sneakoscope 9.1.0 → 9.2.0

package/README.md

@@ -22,7 +22,7 @@ Proof-first orchestration for Codex CLI, ChatGPT Desktop, AI coding agents, mult
 Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
 <!-- END SKS SEARCH VISIBILITY MARKETING -->
 
-This README documents package **SKS 9.1.0** — its own identity, read from `package.json` and subject to release-gate verification, not advice about what to install.
+This README documents package **SKS 9.2.0** — its own identity, read from `package.json` and subject to release-gate verification, not advice about what to install.
 
 Use the official latest stable SKS and Codex CLI releases. The Codex compatibility SSOT is always the **current latest stable** host; capability probes measure what that host can actually do. Product docs do not crown a fixed `0.x.y` string as SSOT (release pins and schema directories are measured artifacts for the current package, not a permanent product version claim). Menu Bar / Center induce updates to the latest stable build. Run `sks update-check` for what is installed and read the capability report for what is supported. Install SSOT is npm `sneakoscope@latest`; PATH `sks` and Menu Bar stamped generation must match that version or gates fail. It resolves managed SKS skills from the authoritative global install, preserves a runnable Naruto child slot when `max_threads=2`, and keeps Menu Bar repair transactional so stamped generations remain verifiable. Naruto uses stable opt-in multi-agent V2 when the host exposes it (Codex official multi-agent wrap-only; SKS does not reimplement a parallel runtime). Local code search is mode-separated (`sks search files|text|structure|symbol|context`); `context` is answered by the compiled TriWiki Context Graph (`context-graph.json` is exhaustive authority; `context-pack.json` and managed `AGENTS.md` are bounded projections) — see [docs/architecture/context-graph.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/docs/architecture/context-graph.md) and [docs/PRODUCT-CONTRACT.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/docs/PRODUCT-CONTRACT.md). See [CHANGELOG.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/CHANGELOG.md).
 

package/crates/sks-core/Cargo.lock

@@ -259,7 +259,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "9.1.0"
+version = "9.2.0"
 dependencies = [
  "globset",
  "grep-matcher",

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "9.1.0"
+version = "9.2.0"
 edition = "2021"
 
 [dependencies]

package/dist/commands/bridge.js

@@ -27,6 +27,7 @@ export function usage(command = 'bridge') {
         `       sks ${command} models select --set <public-id,...> [--json]`,
         `       sks ${command} route list [--json]`,
         `       sks ${command} route set-default <codex-lb|openrouter> [--json]`,
+        `       sks ${command} route official-models <passthrough|gateway|auto> [--json]`,
         `       sks ${command} route explain <model> [--json]`,
         `       sks ${command} unmanage --confirm [--json]`,
         `       sks ${command} rollback <receipt-id> --confirm [--json]`,
@@ -236,6 +237,16 @@ async function parseInvocation(args, io) {
                 label: `Default bridge provider set to ${providerId}`
             };
         }
+        if (action === 'official-models' && target !== undefined && extra === undefined) {
+            allowOnly(parsed, ['--json'], []);
+            if (target !== 'passthrough' && target !== 'gateway' && target !== 'auto')
+                throw new BridgeCliError('bridge_route_official_models_mode_invalid');
+            return {
+                ...base,
+                request: { operation: 'route.official-models', mode: target },
+                label: `Official models routing set to ${target}`
+            };
+        }
         if (action === 'explain' && target !== undefined && extra === undefined) {
             allowOnly(parsed, ['--json'], []);
             return {

package/dist/config/skills-manifest.json

@@ -1,6 +1,6 @@
 {
   "schema": "sks.skills-manifest.v1",
-  "package_version": "9.1.0",
+  "package_version": "9.2.0",
   "skills": [
     {
       "canonical_name": "sks",

package/dist/core/codex-app.js

@@ -894,7 +894,7 @@ function providerModelUiStatusFromDesktopBridge(status) {
         || status.routing.policy?.default_provider_id
         || status.routing.session_pin?.provider_id
         || null;
-    const selectedProfile = selectedProvider ? status.providers[selectedProvider] : null;
+    const selectedProfile = selectedProvider && selectedProvider !== 'openai' ? status.providers[selectedProvider] : null;
     const selectedProviderBlockers = uniqueStrings([
         ...status.readiness.blockers,
         ...status.routing.blockers,

package/dist/core/codex-control/codex-sdk-env-policy.js

@@ -160,16 +160,51 @@ export async function prepareNativeCodexAuthBridge(env, opts = {}) {
                 applyCleanupProof(bridgeProof, result);
                 return result;
             }
-            await assertSourceAuthUnchanged(sourceAuthCandidate, sourceAuthIdentity, sourceAuthFingerprint);
-            const hostAuth = { ...tempAuth, ...originalApiKeyFields };
-            const hostAuthText = `${JSON.stringify(hostAuth, null, 2)}\n`;
-            await writeAuthFileAtomic(sourceAuthCandidate, hostAuthText, async () => {
+            try {
                 await assertSourceAuthUnchanged(sourceAuthCandidate, sourceAuthIdentity, sourceAuthFingerprint);
-            });
-            await removeOwnedTempRoot();
-            const result = { ok: true, status: 'cleaned', outcome: 'refreshed_persisted', cleanup_required: false, blockers: [] };
-            applyCleanupProof(bridgeProof, result);
-            return result;
+                const hostAuth = { ...tempAuth, ...originalApiKeyFields };
+                const hostAuthText = `${JSON.stringify(hostAuth, null, 2)}\n`;
+                await writeAuthFileAtomic(sourceAuthCandidate, hostAuthText, async () => {
+                    await assertSourceAuthUnchanged(sourceAuthCandidate, sourceAuthIdentity, sourceAuthFingerprint);
+                });
+                await removeOwnedTempRoot();
+                const result = { ok: true, status: 'cleaned', outcome: 'refreshed_persisted', cleanup_required: false, blockers: [] };
+                applyCleanupProof(bridgeProof, result);
+                return result;
+            }
+            catch (error) {
+                if (String(error?.message || error) !== 'native_codex_auth_source_conflict')
+                    throw error;
+                const currentText = await readValidatedAuthFile(sourceAuthCandidate, {
+                    requirePrivateMode: true,
+                    requireSingleLink: true,
+                    errorPrefix: 'native_codex_auth_source'
+                });
+                const currentAuth = parseStrictChatGptAuth(currentText);
+                const sameAccount = String(currentAuth.tokens?.account_id || '') === String(tempAuth.tokens?.account_id || '');
+                const hostRefreshedAt = Date.parse(String(currentAuth.last_refresh || ''));
+                const oursRefreshedAt = Date.parse(String(tempAuth.last_refresh || ''));
+                const hostWins = !sameAccount
+                    || !Number.isFinite(oursRefreshedAt)
+                    || (Number.isFinite(hostRefreshedAt) && hostRefreshedAt >= oursRefreshedAt);
+                if (hostWins) {
+                    await removeOwnedTempRoot();
+                    const result = { ok: true, status: 'cleaned', outcome: 'host_newer_kept', cleanup_required: false, blockers: [] };
+                    applyCleanupProof(bridgeProof, result);
+                    return result;
+                }
+                const currentStat = await fsp.lstat(sourceAuthCandidate);
+                const retryIdentity = { dev: currentStat.dev, ino: currentStat.ino };
+                const retryFingerprint = fingerprintText(currentText);
+                const mergedAuth = { ...currentAuth, tokens: tempAuth.tokens, last_refresh: tempAuth.last_refresh };
+                await writeAuthFileAtomic(sourceAuthCandidate, `${JSON.stringify(mergedAuth, null, 2)}\n`, async () => {
+                    await assertSourceAuthUnchanged(sourceAuthCandidate, retryIdentity, retryFingerprint);
+                });
+                await removeOwnedTempRoot();
+                const result = { ok: true, status: 'cleaned', outcome: 'refreshed_persisted_after_conflict', cleanup_required: false, blockers: [] };
+                applyCleanupProof(bridgeProof, result);
+                return result;
+            }
         }
         catch (error) {
             const reason = String(error?.message || error || 'native_codex_auth_cleanup_failed');

package/dist/core/codex-lb/bridge-contracts.js

@@ -1,2 +1,3 @@
 export const MANAGED_ROUTING_RUNTIME = 'desktop-bridge';
 export const BRIDGE_PROVIDER_IDS = ['codex-lb', 'openrouter'];
+export const BRIDGE_OFFICIAL_ROUTE_ID = 'openai';

package/dist/core/codex-lb/desktop-bridge/header-policy.js

@@ -54,6 +54,44 @@ export function buildProviderUpstreamHeaders(inbound, context, upstreamHost) {
     injectCredential(result, context.providerId, context.authTransport, context.credential);
     return result;
 }
+const OFFICIAL_PASSTHROUGH_STRIP = new Set([
+    'forwarded', 'proxy-authorization', 'x-api-key', 'x-codex-lb-api-key',
+    'x-forwarded-for', 'x-forwarded-host', 'x-forwarded-port', 'x-forwarded-proto', 'x-real-ip',
+    'host',
+]);
+export function buildOfficialPassthroughHeaders(inbound, upstreamHost) {
+    const result = {};
+    const dynamic = connectionTokens(inbound);
+    for (const [rawName, rawValue] of Object.entries(inbound)) {
+        if (rawValue === undefined)
+            continue;
+        const name = rawName.toLowerCase();
+        if (HOP_BY_HOP.has(name) || dynamic.has(name))
+            continue;
+        if (name.startsWith(INTERNAL_PREFIX))
+            continue;
+        if (OFFICIAL_PASSTHROUGH_STRIP.has(name))
+            continue;
+        result[name] = rawValue;
+    }
+    result.host = upstreamHost;
+    if (result['x-codex-lb-api-key'] !== undefined)
+        throw new DesktopBridgeError('bridge_provider_credential_invalid');
+    return result;
+}
+export function buildOfficialPassthroughWebSocketHeaders(inbound, upstreamHost) {
+    const result = buildOfficialPassthroughHeaders(inbound, upstreamHost);
+    for (const [rawName, rawValue] of Object.entries(inbound)) {
+        if (rawValue === undefined)
+            continue;
+        const name = rawName.toLowerCase();
+        if (WEBSOCKET_HEADER_ALLOWLIST.has(name))
+            result[name] = rawValue;
+    }
+    result.connection = 'Upgrade';
+    result.upgrade = 'websocket';
+    return result;
+}
 export function buildProviderWebSocketHeaders(inbound, context, upstreamHost) {
     const result = buildProviderUpstreamHeaders(inbound, context, upstreamHost);
     for (const [rawName, rawValue] of Object.entries(inbound)) {

package/dist/core/codex-lb/desktop-bridge/http-forward.js

@@ -2,7 +2,8 @@ import http, {} from 'node:http';
 import https from 'node:https';
 import zlib from 'node:zlib';
 import { pipeline } from 'node:stream/promises';
-import { buildProviderUpstreamHeaders, rewriteResponseHeaders } from './header-policy.js';
+import { BRIDGE_OFFICIAL_ROUTE_ID } from '../bridge-contracts.js';
+import { buildOfficialPassthroughHeaders, buildProviderUpstreamHeaders, rewriteResponseHeaders } from './header-policy.js';
 import { createDesktopBridgeRejectionLogger } from './rejection-log.js';
 import { resolveAndBindDesktopBridgeRouteContext, resolveCodexSessionIdentity, resolveDesktopBridgeTarget, safeBridgeErrorCode, singleBridgeHeader } from './security.js';
 import { desktopBridgeListenOrigin } from './state.js';
@@ -60,6 +61,8 @@ async function readBoundedBody(req, maximum) {
     return Buffer.concat(chunks);
 }
 async function resolveCredential(config, route) {
+    if (route.provider_id === BRIDGE_OFFICIAL_ROUTE_ID)
+        throw new DesktopBridgeError('bridge_provider_route_unavailable');
     const provider = config.providers[route.provider_id];
     if (!provider)
         throw new DesktopBridgeError('bridge_provider_route_unavailable');
@@ -107,7 +110,7 @@ export async function prepareDesktopBridgeRequest(req, config) {
         payload.model = route.upstream_model;
         body = Buffer.from(JSON.stringify(payload));
     }
-    const credential = await resolveCredential(config, route);
+    const credential = route.provider_id === BRIDGE_OFFICIAL_ROUTE_ID ? null : await resolveCredential(config, route);
     return { body, route, credential, contentEncodingStripped };
 }
 function connectTimeout(request, config) {
@@ -148,6 +151,34 @@ function safeUpstreamErrorId(value) {
     const text = String(value ?? '').trim();
     return /^[A-Za-z0-9_.:-]{1,64}$/.test(text) ? text : null;
 }
+const TRANSIENT_UPSTREAM_STATUSES = new Set([500, 502, 503, 524]);
+const TRANSIENT_UPSTREAM_IDENTIFIERS = new Set(['upstream_error', 'upstream_request_timeout']);
+export const TRANSIENT_UPSTREAM_REPLAY_LIMIT = 3;
+const TRANSIENT_UPSTREAM_REPLAY_BACKOFF_MS = [200, 400, 800];
+function isTransientUpstreamIdentifier(value) {
+    return Boolean(value && TRANSIENT_UPSTREAM_IDENTIFIERS.has(value));
+}
+function delay(ms) {
+    return new Promise((resolve) => {
+        const timer = setTimeout(resolve, ms);
+        timer.unref();
+    });
+}
+function isTransientUpstreamFailure(statusCode, upstreamType, upstreamCode) {
+    if (statusCode === 429)
+        return false;
+    if (statusCode === 404) {
+        return isTransientUpstreamIdentifier(upstreamType) || isTransientUpstreamIdentifier(upstreamCode);
+    }
+    return TRANSIENT_UPSTREAM_STATUSES.has(statusCode);
+}
+function redactedUpstreamClientMessage(statusCode, transient) {
+    if (statusCode === 429)
+        return 'rate_limited';
+    if (transient)
+        return 'temporary_upstream_failure';
+    return 'bridge_upstream_request_failed';
+}
 async function readRedactedUpstreamError(response) {
     let total = 0;
     const chunks = [];
@@ -169,19 +200,18 @@ async function readRedactedUpstreamError(response) {
     }
     catch {
     }
-    return {
-        upstreamCode,
-        upstreamType,
-        body: Buffer.from(JSON.stringify({
-            error: {
-                type: 'upstream_error',
-                code: 'bridge_upstream_request_failed',
-                message: 'Upstream request failed',
-                ...(upstreamType ? { upstream_type: upstreamType } : {}),
-                ...(upstreamCode ? { upstream_code: upstreamCode } : {})
-            }
-        }))
-    };
+    return { upstreamCode, upstreamType };
+}
+function buildRedactedUpstreamErrorBody(statusCode, upstreamCode, upstreamType, transient) {
+    return Buffer.from(JSON.stringify({
+        error: {
+            type: 'upstream_error',
+            code: 'bridge_upstream_request_failed',
+            message: redactedUpstreamClientMessage(statusCode, transient),
+            ...(upstreamType ? { upstream_type: upstreamType } : {}),
+            ...(upstreamCode ? { upstream_code: upstreamCode } : {}),
+        },
+    }));
 }
 const upstreamAgents = new Map();
 function upstreamAgent(secure, key, idleTimeoutMs) {
@@ -224,23 +254,32 @@ class StalePooledSocketFailure extends Error {
 export async function forwardHttp(req, res, config, prepared, authenticatedLocalBaseUrl = desktopBridgeListenOrigin(config)) {
     try {
         const request = prepared || await prepareDesktopBridgeRequest(req, config);
-        const provider = config.providers[request.route.provider_id];
-        if (!provider)
+        const official = request.route.provider_id === BRIDGE_OFFICIAL_ROUTE_ID;
+        const provider = official ? null : config.providers[request.route.provider_id];
+        if (!official && !provider)
             throw new DesktopBridgeError('bridge_provider_route_unavailable');
-        const target = resolveDesktopBridgeTarget(req.url, provider.remote);
-        const transport = provider.remote.secure ? https : http;
-        const headers = buildProviderUpstreamHeaders(req.headers, {
-            providerId: provider.provider_id, authTransport: provider.auth_transport, credential: request.credential,
-        }, target.host);
+        const remote = official ? config.officialRemote : provider?.remote;
+        if (!remote)
+            throw new DesktopBridgeError('bridge_official_passthrough_unavailable');
+        const upstreamBaseUrl = official ? remote.baseUrl : provider.base_url;
+        if (!official && !request.credential)
+            throw new DesktopBridgeError('bridge_provider_credential_invalid');
+        const target = resolveDesktopBridgeTarget(req.url, remote);
+        const transport = remote.secure ? https : http;
+        const headers = official
+            ? buildOfficialPassthroughHeaders(req.headers, target.host)
+            : buildProviderUpstreamHeaders(req.headers, {
+                providerId: provider.provider_id, authTransport: provider.auth_transport, credential: request.credential,
+            }, target.host);
         if (request.body)
             headers['content-length'] = String(request.body.length);
         else
             delete headers['content-length'];
         if (request.contentEncodingStripped)
             delete headers['content-encoding'];
-        const agent = upstreamAgent(provider.remote.secure, `${provider.remote.address}:${provider.remote.port}`, config.idleTimeoutMs);
+        const agent = upstreamAgent(remote.secure, `${remote.address}:${remote.port}`, config.idleTimeoutMs);
         const replayable = Buffer.isBuffer(request.body);
-        const attempt = (useFreshConnection) => new Promise((resolve, reject) => {
+        const attempt = (useFreshConnection, canReplay) => new Promise((resolve, reject) => {
             let responseStarted = false;
             let settled = false;
             const abort = () => { if (!res.writableEnded)
@@ -254,10 +293,10 @@ export async function forwardHttp(req, res, config, prepared, authenticatedLocal
                 error ? reject(error) : resolve();
             };
             const upstream = transport.request({
-                protocol: target.protocol, hostname: provider.remote.address, family: provider.remote.family,
-                port: provider.remote.port, method: req.method, path: `${target.pathname}${target.search}`, headers,
+                protocol: target.protocol, hostname: remote.address, family: remote.family,
+                port: remote.port, method: req.method, path: `${target.pathname}${target.search}`, headers,
                 agent: useFreshConnection ? false : agent,
-                ...(provider.remote.tlsServername ? { servername: provider.remote.tlsServername } : {}),
+                ...(remote.tlsServername ? { servername: remote.tlsServername } : {}),
             });
             connectTimeout(upstream, config);
             upstream.setTimeout(config.idleTimeoutMs, () => upstream.destroy(new DesktopBridgeError('bridge_upstream_idle_timeout')));
@@ -272,16 +311,48 @@ export async function forwardHttp(req, res, config, prepared, authenticatedLocal
             });
             upstream.once('response', (response) => {
                 const statusCode = response.statusCode || 502;
+                if (official) {
+                    if (statusCode >= 400 && TRANSIENT_UPSTREAM_STATUSES.has(statusCode) && replayable && canReplay) {
+                        response.resume();
+                        responseStarted = true;
+                        finish(new StalePooledSocketFailure(new DesktopBridgeError('bridge_upstream_transient_mislabel')));
+                        return;
+                    }
+                    if (statusCode >= 400) {
+                        logHttpRejection({
+                            code: `bridge_upstream_status_${statusCode}`,
+                            transport: 'http',
+                            ...(req.method === undefined ? {} : { method: req.method }),
+                            ...(req.url === undefined ? {} : { url: req.url }),
+                            status: statusCode,
+                            provider_id: BRIDGE_OFFICIAL_ROUTE_ID,
+                            public_model: request.route.public_model,
+                        });
+                    }
+                    responseStarted = true;
+                    try {
+                        res.writeHead(statusCode, rewriteResponseHeaders(response.headers, upstreamBaseUrl, authenticatedLocalBaseUrl));
+                    }
+                    catch (error) {
+                        response.destroy(error instanceof Error ? error : undefined);
+                        finish(error);
+                        return;
+                    }
+                    void pipeline(response, res).then(() => finish(), finish);
+                    return;
+                }
                 if (statusCode >= 400) {
-                    void readRedactedUpstreamError(response).then(({ body, upstreamCode, upstreamType }) => {
-                        const transientMislabel = statusCode === 404
-                            && (upstreamType === 'upstream_error' || upstreamCode === 'upstream_error');
-                        if (transientMislabel && replayable && !useFreshConnection) {
+                    void readRedactedUpstreamError(response).then(({ upstreamCode, upstreamType }) => {
+                        const transientMislabel = isTransientUpstreamFailure(statusCode, upstreamType, upstreamCode);
+                        if (transientMislabel && replayable && canReplay) {
                             responseStarted = true;
-                            finish(new StalePooledSocketFailure(new DesktopBridgeError('bridge_upstream_transient_mislabel')));
+                            finish(new StalePooledSocketFailure(new DesktopBridgeError(upstreamCode === 'upstream_request_timeout'
+                                ? 'bridge_upstream_request_timeout'
+                                : 'bridge_upstream_transient_mislabel')));
                             return;
                         }
                         const clientStatus = transientMislabel ? 503 : statusCode;
+                        const body = buildRedactedUpstreamErrorBody(statusCode, upstreamCode, upstreamType, transientMislabel);
                         logHttpRejection({
                             code: transientMislabel
                                 ? `bridge_upstream_status_${statusCode}_translated_503`
@@ -294,10 +365,12 @@ export async function forwardHttp(req, res, config, prepared, authenticatedLocal
                             public_model: request.route.public_model,
                         });
                         responseStarted = true;
-                        const responseHeaders = rewriteResponseHeaders(response.headers, provider.base_url, authenticatedLocalBaseUrl);
+                        const responseHeaders = rewriteResponseHeaders(response.headers, upstreamBaseUrl, authenticatedLocalBaseUrl);
                         responseHeaders['content-length'] = String(body.length);
                         delete responseHeaders['transfer-encoding'];
                         if (transientMislabel)
+                            responseHeaders['retry-after'] = String(responseHeaders['retry-after'] || '10');
+                        if (statusCode === 429 && !responseHeaders['retry-after'])
                             responseHeaders['retry-after'] = '10';
                         res.writeHead(clientStatus, responseHeaders);
                         res.end(body, () => finish());
@@ -306,7 +379,7 @@ export async function forwardHttp(req, res, config, prepared, authenticatedLocal
                 }
                 responseStarted = true;
                 try {
-                    res.writeHead(statusCode, rewriteResponseHeaders(response.headers, provider.base_url, authenticatedLocalBaseUrl));
+                    res.writeHead(statusCode, rewriteResponseHeaders(response.headers, upstreamBaseUrl, authenticatedLocalBaseUrl));
                 }
                 catch (error) {
                     response.destroy(error instanceof Error ? error : undefined);
@@ -321,21 +394,34 @@ export async function forwardHttp(req, res, config, prepared, authenticatedLocal
                 void pipeline(req, upstream).catch((error) => { if (!responseStarted)
                     finish(error); });
         });
-        try {
-            await attempt(false);
-        }
-        catch (error) {
-            if (!(error instanceof StalePooledSocketFailure))
-                throw error;
-            agent.destroy();
-            upstreamAgents.delete(`${provider.remote.secure ? 'https' : 'http'}:${provider.remote.address}:${provider.remote.port}`);
-            logHttpRejection({
-                code: `bridge_upstream_socket_stale_replayed:${underlyingErrorCode(error.reason) || 'unknown'}`,
-                transport: 'http',
-                ...(req.method === undefined ? {} : { method: req.method }),
-                ...(req.url === undefined ? {} : { url: req.url }),
-            });
-            await attempt(true);
+        let remainingReplays = replayable ? TRANSIENT_UPSTREAM_REPLAY_LIMIT : 0;
+        let useFreshConnection = false;
+        for (;;) {
+            try {
+                await attempt(useFreshConnection, remainingReplays > 0);
+                return;
+            }
+            catch (error) {
+                if (!(error instanceof StalePooledSocketFailure) || remainingReplays <= 0)
+                    throw error;
+                remainingReplays -= 1;
+                if (!useFreshConnection) {
+                    agent.destroy();
+                    upstreamAgents.delete(`${remote.secure ? 'https' : 'http'}:${remote.address}:${remote.port}`);
+                }
+                logHttpRejection({
+                    code: `bridge_upstream_socket_stale_replayed:${underlyingErrorCode(error.reason) || 'unknown'}`,
+                    transport: 'http',
+                    ...(req.method === undefined ? {} : { method: req.method }),
+                    ...(req.url === undefined ? {} : { url: req.url }),
+                });
+                useFreshConnection = true;
+                const backoffIndex = TRANSIENT_UPSTREAM_REPLAY_LIMIT - remainingReplays - 1;
+                const backoffMs = TRANSIENT_UPSTREAM_REPLAY_BACKOFF_MS[Math.max(0, backoffIndex)]
+                    ?? TRANSIENT_UPSTREAM_REPLAY_BACKOFF_MS[TRANSIENT_UPSTREAM_REPLAY_BACKOFF_MS.length - 1];
+                if (backoffMs)
+                    await delay(backoffMs);
+            }
         }
     }
     catch (error) {

package/dist/core/codex-lb/desktop-bridge/rejection-log.js

@@ -33,6 +33,7 @@ export function createDesktopBridgeRejectionLogger(options = {}) {
             write(`${JSON.stringify({
                 schema: DESKTOP_BRIDGE_LOG_SCHEMA,
                 sks_version: PACKAGE_VERSION,
+                at: new Date(now()).toISOString(),
                 secret_fields_redacted: true,
                 ...payload,
             })}\n`);

package/dist/core/codex-lb/desktop-bridge/security.js

@@ -1,5 +1,6 @@
 import dns from 'node:dns/promises';
 import net from 'node:net';
+import { BRIDGE_OFFICIAL_ROUTE_ID } from '../bridge-contracts.js';
 import { canonicalizeBridgeModelId, normalizeBridgeUpstreamModelId, } from '../route-index.js';
 import { DESKTOP_BRIDGE_CLIENT_PATH_PREFIX, DesktopBridgeError } from './types.js';
 const MIN_HIGH_PORT = 49_152;
@@ -150,6 +151,19 @@ function canonicalPublicModel(value) {
         throw new DesktopBridgeError('catalog_model_route_missing');
     return model;
 }
+export function desktopBridgeOfficialPassthroughEnabled(config) {
+    return Boolean(config.officialPassthrough?.baseUrl);
+}
+function officialRouteContext(publicModel, policy, upstreamModel) {
+    return {
+        provider_id: BRIDGE_OFFICIAL_ROUTE_ID,
+        public_model: publicModel,
+        upstream_model: upstreamModel || publicModel,
+        catalog_generation: policy.catalog_generation,
+        route_policy_generation: policy.policy_generation,
+        session_pin: null,
+    };
+}
 export function resolveBridgeRequestRoute(request, policy, pins) {
     const publicModel = canonicalPublicModel(request.public_model);
     const sessionId = request.session_id ? canonicalSessionId(request.session_id) : null;
@@ -179,6 +193,8 @@ export function resolveBridgeRequestRoute(request, policy, pins) {
     const route = policy.model_routes[publicModel];
     if (!route)
         throw new DesktopBridgeError('catalog_model_route_missing');
+    if (route.provider_id === BRIDGE_OFFICIAL_ROUTE_ID)
+        return officialRouteContext(publicModel, policy, route.upstream_model);
     const nextPin = sessionId ? {
         thread_id: sessionId,
         provider_id: route.provider_id,
@@ -199,8 +215,36 @@ export function resolveBridgeRequestRoute(request, policy, pins) {
 }
 export function assertDesktopBridgeRouteContext(request, config) {
     const resolver = config.resolveRequestRoute || resolveBridgeRequestRoute;
-    const route = resolver(request, config.routePolicy, config.providerSessionPins);
     const policy = config.routePolicy;
+    let route;
+    try {
+        route = resolver(request, policy, config.providerSessionPins);
+    }
+    catch (error) {
+        if (desktopBridgeOfficialPassthroughEnabled(config)
+            && error instanceof DesktopBridgeError
+            && (error.code === 'catalog_model_route_missing' || error.code === 'session_pin_route_unavailable')) {
+            const model = canonicalizeBridgeModelId(request.public_model) || '';
+            const live = model ? policy.model_routes[model] : undefined;
+            if (!live || live.provider_id === BRIDGE_OFFICIAL_ROUTE_ID) {
+                route = officialRouteContext(model, policy, live?.upstream_model);
+            }
+            else
+                throw error;
+        }
+        else
+            throw error;
+    }
+    if (route.provider_id === BRIDGE_OFFICIAL_ROUTE_ID) {
+        if (!desktopBridgeOfficialPassthroughEnabled(config))
+            throw new DesktopBridgeError('bridge_official_passthrough_unavailable');
+        if (route.catalog_generation !== policy.catalog_generation || route.route_policy_generation !== policy.policy_generation) {
+            throw new DesktopBridgeError('session_pin_route_unavailable');
+        }
+        if (route.session_pin)
+            throw new DesktopBridgeError('bridge_session_pin_invalid');
+        return route;
+    }
     const expected = policy.model_routes[route.public_model];
     if (!expected || expected.provider_id !== route.provider_id || expected.upstream_model !== route.upstream_model) {
         throw new DesktopBridgeError('catalog_model_route_missing');
@@ -399,9 +443,12 @@ function assertRegistryAndPolicy(config, registry) {
     if (policy.schema !== 'sks.bridge-routing-policy.v1' || policy.fallback !== 'none' || !policy.catalog_generation || !policy.policy_generation) {
         throw new DesktopBridgeError('bridge_route_policy_invalid');
     }
+    const officialConfigured = desktopBridgeOfficialPassthroughEnabled(config);
     for (const [model, route] of Object.entries(policy.model_routes)) {
+        const routeTargetAllowed = ids.includes(route.provider_id)
+            || (route.provider_id === BRIDGE_OFFICIAL_ROUTE_ID && officialConfigured);
         if (canonicalizeBridgeModelId(model) !== model
-            || !ids.includes(route.provider_id)
+            || !routeTargetAllowed
             || normalizeBridgeUpstreamModelId(route.upstream_model) !== route.upstream_model) {
             throw new DesktopBridgeError('bridge_route_policy_invalid');
         }
@@ -460,6 +507,8 @@ export function validateDesktopBridgeConfig(config) {
         throw new DesktopBridgeError('bridge_client_capability_invalid');
     if (typeof config.resolveProviderCredential !== 'function')
         throw new DesktopBridgeError('bridge_provider_credential_resolver_missing');
+    if (config.officialPassthrough)
+        validateRemoteUrl(config.officialPassthrough.baseUrl);
     assertRegistryAndPolicy(config, config.providerRegistry);
     if (!Object.values(config.providerRegistry.providers).some((provider) => provider.enabled)) {
         throw new DesktopBridgeError('bridge_provider_registry_no_enabled_provider');
@@ -475,7 +524,10 @@ export async function prepareDesktopBridgeConfig(config, lookup = defaultLookup)
         return [id, prepared];
     }));
     const providers = Object.fromEntries(entries);
-    return { ...config, providers };
+    const officialRemote = config.officialPassthrough
+        ? await resolveDesktopBridgeRemoteTarget(config.officialPassthrough.baseUrl, lookup)
+        : null;
+    return { ...config, providers, officialRemote };
 }
 export function validatePreparedDesktopBridgeConfig(config) {
     validateDesktopBridgeConfig(config);

package/dist/core/codex-lb/desktop-bridge/server.js

@@ -8,7 +8,7 @@ import { createDesktopBridgePublicState, desktopBridgeListenOrigin, desktopBridg
 import { DesktopBridgeError } from './types.js';
 import { PACKAGE_VERSION } from '../../version.js';
 import { DESKTOP_BRIDGE_CLIENT_PATH_PREFIX, DESKTOP_BRIDGE_DIAGNOSTIC_HEALTH_PATH, DESKTOP_BRIDGE_DIAGNOSTIC_PATH, DESKTOP_BRIDGE_DIAGNOSTIC_PROTOCOL } from './types.js';
-import { forwardWebSocket } from './websocket-forward.js';
+import { forwardWebSocket, safeEndUpgradeSocket } from './websocket-forward.js';
 function authenticateDesktopBridgeClient(req, input) {
     const raw = String(req.url || '/');
     if (/^[a-z][a-z0-9+.-]*:\/\//i.test(raw) || raw.startsWith('//') || /[\r\n\0]/.test(raw)) {
@@ -135,22 +135,14 @@ function writeUpgradeRejection(socket, error, req) {
         url: req?.url,
         status: rejectionStatus(safeBridgeErrorCode(error)),
     });
-    socket.on('error', () => undefined);
-    if (socket.destroyed || socket.writableEnded)
-        return;
     const code = safeBridgeErrorCode(error);
     const status = rejectionStatus(code);
-    try {
-        socket.end(`HTTP/1.1 ${status} ${rejectionStatusText(status)}\r\n`
-            + 'Content-Type: application/json\r\n'
-            + 'Cache-Control: no-store\r\n'
-            + 'Connection: close\r\n'
-            + '\r\n'
-            + JSON.stringify({ error: { type: 'sks_bridge_rejection', code, message: code } }));
-    }
-    catch {
-        socket.destroy();
-    }
+    safeEndUpgradeSocket(socket, `HTTP/1.1 ${status} ${rejectionStatusText(status)}\r\n`
+        + 'Content-Type: application/json\r\n'
+        + 'Cache-Control: no-store\r\n'
+        + 'Connection: close\r\n'
+        + '\r\n'
+        + JSON.stringify({ error: { type: 'sks_bridge_rejection', code, message: code } }));
 }
 function writeDiagnosticHealth(req, res, input) {
     if (req.method !== 'GET')

package/dist/core/codex-lb/desktop-bridge/types.js

@@ -12,6 +12,7 @@ export const DESKTOP_BRIDGE_ALLOWED_PATH_PREFIXES = [
     '/api/v1/',
     '/v1/',
 ];
+export const DESKTOP_BRIDGE_OFFICIAL_UPSTREAM_BASE_URL = 'https://chatgpt.com/backend-api/codex';
 export class DesktopBridgeError extends Error {
     code;
     constructor(code, options) {