sneakoscope 10.7.0 → 10.7.1

package/README.md

@@ -17,8 +17,9 @@
 Sneakoscope Codex (`sks`) is an open-source local tool for the Codex CLI and Codex desktop app. It adds a macOS control center, bounded agent workflows, repository context, and evidence checks for SKS releases.
 <!-- END SKS SEARCH VISIBILITY MARKETING -->
 
-Current package: **SKS 10.7.0**, prepared for npm publication.
+Current package: **SKS 10.7.1**, prepared for npm publication.
 [Latest release notes](https://github.com/mandarange/Sneakoscope-Codex/releases/latest)
+· [npm package](https://www.npmjs.com/package/sneakoscope)
 · [Changelog](CHANGELOG.md). Install the latest stable release from npm.
 
 Ordinary work stays with the main agent. Optional Jev decisions use OpenRouter
@@ -132,9 +133,13 @@ sks doctor --json
 
 `sks update` updates the **global** SKS package, verifies the installed command,
 and reconciles SKS-managed skills, hooks, configuration and SKS Center where
-available. In 10.5.5 and later it also repairs the known ignored Codex settings
-and refreshes managed guidance. User-authored text and explicit preferences
-are preserved. If a step fails, follow the recovery action in its output.
+available. Cleanup follows the current package's manifest and ownership markers
+regardless of the previous version, including mixed leftovers from interrupted
+installs or a missing old generation manifest. Running it again when already
+current still repairs the managed setup. It also repairs the known ignored
+Codex settings and refreshes managed guidance. User-authored text, credentials
+and explicit preferences are preserved. A required cleanup failure blocks
+completion and is reported with its recovery action.
 
 To check available updates first, run `sks update check`. For a repair without
 requesting a newer package, run `sks doctor --fix` yourself in the terminal.
@@ -155,7 +160,24 @@ references and rebuilds TriWiki. Update and user-run `sks doctor --fix` share
 that maintenance and repair known ignored configuration settings. User text
 and model choices are preserved. See [harness maintenance](docs/align-modernization.md).
 
-### New in 10.5.7
+### New in 10.7.0
+
+- **A smaller command surface:** duplicate and unused commands were removed;
+  use `sks help <command>` for the supported command path.
+- **Project-aware verification:** Plans and Proof Field reports use the target
+  project's own package scripts and checks instead of SKS maintainer commands.
+- **Project-owned marketing:** SEO/GEO research and apply flows describe the
+  project they run in and preserve an existing project description.
+- **Essential-profile guidance:** read-only paths stay lightweight while
+  safety checks remain active; destructive defaults and misleading proof paths
+  are refused.
+- **Faster read-only commands:** status and help paths no longer load unrelated
+  update-migration machinery.
+
+These changes are product behavior and validation improvements; they do not
+claim a measured model-quality or general speed increase.
+
+### Earlier highlights: 10.5.7
 
 - **Jev execution profiles:** a decision can propose a bounded execution plan.
   The default policy is `baseline`; fast profiles require `optimize` and an

package/crates/sks-core/Cargo.lock

@@ -259,7 +259,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "10.7.0"
+version = "10.7.1"
 dependencies = [
  "globset",
  "grep-matcher",

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "10.7.0"
+version = "10.7.1"
 edition = "2021"
 
 [dependencies]

package/dist/cli/install-helpers-codex-lb-config.js

@@ -4,13 +4,16 @@ import { escapeRegExp } from '../core/text/regex.js';
 export const DESKTOP_BRIDGE_MANAGED_MARKER = '# sks-desktop-bridge-managed';
 export const DESKTOP_BRIDGE_MANAGED_BASE_URL_MARKER = '# sks-desktop-bridge-managed-base-url';
 export const DESKTOP_BRIDGE_MANAGED_MODEL_CATALOG_MARKER = '# sks-desktop-bridge-managed-model-catalog';
-export function bindCodexClientProvider(text, provider) {
-    const selected = topLevelTomlString(text, 'model_provider');
-    if (selected && selected !== 'openai' && selected !== 'codex-lb')
-        return text;
-    if (selected === provider)
-        return text;
-    return upsertTopLevelTomlString(String(text || ''), 'model_provider', provider);
+export function repairManagedCodexLbClientSelection(text) {
+    const source = String(text || '');
+    if (topLevelTomlString(source, 'model_provider') !== 'codex-lb')
+        return source;
+    if (!topLevelHasLine(source, DESKTOP_BRIDGE_MANAGED_MARKER) || hasCodexLbProviderTable(source))
+        return source;
+    return upsertTopLevelTomlString(source, 'model_provider', 'openai');
+}
+export function hasCodexLbProviderTable(text) {
+    return /^\s*\[model_providers\.(?:"codex-lb"|codex-lb)\]\s*(?:#.*)?$/m.test(text);
 }
 export function upsertDesktopBridgeManagedConfig(text, input) {
     const bridgeBaseUrl = normalizeManagedBridgeBaseUrl(input.bridgeBaseUrl);
@@ -39,7 +42,7 @@ export function upsertDesktopBridgeManagedConfig(text, input) {
     if (existingCatalog && !catalogOwned) {
         throw new Error('historical_user_owned_config_conflict:model_catalog_json');
     }
-    const keepCodexLb = selectedProvider === 'codex-lb';
+    const keepCodexLb = selectedProvider === 'codex-lb' && hasCodexLbProviderTable(next);
     next = removeManagedBridgeTopLevelBindings(next);
     next = upsertTopLevelTomlString(next, 'model_provider', keepCodexLb ? 'codex-lb' : 'openai');
     next = addTopLevelMarkerBeforeKey(next, 'model_provider', DESKTOP_BRIDGE_MANAGED_MARKER);

package/dist/config/skills-manifest.json

@@ -1,6 +1,6 @@
 {
   "schema": "sks.skills-manifest.v1",
-  "package_version": "10.7.0",
+  "package_version": "10.7.1",
   "skills": [
     {
       "canonical_name": "sks",

package/dist/core/agents/agent-role-config.js

@@ -5,6 +5,7 @@ import { nowIso, readText, writeJsonAtomic } from '../fsx.js';
 import { inspectConfinedPath, moveConfinedPath, removeConfinedDirectoryIfEmpty, removeManagedPathVerified, uniqueConfinedPath, walkConfinedEntries } from '../managed-path-safety.js';
 import { MANAGED_OFFICIAL_SUBAGENT_ROLES, RETIRED_MANAGED_AGENT_ROLE_TOMBSTONES, managedAgentRoleOwnsText } from '../managed-assets/managed-assets-manifest.js';
 import { installOfficialSubagentAgentConfigs, refreshGlobalOfficialSubagentAgentConfigs } from '../subagents/official-subagent-config.js';
+import { reconcileStaleSksModelPins } from './sks-model-pin-hygiene.js';
 export const AGENT_ROLE_CONFIG_REPAIR_SCHEMA = 'sks.agent-role-config-repair.v1';
 export async function repairAgentRoleConfigs(input) {
     const root = path.resolve(input.root);
@@ -18,6 +19,7 @@ export async function repairAgentRoleConfigs(input) {
         ...(input.globalRuntimeRoot ? { globalRuntimeRoot: input.globalRuntimeRoot } : {}),
         fix: input.apply === true
     });
+    const modelPinHygiene = await reconcileStaleSksModelPins({ root, codexHome, fix: input.apply === true });
     const officialRepair = await installOfficialSubagentAgentConfigs(root, { apply: input.apply === true });
     const globalRepair = path.join(root, '.codex') === codexHome
         ? null
@@ -38,7 +40,7 @@ export async function repairAgentRoleConfigs(input) {
         schema: AGENT_ROLE_CONFIG_REPAIR_SCHEMA,
         generated_at: nowIso(),
         ok: input.apply
-            ? requiredFixes === appliedFixes && manualBlockers.length === 0 && retiredRoleCleanup.ok
+            ? requiredFixes === appliedFixes && manualBlockers.length === 0 && retiredRoleCleanup.ok && modelPinHygiene.errors.length === 0
             : manualBlockers.length === 0 && retiredRoleCleanup.ok && (globalRepair?.stale.length || 0) === 0,
         apply: input.apply === true,
         missing,
@@ -51,12 +53,14 @@ export async function repairAgentRoleConfigs(input) {
         manual_blockers: manualBlockers,
         manifest_role_ids: MANAGED_OFFICIAL_SUBAGENT_ROLES.map((role) => role.id),
         retired_role_cleanup: retiredRoleCleanup,
+        model_pin_hygiene: modelPinHygiene,
         warnings_suppressed: true,
         blockers: [
             ...manualBlockers,
             ...(!input.apply ? (globalRepair?.stale.map((file) => `stale_global_official_subagent_agent:${globalPath(file)}`) || []) : []),
             ...(input.apply && requiredFixes !== appliedFixes ? ['agent_role_config_repair_incomplete'] : []),
-            ...(!retiredRoleCleanup.ok ? ['retired_agent_role_cleanup_incomplete'] : [])
+            ...(!retiredRoleCleanup.ok ? ['retired_agent_role_cleanup_incomplete'] : []),
+            ...modelPinHygiene.errors.map((error) => `model_pin_hygiene_failed:${error}`)
         ]
     };
     if (input.reportPath)

package/dist/core/agents/sks-model-pin-hygiene.js

@@ -0,0 +1,150 @@
+import fsp from 'node:fs/promises';
+import path from 'node:path';
+import { readText, writeTextAtomic } from '../fsx.js';
+import { hasCodexLbProviderTable } from '../../cli/install-helpers-codex-lb-config.js';
+import { hasSksManagedCodexConfigMarker, writeCodexConfigGuarded } from '../codex/codex-config-guard.js';
+import { bridgeRouteIndexPath, combinedBridgeCatalogPath } from '../codex-lb/combined-catalog.js';
+import { readActiveCombinedBridgeCatalog } from '../codex-lb/combined-catalog/persistence.js';
+import { backupInvalidToml } from '../subagents/official-subagent-config.js';
+export const MODEL_PIN_HYGIENE_SCHEMA = 'sks.model-pin-hygiene.v1';
+const LEGACY_ROLE_NAMES = new Set(['sks-planner', 'sks-implementer', 'sks-explorer', 'sks-checker']);
+async function catalogPinState(codexHome) {
+    const read = await readActiveCombinedBridgeCatalog(combinedBridgeCatalogPath(codexHome), bridgeRouteIndexPath(codexHome)).catch(() => null);
+    if (!read?.ok)
+        return null;
+    const rows = new Map();
+    for (const row of read.catalog.models) {
+        for (const id of [row.public_id, row.slug])
+            if (typeof id === 'string' && id)
+                rows.set(id, row);
+    }
+    return (model) => {
+        const row = rows.get(model);
+        if (!row)
+            return 'unlisted';
+        const visibility = String(row.visibility || 'list').toLowerCase();
+        const upgrade = row.upgrade && typeof row.upgrade === 'object' ? row.upgrade.model : null;
+        return visibility === 'hide' || visibility === 'hidden' || (typeof upgrade === 'string' && upgrade) ? 'superseded' : 'current';
+    };
+}
+function topLevelEnd(lines) {
+    const end = lines.findIndex((line) => /^\s*\[/.test(line) || /^\s*developer_instructions\s*=/.test(line));
+    return end === -1 ? lines.length : end;
+}
+function stalePinLines(text, pinState, codexLbProviderDefined) {
+    const lines = text.split('\n');
+    const indexes = [];
+    const labels = [];
+    for (let index = 0; index < topLevelEnd(lines); index += 1) {
+        const match = /^\s*(model|model_provider)\s*=\s*"([^"]*)"\s*(?:#.*)?$/.exec(lines[index] || '');
+        if (!match)
+            continue;
+        const [, key, value] = match;
+        const stale = key === 'model_provider'
+            ? value === 'codex-lb' && !codexLbProviderDefined
+            : pinState !== null && pinState(value) !== 'current';
+        if (!stale)
+            continue;
+        indexes.push(index);
+        labels.push(`${key} = "${value}"`);
+    }
+    return { indexes, labels };
+}
+function withoutLines(text, indexes) {
+    const drop = new Set(indexes);
+    return text.split('\n').filter((_, index) => !drop.has(index)).join('\n');
+}
+const CODEX_LB_SELECTION_EVIDENCE = [
+    /^\s*model_provider\s*=\s*["']codex-lb["']\s*(?:#.*)?$/,
+    /^\s*\[model_providers\.(?:"codex-lb"|codex-lb)\]\s*(?:#.*)?$/
+];
+function sksOwnedProjectConfig(text) {
+    const withoutSelection = text.split('\n')
+        .filter((line) => !CODEX_LB_SELECTION_EVIDENCE.some((pattern) => pattern.test(line)))
+        .join('\n');
+    return hasSksManagedCodexConfigMarker(withoutSelection);
+}
+function isLegacySksRole(file, text) {
+    if (/sks_managed_body_sha256/.test(text))
+        return false;
+    const name = /^\s*name\s*=\s*"([^"]+)"/m.exec(text)?.[1] ?? path.basename(file, '.toml');
+    return /^\s*description\s*=\s*"SKS managed\b/m.test(text) || LEGACY_ROLE_NAMES.has(name);
+}
+async function regularFile(file) {
+    const stat = await fsp.lstat(file).catch(() => null);
+    return Boolean(stat?.isFile() && !stat.isSymbolicLink());
+}
+async function roleFiles(dir) {
+    const entries = await fsp.readdir(dir).catch(() => []);
+    return entries.filter((name) => name.endsWith('.toml')).sort().map((name) => path.join(dir, name));
+}
+export async function reconcileStaleSksModelPins(input) {
+    const root = path.resolve(input.root);
+    const codexHome = path.resolve(input.codexHome);
+    const pinState = await catalogPinState(codexHome);
+    const report = {
+        schema: MODEL_PIN_HYGIENE_SCHEMA,
+        fix: input.fix,
+        catalog_available: pinState !== null,
+        changes: [],
+        remaining: [],
+        errors: []
+    };
+    const projectConfig = path.join(root, '.codex', 'config.toml');
+    const projectText = projectConfig !== path.join(codexHome, 'config.toml') && await regularFile(projectConfig)
+        ? await readText(projectConfig, '')
+        : null;
+    const providerDefinedAbove = hasCodexLbProviderTable(await readText(path.join(codexHome, 'config.toml'), ''))
+        || (projectText !== null && hasCodexLbProviderTable(projectText));
+    const agentDirs = [...new Set([path.join(codexHome, 'agents'), path.join(root, '.codex', 'agents')])];
+    for (const dir of agentDirs) {
+        for (const file of await roleFiles(dir)) {
+            if (!(await regularFile(file)))
+                continue;
+            const text = await readText(file, '');
+            if (!isLegacySksRole(file, text))
+                continue;
+            const pins = stalePinLines(text, pinState, providerDefinedAbove || hasCodexLbProviderTable(text));
+            if (!pins.indexes.length)
+                continue;
+            if (!input.fix) {
+                report.remaining.push({ file, removed: pins.labels, backup_path: null });
+                continue;
+            }
+            try {
+                const backup = await backupInvalidToml(file, text, 'model-pin-hygiene');
+                const mode = (await fsp.stat(file)).mode & 0o777;
+                await writeTextAtomic(file, withoutLines(text, pins.indexes), { mode });
+                report.changes.push({ file, removed: pins.labels, backup_path: backup });
+            }
+            catch (error) {
+                report.errors.push(`${file}: ${error instanceof Error ? error.message : String(error)}`);
+                report.remaining.push({ file, removed: pins.labels, backup_path: null });
+            }
+        }
+    }
+    if (projectText !== null) {
+        const text = projectText;
+        const pins = sksOwnedProjectConfig(text) ? stalePinLines(text, pinState, providerDefinedAbove) : { indexes: [], labels: [] };
+        if (pins.indexes.length && !input.fix)
+            report.remaining.push({ file: projectConfig, removed: pins.labels, backup_path: null });
+        else if (pins.indexes.length) {
+            const write = await writeCodexConfigGuarded({
+                root,
+                configPath: projectConfig,
+                before: text,
+                mutate: () => withoutLines(text, pins.indexes),
+                cause: 'model-pin-hygiene',
+                backupTag: 'model-pin-hygiene',
+                verifyUnchangedBeforeWrite: true
+            });
+            if (write.ok)
+                report.changes.push({ file: projectConfig, removed: pins.labels, backup_path: write.backup_path });
+            else {
+                report.errors.push(`${projectConfig}: ${write.status}`);
+                report.remaining.push({ file: projectConfig, removed: pins.labels, backup_path: null });
+            }
+        }
+    }
+    return report;
+}

package/dist/core/codex/codex-config-guard.js

@@ -585,19 +585,24 @@ export function removeLegacyTopLevelCodexModeLocks(text = '') {
     const lines = String(ensureTrailingNewline(text) || '').split('\n');
     const firstTable = lines.findIndex((x) => /^\s*\[.+\]\s*$/.test(x));
     const end = firstTable === -1 ? lines.length : firstTable;
-    return ensureTrailingNewline(lines.filter((line, index) => {
-        if (index >= end)
-            return true;
-        if (!/^\s*(?:model|model_reasoning_effort)\s*=/.test(line))
-            return true;
-        return !hasSksModeLockProvenance(lines, index);
-    }).join('\n').replace(/^\n+/, '').replace(/\n{3,}/g, '\n\n'));
+    const drop = new Set();
+    for (let index = 0; index < end; index += 1) {
+        if (!/^\s*(?:model|model_reasoning_effort)\s*=/.test(lines[index] || ''))
+            continue;
+        const marker = sksModeLockProvenance(lines, index);
+        if (marker === null)
+            continue;
+        drop.add(index);
+        if (marker >= 0)
+            drop.add(marker);
+    }
+    return ensureTrailingNewline(lines.filter((_, index) => !drop.has(index)).join('\n').replace(/^\n+/, '').replace(/\n{3,}/g, '\n\n'));
 }
-function hasSksModeLockProvenance(lines, index) {
+function sksModeLockProvenance(lines, index) {
     const current = String(lines[index] || '');
     const inlineComment = current.includes('#') ? current.slice(current.indexOf('#')) : '';
     if (isSksModeLockMarker(inlineComment))
-        return true;
+        return -1;
     const allowedManagedKeys = new Set([
         'service_tier', 'model', 'model_reasoning_effort', 'model_provider',
         'approval_policy', 'sandbox_mode', 'web_search', 'notify', 'preferred_auth_method'
@@ -609,17 +614,17 @@ function hasSksModeLockProvenance(lines, index) {
             continue;
         if (candidate.startsWith('#')) {
             if (isSksModeLockMarker(candidate))
-                return true;
+                return cursor;
             continue;
         }
         const key = candidate.match(/^([A-Za-z0-9_-]+)\s*=/)?.[1] || '';
         if (!allowedManagedKeys.has(key))
-            return false;
+            return null;
     }
-    return false;
+    return null;
 }
 function isSksModeLockMarker(value = '') {
-    return /^#\s*(?:SKS|Sneakoscope)\b.*(?:moved machine-local Codex config|forced fast UI|managed (?:Codex )?(?:model|reasoning)|codex-lb (?:model|reasoning))/i.test(String(value || '').trim());
+    return /^#\s*(?:SKS|Sneakoscope)\b.*(?:forced fast UI|managed (?:Codex )?(?:model|reasoning)|codex-lb (?:model|reasoning))/i.test(String(value || '').trim());
 }
 function mergeLostFastUiKeys(before, nextInput) {
     let next = String(nextInput || '');

package/dist/core/codex-app/codex-app-ui-state-snapshot.js

@@ -2,6 +2,7 @@ import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { exists, nowIso, readText, sha256, writeJsonAtomic } from '../fsx.js';
+import { HISTORICAL_DESKTOP_COMPAT_MARKER, HISTORICAL_OAUTH_SELECTION_MARKER, HISTORICAL_PROVIDER_SELECTION_MARKER } from '../codex-lb/desktop-bridge-migration/historical-toml.js';
 export const CODEX_APP_UI_STATE_SNAPSHOT_SCHEMA = 'sks.codex-app-ui-state-snapshot.v1';
 export const PROJECT_LOCAL_FORBIDDEN_CODEX_KEYS = [
     'openai_base_url',
@@ -14,6 +15,9 @@ export const PROJECT_LOCAL_FORBIDDEN_CODEX_KEYS = [
 const HOST_OWNED_KEY_RE = /^(?:model|model_reasoning_effort|openai_base_url|chatgpt_base_url|apps_mcp_product_sku|model_provider|model_providers(?:\.|$)|notify|profile|profiles(?:\.|$)|experimental_realtime_ws_base_url|otel(?:\.|$)|features\.fast_mode|service_tier|user\.fast_mode(?:\.|$))/;
 const SECRET_KEY_RE = /(?:key|token|secret|password|credential|cookie|authorization|auth|bearer|refresh|access|headers?|env)/i;
 const SKS_GLOBAL_UI_LOCK_KEYS = new Set(['model_provider', 'model', 'model_reasoning_effort']);
+const RETIRED_SKS_SELECTION_MARKERS = new Set([
+    HISTORICAL_DESKTOP_COMPAT_MARKER, HISTORICAL_PROVIDER_SELECTION_MARKER, HISTORICAL_OAUTH_SELECTION_MARKER
+]);
 const SKS_GLOBAL_UI_LOCK_CONTEXT_KEYS = new Set([
     'service_tier', 'model_provider', 'model', 'model_reasoning_effort',
     'approval_policy', 'sandbox_mode', 'web_search', 'notify', 'preferred_auth_method'
@@ -155,6 +159,8 @@ export function isSksOwnedGlobalUiLock(lines, index) {
     const inlineComment = current.includes('#') ? current.slice(current.indexOf('#')) : '';
     if (isSksGlobalUiLockMarker(inlineComment))
         return true;
+    if (key === 'model_provider' && RETIRED_SKS_SELECTION_MARKERS.has(String(lines[index - 1] || '').trim()))
+        return true;
     const lowerBound = Math.max(0, index - 16);
     for (let cursor = index - 1; cursor >= lowerBound; cursor -= 1) {
         const candidate = String(lines[cursor] || '').trim();
@@ -174,7 +180,7 @@ export function isSksOwnedGlobalUiLock(lines, index) {
     return false;
 }
 function isSksGlobalUiLockMarker(value) {
-    return /^#\s*(?:SKS|Sneakoscope)\b.*(?:moved machine-local Codex config|forced fast UI|legacy (?:provider|model|reasoning) lock|managed (?:Codex )?(?:provider|model|reasoning)|codex-lb (?:provider|model|reasoning))/i.test(String(value || '').trim());
+    return /^#\s*(?:SKS|Sneakoscope)\b.*(?:forced fast UI|legacy (?:provider|model|reasoning) lock|managed (?:Codex )?(?:provider|model|reasoning)|codex-lb (?:provider|model|reasoning))/i.test(String(value || '').trim());
 }
 export function scanProjectLocalForbiddenKeys(text) {
     const { signals } = scanTomlSignals(text);

package/dist/core/codex-lb/bridge-contracts.js

@@ -1,3 +1,8 @@
 export const MANAGED_ROUTING_RUNTIME = 'desktop-bridge';
 export const BRIDGE_PROVIDER_IDS = ['codex-lb', 'openrouter'];
 export const BRIDGE_OFFICIAL_ROUTE_ID = 'openai';
+export const BRIDGE_REMOTE_COMPACTION = Object.freeze({
+    openai: 'native',
+    'codex-lb': 'native',
+    openrouter: 'bridge_summary',
+});

package/dist/core/codex-lb/combined-catalog/builder.js

@@ -1,6 +1,6 @@
 import { buildBridgeRouteIndex, sha256Stable } from '../route-index.js';
 import { COMBINED_BRIDGE_CATALOG_SCHEMA } from './contracts.js';
-import { normalizeProviderCatalog, providerCatalogStatus, routeProviderState } from './normalize.js';
+import { OPENROUTER_PRIORITY_BASE, normalizeProviderCatalog, providerCatalogStatus, routeProviderState } from './normalize.js';
 import { pinCatalogToLatestGenerations } from './latest-generation.js';
 import { compareModels, unique } from './shared.js';
 import { applyBridgeModelSelection, availableModelRows, emptyBridgeModelSelection } from './model-selection.js';
@@ -11,7 +11,9 @@ export function buildCombinedBridgeCatalog(registry, options) {
         openrouter: normalizeProviderCatalog(options.catalogs.openrouter)
     };
     const selection = options.selection || emptyBridgeModelSelection(createdAt);
-    const allModels = pinCatalogToLatestGenerations([...normalized['codex-lb'].models, ...normalized.openrouter.models].sort(compareModels));
+    let openRouterIndex = 0;
+    const allModels = pinCatalogToLatestGenerations([...normalized['codex-lb'].models, ...normalized.openrouter.models].sort(compareModels)).map((model) => model.provider_id === 'openrouter' ? { ...model, priority: OPENROUTER_PRIORITY_BASE + openRouterIndex++ } : model)
+        .sort((left, right) => left.priority - right.priority || left.slug.localeCompare(right.slug) || compareModels(left, right));
     const availableOpenRouterModels = availableModelRows(allModels, selection);
     const models = options.selection ? applyBridgeModelSelection(allModels, selection) : allModels;
     const routeBuild = buildBridgeRouteIndex({

package/dist/core/codex-lb/combined-catalog/latest-generation.js

@@ -3,13 +3,6 @@ function isListed(model) {
     const visibility = String(model.visibility || 'list').toLowerCase();
     return visibility !== 'hide' && visibility !== 'hidden';
 }
-function escapeRegExp(text) {
-    return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-}
-function displayNamePattern(displayName) {
-    const body = escapeRegExp(displayName.trim()).replace(/\\?-|\s+/g, '[-\\s]');
-    return new RegExp(`(?<![\\w-])${body}(?![\\w-])`, 'gi');
-}
 export function pinCatalogToLatestGenerations(models) {
     const newest = new Map();
     for (const model of models) {
@@ -20,34 +13,14 @@ export function pinCatalogToLatestGenerations(models) {
         if (!best || compareModelVersions(id.version, parseGptModelId(best.public_id).version) > 0)
             newest.set(id.family, model);
     }
-    const byId = new Map(models.map((model) => [model.public_id, model]));
     return models.map((model) => {
         const id = parseGptModelId(model.public_id);
-        let next = model;
-        if (id && isListed(model)) {
-            const best = newest.get(id.family);
-            if (best && compareModelVersions(parseGptModelId(best.public_id).version, id.version) > 0)
-                next = { ...next, visibility: 'hide' };
-        }
-        const upgrade = model.upgrade;
-        const target = upgrade && typeof upgrade === 'object' ? String(upgrade.model || '') : '';
-        const targetId = parseGptModelId(target);
-        const replacement = targetId ? newest.get(targetId.family) : undefined;
-        if (targetId && replacement && replacement.public_id !== target
-            && compareModelVersions(parseGptModelId(replacement.public_id).version, targetId.version) > 0) {
-            const old = byId.get(target);
-            const markdown = upgrade.migration_markdown;
-            next = {
-                ...next,
-                upgrade: {
-                    ...upgrade,
-                    model: replacement.public_id,
-                    ...(typeof markdown === 'string' && old?.display_name
-                        ? { migration_markdown: markdown.replace(displayNamePattern(old.display_name), () => replacement.display_name) }
-                        : {})
-                }
-            };
-        }
-        return next;
+        if (!id || !isListed(model))
+            return model;
+        const best = newest.get(id.family);
+        if (!best || compareModelVersions(parseGptModelId(best.public_id).version, id.version) <= 0)
+            return model;
+        const { upgrade: _retired, ...rest } = model;
+        return { ...rest, visibility: 'hide' };
     });
 }

package/dist/core/codex-lb/combined-catalog/normalize.js

@@ -130,7 +130,7 @@ function normalizeCodexLbBridgeCatalogModels(payload, sourceCatalogGeneration) {
                 ...codexModelInfoFields(publicId, row, {
                     tools: row.supports_tools === true || row.supports_tool_choice === true
                 }),
-                ...(typeof row.priority === 'number' ? {} : { priority: 100 })
+                ...(typeof row.priority === 'number' ? {} : { priority: CODEX_LB_DEFAULT_PRIORITY })
             });
         }
         catch (error) {
@@ -164,6 +164,8 @@ export const OPENROUTER_REASONING_LEVELS = [
     { effort: 'xhigh', description: 'Extra high reasoning depth for complex problems' }
 ];
 export const OPENROUTER_DEFAULT_REASONING_LEVEL = 'medium';
+export const CODEX_LB_DEFAULT_PRIORITY = 500;
+export const OPENROUTER_PRIORITY_BASE = 1000;
 function openRouterReasoningLevels() {
     return OPENROUTER_REASONING_LEVELS.map((level) => ({ ...level }));
 }

package/dist/core/codex-lb/desktop-bridge/codex-lb-turn-state.js

@@ -0,0 +1,35 @@
+const MAX_THREADS = 4_096;
+const MAX_VALUES_PER_THREAD = 8;
+const issued = new Map();
+function scope(threadId, keyFingerprint) {
+    return `${keyFingerprint}\u0000${threadId}`;
+}
+function headerValues(value) {
+    const values = Array.isArray(value) ? value : value === undefined ? [] : [String(value)];
+    return values.map((entry) => entry.trim()).filter(Boolean);
+}
+export function rememberCodexLbTurnState(threadId, keyFingerprint, headers) {
+    const values = headerValues(headers['x-codex-turn-state']);
+    if (!threadId || !values.length)
+        return;
+    const key = scope(threadId, keyFingerprint);
+    const kept = (issued.get(key) ?? []).filter((value) => !values.includes(value));
+    issued.delete(key);
+    issued.set(key, [...kept, ...values].slice(-MAX_VALUES_PER_THREAD));
+    while (issued.size > MAX_THREADS)
+        issued.delete(issued.keys().next().value);
+}
+export function admitCodexLbTurnState(headers, threadId, keyFingerprint) {
+    const values = headerValues(headers['x-codex-turn-state']);
+    if (!values.length) {
+        delete headers['x-codex-turn-state'];
+        return;
+    }
+    const known = threadId ? issued.get(scope(threadId, keyFingerprint)) : undefined;
+    if (values.length === 1 && known?.includes(values[0]))
+        return;
+    delete headers['x-codex-turn-state'];
+}
+export function forgetCodexLbTurnStates() {
+    issued.clear();
+}

package/dist/core/codex-lb/desktop-bridge/compaction-adapter.js

@@ -43,6 +43,9 @@ export function decodeBridgeCompaction(encrypted) {
         return null;
     }
 }
+export function isNativeCompactionItem(item) {
+    return isObject(item) && COMPACTION_ITEM_TYPES.has(String(item.type)) && decodeBridgeCompaction(item.encrypted_content) === null;
+}
 function summaryMessage(summary) {
     return { type: 'message', role: 'user', content: [{ type: 'input_text', text: `${CODEX_SUMMARY_PREFIX}\n${summary}` }] };
 }

package/dist/core/codex-lb/desktop-bridge/header-policy.js

@@ -7,9 +7,10 @@ const REQUEST_HEADER_ALLOWLIST = new Set([
 ]);
 const CODEX_LOCAL_HEADERS = new Set([
     'thread-id', 'thread_id', 'session-id', 'session_id', 'x-client-request-id',
-    'x-codex-installation-id', 'x-codex-turn-metadata', 'x-codex-window-id',
+    'x-codex-installation-id', 'x-codex-turn-metadata', 'x-codex-window-id', 'x-codex-turn-state',
     'originator', 'openai-beta',
 ]);
+const CLIENT_IDENTITY_HEADERS = new Set(['authorization', 'cookie', 'chatgpt-account-id']);
 const NEVER_FORWARD_FROM_CLIENT = new Set([
     'authorization', 'cookie', 'forwarded', 'proxy-authorization', 'x-api-key', 'x-codex-lb-api-key',
     'x-forwarded-for', 'x-forwarded-host', 'x-forwarded-port', 'x-forwarded-proto', 'x-real-ip',
@@ -39,14 +40,19 @@ function injectCredential(result, providerId, transport, credential) {
         result.authorization = `Bearer ${credential.value}`;
 }
 export function buildProviderUpstreamHeaders(inbound, context, upstreamHost) {
+    if (context.providerId === 'codex-lb') {
+        const result = buildOfficialPassthroughHeaders(inbound, upstreamHost);
+        for (const name of CLIENT_IDENTITY_HEADERS)
+            delete result[name];
+        injectCredential(result, context.providerId, context.authTransport, context.credential);
+        return result;
+    }
     const result = {};
     for (const [rawName, rawValue] of Object.entries(inbound)) {
         if (rawValue === undefined)
             continue;
         const name = rawName.toLowerCase();
-        const providerAllowed = (context.providerId === 'openrouter' && OPENROUTER_CLIENT_HEADERS.has(name))
-            || (context.providerId === 'codex-lb' && CODEX_LOCAL_HEADERS.has(name));
-        if (!REQUEST_HEADER_ALLOWLIST.has(name) && !providerAllowed)
+        if (!REQUEST_HEADER_ALLOWLIST.has(name) && !(context.providerId === 'openrouter' && OPENROUTER_CLIENT_HEADERS.has(name)))
             continue;
         result[name] = rawValue;
     }