@bitkyc08/opencodex 2.11.0 → 2.11.1

package/src/oauth/index.ts

@@ -13,6 +13,7 @@ import { loginAntigravity, refreshAntigravityToken } from "./google-antigravity"
 import { loginCursor, refreshCursorToken } from "./cursor";
 import { loginGithubCopilot, refreshGithubCopilotToken, validateCopilotApiBaseUrl } from "./github-copilot";
 import { loginCommandCode, refreshCommandCodeToken } from "./command-code";
+import { ANTIGRAVITY_REQUEST_UA } from "../adapters/google-antigravity-wire";
 import { deriveOAuthDefaultModel, deriveOAuthProviderConfig } from "../providers/derive";
 import { apiKeyPoolEntryId, sanitizeApiKeyValue } from "../providers/api-keys";
 import { effectiveGoogleMode, getProviderRegistryEntry, providerMatchesRegistryTransport } from "../providers/registry";
@@ -53,6 +54,8 @@ export interface OAuthAccessSnapshot {
   accountId: string;
   generation: string;
   accessToken: string;
+  /** Cloud Code Assist project selected during Antigravity login. */
+  projectId?: string;
   /** Safe request-routing subset; refresh-only Kiro client secrets never leave the credential store. */
   kiro?: Pick<KiroOAuthMetadata, "profileArn" | "apiRegion" | "ssoRegion">;
 }
@@ -204,7 +207,7 @@ export const OAUTH_PROVIDERS: Record<string, OAuthProviderDef> = {
     defaultModel: oauthDefaultModel("google-antigravity"),
   },
   cursor: {
-    login: (ctrl) => loginCursor(ctrl),
+    login: (ctrl, opts) => loginCursor(ctrl, undefined, { forceLogin: opts?.forceLogin }),
     refresh: refreshCursorToken,
     providerConfig: oauthConfig("cursor"),
     defaultModel: oauthDefaultModel("cursor"),
@@ -289,6 +292,7 @@ function accessSnapshot(provider: string, accountId: string, cred: OAuthCredenti
     accountId,
     generation: credentialGeneration(cred),
     accessToken: cred.access,
+    ...(cred.projectId ? { projectId: cred.projectId } : {}),
     // Stored account metadata remains authoritative. Metadata-less legacy/environment credentials
     // may use explicit environment routing, but never borrow the currently signed-in local CLI account.
     ...(provider === "kiro"
@@ -628,15 +632,15 @@ function modelDiscoveryTransportSeed(providerName: string, prov: OcxProviderConf
 }
 
 /**
- * Provider-correct `GET /models` request (URL + headers), so both model-listing paths fetch the
+ * Provider-correct model-discovery request (URL + headers), so both model-listing paths fetch the
  * LIVE catalog correctly per adapter. Anthropic is the special case: its endpoint is `/v1/models`
  * (not `/models`), it needs `anthropic-version`, and it authenticates with `x-api-key` by default
  * (or `Authorization: Bearer` when `apiKeyTransport = "bearer"`), plus the OAuth beta for oauth
  * mode — not a bare Bearer. Google (ai-studio mode)
  * is the other special case: `x-goog-api-key` + `/v1beta/models`, returning `{ models: [...] }`.
  * The catalog authority gate intentionally degrades that non-OpenAI shape to stale/static data.
- * Everyone else uses the OpenAI-style `/models` + Bearer with a `{ data: [{ id, owned_by? }] }`
- * response.
+ * Antigravity uses its CCA `:fetchAvailableModels` RPC; everyone else uses the OpenAI-style
+ * `/models` + Bearer with a `{ data: [{ id, owned_by? }] }` response.
  */
 export interface ModelsRequestObservedAuth {
   readonly oauthApiBaseUrl?: string;
@@ -647,7 +651,7 @@ export function buildModelsRequest(
   apiKey: string | undefined,
   providerName = "",
   observedAuth?: ModelsRequestObservedAuth,
-): { url: string; headers: Record<string, string> } {
+): { method?: "POST"; url: string; headers: Record<string, string> } {
   const transportSeed = modelDiscoveryTransportSeed(providerName, prov);
   const copilotApiBaseUrl = observedAuth === undefined
     ? (providerName === "github-copilot" ? getOAuthCredentialApiBaseUrl(providerName) : undefined)
@@ -665,6 +669,17 @@ export function buildModelsRequest(
     effectiveProvider.baseUrl,
     defaultUrl,
   );
+  if (effectiveGoogleMode(providerName, effectiveProvider) === "cloud-code-assist") {
+    headers.Accept = "application/json";
+    headers["Content-Type"] = "application/json";
+    headers["User-Agent"] = ANTIGRAVITY_REQUEST_UA;
+    if (apiKey) headers.Authorization = `Bearer ${apiKey}`;
+    return {
+      method: "POST",
+      url: discoveryUrl(`${effectiveProvider.baseUrl.replace(/\/+$/, "")}/v1internal:fetchAvailableModels`),
+      headers,
+    };
+  }
   if (effectiveGoogleMode(providerName, effectiveProvider) === "ai-studio") {
     // Generative Language API: API key goes in x-goog-api-key (never Authorization: Bearer),
     // models live under /v1beta (v1 misses preview models), and pageSize maxes at 1000 —
@@ -698,9 +713,7 @@ export function buildModelsRequest(
  *
  * Only touches providers that are registry-managed AND still `authMode: "oauth"`. Preset fields
  * are refreshed, while the registry's `liveModels` default is normally filled only when no value
- * is stored. Antigravity has one versioned exception below because its old GUI-generated `true`
- * cannot be distinguished from a hand-written pre-migration `true`. Persists + returns true when
- * anything changed.
+ * is stored. Persists + returns true when anything changed.
  */
 function cloneProviderField(value: unknown): unknown {
   if (Array.isArray(value)) return [...value];
@@ -729,7 +742,7 @@ const OAUTH_RECONCILE_FIELDS: (keyof OcxProviderConfig)[] = [
 ];
 
 const GOOGLE_ANTIGRAVITY_PROVIDER = "google-antigravity";
-const GOOGLE_ANTIGRAVITY_STATIC_CATALOG_VERSION = 1 as const;
+const GOOGLE_ANTIGRAVITY_LIVE_DISCOVERY_VERSION = 2 as const;
 
 /** Only migrate the three-model experimental seed; an operator's later `liveModels: false` wins. */
 function isLegacyCommandCodeStaticCatalog(provider: OcxProviderConfig): boolean {
@@ -738,10 +751,34 @@ function isLegacyCommandCodeStaticCatalog(provider: OcxProviderConfig): boolean
     && JSON.stringify(provider.models) === JSON.stringify(["deepseek-v4-flash", "kimi-k3", "glm-5.2"]);
 }
 
+function isLegacyAntigravityStaticCatalog(provider: OcxProviderConfig): boolean {
+  return provider.liveModels === false
+    && provider.adapter === "google"
+    && provider.baseUrl === "https://daily-cloudcode-pa.googleapis.com"
+    && provider.authMode === "oauth"
+    && provider.googleMode === "cloud-code-assist"
+    && provider.defaultModel === "gemini-3.6-flash"
+    && JSON.stringify(provider.models) === JSON.stringify([
+      "gemini-3.6-flash",
+      "gemini-3.1-pro",
+      "gemini-3.1-flash-image",
+      "claude-sonnet-4-6",
+      "claude-opus-4-6-thinking",
+      "gpt-oss-120b-medium",
+    ]);
+}
+
+/** Promote only the versioned canonical static seed; unmarked `liveModels: false` remains user intent. */
+function migrateLegacyAntigravityStaticCatalog(config: OcxConfig): boolean {
+  if (config.googleAntigravityStaticCatalogVersion !== 1) return false;
+  const provider = config.providers[GOOGLE_ANTIGRAVITY_PROVIDER];
+  if (provider && isLegacyAntigravityStaticCatalog(provider)) provider.liveModels = true;
+  config.googleAntigravityStaticCatalogVersion = GOOGLE_ANTIGRAVITY_LIVE_DISCOVERY_VERSION;
+  return true;
+}
+
 export function reconcileOAuthProviders(config: OcxConfig): boolean {
-  let changed = false;
-  const migrateAntigravityStaticCatalog =
-    config.googleAntigravityStaticCatalogVersion !== GOOGLE_ANTIGRAVITY_STATIC_CATALOG_VERSION;
+  let changed = migrateLegacyAntigravityStaticCatalog(config);
   for (const [name, prov] of Object.entries(config.providers)) {
     const def = OAUTH_PROVIDERS[name];
     if (name === "command-code" && isLegacyCommandCodeStaticCatalog(prov)) {
@@ -750,21 +787,7 @@ export function reconcileOAuthProviders(config: OcxConfig): boolean {
       prov.liveModels = true;
       changed = true;
     }
-    // Normalize the canonical row before the OAuth-only reconciliation guard. The old GUI and a
-    // manual edit both persist the same bare `true`, with no source metadata, so every ambiguous
-    // pre-marker value is reset once. A deliberate live-discovery choice can be re-enabled after
-    // the marker and is then preserved. Do this before the guard so omitted/non-OAuth authMode
-    // rows do not get stamped without actually receiving the new static default.
-    if (name === GOOGLE_ANTIGRAVITY_PROVIDER && migrateAntigravityStaticCatalog && prov.liveModels !== false) {
-      prov.liveModels = false;
-      changed = true;
-    }
-    // During the one-time Antigravity static-catalog migration, also refresh preset catalog
-    // fields when authMode is omitted or non-oauth. Otherwise liveModels flips to static while
-    // a stale models[] remains the published catalog forever.
-    const migrateAntigravityCatalogFields =
-      name === GOOGLE_ANTIGRAVITY_PROVIDER && migrateAntigravityStaticCatalog;
-    if (!def || (prov.authMode !== "oauth" && !migrateAntigravityCatalogFields)) continue;
+    if (!def || prov.authMode !== "oauth") continue;
     const preset = def.providerConfig;
     for (const field of OAUTH_RECONCILE_FIELDS) {
       if (JSON.stringify(prov[field]) === JSON.stringify(preset[field])) continue;
@@ -775,9 +798,6 @@ export function reconcileOAuthProviders(config: OcxConfig): boolean {
       }
       changed = true;
     }
-    // Before this marker existed, the GUI materialized an omitted `liveModels` as `true` on any
-    // settings save. Since persisted values have no provenance, the pre-guard normalization above
-    // intentionally resets all pre-marker `true` values once. Later choices are version-bounded.
     if (prov.liveModels === undefined && preset.liveModels !== undefined) {
       prov.liveModels = preset.liveModels;
       changed = true;
@@ -791,10 +811,6 @@ export function reconcileOAuthProviders(config: OcxConfig): boolean {
       changed = true;
     }
   }
-  if (migrateAntigravityStaticCatalog) {
-    config.googleAntigravityStaticCatalogVersion = GOOGLE_ANTIGRAVITY_STATIC_CATALOG_VERSION;
-    changed = true;
-  }
   if (changed) saveConfig(config);
   return changed;
 }
@@ -851,17 +867,14 @@ export function upsertOAuthProvider(config: OcxConfig, provider: string): void {
   if (provider === "chatgpt") return;
   const def = OAUTH_PROVIDERS[provider];
   if (!def) return;
+  if (provider === GOOGLE_ANTIGRAVITY_PROVIDER) migrateLegacyAntigravityStaticCatalog(config);
   const namespaceCollision = codexAccountNamespaceProviderCollisionError(config.codexAccountNamespaces, provider);
   if (namespaceCollision) throw new Error(namespaceCollision);
   const existing = config.providers[provider];
   const next: OcxProviderConfig = { ...def.providerConfig };
-  // `liveModels` is a user-facing provider toggle. A registry default seeds new rows, but an
-  // explicit post-migration choice must survive re-login and the latest-config upsert. Old GUI
-  // saves and manual edits left identical pre-marker `true` values, so that ambiguous state is
-  // reset once; users who deliberately forced discovery can re-enable it after migration.
-  const preserveExistingLiveModels = provider !== GOOGLE_ANTIGRAVITY_PROVIDER
-    || config.googleAntigravityStaticCatalogVersion === GOOGLE_ANTIGRAVITY_STATIC_CATALOG_VERSION;
-  if (preserveExistingLiveModels && typeof existing?.liveModels === "boolean" && !isLegacyCommandCodeStaticCatalog(existing)) {
+  // `liveModels` is a user-facing provider toggle. Preserve either explicit setting across login;
+  // Antigravity's CCA discovery now uses its real RPC, so legacy `true` remains a valid choice.
+  if (typeof existing?.liveModels === "boolean" && !isLegacyCommandCodeStaticCatalog(existing)) {
     next.liveModels = existing.liveModels;
   }
   // The Command Code protocol-version pin is an operator compatibility control. A re-login,
@@ -893,9 +906,6 @@ export function upsertOAuthProvider(config: OcxConfig, provider: string): void {
     }
   }
   config.providers[provider] = next;
-  if (provider === GOOGLE_ANTIGRAVITY_PROVIDER) {
-    config.googleAntigravityStaticCatalogVersion = GOOGLE_ANTIGRAVITY_STATIC_CATALOG_VERSION;
-  }
 }
 
 interface RunLoginDeps {
@@ -1023,11 +1033,15 @@ export async function runLogin(
   settleKiroTransaction(rawCred, true);
   if (provider !== "chatgpt") {
     try {
+      const { clearModelCache } = await import("../codex/model-cache");
+      const { clearGatherRoutedModelsInflight } = await import("../codex/catalog");
+      clearModelCache(provider);
+      clearGatherRoutedModelsInflight();
       const { clearAccountQuotaCache, clearProviderQuotaCache } = await import("../providers/quota");
       clearProviderQuotaCache();
       clearAccountQuotaCache(provider);
     } catch {
-      // Quota module may be unavailable in tightly scoped unit tests.
+      // Optional state modules may be unavailable in tightly scoped unit tests.
     }
   }
   return cred;

package/src/providers/antigravity-models.ts

@@ -1,10 +1,13 @@
+import { isValidModelDiscoveryModelId, MODEL_DISCOVERY_MAX_MODELS } from "./model-discovery-limits";
+
 // Google Antigravity (Cloud Code Assist) bundled model list.
 //
 // Single source of truth: the Antigravity `:fetchAvailableModels` backend, the same one the `agy`
 // CLI resolves labels against. The ids below separate CCA wire ids, collapsed picker entries,
 // and hidden compatibility aliases for saved selections. The CCA envelope's `model` field must
 // receive the wire id (for example "Gemini 3.1 Pro (High)" => gemini-pro-agent), while the
-// picker exposes collapsed base models with reasoning-effort routing.
+// picker exposes collapsed base models only when CCA returns every known tier; otherwise each
+// returned wire id remains visible so an unavailable tier cannot be selected.
 
 // ── Wire IDs (what CCA :fetchAvailableModels returns) ──
 const ANTIGRAVITY_WIRE_MODELS = [
@@ -19,6 +22,21 @@ const ANTIGRAVITY_WIRE_MODELS = [
   "gpt-oss-120b-medium",
 ];
 
+const ANTIGRAVITY_PICKER_MODEL_BY_WIRE_ID: Record<string, string> = {
+  "gemini-3.6-flash-low": "gemini-3.6-flash",
+  "gemini-3.6-flash-medium": "gemini-3.6-flash",
+  "gemini-3.6-flash-high": "gemini-3.6-flash",
+  "gemini-3.1-pro-low": "gemini-3.1-pro",
+  "gemini-pro-agent": "gemini-3.1-pro",
+};
+
+const ANTIGRAVITY_WIRE_IDS_BY_PICKER_MODEL: Record<string, string[]> = Object.entries(
+  ANTIGRAVITY_PICKER_MODEL_BY_WIRE_ID,
+).reduce<Record<string, string[]>>((out, [wireId, pickerId]) => {
+  (out[pickerId] ??= []).push(wireId);
+  return out;
+}, {});
+
 // ── Effort ladders per collapsed base model ──
 // Gemini models: effort → wire model suffix (official agy UI pattern).
 // Claude Opus: effort → thinkingConfig.thinkingLevel (CLIProxyAPI proven pattern).
@@ -100,8 +118,8 @@ const ANTIGRAVITY_WIRE_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
   "gemini-3.1-pro-low": 1_048_576,
   "gemini-pro-agent": 1_048_576,
   "gemini-3.1-flash-image": 1_048_576,
-  "claude-sonnet-4-6": 200_000,
-  "claude-opus-4-6-thinking": 1_000_000,
+  "claude-sonnet-4-6": 250_000,
+  "claude-opus-4-6-thinking": 250_000,
   "gpt-oss-120b-medium": 131_072,
 };
 
@@ -119,6 +137,100 @@ export const ANTIGRAVITY_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
   ),
 };
 
+export const ANTIGRAVITY_MODEL_INPUT_MODALITIES: Record<string, string[]> = {
+  "gemini-3.6-flash": ["text", "image"],
+  "gemini-3.1-pro": ["text", "image"],
+  "gemini-3.1-flash-image": ["text", "image"],
+  "claude-sonnet-4-6": ["text", "image"],
+  "claude-opus-4-6-thinking": ["text", "image"],
+  "gpt-oss-120b-medium": ["text"],
+};
+
+export interface AntigravityAvailableModel {
+  id: string;
+  contextWindow?: number;
+  inputModalities?: string[];
+}
+
+function antigravityRecord(value: unknown): Record<string, unknown> | undefined {
+  return value !== null && typeof value === "object" && !Array.isArray(value)
+    ? value as Record<string, unknown>
+    : undefined;
+}
+
+function antigravityPositiveInteger(value: unknown): number | undefined {
+  return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : undefined;
+}
+
+/**
+ * Extract the CCA models that are valid for agent requests. The endpoint also returns tab,
+ * command, commit-message, transcription, and standalone image-generation models; those are not
+ * callable through the CCA agent envelope and must not be published to the Codex catalog.
+ */
+export function parseAntigravityAvailableModels(
+  payload: unknown,
+  maxModels = MODEL_DISCOVERY_MAX_MODELS,
+): AntigravityAvailableModel[] | null {
+  const limit = Number.isSafeInteger(maxModels) && maxModels > 0
+    ? Math.min(maxModels, MODEL_DISCOVERY_MAX_MODELS)
+    : MODEL_DISCOVERY_MAX_MODELS;
+  const body = antigravityRecord(payload);
+  if (!body) return null;
+  const models = antigravityRecord(body?.models);
+  const sorts = Array.isArray(body?.agentModelSorts) ? body.agentModelSorts : undefined;
+  if (!models || !sorts) return null;
+
+  const ids: string[] = [];
+  for (const sort of sorts) {
+    const groups = antigravityRecord(sort)?.groups;
+    if (!Array.isArray(groups)) return null;
+    for (const group of groups) {
+      const modelIds = antigravityRecord(group)?.modelIds;
+      if (!Array.isArray(modelIds)) return null;
+      for (const id of modelIds) {
+        if (!isValidModelDiscoveryModelId(id)
+          || !antigravityRecord(models[id])
+          || ids.length >= limit) return null;
+        ids.push(id);
+      }
+    }
+  }
+  // This model is exposed by Antigravity's agent chat surface even though it is grouped under
+  // image generation in the discovery response.
+  if (Array.isArray(body.imageGenerationModelIds)
+    && body.imageGenerationModelIds.includes("gemini-3.1-flash-image")) {
+    if (ids.length >= limit) return null;
+    ids.push("gemini-3.1-flash-image");
+  }
+
+  const available = new Map<string, Record<string, unknown>>();
+  for (const wireId of ids) {
+    const info = antigravityRecord(models[wireId]);
+    if (!info || available.has(wireId)) continue;
+    // Legacy compatibility aliases are deliberately routed to newer wire ids for saved
+    // selections. They are not safe as independently discovered picker rows.
+    if (ANTIGRAVITY_MODEL_ALIASES[wireId] && ANTIGRAVITY_MODEL_ALIASES[wireId] !== wireId) continue;
+    available.set(wireId, info);
+  }
+
+  const out: AntigravityAvailableModel[] = [];
+  const seen = new Set<string>();
+  for (const [wireId, info] of available) {
+    const pickerId = ANTIGRAVITY_PICKER_MODEL_BY_WIRE_ID[wireId];
+    const completePickerSet = pickerId !== undefined
+      && ANTIGRAVITY_WIRE_IDS_BY_PICKER_MODEL[pickerId]!.every(id => available.has(id));
+    const id = completePickerSet ? pickerId! : wireId;
+    if (seen.has(id)) continue;
+    seen.add(id);
+    out.push({
+      id,
+      ...(antigravityPositiveInteger(info.maxTokens) ? { contextWindow: antigravityPositiveInteger(info.maxTokens) } : {}),
+      inputModalities: info.supportsImages === true ? ["text", "image"] : ["text"],
+    });
+  }
+  return out;
+}
+
 export function resolveAntigravityWireModelId(modelId: string): string {
   return ANTIGRAVITY_MODEL_ALIASES[modelId] ?? modelId;
 }

package/src/providers/context-cap.ts

@@ -33,19 +33,27 @@ export function globalContextCapValue(config: Pick<OcxConfig, "contextCapValue">
   return isValidContextCap(value) ? Math.floor(value) : DEFAULT_PROVIDER_CONTEXT_CAP;
 }
 
-export function setProviderContextCap(config: OcxConfig, provider: string, enabled: boolean): void {
+export function setProviderContextCap(config: OcxConfig, provider: string, enabled: boolean, value?: number): void {
   const next = providerContextCaps(config);
-  if (enabled) next[provider] = globalContextCapValue(config);
-  else delete next[provider];
+  if (enabled) {
+    next[provider] = isValidContextCap(value) ? Math.floor(value) : globalContextCapValue(config);
+  } else {
+    delete next[provider];
+  }
   if (Object.keys(next).length > 0) config.providerContextCaps = next;
   else delete config.providerContextCaps;
 }
 
-/** Set the global cap value and re-point every already-enabled provider to it. */
-export function setGlobalContextCapValue(config: OcxConfig, value: number): void {
+/**
+ * Set the global cap value (the default used by per-provider toggles and "set all").
+ * Re-points every already-enabled provider only when `applyToAll` is true (the dashboard's
+ * "apply to every routed provider" toggle); otherwise each provider keeps its own cap value.
+ */
+export function setGlobalContextCapValue(config: OcxConfig, value: number, applyToAll: boolean): void {
   if (!isValidContextCap(value)) return;
   const next = Math.floor(value);
   config.contextCapValue = next;
+  if (!applyToAll) return;
   const caps = providerContextCaps(config);
   for (const provider of Object.keys(caps)) caps[provider] = next;
   if (Object.keys(caps).length > 0) config.providerContextCaps = caps;

package/src/providers/model-discovery-limits.ts

@@ -0,0 +1,16 @@
+/** Hard process-wide limits shared by all live model-discovery parsers. */
+export const MODEL_DISCOVERY_MAX_RESPONSE_BYTES = 4 * 1024 * 1024;
+export const MODEL_DISCOVERY_MAX_MODELS = 2_000;
+export const MODEL_DISCOVERY_MAX_MODEL_ID_LENGTH = 1_024;
+
+const MODEL_DISCOVERY_MODEL_ID_CONTROL_CHARS = /[\u0000-\u001f\u007f-\u009f\u2028\u2029]/;
+
+/** Reject model IDs that cannot safely be published as callable catalog selectors. */
+export function isValidModelDiscoveryModelId(value: unknown): value is string {
+  if (typeof value !== "string") return false;
+  const normalized = value.trim();
+  return Boolean(normalized)
+    && normalized === value
+    && normalized.length <= MODEL_DISCOVERY_MAX_MODEL_ID_LENGTH
+    && !MODEL_DISCOVERY_MODEL_ID_CONTROL_CHARS.test(normalized);
+}

package/src/providers/model-discovery.ts

@@ -1,4 +1,16 @@
 import type { OcxProviderConfig } from "../types";
+import {
+  isValidModelDiscoveryModelId,
+  MODEL_DISCOVERY_MAX_MODEL_ID_LENGTH,
+  MODEL_DISCOVERY_MAX_MODELS,
+  MODEL_DISCOVERY_MAX_RESPONSE_BYTES,
+} from "./model-discovery-limits";
+export {
+  isValidModelDiscoveryModelId,
+  MODEL_DISCOVERY_MAX_MODEL_ID_LENGTH,
+  MODEL_DISCOVERY_MAX_MODELS,
+  MODEL_DISCOVERY_MAX_RESPONSE_BYTES,
+} from "./model-discovery-limits";
 import {
   getProviderRegistryEntry,
   providerMatchesRegistryTransport,
@@ -9,13 +21,8 @@ import {
   type ProviderModelDiscoverySpec,
 } from "./registry";
 
-/** Hard process-wide limits. Registry entries may lower, but never raise, these ceilings. */
-export const MODEL_DISCOVERY_MAX_RESPONSE_BYTES = 4 * 1024 * 1024;
-export const MODEL_DISCOVERY_MAX_MODELS = 2_000;
-export const MODEL_DISCOVERY_MAX_MODEL_ID_LENGTH = 1_024;
 const MODEL_DISCOVERY_MAX_FILTER_VALUES = 256;
 const MODEL_DISCOVERY_MAX_FILTER_STRING_LENGTH = 1_024;
-const MODEL_DISCOVERY_MODEL_ID_CONTROL_CHARS = /[\u0000-\u001f\u007f-\u009f\u2028\u2029]/;
 
 export interface ResolvedProviderModelDiscovery {
   spec?: ProviderModelDiscoverySpec;
@@ -343,16 +350,8 @@ export function extractProviderModelItems(
       return { ok: false, reason: "invalid_shape" };
     }
     const id = (raw as { id?: unknown }).id;
-    if (typeof id !== "string") return { ok: false, reason: "invalid_shape" };
-    const normalizedId = id.trim();
-    if (
-      !normalizedId
-      || normalizedId !== id
-      || normalizedId.length > MODEL_DISCOVERY_MAX_MODEL_ID_LENGTH
-      || MODEL_DISCOVERY_MODEL_ID_CONTROL_CHARS.test(normalizedId)
-    ) {
-      return { ok: false, reason: "invalid_shape" };
-    }
+    if (!isValidModelDiscoveryModelId(id)) return { ok: false, reason: "invalid_shape" };
+    const normalizedId = id;
     const item = raw as ProviderModelsApiItem;
     if (!providerModelMatchesDiscoveryFilter(item, discovery.spec?.filter) || seen.has(normalizedId)) continue;
     seen.add(normalizedId);

package/src/providers/provider-id-rewrite.ts

@@ -148,3 +148,32 @@ export function rewriteProviderReferences(config: OcxConfig, from: string, to: s
 
   return { changed, collisions };
 }
+
+/**
+ * Drop the custom-model rows that belonged to a provider being removed.
+ *
+ * The sibling of the rename pass above. `rewriteProviderReferences` already
+ * carries `customModels[].provider` across a rename, so the array tracks the
+ * provider lifecycle — but removal used to delete only `config.providers[name]`
+ * and leave the rows behind. Those orphans still reach `/api/models` and the
+ * generated Codex catalog, which key on the row rather than on provider
+ * existence, so they surface as models that resolve to nothing (#1273).
+ *
+ * Only the rows are touched: the `customModelCatalogMigration` marker records
+ * one-time ownership of pre-marker rows and must survive removal unchanged, or
+ * an older binary's view of that ownership silently changes.
+ *
+ * Returns the number of rows dropped so callers can report it.
+ */
+export function dropProviderCustomModels(config: OcxConfig, provider: string): number {
+  const existing = config.customModels;
+  if (!Array.isArray(existing) || existing.length === 0) return 0;
+  const kept = existing.filter(model => model.provider !== provider);
+  if (kept.length === existing.length) return 0;
+  // Match the add/remove routes: an emptied list is dropped rather than left as
+  // `[]`, so the `customModels` field is absent either way. Only that field —
+  // the `customModelCatalogMigration` marker is deliberately left in place.
+  if (kept.length > 0) config.customModels = kept;
+  else delete config.customModels;
+  return existing.length - kept.length;
+}

package/src/providers/quota.ts

@@ -11,6 +11,7 @@ import { getValidAccessToken, getValidAccessTokenForAccount } from "../oauth";
 import { getAccountCredential, getAccountSet, getCredential } from "../oauth/store";
 import { antigravityUserAgent } from "../adapters/client-fingerprint";
 import { apiKeyPoolEntryId } from "./api-keys";
+import { XAI_GROK_CLIENT_VERSION, XAI_GROK_COMPATIBILITY } from "./xai-transport";
 import { getProviderRegistryEntry, providerCodexAccountMode } from "./registry";
 import type { OcxConfig, OcxProviderConfig } from "../types";
 import { isCanonicalOpenAiForwardProvider, OPENAI_CODEX_PROVIDER_ID } from "./openai-tiers";
@@ -44,6 +45,8 @@ const VENICE_BASE_URL = "https://api.venice.ai/api/v1";
 const SYNTHETIC_BASE_URL = "https://api.synthetic.new/v2";
 const DEEPINFRA_BASE_URL = "https://api.deepinfra.com";
 const NEURALWATT_BASE_URL = "https://api.neuralwatt.com/v1";
+const XAI_BILLING_URL = "https://cli-chat-proxy.grok.com/v1/billing";
+const XAI_CREDITS_URL = `${XAI_BILLING_URL}?format=credits`;
 /** Keep a failed probe's previous row at most this long before dropping it. */
 const LAST_GOOD_MAX_AGE_MS = CODEX_CAPACITY_MAX_QUOTA_AGE_MS;
 const nativeMainReportGenerations = new WeakMap<ProviderQuotaReport, number>();
@@ -977,6 +980,65 @@ function centsValue(value: unknown): number | undefined {
   return rec ? toFiniteNumber(rec.val) : undefined;
 }
 
+/** Decode JWT payload `sub` for xAI weekly credits when the stored credential lacks accountId. */
+function xaiUserIdFromAccessToken(accessToken: string): string | undefined {
+  const parts = accessToken.split(".");
+  if (parts.length < 2 || !parts[1]) return undefined;
+  try {
+    const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8")) as { sub?: unknown };
+    return typeof payload.sub === "string" && payload.sub.trim() ? payload.sub.trim() : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Grok Build weekly credits envelope:
+ * `{ config: { creditUsagePercent?, currentPeriod: { type: "USAGE_PERIOD_TYPE_WEEKLY", end } } }`.
+ * Omitted percent is treated as 0 (proto3 default).
+ */
+export function parseXaiCreditsResponse(value: unknown): { percent: number; resetAt?: number } | null {
+  const body = asRecord(value);
+  const config = asRecord(body?.config);
+  if (!config) return null;
+  const period = asRecord(config.currentPeriod);
+  if (!period || period.type !== "USAGE_PERIOD_TYPE_WEEKLY") return null;
+  const resetAt = normalizeResetAt(period.end);
+  if (resetAt === undefined) return null;
+  if (config.creditUsagePercent !== undefined) {
+    const percent = normalizePercent(config.creditUsagePercent);
+    if (percent === undefined) return null;
+    return { percent, resetAt };
+  }
+  return { percent: 0, resetAt };
+}
+
+async function fetchXaiWeeklyCredits(accessToken: string, userId: string): Promise<ProviderQuota | null> {
+  try {
+    const response = await fetch(XAI_CREDITS_URL, {
+      headers: {
+        Accept: "application/json",
+        Authorization: `Bearer ${accessToken}`,
+        [XAI_GROK_COMPATIBILITY.headers.tokenAuth]: "xai-grok-cli",
+        [XAI_GROK_COMPATIBILITY.headers.authenticateResponse]: "authenticate-response",
+        "x-userid": userId,
+        [XAI_GROK_COMPATIBILITY.headers.clientVersion]: XAI_GROK_CLIENT_VERSION,
+      },
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+    });
+    if (!response.ok) return null;
+    const parsed = parseXaiCreditsResponse(await response.json().catch(() => null));
+    if (!parsed) return null;
+    return {
+      weeklyPercent: parsed.percent,
+      ...(parsed.resetAt !== undefined ? { weeklyResetAt: parsed.resetAt } : {}),
+      updatedAt: Date.now(),
+    };
+  } catch {
+    return null;
+  }
+}
+
 async function fetchXaiQuota(provider: string): Promise<ProviderQuotaReport | null> {
   let accessToken: string;
   try {
@@ -984,25 +1046,37 @@ async function fetchXaiQuota(provider: string): Promise<ProviderQuotaReport | nu
   } catch {
     return null;
   }
-  const response = await fetch("https://cli-chat-proxy.grok.com/v1/billing", {
-    headers: { Accept: "application/json", Authorization: `Bearer ${accessToken}` },
-    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
-  });
-  if (!response.ok) return null;
-  const body = asRecord(await response.json().catch(() => null));
-  const config = asRecord(body?.config);
-  if (!config) return null;
-  const limitCents = centsValue(config.monthlyLimit);
-  const usedCents = centsValue(config.used);
-  if (limitCents === undefined || usedCents === undefined || limitCents <= 0) return null;
-  const percent = normalizePercent((usedCents / limitCents) * 100);
-  if (percent === undefined) return null;
-  const quota: ProviderQuota = {
-    monthlyPercent: percent,
-    monthlyResetAt: normalizeResetAt(config.billingPeriodEnd),
-    updatedAt: Date.now(),
-  };
-  return report(provider, "xai:grok-billing", quota);
+
+  // Prefer the SuperGrok weekly credits window that actually gates prompting (#1283).
+  const userId = getCredential("xai")?.accountId?.trim() || xaiUserIdFromAccessToken(accessToken);
+  if (userId) {
+    const weekly = await fetchXaiWeeklyCredits(accessToken, userId);
+    if (weekly) return report(provider, "xai:grok-billing-credits", weekly);
+  }
+
+  // Legacy monthly dollar pool — retained when weekly is unavailable.
+  try {
+    const response = await fetch(XAI_BILLING_URL, {
+      headers: { Accept: "application/json", Authorization: `Bearer ${accessToken}` },
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+    });
+    if (!response.ok) return null;
+    const body = asRecord(await response.json().catch(() => null));
+    const config = asRecord(body?.config);
+    if (!config) return null;
+    const limitCents = centsValue(config.monthlyLimit);
+    const usedCents = centsValue(config.used);
+    if (limitCents === undefined || usedCents === undefined || limitCents <= 0) return null;
+    const percent = normalizePercent((usedCents / limitCents) * 100);
+    if (percent === undefined) return null;
+    return report(provider, "xai:grok-billing", {
+      monthlyPercent: percent,
+      monthlyResetAt: normalizeResetAt(config.billingPeriodEnd),
+      updatedAt: Date.now(),
+    });
+  } catch {
+    return null;
+  }
 }
 
 function parseClaudeBucket(value: unknown): { percent?: number; resetAt?: number } | null {