@bitkyc08/opencodex 2.9.1 → 2.10.0

package/src/codex/app-server-processes.ts

@@ -8,8 +8,9 @@
  * `hermes-codex-bridge-mcp`.
  */
 import { execFileSync } from "node:child_process";
-import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { isProcessAlive, waitForExit } from "../lib/process-control";
+import { readCodexCatalogPath } from "./catalog/parsing";
 
 export const STALE_CODEX_APP_SERVER_HINT =
   "If Codex still shows an older model list, restart its long-lived app-server process after sync (ocx sync --restart-codex).";
@@ -72,6 +73,7 @@ export interface ProcessSnapshot {
   commandLine: string;
   uid?: number;
   owner?: string;
+  startedAtMs?: number;
 }
 
 export interface CodexAppServerProcessIo {
@@ -82,6 +84,8 @@ export interface CodexAppServerProcessIo {
   kill?: (pid: number, signal: NodeJS.Signals) => void;
   waitExit?: (pid: number, timeoutMs: number) => boolean;
   now?: () => number;
+  readStartMs?: (pid: number) => number | null;
+  catalogMtimeMs?: () => number | null;
 }
 
 /** Split a process command line into argv-like tokens (handles simple quotes). */
@@ -237,7 +241,9 @@ function parseUnixProcStatusUid(status: string): number | undefined {
 }
 
 function listUnixProcSnapshots(uid: number | undefined): ProcessSnapshot[] {
-  if (!existsSync("/proc")) return [];
+  // procfs missing on a Linux-shaped platform is an enumeration failure, not
+  // "no processes" — the staleness collector must not read it as not_running.
+  if (!existsSync("/proc")) throw new Error("procfs_unavailable");
   const out: ProcessSnapshot[] = [];
   for (const ent of readdirSync("/proc")) {
     if (!/^\d+$/.test(ent)) continue;
@@ -262,40 +268,38 @@ function listUnixProcSnapshots(uid: number | undefined): ProcessSnapshot[] {
 
 function listDarwinSnapshots(uid: number | undefined): ProcessSnapshot[] {
   const out: ProcessSnapshot[] = [];
-  try {
-    const output = uid !== undefined
-      ? execFileSync("ps", ["-u", String(uid), "-o", "pid=,command="], {
-        encoding: "utf-8",
-        stdio: ["ignore", "pipe", "ignore"],
-        timeout: 8_000,
-      })
-      : execFileSync("ps", ["-axo", "pid=,uid=,command="], {
-        encoding: "utf-8",
-        stdio: ["ignore", "pipe", "ignore"],
-        timeout: 8_000,
-      });
-    for (const raw of output.split(/\r?\n/)) {
-      const line = raw.trim();
-      if (!line) continue;
-      if (uid !== undefined) {
-        const match = /^(\d+)\s+(.*)$/.exec(line);
-        if (!match) continue;
-        const pid = Number(match[1]);
-        const commandLine = match[2]?.trim() ?? "";
-        if (!Number.isSafeInteger(pid) || pid <= 1 || !commandLine) continue;
-        out.push({ pid, commandLine, uid });
-        continue;
-      }
-      const match = /^(\d+)\s+(\d+)\s+(.*)$/.exec(line);
+  // Top-level exec failure propagates: callers decide their own safe default
+  // (restart flow → treat as none; staleness check → unknown, never "fresh").
+  const output = uid !== undefined
+    ? execFileSync("ps", ["-u", String(uid), "-o", "pid=,command="], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 5_000,
+    })
+    : execFileSync("ps", ["-axo", "pid=,uid=,command="], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 5_000,
+    });
+  for (const raw of output.split(/\r?\n/)) {
+    const line = raw.trim();
+    if (!line) continue;
+    if (uid !== undefined) {
+      const match = /^(\d+)\s+(.*)$/.exec(line);
       if (!match) continue;
       const pid = Number(match[1]);
-      const processUid = Number(match[2]);
-      const commandLine = match[3]?.trim() ?? "";
+      const commandLine = match[2]?.trim() ?? "";
       if (!Number.isSafeInteger(pid) || pid <= 1 || !commandLine) continue;
-      out.push({ pid, commandLine, uid: Number.isSafeInteger(processUid) ? processUid : undefined });
+      out.push({ pid, commandLine, uid });
+      continue;
     }
-  } catch {
-    return out;
+    const match = /^(\d+)\s+(\d+)\s+(.*)$/.exec(line);
+    if (!match) continue;
+    const pid = Number(match[1]);
+    const processUid = Number(match[2]);
+    const commandLine = match[3]?.trim() ?? "";
+    if (!Number.isSafeInteger(pid) || pid <= 1 || !commandLine) continue;
+    out.push({ pid, commandLine, uid: Number.isSafeInteger(processUid) ? processUid : undefined });
   }
   return out;
 }
@@ -333,33 +337,34 @@ export function listWindowsSnapshots(): ProcessSnapshot[] {
     "} | ForEach-Object {",
     "  try {",
     "    $o=Invoke-CimMethod -InputObject $_ -MethodName GetOwner -ErrorAction Stop",
-    "    if($null -eq $o -or $o.ReturnValue -ne 0 -or [string]::IsNullOrWhiteSpace($o.User)){return}",
+    "    if($null -eq $o -or $o.ReturnValue -ne 0 -or [string]::IsNullOrWhiteSpace($o.User)){\"__OCX_ENUM_INCOMPLETE__\"; return}",
     "    $owner=if($o.Domain){\"$($o.Domain)\\$($o.User)\"}else{$o.User}",
     "    if($owner -ine $me){return}",
     "    $cmd=($_.CommandLine -replace \"`t\",\" \")",
     "    \"{0}`t{1}`t{2}\" -f $_.ProcessId, $cmd, $owner",
-    "  } catch { }",
+    "  } catch { \"__OCX_ENUM_INCOMPLETE__\" }",
     "}",
   ].join("\n");
-  try {
-    const output = execFileSync("powershell.exe", [
-      "-NoProfile", "-NoLogo", "-NonInteractive", "-WindowStyle", "Hidden",
-      "-Command",
-      psCommand,
-    ], { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"], timeout: 12_000, windowsHide: true });
-    for (const line of output.split(/\r?\n/)) {
-      const tab = line.indexOf("\t");
-      if (tab <= 0) continue;
-      const tab2 = line.indexOf("\t", tab + 1);
-      if (tab2 <= tab) continue;
-      const pid = Number(line.slice(0, tab));
-      const commandLine = line.slice(tab + 1, tab2).trim();
-      const owner = line.slice(tab2 + 1).trim();
-      if (!Number.isSafeInteger(pid) || pid <= 1 || !commandLine || !owner) continue;
-      out.push({ pid, commandLine, owner });
-    }
-  } catch {
-    return out;
+  // Top-level exec failure propagates (see listDarwinSnapshots note).
+  const output = execFileSync("powershell.exe", [
+    "-NoProfile", "-NoLogo", "-NonInteractive", "-WindowStyle", "Hidden",
+    "-Command",
+    psCommand,
+  ], { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"], timeout: 8_000, windowsHide: true });
+  for (const line of output.split(/\r?\n/)) {
+    // A candidate whose owner could not be verified makes the whole
+    // enumeration incomplete — the staleness collector must not read the
+    // partial result as "nothing running".
+    if (line.trim() === "__OCX_ENUM_INCOMPLETE__") throw new Error("windows_enum_incomplete");
+    const tab = line.indexOf("\t");
+    if (tab <= 0) continue;
+    const tab2 = line.indexOf("\t", tab + 1);
+    if (tab2 <= tab) continue;
+    const pid = Number(line.slice(0, tab));
+    const commandLine = line.slice(tab + 1, tab2).trim();
+    const owner = line.slice(tab2 + 1).trim();
+    if (!Number.isSafeInteger(pid) || pid <= 1 || !commandLine || !owner) continue;
+    out.push({ pid, commandLine, owner });
   }
   return out;
 }
@@ -379,7 +384,18 @@ export function listCodexAppServerProcesses(io: CodexAppServerProcessIo = {}): C
       return undefined;
     }
   });
-  const snapshots = io.listSnapshots?.() ?? defaultListSnapshots(platform, getuid);
+  let snapshots: ProcessSnapshot[];
+  if (io.listSnapshots) {
+    snapshots = io.listSnapshots();
+  } else {
+    // Restart/kill contract (#476): enumeration failure means no targets —
+    // never signal a process we could not verify.
+    try {
+      snapshots = defaultListSnapshots(platform, getuid);
+    } catch {
+      snapshots = [];
+    }
+  }
   const seen = new Set<number>();
   const matched: CodexAppServerProcess[] = [];
   for (const snapshot of snapshots) {
@@ -401,6 +417,235 @@ export function formatStaleCodexAppServerWarning(processes: readonly CodexAppSer
   );
 }
 
+/** /proc/<pid>/stat starttime (clock ticks since boot) → epoch ms, or null. */
+function readLinuxProcStartMs(pid: number): number | null {
+  try {
+    const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
+    // Field 22 (starttime) follows the comm field, which may contain spaces
+    // inside parentheses — split after the final ")".
+    const close = stat.lastIndexOf(")");
+    if (close < 0) return null;
+    const fields = stat.slice(close + 2).split(/\s+/);
+    const startTicks = Number(fields[19]); // field 22 = index 19 after comm
+    const boot = /^btime\s+(\d+)/m.exec(readFileSync("/proc/stat", "utf8"));
+    if (!Number.isFinite(startTicks) || !boot) return null;
+    const hertz = 100; // USER_HZ on every supported Linux target
+    return (Number(boot[1]) + startTicks / hertz) * 1000;
+  } catch {
+    return null;
+  }
+}
+
+/** `ps` lstart → epoch ms, or null (macOS). */
+function readDarwinProcStartMs(pid: number): number | null {
+  try {
+    const out = execFileSync("ps", ["-o", "lstart=", "-p", String(pid)], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 4_000,
+    }).trim();
+    if (!out) return null;
+    const parsed = Date.parse(out);
+    return Number.isFinite(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Win32_Process.CreationDate → epoch ms, or null (Windows). */
+function readWindowsProcStartMs(pid: number): number | null {
+  try {
+    const out = execFileSync("powershell.exe", [
+      "-NoProfile", "-NoLogo", "-NonInteractive", "-WindowStyle", "Hidden",
+      "-Command",
+      `(Get-CimInstance Win32_Process -Filter "ProcessId=${pid}").CreationDate.ToUniversalTime().ToString("o")`,
+    ], { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"], timeout: 8_000, windowsHide: true }).trim();
+    if (!out) return null;
+    const parsed = Date.parse(out);
+    return Number.isFinite(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Best-effort process start time; null when the platform source is unreadable. */
+export function readProcessStartMs(pid: number, platform: NodeJS.Platform = process.platform): number | null {
+  if (platform === "win32") return readWindowsProcStartMs(pid);
+  if (platform === "darwin") return readDarwinProcStartMs(pid);
+  return readLinuxProcStartMs(pid);
+}
+
+/**
+ * Start times for many pids in ONE platform call where possible, so the
+ * staleness check does not serialize per-process ps/PowerShell invocations
+ * on the request path (#857). Missing entries come back as null.
+ */
+export function readProcessStartMsBatch(
+  pids: readonly number[],
+  platform: NodeJS.Platform = process.platform,
+): Map<number, number | null> {
+  const out = new Map<number, number | null>();
+  if (pids.length === 0) return out;
+  if (platform === "darwin") {
+    try {
+      const stdout = execFileSync("ps", ["-o", "pid=,lstart=", "-p", pids.join(",")], {
+        encoding: "utf-8",
+        stdio: ["ignore", "pipe", "ignore"],
+        timeout: 3_000,
+      });
+      const byPid = new Map<number, number>();
+      for (const raw of stdout.split(/\r?\n/)) {
+        const match = /^\s*(\d+)\s+(.+)$/.exec(raw);
+        if (!match) continue;
+        const pid = Number(match[1]);
+        const parsed = Date.parse(match[2]!.trim());
+        if (Number.isSafeInteger(pid) && Number.isFinite(parsed)) byPid.set(pid, parsed);
+      }
+      for (const pid of pids) out.set(pid, byPid.get(pid) ?? null);
+      return out;
+    } catch {
+      for (const pid of pids) out.set(pid, null);
+      return out;
+    }
+  }
+  if (platform === "win32") {
+    try {
+      const filter = pids.map(pid => `ProcessId=${pid}`).join(" OR ");
+      const stdout = execFileSync("powershell.exe", [
+        "-NoProfile", "-NoLogo", "-NonInteractive", "-WindowStyle", "Hidden",
+        "-Command",
+        `Get-CimInstance Win32_Process -Filter "${filter}" | ForEach-Object { "$($_.ProcessId)\t$($_.CreationDate.ToUniversalTime().ToString("o"))" }`,
+      ], { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"], timeout: 5_000, windowsHide: true });
+      const byPid = new Map<number, number>();
+      for (const line of stdout.split(/\r?\n/)) {
+        const tab = line.indexOf("\t");
+        if (tab <= 0) continue;
+        const pid = Number(line.slice(0, tab));
+        const parsed = Date.parse(line.slice(tab + 1).trim());
+        if (Number.isSafeInteger(pid) && Number.isFinite(parsed)) byPid.set(pid, parsed);
+      }
+      for (const pid of pids) out.set(pid, byPid.get(pid) ?? null);
+      return out;
+    } catch {
+      for (const pid of pids) out.set(pid, null);
+      return out;
+    }
+  }
+  for (const pid of pids) out.set(pid, readLinuxProcStartMs(pid));
+  return out;
+}
+
+export type CodexAppServerCatalogState = "fresh" | "stale" | "not_running" | "unknown";
+
+export interface CodexAppServerCatalogStatus {
+  state: CodexAppServerCatalogState;
+  processes: Array<{ pid: number; startedAtMs: number | null }>;
+  catalogMtimeMs: number | null;
+}
+
+/** Resolve the catalog file Codex app-servers loaded at startup, for staleness checks. */
+function defaultCatalogMtimeMs(): number | null {
+  try {
+    return statSync(readCodexCatalogPath()).mtimeMs;
+  } catch {
+    return null;
+  }
+}
+
+// Short TTL: process listing + stat run once per window even under per-turn
+// guidance calls (#857).
+let catalogStateCache: { atMs: number; status: CodexAppServerCatalogStatus } | null = null;
+const CATALOG_STATE_TTL_MS = 5_000;
+
+/**
+ * Compare the on-disk catalog mtime against the start time of running Codex
+ * app-servers (#857): a server that started before the catalog changed keeps
+ * an in-memory copy that disagrees with what ocx advertises.
+ *
+ * Cost note: a cold call synchronously runs the platform listing plus ONE
+ * batched start-time query (hard bounds: ~5s+3s macOS, ~8s+5s Windows,
+ * microseconds on Linux); the 5s TTL then serves repeats. Typical cold cost
+ * is tens of milliseconds; fully-async background refresh is deliberately
+ * out of scope for this slice.
+ *
+ * - not_running: no app-server process → nothing can disagree.
+ * - unknown: catalog unreadable, or any server's start time is unreadable —
+ *   callers must treat this conservatively (suppress positive model claims).
+ * - stale: at least one server predates the catalog mtime.
+ */
+export function collectCodexAppServerCatalogState(
+  io: CodexAppServerProcessIo = {},
+): CodexAppServerCatalogStatus {
+  const now = (io.now ?? Date.now)();
+  const fullyDefault = !io.listSnapshots && !io.readStartMs && !io.catalogMtimeMs
+    && !io.platform && !io.getuid && !io.now;
+  if (fullyDefault
+    && catalogStateCache && now - catalogStateCache.atMs < CATALOG_STATE_TTL_MS) {
+    return catalogStateCache.status;
+  }
+  const compute = (): CodexAppServerCatalogStatus => {
+    const platform = io.platform ?? process.platform;
+    const getuid = io.getuid ?? (() => {
+      try {
+        return typeof process.getuid === "function" ? process.getuid() : undefined;
+      } catch {
+        return undefined;
+      }
+    });
+    let snapshots: ProcessSnapshot[];
+    let enumerationFailed = false;
+    if (io.listSnapshots) {
+      snapshots = io.listSnapshots();
+    } else {
+      try {
+        snapshots = defaultListSnapshots(platform, getuid);
+      } catch {
+        // Enumeration failure must never read as "nothing running" — that
+        // would let positive model guidance through on guesswork (#857).
+        snapshots = [];
+        enumerationFailed = true;
+      }
+    }
+    const processes: CodexAppServerProcess[] = [];
+    const seen = new Set<number>();
+    for (const snapshot of snapshots) {
+      if (seen.has(snapshot.pid)) continue;
+      if (!isCodexAppServerCommandLine(snapshot.commandLine)) continue;
+      seen.add(snapshot.pid);
+      processes.push({ pid: snapshot.pid, commandLine: snapshot.commandLine });
+    }
+    if (processes.length === 0) {
+      return enumerationFailed
+        ? { state: "unknown", processes: [], catalogMtimeMs: null }
+        : { state: "not_running", processes: [], catalogMtimeMs: null };
+    }
+    const catalogMtimeMs = (io.catalogMtimeMs ?? defaultCatalogMtimeMs)();
+    const withStarts = io.readStartMs
+      ? processes.map(proc => ({ pid: proc.pid, startedAtMs: io.readStartMs!(proc.pid) }))
+      : (() => {
+        const batch = readProcessStartMsBatch(processes.map(proc => proc.pid), platform);
+        return processes.map(proc => ({ pid: proc.pid, startedAtMs: batch.get(proc.pid) ?? null }));
+      })();
+    if (catalogMtimeMs === null || withStarts.some(proc => proc.startedAtMs === null)) {
+      return { state: "unknown", processes: withStarts, catalogMtimeMs };
+    }
+    // `<=` is deliberate: coarse clocks (ps lstart is second-granularity) can
+    // report equal values when the catalog actually changed after startup.
+    const stale = withStarts.some(proc => proc.startedAtMs! <= catalogMtimeMs);
+    return { state: stale ? "stale" : "fresh", processes: withStarts, catalogMtimeMs };
+  };
+  const status = compute();
+  if (fullyDefault) {
+    catalogStateCache = { atMs: now, status };
+  }
+  return status;
+}
+
+/** Test hook: drop the memoized catalog state. */
+export function resetCodexAppServerCatalogStateCache(): void {
+  catalogStateCache = null;
+}
+
 export interface RestartCodexAppServersResult {
   requested: number[];
   stopped: number[];

package/src/codex/catalog/metadata.ts

@@ -34,7 +34,6 @@ import upstreamModelsSnapshot from "../data/upstream-models.json";
 import { filterSupportedNativeSlugs } from "./parsing";
 import type { RawEntry } from "./parsing";
 import { readCurrentCatalogOrCache, unique } from "./bundled";
-import { ensureGpt56ReasoningLevels, isGpt56NativeSlug } from "./effort";
 
 export const NATIVE_OPENAI_MODELS = [
   "gpt-5.5", "gpt-5.4", "gpt-5.4-mini", "gpt-5.3-codex-spark",
@@ -88,21 +87,20 @@ export function nativeReasoningEfforts(slug: string): string[] {
     ? upstream!.supported_reasoning_levels as Array<{ effort?: string }>
     : [];
   if (levels.length > 0) {
-    const efforts = levels.flatMap(l => typeof l.effort === "string" ? [l.effort] : []);
-    // gpt-5.6 natives get max+ultra restored (ensureGpt56ReasoningLevels catalog path does
-    // the same); older natives (gpt-5.5/5.4/5.4-mini/5.3-codex-spark) stop at xhigh per
-    // upstream snapshot.
-    if (isGpt56NativeSlug(slug)) {
-      const set = new Set(efforts);
-      for (const e of ["max", "ultra"]) set.add(e);
-      return [...set];
-    }
-    return efforts;
+    // Preserve the exact pinned per-model ladder. In particular, GPT-5.6 Sol and Terra
+    // include ultra while Luna intentionally ends at max.
+    return levels.flatMap(l => typeof l.effort === "string" ? [l.effort] : []);
   }
   // gpt-5.3-codex-spark is not in upstream snapshot — use the standard old-ladder default.
   return ["low", "medium", "high", "xhigh"];
 }
 
+/** Upstream-pinned default for a native slug, when present and non-empty. */
+export function nativeDefaultReasoningEffort(slug: string): string | undefined {
+  const level = UPSTREAM_NATIVE_ENTRIES.get(slug)?.default_reasoning_level;
+  return typeof level === "string" && level.length > 0 ? level : undefined;
+}
+
 export function nativeParallelToolCalls(slug: string): boolean {
   return UPSTREAM_NATIVE_ENTRIES.get(slug)?.supports_parallel_tool_calls === true
     || false;

package/src/codex/catalog/provider-fetch.ts

@@ -98,7 +98,9 @@ function stableJson(value: unknown): string {
 function providerCatalogFingerprint(name: string, prov: OcxProviderConfig): Record<string, unknown> {
   return {
     n: name,
-    live: prov.liveModels !== false,
+    // Preserve the persisted tri-state. Registry enrichment may turn an omitted value into
+    // `false` while an explicit `true` stays live, so those callers must not share a flight.
+    live: prov.liveModels ?? null,
     base: prov.baseUrl ?? "",
     adapter: prov.adapter ?? "",
     models: [...(prov.models ?? [])].sort(),
@@ -407,7 +409,6 @@ function boundedOwnedBy(value: unknown): string | undefined {
 
 export async function fetchProviderModels(name: string, prov: OcxProviderConfig, ttlMs: number, contextCap?: number): Promise<CatalogModel[]> {
   if (prov.authMode === "forward") return []; // ChatGPT backend has no /models
-  const apiKey = await resolveModelsAuthToken(name, prov);
   const seedVertexDefault = prov.adapter === "google"
     && prov.googleMode === "vertex"
     && (prov.models?.length ?? 0) === 0
@@ -418,6 +419,13 @@ export async function fetchProviderModels(name: string, prov: OcxProviderConfig,
     provider: name,
     ...catalogHintsFromProviderConfig(name, prov, id, contextCap),
   }));
+  // Static catalogs never need an OAuth refresh or an upstream model request. Clear any
+  // discovery failure left by an older live configuration even when the account is logged out.
+  if (prov.liveModels === false) {
+    clearProviderDiscoveryStatus(name);
+    return configured;
+  }
+  const apiKey = await resolveModelsAuthToken(name, prov);
   // A configured default is a real callable selector and must remain discoverable when a
   // compatible provider's live /models request fails (issue #308). Keep this separate from the
   // explicit static list: `liveModels: false` + empty `models[]` intentionally publishes zero
@@ -436,10 +444,6 @@ export async function fetchProviderModels(name: string, prov: OcxProviderConfig,
       : models
   );
   if (prov.adapter === "cursor") {
-    if (prov.liveModels === false) {
-      clearProviderDiscoveryStatus(name);
-      return configured;
-    }
     if (!apiKey) return configured;
     // Cursor uses a bespoke GetUsableModels RPC (not /models), returning the full effort-suffixed
     // variants this PLAN can use. Keep the base-model UX (the request builder appends the effort
@@ -474,10 +478,6 @@ export async function fetchProviderModels(name: string, prov: OcxProviderConfig,
     // matching Cursor's !apiKey → configured degradation and fetch-failure fallback.
     return configured;
   }
-  if (prov.liveModels === false) {
-    clearProviderDiscoveryStatus(name);
-    return configured;
-  }
   const fresh = getFreshCached(name, ttlMs);
   if (fresh) return withVertexDefaultSeed(applyConfigHintsToCachedModels(name, prov, fresh, contextCap)); // dedups Codex's frequent /v1/models polling within the TTL
   if (isModelsFetchCoolingDown(name)) {

package/src/codex/catalog/sync.ts

@@ -334,6 +334,21 @@ export function orderForSubagents(goModels: CatalogModel[], featured?: string[])
   });
 }
 
+/**
+ * True when an existing catalog row was authored by OpenCodex routing (#855).
+ * Every generated routed row — current full-slug form, the June–July 2026
+ * provider-name form, and legacy combo aliases — carries the stable
+ * description prefix `Routed via opencodex → `; foreign rows from Cursor or
+ * user tooling do not. `owned_by` cannot serve as the signal (upstream
+ * ownership), and `comp_hash` defaults to "opencodex" for every normalized
+ * row.
+ */
+function isOcxAuthoredRoutedEntry(entry: RawEntry): boolean {
+  const desc = typeof entry.description === "string" ? entry.description : "";
+  const slug = typeof entry.slug === "string" ? entry.slug : "";
+  return slug.includes("/") && desc.startsWith("Routed via opencodex → ");
+}
+
 export function mergeCatalogEntriesForSync(
   catalogModels: RawEntry[],
   routedEntries: RawEntry[],
@@ -418,12 +433,22 @@ export function mergeCatalogEntriesForSync(
   const preservingExistingRouted = routedEntries.length === 0
     && catalogModels.some(m => typeof m.slug === "string" && (m.slug as string).includes("/"));
   if (preservingExistingRouted) {
-    finalRoutedEntries = catalogModels.filter(m => typeof m.slug === "string" && (m.slug as string).includes("/"));
+    // #855: transient-fetch protection keeps existing rows, but rows OpenCodex
+    // itself authored for a provider that is no longer configured are ghosts,
+    // not protected foreign entries.
+    finalRoutedEntries = catalogModels.filter(m => {
+      if (typeof m.slug !== "string" || !(m.slug as string).includes("/")) return false;
+      const provider = (m.slug as string).slice(0, (m.slug as string).indexOf("/"));
+      return !(isOcxAuthoredRoutedEntry(m) && !gatheredProviderNames.has(provider));
+    });
   } else {
     const preservedForeignRouted = catalogModels.filter(m => {
       if (typeof m.slug !== "string" || !m.slug.includes("/")) return false;
       const provider = m.slug.slice(0, m.slug.indexOf("/"));
-      return !gatheredProviderNames.has(provider) && !freshSlugs.has(m.slug);
+      if (gatheredProviderNames.has(provider) || freshSlugs.has(m.slug)) return false;
+      // #855: an OpenCodex-authored row whose provider was deleted is a ghost;
+      // only genuinely foreign rows (Cursor, user tooling) are preserved.
+      return !isOcxAuthoredRoutedEntry(m);
     });
     finalRoutedEntries = [...routedEntries, ...preservedForeignRouted];
   }

package/src/codex/catalog.ts

@@ -2,7 +2,7 @@
 // Public surface preserved exactly; importers keep using "src/codex/catalog".
 export { isMediaGenerationModelId, shouldExposeRoutedModel, readCodexCatalogPath, readCatalog, normalizeRoutedCatalogEntry, catalogModelSlug, filterSupportedNativeSlugs, catalogModelSupportsReasoningSummaries } from "./catalog/parsing";
 export type { CatalogModel, MultiAgentMode } from "./catalog/parsing";
-export { NATIVE_OPENAI_MODELS, nativeOpenAiContextWindow, disabledNativeSlugs, visibleNativeSlugs, desktopVisibleNativeSlugs, nativeModelRows, applyNativeVisibility, upstreamNativeEntry, nativeOpenAiSlugs, listCatalogNativeSlugs } from "./catalog/metadata";
+export { NATIVE_OPENAI_MODELS, nativeOpenAiContextWindow, disabledNativeSlugs, visibleNativeSlugs, desktopVisibleNativeSlugs, nativeModelRows, applyNativeVisibility, upstreamNativeEntry, nativeOpenAiSlugs, listCatalogNativeSlugs, nativeReasoningEfforts, nativeDefaultReasoningEffort } from "./catalog/metadata";
 export { isSpawnableCodexCandidate, codexExecInvocation, loadBundledCodexCatalog, materializeBundledCodexCatalog, loadCatalogTemplate } from "./catalog/bundled";
 export { nativeEffortClamp, shouldApplyNativeEffortClamp, catalogModelEfforts, codexSupportedReasoningEfforts, clampedDefaultEffort, clampEntryToCodexSupportedEfforts, clampCatalogModelsToCodexSupport } from "./catalog/effort";
 export { applyProviderConfigHints, isDatedVariantId, filterCatalogVisibleModels, gatherRoutedModels, clearGatherRoutedModelsInflight, augmentRoutedModelsWithRegistryOpenAiApiRows, augmentRoutedModelsWithJawcodeMetadata } from "./catalog/provider-fetch";

package/src/config.ts

@@ -760,6 +760,9 @@ const configSchema = z.object({
   providers: z.record(z.string(), providerConfigSchema),
   defaultProvider: z.string().min(1).default("openai"),
   openaiProviderTierVersion: z.union([z.literal(1), z.literal(2)]).optional(),
+  // Invalid hand edits must not discard an otherwise usable config. Treat them as
+  // pre-migration so startup can safely re-run the one-time normalization.
+  googleAntigravityStaticCatalogVersion: z.literal(1).optional().catch(undefined),
   providerContextCaps: z.record(z.string(), z.number().int().positive()).optional(),
   contextCapValue: z.number().int().positive().optional(),
   multiAgentGuidanceEnabled: z.boolean().optional(),
@@ -1457,9 +1460,20 @@ function appOwnedMemoryBudgetError(value: unknown): string | null {
   return null;
 }
 
+function googleAntigravityStaticCatalogVersionError(value: unknown): string | null {
+  const raw = rawConfigRecord(value);
+  if (!raw || !Object.hasOwn(raw, "googleAntigravityStaticCatalogVersion")) return null;
+  const version = raw.googleAntigravityStaticCatalogVersion;
+  if (version === undefined || version === 1) return null;
+  return "schema_invalid: googleAntigravityStaticCatalogVersion: must be 1 or omitted";
+}
+
 /** Validate an in-memory config candidate without touching disk. Used by headless CLI import/set. */
 export function validateConfigCandidate(value: unknown): { ok: true; config: OcxConfig } | { ok: false; error: string } {
-  const boundaryError = blankHostnameError(value) ?? claudeSubagentEffortError(value) ?? appOwnedMemoryBudgetError(value);
+  const boundaryError = blankHostnameError(value)
+    ?? claudeSubagentEffortError(value)
+    ?? appOwnedMemoryBudgetError(value)
+    ?? googleAntigravityStaticCatalogVersionError(value);
   if (boundaryError) return { ok: false, error: boundaryError };
   const result = configSchema.safeParse(value);
   if (result.success) return { ok: true, config: normalizeApiKeyIds(result.data as OcxConfig) };

package/src/lib/bun-stream-caps.ts

@@ -110,3 +110,17 @@ export function selectEagerPath(
   if (platform === "win32") return decision;
   return decision.reason === "config-eager" ? decision : null;
 }
+
+/**
+ * #864 transport gate: win32 traffic that needs a client payload rewrite must
+ * use the eager single reader with the rewrite applied inline, because the
+ * alternative tee()+JS-pull chain is the Bun#32111-unsafe path that loses the
+ * terminal SSE block on Windows. Independent of the version-based eager
+ * policy: the pull chain is unsafe on the AFFECTED runtimes by definition.
+ */
+export function isWin32EagerRewrite(
+  platform: NodeJS.Platform,
+  needsClientRewrite: boolean,
+): boolean {
+  return platform === "win32" && needsClientRewrite;
+}