sneakoscope 9.1.1 → 9.2.0

package/README.md

@@ -22,7 +22,7 @@ Proof-first orchestration for Codex CLI, ChatGPT Desktop, AI coding agents, mult
 Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
 <!-- END SKS SEARCH VISIBILITY MARKETING -->
 
-This README documents package **SKS 9.1.1** — its own identity, read from `package.json` and subject to release-gate verification, not advice about what to install.
+This README documents package **SKS 9.2.0** — its own identity, read from `package.json` and subject to release-gate verification, not advice about what to install.
 
 Use the official latest stable SKS and Codex CLI releases. The Codex compatibility SSOT is always the **current latest stable** host; capability probes measure what that host can actually do. Product docs do not crown a fixed `0.x.y` string as SSOT (release pins and schema directories are measured artifacts for the current package, not a permanent product version claim). Menu Bar / Center induce updates to the latest stable build. Run `sks update-check` for what is installed and read the capability report for what is supported. Install SSOT is npm `sneakoscope@latest`; PATH `sks` and Menu Bar stamped generation must match that version or gates fail. It resolves managed SKS skills from the authoritative global install, preserves a runnable Naruto child slot when `max_threads=2`, and keeps Menu Bar repair transactional so stamped generations remain verifiable. Naruto uses stable opt-in multi-agent V2 when the host exposes it (Codex official multi-agent wrap-only; SKS does not reimplement a parallel runtime). Local code search is mode-separated (`sks search files|text|structure|symbol|context`); `context` is answered by the compiled TriWiki Context Graph (`context-graph.json` is exhaustive authority; `context-pack.json` and managed `AGENTS.md` are bounded projections) — see [docs/architecture/context-graph.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/docs/architecture/context-graph.md) and [docs/PRODUCT-CONTRACT.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/docs/PRODUCT-CONTRACT.md). See [CHANGELOG.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/CHANGELOG.md).
 

package/crates/sks-core/Cargo.lock

@@ -259,7 +259,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "9.1.1"
+version = "9.2.0"
 dependencies = [
  "globset",
  "grep-matcher",

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "9.1.1"
+version = "9.2.0"
 edition = "2021"
 
 [dependencies]

package/dist/commands/bridge.js

@@ -27,6 +27,7 @@ export function usage(command = 'bridge') {
         `       sks ${command} models select --set <public-id,...> [--json]`,
         `       sks ${command} route list [--json]`,
         `       sks ${command} route set-default <codex-lb|openrouter> [--json]`,
+        `       sks ${command} route official-models <passthrough|gateway|auto> [--json]`,
         `       sks ${command} route explain <model> [--json]`,
         `       sks ${command} unmanage --confirm [--json]`,
         `       sks ${command} rollback <receipt-id> --confirm [--json]`,
@@ -236,6 +237,16 @@ async function parseInvocation(args, io) {
                 label: `Default bridge provider set to ${providerId}`
             };
         }
+        if (action === 'official-models' && target !== undefined && extra === undefined) {
+            allowOnly(parsed, ['--json'], []);
+            if (target !== 'passthrough' && target !== 'gateway' && target !== 'auto')
+                throw new BridgeCliError('bridge_route_official_models_mode_invalid');
+            return {
+                ...base,
+                request: { operation: 'route.official-models', mode: target },
+                label: `Official models routing set to ${target}`
+            };
+        }
         if (action === 'explain' && target !== undefined && extra === undefined) {
             allowOnly(parsed, ['--json'], []);
             return {

package/dist/config/skills-manifest.json

@@ -1,6 +1,6 @@
 {
   "schema": "sks.skills-manifest.v1",
-  "package_version": "9.1.1",
+  "package_version": "9.2.0",
   "skills": [
     {
       "canonical_name": "sks",

package/dist/core/codex-app.js

@@ -894,7 +894,7 @@ function providerModelUiStatusFromDesktopBridge(status) {
         || status.routing.policy?.default_provider_id
         || status.routing.session_pin?.provider_id
         || null;
-    const selectedProfile = selectedProvider ? status.providers[selectedProvider] : null;
+    const selectedProfile = selectedProvider && selectedProvider !== 'openai' ? status.providers[selectedProvider] : null;
     const selectedProviderBlockers = uniqueStrings([
         ...status.readiness.blockers,
         ...status.routing.blockers,

package/dist/core/codex-control/codex-sdk-env-policy.js

@@ -160,16 +160,51 @@ export async function prepareNativeCodexAuthBridge(env, opts = {}) {
                 applyCleanupProof(bridgeProof, result);
                 return result;
             }
-            await assertSourceAuthUnchanged(sourceAuthCandidate, sourceAuthIdentity, sourceAuthFingerprint);
-            const hostAuth = { ...tempAuth, ...originalApiKeyFields };
-            const hostAuthText = `${JSON.stringify(hostAuth, null, 2)}\n`;
-            await writeAuthFileAtomic(sourceAuthCandidate, hostAuthText, async () => {
+            try {
                 await assertSourceAuthUnchanged(sourceAuthCandidate, sourceAuthIdentity, sourceAuthFingerprint);
-            });
-            await removeOwnedTempRoot();
-            const result = { ok: true, status: 'cleaned', outcome: 'refreshed_persisted', cleanup_required: false, blockers: [] };
-            applyCleanupProof(bridgeProof, result);
-            return result;
+                const hostAuth = { ...tempAuth, ...originalApiKeyFields };
+                const hostAuthText = `${JSON.stringify(hostAuth, null, 2)}\n`;
+                await writeAuthFileAtomic(sourceAuthCandidate, hostAuthText, async () => {
+                    await assertSourceAuthUnchanged(sourceAuthCandidate, sourceAuthIdentity, sourceAuthFingerprint);
+                });
+                await removeOwnedTempRoot();
+                const result = { ok: true, status: 'cleaned', outcome: 'refreshed_persisted', cleanup_required: false, blockers: [] };
+                applyCleanupProof(bridgeProof, result);
+                return result;
+            }
+            catch (error) {
+                if (String(error?.message || error) !== 'native_codex_auth_source_conflict')
+                    throw error;
+                const currentText = await readValidatedAuthFile(sourceAuthCandidate, {
+                    requirePrivateMode: true,
+                    requireSingleLink: true,
+                    errorPrefix: 'native_codex_auth_source'
+                });
+                const currentAuth = parseStrictChatGptAuth(currentText);
+                const sameAccount = String(currentAuth.tokens?.account_id || '') === String(tempAuth.tokens?.account_id || '');
+                const hostRefreshedAt = Date.parse(String(currentAuth.last_refresh || ''));
+                const oursRefreshedAt = Date.parse(String(tempAuth.last_refresh || ''));
+                const hostWins = !sameAccount
+                    || !Number.isFinite(oursRefreshedAt)
+                    || (Number.isFinite(hostRefreshedAt) && hostRefreshedAt >= oursRefreshedAt);
+                if (hostWins) {
+                    await removeOwnedTempRoot();
+                    const result = { ok: true, status: 'cleaned', outcome: 'host_newer_kept', cleanup_required: false, blockers: [] };
+                    applyCleanupProof(bridgeProof, result);
+                    return result;
+                }
+                const currentStat = await fsp.lstat(sourceAuthCandidate);
+                const retryIdentity = { dev: currentStat.dev, ino: currentStat.ino };
+                const retryFingerprint = fingerprintText(currentText);
+                const mergedAuth = { ...currentAuth, tokens: tempAuth.tokens, last_refresh: tempAuth.last_refresh };
+                await writeAuthFileAtomic(sourceAuthCandidate, `${JSON.stringify(mergedAuth, null, 2)}\n`, async () => {
+                    await assertSourceAuthUnchanged(sourceAuthCandidate, retryIdentity, retryFingerprint);
+                });
+                await removeOwnedTempRoot();
+                const result = { ok: true, status: 'cleaned', outcome: 'refreshed_persisted_after_conflict', cleanup_required: false, blockers: [] };
+                applyCleanupProof(bridgeProof, result);
+                return result;
+            }
         }
         catch (error) {
             const reason = String(error?.message || error || 'native_codex_auth_cleanup_failed');

package/dist/core/codex-lb/bridge-contracts.js

@@ -1,2 +1,3 @@
 export const MANAGED_ROUTING_RUNTIME = 'desktop-bridge';
 export const BRIDGE_PROVIDER_IDS = ['codex-lb', 'openrouter'];
+export const BRIDGE_OFFICIAL_ROUTE_ID = 'openai';

package/dist/core/codex-lb/desktop-bridge/header-policy.js

@@ -54,6 +54,44 @@ export function buildProviderUpstreamHeaders(inbound, context, upstreamHost) {
     injectCredential(result, context.providerId, context.authTransport, context.credential);
     return result;
 }
+const OFFICIAL_PASSTHROUGH_STRIP = new Set([
+    'forwarded', 'proxy-authorization', 'x-api-key', 'x-codex-lb-api-key',
+    'x-forwarded-for', 'x-forwarded-host', 'x-forwarded-port', 'x-forwarded-proto', 'x-real-ip',
+    'host',
+]);
+export function buildOfficialPassthroughHeaders(inbound, upstreamHost) {
+    const result = {};
+    const dynamic = connectionTokens(inbound);
+    for (const [rawName, rawValue] of Object.entries(inbound)) {
+        if (rawValue === undefined)
+            continue;
+        const name = rawName.toLowerCase();
+        if (HOP_BY_HOP.has(name) || dynamic.has(name))
+            continue;
+        if (name.startsWith(INTERNAL_PREFIX))
+            continue;
+        if (OFFICIAL_PASSTHROUGH_STRIP.has(name))
+            continue;
+        result[name] = rawValue;
+    }
+    result.host = upstreamHost;
+    if (result['x-codex-lb-api-key'] !== undefined)
+        throw new DesktopBridgeError('bridge_provider_credential_invalid');
+    return result;
+}
+export function buildOfficialPassthroughWebSocketHeaders(inbound, upstreamHost) {
+    const result = buildOfficialPassthroughHeaders(inbound, upstreamHost);
+    for (const [rawName, rawValue] of Object.entries(inbound)) {
+        if (rawValue === undefined)
+            continue;
+        const name = rawName.toLowerCase();
+        if (WEBSOCKET_HEADER_ALLOWLIST.has(name))
+            result[name] = rawValue;
+    }
+    result.connection = 'Upgrade';
+    result.upgrade = 'websocket';
+    return result;
+}
 export function buildProviderWebSocketHeaders(inbound, context, upstreamHost) {
     const result = buildProviderUpstreamHeaders(inbound, context, upstreamHost);
     for (const [rawName, rawValue] of Object.entries(inbound)) {

package/dist/core/codex-lb/desktop-bridge/http-forward.js

@@ -2,7 +2,8 @@ import http, {} from 'node:http';
 import https from 'node:https';
 import zlib from 'node:zlib';
 import { pipeline } from 'node:stream/promises';
-import { buildProviderUpstreamHeaders, rewriteResponseHeaders } from './header-policy.js';
+import { BRIDGE_OFFICIAL_ROUTE_ID } from '../bridge-contracts.js';
+import { buildOfficialPassthroughHeaders, buildProviderUpstreamHeaders, rewriteResponseHeaders } from './header-policy.js';
 import { createDesktopBridgeRejectionLogger } from './rejection-log.js';
 import { resolveAndBindDesktopBridgeRouteContext, resolveCodexSessionIdentity, resolveDesktopBridgeTarget, safeBridgeErrorCode, singleBridgeHeader } from './security.js';
 import { desktopBridgeListenOrigin } from './state.js';
@@ -60,6 +61,8 @@ async function readBoundedBody(req, maximum) {
     return Buffer.concat(chunks);
 }
 async function resolveCredential(config, route) {
+    if (route.provider_id === BRIDGE_OFFICIAL_ROUTE_ID)
+        throw new DesktopBridgeError('bridge_provider_route_unavailable');
     const provider = config.providers[route.provider_id];
     if (!provider)
         throw new DesktopBridgeError('bridge_provider_route_unavailable');
@@ -107,7 +110,7 @@ export async function prepareDesktopBridgeRequest(req, config) {
         payload.model = route.upstream_model;
         body = Buffer.from(JSON.stringify(payload));
     }
-    const credential = await resolveCredential(config, route);
+    const credential = route.provider_id === BRIDGE_OFFICIAL_ROUTE_ID ? null : await resolveCredential(config, route);
     return { body, route, credential, contentEncodingStripped };
 }
 function connectTimeout(request, config) {
@@ -251,21 +254,30 @@ class StalePooledSocketFailure extends Error {
 export async function forwardHttp(req, res, config, prepared, authenticatedLocalBaseUrl = desktopBridgeListenOrigin(config)) {
     try {
         const request = prepared || await prepareDesktopBridgeRequest(req, config);
-        const provider = config.providers[request.route.provider_id];
-        if (!provider)
+        const official = request.route.provider_id === BRIDGE_OFFICIAL_ROUTE_ID;
+        const provider = official ? null : config.providers[request.route.provider_id];
+        if (!official && !provider)
             throw new DesktopBridgeError('bridge_provider_route_unavailable');
-        const target = resolveDesktopBridgeTarget(req.url, provider.remote);
-        const transport = provider.remote.secure ? https : http;
-        const headers = buildProviderUpstreamHeaders(req.headers, {
-            providerId: provider.provider_id, authTransport: provider.auth_transport, credential: request.credential,
-        }, target.host);
+        const remote = official ? config.officialRemote : provider?.remote;
+        if (!remote)
+            throw new DesktopBridgeError('bridge_official_passthrough_unavailable');
+        const upstreamBaseUrl = official ? remote.baseUrl : provider.base_url;
+        if (!official && !request.credential)
+            throw new DesktopBridgeError('bridge_provider_credential_invalid');
+        const target = resolveDesktopBridgeTarget(req.url, remote);
+        const transport = remote.secure ? https : http;
+        const headers = official
+            ? buildOfficialPassthroughHeaders(req.headers, target.host)
+            : buildProviderUpstreamHeaders(req.headers, {
+                providerId: provider.provider_id, authTransport: provider.auth_transport, credential: request.credential,
+            }, target.host);
         if (request.body)
             headers['content-length'] = String(request.body.length);
         else
             delete headers['content-length'];
         if (request.contentEncodingStripped)
             delete headers['content-encoding'];
-        const agent = upstreamAgent(provider.remote.secure, `${provider.remote.address}:${provider.remote.port}`, config.idleTimeoutMs);
+        const agent = upstreamAgent(remote.secure, `${remote.address}:${remote.port}`, config.idleTimeoutMs);
         const replayable = Buffer.isBuffer(request.body);
         const attempt = (useFreshConnection, canReplay) => new Promise((resolve, reject) => {
             let responseStarted = false;
@@ -281,10 +293,10 @@ export async function forwardHttp(req, res, config, prepared, authenticatedLocal
                 error ? reject(error) : resolve();
             };
             const upstream = transport.request({
-                protocol: target.protocol, hostname: provider.remote.address, family: provider.remote.family,
-                port: provider.remote.port, method: req.method, path: `${target.pathname}${target.search}`, headers,
+                protocol: target.protocol, hostname: remote.address, family: remote.family,
+                port: remote.port, method: req.method, path: `${target.pathname}${target.search}`, headers,
                 agent: useFreshConnection ? false : agent,
-                ...(provider.remote.tlsServername ? { servername: provider.remote.tlsServername } : {}),
+                ...(remote.tlsServername ? { servername: remote.tlsServername } : {}),
             });
             connectTimeout(upstream, config);
             upstream.setTimeout(config.idleTimeoutMs, () => upstream.destroy(new DesktopBridgeError('bridge_upstream_idle_timeout')));
@@ -299,6 +311,36 @@ export async function forwardHttp(req, res, config, prepared, authenticatedLocal
             });
             upstream.once('response', (response) => {
                 const statusCode = response.statusCode || 502;
+                if (official) {
+                    if (statusCode >= 400 && TRANSIENT_UPSTREAM_STATUSES.has(statusCode) && replayable && canReplay) {
+                        response.resume();
+                        responseStarted = true;
+                        finish(new StalePooledSocketFailure(new DesktopBridgeError('bridge_upstream_transient_mislabel')));
+                        return;
+                    }
+                    if (statusCode >= 400) {
+                        logHttpRejection({
+                            code: `bridge_upstream_status_${statusCode}`,
+                            transport: 'http',
+                            ...(req.method === undefined ? {} : { method: req.method }),
+                            ...(req.url === undefined ? {} : { url: req.url }),
+                            status: statusCode,
+                            provider_id: BRIDGE_OFFICIAL_ROUTE_ID,
+                            public_model: request.route.public_model,
+                        });
+                    }
+                    responseStarted = true;
+                    try {
+                        res.writeHead(statusCode, rewriteResponseHeaders(response.headers, upstreamBaseUrl, authenticatedLocalBaseUrl));
+                    }
+                    catch (error) {
+                        response.destroy(error instanceof Error ? error : undefined);
+                        finish(error);
+                        return;
+                    }
+                    void pipeline(response, res).then(() => finish(), finish);
+                    return;
+                }
                 if (statusCode >= 400) {
                     void readRedactedUpstreamError(response).then(({ upstreamCode, upstreamType }) => {
                         const transientMislabel = isTransientUpstreamFailure(statusCode, upstreamType, upstreamCode);
@@ -323,7 +365,7 @@ export async function forwardHttp(req, res, config, prepared, authenticatedLocal
                             public_model: request.route.public_model,
                         });
                         responseStarted = true;
-                        const responseHeaders = rewriteResponseHeaders(response.headers, provider.base_url, authenticatedLocalBaseUrl);
+                        const responseHeaders = rewriteResponseHeaders(response.headers, upstreamBaseUrl, authenticatedLocalBaseUrl);
                         responseHeaders['content-length'] = String(body.length);
                         delete responseHeaders['transfer-encoding'];
                         if (transientMislabel)
@@ -337,7 +379,7 @@ export async function forwardHttp(req, res, config, prepared, authenticatedLocal
                 }
                 responseStarted = true;
                 try {
-                    res.writeHead(statusCode, rewriteResponseHeaders(response.headers, provider.base_url, authenticatedLocalBaseUrl));
+                    res.writeHead(statusCode, rewriteResponseHeaders(response.headers, upstreamBaseUrl, authenticatedLocalBaseUrl));
                 }
                 catch (error) {
                     response.destroy(error instanceof Error ? error : undefined);
@@ -365,7 +407,7 @@ export async function forwardHttp(req, res, config, prepared, authenticatedLocal
                 remainingReplays -= 1;
                 if (!useFreshConnection) {
                     agent.destroy();
-                    upstreamAgents.delete(`${provider.remote.secure ? 'https' : 'http'}:${provider.remote.address}:${provider.remote.port}`);
+                    upstreamAgents.delete(`${remote.secure ? 'https' : 'http'}:${remote.address}:${remote.port}`);
                 }
                 logHttpRejection({
                     code: `bridge_upstream_socket_stale_replayed:${underlyingErrorCode(error.reason) || 'unknown'}`,

package/dist/core/codex-lb/desktop-bridge/rejection-log.js

@@ -33,6 +33,7 @@ export function createDesktopBridgeRejectionLogger(options = {}) {
             write(`${JSON.stringify({
                 schema: DESKTOP_BRIDGE_LOG_SCHEMA,
                 sks_version: PACKAGE_VERSION,
+                at: new Date(now()).toISOString(),
                 secret_fields_redacted: true,
                 ...payload,
             })}\n`);

package/dist/core/codex-lb/desktop-bridge/security.js

@@ -1,5 +1,6 @@
 import dns from 'node:dns/promises';
 import net from 'node:net';
+import { BRIDGE_OFFICIAL_ROUTE_ID } from '../bridge-contracts.js';
 import { canonicalizeBridgeModelId, normalizeBridgeUpstreamModelId, } from '../route-index.js';
 import { DESKTOP_BRIDGE_CLIENT_PATH_PREFIX, DesktopBridgeError } from './types.js';
 const MIN_HIGH_PORT = 49_152;
@@ -150,6 +151,19 @@ function canonicalPublicModel(value) {
         throw new DesktopBridgeError('catalog_model_route_missing');
     return model;
 }
+export function desktopBridgeOfficialPassthroughEnabled(config) {
+    return Boolean(config.officialPassthrough?.baseUrl);
+}
+function officialRouteContext(publicModel, policy, upstreamModel) {
+    return {
+        provider_id: BRIDGE_OFFICIAL_ROUTE_ID,
+        public_model: publicModel,
+        upstream_model: upstreamModel || publicModel,
+        catalog_generation: policy.catalog_generation,
+        route_policy_generation: policy.policy_generation,
+        session_pin: null,
+    };
+}
 export function resolveBridgeRequestRoute(request, policy, pins) {
     const publicModel = canonicalPublicModel(request.public_model);
     const sessionId = request.session_id ? canonicalSessionId(request.session_id) : null;
@@ -179,6 +193,8 @@ export function resolveBridgeRequestRoute(request, policy, pins) {
     const route = policy.model_routes[publicModel];
     if (!route)
         throw new DesktopBridgeError('catalog_model_route_missing');
+    if (route.provider_id === BRIDGE_OFFICIAL_ROUTE_ID)
+        return officialRouteContext(publicModel, policy, route.upstream_model);
     const nextPin = sessionId ? {
         thread_id: sessionId,
         provider_id: route.provider_id,
@@ -199,8 +215,36 @@ export function resolveBridgeRequestRoute(request, policy, pins) {
 }
 export function assertDesktopBridgeRouteContext(request, config) {
     const resolver = config.resolveRequestRoute || resolveBridgeRequestRoute;
-    const route = resolver(request, config.routePolicy, config.providerSessionPins);
     const policy = config.routePolicy;
+    let route;
+    try {
+        route = resolver(request, policy, config.providerSessionPins);
+    }
+    catch (error) {
+        if (desktopBridgeOfficialPassthroughEnabled(config)
+            && error instanceof DesktopBridgeError
+            && (error.code === 'catalog_model_route_missing' || error.code === 'session_pin_route_unavailable')) {
+            const model = canonicalizeBridgeModelId(request.public_model) || '';
+            const live = model ? policy.model_routes[model] : undefined;
+            if (!live || live.provider_id === BRIDGE_OFFICIAL_ROUTE_ID) {
+                route = officialRouteContext(model, policy, live?.upstream_model);
+            }
+            else
+                throw error;
+        }
+        else
+            throw error;
+    }
+    if (route.provider_id === BRIDGE_OFFICIAL_ROUTE_ID) {
+        if (!desktopBridgeOfficialPassthroughEnabled(config))
+            throw new DesktopBridgeError('bridge_official_passthrough_unavailable');
+        if (route.catalog_generation !== policy.catalog_generation || route.route_policy_generation !== policy.policy_generation) {
+            throw new DesktopBridgeError('session_pin_route_unavailable');
+        }
+        if (route.session_pin)
+            throw new DesktopBridgeError('bridge_session_pin_invalid');
+        return route;
+    }
     const expected = policy.model_routes[route.public_model];
     if (!expected || expected.provider_id !== route.provider_id || expected.upstream_model !== route.upstream_model) {
         throw new DesktopBridgeError('catalog_model_route_missing');
@@ -399,9 +443,12 @@ function assertRegistryAndPolicy(config, registry) {
     if (policy.schema !== 'sks.bridge-routing-policy.v1' || policy.fallback !== 'none' || !policy.catalog_generation || !policy.policy_generation) {
         throw new DesktopBridgeError('bridge_route_policy_invalid');
     }
+    const officialConfigured = desktopBridgeOfficialPassthroughEnabled(config);
     for (const [model, route] of Object.entries(policy.model_routes)) {
+        const routeTargetAllowed = ids.includes(route.provider_id)
+            || (route.provider_id === BRIDGE_OFFICIAL_ROUTE_ID && officialConfigured);
         if (canonicalizeBridgeModelId(model) !== model
-            || !ids.includes(route.provider_id)
+            || !routeTargetAllowed
             || normalizeBridgeUpstreamModelId(route.upstream_model) !== route.upstream_model) {
             throw new DesktopBridgeError('bridge_route_policy_invalid');
         }
@@ -460,6 +507,8 @@ export function validateDesktopBridgeConfig(config) {
         throw new DesktopBridgeError('bridge_client_capability_invalid');
     if (typeof config.resolveProviderCredential !== 'function')
         throw new DesktopBridgeError('bridge_provider_credential_resolver_missing');
+    if (config.officialPassthrough)
+        validateRemoteUrl(config.officialPassthrough.baseUrl);
     assertRegistryAndPolicy(config, config.providerRegistry);
     if (!Object.values(config.providerRegistry.providers).some((provider) => provider.enabled)) {
         throw new DesktopBridgeError('bridge_provider_registry_no_enabled_provider');
@@ -475,7 +524,10 @@ export async function prepareDesktopBridgeConfig(config, lookup = defaultLookup)
         return [id, prepared];
     }));
     const providers = Object.fromEntries(entries);
-    return { ...config, providers };
+    const officialRemote = config.officialPassthrough
+        ? await resolveDesktopBridgeRemoteTarget(config.officialPassthrough.baseUrl, lookup)
+        : null;
+    return { ...config, providers, officialRemote };
 }
 export function validatePreparedDesktopBridgeConfig(config) {
     validateDesktopBridgeConfig(config);

package/dist/core/codex-lb/desktop-bridge/types.js

@@ -12,6 +12,7 @@ export const DESKTOP_BRIDGE_ALLOWED_PATH_PREFIXES = [
     '/api/v1/',
     '/v1/',
 ];
+export const DESKTOP_BRIDGE_OFFICIAL_UPSTREAM_BASE_URL = 'https://chatgpt.com/backend-api/codex';
 export class DesktopBridgeError extends Error {
     code;
     constructor(code, options) {

package/dist/core/codex-lb/desktop-bridge/websocket-forward.js

@@ -1,10 +1,11 @@
 import { createHash, randomBytes } from 'node:crypto';
 import net from 'node:net';
 import tls from 'node:tls';
-import { buildProviderWebSocketHeaders } from './header-policy.js';
+import { BRIDGE_OFFICIAL_ROUTE_ID } from '../bridge-contracts.js';
+import { buildOfficialPassthroughWebSocketHeaders, buildProviderWebSocketHeaders } from './header-policy.js';
 import { createDesktopBridgeRejectionLogger } from './rejection-log.js';
 import { rewriteLocationHeader } from './location-rewrite.js';
-import { resolveAndBindDesktopBridgeRouteContext, resolveCodexSessionIdentity, resolveDesktopBridgeTarget, safeBridgeErrorCode, singleBridgeHeader, canonicalSessionId } from './security.js';
+import { desktopBridgeOfficialPassthroughEnabled, resolveAndBindDesktopBridgeRouteContext, resolveCodexSessionIdentity, resolveDesktopBridgeTarget, safeBridgeErrorCode, singleBridgeHeader, canonicalSessionId } from './security.js';
 import { desktopBridgeListenOrigin } from './state.js';
 import { DESKTOP_BRIDGE_DIAGNOSTIC_PROTOCOL, DesktopBridgeError, } from './types.js';
 const MAX_HEAD = 64 * 1024;
@@ -82,7 +83,7 @@ export async function prepareDesktopBridgeWebSocketRequest(req, config) {
     const sessionIdentity = resolveCodexSessionIdentity(req.headers);
     const pinnedModel = websocketPinnedModel(sessionIdentity.thread_id, config);
     const publicModel = singleBridgeHeader(req.headers, 'x-sks-model') || pinnedModel || '';
-    if (!publicModel) {
+    if (!publicModel && !(desktopBridgeOfficialPassthroughEnabled(config) && config.officialRemote)) {
         throw new DesktopBridgeError('bridge_websocket_route_unresolvable');
     }
     const route = await resolveAndBindDesktopBridgeRouteContext({
@@ -91,6 +92,8 @@ export async function prepareDesktopBridgeWebSocketRequest(req, config) {
         pathname: new URL(req.url || '/', 'http://bridge.invalid').pathname,
         transport: 'websocket', headers: req.headers,
     }, config);
+    if (route.provider_id === BRIDGE_OFFICIAL_ROUTE_ID)
+        return { route, provider: null, credential: null };
     const provider = config.providers[route.provider_id];
     if (!provider)
         throw new DesktopBridgeError('bridge_provider_route_unavailable');
@@ -142,11 +145,18 @@ export async function forwardWebSocket(req, client, head, config, authenticatedL
         writeUpgradeFailure(client, error, req);
         return;
     }
-    const { provider, credential } = prepared;
-    const target = resolveDesktopBridgeTarget(req.url, provider.remote);
-    const upstream = provider.remote.secure
-        ? tls.connect({ host: provider.remote.address, port: provider.remote.port, ...(provider.remote.tlsServername ? { servername: provider.remote.tlsServername } : {}) })
-        : net.connect({ host: provider.remote.address, port: provider.remote.port, family: provider.remote.family });
+    const { provider, credential, route } = prepared;
+    const official = route.provider_id === BRIDGE_OFFICIAL_ROUTE_ID;
+    const remote = official ? config.officialRemote : provider?.remote;
+    if (!remote) {
+        writeUpgradeFailure(client, new DesktopBridgeError(official ? 'bridge_official_passthrough_unavailable' : 'bridge_provider_route_unavailable'), req);
+        return;
+    }
+    const upstreamBaseUrl = official ? remote.baseUrl : provider.base_url;
+    const target = resolveDesktopBridgeTarget(req.url, remote);
+    const upstream = remote.secure
+        ? tls.connect({ host: remote.address, port: remote.port, ...(remote.tlsServername ? { servername: remote.tlsServername } : {}) })
+        : net.connect({ host: remote.address, port: remote.port, family: remote.family });
     const key = String(req.headers['sec-websocket-key'] || '');
     const requestedProtocol = String(req.headers['sec-websocket-protocol'] || '').split(',')[0]?.trim() || null;
     let connected = false;
@@ -165,7 +175,9 @@ export async function forwardWebSocket(req, client, head, config, authenticatedL
         const clientSocket = client;
         if (typeof clientSocket.setKeepAlive === 'function')
             clientSocket.setKeepAlive(true, 30_000);
-        const headers = buildProviderWebSocketHeaders(req.headers, { providerId: provider.provider_id, authTransport: provider.auth_transport, credential }, target.host);
+        const headers = official
+            ? buildOfficialPassthroughWebSocketHeaders(req.headers, target.host)
+            : buildProviderWebSocketHeaders(req.headers, { providerId: provider.provider_id, authTransport: provider.auth_transport, credential: credential }, target.host);
         upstream.write([`${req.method || 'GET'} ${target.pathname}${target.search} HTTP/1.1`, ...serializeHeaders(headers), '', ''].join('\r\n'));
         if (head.length)
             upstream.write(head);
@@ -183,7 +195,7 @@ export async function forwardWebSocket(req, client, head, config, authenticatedL
             const remaining = response.subarray(boundary + 4);
             try {
                 validateUpgrade(raw, key, requestedProtocol);
-                client.write(rewriteUpgradeResponseHead(raw, provider.base_url, authenticatedLocalBaseUrl));
+                client.write(rewriteUpgradeResponseHead(raw, upstreamBaseUrl, authenticatedLocalBaseUrl));
                 if (remaining.length)
                     client.write(remaining);
             }
@@ -196,7 +208,7 @@ export async function forwardWebSocket(req, client, head, config, authenticatedL
         };
         upstream.on('data', onData);
     };
-    if (provider.remote.secure)
+    if (remote.secure)
         upstream.once('secureConnect', onConnected);
     else
         upstream.once('connect', onConnected);

package/dist/core/codex-lb/desktop-bridge-migration/receipt.js

@@ -1,8 +1,6 @@
 export function authSemanticIdentityPreserved(before, after) {
     if (before.path !== after.path || before.exists !== after.exists)
         return false;
-    if (before.sha256 !== after.sha256)
-        return false;
     const beforeIsOAuth = before.mode === 'chatgpt_oauth' || before.mode === 'mixed';
     const afterIsOAuth = after.mode === 'chatgpt_oauth' || after.mode === 'mixed';
     if (beforeIsOAuth || afterIsOAuth) {
@@ -11,7 +9,7 @@ export function authSemanticIdentityPreserved(before, after) {
             && before.semantic_fingerprint !== null
             && before.semantic_fingerprint === after.semantic_fingerprint;
     }
-    return true;
+    return before.sha256 === after.sha256;
 }
 export function buildDesktopBridgeMigrationReceipt(input) {
     const common = {

package/dist/core/codex-lb/desktop-bridge-migration/retired-runtime-cleanup.js

@@ -17,7 +17,7 @@ const SETTINGS_V1_KEYS = new Set([
 const SETTINGS_V2_KEYS = new Set([
     'schema', 'listen_host', 'listen_port', 'provider_registry', 'route_policy',
     'provider_session_pins', 'client_capability_sha256', 'allowed_origins',
-    'connect_timeout_ms', 'idle_timeout_ms',
+    'connect_timeout_ms', 'idle_timeout_ms', 'official_passthrough',
 ]);
 const TRANSFERABLE_V1_KEYS = [
     'listen_host', 'listen_port', 'allowed_origins', 'connect_timeout_ms', 'idle_timeout_ms',

package/dist/core/codex-lb/desktop-bridge-migration.js

@@ -90,8 +90,7 @@ async function migrateDesktopBridgeConfigUnlocked(input) {
         const authPreserved = authSemanticIdentityPreserved(authBefore, authAfter);
         const configSha = sha256(currentConfig);
         const configUnchanged = await fileSha256OrMissing(configPath) === configSha;
-        const authBytesUnchanged = authBefore.sha256 === authAfter.sha256;
-        if (!authPreserved || !configUnchanged || !authBytesUnchanged) {
+        if (!authPreserved || !configUnchanged) {
             return {
                 ...baseResult,
                 ok: false,
@@ -101,8 +100,7 @@ async function migrateDesktopBridgeConfigUnlocked(input) {
                 auth_semantic_identity_preserved: authPreserved,
                 blockers: [
                     ...(!configUnchanged ? ['desktop_bridge_config_changed_during_noop'] : []),
-                    ...(!authPreserved ? ['desktop_oauth_identity_changed'] : []),
-                    ...(authPreserved && !authBytesUnchanged ? ['desktop_auth_changed_during_noop'] : [])
+                    ...(!authPreserved ? ['desktop_oauth_identity_changed'] : [])
                 ]
             };
         }

package/dist/core/codex-lb/desktop-controller-v3/catalog.js

@@ -5,12 +5,12 @@ import { listOpenRouterModels } from '../../providers/openrouter/openrouter-acco
 import { buildCombinedBridgeCatalog, readActiveCombinedBridgeCatalog, stageCombinedBridgeCatalog } from '../combined-catalog.js';
 import { COMBINED_BRIDGE_CATALOG_TTL_MS } from '../combined-catalog/contracts.js';
 import { codexLbEnvPath, codexLbMetadataPath, loadCodexLbEnv, readCodexLbModelCatalog } from '../codex-lb-env.js';
-import { bootstrapExistingDesktopBridgeService, desktopBridgeServicePaths, desktopBridgeServiceStatus, resolveDesktopBridgeActivationSettings } from '../desktop-service.js';
+import { bootstrapExistingDesktopBridgeService, desktopBridgeServicePaths, desktopBridgeServiceStatus, readDesktopBridgeServiceSettings, resolveDesktopBridgeActivationSettings, resolveEffectiveOfficialModelsMode } from '../desktop-service.js';
 import { inspectHistoricalDesktopBridgeIntent, migrateDesktopBridgeConfig } from '../desktop-bridge-migration.js';
 import { rollbackDesktopBridgeUnificationReceipt } from '../migration-receipt.js';
 import { recordProviderCredentialValidation } from '../provider-credentials.js';
 import { bridgeProviderRegistryPath, buildStoredBridgeProviderRegistry, loadStoredBridgeProviderRegistry, resolveBridgeProviderRegistry, serializeStoredBridgeProviderRegistry } from '../provider-registry.js';
-import { buildBridgeRoutingPolicy, readBridgeRoutingPolicy } from '../provider-route-policy.js';
+import { applyOfficialModelPassthrough, buildBridgeRoutingPolicy, readBridgeRoutingPolicy } from '../provider-route-policy.js';
 import { sha256Stable } from '../route-index.js';
 import { bridgeBaseUrl, commandResult, controllerEnv, controllerPaths, nowIso, providerCode, providerRegistrySnapshot, resolveRawCredentials, resolveValidatedCredentials, safeCode, serializedSettings, stringArray, timeoutMs, unique } from './shared.js';
 import { desktopBridgeStatusV3 } from './status.js';
@@ -76,12 +76,14 @@ export async function syncCatalogInternal(options) {
         ? previousDefault
         : historicalDefault && readyProviders.includes(historicalDefault) ? historicalDefault
             : readyProviders.length === 1 ? readyProviders[0] || null : null;
-    const policy = buildBridgeRoutingPolicy({
+    const persistedSettings = await readDesktopBridgeServiceSettings(desktopBridgeServicePaths(paths.home).settings_path).catch(() => null);
+    const officialModelsMode = await resolveEffectiveOfficialModelsMode(persistedSettings?.official_passthrough, { home: paths.home, authPath: paths.authPath });
+    const policy = applyOfficialModelPassthrough(buildBridgeRoutingPolicy({
         route_index: build.route_index,
         catalog_generation: build.catalog.generation,
         default_provider_id: defaultProvider,
         changed_at: nowIso(options)
-    });
+    }), { mode: officialModelsMode, changedAt: nowIso(options) });
     let settings;
     let managedBridgeBaseUrl;
     try {

package/dist/core/codex-lb/desktop-controller-v3/lifecycle-commands.js

@@ -2,10 +2,11 @@ import path from 'node:path';
 import { removeDesktopBridgeManagedConfig } from '../../../cli/install-helpers-codex-lb-config.js';
 import { safeWriteCodexConfigToml } from '../../codex-runtime/codex-desktop-config-policy.js';
 import { exists, readText } from '../../fsx.js';
-import { bootstrapExistingDesktopBridgeService, desktopBridgeServiceStatus, installAndStartDesktopBridgeService, stopDesktopBridgeService } from '../desktop-service.js';
+import { bootstrapExistingDesktopBridgeService, desktopBridgeServicePaths, desktopBridgeServiceStatus, installAndStartDesktopBridgeService, readDesktopBridgeServiceSettings, resolveEffectiveOfficialModelsMode, stopDesktopBridgeService } from '../desktop-service.js';
 import { rollbackDesktopBridgeUnificationReceipt } from '../migration-receipt.js';
+import { DESKTOP_BRIDGE_OFFICIAL_UPSTREAM_BASE_URL } from '../desktop-bridge/index.js';
 import { resolveBridgeRequestRoute } from '../request-route-resolver.js';
-import { setBridgeRoutingDefault, writeBridgeRoutingPolicy } from '../provider-route-policy.js';
+import { applyOfficialModelPassthrough, buildBridgeRoutingPolicy, setBridgeRoutingDefault, writeBridgeRoutingPolicy } from '../provider-route-policy.js';
 import { syncCatalogInternal } from './catalog.js';
 import { commandResult, controllerPaths, nowIso, persistRuntimeSettings, providerCode, providerRegistrySnapshot, stringArray } from './shared.js';
 import { desktopBridgeStatusV3, loadCore, statusFromCore } from './status.js';
@@ -70,6 +71,39 @@ export async function setDefaultProvider(providerId, options) {
     const status = await desktopBridgeStatusV3(options);
     return commandResult('route.set-default', true, status, { provider_id: providerId, policy_generation: policy.policy_generation }, [], options);
 }
+export async function setOfficialModelsMode(mode, options) {
+    const core = await loadCore(options);
+    if (!core.policy || !core.activeCatalog.ok)
+        throw new Error('bridge_route_policy_missing');
+    const settingsPath = options.settingsPath || desktopBridgeServicePaths(core.paths.home).settings_path;
+    const persisted = await readDesktopBridgeServiceSettings(settingsPath).catch(() => null);
+    const nextOfficial = {
+        enabled: persisted?.official_passthrough?.enabled ?? true,
+        base_url: persisted?.official_passthrough?.base_url || DESKTOP_BRIDGE_OFFICIAL_UPSTREAM_BASE_URL,
+        models: mode,
+    };
+    const effective = mode === 'auto'
+        ? await resolveEffectiveOfficialModelsMode(nextOfficial, { home: core.paths.home })
+        : mode;
+    const policy = effective === 'passthrough'
+        ? applyOfficialModelPassthrough(core.policy, { mode: 'passthrough', changedAt: nowIso(options) })
+        : buildBridgeRoutingPolicy({
+            route_index: core.activeCatalog.route_index,
+            catalog_generation: core.policy.catalog_generation,
+            default_provider_id: core.policy.default_provider_id,
+            changed_at: nowIso(options)
+        });
+    await writeBridgeRoutingPolicy(core.paths.routePolicyPath, policy, core.activeCatalog.route_index);
+    await persistRuntimeSettings({ ...core, policy, policyBlockers: [] }, {
+        ...options,
+        settings: { ...(options.settings || {}), official_passthrough: nextOfficial },
+    });
+    const status = await desktopBridgeStatusV3(options);
+    const officialModels = Object.entries(policy.model_routes)
+        .filter(([, route]) => route.provider_id === 'openai')
+        .map(([model]) => model);
+    return commandResult('route.official-models', true, status, { mode, effective_mode: effective, official_models: officialModels, policy_generation: policy.policy_generation }, [], options);
+}
 export async function explainRoute(model, options) {
     const core = await loadCore(options);
     if (!core.policy || !core.activeCatalog.ok)

package/dist/core/codex-lb/desktop-controller-v3.js

@@ -1,5 +1,5 @@
 import { listSelectableModels, selectExposedModels, syncCatalog } from './desktop-controller-v3/catalog.js';
-import { explainRoute, ensureDesktopBridge, repairDesktopBridge, rollbackDesktopBridge, setDefaultProvider, unmanageDesktopBridge } from './desktop-controller-v3/lifecycle-commands.js';
+import { explainRoute, ensureDesktopBridge, repairDesktopBridge, rollbackDesktopBridge, setDefaultProvider, setOfficialModelsMode, unmanageDesktopBridge } from './desktop-controller-v3/lifecycle-commands.js';
 import { configureProvider, removeCredential, setProviderState, validateProvider } from './desktop-controller-v3/provider-commands.js';
 import { commandResult, safeCode } from './desktop-controller-v3/shared.js';
 import { desktopBridgeStatusV3 } from './desktop-controller-v3/status.js';
@@ -56,6 +56,8 @@ export async function executeDesktopBridgeCommandV3(request, options = {}) {
             }
             if (request.operation === 'route.set-default')
                 return setDefaultProvider(request.provider_id, options);
+            if (request.operation === 'route.official-models')
+                return setOfficialModelsMode(request.mode, options);
             if (request.operation === 'route.explain')
                 return explainRoute(request.model, options);
             if (request.operation === 'unmanage')

package/dist/core/codex-lb/desktop-service.js

@@ -9,9 +9,11 @@ import { loadCodexLbEnv } from './codex-lb-env.js';
 import { resolveOpenRouterApiKey } from '../providers/openrouter/openrouter-secret-store.js';
 import { cleanupRetiredDesktopBridgeRuntime, prepareRetiredDesktopBridgeRuntime, } from './desktop-bridge-migration/retired-runtime-cleanup.js';
 import { canonicalizeBridgeModelId, normalizeBridgeUpstreamModelId, sha256Stable } from './route-index.js';
+import { captureCodexAuthSnapshot } from './desktop-auth-invariant.js';
+import { applyOfficialModelPassthrough, bridgeRoutePolicyPath, writeBridgeRoutingPolicy } from './provider-route-policy.js';
 import { desktopBridgeRuntimeVersion, desktopBridgeRuntimeVersionStale } from './desktop-bridge/state.js';
 import { PACKAGE_VERSION } from '../version.js';
-import { DESKTOP_BRIDGE_ALLOWED_PATH_PREFIXES, DESKTOP_BRIDGE_LAUNCHD_LABEL, desktopBridgeConfigGeneration, desktopBridgeLaunchdPlistPath, desktopBridgeProcessExists, desktopBridgeStatePath, getDesktopBridgeStatus, preflightDesktopBridge, readDesktopBridgeState, safeBridgeErrorCode, writeDesktopBridgeLaunchdPlist, selectAvailableDesktopBridgePort, startPreparedDesktopBridge, DESKTOP_BRIDGE_STATE_SCHEMA, DesktopBridgeError, } from './desktop-bridge/index.js';
+import { DESKTOP_BRIDGE_ALLOWED_PATH_PREFIXES, DESKTOP_BRIDGE_LAUNCHD_LABEL, desktopBridgeConfigGeneration, desktopBridgeLaunchdPlistPath, desktopBridgeProcessExists, desktopBridgeStatePath, getDesktopBridgeStatus, preflightDesktopBridge, readDesktopBridgeState, safeBridgeErrorCode, writeDesktopBridgeLaunchdPlist, selectAvailableDesktopBridgePort, startPreparedDesktopBridge, DESKTOP_BRIDGE_STATE_SCHEMA, DESKTOP_BRIDGE_OFFICIAL_UPSTREAM_BASE_URL, DesktopBridgeError, } from './desktop-bridge/index.js';
 export const DEFAULT_DESKTOP_BRIDGE_HOST = '127.0.0.1';
 export const DEFAULT_DESKTOP_BRIDGE_PORT = 49_152;
 export const DESKTOP_BRIDGE_SETTINGS_SCHEMA = 'sks.desktop-bridge-settings.v2';
@@ -159,7 +161,7 @@ export async function writeDesktopBridgeServiceSettings(file, settings) {
 }
 async function writeDesktopBridgeServiceSettingsUnlocked(file, settings) {
     const validated = validateDesktopBridgeServiceSettings(settings);
-    const persisted = { schema: validated.schema, listen_host: validated.listen_host, listen_port: validated.listen_port, provider_registry: validated.provider_registry, route_policy: validated.route_policy, provider_session_pins: validated.provider_session_pins, client_capability_sha256: validated.client_capability_sha256, allowed_origins: validated.allowed_origins, connect_timeout_ms: validated.connect_timeout_ms, idle_timeout_ms: validated.idle_timeout_ms };
+    const persisted = { schema: validated.schema, listen_host: validated.listen_host, listen_port: validated.listen_port, provider_registry: validated.provider_registry, route_policy: validated.route_policy, provider_session_pins: validated.provider_session_pins, client_capability_sha256: validated.client_capability_sha256, allowed_origins: validated.allowed_origins, connect_timeout_ms: validated.connect_timeout_ms, idle_timeout_ms: validated.idle_timeout_ms, official_passthrough: validated.official_passthrough };
     await writeTextAtomic(file, `${JSON.stringify(persisted, null, 2)}\n`, { mode: 0o600 });
     await fsp.chmod(file, 0o600);
 }
@@ -246,11 +248,13 @@ export async function resolveDesktopBridgeRuntimeConfig(options = {}) {
     if (!Object.keys(settings.route_policy.model_routes).length)
         throw new Error('catalog_model_route_missing');
     const enabledRoutes = new Set(Object.values(settings.route_policy.model_routes).map((route) => route.provider_id));
-    if (![...enabledRoutes].some((id) => credentials.registry.providers[id].credential_state === 'ready'))
+    const providerRouteIds = [...enabledRoutes].filter((id) => id === 'codex-lb' || id === 'openrouter');
+    const officialOnly = providerRouteIds.length === 0 && settings.official_passthrough.enabled;
+    if (!officialOnly && !providerRouteIds.some((id) => credentials.registry.providers[id].credential_state === 'ready'))
         throw new Error('desktop_bridge_provider_credentials_unavailable');
     const persistProviderSessionPins = options.persistProviderSessionPins
         || ((pins) => persistDesktopBridgeSessionPins(paths.settings_path, settings, pins));
-    const config = { providerRegistry: settings.provider_registry, routePolicy: settings.route_policy, providerSessionPins: settings.provider_session_pins, ...(options.resolveRequestRoute ? { resolveRequestRoute: options.resolveRequestRoute } : {}), persistProviderSessionPins, resolveProviderCredential: credentials.resolver, clientCapabilitySha256: settings.client_capability_sha256, listenHost: settings.listen_host, listenPort: settings.listen_port, allowedPathPrefixes: DESKTOP_BRIDGE_ALLOWED_PATH_PREFIXES, allowedOrigins: settings.allowed_origins, connectTimeoutMs: settings.connect_timeout_ms, idleTimeoutMs: settings.idle_timeout_ms };
+    const config = { providerRegistry: settings.provider_registry, routePolicy: settings.route_policy, providerSessionPins: settings.provider_session_pins, ...(options.resolveRequestRoute ? { resolveRequestRoute: options.resolveRequestRoute } : {}), persistProviderSessionPins, resolveProviderCredential: credentials.resolver, clientCapabilitySha256: settings.client_capability_sha256, listenHost: settings.listen_host, listenPort: settings.listen_port, allowedPathPrefixes: DESKTOP_BRIDGE_ALLOWED_PATH_PREFIXES, allowedOrigins: settings.allowed_origins, connectTimeoutMs: settings.connect_timeout_ms, idleTimeoutMs: settings.idle_timeout_ms, officialPassthrough: settings.official_passthrough.enabled ? { baseUrl: settings.official_passthrough.base_url } : null };
     const primary = credentials.sources['codex-lb'] || credentials.sources.openrouter;
     if (!primary)
         throw new Error('desktop_bridge_provider_credentials_unavailable');
@@ -434,24 +438,67 @@ async function installedPackageVersion() {
         return null;
     }
 }
+export const DESKTOP_BRIDGE_SKEW_RESTART_COOLDOWN_MS = 30 * 60_000;
+export function desktopBridgeSkewRestartSuppressed(marker, running, installed, nowMs) {
+    return Boolean(marker
+        && marker.running === running
+        && marker.installed === installed
+        && nowMs - Date.parse(marker.at) < DESKTOP_BRIDGE_SKEW_RESTART_COOLDOWN_MS);
+}
+async function readSkewRestartMarker(file) {
+    try {
+        const parsed = JSON.parse(await fsp.readFile(file, 'utf8'));
+        if (typeof parsed.running !== 'string' || typeof parsed.installed !== 'string' || !Number.isFinite(Date.parse(String(parsed.at))))
+            return null;
+        return { running: parsed.running, installed: parsed.installed, at: String(parsed.at) };
+    }
+    catch {
+        return null;
+    }
+}
+async function autoApplyOfficialModelsAtServe(runtime, home, options) {
+    const settings = runtime.settings;
+    const mode = await resolveEffectiveOfficialModelsMode(settings.official_passthrough, { home });
+    if (mode !== 'passthrough')
+        return;
+    const flipped = applyOfficialModelPassthrough(settings.route_policy, { mode: 'passthrough' });
+    if (flipped.policy_generation === settings.route_policy.policy_generation)
+        return;
+    const nextSettings = { ...settings, route_policy: flipped };
+    await writeDesktopBridgeServiceSettings(options.settingsPath || desktopBridgeServicePaths(home).settings_path, nextSettings);
+    await writeBridgeRoutingPolicy(bridgeRoutePolicyPath(path.join(path.resolve(home), '.codex')), flipped).catch(() => undefined);
+    settings.route_policy = flipped;
+    runtime.config.routePolicy = flipped;
+    process.stdout.write(`${JSON.stringify({ schema: 'sks.desktop-bridge-log.v2', event: 'sks.desktop_bridge.official_models_auto_applied', at: new Date().toISOString(), sks_version: PACKAGE_VERSION, mode: 'passthrough', policy_generation: flipped.policy_generation, secret_fields_redacted: true })}\n`);
+}
 export async function serveDesktopBridge(options = {}) {
     let handle = null;
     try {
         const runtime = await resolveDesktopBridgeRuntimeConfig(options);
+        const serveHome = options.home || options.env?.HOME || process.env.HOME || os.homedir();
+        await autoApplyOfficialModelsAtServe(runtime, serveHome, options);
         const supervised = desktopBridgeIsSupervised();
+        const skewMarkerPath = path.join(path.dirname(runtime.paths.state_path), 'desktop-bridge-skew-restart.json');
         handle = await startPreparedDesktopBridge(await preflightDesktopBridge(runtime.config), {
             statePath: runtime.paths.state_path,
             versionSkew: {
                 readInstalledVersion: installedPackageVersion,
                 onSkew: (installedVersion) => {
-                    process.stdout.write(`${JSON.stringify({ schema: 'sks.desktop-bridge-log.v2', event: 'sks.desktop_bridge.version_skew', running: PACKAGE_VERSION, installed: installedVersion, supervised, action: supervised ? 'restarting' : 'logged_only', secret_fields_redacted: true })}\n`);
-                    if (!supervised)
-                        return;
-                    void handle?.stop().catch(() => undefined).finally(() => process.exit(64));
+                    void (async () => {
+                        const marker = await readSkewRestartMarker(skewMarkerPath);
+                        const cooldownActive = desktopBridgeSkewRestartSuppressed(marker, PACKAGE_VERSION, installedVersion, Date.now());
+                        const action = !supervised ? 'logged_only' : cooldownActive ? 'suppressed_cooldown' : 'restarting';
+                        process.stdout.write(`${JSON.stringify({ schema: 'sks.desktop-bridge-log.v2', event: 'sks.desktop_bridge.version_skew', at: new Date().toISOString(), running: PACKAGE_VERSION, installed: installedVersion, supervised, action, secret_fields_redacted: true })}\n`);
+                        if (!supervised || cooldownActive)
+                            return;
+                        await writeTextAtomic(skewMarkerPath, `${JSON.stringify({ running: PACKAGE_VERSION, installed: installedVersion, at: new Date().toISOString() })}\n`, { mode: 0o600 }).catch(() => undefined);
+                        await handle?.stop().catch(() => undefined);
+                        process.exit(64);
+                    })();
                 },
             },
         });
-        process.stdout.write(`${JSON.stringify({ schema: 'sks.desktop-bridge-log.v2', event: 'sks.desktop_bridge.started', pid: handle.state.pid, process_generation: handle.state.schema === DESKTOP_BRIDGE_STATE_SCHEMA ? handle.state.process_generation : null, provider_registry_generation: runtime.config.providerRegistry?.generation, route_policy_generation: runtime.config.routePolicy?.policy_generation, secret_fields_redacted: true })}\n`);
+        process.stdout.write(`${JSON.stringify({ schema: 'sks.desktop-bridge-log.v2', event: 'sks.desktop_bridge.started', at: new Date().toISOString(), sks_version: PACKAGE_VERSION, pid: handle.state.pid, process_generation: handle.state.schema === DESKTOP_BRIDGE_STATE_SCHEMA ? handle.state.process_generation : null, provider_registry_generation: runtime.config.providerRegistry?.generation, route_policy_generation: runtime.config.routePolicy?.policy_generation, secret_fields_redacted: true })}\n`);
         await waitForShutdown(handle);
         return { schema: 'sks.desktop-bridge-serve.v1', ok: true, status: 'stopped', state: handle.state };
     }
@@ -470,7 +517,7 @@ function validateDesktopBridgeServiceSettings(value) {
     const input = row;
     if (input.schema !== DESKTOP_BRIDGE_SETTINGS_SCHEMA)
         throw new Error('desktop_bridge_settings_schema_invalid');
-    const allowedKeys = new Set(['schema', 'listen_host', 'listen_port', 'provider_registry', 'route_policy', 'provider_session_pins', 'client_capability_sha256', 'allowed_origins', 'connect_timeout_ms', 'idle_timeout_ms']);
+    const allowedKeys = new Set(['schema', 'listen_host', 'listen_port', 'provider_registry', 'route_policy', 'provider_session_pins', 'client_capability_sha256', 'allowed_origins', 'connect_timeout_ms', 'idle_timeout_ms', 'official_passthrough']);
     if (Object.keys(input).some((key) => !allowedKeys.has(key)))
         throw new Error('desktop_bridge_settings_unknown_field');
     const serialized = JSON.stringify(input);
@@ -502,7 +549,44 @@ function validateDesktopBridgeServiceSettings(value) {
         throw new Error('desktop_bridge_settings_connect_timeout_invalid');
     if (!Number.isFinite(idle) || idle < 1_000 || idle > 86_400_000)
         throw new Error('desktop_bridge_settings_idle_timeout_invalid');
-    return { schema: DESKTOP_BRIDGE_SETTINGS_SCHEMA, listen_host: host, listen_port: port, provider_registry: registry, route_policy: policy, provider_session_pins: pins, client_capability_sha256: clientCapabilitySha256, allowed_origins: [...new Set(origins)], connect_timeout_ms: connect, idle_timeout_ms: idle };
+    const officialPassthrough = validateOfficialPassthroughSettings(input.official_passthrough);
+    return { schema: DESKTOP_BRIDGE_SETTINGS_SCHEMA, listen_host: host, listen_port: port, provider_registry: registry, route_policy: policy, provider_session_pins: pins, client_capability_sha256: clientCapabilitySha256, allowed_origins: [...new Set(origins)], connect_timeout_ms: connect, idle_timeout_ms: idle, official_passthrough: officialPassthrough };
+}
+function validateOfficialPassthroughSettings(value) {
+    if (value === undefined || value === null) {
+        return { enabled: true, base_url: DESKTOP_BRIDGE_OFFICIAL_UPSTREAM_BASE_URL, models: 'auto' };
+    }
+    if (typeof value !== 'object' || Array.isArray(value))
+        throw new Error('desktop_bridge_settings_official_passthrough_invalid');
+    const row = value;
+    if (Object.keys(row).some((key) => key !== 'enabled' && key !== 'base_url' && key !== 'models'))
+        throw new Error('desktop_bridge_settings_official_passthrough_invalid');
+    const enabled = row.enabled === true;
+    const baseUrl = typeof row.base_url === 'string' && row.base_url.trim() ? row.base_url.trim() : DESKTOP_BRIDGE_OFFICIAL_UPSTREAM_BASE_URL;
+    try {
+        new URL(baseUrl);
+    }
+    catch {
+        throw new Error('desktop_bridge_settings_official_passthrough_invalid');
+    }
+    const models = row.models === 'passthrough' || row.models === 'gateway' || row.models === 'auto'
+        ? row.models
+        : row.models === undefined ? 'auto' : null;
+    if (models === null)
+        throw new Error('desktop_bridge_settings_official_passthrough_invalid');
+    return { enabled, base_url: baseUrl, models };
+}
+export async function resolveEffectiveOfficialModelsMode(official, input) {
+    if (official && official.enabled === false)
+        return 'gateway';
+    const models = official?.models || 'auto';
+    if (models === 'passthrough' || models === 'gateway')
+        return models;
+    const snapshot = await captureCodexAuthSnapshot({
+        home: input.home,
+        ...(input.authPath ? { authPath: input.authPath } : {}),
+    }).catch(() => null);
+    return snapshot && (snapshot.mode === 'chatgpt_oauth' || snapshot.mode === 'mixed') ? 'passthrough' : 'gateway';
 }
 function validateProviderSessionPins(value) {
     const pins = Array.isArray(value) ? value : [];

package/dist/core/codex-lb/provider-route-policy.js

@@ -1,6 +1,7 @@
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
+import { BRIDGE_OFFICIAL_ROUTE_ID } from './bridge-contracts.js';
 import { canonicalizeBridgeModelId, normalizeBridgeUpstreamModelId, sha256Stable } from './route-index.js';
 import { writeJsonAtomic } from '../fsx.js';
 import { withFileLock } from '../locks/file-lock.js';
@@ -58,6 +59,8 @@ export function validateBridgeRoutingPolicy(policy, routeIndex) {
         blockers.push('bridge_route_policy_model_invalid');
     if (routeIndex) {
         for (const [model, target] of Object.entries(canonical)) {
+            if (target.provider_id === BRIDGE_OFFICIAL_ROUTE_ID)
+                continue;
             const indexed = routeIndex.routes[model];
             if (!indexed || !sameTarget(indexed, target))
                 blockers.push('bridge_route_policy_route_index_mismatch');
@@ -101,7 +104,7 @@ function canonicalRoutes(routes) {
     for (const [model, target] of Object.entries(routes)) {
         const canonicalModel = canonicalizeBridgeModelId(model);
         const upstreamModel = normalizeBridgeUpstreamModelId(target.upstream_model);
-        if (!canonicalModel || !upstreamModel || !isProviderId(target.provider_id))
+        if (!canonicalModel || !upstreamModel || !isRouteTargetId(target.provider_id))
             continue;
         rows.push([canonicalModel, { provider_id: target.provider_id, upstream_model: upstreamModel }]);
     }
@@ -110,6 +113,32 @@ function canonicalRoutes(routes) {
 function isProviderId(value) {
     return value === 'codex-lb' || value === 'openrouter';
 }
+function isRouteTargetId(value) {
+    return isProviderId(value) || value === BRIDGE_OFFICIAL_ROUTE_ID;
+}
+export const OFFICIAL_MODEL_ID_PATTERN = /^(?:gpt-[0-9]|o[0-9]|codex-mini)/;
+export function applyOfficialModelPassthrough(policy, input = { mode: 'passthrough' }) {
+    if (input.mode === 'gateway')
+        return policy;
+    const routes = {};
+    for (const [model, target] of Object.entries(policy.model_routes)) {
+        routes[model] = OFFICIAL_MODEL_ID_PATTERN.test(model) && !model.includes(':')
+            ? { provider_id: BRIDGE_OFFICIAL_ROUTE_ID, upstream_model: model }
+            : target;
+    }
+    const semantic = {
+        default_provider_id: policy.default_provider_id,
+        fallback: 'none',
+        model_routes: canonicalRoutes(routes),
+        catalog_generation: policy.catalog_generation
+    };
+    return {
+        schema: 'sks.bridge-routing-policy.v1',
+        ...semantic,
+        policy_generation: sha256Stable(semantic),
+        changed_at: input.changedAt || new Date().toISOString()
+    };
+}
 function sameTarget(left, right) {
     return left.provider_id === right.provider_id && left.upstream_model === right.upstream_model;
 }

package/dist/core/codex-lb/request-route-resolver.js

@@ -51,6 +51,20 @@ export function resolveBridgeRequestRoute(request, policy, options) {
     const policyTarget = policy.model_routes[model];
     if (!indexed || !policyTarget)
         return blocked(base, 'catalog_model_route_missing');
+    if (policyTarget.provider_id === 'openai') {
+        return {
+            ...base,
+            ok: true,
+            route: policyTarget,
+            endpoint_url: null,
+            source: 'route_index',
+            proposed_session_pin: null,
+            blockers: [],
+            recovery_action: null
+        };
+    }
+    if (indexed.provider_id === 'openai')
+        return blocked(base, 'catalog_route_provider_unknown');
     if (!sameTarget(indexed, policyTarget))
         return blocked(base, 'bridge_route_policy_route_index_mismatch');
     if (pinClaim && !sameTarget(indexed, pinClaim))

package/dist/core/imagegen/desktop-bridge-imagegen-target.js

@@ -18,7 +18,7 @@ export async function resolveDesktopBridgeImagegenTarget(opts = {}) {
     const route = model && policy?.fallback === 'none'
         ? policy.model_routes?.[model] || null
         : null;
-    const provider = route ? status?.providers?.[route.provider_id] || null : null;
+    const provider = route && route.provider_id !== 'openai' ? status?.providers?.[route.provider_id] || null : null;
     const providerImagegen = provider?.capabilities?.capabilities?.image_generation || null;
     const blocker = !status || status.schema !== 'sks.desktop-bridge-status.v3'
         ? 'desktop_bridge_status_unavailable'
@@ -50,7 +50,7 @@ export async function resolveDesktopBridgeImagegenTarget(opts = {}) {
         model,
         model_source: model ? 'explicit' : null,
         route: route || null,
-        provider_id: route?.provider_id || null,
+        provider_id: route && route.provider_id !== 'openai' ? route.provider_id : null,
         status_source: injected ? 'injected_fixture' : 'runtime',
         live_evidence_allowed: bridgeVerified && !injected,
         blocker,

package/dist/core/provider/provider-context.js

@@ -86,7 +86,8 @@ export async function writeProviderContextReport(root = process.cwd(), input = {
     return { ...report, report_path: reportPath };
 }
 function selectedBridgeProvider(status) {
-    return status?.routing.selected_route?.provider_id
+    const selected = status?.routing.selected_route?.provider_id;
+    return (selected === 'codex-lb' || selected === 'openrouter' ? selected : null)
         || status?.routing.policy?.default_provider_id
         || status?.routing.session_pin?.provider_id
         || null;

package/dist/core/release/gate-affected-globs.js

@@ -59,6 +59,15 @@ export function affectedGlobsFor(id) {
                 'package-lock.json',
                 'src/core/codex-app.ts',
                 'src/core/codex-lb-circuit.ts',
+                'src/core/codex-lb/**',
+                `src/scripts/${prefix}-*.ts`
+            ];
+        case 'desktop-bridge':
+            return [
+                'src/core/codex-lb/desktop-bridge/**',
+                'src/core/codex-lb/desktop-service.ts',
+                'src/core/codex-lb/provider-route-policy.ts',
+                'src/core/codex-lb/request-route-resolver.ts',
                 `src/scripts/${prefix}-*.ts`
             ];
         case 'context-graph-v2':

package/dist/core/version.js

@@ -1 +1 @@
-export const PACKAGE_VERSION = '9.1.1';
+export const PACKAGE_VERSION = '9.2.0';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "9.1.1",
+  "version": "9.2.0",
   "description": "Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",