Disable websocket transport by default

Author: Codex

src/codex-catalog.ts

@@ -233,7 +233,7 @@ function deriveEntry(template: RawEntry | null, slug: string, desc: string, prio
  * catalog sync and the proxy `/v1/models?client_version` branch.
  * Native gpt slugs stay bare; routed models are namespaced `<provider>/<model>`.
  */
-export function buildCatalogEntries(template: RawEntry | null, gptSlugs: string[], goModels: CatalogModel[], featured?: string[], wsEnabled = true): RawEntry[] {
+export function buildCatalogEntries(template: RawEntry | null, gptSlugs: string[], goModels: CatalogModel[], featured?: string[], wsEnabled = false): RawEntry[] {
   // Codex's models-manager sorts by `priority` ASC and advertises the first 5 picker-visible
   // models to spawn_agent (sort_by_key(priority) + MAX_MODEL_OVERRIDES_IN_SPAWN_AGENT=5). Catalog
   // ARRAY order is discarded — so "featuring" a model = giving it the LOWEST priority (0..N-1) so

src/codex-inject.ts

@@ -14,7 +14,7 @@ const OCX_SECTION_MARKER = "# Auto-injected by opencodex";
  * whatever `[table]` happened to be open last (e.g. `[plugins."chrome@openai-bundled"]`), so Codex
  * never saw a global model_provider and silently fell back to the `openai` (ChatGPT) provider.
  */
-export function buildProviderTableBlock(port: number, supportsWebsockets = true): string {
+export function buildProviderTableBlock(port: number, supportsWebsockets = false): string {
   const lines = [
     "",
     OCX_SECTION_MARKER,

src/config.ts

@@ -58,7 +58,7 @@ export function saveConfig(config: OcxConfig): void {
 }
 
 export function websocketsEnabled(config: Pick<OcxConfig, "websockets">): boolean {
-  return config.websockets !== false;
+  return config.websockets === true;
 }
 
 export function getDefaultConfig(): OcxConfig {
@@ -76,7 +76,7 @@ export function getDefaultConfig(): OcxConfig {
     },
     defaultProvider: "openai",
     subagentModels: [...DEFAULT_SUBAGENT_MODELS],
-    websockets: true,
+    websockets: false,
   };
 }
 

src/types.ts

@@ -175,7 +175,7 @@ export interface OcxConfig {
   subagentModels?: string[];
   /** Routed model ids ("<provider>/<model>") hidden from Codex (excluded from the catalog + /v1/models). */
   disabledModels?: string[];
-  /** Advertise supports_websockets so Codex opens the WS endpoint. Default true; set false to force HTTPS/SSE. */
+  /** Advertise supports_websockets so Codex opens the WS endpoint. Default false; set true to opt in. */
   websockets?: boolean;
   /** Freshness window (ms) for the per-provider live `/models` cache. Defaults to 5 min. */
   modelCacheTtlMs?: number;

tests/codex-catalog.test.ts

@@ -62,7 +62,7 @@ describe("Codex catalog routed normalization", () => {
     expect(routed).not.toHaveProperty("tool_mode");
     expect(routed).not.toHaveProperty("multi_agent_version");
     expect(routed).not.toHaveProperty("use_responses_lite");
-    expect(routed?.supports_websockets).toBe(true);
+    expect(routed).not.toHaveProperty("supports_websockets");
     expect(routed).not.toHaveProperty("additional_speed_tiers");
     expect(routed).not.toHaveProperty("service_tier");
     expect(routed).not.toHaveProperty("service_tiers");
@@ -99,20 +99,20 @@ describe("Codex catalog routed normalization", () => {
     expect(native?.tool_mode).toBe("code");
     expect(native?.multi_agent_version).toBe("v2");
     expect(native?.use_responses_lite).toBe(true);
-    // Phase 133: websocket advertisement is default-on after Phase 132 hardening.
-    expect(native?.supports_websockets).toBe(true);
+    // WebSocket advertisement is opt-in; templates must not leak it by default.
+    expect(native).not.toHaveProperty("supports_websockets");
     expect(native?.web_search_tool_type).toBe("text_and_image");
     expect(native?.supports_search_tool).toBe(true);
     expect(native?.service_tier).toBe("priority");
     expect(native?.service_tiers).toEqual([{ id: "priority" }]);
   });
 
-  test("buildCatalogEntries advertises supports_websockets by default with explicit opt-out", () => {
+  test("buildCatalogEntries advertises supports_websockets only on explicit opt-in", () => {
     const goModels = [{ provider: "anthropic", id: "claude-sonnet-4-6", owned_by: "anthropic" }];
 
-    const defaultOn = buildCatalogEntries(nativeTemplate(), ["gpt-5.5"], goModels);
-    expect(defaultOn.find(e => e.slug === "gpt-5.5")?.supports_websockets).toBe(true);
-    expect(defaultOn.find(e => e.slug === "anthropic/claude-sonnet-4-6")?.supports_websockets).toBe(true);
+    const defaultOff = buildCatalogEntries(nativeTemplate(), ["gpt-5.5"], goModels);
+    expect(defaultOff.find(e => e.slug === "gpt-5.5")).not.toHaveProperty("supports_websockets");
+    expect(defaultOff.find(e => e.slug === "anthropic/claude-sonnet-4-6")).not.toHaveProperty("supports_websockets");
 
     const on = buildCatalogEntries(nativeTemplate(), ["gpt-5.5"], goModels, undefined, true);
     expect(on.find(e => e.slug === "gpt-5.5")?.supports_websockets).toBe(true);

tests/codex-inject.test.ts

@@ -2,13 +2,13 @@ import { describe, expect, test } from "bun:test";
 import { buildProviderTableBlock, stripOpencodexConfig } from "../src/codex-inject";
 
 describe("Codex config injection", () => {
-  test("advertises provider-level Responses WebSocket support by default", () => {
+  test("omits provider-level Responses WebSocket support by default", () => {
     const block = buildProviderTableBlock(10100);
 
     expect(block).toContain("[model_providers.opencodex]");
     expect(block).toContain('wire_api = "responses"');
     expect(block).toContain("requires_openai_auth = true");
-    expect(block).toContain("supports_websockets = true");
+    expect(block).not.toContain("supports_websockets");
   });
 
   test("can suppress provider-level Responses WebSocket support for explicit opt-out", () => {