sneakoscope 9.1.0 → 9.2.0

package/dist/core/codex-lb/desktop-bridge/websocket-forward.js

@@ -1,10 +1,11 @@
 import { createHash, randomBytes } from 'node:crypto';
 import net from 'node:net';
 import tls from 'node:tls';
-import { buildProviderWebSocketHeaders } from './header-policy.js';
+import { BRIDGE_OFFICIAL_ROUTE_ID } from '../bridge-contracts.js';
+import { buildOfficialPassthroughWebSocketHeaders, buildProviderWebSocketHeaders } from './header-policy.js';
 import { createDesktopBridgeRejectionLogger } from './rejection-log.js';
 import { rewriteLocationHeader } from './location-rewrite.js';
-import { resolveAndBindDesktopBridgeRouteContext, resolveCodexSessionIdentity, resolveDesktopBridgeTarget, safeBridgeErrorCode, singleBridgeHeader, canonicalSessionId } from './security.js';
+import { desktopBridgeOfficialPassthroughEnabled, resolveAndBindDesktopBridgeRouteContext, resolveCodexSessionIdentity, resolveDesktopBridgeTarget, safeBridgeErrorCode, singleBridgeHeader, canonicalSessionId } from './security.js';
 import { desktopBridgeListenOrigin } from './state.js';
 import { DESKTOP_BRIDGE_DIAGNOSTIC_PROTOCOL, DesktopBridgeError, } from './types.js';
 const MAX_HEAD = 64 * 1024;
@@ -82,7 +83,7 @@ export async function prepareDesktopBridgeWebSocketRequest(req, config) {
     const sessionIdentity = resolveCodexSessionIdentity(req.headers);
     const pinnedModel = websocketPinnedModel(sessionIdentity.thread_id, config);
     const publicModel = singleBridgeHeader(req.headers, 'x-sks-model') || pinnedModel || '';
-    if (!publicModel) {
+    if (!publicModel && !(desktopBridgeOfficialPassthroughEnabled(config) && config.officialRemote)) {
         throw new DesktopBridgeError('bridge_websocket_route_unresolvable');
     }
     const route = await resolveAndBindDesktopBridgeRouteContext({
@@ -91,6 +92,8 @@ export async function prepareDesktopBridgeWebSocketRequest(req, config) {
         pathname: new URL(req.url || '/', 'http://bridge.invalid').pathname,
         transport: 'websocket', headers: req.headers,
     }, config);
+    if (route.provider_id === BRIDGE_OFFICIAL_ROUTE_ID)
+        return { route, provider: null, credential: null };
     const provider = config.providers[route.provider_id];
     if (!provider)
         throw new DesktopBridgeError('bridge_provider_route_unavailable');
@@ -107,6 +110,17 @@ const PERMANENT_UPGRADE_REFUSALS = new Set([
     'catalog_model_route_missing',
     'bridge_provider_route_unavailable',
 ]);
+export function safeEndUpgradeSocket(socket, payload) {
+    socket.on('error', () => undefined);
+    if (socket.destroyed || socket.writableEnded)
+        return;
+    try {
+        socket.end(payload);
+    }
+    catch {
+        socket.destroy();
+    }
+}
 function writeUpgradeFailure(client, error, req) {
     const code = safeBridgeErrorCode(error) || 'bridge_websocket_upstream_unavailable';
     const permanent = PERMANENT_UPGRADE_REFUSALS.has(code);
@@ -119,9 +133,7 @@ function writeUpgradeFailure(client, error, req) {
         ...(req?.url === undefined ? {} : { url: req.url }),
         status,
     });
-    if (client.destroyed)
-        return;
-    client.end(`HTTP/1.1 ${status} ${reason}\r\nContent-Type: application/json\r\nCache-Control: no-store\r\nConnection: close\r\n\r\n`
+    safeEndUpgradeSocket(client, `HTTP/1.1 ${status} ${reason}\r\nContent-Type: application/json\r\nCache-Control: no-store\r\nConnection: close\r\n\r\n`
         + JSON.stringify({ error: { type: 'sks_bridge_error', code, retryable: !permanent } }));
 }
 export async function forwardWebSocket(req, client, head, config, authenticatedLocalBaseUrl = desktopBridgeListenOrigin(config)) {
@@ -133,11 +145,18 @@ export async function forwardWebSocket(req, client, head, config, authenticatedL
         writeUpgradeFailure(client, error, req);
         return;
     }
-    const { provider, credential } = prepared;
-    const target = resolveDesktopBridgeTarget(req.url, provider.remote);
-    const upstream = provider.remote.secure
-        ? tls.connect({ host: provider.remote.address, port: provider.remote.port, ...(provider.remote.tlsServername ? { servername: provider.remote.tlsServername } : {}) })
-        : net.connect({ host: provider.remote.address, port: provider.remote.port, family: provider.remote.family });
+    const { provider, credential, route } = prepared;
+    const official = route.provider_id === BRIDGE_OFFICIAL_ROUTE_ID;
+    const remote = official ? config.officialRemote : provider?.remote;
+    if (!remote) {
+        writeUpgradeFailure(client, new DesktopBridgeError(official ? 'bridge_official_passthrough_unavailable' : 'bridge_provider_route_unavailable'), req);
+        return;
+    }
+    const upstreamBaseUrl = official ? remote.baseUrl : provider.base_url;
+    const target = resolveDesktopBridgeTarget(req.url, remote);
+    const upstream = remote.secure
+        ? tls.connect({ host: remote.address, port: remote.port, ...(remote.tlsServername ? { servername: remote.tlsServername } : {}) })
+        : net.connect({ host: remote.address, port: remote.port, family: remote.family });
     const key = String(req.headers['sec-websocket-key'] || '');
     const requestedProtocol = String(req.headers['sec-websocket-protocol'] || '').split(',')[0]?.trim() || null;
     let connected = false;
@@ -156,7 +175,9 @@ export async function forwardWebSocket(req, client, head, config, authenticatedL
         const clientSocket = client;
         if (typeof clientSocket.setKeepAlive === 'function')
             clientSocket.setKeepAlive(true, 30_000);
-        const headers = buildProviderWebSocketHeaders(req.headers, { providerId: provider.provider_id, authTransport: provider.auth_transport, credential }, target.host);
+        const headers = official
+            ? buildOfficialPassthroughWebSocketHeaders(req.headers, target.host)
+            : buildProviderWebSocketHeaders(req.headers, { providerId: provider.provider_id, authTransport: provider.auth_transport, credential: credential }, target.host);
         upstream.write([`${req.method || 'GET'} ${target.pathname}${target.search} HTTP/1.1`, ...serializeHeaders(headers), '', ''].join('\r\n'));
         if (head.length)
             upstream.write(head);
@@ -174,7 +195,7 @@ export async function forwardWebSocket(req, client, head, config, authenticatedL
             const remaining = response.subarray(boundary + 4);
             try {
                 validateUpgrade(raw, key, requestedProtocol);
-                client.write(rewriteUpgradeResponseHead(raw, provider.base_url, authenticatedLocalBaseUrl));
+                client.write(rewriteUpgradeResponseHead(raw, upstreamBaseUrl, authenticatedLocalBaseUrl));
                 if (remaining.length)
                     client.write(remaining);
             }
@@ -187,7 +208,7 @@ export async function forwardWebSocket(req, client, head, config, authenticatedL
         };
         upstream.on('data', onData);
     };
-    if (provider.remote.secure)
+    if (remote.secure)
         upstream.once('secureConnect', onConnected);
     else
         upstream.once('connect', onConnected);

package/dist/core/codex-lb/desktop-bridge-migration/receipt.js

@@ -1,8 +1,6 @@
 export function authSemanticIdentityPreserved(before, after) {
     if (before.path !== after.path || before.exists !== after.exists)
         return false;
-    if (before.sha256 !== after.sha256)
-        return false;
     const beforeIsOAuth = before.mode === 'chatgpt_oauth' || before.mode === 'mixed';
     const afterIsOAuth = after.mode === 'chatgpt_oauth' || after.mode === 'mixed';
     if (beforeIsOAuth || afterIsOAuth) {
@@ -11,7 +9,7 @@ export function authSemanticIdentityPreserved(before, after) {
             && before.semantic_fingerprint !== null
             && before.semantic_fingerprint === after.semantic_fingerprint;
     }
-    return true;
+    return before.sha256 === after.sha256;
 }
 export function buildDesktopBridgeMigrationReceipt(input) {
     const common = {

package/dist/core/codex-lb/desktop-bridge-migration/retired-runtime-cleanup.js

@@ -17,7 +17,7 @@ const SETTINGS_V1_KEYS = new Set([
 const SETTINGS_V2_KEYS = new Set([
     'schema', 'listen_host', 'listen_port', 'provider_registry', 'route_policy',
     'provider_session_pins', 'client_capability_sha256', 'allowed_origins',
-    'connect_timeout_ms', 'idle_timeout_ms',
+    'connect_timeout_ms', 'idle_timeout_ms', 'official_passthrough',
 ]);
 const TRANSFERABLE_V1_KEYS = [
     'listen_host', 'listen_port', 'allowed_origins', 'connect_timeout_ms', 'idle_timeout_ms',

package/dist/core/codex-lb/desktop-bridge-migration.js

@@ -90,8 +90,7 @@ async function migrateDesktopBridgeConfigUnlocked(input) {
         const authPreserved = authSemanticIdentityPreserved(authBefore, authAfter);
         const configSha = sha256(currentConfig);
         const configUnchanged = await fileSha256OrMissing(configPath) === configSha;
-        const authBytesUnchanged = authBefore.sha256 === authAfter.sha256;
-        if (!authPreserved || !configUnchanged || !authBytesUnchanged) {
+        if (!authPreserved || !configUnchanged) {
             return {
                 ...baseResult,
                 ok: false,
@@ -101,8 +100,7 @@ async function migrateDesktopBridgeConfigUnlocked(input) {
                 auth_semantic_identity_preserved: authPreserved,
                 blockers: [
                     ...(!configUnchanged ? ['desktop_bridge_config_changed_during_noop'] : []),
-                    ...(!authPreserved ? ['desktop_oauth_identity_changed'] : []),
-                    ...(authPreserved && !authBytesUnchanged ? ['desktop_auth_changed_during_noop'] : [])
+                    ...(!authPreserved ? ['desktop_oauth_identity_changed'] : [])
                 ]
             };
         }

package/dist/core/codex-lb/desktop-controller-v3/catalog.js

@@ -5,12 +5,12 @@ import { listOpenRouterModels } from '../../providers/openrouter/openrouter-acco
 import { buildCombinedBridgeCatalog, readActiveCombinedBridgeCatalog, stageCombinedBridgeCatalog } from '../combined-catalog.js';
 import { COMBINED_BRIDGE_CATALOG_TTL_MS } from '../combined-catalog/contracts.js';
 import { codexLbEnvPath, codexLbMetadataPath, loadCodexLbEnv, readCodexLbModelCatalog } from '../codex-lb-env.js';
-import { bootstrapExistingDesktopBridgeService, desktopBridgeServicePaths, desktopBridgeServiceStatus, resolveDesktopBridgeActivationSettings } from '../desktop-service.js';
+import { bootstrapExistingDesktopBridgeService, desktopBridgeServicePaths, desktopBridgeServiceStatus, readDesktopBridgeServiceSettings, resolveDesktopBridgeActivationSettings, resolveEffectiveOfficialModelsMode } from '../desktop-service.js';
 import { inspectHistoricalDesktopBridgeIntent, migrateDesktopBridgeConfig } from '../desktop-bridge-migration.js';
 import { rollbackDesktopBridgeUnificationReceipt } from '../migration-receipt.js';
 import { recordProviderCredentialValidation } from '../provider-credentials.js';
 import { bridgeProviderRegistryPath, buildStoredBridgeProviderRegistry, loadStoredBridgeProviderRegistry, resolveBridgeProviderRegistry, serializeStoredBridgeProviderRegistry } from '../provider-registry.js';
-import { buildBridgeRoutingPolicy, readBridgeRoutingPolicy } from '../provider-route-policy.js';
+import { applyOfficialModelPassthrough, buildBridgeRoutingPolicy, readBridgeRoutingPolicy } from '../provider-route-policy.js';
 import { sha256Stable } from '../route-index.js';
 import { bridgeBaseUrl, commandResult, controllerEnv, controllerPaths, nowIso, providerCode, providerRegistrySnapshot, resolveRawCredentials, resolveValidatedCredentials, safeCode, serializedSettings, stringArray, timeoutMs, unique } from './shared.js';
 import { desktopBridgeStatusV3 } from './status.js';
@@ -76,12 +76,14 @@ export async function syncCatalogInternal(options) {
         ? previousDefault
         : historicalDefault && readyProviders.includes(historicalDefault) ? historicalDefault
             : readyProviders.length === 1 ? readyProviders[0] || null : null;
-    const policy = buildBridgeRoutingPolicy({
+    const persistedSettings = await readDesktopBridgeServiceSettings(desktopBridgeServicePaths(paths.home).settings_path).catch(() => null);
+    const officialModelsMode = await resolveEffectiveOfficialModelsMode(persistedSettings?.official_passthrough, { home: paths.home, authPath: paths.authPath });
+    const policy = applyOfficialModelPassthrough(buildBridgeRoutingPolicy({
         route_index: build.route_index,
         catalog_generation: build.catalog.generation,
         default_provider_id: defaultProvider,
         changed_at: nowIso(options)
-    });
+    }), { mode: officialModelsMode, changedAt: nowIso(options) });
     let settings;
     let managedBridgeBaseUrl;
     try {

package/dist/core/codex-lb/desktop-controller-v3/lifecycle-commands.js

@@ -2,10 +2,11 @@ import path from 'node:path';
 import { removeDesktopBridgeManagedConfig } from '../../../cli/install-helpers-codex-lb-config.js';
 import { safeWriteCodexConfigToml } from '../../codex-runtime/codex-desktop-config-policy.js';
 import { exists, readText } from '../../fsx.js';
-import { bootstrapExistingDesktopBridgeService, desktopBridgeServiceStatus, installAndStartDesktopBridgeService, stopDesktopBridgeService } from '../desktop-service.js';
+import { bootstrapExistingDesktopBridgeService, desktopBridgeServicePaths, desktopBridgeServiceStatus, installAndStartDesktopBridgeService, readDesktopBridgeServiceSettings, resolveEffectiveOfficialModelsMode, stopDesktopBridgeService } from '../desktop-service.js';
 import { rollbackDesktopBridgeUnificationReceipt } from '../migration-receipt.js';
+import { DESKTOP_BRIDGE_OFFICIAL_UPSTREAM_BASE_URL } from '../desktop-bridge/index.js';
 import { resolveBridgeRequestRoute } from '../request-route-resolver.js';
-import { setBridgeRoutingDefault, writeBridgeRoutingPolicy } from '../provider-route-policy.js';
+import { applyOfficialModelPassthrough, buildBridgeRoutingPolicy, setBridgeRoutingDefault, writeBridgeRoutingPolicy } from '../provider-route-policy.js';
 import { syncCatalogInternal } from './catalog.js';
 import { commandResult, controllerPaths, nowIso, persistRuntimeSettings, providerCode, providerRegistrySnapshot, stringArray } from './shared.js';
 import { desktopBridgeStatusV3, loadCore, statusFromCore } from './status.js';
@@ -70,6 +71,39 @@ export async function setDefaultProvider(providerId, options) {
     const status = await desktopBridgeStatusV3(options);
     return commandResult('route.set-default', true, status, { provider_id: providerId, policy_generation: policy.policy_generation }, [], options);
 }
+export async function setOfficialModelsMode(mode, options) {
+    const core = await loadCore(options);
+    if (!core.policy || !core.activeCatalog.ok)
+        throw new Error('bridge_route_policy_missing');
+    const settingsPath = options.settingsPath || desktopBridgeServicePaths(core.paths.home).settings_path;
+    const persisted = await readDesktopBridgeServiceSettings(settingsPath).catch(() => null);
+    const nextOfficial = {
+        enabled: persisted?.official_passthrough?.enabled ?? true,
+        base_url: persisted?.official_passthrough?.base_url || DESKTOP_BRIDGE_OFFICIAL_UPSTREAM_BASE_URL,
+        models: mode,
+    };
+    const effective = mode === 'auto'
+        ? await resolveEffectiveOfficialModelsMode(nextOfficial, { home: core.paths.home })
+        : mode;
+    const policy = effective === 'passthrough'
+        ? applyOfficialModelPassthrough(core.policy, { mode: 'passthrough', changedAt: nowIso(options) })
+        : buildBridgeRoutingPolicy({
+            route_index: core.activeCatalog.route_index,
+            catalog_generation: core.policy.catalog_generation,
+            default_provider_id: core.policy.default_provider_id,
+            changed_at: nowIso(options)
+        });
+    await writeBridgeRoutingPolicy(core.paths.routePolicyPath, policy, core.activeCatalog.route_index);
+    await persistRuntimeSettings({ ...core, policy, policyBlockers: [] }, {
+        ...options,
+        settings: { ...(options.settings || {}), official_passthrough: nextOfficial },
+    });
+    const status = await desktopBridgeStatusV3(options);
+    const officialModels = Object.entries(policy.model_routes)
+        .filter(([, route]) => route.provider_id === 'openai')
+        .map(([model]) => model);
+    return commandResult('route.official-models', true, status, { mode, effective_mode: effective, official_models: officialModels, policy_generation: policy.policy_generation }, [], options);
+}
 export async function explainRoute(model, options) {
     const core = await loadCore(options);
     if (!core.policy || !core.activeCatalog.ok)

package/dist/core/codex-lb/desktop-controller-v3.js

@@ -1,5 +1,5 @@
 import { listSelectableModels, selectExposedModels, syncCatalog } from './desktop-controller-v3/catalog.js';
-import { explainRoute, ensureDesktopBridge, repairDesktopBridge, rollbackDesktopBridge, setDefaultProvider, unmanageDesktopBridge } from './desktop-controller-v3/lifecycle-commands.js';
+import { explainRoute, ensureDesktopBridge, repairDesktopBridge, rollbackDesktopBridge, setDefaultProvider, setOfficialModelsMode, unmanageDesktopBridge } from './desktop-controller-v3/lifecycle-commands.js';
 import { configureProvider, removeCredential, setProviderState, validateProvider } from './desktop-controller-v3/provider-commands.js';
 import { commandResult, safeCode } from './desktop-controller-v3/shared.js';
 import { desktopBridgeStatusV3 } from './desktop-controller-v3/status.js';
@@ -56,6 +56,8 @@ export async function executeDesktopBridgeCommandV3(request, options = {}) {
             }
             if (request.operation === 'route.set-default')
                 return setDefaultProvider(request.provider_id, options);
+            if (request.operation === 'route.official-models')
+                return setOfficialModelsMode(request.mode, options);
             if (request.operation === 'route.explain')
                 return explainRoute(request.model, options);
             if (request.operation === 'unmanage')

package/dist/core/codex-lb/desktop-service.js

@@ -9,9 +9,11 @@ import { loadCodexLbEnv } from './codex-lb-env.js';
 import { resolveOpenRouterApiKey } from '../providers/openrouter/openrouter-secret-store.js';
 import { cleanupRetiredDesktopBridgeRuntime, prepareRetiredDesktopBridgeRuntime, } from './desktop-bridge-migration/retired-runtime-cleanup.js';
 import { canonicalizeBridgeModelId, normalizeBridgeUpstreamModelId, sha256Stable } from './route-index.js';
+import { captureCodexAuthSnapshot } from './desktop-auth-invariant.js';
+import { applyOfficialModelPassthrough, bridgeRoutePolicyPath, writeBridgeRoutingPolicy } from './provider-route-policy.js';
 import { desktopBridgeRuntimeVersion, desktopBridgeRuntimeVersionStale } from './desktop-bridge/state.js';
 import { PACKAGE_VERSION } from '../version.js';
-import { DESKTOP_BRIDGE_ALLOWED_PATH_PREFIXES, DESKTOP_BRIDGE_LAUNCHD_LABEL, desktopBridgeConfigGeneration, desktopBridgeLaunchdPlistPath, desktopBridgeProcessExists, desktopBridgeStatePath, getDesktopBridgeStatus, preflightDesktopBridge, readDesktopBridgeState, safeBridgeErrorCode, writeDesktopBridgeLaunchdPlist, selectAvailableDesktopBridgePort, startPreparedDesktopBridge, DESKTOP_BRIDGE_STATE_SCHEMA, DesktopBridgeError, } from './desktop-bridge/index.js';
+import { DESKTOP_BRIDGE_ALLOWED_PATH_PREFIXES, DESKTOP_BRIDGE_LAUNCHD_LABEL, desktopBridgeConfigGeneration, desktopBridgeLaunchdPlistPath, desktopBridgeProcessExists, desktopBridgeStatePath, getDesktopBridgeStatus, preflightDesktopBridge, readDesktopBridgeState, safeBridgeErrorCode, writeDesktopBridgeLaunchdPlist, selectAvailableDesktopBridgePort, startPreparedDesktopBridge, DESKTOP_BRIDGE_STATE_SCHEMA, DESKTOP_BRIDGE_OFFICIAL_UPSTREAM_BASE_URL, DesktopBridgeError, } from './desktop-bridge/index.js';
 export const DEFAULT_DESKTOP_BRIDGE_HOST = '127.0.0.1';
 export const DEFAULT_DESKTOP_BRIDGE_PORT = 49_152;
 export const DESKTOP_BRIDGE_SETTINGS_SCHEMA = 'sks.desktop-bridge-settings.v2';
@@ -159,7 +161,7 @@ export async function writeDesktopBridgeServiceSettings(file, settings) {
 }
 async function writeDesktopBridgeServiceSettingsUnlocked(file, settings) {
     const validated = validateDesktopBridgeServiceSettings(settings);
-    const persisted = { schema: validated.schema, listen_host: validated.listen_host, listen_port: validated.listen_port, provider_registry: validated.provider_registry, route_policy: validated.route_policy, provider_session_pins: validated.provider_session_pins, client_capability_sha256: validated.client_capability_sha256, allowed_origins: validated.allowed_origins, connect_timeout_ms: validated.connect_timeout_ms, idle_timeout_ms: validated.idle_timeout_ms };
+    const persisted = { schema: validated.schema, listen_host: validated.listen_host, listen_port: validated.listen_port, provider_registry: validated.provider_registry, route_policy: validated.route_policy, provider_session_pins: validated.provider_session_pins, client_capability_sha256: validated.client_capability_sha256, allowed_origins: validated.allowed_origins, connect_timeout_ms: validated.connect_timeout_ms, idle_timeout_ms: validated.idle_timeout_ms, official_passthrough: validated.official_passthrough };
     await writeTextAtomic(file, `${JSON.stringify(persisted, null, 2)}\n`, { mode: 0o600 });
     await fsp.chmod(file, 0o600);
 }
@@ -246,11 +248,13 @@ export async function resolveDesktopBridgeRuntimeConfig(options = {}) {
     if (!Object.keys(settings.route_policy.model_routes).length)
         throw new Error('catalog_model_route_missing');
     const enabledRoutes = new Set(Object.values(settings.route_policy.model_routes).map((route) => route.provider_id));
-    if (![...enabledRoutes].some((id) => credentials.registry.providers[id].credential_state === 'ready'))
+    const providerRouteIds = [...enabledRoutes].filter((id) => id === 'codex-lb' || id === 'openrouter');
+    const officialOnly = providerRouteIds.length === 0 && settings.official_passthrough.enabled;
+    if (!officialOnly && !providerRouteIds.some((id) => credentials.registry.providers[id].credential_state === 'ready'))
         throw new Error('desktop_bridge_provider_credentials_unavailable');
     const persistProviderSessionPins = options.persistProviderSessionPins
         || ((pins) => persistDesktopBridgeSessionPins(paths.settings_path, settings, pins));
-    const config = { providerRegistry: settings.provider_registry, routePolicy: settings.route_policy, providerSessionPins: settings.provider_session_pins, ...(options.resolveRequestRoute ? { resolveRequestRoute: options.resolveRequestRoute } : {}), persistProviderSessionPins, resolveProviderCredential: credentials.resolver, clientCapabilitySha256: settings.client_capability_sha256, listenHost: settings.listen_host, listenPort: settings.listen_port, allowedPathPrefixes: DESKTOP_BRIDGE_ALLOWED_PATH_PREFIXES, allowedOrigins: settings.allowed_origins, connectTimeoutMs: settings.connect_timeout_ms, idleTimeoutMs: settings.idle_timeout_ms };
+    const config = { providerRegistry: settings.provider_registry, routePolicy: settings.route_policy, providerSessionPins: settings.provider_session_pins, ...(options.resolveRequestRoute ? { resolveRequestRoute: options.resolveRequestRoute } : {}), persistProviderSessionPins, resolveProviderCredential: credentials.resolver, clientCapabilitySha256: settings.client_capability_sha256, listenHost: settings.listen_host, listenPort: settings.listen_port, allowedPathPrefixes: DESKTOP_BRIDGE_ALLOWED_PATH_PREFIXES, allowedOrigins: settings.allowed_origins, connectTimeoutMs: settings.connect_timeout_ms, idleTimeoutMs: settings.idle_timeout_ms, officialPassthrough: settings.official_passthrough.enabled ? { baseUrl: settings.official_passthrough.base_url } : null };
     const primary = credentials.sources['codex-lb'] || credentials.sources.openrouter;
     if (!primary)
         throw new Error('desktop_bridge_provider_credentials_unavailable');
@@ -434,24 +438,67 @@ async function installedPackageVersion() {
         return null;
     }
 }
+export const DESKTOP_BRIDGE_SKEW_RESTART_COOLDOWN_MS = 30 * 60_000;
+export function desktopBridgeSkewRestartSuppressed(marker, running, installed, nowMs) {
+    return Boolean(marker
+        && marker.running === running
+        && marker.installed === installed
+        && nowMs - Date.parse(marker.at) < DESKTOP_BRIDGE_SKEW_RESTART_COOLDOWN_MS);
+}
+async function readSkewRestartMarker(file) {
+    try {
+        const parsed = JSON.parse(await fsp.readFile(file, 'utf8'));
+        if (typeof parsed.running !== 'string' || typeof parsed.installed !== 'string' || !Number.isFinite(Date.parse(String(parsed.at))))
+            return null;
+        return { running: parsed.running, installed: parsed.installed, at: String(parsed.at) };
+    }
+    catch {
+        return null;
+    }
+}
+async function autoApplyOfficialModelsAtServe(runtime, home, options) {
+    const settings = runtime.settings;
+    const mode = await resolveEffectiveOfficialModelsMode(settings.official_passthrough, { home });
+    if (mode !== 'passthrough')
+        return;
+    const flipped = applyOfficialModelPassthrough(settings.route_policy, { mode: 'passthrough' });
+    if (flipped.policy_generation === settings.route_policy.policy_generation)
+        return;
+    const nextSettings = { ...settings, route_policy: flipped };
+    await writeDesktopBridgeServiceSettings(options.settingsPath || desktopBridgeServicePaths(home).settings_path, nextSettings);
+    await writeBridgeRoutingPolicy(bridgeRoutePolicyPath(path.join(path.resolve(home), '.codex')), flipped).catch(() => undefined);
+    settings.route_policy = flipped;
+    runtime.config.routePolicy = flipped;
+    process.stdout.write(`${JSON.stringify({ schema: 'sks.desktop-bridge-log.v2', event: 'sks.desktop_bridge.official_models_auto_applied', at: new Date().toISOString(), sks_version: PACKAGE_VERSION, mode: 'passthrough', policy_generation: flipped.policy_generation, secret_fields_redacted: true })}\n`);
+}
 export async function serveDesktopBridge(options = {}) {
     let handle = null;
     try {
         const runtime = await resolveDesktopBridgeRuntimeConfig(options);
+        const serveHome = options.home || options.env?.HOME || process.env.HOME || os.homedir();
+        await autoApplyOfficialModelsAtServe(runtime, serveHome, options);
         const supervised = desktopBridgeIsSupervised();
+        const skewMarkerPath = path.join(path.dirname(runtime.paths.state_path), 'desktop-bridge-skew-restart.json');
         handle = await startPreparedDesktopBridge(await preflightDesktopBridge(runtime.config), {
             statePath: runtime.paths.state_path,
             versionSkew: {
                 readInstalledVersion: installedPackageVersion,
                 onSkew: (installedVersion) => {
-                    process.stdout.write(`${JSON.stringify({ schema: 'sks.desktop-bridge-log.v2', event: 'sks.desktop_bridge.version_skew', running: PACKAGE_VERSION, installed: installedVersion, supervised, action: supervised ? 'restarting' : 'logged_only', secret_fields_redacted: true })}\n`);
-                    if (!supervised)
-                        return;
-                    void handle?.stop().catch(() => undefined).finally(() => process.exit(64));
+                    void (async () => {
+                        const marker = await readSkewRestartMarker(skewMarkerPath);
+                        const cooldownActive = desktopBridgeSkewRestartSuppressed(marker, PACKAGE_VERSION, installedVersion, Date.now());
+                        const action = !supervised ? 'logged_only' : cooldownActive ? 'suppressed_cooldown' : 'restarting';
+                        process.stdout.write(`${JSON.stringify({ schema: 'sks.desktop-bridge-log.v2', event: 'sks.desktop_bridge.version_skew', at: new Date().toISOString(), running: PACKAGE_VERSION, installed: installedVersion, supervised, action, secret_fields_redacted: true })}\n`);
+                        if (!supervised || cooldownActive)
+                            return;
+                        await writeTextAtomic(skewMarkerPath, `${JSON.stringify({ running: PACKAGE_VERSION, installed: installedVersion, at: new Date().toISOString() })}\n`, { mode: 0o600 }).catch(() => undefined);
+                        await handle?.stop().catch(() => undefined);
+                        process.exit(64);
+                    })();
                 },
             },
         });
-        process.stdout.write(`${JSON.stringify({ schema: 'sks.desktop-bridge-log.v2', event: 'sks.desktop_bridge.started', pid: handle.state.pid, process_generation: handle.state.schema === DESKTOP_BRIDGE_STATE_SCHEMA ? handle.state.process_generation : null, provider_registry_generation: runtime.config.providerRegistry?.generation, route_policy_generation: runtime.config.routePolicy?.policy_generation, secret_fields_redacted: true })}\n`);
+        process.stdout.write(`${JSON.stringify({ schema: 'sks.desktop-bridge-log.v2', event: 'sks.desktop_bridge.started', at: new Date().toISOString(), sks_version: PACKAGE_VERSION, pid: handle.state.pid, process_generation: handle.state.schema === DESKTOP_BRIDGE_STATE_SCHEMA ? handle.state.process_generation : null, provider_registry_generation: runtime.config.providerRegistry?.generation, route_policy_generation: runtime.config.routePolicy?.policy_generation, secret_fields_redacted: true })}\n`);
         await waitForShutdown(handle);
         return { schema: 'sks.desktop-bridge-serve.v1', ok: true, status: 'stopped', state: handle.state };
     }
@@ -470,7 +517,7 @@ function validateDesktopBridgeServiceSettings(value) {
     const input = row;
     if (input.schema !== DESKTOP_BRIDGE_SETTINGS_SCHEMA)
         throw new Error('desktop_bridge_settings_schema_invalid');
-    const allowedKeys = new Set(['schema', 'listen_host', 'listen_port', 'provider_registry', 'route_policy', 'provider_session_pins', 'client_capability_sha256', 'allowed_origins', 'connect_timeout_ms', 'idle_timeout_ms']);
+    const allowedKeys = new Set(['schema', 'listen_host', 'listen_port', 'provider_registry', 'route_policy', 'provider_session_pins', 'client_capability_sha256', 'allowed_origins', 'connect_timeout_ms', 'idle_timeout_ms', 'official_passthrough']);
     if (Object.keys(input).some((key) => !allowedKeys.has(key)))
         throw new Error('desktop_bridge_settings_unknown_field');
     const serialized = JSON.stringify(input);
@@ -502,7 +549,44 @@ function validateDesktopBridgeServiceSettings(value) {
         throw new Error('desktop_bridge_settings_connect_timeout_invalid');
     if (!Number.isFinite(idle) || idle < 1_000 || idle > 86_400_000)
         throw new Error('desktop_bridge_settings_idle_timeout_invalid');
-    return { schema: DESKTOP_BRIDGE_SETTINGS_SCHEMA, listen_host: host, listen_port: port, provider_registry: registry, route_policy: policy, provider_session_pins: pins, client_capability_sha256: clientCapabilitySha256, allowed_origins: [...new Set(origins)], connect_timeout_ms: connect, idle_timeout_ms: idle };
+    const officialPassthrough = validateOfficialPassthroughSettings(input.official_passthrough);
+    return { schema: DESKTOP_BRIDGE_SETTINGS_SCHEMA, listen_host: host, listen_port: port, provider_registry: registry, route_policy: policy, provider_session_pins: pins, client_capability_sha256: clientCapabilitySha256, allowed_origins: [...new Set(origins)], connect_timeout_ms: connect, idle_timeout_ms: idle, official_passthrough: officialPassthrough };
+}
+function validateOfficialPassthroughSettings(value) {
+    if (value === undefined || value === null) {
+        return { enabled: true, base_url: DESKTOP_BRIDGE_OFFICIAL_UPSTREAM_BASE_URL, models: 'auto' };
+    }
+    if (typeof value !== 'object' || Array.isArray(value))
+        throw new Error('desktop_bridge_settings_official_passthrough_invalid');
+    const row = value;
+    if (Object.keys(row).some((key) => key !== 'enabled' && key !== 'base_url' && key !== 'models'))
+        throw new Error('desktop_bridge_settings_official_passthrough_invalid');
+    const enabled = row.enabled === true;
+    const baseUrl = typeof row.base_url === 'string' && row.base_url.trim() ? row.base_url.trim() : DESKTOP_BRIDGE_OFFICIAL_UPSTREAM_BASE_URL;
+    try {
+        new URL(baseUrl);
+    }
+    catch {
+        throw new Error('desktop_bridge_settings_official_passthrough_invalid');
+    }
+    const models = row.models === 'passthrough' || row.models === 'gateway' || row.models === 'auto'
+        ? row.models
+        : row.models === undefined ? 'auto' : null;
+    if (models === null)
+        throw new Error('desktop_bridge_settings_official_passthrough_invalid');
+    return { enabled, base_url: baseUrl, models };
+}
+export async function resolveEffectiveOfficialModelsMode(official, input) {
+    if (official && official.enabled === false)
+        return 'gateway';
+    const models = official?.models || 'auto';
+    if (models === 'passthrough' || models === 'gateway')
+        return models;
+    const snapshot = await captureCodexAuthSnapshot({
+        home: input.home,
+        ...(input.authPath ? { authPath: input.authPath } : {}),
+    }).catch(() => null);
+    return snapshot && (snapshot.mode === 'chatgpt_oauth' || snapshot.mode === 'mixed') ? 'passthrough' : 'gateway';
 }
 function validateProviderSessionPins(value) {
     const pins = Array.isArray(value) ? value : [];

package/dist/core/codex-lb/provider-route-policy.js

@@ -1,6 +1,7 @@
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
+import { BRIDGE_OFFICIAL_ROUTE_ID } from './bridge-contracts.js';
 import { canonicalizeBridgeModelId, normalizeBridgeUpstreamModelId, sha256Stable } from './route-index.js';
 import { writeJsonAtomic } from '../fsx.js';
 import { withFileLock } from '../locks/file-lock.js';
@@ -58,6 +59,8 @@ export function validateBridgeRoutingPolicy(policy, routeIndex) {
         blockers.push('bridge_route_policy_model_invalid');
     if (routeIndex) {
         for (const [model, target] of Object.entries(canonical)) {
+            if (target.provider_id === BRIDGE_OFFICIAL_ROUTE_ID)
+                continue;
             const indexed = routeIndex.routes[model];
             if (!indexed || !sameTarget(indexed, target))
                 blockers.push('bridge_route_policy_route_index_mismatch');
@@ -101,7 +104,7 @@ function canonicalRoutes(routes) {
     for (const [model, target] of Object.entries(routes)) {
         const canonicalModel = canonicalizeBridgeModelId(model);
         const upstreamModel = normalizeBridgeUpstreamModelId(target.upstream_model);
-        if (!canonicalModel || !upstreamModel || !isProviderId(target.provider_id))
+        if (!canonicalModel || !upstreamModel || !isRouteTargetId(target.provider_id))
             continue;
         rows.push([canonicalModel, { provider_id: target.provider_id, upstream_model: upstreamModel }]);
     }
@@ -110,6 +113,32 @@ function canonicalRoutes(routes) {
 function isProviderId(value) {
     return value === 'codex-lb' || value === 'openrouter';
 }
+function isRouteTargetId(value) {
+    return isProviderId(value) || value === BRIDGE_OFFICIAL_ROUTE_ID;
+}
+export const OFFICIAL_MODEL_ID_PATTERN = /^(?:gpt-[0-9]|o[0-9]|codex-mini)/;
+export function applyOfficialModelPassthrough(policy, input = { mode: 'passthrough' }) {
+    if (input.mode === 'gateway')
+        return policy;
+    const routes = {};
+    for (const [model, target] of Object.entries(policy.model_routes)) {
+        routes[model] = OFFICIAL_MODEL_ID_PATTERN.test(model) && !model.includes(':')
+            ? { provider_id: BRIDGE_OFFICIAL_ROUTE_ID, upstream_model: model }
+            : target;
+    }
+    const semantic = {
+        default_provider_id: policy.default_provider_id,
+        fallback: 'none',
+        model_routes: canonicalRoutes(routes),
+        catalog_generation: policy.catalog_generation
+    };
+    return {
+        schema: 'sks.bridge-routing-policy.v1',
+        ...semantic,
+        policy_generation: sha256Stable(semantic),
+        changed_at: input.changedAt || new Date().toISOString()
+    };
+}
 function sameTarget(left, right) {
     return left.provider_id === right.provider_id && left.upstream_model === right.upstream_model;
 }

package/dist/core/codex-lb/request-route-resolver.js

@@ -51,6 +51,20 @@ export function resolveBridgeRequestRoute(request, policy, options) {
     const policyTarget = policy.model_routes[model];
     if (!indexed || !policyTarget)
         return blocked(base, 'catalog_model_route_missing');
+    if (policyTarget.provider_id === 'openai') {
+        return {
+            ...base,
+            ok: true,
+            route: policyTarget,
+            endpoint_url: null,
+            source: 'route_index',
+            proposed_session_pin: null,
+            blockers: [],
+            recovery_action: null
+        };
+    }
+    if (indexed.provider_id === 'openai')
+        return blocked(base, 'catalog_route_provider_unknown');
     if (!sameTarget(indexed, policyTarget))
         return blocked(base, 'bridge_route_policy_route_index_mismatch');
     if (pinClaim && !sameTarget(indexed, pinClaim))

package/dist/core/hooks-runtime/official-subagent-lifecycle.js

@@ -18,6 +18,28 @@ import { MAX_LIFECYCLE_THREADS } from './subagent-skill-availability-contract.js
 import { officialSubagentEvidenceReady, terminalBlockedNarutoGate } from '../subagents/terminal-subagent-state.js';
 const SUBAGENT_LIFECYCLE_CAPTURE_FAILURE_SCHEMA = 'sks.subagent-lifecycle-capture-failure.v1';
 const MAX_SUBAGENT_LIFECYCLE_CAPTURE_FAILURES = 528;
+export const ACTIVE_OFFICIAL_WORKFLOW_IDLE_MS = 2 * 60 * 60 * 1000;
+function parseIsoMs(value) {
+    const parsed = Date.parse(String(value || ''));
+    return Number.isFinite(parsed) ? parsed : 0;
+}
+export function officialWorkflowLastActivityMs(input) {
+    const times = [
+        parseIsoMs(input.plan?.created_at),
+        parseIsoMs(input.plan?.updated_at),
+        parseIsoMs(input.plan?.wave_lifecycle?.updated_at),
+        parseIsoMs(input.plan?.wave_lifecycle?.created_at),
+        parseIsoMs(input.gate?.updated_at),
+        parseIsoMs(input.gate?.created_at),
+        ...(input.events || []).map((event) => parseIsoMs(event.occurred_at ?? event.ts))
+    ];
+    return times.reduce((max, value) => (value > max ? value : max), 0);
+}
+export function officialWorkflowIsIdle(activityMs, nowMs = Date.now()) {
+    if (activityMs <= 0)
+        return true;
+    return nowMs - activityMs > ACTIVE_OFFICIAL_WORKFLOW_IDLE_MS;
+}
 export async function inspectActiveOfficialSubagentWorkflow(root, state, sessionKey = null) {
     const missionId = String(state?.mission_id || '').trim();
     const workflowRunId = String(state?.official_subagent_run_id || '').trim();
@@ -71,8 +93,14 @@ export async function inspectActiveOfficialSubagentWorkflow(root, state, session
             if (events.length > 0 && openThreads !== liveThreads.size) {
                 return { status: 'invalid', missionId, workflowRunId, reason: 'active_lifecycle_event_mismatch' };
             }
+            if (officialWorkflowIsIdle(officialWorkflowLastActivityMs({ plan, gate, events }))) {
+                return { status: 'inactive' };
+            }
             return { status: 'active', missionId, workflowRunId, openThreads };
         }
+        if (officialWorkflowIsIdle(officialWorkflowLastActivityMs({ plan, gate, events }))) {
+            return { status: 'inactive' };
+        }
         return { status: 'active', missionId, workflowRunId, openThreads: liveThreads.size };
     }
     catch {

package/dist/core/hooks-runtime.js

@@ -2,7 +2,7 @@ import fsp from 'node:fs/promises';
 import path from 'node:path';
 import { projectRoot, readJson, writeJsonAtomic, writeTextAtomic, appendJsonl, nowIso, sha256, packageRoot } from './fsx.js';
 import { looksInteractiveCommand, interactiveCommandReason } from './no-question-guard.js';
-import { loadStateForSession, missionDir, sessionStateKey, setCurrent, stateFileForSession } from './mission.js';
+import { loadOwnedRouteState, missionDir, sessionStateKey, setCurrent, stateFileForSession } from './mission.js';
 import { checkDbOperation, dbBlockReason, handleMadSksUserConfirmation } from './db-safety.js';
 import { maybeRecordMadSksSqlPlaneToolResultFromToolUse } from './mad-sks/sql-plane/result-lifecycle.js';
 import { checkHarnessModification, harnessGuardBlockReason, isHarnessSourceProject } from './harness-guard.js';
@@ -53,7 +53,7 @@ export { selftestCodexCommitHooks } from './hooks-runtime/codex-commit-hooks-sel
 async function loadState(root, payload = {}) {
     const sessionKey = conversationId(payload);
     if (!explicitConversationId(payload))
-        return loadStateForSession(root, sessionKey);
+        return loadOwnedRouteState(root);
     const hashed = sessionStateKey(sessionKey);
     const sessionState = await readJson(stateFileForSession(root, sessionKey), null).catch(() => null);
     return sessionState ? { ...sessionState, _session_key: sessionState._session_key || hashed } : {};

package/dist/core/imagegen/desktop-bridge-imagegen-target.js

@@ -18,7 +18,7 @@ export async function resolveDesktopBridgeImagegenTarget(opts = {}) {
     const route = model && policy?.fallback === 'none'
         ? policy.model_routes?.[model] || null
         : null;
-    const provider = route ? status?.providers?.[route.provider_id] || null : null;
+    const provider = route && route.provider_id !== 'openai' ? status?.providers?.[route.provider_id] || null : null;
     const providerImagegen = provider?.capabilities?.capabilities?.image_generation || null;
     const blocker = !status || status.schema !== 'sks.desktop-bridge-status.v3'
         ? 'desktop_bridge_status_unavailable'
@@ -50,7 +50,7 @@ export async function resolveDesktopBridgeImagegenTarget(opts = {}) {
         model,
         model_source: model ? 'explicit' : null,
         route: route || null,
-        provider_id: route?.provider_id || null,
+        provider_id: route && route.provider_id !== 'openai' ? route.provider_id : null,
         status_source: injected ? 'injected_fixture' : 'runtime',
         live_evidence_allowed: bridgeVerified && !injected,
         blocker,