@bitkyc08/opencodex 2.33.0 → 2.34.0

package/src/oauth/types.ts

@@ -1,6 +1,16 @@
 /** Minimal OAuth types, ported from jawcode packages/ai/src/utils/oauth/types.ts. */
 export type OAuthCredentialSource = "oauth" | "local-cli" | "credential-file" | "environment" | "manual";
 
+/**
+ * How the account authenticated. Mirrors `KiroAuthType` in `./kiro-credentials`, restated here so
+ * the credential-store types do not depend on the SQLite import module.
+ *
+ * `aws_sso_oidc` covers AWS Builder ID, which never issues an account-scoped CodeWhisperer
+ * profile ARN; the adapter needs that distinction to tell a Builder ID account apart from a
+ * `kiro_desktop` account whose profile import merely failed.
+ */
+export type KiroCredentialAuthType = "kiro_desktop" | "aws_sso_oidc";
+
 /** Account-scoped Kiro data required for refresh and request routing. */
 export interface KiroOAuthMetadata {
   profileArn?: string;
@@ -8,6 +18,11 @@ export interface KiroOAuthMetadata {
   apiRegion?: string;
   clientId?: string;
   clientSecret?: string;
+  /**
+   * Non-secret routing signal. Derived from the presence of a device-registration client pair, so
+   * it stays accurate even though `clientId`/`clientSecret` never leave the credential store.
+   */
+  authType?: KiroCredentialAuthType;
 }
 
 export type OAuthCredentials = {

package/src/providers/command-code-efforts.ts

@@ -9,12 +9,44 @@ const COMMAND_CODE_MODEL_EFFORTS = {
     efforts: ["high", "max"],
     profileUrl: "https://commandcode.ai/models/deepseek-v4-flash",
   },
-  // Ox Alpha (stealth preview, added in Command Code v1.31.0): free 1M-context
-  // reasoning model on every plan. The profile does not publish an effort ladder,
-  // so mirror the OpenRouter contract (reasoning mandatory; max/high/low).
-  "stealth/ox-alpha": {
-    efforts: ["low", "high", "max"],
-    profileUrl: "https://commandcode.ai/models/ox-alpha",
+  /*
+   * Three live routes that reached the catalog without an effort ladder (#2647).
+   * Without a row here the model advertises no efforts at all, so a client that
+   * sends one gets it stripped or rejected rather than honored.
+   *
+   * PROVENANCE, stated plainly: these three ladders are the reporter's
+   * (darwintree, #2647), recorded as reported and NOT independently verified.
+   * All three profileUrls return HTTP 200, but commandcode.ai renders these
+   * pages client-side and ships the ladder inside a serialized React payload
+   * whose `reasoningEfforts` array is EMPTY in the delivered HTML. There is no
+   * fetchable statement of these ladders to check them against.
+   *
+   * Do not assume the refresh path launders this. It does not:
+   * `parsedProfileEfforts` below matches prose of the form
+   * "Reasoning efforts ... are supported;", and `grep -c -i 'reasoning efforts'`
+   * against the live pages returns 0 — for these three AND for the older rows
+   * (deepseek-v4-pro, GLM-5.3, muse-spark-1.2 all measured 0 on 2026-08-27).
+   * So `refreshCommandCodeReasoningEfforts` returns undefined and the caller
+   * keeps whatever is written here, indefinitely. The self-correction mechanism
+   * is currently dead for EVERY row in this table, which is a pre-existing
+   * defect worth its own fix (teach the parser to read the embedded payload),
+   * not something these three rows introduced.
+   *
+   * The practical consequence: a wrong ladder here stays wrong until a human
+   * changes it. It degrades safely — an effort the upstream rejects surfaces as
+   * an error rather than silent corruption — but it does not self-heal.
+   */
+  "deepseek/deepseek-v4-flash-vision-exp": {
+    efforts: ["high", "max"],
+    profileUrl: "https://commandcode.ai/models/deepseek-v4-flash-vision-exp",
+  },
+  "gpt-5.6-luna": {
+    efforts: ["low", "medium", "high", "xhigh", "max"],
+    profileUrl: "https://commandcode.ai/models/gpt-5-6-luna",
+  },
+  "google/gemini-3.7-flash": {
+    efforts: ["low", "medium", "high"],
+    profileUrl: "https://commandcode.ai/models/gemini-3-7-flash",
   },
   // Keys must match the EXACT upstream /provider/v1/models ids (GLM ships as
   // `zai-org/GLM-5.3`, not `zai-org/glm-5.3`). The table doubles as the router's

package/src/providers/context-cap.ts

@@ -1,4 +1,5 @@
 import type { OcxConfig } from "../types";
+import { deleteConfigTopLevelKey } from "../config/rebase-provenance";
 
 export const DEFAULT_PROVIDER_CONTEXT_CAP = 350_000;
 
@@ -50,7 +51,7 @@ export function setProviderContextCap(config: OcxConfig, provider: string, enabl
     delete next[provider];
   }
   if (Object.keys(next).length > 0) config.providerContextCaps = next;
-  else delete config.providerContextCaps;
+  else deleteConfigTopLevelKey(config, "providerContextCaps");
 }
 
 /**
@@ -71,12 +72,12 @@ export function setGlobalContextCapValue(config: OcxConfig, value: number, apply
 /** Enable the cap for every named provider at the current value, or clear all caps. */
 export function setAllProviderContextCaps(config: OcxConfig, providerNames: string[], enabled: boolean): void {
   if (!enabled) {
-    delete config.providerContextCaps;
+    deleteConfigTopLevelKey(config, "providerContextCaps");
     return;
   }
   const value = globalContextCapValue(config);
   const next: Record<string, number> = {};
   for (const name of providerNames) next[name] = value;
   if (Object.keys(next).length > 0) config.providerContextCaps = next;
-  else delete config.providerContextCaps;
+  else deleteConfigTopLevelKey(config, "providerContextCaps");
 }

package/src/providers/default-aliases.ts

@@ -0,0 +1,65 @@
+import type { OcxConfig, OcxProviderConfig } from "../types";
+
+export const MODEL_ALIAS_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+
+/** Ordered, most-specific-first built-in aliases. Updated with the provider registry. */
+export const DEFAULT_MODEL_ALIASES: ReadonlyArray<{ match: RegExp; alias: string }> = [
+  { match: /^claude-opus-5/, alias: "opus" },
+  { match: /^claude-sonnet-5/, alias: "sonnet" },
+  { match: /^claude-haiku/, alias: "haiku" },
+  { match: /^gemini-3(?:\.\d+)?-pro/, alias: "g3p" },
+  { match: /^gemini-3(?:\.\d+)?-flash/, alias: "g3f" },
+  { match: /^deepseek-v4/, alias: "ds4" },
+  { match: /^grok-4/, alias: "grok" },
+];
+
+export interface EffectiveModelAlias { alias: string; source: "user" | "builtin" }
+
+function builtinRule(id: string): { match: RegExp; alias: string } | undefined {
+  const tail = id.slice(id.lastIndexOf("/") + 1);
+  return DEFAULT_MODEL_ALIASES.find(rule => rule.match.test(id) || rule.match.test(tail));
+}
+
+export function defaultAliasesEnabled(config: Pick<OcxConfig, "defaultModelAliases">, provider: OcxProviderConfig): boolean {
+  return provider.defaultAliases ?? config.defaultModelAliases ?? false;
+}
+
+export function effectiveModelAliases(
+  config: Pick<OcxConfig, "defaultModelAliases">,
+  provider: OcxProviderConfig,
+  knownIds: Iterable<string>,
+): Map<string, EffectiveModelAlias> {
+  const result = new Map<string, EffectiveModelAlias>();
+  for (const [id, alias] of Object.entries(provider.modelAliases ?? {})) {
+    if (typeof alias === "string" && MODEL_ALIAS_PATTERN.test(alias)) result.set(id, { alias, source: "user" });
+  }
+  if (!defaultAliasesEnabled(config, provider)) return result;
+  const claims = new Map<string, string[]>();
+  for (const id of knownIds) {
+    if (result.has(id)) continue;
+    const rule = builtinRule(id);
+    if (!rule) continue;
+    const key = rule.alias.toLowerCase();
+    claims.set(key, [...(claims.get(key) ?? []), id]);
+  }
+  for (const [alias, ids] of claims) {
+    if (ids.length !== 1) continue;
+    const id = ids[0]!;
+    // Catalog drift must skip, never shadow, a native id or explicit user alias.
+    if ([...knownIds].some(candidate => candidate.toLowerCase() === alias)) continue;
+    if ([...result.values()].some(value => value.alias.toLowerCase() === alias)) continue;
+    result.set(id, { alias: builtinRule(id)!.alias, source: "builtin" });
+  }
+  return result;
+}
+
+export function resolveModelAlias(
+  config: Pick<OcxConfig, "defaultModelAliases">,
+  provider: OcxProviderConfig,
+  knownIds: Iterable<string>,
+  requested: string,
+): string | undefined {
+  const needle = requested.toLowerCase();
+  return [...effectiveModelAliases(config, provider, knownIds)]
+    .find(([, value]) => value.alias.toLowerCase() === needle)?.[0];
+}

package/src/providers/derive.ts

@@ -390,6 +390,32 @@ function serviceTierModelDefaultsFor(
     : undefined;
 }
 
+/**
+ * Materialize the registry's verbosity opt-out into the provider config at seed/enrich time.
+ *
+ * The catalog hint pass must not read PROVIDER_REGISTRY: a gather flight captures its registry
+ * authority up front and forbids any later read, so consulting the registry per model turned
+ * every hint pass into a post-lookup read and dropped a custom-destination flight's own
+ * discovery result (tests/codex-gather-authority.test.ts).
+ *
+ * Registry values go in first so an explicit user entry still wins, matching
+ * `applyReasoningSummaryDefaults`. `supportsVerbosity` is the provider-wide default, expanded
+ * across the seeded model list so an id discovered later still inherits it through the same
+ * Record the hint pass already reads.
+ */
+function applyVerbosityDefaults(prov: OcxProviderConfig, entry: ProviderRegistryEntry | undefined): void {
+  if (!entry) return;
+  const perModel = entry.modelSupportsVerbosity;
+  if (!perModel && entry.supportsVerbosity === undefined) return;
+  prov.modelSupportsVerbosity = {
+    ...(perModel ?? {}),
+    ...(prov.modelSupportsVerbosity ?? {}),
+  };
+  if (entry.supportsVerbosity !== undefined) {
+    prov.supportsVerbosity ??= entry.supportsVerbosity;
+  }
+}
+
 /**
  * Last-resort enrichment for a provider whose NAME matches no registry id.
  *
@@ -426,6 +452,7 @@ export function enrichProviderFromRegistry(name: string, prov: OcxProviderConfig
     // destinations, so a templated or overridable base URL cannot be claimed by it.
     enrichReasoningSummariesByDestination(prov);
     applyServiceTierModelDefaults(prov, serviceTierModelDefaultsFor(registryEntryForProviderDestination(prov), prov));
+    applyVerbosityDefaults(prov, registryEntryForProviderDestination(prov));
     return;
   }
   const explicitDirectReasoning: DirectReasoningEffortOverrides = {
@@ -489,6 +516,7 @@ export function enrichProviderFromRegistry(name: string, prov: OcxProviderConfig
   if (prov.preserveResponsesReasoningContent === undefined && entry.preserveResponsesReasoningContent !== undefined) prov.preserveResponsesReasoningContent = entry.preserveResponsesReasoningContent;
   applyReasoningSummaryDefaults(prov, entry.modelSupportsReasoningSummaries);
   applyServiceTierModelDefaults(prov, serviceTierModelDefaultsFor(entry, prov));
+  applyVerbosityDefaults(prov, entry);
   // Registry-only repair policy (#938): fill only when the runtime provider has
   // no explicit policy, and deep-clone so saved/user values never alias the
   // registry constant.

package/src/providers/fastwire.ts

@@ -246,6 +246,7 @@ export function tierObservationContext(
   policy: ResolvedFastPolicy,
   fastMode: boolean | undefined,
   callerTier: string | undefined,
+  responseTierAuthoritative?: boolean,
 ): TierObservationContext {
   return {
     capability: policy.capability,
@@ -253,6 +254,7 @@ export function tierObservationContext(
     fastWire: policy.fastWire,
     demandDecision: fastMode === true ? "force-fast" : fastMode === false ? "force-default" : "inherit",
     ...(callerTier !== undefined ? { callerTier } : {}),
+    ...(responseTierAuthoritative !== undefined ? { responseTierAuthoritative } : {}),
   };
 }
 
@@ -344,7 +346,11 @@ export function createAdapterTierMetadata(
 
   const responseCanConfirmFast = effectiveFastRequested
     && context.eligibility === "eligible"
-    && wireValue !== null;
+    && wireValue !== null
+    // A destination whose echo is not authoritative can neither confirm nor deny Fast. The
+    // ChatGPT-internal Codex backend echoes "default" on priority-scheduled turns, so believing
+    // it reported every Fast request as `response-declined` (#2558).
+    && context.responseTierAuthoritative !== false;
   return {
     outcome,
     observeResponseServiceTier(value: unknown) {

package/src/providers/model-presets.ts

@@ -0,0 +1,119 @@
+/**
+ * Shipped per-provider "latest/core" model presets (#2465).
+ *
+ * Adding a high-volume provider exposes its entire catalog to the Codex picker on day one:
+ * openrouter ships 400+ rows, an Anthropic provider ships every historical snapshot. The useful
+ * set is a handful of current flagships, so a newly added provider seeds from a curated preset
+ * and "everything" stays one click away.
+ *
+ * Rules are ID PATTERNS rather than literal id lists so a vendor snapshot suffix does not stale
+ * the preset between releases: `claude-opus-5-20260814` and `claude-opus-5` both match one rule.
+ *
+ * The preset is a SEED, not a lock. Materialization evaluates these rules against the provider's
+ * current catalog and stores CONCRETE ids in `selectedModels`, so the visibility hot path
+ * (`filterCatalogVisibleModels`) never learns about patterns and an older binary still sees a
+ * plain allowlist. Design: devlog/_plan/260824_model_ux_aliases_and_defaults/030_default_preset.md
+ */
+
+import type { OcxProviderConfig } from "../types";
+
+export interface ModelPresetRule {
+  readonly pattern: RegExp;
+}
+
+export interface ModelPreset {
+  /** Bumped whenever this provider's rules change; drives upgrade reconciliation. */
+  readonly version: number;
+  readonly rules: readonly ModelPresetRule[];
+}
+
+/**
+ * Curated on the same release train as the provider registry. A provider WITHOUT an entry has no
+ * preset and behaves exactly as today (mode "all").
+ *
+ * Deliberately limited to high-volume catalogs. A provider that already ships a short curated
+ * list gains nothing from a preset and would only add a marker to reconcile.
+ */
+export const MODEL_PRESETS: Readonly<Record<string, ModelPreset>> = Object.freeze({
+  openrouter: {
+    version: 1,
+    rules: [
+      { pattern: /^anthropic\/claude-(opus|sonnet|haiku)-[45]/ },
+      { pattern: /^google\/gemini-3(\.\d+)?-(pro|flash)/ },
+      { pattern: /^openai\/gpt-5(\.\d+)?/ },
+      { pattern: /^deepseek\/deepseek-(v4|r2)/ },
+      { pattern: /^x-ai\/grok-4(\.\d+)?/ },
+      { pattern: /^moonshotai\/kimi-k[23]/ },
+      { pattern: /^z-ai\/glm-[45]/ },
+    ],
+  },
+  anthropic: {
+    version: 1,
+    rules: [
+      { pattern: /^claude-opus-[45]/ },
+      { pattern: /^claude-sonnet-[45]/ },
+      { pattern: /^claude-haiku-[45]/ },
+      { pattern: /^claude-fable-5/ },
+    ],
+  },
+  "anthropic-apikey": {
+    version: 1,
+    rules: [
+      { pattern: /^claude-opus-[45]/ },
+      { pattern: /^claude-sonnet-[45]/ },
+      { pattern: /^claude-haiku-[45]/ },
+      { pattern: /^claude-fable-5/ },
+    ],
+  },
+});
+
+/** The preset for a provider, or undefined when none is shipped. */
+export function modelPresetFor(providerName: string): ModelPreset | undefined {
+  return MODEL_PRESETS[providerName];
+}
+
+/** True when a provider has a shipped preset at all. */
+export function hasModelPreset(providerName: string): boolean {
+  return modelPresetFor(providerName) !== undefined;
+}
+
+/**
+ * Evaluate a provider's rules against concrete catalog ids.
+ *
+ * Input order is preserved so a caller can show the preset in the same order the picker does.
+ * Duplicates are collapsed; a model matching several rules is selected once.
+ */
+export function materializeModelPreset(
+  providerName: string,
+  catalogModelIds: Iterable<string>,
+): string[] {
+  const preset = modelPresetFor(providerName);
+  if (!preset) return [];
+  const seen = new Set<string>();
+  const out: string[] = [];
+  for (const id of catalogModelIds) {
+    if (seen.has(id)) continue;
+    // `RegExp.test` on a shared literal is safe here because no rule uses the `g` flag; a
+    // sticky/global pattern would carry lastIndex between calls and skip rows.
+    if (preset.rules.some(rule => rule.pattern.test(id))) {
+      seen.add(id);
+      out.push(id);
+    }
+  }
+  return out;
+}
+
+
+/**
+ * Flip a provider out of preset mode when the user edits its selection (#2465).
+ *
+ * No-op unless the provider is currently in preset mode: "all" has no marker to keep, and
+ * "custom" is already terminal. The applied version is retained so the GUI can still offer
+ * "a newer preset is available" without losing what the user chose.
+ */
+export function markModelPresetDiverged(provider: OcxProviderConfig): void {
+  const marker = provider.modelPreset;
+  if (marker?.mode !== "preset") return;
+  provider.modelPreset = { ...marker, mode: "custom" };
+}
+

package/src/providers/new-model-policy.ts

@@ -0,0 +1,146 @@
+import type { OcxConfig } from "../types";
+import { routedSlug } from "./slug-codec";
+
+export const MODEL_REMOVAL_GRACE_FETCHES = 3;
+export const MAX_KNOWN_MODELS_PER_PROVIDER = 2_000;
+export const MAX_RECENT_ARRIVALS_PER_PROVIDER = 50;
+
+export type KnownModelBaseline = NonNullable<NonNullable<OcxConfig["modelDiscovery"]>["knownModels"]>[string];
+export type NewModelPolicy = "on" | "off";
+
+export interface NewModelPolicyResult {
+  newIds: string[];
+  nextBaseline: KnownModelBaseline;
+  slugsToDisable: string[];
+  arrivals: Array<{ id: string; at: string }>;
+  overflow: boolean;
+}
+
+/**
+ * Whether a transition actually changes persisted state.
+ *
+ * `updatedAt` moves on every successful fetch, so comparing whole baselines would report a
+ * change every time and rewrite config.json on every catalog convergence — a write amplification
+ * that also churns the config generation other writers revalidate against. Only the fields that
+ * carry meaning are compared.
+ */
+function baselineDiffers(prior: KnownModelBaseline | undefined, next: KnownModelBaseline): boolean {
+  if (!prior) return true;
+  const sameList = (a: readonly string[], b: readonly string[]) =>
+    a.length === b.length && a.every((value, index) => value === b[index]);
+  if (!sameList(prior.ids, next.ids) || !sameList(prior.removed, next.removed)) return true;
+  const priorMissing = prior.missing ?? {};
+  const nextMissing = next.missing ?? {};
+  const keys = new Set([...Object.keys(priorMissing), ...Object.keys(nextMissing)]);
+  for (const key of keys) if (priorMissing[key] !== nextMissing[key]) return true;
+  return false;
+}
+
+/** Pure successful-discovery transition. An absent baseline bootstraps without hiding anything. */
+export function applyNewModelPolicy(options: {
+  provider: string;
+  discoveredIds: Iterable<string>;
+  baseline?: KnownModelBaseline;
+  policy: NewModelPolicy;
+  hasSelectedModels?: boolean;
+  now: string;
+}): NewModelPolicyResult {
+  const discovered = [...new Set(options.discoveredIds)].sort();
+  const prior = options.baseline;
+  if (!prior) {
+    return {
+      newIds: [],
+      nextBaseline: { ids: discovered, removed: [], updatedAt: options.now },
+      slugsToDisable: [], arrivals: [],
+      overflow: discovered.length > MAX_KNOWN_MODELS_PER_PROVIDER,
+    };
+  }
+  const active = new Set(prior.ids);
+  const removed = new Set(prior.removed);
+  const seen = new Set(discovered);
+  const newIds = discovered.filter(id => !active.has(id) && !removed.has(id));
+  const missing: Record<string, number> = {};
+  for (const id of active) {
+    if (seen.has(id)) continue;
+    const count = (prior.missing?.[id] ?? 0) + 1;
+    if (count >= MODEL_REMOVAL_GRACE_FETCHES) {
+      active.delete(id);
+      removed.add(id);
+    } else missing[id] = count;
+  }
+  for (const id of discovered) active.add(id);
+  const unionSize = active.size + removed.size;
+  const overflow = unionSize > MAX_KNOWN_MODELS_PER_PROVIDER;
+  const arrivals = newIds.map(id => ({ id, at: options.now }));
+  return {
+    newIds,
+    nextBaseline: {
+      ids: [...active].sort(), removed: [...removed].sort(), updatedAt: options.now,
+      ...(Object.keys(missing).length ? { missing } : {}),
+    },
+    // A non-empty preset/custom allowlist already excludes arrivals. This explicit no-op is
+    // deliberate: preset mode owns which matching flagships arrive on.
+    slugsToDisable: !overflow && options.policy === "off" && !options.hasSelectedModels
+      ? newIds.map(id => routedSlug(options.provider, id)) : [],
+    arrivals,
+    overflow,
+  };
+}
+
+export function effectiveNewModelPolicy(config: OcxConfig, provider: string): NewModelPolicy {
+  const local = config.providers[provider]?.newModelPolicy;
+  if (local === "on" || local === "off") return local;
+  return config.modelDiscovery?.newModelPolicy ?? "on";
+}
+
+/** Apply authoritative provider rows to a mutable convergence copy; degraded providers are omitted. */
+export function reconcileSuccessfulModelDiscoveries(options: {
+  config: OcxConfig;
+  models: Iterable<{ provider: string; id: string; custom?: boolean }>;
+  authoritativeProviders: Iterable<string>;
+  now: string;
+}): boolean {
+  const byProvider = new Map<string, string[]>();
+  for (const model of options.models) {
+    if (model.custom) continue;
+    const ids = byProvider.get(model.provider) ?? [];
+    ids.push(model.id); byProvider.set(model.provider, ids);
+  }
+  let changed = false;
+  for (const provider of options.authoritativeProviders) {
+    const configured = options.config.providers[provider];
+    if (!configured || configured.liveModels === false) continue;
+    const discoveredIds = byProvider.get(provider) ?? [];
+    const discovery = options.config.modelDiscovery ??= {};
+    const known = discovery.knownModels ??= {};
+    const result = applyNewModelPolicy({
+      provider, discoveredIds, baseline: known[provider],
+      policy: effectiveNewModelPolicy(options.config, provider),
+      hasSelectedModels: (configured.selectedModels?.length ?? 0) > 0,
+      now: options.now,
+    });
+    if (result.overflow) continue;
+    const priorBaseline = known[provider];
+    const baselineChanged = baselineDiffers(priorBaseline, result.nextBaseline);
+    known[provider] = result.nextBaseline;
+    // Keep the previous timestamp when nothing else moved, so a steady-state roster does not
+    // make the baseline look dirty on the next comparison either.
+    if (!baselineChanged && priorBaseline) known[provider] = priorBaseline;
+    if (result.slugsToDisable.length) {
+      const disabled = options.config.disabledModels ??= [];
+      for (const slug of result.slugsToDisable) {
+        if (disabled.includes(slug)) continue;
+        disabled.push(slug);
+        changed = true;
+      }
+    }
+    if (result.arrivals.length) {
+      const recent = discovery.recentArrivals ??= {};
+      recent[provider] = [...(recent[provider] ?? []), ...result.arrivals]
+        .slice(-MAX_RECENT_ARRIVALS_PER_PROVIDER);
+      changed = true;
+    }
+    if (baselineChanged) changed = true;
+  }
+  return changed;
+}

package/src/providers/provider-id-rewrite.ts

@@ -1,4 +1,5 @@
 import type { OcxConfig } from "../types";
+import { deleteConfigTopLevelKey } from "../config/rebase-provenance";
 
 export interface ProviderRewriteResult {
   /** Number of references re-pointed. */
@@ -174,6 +175,6 @@ export function dropProviderCustomModels(config: OcxConfig, provider: string): n
   // `[]`, so the `customModels` field is absent either way. Only that field —
   // the `customModelCatalogMigration` marker is deliberately left in place.
   if (kept.length > 0) config.customModels = kept;
-  else delete config.customModels;
+  else deleteConfigTopLevelKey(config, "customModels");
   return existing.length - kept.length;
 }

package/src/providers/quota.ts

@@ -3,7 +3,9 @@ import {
   effectiveCodexAuthAccountId,
   fetchMainAccountInfoSnapshot,
   listCodexAuthAccountsSnapshot,
+  withSparkVisibility,
 } from "../codex/auth-api";
+import type { StoredAccountQuota } from "../codex/quota";
 import { isMainAccountIdentityGenerationLive } from "../codex/main-account-cache";
 import { MAIN_CODEX_ACCOUNT_ID } from "../codex/main-account";
 import { codexPlanKey } from "../codex/plan";
@@ -166,6 +168,27 @@ function quotaSignatureValue(quota: CodexCapacityQuota | null): unknown {
   };
 }
 
+function providerQuotaFromCodexQuota(
+  quota: StoredAccountQuota | Omit<StoredAccountQuota, "updatedAt"> | null | undefined,
+): CodexCapacityQuota | null {
+  if (!quota) return null;
+  // Every Codex-sourced provider report funnels through here — the pooled path via
+  // listCodexAuthAccountsSnapshot and the `direct` path via fetchMainAccountInfoSnapshot, which
+  // never touches the Codex Auth DTO. Applying the Spark preference at this one point is what
+  // stops the row surviving on /api/provider-quotas after the operator switched it off.
+  quota = withSparkVisibility(quota ?? null) ?? quota;
+  return {
+    ...(quota.shortPercent !== undefined ? { fiveHourPercent: quota.shortPercent } : {}),
+    ...(quota.shortResetAt !== undefined ? { fiveHourResetAt: quota.shortResetAt } : {}),
+    ...(quota.weeklyPercent !== undefined ? { weeklyPercent: quota.weeklyPercent } : {}),
+    ...(quota.weeklyResetAt !== undefined ? { weeklyResetAt: quota.weeklyResetAt } : {}),
+    ...(quota.monthlyPercent !== undefined ? { monthlyPercent: quota.monthlyPercent } : {}),
+    ...(quota.monthlyResetAt !== undefined ? { monthlyResetAt: quota.monthlyResetAt } : {}),
+    ...(quota.customWindows !== undefined ? { customWindows: quota.customWindows } : {}),
+    updatedAt: "updatedAt" in quota ? quota.updatedAt : Date.now(),
+  };
+}
+
 /** Hash only presentation-relevant state; account ids and email addresses never enter the key. */
 function cacheKeyWithAggregationState(
   config: OcxConfig,
@@ -183,7 +206,7 @@ function cacheKeyWithAggregationState(
         plan: codexPlanKey(account.plan) ?? null,
         paused: account.paused,
         needsReauth: account.needsReauth === true,
-        quota: quotaSignatureValue(account.quota as CodexCapacityQuota | null),
+        quota: quotaSignatureValue(providerQuotaFromCodexQuota(account.quota)),
       }));
       const canonicalRows = rows.map(row => JSON.stringify(row)).sort();
       const digest = createHash("sha256").update(JSON.stringify(canonicalRows)).digest("hex").slice(0, 24);
@@ -1103,9 +1126,8 @@ async function fetchChatGptForwardQuota(
 ): Promise<ProviderQuotaReport | null> {
   if (providerCodexAccountMode(provider, providerConfig) === "direct") {
     const snapshot = await fetchMainAccountInfoSnapshot(forceRefresh);
-    const quota = snapshot.info.quota
-      ? { ...snapshot.info.quota, updatedAt: Date.now() } as ProviderQuota
-      : null;
+    const quota = providerQuotaFromCodexQuota(snapshot.info.quota);
+    if (quota) quota.updatedAt = Date.now();
     return quota
       ? tagNativeMainReport(report(provider, "chatgpt:wham", quota), snapshot.mainIdentityGeneration)
       : null;
@@ -1113,10 +1135,14 @@ async function fetchChatGptForwardQuota(
   const snapshot = await (prefetchedSnapshot ?? listCodexAuthAccountsSnapshot(config, forceRefresh));
   const accounts = snapshot.accounts;
   const activeId = effectiveCodexAuthAccountId(config);
-  const capacityAccounts = accounts.map(account => ({ ...account, active: account.id === activeId }));
+  const capacityAccounts = accounts.map(account => ({
+    ...account,
+    active: account.id === activeId,
+    quota: providerQuotaFromCodexQuota(account.quota),
+  }));
   const active = capacityAccounts.find(account => account.active)
-    ?? accounts.find(account => account.id === MAIN_CODEX_ACCOUNT_ID)
-    ?? accounts[0];
+    ?? capacityAccounts.find(account => account.id === MAIN_CODEX_ACCOUNT_ID)
+    ?? capacityAccounts[0];
   const now = Date.now();
   const capacity = aggregateCodexPoolCapacity(capacityAccounts, now);
   if (capacity.aggregation && capacity.quota) {
@@ -1278,6 +1304,24 @@ function parseClaudeBucket(value: unknown): { percent?: number; resetAt?: number
   return { percent, resetAt };
 }
 
+function parseClaudeLimit(value: unknown): { label: string; percent: number; resetAt?: number } | null {
+  const rec = asRecord(value);
+  if (!rec) return null;
+  const percent = normalizePercent(rec.percent);
+  if (percent === undefined) return null;
+  const scope = asRecord(rec.scope);
+  const model = asRecord(scope?.model);
+  const rawLabel = String(model?.display_name ?? "").trim();
+  if (!rawLabel) return null;
+  const lowerLabel = rawLabel.toLowerCase();
+  const label = lowerLabel.includes("fable") ? "Fable"
+    : lowerLabel.includes("opus") ? "Opus"
+      : lowerLabel.includes("sonnet") ? "Sonnet"
+        : rawLabel;
+  const resetAt = normalizeResetAt(rec.resets_at);
+  return { label, percent, ...(resetAt !== undefined ? { resetAt } : {}) };
+}
+
 /** Claude's OAuth usage endpoint, probed with ONE account's own bearer token. */
 const anthropicUsageInflight = new Map<string, Promise<ProviderQuota | null>>();
 
@@ -1301,11 +1345,25 @@ async function fetchAnthropicUsageQuota(accessToken: string): Promise<ProviderQu
     if (!body) return null;
     const fiveHour = parseClaudeBucket(body.five_hour);
     const sevenDay = parseClaudeBucket(body.seven_day);
+    const fable = parseClaudeBucket(body.seven_day_fable);
     const opus = parseClaudeBucket(body.seven_day_opus);
     const sonnet = parseClaudeBucket(body.seven_day_sonnet);
     const customWindows: ProviderQuotaWindow[] = [];
+    if (fable?.percent !== undefined) customWindows.push({ label: "Fable", percent: fable.percent, ...(fable.resetAt !== undefined ? { resetAt: fable.resetAt } : {}) });
     if (opus?.percent !== undefined) customWindows.push({ label: "Opus", percent: opus.percent, ...(opus.resetAt !== undefined ? { resetAt: opus.resetAt } : {}) });
     if (sonnet?.percent !== undefined) customWindows.push({ label: "Sonnet", percent: sonnet.percent, ...(sonnet.resetAt !== undefined ? { resetAt: sonnet.resetAt } : {}) });
+    const knownLabels = new Set(customWindows.map(window => window.label.toLowerCase()));
+    const limits = Array.isArray(body.limits) ? body.limits : [];
+    for (const rawLimit of limits) {
+      const limitRecord = asRecord(rawLimit);
+      // `session` and `weekly_all` mirror the canonical five-hour and weekly
+      // buckets above; only model-scoped weekly limits add a third window.
+      if (String(limitRecord?.kind ?? "").trim().toLowerCase() !== "weekly_scoped") continue;
+      const limit = parseClaudeLimit(rawLimit);
+      if (!limit || knownLabels.has(limit.label.toLowerCase())) continue;
+      knownLabels.add(limit.label.toLowerCase());
+      customWindows.push(limit);
+    }
     const quota: ProviderQuota = {
       // Claude's 5-hour window is a first-class rate limit, same as the Codex login 5h/weekly
       // rows: report it in the canonical fields so the dashboard renders it with the standard