sneakoscope 10.3.7 → 10.3.8

package/README.md

@@ -16,7 +16,7 @@
 Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
 <!-- END SKS SEARCH VISIBILITY MARKETING -->
 
-Current package: **SKS 10.3.7**. Install the latest stable release from npm.
+Current package: **SKS 10.3.8**. Install the latest stable release from npm.
 
 [Quick start](#install-in-one-command) · [Commands](#everyday-commands) · [SKS Center](#sks-center-macos) · [Documentation](#documentation) · [Changelog](CHANGELOG.md)
 
@@ -101,7 +101,8 @@ home directory; set `SKS_POSTINSTALL_MENUBAR=1` to force the build in a script,
 | Page | Use it to |
 | --- | --- |
 | Overview | Check local health and find the next action. |
-| Connections | Connect Codex-LB or OpenRouter, choose authentication priority, and manage exposed models. |
+| Connections | Connect Codex-LB or OpenRouter, choose Prefer Codex-LB or OpenRouter Only, and manage exposed models. |
+| Subagent Models | Keep the OpenRouter models subagents may use in OpenRouter Only Mode, with the criteria Jev routes by. |
 | Updates | Check and update SKS and Codex CLI, with operation progress and recovery details. |
 | MCP Servers | Manage server configuration, health checks, and authentication. |
 | Image Generation | Keep Codex's default image generation, or route it through the Desktop Bridge to an OpenRouter image model you pick. |
@@ -123,184 +124,11 @@ connection first for eligible models. The switch distinguishes a saved preferenc
 from connection readiness: **on but unavailable** means setup needs attention.
 Turning it off restores the configured official-model routing preference.
 
-The same controls are available from the CLI:
-
-```sh
-sks bridge auth-priority status --json
-sks bridge auth-priority on --json
-sks bridge auth-priority off --json
-sks bridge status --json
-sks bridge route explain gpt-6-astra --json
-```
-
-Enter credentials through the native connection dialog or the CLI's
-`--api-key-stdin` option. See the [provider guide](docs/codex-lb.md) for
-configuration, transport checks, and recovery commands.
-
-## Image generation
-
-SKS image routes (image generation, UX-Review callouts, PPT assets, slide
-reviews) follow one image mode. By default they use Codex's own image
-generation. Turn on a custom image model on the **Image Generation** page to
-send every SKS image through the Desktop Bridge to an OpenRouter image model
-you pick. SKS pins no image model and records which model made each image.
-
-```sh
-sks imagegen status --json
-sks imagegen models --json
-sks imagegen enable --model black-forest-labs/flux.2-klein-4b
-sks imagegen generate --prompt "App icon, flat, blue" --out icon.png
-sks imagegen disable
-```
-
-See [Image generation](docs/image-generation.md) for both modes, evidence
-sidecars, and the Jev choices.
-
-## Naruto workflow
-
-The parent orchestrates: it decomposes the task, spawns a child for each
-disjoint slice, waits, and owns integration and final verification. It does not
-implement slices itself. The SKS PreToolUse hook denies parent source edits
-until the first child starts and while children are still running. Children
-receive bounded tasks and do not spawn children.
-
-No model family is pinned. Every child runs the newest model of the tier its
-work needs, read from the Codex models cache, so a new model family is used as
-soon as Codex lists it:
-
-| Work | Tier | Effort | Today |
-| --- | --- | --- | --- |
-| Tiny mechanical tasks | fast | low | `gpt-6-luna` |
-| Instructed implementation | balanced | low | `gpt-6-sol` |
-| Exploration, large-context reads, and direct tool operation | context | medium | `gpt-6-sol` |
-| Planning, review, debugging, and focused judgment | deep | max | `gpt-6-astra` |
-
-With Jev mode on, Jev picks the tier for every spawn, every gated parent edit,
-the plan, and the context, so the parent spends no time on those choices. It
-also picks the pipeline for each prompt; an explicit SKS `<div align="center">
-
-<img src="docs/assets/sks-logo.svg" alt="Sneakoscope Codex logo" width="120" height="120" />
-
-# Sneakoscope Codex
-
-**Plan, build, and verify with Codex.**
-
-[![npm version](https://img.shields.io/npm/v/sneakoscope?color=cb3837&logo=npm)](https://www.npmjs.com/package/sneakoscope)
-[![node](https://img.shields.io/badge/node-%3E%3D20.11-339933?logo=node.js&logoColor=white)](#requirements)
-[![license](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
-
-</div>
-
-<!-- BEGIN SKS SEARCH VISIBILITY MARKETING -->
-Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
-<!-- END SKS SEARCH VISIBILITY MARKETING -->
-
-Current package: **SKS 10.3.7**. Install the latest stable release from npm.
-
-[Quick start](#install-in-one-command) · [Commands](#everyday-commands) · [SKS Center](#sks-center-macos) · [Documentation](#documentation) · [Changelog](CHANGELOG.md)
-
-## Install in one command
-
-```sh
-npm exec --yes --package=sneakoscope@latest -- sneakoscope install --yes
-```
-
-The installer resolves the latest release, installs it globally, runs setup and
-Doctor, and checks that `sks` on your PATH points to the installed version.
-
-To set up a project, run this from its root, then open it in Codex:
-
-```sh
-sks bootstrap --yes
-```
-
-## What SKS adds
-
-| Capability | What you get |
-| --- | --- |
-| Focused execution | Answers and tiny edits stay lightweight; implementation work runs through official Codex subagents while the parent orchestrates and integrates. |
-| Project context | TriWiki indexes repository code and supplies bounded context that can be checked against source. |
-| Verification | Tests, diagnostics, and release evidence support completion claims. Security and data-integrity checks stay in place. |
-| Native controls | SKS Center brings connections, updates, MCP servers, and diagnostics together on macOS. |
-| Consistent setup | `sks update` installs the latest release, runs Doctor, and reconciles SKS-managed files and legacy assets. |
-
-The default `essential` profile avoids repetitive completion rituals. `strict`
-adds stronger completion requirements. See [Essential Trust](docs/essential-trust.md).
-
-With Codex-LB connected, `sks agent-bridge async --prompt "Check SKS status while
-explaining what the check covers" --tools status --json` runs native Astra Async
-tool calling with selected read-only SKS tools, using WebSocket first and safe
-HTTP fallback. See [Astra guidance](docs/astra-guidance.md)
-for setup boundaries and reported execution evidence.
-
-## Everyday commands
-
-SKS enables experimental Astra context management by default during setup and
-repair. Turn it off in **SKS Center → Settings → Astra context management**, or
-use `sks codex-app context-management off`. Updates preserve an explicit opt-out.
-Start a new task after changing the setting. Availability depends on a supported
-Codex client and eligible ChatGPT sign-in; API-key and custom-provider sessions
-may not activate it. See [OpenAI's context management guidance](https://learn.chatgpt.com/docs/models#experimental-context-management).
-
-Use these inside a Codex conversation:
-
-| Command | Purpose |
-| --- | --- |
-| `$sks-plan "task"` | Create a plan without editing product code. |
-| `$sks-work` | Execute the latest plan. |
-| `$sks-naruto "task"` | Run an official subagent workflow. |
-| `$sks-review` | Review the current changes. |
-| `$sks-help` | Explore available SKS workflows. |
-
-Use these in your terminal:
-
-```sh
-sks --help
-sks status --json
-sks review --staged
-sks doctor --json
-sks update-check
-sks update
-```
-
-`sks update` runs setup reconciliation even when the package is already current.
-It preserves user-authored configuration and cleans up recognized SKS-owned
-legacy assets. If a check needs attention, follow its reported recovery action
-in your terminal.
-
-## SKS Center (macOS)
-
-Open **SKS Control Center** from the SKS menu bar.
-The Menu Bar app (with the Control Center) is built from source on macOS when you run
-`npm i -g sneakoscope` interactively in a terminal, and by `sks install`, `sks doctor --fix`,
-`sks update`, or `sks menubar install`. Dependency, CI, and piped installs never touch your
-home directory; set `SKS_POSTINSTALL_MENUBAR=1` to force the build in a script, or
-`SKS_POSTINSTALL_NO_MENUBAR=1` to skip it.
-
-| Page | Use it to |
-| --- | --- |
-| Overview | Check local health and find the next action. |
-| Connections | Connect Codex-LB or OpenRouter, choose authentication priority, and manage exposed models. |
-| Updates | Check and update SKS and Codex CLI, with operation progress and recovery details. |
-| MCP Servers | Manage server configuration, health checks, and authentication. |
-| Image Generation | Keep Codex's default image generation, or route it through the Desktop Bridge to an OpenRouter image model you pick. |
-| Diagnostics | Inspect issues and run targeted checks. |
-| Settings | Configure lifecycle behavior, notifications, and advanced options. |
-| Remote Coding | Find the independent [Paseo companion](https://paseo.sh/docs) and its setup guidance. |
-
-Connection controls appear first. Model catalogs, bridge diagnostics, and
-advanced settings expand when you need them.
-
-## Desktop Bridge
-
-One local bridge manages routing for independent **Codex-LB** and **OpenRouter**
-profiles. ChatGPT sign-in remains owned by Codex. Provider choices and existing
-session pins remain authoritative; unavailable routes are reported explicitly.
-
-In **Connections**, turn on **Prefer Codex-LB** to use the saved Codex-LB
-connection first for eligible models. The switch distinguishes a saved preference
-from connection readiness: **on but unavailable** means setup needs attention.
-Turning it off restores the configured official-model routing preference.
+Turn on **OpenRouter Only** instead to run the main thread and every subagent on
+OpenRouter models. The two switches are mutually exclusive: turning one on turns
+the other off. Subagents may use only the models on the **Subagent Models** page,
+and with Jev mode on, Jev picks one for each child from the criteria you wrote.
+See [OpenRouter Only Mode](docs/openrouter-only-mode.md).
 
 The same controls are available from the CLI:
 
@@ -308,6 +136,8 @@ The same controls are available from the CLI:
 sks bridge auth-priority status --json
 sks bridge auth-priority on --json
 sks bridge auth-priority off --json
+sks bridge openrouter-only on --json
+sks bridge subagent-models list --json
 sks bridge status --json
 sks bridge route explain gpt-6-astra --json
 ```
@@ -356,7 +186,7 @@ soon as Codex lists it:
 
 With Jev mode on, Jev picks the tier for every spawn, every gated parent edit,
 the plan, and the context, so the parent spends no time on those choices. It
- command always
+also picks the pipeline for each prompt; an explicit SKS dollar command always
 wins. A stored role-model preference on a current model wins in both modes.
 
 An active Codex task keeps the user's selected main model, effort, and service
@@ -393,6 +223,7 @@ freshness semantics.
 - [Astra guidance](docs/astra-guidance.md) — how SKS applies the official model recommendations.
 - [Agent Bridge](docs/AGENT-BRIDGE.md) — integrate through the CLI or MCP interface.
 - [Codex-LB priority](docs/codex-lb-priority.md) — how Codex App WebSockets follow the Center priority setting.
+- [OpenRouter Only Mode](docs/openrouter-only-mode.md) — run everything on OpenRouter with a subagent model list Jev routes by.
 - [Release readiness](docs/release-readiness.md) — build, verify, and publish a release.
 - [Release evidence](docs/release-proof-truth.md) — what each verification result proves.
 - [Changelog](CHANGELOG.md) — changes by version.

package/crates/sks-core/Cargo.lock

@@ -259,7 +259,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "10.3.7"
+version = "10.3.8"
 dependencies = [
  "globset",
  "grep-matcher",

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "10.3.7"
+version = "10.3.8"
 edition = "2021"
 
 [dependencies]

package/dist/commands/bridge.js

@@ -5,6 +5,7 @@ import { serveDesktopBridge } from '../core/codex-lb/desktop-service.js';
 import { BridgeCliError, errorOutput, mergeMetadata, ordinaryOutput, sanitizeBridgeValue, textSummary, verificationOutput } from './bridge-command-output.js';
 const CONTROLLER_FACADE_EXPORT = 'executeDesktopBridgeCommand';
 const MAX_STDIN_SECRET_BYTES = 64 * 1024;
+const MAX_STDIN_JSON_BYTES = 64 * 1024;
 const DEFAULT_IO = {
     readStdin,
     stdout: (text) => process.stdout.write(text),
@@ -18,6 +19,9 @@ export function usage(command = 'bridge') {
         `Usage: sks ${command} status [--json]`,
         `       sks ${command} ensure|repair [--json]`,
         `       sks ${command} auth-priority status|on|off [--json]`,
+        `       sks ${command} openrouter-only status|on|off [--no-restart] [--json]`,
+        `       sks ${command} subagent-models list [--json]`,
+        `       sks ${command} subagent-models set --stdin [--no-restart] [--json]`,
         `       sks ${command} verify --level shallow|transport|deep [--strict|--require-ready] [--json]`,
         `       sks ${command} provider list [--json]`,
         `       sks ${command} provider configure codex-lb --host <host> --api-key-stdin [--json]`,
@@ -34,7 +38,9 @@ export function usage(command = 'bridge') {
         `       sks ${command} unmanage --confirm [--json]`,
         `       sks ${command} rollback <receipt-id> --confirm [--json]`,
         '',
-        'Provider secrets are accepted only through --api-key-stdin. Readiness changes the exit code only with --strict or --require-ready.'
+        'Provider secrets are accepted only through --api-key-stdin. Readiness changes the exit code only with --strict or --require-ready.',
+        'OpenRouter Only Mode and Codex-LB authentication priority are mutually exclusive; turning one on turns the other off.',
+        'subagent-models set reads {"subagent_models":[{"model","criteria","reasoning_effort","default"}]} (max 16) from stdin.'
     ].join('\n');
 }
 export async function run(_command, args = []) {
@@ -120,6 +126,39 @@ async function parseInvocation(args, io) {
                 ? { operation: 'auth-priority.status' }
                 : { operation: 'auth-priority.set', enabled: action === 'on' }, label: 'Codex-LB authentication priority' };
     }
+    if (area === 'openrouter-only' && target === undefined && (action === 'status' || action === 'on' || action === 'off')) {
+        if (action === 'status') {
+            allowOnly(parsed, ['--json'], []);
+            return { ...base, request: { operation: 'openrouter-only.status' }, label: 'OpenRouter Only Mode' };
+        }
+        allowOnly(parsed, ['--json', '--no-restart'], []);
+        return {
+            ...base,
+            request: { operation: 'openrouter-only.set', enabled: action === 'on', no_restart: parsed.flags.has('--no-restart') },
+            label: 'OpenRouter Only Mode'
+        };
+    }
+    if (area === 'subagent-models' && target === undefined) {
+        if (action === 'list') {
+            allowOnly(parsed, ['--json'], []);
+            return { ...base, request: { operation: 'subagent-models.list' }, label: 'Subagent model list' };
+        }
+        if (action === 'set') {
+            allowOnly(parsed, ['--json', '--stdin', '--no-restart'], []);
+            if (!parsed.flags.has('--stdin')) {
+                throw new BridgeCliError('bridge_subagent_models_stdin_required', 'retry_with_stdin');
+            }
+            return {
+                ...base,
+                request: {
+                    operation: 'subagent-models.set',
+                    subagent_models: subagentModelsFromStdin(await io.readStdin()),
+                    no_restart: parsed.flags.has('--no-restart')
+                },
+                label: 'Subagent model list update'
+            };
+        }
+    }
     if (area === 'status' && action === undefined) {
         allowOnly(parsed, ['--json'], []);
         return { ...base, request: { operation: 'status' }, label: 'Desktop Bridge status' };
@@ -318,6 +357,27 @@ function parseArgs(args) {
     }
     return { positionals, flags, values };
 }
+function subagentModelsFromStdin(text) {
+    const raw = String(text || '').trim();
+    if (!raw)
+        throw new BridgeCliError('bridge_subagent_models_stdin_empty', 'retry_with_stdin');
+    if (Buffer.byteLength(raw, 'utf8') > MAX_STDIN_JSON_BYTES) {
+        throw new BridgeCliError('bridge_subagent_models_stdin_too_large', 'retry_with_stdin');
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new BridgeCliError('bridge_subagent_models_stdin_invalid_json', 'retry_with_stdin');
+    }
+    const models = parsed && typeof parsed === 'object' && !Array.isArray(parsed)
+        ? parsed.subagent_models
+        : undefined;
+    if (!Array.isArray(models))
+        throw new BridgeCliError('bridge_subagent_models_stdin_invalid', 'retry_with_stdin');
+    return models;
+}
 function rejectSecretArgv(args) {
     for (const arg of args) {
         const option = String(arg).split('=', 1)[0]?.toLowerCase() || '';

package/dist/commands/codex-app.js

@@ -38,7 +38,10 @@ export async function run(_command, args = []) {
         }
         console.log(`Codex 1M Context: ${result.enabled ? 'enabled' : 'disabled'}`);
         console.log(`Config: ${result.config_path}`);
-        console.log(`Model: ${result.model || 'not set'} (documented for ${result.expected_model})`);
+        const window = result.model_window;
+        console.log(`Model: ${result.model || 'not set'}${window.effective_window ? ` · window ${window.effective_window} (default ${window.default_window ?? 'unknown'}, max ${window.max_window ?? 'uncapped'})` : ' · window unknown'}`);
+        if (result.larger_window_models.length)
+            console.log(`Models with a larger window: ${result.larger_window_models.join(', ')}`);
         for (const [key, target] of Object.entries(result.target)) {
             const state = result.keys[key];
             const detail = state?.present ? `${state.value ?? 'unparsed'}${state.managed ? ' (SKS-managed)' : ''}` : 'not set';

package/dist/config/skills-manifest.json

@@ -1,6 +1,6 @@
 {
   "schema": "sks.skills-manifest.v1",
-  "package_version": "10.3.7",
+  "package_version": "10.3.8",
   "skills": [
     {
       "canonical_name": "sks",

package/dist/core/agents/native-worker-backend-router.js

@@ -13,6 +13,8 @@ import { codexTimeoutClassForRoute } from '../codex-control/codex-reliability-sh
 import { decideSubagentModel } from '../subagents/model-policy.js';
 import { latestTierModelSet } from '../subagents/model-tiers.js';
 import { consultJevTurnModel } from '../decisions/integration.js';
+import { chooseChildModel, fallbackChildModel } from '../decisions/child-model-choice.js';
+import { OPENROUTER_ONLY_SCHEMA, allowlistedChildModel, effectiveChildModelAllowlist, isSubagentModelEffort } from '../subagents/child-model-allowlist.js';
 export const NATIVE_WORKER_BACKEND_ROUTER_SCHEMA = 'sks.native-worker-backend-router.v1';
 export async function runNativeWorkerBackendRouter(input) {
     const root = path.resolve(input.agentRoot);
@@ -229,6 +231,10 @@ export async function resolveWorkerModelRouting(input, deps = {}) {
     const riskText = [taskKindText, input.slice?.risk, input.slice?.risk_focus, input.slice?.acceptance, input.slice?.parent_prompt, input.slice?.description, input.intake?.prompt].map((value) => String(value || '')).join(' ');
     const category = categoryForWorkerRole(String(input.agent?.role || 'executor'), taskKindText);
     const env = deps.env || process.env;
+    const allowlist = effectiveChildModelAllowlist({ env });
+    if (allowlist.mode === 'openrouter_only') {
+        return resolveOpenRouterOnlyWorkerRouting(input, deps, { allowlist, category, env, taskKindText, riskText });
+    }
     const lbHealth = Object.prototype.hasOwnProperty.call(deps, 'lbHealth') ? deps.lbHealth : await readLbHealth().catch(() => null);
     const lbCatalog = narutoOnly
         ? Object.prototype.hasOwnProperty.call(deps, 'lbCatalog')
@@ -305,6 +311,55 @@ export async function resolveWorkerModelRouting(input, deps = {}) {
         })
     };
 }
+async function resolveOpenRouterOnlyWorkerRouting(input, deps, ctx) {
+    const { allowlist, category, env } = ctx;
+    const state = { schema: OPENROUTER_ONLY_SCHEMA, enabled: true, subagent_models: allowlist.entries, restore: null, updated_at: null };
+    const explicitModel = String(env.SKS_WORKER_MODEL || env.SKS_AGENT_MODEL || '').trim();
+    const explicitReasoning = listReasoning(env.SKS_WORKER_REASONING || env.SKS_WORKER_MODEL_REASONING);
+    const explicitTier = normalizeServiceTier(String(env.SKS_WORKER_SERVICE_TIER || env.SKS_SERVICE_TIER || '').trim());
+    const planned = /^openrouter_only_/.test(String(input.agent?.routed_model_policy || ''))
+        ? allowlistedChildModel(input.agent?.routed_model, allowlist)
+        : null;
+    const requested = String(input.agent?.routed_model || input.agent?.model || '').trim() || null;
+    const explicitListed = explicitModel ? allowlistedChildModel(explicitModel, allowlist) : null;
+    const task = `${ctx.taskKindText}\n${ctx.riskText}`.trim().slice(0, 1200);
+    const choice = explicitModel
+        ? (explicitListed ? fallbackChildModel(state, explicitListed, 'explicit') : null)
+        : planned
+            ? fallbackChildModel(state, planned, 'planned')
+            : deps.consultJev === false || !task
+                ? fallbackChildModel(state, requested, deps.consultJev === false ? 'jev_skipped' : 'empty_task')
+                : await chooseChildModel({ root: deps.root || process.cwd(), task, role: input.agent?.role || null, requestedModel: requested, state, env })
+                    .catch(() => fallbackChildModel(state, requested, 'consult_failed'));
+    const taskPolicy = decideSubagentModel({ title: ctx.taskKindText, description: ctx.riskText, role: input.agent?.role });
+    const choiceModel = choice?.entry.model || '';
+    const routed = {
+        model: choiceModel,
+        reasoning: explicitReasoning || choice?.entry.reasoning_effort || listReasoning(taskPolicy.modelReasoningEffort) || 'medium',
+        serviceTier: explicitTier || input.fastModePolicy.service_tier || 'fast'
+    };
+    const blockers = [
+        ...(!allowlist.entries.length ? ['openrouter_only_subagent_list_empty'] : []),
+        ...(explicitModel && !explicitListed ? ['openrouter_only_subagent_model_not_listed'] : []),
+        ...(!choiceModel ? ['naruto_worker_model_unavailable'] : [])
+    ];
+    const why = choice ? `${choice.source}${choice.reason === 'applied' ? '' : `:${choice.reason}`}` : 'blocked';
+    return {
+        category,
+        choice: routed,
+        explicit: Boolean(explicitModel),
+        lb_health: Object.prototype.hasOwnProperty.call(deps, 'lbHealth') ? deps.lbHealth : null,
+        lb_catalog: null,
+        blockers: [...new Set(blockers)],
+        reason: `${category}->${choiceModel || 'blocked'}@${routed.reasoning} (openrouter only list: ${why})`
+    };
+}
+function listReasoning(value) {
+    const text = String(value || '').trim().toLowerCase();
+    if (text === 'max' || text === 'ultra')
+        return 'xhigh';
+    return isSubagentModelEffort(text) ? text : null;
+}
 function normalizeModelReasoning(value) {
     const text = String(value || '').toLowerCase();
     return text === 'low' || text === 'medium' || text === 'high' || text === 'xhigh' || text === 'max' || text === 'ultra' ? text : null;

package/dist/core/codex-app/codex-app-restart-policy.js

@@ -0,0 +1,20 @@
+import { isCodexAppRunningByBundleId } from './menubar/config.js';
+import { restartCodexApp } from './codex-app-restart.js';
+export async function maybeRestartRunningCodexApp(input) {
+    const skipped = (reason) => ({ attempted: false, running: null, status: 'skipped', reason, ok: true, blockers: [] });
+    if (input.noRestart)
+        return skipped('no_restart_flag');
+    if (!input.changed)
+        return skipped('config_unchanged');
+    if (input.env.SKS_SKIP_CODEX_APP_RESTART === '1')
+        return skipped('SKS_SKIP_CODEX_APP_RESTART');
+    if ((input.platform || process.platform) !== 'darwin')
+        return skipped('not_macos');
+    const bundleId = String(input.env.SKS_CODEX_APP_BUNDLE_ID || 'com.openai.codex');
+    const running = await (input.isRunningImpl || isCodexAppRunningByBundleId)(bundleId, input.env);
+    if (!running) {
+        return { attempted: false, running: false, status: 'skipped', reason: 'codex_not_running', ok: true, blockers: [] };
+    }
+    const result = await (input.restartImpl || restartCodexApp)({ env: input.env, ...(input.root ? { root: input.root } : {}) });
+    return { attempted: true, running: true, status: result.status, reason: null, ok: result.ok, blockers: [...result.blockers] };
+}

package/dist/core/codex-app/codex-context-window.js

@@ -1,16 +1,17 @@
+import path from 'node:path';
 import { exists, readText } from '../fsx.js';
 import { escapeRegExp } from '../text/regex.js';
 import { safeWriteCodexConfigToml } from '../codex-runtime/codex-desktop-config-policy.js';
-import { codexUserConfigPath, readTopLevelTomlString } from './codex-model-catalog.js';
+import { codexHomePath, codexUserConfigPath, readTopLevelTomlString } from './codex-model-catalog.js';
 import { isCodexAppRunningByBundleId } from './menubar/config.js';
 import { restartCodexApp } from './codex-app-restart.js';
+import { maybeRestartRunningCodexApp } from './codex-app-restart-policy.js';
 export const CODEX_CONTEXT_1M_SCHEMA = 'sks.codex-context-1m.v1';
 export const CODEX_CONTEXT_1M_MARKER = 'sks-codex-context-1m';
 export const CODEX_CONTEXT_1M_TARGETS = {
     model_context_window: 1_000_000,
     model_auto_compact_token_limit: 900_000
 };
-export const CODEX_CONTEXT_1M_MODEL = 'gpt-5.6-sol';
 const MANAGED_KEYS = Object.keys(CODEX_CONTEXT_1M_TARGETS);
 function topLevelRegionEnd(lines) {
     const first = lines.findIndex((line) => /^\s*\[.+\]\s*$/.test(line));
@@ -64,6 +65,50 @@ export function inspectCodexContext1m(text) {
     const enabled = MANAGED_KEYS.every((key) => keys[key].managed && keys[key].value === CODEX_CONTEXT_1M_TARGETS[key]);
     return { enabled, model: readTopLevelTomlString(String(text || ''), 'model'), keys, warnings };
 }
+function positiveInt(value) {
+    return typeof value === 'number' && Number.isInteger(value) && value > 0 ? value : null;
+}
+export async function readCodexModelWindows(input = {}) {
+    const text = await readText(path.join(codexHomePath(input), 'models_cache.json'), '');
+    let parsed = null;
+    try {
+        parsed = JSON.parse(String(text || 'null'));
+    }
+    catch {
+        return [];
+    }
+    const models = parsed?.models;
+    if (!Array.isArray(models))
+        return [];
+    return models.flatMap((row) => {
+        if (!row || typeof row !== 'object')
+            return [];
+        const record = row;
+        const slug = typeof record.slug === 'string' ? record.slug.trim() : '';
+        if (!slug)
+            return [];
+        return [{
+                slug,
+                listed: record.visibility !== 'hide',
+                default_window: positiveInt(record.context_window),
+                max_window: positiveInt(record.max_context_window)
+            }];
+    });
+}
+export function codexContextModelWindow(rows, model) {
+    const row = model ? rows.find((candidate) => candidate.slug === model) : undefined;
+    if (!row)
+        return { source: 'unknown', default_window: null, max_window: null, effective_window: null, extends: null };
+    const target = CODEX_CONTEXT_1M_TARGETS.model_context_window;
+    const effective = row.max_window === null ? target : Math.min(target, row.max_window);
+    return {
+        source: 'codex_models_cache',
+        default_window: row.default_window,
+        max_window: row.max_window,
+        effective_window: effective,
+        extends: row.default_window === null ? null : effective > row.default_window
+    };
+}
 export function enableCodexContext1m(text) {
     const source = String(text || '');
     const lines = source.split('\n');
@@ -160,15 +205,21 @@ export async function codexContext1mCommand(args = [], opts = {}) {
     }
     const inspection = inspectCodexContext1m(afterText);
     warnings.push(...inspection.warnings);
+    const windowRows = await readCodexModelWindows({ env, ...(opts.home ? { home: opts.home } : {}) });
+    const modelWindow = codexContextModelWindow(windowRows, inspection.model);
     if (action === 'on' || inspection.enabled) {
         if (!inspection.model)
             warnings.push('codex_context_model_line_missing');
-        else if (inspection.model !== CODEX_CONTEXT_1M_MODEL)
-            warnings.push(`codex_context_active_model_not_${CODEX_CONTEXT_1M_MODEL}:${inspection.model}`);
+        else if (modelWindow.source === 'unknown')
+            warnings.push(`codex_context_model_window_unknown:${inspection.model}`);
+        else if (modelWindow.max_window === null)
+            warnings.push(`codex_context_model_window_uncapped:${inspection.model}`);
+        else if (modelWindow.extends === false)
+            warnings.push(`codex_context_model_window_fixed:${inspection.model}:${modelWindow.max_window}`);
     }
     let restart = null;
     if ((action === 'on' || action === 'off') && !blockers.length) {
-        restart = await maybeRestartCodexApp({
+        restart = await maybeRestartRunningCodexApp({
             env,
             changed,
             noRestart,
@@ -186,7 +237,10 @@ export async function codexContext1mCommand(args = [], opts = {}) {
         enabled: inspection.enabled,
         config_path: configPath,
         model: inspection.model,
-        expected_model: CODEX_CONTEXT_1M_MODEL,
+        model_window: modelWindow,
+        larger_window_models: windowRows
+            .filter((row) => row.listed && row.max_window !== null && row.default_window !== null && row.max_window > row.default_window)
+            .map((row) => row.slug),
         target: { ...CODEX_CONTEXT_1M_TARGETS },
         keys: inspection.keys,
         previous: mutation && action === 'on' ? mutation.previous : null,
@@ -198,6 +252,7 @@ export async function codexContext1mCommand(args = [], opts = {}) {
         warnings,
         notes: [
             'Only new Codex sessions pick up context-window changes; existing conversations keep their previous limits.',
+            'Codex caps the window at each model\'s maximum, so every model gets its largest supported window up to 1M.',
             'Requests with more than 272K input tokens are billed at the long-context rate (2x input / 1.5x output) for the entire request.'
         ],
         cli_commands: {
@@ -207,21 +262,3 @@ export async function codexContext1mCommand(args = [], opts = {}) {
         }
     };
 }
-async function maybeRestartCodexApp(input) {
-    const skippedOutcome = (reason) => ({ attempted: false, running: null, status: 'skipped', reason, ok: true, blockers: [] });
-    if (input.noRestart)
-        return skippedOutcome('no_restart_flag');
-    if (!input.changed)
-        return skippedOutcome('config_unchanged');
-    if (input.env.SKS_SKIP_CODEX_APP_RESTART === '1')
-        return skippedOutcome('SKS_SKIP_CODEX_APP_RESTART');
-    if (process.platform !== 'darwin')
-        return skippedOutcome('not_macos');
-    const bundleId = String(input.env.SKS_CODEX_APP_BUNDLE_ID || 'com.openai.codex');
-    const running = await (input.isRunningImpl || isCodexAppRunningByBundleId)(bundleId, input.env);
-    if (!running) {
-        return { attempted: false, running: false, status: 'skipped', reason: 'codex_not_running', ok: true, blockers: [] };
-    }
-    const result = await (input.restartImpl || restartCodexApp)({ env: input.env, ...(input.root ? { root: input.root } : {}) });
-    return { attempted: true, running: true, status: result.status, reason: null, ok: result.ok, blockers: result.blockers };
-}

package/dist/core/codex-app/menubar/constants.js

@@ -29,6 +29,10 @@ export const NATIVE_SOURCE_FILES = [
     'ProvidersOpenRouter.swift',
     'ProvidersModelExposure.swift',
     'ProvidersBridgeCatalog.swift',
+    'OpenRouterOnlyState.swift',
+    'ProvidersOpenRouterOnly.swift',
+    'SubagentModelsModels.swift',
+    'SubagentModelsViewController.swift',
     'RemoteCodingViewController.swift',
     'DiagnosticsViewController.swift',
     'SettingsViewController.swift',

package/dist/core/codex-compat/codex-hook-output-builders.js

@@ -24,12 +24,14 @@ export function buildPreToolUseAllowRewrite(updatedInput, options = {}) {
     if (updatedInput === undefined || updatedInput === null) {
         throw new Error('PreToolUse allow rewrite requires updatedInput');
     }
+    const additionalContext = optionalText(options.additionalContext);
     return withOptionalSystemMessage({
         continue: true,
         hookSpecificOutput: {
             hookEventName: 'PreToolUse',
             permissionDecision: 'allow',
-            updatedInput
+            updatedInput,
+            ...(additionalContext ? { additionalContext } : {})
         }
     }, options.systemMessage);
 }

package/dist/core/codex-lb/bridge-cli-contract.js

@@ -6,6 +6,8 @@ export const BRIDGE_CLI_BOOLEAN_OPTIONS = [
     '--require-ready',
     '--api-key-stdin',
     '--confirm',
+    '--no-restart',
+    '--stdin',
     DESKTOP_BRIDGE_SUPERVISED_FLAG
 ];
 export const BRIDGE_CLI_VALUE_OPTIONS = ['--level', '--host', '--settings', '--set'];