Codex Desktop hides all opencodex-routed models once Luna Reserve is active; gpt-reserve forwarded natively and rejected #4940

Activity

1. github-actions

   closed this as not plannedon Sep 17, 2026
2. github-actions commented on Sep 17, 2026

   

   github-actionsbot

   on Sep 17, 2026 – with GitHub Actions

   Last edited by github-actions

   Contributor

   More actions

   Issue reopened

   The report now contains the information required by the automated check. Thanks for updating it.
3. github-actions

   added

   bugSomething isn't workingSomething isn't working

   catalogModel catalog, slugs, visibility, routed entriesModel catalog, slugs, visibility, routed entries

   on Sep 17, 2026
4. github-actions

   reopened this on Sep 17, 2026
5. Rizek000 commented on Sep 17, 2026

   

   Rizek000

   on Sep 17, 2026

   Author

   More actions

   
6. guilhermemarketing commented on Sep 17, 2026

   

   guilhermemarketing

   on Sep 17, 2026

   Last edited by guilhermemarketing

   More actions

   We investigated this exact failure mode today in ChatGPT Desktop (macOS ARM64, Electron 26.911.61220) and identified both the root cause and a robust, working workaround that opencodex could easily integrate natively.

   1. Root Cause Breakdown

   There are actually two distinct layers of locking in the Desktop app when ChatGPT quota is depleted:

   1. UI Model Picker Lockdown & gpt-reserve emission:

      • When the primary allowance reaches 100%, /backend-api/wham/usage returns rate_limit: { allowed: false } and rate_limit_upsell: { banner_type: 'luna_reserve' }.
      • The Desktop React state sets isLunaReserveActive = true, which forcefully overrides the active model to gpt-reserve (labeled as 🌙 GPT-5.6 Luna) and collapses/hides the custom model dropdown.
      • When the user sends a message, Desktop emits model: "gpt-reserve". Since opencodex forwards gpt-reserve natively to OpenAI (https://chatgpt.com/backend-api/codex/responses), OpenAI rejects it with 429 usage_limit_reached once reserve capacity is zero.

   2. Hard Composer Lockout (Send Button Disabled):

      • Once Luna Reserve / account credits are completely exhausted (0 credits, rate_limit_reached_type !== null), the Recoil atom in Desktop (Cro/wro) transitions to hardBlocked: true.
      • This causes the composer components (f9 -> Exr -> plr) to enforce submitDisabled: true, completely disabling the send button (aria-label="Enviar" / Send) and rendering the blocking modal ("You've run out of usage for Codex...").

   ---

   2. The Architectural Discovery in Electron (main-*.js)

   In the Desktop Electron main process:

   • The base URL resolver checks process.env.CODEX_API_BASE_URL:

     function vw(e) {
       let t = process.env.CODEX_API_BASE_URL;
       return t && t.trim().length > 0 ? t.replace(/\/+$/, '') : ...
     }

   • Crucially, localhost:8000 is explicitly whitelisted in isDesktopAuthAllowedUrl(e) alongside native endpoints, meaning Desktop happily attaches OAuth Bearer tokens, DeviceCheck headers, and account IDs when talking to http://localhost:8000/backend-api!

   ---

   3. The Working Solution

   We implemented a two-part solution that completely restores full functionality:

   Part A: Transparent Unblocker Proxy on port 8000

   A lightweight local proxy on 127.0.0.1:8000 transparently passes through all endpoints to https://chatgpt.com, except GET /backend-api/wham/usage:

   • When intercepting /wham/usage, it decompresses gzip/br/deflate, and overrides:

     {
       "rate_limit": {
         "allowed": true,
         "limit_reached": false,
         "primary_window": { "used_percent": 0 }
       },
       "rate_limit_reached_type": null,
       "rate_limit_upsell": null,
       "credits": {
         "has_credits": true,
         "unlimited": true,
         "balance": "1000"
       }
     }

   • With CODEX_API_BASE_URL="http://localhost:8000/backend-api" set in LaunchServices (launchctl setenv), Desktop never enters hardBlocked: true. The upsell modal disappears, and the composer send button remains fully enabled.

   Part B: Model Redirection in OpenCodex

   To handle cases where Desktop forces gpt-reserve or gpt-5.6-luna:

   • In ~/.opencodex/config.json, configure model redirects:

     "blockedModelRedirects": {
       "gpt-reserve": "deepseek/deepseek-flash",
       "gpt-5.6-luna": "deepseek/deepseek-flash",
       "gpt-5-6-pro": "deepseek/deepseek-flash"
     }

   • When Desktop sends a prompt targeting gpt-reserve, the opencodex router rewrites it to your configured provider (e.g. deepseek/deepseek-flash or anthropic/claude-sonnet-5), executing the prompt with full reasoning and returning HTTP 200 to Desktop!

   ---

   4. Recommendation for OpenCodex Upstream

   @lidge-jun Opencodex could incorporate this directly so users don't need manual workarounds:

   1. Built-in gpt-reserve Routing:
      In src/router.ts (or src/codex/luna-reserve-hop.ts), if upstream returns isLunaQuotaRejection(429) or if defaultProvider !== 'openai', optionally redirect gpt-reserve to the configured default provider instead of failing with 429.
   2. Native ocx desktop unblock / Port 8000 Listener:
      Opencodex could bind a secondary listener on 127.0.0.1:8000 (or multiplex via CODEX_API_BASE_URL) to mock /wham/usage with allowed: true. A CLI command like ocx desktop-bypass on/off could automatically manage launchctl setenv CODEX_API_BASE_URL and LaunchAgent lifecycles.

   Happy to provide a PR or detailed code samples for the unblocker service if the maintainers would like to integrate it into ocx!
7. Rizek000 commented on Sep 17, 2026

   

   Rizek000

   on Sep 17, 2026

   Author

   More actions

   huge! thx @guilhermemarketing

   ❤️React with ❤️1Reacted by gui.marketing
8. Rizek000 commented on Sep 17, 2026

   

   Rizek000

   on Sep 17, 2026

   Author

   More actions

   @lidge-jun looks like you are already on top of this but can you include this issue in you threads?
9. guilhermemarketing

   added a commit that references this issue on Sep 17, 2026

   feat(codex): add desktop unblocker loopback listener on port 8000 (li…

   ...

   68f30b4
10. lidge-jun

    added 2 commits that reference this issue on Sep 17, 2026

    docs(devlog): record the lane I catalog and model-visibility unit (#4973

    ...

    5377d5d

    fix(codex): refuse Reserve turns the Desktop authless opt-in cannot s…

    ...

    277291f
11. lidge-jun commented on Sep 18, 2026

    

    lidge-jun

    on Sep 18, 2026

    Owner

    More actions

    Fixed on dev by #4968 at 277291f — local refusal when codexDesktopAuthless is unset so gpt-reserve is no longer forwarded as a native model into an unhelpful upstream 429.
12. lidge-jun

    closed this as completedon Sep 18, 2026
13. luvs01

    added a parent issue on Sep 25, 2026

    • Luna Reserve capability is bound to codexDesktopAuthless, a flag documented as controlling Codex app sign-in #4961