fix(codex): combine V2 forwarding, account recovery, and served-model diagnostics

[luvs01]

Summary

Combine #5492, #5486, and #5485 above the Codex client compatibility layer. The client and routing layers carry seven original PRs; #5529 adds five related catalog/capability sources to this same Stack.

• Recognize the first developer additional_tools catalog for Responses Lite V2 plaintext forwarding when top-level tools are absent, preserving existing opt-in and collision boundaries.
• Recover exact model-not-supported WebSocket refusals across eligible pool accounts, and discard deferred spend settlements only when ledger ownership has ended.
• Preserve the exact upstream wire model and separately record the model actually served, including route-normalized requests. The GUI Logs column and detail view show wire → served mismatches with complete translated tooltips.
• Preserve original commit attribution and cherry-pick provenance. Fully migrated standalone sources were closed after commit-inclusion verification and evidence comments; partial source fix(codex): reconcile a v1 injection with the global multi_agent_v2 flag #4936 remains open.

Screenshot

Actual combined Logs component with synthetic API responses, including mismatched and matching model identities. No live user account or request data is included.

Related maintainer carry

Shared contribution: #5492 is also carried by maintainer-owned #5508. The relevant production file is identical between the two draft replacements; neither draft proves dev inclusion. Keep #5492 open until the landed implementation is verified, and reconcile this layer against dev when that carry lands.

Verification

• Updated above fix(codex): combine client configuration and catalog compatibility #5503 against dev c37f4f5f43351feee3ca46736770429ccbd068df; current head 8ca80420b4da6cedac59738db850e85b48b10829.
• TypeScript, structure SSOT, file-size ratchet, privacy scan, GUI i18n lint, and production GUI build passed during integration. Model-title/locale tests: 9 passed, 101 assertions. Headless Chromium verified the real Logs component using synthetic data.
• The initial focused runtime run had 361 passes, 2 skips and two V2 test timeouts. Commit 44539f0 makes the existing catalog-state test override hermetic, avoiding real Windows PowerShell process enumeration and cross-test fixture interference. The final uninstrumented V2 file passed 27 tests / 152 assertions. Product behavior, ACL rules and timeout limits were unchanged.
• After dev integration, the stalled-400 fixture regression passed (1 test / 5 assertions), and final structure/size checks passed. The lower layer's two sync-api failures also passed unchanged in a clean worktree.
• Source fix(codex): recover WebSocket model refusals across pool accounts #5486 and feat(logs): record the upstream-served model and flag wire/served mismatches #5485 were closed with verified commit-inclusion evidence. fix(subagents): recognize Responses Lite plaintext V2 catalogs #5492 was reopened to honor fix(responses): consolidate native control bounds, authorization and Lite catalogs #5508's explicit requirement to verify inclusion on dev before source closure. Catalog/capability layer fix(catalog): consolidate capability overrides, modality seeds, and exclusions #5529 extends this Stack.
• Hosted checks include cancellations; full cross-platform CI, docs build and independent security review remain incomplete. This PR stays draft.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Review readiness

• Local CI is green on this exact head.
• Stack is rooted in the current dev commit at preparation time.
• All correct Codex and CodeRabbit findings are fixed on the combined head.
• Ready-for-review confirmation.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ Deterministic hygiene checks failed.

• missing_coauthor_credit — This pull request says it reimplements, supersedes, carries, or rebases another author's pull request, but no Co-authored-by trailer names that author. Prose in a commit body is not read by anything; the trailer is what GitHub counts. Add it to the description or a commit, or obtain attribution-approved. Paths: #5508.

[lidge-jun]

리뷰 · 우선순위 60 / 80

이 PR은 Codex 쪽 문제를 세 덩어리로 묶은 스택입니다. 첫째, Responses Lite V2가 맨 위 tools 없이 developer additional_tools 카탈로그만 있을 때도 plaintext 전달을 켜게 합니다. 둘째, WebSocket이 모델 거절을 error.message로 줄 때도 HTTP detail과 같이 읽어, 풀 계정에서 같은 거절을 다시 잡을 수 있게 합니다. 셋째, 업스트림이 실제로 쓴 모델을 servedModel로, 전송한 모델을 wireModel로 따로 남기고 Logs에 wire → served로 보여 줍니다. 그 위에 서버가 이미 장부 소유권을 놓은 뒤 늦게 오는 spend settle이 프로세스를 죽이지 않도록 SpendLedgerOwnerError만 삼키는 수정도 들어 있습니다. 베이스는 dev가 아니라 stack/codex-client-compat이고, 원본 #5492·#5486·#5485는 아직 열려 있습니다. 작성자도 draft와 런타임 실패(plaintext-V2 타임아웃 2건, 하위 레이어 Windows 실패)를 인정했고, 보안 체크리스트와 exact-head CI는 아직 비어 있습니다.

라인 - src/server/responses/request-spend.ts settle: 소유권 종료 후 SpendLedgerOwnerError를 조용히 버리면 크래시는 막지만, 미정산 spend가 로그·메트릭 없이 사라질 수 있음. 의도적 폐기인지, 최소한 관측 한 줄이 필요한지 확인이 필요함.
라인 - gui/src/pages/Logs.tsx servedModelLabel: isModelRerouted 가드 뒤 log.servedModel! 비널 단언. 지금은 맞지만 가드가 바뀌면 깨지기 쉬움. servedModel을 지역 변수로 좁히는 편이 안전함.
라인 - 헤드 CI: Cross-platform ci FAILURE, 다수 잡 CANCELLED. 작성자 보고 런타임 회귀 2 fail(plaintext-V2 over-limit / option-change namespace)은 이 스택 머지 전 차단 이슈로 보는 것이 맞음.
라인 - 베이스 stack/codex-client-compat(선호 base dev 아님). 스택 합류 후 원본 draft #5492·#5486·#5485는 중복으로 닫는 편이 리뷰 부담을 줄임.

메인테이너의 판단이 필요한 지점
계정 거절 복구와 spend 장부 폐기는 과금·재시도 경계에 닿습니다. 소유권 밖 settle을 삼키는 정책이 “프로세스 생존”만 목표인지, “미정산은 반드시 어딘가에 남아야 한다”인지 먼저 정해 주세요. 또 draft + 빨간 테스트를 스택 채로 dev로 올릴지, 하위 레이어·타임아웃을 먼저 고칠지 순서가 필요합니다. 보안 체크(시크릿·auth·기본값)도 아직 미체크입니다.

너의 추천
지금 상태로는 Ready 아님. (1) plaintext-V2 타임아웃 2건과 하위 Windows 실패를 이 헤드에서 재현·해소하거나, 실패를 재현 가능한 이슈로 분리한 뒤 (2) settle 삼킴에 관측(로그/카운터)을 넣을지 정책을 확정하고 (3) exact-head CI가 초록이 된 다음에만 draft 해제. 스택이 dev에 안착한 뒤에는 #5492·#5486·#5485를 닫아 중복 리뷰를 끊으세요. Logs의 servedModel!은 작은 정리로 같이 해주는 편이 좋습니다.

이 댓글은 grok-bot이 작성했습니다

[github-actions]

⏳ DRAFT

• hygiene: missing_coauthor_credit.

What to do

• Fix missing_coauthor_credit — This pull request says it reimplements, supersedes, carries, or rebases another author's pull request, but no Co-authored-by trailer names that author. Prose in a commit body is not read by anything; the trailer is what GitHub counts. Add it to the description or a commit, or obtain attribution-approved. Paths: #5508.

This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.

[lidge-jun]

Superseded by #5609, which is open and not yet merged. Cherry-picked (authored by you): refusal recovery with the pool harness (1b55d81 + c7e06af), served/wire model logging (632cf0d), the V2 catalog test isolation (44539f0) and the model-identity docs (271fde4). The logged served model is now bounded, and it is dropped when the secret redactor would change it. The settlement change (bba58c3, originally by Devin AI) is reimplemented crediting Devin AI and you, so that only an expired ledger lease is dropped. The reroute translations (24d8a0c) and the tooltip (4ea2059) are reimplemented with you as co-author; Turkish and Vietnamese are now translated. Two parts are already on dev: the Lite catalog detection (b8010ce, via #5508 / 5365429) and the stalled-body fixture (a216f6f, 6c2f767). Thank you!