LimLLL · kot4ri · Sep 10, 2026
diff --git a/Dockerfile b/Dockerfile
@@ -91,7 +91,7 @@ RUN node --version \
  && mise --version
 
 # Install global npm tools (codex + MCP utilities)
-ARG CODEX_CLI_VERSION=0.153.2
+ARG CODEX_CLI_VERSION=0.154.0
 ENV CODEX_CLI_VERSION=${CODEX_CLI_VERSION}
 RUN npm install -g \
     @openai/codex@${CODEX_CLI_VERSION} \
@@ -119,7 +119,7 @@ RUN npx --yes node-gyp rebuild --directory=node_modules/node-pty || true \
 # ── Stage 6: Runtime ─────────────────────────────────────────────────
 FROM runtime-base AS runtime
 
-ARG CODEX_CLI_VERSION=0.153.2
+ARG CODEX_CLI_VERSION=0.154.0
 ENV CODEX_CLI_VERSION=${CODEX_CLI_VERSION}
 
 WORKDIR /app

diff --git a/README.en.md b/README.en.md
@@ -249,8 +249,8 @@ The same image can serve both a domain root and a proxy subpath (for example, `h
 
 ```bash
 docker build \
-  --build-arg CODEX_CLI_VERSION=0.153.2 \
-  -t codex-webui:0.153.2 .
+  --build-arg CODEX_CLI_VERSION=0.154.0 \
+  -t codex-webui:0.154.0 .
 ```
 
 Nginx must retain `/codex/` in browser-facing URLs and strip it when proxying to the backend. The trailing slashes on both `location` and `proxy_pass` are required:

diff --git a/README.md b/README.md
@@ -249,8 +249,8 @@ Docker Compose 中使用时，`proxy_pass` 改为 `http://codex-webui:8172`，
 
 ```bash
 docker build \
-  --build-arg CODEX_CLI_VERSION=0.153.2 \
-  -t codex-webui:0.153.2 .
+  --build-arg CODEX_CLI_VERSION=0.154.0 \
+  -t codex-webui:0.154.0 .
 ```
 
 Nginx 必须保留浏览器侧的 `/codex/` 前缀，并在转发到后端时将它移除。`location` 和 `proxy_pass` 末尾的 `/` 均不可省略：

diff --git a/docker-compose.yml b/docker-compose.yml
@@ -5,7 +5,7 @@ services:
     # build:
     #   context: .
     #   args:
-    #     CODEX_CLI_VERSION: "0.153.2"
+    #     CODEX_CLI_VERSION: "0.154.0"
     ports:
       - "${PORT:-8172}:8172"
     environment:

diff --git a/docs/docker.md b/docs/docker.md
@@ -114,16 +114,16 @@ HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
 
 | ARG | 默认值 | 说明 |
 |-----|--------|------|
-| `CODEX_CLI_VERSION` | `0.153.2` | **运行时**镜像内全局安装的 codex npm 包版本 |
+| `CODEX_CLI_VERSION` | `0.154.0` | **运行时**镜像内全局安装的 codex npm 包版本 |
 
 构建阶段生成协议类型用的是 `@openai/codex` devDependency（由 `pnpm-lock.yaml` 锁定），**不受本 ARG 控制**。改 `CODEX_CLI_VERSION` 时须同步更新 `package.json` 里的 devDependency，否则会出现「类型按 A 版本生成、运行时跑 B 版本」的错配。版本的唯一真相源是 `package.json`，Dockerfile / docker-compose / CI fallback 均跟随它。
 
 本地构建：
 ```bash
-docker compose build --build-arg CODEX_CLI_VERSION=0.153.2
+docker compose build --build-arg CODEX_CLI_VERSION=0.154.0
 ```
 
-CI 由 `codex-*` 格式的 tag 触发，tag 名会被解析成本 ARG：`codex-0.153.2` → `0.153.2`。同一 codex 版本重发镜像用 `codex-0.153.2-2` 这类后缀。tag 名不合该格式会导致解析失败、构建报错。
+CI 由 `codex-*` 格式的 tag 触发，tag 名会被解析成本 ARG：`codex-0.154.0` → `0.154.0`。同一 codex 版本重发镜像用 `codex-0.154.0-2` 这类后缀。tag 名不合该格式会导致解析失败、构建报错。
 
 ## 反向代理与子目录部署
 

diff --git a/docs/model-catalog.md b/docs/model-catalog.md
@@ -69,7 +69,7 @@ WebUI 另外检查非空 models、slug 和重复 slug；空指令给出 warning
 指针先转换为原配置目录下的位置。Codex 可刷新这个临时缓存，原缓存保持不变。导出
 仍可能与已有进程冻结的目录不同；它不构成运行中进程的原子快照。
 
-`docs/upstream/model-catalog-0.153.2.json` 是 pinned binary 的完整 bundled 导出，包含
+`docs/upstream/model-catalog-0.154.0.json` 是 pinned binary 的完整 bundled 导出，包含
 11 个条目及指令。用 `pnpm codex:catalog` 刷新；升级 CLI 时一起修改脚本目标版本、
 刷新文件及协议 README。保留 CODEX-LICENSE、CODEX-NOTICE。运行时从 binary 导出，
 不依赖容器包含 docs 目录。

diff --git a/docs/upstream/README.md b/docs/upstream/README.md
@@ -1,25 +1,16 @@
 # Vendored upstream documentation
 
-Files in this directory are **verbatim copies of upstream Codex documentation**,
-kept here so protocol questions can be answered from the exact revision this
-project is pinned to rather than from whatever `main` happens to say today.
+Files in this directory are **verbatim upstream artifacts** kept so protocol
+questions can be answered from the exact revision this project is pinned to
+rather than from whatever `main` happens to say today.
 
 Do not edit them. Fix anything wrong by refreshing from upstream.
 
-| File | Upstream path | Tag |
-|---|---|---|
-| `codex-app-server-0.153.2.md` | `codex-rs/app-server/README.md` | `rust-v0.153.2` |
-
-The tag matches the `@openai/codex` version pinned in the root `package.json`.
-Refresh after bumping that dependency — a protocol migration is exactly when a
-stale copy is most likely to mislead:
-
-```bash
-VERSION=$(node -p "require('./package.json').devDependencies['@openai/codex']")
-curl -fsSL \
-  "https://raw.githubusercontent.com/openai/codex/rust-v${VERSION}/codex-rs/app-server/README.md" \
-  -o "docs/upstream/codex-app-server-${VERSION}.md"
-```
+Starting with `rust-v0.154.0`, upstream removed
+`codex-rs/app-server/README.md`. The versioned local copy therefore stops at
+0.153.2; current protocol intent is documented on the official Codex App Server
+documentation site, while the exact pinned wire contract is generated locally
+with `pnpm codex:schema`.
 
 Note that the README documents the *intended* protocol. Several behaviours this
 project depends on were established by measurement instead, because they are
@@ -31,7 +22,7 @@ measured behaviour recorded there is the one the code was written against.
 
 ## Bundled model catalog
 
-`model-catalog-0.153.2.json` is the complete deterministic output of the pinned binary's
+`model-catalog-0.154.0.json` is the complete deterministic output of the pinned binary's
 `codex debug models --bundled`, including instruction text and hidden entries. Refresh
 with `pnpm codex:catalog`; update the script's versioned target when bumping the CLI.
 It is a bundled baseline, not an authenticated account's effective remote catalog.

diff --git a/docs/upstream/model-catalog-0.153.2.json b/docs/upstream/model-catalog-0.153.2.json
diff --git a/docs/upstream/model-catalog-0.154.0.json b/docs/upstream/model-catalog-0.154.0.json
diff --git a/package.json b/package.json
@@ -23,7 +23,7 @@
     "db:generate": "drizzle-kit generate",
     "db:migrate": "drizzle-kit migrate",
     "db:studio": "drizzle-kit studio",
-    "codex:catalog": "codex debug models --bundled > docs/upstream/model-catalog-0.153.2.json",
+    "codex:catalog": "codex debug models --bundled > docs/upstream/model-catalog-0.154.0.json",
     "probe": "ts-node --project codex_probe/tsconfig.json codex_probe/index.ts"
   },
   "dependencies": {
@@ -63,7 +63,7 @@
     "@nestjs/cli": "^11.0.0",
     "@nestjs/schematics": "^11.0.0",
     "@nestjs/testing": "^11.0.1",
-    "@openai/codex": "0.153.2",
+    "@openai/codex": "0.154.0",
     "@swc/core": "^1.16.1",
     "@types/better-sqlite3": "^7.6.13",
     "@types/jsonwebtoken": "^9.0.10",

diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
diff --git a/src/account/dto/account.dto.ts b/src/account/dto/account.dto.ts
@@ -180,6 +180,9 @@ export class RateLimitSnapshotDto {
   @ApiProperty({ type: String, nullable: true })
   limitName!: string | null;
 
+  @ApiProperty({ type: String, nullable: true })
+  normalModelSlug!: string | null;
+
   @ApiProperty({ type: () => RateLimitWindowDto, nullable: true })
   primary!: RateLimitWindowDto | null;
 
@@ -203,4 +206,7 @@ export class AccountRateLimitsResponseDto {
     additionalProperties: { $ref: '#/components/schemas/RateLimitSnapshotDto' },
   })
   rateLimitsByLimitId!: Record<string, RateLimitSnapshotDto | undefined> | null;
+
+  @ApiProperty({ type: Boolean, nullable: true })
+  ordinaryUsageAllowed!: boolean | null;
 }
diff --git a/src/codex/catalog/catalog-native.service.spec.ts b/src/codex/catalog/catalog-native.service.spec.ts
@@ -20,7 +20,7 @@ import { writeAtomic } from './catalog-files';
 import type { v2 } from '../codex-schema';
 
 const baseline = readFileSync(
-  resolve('docs/upstream/model-catalog-0.153.2.json'),
+  resolve('docs/upstream/model-catalog-0.154.0.json'),
   'utf8',
 );
 

diff --git a/src/codex/catalog/catalog-provider.testing.ts b/src/codex/catalog/catalog-provider.testing.ts
@@ -28,7 +28,7 @@ export async function localCatalogProvider() {
   const catalog = fixture.storage.candidatePath();
   writeAtomic(
     catalog,
-    readFileSync(resolve('docs/upstream/model-catalog-0.153.2.json'), 'utf8'),
+    readFileSync(resolve('docs/upstream/model-catalog-0.154.0.json'), 'utf8'),
   );
   const port = (provider.address() as AddressInfo).port;
   writeAtomic(

diff --git a/src/codex/dto/v2/openapi-contract.spec.ts b/src/codex/dto/v2/openapi-contract.spec.ts
@@ -101,9 +101,9 @@ describe('Codex v2 OpenAPI contract', () => {
     expect(discriminators).toEqual(THREAD_ITEM_TYPES);
   });
 
-  it('exposes Codex 0.153 thread and asynchronous question metadata', () => {
+  it('exposes Codex 0.154 thread and asynchronous question metadata', () => {
     expect(Object.keys(schema('ThreadDto').properties ?? {})).toEqual(
-      expect.arrayContaining(['model', 'reasoningEffort']),
+      expect.arrayContaining(['model', 'reasoningEffort', 'originator']),
     );
     expect(
       Object.keys(schema('AgentMessageThreadItemDto').properties ?? {}),

diff --git a/src/codex/dto/v2/thread.dto.ts b/src/codex/dto/v2/thread.dto.ts
@@ -70,6 +70,9 @@ export class ThreadDto {
   @ApiProperty(NULLABLE_STRING_SCHEMA)
   agentRole!: string | null;
 
+  @ApiProperty(NULLABLE_STRING_SCHEMA)
+  originator!: string | null;
+
   @ApiProperty({ nullable: true, type: () => GitInfoDto })
   gitInfo!: GitInfoDto | null;
 

diff --git a/src/threads/threads.testing.ts b/src/threads/threads.testing.ts
@@ -36,7 +36,7 @@ export function makeThreadFixture(
     status: { type: 'idle' },
     path: null,
     cwd: '/tmp',
-    cliVersion: '0.153.2',
+    cliVersion: '0.154.0',
     source: 'appServer',
     threadSource: null,
     agentNickname: null,

diff --git a/web/src/generated/api/types.gen.ts b/web/src/generated/api/types.gen.ts
@@ -567,6 +567,7 @@ export type CreditsSnapshotDto = {
 export type RateLimitSnapshotDto = {
     limitId: string | null;
     limitName: string | null;
+    normalModelSlug: string | null;
     primary: RateLimitWindowDto | null;
     secondary: RateLimitWindowDto | null;
     credits: CreditsSnapshotDto | null;
@@ -578,6 +579,7 @@ export type AccountRateLimitsResponseDto = {
     rateLimitsByLimitId: {
         [key: string]: RateLimitSnapshotDto;
     } | null;
+    ordinaryUsageAllowed: boolean | null;
 };
 
 export type AppBrandingDto = {
@@ -1196,6 +1198,7 @@ export type ThreadDto = {
     source: 'cli' | 'vscode' | 'exec' | 'appServer' | 'unknown' | SessionSourceCustomDto | SessionSourceSubAgentDto;
     agentNickname: string | null;
     agentRole: string | null;
+    originator: string | null;
     gitInfo: GitInfoDto | null;
     name: string | null;
     turns: Array<TurnDto>;

diff --git a/web/src/hooks/use-thread-open.spec.ts b/web/src/hooks/use-thread-open.spec.ts
@@ -29,8 +29,8 @@ function response(): ThreadOpenResponseDto {
       id: 't', name: 'thread', preview: '', status: { type: 'idle' }, cwd: '/workspace',
       forkedFromId: null, ephemeral: false, modelProvider: 'test', model: null,
       reasoningEffort: null, createdAt: 0, updatedAt: 0, path: null,
-      cliVersion: '0.153.2', source: 'appServer', agentNickname: null,
-      agentRole: null, gitInfo: null, turns: [],
+      cliVersion: '0.154.0', source: 'appServer', agentNickname: null,
+      agentRole: null, originator: null, gitInfo: null, turns: [],
     },
     reasoningEffort: 'low', serviceTier: null,
     initialTurnsPage: { data: [running], nextCursor: null, backwardsCursor: null },

diff --git a/web/src/stores/account-store.ts b/web/src/stores/account-store.ts
@@ -77,6 +77,7 @@ export const useAccountStore = create<AccountState>((set, get) => ({
       rateLimits: {
         rateLimits: snapshot,
         rateLimitsByLimitId: existing?.rateLimitsByLimitId ?? null,
+        ordinaryUsageAllowed: existing?.ordinaryUsageAllowed ?? null,
       },
     });
   },

diff --git a/web/src/types/mcp.ts b/web/src/types/mcp.ts
@@ -15,6 +15,7 @@ export type McpAuthStatus =
 export interface McpServerStatus {
   name: string;
   tools: Record<string, unknown>;
+  toolsError: string | null;
   resources: unknown[];
   resourceTemplates: unknown[];
   authStatus: McpAuthStatus;