sneakoscope 10.7.0 → 10.7.2

package/dist/core/codex-lb/desktop-controller-v3/model-refresh.js

@@ -0,0 +1,140 @@
+import http from 'node:http';
+import path from 'node:path';
+import { readText, writeJsonAtomic } from '../../fsx.js';
+import { safeWriteCodexConfigToml } from '../../codex-runtime/codex-desktop-config-policy.js';
+import { readTopLevelTomlString } from '../../codex-app/codex-model-catalog.js';
+import { codexReadsBridgeModels, hasUserOwnedModelCatalog, setDesktopBridgeManagedModelCatalog } from '../../../cli/install-helpers-codex-lb-config.js';
+import { captureCodexAuthSnapshot } from '../desktop-auth-invariant.js';
+import { desktopBridgeModelsEtag } from '../desktop-bridge/models-endpoint.js';
+export const MODEL_REFRESH_STATE_SCHEMA = 'sks.bridge-model-refresh-state.v1';
+export const MODEL_REFRESH_DEBOUNCE_MS = 60_000;
+export const MODEL_REFRESH_RECOVERY_COMMAND = 'sks bridge models refresh';
+export function modelRefreshStatePath(home) {
+    return path.join(path.resolve(home), '.codex', 'sks', 'sks-bridge-model-refresh.json');
+}
+export async function readModelRefreshState(home) {
+    try {
+        const parsed = JSON.parse(await readText(modelRefreshStatePath(home), ''));
+        return parsed?.schema === MODEL_REFRESH_STATE_SCHEMA && typeof parsed.refreshed_at === 'string'
+            && typeof parsed.provider_registry_generation === 'string' && typeof parsed.generation === 'string'
+            && Number.isSafeInteger(parsed.total)
+            ? parsed
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+export async function writeModelRefreshState(home, state) {
+    await writeJsonAtomic(modelRefreshStatePath(home), { schema: MODEL_REFRESH_STATE_SCHEMA, ...state }, { mode: 0o600 });
+}
+export function refreshedRecently(state, registryGeneration, nowMs) {
+    if (!state || state.provider_registry_generation !== registryGeneration)
+        return false;
+    const age = nowMs - Date.parse(state.refreshed_at);
+    return Number.isFinite(age) && age >= 0 && age < MODEL_REFRESH_DEBOUNCE_MS;
+}
+export function listedModelSlugs(catalog) {
+    if (!catalog)
+        return [];
+    return [...new Set(catalog.models
+            .filter((model) => !/^hid(?:e|den)$/i.test(String(model.visibility || 'list')))
+            .map((model) => String(model.slug || ''))
+            .filter(Boolean))].sort();
+}
+export function modelListDiff(before, after) {
+    const was = new Set(before);
+    const is = new Set(after);
+    return { added: after.filter((slug) => !was.has(slug)), removed: before.filter((slug) => !is.has(slug)) };
+}
+export function modelRefreshLine(input) {
+    const line = `Model list refreshed: ${input.total} models (+${input.added} −${input.removed}) generation ${input.generation.slice(0, 8)}`;
+    return input.restartCodex ? `${line}. Restart Codex to see the new model list.` : line;
+}
+export async function bridgeServesModels(baseUrl, catalog, options = {}) {
+    const expected = desktopBridgeModelsEtag(catalog.generation);
+    let failure = 'bridge_models_self_check_unreachable';
+    for (let attempt = 0; attempt < (options.attempts ?? 3); attempt += 1) {
+        if (attempt > 0)
+            await new Promise((resolve) => setTimeout(resolve, 500));
+        failure = await new Promise((resolve) => {
+            let url;
+            try {
+                url = new URL(`${baseUrl.replace(/\/+$/, '')}/models`);
+            }
+            catch {
+                resolve('bridge_models_self_check_url_invalid');
+                return;
+            }
+            if (url.protocol !== 'http:' || !['127.0.0.1', '[::1]', 'localhost'].includes(url.hostname)) {
+                resolve('bridge_models_self_check_not_loopback');
+                return;
+            }
+            const request = http.get(url, { timeout: options.timeoutMs ?? 3_000 }, (response) => {
+                const chunks = [];
+                response.on('data', (chunk) => chunks.push(chunk));
+                response.once('end', () => {
+                    if (response.statusCode !== 200) {
+                        resolve(`bridge_models_self_check_status_${response.statusCode}`);
+                        return;
+                    }
+                    if (response.headers.etag !== expected) {
+                        resolve('bridge_models_self_check_generation_mismatch');
+                        return;
+                    }
+                    try {
+                        const models = JSON.parse(Buffer.concat(chunks).toString('utf8')).models;
+                        resolve(Array.isArray(models) && models.length === catalog.models.length ? null : 'bridge_models_self_check_rows_mismatch');
+                    }
+                    catch {
+                        resolve('bridge_models_self_check_body_invalid');
+                    }
+                });
+                response.once('error', () => resolve('bridge_models_self_check_unreachable'));
+            });
+            request.once('timeout', () => request.destroy());
+            request.once('error', () => resolve('bridge_models_self_check_unreachable'));
+        });
+        if (failure === null)
+            return null;
+    }
+    return failure;
+}
+export async function alignCodexModelSource(input) {
+    const current = await readText(input.configPath, '');
+    if (hasUserOwnedModelCatalog(current)) {
+        return { source: 'user_model_catalog_json', changed: false, warnings: ['codex_model_list_pinned_by_user_model_catalog_json'] };
+    }
+    const baseUrl = readTopLevelTomlString(current, 'openai_base_url');
+    if (!baseUrl || (!codexReadsBridgeModels(current) && !readTopLevelTomlString(current, 'model_catalog_json'))) {
+        return { source: 'not_managed', changed: false, warnings: [] };
+    }
+    const auth = await captureCodexAuthSnapshot({ home: input.home, authPath: input.authPath }).catch(() => null);
+    const warnings = [];
+    let wantBridge = auth?.mode === 'chatgpt_oauth';
+    if (wantBridge) {
+        const failure = await input.selfCheck(baseUrl, input.catalog);
+        if (failure) {
+            warnings.push(failure);
+            wantBridge = false;
+        }
+    }
+    if (!wantBridge && !input.catalogPath) {
+        return { source: codexReadsBridgeModels(current) ? 'bridge_models' : 'model_catalog_json', changed: false, warnings: [...warnings, 'codex_model_catalog_path_unavailable'] };
+    }
+    const next = setDesktopBridgeManagedModelCatalog(current, wantBridge ? null : input.catalogPath);
+    const source = wantBridge ? 'bridge_models' : 'model_catalog_json';
+    if (next === current)
+        return { source, changed: false, warnings };
+    if (!input.allowConfigWrites) {
+        return {
+            source: codexReadsBridgeModels(current) ? 'bridge_models' : 'model_catalog_json',
+            changed: false,
+            warnings: [...warnings, `codex_model_source_change_deferred:${source}`]
+        };
+    }
+    const write = await safeWriteCodexConfigToml(input.configPath, current, next, 'desktop-bridge-model-source', { verifyUnchangedBeforeWrite: true });
+    if (!write.ok)
+        return { source: codexReadsBridgeModels(current) ? 'bridge_models' : 'model_catalog_json', changed: false, warnings: [...warnings, `codex_model_source_write_refused:${write.status}`] };
+    return { source, changed: true, warnings };
+}

package/dist/core/codex-lb/desktop-controller-v3/openrouter-only-commands.js

@@ -9,7 +9,7 @@ import { readActiveCombinedBridgeCatalog } from '../combined-catalog.js';
 import { MAX_SELECTED_OPENROUTER_MODELS, bridgeAvailableModelsPath, readBridgeModelSelectionState, writeBridgeModelSelection } from '../combined-catalog/model-selection.js';
 import { ensureUserReadOnlyListRole } from '../../subagents/read-only-list-role.js';
 import { canonicalizeBridgeModelId } from '../route-index.js';
-import { syncCatalogInternal } from './catalog.js';
+import { syncAsRefresh } from './catalog.js';
 import { hasOpenRouterRoute, openRouterOnlyStoreLocation } from './openrouter-only-catalog.js';
 import { applyOpenRouterOnlyMainModel, openRouterOnlyMainModelTarget, restoreOpenRouterOnlyMainModel } from './openrouter-only-main-model.js';
 import { openRouterOnlyProviderBlocker, openRouterOnlyStatusFromCore } from './openrouter-only-status.js';
@@ -116,10 +116,10 @@ async function enableOpenRouterOnly(noRestart, options) {
     if (entries.length === 0) {
         return finish('openrouter-only.set', false, ['openrouter_only_no_openrouter_models'], {}, options);
     }
-    const sync = await syncCatalogInternal({
+    const sync = await syncAsRefresh({
         ...options,
         settings: { ...(options.settings || {}), auth_priority_enabled: false }
-    }, {
+    }, 'openrouter-only.set', {
         openRouterOnly: { ...before, enabled: true, subagent_models: entries },
         onActivated: async () => {
             await requireRoutableEntry(core.paths, { ...before, enabled: true, subagent_models: entries });
@@ -204,7 +204,7 @@ export async function turnOffOpenRouterOnly(options, behavior = {}) {
         return { ok: true, changed: false, catalog_sync: null, main_model: null, blockers: [] };
     }
     const off = { ...before, enabled: false };
-    const sync = (commit) => syncCatalogInternal(options, {
+    const sync = (commit) => syncAsRefresh(options, 'openrouter-only.off', {
         ...(behavior.restartService === undefined ? {} : { restartService: behavior.restartService }),
         openRouterOnly: off,
         ...(commit ? { onActivated: () => writeOpenRouterOnlyState({ enabled: false }, location) } : {})
@@ -319,7 +319,7 @@ export async function setSubagentModels(raw, noRestart, options, expectedProfile
         }, options);
     }
     const exposedBefore = await exposedModelIds(paths);
-    const sync = await syncCatalogInternal(options, {
+    const sync = await syncAsRefresh(options, 'subagent-models.set', {
         openRouterOnly: { ...before, subagent_models: entries },
         onActivated: async () => {
             if (entries.length > 0)

package/dist/core/codex-lb/desktop-controller-v3/provider-commands.js

@@ -1,6 +1,3 @@
-import { bindCodexClientProvider } from '../../../cli/install-helpers-codex-lb-config.js';
-import { safeWriteCodexConfigToml } from '../../codex-runtime/codex-desktop-config-policy.js';
-import { readText } from '../../fsx.js';
 import { testOpenRouterConnection } from '../../providers/openrouter/openrouter-account.js';
 import { openRouterSecretPaths } from '../../providers/openrouter/openrouter-secret-store.js';
 import { codexLbEnvPath, codexLbMetadataPath, readCodexLbModelCatalog } from '../codex-lb-env.js';
@@ -8,6 +5,14 @@ import { configureProviderCredential, recordProviderCredentialValidation, remove
 import { configureBridgeProviderProfile, resolveBridgeProviderRegistry, setBridgeProviderEnabled } from '../provider-registry.js';
 import { commandResult, activeProviderIds, controllerEnv, controllerPaths, nowIso, persistRuntimeSettings, providerCode, quiesceRunningBridge, resolveRawCredentials, stringArray, timeoutMs } from './shared.js';
 import { desktopBridgeStatusV3, loadCore } from './status.js';
+import { refreshModelCatalog } from './catalog.js';
+async function refreshAfterProviderChange(reason, options) {
+    const core = await loadCore(options);
+    if (!core.activeCatalog.ok || !core.policy)
+        return null;
+    const { sync: _sync, ...summary } = await refreshModelCatalog(options, { reason, force: true, allowConfigWrites: true });
+    return summary;
+}
 export async function configureProvider(request, options) {
     const paths = controllerPaths(options);
     const restartDeferred = await quiesceRunningBridge(await loadCore(options), options);
@@ -37,12 +42,14 @@ export async function configureProvider(request, options) {
     if (core.activeCatalog.ok && core.policy) {
         await persistRuntimeSettings({ ...core, registry }, options, { restartService: false });
     }
+    const modelRefresh = restartDeferred ? null : await refreshAfterProviderChange('provider.configure', options);
     const status = await desktopBridgeStatusV3(options);
     const blockers = restartDeferred ? ['desktop_bridge_restart_deferred_until_provider_validation'] : [];
     return commandResult('provider.configure', true, status, {
         configuration: configured,
         restart_deferred: restartDeferred,
         recovery_action: restartDeferred ? `bridge provider validate ${request.provider_id}` : null,
+        model_refresh: modelRefresh,
     }, blockers, options);
 }
 export async function validateProvider(providerId, options) {
@@ -85,8 +92,9 @@ export async function validateProvider(providerId, options) {
             });
         }
     }
+    const modelRefresh = ok ? await refreshAfterProviderChange('provider.validate', options) : null;
     const status = await desktopBridgeStatusV3(options);
-    return commandResult('provider.validate', true, status, { provider_id: providerId, validated: ok, validation: publicValidationResult(result) }, ok ? [] : blockers, options);
+    return commandResult('provider.validate', true, status, { provider_id: providerId, validated: ok, validation: publicValidationResult(result), model_refresh: modelRefresh }, ok ? [] : blockers, options);
 }
 export async function setProviderState(providerId, enabled, operation, options) {
     const paths = controllerPaths(options);
@@ -111,14 +119,9 @@ export async function setProviderState(providerId, enabled, operation, options)
             });
         }
     }
-    if (providerId === 'codex-lb') {
-        const current = await readText(paths.configPath, '');
-        const next = bindCodexClientProvider(current, enabled ? 'codex-lb' : 'openai');
-        if (next !== current)
-            await safeWriteCodexConfigToml(paths.configPath, current, next, 'codex-lb-client-provider');
-    }
+    const modelRefresh = await refreshAfterProviderChange(operation, options);
     const status = await desktopBridgeStatusV3(options);
-    return commandResult(operation, true, status, { provider_id: providerId, enabled }, [], options);
+    return commandResult(operation, true, status, { provider_id: providerId, enabled, model_refresh: modelRefresh }, [], options);
 }
 export async function removeCredential(providerId, options) {
     const paths = controllerPaths(options);

package/dist/core/codex-lb/desktop-controller-v3/status.js

@@ -1,4 +1,4 @@
-import { DESKTOP_BRIDGE_MANAGED_BASE_URL_MARKER, DESKTOP_BRIDGE_MANAGED_MARKER, DESKTOP_BRIDGE_MANAGED_MODEL_CATALOG_MARKER } from '../../../cli/install-helpers-codex-lb-config.js';
+import { DESKTOP_BRIDGE_MANAGED_BASE_URL_MARKER, DESKTOP_BRIDGE_MANAGED_MARKER } from '../../../cli/install-helpers-codex-lb-config.js';
 import { readActiveCombinedBridgeCatalog } from '../combined-catalog.js';
 import { desktopBridgeServiceStatus, desktopBridgeServicePaths, readDesktopBridgeServiceSettings } from '../desktop-service.js';
 import { captureCodexAuthSnapshot } from '../desktop-auth-invariant.js';
@@ -276,8 +276,7 @@ function isManagedConfig(config) {
     const top = String(config || '').split(/\n\s*\[/)[0] || '';
     return [
         DESKTOP_BRIDGE_MANAGED_MARKER,
-        DESKTOP_BRIDGE_MANAGED_BASE_URL_MARKER,
-        DESKTOP_BRIDGE_MANAGED_MODEL_CATALOG_MARKER
+        DESKTOP_BRIDGE_MANAGED_BASE_URL_MARKER
     ].every((marker) => top.split(/\r?\n/).some((line) => line.trim() === marker))
         && /^\s*model_provider\s*=\s*"openai"\s*(?:#.*)?$/m.test(top);
 }

package/dist/core/codex-lb/desktop-controller-v3.js

@@ -1,4 +1,4 @@
-import { listSelectableModels, selectExposedModels, syncCatalog } from './desktop-controller-v3/catalog.js';
+import { listSelectableModels, refreshModels, selectExposedModels, syncCatalog } from './desktop-controller-v3/catalog.js';
 import { explainRoute, ensureDesktopBridge, repairDesktopBridge, rollbackDesktopBridge, setDefaultProvider, setOfficialModelsMode, setAuthPriority, unmanageDesktopBridge } from './desktop-controller-v3/lifecycle-commands.js';
 import { configureProvider, removeCredential, setProviderState, validateProvider } from './desktop-controller-v3/provider-commands.js';
 import { listSubagentModels, openRouterOnlyStatusCommand, setOpenRouterOnly, setSubagentModels } from './desktop-controller-v3/openrouter-only-commands.js';
@@ -55,6 +55,8 @@ export async function executeDesktopBridgeCommandV3(request, options = {}) {
                 return listSelectableModels(options);
             if (request.operation === 'models.select')
                 return selectExposedModels(request.public_ids, options);
+            if (request.operation === 'models.refresh')
+                return refreshModels(request, options);
             if (request.operation === 'catalog.sync')
                 return syncCatalog(options);
             if (request.operation === 'catalog.status') {

package/dist/core/codex-lb/desktop-service.js

@@ -13,6 +13,8 @@ import { canonicalizeBridgeModelId, normalizeBridgeUpstreamModelId, sha256Stable
 import { captureCodexAuthSnapshot } from './desktop-auth-invariant.js';
 import { applyOfficialModelPassthrough, bridgeRoutePolicyPath, writeBridgeRoutingPolicy } from './provider-route-policy.js';
 import { desktopBridgeRuntimeVersion, desktopBridgeRuntimeVersionStale } from './desktop-bridge/state.js';
+import { REQUEST_COMPAT_INCLUDE_VALUE, REQUEST_COMPAT_MAX_EXTRA_INCLUDE } from './desktop-bridge/provider-request-compat.js';
+import { bridgeRouteIndexPath, combinedBridgeCatalogPath, readActiveCombinedBridgeCatalog } from './combined-catalog.js';
 import { PACKAGE_VERSION } from '../version.js';
 import { canonicalChildModelId, readOpenRouterOnlyStateSync } from '../subagents/child-model-allowlist.js';
 import { BRIDGE_OFFICIAL_ROUTE_ID } from './bridge-contracts.js';
@@ -133,7 +135,7 @@ export async function resolveDesktopBridgeActivationSettings(options = {}) {
     const merged = { ...(persisted || {}), ...(options.settings || {}) };
     const host = merged.listen_host || DEFAULT_DESKTOP_BRIDGE_HOST;
     const port = merged.listen_port ?? await (options.selectAvailablePort || selectAvailableDesktopBridgePort)(host);
-    return defaultDesktopBridgeServiceSettings({ ...merged, ...(options.providerRegistry ? { provider_registry: options.providerRegistry } : {}), ...(options.routePolicy ? { route_policy: options.routePolicy } : {}), ...(options.providerSessionPins ? { provider_session_pins: [...options.providerSessionPins] } : {}), client_capability_sha256: sha256(clientCapability), listen_host: host, listen_port: port });
+    return defaultDesktopBridgeServiceSettings({ ...merged, ...(options.providerRegistry ? { provider_registry: withPersistedRequestCompat(options.providerRegistry, persisted?.provider_registry) } : {}), ...(options.routePolicy ? { route_policy: options.routePolicy } : {}), ...(options.providerSessionPins ? { provider_session_pins: [...options.providerSessionPins] } : {}), client_capability_sha256: sha256(clientCapability), listen_host: host, listen_port: port });
 }
 export async function readDesktopBridgeServiceSettings(file) {
     let stat;
@@ -297,7 +299,8 @@ function normalizeEndpointForBinding(value) {
 export async function resolveDesktopBridgeRuntimeConfig(options = {}) {
     const home = options.home || options.env?.HOME || process.env.HOME || os.homedir();
     const paths = overridePaths(desktopBridgeServicePaths(home), options);
-    let settings = defaultDesktopBridgeServiceSettings({ ...((await readDesktopBridgeServiceSettings(paths.settings_path)) || {}), ...(options.settings || {}), ...(options.providerRegistry ? { provider_registry: options.providerRegistry } : {}), ...(options.routePolicy ? { route_policy: options.routePolicy } : {}), ...(options.providerSessionPins ? { provider_session_pins: [...options.providerSessionPins] } : {}) });
+    const persisted = await readDesktopBridgeServiceSettings(paths.settings_path);
+    let settings = defaultDesktopBridgeServiceSettings({ ...(persisted || {}), ...(options.settings || {}), ...(options.providerRegistry ? { provider_registry: withPersistedRequestCompat(options.providerRegistry, persisted?.provider_registry) } : {}), ...(options.routePolicy ? { route_policy: options.routePolicy } : {}), ...(options.providerSessionPins ? { provider_session_pins: [...options.providerSessionPins] } : {}) });
     const clientCapability = options.clientCapability
         ? validateClientCapability(options.clientCapability)
         : await readDesktopBridgeClientCapability(paths.client_capability_path);
@@ -313,23 +316,17 @@ export async function resolveDesktopBridgeRuntimeConfig(options = {}) {
     if (!officialOnly && !providerRouteIds.some((id) => credentials.registry.providers[id].credential_state === 'ready'))
         throw new Error('desktop_bridge_provider_credentials_unavailable');
     const persistProviderSessionPins = options.persistProviderSessionPins
-        || ((pins) => persistDesktopBridgeSessionPins(paths.settings_path, settings, pins));
+        || ((pins) => persistDesktopBridgeSessionPins(paths.settings_path, pins));
     const openRouterOnly = resolveDesktopBridgeOpenRouterOnly({ home, ...(options.env ? { env: options.env } : {}) });
     const config = { providerRegistry: settings.provider_registry, routePolicy: settings.route_policy, providerSessionPins: settings.provider_session_pins, ...(options.resolveRequestRoute ? { resolveRequestRoute: options.resolveRequestRoute } : {}), persistProviderSessionPins, resolveProviderCredential: credentials.resolver, clientCapabilitySha256: settings.client_capability_sha256, listenHost: settings.listen_host, listenPort: settings.listen_port, allowedPathPrefixes: DESKTOP_BRIDGE_ALLOWED_PATH_PREFIXES, allowedOrigins: settings.allowed_origins, connectTimeoutMs: settings.connect_timeout_ms, idleTimeoutMs: settings.idle_timeout_ms, officialPassthrough: settings.official_passthrough.enabled ? { baseUrl: settings.official_passthrough.base_url } : null, ...(openRouterOnly ? { openRouterOnly } : {}) };
     const primary = credentials.sources['codex-lb'] || credentials.sources.openrouter;
     return { config, settings, loaded_env: credentials.loaded, credential_source: primary || null, credential_sources: credentials.sources, paths };
 }
-async function persistDesktopBridgeSessionPins(file, expected, pins) {
+async function persistDesktopBridgeSessionPins(file, pins) {
     await withFileLock(settingsLockOptions(file), async () => {
         const current = await readDesktopBridgeServiceSettings(file);
-        if (!current
-            || current.listen_host !== expected.listen_host
-            || current.listen_port !== expected.listen_port
-            || current.provider_registry.generation !== expected.provider_registry.generation
-            || current.route_policy.policy_generation !== expected.route_policy.policy_generation
-            || current.route_policy.catalog_generation !== expected.route_policy.catalog_generation) {
-            throw new DesktopBridgeError('session_pin_route_unavailable');
-        }
+        if (!current)
+            return;
         await writeDesktopBridgeServiceSettingsUnlocked(file, {
             ...current,
             provider_session_pins: [...pins],
@@ -557,12 +554,20 @@ async function autoApplyOfficialModelsAtServe(runtime, home, options) {
     runtime.config.routePolicy = converged;
     process.stdout.write(`${JSON.stringify({ schema: 'sks.desktop-bridge-log.v2', event: 'sks.desktop_bridge.official_models_auto_applied', at: new Date().toISOString(), sks_version: PACKAGE_VERSION, mode, policy_generation: converged.policy_generation, secret_fields_redacted: true })}\n`);
 }
+async function activeModelsCatalog(home) {
+    const codexHome = path.join(path.resolve(home), '.codex');
+    const active = await readActiveCombinedBridgeCatalog(combinedBridgeCatalogPath(codexHome), bridgeRouteIndexPath(codexHome)).catch(() => null);
+    if (!active?.ok || active.catalog.models.length === 0)
+        return null;
+    return { generation: active.catalog.generation, models: active.catalog.models };
+}
 export async function serveDesktopBridge(options = {}) {
     let handle = null;
     try {
         const runtime = await resolveDesktopBridgeRuntimeConfig(options);
         const serveHome = options.home || options.env?.HOME || process.env.HOME || os.homedir();
         await autoApplyOfficialModelsAtServe(runtime, serveHome, options);
+        runtime.config.modelsCatalog = await activeModelsCatalog(serveHome);
         const supervised = desktopBridgeIsSupervised();
         const skewMarkerPath = path.join(path.dirname(runtime.paths.state_path), 'desktop-bridge-skew-restart.json');
         const prepared = await preflightDesktopBridge(runtime.config);
@@ -701,8 +706,9 @@ function validateProviderSessionPins(value) {
         const pin = value;
         const allowed = new Set([
             'thread_id', 'provider_id', 'public_model', 'upstream_model',
-            'catalog_generation', 'route_policy_generation', 'created_at'
+            'catalog_generation', 'route_policy_generation', 'created_at', 'handoff_from'
         ]);
+        const target = (value) => value === 'codex-lb' || value === 'openrouter' || value === BRIDGE_OFFICIAL_ROUTE_ID;
         const threadId = typeof pin.thread_id === 'string' ? pin.thread_id.trim() : '';
         if (Object.keys(pin).some((key) => !allowed.has(key))
             || !threadId
@@ -710,7 +716,8 @@ function validateProviderSessionPins(value) {
             || threadId.length > 256
             || !/^[A-Za-z0-9._:/-]+$/.test(threadId)
             || seen.has(threadId)
-            || (pin.provider_id !== 'codex-lb' && pin.provider_id !== 'openrouter')
+            || !target(pin.provider_id)
+            || (pin.handoff_from !== undefined && (!target(pin.handoff_from) || pin.handoff_from === pin.provider_id))
             || canonicalizeBridgeModelId(pin.public_model) !== pin.public_model
             || normalizeBridgeUpstreamModelId(pin.upstream_model) !== pin.upstream_model
             || typeof pin.catalog_generation !== 'string'
@@ -729,7 +736,8 @@ function validateProviderSessionPins(value) {
             upstream_model: pin.upstream_model,
             catalog_generation: pin.catalog_generation,
             route_policy_generation: pin.route_policy_generation,
-            created_at: pin.created_at
+            created_at: pin.created_at,
+            ...(pin.handoff_from === undefined ? {} : { handoff_from: pin.handoff_from })
         };
     });
 }
@@ -781,11 +789,37 @@ function normalizeProviderRegistrySnapshot(value) {
     const providers = Object.fromEntries(['codex-lb', 'openrouter'].map((providerId) => {
         const provider = registry.providers[providerId];
         const sourceCatalogGeneration = provider.source_catalog_generation ?? provider.catalog_generation ?? null;
-        const { catalog_generation: _legacyCatalogGeneration, ...rest } = provider;
-        return [providerId, { ...rest, source_catalog_generation: sourceCatalogGeneration }];
+        const { catalog_generation: _legacyCatalogGeneration, request_compat: requestCompat, ...rest } = provider;
+        const normalized = { ...rest, source_catalog_generation: sourceCatalogGeneration };
+        if (requestCompat !== undefined)
+            normalized.request_compat = validateRequestCompat(requestCompat);
+        return [providerId, normalized];
     }));
     return { ...registry, providers };
 }
+function validateRequestCompat(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('desktop_bridge_settings_request_compat_invalid');
+    const row = value;
+    if (Object.keys(row).some((key) => key !== 'extra_include'))
+        throw new Error('desktop_bridge_settings_request_compat_invalid');
+    const values = row.extra_include ?? [];
+    if (!Array.isArray(values) || values.length > REQUEST_COMPAT_MAX_EXTRA_INCLUDE
+        || values.some((entry) => typeof entry !== 'string' || !REQUEST_COMPAT_INCLUDE_VALUE.test(entry))) {
+        throw new Error('desktop_bridge_settings_request_compat_invalid');
+    }
+    return { extra_include: [...new Set(values)] };
+}
+function withPersistedRequestCompat(registry, persisted) {
+    let providers = null;
+    for (const id of ['codex-lb', 'openrouter']) {
+        const compat = persisted?.providers?.[id]?.request_compat;
+        if (!compat || registry.providers[id].request_compat)
+            continue;
+        providers = { ...(providers ?? registry.providers), [id]: { ...registry.providers[id], request_compat: compat } };
+    }
+    return providers ? { ...registry, generation: sha256Stable(providers), providers } : registry;
+}
 function overridePaths(base, options) { return { settings_path: options.settingsPath || base.settings_path, state_path: options.statePath || base.state_path, client_capability_path: options.clientCapabilityPath || base.client_capability_path, launch_agent_path: options.launchAgentPath || base.launch_agent_path, stdout_log_path: options.stdoutLogPath || base.stdout_log_path, stderr_log_path: options.stderrLogPath || base.stderr_log_path }; }
 function launchDomain(uid = typeof process.getuid === 'function' ? process.getuid() : 0) { return `gui/${uid}`; }
 function launchService(uid) { return `${launchDomain(uid)}/${DESKTOP_BRIDGE_LAUNCHD_LABEL}`; }

package/dist/core/codex-lb/model-refresh-after.js

@@ -0,0 +1,16 @@
+import os from 'node:os';
+import path from 'node:path';
+import { exists } from '../fsx.js';
+import { desktopBridgeServicePaths } from './desktop-service.js';
+export async function refreshModelListAfter(reason) {
+    if (process.platform !== 'darwin')
+        return null;
+    if (process.env.NODE_TEST_CONTEXT !== undefined || process.env.SKS_TEST_ISOLATION === '1' || process.env.SKS_RELEASE_UPGRADE_SMOKE === '1')
+        return null;
+    const home = path.resolve(process.env.HOME || os.homedir());
+    if (!(await exists(desktopBridgeServicePaths(home).settings_path)))
+        return null;
+    const { executeDesktopBridgeCommandV3 } = await import('./desktop-controller-v3.js');
+    const command = await executeDesktopBridgeCommandV3({ operation: 'models.refresh', reason, force: false, allow_config_writes: true }, { home, env: process.env }).catch(() => null);
+    return command?.result?.model_refresh ?? null;
+}

package/dist/core/codex-lb/request-route-resolver.js

@@ -23,7 +23,7 @@ export function resolveBridgeRequestRoute(request, policy, options) {
         return blocked(base, 'catalog_route_index_stale');
     }
     const threadPin = request.thread_id ? findSessionPin(options.session_pins, request.thread_id) : null;
-    const pin = threadPin && canonicalizeBridgeModelId(threadPin.public_model) === model ? threadPin : null;
+    const pin = threadPin && threadPin.provider_id !== 'openai' && canonicalizeBridgeModelId(threadPin.public_model) === model ? threadPin : null;
     const pinAffinity = pin ? sessionPinAffinity(pin, policy, options.route_index, options.registry) : null;
     if (pinAffinity === 'unprovable')
         return blocked(base, 'session_pin_route_unavailable');

package/dist/core/codex-runtime/codex-desktop-config-policy.js

@@ -197,7 +197,6 @@ export async function safeWriteCodexConfigToml(configPath, current, next, tag =
         configPath,
         before: String(current || ''),
         cause: tag,
-        removeTopLevelModeLocks: true,
         ...(opts.preserveFastUiKeys === undefined ? {} : { preserveFastUiKeys: opts.preserveFastUiKeys }),
         ...(opts.verifyUnchangedBeforeWrite === undefined ? {} : { verifyUnchangedBeforeWrite: opts.verifyUnchangedBeforeWrite }),
         ...(opts.expectedBeforeExists === undefined ? {} : { expectedBeforeExists: opts.expectedBeforeExists }),

package/dist/core/commands/basic-cli.js

@@ -330,6 +330,9 @@ export async function setupCommand(args = []) {
             ...[...(codexHooks?.activation?.blockers || []), ...(codexHooks?.project?.blockers || [])].map((blocker) => `codex_hooks:${blocker}`)
         ]
     };
+    const modelRefresh = result.ok ? await (await import('../codex-lb/model-refresh-after.js')).refreshModelListAfter('setup') : null;
+    if (modelRefresh)
+        result.model_refresh = modelRefresh;
     if (!result.ok)
         process.exitCode = 1;
     if (flag(args, '--json')) {
@@ -337,6 +340,8 @@ export async function setupCommand(args = []) {
         return result;
     }
     console.log(`${result.ok ? 'Setup complete' : 'Setup blocked'}: ${root}`);
+    if (typeof modelRefresh?.line === 'string')
+        console.log(modelRefresh.line);
     console.log(`Install scope: ${installScope}`);
     console.log(`Codex CLI: ${cliTools.codex.status}${cliTools.codex.version ? ` ${cliTools.codex.version}` : ''}`);
     console.log(`SKS Codex hooks: ${codexHooks?.active ? 'active for every Codex project' : installScope === 'project' ? 'this project only' : 'not active (run: sks doctor --fix)'}`);

package/dist/core/commands/menubar-command.js

@@ -31,7 +31,9 @@ export async function menubarCommand(subcommand = 'status', args = []) {
         return result;
     }
     if (action === 'install') {
-        const result = await installSksMenuBar({ root, ...(home ? { home } : {}), apply: true, launch: !flag(args, '--no-launch'), quiet: flag(args, '--json') });
+        const installed = await installSksMenuBar({ root, ...(home ? { home } : {}), apply: true, launch: !flag(args, '--no-launch'), quiet: flag(args, '--json') });
+        const modelRefresh = await (await import('../codex-lb/model-refresh-after.js')).refreshModelListAfter('menubar-install');
+        const result = modelRefresh ? { ...installed, model_refresh: modelRefresh } : installed;
         if (flag(args, '--json')) {
             printJson(result);
             if (!result.ok)
@@ -46,6 +48,8 @@ export async function menubarCommand(subcommand = 'status', args = []) {
         console.log(`SKS menu bar install: ${result.status}`);
         for (const actionLine of result.actions)
             console.log(`- ${actionLine}`);
+        if (typeof modelRefresh?.line === 'string')
+            console.log(modelRefresh.line);
         for (const warning of result.warnings)
             console.log(`warning: ${warning}`);
         for (const blocker of result.blockers)

package/dist/core/doctor/desktop-bridge-catalog-repair.js

@@ -101,10 +101,8 @@ export async function repairDoctorDesktopBridgeCatalog(input, deps = {}) {
             fix: input.fix
         });
         const status = await statusImpl({ home: bridgeHome, env: process.env });
-        const blockers = (status?.readiness?.blockers || []).map(String);
-        const stale = blockers.filter((blocker) => blocker.endsWith('_catalog_stale'));
         const reverify = { fix: input.fix, bridgeHome, restarted: restarted.restarted };
-        if (!status?.management?.managed || stale.length === 0) {
+        if (!status?.management?.managed) {
             return reverifyTransportIfDegraded({
                 ...base,
                 ok: restarted.blockers.length === 0,
@@ -114,28 +112,33 @@ export async function repairDoctorDesktopBridgeCatalog(input, deps = {}) {
             }, reverify, statusImpl, executeImpl);
         }
         const attempts = [];
-        let syncedAndVerified = false;
+        let refresh = null;
+        let stale = [];
         for (let attempt = 1; attempt <= CATALOG_REPAIR_MAX_ATTEMPTS; attempt += 1) {
-            const sync = await executeImpl({ operation: 'catalog.sync' }, { home: bridgeHome, env: process.env });
-            const commandOk = sync?.ok === true && sync?.execution?.ok === true;
+            const command = await executeImpl({
+                operation: 'models.refresh',
+                reason: input.reason || (input.fix ? 'doctor-fix' : 'doctor'),
+                force: false,
+                allow_config_writes: input.fix
+            }, { home: bridgeHome, env: process.env });
+            refresh = command?.result?.model_refresh && typeof command.result.model_refresh === 'object' ? command.result.model_refresh : null;
             const after = await statusImpl({ home: bridgeHome, env: process.env });
-            const stillStale = (after?.readiness?.blockers || [])
-                .map(String).filter((blocker) => blocker.endsWith('_catalog_stale'));
-            if (commandOk && stillStale.length === 0) {
-                syncedAndVerified = true;
+            stale = (after?.readiness?.blockers || []).map(String).filter((blocker) => blocker.endsWith('_catalog_stale'));
+            if (refresh?.ok === true && stale.length === 0)
                 break;
-            }
-            attempts.push(`catalog_sync_attempt_${attempt}:${commandOk ? `still_stale:${stillStale.join(',')}` : (sync?.execution?.blockers || ['failed']).map(String).join(',')}`);
+            attempts.push(`model_refresh_attempt_${attempt}:${refresh?.ok === true ? `still_stale:${stale.join(',')}` : (refresh?.blockers || command?.execution?.blockers || ['failed']).map(String).join(',')}`);
         }
+        const refreshed = refresh?.ok === true;
         return reverifyTransportIfDegraded({
             ...base,
-            ok: syncedAndVerified && restarted.blockers.length === 0,
-            repaired: syncedAndVerified || restarted.restarted,
-            warnings: [...restarted.warnings, ...(syncedAndVerified ? attempts : [])],
+            ok: stale.length === 0 && restarted.blockers.length === 0,
+            repaired: (refreshed && refresh?.skipped !== true) || restarted.restarted,
+            warnings: [...restarted.warnings, ...(refresh?.warnings || []).map(String), ...(stale.length === 0 ? attempts : [])],
             blockers: [
-                ...(syncedAndVerified ? [] : ['desktop_bridge_catalog_still_stale_after_repair', ...attempts]),
+                ...(stale.length === 0 ? [] : ['desktop_bridge_catalog_still_stale_after_repair', ...attempts]),
                 ...restarted.blockers
-            ]
+            ],
+            model_refresh: refresh
         }, reverify, statusImpl, executeImpl);
     }
     catch (error) {

package/dist/core/hooks-runtime/jev-spawn-routing.js

@@ -75,7 +75,7 @@ async function openRouterOnlySpawnRouting(root, parentState, input, allowlist) {
     const requestedEffort = String(input.reasoning_effort || '') || null;
     const agent = String(input.agent_type || input.agentType || '').trim() || null;
     const task = spawnTask(input, { items: true });
-    const choice = task && !parentState?.jev_execution_plan
+    const choice = task
         ? await chooseChildModel({ root, task, role: agent, requestedModel: requested, requestedEffort, state, profile: childModelListProfile(allowlist) })
             .catch(() => fallbackChildModel(state, requested, 'consult_failed', requestedEffort))
         : fallbackChildModel(state, requested, 'empty_task', requestedEffort);
@@ -144,10 +144,6 @@ async function tierSpawnRewrite(root, state, input) {
             return next;
         }
     }
-    if (boundPlan) {
-        const fallback = roleTierFallback(agent);
-        return { ...input, model: fallback.model, reasoning_effort: fallback.effort, ...forkTurns };
-    }
     const decision = await consultJevTurnModel({ root, prompt: task, roleId: 'spawn' }).catch(() => null);
     if (!decision?.called)
         return null;

package/dist/core/hooks-runtime/parent-orchestration-gate.js

@@ -328,14 +328,12 @@ export async function evaluateParentOrchestrationGate(input) {
         const message = ledger.escapes === 0 ? escapeMessage(missionId, intent, next) : null;
         return { action: 'escape', reason: 'max_blocks_reached', message, jev: null };
     }
-    const jev = state?.jev_execution_plan
-        ? { called: false, choice: null, reason: 'turn_binding_keeps_delegation_baseline' }
-        : await consultJevToolDelegation({
-            root,
-            missionGoal: missionGoal(state),
-            toolName: intent.toolName,
-            targets: intent.targets
-        }).catch(() => ({ called: false, choice: null, reason: 'consult_failed' }));
+    const jev = await consultJevToolDelegation({
+        root,
+        missionGoal: missionGoal(state),
+        toolName: intent.toolName,
+        targets: intent.targets
+    }).catch(() => ({ called: false, choice: null, reason: 'consult_failed' }));
     const base = {
         ...ledger,
         last_tool: intent.toolName,