@bitkyc08/opencodex 2.86.0 → 2.88.0

package/src/codex/catalog/routed-gather.ts

@@ -35,7 +35,6 @@ import {
 import type { OcxConfig, OcxProviderConfig } from "../../types";
 import { modelInList } from "../../types";
 import { CODEX_REASONING_LEVELS, codexEffortRank, configuredReasoningEfforts, modelRecordValue, sanitizeCodexReasoningEfforts } from "../../reasoning-effort";
-import { isModelVisionSidecarConsumer } from "../../vision/eligibility";
 import { getModelMetadata, getModelMetadataCaseInsensitive, listModelMetadata, resolveMetadataProvider, type ModelMetadata } from "../../generated/model-metadata";
 import { enrichProviderFromRegistry, shouldCaseFoldMetadataModelId } from "../../providers/derive";
 import {
@@ -103,7 +102,7 @@ import type {
   CatalogTrustedOpenAiApiPolicySnapshot,
 } from "../convergence-types";
 import type { CatalogGatherProviderAuthOutcome, CatalogGatherProviderModelOutcome, GatherFlightCapture, ModelsAuthResolverFactory } from "./gather-capture";
-import { applyProviderConfigHints, configuredAutoCompactTokenLimit, configuredMaxInputTokens, configuredReasoningSummarySupport, modelInputModalities, routedMaxOutputTokens } from "./model-hints";
+import { applyProviderConfigHints, configuredAutoCompactTokenLimit, configuredMaxInputTokens, configuredModelDisplayName, configuredReasoningSummarySupport, modelInputModalities, routedMaxOutputTokens, withVisionSidecarInput } from "./model-hints";
 import { resolveComboCatalogMember } from "./combo-member";
 import { captureGatherFlight, captureTrustedOpenAiApiPolicy, gatherFlightKey, keyedGatherBytesIdentity, withCanonicalOpenAiForwardAuthDefault } from "./gather-capture";
 import { fetchProviderModelsWithAuth, observedModelsAuthResolver, refreshingModelsAuthResolver } from "./provider-models";
@@ -330,6 +329,7 @@ async function gatherRoutedModelsUncached(
   const localProviderAuthOutcomes = capture.providerAuthOutcomes;
   const resolveAuth = capture.authResolver;
   const ttlMs = config.modelCacheTtlMs ?? DEFAULT_MODEL_CACHE_TTL_MS;
+  const visionSidecarEnabled = config.visionSidecar?.enabled !== false;
   // Persisted provider entries can predate newer registry fields (noVisionModels,
   // modelInputModalities, ...). The ROUTER merges registry seeds at request time
   // (routedProviderConfig), so the proxy behaves correctly — the catalog listing must see the
@@ -337,6 +337,8 @@ async function gatherRoutedModelsUncached(
   // vision-sidecar model advertised text-only, blocking image attachments app-side).
   // Enrich a CLONE: hydrated defaults must never leak into the persisted config.
   const activeProviders = capture.providers;
+  // Use admission-time provider clones for sidecar advertisement, custom rows and combo members.
+  const enrichedByName = new Map(activeProviders.map(provider => [provider.name, provider.provider]));
   const providerResults = await Promise.all(
     activeProviders.map(provider => fetchProviderModelsWithAuth(
       provider,
@@ -378,7 +380,9 @@ async function gatherRoutedModelsUncached(
     config,
     metadataModelIdCaseFoldByProvider,
     metadataConfigDirByProvider,
+    false,
   )
+    .map(model => withVisionSidecarInput(model, enrichedByName.get(model.provider), visionSidecarEnabled))
     // Drop image/video generation models (e.g. Grok image/video) by default. Cursor's static catalog
     // intentionally mirrors Cursor's public model table, including Gemini image preview, so the
     // exposure decision goes through shouldExposeRoutedModel (single choke point).
@@ -482,9 +486,6 @@ async function gatherRoutedModelsUncached(
       ...(custom.codexToolMode !== undefined ? { codexToolMode: custom.codexToolMode } : {}),
     });
   }
-  // Enriched (registry-hydrated) provider clones — shared by combo member synthesis and
-  // custom-model vision-sidecar inheritance so both see the same merged registry view.
-  const enrichedByName = new Map(activeProviders.map(provider => [provider.name, provider.provider]));
   for (const id of listComboIds(config)) {
     const combo = getCombo(config, id);
     if (!combo) continue;
@@ -521,6 +522,7 @@ async function gatherRoutedModelsUncached(
         nativeAliasFallback,
         metadataModelIdCaseFoldByProvider.get(target.provider),
         metadataConfigDirByProvider.get(target.provider),
+        visionSidecarEnabled,
       ))
       .filter((member): member is CatalogModel => member !== undefined);
     const derived = deriveComboCatalogModel(id, combo, members);
@@ -714,7 +716,7 @@ async function gatherRoutedModelsUncached(
     const customContextHints = merged.contextWindow === undefined && effectiveProvider && canInferVendorContext(cm.provider, effectiveProvider)
       ? applyProviderConfigHints(cm.provider, effectiveProvider, { provider: cm.provider, id: cm.modelId },
         providerContextCap(config, cm.provider), metadataModelIdCaseFoldByProvider.get(cm.provider),
-        undefined, metadataConfigDirByProvider.get(cm.provider))
+        undefined, metadataConfigDirByProvider.get(cm.provider), false)
       : undefined;
     const contextResolved: CatalogModel = customContextHints?.contextWindow !== undefined
       ? { ...merged, contextWindow: customContextHints.contextWindow,
@@ -762,13 +764,7 @@ async function gatherRoutedModelsUncached(
       : mergedWithHardBounds;
     const enrichedProvider = enrichedByName.get(cm.provider) ?? rawProvider;
     // Reuse the request-time consumer predicate so custom rows cannot drift from catalog hints.
-    if (enrichedProvider && isModelVisionSidecarConsumer(enrichedProvider, mergedWithAutoCompact.id)) {
-      const current = mergedWithAutoCompact.inputModalities ?? ["text"];
-      if (!current.includes("image")) {
-        return { ...mergedWithAutoCompact, inputModalities: [...current, "image"] };
-      }
-    }
-    return mergedWithAutoCompact;
+    return withVisionSidecarInput(mergedWithAutoCompact, enrichedProvider, visionSidecarEnabled);
   });
   // Custom rows override discovered rows that encode to the same Codex-facing slug. A provider whose
   // captured discovery declares an order (preferFirst) keeps each replacement in the discovered row's
@@ -890,10 +886,12 @@ function augmentRoutedModelsWithCapturedOpenAiApiRows(
       undefined,
       metadataConfigDir,
     );
+    const displayName = configuredModelDisplayName(configured, id);
     return {
       provider: OPENAI_API_PROVIDER_ID,
       id,
       owned_by: OPENAI_API_PROVIDER_ID,
+      ...(displayName ? { displayName } : {}),
       ...(contextWindow ? { contextWindow } : {}),
       ...(maxInputTokens ? { maxInputTokens } : {}),
       ...(maxOutputTokens !== undefined ? { maxOutputTokens } : {}),
@@ -948,6 +946,7 @@ export function augmentRoutedModelsWithMetadata(
   caps?: Pick<OcxConfig, "providerContextCaps">,
   metadataModelIdCaseFoldByProvider?: ReadonlyMap<string, boolean>,
   metadataConfigDirByProvider?: ReadonlyMap<string, string>,
+  includeVisionSidecar = true,
 ): CatalogModel[] {
   const out = [...models];
   const indexByKey = new Map(out.map((model, index) => [`${model.provider}/${model.id}`, index]));
@@ -977,6 +976,7 @@ export function augmentRoutedModelsWithMetadata(
             metadataModelIdCaseFoldByProvider?.get(provider),
             undefined,
             metadataConfigDirByProvider?.get(provider),
+            includeVisionSidecar,
           )
           : seeded;
         continue;
@@ -1001,6 +1001,7 @@ export function augmentRoutedModelsWithMetadata(
             metadataModelIdCaseFoldByProvider?.get(provider),
             undefined,
             metadataConfigDirByProvider?.get(provider),
+            includeVisionSidecar,
           )
           : {}),
       });

package/src/codex/cli-install-provenance.ts

@@ -18,6 +18,9 @@ import { isSpawnableCodexCandidate } from "./exec-invocation";
 import {
   codexRuntimeStatePath,
   parsePersistedCodexRuntime,
+  resolveCodexRuntime,
+  type ResolveCodexRuntimeDeps,
+  type ResolveCodexRuntimeResult,
 } from "./runtime";
 import {
   inspectCodexShimBackingForCommand,
@@ -46,12 +49,13 @@ export type CodexCliInstallReason =
   | "shim_state_unknown"
   | "shim_update_deferred"
   | "app_bundle"
-  | "version_manager_owned"
-  | "npm_global_unverified"
-  | "selection_unattested"
-  | "version_mismatch"
-  | "unverified_standalone"
-  | "inspection_failed";
+ | "version_manager_owned"
+ | "npm_global_unverified"
+  | "managed_npm_global"
+ | "selection_unattested"
+ | "version_mismatch"
+ | "unverified_standalone"
+ | "inspection_failed";
 
 export type CodexCliCandidateSource = "environment" | "persisted";
 export type CodexCliInstallEvidence =
@@ -82,6 +86,12 @@ export interface CodexCliInstallReport {
   readonly managed: boolean;
   readonly reason: CodexCliInstallReason;
   readonly location: string | null;
+  /**
+   * sha256 digest of the canonical package manifest root when one was observed,
+   * otherwise null. Digest-only so the public report still carries no path; plan
+   * identity binds this value so two different install roots cannot share a plan.
+   */
+  readonly installDigest: string | null;
   readonly packageVersion: string | null;
   readonly shim: Readonly<{
     status: "not-tracked" | "matched" | "unknown";
@@ -105,6 +115,19 @@ export interface CodexCliInstallProvenanceDeps {
     platform: NodeJS.Platform,
     configDir: string,
   ) => CodexShimBackingForCommand;
+  /**
+   * Caller assertion that `env.CODEX_CLI_PATH` is the runtime the launcher actually
+   * selected, not merely a configured name. Only a proof-bound caller may set this;
+   * a persisted selection and an arbitrary environment stay unattested.
+   */
+  readonly selectionAttested?: boolean;
+  /**
+   * The command the runtime resolver actually selected under the same evidence.
+   * Attestation additionally requires its canonical path to match the inspected
+   * candidate, so a snapshot candidate the resolver would have rejected cannot
+   * turn a different installation managed.
+   */
+  readonly selectedCommand?: string | null;
 }
 
 interface PackageManifestEvidence {
@@ -159,6 +182,7 @@ function unknownReport(
     managed: false,
     reason,
     location: extra.location ?? null,
+    installDigest: null,
     packageVersion: null,
     shim: Object.freeze({ status: "not-tracked", backingKind: null }),
     evidence: Object.freeze([]),
@@ -287,6 +311,38 @@ function resolveCandidateCommandPath(
   return null;
 }
 
+/** Resolve selection under inspection's bounded, local-only filesystem policy. */
+export function observeCodexCliSelectedCommand(
+  deps: CodexCliInstallProvenanceDeps,
+  resolve: (deps: ResolveCodexRuntimeDeps) => ResolveCodexRuntimeResult = resolveCodexRuntime,
+): string | null {
+  const platform = deps.platform ?? process.platform;
+  // Even the general resolver's existence checks can touch a remote Windows
+  // candidate. Deferred inspection must return before invoking it at all.
+  if (platform === "win32") return null;
+  const configDir = deps.configDir ?? getConfigDir();
+  if (!isSafeLocalInspectionPath(configDir, deps)) return null;
+  try {
+    return resolve({
+      platform,
+      env: deps.env,
+      configDir,
+      discoverAlternatives: false,
+      probeVersion: false,
+      // Runtime and shim state must use the same no-follow, nonblocking,
+      // size-bounded descriptor reads as provenance, including before selection.
+      readFileSync: path => {
+        const bytes = readBoundedFile(path, MAX_RUNTIME_STATE_BYTES, deps);
+        if (!bytes) throw new Error("inspection_state_unavailable");
+        return bytes.toString("utf8");
+      },
+      existsSync: path => resolveCandidateCommandPath(path, deps) !== null,
+    }).runtime.command ?? null;
+  } catch {
+    return null;
+  }
+}
+
 function canonicalize(path: string, deps: CodexCliInstallProvenanceDeps): string | null {
   if (!isSafeLocalInspectionPath(path, deps)) return null;
   try {
@@ -630,15 +686,16 @@ export async function inspectCodexCliInstall(
         managed: false,
         reason: appBundle ? "app_bundle" : "version_manager_owned",
         location: publicExecutableLocation(lexicalCandidatePath, platform),
+        installDigest: null,
         packageVersion: null,
         shim: Object.freeze({ status: "unknown", backingKind: null }),
         evidence: Object.freeze([appBundle ? "app_bundle_path" : "version_manager_path"]),
       });
     }
-    return unknownWindowsReport("windows_inspection_deferred", candidate, {
-      location: publicExecutableLocation(lexicalCandidatePath, platform),
-    });
-  }
+   return unknownWindowsReport("windows_inspection_deferred", candidate, {
+     location: publicExecutableLocation(lexicalCandidatePath, platform),
+   });
+ }
   const configDir = deps.configDir ?? getConfigDir();
   if (!isSafeLocalInspectionPath(configDir, deps)) {
     return unknownReport("shim_state_unknown", candidate);
@@ -651,6 +708,23 @@ export async function inspectCodexCliInstall(
   if (!canonicalCandidatePath) {
     return unknownReport("candidate_path_unsafe", candidate);
   }
+  // Only a proof-bound caller may attest that the environment candidate is the
+  // runtime it actually selected, and only when the runtime resolver picked the
+  // same canonical path under the same evidence. A persisted selection records
+  // intent, not the resolved binary, and an arbitrary environment is ambient —
+  // neither can become managed here; a resolver that would choose a different
+  // executable cannot attest the snapshot's installation either.
+  const resolverPicked = deps.selectedCommand
+    ? canonicalize(
+        resolveCandidateCommandPath(deps.selectedCommand, deps) ?? deps.selectedCommand,
+        deps,
+      )
+    : null;
+  const selectionAttested =
+    deps.selectionAttested === true
+    && candidate.evidence === "environment"
+    && resolverPicked !== null
+    && samePath(resolverPicked, canonicalCandidatePath, platform);
   const inspectShim = deps.inspectShim ?? inspectCodexShimBackingForCommand;
   const shim = inspectShim(candidatePath, platform, configDir);
   if (shim.status === "unknown") {
@@ -658,6 +732,7 @@ export async function inspectCodexCliInstall(
       ...unknownReport("shim_state_unknown", candidate, {
         location: publicExecutableLocation(canonicalCandidatePath, platform),
       }),
+      selectionAttested,
       shim: shimReport(shim),
     });
   }
@@ -666,6 +741,7 @@ export async function inspectCodexCliInstall(
       ...unknownReport("shim_update_deferred", candidate, {
         location: publicExecutableLocation(canonicalCandidatePath, platform),
       }),
+      selectionAttested,
       provenance: "standalone-unverified",
       shim: shimReport(shim),
       evidence: Object.freeze(["canonical_path", "shim_backing"] as const),
@@ -685,7 +761,7 @@ export async function inspectCodexCliInstall(
       candidateAvailable: true,
       candidateVersion: candidate.version,
       candidateSource: candidate.evidence,
-      selectionAttested: false,
+      selectionAttested,
       versionEvidence: Object.freeze({
         kind: candidate.version ? "advisory-runtime" as const : "unavailable" as const,
       }),
@@ -693,6 +769,7 @@ export async function inspectCodexCliInstall(
       managed: false,
       reason: "app_bundle",
       location,
+      installDigest: null,
       packageVersion: null,
       shim: shimReport(shim),
       evidence: Object.freeze(["canonical_path", "app_bundle_path"]),
@@ -706,7 +783,7 @@ export async function inspectCodexCliInstall(
       candidateAvailable: true,
       candidateVersion: candidate.version,
       candidateSource: candidate.evidence,
-      selectionAttested: false,
+      selectionAttested,
       versionEvidence: Object.freeze({
         kind: candidate.version ? "advisory-runtime" as const : "unavailable" as const,
       }),
@@ -714,6 +791,7 @@ export async function inspectCodexCliInstall(
       managed: false,
       reason: "version_manager_owned",
       location,
+      installDigest: null,
       packageVersion: null,
       shim: shimReport(shim),
       evidence: Object.freeze(["canonical_path", "version_manager_path"]),
@@ -722,6 +800,7 @@ export async function inspectCodexCliInstall(
   if (/codex[.]opencodex-real(?:[.](?:cmd|bat|exe))?$/i.test(pathTools(platform).basename(candidatePath))) {
     return freezeReport({
       ...unknownReport("shim_state_unknown", candidate, { location }),
+      selectionAttested,
       shim: shimReport(shim),
     });
   }
@@ -745,22 +824,30 @@ export async function inspectCodexCliInstall(
     const versionMatches = candidate.version === null || candidate.version === manifest.version;
     const reason: CodexCliInstallReason = !global || !linked
       ? "npm_global_unverified"
-      : !versionMatches ? "version_mismatch" : "selection_unattested";
+      : !versionMatches ? "version_mismatch"
+        : selectionAttested ? "managed_npm_global" : "selection_unattested";
     return freezeReport({
       schemaVersion: 1,
       candidateAvailable: true,
       candidateVersion: candidate.version,
       candidateSource: candidate.evidence,
-      selectionAttested: false,
+      selectionAttested,
       versionEvidence: Object.freeze({
-        kind: manifestOwned && candidate.version !== null && versionMatches
+        // The manifest is the on-disk record of what is installed. An absent advisory
+        // version (the launcher snapshot carries no version) cannot contradict it,
+        // while a reported one that disagrees already classified as version_mismatch.
+        kind: manifestOwned && versionMatches
           ? "package-manifest" as const
           : candidate.version !== null ? "advisory-runtime" as const : "unavailable" as const,
       }),
       provenance: manifestOwned ? "npm-global" : "standalone-unverified",
-      managed: false,
+      managed: manifestOwned && versionMatches && selectionAttested,
       reason,
       location,
+      // Plan identity binds this digest, not the redacted display location: two
+      // package roots that resolve to the same "<path>/codex" string must still
+      // produce different plans.
+      installDigest: sha256("codex-cli-install-root-v1", normalizePath(manifest.root, platform)),
       packageVersion: manifest.version,
       shim: shimReport(shim),
       evidence: Object.freeze<CodexCliInstallEvidence[]>([
@@ -786,7 +873,7 @@ export async function inspectCodexCliInstall(
     candidateAvailable: true,
     candidateVersion: candidate.version,
     candidateSource: candidate.evidence,
-    selectionAttested: false,
+    selectionAttested,
     versionEvidence: Object.freeze({
       kind: candidate.version ? "advisory-runtime" as const : "unavailable" as const,
     }),
@@ -794,6 +881,7 @@ export async function inspectCodexCliInstall(
     managed: false,
     reason: "unverified_standalone",
     location,
+    installDigest: null,
     packageVersion: null,
     shim: shimReport(shim),
     evidence: Object.freeze(["canonical_path"]),