@bitkyc08/opencodex 2.73.0 → 2.74.0

package/src/codex/catalog-auto-refresh.ts

@@ -1,5 +1,5 @@
 /**
- * Opt-in periodic catalog refresh so newly released models appear without a
+ * Default-on periodic catalog refresh so newly released models appear without a
  * manual `ocx sync` (issue #3630).
  *
  * This is load-bearing, not a convenience. The served model set is otherwise
@@ -24,6 +24,7 @@
  */
 const DEFAULT_INTERVAL_MS = 60 * 60_000;
 const MIN_INTERVAL_MS = 15 * 60_000;
+const INITIAL_DELAY_MS = 3 * 60_000;
 /**
  * Commit-lock wait only. Gather already has per-provider timeouts, and automatic
  * callers fail fast and defer (ConvergeRequest.mode) rather than holding the
@@ -37,6 +38,7 @@ const MAX_JOURNAL_BYTES = 1024 * 1024;
 const MAX_CATALOG_BYTES = 64 * 1024 * 1024;
 
 let timer: ReturnType<typeof setInterval> | null = null;
+let initialTimer: ReturnType<typeof setTimeout> | null = null;
 let detachShutdownHook: (() => void) | null = null;
 /** The bounded cadence the live timer was created with, so a tick can notice config drift. */
 let liveIntervalMs: number | null = null;
@@ -170,8 +172,10 @@ function boundedInterval(value: number): number {
 /** Re-arm the timer when the operator changed the cadence since it was created. */
 function restartIfCadenceChanged(configured: number): void {
   if (timer === null || boundedInterval(configured) === liveIntervalMs) return;
-  stopCatalogAutoRefresh();
-  startCatalogAutoRefresh(configured);
+  clearInterval(timer);
+  liveIntervalMs = boundedInterval(configured);
+  timer = setInterval(() => void tick(), liveIntervalMs);
+  timer.unref?.();
 }
 
 async function tick(): Promise<void> {
@@ -199,6 +203,13 @@ async function tick(): Promise<void> {
     // and the unref'd timer is left running so flipping the minutes back on is
     // picked up without a process restart.
     if (configured === 0) return;
+    // The default-on case belongs to installs whose local Codex client this proxy manages. With
+    // the integration off (or on a hub or sibling), an absent section keeps the old opt-in
+    // meaning: no background converge may write the native Codex home unasked. An explicit
+    // `enabled: true` still refreshes, as it did before the default flipped.
+    const { shouldSyncCodexOnStart } = await import("./desired-state");
+    const codexManaged = shouldSyncCodexOnStart(config);
+    if (!codexManaged && config.catalogAutoRefresh?.enabled !== true) return;
     // A stop or restart landed while the config resolved: this tick no longer owns the timer,
     // so it must neither count as a refresh nor adopt a cadence for a generation that is gone.
     if (entryGeneration !== generation) return;
@@ -218,6 +229,12 @@ async function tick(): Promise<void> {
     } else if (heal === "not-healed") {
       console.info("[catalog-auto-refresh] injected Codex config keys were rewritten externally; not re-injected this tick");
     }
+    const { refreshCatalogAutoRefreshSources, catalogAutoRefreshReloadRequired } =
+      await import("./catalog-auto-refresh-sources");
+    if (entryGeneration !== generation) return;
+    // Codex sources read Codex credentials and probe its binary; only a managed client needs them.
+    if (codexManaged) await refreshCatalogAutoRefreshSources(config, () => entryGeneration === generation);
+    if (entryGeneration !== generation) return;
     const [{ createManagementConvergeCodex }, { createCatalogConvergeRequest }] = await Promise.all([
       import("./management-convergence"),
       import("./catalog-admission"),
@@ -231,11 +248,16 @@ async function tick(): Promise<void> {
     // createManagementConvergeCodex always projects catalog-only. Any other kind is a
     // funnel contract break, not something this scheduler should re-classify.
     if (outcome.kind !== "catalog-only") return;
-    const { recordCatalogAutoRefreshOutcome } = await import("./catalog-refresh-status");
-    recordCatalogAutoRefreshOutcome(outcome.catalogRefresh, outcome.changed);
+    const { recordCatalogAutoRefreshOutcome, lastCatalogAutoRefreshOutcome } = await import("./catalog-refresh-status");
+    const reloadRequired = (outcome.changed || lastCatalogAutoRefreshOutcome()?.reloadRequired === true)
+      ? await catalogAutoRefreshReloadRequired(outcome.changed) : false;
+    if (entryGeneration !== generation) return;
+    recordCatalogAutoRefreshOutcome(outcome.catalogRefresh, outcome.changed, reloadRequired);
     if (outcome.changed) {
       // Privacy scan: no provider names, model ids, paths, or account identifiers.
-      console.info("[catalog-auto-refresh] served model set changed");
+      console.info(reloadRequired
+        ? "[catalog-auto-refresh] served model set changed; running Codex sessions keep the old list until restarted (ocx sync --restart-codex)"
+        : "[catalog-auto-refresh] served model set changed");
     }
   } catch {
     // A failed refresh is not an error worth surfacing: the next tick tries again.
@@ -253,8 +275,16 @@ export function startCatalogAutoRefresh(intervalMs = DEFAULT_INTERVAL_MS): void
   timer = setInterval(() => void tick(), bounded);
   // Never keep the process alive for a catalog refresh.
   timer.unref?.();
+  const startedGeneration = generation;
+  initialTimer = setTimeout(() => {
+    if (startedGeneration !== generation) return;
+    initialTimer = null;
+    return tick();
+  }, INITIAL_DELAY_MS);
+  initialTimer.unref?.();
   void import("../lib/optional-shutdown-hooks")
     .then(hooks => {
+      if (startedGeneration !== generation) return;
       detachShutdownHook = hooks.registerOptionalShutdownHook(
         "catalog-auto-refresh",
         stopCatalogAutoRefresh,
@@ -266,6 +296,10 @@ export function startCatalogAutoRefresh(intervalMs = DEFAULT_INTERVAL_MS): void
 }
 
 export function stopCatalogAutoRefresh(): void {
+  if (initialTimer) {
+    clearTimeout(initialTimer);
+    initialTimer = null;
+  }
   if (timer) {
     clearInterval(timer);
     timer = null;
@@ -290,7 +324,9 @@ export function isCatalogAutoRefreshRunning(): boolean {
  * microtasks before this settles.
  */
 export async function syncCatalogAutoRefreshCadence(): Promise<void> {
+  const entryGeneration = generation;
   const { loadConfig, resolveCatalogAutoRefreshIntervalMs } = await import("../config");
+  if (entryGeneration !== generation) return;
   const configured = resolveCatalogAutoRefreshIntervalMs(loadConfig());
   // 0 is dormant: tick() already returns before converging, and the timer stays unref'd.
   if (configured === 0) return;

package/src/codex/catalog-refresh-status.ts

@@ -108,6 +108,7 @@ export interface CatalogAutoRefreshOutcome {
   readonly at: number;
   readonly disposition: CatalogDisposition;
   readonly changed: boolean;
+  readonly reloadRequired: boolean;
   /**
    * A refresh that has failed repeatedly is the signal an operator needs, and the
    * boolean disposition alone cannot express it: skipped and failed look the same
@@ -158,6 +159,7 @@ function freezeCatalogAutoRefreshOutcome(
     at: outcome.at,
     disposition: freezeCatalogDisposition(outcome.disposition),
     changed: outcome.changed,
+    reloadRequired: outcome.reloadRequired,
     consecutiveFailures: outcome.consecutiveFailures,
   });
 }
@@ -171,6 +173,7 @@ function freezeCatalogAutoRefreshOutcome(
 export function recordCatalogAutoRefreshOutcome(
   disposition: CatalogDisposition,
   changed: boolean,
+  reloadRequired = false,
 ): CatalogAutoRefreshOutcome | null {
   const normalized = normalizeCatalogDisposition(disposition);
   if (normalized === null) return null;
@@ -181,6 +184,7 @@ export function recordCatalogAutoRefreshOutcome(
     at: Date.now(),
     disposition: normalized,
     changed: changed === true,
+    reloadRequired: reloadRequired === true,
     consecutiveFailures,
   });
   lastAutoRefreshOutcome = outcome;

package/src/codex/credits.ts

@@ -0,0 +1,86 @@
+import type { OcxConfig } from "../types";
+
+/** Display-only WHAM observation, never persisted or used for routing. */
+export interface CodexCredits {
+  hasCredits?: boolean;
+  unlimited?: boolean;
+  overageLimitReached?: boolean;
+  balance?: string;
+  approxLocalMessages?: [number, number];
+  approxCloudMessages?: [number, number];
+}
+
+/**
+ * An entry without `credits` means "this identity was observed and reported nothing to show".
+ * Keeping that apart from "never observed" lets the account listing bypass the persisted quota
+ * cache exactly once per identity after a restart, instead of on every dashboard poll.
+ */
+const observations = new Map<string, { identity: string; credits?: CodexCredits }>();
+
+function messageRange(raw: unknown): [number, number] | undefined {
+  return Array.isArray(raw) && raw.length === 2
+    && raw.every(value => typeof value === "number" && Number.isFinite(value) && value >= 0)
+    ? [raw[0], raw[1]] : undefined;
+}
+
+/** Undefined keeps the prior observation; null or unusable input clears it. */
+export function parseCodexCredits(raw: unknown): CodexCredits | null | undefined {
+  if (raw === undefined) return undefined;
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
+  const value = raw as Record<string, unknown>;
+  const credits: CodexCredits = {};
+  if (typeof value.has_credits === "boolean") credits.hasCredits = value.has_credits;
+  if (typeof value.unlimited === "boolean") credits.unlimited = value.unlimited;
+  if (typeof value.overage_limit_reached === "boolean") credits.overageLimitReached = value.overage_limit_reached;
+  if (typeof value.balance === "string" && /^\d+(\.\d+)?$/.test(value.balance)) credits.balance = value.balance;
+  else if (typeof value.balance === "number" && Number.isFinite(value.balance) && value.balance >= 0) {
+    // String(1e-7) is "1e-7"; the DTO promises a plain decimal string, which the GUI validates.
+    credits.balance = value.balance.toLocaleString("en-US", { useGrouping: false, maximumFractionDigits: 20 });
+  }
+  const local = messageRange(value.approx_local_messages);
+  const cloud = messageRange(value.approx_cloud_messages);
+  if (local) credits.approxLocalMessages = local;
+  if (cloud) credits.approxCloudMessages = cloud;
+  return Object.keys(credits).length > 0 ? credits : null;
+}
+
+export function rememberCodexCredits(accountId: string, identity: string, parsed: CodexCredits | null | undefined): void {
+  const previous = observations.get(accountId);
+  if (parsed === undefined) {
+    // Omission keeps a same-identity observation; otherwise it still records that this identity
+    // answered, so the listing stops forcing fresh reads for it.
+    if (previous?.identity !== identity) observations.set(accountId, { identity });
+    return;
+  }
+  observations.set(accountId, parsed === null ? { identity } : { identity, credits: structuredClone(parsed) });
+}
+
+export function codexCreditsFor(accountId: string, identity: string | null): CodexCredits | undefined {
+  const observation = observations.get(accountId);
+  if (!observation) return undefined;
+  if (identity !== observation.identity) {
+    observations.delete(accountId);
+    return undefined;
+  }
+  return observation.credits ? structuredClone(observation.credits) : undefined;
+}
+
+/** Whether this identity has answered at least one usage read since the process started. */
+export function hasCodexCreditsObservation(accountId: string, identity: string | null): boolean {
+  const observation = observations.get(accountId);
+  return observation !== undefined && identity !== null && observation.identity === identity;
+}
+
+export function codexCreditsDtoField(config: Pick<OcxConfig, "showCodexCredits">, accountId: string, identity: string | null): { credits?: CodexCredits } {
+  const credits = codexCreditsFor(accountId, identity);
+  return config.showCodexCredits === true && credits ? { credits } : {};
+}
+
+export function pruneCodexCredits(liveAccountIds: Iterable<string>): void {
+  const live = new Set(liveAccountIds);
+  for (const id of observations.keys()) if (!live.has(id)) observations.delete(id);
+}
+
+export function resetCodexCreditsForTests(): void {
+  observations.clear();
+}

package/src/codex/main-account-hard-lock.ts

@@ -66,9 +66,9 @@ export function getMainAccountHardLockStatus(
   const windows = governingWindows(quota);
   const blocking = windows.filter(w => validPercent(w.percent) && w.percent >= MAIN_ACCOUNT_HARD_LOCK_PERCENT);
   if (blocking.length > 0) {
-    // The lock holds until every blocking window reads lower, so the earliest possible unlock is
+    // The lock holds until every blocking window reads lower or is authoritatively absent, so the earliest possible unlock is
     // the latest blocking reset. One blocking window without a future reset makes it unknowable.
-    // A predicted reset is not evidence of recovery either way: only a fresh lower reading releases.
+    // A predicted reset is not evidence of recovery; fresh lower usage or validated WHAM absence releases.
     const resets = blocking.map(w => resetTimestamp(w.resetAt));
     const resetAt = resets.every(r => r !== undefined && r > now) ? Math.max(...(resets as number[])) : undefined;
     return { enabled: true, state: "blocked", ...(resetAt !== undefined ? { resetAt } : {}) };

package/src/codex/model-entitlements.ts

@@ -20,6 +20,7 @@ import {
 } from "./catalog/native-models";
 import { loadPersistedCodexRuntime } from "./runtime";
 import { codexRuntimeStateEpoch } from "./runtime";
+import { recordDiscoveredNativeModels, validateDiscoveredNativeRows } from "./catalog/discovered-natives";
 import { pinnedNativeModelRows } from "./catalog/pinned-models";
 import { codexCredentialMutationEpoch } from "./credential-mutation-epoch";
 import {
@@ -650,6 +651,7 @@ function boundedAvailabilityMessage(message: string): string {
 
 /** Keep valid roster slugs while dropping malformed program and availability metadata. */
 function parseAccountModels(text: string): {
+  discoveredRows: Record<string, unknown>[];
   models: ReadonlySet<string>;
   accessProgramsByModel: ReadonlyMap<string, CodexAvailableAccessPrograms>;
   availabilityNuxByModel: ReadonlyMap<string, { message: string }>;
@@ -681,7 +683,8 @@ function parseAccountModels(text: string): {
       }
       return [row.slug];
     });
-    return { models: new Set(models), accessProgramsByModel, availabilityNuxByModel };
+    return { models: new Set(models), accessProgramsByModel, availabilityNuxByModel,
+      discoveredRows: validateDiscoveredNativeRows(payload.models) };
   } catch {
     return null;
   }
@@ -757,6 +760,7 @@ async function fetchAccountModels(
     if (!usable) {
       return unconfirmedAccountModels(credential, clientVersion, now, { kind: "parsed-empty" });
     }
+    recordDiscoveredNativeModels(parsed.discoveredRows, clientVersion, now);
     const hasUnknownGatedAbsence = [...ACCOUNT_GATED_NATIVE_MODEL_MINIMUM_CLIENT_VERSIONS]
       // Reachable only through tier 1, an inbound client_version below the floor. Every other
       // resolution is now structurally >= every recorded minimum, because the floor is the max
@@ -789,6 +793,123 @@ async function fetchAccountModels(
   }
 }
 
+/**
+ * Client version the discovery-only roster request claims.
+ *
+ * Upstream filters `/models` by client version AND by a rollout gate the row's own
+ * `minimal_client_version` does not describe: on 2026-09-30 `gpt-6.1-sol` carried
+ * `minimal_client_version: "0.153.0"` yet was served only to `client_version >= 0.159.0`, while the
+ * installed Codex was 0.158.0-alpha. Asking under the installed version (what the entitlement path
+ * must do, #2886) therefore could not see the model at all. Discovery asks as a client newer than
+ * any release so it sees the whole roster; this proxy already serves pinned rows to older
+ * clients, so the version only widens what we learn, never what an account may call.
+ */
+export const CODEX_ROSTER_DISCOVERY_CLIENT_VERSION = "99.0.0";
+
+export type CodexNativeRosterDiscoveryOutcome = "recorded" | "not-modified" | "unavailable";
+
+export interface CodexNativeRosterDiscoveryOptions extends Pick<
+  CodexModelEntitlementResolveOptions,
+  "credentials" | "fetcher" | "signal" | "now" | "nativeMainRefreshDependencies"
+> {
+  /** Checked right before publication; false means the caller's scheduler generation is gone. */
+  readonly isCurrent?: () => boolean;
+}
+
+/**
+ * Last ETag per credential identity, so an unchanged roster costs a 304 when upstream honours it.
+ * A 304 carries no rows and so cannot renew a discovery's last-seen time; a model visible only
+ * under the discovery version would then expire after its retention while still being served.
+ * The ETag is therefore used only within a day of the full fetch that earned it.
+ */
+const discoveryEtags = new Map<string, { etag: string; fetchedAt: number }>();
+const DISCOVERY_ETAG_MAX_AGE_MS = 24 * 60 * 60 * 1000;
+
+/**
+ * Background discovery of native rows this build does not pin, independent of entitlement.
+ *
+ * It never writes the entitlement cache: a roster fetched under the discovery version answers a
+ * different question than "may this client call this model", and letting it satisfy entitlement
+ * reads would reintroduce the cross-version leak #2548/#2886 closed. The first account that
+ * answers is enough to learn a row; whether a given account may call it stays with the
+ * entitlement path and, for ungated rows, with the upstream status the request receives.
+ */
+export async function discoverCodexNativeRoster(
+  config: Pick<OcxConfig, "codexAccounts">,
+  options: CodexNativeRosterDiscoveryOptions = {},
+): Promise<CodexNativeRosterDiscoveryOutcome> {
+  const fetcher = options.fetcher ?? fetch;
+  const run = async (excluded: ReadonlySet<string>, releaseMainLease?: () => void) => {
+    const credentials: CodexModelEntitlementCredentialSnapshot[] = [...(options.credentials ?? [])];
+    for (const accountId of options.credentials ? [] : normalizedCandidateAccountIds(config)) {
+      if (excluded.has(accountId)) continue;
+      const credential = await accountCredentialSnapshot(accountId, {
+        nativeMainRefreshDependencies: options.nativeMainRefreshDependencies,
+        signal: options.signal,
+      }).catch(() => null);
+      if (credential) credentials.push(credential);
+    }
+    releaseMainLease?.();
+    for (const credential of credentials) {
+      const outcome = await fetchDiscoveryRoster(credential, fetcher, options).catch(() => "unavailable" as const);
+      if (outcome !== "unavailable") return outcome;
+    }
+    return "unavailable" as const;
+  };
+  try {
+    return await withNativeMainCredentialAdmission(run);
+  } catch {
+    return "unavailable";
+  }
+}
+
+async function fetchDiscoveryRoster(
+  credential: CodexModelEntitlementCredentialSnapshot,
+  fetcher: typeof fetch,
+  options: Pick<CodexNativeRosterDiscoveryOptions, "signal" | "now" | "isCurrent">,
+): Promise<CodexNativeRosterDiscoveryOutcome> {
+  const controller = new AbortController();
+  const abort = () => controller.abort(options.signal?.reason);
+  options.signal?.addEventListener("abort", abort, { once: true });
+  const timer = setTimeout(() => controller.abort(new DOMException("Codex model discovery timed out", "TimeoutError")), MODEL_ROSTER_TIMEOUT_MS);
+  try {
+    const headers = new Headers({ Authorization: `Bearer ${credential.accessToken}`, Accept: "application/json" });
+    if (credential.chatgptAccountId) headers.set("ChatGPT-Account-Id", credential.chatgptAccountId);
+    const now = options.now ?? Date.now();
+    const cached = discoveryEtags.get(credential.credentialIdentity);
+    if (cached && now - cached.fetchedAt < DISCOVERY_ETAG_MAX_AGE_MS) headers.set("If-None-Match", cached.etag);
+    const response = await fetcher(codexModelsUrl(CODEX_ROSTER_DISCOVERY_CLIENT_VERSION), {
+      headers,
+      redirect: "error",
+      signal: controller.signal,
+    });
+    if (response.status === 304) return "not-modified";
+    if (!response.ok) return "unavailable";
+    const body = await readBoundedResponseBody(response, {
+      signal: controller.signal,
+      maxBytes: MODEL_ROSTER_MAX_BYTES,
+      fatalUtf8: true,
+    });
+    if (!body.displaySafe || body.truncated) return "unavailable";
+    const parsed = parseAccountModels(body.text);
+    if (parsed === null || parsed.models.size === 0) return "unavailable";
+    if (controller.signal.aborted || options.isCurrent?.() === false) return "unavailable";
+    recordDiscoveredNativeModels(parsed.discoveredRows, CODEX_ROSTER_DISCOVERY_CLIENT_VERSION, now);
+    const nextEtag = response.headers.get("etag");
+    if (nextEtag && nextEtag.length <= 256) discoveryEtags.set(credential.credentialIdentity, { etag: nextEtag, fetchedAt: now });
+    else discoveryEtags.delete(credential.credentialIdentity);
+    if (discoveryEtags.size > 64) discoveryEtags.delete(discoveryEtags.keys().next().value!);
+    return "recorded";
+  } finally {
+    clearTimeout(timer);
+    options.signal?.removeEventListener("abort", abort);
+  }
+}
+
+export function resetCodexNativeRosterDiscoveryForTests(): void {
+  discoveryEtags.clear();
+}
+
 function directCallerCredential(headers: Headers): CodexModelEntitlementCredentialSnapshot | null {
   const match = /^Bearer\s+(\S+)$/i.exec(headers.get("authorization")?.trim() ?? "");
   if (!match) return null;

package/src/codex/quota-types.ts

@@ -118,6 +118,7 @@ export type WhamUsageResponse = {
     secondary_window?: WhamUsageWindow | null;
     tertiary_window?: WhamUsageWindow | null;
   };
+  credits?: unknown;
   rate_limit_reset_credits?: { available_count: number } | null;
   additional_rate_limits?: WhamAdditionalRateLimit[] | null;
 };

package/src/codex/quota.ts

@@ -827,8 +827,8 @@ function filterMainPolicyMonthlyQuota(
 
 /**
  * Parse ordinary main-policy usage, rejecting messages with invalid numeric window percentages.
- * Mark a valid primary of at least 24h as replacement evidence only when both other windows
- * are explicitly null or at least 24h. A null result supplies no usable policy observation.
+ * A measured long primary, or explicitly absent primary with measured weekly secondary,
+ * proves replacement only with complete long/null topology. Null supplies no usable evidence.
  */
 export function parseMainPolicyUsageQuota(data: WhamUsageResponse): MainPolicyQuotaObservation | null {
   const windows = [data.rate_limit?.primary_window, data.rate_limit?.secondary_window, data.rate_limit?.tertiary_window];
@@ -840,7 +840,8 @@ export function parseMainPolicyUsageQuota(data: WhamUsageResponse): MainPolicyQu
   // carries a valid usage reading: a long window without used_percent leaves that
   // window's usage unknown, and unknown usage must never release a block.
   // Headers never supply this proof, and reset time alone still cannot release a block.
-  if (quota && normalizeUsagePercent(primary?.used_percent) !== undefined && isExplicitLongWindow(primary)
+  if (quota && (isMeasuredLongWindow(primary)
+      || (primary === null && isMeasuredLongWindow(secondary) && quota.weeklyPercent !== undefined))
     && (secondary === null || isMeasuredLongWindow(secondary))
     && (tertiary === null || isMeasuredLongWindow(tertiary))) {
     return { ...quota, shortWindowAbsent: true };

package/src/codex/shim-probe.ts

@@ -146,9 +146,12 @@ function finishAfterStderr(status) {
 }
 
 try {
+  // BUN_BE_BUN selects the supervisor's interpreter mode, not the saved launcher.
+  const launcherEnv = { ...process.env };
+  delete launcherEnv.BUN_BE_BUN;
   launcher = spawn(launcherShellPath, [wrapperPath, "--version"], {
     detached: true,
-    env: process.env,
+    env: launcherEnv,
     stdio: ["ignore", "ignore", "pipe", "pipe"],
   });
   if (!launcher.pid) throw new Error("Codex shim probe launcher has no pid");
@@ -252,6 +255,7 @@ function probeUnixShimInstall(wrapperPath: string): UnixShimProbeResult {
   const stderrPath = join(probeDir, "stderr");
   const env: NodeJS.ProcessEnv = {
     ...process.env,
+    BUN_BE_BUN: "1",
     OCX_SHIM_BYPASS: "1",
     OCX_SHIM_PROBE: "1",
     OCX_SHIM_PROBE_REENTRY_PATH: reentryPath,

package/src/codex/shim-templates.ts

@@ -1,6 +1,7 @@
 import { BUN_RUNTIME_PATH_ENV, BUN_RUNTIME_SOURCE_ENV } from "../lib/bun-runtime";
 import type { BunRuntimeSource } from "../lib/bun-runtime";
 import { serviceApiTokenFilePath } from "../lib/service-secrets";
+import { selfLaunchArgv } from "../lib/self-launch-argv";
 import { windowsEnvIndirectBatchValue } from "../lib/win-paths";
 
 const SHIM_MARKER = "opencodex codex autostart shim";
@@ -83,6 +84,8 @@ function shQuote(value: string): string {
 export function buildUnixCodexShim(realCodexPath: string, bunPath: string, cliPath: string, bunRuntimeSource: BunRuntimeSource, tokenFile = serviceApiTokenFilePath()): string {
   const internalCommands = CODEX_INTERNAL_COMMANDS.join("|");
   const valueOptions = CODEX_GLOBAL_OPTIONS_WITH_VALUE.join("|");
+  const cliArgs = selfLaunchArgv([], { sourceEntrypoint: cliPath, isStandaloneExecutable: bunRuntimeSource === "standalone" })
+    .map(arg => `${shQuote(arg)} `).join("");
   return `#!/usr/bin/env sh
 # ${SHIM_MARKER}
 # ${UNIX_SHIM_REVISION_MARKER}
@@ -154,7 +157,7 @@ case "$ocx_subcommand" in
     ;;
   *)
     if [ -z "$OCX_SHIM_BYPASS" ]; then
-      if ! ${BUN_RUNTIME_SOURCE_ENV}=${shQuote(bunRuntimeSource)} ${BUN_RUNTIME_PATH_ENV}=${shQuote(bunPath)} ${shQuote(bunPath)} ${shQuote(cliPath)} ensure >/dev/null 2>&1; then
+      if ! ${BUN_RUNTIME_SOURCE_ENV}=${shQuote(bunRuntimeSource)} ${BUN_RUNTIME_PATH_ENV}=${shQuote(bunPath)} ${shQuote(bunPath)} ${cliArgs}ensure >/dev/null 2>&1; then
         printf '%s\\n' ${shQuote(CODEX_SHIM_ENSURE_FAILED_DIAGNOSTIC)} >&2
       fi
     fi
@@ -184,12 +187,13 @@ function windowsBatchSet(name: string, value: string): string {
 export function buildWindowsCodexShim(realCodexPath: string, bunPath: string, cliPath: string, bunRuntimeSource: BunRuntimeSource): string {
   const internalCommandChecks = CODEX_INTERNAL_COMMANDS.map(command => `if /I "%~1"=="${command}" goto run_codex`).join("\r\n");
   const valueOptionChecks = CODEX_GLOBAL_OPTIONS_WITH_VALUE.map(option => `if /I "%~1"=="${option}" goto skip_option_value`).join("\r\n");
+  const cliArgs = selfLaunchArgv([], { sourceEntrypoint: cliPath, isStandaloneExecutable: bunRuntimeSource === "standalone" });
   return `@echo off\r
 rem ${SHIM_MARKER}\r
 setlocal\r
 ${windowsBatchSet("OCX_REAL_CODEX", realCodexPath)}\r
 ${windowsBatchSet("OCX_BUN", bunPath)}\r
-${windowsBatchSet("OCX_CLI", cliPath)}\r
+${cliArgs.length ? windowsBatchSet("OCX_CLI", cliArgs[0]!) : ""}\r
 ${windowsBatchSet("OCX_API_TOKEN_FILE", serviceApiTokenFilePath())}\r
 if "%OPENCODEX_API_AUTH_TOKEN%"=="" if exist "%OCX_API_TOKEN_FILE%" set /p OPENCODEX_API_AUTH_TOKEN=<"%OCX_API_TOKEN_FILE%"\r
 if not "%OCX_SHIM_BYPASS%"=="" goto run_codex\r
@@ -216,7 +220,7 @@ goto scan_codex_args\r
 setlocal\r
 ${windowsBatchSet(BUN_RUNTIME_SOURCE_ENV, bunRuntimeSource)}\r
 ${windowsBatchSet(BUN_RUNTIME_PATH_ENV, bunPath)}\r
-"%OCX_BUN%" "%OCX_CLI%" ensure >nul 2>nul\r
+"%OCX_BUN%" ${cliArgs.length ? '"%OCX_CLI%" ' : ""}ensure >nul 2>nul\r
 if errorlevel 1 echo ${CODEX_SHIM_ENSURE_FAILED_DIAGNOSTIC} 1>&2\r
 endlocal\r
 :run_codex\r
@@ -232,6 +236,8 @@ export function buildWindowsPowerShellCodexShim(realCodexPath: string, bunPath:
   const internalCommands = CODEX_INTERNAL_COMMANDS.map(command => psString(command)).join(", ");
   const valueOptions = CODEX_GLOBAL_OPTIONS_WITH_VALUE.map(option => psString(option)).join(", ");
   const tokenFile = serviceApiTokenFilePath();
+  const cliArgs = selfLaunchArgv([], { sourceEntrypoint: cliPath, isStandaloneExecutable: bunRuntimeSource === "standalone" })
+    .map(arg => `${psString(arg)} `).join("");
   return `#!/usr/bin/env pwsh
 # ${SHIM_MARKER}
 $hadApiAuthToken = Test-Path Env:\\OPENCODEX_API_AUTH_TOKEN
@@ -263,7 +269,7 @@ if (-not $skipEnsure) {
   $ocxEnsureFailed = $false
   # Caught, not propagated: a throwing ensure used to escape this wrapper and Codex never
   # launched at all, which is a lockout produced by the autostart helper itself (#5261).
-  try { & ${psString(bunPath)} ${psString(cliPath)} ensure *> $null; if ($LASTEXITCODE -ne 0) { $ocxEnsureFailed = $true } }
+  try { & ${psString(bunPath)} ${cliArgs}ensure *> $null; if ($LASTEXITCODE -ne 0) { $ocxEnsureFailed = $true } }
   catch { $ocxEnsureFailed = $true }
   finally {
     if ($null -eq $priorRuntimeSource) { Remove-Item Env:\\${BUN_RUNTIME_SOURCE_ENV} -ErrorAction SilentlyContinue }

package/src/config/derived-registries.ts

@@ -1,3 +1,4 @@
+import { loadDiscoveredNativeModels } from "../codex/catalog/discovered-natives";
 import { setConfiguredNativeOpenAiModels } from "../codex/catalog/native-models";
 import { isCanonicalOpenAiForwardProvider, OPENAI_CODEX_PROVIDER_ID } from "../providers/openai-tiers-destination";
 import type { OcxConfig, OcxProviderConfig } from "../types";
@@ -20,10 +21,11 @@ export function configuredNativeOpenAiModelIds(config: Pick<OcxConfig, "provider
 
 /**
  * Rebuild every process-local registry derived from a committed config: user price overlays and
- * configured native GPT models. Called wherever a loaded, persisted or reconciled config becomes
- * current, so the two never disagree about which config is live.
+ * configured/discovered native GPT models. Called wherever loaded, persisted or reconciled
+ * config becomes current, so catalog registration follows the active config and OpenCodex home.
  */
 export function refreshConfigDerivedRegistries(config: OcxConfig): void {
   refreshUserCostOverlays(config);
   setConfiguredNativeOpenAiModels(configuredNativeOpenAiModelIds(config));
+  loadDiscoveredNativeModels();
 }

package/src/config/diagnostics.ts

@@ -455,6 +455,14 @@ function dropCodexSafetyBufferingError(value: unknown): string | null {
   return "schema_invalid: dropCodexSafetyBuffering: must be a boolean or omitted";
 }
 
+function showCodexCreditsError(value: unknown): string | null {
+  const raw = rawConfigRecord(value);
+  if (!raw || !Object.hasOwn(raw, "showCodexCredits")) return null;
+  const enabled = raw.showCodexCredits;
+  if (enabled === undefined || typeof enabled === "boolean") return null;
+  return "schema_invalid: showCodexCredits: must be a boolean or omitted";
+}
+
 function oauthOpenBrowserError(value: unknown): string | null {
   const raw = rawConfigRecord(value);
   if (!raw || !Object.hasOwn(raw, "oauthOpenBrowser")) return null;
@@ -645,6 +653,7 @@ export function validateConfigCandidate(value: unknown): { ok: true; config: Ocx
     ?? emptyCompletionRetryError(value)
     ?? dropCodexSafetyBufferingError(value)
     ?? oauthOpenBrowserError(value)
+    ?? showCodexCreditsError(value)
     ?? runtimeRoleError(value)
     ?? remoteGuiConfigError(value)
     ?? clientConnectionConfigError(value)

package/src/config/feature-flags.ts

@@ -18,7 +18,7 @@ export function metricsExportEnabled(config: Pick<OcxConfig, "metricsExport">):
 }
 
 /**
- * Default cadence for the opt-in catalog auto-refresh (issue #3630): one converge pass
+ * Default cadence for catalog auto-refresh (issue #3630): one converge pass
  * per hour. Each pass spends a live /models call against every enabled provider, and
  * provider catalogs are themselves cached upstream for minutes, so an hour is fresh
  * enough for newly released models to appear without an `ocx sync`.
@@ -33,15 +33,17 @@ export const CATALOG_AUTO_REFRESH_DEFAULT_INTERVAL_MS: number = 60 * 60_000;
 export const CATALOG_AUTO_REFRESH_MIN_INTERVAL_MS: number = 15 * 60_000;
 
 /**
- * Opt-in master switch, read with the house `=== true` idiom so an absent key and a
- * malformed one both mean off. Pure on purpose: the scheduler calls this from a
+ * Enabled by default; explicit false or a zero cadence disables background work.
+ * Malformed enabled values still mean off. Pure on purpose: the scheduler calls this from a
  * dynamically imported context, so it takes an explicit config slice and reads nothing
  * global.
  */
 export function isCatalogAutoRefreshEnabled(
   config: Pick<OcxConfig, "catalogAutoRefresh">,
 ): boolean {
-  return config.catalogAutoRefresh?.enabled === true;
+  const section = config.catalogAutoRefresh;
+  return (section?.enabled === undefined || section.enabled === true)
+    && section?.intervalMinutes !== 0;
 }
 
 /**

package/src/config/schema/config-schema.ts

@@ -196,6 +196,7 @@ export const configSchema = z.object({
   // A malformed hand edit must not silently stop opening the browser: fall back
   // to undefined, which resolves to the historical auto-open behavior.
   oauthOpenBrowser: z.boolean().optional().catch(undefined),
+  showCodexCredits: z.boolean().optional().catch(false),
   openaiProviderTierVersion: z.union([z.literal(1), z.literal(2)]).optional(),
   // Invalid hand edits must not discard an otherwise usable config.
   googleAntigravityStaticCatalogVersion: z.union([z.literal(1), z.literal(2)]).optional().catch(undefined),

package/src/config/schema/leaf-validators.ts

@@ -1058,6 +1058,7 @@ export const quotaResetNotifySchema = z.object({
 
 /**
  * Catalog auto-refresh section (issue #3630).
+ * Missing section or enabled flag uses the hourly default-on scheduler.
  *
  * `.strict()` like its neighbour: a typo in an optional feature section should surface as a
  * rejected write rather than a silently ignored key that leaves the operator believing they