@@ -50,9 +53,10 @@ type DesktopSwitchConfig = Pick<
 
 function describeSwitch(
   stored: boolean,
-  effective: boolean,
+  effective: boolean | null,
   config: Pick<OcxConfig, "runtimeRole">,
 ): CodexDesktopSwitchState {
+  if (effective === null) return { stored, effective };
   if (!stored || effective) return { stored, effective };
   return {
     stored,
@@ -68,15 +72,31 @@ export function describeCodexDesktopSwitches(
   apply: CodexDesktopSwitchApply,
 ): CodexDesktopSwitchReport {
   const authlessStored = config.codexDesktopAuthless === true;
-  const authlessEffective = isEffectiveCodexDesktopAuthless(config);
+  const externallyOwned = !apply.applied && apply.reason === "external_provider";
+  const ownershipUndetermined = !apply.applied && apply.reason === "ownership_undetermined";
+  // An unreadable config.toml leaves ownership undetermined, so the local effective values are
+  // withheld exactly like the externally owned case: reporting them would present OpenCodex's
+  // stored-versus-computed state as live while the file may belong to another provider.
+  const effectiveWithheld = externallyOwned || ownershipUndetermined;
+  const authlessEffective = effectiveWithheld ? null : isEffectiveCodexDesktopAuthless(config);
   const compactionStored = config.codexClientCompaction === true;
-  const compactionEffective = isEffectiveCodexClientCompaction(config);
+  const compactionEffective = effectiveWithheld ? null : isEffectiveCodexClientCompaction(config);
 
   return {
     codexDesktopAuthless: describeSwitch(authlessStored, authlessEffective, config),
     codexClientCompaction: describeSwitch(compactionStored, compactionEffective, config),
     apply,
-    authSource: authlessEffective
+    authSource: externallyOwned
+      ? {
+          presentsCodexAccount: null,
+          summary: "An external model provider owns Codex sign-in behavior; its account requirement was not changed.",
+        }
+      : ownershipUndetermined
+      ? {
+          presentsCodexAccount: null,
+          summary: "Whether the Codex app requires its own account sign-in is undetermined; config.toml ownership could not be read.",
+        }
+      : authlessEffective
       ? {
           presentsCodexAccount: false,
           summary: "The Codex app will not require its own account sign-in.",
@@ -88,6 +108,53 @@ export function describeCodexDesktopSwitches(
   };
 }
 
+/**
+ * The apply record for a report that attempted no rewrite. `not_requested` alone would have
+ * the report claiming OpenCodex's stored-versus-effective state as live, so the read path
+ * consults the same ownership predicate the injector does and reports external ownership
+ * instead — a settings GET and a switch-free PUT then agree with an attempted apply.
+ */
+export async function observedCodexDesktopSwitchApply(): Promise<CodexDesktopSwitchApply> {
+  // Same lazy boundary as applyCodexConfigInjection: the ownership predicate lives in the
+  // injection graph, which the settings read path must not pull in at module scope.
+  const { currentExternalCodexModelProvider } = await import("./inject/config-toml");
+  let provider: string | null;
+  try {
+    provider = currentExternalCodexModelProvider();
+  } catch (error) {
+    // A present-but-unreadable config.toml (permissions, deletion racing existsSync)
+    // must not take down the whole settings report. The undetermined reason keeps the
+    // reporting contract honest: effective values and the sign-in answer stay null instead
+    // of presenting local state a foreign provider may still control.
+    return {
+      applied: false,
+      reason: "ownership_undetermined",
+      retryable: true,
+      detail: `config.toml ownership could not be determined: ${error instanceof Error ? error.message : String(error)}`,
+    };
+  }
+  if (!provider) return { applied: false, reason: "not_requested", retryable: false };
+  return {
+    applied: false,
+    reason: "external_provider",
+    retryable: false,
+    detail: `config.toml selects the external model_provider ${tomlString(provider)}.`,
+  };
+}
+
+// The apply gates skip the injector entirely, so they run the same ownership read the
+// observed path does — a disabled integration or an absent runtime must not make a
+// switch PUT report local state the external provider still controls. An undetermined
+// read is kept for the same reason: replacing it with the gate's reason would drop the
+// "ownership could not be determined" explanation the locked save still owes.
+async function observedOwnershipApply(): Promise<CodexDesktopSwitchApply | null> {
+  const ownership = await observedCodexDesktopSwitchApply();
+  return !ownership.applied
+    && (ownership.reason === "external_provider" || ownership.reason === "ownership_undetermined")
+    ? ownership
+    : null;
+}
+
 /**
  * Re-run the Codex config injection so a setting that lives in `~/.codex/config.toml` follows the
  * stored config NOW rather than at the next `ocx sync`.
@@ -100,13 +167,15 @@ export async function applyCodexConfigInjection(
   config: OcxConfig,
 ): Promise<CodexDesktopSwitchApply> {
   if (!shouldSyncCodexOnStart(config)) {
-    return { applied: false, reason: "integration_disabled", retryable: false };
+    return (await observedOwnershipApply())
+      ?? { applied: false, reason: "integration_disabled", retryable: false };
   }
 
   const { readRuntimePort } = await import("../config/process-state");
   const runtime = readRuntimePort(process.pid);
   if (!runtime) {
-    return { applied: false, reason: "proxy_not_running", retryable: true };
+    return (await observedOwnershipApply())
+      ?? { applied: false, reason: "proxy_not_running", retryable: true };
   }
 
   try {
@@ -123,6 +192,14 @@ export async function applyCodexConfigInjection(
         detail: result.message,
       };
     }
+    if (result.success && result.configApplied === false) {
+      return {
+        applied: false,
+        reason: "external_provider",
+        retryable: false,
+        detail: result.message,
+      };
+    }
     if (result.success) {
       // history_paginated_requires_native_writer stands down only the legacy relabel;
       // apply still writes the routing and catalog half for paginated Codex homes.
@@ -143,6 +220,9 @@ export async function applyCodexConfigInjection(
       detail: result.message,
     };
   } catch (error) {
+    // The injector may fail its ownership read after the initial apply gates passed.
+    const ownership = await observedOwnershipApply();
+    if (ownership) return ownership;
     return {
       applied: false,
       reason: "injection_refused",

package/src/codex/inject/plan.ts

@@ -102,6 +102,19 @@ export type CodexInjectionPlan =
     }
   | CodexInjectionPlanOk;
 
+function websocketsForRoutingTarget(
+  config: OcxConfig | undefined,
+  routingTarget: CodexRoutingTarget,
+): boolean {
+  // A link client reaches the hub through an HTTP-only tunnel. Its local Codex target is
+  // deliberately distinct from the tunnel origin, so force the injected websocket setting off
+  // even when the operator enabled the global websocket option. Hub mode can also use a local
+  // HTTP target with admission, so the explicit discriminator is required here.
+  return (routingTarget as CodexRoutingTarget & { link?: boolean }).link === true
+    ? false
+    : websocketsEnabled(config ?? {});
+}
+
 export function deriveCodexInjectionPlan(
   source: string,
   ctx: CodexInjectionPlanContext,
@@ -240,7 +253,7 @@ export function deriveCodexInjectionPlan(
     content =
       content.trimEnd() +
       "\n" +
-      buildProviderTableBlockForTarget(routingTarget, websocketsEnabled(config ?? {}), config?.codexProviderDisplayName);
+      buildProviderTableBlockForTarget(routingTarget, websocketsForRoutingTarget(config, routingTarget), config?.codexProviderDisplayName);
     // 3) Keep existing `openai`-tagged threads reaching the proxy (see above). Ownership rules
     // are the Design B ones: a user's own root line is never replaced.
     if (keepRootOverrideAlongsideTable) {
@@ -299,7 +312,7 @@ export function deriveCodexInjectionPlan(
   const profileContent = buildProfileFileForTarget(
     routingTarget,
     catalogPath,
-    websocketsEnabled(config ?? {}),
+    websocketsForRoutingTarget(config, routingTarget),
     config?.fastMode,
     config?.codexProviderDisplayName,
   );
@@ -358,7 +371,7 @@ export function deriveCodexInjectionPlan(
    */
   if (hadOcxProviderTableOnDisk && !providerTableMode) {
     content = applyEol(
-      content.trimEnd() + "\n" + buildProviderTableBlockForTarget(routingTarget, websocketsEnabled(config ?? {}), config?.codexProviderDisplayName),
+      content.trimEnd() + "\n" + buildProviderTableBlockForTarget(routingTarget, websocketsForRoutingTarget(config, routingTarget), config?.codexProviderDisplayName),
       eol,
     );
   }

package/src/codex/inject.ts

@@ -133,6 +133,8 @@ function runClientWriteGuard(guard: InjectCodexOptions["beforeClientWrite"]): vo
 export interface CodexInjectResult {
   success: boolean;
   message: string;
+  /** False when injection intentionally preserves configuration owned by another provider. */
+  configApplied?: false;
   /**
    * Structured read-only history preflight refusal; never parsed from display text.
    *
@@ -240,6 +242,7 @@ async function injectCodexConfigImpl(
       : undefined;
     return {
       success: true,
+      configApplied: false,
       ...(nativeSubagentDefaultsWarning
         ? { nativeSubagentDefaultsWarning }
         : {}),

package/src/codex/internal/catalog-writer.ts

@@ -5,6 +5,7 @@ import {
   AtomicWriteResidualTempError,
   AtomicWriteSecretResidualError,
   atomicWriteFile,
+  getConfigDir,
   resolveWriteTarget,
   type AtomicWriteIO,
 } from "../../config";
@@ -17,6 +18,7 @@ import {
   hardenSecretPath,
 } from "../../lib/windows-secret-acl";
 import { resetCodexAppServerCatalogStateCache } from "../app-server-processes";
+import { recordOwnedConfigPath } from "../../lib/config-ownership";
 
 export interface PreparedCatalogFileWrite {
   readonly path: string;
@@ -169,6 +171,7 @@ function scrubAndRemoveUnpublishedTemp(
 function publishCatalogBackup(
   prepared: PreparedCatalogFileWrite,
   suppliedIo?: CatalogBackupWriteIO,
+  onPublished?: () => void,
 ): CatalogBackupPublication {
   const io = suppliedIo ?? defaultBackupWriteIO(prepared.path);
   const target = io.resolveTarget(prepared.path);
@@ -187,7 +190,12 @@ function publishCatalogBackup(
     throw error;
   }
 
-  removePublishedTemp(tempPath, io);
+  try {
+    // Publication already succeeded; cleanup failure must not erase that ownership.
+    onPublished?.();
+  } finally {
+    removePublishedTemp(tempPath, io);
+  }
   return "written";
 }
 
@@ -211,7 +219,10 @@ export function publishHashedCodexCatalogBackup(
   io?: CatalogBackupWriteIO,
 ): CatalogBackupPublication {
   assertCatalogWritePermit(permit, owningCodexHome);
-  return publishCatalogBackup(prepared, io);
+  return publishCatalogBackup(prepared, io, io ? undefined : () => {
+    // Called only after a new no-replace publication, never for preserved winners.
+    recordOwnedConfigPath(getConfigDir(), prepared.path);
+  });
 }
 
 /** Atomically publish the legacy immutable backup without clobbering. */

package/src/combos/failover.ts

@@ -215,11 +215,11 @@ export function coolComboTarget(
     code?: string | null;
     message?: string;
   },
-): void {
+): boolean {
   const now = options?.now ?? Date.now();
   const writerGeneration = options?.writerGeneration ?? captureConfigGeneration();
   const ownerKey = `${comboId}::${targetKey(target)}`;
-  if (writerGeneration < lastReconciledGeneration && !liveComboTargets.has(ownerKey)) return;
+  if (writerGeneration < lastReconciledGeneration && !liveComboTargets.has(ownerKey)) return false;
   // A server-provided Retry-After is authoritative, including an immediate `0` directive.
   // A quota reset is the next-most-specific signal (#3256); configured and default cooldowns
   // are only fallbacks when upstream supplied neither usable value.
@@ -240,6 +240,7 @@ export function coolComboTarget(
     cooldownUntil: now + (serverDelayMs ?? Math.min(Math.max(cooldownMs, 1), MAX_COOLDOWN_MS)),
   });
   sweepExpiredOnWrite(now);
+  return true;
 }
 
 export function earliestComboCooldown(

package/src/combos/index.ts

@@ -56,3 +56,15 @@ export {
   resetComboEffortWarningStateForTests,
 } from "./request";
 export { earliestQuotaResetAt, quotaResetRemainingMs } from "./reset-window";
+export {
+  buildJevRouteQuestion,
+  buildJevState,
+  JEV_API_URL,
+  JEV_MODEL,
+  JEV_PROVIDER_ID,
+  parseJevDecision,
+  resolveJevDecision,
+  type JevCandidate,
+  type JevDecision,
+  type ResolveJevDecisionOptions,
+} from "./jev";