sneakoscope 10.3.7 → 10.3.8

package/dist/core/codex-lb/desktop-controller-v3/openrouter-only-commands.js

@@ -0,0 +1,286 @@
+import { readTopLevelTomlString } from '../../codex-app/codex-model-catalog.js';
+import { maybeRestartRunningCodexApp } from '../../codex-app/codex-app-restart-policy.js';
+import { readText } from '../../fsx.js';
+import { isOpenRouterModelId } from '../../imagegen/imagegen-config.js';
+import { MAX_SUBAGENT_MODELS, normalizeSubagentModelList, readOpenRouterOnlyStateSync, writeOpenRouterOnlyState } from '../../subagents/child-model-allowlist.js';
+import { assertDesktopBridgeStatusV3 } from '../bridge-runtime-validation.js';
+import { readActiveCombinedBridgeCatalog } from '../combined-catalog.js';
+import { MAX_SELECTED_OPENROUTER_MODELS, bridgeAvailableModelsPath, readBridgeModelSelectionState, writeBridgeModelSelection } from '../combined-catalog/model-selection.js';
+import { ensureUserReadOnlyListRole } from '../../subagents/read-only-list-role.js';
+import { canonicalizeBridgeModelId } from '../route-index.js';
+import { syncCatalogInternal } from './catalog.js';
+import { hasOpenRouterRoute, openRouterOnlyStoreLocation } from './openrouter-only-catalog.js';
+import { applyOpenRouterOnlyMainModel, openRouterOnlyMainModelTarget, restoreOpenRouterOnlyMainModel } from './openrouter-only-main-model.js';
+import { openRouterOnlyProviderBlocker, openRouterOnlyStatusFromCore } from './openrouter-only-status.js';
+import { commandResult, controllerEnv, controllerPaths, nowIso, stringArray } from './shared.js';
+import { loadCore, statusFromCore } from './status.js';
+async function finish(operation, ok, blockers, extra, options) {
+    const core = await loadCore(options);
+    const status = statusFromCore(core, options);
+    assertDesktopBridgeStatusV3(status);
+    const openRouterOnly = await openRouterOnlyStatusFromCore(core, options);
+    return commandResult(operation, ok, status, {
+        openrouter_only: openRouterOnly,
+        auth_priority: status.auth_priority,
+        ...extra
+    }, blockers, options);
+}
+function syncBlockers(sync) {
+    const activation = sync.activation && typeof sync.activation === 'object' && !Array.isArray(sync.activation)
+        ? sync.activation
+        : {};
+    const blockers = stringArray(activation.blockers);
+    return blockers.length > 0 ? blockers : ['combined_catalog_sync_failed'];
+}
+export const CODEX_RESTART_FAILED_BLOCKER = 'codex_restart_failed_manual_restart_required';
+export const CODEX_RELAUNCH_FOR_SUBAGENT_MODELS_WARNING = 'codex_relaunch_required_for_new_subagent_models';
+export function codexRestartBlockers(restart) {
+    return restart?.attempted && !restart.ok ? [CODEX_RESTART_FAILED_BLOCKER] : [];
+}
+function restartCodex(changed, noRestart, options) {
+    return maybeRestartRunningCodexApp({
+        env: controllerEnv(options),
+        changed,
+        noRestart,
+        ...(options.platform ? { platform: options.platform } : {}),
+        ...(options.codexAppRunningImpl ? { isRunningImpl: options.codexAppRunningImpl } : {}),
+        ...(options.codexAppRestartImpl ? { restartImpl: options.codexAppRestartImpl } : {})
+    });
+}
+export async function openRouterOnlyStatusCommand(options) {
+    return finish('openrouter-only.status', true, [], {}, options);
+}
+export async function setOpenRouterOnly(enabled, noRestart, options) {
+    if (enabled)
+        return enableOpenRouterOnly(noRestart, options);
+    const off = await turnOffOpenRouterOnly(options, { repairCatalog: true });
+    if (!off.ok)
+        return finish('openrouter-only.set', false, off.blockers, { catalog_sync: off.catalog_sync }, options);
+    const restart = await restartCodex(off.changed, noRestart, options);
+    return finish('openrouter-only.set', true, [...off.blockers, ...codexRestartBlockers(restart)], {
+        changed: off.changed,
+        catalog_sync: off.catalog_sync,
+        main_model: off.main_model,
+        codex_restart: restart
+    }, options);
+}
+async function seedSubagentModels(home, configText, options) {
+    const selected = (await readBridgeModelSelectionState(home, nowIso(options))).selection.openrouter.public_ids;
+    const configured = readTopLevelTomlString(configText, 'model');
+    const candidates = (selected.length > 0 ? selected : [configured]).filter(isOpenRouterModelId);
+    return normalizeSubagentModelList(candidates.slice(0, MAX_SUBAGENT_MODELS).map((model, index) => ({
+        model,
+        criteria: '',
+        reasoning_effort: null,
+        default: index === 0
+    }))).entries;
+}
+async function enableOpenRouterOnly(noRestart, options) {
+    const core = await loadCore(options);
+    const location = openRouterOnlyStoreLocation(core.paths);
+    const before = readOpenRouterOnlyStateSync(location);
+    const providerBlocker = openRouterOnlyProviderBlocker(core);
+    if (providerBlocker)
+        return finish('openrouter-only.set', false, [providerBlocker], {}, options);
+    const entries = before.subagent_models.length > 0
+        ? before.subagent_models
+        : await seedSubagentModels(core.paths.home, core.config, options);
+    if (entries.length === 0) {
+        return finish('openrouter-only.set', false, ['openrouter_only_no_openrouter_models'], {}, options);
+    }
+    const sync = await syncCatalogInternal({
+        ...options,
+        settings: { ...(options.settings || {}), auth_priority_enabled: false }
+    }, {
+        openRouterOnly: { ...before, enabled: true, subagent_models: entries },
+        onActivated: async () => {
+            await requireRoutableEntry(core.paths, { ...before, enabled: true, subagent_models: entries });
+            await writeOpenRouterOnlyState({ enabled: true, subagent_models: entries }, location);
+        }
+    });
+    if (sync.ok !== true)
+        return finish('openrouter-only.set', false, syncBlockers(sync), { catalog_sync: sync }, options);
+    const main = await switchMainModelToList(core.paths, location, options)
+        .catch(() => failedMainModel('openrouter_only_main_model_switch_failed'));
+    const readOnlyRole = await ensureUserReadOnlyListRole(core.paths.home).catch(() => 'failed');
+    const roleBlockers = readOnlyRole === 'failed' ? ['openrouter_only_read_only_role_install_failed'] : [];
+    const changed = !before.enabled || main.changed || readOnlyRole === 'created' || readOnlyRole === 'updated';
+    const restart = await restartCodex(changed, noRestart, options);
+    return finish('openrouter-only.set', true, [...main.blockers, ...roleBlockers, ...codexRestartBlockers(restart)], {
+        changed,
+        seeded_subagent_models: before.subagent_models.length === 0,
+        catalog_sync: sync,
+        main_model: main,
+        read_only_role: readOnlyRole,
+        codex_restart: restart
+    }, options);
+}
+async function switchMainModelToList(paths, location, options) {
+    const active = await readActiveCombinedBridgeCatalog(paths.catalogPath, paths.routeIndexPath);
+    const state = readOpenRouterOnlyStateSync(location);
+    const main = await applyOpenRouterOnlyMainModel(paths, state, active.ok ? active.route_index : null, options);
+    if (main.restore !== state.restore)
+        await writeOpenRouterOnlyState({ restore: main.restore }, location);
+    return main.change;
+}
+function failedMainModel(blocker) {
+    return { changed: false, action: 'blocked', previous_model: null, model: null, write_status: null, blockers: [blocker] };
+}
+async function requireRoutableEntry(paths, state) {
+    const active = await readActiveCombinedBridgeCatalog(paths.catalogPath, paths.routeIndexPath);
+    if (!openRouterOnlyMainModelTarget(state, active.ok ? active.route_index : null)) {
+        throw new Error('openrouter_only_no_routable_subagent_model');
+    }
+}
+async function exposedModelIds(paths) {
+    return new Set(((await activeCatalog(paths))?.catalog.models ?? []).map((model) => String(model.public_id)));
+}
+async function activeCatalog(paths) {
+    const active = await readActiveCombinedBridgeCatalog(paths.catalogPath, paths.routeIndexPath);
+    return active.ok ? active : null;
+}
+async function keepModelInPickerSelection(home, model, options) {
+    if (!isOpenRouterModelId(model))
+        return { changed: false, blockers: [] };
+    const { selection } = await readBridgeModelSelectionState(home, nowIso(options));
+    const ids = selection.openrouter.public_ids;
+    const key = canonicalizeBridgeModelId(model);
+    if (ids.some((id) => canonicalizeBridgeModelId(id) === key))
+        return { changed: false, blockers: [] };
+    if (ids.length >= MAX_SELECTED_OPENROUTER_MODELS)
+        return { changed: false, blockers: ['openrouter_only_main_model_unexposed'] };
+    await writeBridgeModelSelection(home, {
+        ...selection,
+        updated_at: nowIso(options),
+        openrouter: { mode: 'selected', public_ids: [...ids, model] }
+    });
+    return { changed: true, blockers: [] };
+}
+async function codexLbRowsMissing(options) {
+    const core = await loadCore(options);
+    const profile = core.registry.profiles['codex-lb'];
+    return profile.enabled && profile.state === 'ready' && core.activeCatalog.ok
+        && !core.activeCatalog.catalog.models.some((model) => model.provider_id === 'codex-lb');
+}
+async function restoreMainModel(paths, location, before, options) {
+    const main = await restoreOpenRouterOnlyMainModel(paths, before.restore, options);
+    await writeOpenRouterOnlyState({ restore: main.blockers.length > 0 ? before.restore : null }, location);
+    return main;
+}
+export async function turnOffOpenRouterOnly(options, behavior = {}) {
+    const paths = controllerPaths(options);
+    const location = openRouterOnlyStoreLocation(paths);
+    const before = readOpenRouterOnlyStateSync(location);
+    const repair = !before.enabled && behavior.repairCatalog === true && await codexLbRowsMissing(options);
+    if (!before.enabled && !before.restore && !repair) {
+        return { ok: true, changed: false, catalog_sync: null, main_model: null, blockers: [] };
+    }
+    const off = { ...before, enabled: false };
+    const sync = (commit) => syncCatalogInternal(options, {
+        ...(behavior.restartService === undefined ? {} : { restartService: behavior.restartService }),
+        openRouterOnly: off,
+        ...(commit ? { onActivated: () => writeOpenRouterOnlyState({ enabled: false }, location) } : {})
+    });
+    const configured = readTopLevelTomlString(String(await readText(paths.configPath, '')), 'model');
+    const restoreApplies = Boolean(before.restore?.applied_model) && configured === before.restore?.applied_model;
+    const kept = restoreApplies ? { changed: false, blockers: [] } : await keepModelInPickerSelection(paths.home, configured, options);
+    let catalogSync = null;
+    if (before.enabled || repair || kept.changed) {
+        catalogSync = await sync(true);
+        if (catalogSync.ok !== true) {
+            return { ok: false, changed: false, catalog_sync: catalogSync, main_model: null, blockers: syncBlockers(catalogSync) };
+        }
+    }
+    const main = await restoreMainModel(paths, location, before, options);
+    const blockers = [...kept.blockers, ...main.blockers];
+    if (main.action === 'blocked' && !hasOpenRouterRoute((await activeCatalog(paths))?.route_index ?? null, main.model)) {
+        const keptAfter = await keepModelInPickerSelection(paths.home, main.model, options);
+        blockers.push(...keptAfter.blockers);
+        if (keptAfter.changed) {
+            catalogSync = await sync(false);
+            if (catalogSync.ok !== true)
+                blockers.push(...syncBlockers(catalogSync));
+        }
+    }
+    return {
+        ok: true,
+        changed: before.enabled || repair || kept.changed || main.changed,
+        catalog_sync: catalogSync,
+        main_model: main,
+        blockers
+    };
+}
+export async function releaseOpenRouterOnlyWithoutBridge(options) {
+    const paths = controllerPaths(options);
+    const location = openRouterOnlyStoreLocation(paths);
+    const before = readOpenRouterOnlyStateSync(location);
+    if (!before.enabled && !before.restore)
+        return null;
+    if (before.enabled)
+        await writeOpenRouterOnlyState({ enabled: false }, location);
+    const main = await restoreMainModel(paths, location, before, options);
+    return { ok: true, changed: before.enabled || main.changed, catalog_sync: null, main_model: main, blockers: main.blockers };
+}
+export function releaseOpenRouterOnlyForAuthPriority(options) {
+    return turnOffOpenRouterOnly(options, { restartService: false });
+}
+export function restartCodexAfterOpenRouterOnlyOff(off, options) {
+    return restartCodex(off.changed, false, options);
+}
+async function availableOpenRouterModels(home) {
+    try {
+        const parsed = JSON.parse(await readText(bridgeAvailableModelsPath(home), '') || 'null');
+        const rows = Array.isArray(parsed?.openrouter) ? parsed.openrouter : [];
+        return rows.map((row) => ({
+            public_id: String(row?.public_id || ''),
+            display_name: String(row?.display_name || row?.public_id || '')
+        })).filter((row) => row.public_id);
+    }
+    catch {
+        return [];
+    }
+}
+export async function listSubagentModels(options) {
+    const available = await availableOpenRouterModels(controllerPaths(options).home);
+    return finish('subagent-models.list', true, [], { available }, options);
+}
+export async function setSubagentModels(raw, noRestart, options) {
+    if (!Array.isArray(raw))
+        return finish('subagent-models.set', false, ['subagent_models_payload_invalid'], {}, options);
+    const { entries, issues } = normalizeSubagentModelList(raw);
+    if (issues.length > 0) {
+        return finish('subagent-models.set', false, issues.map((issue) => `${issue.code}:${issue.index}`), {}, options);
+    }
+    const paths = controllerPaths(options);
+    const location = openRouterOnlyStoreLocation(paths);
+    const before = readOpenRouterOnlyStateSync(location);
+    if (!before.enabled) {
+        await writeOpenRouterOnlyState({ subagent_models: entries }, location);
+        return finish('subagent-models.set', true, [], { catalog_sync: null }, options);
+    }
+    const exposedBefore = await exposedModelIds(paths);
+    const sync = await syncCatalogInternal(options, {
+        openRouterOnly: { ...before, subagent_models: entries },
+        onActivated: async () => {
+            if (entries.length > 0)
+                await requireRoutableEntry(paths, { ...before, subagent_models: entries });
+            await writeOpenRouterOnlyState({ subagent_models: entries }, location);
+        }
+    });
+    if (sync.ok !== true)
+        return finish('subagent-models.set', false, syncBlockers(sync), { catalog_sync: sync }, options);
+    const main = await switchMainModelToList(paths, location, options)
+        .catch(() => failedMainModel('openrouter_only_main_model_switch_failed'));
+    const exposedAfter = await exposedModelIds(paths);
+    const catalogChanged = [...exposedAfter].some((id) => !exposedBefore.has(id));
+    const changed = catalogChanged || main.changed;
+    const restart = await restartCodex(changed, noRestart, options);
+    const relaunchPending = changed && !restart.attempted && restart.reason !== 'codex_not_running';
+    return finish('subagent-models.set', true, [...main.blockers, ...codexRestartBlockers(restart)], {
+        changed,
+        catalog_sync: sync,
+        main_model: main,
+        codex_restart: restart,
+        warnings: relaunchPending ? [CODEX_RELAUNCH_FOR_SUBAGENT_MODELS_WARNING] : []
+    }, options);
+}

package/dist/core/codex-lb/desktop-controller-v3/openrouter-only-main-model.js

@@ -0,0 +1,101 @@
+import { readTopLevelTomlString } from '../../codex-app/codex-model-catalog.js';
+import { removeTopLevelTomlKeyIfValue, safeWriteCodexConfigToml, upsertTopLevelTomlString } from '../../codex-runtime/codex-desktop-config-policy.js';
+import { exists, readText } from '../../fsx.js';
+import { defaultSubagentEntry } from '../../subagents/child-model-allowlist.js';
+import { canonicalizeBridgeModelId } from '../route-index.js';
+import { hasOpenRouterRoute } from './openrouter-only-catalog.js';
+const MAIN_MODEL_WRITE_CAUSE = 'openrouter-only-main-model';
+function tomlBasicStringBody(value) {
+    return value.replace(/[\\"\u0000-\u001f\u007f]/g, (character) => character === '\\'
+        ? '\\\\'
+        : character === '"' ? '\\"' : `\\u${character.charCodeAt(0).toString(16).padStart(4, '0')}`);
+}
+export function openRouterOnlyMainModelTarget(state, routeIndex) {
+    const preferred = defaultSubagentEntry(state);
+    const ordered = [...(preferred ? [preferred] : []), ...state.subagent_models.filter((entry) => entry !== preferred)];
+    for (const entry of ordered) {
+        if (hasOpenRouterRoute(routeIndex, entry.model))
+            return canonicalizeBridgeModelId(entry.model);
+    }
+    return null;
+}
+async function writeModelLine(paths, before, next, expected, options) {
+    const write = await (options.safeWriteConfigImpl || safeWriteCodexConfigToml)(paths.configPath, before, next, MAIN_MODEL_WRITE_CAUSE, { verifyUnchangedBeforeWrite: true, expectedBeforeExists: await exists(paths.configPath) });
+    if (!write.ok)
+        return { ok: false, status: write.status, blockers: [`openrouter_only_main_model_write_${write.status}`] };
+    const after = write.expected_after?.text ?? next;
+    if (readTopLevelTomlString(after, 'model') !== expected) {
+        return { ok: false, status: write.status, blockers: ['openrouter_only_main_model_write_not_applied'] };
+    }
+    return { ok: true, status: write.status, blockers: [] };
+}
+function topLevelModelLinePresent(text) {
+    const lines = text.split('\n');
+    const firstTable = lines.findIndex((line) => /^\s*\[.+\]\s*$/.test(line));
+    return lines.slice(0, firstTable === -1 ? lines.length : firstTable).some((line) => /^\s*model\s*=/.test(line));
+}
+export async function applyOpenRouterOnlyMainModel(paths, state, routeIndex, options) {
+    const before = String(await readText(paths.configPath, ''));
+    const current = readTopLevelTomlString(before, 'model');
+    if (current === null && topLevelModelLinePresent(before)) {
+        return {
+            change: {
+                changed: false, action: 'blocked', previous_model: null, model: null, write_status: null,
+                blockers: ['openrouter_only_main_model_unparsed']
+            },
+            restore: state.restore
+        };
+    }
+    if (hasOpenRouterRoute(routeIndex, current)) {
+        return {
+            change: { changed: false, action: 'kept_openrouter', previous_model: current, model: current, write_status: null, blockers: [] },
+            restore: state.restore
+        };
+    }
+    const target = openRouterOnlyMainModelTarget(state, routeIndex);
+    if (!target) {
+        return {
+            change: {
+                changed: false, action: 'blocked', previous_model: current, model: current, write_status: null,
+                blockers: ['openrouter_only_main_model_not_openrouter']
+            },
+            restore: state.restore
+        };
+    }
+    const written = await writeModelLine(paths, before, upsertTopLevelTomlString(before, 'model', tomlBasicStringBody(target)), target, options);
+    if (!written.ok) {
+        return {
+            change: { changed: false, action: 'blocked', previous_model: current, model: current, write_status: written.status, blockers: written.blockers },
+            restore: state.restore
+        };
+    }
+    return {
+        change: { changed: true, action: 'applied', previous_model: current, model: target, write_status: written.status, blockers: [] },
+        restore: { previous_model: current, applied_model: target }
+    };
+}
+export async function restoreOpenRouterOnlyMainModel(paths, restore, options) {
+    const before = String(await readText(paths.configPath, ''));
+    const current = readTopLevelTomlString(before, 'model');
+    const unchanged = (action) => ({ changed: false, action, previous_model: current, model: current, write_status: null, blockers: [] });
+    if (!restore?.applied_model)
+        return unchanged('no_record');
+    if (current !== restore.applied_model)
+        return unchanged('user_changed');
+    const previous = restore.previous_model;
+    const next = previous === null
+        ? removeTopLevelTomlKeyIfValue(before, 'model', restore.applied_model)
+        : upsertTopLevelTomlString(before, 'model', tomlBasicStringBody(previous));
+    const written = await writeModelLine(paths, before, next, previous, options);
+    if (!written.ok) {
+        return { changed: false, action: 'blocked', previous_model: current, model: current, write_status: written.status, blockers: written.blockers };
+    }
+    return {
+        changed: true,
+        action: previous === null ? 'removed' : 'restored',
+        previous_model: current,
+        model: previous,
+        write_status: written.status,
+        blockers: []
+    };
+}

package/dist/core/codex-lb/desktop-controller-v3/openrouter-only-status.js

@@ -0,0 +1,68 @@
+import { readTopLevelTomlString } from '../../codex-app/codex-model-catalog.js';
+import { jevEnabled, readDecisionConfig } from '../../decisions/config.js';
+import { readImagegenConfig } from '../../imagegen/imagegen-config.js';
+import { defaultSubagentEntry } from '../../subagents/child-model-allowlist.js';
+import { hasOpenRouterRoute, readControllerOpenRouterOnlyState } from './openrouter-only-catalog.js';
+import { controllerEnv } from './shared.js';
+import { loadCore } from './status.js';
+export const OPENROUTER_ONLY_UNAVAILABLE_ERRORS = [
+    'openrouter_only_provider_disabled',
+    'openrouter_only_credential_missing',
+    'openrouter_only_subagent_list_empty',
+    'openrouter_only_main_model_not_openrouter',
+    'desktop_bridge_not_running'
+];
+export const OPENROUTER_ONLY_CODEX_IMAGE_MODE_WARNING = 'openrouter_only_codex_image_mode_unavailable';
+export function openRouterOnlyProviderBlocker(core) {
+    const profile = core.registry.profiles.openrouter;
+    if (!profile.enabled)
+        return 'openrouter_only_provider_disabled';
+    if (profile.state !== 'ready')
+        return 'openrouter_only_credential_missing';
+    return null;
+}
+function activeRouteIndex(core) {
+    return core.activeCatalog.ok ? core.activeCatalog.route_index : null;
+}
+export function openRouterOnlyError(core, state) {
+    return openRouterOnlyProviderBlocker(core)
+        ?? (state.subagent_models.length === 0 ? 'openrouter_only_subagent_list_empty' : null)
+        ?? (hasOpenRouterRoute(activeRouteIndex(core), readTopLevelTomlString(core.config, 'model'))
+            ? null : 'openrouter_only_main_model_not_openrouter')
+        ?? (core.service.running ? null : 'desktop_bridge_not_running');
+}
+export async function openRouterOnlyStatusFromCore(core, options, state = readControllerOpenRouterOnlyState(core.paths)) {
+    const routeIndex = activeRouteIndex(core);
+    const [jev, imagegen] = await Promise.all([
+        readDecisionConfig(controllerEnv(options)).then(jevEnabled).catch(() => false),
+        readImagegenConfig({ HOME: core.paths.home }).catch(() => null)
+    ]);
+    const subagentModels = state.subagent_models.map((entry) => ({
+        model: entry.model,
+        criteria: entry.criteria,
+        reasoning_effort: entry.reasoning_effort,
+        default: entry.default,
+        routable: hasOpenRouterRoute(routeIndex, entry.model)
+    }));
+    const error = state.enabled ? openRouterOnlyError(core, state) : null;
+    const warnings = state.enabled
+        ? [
+            ...(imagegen?.mode === 'openrouter' ? [] : [OPENROUTER_ONLY_CODEX_IMAGE_MODE_WARNING]),
+            ...subagentModels.filter((entry) => !entry.routable)
+                .map((entry) => `openrouter_only_subagent_model_unroutable:${entry.model}`)
+        ]
+        : [];
+    return {
+        enabled: state.enabled,
+        state: !state.enabled ? 'off' : error ? 'unavailable' : 'active',
+        error,
+        main_model: readTopLevelTomlString(core.config, 'model'),
+        default_subagent_model: defaultSubagentEntry(state)?.model ?? null,
+        subagent_models: subagentModels,
+        jev_enabled: jev,
+        warnings
+    };
+}
+export async function openRouterOnlyStatus(options) {
+    return openRouterOnlyStatusFromCore(await loadCore(options), options);
+}

package/dist/core/codex-lb/desktop-controller-v3/status.js

@@ -8,6 +8,7 @@ import { readBridgeRoutingPolicy, validateBridgeRoutingPolicy } from '../provide
 import { sha256Stable } from '../route-index.js';
 import { assertDesktopBridgeStatusV3 } from '../bridge-runtime-validation.js';
 import { desktopBridgeReportReadinessV3, readLastDiagnostic } from './diagnostics.js';
+import { readControllerOpenRouterOnlyState } from './openrouter-only-catalog.js';
 import { activeProviderIds, controllerPaths, emptyScope, makeId, providerCode, providerRegistrySnapshot, recoveryActions, resolveValidatedCredentials, serviceLoopbackOrigin, unique } from './shared.js';
 export async function desktopBridgeStatusV3(options = {}) {
     const core = await loadCore(options);
@@ -39,10 +40,11 @@ export async function loadCore(options) {
         ...(snapshot ? { providerRegistry: snapshot } : {}),
         ...(policy ? { routePolicy: policy } : {})
     });
-    const catalogSync = desktopBridgeCatalogStatusV3(activeCatalog, registry, policy, policyBlockers, checkedAt);
+    const openRouterOnlyEnabled = readControllerOpenRouterOnlyState(paths).enabled;
+    const catalogSync = desktopBridgeCatalogStatusV3(activeCatalog, registry, policy, policyBlockers, checkedAt, openRouterOnlyEnabled ? ['codex-lb'] : []);
     const diagnostic = await readLastDiagnostic(paths.diagnosticPath, catalogSync.generation, service.state?.process_generation || null, service.state?.last_verified_probe_ids || []);
     const settings = await readDesktopBridgeServiceSettings(options.settingsPath || desktopBridgeServicePaths(paths.home).settings_path).catch(() => null);
-    return { authPriorityEnabled: settings?.auth_priority_enabled === true, paths, checkedAt, config, credentials, registry, activeCatalog, policy, policyBlockers, service, auth, catalogSync, diagnostic };
+    return { authPriorityEnabled: settings?.auth_priority_enabled === true, openRouterOnlyEnabled, paths, checkedAt, config, credentials, registry, activeCatalog, policy, policyBlockers, service, auth, catalogSync, diagnostic };
 }
 export function scopeCatalogBlockersToActiveProviders(combinedBlockers, activeProviderProblems, inactiveProviderProblems) {
     return combinedBlockers.filter((blocker) => activeProviderProblems.has(blocker) || !inactiveProviderProblems.has(blocker));
@@ -185,7 +187,8 @@ function providerProfileStatus(core, providerId) {
         capabilities: core.diagnostic?.report.providers[providerId] || emptyScope(`provider:${providerId}`, core.checkedAt)
     };
 }
-export function desktopBridgeCatalogStatusV3(active, registry, policy, policyBlockers, checkedAt) {
+export function desktopBridgeCatalogStatusV3(active, registry, policy, policyBlockers, checkedAt, excludedProviders = []) {
+    const catalogEnabled = (providerId) => registry.profiles[providerId].enabled && !excludedProviders.includes(providerId);
     const providerRows = Object.fromEntries(['codex-lb', 'openrouter'].map((providerId) => {
         const profile = registry.profiles[providerId];
         const models = active.ok ? active.catalog.models.filter((model) => model.provider_id === providerId) : [];
@@ -194,7 +197,7 @@ export function desktopBridgeCatalogStatusV3(active, registry, policy, policyBlo
         const expired = Boolean(persisted?.expires_at && Date.parse(persisted.expires_at) <= Date.parse(checkedAt));
         const state = !active.ok
             ? 'not_started'
-            : !profile.enabled ? 'not_started'
+            : !catalogEnabled(providerId) ? 'not_started'
                 : expired ? 'stale'
                     : indexed?.state === 'ready' && models.length > 0
                         && persisted?.state === 'verified' && persisted.generation === indexed.catalog_generation
@@ -220,7 +223,7 @@ export function desktopBridgeCatalogStatusV3(active, registry, policy, policyBlo
         };
         return [providerId, row];
     }));
-    const enabled = ['codex-lb', 'openrouter'].filter((id) => registry.profiles[id].enabled);
+    const enabled = ['codex-lb', 'openrouter'].filter(catalogEnabled);
     const verified = enabled.filter((id) => providerRows[id].state === 'verified');
     const stale = enabled.filter((id) => providerRows[id].state === 'stale');
     const conflicts = active.ok ? active.route_index.conflicts.length : 0;

package/dist/core/codex-lb/desktop-controller-v3.js

@@ -1,6 +1,8 @@
 import { listSelectableModels, selectExposedModels, syncCatalog } from './desktop-controller-v3/catalog.js';
 import { explainRoute, ensureDesktopBridge, repairDesktopBridge, rollbackDesktopBridge, setDefaultProvider, setOfficialModelsMode, setAuthPriority, unmanageDesktopBridge } from './desktop-controller-v3/lifecycle-commands.js';
 import { configureProvider, removeCredential, setProviderState, validateProvider } from './desktop-controller-v3/provider-commands.js';
+import { listSubagentModels, openRouterOnlyStatusCommand, setOpenRouterOnly, setSubagentModels } from './desktop-controller-v3/openrouter-only-commands.js';
+import { openRouterOnlyStatus } from './desktop-controller-v3/openrouter-only-status.js';
 import { commandResult, safeCode } from './desktop-controller-v3/shared.js';
 import { desktopBridgeStatusV3 } from './desktop-controller-v3/status.js';
 import { verifyDesktopBridgeV3 } from './desktop-controller-v3/verification.js';
@@ -8,6 +10,7 @@ import { withFileLock } from '../locks/file-lock.js';
 import path from 'node:path';
 export { desktopBridgeDiagnosticBindingCurrentV3, desktopBridgeReportReadinessV3 } from './desktop-controller-v3/diagnostics.js';
 export { runDesktopBridgeDeepProviderProbesV3 } from './desktop-controller-v3/live-probes.js';
+export { openRouterOnlyStatus } from './desktop-controller-v3/openrouter-only-status.js';
 export { desktopBridgeCatalogStatusV3, desktopBridgeStatusV3 } from './desktop-controller-v3/status.js';
 export { verifyDesktopBridgeV3 } from './desktop-controller-v3/verification.js';
 export async function executeDesktopBridgeCommandV3(request, options = {}) {
@@ -19,6 +22,10 @@ export async function executeDesktopBridgeCommandV3(request, options = {}) {
     }
     if (request.operation === 'verify')
         return verifyDesktopBridgeV3(request.level, options);
+    if (request.operation === 'openrouter-only.status')
+        return openRouterOnlyStatusCommand(options);
+    if (request.operation === 'subagent-models.list')
+        return listSubagentModels(options);
     try {
         const home = path.resolve(options.home || process.env.HOME || '.');
         return await withFileLock({
@@ -62,6 +69,12 @@ export async function executeDesktopBridgeCommandV3(request, options = {}) {
                 return setDefaultProvider(request.provider_id, options);
             if (request.operation === 'auth-priority.set')
                 return setAuthPriority(request.enabled, options);
+            if (request.operation === 'openrouter-only.set') {
+                return setOpenRouterOnly(request.enabled, request.no_restart === true, options);
+            }
+            if (request.operation === 'subagent-models.set') {
+                return setSubagentModels(request.subagent_models, request.no_restart === true, options);
+            }
             if (request.operation === 'route.official-models')
                 return setOfficialModelsMode(request.mode, options);
             if (request.operation === 'route.explain')
@@ -74,7 +87,18 @@ export async function executeDesktopBridgeCommandV3(request, options = {}) {
     catch (error) {
         const blocker = safeCode(error, 'desktop_bridge_command_failed');
         const status = await desktopBridgeStatusV3(options).catch(() => null);
-        return commandResult(request.operation, false, status, request.operation === 'auth-priority.set' && status?.auth_priority
-            ? { auth_priority: status.auth_priority } : {}, [blocker], options);
+        return commandResult(request.operation, false, status, await failureModeEcho(request.operation, status, options), [blocker], options);
     }
 }
+async function failureModeEcho(operation, status, options) {
+    const modeOperation = operation === 'auth-priority.set'
+        || operation.startsWith('openrouter-only.')
+        || operation.startsWith('subagent-models.');
+    if (!modeOperation)
+        return {};
+    const openRouterOnly = await openRouterOnlyStatus(options).catch(() => null);
+    return {
+        ...(status?.auth_priority ? { auth_priority: status.auth_priority } : {}),
+        ...(openRouterOnly ? { openrouter_only: openRouterOnly } : {})
+    };
+}

package/dist/core/codex-lb/desktop-service.js

@@ -14,6 +14,7 @@ import { captureCodexAuthSnapshot } from './desktop-auth-invariant.js';
 import { applyOfficialModelPassthrough, bridgeRoutePolicyPath, writeBridgeRoutingPolicy } from './provider-route-policy.js';
 import { desktopBridgeRuntimeVersion, desktopBridgeRuntimeVersionStale } from './desktop-bridge/state.js';
 import { PACKAGE_VERSION } from '../version.js';
+import { canonicalChildModelId, readOpenRouterOnlyStateSync } from '../subagents/child-model-allowlist.js';
 import { BRIDGE_OFFICIAL_ROUTE_ID } from './bridge-contracts.js';
 import { DESKTOP_BRIDGE_ALLOWED_PATH_PREFIXES, DESKTOP_BRIDGE_LAUNCHD_LABEL, desktopBridgeConfigGeneration, desktopBridgeLaunchdPlistPath, desktopBridgeProcessExists, desktopBridgeStatePath, getDesktopBridgeStatus, preflightDesktopBridge, readDesktopBridgeState, safeBridgeErrorCode, writeDesktopBridgeLaunchdPlist, selectAvailableDesktopBridgePort, startPreparedDesktopBridge, DESKTOP_BRIDGE_STATE_SCHEMA, DESKTOP_BRIDGE_OFFICIAL_UPSTREAM_BASE_URL, DesktopBridgeError, } from './desktop-bridge/index.js';
 export const DEFAULT_DESKTOP_BRIDGE_HOST = '127.0.0.1';
@@ -230,6 +231,15 @@ async function runtimeCredentials(settings, options) {
     });
     return { registry, resolver, sources: Object.fromEntries([...adopted].map(([id, value]) => [id, value.source])), loaded };
 }
+export function resolveDesktopBridgeOpenRouterOnly(input) {
+    const state = readOpenRouterOnlyStateSync({ home: input.home, ...(input.env ? { env: input.env } : {}) });
+    if (!state.enabled)
+        return null;
+    const models = state.subagent_models
+        .map((entry) => canonicalChildModelId(entry.model))
+        .filter((model) => canonicalizeBridgeModelId(model) === model);
+    return { enabled: true, subagent_models: [...new Set(models)] };
+}
 function normalizeEndpointForBinding(value) {
     try {
         return new URL(value).toString().replace(/\/+$/, '');
@@ -258,7 +268,8 @@ export async function resolveDesktopBridgeRuntimeConfig(options = {}) {
         throw new Error('desktop_bridge_provider_credentials_unavailable');
     const persistProviderSessionPins = options.persistProviderSessionPins
         || ((pins) => persistDesktopBridgeSessionPins(paths.settings_path, settings, pins));
-    const config = { providerRegistry: settings.provider_registry, routePolicy: settings.route_policy, providerSessionPins: settings.provider_session_pins, ...(options.resolveRequestRoute ? { resolveRequestRoute: options.resolveRequestRoute } : {}), persistProviderSessionPins, resolveProviderCredential: credentials.resolver, clientCapabilitySha256: settings.client_capability_sha256, listenHost: settings.listen_host, listenPort: settings.listen_port, allowedPathPrefixes: DESKTOP_BRIDGE_ALLOWED_PATH_PREFIXES, allowedOrigins: settings.allowed_origins, connectTimeoutMs: settings.connect_timeout_ms, idleTimeoutMs: settings.idle_timeout_ms, officialPassthrough: settings.official_passthrough.enabled ? { baseUrl: settings.official_passthrough.base_url } : null };
+    const openRouterOnly = resolveDesktopBridgeOpenRouterOnly({ home, ...(options.env ? { env: options.env } : {}) });
+    const config = { providerRegistry: settings.provider_registry, routePolicy: settings.route_policy, providerSessionPins: settings.provider_session_pins, ...(options.resolveRequestRoute ? { resolveRequestRoute: options.resolveRequestRoute } : {}), persistProviderSessionPins, resolveProviderCredential: credentials.resolver, clientCapabilitySha256: settings.client_capability_sha256, listenHost: settings.listen_host, listenPort: settings.listen_port, allowedPathPrefixes: DESKTOP_BRIDGE_ALLOWED_PATH_PREFIXES, allowedOrigins: settings.allowed_origins, connectTimeoutMs: settings.connect_timeout_ms, idleTimeoutMs: settings.idle_timeout_ms, officialPassthrough: settings.official_passthrough.enabled ? { baseUrl: settings.official_passthrough.base_url } : null, ...(openRouterOnly ? { openRouterOnly } : {}) };
     const primary = credentials.sources['codex-lb'] || credentials.sources.openrouter;
     if (!primary)
         throw new Error('desktop_bridge_provider_credentials_unavailable');
@@ -512,7 +523,7 @@ export async function serveDesktopBridge(options = {}) {
                 },
             },
         });
-        process.stdout.write(`${JSON.stringify({ schema: 'sks.desktop-bridge-log.v2', event: 'sks.desktop_bridge.started', at: new Date().toISOString(), sks_version: PACKAGE_VERSION, pid: handle.state.pid, process_generation: handle.state.schema === DESKTOP_BRIDGE_STATE_SCHEMA ? handle.state.process_generation : null, provider_registry_generation: runtime.config.providerRegistry?.generation, route_policy_generation: runtime.config.routePolicy?.policy_generation, ...(deferredUpstreams.length ? { deferred_upstreams: deferredUpstreams } : {}), secret_fields_redacted: true })}\n`);
+        process.stdout.write(`${JSON.stringify({ schema: 'sks.desktop-bridge-log.v2', event: 'sks.desktop_bridge.started', at: new Date().toISOString(), sks_version: PACKAGE_VERSION, pid: handle.state.pid, process_generation: handle.state.schema === DESKTOP_BRIDGE_STATE_SCHEMA ? handle.state.process_generation : null, provider_registry_generation: runtime.config.providerRegistry?.generation, route_policy_generation: runtime.config.routePolicy?.policy_generation, ...(deferredUpstreams.length ? { deferred_upstreams: deferredUpstreams } : {}), ...(runtime.config.openRouterOnly ? { openrouter_only: { enabled: true, subagent_model_count: runtime.config.openRouterOnly.subagent_models.length } } : {}), secret_fields_redacted: true })}\n`);
         await waitForShutdown(handle);
         return { schema: 'sks.desktop-bridge-serve.v1', ok: true, status: 'stopped', state: handle.state };
     }

package/dist/core/commands/naruto-command.js

@@ -44,7 +44,7 @@ export async function narutoCommand(commandOrArgs = 'naruto', maybeArgs = []) {
             schema: 'sks.naruto-credential-policy.v1',
             ok: false,
             blockers: credentialPolicy.blockers,
-            hint: 'sks naruto run --auth-mode=host --model-provider=<config.toml provider block> --provider-env-key=<ENV NAME>'
+            hint: credentialPolicy.hint ?? 'sks naruto run --auth-mode=host --model-provider=<config.toml provider block> --provider-env-key=<ENV NAME>'
         };
         if (args.includes('--json'))
             console.log(JSON.stringify(blocked, null, 2));