@bitkyc08/opencodex 2.82.0 → 2.84.0

package/src/clients/config-export/zcode-store.ts

@@ -1,6 +1,6 @@
 // ZCode personal provider store export.
 import type { ExportContext, ManagedContribution, ManagedFragment } from "./contracts";
-import { authoritativeContextWindow, inputModalitiesForClient, normalizeExportModels } from "./model-metadata";
+import { authoritativeContextWindow, inputModalitiesForClient, normalizeExportModels, zcodeSelectableEfforts } from "./model-metadata";
 import { OPENCODE_PROVIDER_ID, LOOPBACK_API_KEY_PLACEHOLDER } from "./constants";
 import { formatSelectorConjunction } from "../../integrations/merge";
 
@@ -49,10 +49,30 @@ export interface ZcodeStoreProviderRule {
   };
 }
 
+/**
+ * One model rule, as the client's own store loader accepts it.
+ *
+ * The capability fields are the client's schema, not ours: ZCode 3.14's CLI
+ * bundle parses each `providerModelRules` entry with a strict object whose
+ * `config.properties` admits `inputFormat.{supportsText..supportsPdf}` (booleans)
+ * and whose `config.optionSpecs` admits `reasoningLevel.values` (non-empty,
+ * deduplicated) plus an optional compiled `map`. With no `map`, the chosen level
+ * is validated against `values` and forwarded verbatim to the wire field the
+ * `openai-responses` api type uses — `reasoning.effort`, which is exactly the
+ * Codex vocabulary our ladder already carries, so no mapping is emitted.
+ */
 export interface ZcodeStoreModelRule {
   providerId: string;
   modelId: string;
-  config: { properties: { contextWindow: number } };
+  config: {
+    properties: {
+      contextWindow?: number;
+      inputFormat?: { supportsImage: true };
+    };
+    optionSpecs?: {
+      reasoningLevel: { values: string[] };
+    };
+  };
 }
 
 /**
@@ -77,7 +97,7 @@ export function zcodeStoreSchemaEstablished(parsed: unknown): boolean {
  * carrying only the model would match another provider's rule for the same
  * model. The conjunction grammar reserves `,` and `]`, and a model id holding
  * either cannot be addressed unambiguously — that row ships without its
- * context window rather than with a selector that points somewhere else.
+ * model rule rather than with a selector that points somewhere else.
  */
 function modelRuleSelector(modelId: string): string | null {
   return formatSelectorConjunction([
@@ -128,12 +148,18 @@ export function buildZcodeStoreProviderRule(ctx: ExportContext): ZcodeStoreProvi
 
 /**
  * Everything this project owns inside the store: one provider rule, plus one
- * model rule per row that has an authoritative context window.
+ * model rule per row that has anything authoritative to assert.
  *
- * A row without one ships no model rule at all, which is the same
- * authoritative-window rule the legacy block follows — an emitted stand-in
- * would be a guessed capability. Reasoning ladders have no counterpart here
- * that this project has observed the client produce, so none is written.
+ * A model rule now exists when the row has any of: an authoritative context
+ * window, image input, or a selectable effort ladder. A row with none of the
+ * three ships no rule at all, which is the same no-guessed-capability rule the
+ * legacy block follows. Image input is asserted only when the catalog declares
+ * it — `supportsImage: true` is what gates the client's attachment UI, and a
+ * text-only row keeps the client's own defaults rather than being pinned to
+ * `false`. `reasoningLevel.values` carries the same ladder (minus the `none`
+ * sentinel) the legacy block's `reasoning.variants` carries, so both surfaces
+ * offer the picker the catalog declared instead of the store silently losing
+ * reasoning and vision the way #5348 lost the provider itself.
  */
 export function buildZcodeStoreContribution(ctx: ExportContext): ManagedContribution {
   const fragments: ManagedFragment[] = [{
@@ -141,15 +167,24 @@ export function buildZcodeStoreContribution(ctx: ExportContext): ManagedContribu
     value: buildZcodeStoreProviderRule(ctx),
   }];
   for (const model of normalizeExportModels(ctx.models)) {
-    if (inputModalitiesForClient("pi", model.inputModalities) === null) continue;
+    const input = inputModalitiesForClient("pi", model.inputModalities);
+    if (input === null) continue;
     const contextWindow = authoritativeContextWindow(model.contextWindow);
-    if (contextWindow === undefined) continue;
+    const supportsImage = input.includes("image");
+    const efforts = zcodeSelectableEfforts(model.reasoningEfforts);
+    if (contextWindow === undefined && !supportsImage && efforts === undefined) continue;
     const selector = modelRuleSelector(model.namespaced);
     if (selector === null) continue;
     const rule: ZcodeStoreModelRule = {
       providerId: OPENCODE_PROVIDER_ID,
       modelId: model.namespaced,
-      config: { properties: { contextWindow } },
+      config: {
+        properties: {
+          ...(contextWindow !== undefined ? { contextWindow } : {}),
+          ...(supportsImage ? { inputFormat: { supportsImage: true } } : {}),
+        },
+        ...(efforts !== undefined ? { optionSpecs: { reasoningLevel: { values: efforts } } } : {}),
+      },
     };
     fragments.push({ path: [...ZCODE_STORE_MODEL_RULES_PATH, selector], value: rule });
   }

package/src/clients/config-export/zcode.ts

@@ -1,7 +1,6 @@
 // ZCode config export.
 import type { ExportContext, ManagedContribution } from "./contracts";
-import { normalizeExportModels, inputModalitiesForClient, exportModelLabel, authoritativeContextWindow, singleFragment } from "./model-metadata";
-import { sanitizeCodexReasoningEfforts } from "../../reasoning-effort";
+import { normalizeExportModels, inputModalitiesForClient, exportModelLabel, authoritativeContextWindow, singleFragment, zcodeSelectableEfforts } from "./model-metadata";
 import { OPENCODE_PROVIDER_ID, LOOPBACK_API_KEY_PLACEHOLDER } from "./constants";
 
 
@@ -86,9 +85,8 @@ export function buildZcodeClientConfig(ctx: ExportContext): ZcodeGeneratedConfig
     // `ultra` when present: ZCode forwards the selected variant to the wire field its
     // kind uses — `reasoning.effort` on `openai`, which is what `/v1/responses` reads
     // natively. Set `defaultVariant` only when it survives that filter.
-    const efforts = sanitizeCodexReasoningEfforts(model.reasoningEfforts)
-      ?.filter(effort => effort !== "none");
-    if (efforts && efforts.length > 0) {
+    const efforts = zcodeSelectableEfforts(model.reasoningEfforts);
+    if (efforts !== undefined) {
       const defaultVariant = model.defaultReasoningEffort?.trim().toLowerCase();
       entry.reasoning = {
         enabled: true,

package/src/clients/config-export.ts

@@ -470,20 +470,51 @@ export function mcodeConfigPath(env: OpencodeLaunchEnv = process.env, home: stri
   return join(mcodeHomeDir(env, home), "config.yaml");
 }
 
-/**
- * ZCode (Z.ai's desktop client) keeps everything under `~/.zcode`; custom
- * providers live in `v2/config.json`. `ZCODE_DATA_DIR` mirrors the other
- * clients' override convention; relative overrides are refused for the same
- * reason as MCode's.
- */
-export function zcodeHomeDir(env: OpencodeLaunchEnv = process.env, home: string = homedir()): string {
-  const override = env.ZCODE_DATA_DIR?.trim();
-  if (override) return absoluteClientPath(override, home, "ZCODE_DATA_DIR");
-  return join(home, ".zcode");
+/** Bootstrap settings always stay at the default home, even after relocation. */
+export type ZcodePathIO = {
+  readText: (path: string) => { kind: "text"; text: string } | { kind: "missing" } | { kind: "failed"; code?: string };
+};
+const zcodePathIO: ZcodePathIO = {
+  readText: path => {
+    try { return { kind: "text", text: readFileSync(path, "utf8") }; }
+    catch (error) { return (error as NodeJS.ErrnoException).code === "ENOENT" ? { kind: "missing" } : { kind: "failed" }; }
+  },
+};
+export class ZcodeSettingsPathError extends ClientPathError {}
+
+export function zcodeBootstrapSettingsPath(home: string = homedir()): string {
+  return join(home, ".zcode", "v2", "setting.json");
 }
 
-export function zcodeConfigPath(env: OpencodeLaunchEnv = process.env, home: string = homedir()): string {
-  return join(zcodeHomeDir(env, home), "v2", "config.json");
+/** The pre-relocation path is retained solely to recognize historical ownership. */
+export function zcodeLegacyHomeDir(env: OpencodeLaunchEnv = process.env, home: string = homedir()): string {
+  const override = env.ZCODE_DATA_DIR?.trim();
+  return override ? absoluteClientPath(override, home, "ZCODE_DATA_DIR") : join(home, ".zcode");
+}
+
+/** ZCODE_DATA_DIR names the .zcode root; dataBaseDir names its parent. */
+export function zcodeHomeDir(env: OpencodeLaunchEnv = process.env, home: string = homedir(), io: ZcodePathIO = zcodePathIO): string {
+  if (env.ZCODE_DATA_DIR?.trim()) return zcodeLegacyHomeDir(env, home);
+  const bootstrap = zcodeBootstrapSettingsPath(home);
+  const read = io.readText(bootstrap);
+  if (read.kind === "missing") return join(home, ".zcode");
+  const unknown = () => new ZcodeSettingsPathError(
+    `ZCode's active data root is unknown: ${bootstrap} must be readable JSON with an absolute dataBaseDir (or no dataBaseDir). Repair the bootstrap setting before enabling or refreshing; no legacy provider will be applied.`,
+  );
+  if (read.kind !== "text") throw unknown();
+  let settings: unknown;
+  try { settings = JSON.parse(read.text); } catch { throw unknown(); }
+  if (settings === null || typeof settings !== "object" || Array.isArray(settings)) throw unknown();
+  const base = (settings as Record<string, unknown>).dataBaseDir;
+  if (base === undefined) return join(home, ".zcode");
+  // Match the native path's value, without cwd or tilde expansion. The native
+  // ZCODE_DATA_BASE_DIR selector is not an alias for our ZCODE_DATA_DIR.
+  if (typeof base !== "string" || !isAbsolute(base) || base.includes("\0")) throw unknown();
+  return join(base, ".zcode");
+}
+
+export function zcodeConfigPath(env: OpencodeLaunchEnv = process.env, home: string = homedir(), io?: ZcodePathIO): string {
+  return join(zcodeHomeDir(env, home, io), "v2", "config.json");
 }
 
 /**
@@ -532,8 +563,7 @@ export function commandCodeConfigPath(env: OpencodeLaunchEnv = process.env, home
  * an install that has ever run, the import has already happened and never runs
  * again — every later write to `v2/config.json` is read by nobody (#5348).
  *
- * This project does not write this file; it names it so the integration can
- * tell whether its own write can still reach the client. The env override is
+ * The integration writes this store through its existing schema-aware writer. The env override is
  * ZCode's own (`ZCODE_PERSONAL_PROVIDER_CONFIG_FILE`), so an operator who
  * relocated the store is measured against the file their client actually opens
  * rather than the default location. A relative override is refused for the same
@@ -541,10 +571,10 @@ export function commandCodeConfigPath(env: OpencodeLaunchEnv = process.env, home
  * which file it names, and here that disagreement decides whether an apply is
  * reported as effective.
  */
-export function zcodeProviderStorePath(env: OpencodeLaunchEnv = process.env, home: string = homedir()): string {
+export function zcodeProviderStorePath(env: OpencodeLaunchEnv = process.env, home: string = homedir(), io?: ZcodePathIO): string {
   const override = env.ZCODE_PERSONAL_PROVIDER_CONFIG_FILE?.trim();
   if (override) return absoluteClientPath(override, home, "ZCODE_PERSONAL_PROVIDER_CONFIG_FILE");
-  return join(zcodeHomeDir(env, home), "v2", "provider_config.json");
+  return join(zcodeHomeDir(env, home, io), "v2", "provider_config.json");
 }
 
 /**
@@ -1367,7 +1397,7 @@ function buildAsideContribution(ctx: ExportContext): ManagedContribution {
  * the keyed `providers`, the `models` ARRAY whose identity is `id`, the
  * `openai-completions` dialect, the loopback placeholder, and the
  * `thinkingLevelMap` levels. Evidence:
- * `devlog/_plan/260912_omo_client_integration/001_omo_contract.md`.
+ * `devlog/_fin/260912_omo_client_integration/001_omo_contract.md`.
  *
  * The flag is passed HERE as well as in the spec's `build`, which is the one
  * thing Prime and Aside do not do. They pass the default on both paths, so they

package/src/clients/omo-role-models.ts

@@ -120,10 +120,13 @@ function serialize(text: string, doc: JsonObject): string {
 /**
  * `reasoning` left undefined keeps the entry's level; null removes it, so a level LazyCodex cannot
  * express does not leave a stale one behind for its next install to apply.
+ * `model` left undefined keeps the entry's model, so an effort-only save of a role that inherits
+ * its model never adds a pin here. LazyCodex declares both keys optional, so an entry may carry
+ * `reasoning` alone; an absent entry is created only when there is a value to put in it.
  */
 export function writeOmoRoleModel(
   role: string,
-  model: string,
+  model: string | undefined,
   path: string = omoJsoncPath(),
   reasoning?: string | null,
 ): OmoRoleModelWriteStatus {
@@ -137,10 +140,10 @@ export function writeOmoRoleModel(
   if (!isObject(agents)) return "invalid";
   const entry = agents[role] === undefined ? {} : agents[role];
   if (!isObject(entry)) return "invalid";
-  const next: JsonObject = { ...entry, model };
+  const next: JsonObject = model === undefined ? { ...entry } : { ...entry, model };
   if (reasoning === null) delete next.reasoning;
   else if (reasoning !== undefined) next.reasoning = reasoning;
-  if (entry.model === model && entry.reasoning === next.reasoning) return "unchanged";
+  if (entry.model === next.model && entry.reasoning === next.reasoning) return "unchanged";
   agents[role] = next;
   codex.agents = agents;
   doc[CODEX_SECTION] = codex;

package/src/codex/agent-role-models.ts

@@ -1,11 +1,12 @@
 /**
- * The dashboard's write of one Codex agent role's model, and optionally its reasoning effort.
+ * The dashboard's write of one Codex agent role's model, its reasoning effort, or both.
  *
  * Codex overrides the spawn-time model with the root `model` pin in
  * `$CODEX_HOME/agents/<role>.toml`, so that pin is what decides a child's model. This module
- * edits exactly that value, plus the root `model_reasoning_effort` when a caller passes one, and
- * nothing else: every other byte of the file, including the instructions multiline string that
- * usually mentions `model =` in prose, is left as it was.
+ * edits exactly that value when a caller passes a model, plus the root `model_reasoning_effort`
+ * when a caller passes an effort, and nothing else: every other byte of the file, including the
+ * instructions multiline string that usually mentions `model =` in prose, is left as it was. An
+ * omitted model leaves the pin as it is, so a role that inherits its model keeps inheriting it.
  * It runs only on an explicit user action; no sync or startup path calls it.
  */
 import { lstatSync, readFileSync } from "node:fs";
@@ -97,6 +98,21 @@ export function setTomlRootReasoningEffort(content: string, effort: string): str
   return setTomlRootString(content, locateTomlReasoningEffortKey(content), "model_reasoning_effort", effort);
 }
 
+export function removeTomlRootReasoningEffort(content: string): string {
+  const location = locateTomlReasoningEffortKey(content);
+  if (!location?.inRootTable) return content;
+  if (!location.span) {
+    throw new AgentRoleModelError("unsupported_model_value", "the existing model_reasoning_effort value is not a one-line string");
+  }
+  const lines = content.split("\n");
+  // A terminated line goes with its own newline. An unterminated last line is emptied instead,
+  // so the previous line keeps its terminator (and its \r in a CRLF file).
+  if (location.line < lines.length - 1) lines.splice(location.line, 1);
+  else lines[location.line] = "";
+  const bom = location.line === 0 && content.startsWith("\ufeff") ? "\ufeff" : "";
+  return bom + lines.join("\n");
+}
+
 export function readCodexAgentRoleEffort(role: string, codexHome: string): string | null {
   try {
     const location = locateTomlReasoningEffortKey(readFileSync(roleFile(role, codexHome), "utf8"));
@@ -148,9 +164,9 @@ function assertValidRoleToml(role: string, text: string, stage: "before" | "afte
 
 export function writeCodexAgentRoleModel(
   role: string,
-  model: string,
+  model: string | undefined,
   codexHome: string,
-  effort?: string,
+  effort?: string | null,
 ): { status: "written" | "unchanged" } {
   requireKnownRole(role, codexHome);
   const path = roleFile(role, codexHome);
@@ -159,10 +175,12 @@ export function writeCodexAgentRoleModel(
   }
   const before = readFileSync(path, "utf8");
   assertValidRoleToml(role, before, "before");
-  const withModel = setTomlRootModel(before, validateAgentRoleModel(model));
+  const withModel = model === undefined ? before : setTomlRootModel(before, validateAgentRoleModel(model));
   const after = effort === undefined
     ? withModel
-    : setTomlRootReasoningEffort(withModel, validateAgentRoleEffort(effort));
+    : effort === null
+      ? removeTomlRootReasoningEffort(withModel)
+      : setTomlRootReasoningEffort(withModel, validateAgentRoleEffort(effort));
   if (after === before) return { status: "unchanged" };
   assertValidRoleToml(role, after, "after");
   assertIntegrationWriteOwnership(path);

package/src/codex/auth-api/account-list.ts

@@ -33,6 +33,7 @@ import { fetchMainAccountInfoAttempt, EMPTY_MAIN_ACCOUNT_INFO, mainResetCreditsF
 import { fetchPoolAccountQuota, PoolQuotaProbeBusyError, POOL_QUOTA_REFRESH_CONCURRENCY } from "./pool-quota-probe";
 import type { PoolQuotaResult } from "./pool-quota-probe";
 import { getRuntimeConfig, configuredPoolAccount, mapWithConcurrency } from "./runtime-config";
+import { isPassiveRead } from "../../lib/passive-read";
 
 export function quotaForPlan<T extends Omit<StoredAccountQuota, "updatedAt"> | StoredAccountQuota | null>(
   quota: T,
@@ -274,13 +275,25 @@ export async function listCodexAuthAccountsSnapshot(
   pruneCodexCredits([MAIN_CODEX_ACCOUNT_ID, ...poolAccounts.map(account => account.id)]);
   // One redaction decision for the whole snapshot, read once from the operator's config (#3859).
   const maskEmails = emailMaskingEnabled(runtimeConfig);
-  const mainResult = await fetchMainAccountInfoAttempt(forceRefresh, 1, undefined, false,
-    forceRefresh, false, runtimeConfig);
+  // A passive read (a Remote Link Child's, #6959) reports what this machine already observed: no
+  // token refresh, no WHAM probe, and so none of the plan or credential writes they make.
+  const passive = isPassiveRead();
+  const mainResult: Awaited<ReturnType<typeof fetchMainAccountInfoAttempt>> = passive
+    ? { info: getMainAccountInfoCache() ?? EMPTY_MAIN_ACCOUNT_INFO, credentialChecked: false, hasCredential: false,
+      identityGeneration: captureMainAccountIdentityGeneration() }
+    : await fetchMainAccountInfoAttempt(forceRefresh, 1, undefined, false, forceRefresh, false, runtimeConfig);
   const refreshedPool = await mapWithConcurrency(poolAccounts, POOL_QUOTA_REFRESH_CONCURRENCY, async account => {
     const cred = getCodexAccountCredential(account.id);
     let quotaResult: PoolQuotaResult;
     if (!cred) {
       quotaResult = { quota: null, needsReauth: true };
+    } else if (passive) {
+      quotaResult = {
+        quota: getAccountQuota(account.id),
+        needsReauth: false,
+        credentialGeneration: readCodexAccountRecord(account.id)?.generation,
+        quotaProbeSkipped: true,
+      };
     } else {
       try {
         // Credits are process-local while pool quota is hydrated from disk, so right after a
@@ -410,6 +423,8 @@ export async function listCodexAuthAccountsSnapshot(
   };
   // Project the refusal and DTO in the same owned synchronous observation. A same-account grant
   // replacement during earlier pool probes must not inherit the previous grant's refusal.
+  // A passive read opens no claim database (its lock file is hardened on open).
+  if (passive) return projectSnapshot();
   const projectionLease = tryAcquireNativeMainProfileClaim();
   if (!projectionLease) return projectSnapshot();
   try {

package/src/codex/auth-api/account-selection.ts

@@ -6,11 +6,11 @@ import { deleteConfigTopLevelKey, fileBackedConfigPath, recordFileBackedConfig }
 import { MAIN_CODEX_ACCOUNT_ID, hasLegacyMainCodexPoolAccount, isSelectableCodexPoolAccount, isValidCodexAccountId } from "../account-id";
 import { isCodexAccountPaused } from "../account-pause";
 import { readCodexAccountRecord } from "../account-store";
-import { codexAccountPinDrainReason, resetCodexRoutingForManualSelection } from "../routing";
+import { codexAccountPinDrainReason, resetCodexRoutingForClearedSelection, resetCodexRoutingForManualSelection } from "../routing";
 import { jsonResponse } from "./http";
 
 class SelectionRejected extends Error {
-  constructor(message: string, readonly status: number) { super(message); }
+  constructor(message: string, readonly status: number, readonly code?: string) { super(message); }
 }
 
 function validateSelection(config: OcxConfig, accountId: string | null): void {
@@ -42,8 +42,14 @@ function applySelection(config: OcxConfig, accountId: string | null): boolean {
   return changed;
 }
 
+function validateExpectedPin(config: OcxConfig, expectedPinnedAccountId: string | undefined): void {
+  if (expectedPinnedAccountId !== undefined && config.activeCodexAccountPinned !== expectedPinnedAccountId) {
+    throw new SelectionRejected("The pin changed; reload accounts before releasing it", 409, "account_pin_changed");
+  }
+}
+
 /** A manual selection is an explicit command, even when equal to the live merge baseline. */
-export function persistCodexAccountSelection(config: OcxConfig, accountId: string | null): Response {
+export function persistCodexAccountSelection(config: OcxConfig, accountId: string | null, expectedPinnedAccountId?: string): Response {
   const unknown = () => jsonResponse({
     error: "Account selection could not be confirmed; reload settings before retrying",
     code: "account_selection_unavailable",
@@ -63,7 +69,9 @@ export function persistCodexAccountSelection(config: OcxConfig, accountId: strin
       const normalized = validateConfigCandidate(mergeConfigDefaults(config));
       if (!normalized.ok) return unknown();
       const initial = normalized.config;
-      applySelection(initial, accountId);
+      validateExpectedPin(initial, expectedPinnedAccountId);
+      // Conditional release must keep the baseline pin until the locked mutation checks it.
+      if (expectedPinnedAccountId === undefined) applySelection(initial, accountId);
       initializePersistedConfigIfMissing(initial);
     }
     const result = mutatePersistedConfig(persisted => {
@@ -71,12 +79,13 @@ export function persistCodexAccountSelection(config: OcxConfig, accountId: strin
       // A removed or paused account must not be resurrected by a stale UI snapshot.
       validateSelection(config, accountId);
       validateSelection(persisted, accountId);
+      validateExpectedPin(persisted, expectedPinnedAccountId);
       return { changed: applySelection(persisted, accountId), value: persisted };
     });
     if (result.status === "unavailable") return unknown();
     committed = result.value;
   } catch (error) {
-    if (error instanceof SelectionRejected) return jsonResponse({ error: error.message }, error.status);
+    if (error instanceof SelectionRejected) return jsonResponse({ error: error.message, ...(error.code ? { code: error.code } : {}) }, error.status);
     // Atomic publication may succeed before generation/bookkeeping fails. Confirm the exact
     // durable selection instead of rolling live state back behind an already published write.
     const snapshot = readConfigFileSnapshot();
@@ -95,12 +104,13 @@ export function persistCodexAccountSelection(config: OcxConfig, accountId: strin
   adoptPersistedCodexAccountSelection(config, committed);
   recordFileBackedConfig(config, configPath);
   // No failed save may clear affinity, spend the manual preference, or move the RR cursor.
-  resetCodexRoutingForManualSelection(accountId ?? MAIN_CODEX_ACCOUNT_ID);
+  if (accountId === null) resetCodexRoutingForClearedSelection();
+  else resetCodexRoutingForManualSelection(accountId);
   const pinDrainReason = accountId === null ? undefined : codexAccountPinDrainReason(config, accountId);
   return jsonResponse({
     ok: true,
     activeCodexAccountId: config.activeCodexAccountId ?? null,
-    appliesImmediately: true,
+    appliesImmediately: accountId !== null,
     ...(pinDrainReason !== undefined ? { pinDrained: true, pinDrainReason } : {}),
     ...(warning ? { warning: "config_bookkeeping_failed" } : {}),
   });

package/src/codex/auth-api/pool-mode-gate.ts

@@ -88,14 +88,13 @@ export async function runMainAccountHardLockRecovery(config: OcxConfig): Promise
     const now = Date.now();
     const quota = getMainPolicyQuota();
     const observedAt = quota?.credits?.observedAt;
-    // getMainPolicyQuota binds evidence to the observed physical identity. Only renew
-    // valid formerly spendable funds; admission retains the actual five-minute clock.
+    // Positive evidence renews before expiry; unavailable evidence keeps discovery
+    // eligible under the same pacing. Admission still requires fresh spendable funds.
     return codexAccountUsesCreditsAfterLimit(config, MAIN_CODEX_ACCOUNT_ID)
       && !isCodexAccountPaused(config, MAIN_CODEX_ACCOUNT_ID)
       && codexUsageLimitResetAt(quota, undefined, now) !== undefined
-      && observedAt !== undefined && observedAt > 0
-      && now - observedAt >= MAIN_CREDIT_RENEWAL_AGE_MS
-      && hasSpendableCodexCredits(quota, observedAt);
+      && (!hasSpendableCodexCredits(quota, now)
+        || (observedAt !== undefined && now - observedAt >= MAIN_CREDIT_RENEWAL_AGE_MS));
   };
   const status = getMainAccountHardLockStatus(config);
   if (status.state !== "blocked" && !creditRecoveryNeeded()) { mainHardLockRecoveryAttempt = undefined; return; }

package/src/codex/auth-api/routes.ts

@@ -254,7 +254,11 @@ export async function handleCodexAuthAPI(
       || !("accountId" in body) || (body.accountId !== null && typeof body.accountId !== "string")) {
       return jsonResponse({ error: "accountId must be an account id or null" }, 400);
     }
-    return persistCodexAccountSelection(getRuntimeConfig(config), body.accountId);
+    const expectedPin = "expectedPinnedAccountId" in body ? body.expectedPinnedAccountId : undefined;
+    if (expectedPin !== undefined && (body.accountId !== null || !isCodexAccountPriorityKey(expectedPin))) {
+      return jsonResponse({ error: "expectedPinnedAccountId must be a valid account id for a release" }, 400);
+    }
+    return persistCodexAccountSelection(getRuntimeConfig(config), body.accountId, expectedPin as string | undefined);
   }
 
   if (url.pathname === "/api/codex-auth/active" && req.method === "GET") {

package/src/codex/auth-context.ts

@@ -1,5 +1,6 @@
 import { bindPoolCreditPolicy, poolCreditHoldResetAt, poolContextCreditHoldResetAt } from "./pool-credit-policy";
 import { hasSpendableCodexCredits } from "./quota-types";
+import { nextQuotaQueryDelay } from "./quota-query-backoff";
 import { noteMainAccountActivity } from "./main-account-external-usage";
 import { codexAccountPriorityFailbackEnabled } from "./account-priority";
 import type { PoolQuotaWriter } from "./quota-types";
@@ -553,8 +554,11 @@ function assertPoolAccountCredits(accountId: string, resetAt: number | undefined
 export class CodexMainAccountCreditsOffError extends CodexAccountCooldownError {
   readonly resetAt?: number;
 
-  constructor(resetAt?: number) {
-    super(MAIN_CODEX_ACCOUNT_ID, resetAt ?? 0);
+  constructor(resetAt?: number, creditRecovery = false) {
+    // Keep the included reset as policy evidence, but let consented callers retry
+    // within the base metadata recovery interval even when backoff grows longer.
+    super(MAIN_CODEX_ACCOUNT_ID, creditRecovery
+      ? Math.min(resetAt ?? Infinity, Date.now() + nextQuotaQueryDelay()) : resetAt ?? 0);
     this.name = "CodexMainAccountCreditsOffError";
     this.resetAt = resetAt;
     this.message = "Codex main account reached its usage limit, and spending ChatGPT credits is off or no fresh spendable balance is available."
@@ -778,7 +782,8 @@ function assertMainAccountPolicy(
     const status = getMainAccountHardLockStatus(config);
     if (status.state === "blocked") throw new CodexMainAccountHardLockError(status.resetAt, status.thresholds);
     const creditsResetAt = mainCreditsHoldResetAt(config);
-    if (creditsResetAt !== undefined) throw new CodexMainAccountCreditsOffError(creditsResetAt);
+    if (creditsResetAt !== undefined) throw new CodexMainAccountCreditsOffError(creditsResetAt,
+      codexAccountUsesCreditsAfterLimit(config, MAIN_CODEX_ACCOUNT_ID));
   }
   // Only an admitted request is opencodex's own use of the main account. Counting a refused one
   // would hide outside usage from the warning exactly while the lock is holding.

package/src/codex/autostart-health.ts

@@ -215,7 +215,9 @@ function classifyStartupHealthSummary(health: StartupHealth): string {
     ? "custom remote Codex routing (no local restart dependency)"
     : "native Codex routing (no opencodex restart dependency)";
   if (health.protection === "service") return "protected by background service";
-  if (health.protection === "desktop") return "protected by desktop app at login and its proxy supervisor";
+  if (health.protection === "desktop") return health.desktop?.loginRegistration === "registered-not-loaded"
+    ? "protected by desktop app at next login and its proxy supervisor (Start at Login registered; not loaded in this session)"
+    : "protected by desktop app at login and its proxy supervisor";
   const command = health.recommendedCommand ?? health.commands.restoreNative;
   if (health.routingKind === "unknown") return `AT RISK after restart (Codex routing could not be verified; run '${command}')`;
   if (health.routingKind === "custom-local") return `AT RISK after restart (custom local gateway lifecycle is not managed by opencodex; run '${command}')`;

package/src/codex/catalog/bundled.ts

@@ -28,6 +28,7 @@ import {
 import type { NormalizedComboConfig } from "../../combos/types";
 import { providerDestinationResolvedError } from "../../lib/destination-policy";
 import { redactSecretString } from "../../lib/redact";
+import { isPassiveRead } from "../../lib/passive-read";
 import upstreamModelsSnapshot from "../data/upstream-models.json";
 import { decodeOverlayState } from "../shim-state-file";
 
@@ -313,7 +314,8 @@ function* bundledCatalogSteps(
       const output = yield command;
       if (!current()) return null;
       const catalog = output === null ? null : parseCatalogJson(output);
-      if (catalog && findNativeTemplate(catalog)) {
+      if (catalog && catalog.models?.every(row => row !== null && typeof row === "object" && !Array.isArray(row))
+        && findNativeTemplate(catalog)) {
         if (cacheKey) {
           publishBundledCatalogCache(
             cacheKey,
@@ -377,6 +379,8 @@ export function loadBundledCodexCatalogAsync(
   if (useCache && bundledCatalogFlight?.inputs === inputs && bundledCatalogFlight.epoch === epoch) {
     return view(bundledCatalogFlight.promise);
   }
+  // A passive read (a Remote Link Child's, #6959) runs no Codex binary and persists no runtime.
+  if (isPassiveRead()) return Promise.resolve(null);
   const controller = new AbortController();
   const flight = { inputs, epoch, controller, promise: Promise.resolve<ReadonlyRawCatalog | null>(null) };
   if (useCache && !signal && isCurrent === catalogAlwaysCurrent) {

package/src/codex/catalog/effort.ts

@@ -620,8 +620,8 @@ export function clampCatalogModelsToCodexSupport(models: RawEntry[], deps: Bundl
       removedEfforts: [...clamp.removedEfforts],
       affectedModels: [...clamp.affectedModels],
     };
-    for (const line of formatClampLogLines(diagnostic)) console.warn(line);
-    if (!deps.commandCandidates) persistEffortClamp(diagnostic, { configDir: deps.configDir });
+    const changed = deps.commandCandidates ? true : persistEffortClamp(diagnostic, { configDir: deps.configDir });
+    if (changed) for (const line of formatClampLogLines(diagnostic)) console.warn(line);
     deps.onEffortClamp?.(diagnostic);
   } else if (!deps.commandCandidates) {
     persistEffortClamp(null, { configDir: deps.configDir });

package/src/codex/catalog/metadata.ts

@@ -42,6 +42,7 @@ import { RESERVE_METADATA_SOURCE_FIELD } from "./reserve";
 import {
   ACCOUNT_GATED_NATIVE_OPENAI_MODELS,
   NATIVE_GPT6_CONTEXT,
+  NATIVE_GPT61_SOL_CONTEXT,
   NATIVE_DAYBREAK_BLUE_MODEL,
   NATIVE_GPT6_ASTRA_MINOR_MODEL,
   NATIVE_GPT6_ASTRA_MODEL,
@@ -202,8 +203,9 @@ export const NATIVE_OPENAI_CONTEXT_OVERRIDES: Record<string, { contextWindow?: n
   // the row's own ceiling rather than the GPT-5.6 family's measured 922,000.
   [NATIVE_GPT6_SOL_MODEL]: { ...NATIVE_GPT6_CONTEXT },
   [NATIVE_GPT6_LUNA_MODEL]: { ...NATIVE_GPT6_CONTEXT },
-  // GPT-6.1 Sol's row (openai/codex models.json after #49318) ships the same 272,000 / 872,000 pair.
-  [NATIVE_GPT61_SOL_MODEL]: { ...NATIVE_GPT6_CONTEXT },
+  // GPT-6.1 Sol's row (openai/codex models.json after #49318) ships 272,000 / 872,000, but OpenAI
+  // raised its Codex & Work default to 500,000 on 2026-10-11; the 872,000 ceiling is unchanged.
+  [NATIVE_GPT61_SOL_MODEL]: { ...NATIVE_GPT61_SOL_CONTEXT },
   // Astra Minor borrows Astra's row, so it inherits Astra's numbers. No account we hold can reach
   // it, so this is inheritance, not a measurement.
   [NATIVE_GPT6_ASTRA_MINOR_MODEL]: { ...NATIVE_GPT6_CONTEXT },

package/src/codex/catalog/native-models.ts

@@ -44,7 +44,8 @@ export const NATIVE_GPT6_LUNA_MODEL = "gpt-6-luna";
  * SELF-DESCRIBED: its row is pinned verbatim in `src/codex/data/roster-pinned-models.json` from
  * openai/codex `codex-rs/models-manager/models.json` after #49318, which also made it the Codex
  * catalog default (priority 1). Ladder low..ultra with default effort low, and the GPT-6
- * 272,000 / 872,000 context pair. Ungated for the same owner decision as Sol and Luna.
+ * 272,000 / 872,000 context pair in that pinned row; the effective native default is now 500,000
+ * (NATIVE_GPT61_SOL_CONTEXT). Ungated for the same owner decision as Sol and Luna.
  */
 export const NATIVE_GPT61_SOL_MODEL = "gpt-6.1-sol";
 
@@ -62,11 +63,24 @@ export const NATIVE_GPT6_ASTRA_MINOR_MODEL = "gpt-6-astra-minor";
 /**
  * Context pair every GPT-6 native ships in its upstream row: a 272,000-token default window
  * against an 872,000-token ceiling (and input limit) reached only through the long-window opt-in.
- * The built-in GPT-6 rows and every configured native (below) inherit this one value.
+ * The built-in GPT-6 rows and every configured native (below) inherit this one value, except
+ * GPT-6.1 Sol, whose default window is NATIVE_GPT61_SOL_CONTEXT.
  */
 export const NATIVE_GPT6_CONTEXT: Readonly<{ contextWindow: number; maxContextWindow: number; maxInputTokens: number }> =
   Object.freeze({ contextWindow: 272_000, maxContextWindow: 872_000, maxInputTokens: 872_000 });
 
+/**
+ * GPT-6.1 Sol through Codex & Work: OpenAI raised the default context from 272k to 500k
+ * (Tibo Sottiaux, 2026-10-11, https://x.com/thsottiaux/status/2109430343346581527), while
+ * overrides stay allowed and the model maximum is described as 1M. The bundled codex-rs row
+ * still reads 272,000 / 872,000, and built-in natives never take roster values, so the default
+ * lives here. The 872,000 ceiling (and input limit) is kept on purpose: the announcement does
+ * not say how "1M" maps onto the native window and input fields, and raising maxInputTokens
+ * would assert an input allowance nobody has measured. Overrides therefore clamp to 872,000.
+ */
+export const NATIVE_GPT61_SOL_CONTEXT: Readonly<{ contextWindow: number; maxContextWindow: number; maxInputTokens: number }> =
+  Object.freeze({ ...NATIVE_GPT6_CONTEXT, contextWindow: 500_000 });
+
 /** Pinned row a configured native borrows its capability metadata from: the current Sol. */
 export const CONFIGURED_NATIVE_OPENAI_TEMPLATE_MODEL = NATIVE_GPT61_SOL_MODEL;
 
@@ -93,7 +107,7 @@ export const CONFIGURED_NATIVE_OPENAI_TEMPLATE_MODEL = NATIVE_GPT61_SOL_MODEL;
  *
  * `gpt-daybreak-blue-latest` stays gated. It has no shipped catalog row anywhere, so absence is
  * the only signal that exists for it, and the ungating decision was scoped to the flagships.
- * Evidence: devlog/_plan/260904_flagship_native_always_visible/.
+ * Evidence: devlog/_fin/260904_flagship_native_always_visible/.
  */
 export const ACCOUNT_GATED_NATIVE_OPENAI_MODELS: ReadonlySet<string> = new Set([
   NATIVE_DAYBREAK_BLUE_MODEL,