sneakoscope 10.7.0 → 10.7.2

package/dist/core/codex-lb/desktop-bridge/security.js

@@ -209,14 +209,45 @@ function canonicalPublicModel(value) {
 export function desktopBridgeOfficialPassthroughEnabled(config) {
     return Boolean(config.officialPassthrough?.baseUrl);
 }
-function officialRouteContext(publicModel, policy, upstreamModel) {
+function mintSessionPin(sessionId, target, publicModel, policy, previous) {
+    const handoffFrom = previous && previous.provider_id !== target.provider_id ? previous.provider_id : previous?.handoff_from;
+    return {
+        thread_id: sessionId,
+        provider_id: target.provider_id,
+        public_model: publicModel,
+        upstream_model: target.upstream_model,
+        catalog_generation: policy.catalog_generation,
+        route_policy_generation: policy.policy_generation,
+        created_at: new Date().toISOString(),
+        ...(handoffFrom ? { handoff_from: handoffFrom } : {}),
+    };
+}
+function officialRouteContext(publicModel, policy, upstreamModel, pin = null) {
     return {
         provider_id: BRIDGE_OFFICIAL_ROUTE_ID,
         public_model: publicModel,
         upstream_model: upstreamModel || publicModel,
         catalog_generation: policy.catalog_generation,
         route_policy_generation: policy.policy_generation,
-        session_pin: null,
+        session_pin: pin,
+    };
+}
+function pinnedRouteContext(pin, publicModel, policy) {
+    const aged = pin.catalog_generation !== policy.catalog_generation
+        || pin.route_policy_generation !== policy.policy_generation;
+    return {
+        provider_id: pin.provider_id,
+        public_model: publicModel,
+        upstream_model: pin.upstream_model,
+        catalog_generation: policy.catalog_generation,
+        route_policy_generation: policy.policy_generation,
+        session_pin: aged
+            ? {
+                ...pin,
+                catalog_generation: policy.catalog_generation,
+                route_policy_generation: policy.policy_generation,
+            }
+            : pin,
     };
 }
 export function resolveBridgeRequestRoute(request, policy, pins) {
@@ -224,43 +255,22 @@ export function resolveBridgeRequestRoute(request, policy, pins) {
     const sessionId = request.session_id ? canonicalSessionId(request.session_id) : null;
     const pin = sessionId ? pins.find((entry) => entry.thread_id === sessionId) || null : null;
     if (pin && pin.public_model === publicModel) {
+        if (pin.provider_id === BRIDGE_OFFICIAL_ROUTE_ID)
+            return pinnedRouteContext(pin, publicModel, policy);
         const bare = policy.model_routes[publicModel];
         const qualified = policy.model_routes[`${pin.provider_id}:${publicModel}`];
         const current = bare?.provider_id === pin.provider_id && bare.upstream_model === pin.upstream_model ? bare : qualified;
         if (!current || current.provider_id !== pin.provider_id || current.upstream_model !== pin.upstream_model) {
             throw new DesktopBridgeError('session_pin_route_unavailable');
         }
-        const aged = pin.catalog_generation !== policy.catalog_generation
-            || pin.route_policy_generation !== policy.policy_generation;
-        return {
-            provider_id: pin.provider_id,
-            public_model: publicModel,
-            upstream_model: pin.upstream_model,
-            catalog_generation: policy.catalog_generation,
-            route_policy_generation: policy.policy_generation,
-            session_pin: aged
-                ? {
-                    ...pin,
-                    catalog_generation: policy.catalog_generation,
-                    route_policy_generation: policy.policy_generation,
-                }
-                : pin,
-        };
+        return pinnedRouteContext(pin, publicModel, policy);
     }
     const route = policy.model_routes[publicModel];
     if (!route)
         throw new DesktopBridgeError('catalog_model_route_missing');
+    const nextPin = sessionId ? mintSessionPin(sessionId, route, publicModel, policy, pin) : null;
     if (route.provider_id === BRIDGE_OFFICIAL_ROUTE_ID)
-        return officialRouteContext(publicModel, policy, route.upstream_model);
-    const nextPin = sessionId ? {
-        thread_id: sessionId,
-        provider_id: route.provider_id,
-        public_model: publicModel,
-        upstream_model: route.upstream_model,
-        catalog_generation: policy.catalog_generation,
-        route_policy_generation: policy.policy_generation,
-        created_at: new Date().toISOString(),
-    } : null;
+        return officialRouteContext(publicModel, policy, route.upstream_model, nextPin);
     return {
         provider_id: route.provider_id,
         public_model: publicModel,
@@ -270,7 +280,7 @@ export function resolveBridgeRequestRoute(request, policy, pins) {
         session_pin: nextPin,
     };
 }
-function threadPinProvider(request, config) {
+function threadPin(request, pins) {
     if (!request.session_id)
         return null;
     let threadId;
@@ -280,7 +290,25 @@ function threadPinProvider(request, config) {
     catch {
         return null;
     }
-    return config.providerSessionPins.find((pin) => pin.thread_id === threadId)?.provider_id ?? null;
+    return pins.find((pin) => pin.thread_id === threadId) ?? null;
+}
+function threadPinProvider(request, config) {
+    return threadPin(request, config.providerSessionPins)?.provider_id ?? null;
+}
+export function pinnedPublicModel(threadId, config) {
+    if (!threadId)
+        return null;
+    return threadPin({ session_id: threadId }, config.providerSessionPins)?.public_model ?? null;
+}
+const RESPONSES_PATH_PREFIXES = ['/backend-api/codex/responses', '/api/v1/responses', '/v1/responses'];
+export function isResponsesFamilyPath(pathname) {
+    return RESPONSES_PATH_PREFIXES.some((prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`));
+}
+export function threadRouteMove(request, route, config) {
+    if (!route.session_pin)
+        return null;
+    const previous = threadPin(request, config.providerSessionPins);
+    return previous && previous.provider_id !== route.provider_id ? { from: previous.provider_id, to: route.provider_id } : null;
 }
 export function assertDesktopBridgeRouteContext(request, config) {
     const resolver = config.resolveRequestRoute || resolveBridgeRequestRoute;
@@ -295,8 +323,16 @@ export function assertDesktopBridgeRouteContext(request, config) {
             && error.code === 'catalog_model_route_missing') {
             const model = canonicalizeBridgeModelId(request.public_model) || '';
             const live = model ? policy.model_routes[model] : undefined;
+            const pin = threadPin(request, config.providerSessionPins);
+            const responses = isResponsesFamilyPath(request.pathname);
+            if (pin && pin.provider_id !== BRIDGE_OFFICIAL_ROUTE_ID && responses) {
+                assertOpenRouterOnlyRoute(request, officialRouteContext(model, policy), config);
+                throw error;
+            }
             if (!live || live.provider_id === BRIDGE_OFFICIAL_ROUTE_ID) {
-                route = officialRouteContext(model, policy, live?.upstream_model);
+                const sessionId = model && responses && request.session_id ? canonicalSessionId(request.session_id) : null;
+                const target = { provider_id: BRIDGE_OFFICIAL_ROUTE_ID, upstream_model: live?.upstream_model || model };
+                route = officialRouteContext(model, policy, live?.upstream_model, sessionId ? mintSessionPin(sessionId, target, model, policy, pin) : null);
             }
             else
                 throw error;
@@ -315,8 +351,7 @@ export function assertDesktopBridgeRouteContext(request, config) {
         if (route.catalog_generation !== policy.catalog_generation || route.route_policy_generation !== policy.policy_generation) {
             throw new DesktopBridgeError('session_pin_route_unavailable');
         }
-        if (route.session_pin)
-            throw new DesktopBridgeError('bridge_session_pin_invalid');
+        assertRouteSessionPin(request, route, false);
         return route;
     }
     const existingPin = request.session_id ? config.providerSessionPins.find((pin) => pin.thread_id === request.session_id && pin.public_model === route.public_model
@@ -330,21 +365,7 @@ export function assertDesktopBridgeRouteContext(request, config) {
     if (route.catalog_generation !== policy.catalog_generation || route.route_policy_generation !== policy.policy_generation) {
         throw new DesktopBridgeError('session_pin_route_unavailable');
     }
-    if (request.session_id) {
-        const sessionId = canonicalSessionId(request.session_id);
-        if (!route.session_pin
-            || route.session_pin.thread_id !== sessionId
-            || route.session_pin.provider_id !== route.provider_id
-            || route.session_pin.public_model !== route.public_model
-            || route.session_pin.upstream_model !== route.upstream_model
-            || route.session_pin.catalog_generation !== route.catalog_generation
-            || route.session_pin.route_policy_generation !== route.route_policy_generation) {
-            throw new DesktopBridgeError('bridge_session_pin_invalid');
-        }
-    }
-    else if (route.session_pin) {
-        throw new DesktopBridgeError('bridge_session_pin_invalid');
-    }
+    assertRouteSessionPin(request, route, true);
     const provider = config.providers[route.provider_id];
     if (!provider || !provider.enabled)
         throw new DesktopBridgeError('bridge_provider_route_unavailable');
@@ -358,7 +379,28 @@ export function assertDesktopBridgeRouteContext(request, config) {
     }
     return route;
 }
-export async function resolveAndBindDesktopBridgeRouteContext(request, config) {
+function assertRouteSessionPin(request, route, required) {
+    if (!request.session_id) {
+        if (route.session_pin)
+            throw new DesktopBridgeError('bridge_session_pin_invalid');
+        return;
+    }
+    if (!route.session_pin) {
+        if (required)
+            throw new DesktopBridgeError('bridge_session_pin_invalid');
+        return;
+    }
+    const sessionId = canonicalSessionId(request.session_id);
+    if (route.session_pin.thread_id !== sessionId
+        || route.session_pin.provider_id !== route.provider_id
+        || route.session_pin.public_model !== route.public_model
+        || route.session_pin.upstream_model !== route.upstream_model
+        || route.session_pin.catalog_generation !== route.catalog_generation
+        || route.session_pin.route_policy_generation !== route.route_policy_generation) {
+        throw new DesktopBridgeError('bridge_session_pin_invalid');
+    }
+}
+export async function resolveAndBindDesktopBridgeRouteContext(request, config, beforeBind) {
     const pinsRead = config.providerSessionPins;
     let steady = null;
     try {
@@ -368,13 +410,14 @@ export async function resolveAndBindDesktopBridgeRouteContext(request, config) {
         steady = null;
     }
     const steadyPin = steady?.session_pin;
-    if (steady && !steadyPin)
-        return steady;
     const persisted = steadyPin ? pinsRead.find((entry) => entry.thread_id === steadyPin.thread_id) : undefined;
-    if (steady && steadyPin && persisted && sameSessionPin(persisted, steadyPin))
+    if (steady && (!steadyPin || (persisted && sameSessionPin(persisted, steadyPin)))) {
+        beforeBind?.(steady);
         return steady;
+    }
     return withSessionPinMutation(config, async () => {
         const route = steady && config.providerSessionPins === pinsRead ? steady : assertDesktopBridgeRouteContext(request, config);
+        beforeBind?.(route);
         const pin = route.session_pin;
         if (!pin)
             return route;
@@ -418,7 +461,8 @@ function sameSessionPin(left, right) {
         && left.public_model === right.public_model
         && left.upstream_model === right.upstream_model
         && left.catalog_generation === right.catalog_generation
-        && left.route_policy_generation === right.route_policy_generation;
+        && left.route_policy_generation === right.route_policy_generation
+        && left.handoff_from === right.handoff_from;
 }
 export function canonicalSessionId(value) {
     const sessionId = typeof value === 'string' ? value.trim() : '';
@@ -634,15 +678,17 @@ function assertRegistryAndPolicy(config, registry) {
         }
     }
     const pinIds = new Set();
+    const pinTargets = [...ids, BRIDGE_OFFICIAL_ROUTE_ID];
     for (const pin of config.providerSessionPins) {
         const keys = Object.keys(pin);
         if (keys.some((key) => ![
             'thread_id', 'provider_id', 'public_model', 'upstream_model',
-            'catalog_generation', 'route_policy_generation', 'created_at',
+            'catalog_generation', 'route_policy_generation', 'created_at', 'handoff_from',
         ].includes(key))
             || canonicalSessionId(pin.thread_id) !== pin.thread_id
             || pinIds.has(pin.thread_id)
-            || !ids.includes(pin.provider_id)
+            || !pinTargets.includes(pin.provider_id)
+            || (pin.handoff_from !== undefined && (!pinTargets.includes(pin.handoff_from) || pin.handoff_from === pin.provider_id))
             || canonicalizeBridgeModelId(pin.public_model) !== pin.public_model
             || normalizeBridgeUpstreamModelId(pin.upstream_model) !== pin.upstream_model
             || !pin.catalog_generation

package/dist/core/codex-lb/desktop-bridge/server.js

@@ -6,10 +6,12 @@ import { createDesktopBridgeRejectionLogger } from './rejection-log.js';
 import { OPENROUTER_ONLY_REFUSAL_CODES } from './exclusive-provider-guard.js';
 import { assertAllowedOrigin, assertAllowedPath, assertLoopbackPeer, assertLoopbackListenHost, assertWebSocketUpgrade, prepareDesktopBridgeConfig, safeBridgeErrorCode, validatePreparedDesktopBridgeConfig, } from './security.js';
 import { createDesktopBridgePublicState, desktopBridgeListenOrigin, desktopBridgeStatePath, refreshDesktopBridgeState, removeDesktopBridgeStateIfOwned, writeDesktopBridgeState, } from './state.js';
-import { DesktopBridgeError, DesktopBridgeRequestBodyTooLargeError } from './types.js';
+import { DesktopBridgeError, DesktopBridgeRequestBodyTooLargeError, isDesktopBridgeRoutingConflict } from './types.js';
+import { ProviderHandoffRefusedError, providerHandoffRefusalBody } from './provider-handoff.js';
 import { PACKAGE_VERSION } from '../../version.js';
 import { DESKTOP_BRIDGE_CLIENT_PATH_PREFIX, DESKTOP_BRIDGE_DIAGNOSTIC_HEALTH_PATH, DESKTOP_BRIDGE_DIAGNOSTIC_PATH, DESKTOP_BRIDGE_DIAGNOSTIC_PROTOCOL, DESKTOP_BRIDGE_IMAGEGEN_PATH } from './types.js';
 import { handleDesktopBridgeImagegen } from './imagegen-endpoint.js';
+import { answerDesktopBridgeModels, isDesktopBridgeModelsRequest } from './models-endpoint.js';
 import { forwardWebSocket, safeEndUpgradeSocket } from './websocket-forward.js';
 function authenticateDesktopBridgeClient(req, input) {
     const raw = String(req.url || '/');
@@ -94,7 +96,9 @@ function rejectionStatus(code) {
         return 404;
     if (code === 'bridge_request_capacity_exhausted')
         return 503;
-    if (code === 'bridge_session_pin_persist_failed' || code.startsWith('bridge_upstream_'))
+    if (isDesktopBridgeRoutingConflict(code))
+        return 409;
+    if (code.startsWith('bridge_upstream_'))
         return 502;
     if (code.includes('origin') || code.includes('peer') || code.includes('loopback') || code.includes('capability'))
         return 403;
@@ -134,6 +138,11 @@ function writeBridgeRejection(res, error, req) {
         res.destroy(error instanceof Error ? error : undefined);
         return;
     }
+    if (error instanceof ProviderHandoffRefusedError) {
+        res.writeHead(400, { 'content-type': 'application/json', 'cache-control': 'no-store', connection: 'close' });
+        res.end(providerHandoffRefusalBody(error));
+        return;
+    }
     const code = rejectedCode;
     res.writeHead(rejectionStatus(code), {
         'content-type': 'application/json',
@@ -262,6 +271,10 @@ export async function startPreparedDesktopBridge(input, options = {}) {
                     return;
                 }
                 assertAllowedPath(authenticated.pathname, input.allowedPathPrefixes);
+                if (input.modelsCatalog && isDesktopBridgeModelsRequest(req, authenticated.pathname)) {
+                    answerDesktopBridgeModels(req, res, input.modelsCatalog);
+                    return;
+                }
                 const prepared = await prepareDesktopBridgeRequest(req, input);
                 await forwardHttp(req, res, input, prepared, `${desktopBridgeListenOrigin(input)}${authenticated.clientBasePath}`);
             }

package/dist/core/codex-lb/desktop-bridge/types.js

@@ -22,6 +22,9 @@ export class DesktopBridgeError extends Error {
         this.code = code;
     }
 }
+export function isDesktopBridgeRoutingConflict(code) {
+    return code.startsWith('catalog_') || code.startsWith('session_') || code.includes('route_');
+}
 export const DEFAULT_DESKTOP_BRIDGE_MAX_REQUEST_BODY_BYTES = 128 * 1024 * 1024;
 export class DesktopBridgeRequestBodyTooLargeError extends DesktopBridgeError {
     maximumBytes;

package/dist/core/codex-lb/desktop-bridge/websocket-forward.js

@@ -9,6 +9,7 @@ import { OPENROUTER_ONLY_REFUSAL_CODES, openRouterOnlyEnabled } from './exclusiv
 import { desktopBridgeOfficialPassthroughEnabled, ensureDesktopBridgeRemoteTarget, isUnreachableUpstreamError, refreshDesktopBridgeRemoteTarget, resolveAndBindDesktopBridgeRouteContext, resolveCodexSessionIdentity, resolveDesktopBridgeTarget, safeBridgeErrorCode, singleBridgeHeader, canonicalSessionId } from './security.js';
 import { desktopBridgeListenOrigin } from './state.js';
 import { forwardResponsesWebSocket, isResponsesWebSocketRequest } from './responses-websocket.js';
+import { admitCodexLbTurnState } from './codex-lb-turn-state.js';
 import { DESKTOP_BRIDGE_DIAGNOSTIC_PROTOCOL, DesktopBridgeError, } from './types.js';
 const MAX_HEAD = 64 * 1024;
 const REDACTED_RESPONSE_HEADERS = new Set(['authorization', 'cookie', 'proxy-authenticate', 'proxy-authorization', 'set-cookie', 'x-api-key', 'x-codex-lb-api-key']);
@@ -203,6 +204,8 @@ export async function forwardWebSocket(req, client, head, config, authenticatedL
             const headers = official
                 ? buildOfficialPassthroughWebSocketHeaders(req.headers, target.host)
                 : buildProviderWebSocketHeaders(req.headers, { providerId: provider.provider_id, authTransport: provider.auth_transport, credential: credential }, target.host);
+            if (provider?.provider_id === 'codex-lb')
+                admitCodexLbTurnState(headers, route.session_pin?.thread_id ?? null, credential.fingerprint);
             upstream.write([`${req.method || 'GET'} ${target.pathname}${target.search} HTTP/1.1`, ...serializeHeaders(headers), '', ''].join('\r\n'));
             if (head.length)
                 upstream.write(head);

package/dist/core/codex-lb/desktop-bridge-migration/historical-config.js

@@ -1,5 +1,5 @@
 import path from 'node:path';
-import { DESKTOP_BRIDGE_MANAGED_BASE_URL_MARKER, DESKTOP_BRIDGE_MANAGED_MARKER, DESKTOP_BRIDGE_MANAGED_MODEL_CATALOG_MARKER } from '../../../cli/install-helpers-codex-lb-config.js';
+import { DESKTOP_BRIDGE_MANAGED_BASE_URL_MARKER, DESKTOP_BRIDGE_MANAGED_MARKER } from '../../../cli/install-helpers-codex-lb-config.js';
 import { escapeRegExp } from '../../text/regex.js';
 import { CANONICAL_OPENROUTER_ENDPOINT, HISTORICAL_DESKTOP_BRIDGE_MARKER, HISTORICAL_DESKTOP_COMPAT_MARKER, HISTORICAL_MODEL_CATALOG_MARKER, HISTORICAL_OAUTH_SELECTION_MARKER, HISTORICAL_OPENAI_ROUTING_MARKER, HISTORICAL_PROVIDER_MODE_MARKER, HISTORICAL_PROVIDER_SELECTION_MARKER, hasTomlTable, hasTopLevelMarker, isHistoricalProviderMode, secretFreeProviderEndpoint, tomlTableBoolean, tomlTableContainsCustomHeader, tomlTableString, topLevelTomlString } from './historical-toml.js';
 export function inspectHistoricalDesktopBridgeIntent(configText) {
@@ -122,11 +122,7 @@ export function inspectHistoricalDesktopBridgeIntent(configText) {
 }
 export function prepareHistoricalConfigForDesktopBridgeWriter(text, state) {
     const source = String(text || '');
-    if ([
-        DESKTOP_BRIDGE_MANAGED_MARKER,
-        DESKTOP_BRIDGE_MANAGED_BASE_URL_MARKER,
-        DESKTOP_BRIDGE_MANAGED_MODEL_CATALOG_MARKER
-    ].every((marker) => hasTopLevelMarker(source, marker)))
+    if ([DESKTOP_BRIDGE_MANAGED_MARKER, DESKTOP_BRIDGE_MANAGED_BASE_URL_MARKER].every((marker) => hasTopLevelMarker(source, marker)))
         return source;
     const historicalMarkers = historicalManagedMarkers();
     const hasHistoricalMarker = historicalMarkers.some((marker) => hasTopLevelMarker(source, marker));

package/dist/core/codex-lb/desktop-bridge-migration.js

@@ -55,7 +55,8 @@ async function migrateDesktopBridgeConfigUnlocked(input) {
         const migrationInputConfig = prepareHistoricalConfigForDesktopBridgeWriter(currentConfig, historicalState);
         nextConfig = upsertDesktopBridgeManagedConfig(migrationInputConfig, {
             bridgeBaseUrl: input.bridgeBaseUrl,
-            combinedCatalogPath
+            combinedCatalogPath,
+            bindModelCatalog: input.bindModelCatalog !== false
         });
         validateMetadataUpdates(input.metadataUpdates || [], { home, configPath, authPath });
     }
@@ -74,6 +75,17 @@ async function migrateDesktopBridgeConfigUnlocked(input) {
             error: message
         };
     }
+    if (input.configWrite === 'forbid' && nextConfig !== currentConfig) {
+        return {
+            ...baseResult,
+            ok: false,
+            status: 'blocked',
+            managed_runtime: null,
+            receipt_path: null,
+            auth_semantic_identity_preserved: true,
+            blockers: ['desktop_bridge_config_write_deferred']
+        };
+    }
     const metadataUpdates = normalizedMetadataUpdates(input.metadataUpdates || []);
     const metadataAlreadyCurrent = await Promise.all(metadataUpdates.map(async (update) => {
         const currentSha = await fileSha256OrMissing(update.path);
@@ -82,7 +94,7 @@ async function migrateDesktopBridgeConfigUnlocked(input) {
     const hasUnifiedMarkers = [
         DESKTOP_BRIDGE_MANAGED_MARKER,
         DESKTOP_BRIDGE_MANAGED_BASE_URL_MARKER,
-        DESKTOP_BRIDGE_MANAGED_MODEL_CATALOG_MARKER
+        ...(input.bindModelCatalog === false ? [] : [DESKTOP_BRIDGE_MANAGED_MODEL_CATALOG_MARKER])
     ].every((marker) => hasTopLevelMarker(currentConfig, marker));
     if (nextConfig === currentConfig && hasUnifiedMarkers && metadataAlreadyCurrent.every(Boolean)) {
         const authAfter = await captureCodexAuthSnapshot({ home, authPath });

package/dist/core/codex-lb/desktop-controller-v3/catalog.js

@@ -1,4 +1,6 @@
 import { readText, writeJsonAtomic } from '../../fsx.js';
+import { codexReadsBridgeModels, hasUserOwnedModelCatalog, repairManagedCodexLbClientSelection } from '../../../cli/install-helpers-codex-lb-config.js';
+import { safeWriteCodexConfigToml } from '../../codex-runtime/codex-desktop-config-policy.js';
 import { readTopLevelTomlString } from '../../codex-app/codex-model-catalog.js';
 import { codexRestartBlockers, maybeRestartRunningCodexApp } from '../../codex-app/codex-app-restart-policy.js';
 import { BRIDGE_MODEL_SELECTION_SCHEMA, MAX_SELECTED_OPENROUTER_MODELS, bridgeAvailableModelsPath, pruneSelection, readBridgeModelSelectionState, writeBridgeModelSelection } from '../combined-catalog/model-selection.js';
@@ -16,6 +18,7 @@ import { sha256Stable } from '../route-index.js';
 import { bridgeBaseUrl, commandResult, controllerEnv, controllerPaths, nowIso, providerCode, providerRegistrySnapshot, resolveRawCredentials, resolveValidatedCredentials, safeCode, serializedSettings, stringArray, timeoutMs, unique } from './shared.js';
 import { desktopBridgeStatusV3 } from './status.js';
 import { openRouterOnlyExposure, readControllerOpenRouterOnlyState, withoutCodexLbCatalog } from './openrouter-only-catalog.js';
+import { MODEL_REFRESH_RECOVERY_COMMAND, alignCodexModelSource, bridgeServesModels, listedModelSlugs, modelListDiff, modelRefreshLine, readModelRefreshState, refreshedRecently, writeModelRefreshState } from './model-refresh.js';
 export async function syncCatalog(options) {
     const result = await syncCatalogInternal(options);
     const status = await desktopBridgeStatusV3(options);
@@ -24,9 +27,21 @@ export async function syncCatalog(options) {
         : {};
     return commandResult('catalog.sync', result.ok === true, status, { catalog_sync: result }, result.ok === true ? [] : stringArray(activation.blockers), options);
 }
+async function repairCodexLbClientSelection(configPath) {
+    const current = await readText(configPath, '');
+    const next = repairManagedCodexLbClientSelection(current);
+    if (next === current)
+        return null;
+    const write = await safeWriteCodexConfigToml(configPath, current, next, 'codex-lb-client-provider-repair', { verifyUnchangedBeforeWrite: true });
+    return write.ok ? null : `codex_lb_client_provider_repair_refused:${write.status}`;
+}
 export async function syncCatalogInternal(options, behavior = {}) {
     const paths = controllerPaths(options);
-    const historicalIntent = inspectHistoricalDesktopBridgeIntent(await readText(paths.configPath, ''));
+    const repair = behavior.configWrites === false ? null : await repairCodexLbClientSelection(paths.configPath);
+    if (repair)
+        return blockedSync(inspectHistoricalDesktopBridgeIntent(''), [repair]);
+    const configText = await readText(paths.configPath, '');
+    const historicalIntent = inspectHistoricalDesktopBridgeIntent(configText);
     if (historicalIntent.blockers.length > 0)
         return blockedSync(historicalIntent, historicalIntent.blockers);
     const rawCredentials = await resolveRawCredentials(options, paths);
@@ -55,6 +70,10 @@ export async function syncCatalogInternal(options, behavior = {}) {
         ? openRouterOnlyExposure(selection, openRouterOnly, await readText(paths.configPath, ''))
         : selection;
     const build = buildCombinedBridgeCatalog(catalogRegistry(registry), { catalogs, created_at: nowIso(options), selection: exposure });
+    const lost = providersLostToFailedFetch(await readActiveCombinedBridgeCatalog(paths.catalogPath, paths.routeIndexPath), catalogs, catalogRegistry(registry));
+    if (lost.length > 0) {
+        return { ...blockedSync(historicalIntent, lost.map((providerId) => `${providerCode(providerId)}_catalog_refresh_failed`)), build, active_generation_preserved: true };
+    }
     if (!selectionState.stored)
         await writeBridgeModelSelection(paths.home, selection).catch(() => undefined);
     await writeJsonAtomic(bridgeAvailableModelsPath(paths.home), {
@@ -126,6 +145,8 @@ export async function syncCatalogInternal(options, behavior = {}) {
         receiptDir: paths.receiptDir,
         bridgeBaseUrl: managedBridgeBaseUrl,
         combinedCatalogPath: staging.catalog_path,
+        bindModelCatalog: !codexReadsBridgeModels(configText) && !hasUserOwnedModelCatalog(configText),
+        configWrite: behavior.configWrites === false ? 'forbid' : 'allow',
         newCatalogGeneration: build.catalog.generation,
         metadataUpdates: [
             {
@@ -303,6 +324,20 @@ function emptyProviderCatalog(providerId, state, checkedAt, blockers) {
         warnings: []
     };
 }
+function providersLostToFailedFetch(active, catalogs, registry) {
+    if (!active.ok)
+        return [];
+    return ['codex-lb', 'openrouter'].filter((providerId) => {
+        const blockers = catalogs[providerId].blockers || [];
+        return registry.profiles[providerId].enabled
+            && catalogs[providerId].state === 'failed'
+            && !blockers.some(refusesCredential)
+            && active.catalog.models.some((model) => model.provider_id === providerId);
+    });
+}
+function refusesCredential(blocker) {
+    return /unauthorized|credential_missing|key_missing|invalid_key|_http_40[13]\b/.test(blocker);
+}
 function validationFailureState(blockers) {
     return blockers.some((blocker) => /(?:401|403|auth|rejected|invalid_key|unauthorized)/i.test(blocker))
         ? 'rejected' : 'unavailable';
@@ -349,12 +384,14 @@ export async function selectExposedModels(publicIds, options) {
         updated_at: nowIso(options),
         openrouter: { mode: 'selected', public_ids: requested }
     });
-    const sync = await syncCatalogInternal(options);
+    const sync = await syncAsRefresh(options, 'models.select');
     const status = await desktopBridgeStatusV3(options);
     const activation = sync.activation && typeof sync.activation === 'object'
         ? sync.activation
         : {};
-    const changed = before.selection.openrouter.public_ids.join('\0') !== requested.join('\0');
+    const refresh = sync.model_refresh;
+    const changed = before.selection.openrouter.public_ids.join('\0') !== requested.join('\0')
+        && (refresh.codex_model_source !== 'bridge_models' || refresh.restart_codex_required);
     const restart = sync.ok === true
         ? await maybeRestartRunningCodexApp({
             env: controllerEnv(options),
@@ -374,3 +411,88 @@ function seedSelectionFromConfiguredModel(selection, configText) {
         return selection;
     return { ...selection, openrouter: { mode: 'selected', public_ids: [configured] } };
 }
+export async function refreshModelCatalog(options, input) {
+    const paths = controllerPaths(options);
+    const refreshedAt = nowIso(options);
+    const base = {
+        schema: 'sks.bridge-model-refresh.v1',
+        reason: input.reason,
+        refreshed_at: refreshedAt,
+        added: [],
+        removed: [],
+        restart_codex_required: false
+    };
+    try {
+        const registryGeneration = (await resolveBridgeProviderRegistry({
+            home: paths.home,
+            credentials: await resolveRawCredentials(options, paths)
+        })).generation;
+        const recent = input.force ? null : await readModelRefreshState(paths.home);
+        if (recent && refreshedRecently(recent, registryGeneration, Date.parse(refreshedAt))) {
+            return {
+                ...base, ok: true, skipped: true, generation: recent.generation, total: recent.total, codex_model_source: null,
+                line: `Model list refreshed recently: ${recent.total} models generation ${recent.generation.slice(0, 8)}`,
+                warnings: ['model_refresh_skipped_recent'], blockers: [], sync: null
+            };
+        }
+        const before = await readActiveCombinedBridgeCatalog(paths.catalogPath, paths.routeIndexPath);
+        const sync = await syncCatalogInternal(options, { ...(input.behavior || {}), configWrites: input.allowConfigWrites });
+        if (sync.ok !== true)
+            return refreshFailed(base, stringArray(sync.activation?.blockers), sync);
+        const build = sync.build;
+        const activation = sync.activation;
+        const diff = modelListDiff(listedModelSlugs(before.ok ? before.catalog : null), listedModelSlugs(build.catalog));
+        const source = await alignCodexModelSource({
+            home: paths.home,
+            configPath: paths.configPath,
+            authPath: paths.authPath,
+            catalog: build.catalog,
+            catalogPath: typeof activation.catalog_path === 'string' ? activation.catalog_path : null,
+            allowConfigWrites: input.allowConfigWrites,
+            selfCheck: options.modelsSelfCheckImpl || bridgeServesModels
+        });
+        const restart = source.changed || (source.source === 'model_catalog_json' && diff.added.length + diff.removed.length > 0);
+        const total = listedModelSlugs(build.catalog).length;
+        await writeModelRefreshState(paths.home, {
+            refreshed_at: refreshedAt,
+            provider_registry_generation: registryGeneration,
+            generation: build.catalog.generation,
+            total
+        }).catch(() => undefined);
+        return {
+            ...base, ok: true, skipped: false, generation: build.catalog.generation, total, added: diff.added, removed: diff.removed,
+            codex_model_source: source.source, restart_codex_required: restart,
+            line: modelRefreshLine({ total, added: diff.added.length, removed: diff.removed.length, generation: build.catalog.generation, restartCodex: restart }),
+            warnings: source.warnings, blockers: [], sync
+        };
+    }
+    catch (error) {
+        return refreshFailed(base, [safeCode(error, 'model_refresh_failed')], null);
+    }
+}
+function refreshFailed(base, blockers, sync) {
+    return {
+        ...base, ok: false, skipped: false, generation: null, total: 0, codex_model_source: null,
+        line: `Model list refresh failed; the previous list stays active. Run \`${MODEL_REFRESH_RECOVERY_COMMAND}\` to retry.`,
+        warnings: [`model_refresh_failed: run \`${MODEL_REFRESH_RECOVERY_COMMAND}\``],
+        blockers: unique(blockers.length > 0 ? blockers : ['model_refresh_failed']),
+        sync
+    };
+}
+export async function refreshModels(request, options) {
+    const refresh = await refreshModelCatalog(options, {
+        reason: request.reason || 'cli',
+        force: request.force !== false,
+        allowConfigWrites: request.allow_config_writes !== false
+    });
+    const { sync, ...model_refresh } = refresh;
+    const status = await desktopBridgeStatusV3(options);
+    return commandResult('models.refresh', refresh.ok, status, { model_refresh, catalog_sync: sync }, refresh.blockers, options);
+}
+export async function syncAsRefresh(options, reason, behavior = {}) {
+    const { sync, ...model_refresh } = await refreshModelCatalog(options, { reason, force: true, allowConfigWrites: true, behavior });
+    return {
+        ...(sync ?? blockedSync(null, model_refresh.blockers)),
+        model_refresh
+    };
+}