sneakoscope 10.3.6 → 10.3.8

package/dist/core/codex-lb/desktop-bridge/exclusive-provider-guard.js

@@ -0,0 +1,59 @@
+import { canonicalizeBridgeModelId } from '../route-index.js';
+import { DesktopBridgeError } from './types.js';
+export const OPENROUTER_ONLY_ROUTE_BLOCKED = 'openrouter_only_route_blocked';
+export const OPENROUTER_ONLY_SUBAGENT_MODEL_BLOCKED = 'openrouter_only_subagent_model_blocked';
+export const OPENROUTER_ONLY_REFUSAL_CODES = new Set([
+    OPENROUTER_ONLY_ROUTE_BLOCKED,
+    OPENROUTER_ONLY_SUBAGENT_MODEL_BLOCKED,
+]);
+const MAX_SUBAGENT_MODEL_IDS = 64;
+const OPENROUTER_ROUTE_QUALIFIER = 'openrouter:';
+export function validateOpenRouterOnlyConfig(value) {
+    const row = value && typeof value === 'object' && !Array.isArray(value) ? value : null;
+    const models = row?.subagent_models;
+    if (!row
+        || Object.keys(row).some((key) => key !== 'enabled' && key !== 'subagent_models')
+        || typeof row.enabled !== 'boolean'
+        || !Array.isArray(models)
+        || models.length > MAX_SUBAGENT_MODEL_IDS
+        || models.some((model) => typeof model !== 'string' || canonicalizeBridgeModelId(model) !== model)
+        || new Set(models).size !== models.length) {
+        throw new DesktopBridgeError('bridge_openrouter_only_config_invalid');
+    }
+}
+export function openRouterOnlyEnabled(config) {
+    return config.openRouterOnly?.enabled === true;
+}
+export function codexRequestIsChild(identity) {
+    if (!identity)
+        return false;
+    if (identity.parent_thread_id)
+        return true;
+    const kind = identity.subagent_kind?.toLowerCase() ?? null;
+    if (kind === 'compact')
+        return false;
+    return Boolean(kind) || identity.thread_source?.toLowerCase() === 'subagent';
+}
+function requestCarriesModel(request) {
+    return String(request.public_model ?? '').trim() !== '';
+}
+function subagentListKey(publicModel) {
+    const model = canonicalizeBridgeModelId(publicModel) || '';
+    return model.startsWith(OPENROUTER_ROUTE_QUALIFIER) ? model.slice(OPENROUTER_ROUTE_QUALIFIER.length) : model;
+}
+export function openRouterOnlyRefusesPinnedProvider(request, pinnedProviderId, config) {
+    return openRouterOnlyEnabled(config) && requestCarriesModel(request)
+        && pinnedProviderId !== null && pinnedProviderId !== 'openrouter';
+}
+export function assertOpenRouterOnlyRoute(request, route, config) {
+    const mode = config.openRouterOnly;
+    if (!mode || mode.enabled !== true || !requestCarriesModel(request))
+        return;
+    if (route.provider_id !== 'openrouter')
+        throw new DesktopBridgeError(OPENROUTER_ONLY_ROUTE_BLOCKED);
+    if (!codexRequestIsChild(request.identity))
+        return;
+    const key = subagentListKey(route.public_model);
+    if (!key || !mode.subagent_models.includes(key))
+        throw new DesktopBridgeError(OPENROUTER_ONLY_SUBAGENT_MODEL_BLOCKED);
+}

package/dist/core/codex-lb/desktop-bridge/http-forward.js

@@ -5,6 +5,7 @@ import { pipeline } from 'node:stream/promises';
 import { BRIDGE_OFFICIAL_ROUTE_ID } from '../bridge-contracts.js';
 import { buildOfficialPassthroughHeaders, buildProviderUpstreamHeaders, rewriteResponseHeaders } from './header-policy.js';
 import { createDesktopBridgeRejectionLogger } from './rejection-log.js';
+import { OPENROUTER_ONLY_REFUSAL_CODES, openRouterOnlyEnabled } from './exclusive-provider-guard.js';
 import { ensureDesktopBridgeRemoteTarget, isUnreachableUpstreamError, refreshDesktopBridgeRemoteTarget, resolveAndBindDesktopBridgeRouteContext, resolveCodexSessionIdentity, resolveDesktopBridgeTarget, safeBridgeErrorCode, singleBridgeHeader } from './security.js';
 import { desktopBridgeListenOrigin } from './state.js';
 import { DEFAULT_DESKTOP_BRIDGE_MAX_REQUEST_BODY_BYTES, DesktopBridgeError, DesktopBridgeRequestBodyTooLargeError } from './types.js';
@@ -46,9 +47,12 @@ function decodeBridgeRequestBody(body, encoding, maximum) {
         throw new DesktopBridgeError('bridge_responses_body_invalid_json');
     }
 }
-function bodyCarriesModel(rawUrl) {
-    const pathname = new URL(String(rawUrl || '/'), 'http://bridge.invalid').pathname;
-    return pathname === '/backend-api/codex/responses' || pathname === '/api/v1/responses' || pathname === '/v1/responses';
+const RESPONSES_PATHS = ['/backend-api/codex/responses', '/api/v1/responses', '/v1/responses'];
+function modelBodyKind(req, pathname, config) {
+    if (RESPONSES_PATHS.includes(pathname))
+        return 'responses';
+    return openRouterOnlyEnabled(config) && req.method === 'POST'
+        && RESPONSES_PATHS.some((prefix) => pathname.startsWith(`${prefix}/`)) ? 'sub-endpoint' : null;
 }
 async function readBoundedBody(req, maximum) {
     const declared = Number(req.headers['content-length'] || 0);
@@ -83,7 +87,8 @@ export async function prepareDesktopBridgeRequest(req, config) {
     let body = null;
     let payload = null;
     let contentEncodingStripped = false;
-    if (bodyCarriesModel(req.url)) {
+    const bodyKind = modelBodyKind(req, pathname, config);
+    if (bodyKind) {
         const maximum = config.maxRequestBodyBytes ?? DEFAULT_DESKTOP_BRIDGE_MAX_REQUEST_BODY_BYTES;
         body = await readBoundedBody(req, maximum);
         const encoding = String(req.headers['content-encoding'] || '').trim().toLowerCase();
@@ -92,14 +97,16 @@ export async function prepareDesktopBridgeRequest(req, config) {
             decoded = decodeBridgeRequestBody(body, encoding, maximum);
             contentEncodingStripped = true;
         }
-        try {
-            const parsed = JSON.parse(decoded.toString('utf8'));
-            if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
-                throw new Error();
-            payload = parsed;
-        }
-        catch {
-            throw new DesktopBridgeError('bridge_responses_body_invalid_json');
+        if (bodyKind === 'responses' || decoded.length > 0) {
+            try {
+                const parsed = JSON.parse(decoded.toString('utf8'));
+                if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+                    throw new Error();
+                payload = parsed;
+            }
+            catch {
+                throw new DesktopBridgeError('bridge_responses_body_invalid_json');
+            }
         }
         if (contentEncodingStripped)
             body = decoded;
@@ -109,9 +116,9 @@ export async function prepareDesktopBridgeRequest(req, config) {
     const sessionIdentity = resolveCodexSessionIdentity(req.headers, payload);
     const route = await resolveAndBindDesktopBridgeRouteContext({
         public_model: String(model || ''), session_id: sessionIdentity.thread_id,
-        pathname, transport: 'http', headers: req.headers,
+        pathname, transport: 'http', headers: req.headers, identity: sessionIdentity,
     }, config);
-    if (payload && payload.model !== route.upstream_model) {
+    if (payload && (bodyKind === 'responses' || typeof payload.model === 'string') && payload.model !== route.upstream_model) {
         payload.model = route.upstream_model;
         body = Buffer.from(JSON.stringify(payload));
     }
@@ -147,7 +154,8 @@ function writeHttpBridgeError(res, error, req) {
         res.destroy(error instanceof Error ? error : undefined);
         return;
     }
-    res.writeHead(code.startsWith('catalog_') || code.startsWith('session_') || code.includes('route_') ? 409 : 502, {
+    res.writeHead(code.startsWith('catalog_') || code.startsWith('session_') || code.includes('route_')
+        || OPENROUTER_ONLY_REFUSAL_CODES.has(code) ? 409 : 502, {
         'content-type': 'application/json', 'cache-control': 'no-store', connection: 'close',
     });
     res.end(JSON.stringify({ error: { type: 'sks_bridge_error', code, message: code } }));

package/dist/core/codex-lb/desktop-bridge/index.js

@@ -1,5 +1,6 @@
 export * from './types.js';
 export * from './security.js';
+export * from './exclusive-provider-guard.js';
 export * from './header-policy.js';
 export * from './location-rewrite.js';
 export * from './state.js';

package/dist/core/codex-lb/desktop-bridge/responses-websocket.js

@@ -17,6 +17,14 @@ export function isResponsesWebSocketRequest(req) {
 function bytes(data) {
     return Buffer.isBuffer(data) ? data : Array.isArray(data) ? Buffer.concat(data) : Buffer.from(data);
 }
+function withLineage(identity, next) {
+    return {
+        ...identity,
+        parent_thread_id: identity.parent_thread_id ?? next.parent_thread_id,
+        subagent_kind: identity.subagent_kind ?? next.subagent_kind,
+        thread_source: next.thread_source === 'subagent' ? next.thread_source : identity.thread_source ?? next.thread_source,
+    };
+}
 export function forwardResponsesWebSocket(req, socket, head, config) {
     const upgradeIdentity = resolveCodexSessionIdentity(req.headers);
     const maxBytes = config.maxRequestBodyBytes ?? DEFAULT_DESKTOP_BRIDGE_MAX_REQUEST_BODY_BYTES;
@@ -90,7 +98,7 @@ export function forwardResponsesWebSocket(req, socket, head, config) {
                 fail(error); });
         }
         function routeRequest(model) {
-            return { public_model: model, session_id: identity.thread_id, pathname: new URL(req.url || '/', 'http://bridge.invalid').pathname, transport: 'websocket', headers: req.headers };
+            return { public_model: model, session_id: identity.thread_id, pathname: new URL(req.url || '/', 'http://bridge.invalid').pathname, transport: 'websocket', headers: req.headers, identity };
         }
         function assertBinding(route) {
             if (!bound)
@@ -112,8 +120,7 @@ export function forwardResponsesWebSocket(req, socket, head, config) {
                 || (nextIdentity.session_id && nextIdentity.session_id !== identity.session_id))) {
                 throw new DesktopBridgeError('bridge_codex_session_identity_conflict');
             }
-            if (!bound)
-                identity = nextIdentity;
+            identity = bound ? withLineage(identity, nextIdentity) : nextIdentity;
             const request = routeRequest(model);
             assertBinding(assertDesktopBridgeRouteContext(request, config));
             const route = await resolveAndBindDesktopBridgeRouteContext(request, config);

package/dist/core/codex-lb/desktop-bridge/security.js

@@ -3,6 +3,7 @@ import net from 'node:net';
 import { BRIDGE_OFFICIAL_ROUTE_ID } from '../bridge-contracts.js';
 import { canonicalizeBridgeModelId, normalizeBridgeUpstreamModelId, } from '../route-index.js';
 import { DESKTOP_BRIDGE_CLIENT_PATH_PREFIX, DesktopBridgeError } from './types.js';
+import { OPENROUTER_ONLY_ROUTE_BLOCKED, assertOpenRouterOnlyRoute, openRouterOnlyRefusesPinnedProvider, validateOpenRouterOnlyConfig, } from './exclusive-provider-guard.js';
 const MIN_HIGH_PORT = 49_152;
 const MAX_PORT = 65_535;
 const MAX_SESSION_PINS = 10_000;
@@ -61,6 +62,37 @@ export function singleBridgeHeader(headers, name) {
         throw new DesktopBridgeError('bridge_policy_header_ambiguous');
     return values[0] || null;
 }
+const MAX_LINEAGE_CHARS = 256;
+function lineageText(value) {
+    if (typeof value !== 'string')
+        return null;
+    const text = value.trim();
+    return text && text.length <= MAX_LINEAGE_CHARS && !/[\u0000-\u001f\u007f]/.test(text) ? text : null;
+}
+function firstLineage(values) {
+    for (const value of values) {
+        const text = lineageText(value);
+        if (text)
+            return text;
+    }
+    return null;
+}
+function lenientHeader(headers, name) {
+    const value = headers[name];
+    return lineageText(Array.isArray(value) ? value[0] : value);
+}
+function nestedTurnMetadata(clientMetadata) {
+    const raw = clientMetadata?.['x-codex-turn-metadata'];
+    if (typeof raw !== 'string' || Buffer.byteLength(raw) > 16 * 1024)
+        return null;
+    try {
+        const parsed = JSON.parse(raw);
+        return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
 function codexMetadataObject(value, source) {
     if (value === undefined || value === null)
         return null;
@@ -108,7 +140,18 @@ export function resolveCodexSessionIdentity(headers, payload = null) {
     ], 'session');
     if (sessionId && !threadId)
         throw new DesktopBridgeError('bridge_codex_thread_id_missing');
-    return { thread_id: threadId, session_id: sessionId };
+    const nested = nestedTurnMetadata(clientMetadata);
+    const lineage = (key, header = null) => [
+        turnMetadata?.[key], clientMetadata?.[key], nested?.[key],
+        ...(header ? [clientMetadata?.[header], lenientHeader(headers, header)] : []),
+    ];
+    return {
+        thread_id: threadId,
+        session_id: sessionId,
+        parent_thread_id: firstLineage(lineage('parent_thread_id', 'x-codex-parent-thread-id')),
+        subagent_kind: firstLineage(lineage('subagent_kind', 'x-openai-subagent')),
+        thread_source: firstLineage(lineage('thread_source')),
+    };
 }
 function comparableOrigin(value, referer) {
     if (value === 'null')
@@ -216,6 +259,18 @@ export function resolveBridgeRequestRoute(request, policy, pins) {
         session_pin: nextPin,
     };
 }
+function threadPinProvider(request, config) {
+    if (!request.session_id)
+        return null;
+    let threadId;
+    try {
+        threadId = canonicalSessionId(request.session_id);
+    }
+    catch {
+        return null;
+    }
+    return config.providerSessionPins.find((pin) => pin.thread_id === threadId)?.provider_id ?? null;
+}
 export function assertDesktopBridgeRouteContext(request, config) {
     const resolver = config.resolveRequestRoute || resolveBridgeRequestRoute;
     const policy = config.routePolicy;
@@ -235,9 +290,14 @@ export function assertDesktopBridgeRouteContext(request, config) {
             else
                 throw error;
         }
+        else if (error instanceof DesktopBridgeError && error.code === 'session_pin_route_unavailable'
+            && openRouterOnlyRefusesPinnedProvider(request, threadPinProvider(request, config), config)) {
+            throw new DesktopBridgeError(OPENROUTER_ONLY_ROUTE_BLOCKED);
+        }
         else
             throw error;
     }
+    assertOpenRouterOnlyRoute(request, route, config);
     if (route.provider_id === BRIDGE_OFFICIAL_ROUTE_ID) {
         if (!desktopBridgeOfficialPassthroughEnabled(config))
             throw new DesktopBridgeError('bridge_official_passthrough_unavailable');
@@ -603,6 +663,8 @@ export function validateDesktopBridgeConfig(config) {
         throw new DesktopBridgeError('bridge_provider_credential_resolver_missing');
     if (config.officialPassthrough)
         validateRemoteUrl(config.officialPassthrough.baseUrl);
+    if (config.openRouterOnly !== undefined && config.openRouterOnly !== null)
+        validateOpenRouterOnlyConfig(config.openRouterOnly);
     assertRegistryAndPolicy(config, config.providerRegistry);
     if (!Object.values(config.providerRegistry.providers).some((provider) => provider.enabled)) {
         throw new DesktopBridgeError('bridge_provider_registry_no_enabled_provider');

package/dist/core/codex-lb/desktop-bridge/server.js

@@ -3,6 +3,7 @@ import http, {} from 'node:http';
 import net, {} from 'node:net';
 import { destroyDesktopBridgeUpstreamAgents, forwardHttp, prepareDesktopBridgeRequest } from './http-forward.js';
 import { createDesktopBridgeRejectionLogger } from './rejection-log.js';
+import { OPENROUTER_ONLY_REFUSAL_CODES } from './exclusive-provider-guard.js';
 import { assertAllowedOrigin, assertAllowedPath, assertLoopbackPeer, assertLoopbackListenHost, assertWebSocketUpgrade, prepareDesktopBridgeConfig, safeBridgeErrorCode, validatePreparedDesktopBridgeConfig, } from './security.js';
 import { createDesktopBridgePublicState, desktopBridgeListenOrigin, desktopBridgeStatePath, refreshDesktopBridgeState, removeDesktopBridgeStateIfOwned, writeDesktopBridgeState, } from './state.js';
 import { DesktopBridgeError, DesktopBridgeRequestBodyTooLargeError } from './types.js';
@@ -85,6 +86,8 @@ function handleDiagnosticWebSocket(req, socket, head) {
     consume();
 }
 function rejectionStatus(code) {
+    if (OPENROUTER_ONLY_REFUSAL_CODES.has(code))
+        return 409;
     if (code === 'bridge_request_body_too_large')
         return 413;
     if (code === 'bridge_path_not_allowed')
@@ -98,6 +101,8 @@ function rejectionStatus(code) {
     return 400;
 }
 function rejectionStatusText(status) {
+    if (status === 409)
+        return 'Conflict';
     if (status === 413)
         return 'Payload Too Large';
     if (status === 404)

package/dist/core/codex-lb/desktop-bridge/state.js

@@ -23,6 +23,9 @@ export function desktopBridgeConfigGeneration(config) {
         client_capability_sha256: config.clientCapabilitySha256,
         allowed_paths: [...config.allowedPathPrefixes], allowed_origins: [...config.allowedOrigins].sort(),
         connect_timeout_ms: config.connectTimeoutMs, idle_timeout_ms: config.idleTimeoutMs,
+        ...(config.openRouterOnly?.enabled === true
+            ? { openrouter_only: [...config.openRouterOnly.subagent_models].sort() }
+            : {}),
     }));
 }
 export function createDesktopBridgePublicState(config, options = {}) {

package/dist/core/codex-lb/desktop-bridge/websocket-forward.js

@@ -5,6 +5,7 @@ import { BRIDGE_OFFICIAL_ROUTE_ID } from '../bridge-contracts.js';
 import { buildOfficialPassthroughWebSocketHeaders, buildProviderWebSocketHeaders } from './header-policy.js';
 import { createDesktopBridgeRejectionLogger } from './rejection-log.js';
 import { rewriteLocationHeader } from './location-rewrite.js';
+import { OPENROUTER_ONLY_REFUSAL_CODES, openRouterOnlyEnabled } from './exclusive-provider-guard.js';
 import { desktopBridgeOfficialPassthroughEnabled, ensureDesktopBridgeRemoteTarget, isUnreachableUpstreamError, refreshDesktopBridgeRemoteTarget, resolveAndBindDesktopBridgeRouteContext, resolveCodexSessionIdentity, resolveDesktopBridgeTarget, safeBridgeErrorCode, singleBridgeHeader, canonicalSessionId } from './security.js';
 import { desktopBridgeListenOrigin } from './state.js';
 import { forwardResponsesWebSocket, isResponsesWebSocketRequest } from './responses-websocket.js';
@@ -78,6 +79,8 @@ function websocketPinnedModel(threadId, config) {
         return null;
     }
     const pin = config.providerSessionPins.find((entry) => entry.thread_id === canonical);
+    if (pin && openRouterOnlyEnabled(config) && pin.provider_id !== 'openrouter')
+        return null;
     return pin?.public_model || null;
 }
 export async function prepareDesktopBridgeWebSocketRequest(req, config) {
@@ -91,7 +94,7 @@ export async function prepareDesktopBridgeWebSocketRequest(req, config) {
         public_model: publicModel,
         session_id: sessionIdentity.thread_id,
         pathname: new URL(req.url || '/', 'http://bridge.invalid').pathname,
-        transport: 'websocket', headers: req.headers,
+        transport: 'websocket', headers: req.headers, identity: sessionIdentity,
     }, config);
     if (route.provider_id === BRIDGE_OFFICIAL_ROUTE_ID)
         return { route, provider: null, credential: null };
@@ -110,6 +113,7 @@ const PERMANENT_UPGRADE_REFUSALS = new Set([
     'bridge_websocket_route_unresolvable',
     'catalog_model_route_missing',
     'bridge_provider_route_unavailable',
+    ...OPENROUTER_ONLY_REFUSAL_CODES,
 ]);
 export function safeEndUpgradeSocket(socket, payload) {
     socket.on('error', () => undefined);

package/dist/core/codex-lb/desktop-controller-v3/catalog.js

@@ -14,6 +14,7 @@ import { applyOfficialModelPassthrough, buildBridgeRoutingPolicy, readBridgeRout
 import { sha256Stable } from '../route-index.js';
 import { bridgeBaseUrl, commandResult, controllerEnv, controllerPaths, nowIso, providerCode, providerRegistrySnapshot, resolveRawCredentials, resolveValidatedCredentials, safeCode, serializedSettings, stringArray, timeoutMs, unique } from './shared.js';
 import { desktopBridgeStatusV3 } from './status.js';
+import { openRouterOnlyExposure, readControllerOpenRouterOnlyState, withoutCodexLbCatalog } from './openrouter-only-catalog.js';
 export async function syncCatalog(options) {
     const result = await syncCatalogInternal(options);
     const status = await desktopBridgeStatusV3(options);
@@ -40,14 +41,19 @@ export async function syncCatalogInternal(options, behavior = {}) {
         credentials: rawCredentials,
         storedRegistry
     });
-    const catalogs = await fetchProviderCatalogs(initialRegistry, rawCredentials, paths, options);
+    const openRouterOnly = behavior.openRouterOnly ?? readControllerOpenRouterOnlyState(paths);
+    const catalogRegistry = (value) => openRouterOnly.enabled ? withoutCodexLbCatalog(value) : value;
+    const catalogs = await fetchProviderCatalogs(catalogRegistry(initialRegistry), rawCredentials, paths, options);
     const credentials = await resolveValidatedCredentials(options, paths);
     const registry = await resolveBridgeProviderRegistry({ home: paths.home, credentials, storedRegistry });
     const selectionState = await readBridgeModelSelectionState(paths.home, nowIso(options));
     const selection = selectionState.stored
         ? selectionState.selection
         : seedSelectionFromConfiguredModel(selectionState.selection, await readText(paths.configPath, ''));
-    const build = buildCombinedBridgeCatalog(registry, { catalogs, created_at: nowIso(options), selection });
+    const exposure = openRouterOnly.enabled
+        ? openRouterOnlyExposure(selection, openRouterOnly, await readText(paths.configPath, ''))
+        : selection;
+    const build = buildCombinedBridgeCatalog(catalogRegistry(registry), { catalogs, created_at: nowIso(options), selection: exposure });
     if (!selectionState.stored)
         await writeBridgeModelSelection(paths.home, selection).catch(() => undefined);
     await writeJsonAtomic(bridgeAvailableModelsPath(paths.home), {
@@ -72,10 +78,12 @@ export async function syncCatalogInternal(options, behavior = {}) {
         && Object.values(build.route_index.routes).some((route) => route.provider_id === providerId));
     const previousDefault = priorPolicy.policy?.default_provider_id || null;
     const historicalDefault = historicalIntent.default_provider_id;
-    const defaultProvider = previousDefault && readyProviders.includes(previousDefault)
+    const defaultProvider = openRouterOnly.enabled && priorPolicy.policy
         ? previousDefault
-        : historicalDefault && readyProviders.includes(historicalDefault) ? historicalDefault
-            : readyProviders.length === 1 ? readyProviders[0] || null : null;
+        : previousDefault && readyProviders.includes(previousDefault)
+            ? previousDefault
+            : historicalDefault && readyProviders.includes(historicalDefault) ? historicalDefault
+                : readyProviders.length === 1 ? readyProviders[0] || null : null;
     const persistedSettings = await readDesktopBridgeServiceSettings(options.settingsPath || desktopBridgeServicePaths(paths.home).settings_path).catch(() => null);
     const officialModelsMode = await resolveEffectiveOfficialModelsMode(persistedSettings?.official_passthrough, {
         home: paths.home,
@@ -154,6 +162,24 @@ export async function syncCatalogInternal(options, behavior = {}) {
             active_generation_preserved: rollback?.ok === true
         };
     }
+    if (behavior.onActivated) {
+        try {
+            await behavior.onActivated();
+        }
+        catch (error) {
+            const rollback = migration.receipt
+                ? await rollbackDesktopBridgeUnificationReceipt({ receipt: migration.receipt })
+                : null;
+            return {
+                ok: false,
+                build,
+                activation: activationResult(staging, false, [safeCode(error, 'combined_catalog_commit_failed')]),
+                migration,
+                rollback,
+                active_generation_preserved: rollback?.ok === true
+            };
+        }
+    }
     const serviceBefore = await (options.serviceStatusImpl || desktopBridgeServiceStatus)({ ...options, home: paths.home });
     if (behavior.restartService !== false && (serviceBefore.installed || serviceBefore.running)) {
         await (options.bootstrapServiceImpl || bootstrapExistingDesktopBridgeService)({

package/dist/core/codex-lb/desktop-controller-v3/lifecycle-commands.js

@@ -8,6 +8,8 @@ import { DESKTOP_BRIDGE_OFFICIAL_UPSTREAM_BASE_URL } from '../desktop-bridge/ind
 import { resolveBridgeRequestRoute } from '../request-route-resolver.js';
 import { applyOfficialModelPassthrough, buildBridgeRoutingPolicy, setBridgeRoutingDefault, writeBridgeRoutingPolicy } from '../provider-route-policy.js';
 import { syncCatalogInternal } from './catalog.js';
+import { codexRestartBlockers, releaseOpenRouterOnlyForAuthPriority, releaseOpenRouterOnlyWithoutBridge, restartCodexAfterOpenRouterOnlyOff } from './openrouter-only-commands.js';
+import { openRouterOnlyStatus } from './openrouter-only-status.js';
 import { commandResult, controllerPaths, nowIso, persistRuntimeSettings, providerCode, providerRegistrySnapshot, stringArray } from './shared.js';
 import { desktopBridgeStatusV3, loadCore, statusFromCore } from './status.js';
 import { verifyDesktopBridgeV3 } from './verification.js';
@@ -107,6 +109,15 @@ export async function setOfficialModelsMode(mode, options) {
     return commandResult('route.official-models', true, status, { mode, effective_mode: effective, official_models: officialModels, policy_generation: policy.policy_generation }, [], options);
 }
 export async function setAuthPriority(enabled, options) {
+    const released = enabled ? await releaseOpenRouterOnlyForAuthPriority(options) : null;
+    if (released && !released.ok) {
+        const status = await desktopBridgeStatusV3(options);
+        return commandResult('auth-priority.set', false, status, {
+            auth_priority: status.auth_priority,
+            openrouter_only: await openRouterOnlyStatus(options),
+            catalog_sync: released.catalog_sync
+        }, released.blockers, options);
+    }
     const core = await loadCore(options);
     const settingsPath = options.settingsPath || desktopBridgeServicePaths(core.paths.home).settings_path;
     const persisted = await readDesktopBridgeServiceSettings(settingsPath);
@@ -127,8 +138,13 @@ export async function setAuthPriority(enabled, options) {
     else {
         await writeDesktopBridgeServiceSettings(settingsPath, nextSettings);
     }
+    const codexRestart = released?.changed ? await restartCodexAfterOpenRouterOnlyOff(released, options) : null;
     const status = await desktopBridgeStatusV3(options);
-    return commandResult('auth-priority.set', true, status, { auth_priority: status.auth_priority }, [], options);
+    return commandResult('auth-priority.set', true, status, {
+        auth_priority: status.auth_priority,
+        openrouter_only: await openRouterOnlyStatus(options),
+        ...(released?.changed ? { openrouter_only_off: { ...released, codex_restart: codexRestart } } : {})
+    }, [...(released?.blockers || []), ...codexRestartBlockers(codexRestart)], options);
 }
 export async function explainRoute(model, options) {
     const core = await loadCore(options);
@@ -166,6 +182,7 @@ export async function unmanageDesktopBridge(options) {
         return commandResult('unmanage', false, status, { write, service: stopped, recovery }, [error.message], options);
     }
     const cleaned = await removePreservedServiceArtifacts(options, paths.home, 'unmanage');
+    const openRouterOnlyOff = await releaseOpenRouterOnlyWithoutBridge(options);
     const status = await desktopBridgeStatusV3(options);
     requireUnmanaged(status.management.managed, 'unmanage');
     return commandResult('unmanage', true, status, {
@@ -173,8 +190,9 @@ export async function unmanageDesktopBridge(options) {
         credentials_deleted: false,
         service: cleaned,
         stopped_service: stopped,
-        config_backup_path: write.backup_path || null
-    }, [], options);
+        config_backup_path: write.backup_path || null,
+        ...(openRouterOnlyOff ? { openrouter_only_off: openRouterOnlyOff } : {})
+    }, openRouterOnlyOff?.blockers || [], options);
 }
 export async function rollbackDesktopBridge(receiptId, options) {
     if (!/^[A-Za-z0-9._-]{1,160}$/.test(receiptId))
@@ -205,6 +223,7 @@ export async function rollbackDesktopBridge(receiptId, options) {
         return commandResult('rollback', false, status, { rollback, service: stopped, recovery }, [rollback.status], options);
     }
     const cleaned = await removePreservedServiceArtifacts(options, paths.home, 'rollback');
+    const openRouterOnlyOff = await releaseOpenRouterOnlyWithoutBridge(options);
     const observed = await desktopBridgeStatusV3(options);
     if (observed.management.managed)
         throw new Error('desktop_bridge_rollback_final_state_managed');
@@ -215,7 +234,7 @@ export async function rollbackDesktopBridge(receiptId, options) {
             reason: 'rollback_complete'
         }
     };
-    return commandResult('rollback', true, status, { rollback, service: cleaned, stopped_service: stopped }, [], options);
+    return commandResult('rollback', true, status, { rollback, service: cleaned, stopped_service: stopped, ...(openRouterOnlyOff ? { openrouter_only_off: openRouterOnlyOff } : {}) }, openRouterOnlyOff?.blockers || [], options);
 }
 async function currentServiceStatus(options, home) {
     return (options.serviceStatusImpl || desktopBridgeServiceStatus)({ ...options, home });

package/dist/core/codex-lb/desktop-controller-v3/openrouter-only-catalog.js

@@ -0,0 +1,39 @@
+import { readTopLevelTomlString } from '../../codex-app/codex-model-catalog.js';
+import { isOpenRouterModelId } from '../../imagegen/imagegen-config.js';
+import { readOpenRouterOnlyStateSync } from '../../subagents/child-model-allowlist.js';
+import { MAX_SELECTED_OPENROUTER_MODELS } from '../combined-catalog/model-selection.js';
+import { canonicalizeBridgeModelId } from '../route-index.js';
+export function openRouterOnlyStoreLocation(paths) {
+    return { home: paths.home, env: { HOME: paths.home, CODEX_HOME: paths.codexHome } };
+}
+export function readControllerOpenRouterOnlyState(paths) {
+    return readOpenRouterOnlyStateSync(openRouterOnlyStoreLocation(paths));
+}
+export function openRouterOnlyExposure(selection, state, configText) {
+    const configured = readTopLevelTomlString(configText, 'model');
+    const ordered = [
+        ...state.subagent_models.map((entry) => entry.model),
+        ...(isOpenRouterModelId(configured) ? [configured] : []),
+        ...selection.openrouter.public_ids
+    ];
+    const ids = [];
+    for (const raw of ordered) {
+        const id = canonicalizeBridgeModelId(raw);
+        if (id && !ids.includes(id))
+            ids.push(id);
+    }
+    return { ...selection, openrouter: { mode: 'selected', public_ids: ids.slice(0, MAX_SELECTED_OPENROUTER_MODELS) } };
+}
+export function withoutCodexLbCatalog(registry) {
+    return {
+        ...registry,
+        profiles: {
+            ...registry.profiles,
+            'codex-lb': { ...registry.profiles['codex-lb'], enabled: false, state: 'disabled' }
+        }
+    };
+}
+export function hasOpenRouterRoute(routeIndex, model) {
+    const key = canonicalizeBridgeModelId(model);
+    return Boolean(key && routeIndex?.routes[key]?.provider_id === 'openrouter');
+}