@bitkyc08/opencodex 2.25.0 → 2.26.0

package/src/oauth/index.ts

@@ -292,12 +292,56 @@ export class UnsupportedOAuthProviderError extends Error {
 }
 
 export class OAuthLoginRequiredError extends Error {
+  readonly provider: string;
+
   constructor(provider: string) {
     super(`Not logged in to ${provider}. Run: ocx login ${provider}`);
     this.name = "OAuthLoginRequiredError";
+    this.provider = provider;
+  }
+}
+
+export class OAuthProviderPublicationError extends Error {
+  constructor() {
+    super("OAuth credential was saved, but the provider entry was not written. Resolve the account namespace collision, then retry login.");
+    this.name = "OAuthProviderPublicationError";
   }
 }
 
+export class OAuthReauthIdentityMismatchError extends Error {
+  constructor() {
+    super("Signed-in account does not match the selected account. Sign in with the same account.");
+    this.name = "OAuthReauthIdentityMismatchError";
+  }
+}
+
+export class OAuthReauthIdentityUnverifiedError extends Error {
+  constructor() {
+    super("Could not verify signed-in account identity for reauth.");
+    this.name = "OAuthReauthIdentityUnverifiedError";
+  }
+}
+
+/** Project arbitrary OAuth failures onto the small, stable public error vocabulary. */
+export function publicOAuthAuthenticationErrorMessage(error: unknown): string {
+  if (error instanceof OAuthMutationBusyError) {
+    return error.message === "OAuth mutation queue wait timed out"
+      ? "OAuth mutation queue wait timed out"
+      : "OAuth mutation queue is busy";
+  }
+  if (
+    (error instanceof OAuthLoginRequiredError && isOAuthProvider(error.provider))
+    || error instanceof OAuthProviderPublicationError
+    // Reauth identity outcomes carry fixed, account-free remediation text. Dropping them to the
+    // generic message hides WHICH failure the user must fix (sign in with the selected account).
+    || error instanceof OAuthReauthIdentityMismatchError
+    || error instanceof OAuthReauthIdentityUnverifiedError
+    || error instanceof OAuthTokenRefreshBusyError
+    || error instanceof OAuthTokenRefreshStaleError
+  ) return error.message;
+  return "OAuth authentication failed. Check the OpenCodex account status and retry.";
+}
+
 function accessSnapshot(provider: string, accountId: string, cred: OAuthCredentials): OAuthAccessSnapshot {
   const storedKiroRouting = {
     ...(cred.kiro?.profileArn ? { profileArn: cred.kiro.profileArn } : {}),
@@ -1111,7 +1155,7 @@ export async function runLogin(
       const existing = getAccountCredential(provider, opts.reauthAccountId);
       if (!existing) throw new Error(`Unknown account for reauth: ${opts.reauthAccountId}`);
       if (!existing.accountId && !existing.email) {
-        throw new Error("Could not verify signed-in account identity for reauth.");
+        throw new OAuthReauthIdentityUnverifiedError();
       }
       const identityMatches = existing.accountId && cred.accountId
         ? existing.accountId === cred.accountId
@@ -1119,7 +1163,7 @@ export async function runLogin(
           ? existing.email.toLowerCase() === cred.email.toLowerCase()
           : false;
       if (!identityMatches) {
-        throw new Error("Signed-in account does not match the selected account. Sign in with the same account.");
+        throw new OAuthReauthIdentityMismatchError();
       }
       await (deps.saveAccountCredential ?? saveAccountCredential)(provider, opts.reauthAccountId, cred);
     } else {
@@ -1136,10 +1180,7 @@ export async function runLogin(
         provider,
       );
       if (lateCollision) {
-        throw new Error(
-          `${lateCollision}. The credential for "${provider}" was saved, but the provider entry was not written. `
-          + "Rename the account selector, then re-run the login.",
-        );
+        throw new OAuthProviderPublicationError();
       }
       upsertOAuthProvider(latestConfig, provider);
       saveLatestConfig(latestConfig);
@@ -1381,7 +1422,16 @@ export async function startLoginFlow(
       onManualCodeInput: (expectedState?: string) => waitForManualLoginCode(provider, abort.signal, expectedState),
       signal: abort.signal,
     };
+    const abandonIfNotOwner = (error?: unknown): boolean => {
+      if (loginAbort.get(provider) === abort) return false;
+      if (!urlResolved) reject(error ?? new Error("OAuth login was superseded"));
+      return true;
+    };
     const settle = async (error?: unknown): Promise<void> => {
+      // Cancellation deletes this controller and records its own terminal result. A late provider
+      // rejection (or an older flow settling after a replacement starts) must not overwrite that
+      // state or delete the replacement flow's controller/manual-code slot.
+      if (abandonIfNotOwner(error)) return;
       let finalError = error;
       try {
         await lifecycle?.onSettled?.();
@@ -1390,6 +1440,7 @@ export async function startLoginFlow(
         // runtime config. For an already-failed login, keep the original recovery error.
         if (finalError === undefined) finalError = settleError;
       }
+      if (abandonIfNotOwner(finalError)) return;
       if (finalError === undefined) {
         loginAbort.delete(provider);
         clearManualCodeSlot(provider);
@@ -1403,7 +1454,7 @@ export async function startLoginFlow(
       const e = finalError;
       loginAbort.delete(provider);
       clearManualCodeSlot(provider);
-      const msg = e instanceof Error ? e.message : String(e);
+      const msg = publicOAuthAuthenticationErrorMessage(e);
       loginState.set(provider, { done: true, error: msg });
       if (!urlResolved) reject(e);
     };
@@ -1414,9 +1465,10 @@ export async function startLoginFlow(
       (e: unknown) => settle(e),
     ).catch((e: unknown) => {
       // settle catches lifecycle failures, so this is only a defensive promise-boundary guard.
+      if (abandonIfNotOwner(e)) return;
       loginAbort.delete(provider);
       clearManualCodeSlot(provider);
-      const msg = e instanceof Error ? e.message : String(e);
+      const msg = publicOAuthAuthenticationErrorMessage(e);
       loginState.set(provider, { done: true, error: msg });
       if (!urlResolved) reject(e);
     });

package/src/providers/antigravity-models.ts

@@ -78,9 +78,6 @@ function pickerModelIdForDiscoveredWireId(
   info: Record<string, unknown>,
   available: ReadonlyMap<string, Record<string, unknown>>,
 ): string {
-  const displayModelId = antigravityDisplayModelId(info.displayName, wireId);
-  if (displayModelId) return displayModelId;
-
   const explicitPickerId = Object.hasOwn(ANTIGRAVITY_PICKER_MODEL_BY_WIRE_ID, wireId)
     ? ANTIGRAVITY_PICKER_MODEL_BY_WIRE_ID[wireId]
     : undefined;
@@ -107,9 +104,35 @@ function pickerModelIdForDiscoveredWireId(
       return baseId;
     }
   }
+
+  // Display labels are a LAST resort, never a first one. CCA labels a tier row
+  // "Gemini 3.7 Flash (High)", which slugs to `gemini-3.7-flash-high` — a per-tier
+  // picker row that re-splits exactly the ladder the collapse rules above just
+  // joined, and that carries no effort ladder of its own. Consulting the label
+  // first (the #1897 regression) turned every collapsed base model back into three
+  // suffix rows and stripped reasoning-effort control from the picker.
+  //
+  // The label still earns its keep where nothing else can speak: an id Google has
+  // renamed on the wire while keeping a stable public name.
+  const displayModelId = antigravityDisplayModelId(info.displayName, wireId);
+  if (displayModelId && !collapsesIntoKnownPickerModel(displayModelId)) return displayModelId;
+
   return wireId;
 }
 
+/**
+ * Whether a display-derived id is really a tier of a picker-visible base model.
+ *
+ * `gemini-3.7-flash-high` looks like a model id and is not one: it is the "high"
+ * rung of `gemini-3.7-flash`, whose ladder lives in ANTIGRAVITY_MODEL_EFFORTS.
+ * Publishing it as its own row is what breaks effort selection.
+ */
+function collapsesIntoKnownPickerModel(candidateId: string): boolean {
+  const effortMatch = /^(.*)-(low|medium|high)$/.exec(candidateId);
+  const baseId = effortMatch?.[1];
+  return baseId !== undefined && isKnownAntigravityPickerModelId(baseId);
+}
+
 // ── Effort ladders per collapsed base model ──
 // Gemini models: effort → wire model suffix (official agy UI pattern).
 // Claude Opus: effort → thinkingConfig.thinkingLevel (CLIProxyAPI proven pattern).
@@ -389,6 +412,16 @@ export function parseAntigravityAvailableModels(
       }
     }
   }
+  // This model is exposed by Antigravity's agent chat surface even though the discovery
+  // response groups it under image generation, so it never appears in agentModelSorts.
+  if (Array.isArray(body.imageGenerationModelIds)
+    && body.imageGenerationModelIds.includes("gemini-3.1-flash-image")
+    && Object.hasOwn(models, "gemini-3.1-flash-image")
+    && antigravityRecord(models["gemini-3.1-flash-image"])
+    && !ids.includes("gemini-3.1-flash-image")) {
+    if (ids.length >= limit) return null;
+    ids.push("gemini-3.1-flash-image");
+  }
   // Newer CCA responses identify tiered Flash models through this index instead of
   // adding their synthetic wire ids to agentModelSorts.
   const tieredModelIds = antigravityRecord(body.tieredModelIds);
@@ -413,6 +446,16 @@ export function parseAntigravityAvailableModels(
   for (const wireId of ids) {
     const info = antigravityRecord(models[wireId]);
     if (!info || available.has(wireId)) continue;
+    // Compatibility aliases are deliberately routed to NEWER wire ids for saved
+    // selections. CCA keeps serving retired generations (3.5/3.6 Flash tiers) in its
+    // agent list long after they stop being the model anyone should pick, so admitting
+    // them as independently discovered rows republishes exactly the dead tiers the
+    // alias map exists to retire. Routing for a saved id still works — it resolves
+    // through ANTIGRAVITY_MODEL_ALIASES — it just no longer gets its own picker row.
+    const alias = Object.hasOwn(ANTIGRAVITY_MODEL_ALIASES, wireId)
+      ? ANTIGRAVITY_MODEL_ALIASES[wireId]
+      : undefined;
+    if (alias && alias !== wireId) continue;
     available.set(wireId, info);
   }
 
@@ -479,7 +522,18 @@ export function resolveAntigravityEffortWireModel(
   effort?: string,
   baseUrl?: string,
 ): { wireModelId: string; thinkingLevel?: string } {
-  const discoveredWireModelId = discoveredAntigravityWireModelId(modelId, baseUrl);
+  // A collapsed picker row reports ONE representative wire id (whichever tier CCA
+  // listed first), so live discovery cannot describe a ladder — it can only name a
+  // single rung. Letting it answer for a base model we already have a ladder for
+  // collapses every effort onto that one rung: `gemini-3.1-pro` low and high both
+  // became `gemini-pro-agent`, and `gemini-3.7-flash` sent thinkingLevel=low against
+  // the `-high` wire id, a request that contradicts itself. Rules 1b/2/3 below own
+  // these models; discovery answers only for ids no rule knows.
+  const hasOwnEffortLadder = Object.hasOwn(ANTIGRAVITY_THINKING_LEVEL_MODELS, modelId)
+    || Object.hasOwn(ANTIGRAVITY_EFFORT_WIRE_MAP, modelId);
+  const discoveredWireModelId = hasOwnEffortLadder
+    ? undefined
+    : discoveredAntigravityWireModelId(modelId, baseUrl);
   if (discoveredWireModelId && (discoveredWireModelId !== modelId || isAntigravitySuffixModelId(modelId))) {
     const defaultLevel = ANTIGRAVITY_THINKING_LEVEL_MODELS[modelId];
     return {

package/src/providers/command-code-efforts.ts

@@ -9,14 +9,31 @@ const COMMAND_CODE_MODEL_EFFORTS = {
     efforts: ["high", "max"],
     profileUrl: "https://commandcode.ai/models/deepseek-v4-flash",
   },
-  "zai-org/glm-5.3": {
-    efforts: ["low", "high", "max"],
-    profileUrl: "https://commandcode.ai/models/glm-5-3",
+  // Keys must match the EXACT upstream /provider/v1/models ids (GLM ships as
+  // `zai-org/GLM-5.3`, not `zai-org/glm-5.3`). The table doubles as the router's
+  // known-ids decode source (via `knownModelIdsForProvider`), so a case mismatch
+  // makes the Codex-facing slug `commandcode/zai-org-GLM-5.3` pass through
+  // undecoded and upstream rejects it with `unsupported_model`.
+  "zai-org/GLM-5": {
+    efforts: ["high", "max"],
+    profileUrl: "https://commandcode.ai/models/glm-5",
   },
-  "zai-org/glm-5.2": {
+  "zai-org/GLM-5.1": {
+    efforts: ["high", "max"],
+    profileUrl: "https://commandcode.ai/models/glm-5-1",
+  },
+  "zai-org/GLM-5.2": {
     efforts: ["high", "max"],
     profileUrl: "https://commandcode.ai/models/glm-5-2",
   },
+  "zai-org/GLM-5.2-Fast": {
+    efforts: ["high", "max"],
+    profileUrl: "https://commandcode.ai/models/glm-5-2-fast",
+  },
+  "zai-org/GLM-5.3": {
+    efforts: ["low", "high", "max"],
+    profileUrl: "https://commandcode.ai/models/glm-5-3",
+  },
   // Muse Spark: CLI currently prints "has no adjustable reasoning effort" and
   // blocks --effort locally, but the upstream /alpha/generate endpoint accepts
   // reasoning_effort low..max for meta/muse-spark-1.2-contributor (verified
@@ -53,8 +70,14 @@ function keyFor(modelId: string): string {
 
 export function commandCodeReasoningEfforts(modelId: string): readonly string[] | undefined {
   const key = keyFor(modelId);
-  return refreshedEfforts.get(key)
-    ?? (Object.hasOwn(COMMAND_CODE_MODEL_REASONING_EFFORTS, key) ? COMMAND_CODE_MODEL_REASONING_EFFORTS[key] : undefined);
+  const refreshed = refreshedEfforts.get(key);
+  if (refreshed !== undefined) return refreshed;
+  // Case-insensitive: the table keys match the EXACT upstream ids (e.g. `zai-org/GLM-5.3`),
+  // but callers may pass either case.
+  for (const [id, efforts] of Object.entries(COMMAND_CODE_MODEL_REASONING_EFFORTS)) {
+    if (keyFor(id) === key) return efforts;
+  }
+  return undefined;
 }
 
 function parsedProfileEfforts(page: string): string[] | undefined {
@@ -82,9 +105,13 @@ export async function refreshCommandCodeReasoningEfforts(
   fetchFn: typeof globalThis.fetch = globalThis.fetch,
 ): Promise<readonly string[] | undefined> {
   const key = keyFor(modelId);
-  const profile = Object.hasOwn(COMMAND_CODE_MODEL_EFFORTS, key)
-    ? COMMAND_CODE_MODEL_EFFORTS[key as keyof typeof COMMAND_CODE_MODEL_EFFORTS]
-    : undefined;
+  let profile: { efforts: readonly string[]; profileUrl: string } | undefined;
+  for (const [id, row] of Object.entries(COMMAND_CODE_MODEL_EFFORTS)) {
+    if (keyFor(id) === key) {
+      profile = row;
+      break;
+    }
+  }
   if (!profile) return undefined;
   try {
     const response = await fetchFn(profile.profileUrl, {

package/src/providers/context-cap.ts

@@ -27,6 +27,15 @@ export function applyProviderContextCap(contextWindow: number | undefined, cap:
   return contextWindow > cap ? cap : contextWindow;
 }
 
+/**
+ * 上游没报窗口时，已开启的 Context cap 就是实际窗口。
+ * 128k 只是 Codex 解析器的兼容底线，不能当成“已发现窗口”再拿去和 cap 做 min。
+ */
+export function resolveUnknownRoutedContextWindow(cap: number | undefined): number {
+  const window = isValidContextCap(cap) ? Math.floor(cap) : 0;
+  return window > 0 ? window : 128_000;
+}
+
 /** Effective global cap value: explicit config value, else the built-in default. */
 export function globalContextCapValue(config: Pick<OcxConfig, "contextCapValue">): number {
   const value = config.contextCapValue;

package/src/providers/derive.ts

@@ -1,4 +1,5 @@
 import type { CodexAccountMode, OcxProviderConfig } from "../types";
+import { cloneFastWire } from "./fastwire";
 import {
   PROVIDER_REGISTRY,
   registryEntryForProviderDestination,
@@ -459,6 +460,9 @@ export function enrichProviderFromRegistry(name: string, prov: OcxProviderConfig
   }
   // Registry-only metadata (never seeded into saved config): backfill straight from
   // the entry so an explicit user value stays distinguishable from the default.
+  if (prov.fastWire === undefined && entry.fastWire !== undefined) {
+    prov.fastWire = cloneFastWire(entry.fastWire);
+  }
   if (prov.supportsServiceTier === undefined && entry.supportsServiceTier !== undefined) prov.supportsServiceTier = entry.supportsServiceTier;
   if (prov.preserveResponsesReasoningContent === undefined && entry.preserveResponsesReasoningContent !== undefined) prov.preserveResponsesReasoningContent = entry.preserveResponsesReasoningContent;
   applyReasoningSummaryDefaults(prov, entry.modelSupportsReasoningSummaries);