llm-switcher 1.1.5 → 1.1.6

package/README.md

@@ -191,7 +191,15 @@ flowchart LR
 
 ---
 
-## Changes in 1.1.5
+## Changes in 1.1.6
+
+- **Codex over WebSocket.** The gateway keeps the turns of each WebSocket session. A turn that sends `previous_response_id` gets the earlier turns back, so Codex no longer loses the task after the first tool call. An unknown id fails the turn with `previous_response_not_found`.
+- **Codex warmup.** A `response.create` frame with `generate: false` gets a local answer. It no longer spends a model call.
+- **Codex model name.** A profile without `publicModels` no longer sends `OpenAI-Model: main` in the handshake, and `switch codex` and `switch doctor` warn about it. Codex read `main` as a reroute and showed a false "high-risk cyber activity" warning. See "Codex-first setup".
+- **Contract lab.** The gateway uploads each sample with the key that opened its trace. intact refused the 1.1.5 uploads with `HTTP 404 trace not found`.
+- **Version stamp.** The stamp uses the last commit only when the checkout has no changes. Otherwise it uses the newest file time.
+
+### Changes in 1.1.5
 
 - **Contract lab privacy.** Masking now uses an allowlist. Every string value is masked except the enum values that intact reads. 1.1.4 masked a list of content keys and missed 16 fields (citations, document and web titles, web search queries, logprobs tokens, file names and URIs, stop sequences, participant names, error messages, tool descriptions).
 
@@ -342,6 +350,8 @@ The shim does not edit `~/.codex/config.toml`. When the gateway is active, it pa
 | `review` | `review_model` | `publicModels[1]` |
 | `subagent` | `agents.default_subagent_model` | `publicModels[2]` |
 
+**A profile that serves Codex must have `publicModels`.** Without it, the gateway has no official name for Codex. It then writes no model catalog and sends no `OpenAI-Model` header, and Codex shows two false warnings: "Model metadata for `<model>` not found" and "Your account was flagged for potentially high-risk cyber activity". `switch codex` and `switch doctor` warn when the Codex profile has no `publicModels`.
+
 **Codex never receives an internal name.** The slot aliases `main`, `review` and `subagent` stay inside the gateway. The CLI receives the official model names from `publicModels`, and `mapModel` resolves each one back to its slot. Set `codexRoles` in the profile when you want a different pairing than the order of that list.
 
 The shim also passes `model_catalog_json`. That file is generated from `publicModels` on every profile change, and the `/model` picker reads it. The picker never calls `/v1/models`. `/v1/models` serves the same entries, and each window follows `model1M` for its slot.
@@ -544,7 +554,12 @@ re-opened from a shell where the shim is on `PATH`.
         "sonnet": true,
         "haiku": false,
         "fable": true
-      }
+      },
+      // Codex keys. A profile that serves Codex MUST have publicModels (see Codex-first setup).
+      "publicModels": ["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna"], // official names for main, review, subagent
+      "codexRoles": { "review": "gpt-5.6-sol" }, // optional: pair one role with another public name
+      "blindfold": false,            // true: Codex keeps its official endpoint (see Codex blindfold mode)
+      "blindfoldPort": 3457          // interceptor port when blindfold is true
     }
   },
   "debug": false,

package/README.vi.md

@@ -191,7 +191,15 @@ flowchart LR
 
 ---
 
-## Thay đổi trong bản 1.1.5
+## Thay đổi trong bản 1.1.6
+
+- **Codex qua WebSocket.** Gateway giữ các lượt của mỗi phiên WebSocket. Lượt nào gửi `previous_response_id` sẽ nhận lại các lượt trước, nên Codex không còn mất nhiệm vụ sau lần gọi tool đầu tiên. Id không tồn tại làm lượt đó lỗi với `previous_response_not_found`.
+- **Warmup của Codex.** Frame `response.create` có `generate: false` được trả lời ngay tại máy. Frame này không còn tốn một lần gọi model.
+- **Tên model cho Codex.** Profile không có `publicModels` không còn gửi `OpenAI-Model: main` trong handshake, và `switch codex` cùng `switch doctor` cảnh báo trường hợp này. Codex đọc `main` là bị chuyển model và hiện cảnh báo sai "high-risk cyber activity". Xem mục "Cấu hình ưu tiên Codex".
+- **Contract lab.** Gateway gửi mỗi mẫu bằng đúng key đã mở trace của mẫu đó. intact từ chối các lần gửi của bản 1.1.5 với `HTTP 404 trace not found`.
+- **Dấu phiên bản.** Dấu phiên bản chỉ dùng commit cuối khi bản checkout không có thay đổi. Nếu có thay đổi, dấu dùng thời gian file mới nhất.
+
+### Thay đổi trong bản 1.1.5
 
 - **Bảo mật contract lab.** Việc che giờ dùng allowlist. Mọi giá trị string đều bị che, trừ các giá trị enum mà intact đọc. Bản 1.1.4 che theo danh sách key nội dung và bỏ sót 16 field (trích dẫn, tiêu đề tài liệu và trang web, câu truy vấn web search, token logprobs, tên và URI file, stop sequence, tên người tham gia, thông báo lỗi, mô tả tool).
 
@@ -344,6 +352,8 @@ Shim không sửa `~/.codex/config.toml`. Khi gateway hoạt động, shim truy
 | `review` | `review_model` | `publicModels[1]` |
 | `subagent` | `agents.default_subagent_model` | `publicModels[2]` |
 
+**Profile phục vụ Codex bắt buộc có `publicModels`.** Nếu thiếu khóa này, gateway không có tên chính thức nào để đưa cho Codex. Khi đó gateway không ghi model catalog và không gửi header `OpenAI-Model`, và Codex hiện hai cảnh báo sai: "Model metadata for `<model>` not found" và "Your account was flagged for potentially high-risk cyber activity". `switch codex` và `switch doctor` cảnh báo khi profile Codex không có `publicModels`.
+
 **Codex không bao giờ nhận tên nội bộ.** Alias `main`, `review`, `subagent` chỉ tồn tại bên trong gateway. CLI nhận tên model chính thức từ `publicModels`, và `mapModel` phân giải ngược từng tên về đúng slot. Đặt `codexRoles` trong profile nếu muốn ghép khác thứ tự danh sách đó.
 
 Shim còn truyền `model_catalog_json`. File này được sinh lại từ `publicModels` mỗi lần đổi profile, và màn `/model` đọc chính nó. Màn `/model` không gọi `/v1/models`. `/v1/models` trả cùng các mục đó, và context window của mỗi mục theo `model1M` của slot.
@@ -544,7 +554,12 @@ trong `PATH`.
         "sonnet": true,
         "haiku": false,
         "fable": true
-      }
+      },
+      // Khóa cho Codex. Profile phục vụ Codex BẮT BUỘC có publicModels (xem Cấu hình ưu tiên Codex).
+      "publicModels": ["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna"], // tên chính thức cho main, review, subagent
+      "codexRoles": { "review": "gpt-5.6-sol" }, // không bắt buộc: ghép một vai trò với tên public khác
+      "blindfold": false,            // true: Codex giữ endpoint chính thức (xem chế độ blindfold)
+      "blindfoldPort": 3457          // cổng interceptor khi blindfold là true
     }
   },
   "debug": false,

package/contract.mjs

@@ -42,6 +42,26 @@ let cachedVersion = '';
 
 // package version + the commit time, the shape the half route demands. Without git (an unpacked
 // copy) the mtime of package.json stands in, so the value always parses as a past UTC time.
+// The time of the code that runs. The last commit counts only when the tree matches it: files copied
+// over an old checkout (a ZIP) keep the old commit, so a dirty tree uses its newest code file instead.
+export function versionStamp(rootDir) {
+  const git = (...a) => execFileSync('git', ['-C', rootDir, ...a], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 5000 }).trim();
+  try {
+    if (git('status', '--porcelain', '--untracked-files=no') === '') {
+      const out = git('log', '-1', '--format=%ct');
+      if (/^\d{1,12}$/.test(out)) return Number(out) * 1000;
+    }
+  } catch {}
+  let newest = 0;
+  try {
+    for (const name of fs.readdirSync(rootDir)) {
+      if (!/\.(mjs|json|html)$/.test(name)) continue;
+      newest = Math.max(newest, fs.statSync(path.join(rootDir, name)).mtimeMs);
+    }
+  } catch {}
+  return newest || Date.now();
+}
+
 export function switcherVersion() {
   if (cachedVersion) return cachedVersion;
   let version = '0.0.0';
@@ -50,17 +70,12 @@ export function switcherVersion() {
     const pkgPath = path.join(ROOT_DIR, 'package.json');
     const parsed = /^(\d{1,5}\.\d{1,5}\.\d{1,5})/.exec(JSON.parse(fs.readFileSync(pkgPath, 'utf8')).version || '');
     if (parsed) version = parsed[1];
-    stampMs = fs.statSync(pkgPath).mtimeMs;
-  } catch {}
-  try {
-    const out = execFileSync('git', ['-C', ROOT_DIR, 'log', '-1', '--format=%ct'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
-    if (/^\d{1,12}$/.test(out)) stampMs = Number(out) * 1000;
   } catch {}
+  stampMs = versionStamp(ROOT_DIR);
   cachedVersion = `${version}+${utcStamp(stampMs)}`;
   return cachedVersion;
 }
 
-/** Copies what the gateway writes to the client. Past the cap the side is dropped, not cut. */
 // ---------------- masking of client content ----------------
 // A half leaves this machine, so every string value is masked with "x" of the same byte length,
 // except the enum values that intact's reducer reads: the same key list, value shape and exclusions as
@@ -119,6 +134,7 @@ export function maskHalf(text) {
   }).join('\n');
 }
 
+/** Copies what the gateway writes to the client. Past the cap the side is dropped, not cut. */
 export function createHalfTap(limit = MAX_HALF_BYTES) {
   const chunks = [];
   let size = 0;
@@ -273,7 +289,9 @@ export function createContractLab(options = {}) {
     try {
       const res = await call(`${s.url}/api/contracts/traces/${encodeURIComponent(traceId)}/half`, {
         method: 'POST',
-        headers: { 'content-type': 'application/json', authorization: `Bearer ${s.apiKey}` },
+        // intact takes a half only from the key that opened the trace, the one this request used;
+        // contractLab.apiKey stays for the policy, findings and fixtures.
+        headers: { 'content-type': 'application/json', authorization: `Bearer ${half.openerKey || s.apiKey}` },
         body
       });
       // 409 means intact already holds this half: the work is done, a retry would only repeat it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "llm-switcher",
-  "version": "1.1.5",
+  "version": "1.1.6",
   "description": "Zero-dependency multi-protocol edge gateway & provider switcher for Claude Code, Codex, OpenAI and Gemini clients",
   "keywords": [
     "llm",

package/proxy.mjs

@@ -861,7 +861,8 @@ async function handleConvert(clientFormat, req, res, bodyBuffer, opts = {}) {
         toolResponse: halfTap?.text() || '',
         toolVersion: toolVersionFromUA(req.headers['user-agent']),
         inFormat: clientFormat,
-        outFormat
+        outFormat,
+        openerKey: profile.apiKey || ''
       });
     }
   }
@@ -1461,14 +1462,44 @@ function tapWsEvent(tap, event, data) {
 // Terminal failure for the WS (responses-ws) transport: Codex ends a turn only on
 // response.completed / response.failed, so a bare {type:'error'} frame leaves the turn
 // hanging. Emit the full created -> in_progress -> failed sequence instead.
-function sendWsFailed(socket, model, message, status = 500, tap = null) {
+function sendWsFailed(socket, model, message, status = 500, tap = null, code = null) {
   if (!socket.writable) return;
   const renderer = createResponsesStream((e, d) => {
     tapWsEvent(tap, e, d);
     if (socket.writable) socket.write(encodeWsFrame(JSON.stringify(d)));
   }, model || 'main');
   renderer.start();
-  renderer.error(message, responsesErrorCode(status));
+  renderer.error(message, code || responsesErrorCode(status));
+}
+
+// Codex on WebSocket sends only the new items of a turn and names the turn before in
+// previous_response_id; the server keeps the rest. The gateway keeps it per socket, bounded.
+const WS_HISTORY_MAX = 8;
+// Only these output items are valid input for the next turn; reasoning items are not replayed.
+const WS_REPLAY_TYPES = new Set(['message', 'function_call', 'custom_tool_call', 'local_shell_call']);
+
+function wsInputItems(input) {
+  if (typeof input === 'string') return input ? [{ type: 'message', role: 'user', content: [{ type: 'input_text', text: input }] }] : [];
+  return Array.isArray(input) ? input : [];
+}
+
+function rememberWsTurn(history, response, input) {
+  if (!history || !response?.id) return;
+  const output = (Array.isArray(response.output) ? response.output : []).filter(i => i && WS_REPLAY_TYPES.has(i.type));
+  history.set(response.id, [...input, ...output]);
+  while (history.size > WS_HISTORY_MAX) history.delete(history.keys().next().value);
+}
+
+// A generate:false frame warms the session up (Codex sends its whole tool list in it); it needs no model call.
+function answerWsWarmup(socket, payload, history, input) {
+  let completed = null;
+  const renderer = createResponsesStream((e, d) => {
+    if (e === 'response.completed') completed = d.response;
+    if (socket.writable) socket.write(encodeWsFrame(JSON.stringify(d)));
+  }, typeof payload?.model === 'string' ? payload.model : 'main');
+  renderer.start();
+  renderer.finish('stop', { completion: 0, prompt: 0, cached: 0, reasoning: 0, hasTools: false });
+  rememberWsTurn(history, completed, input);
 }
 
 // 9Router forwards OpenAI-format tools to Gemini/Vertex for ag/* models, which accept only
@@ -1483,7 +1514,7 @@ function geminiSafeTools(tools) {
 }
 
 // One turn of the Codex WS transport. The socket loop runs turns one at a time and owns `ac`.
-async function handleWsResponseCreate(socket, payload, req, ac) {
+async function handleWsResponseCreate(socket, payload, req, ac, history = null) {
   const clientFormat = 'responses';
   const { profileKey, profile, error: profileError } = getActiveProfile(clientFormat, req);
   if (!loadConfig()) {
@@ -1495,6 +1526,22 @@ async function handleWsResponseCreate(socket, payload, req, ac) {
     return;
   }
 
+  let input = wsInputItems(payload.input);
+  if (payload.previous_response_id) {
+    const earlier = history?.get(payload.previous_response_id);
+    if (!earlier) {
+      sendWsFailed(socket, payload?.model || 'main', `Previous response ${String(payload.previous_response_id).slice(0, 80)} is not known on this connection.`, 400, null, 'previous_response_not_found');
+      return;
+    }
+    input = [...earlier, ...input];
+  }
+  if (payload.generate === false) {
+    answerWsWarmup(socket, payload, history, input);
+    return;
+  }
+  const { previous_response_id: _prev, ...rest } = payload;
+  payload = { ...rest, input };
+
   let ir;
   try {
     ir = parseToIR('responses', payload);
@@ -1546,8 +1593,10 @@ async function handleWsResponseCreate(socket, payload, req, ac) {
     const normalize = createUpstreamNormalizer(outFormat);
     const col = createCollector();
 
+    let completedResponse = null;
     const renderer = createResponsesStream((e, d) => {
       tapWsEvent(halfTap, e, d);
+      if (e === 'response.completed') completedResponse = d.response;
       if (socket.writable) {
         socket.write(encodeWsFrame(JSON.stringify(d)));
       }
@@ -1567,6 +1616,7 @@ async function handleWsResponseCreate(socket, payload, req, ac) {
     } else {
       renderer.finish(col.finish, { completion, prompt: col.prompt, cached: col.cached, reasoning: col.reasoning, hasTools: col.tools.size > 0 });
       answered = true;
+      rememberWsTurn(history, completedResponse, input);
     }
     log({
       status: streamError ? 502 : 200, stream: true,
@@ -1588,7 +1638,8 @@ async function handleWsResponseCreate(socket, payload, req, ac) {
       toolResponse: halfTap?.text() || '',
       toolVersion: toolVersionFromUA(req.headers['user-agent']),
       inFormat: clientFormat,
-      outFormat
+      outFormat,
+      openerKey: profile.apiKey || ''
     });
   }
 }
@@ -1633,14 +1684,15 @@ server.on('upgrade', (req, socket) => {
   // The official name or the slot, never the upstream ID. The value goes into a raw header line.
   const { profile } = getActiveProfile('responses', req);
   const publicMain = profile ? codexPublicModel(profile, 'main') : '';
-  const activeModel = isSafeModelName(publicMain) ? publicMain : 'main';
+  // With no public name, no header: Codex compares it with the model it asked for, and "main" reads as a reroute.
+  const modelHeader = isSafeModelName(publicMain) ? `OpenAI-Model: ${publicMain}\r\n` : '';
 
   socket.write(
     'HTTP/1.1 101 Switching Protocols\r\n' +
     'Upgrade: websocket\r\n' +
     'Connection: Upgrade\r\n' +
     `Sec-WebSocket-Accept: ${accept}\r\n` +
-    `OpenAI-Model: ${activeModel}\r\n` +
+    modelHeader +
     'x-reasoning-included: true\r\n' +
     'x-codex-turn-state: ready\r\n\r\n'
   );
@@ -1649,6 +1701,7 @@ server.on('upgrade', (req, socket) => {
   // Turns run one at a time: two at once interleave their events on one socket. Every turn,
   // queued or running, holds a controller here, so a cancel or a close stops all of them.
   const turns = new Set();
+  const history = new Map(); // response id -> the input items of that turn plus its output
   let turnChain = Promise.resolve();
   const abortTurns = () => { for (const ac of turns) ac.abort(); };
 
@@ -1657,7 +1710,7 @@ server.on('upgrade', (req, socket) => {
       const ac = new AbortController();
       turns.add(ac);
       turnChain = turnChain
-        .then(() => (ac.signal.aborted ? null : handleWsResponseCreate(socket, msg, req, ac)))
+        .then(() => (ac.signal.aborted ? null : handleWsResponseCreate(socket, msg, req, ac, history)))
         .catch(err => {
           // A throw before the handler's own try: Codex ends a turn only on response.failed.
           console.error('[llm-switcher:ws] Unhandled turn error:', err);

package/state.mjs

@@ -285,6 +285,14 @@ export function isSafeModelName(name) {
   return typeof name === 'string' && SAFE_MODEL_NAME.test(name) && !TOML_NON_STRING.test(name);
 }
 
+// Codex compares the handshake model with the one it asked for, and reads its /model catalog from publicModels.
+export function codexPublicModelsWarning(key, profile) {
+  if (!profile || isSafeModelName(codexPublicModel(profile, 'main'))) return '';
+  return `Profile "${key}" serves Codex but has no publicModels. Codex gets no model catalog and shows false `
+    + `"model metadata not found" and "high-risk cyber activity" warnings. Add for example `
+    + `"publicModels": ["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna"], then run \`switch codex ${key}\` again.`;
+}
+
 /**
  * Does this leaf certificate cover the host the interceptor will present it for?
  * Changing blindfoldHost without rebuilding the leaf produces a TLS error that reads

package/switch.mjs

@@ -9,7 +9,7 @@ import {
   applyLaunchState, clearLaunchState, computeLaunchState,
   modelSlotsForProfile, modelForSlot, model1MForSlot, readAdminToken, adminTokenPath, openLog,
   probeGateway, probeBlindfold, blindfoldPreflight, stopRecordedBlindfold, writeDashboardLauncher,
-  contractLabSettings
+  contractLabSettings, codexPublicModelsWarning
 } from './state.mjs';
 import { runProbe, runCheck } from './contract.mjs';
 import {
@@ -436,6 +436,9 @@ async function turnOn(profileName, cliTarget) {
   printTargets(getActiveMap(planned));
   console.log(`\nClaude 1M:    ${describeClaude1M(st)}`);
   console.log(`Codex 1M:     ${st.codex1M ? 'ACTIVE (1,000,000 tokens)' : 'OFF'}`);
+  const codexKey = getActiveMap(planned).responses;
+  const codexWarning = codexPublicModelsWarning(show(codexKey), planned.profiles[codexKey]);
+  if (codexWarning) console.warn(`\n[WARN] ${codexWarning}`);
 }
 
 async function turnOff(targetArg) {
@@ -770,6 +773,10 @@ async function runDoctor() {
     const p = config.profiles[key];
     if (!p) warn(`[WARN] Target ${t} points to missing profile "${show(key)}".`);
     else if (!p.baseURL || /YOUR-|REPLACE-ME/i.test(`${p.baseURL} ${p.apiKey}`)) warn(`[WARN] Profile "${show(key)}" (${t}) still has placeholder baseURL/apiKey.`);
+    if (p && t === 'responses') {
+      const codexWarning = codexPublicModelsWarning(show(key), p);
+      if (codexWarning) warn(`[WARN] ${codexWarning}`);
+    }
   }
 
   // 3. Launcher flags match proxy state

package/tests/contract-lab.test.mjs

@@ -394,7 +394,8 @@ test('the half of a sampled request reaches intact with the exchange and the ver
   }, 'a sampled request to reach intact');
   const last = halves.at(-1);
   assert.match(last.traceId, TRACE_ID_RE);
-  assert.equal(last.headers.authorization, 'Bearer sk-lab');
+  // intact accepts a half only from the key that opened the trace: the key of the profile that made the call.
+  assert.equal(last.headers.authorization, 'Bearer sk-secret-ant');
   assert.deepEqual(last.body.converter, { inFormat: 'anthropic', outFormat: 'anthropic' });
   assert.equal(last.body.toolVersion, '1.2.3');
   assert.match(last.body.switcherVersion, SWITCHER_VERSION_RE);
@@ -557,7 +558,9 @@ test('a sampled Codex WS turn is tagged and its half reaches intact', async () =
   assert.match(body.switcherVersion, SWITCHER_VERSION_RE);
   const asked = JSON.parse(body.toolRequest);
   assert.equal(asked.type, 'response.create');
-  assert.equal(asked.input, 'x'.repeat('hello over ws'.length), 'the WS request is masked');
+  // The half holds the request as the upstream saw it: the turn's input as items (with any earlier
+  // turns restored from previous_response_id), its text masked.
+  assert.equal(asked.input[0].content[0].text, 'x'.repeat('hello over ws'.length), 'the WS request is masked');
   assert.ok(body.toolResponse.includes('event: response.completed'), 'the half holds the events the turn wrote');
   assert.ok(!body.toolResponse.includes('ws ok'), 'the answer text is masked in the half');
 });

package/tests/datadir.test.mjs

@@ -49,3 +49,17 @@ test('make-certs.sh runs with an openssl that lacks LibreSSL-missing options', {
   execFileSync('bash', [script, 'chatgpt.com', out], { env: { ...process.env, PATH: `${bin}:${process.env.PATH}` }, stdio: 'pipe' });
   for (const f of ['ca.pem', 'leaf.pem', 'leaf.key']) assert.ok(fs.existsSync(path.join(out, f)), f);
 });
+
+// LS-4: files copied over an old checkout (a ZIP) must not borrow the time of the old commit.
+test('the version stamp uses the commit time only when the working tree is clean', async () => {
+  const { versionStamp } = await import('../contract.mjs');
+  const dir = tmp();
+  const git = (...a) => execFileSync('git', ['-C', dir, ...a], { stdio: 'pipe', env: { ...process.env, GIT_AUTHOR_DATE: '2026-01-01T00:00:00Z', GIT_COMMITTER_DATE: '2026-01-01T00:00:00Z' } });
+  fs.writeFileSync(path.join(dir, 'package.json'), '{"version":"1.2.3"}');
+  fs.writeFileSync(path.join(dir, 'a.mjs'), 'export {};\n');
+  git('init', '-q'); git('-c', 'user.email=t@t', '-c', 'user.name=t', 'add', '.'); git('-c', 'user.email=t@t', '-c', 'user.name=t', 'commit', '-qm', 'old');
+  const commitMs = Date.parse('2026-01-01T00:00:00Z');
+  assert.equal(versionStamp(dir), commitMs, 'clean tree: commit time');
+  fs.writeFileSync(path.join(dir, 'a.mjs'), 'export const changed = 1;\n');
+  assert.ok(versionStamp(dir) > commitMs + 60_000, 'dirty tree: the time of the newest file, not of the old commit');
+});

package/tests/gateway.e2e.test.mjs

@@ -784,9 +784,10 @@ test('Codex WS: a frame larger than the body cap closes the socket before it is
   assert.equal(close.payload.readUInt16BE(0), 1009);
 });
 
-test('Codex WS: 101 reply names the public main model or the slot, never the upstream id', async () => {
+test('Codex WS: 101 reply names the public main model, or no model, never the upstream id', async () => {
   const hidden = await rawWs({ 'x-llm-profile': 'agmock' });
-  assert.match(hidden.reply, /\r\nOpenAI-Model: main\r\n/i);
+  // With no public name the header is left out: Codex reads a different name as a reroute (LS-2).
+  assert.ok(!/\r\nOpenAI-Model:/i.test(hidden.reply), hidden.reply);
   assert.ok(!hidden.reply.includes('ag/mock-flash'));
   hidden.socket.destroy();
   const published = await rawWs({ 'x-llm-profile': 'pub' });
@@ -805,6 +806,45 @@ test('Codex WS: overlapping response.create turns run one after the other', asyn
   ws.socket.destroy();
 });
 
+// LS-1: from turn 2 Codex sends previous_response_id and only the new items; the gateway must put the
+// earlier turns back, or the model loses the task and loops.
+test('Codex WS: previous_response_id brings back the earlier turns', async () => {
+  const ws = await rawWs();
+  ws.socket.write(clientFrame(1, JSON.stringify({ type: 'response.create', model: 'main', input: 'remember the code word ZEBRA-42' })));
+  assert.ok(await until(() => ws.messages.some(m => m.type === 'response.completed')), 'turn 1 ends');
+  const firstId = ws.messages.find(m => m.type === 'response.completed').response.id;
+  const before = received.length;
+  ws.socket.write(clientFrame(1, JSON.stringify({ type: 'response.create', model: 'main', previous_response_id: firstId,
+    input: [{ type: 'function_call_output', call_id: 'call_1', output: 'tool says ok' }] })));
+  assert.ok(await until(() => ws.messages.filter(m => m.type === 'response.completed' || m.type === 'response.failed').length === 2), 'turn 2 ends');
+  const sent = JSON.stringify(received.slice(before).at(-1).body);
+  assert.ok(sent.includes('ZEBRA-42'), `turn 2 upstream lost turn 1: ${sent.slice(0, 400)}`);
+  assert.ok(sent.includes('tool says ok'), 'turn 2 keeps its own new item');
+  ws.socket.destroy();
+});
+
+test('Codex WS: an unknown previous_response_id fails the turn without an upstream call', async () => {
+  const ws = await rawWs();
+  const before = received.length;
+  ws.socket.write(clientFrame(1, JSON.stringify({ type: 'response.create', model: 'main', previous_response_id: 'resp_unknown', input: [] })));
+  assert.ok(await until(() => ws.messages.some(m => m.type === 'response.failed')), 'the turn fails');
+  assert.equal(ws.messages.find(m => m.type === 'response.failed').response.error.code, 'previous_response_not_found');
+  assert.equal(received.length, before, 'no upstream call');
+  ws.socket.destroy();
+});
+
+// LS-3: Codex opens a session with generate:false. It carries the whole tool list and needs no answer.
+test('Codex WS: a generate:false warmup is answered locally, never sent upstream', async () => {
+  const ws = await rawWs();
+  const before = received.length;
+  ws.socket.write(clientFrame(1, JSON.stringify({ type: 'response.create', model: 'main', generate: false, input: [], tools: [] })));
+  assert.ok(await until(() => ws.messages.some(m => m.type === 'response.completed')), 'the warmup completes');
+  const done = ws.messages.find(m => m.type === 'response.completed');
+  assert.deepEqual(done.response.output, []);
+  assert.equal(received.length, before, 'no upstream call for a warmup');
+  ws.socket.destroy();
+});
+
 test('Codex WS: a mid-stream error is logged with its text', async () => {
   const ws = await rawWs();
   ws.socket.write(clientFrame(1, JSON.stringify({ type: 'response.create', model: 'main', input: 'MID_STREAM_ERROR over ws' })));

package/tests/switch.test.mjs

@@ -154,3 +154,20 @@ test('switch port stops the new gateway it started when it rolls back', { skip:
   });
   assert.equal(probe, 'free', 'nothing listens on the abandoned port');
 });
+
+// Without publicModels the gateway has no official name to give Codex: no model catalog, no OpenAI-Model
+// header, and Codex prints false "metadata not found" and "high-risk cyber activity" warnings.
+test('switch codex and switch doctor warn when the Codex profile has no publicModels', { skip: !POSIX && 'posix' }, async (t) => {
+  const base = { mode: 'convert', inFormat: 'auto', baseURL: 'http://127.0.0.1:9/v1', apiKey: 'k', defaultModels: { opus: 'o' } };
+  const ws = workspace(t, await freePort(), { bare: { name: 'Bare', ...base }, named: { name: 'Named', ...base, publicModels: ['gpt-5.6-sol'] } });
+  const on = await run(ws, ['codex', 'bare']);
+  assert.equal(on.status, 0, on.stderr);
+  assert.match(on.stdout + on.stderr, /\[WARN\].*"bare".*publicModels/);
+  const doctor = await run(ws, ['doctor']);
+  assert.match(doctor.stdout, /\[WARN\].*"bare".*publicModels/);
+
+  const named = await run(ws, ['codex', 'named']);
+  assert.equal(named.status, 0, named.stderr);
+  assert.doesNotMatch(named.stdout + named.stderr, /publicModels/);
+  assert.doesNotMatch((await run(ws, ['doctor'])).stdout, /publicModels/);
+});