@bitkyc08/opencodex 2.83.0 → 2.84.0

package/src/client/machine-listener.ts

@@ -23,6 +23,8 @@ import { projectClientLinkChild, type ClientLinkSidecarRead } from "./link-statu
 import type { ClientLinkSupervisorStatus } from "./link-tunnel";
 import { packageVersion } from "../lib/package-version";
 import { linkRouteAllowed } from "../link/routes";
+import { linkHomeName, linkHomePhrase } from "./link-home";
+import { relayLinkManagementRead } from "./link-management-relay";
 
 const VERSION = packageVersion("0.0.0");
 const GUI_SPA_PATHS = new Set([
@@ -100,6 +102,8 @@ export function startMachineListener(
   if (linkMode && !connection.link) throw new Error("link machine listener requires link transport metadata");
   const managementAuth = deps.managementAuthState ?? initializeManagementAuthState(config);
   let hubReachability: HubReachability = "unknown";
+  const readSidecar = deps.readSidecar ?? (() => readClientLinkState());
+  const sidecarOrNull = () => { const read = readSidecarSafely(readSidecar); return read === "invalid" ? null : read; };
   const machineApiDeps: MachineApiDeps = {
     sync: deps.machineApi?.sync ?? syncConnectedClient,
     disconnect: deps.machineApi?.disconnect ?? disconnectClient,
@@ -108,8 +112,11 @@ export function startMachineListener(
     }),
     hubReachability: deps.machineApi?.hubReachability ?? (() => hubReachability),
     setHubReachability: deps.machineApi?.setHubReachability ?? (value => { hubReachability = value; }),
+    ...(linkMode ? { linkHomeName: () => linkHomeName(connection, sidecarOrNull) } : {}),
   };
-  const relayEnabled = !linkMode && connection.managementTransport === "relay";
+  // A link Child relays its dashboard's management reads to the Home over the link (#6957);
+  // a hub client relays over its management transport when that is `relay`.
+  const relayEnabled = linkMode || connection.managementTransport === "relay";
   // Link mode only. Everything is resolved once here, so a relayed request reads no file and
   // builds no policy: the key is cached, the loopback policy is fixed at bind like the listener.
   const inboundBodyLimit = resolveInboundBodyLimitBytes(config.maxInboundBodyBytes);
@@ -123,8 +130,6 @@ export function startMachineListener(
       relay: { fetchImpl: deps.fetchImpl, bodyLimitBytes: inboundBodyLimit, tunnel: deps.linkTunnel, ...deps.linkRelay },
     }
     : null;
-  const readSidecar = deps.readSidecar ?? (() => readClientLinkState());
-
   return (deps.serve ?? (options => Bun.serve(options)))({
     port: port ?? config.port ?? 10100,
     hostname: "127.0.0.1",
@@ -147,9 +152,29 @@ export function startMachineListener(
       }
       if (url.pathname.startsWith("/api/machine/hub-relay/")) {
         if (!relayEnabled) return json404(req);
+        const prefix = "/api/machine/hub-relay";
+        if (linkIngress) {
+          const suffix = `${url.pathname.slice(prefix.length)}${url.search}`;
+          // The dashboard's shared plane bootstraps here. On a link Child that plane is this
+          // listener, so it receives this listener's own session; no Home credential exists.
+          if (suffix === "/opencodex-session") {
+            if (req.method !== "GET") return json404(req);
+            const session = issueGuiSession(req, config, managementAuth, { trustedTailscaleIngress: false });
+            return session ? serveSessionBootstrap(session) : Response.json({ error: "session unavailable" }, { status: 503 });
+          }
+          const authError = requireManagementAuth(req, managementAuth, config);
+          if (authError) return authError;
+          if (managementPrincipal(req, managementAuth, config) !== "gui-session") {
+            return Response.json({ error: "opencodex machine GUI session required" }, { status: 401 });
+          }
+          const response = await relayLinkManagementRead(req, suffix, linkIngress, linkHomePhrase(connection, sidecarOrNull));
+          if (response.status === 401) hubReachability = "unauthorized";
+          else if (response.status >= 500) hubReachability = "offline";
+          else if (response.status !== 403) hubReachability = "online";
+          return response;
+        }
         const authError = requireMachineAuth(req, managementAuth, config);
         if (authError) return authError;
-        const prefix = "/api/machine/hub-relay";
         const suffix = `${url.pathname.slice(prefix.length)}${url.search}`;
         const response = await relayHubManagementRequest(req, suffix, {
           managementUrl: connection.managementUrl,

package/src/clients/config-export.ts

@@ -470,20 +470,51 @@ export function mcodeConfigPath(env: OpencodeLaunchEnv = process.env, home: stri
   return join(mcodeHomeDir(env, home), "config.yaml");
 }
 
-/**
- * ZCode (Z.ai's desktop client) keeps everything under `~/.zcode`; custom
- * providers live in `v2/config.json`. `ZCODE_DATA_DIR` mirrors the other
- * clients' override convention; relative overrides are refused for the same
- * reason as MCode's.
- */
-export function zcodeHomeDir(env: OpencodeLaunchEnv = process.env, home: string = homedir()): string {
-  const override = env.ZCODE_DATA_DIR?.trim();
-  if (override) return absoluteClientPath(override, home, "ZCODE_DATA_DIR");
-  return join(home, ".zcode");
+/** Bootstrap settings always stay at the default home, even after relocation. */
+export type ZcodePathIO = {
+  readText: (path: string) => { kind: "text"; text: string } | { kind: "missing" } | { kind: "failed"; code?: string };
+};
+const zcodePathIO: ZcodePathIO = {
+  readText: path => {
+    try { return { kind: "text", text: readFileSync(path, "utf8") }; }
+    catch (error) { return (error as NodeJS.ErrnoException).code === "ENOENT" ? { kind: "missing" } : { kind: "failed" }; }
+  },
+};
+export class ZcodeSettingsPathError extends ClientPathError {}
+
+export function zcodeBootstrapSettingsPath(home: string = homedir()): string {
+  return join(home, ".zcode", "v2", "setting.json");
 }
 
-export function zcodeConfigPath(env: OpencodeLaunchEnv = process.env, home: string = homedir()): string {
-  return join(zcodeHomeDir(env, home), "v2", "config.json");
+/** The pre-relocation path is retained solely to recognize historical ownership. */
+export function zcodeLegacyHomeDir(env: OpencodeLaunchEnv = process.env, home: string = homedir()): string {
+  const override = env.ZCODE_DATA_DIR?.trim();
+  return override ? absoluteClientPath(override, home, "ZCODE_DATA_DIR") : join(home, ".zcode");
+}
+
+/** ZCODE_DATA_DIR names the .zcode root; dataBaseDir names its parent. */
+export function zcodeHomeDir(env: OpencodeLaunchEnv = process.env, home: string = homedir(), io: ZcodePathIO = zcodePathIO): string {
+  if (env.ZCODE_DATA_DIR?.trim()) return zcodeLegacyHomeDir(env, home);
+  const bootstrap = zcodeBootstrapSettingsPath(home);
+  const read = io.readText(bootstrap);
+  if (read.kind === "missing") return join(home, ".zcode");
+  const unknown = () => new ZcodeSettingsPathError(
+    `ZCode's active data root is unknown: ${bootstrap} must be readable JSON with an absolute dataBaseDir (or no dataBaseDir). Repair the bootstrap setting before enabling or refreshing; no legacy provider will be applied.`,
+  );
+  if (read.kind !== "text") throw unknown();
+  let settings: unknown;
+  try { settings = JSON.parse(read.text); } catch { throw unknown(); }
+  if (settings === null || typeof settings !== "object" || Array.isArray(settings)) throw unknown();
+  const base = (settings as Record<string, unknown>).dataBaseDir;
+  if (base === undefined) return join(home, ".zcode");
+  // Match the native path's value, without cwd or tilde expansion. The native
+  // ZCODE_DATA_BASE_DIR selector is not an alias for our ZCODE_DATA_DIR.
+  if (typeof base !== "string" || !isAbsolute(base) || base.includes("\0")) throw unknown();
+  return join(base, ".zcode");
+}
+
+export function zcodeConfigPath(env: OpencodeLaunchEnv = process.env, home: string = homedir(), io?: ZcodePathIO): string {
+  return join(zcodeHomeDir(env, home, io), "v2", "config.json");
 }
 
 /**
@@ -532,8 +563,7 @@ export function commandCodeConfigPath(env: OpencodeLaunchEnv = process.env, home
  * an install that has ever run, the import has already happened and never runs
  * again — every later write to `v2/config.json` is read by nobody (#5348).
  *
- * This project does not write this file; it names it so the integration can
- * tell whether its own write can still reach the client. The env override is
+ * The integration writes this store through its existing schema-aware writer. The env override is
  * ZCode's own (`ZCODE_PERSONAL_PROVIDER_CONFIG_FILE`), so an operator who
  * relocated the store is measured against the file their client actually opens
  * rather than the default location. A relative override is refused for the same
@@ -541,10 +571,10 @@ export function commandCodeConfigPath(env: OpencodeLaunchEnv = process.env, home
  * which file it names, and here that disagreement decides whether an apply is
  * reported as effective.
  */
-export function zcodeProviderStorePath(env: OpencodeLaunchEnv = process.env, home: string = homedir()): string {
+export function zcodeProviderStorePath(env: OpencodeLaunchEnv = process.env, home: string = homedir(), io?: ZcodePathIO): string {
   const override = env.ZCODE_PERSONAL_PROVIDER_CONFIG_FILE?.trim();
   if (override) return absoluteClientPath(override, home, "ZCODE_PERSONAL_PROVIDER_CONFIG_FILE");
-  return join(zcodeHomeDir(env, home), "v2", "provider_config.json");
+  return join(zcodeHomeDir(env, home, io), "v2", "provider_config.json");
 }
 
 /**

package/src/clients/omo-role-models.ts

@@ -120,10 +120,13 @@ function serialize(text: string, doc: JsonObject): string {
 /**
  * `reasoning` left undefined keeps the entry's level; null removes it, so a level LazyCodex cannot
  * express does not leave a stale one behind for its next install to apply.
+ * `model` left undefined keeps the entry's model, so an effort-only save of a role that inherits
+ * its model never adds a pin here. LazyCodex declares both keys optional, so an entry may carry
+ * `reasoning` alone; an absent entry is created only when there is a value to put in it.
  */
 export function writeOmoRoleModel(
   role: string,
-  model: string,
+  model: string | undefined,
   path: string = omoJsoncPath(),
   reasoning?: string | null,
 ): OmoRoleModelWriteStatus {
@@ -137,10 +140,10 @@ export function writeOmoRoleModel(
   if (!isObject(agents)) return "invalid";
   const entry = agents[role] === undefined ? {} : agents[role];
   if (!isObject(entry)) return "invalid";
-  const next: JsonObject = { ...entry, model };
+  const next: JsonObject = model === undefined ? { ...entry } : { ...entry, model };
   if (reasoning === null) delete next.reasoning;
   else if (reasoning !== undefined) next.reasoning = reasoning;
-  if (entry.model === model && entry.reasoning === next.reasoning) return "unchanged";
+  if (entry.model === next.model && entry.reasoning === next.reasoning) return "unchanged";
   agents[role] = next;
   codex.agents = agents;
   doc[CODEX_SECTION] = codex;

package/src/codex/agent-role-models.ts

@@ -1,11 +1,12 @@
 /**
- * The dashboard's write of one Codex agent role's model, and optionally its reasoning effort.
+ * The dashboard's write of one Codex agent role's model, its reasoning effort, or both.
  *
  * Codex overrides the spawn-time model with the root `model` pin in
  * `$CODEX_HOME/agents/<role>.toml`, so that pin is what decides a child's model. This module
- * edits exactly that value, plus the root `model_reasoning_effort` when a caller passes one, and
- * nothing else: every other byte of the file, including the instructions multiline string that
- * usually mentions `model =` in prose, is left as it was.
+ * edits exactly that value when a caller passes a model, plus the root `model_reasoning_effort`
+ * when a caller passes an effort, and nothing else: every other byte of the file, including the
+ * instructions multiline string that usually mentions `model =` in prose, is left as it was. An
+ * omitted model leaves the pin as it is, so a role that inherits its model keeps inheriting it.
  * It runs only on an explicit user action; no sync or startup path calls it.
  */
 import { lstatSync, readFileSync } from "node:fs";
@@ -97,6 +98,21 @@ export function setTomlRootReasoningEffort(content: string, effort: string): str
   return setTomlRootString(content, locateTomlReasoningEffortKey(content), "model_reasoning_effort", effort);
 }
 
+export function removeTomlRootReasoningEffort(content: string): string {
+  const location = locateTomlReasoningEffortKey(content);
+  if (!location?.inRootTable) return content;
+  if (!location.span) {
+    throw new AgentRoleModelError("unsupported_model_value", "the existing model_reasoning_effort value is not a one-line string");
+  }
+  const lines = content.split("\n");
+  // A terminated line goes with its own newline. An unterminated last line is emptied instead,
+  // so the previous line keeps its terminator (and its \r in a CRLF file).
+  if (location.line < lines.length - 1) lines.splice(location.line, 1);
+  else lines[location.line] = "";
+  const bom = location.line === 0 && content.startsWith("\ufeff") ? "\ufeff" : "";
+  return bom + lines.join("\n");
+}
+
 export function readCodexAgentRoleEffort(role: string, codexHome: string): string | null {
   try {
     const location = locateTomlReasoningEffortKey(readFileSync(roleFile(role, codexHome), "utf8"));
@@ -148,9 +164,9 @@ function assertValidRoleToml(role: string, text: string, stage: "before" | "afte
 
 export function writeCodexAgentRoleModel(
   role: string,
-  model: string,
+  model: string | undefined,
   codexHome: string,
-  effort?: string,
+  effort?: string | null,
 ): { status: "written" | "unchanged" } {
   requireKnownRole(role, codexHome);
   const path = roleFile(role, codexHome);
@@ -159,10 +175,12 @@ export function writeCodexAgentRoleModel(
   }
   const before = readFileSync(path, "utf8");
   assertValidRoleToml(role, before, "before");
-  const withModel = setTomlRootModel(before, validateAgentRoleModel(model));
+  const withModel = model === undefined ? before : setTomlRootModel(before, validateAgentRoleModel(model));
   const after = effort === undefined
     ? withModel
-    : setTomlRootReasoningEffort(withModel, validateAgentRoleEffort(effort));
+    : effort === null
+      ? removeTomlRootReasoningEffort(withModel)
+      : setTomlRootReasoningEffort(withModel, validateAgentRoleEffort(effort));
   if (after === before) return { status: "unchanged" };
   assertValidRoleToml(role, after, "after");
   assertIntegrationWriteOwnership(path);

package/src/codex/auth-api/account-list.ts

@@ -33,6 +33,7 @@ import { fetchMainAccountInfoAttempt, EMPTY_MAIN_ACCOUNT_INFO, mainResetCreditsF
 import { fetchPoolAccountQuota, PoolQuotaProbeBusyError, POOL_QUOTA_REFRESH_CONCURRENCY } from "./pool-quota-probe";
 import type { PoolQuotaResult } from "./pool-quota-probe";
 import { getRuntimeConfig, configuredPoolAccount, mapWithConcurrency } from "./runtime-config";
+import { isPassiveRead } from "../../lib/passive-read";
 
 export function quotaForPlan<T extends Omit<StoredAccountQuota, "updatedAt"> | StoredAccountQuota | null>(
   quota: T,
@@ -274,13 +275,25 @@ export async function listCodexAuthAccountsSnapshot(
   pruneCodexCredits([MAIN_CODEX_ACCOUNT_ID, ...poolAccounts.map(account => account.id)]);
   // One redaction decision for the whole snapshot, read once from the operator's config (#3859).
   const maskEmails = emailMaskingEnabled(runtimeConfig);
-  const mainResult = await fetchMainAccountInfoAttempt(forceRefresh, 1, undefined, false,
-    forceRefresh, false, runtimeConfig);
+  // A passive read (a Remote Link Child's, #6959) reports what this machine already observed: no
+  // token refresh, no WHAM probe, and so none of the plan or credential writes they make.
+  const passive = isPassiveRead();
+  const mainResult: Awaited<ReturnType<typeof fetchMainAccountInfoAttempt>> = passive
+    ? { info: getMainAccountInfoCache() ?? EMPTY_MAIN_ACCOUNT_INFO, credentialChecked: false, hasCredential: false,
+      identityGeneration: captureMainAccountIdentityGeneration() }
+    : await fetchMainAccountInfoAttempt(forceRefresh, 1, undefined, false, forceRefresh, false, runtimeConfig);
   const refreshedPool = await mapWithConcurrency(poolAccounts, POOL_QUOTA_REFRESH_CONCURRENCY, async account => {
     const cred = getCodexAccountCredential(account.id);
     let quotaResult: PoolQuotaResult;
     if (!cred) {
       quotaResult = { quota: null, needsReauth: true };
+    } else if (passive) {
+      quotaResult = {
+        quota: getAccountQuota(account.id),
+        needsReauth: false,
+        credentialGeneration: readCodexAccountRecord(account.id)?.generation,
+        quotaProbeSkipped: true,
+      };
     } else {
       try {
         // Credits are process-local while pool quota is hydrated from disk, so right after a
@@ -410,6 +423,8 @@ export async function listCodexAuthAccountsSnapshot(
   };
   // Project the refusal and DTO in the same owned synchronous observation. A same-account grant
   // replacement during earlier pool probes must not inherit the previous grant's refusal.
+  // A passive read opens no claim database (its lock file is hardened on open).
+  if (passive) return projectSnapshot();
   const projectionLease = tryAcquireNativeMainProfileClaim();
   if (!projectionLease) return projectSnapshot();
   try {

package/src/codex/auth-api/account-selection.ts

@@ -6,11 +6,11 @@ import { deleteConfigTopLevelKey, fileBackedConfigPath, recordFileBackedConfig }
 import { MAIN_CODEX_ACCOUNT_ID, hasLegacyMainCodexPoolAccount, isSelectableCodexPoolAccount, isValidCodexAccountId } from "../account-id";
 import { isCodexAccountPaused } from "../account-pause";
 import { readCodexAccountRecord } from "../account-store";
-import { codexAccountPinDrainReason, resetCodexRoutingForManualSelection } from "../routing";
+import { codexAccountPinDrainReason, resetCodexRoutingForClearedSelection, resetCodexRoutingForManualSelection } from "../routing";
 import { jsonResponse } from "./http";
 
 class SelectionRejected extends Error {
-  constructor(message: string, readonly status: number) { super(message); }
+  constructor(message: string, readonly status: number, readonly code?: string) { super(message); }
 }
 
 function validateSelection(config: OcxConfig, accountId: string | null): void {
@@ -42,8 +42,14 @@ function applySelection(config: OcxConfig, accountId: string | null): boolean {
   return changed;
 }
 
+function validateExpectedPin(config: OcxConfig, expectedPinnedAccountId: string | undefined): void {
+  if (expectedPinnedAccountId !== undefined && config.activeCodexAccountPinned !== expectedPinnedAccountId) {
+    throw new SelectionRejected("The pin changed; reload accounts before releasing it", 409, "account_pin_changed");
+  }
+}
+
 /** A manual selection is an explicit command, even when equal to the live merge baseline. */
-export function persistCodexAccountSelection(config: OcxConfig, accountId: string | null): Response {
+export function persistCodexAccountSelection(config: OcxConfig, accountId: string | null, expectedPinnedAccountId?: string): Response {
   const unknown = () => jsonResponse({
     error: "Account selection could not be confirmed; reload settings before retrying",
     code: "account_selection_unavailable",
@@ -63,7 +69,9 @@ export function persistCodexAccountSelection(config: OcxConfig, accountId: strin
       const normalized = validateConfigCandidate(mergeConfigDefaults(config));
       if (!normalized.ok) return unknown();
       const initial = normalized.config;
-      applySelection(initial, accountId);
+      validateExpectedPin(initial, expectedPinnedAccountId);
+      // Conditional release must keep the baseline pin until the locked mutation checks it.
+      if (expectedPinnedAccountId === undefined) applySelection(initial, accountId);
       initializePersistedConfigIfMissing(initial);
     }
     const result = mutatePersistedConfig(persisted => {
@@ -71,12 +79,13 @@ export function persistCodexAccountSelection(config: OcxConfig, accountId: strin
       // A removed or paused account must not be resurrected by a stale UI snapshot.
       validateSelection(config, accountId);
       validateSelection(persisted, accountId);
+      validateExpectedPin(persisted, expectedPinnedAccountId);
       return { changed: applySelection(persisted, accountId), value: persisted };
     });
     if (result.status === "unavailable") return unknown();
     committed = result.value;
   } catch (error) {
-    if (error instanceof SelectionRejected) return jsonResponse({ error: error.message }, error.status);
+    if (error instanceof SelectionRejected) return jsonResponse({ error: error.message, ...(error.code ? { code: error.code } : {}) }, error.status);
     // Atomic publication may succeed before generation/bookkeeping fails. Confirm the exact
     // durable selection instead of rolling live state back behind an already published write.
     const snapshot = readConfigFileSnapshot();
@@ -95,12 +104,13 @@ export function persistCodexAccountSelection(config: OcxConfig, accountId: strin
   adoptPersistedCodexAccountSelection(config, committed);
   recordFileBackedConfig(config, configPath);
   // No failed save may clear affinity, spend the manual preference, or move the RR cursor.
-  resetCodexRoutingForManualSelection(accountId ?? MAIN_CODEX_ACCOUNT_ID);
+  if (accountId === null) resetCodexRoutingForClearedSelection();
+  else resetCodexRoutingForManualSelection(accountId);
   const pinDrainReason = accountId === null ? undefined : codexAccountPinDrainReason(config, accountId);
   return jsonResponse({
     ok: true,
     activeCodexAccountId: config.activeCodexAccountId ?? null,
-    appliesImmediately: true,
+    appliesImmediately: accountId !== null,
     ...(pinDrainReason !== undefined ? { pinDrained: true, pinDrainReason } : {}),
     ...(warning ? { warning: "config_bookkeeping_failed" } : {}),
   });

package/src/codex/auth-api/routes.ts

@@ -254,7 +254,11 @@ export async function handleCodexAuthAPI(
       || !("accountId" in body) || (body.accountId !== null && typeof body.accountId !== "string")) {
       return jsonResponse({ error: "accountId must be an account id or null" }, 400);
     }
-    return persistCodexAccountSelection(getRuntimeConfig(config), body.accountId);
+    const expectedPin = "expectedPinnedAccountId" in body ? body.expectedPinnedAccountId : undefined;
+    if (expectedPin !== undefined && (body.accountId !== null || !isCodexAccountPriorityKey(expectedPin))) {
+      return jsonResponse({ error: "expectedPinnedAccountId must be a valid account id for a release" }, 400);
+    }
+    return persistCodexAccountSelection(getRuntimeConfig(config), body.accountId, expectedPin as string | undefined);
   }
 
   if (url.pathname === "/api/codex-auth/active" && req.method === "GET") {

package/src/codex/autostart-health.ts

@@ -215,7 +215,9 @@ function classifyStartupHealthSummary(health: StartupHealth): string {
     ? "custom remote Codex routing (no local restart dependency)"
     : "native Codex routing (no opencodex restart dependency)";
   if (health.protection === "service") return "protected by background service";
-  if (health.protection === "desktop") return "protected by desktop app at login and its proxy supervisor";
+  if (health.protection === "desktop") return health.desktop?.loginRegistration === "registered-not-loaded"
+    ? "protected by desktop app at next login and its proxy supervisor (Start at Login registered; not loaded in this session)"
+    : "protected by desktop app at login and its proxy supervisor";
   const command = health.recommendedCommand ?? health.commands.restoreNative;
   if (health.routingKind === "unknown") return `AT RISK after restart (Codex routing could not be verified; run '${command}')`;
   if (health.routingKind === "custom-local") return `AT RISK after restart (custom local gateway lifecycle is not managed by opencodex; run '${command}')`;

package/src/codex/catalog/bundled.ts

@@ -28,6 +28,7 @@ import {
 import type { NormalizedComboConfig } from "../../combos/types";
 import { providerDestinationResolvedError } from "../../lib/destination-policy";
 import { redactSecretString } from "../../lib/redact";
+import { isPassiveRead } from "../../lib/passive-read";
 import upstreamModelsSnapshot from "../data/upstream-models.json";
 import { decodeOverlayState } from "../shim-state-file";
 
@@ -313,7 +314,8 @@ function* bundledCatalogSteps(
       const output = yield command;
       if (!current()) return null;
       const catalog = output === null ? null : parseCatalogJson(output);
-      if (catalog && findNativeTemplate(catalog)) {
+      if (catalog && catalog.models?.every(row => row !== null && typeof row === "object" && !Array.isArray(row))
+        && findNativeTemplate(catalog)) {
         if (cacheKey) {
           publishBundledCatalogCache(
             cacheKey,
@@ -377,6 +379,8 @@ export function loadBundledCodexCatalogAsync(
   if (useCache && bundledCatalogFlight?.inputs === inputs && bundledCatalogFlight.epoch === epoch) {
     return view(bundledCatalogFlight.promise);
   }
+  // A passive read (a Remote Link Child's, #6959) runs no Codex binary and persists no runtime.
+  if (isPassiveRead()) return Promise.resolve(null);
   const controller = new AbortController();
   const flight = { inputs, epoch, controller, promise: Promise.resolve<ReadonlyRawCatalog | null>(null) };
   if (useCache && !signal && isCurrent === catalogAlwaysCurrent) {

package/src/codex/catalog/effort.ts

@@ -620,8 +620,8 @@ export function clampCatalogModelsToCodexSupport(models: RawEntry[], deps: Bundl
       removedEfforts: [...clamp.removedEfforts],
       affectedModels: [...clamp.affectedModels],
     };
-    for (const line of formatClampLogLines(diagnostic)) console.warn(line);
-    if (!deps.commandCandidates) persistEffortClamp(diagnostic, { configDir: deps.configDir });
+    const changed = deps.commandCandidates ? true : persistEffortClamp(diagnostic, { configDir: deps.configDir });
+    if (changed) for (const line of formatClampLogLines(diagnostic)) console.warn(line);
     deps.onEffortClamp?.(diagnostic);
   } else if (!deps.commandCandidates) {
     persistEffortClamp(null, { configDir: deps.configDir });

package/src/codex/catalog/metadata.ts

@@ -42,6 +42,7 @@ import { RESERVE_METADATA_SOURCE_FIELD } from "./reserve";
 import {
   ACCOUNT_GATED_NATIVE_OPENAI_MODELS,
   NATIVE_GPT6_CONTEXT,
+  NATIVE_GPT61_SOL_CONTEXT,
   NATIVE_DAYBREAK_BLUE_MODEL,
   NATIVE_GPT6_ASTRA_MINOR_MODEL,
   NATIVE_GPT6_ASTRA_MODEL,
@@ -202,8 +203,9 @@ export const NATIVE_OPENAI_CONTEXT_OVERRIDES: Record<string, { contextWindow?: n
   // the row's own ceiling rather than the GPT-5.6 family's measured 922,000.
   [NATIVE_GPT6_SOL_MODEL]: { ...NATIVE_GPT6_CONTEXT },
   [NATIVE_GPT6_LUNA_MODEL]: { ...NATIVE_GPT6_CONTEXT },
-  // GPT-6.1 Sol's row (openai/codex models.json after #49318) ships the same 272,000 / 872,000 pair.
-  [NATIVE_GPT61_SOL_MODEL]: { ...NATIVE_GPT6_CONTEXT },
+  // GPT-6.1 Sol's row (openai/codex models.json after #49318) ships 272,000 / 872,000, but OpenAI
+  // raised its Codex & Work default to 500,000 on 2026-10-11; the 872,000 ceiling is unchanged.
+  [NATIVE_GPT61_SOL_MODEL]: { ...NATIVE_GPT61_SOL_CONTEXT },
   // Astra Minor borrows Astra's row, so it inherits Astra's numbers. No account we hold can reach
   // it, so this is inheritance, not a measurement.
   [NATIVE_GPT6_ASTRA_MINOR_MODEL]: { ...NATIVE_GPT6_CONTEXT },

package/src/codex/catalog/native-models.ts

@@ -44,7 +44,8 @@ export const NATIVE_GPT6_LUNA_MODEL = "gpt-6-luna";
  * SELF-DESCRIBED: its row is pinned verbatim in `src/codex/data/roster-pinned-models.json` from
  * openai/codex `codex-rs/models-manager/models.json` after #49318, which also made it the Codex
  * catalog default (priority 1). Ladder low..ultra with default effort low, and the GPT-6
- * 272,000 / 872,000 context pair. Ungated for the same owner decision as Sol and Luna.
+ * 272,000 / 872,000 context pair in that pinned row; the effective native default is now 500,000
+ * (NATIVE_GPT61_SOL_CONTEXT). Ungated for the same owner decision as Sol and Luna.
  */
 export const NATIVE_GPT61_SOL_MODEL = "gpt-6.1-sol";
 
@@ -62,11 +63,24 @@ export const NATIVE_GPT6_ASTRA_MINOR_MODEL = "gpt-6-astra-minor";
 /**
  * Context pair every GPT-6 native ships in its upstream row: a 272,000-token default window
  * against an 872,000-token ceiling (and input limit) reached only through the long-window opt-in.
- * The built-in GPT-6 rows and every configured native (below) inherit this one value.
+ * The built-in GPT-6 rows and every configured native (below) inherit this one value, except
+ * GPT-6.1 Sol, whose default window is NATIVE_GPT61_SOL_CONTEXT.
  */
 export const NATIVE_GPT6_CONTEXT: Readonly<{ contextWindow: number; maxContextWindow: number; maxInputTokens: number }> =
   Object.freeze({ contextWindow: 272_000, maxContextWindow: 872_000, maxInputTokens: 872_000 });
 
+/**
+ * GPT-6.1 Sol through Codex & Work: OpenAI raised the default context from 272k to 500k
+ * (Tibo Sottiaux, 2026-10-11, https://x.com/thsottiaux/status/2109430343346581527), while
+ * overrides stay allowed and the model maximum is described as 1M. The bundled codex-rs row
+ * still reads 272,000 / 872,000, and built-in natives never take roster values, so the default
+ * lives here. The 872,000 ceiling (and input limit) is kept on purpose: the announcement does
+ * not say how "1M" maps onto the native window and input fields, and raising maxInputTokens
+ * would assert an input allowance nobody has measured. Overrides therefore clamp to 872,000.
+ */
+export const NATIVE_GPT61_SOL_CONTEXT: Readonly<{ contextWindow: number; maxContextWindow: number; maxInputTokens: number }> =
+  Object.freeze({ ...NATIVE_GPT6_CONTEXT, contextWindow: 500_000 });
+
 /** Pinned row a configured native borrows its capability metadata from: the current Sol. */
 export const CONFIGURED_NATIVE_OPENAI_TEMPLATE_MODEL = NATIVE_GPT61_SOL_MODEL;
 

package/src/codex/native-profile-startup.ts

@@ -20,6 +20,7 @@ import { withNativeMainExclusiveClaim } from "./native-main-claim";
 import { scrubNativeMainAuthTempResidues } from "./native-main-auth-temp";
 import { NATIVE_STAGE_SWEEP_INTERVAL_MS } from "./native-profile-stage-store";
 import type { NativeCodexOwnership } from "../integrations/native/ownership-preflight";
+import { isPassiveRead } from "../lib/passive-read";
 
 export type NativeMainStartupGateSnapshot =
   | { status: "ready"; homeId: string | null }
@@ -701,7 +702,9 @@ export async function releaseNativeMainStartupLifecycle(server: object): Promise
 
 export function isNativeMainTrafficBlocked(): boolean {
   const reason = activeServiceOwnershipBlockReason();
-  if (reason !== null && reprobeServiceOwnership(reason)) {
+  // A passive read (a Remote Link Child's, #6959) reports the gate as it stands: re-inspecting
+  // service ownership can activate the native-main lifecycle and its recovery on this machine.
+  if (reason !== null && !isPassiveRead() && reprobeServiceOwnership(reason)) {
     // The host became ownable after boot (#2108): the fence lifts here rather than
     // waiting for the restart the reporter had to perform by hand.
     return activeServiceOwnershipBlockReason() !== null || snapshot.status === "blocked";

package/src/codex/prompt-journal.ts

@@ -318,7 +318,7 @@ export function recoverIfNeeded(
       };
     }
     try {
-      publishConfigWrite(expectedTargets.configPath, held, (destination, hooks) => restore(destination, record.preConfigBytes, hooks));
+      publishConfigWrite(expectedTargets.configPath, held, (destination, hooks) => restore(destination, record.preConfigBytes, expectingImage(hooks, record.postConfig)));
     } catch (error) {
       return {
         ok: false,
@@ -336,7 +336,7 @@ export function recoverIfNeeded(
       };
     }
     try {
-      publishConfigWriteTarget(expectedTargets.configPath, held, expectedTargets.storePath, (destination, hooks) => restore(destination, record.preStoreBytes, hooks));
+      publishConfigWriteTarget(expectedTargets.configPath, held, expectedTargets.storePath, (destination, hooks) => restore(destination, record.preStoreBytes, expectingImage(hooks, record.postStore)));
     } catch (error) {
       return {
         ok: false,
@@ -363,3 +363,21 @@ function restore(path: string, bytes: string | null, hooks: AtomicWriteHooks): v
   if (bytes === null) durableDelete(path, hooks);
   else durableWrite(path, bytes, hooks);
 }
+
+/**
+ * Bind a write to the image the caller classified. The rename retry hooks check
+ * path and inode identity only; an in-place edit by another process during a
+ * Windows sharing-violation retry keeps the inode, so without this re-read a
+ * later attempt would replace newer bytes. Checked before every attempt.
+ */
+export function expectingImage(hooks: AtomicWriteHooks, expectedHash: string): AtomicWriteHooks {
+  return {
+    ...hooks,
+    validateBeforeRename: (targetPath: string) => {
+      hooks.validateBeforeRename?.(targetPath);
+      if (hashBytes(readOrNull(targetPath)) !== expectedHash) {
+        throw new Error(targetPath + " changed during the write; refusing to overwrite it. Files and recovery evidence were preserved.");
+      }
+    },
+  };
+}

package/src/codex/prompt-layers/encoding.ts

@@ -119,3 +119,52 @@ export function decodeTomlBasicString(literal: string): string | null {
   }
   return out;
 }
+
+/** Shared scalar assignment matching; quoted and escaped keys retain their spelling. */
+export function matchKeyHead(line: string, key: string): { prefix: string; rest: string } | null {
+  const m = /^\s*("(?:[^"\\]|\\.)*"|'[^']*'|[A-Za-z0-9_-]+)\s*=\s*/.exec(line);
+  if (!m) return null;
+  const token = m[1]!;
+  const decoded = token.startsWith('"') ? decodeTomlBasicString(token)
+    : token.startsWith("'") ? token.slice(1, -1) : token;
+  return decoded === key ? { prefix: m[0], rest: line.slice(m[0].length) } : null;
+}
+
+/**
+ * For each line, whether it begins outside every string and composite span, or
+ * `null` when a span never closes and the scope of later lines is unknown.
+ *
+ * Line matchers for assignments and table headers must only look at lines that
+ * start at top level: `"model_instructions_file" = "x"` written inside a
+ * `"""…"""` value or a multi-line array is prose, not syntax. Readers and
+ * editors share this so a write and the snapshot read back agree.
+ */
+export function lexicalLineStarts(lines: readonly string[]): boolean[] | null {
+  const starts: boolean[] = [];
+  let open: string | null = null;
+  let depth = 0;
+  for (const line of lines) {
+    starts.push(open === null && depth === 0);
+    for (let i = 0; i < line.length; i += 1) {
+      const char = line[i]!;
+      if (open !== null) {
+        if (char === "\\" && (open === '"' || open === '"""')) { i += 1; continue; }
+        if (char !== open[0]) continue;
+        if (open.length === 1) { open = null; continue; }
+        let run = 0;
+        while (line[i + run] === char) run += 1;
+        // Up to two quotes may sit inside the value just before the closing three.
+        if (run >= 3) open = null;
+        i += run - 1;
+      } else if (char === "#") break;
+      else if (char === '"' || char === "'") {
+        open = line.startsWith(char.repeat(3), i) ? char.repeat(3) : char;
+        i += open.length - 1;
+      } else if (char === "[" || char === "{") depth += 1;
+      else if (char === "]" || char === "}") { depth -= 1; if (depth < 0) return null; }
+    }
+    // Single-line strings cannot cross a newline.
+    if (open !== null && open.length === 1) return null;
+  }
+  return open === null && depth === 0 ? starts : null;
+}