@bitkyc08/opencodex 2.84.0 → 2.87.0

package/src/codex/catalog/routed-gather.ts

@@ -1,5 +1,7 @@
+import { canInferVendorContext } from "./vendor-context";
 import { effectiveProviderAlias, effectiveProviderAliasDecision } from "../../providers/default-aliases";
 import { initialModelSelectionPending } from "../../providers/initial-model-selection";
+import { supportsConfiguredUltraFast } from "./configured-tiers";
 import { execFileSync } from "node:child_process";
 import { createHash, createHmac, randomBytes } from "node:crypto";
 import { copyFileSync, existsSync, mkdirSync, readFileSync, realpathSync } from "node:fs";
@@ -33,7 +35,6 @@ import {
 import type { OcxConfig, OcxProviderConfig } from "../../types";
 import { modelInList } from "../../types";
 import { CODEX_REASONING_LEVELS, codexEffortRank, configuredReasoningEfforts, modelRecordValue, sanitizeCodexReasoningEfforts } from "../../reasoning-effort";
-import { isModelVisionSidecarConsumer } from "../../vision/eligibility";
 import { getModelMetadata, getModelMetadataCaseInsensitive, listModelMetadata, resolveMetadataProvider, type ModelMetadata } from "../../generated/model-metadata";
 import { enrichProviderFromRegistry, shouldCaseFoldMetadataModelId } from "../../providers/derive";
 import {
@@ -101,7 +102,7 @@ import type {
   CatalogTrustedOpenAiApiPolicySnapshot,
 } from "../convergence-types";
 import type { CatalogGatherProviderAuthOutcome, CatalogGatherProviderModelOutcome, GatherFlightCapture, ModelsAuthResolverFactory } from "./gather-capture";
-import { applyProviderConfigHints, configuredAutoCompactTokenLimit, configuredMaxInputTokens, configuredReasoningSummarySupport, modelInputModalities, routedMaxOutputTokens } from "./model-hints";
+import { applyProviderConfigHints, configuredAutoCompactTokenLimit, configuredMaxInputTokens, configuredReasoningSummarySupport, modelInputModalities, routedMaxOutputTokens, withVisionSidecarInput } from "./model-hints";
 import { resolveComboCatalogMember } from "./combo-member";
 import { captureGatherFlight, captureTrustedOpenAiApiPolicy, gatherFlightKey, keyedGatherBytesIdentity, withCanonicalOpenAiForwardAuthDefault } from "./gather-capture";
 import { fetchProviderModelsWithAuth, observedModelsAuthResolver, refreshingModelsAuthResolver } from "./provider-models";
@@ -318,6 +319,7 @@ function boundCustomNativeReasoning(
   return bounded;
 }
 
+/** Gather discovered and custom rows under one captured provider policy, including speed capabilities. */
 async function gatherRoutedModelsUncached(
   config: OcxConfig,
   capture: GatherFlightCapture,
@@ -327,6 +329,7 @@ async function gatherRoutedModelsUncached(
   const localProviderAuthOutcomes = capture.providerAuthOutcomes;
   const resolveAuth = capture.authResolver;
   const ttlMs = config.modelCacheTtlMs ?? DEFAULT_MODEL_CACHE_TTL_MS;
+  const visionSidecarEnabled = config.visionSidecar?.enabled !== false;
   // Persisted provider entries can predate newer registry fields (noVisionModels,
   // modelInputModalities, ...). The ROUTER merges registry seeds at request time
   // (routedProviderConfig), so the proxy behaves correctly — the catalog listing must see the
@@ -334,6 +337,8 @@ async function gatherRoutedModelsUncached(
   // vision-sidecar model advertised text-only, blocking image attachments app-side).
   // Enrich a CLONE: hydrated defaults must never leak into the persisted config.
   const activeProviders = capture.providers;
+  // Use admission-time provider clones for sidecar advertisement, custom rows and combo members.
+  const enrichedByName = new Map(activeProviders.map(provider => [provider.name, provider.provider]));
   const providerResults = await Promise.all(
     activeProviders.map(provider => fetchProviderModelsWithAuth(
       provider,
@@ -358,6 +363,7 @@ async function gatherRoutedModelsUncached(
       const policy = fastPolicyForModel(apiProvider.provider, model.id, apiProvider.name);
       const supported = serviceTierSupportFromPolicy(policy);
       if (supported !== undefined) model.supportsServiceTier = supported;
+      model.supportsUltraFastTier = supportsConfiguredUltraFast(policy);
       if (supported === true && policy.fastTierDescription !== undefined) model.fastTierDescription = policy.fastTierDescription;
     }
   }
@@ -374,7 +380,9 @@ async function gatherRoutedModelsUncached(
     config,
     metadataModelIdCaseFoldByProvider,
     metadataConfigDirByProvider,
+    false,
   )
+    .map(model => withVisionSidecarInput(model, enrichedByName.get(model.provider), visionSidecarEnabled))
     // Drop image/video generation models (e.g. Grok image/video) by default. Cursor's static catalog
     // intentionally mirrors Cursor's public model table, including Gemini image preview, so the
     // exposure decision goes through shouldExposeRoutedModel (single choke point).
@@ -467,7 +475,7 @@ async function gatherRoutedModelsUncached(
       ...inherited,
       catalogKind: CODEX_CUSTOM_MODEL_CATALOG_KIND,
       ...(typeof custom.contextWindow === "number" && custom.contextWindow > 0
-        ? { contextWindow: custom.contextWindow }
+        ? { contextWindow: custom.contextWindow, contextWindowInference: undefined }
         : {}),
       ...(Array.isArray(custom.inputModalities)
         ? { inputModalities: [...custom.inputModalities] }
@@ -478,9 +486,6 @@ async function gatherRoutedModelsUncached(
       ...(custom.codexToolMode !== undefined ? { codexToolMode: custom.codexToolMode } : {}),
     });
   }
-  // Enriched (registry-hydrated) provider clones — shared by combo member synthesis and
-  // custom-model vision-sidecar inheritance so both see the same merged registry view.
-  const enrichedByName = new Map(activeProviders.map(provider => [provider.name, provider.provider]));
   for (const id of listComboIds(config)) {
     const combo = getCombo(config, id);
     if (!combo) continue;
@@ -517,6 +522,7 @@ async function gatherRoutedModelsUncached(
         nativeAliasFallback,
         metadataModelIdCaseFoldByProvider.get(target.provider),
         metadataConfigDirByProvider.get(target.provider),
+        visionSidecarEnabled,
       ))
       .filter((member): member is CatalogModel => member !== undefined);
     const derived = deriveComboCatalogModel(id, combo, members);
@@ -654,6 +660,7 @@ async function gatherRoutedModelsUncached(
       ...(Array.isArray(cm.reasoningEfforts) ? { reasoningEfforts: [...cm.reasoningEfforts] } : {}),
       ...(cm.defaultReasoningEffort ? { defaultReasoningEffort: cm.defaultReasoningEffort } : {}),
       ...(typeof supportsServiceTier === "boolean" ? { supportsServiceTier } : {}),
+      supportsUltraFastTier: supportsConfiguredUltraFast(fastPolicy),
       ...(supportsServiceTier === true && fastPolicy?.fastTierDescription !== undefined
         ? { fastTierDescription: fastPolicy.fastTierDescription }
         : {}),
@@ -686,7 +693,8 @@ async function gatherRoutedModelsUncached(
       : undefined;
     const merged: CatalogModel = replaced ? {
       ...base,
-      ...(base.contextWindow === undefined && replaced.contextWindow !== undefined ? { contextWindow: replaced.contextWindow } : {}),
+      ...(base.contextWindow === undefined && replaced.contextWindow !== undefined
+        ? { contextWindow: replaced.contextWindow, ...(replaced.contextWindowInference ? { contextWindowInference: replaced.contextWindowInference, contextCap: replaced.contextCap, contextCapped: replaced.contextCapped } : {}) } : {}),
       ...(mergedMaxInput !== undefined ? { maxInputTokens: mergedMaxInput } : {}),
       ...(mergedMaxOutput !== undefined ? { maxOutputTokens: mergedMaxOutput } : {}),
       ...(base.autoCompactTokenLimit === undefined && replaced.autoCompactTokenLimit !== undefined
@@ -703,17 +711,29 @@ async function gatherRoutedModelsUncached(
       ...(base.codexToolMode === undefined && replaced.codexToolMode !== undefined ? { codexToolMode: replaced.codexToolMode } : {}),
       ...(base.capabilities === undefined && replaced.capabilities !== undefined ? { capabilities: replaced.capabilities } : {}),
     } : base;
+    // A custom-only model may never appear in /models or the provider's configured roster.
+    // Fill only its absent context; a full hint overlay would overwrite custom capabilities.
+    const customContextHints = merged.contextWindow === undefined && effectiveProvider && canInferVendorContext(cm.provider, effectiveProvider)
+      ? applyProviderConfigHints(cm.provider, effectiveProvider, { provider: cm.provider, id: cm.modelId },
+        providerContextCap(config, cm.provider), metadataModelIdCaseFoldByProvider.get(cm.provider),
+        undefined, metadataConfigDirByProvider.get(cm.provider), false)
+      : undefined;
+    const contextResolved: CatalogModel = customContextHints?.contextWindow !== undefined
+      ? { ...merged, contextWindow: customContextHints.contextWindow,
+        ...(customContextHints.contextWindowInference ? { contextWindowInference: customContextHints.contextWindowInference } : {}),
+        ...(customContextHints.contextCap !== undefined ? { contextCap: customContextHints.contextCap, contextCapped: customContextHints.contextCapped } : {}) }
+      : merged;
     // Catalog-advertised efforts are bounded whenever the model id is a pinned native
     // slug. Desktop validates that id, so a gateway such as YYLJ/gpt-6-astra still cannot
     // advertise none/minimal. Full native identity stays behind the alias predicate.
     const nativeEffortSource = hasNativeOpenAiCapabilityMetadata(cm.modelId);
     const reasoningBounded = nativeEffortSource
       ? boundCustomNativeReasoning(
-        merged,
+        contextResolved,
         nativeReasoningEfforts(cm.modelId),
         nativeAliasDefaultEffort ?? nativeDefaultReasoningEffort(cm.modelId),
       )
-      : merged;
+      : contextResolved;
     // Vision-sidecar coverage only: when the enriched provider's shared predicate matches
     // noVisionModels or text-without-image modelInputModalities, advertise image input so the
     // Codex app lets images reach the sidecar (#349/#344). Deliberately NOT the full
@@ -744,13 +764,7 @@ async function gatherRoutedModelsUncached(
       : mergedWithHardBounds;
     const enrichedProvider = enrichedByName.get(cm.provider) ?? rawProvider;
     // Reuse the request-time consumer predicate so custom rows cannot drift from catalog hints.
-    if (enrichedProvider && isModelVisionSidecarConsumer(enrichedProvider, mergedWithAutoCompact.id)) {
-      const current = mergedWithAutoCompact.inputModalities ?? ["text"];
-      if (!current.includes("image")) {
-        return { ...mergedWithAutoCompact, inputModalities: [...current, "image"] };
-      }
-    }
-    return mergedWithAutoCompact;
+    return withVisionSidecarInput(mergedWithAutoCompact, enrichedProvider, visionSidecarEnabled);
   });
   // Custom rows override discovered rows that encode to the same Codex-facing slug. A provider whose
   // captured discovery declares an order (preferFirst) keeps each replacement in the discovered row's
@@ -930,6 +944,7 @@ export function augmentRoutedModelsWithMetadata(
   caps?: Pick<OcxConfig, "providerContextCaps">,
   metadataModelIdCaseFoldByProvider?: ReadonlyMap<string, boolean>,
   metadataConfigDirByProvider?: ReadonlyMap<string, string>,
+  includeVisionSidecar = true,
 ): CatalogModel[] {
   const out = [...models];
   const indexByKey = new Map(out.map((model, index) => [`${model.provider}/${model.id}`, index]));
@@ -959,6 +974,7 @@ export function augmentRoutedModelsWithMetadata(
             metadataModelIdCaseFoldByProvider?.get(provider),
             undefined,
             metadataConfigDirByProvider?.get(provider),
+            includeVisionSidecar,
           )
           : seeded;
         continue;
@@ -983,6 +999,7 @@ export function augmentRoutedModelsWithMetadata(
             metadataModelIdCaseFoldByProvider?.get(provider),
             undefined,
             metadataConfigDirByProvider?.get(provider),
+            includeVisionSidecar,
           )
           : {}),
       });

package/src/codex/catalog/vendor-context.ts

@@ -0,0 +1,82 @@
+import { listModelMetadata, resolveMetadataProvider, type ModelMetadata } from "../../generated/model-metadata";
+import { PROVIDER_REGISTRY } from "../../providers/registry";
+import type { OcxProviderConfig } from "../../types";
+
+/** A bundled model-window estimate, not evidence of the serving gateway's capacity. */
+export interface VendorContextInference {
+  source: "vendor" | "aggregator";
+  provider: string;
+  modelId: string;
+  contextWindow: number;
+}
+
+// Capacity and price have different authorities: hosting vendors (Cerebras/Bedrock), Azure
+// and the Codex subscription table must not replace the original vendor's API window.
+const VENDORS = ["anthropic", "openai", "google", "moonshot", "minimax", "deepseek", "xai", "zai", "mistral", "xiaomi"];
+const AGGREGATORS = ["openrouter", "opencode-go"];
+// Snapshot names once, never consult the mutable registry after gather flight admission.
+const BUILTIN_NAMES = new Set(PROVIDER_REGISTRY.map(entry => entry.id.toLowerCase()));
+/**
+ * Opt-in only (#1073): an id-only custom row keeps the conservative fallback unless the
+ * operator sets `inferContextWindow: true`. Built-in names stay excluded even when set.
+ */
+export function canInferVendorContext(provider: string, config: Pick<OcxProviderConfig, "inferContextWindow"> | undefined): boolean {
+  return config?.inferContextWindow === true
+    && !BUILTIN_NAMES.has(provider.toLowerCase()) && !resolveMetadataProvider(provider);
+}
+
+const normalize = (id: string): string => id.toLowerCase().replaceAll(".", "-");
+type Candidate = VendorContextInference | null;
+
+/** Build a pure lookup; conflicting windows within one authority tier fail closed. */
+export function createVendorContextLookup(
+  vendors: readonly ModelMetadata[],
+  aggregators: readonly ModelMetadata[],
+): (id: string) => VendorContextInference | undefined {
+  const build = (rows: readonly ModelMetadata[], source: VendorContextInference["source"]) => {
+    const exact = new Map<string, Candidate>();
+    const normalized = new Map<string, Candidate>();
+    const add = (map: Map<string, Candidate>, id: string, value: VendorContextInference) => {
+      if (!map.has(id)) map.set(id, value);
+      else if (map.get(id)?.contextWindow !== value.contextWindow) map.set(id, null);
+    };
+    for (const row of rows) {
+      const window = row.contextWindow;
+      if (!Number.isSafeInteger(window) || window! <= 0 || row.id.startsWith("~")) continue;
+      const value: VendorContextInference = { source, provider: row.provider, modelId: row.id, contextWindow: window! };
+      const ids = source === "aggregator" ? [row.id, row.id.slice(row.id.lastIndexOf("/") + 1)] : [row.id];
+      for (const id of ids) {
+        if (!id) continue;
+        add(exact, id, value);
+        add(normalized, normalize(id), value);
+      }
+    }
+    return { exact, normalized };
+  };
+  const tiers = [build(vendors, "vendor"), build(aggregators, "aggregator")];
+  return rawId => {
+    const id = rawId.trim();
+    if (!id || id.startsWith("~")) return undefined;
+    for (const tier of tiers) {
+      // An exact spelling wins over its normalized alias. A conflicting key does not
+      // fall through to a lower-authority source and accidentally regain a larger window.
+      const map = tier.exact.has(id) ? tier.exact : tier.normalized;
+      const key = map === tier.exact ? id : normalize(id);
+      if (map.has(key)) {
+        const value = map.get(key);
+        return value ? { ...value } : undefined;
+      }
+    }
+    return undefined;
+  };
+}
+
+let lookup: ReturnType<typeof createVendorContextLookup> | undefined;
+export function vendorContextInference(modelId: string): VendorContextInference | undefined {
+  lookup ??= createVendorContextLookup(VENDORS.flatMap(listModelMetadata), AGGREGATORS.flatMap(listModelMetadata));
+  return lookup(modelId);
+}
+
+export function vendorContextWindow(modelId: string): number | undefined {
+  return vendorContextInference(modelId)?.contextWindow;
+}

package/src/codex/cli-install-provenance.ts

@@ -18,6 +18,9 @@ import { isSpawnableCodexCandidate } from "./exec-invocation";
 import {
   codexRuntimeStatePath,
   parsePersistedCodexRuntime,
+  resolveCodexRuntime,
+  type ResolveCodexRuntimeDeps,
+  type ResolveCodexRuntimeResult,
 } from "./runtime";
 import {
   inspectCodexShimBackingForCommand,
@@ -46,12 +49,13 @@ export type CodexCliInstallReason =
   | "shim_state_unknown"
   | "shim_update_deferred"
   | "app_bundle"
-  | "version_manager_owned"
-  | "npm_global_unverified"
-  | "selection_unattested"
-  | "version_mismatch"
-  | "unverified_standalone"
-  | "inspection_failed";
+ | "version_manager_owned"
+ | "npm_global_unverified"
+  | "managed_npm_global"
+ | "selection_unattested"
+ | "version_mismatch"
+ | "unverified_standalone"
+ | "inspection_failed";
 
 export type CodexCliCandidateSource = "environment" | "persisted";
 export type CodexCliInstallEvidence =
@@ -82,6 +86,12 @@ export interface CodexCliInstallReport {
   readonly managed: boolean;
   readonly reason: CodexCliInstallReason;
   readonly location: string | null;
+  /**
+   * sha256 digest of the canonical package manifest root when one was observed,
+   * otherwise null. Digest-only so the public report still carries no path; plan
+   * identity binds this value so two different install roots cannot share a plan.
+   */
+  readonly installDigest: string | null;
   readonly packageVersion: string | null;
   readonly shim: Readonly<{
     status: "not-tracked" | "matched" | "unknown";
@@ -105,6 +115,19 @@ export interface CodexCliInstallProvenanceDeps {
     platform: NodeJS.Platform,
     configDir: string,
   ) => CodexShimBackingForCommand;
+  /**
+   * Caller assertion that `env.CODEX_CLI_PATH` is the runtime the launcher actually
+   * selected, not merely a configured name. Only a proof-bound caller may set this;
+   * a persisted selection and an arbitrary environment stay unattested.
+   */
+  readonly selectionAttested?: boolean;
+  /**
+   * The command the runtime resolver actually selected under the same evidence.
+   * Attestation additionally requires its canonical path to match the inspected
+   * candidate, so a snapshot candidate the resolver would have rejected cannot
+   * turn a different installation managed.
+   */
+  readonly selectedCommand?: string | null;
 }
 
 interface PackageManifestEvidence {
@@ -159,6 +182,7 @@ function unknownReport(
     managed: false,
     reason,
     location: extra.location ?? null,
+    installDigest: null,
     packageVersion: null,
     shim: Object.freeze({ status: "not-tracked", backingKind: null }),
     evidence: Object.freeze([]),
@@ -287,6 +311,38 @@ function resolveCandidateCommandPath(
   return null;
 }
 
+/** Resolve selection under inspection's bounded, local-only filesystem policy. */
+export function observeCodexCliSelectedCommand(
+  deps: CodexCliInstallProvenanceDeps,
+  resolve: (deps: ResolveCodexRuntimeDeps) => ResolveCodexRuntimeResult = resolveCodexRuntime,
+): string | null {
+  const platform = deps.platform ?? process.platform;
+  // Even the general resolver's existence checks can touch a remote Windows
+  // candidate. Deferred inspection must return before invoking it at all.
+  if (platform === "win32") return null;
+  const configDir = deps.configDir ?? getConfigDir();
+  if (!isSafeLocalInspectionPath(configDir, deps)) return null;
+  try {
+    return resolve({
+      platform,
+      env: deps.env,
+      configDir,
+      discoverAlternatives: false,
+      probeVersion: false,
+      // Runtime and shim state must use the same no-follow, nonblocking,
+      // size-bounded descriptor reads as provenance, including before selection.
+      readFileSync: path => {
+        const bytes = readBoundedFile(path, MAX_RUNTIME_STATE_BYTES, deps);
+        if (!bytes) throw new Error("inspection_state_unavailable");
+        return bytes.toString("utf8");
+      },
+      existsSync: path => resolveCandidateCommandPath(path, deps) !== null,
+    }).runtime.command ?? null;
+  } catch {
+    return null;
+  }
+}
+
 function canonicalize(path: string, deps: CodexCliInstallProvenanceDeps): string | null {
   if (!isSafeLocalInspectionPath(path, deps)) return null;
   try {
@@ -630,15 +686,16 @@ export async function inspectCodexCliInstall(
         managed: false,
         reason: appBundle ? "app_bundle" : "version_manager_owned",
         location: publicExecutableLocation(lexicalCandidatePath, platform),
+        installDigest: null,
         packageVersion: null,
         shim: Object.freeze({ status: "unknown", backingKind: null }),
         evidence: Object.freeze([appBundle ? "app_bundle_path" : "version_manager_path"]),
       });
     }
-    return unknownWindowsReport("windows_inspection_deferred", candidate, {
-      location: publicExecutableLocation(lexicalCandidatePath, platform),
-    });
-  }
+   return unknownWindowsReport("windows_inspection_deferred", candidate, {
+     location: publicExecutableLocation(lexicalCandidatePath, platform),
+   });
+ }
   const configDir = deps.configDir ?? getConfigDir();
   if (!isSafeLocalInspectionPath(configDir, deps)) {
     return unknownReport("shim_state_unknown", candidate);
@@ -651,6 +708,23 @@ export async function inspectCodexCliInstall(
   if (!canonicalCandidatePath) {
     return unknownReport("candidate_path_unsafe", candidate);
   }
+  // Only a proof-bound caller may attest that the environment candidate is the
+  // runtime it actually selected, and only when the runtime resolver picked the
+  // same canonical path under the same evidence. A persisted selection records
+  // intent, not the resolved binary, and an arbitrary environment is ambient —
+  // neither can become managed here; a resolver that would choose a different
+  // executable cannot attest the snapshot's installation either.
+  const resolverPicked = deps.selectedCommand
+    ? canonicalize(
+        resolveCandidateCommandPath(deps.selectedCommand, deps) ?? deps.selectedCommand,
+        deps,
+      )
+    : null;
+  const selectionAttested =
+    deps.selectionAttested === true
+    && candidate.evidence === "environment"
+    && resolverPicked !== null
+    && samePath(resolverPicked, canonicalCandidatePath, platform);
   const inspectShim = deps.inspectShim ?? inspectCodexShimBackingForCommand;
   const shim = inspectShim(candidatePath, platform, configDir);
   if (shim.status === "unknown") {
@@ -658,6 +732,7 @@ export async function inspectCodexCliInstall(
       ...unknownReport("shim_state_unknown", candidate, {
         location: publicExecutableLocation(canonicalCandidatePath, platform),
       }),
+      selectionAttested,
       shim: shimReport(shim),
     });
   }
@@ -666,6 +741,7 @@ export async function inspectCodexCliInstall(
       ...unknownReport("shim_update_deferred", candidate, {
         location: publicExecutableLocation(canonicalCandidatePath, platform),
       }),
+      selectionAttested,
       provenance: "standalone-unverified",
       shim: shimReport(shim),
       evidence: Object.freeze(["canonical_path", "shim_backing"] as const),
@@ -685,7 +761,7 @@ export async function inspectCodexCliInstall(
       candidateAvailable: true,
       candidateVersion: candidate.version,
       candidateSource: candidate.evidence,
-      selectionAttested: false,
+      selectionAttested,
       versionEvidence: Object.freeze({
         kind: candidate.version ? "advisory-runtime" as const : "unavailable" as const,
       }),
@@ -693,6 +769,7 @@ export async function inspectCodexCliInstall(
       managed: false,
       reason: "app_bundle",
       location,
+      installDigest: null,
       packageVersion: null,
       shim: shimReport(shim),
       evidence: Object.freeze(["canonical_path", "app_bundle_path"]),
@@ -706,7 +783,7 @@ export async function inspectCodexCliInstall(
       candidateAvailable: true,
       candidateVersion: candidate.version,
       candidateSource: candidate.evidence,
-      selectionAttested: false,
+      selectionAttested,
       versionEvidence: Object.freeze({
         kind: candidate.version ? "advisory-runtime" as const : "unavailable" as const,
       }),
@@ -714,6 +791,7 @@ export async function inspectCodexCliInstall(
       managed: false,
       reason: "version_manager_owned",
       location,
+      installDigest: null,
       packageVersion: null,
       shim: shimReport(shim),
       evidence: Object.freeze(["canonical_path", "version_manager_path"]),
@@ -722,6 +800,7 @@ export async function inspectCodexCliInstall(
   if (/codex[.]opencodex-real(?:[.](?:cmd|bat|exe))?$/i.test(pathTools(platform).basename(candidatePath))) {
     return freezeReport({
       ...unknownReport("shim_state_unknown", candidate, { location }),
+      selectionAttested,
       shim: shimReport(shim),
     });
   }
@@ -745,22 +824,30 @@ export async function inspectCodexCliInstall(
     const versionMatches = candidate.version === null || candidate.version === manifest.version;
     const reason: CodexCliInstallReason = !global || !linked
       ? "npm_global_unverified"
-      : !versionMatches ? "version_mismatch" : "selection_unattested";
+      : !versionMatches ? "version_mismatch"
+        : selectionAttested ? "managed_npm_global" : "selection_unattested";
     return freezeReport({
       schemaVersion: 1,
       candidateAvailable: true,
       candidateVersion: candidate.version,
       candidateSource: candidate.evidence,
-      selectionAttested: false,
+      selectionAttested,
       versionEvidence: Object.freeze({
-        kind: manifestOwned && candidate.version !== null && versionMatches
+        // The manifest is the on-disk record of what is installed. An absent advisory
+        // version (the launcher snapshot carries no version) cannot contradict it,
+        // while a reported one that disagrees already classified as version_mismatch.
+        kind: manifestOwned && versionMatches
           ? "package-manifest" as const
           : candidate.version !== null ? "advisory-runtime" as const : "unavailable" as const,
       }),
       provenance: manifestOwned ? "npm-global" : "standalone-unverified",
-      managed: false,
+      managed: manifestOwned && versionMatches && selectionAttested,
       reason,
       location,
+      // Plan identity binds this digest, not the redacted display location: two
+      // package roots that resolve to the same "<path>/codex" string must still
+      // produce different plans.
+      installDigest: sha256("codex-cli-install-root-v1", normalizePath(manifest.root, platform)),
       packageVersion: manifest.version,
       shim: shimReport(shim),
       evidence: Object.freeze<CodexCliInstallEvidence[]>([
@@ -786,7 +873,7 @@ export async function inspectCodexCliInstall(
     candidateAvailable: true,
     candidateVersion: candidate.version,
     candidateSource: candidate.evidence,
-    selectionAttested: false,
+    selectionAttested,
     versionEvidence: Object.freeze({
       kind: candidate.version ? "advisory-runtime" as const : "unavailable" as const,
     }),
@@ -794,6 +881,7 @@ export async function inspectCodexCliInstall(
     managed: false,
     reason: "unverified_standalone",
     location,
+    installDigest: null,
     packageVersion: null,
     shim: shimReport(shim),
     evidence: Object.freeze(["canonical_path"]),