@bitkyc08/opencodex 2.35.0 → 2.36.0-preview.20260830

package/src/codex/auth-context.ts

@@ -12,7 +12,15 @@ import { isCodexAccountPaused } from "./account-pause";
 import { ConfigMutationLockError } from "../config";
 import { isCodexAccountUsable } from "./account-usability";
 import { reconcileMainCodexAccountRuntimeState } from "./account-lifecycle";
-import { MAIN_CODEX_ACCOUNT_ID, getMainAccountToken, isMainAccountTokenLive } from "./main-account";
+import {
+  MAIN_CODEX_ACCOUNT_ID,
+  MainAccountTokenRefreshError,
+  MainAuthJsonChangedDuringRefreshError,
+  getMainAccountToken,
+  getValidMainAccountToken,
+  isMainAccountTokenLive,
+  type NativeMainRefreshDependencies,
+} from "./main-account";
 import { isNativeMainTrafficBlocked, nativeMainStartupGateSnapshot } from "./native-profile-startup";
 import type { NativeMainStartupBlockReason } from "./native-profile-startup";
 import {
@@ -39,6 +47,7 @@ import type { CodexAccountMode, OcxConfig, OcxProviderConfig } from "../types";
 import { FORWARD_HEADERS } from "../adapters/openai-responses";
 import { captureConfigGeneration } from "../lib/state-store-sweeper";
 import { retainedUtf8Bytes } from "../lib/admission";
+import { extractAccountId } from "../oauth/chatgpt";
 
 const CODEX_AFFINITY_COMPONENT_MAX_BYTES = 512;
 const CODEX_APP_AFFINITY_KEY = randomBytes(32);
@@ -97,7 +106,7 @@ export type CodexAuthContext =
     }
   | {
       // Main Codex account participating in rotation: token injected from ~/.codex/auth.json
-      // (Option A). Distinct from "main" (passthrough fallback that forwards the client token).
+      // (Option A). Distinct from "main" (request-owned passthrough or Direct mode).
       kind: "main-pool";
       accountId: string;
       writerGeneration: number;
@@ -317,6 +326,8 @@ export function shouldMarkAccountNeedsReauthForCodexAuthFailure(cause: unknown):
     && !(cause instanceof CodexCredentialRefreshLockTimeoutError)
     && !(cause instanceof CodexCredentialRefreshBusyError)
     && !(cause instanceof CodexCredentialRefreshStaleError)
+    && !(cause instanceof MainAuthJsonChangedDuringRefreshError)
+    && !(cause instanceof MainAccountTokenRefreshError && cause.reason === "transient")
     && !(cause instanceof ConfigMutationLockError);
 }
 
@@ -331,11 +342,16 @@ export interface ResolveCodexAuthContextOptions {
   /** Test-only native credential read seams. */
   isMainAccountTokenLive?: () => boolean;
   getMainAccountToken?: typeof getMainAccountToken;
+  getValidMainAccountToken?: typeof getValidMainAccountToken;
+  nativeMainRefreshDependencies?: NativeMainRefreshDependencies;
+  signal?: AbortSignal;
   primeCodexPoolQuotas?: (config: OcxConfig, reason: string) => Promise<void>;
   /** Test seam for account-gated native model discovery. */
   resolveCodexModelEntitlements?: typeof resolveCodexModelEntitlements;
   /** Direct requests admitted with a proxy bearer substitute the stored native-main credential. */
   substituteMainCredentialForDirect?: boolean;
+  /** A validated native Codex bearer may serve this request without entering Pool state. */
+  requestScopedMainCredential?: boolean;
   /** Test seam for a Direct request's own forwarded ChatGPT credential. */
   isDirectCallerEntitledToCodexModel?: (headers: Headers, modelId: string) => Promise<boolean>;
 }
@@ -353,36 +369,86 @@ export async function resolveCodexAuthContext(
   options: ResolveCodexAuthContextOptions = {},
 ): Promise<CodexAuthContext> {
   const writerGeneration = captureConfigGeneration();
+  const requestScopedMainCredential = options.requestScopedMainCredential === true
+    && hasCallerCodexBearer(headers);
   const fixedAccountId = options.accountId;
   if (fixedAccountId !== undefined && options.excludeAccountId !== undefined) {
     throw new Error("Codex auth context cannot select and exclude an account simultaneously");
   }
-  // An explicit namespace binding is stronger than the provider's default mode. It must use the
-  // selected stored credential even while the canonical OpenAI provider is globally Direct.
-  if (mode === "direct" && fixedAccountId === undefined) {
+  const resolveCallerOwnedMainContext = async (): Promise<CodexAuthContext> => {
     if (!hasCallerCodexBearer(headers)) throw new CodexDirectAuthenticationError();
-    if (options.modelId && ACCOUNT_GATED_NATIVE_OPENAI_MODELS.has(options.modelId)) {
-      const entitled = options.substituteMainCredentialForDirect
-        ? entitledCodexAccountIdsForModel(
-            await (options.resolveCodexModelEntitlements ?? resolveCodexModelEntitlements)(config),
-            options.modelId,
-          )?.has(MAIN_CODEX_ACCOUNT_ID) === true
-        : await (options.isDirectCallerEntitledToCodexModel ?? isDirectCallerEntitledToCodexModel)(
-            headers,
-            options.modelId,
-          );
-      if (!entitled) {
-        throw new CodexPoolAuthenticationError("The selected ChatGPT account does not support this model");
+    const substituteStoredMain = options.substituteMainCredentialForDirect === true;
+    if (!substituteStoredMain) {
+      if (options.modelId && ACCOUNT_GATED_NATIVE_OPENAI_MODELS.has(options.modelId)) {
+        const entitled = await (
+          options.isDirectCallerEntitledToCodexModel ?? isDirectCallerEntitledToCodexModel
+        )(headers, options.modelId);
+        if (!entitled) {
+          throw new CodexPoolAuthenticationError("The selected ChatGPT account does not support this model");
+        }
       }
+      return { kind: "main", accountId: null };
     }
-    return { kind: "main", accountId: null };
+
+    // Admission-bearer Direct requests later replace the proxy secret with the stored
+    // native-main credential. Reserve and claim that physical profile before entitlement
+    // discovery or materialization can read it; caller-owned Direct credentials never enter
+    // this branch. A missing turn admission must fail closed instead of recreating an
+    // untracked native-main read.
+    if (isNativeMainTrafficBlocked()) throw new CodexMainProfileDrainingError();
+    const directSelectionAdmission = options.beginCodexAccountSelection?.();
+    if (!directSelectionAdmission) throw new CodexMainProfileDrainingError();
+    try {
+      if (
+        directSelectionAdmission.mainProfileDraining
+        || !directSelectionAdmission.claimMainProfile()
+        || isNativeMainTrafficBlocked()
+      ) {
+        throw new CodexMainProfileDrainingError();
+      }
+      if (options.modelId && ACCOUNT_GATED_NATIVE_OPENAI_MODELS.has(options.modelId)) {
+        const entitled = entitledCodexAccountIdsForModel(
+          await (options.resolveCodexModelEntitlements ?? resolveCodexModelEntitlements)(config, {
+            signal: options.signal,
+            nativeMainRefreshDependencies: options.nativeMainRefreshDependencies,
+          }),
+          options.modelId,
+        )?.has(MAIN_CODEX_ACCOUNT_ID) === true;
+        if (!entitled) {
+          throw new CodexPoolAuthenticationError("The selected ChatGPT account does not support this model");
+        }
+      }
+      return { kind: "main", accountId: null };
+    } finally {
+      // The short selector reservation ends here. A successful claim remains owned by
+      // the enclosing turn lease until the request or transferred stream settles.
+      directSelectionAdmission.release();
+    }
+  };
+  // An explicit namespace binding is stronger than the provider's default mode. It must use the
+  // selected stored credential even while the canonical OpenAI provider is globally Direct.
+  // A request-owned bearer is deliberately not represented as `main-pool`: Pool account ids own
+  // durable health, quota, and affinity state, while this credential exists for one request only.
+  if ((mode === "direct" && fixedAccountId === undefined)
+    || (requestScopedMainCredential && fixedAccountId === MAIN_CODEX_ACCOUNT_ID)) {
+    return resolveCallerOwnedMainContext();
   }
-  const affinityKey = fixedAccountId === undefined ? codexPoolAffinityKey(headers) : undefined;
+  // A caller bearer can still accompany a request that selects a configured Pool account. Do not
+  // let that request read, delete, or create a file-main affinity binding while deciding whether a
+  // stored account is available; only the stored credential selected below may own Pool state.
+  const affinityKey = fixedAccountId === undefined && !requestScopedMainCredential
+    ? codexPoolAffinityKey(headers)
+    : undefined;
   // Retained startup recovery makes the physical main identity ineligible. Routing
-  // can still preserve service by selecting a healthy configured pool account.
+  // can still preserve service by selecting a healthy configured pool account. A
+  // request-owned bearer likewise cannot inspect or reconcile file-main state.
   const nativeMainTrafficBlocked = isNativeMainTrafficBlocked();
   const selectionAdmission = options.beginCodexAccountSelection?.();
-  const nativeMainReadsForbidden = nativeMainTrafficBlocked || selectionAdmission?.mainProfileDraining === true;
+  const nativeMainReadsForbidden = requestScopedMainCredential
+    || nativeMainTrafficBlocked
+    || selectionAdmission?.mainProfileDraining === true;
+  const nativeMainSelectionOnly = !nativeMainTrafficBlocked
+    && selectionAdmission?.mainProfileDraining === true;
   let accountId: string;
   const quotaScope = codexQuotaScopeForModel(options.modelId);
   try {
@@ -390,7 +456,11 @@ export async function resolveCodexAuthContext(
       ? new Set([MAIN_CODEX_ACCOUNT_ID])
       : undefined;
     const entitlementSnapshot = options.modelId && ACCOUNT_GATED_NATIVE_OPENAI_MODELS.has(options.modelId)
-      ? await (options.resolveCodexModelEntitlements ?? resolveCodexModelEntitlements)(config, { excludeAccountIds })
+      ? await (options.resolveCodexModelEntitlements ?? resolveCodexModelEntitlements)(config, {
+        excludeAccountIds,
+        signal: options.signal,
+        nativeMainRefreshDependencies: options.nativeMainRefreshDependencies,
+      })
       : undefined;
     const entitledAccountIds = entitlementSnapshot
       ? entitledCodexAccountIdsForModel(entitlementSnapshot, options.modelId)
@@ -401,9 +471,10 @@ export async function resolveCodexAuthContext(
     const selectionOptions = {
       // Temporary switch drain keeps the candidate until the atomic claim rejects
       // it. Retained recovery makes main wholly ineligible so pool routing continues.
-      nativeMainSelectionOnly: !nativeMainTrafficBlocked
-        && selectionAdmission?.mainProfileDraining === true,
-      isMainAccountTokenLive: options.isMainAccountTokenLive,
+      nativeMainSelectionOnly,
+      isMainAccountTokenLive: requestScopedMainCredential
+        ? () => false
+        : options.isMainAccountTokenLive,
       modelEligibleAccountIds,
     };
     // A pre-drain selector reserves the native identity while reconciliation and
@@ -425,10 +496,20 @@ export async function resolveCodexAuthContext(
             ? { status: "selected" as const, accountId: selected }
             : { status: "none" as const };
         })()
-      : resolveCodexAccountForThreadDetailed(affinityKey ?? null, config, Date.now(), quotaScope, selectionOptions);
+      : resolveCodexAccountForThreadDetailed(
+          affinityKey ?? null,
+          config,
+          Date.now(),
+          quotaScope,
+          selectionOptions,
+          options.modelId,
+        );
     if (resolution.status === "expired") throw new CodexThreadAffinityExpiredError(resolution.accountId);
     const selected = resolution.status === "selected" ? resolution.accountId : null;
     if (!selected) {
+      if (requestScopedMainCredential && fixedAccountId === undefined && !options.excludeAccountId) {
+        return await resolveCallerOwnedMainContext();
+      }
       if (fixedAccountId !== undefined) {
         throw new CodexPoolAuthenticationError(
           modelEligibleAccountIds && !modelEligibleAccountIds.has(fixedAccountId)
@@ -436,12 +517,13 @@ export async function resolveCodexAuthContext(
             : "Selected Codex account is unavailable",
         );
       }
-      // Recovery deliberately makes physical main ineligible. If no healthy
-      // pool route is configured and main is the intended route, report the
-      // temporary fence rather than misclassifying that credential as invalid.
+      // Recovery or a turn drain deliberately makes physical main unobservable.
+      // If no healthy pool route is available, report the temporary fence rather
+      // than turning a credential we were forbidden to inspect into a permanent
+      // model-entitlement denial.
       // A configured pool retry/exclusion that finds no alternate preserves its
       // ordinary pool-auth failure instead of being mislabeled as a main fence.
-      if (nativeMainTrafficBlocked && !options.excludeAccountId) {
+      if (nativeMainReadsForbidden && !options.excludeAccountId) {
         throw new CodexMainProfileDrainingError();
       }
       throw new CodexPoolAuthenticationError(
@@ -523,8 +605,21 @@ export async function resolveCodexAuthContext(
   }
 
   if (accountId === MAIN_CODEX_ACCOUNT_ID) {
-    // Main account in rotation: inject the read-only auth.json token and fail closed if it vanished.
-    const token = (options.getMainAccountToken ?? getMainAccountToken)();
+    // Main account in rotation: refresh auth.json before upstream I/O and fail closed if it vanished.
+    let token: { accessToken: string; chatgptAccountId: string } | null;
+    try {
+      token = await (options.getValidMainAccountToken ?? getValidMainAccountToken)({
+        signal: options.signal,
+        ...(options.nativeMainRefreshDependencies ?? {}),
+      });
+    } catch (cause) {
+      if (probeLeaseId && probeQuotaScope) releaseCodexQuotaScopeProbeLease(accountId, probeQuotaScope, probeLeaseId);
+      else if (probeLeaseId) releaseCodexQuotaProbeLease(accountId, probeLeaseId);
+      if (shouldMarkAccountNeedsReauthForCodexAuthFailure(cause)) {
+        markAccountNeedsReauth(accountId, writerGeneration);
+      }
+      throw new CodexAuthContextError(accountId, cause);
+    }
     if (!token) {
       // Nothing will reach upstream, so give the probe back instead of burning it.
       if (probeLeaseId && probeQuotaScope) releaseCodexQuotaScopeProbeLease(accountId, probeQuotaScope, probeLeaseId);
@@ -634,6 +729,12 @@ export function materializeCodexUpstreamAuth(
     selected.set("chatgpt-account-id", ctx.chatgptAccountId);
     return selected;
   }
+  if (ctx.kind === "main" && options.substituteMainCredential !== true
+    && !selected.has("chatgpt-account-id")) {
+    const bearer = selected.get("authorization")?.replace(/^Bearer\s+/i, "").trim();
+    const accountId = bearer ? extractAccountId(undefined, bearer) : undefined;
+    if (accountId) selected.set("chatgpt-account-id", accountId);
+  }
   if (ctx.kind === "main" && options.substituteMainCredential === true) {
     const stored = getMainAccountToken();
     // Fail BEFORE any upstream I/O. Falling through here would send the admission secret.
@@ -647,6 +748,33 @@ export function materializeCodexUpstreamAuth(
   return selected;
 }
 
+export async function materializeCodexUpstreamAuthAsync(
+  headers: Headers,
+  ctx: CodexAuthContext,
+  options: {
+    substituteMainCredential?: boolean;
+    signal?: AbortSignal;
+    nativeMainRefreshDependencies?: NativeMainRefreshDependencies;
+  } = {},
+): Promise<Headers> {
+  if (ctx.kind !== "main" || options.substituteMainCredential !== true) {
+    return materializeCodexUpstreamAuth(headers, ctx, options);
+  }
+  const selected = new Headers();
+  for (const name of FORWARD_HEADERS) {
+    const value = headers.get(name);
+    if (value) selected.set(name, value);
+  }
+  const stored = await getValidMainAccountToken({
+    signal: options.signal,
+    ...(options.nativeMainRefreshDependencies ?? {}),
+  });
+  if (!stored?.accessToken) throw new CodexMainSubstitutionUnavailableError();
+  selected.set("authorization", `Bearer ${stored.accessToken}`);
+  if (stored.chatgptAccountId) selected.set("chatgpt-account-id", stored.chatgptAccountId);
+  return selected;
+}
+
 /** @deprecated Prefer materializeCodexUpstreamAuth; kept for call sites without admission context. */
 export function headersForCodexAuthContext(headers: Headers, ctx: CodexAuthContext): Headers {
   return materializeCodexUpstreamAuth(headers, ctx);

package/src/codex/catalog/bundled.ts

@@ -31,7 +31,7 @@ import { redactSecretString } from "../../lib/redact";
 import upstreamModelsSnapshot from "../data/upstream-models.json";
 
 
-import { activeCodexModelsCachePath, catalogBackupPathFor, findNativeTemplate, isDefaultCatalogPath, legacyCatalogBackupPath, parseCatalogJson, readCatalog, readCatalogBackup, readCodexCatalogPath } from "./parsing";
+import { activeCodexModelsCachePath, catalogBackupPathFor, findNativeTemplate, findSupportedNativeTemplate, isDefaultCatalogPath, legacyCatalogBackupPath, parseCatalogJson, readCatalog, readCatalogBackup, readCodexCatalogPath } from "./parsing";
 import type { RawCatalog, RawEntry } from "./parsing";
 import { codexExecInvocation, isSpawnableCodexCandidate } from "../exec-invocation";
 import {
@@ -541,9 +541,11 @@ export function readCurrentCodexModelsCache(): RawCatalog | null {
 export function loadCatalogTemplate(): RawEntry | null {
   const catalogPath = readCodexCatalogPath();
   const bundled = loadBundledCodexCatalog();
-  const native = findNativeTemplate(readCatalog(catalogPath))
-    ?? findNativeTemplate(readCatalogBackup(catalogPath))
-    ?? findNativeTemplate(readCatalog(activeCodexModelsCachePath()))
-    ?? findNativeTemplate(bundled ? JSON.parse(JSON.stringify(bundled)) as RawCatalog : null);
+  // Template inheritance only. The validity gates in this file keep `findNativeTemplate`
+  // so a catalog carrying only a newly launched native row stays valid (#2813).
+  const native = findSupportedNativeTemplate(readCatalog(catalogPath))
+    ?? findSupportedNativeTemplate(readCatalogBackup(catalogPath))
+    ?? findSupportedNativeTemplate(readCatalog(activeCodexModelsCachePath()))
+    ?? findSupportedNativeTemplate(bundled ? JSON.parse(JSON.stringify(bundled)) as RawCatalog : null);
   return native ? JSON.parse(JSON.stringify(native)) : null;
 }

package/src/codex/catalog/metadata.ts

@@ -548,7 +548,7 @@ function hasNativeCatalogRowShape(entry: RawEntry): boolean {
   return typeof entry.base_instructions === "string"
     && entry.base_instructions.length > 0
     && (typeof entry.comp_hash === "string" || entry.comp_hash === null)
-    && entry.shell_type === "shell_command"
+    && (entry.shell_type === "unified_exec" || entry.shell_type === "shell_command")
     && Array.isArray(levels)
     && levels.length > 0
     && levels.every(level => typeof level === "object" && level !== null

package/src/codex/catalog/parsing.ts

@@ -264,6 +264,34 @@ export function findNativeTemplate(catalog: RawCatalog | null): RawEntry | null
   ) ?? null;
 }
 
+/**
+ * Template selection, as opposed to catalog VALIDITY.
+ *
+ * `findNativeTemplate` answers "does this look like a real catalog?" and must stay
+ * permissive: four call sites use it as a validity gate, and a catalog holding only a
+ * newly launched native model has to keep passing or sync falls back to stale data.
+ *
+ * This answers a different question — "which row should every routed model inherit
+ * from?" — and must be strict. `deriveEntry` deep-clones the chosen row, so an unknown
+ * bare row carrying `base_instructions` would become the template for every routed
+ * model and hand them its native eligibility metadata. #2813 is the report that made
+ * that concrete: a Reserve-shaped row injected by the client is exactly such a row.
+ *
+ * Returning null is safe and expected; `deriveEntry` falls back to a conservative
+ * synthetic template.
+ */
+export function findSupportedNativeTemplate(catalog: RawCatalog | null): RawEntry | null {
+  return catalog?.models?.find(
+    m => typeof m.slug === "string"
+      && SUPPORTED_NATIVE_OPENAI_SLUGS.has(m.slug)
+      && !m.slug.includes("/")
+      && "base_instructions" in m
+      && m.opencodex_catalog_kind !== CODEX_NATIVE_ALIAS_CATALOG_KIND
+      && m.owned_by !== COMBO_NAMESPACE
+      && !(typeof m.description === "string" && m.description.startsWith("Routed via opencodex → ")),
+  ) ?? null;
+}
+
 /**
  * Native OpenAI slugs that do NOT support the Fast (priority) service tier.
  * Upstream may advertise service_tiers for these models, but the tier is not
@@ -403,10 +431,22 @@ export function ensureStrictCatalogFields(
   entry: RawEntry,
   options: { preserveExactInputModalities?: boolean; isRouted?: boolean } = {},
 ): RawEntry {
+  if (entry.shell_type === "default" || entry.shell_type === "local" || entry.shell_type === "shell_command") {
+    entry.shell_type = "unified_exec";
+  }
+  if (typeof entry.node_repl_disabled !== "boolean") entry.node_repl_disabled = false;
+  if (typeof entry.node_repl_auto_review_required !== "boolean") entry.node_repl_auto_review_required = false;
+  if (typeof entry.include_plugin_usage_instructions !== "boolean") entry.include_plugin_usage_instructions = false;
+  if (typeof entry.include_apps_usage_instructions !== "boolean") entry.include_apps_usage_instructions = true;
   if (typeof entry.supports_reasoning_summaries !== "boolean") entry.supports_reasoning_summaries = false;
   if (typeof entry.default_reasoning_summary !== "string") entry.default_reasoning_summary = "none";
   if (typeof entry.support_verbosity !== "boolean") entry.support_verbosity = true;
-  if (typeof entry.default_verbosity !== "string") entry.default_verbosity = "low";
+  // A row that has declared it does NOT support verbosity must not also ship a default for the
+  // control it just disowned: Codex seeds its picker from `default_verbosity`, so leaving the
+  // strict-fields fallback in place re-creates the dead toggle the explicit opt-out removed.
+  // Scoped to an explicit `false`, so rows that never declare a capability keep the default.
+  if (entry.support_verbosity === false) delete entry.default_verbosity;
+  else if (typeof entry.default_verbosity !== "string") entry.default_verbosity = "low";
   if (typeof entry.apply_patch_tool_type !== "string") entry.apply_patch_tool_type = "freeform";
   if (!entry.truncation_policy || typeof entry.truncation_policy !== "object" || Array.isArray(entry.truncation_policy)) {
     entry.truncation_policy = { mode: "tokens", limit: 10000 };
@@ -438,6 +478,22 @@ export function ensureStrictCatalogFields(
   }
   if (typeof entry.effective_context_window_percent !== "number") entry.effective_context_window_percent = 95;
   if (typeof entry.comp_hash !== "string") entry.comp_hash = "opencodex";
+  // Routed rows must not carry NATIVE eligibility metadata. `deriveEntry` deep-clones a
+  // native template and deletes a fixed denylist, so these five survive onto rows backed
+  // by unrelated provider credentials — advertising ChatGPT plan eligibility for a model
+  // that never touches a ChatGPT account (#2813).
+  //
+  // This lives here rather than only in `normalizeRoutedCatalogEntry` because that runs on
+  // freshly derived rows only. Degraded-provider and foreign routed rows are preserved
+  // from disk and reach the merge through this function alone, so sanitizing there would
+  // leave already-contaminated rows contaminated forever.
+  if (options.isRouted === true) {
+    entry.supported_in_api = true;
+    delete entry.available_in_plans;
+    delete entry.minimal_client_version;
+    delete entry.availability_nux;
+    delete entry.upgrade;
+  }
   return ensureAutoCompactTokenLimit(entry);
 }
 

package/src/codex/catalog/provider-fetch.ts

@@ -71,6 +71,7 @@ import {
   type ProviderModelsApiItem,
   type ResolvedProviderModelDiscovery,
 } from "../../providers/model-discovery";
+import { applyConfiguredHeadersLast, fetchOllamaShowEnrichment, ollamaShowEnrichable } from "../../providers/ollama-show";
 import upstreamModelsSnapshot from "../data/upstream-models.json";
 import { createAdmissionGate, ResourceAdmissionError, type AdmissionMetrics } from "../../lib/admission";
 
@@ -962,6 +963,7 @@ export const CALLABLE_CONFIGURED_COMPATIBILITY_MODELS: Readonly<Record<string, R
   ]),
   xai: new Set([
     "grok-4.3",
+    "grok-4.20-multi-agent-0309",
     "grok-4.20-0309-reasoning",
     "grok-4.20-0309-non-reasoning",
     "grok-build-0.1",
@@ -1093,8 +1095,24 @@ function modelInputModalities(
       .filter(value => value === "text" || value === "image" || value === "audio");
     if (inferred.length > 0) return [...new Set(inferred)];
   }
-  if (capabilityRecord?.vision === false) return ["text"];
-  if (capabilityRecord?.vision === true || capabilities?.some(value => (
+  // GitHub Copilot nests vision support one level down as `capabilities.supports.vision`, so the
+  // flat read alone finds nothing and every Copilot model falls through to `["text"]` — Codex then
+  // refuses image attachments on models that accept them (#2941). Precedence is by specificity:
+  // a flat boolean is authoritative when present, the nested boolean is consulted only otherwise,
+  // and a non-boolean at either level decides NOTHING so the signals below still apply. Two things
+  // this ordering deliberately avoids: a deny-wins rule across both levels would flip a provider
+  // reporting flat `true` with nested `false` from image-capable to text-only, changing behaviour
+  // that predates Copilot support; and a truthy test would let the string `"no"` advertise image
+  // input. The payload also carries a SECOND `vision` key under `limits` holding an image count,
+  // which is why this reads one exact path instead of searching `capabilities` for a vision-ish key.
+  const nestedSupports = plainRecord(capabilityRecord?.supports);
+  const explicitVisionSupport = typeof capabilityRecord?.vision === "boolean"
+    ? capabilityRecord.vision
+    : typeof nestedSupports?.vision === "boolean"
+      ? nestedSupports.vision
+      : undefined;
+  if (explicitVisionSupport === false) return ["text"];
+  if (explicitVisionSupport === true || capabilities?.some(value => (
     value === "vision" || value === "image-input" || value === "image_input"
     // llama.cpp and Ollama-compatible servers report vision as "multimodal" —
     // it is the only image signal those servers emit (#1797). Mapped to the
@@ -1370,7 +1388,16 @@ async function fetchProviderModelsWithAuth(
     );
   }
   const url = request.url;
-  const headers = materializeCapturedHeaders(request, apiKey);
+  let headers = materializeCapturedHeaders(request, apiKey);
+  // One Ollama authority contract: for canonical ollama-cloud/ollama-native rows, discovery
+  // (/v1/models), enrichment (/api/show) and inference (/api/chat) must all materialize the
+  // SAME effective credential/header authority. buildModelsRequest's generic tail writes the
+  // generated Bearer AFTER configured headers, but the native inference adapter applies
+  // provider.headers LAST (configured wins, case-insensitive collapse). Reapply the configured
+  // provider headers here so the whole Ollama request family shares that one authority.
+  if (ollamaShowEnrichable(name, prov)) {
+    headers = applyConfiguredHeadersLast(headers, prov.headers);
+  }
   const urlClass = new URL(url).hostname.endsWith("aiplatform.googleapis.com")
     ? "vertex-aiplatform"
     : "provider-models";
@@ -1500,13 +1527,40 @@ async function fetchProviderModelsWithAuth(
       return observed(models, "degraded");
     }
     const items = extracted.items;
+    // Ollama Cloud enrichment: /v1/models carries no per-model context or capability metadata,
+    // so a newly announced id would otherwise publish generic defaults. /api/show fills that
+    // per model, fail-soft, bounded, and cached with this gather's result. Explicit configured
+    // metadata keeps its normal precedence (applyProviderConfigHints applies the discovered
+    // window only where exact config is absent, and the provider context cap still caps it).
+    const showEnrichment = ollamaShowEnrichable(name, prov)
+      ? await fetchOllamaShowEnrichment({
+        headers,
+        discoveryUrl: request.url,
+        modelIds: items.map(m => m.id),
+        provider: prov,
+      }).catch(() => undefined)
+      : undefined;
     const live = items.map(m => {
       const ownedBy = boundedOwnedBy(m.owned_by);
+      // Precedence: the authoritative /v1/models row wins; /api/show fills only metadata the
+      // models-API row does not carry. applyProviderConfigHints then applies explicit
+      // configured metadata over both, and the provider context cap still caps the result.
+      const modelsApiHints = catalogHintsFromModelsApiItem(name, m);
+      const show = showEnrichment?.metadata.get(m.id);
+      const discoveredHints = {
+        ...modelsApiHints,
+        ...(modelsApiHints.contextWindow === undefined && show?.contextWindow !== undefined
+          ? { contextWindow: show.contextWindow }
+          : {}),
+        ...(modelsApiHints.inputModalities === undefined && show?.nativeVision === true
+          ? { inputModalities: ["text", "image"] as string[] }
+          : {}),
+      };
       return applyProviderConfigHints(name, prov, {
         id: m.id,
         provider: name,
         ...(ownedBy ? { owned_by: ownedBy } : {}),
-        ...catalogHintsFromModelsApiItem(name, m),
+        ...discoveredHints,
       }, contextCap);
     })
       .filter(m => shouldExposeProviderModel(name, m.id));
@@ -1568,6 +1622,9 @@ export async function fetchProviderModels(
 
 export function shouldExposeProviderModel(providerName: string, modelId: string): boolean {
   if (providerName === "opencode-free") return modelId === "big-pickle" || modelId.endsWith("-free");
+  // xAI /models advertises both the dated deployment and this floating alias.
+  // Keep only grok-4.20-multi-agent-0309; the alias is the same server-side id.
+  if (providerName === "xai" && modelId === "grok-4.20-multi-agent-beta-latest") return false;
   return true;
 }
 

package/src/codex/catalog/sync.ts

@@ -41,7 +41,7 @@ import {
 } from "../model-entitlements";
 
 
-import { CODEX_CUSTOM_MODEL_CATALOG_KIND, CODEX_PROVIDER_MODEL_CATALOG_KIND, activeCodexModelsCachePath, applyCatalogMetadata, applyMultiAgentMode, applyNativeOpenAiContextOverride, applyRoutedCodexToolMode, catalogBackupPathFor, catalogHasRoutedEntries, catalogModelSlug, ensureStrictCatalogFields, findNativeTemplate, isDefaultCatalogPath, isRoutedModelCompatibilityExcluded, legacyCatalogBackupPath, normalizeRoutedCatalogEntry, normalizeServiceTiers, readCatalog, readCatalogBackup, readCodexCatalogPath, readCodexCatalogPathForHome, readConfiguredAutoReviewModel, readNativeBaseline } from "./parsing";
+import { CODEX_CUSTOM_MODEL_CATALOG_KIND, CODEX_PROVIDER_MODEL_CATALOG_KIND, activeCodexModelsCachePath, applyCatalogMetadata, applyMultiAgentMode, applyNativeOpenAiContextOverride, applyRoutedCodexToolMode, catalogBackupPathFor, catalogHasRoutedEntries, catalogModelSlug, ensureStrictCatalogFields, findNativeTemplate, findSupportedNativeTemplate, isDefaultCatalogPath, isRoutedModelCompatibilityExcluded, legacyCatalogBackupPath, normalizeRoutedCatalogEntry, normalizeServiceTiers, readCatalog, readCatalogBackup, readCodexCatalogPath, readCodexCatalogPathForHome, readConfiguredAutoReviewModel, readNativeBaseline } from "./parsing";
 import type { CatalogModel, MultiAgentMode, RawCatalog, RawEntry } from "./parsing";
 import { accountBoundNativeOpenAiSlugs, accountBoundNativeOpenAiSlugsBySelector, applyNativeVisibility, CODEX_NATIVE_ALIAS_CATALOG_KIND, desktopAllowlistSuppressedNativeSlugs, disabledNativeSlugs, isNativeAliasCatalogEntry, isUnsupportedOpenAiNativeSlug, NATIVE_OPENAI_MODELS, nativeContextLimits, observedAccountBoundNativeEntries, shouldIncludeAccountBoundNativeOpenAi, shouldIncludeNativeOpenAi, shouldUpgradeToUpstreamEntry, SUPPORTED_NATIVE_OPENAI_SLUGS, upstreamNativeEntry, type NativeContextLimitsInput } from "./metadata";
 import {
@@ -375,7 +375,7 @@ export function deriveEntry(
   const isCursorFallback = isRouted && model?.provider === "cursor";
   const entry: RawEntry = {
     slug, display_name: routedDisplayName(slug), description: desc,
-    shell_type: "shell_command", visibility: "list", supported_in_api: true,
+    shell_type: "unified_exec", visibility: "list", supported_in_api: true,
     priority, base_instructions: "You are a helpful coding assistant.",
     ...(isRouted
       ? isCursorFallback
@@ -1543,7 +1543,8 @@ function writeRetainedCatalogSync({
     catalog,
     onDiskCatalog,
   );
-  const template = findNativeTemplate(catalog);
+  // Strict selector for template inheritance; the validity gate above keeps the broad one.
+  const template = findSupportedNativeTemplate(catalog);
 
   try {
     // Once-only: preserve the PRISTINE pre-opencodex catalog as the native-priority baseline

package/src/codex/convergence.ts

@@ -33,7 +33,7 @@ import {
   import {
   catalogBackupPathFor,
   catalogHasRoutedEntries,
-  findNativeTemplate,
+  findSupportedNativeTemplate,
   legacyCatalogBackupPath,
   parseCatalogJson,
   type RawCatalog,
@@ -238,7 +238,8 @@ function prepareCatalog(
   observedAccountNativeEntries: readonly RawEntry[] = [],
 ): RawCatalog {
   const catalog = JSON.parse(JSON.stringify(source.catalog)) as RawCatalog;
-  const template = findNativeTemplate(catalog);
+  // Strict selector: an unknown bare row must never become the routed template (#2813).
+  const template = findSupportedNativeTemplate(catalog);
   const enabled = filterCatalogVisibleModels(routedModels, config);
   const featured = config.subagentModels ?? [];
   const ordered = orderForSubagents(enabled, featured);