@bitkyc08/opencodex 2.36.0-preview.20260829 → 2.36.0

package/src/providers/registry.ts

@@ -215,6 +215,11 @@ export interface ProviderRegistryEntry {
    * to stay contiguous. This is seeded/backfilled like other fixed wire capabilities.
    */
   requiresAdjacentResponsesToolResults?: boolean;
+  /**
+   * When enabled, tool results that are present but empty are annotated on the wire.
+   * Seeded/backfilled like other fixed wire capabilities.
+   */
+  annotateEmptyToolOutputs?: boolean;
   /**
    * Registry default for the provider's `service_tier` support; see
    * `OcxProviderConfig.supportsServiceTier`. Registry-only: backfilled (never
@@ -454,6 +459,7 @@ const XAI_MODELS = [
   "grok-4.6",
   "grok-4.5",
   "grok-4.3",
+  "grok-4.20-multi-agent-0309",
   "grok-4.20-0309-reasoning",
   "grok-4.20-0309-non-reasoning",
   "grok-build-0.1",
@@ -1148,8 +1154,9 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     // 260709 refresh: lineup + metadata from official docs.x.ai (grok-4.5 announced 07-08);
     // grok-composer-2.5-fast kept as account-verified (absent from public docs). Evidence:
     // devlog/model_update/260709_model_refresh/001_xai_lineup.md.
-    // grok-4.20-multi-agent-0309 is intentionally absent: the OAuth chat-completions
-    // transport returns 400 ("Multi Agent requests are not allowed on chat completions").
+    // 260823: grok-4.20-multi-agent-0309 still returns 400 on Chat Completions, but works
+    // on Responses. The server reports this dated id for both it and the floating
+    // grok-4.20-multi-agent-beta-latest alias, so expose only the dated deployment id.
     // 260813: grok-4.6 added per docs.x.ai/developers/grok-4-6. Context/vision still match
     // grok-4.5; the reasoning ladder does not — 4.6 adds the documented xhigh rung.
     models: XAI_MODELS,
@@ -1165,9 +1172,11 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     // than the seeded ones do.
     supportsVerbosity: false,
     defaultModel: "grok-4.5",
-    // Keep Codex Responses callers on the compatibility Chat wire until xAI can replay
-    // opaque reasoning continuation and compaction state across later turns. The scoped
-    // declaration also keeps caller-owned service tiers off the OAuth subscription route.
+    // Keep 4.6/4.5 Responses callers on the compatibility Chat wire until xAI can replay
+    // opaque reasoning continuation and compaction state across later turns. Multi-agent has
+    // no Chat wire, so Responses callers use its only working wire under both auth modes.
+    // Caller-owned service tiers stay off the unclassified OAuth subscription route; key-auth
+    // Fast remains proxy-owned and is still selected through keyAuthServiceTier above.
     modelWireDefaults: {
       "grok-4.6": {
         wire: "openai-chat",
@@ -1181,6 +1190,19 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
         authModes: ["oauth"],
         forwardCallerServiceTier: false,
       },
+      "grok-4.20-multi-agent-0309": {
+        // Even at high effort it emits no reasoning-summary deltas or encrypted replay
+        // material. Do not encode that as modelSupportsReasoningSummaries:false: through
+        // Codex #1100 that suppresses the entire reasoning object, including the effort
+        // that controls this model's agent count. An empty summary pane is harmless.
+        // Chat Completions returns 400 for this model, so every inbound uses Responses —
+        // `anthropic` included. Omitting it left providerModelWireDefault returning undefined
+        // for the Claude Messages lane, so resolveWireProtocolOverride kept xAI's provider-wide
+        // openai-chat adapter and sent this model to the wire it 400s on.
+        wire: "openai-responses",
+        inbound: ["responses", "chat", "anthropic"],
+        forwardCallerServiceTier: false,
+      },
     },
     // Vision lineup per docs.x.ai model-capabilities/images/understanding: the grok-4.x chat
     // models accept image input (JPEG/PNG, URL or base64). Without this the catalog leaves
@@ -1192,6 +1214,7 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
       "grok-4.6": ["text", "image"],
       "grok-4.5": ["text", "image"],
       "grok-4.3": ["text", "image"],
+      "grok-4.20-multi-agent-0309": ["text", "image"],
       "grok-4.20-0309-reasoning": ["text", "image"],
       "grok-4.20-0309-non-reasoning": ["text", "image"],
     },
@@ -1203,13 +1226,19 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     preserveReasoningContentModels: ["grok-4.6", "grok-4.5", "grok-4.3", "grok-4.20-0309-reasoning"],
     // grok-4.5 reasoning is always-on with low/medium/high (no off tier, no xhigh).
     // grok-4.6 adds xhigh per docs.x.ai/developers/model-capabilities/text/reasoning;
-    // xAI documents high as the upstream default.
-    modelReasoningEfforts: { "grok-4.6": ["low", "medium", "high", "xhigh"], "grok-4.5": ["low", "medium", "high"] },
+    // multi-agent accepts the same four wire values to select 4 or 16 collaborators. xAI
+    // documents high as the 4.6 default but no multi-agent default, so do not invent one.
+    modelReasoningEfforts: {
+      "grok-4.6": ["low", "medium", "high", "xhigh"],
+      "grok-4.5": ["low", "medium", "high"],
+      "grok-4.20-multi-agent-0309": ["low", "medium", "high", "xhigh"],
+    },
     modelDefaultReasoningEfforts: { "grok-4.6": "high" },
     modelContextWindows: {
       "grok-4.6": 500_000,
       "grok-4.5": 500_000,
       "grok-4.3": 1_000_000,
+      "grok-4.20-multi-agent-0309": 1_000_000,
       "grok-4.20-0309-reasoning": 1_000_000,
       "grok-4.20-0309-non-reasoning": 1_000_000,
       "grok-build-0.1": 256_000,
@@ -1442,6 +1471,10 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
       // The DeepSeek vision preview id is metadata-only here: the Go roster is
       // discovered live, so it applies the moment the gateway serves the id.
       [DEEPSEEK_VISION_PREVIEW_MODEL]: 1_048_576,
+      // Muse Spark 1.2 Contributor serves a 1,048,576-token (1M) context window over
+      // /responses on Zen Go, matching its 1.1 sibling (Meta developer docs, verified 2026-08-28).
+      // Without this declaration the catalog falls back to 128k, capping real usable context.
+      "muse-spark-1.2-contributor": 1_048_576,
     },
     modelInputModalities: {
       "kimi-k3": ["text", "image"],
@@ -1780,6 +1813,10 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     // context splits a call from its result (#1292); parallel calls remain one
     // reasoning-bearing assistant batch rather than being split per pair (#1477).
     requiresAdjacentResponsesToolResults: true,
+    // DeepSeek exec tool results can be present-but-empty (a script that ran without
+    // calling text(...)); annotate them so routed models do not silently accept an
+    // empty result or re-issue the same call.
+    annotateEmptyToolOutputs: true,
     /* [Decision Log]
     - 목적: DeepSeek V4 thinking mode multi-turn/tool-call requests must replay prior assistant reasoning_content.
     - 대안 분석: Globally preserve reasoning_content for all OpenAI-compatible models; preserve it for legacy deepseek-reasoner too; mark only V4 thinking models in registry metadata.
@@ -2550,13 +2587,23 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
   {
     id: "ollama-cloud",
     label: "Ollama Cloud",
+    // The upstream /v1 spelling is deliberately unchanged: ollamaNativeChatUrl() normalizes it
+    // to /api/chat, and live model discovery declares its own /v1/models path against the origin,
+    // so the native transport needs no base-URL edit here or in the free-provider directory.
     baseUrl: "https://ollama.com/v1",
-    adapter: "openai-chat",
+    // The native transport must be declared HERE, not in configuration. routedProviderConfig()
+    // overwrites provider.adapter with the registry adapter for every row whose transport
+    // matches, so a config-level adapter is silently discarded.
+    adapter: "ollama-native",
     authKind: "key",
     dashboardUrl: "https://ollama.com/settings/keys",
     // Live IDs verified 2026-07-10; qwen3-coder:480b retires 2026-07-15.
     models: ["glm-5.3", "glm-5.3-flash", "glm-5.2", "deepseek-v4-pro", "qwen3-coder:480b", "gpt-oss:120b", "kimi-k2.6", "minimax-m3", "qwen3.5:397b", "gemma4:31b"],
     defaultModel: "glm-5.3",
+    // Owner-audited exact outage fallback: these current Ollama Cloud GLM-5.3 rows have
+    // 1,048,576-token context windows. Live discovery and successful /api/show enrichment keep
+    // their existing precedence; these values prevent a failed show from becoming generic.
+    modelContextWindows: { "glm-5.3": 1_048_576, "glm-5.3-flash": 1_048_576 },
     noVisionModels: [
       // glm-5.3-flash is absent on purpose: native VLM
       // (docs.z.ai/guides/vlm/glm-5.3-flash), so its images skip the sidecar.
@@ -2566,6 +2613,19 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
       "deepseek-v4-pro", "deepseek-v4-flash",
       "gpt-oss", "qwen3-coder:480b",
     ],
+    // Ollama's native chat API has no `text.verbosity` equivalent and the ollama-native adapter
+    // never emits one, so a routed row must not inherit the Codex template's verbosity picker.
+    // Provider-wide rather than per-model: this catalog is discovery-authoritative, so ids that
+    // arrive later from live discovery must opt out too (the live-discovery gap closed by #2578).
+    supportsVerbosity: false,
+    // Live model discovery: Ollama serves the standard OpenAI-style data[] envelope at /v1/models,
+    // so the generic discovery pipeline needs no special-casing. The path is spelled against the
+    // ORIGIN (model-discovery resolves a leading-slash path against base.origin). A discovery
+    // spec is REQUIRED here: without one the pipeline probes https://ollama.com/models, which
+    // 307-redirects to /search and discovery falls back to the configured list.
+    modelDiscovery: {
+      path: "/v1/models",
+    },
   },
   // FREEZE 2026-07-10: codestral-latest is unconfirmed behind auth. Evidence: devlog/_plan/260710_provider_hardening/003_research_aggregators.md.
   { id: "mistral", label: "Mistral", baseUrl: "https://api.mistral.ai/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://console.mistral.ai/api-keys", defaultModel: "codestral-latest" },

package/src/providers/slug-codec.ts

@@ -140,13 +140,21 @@ export function resolveSlugSelection(
   // selection as provider-qualified made `a/b` resolve against provider "a", so the same
   // collision reported ambiguous through the dash spelling and unambiguous through the slash
   // spelling — the exact asymmetry this resolver exists to remove.
-  const qualified = selection.startsWith(`${provider}/`)
+  const matched: string[] = [];
+  let exact: string | undefined;
+  const ids = [...knownIds];
+  // A selection that starts with `<provider>/` is genuinely ambiguous: it reads as the
+  // provider-qualified form of `b`, but it is ALSO the native spelling of a self-namespaced
+  // id `provider/b`. Stripping the prefix unconditionally erased that second reading, so a
+  // published `acme/turbo` became unreachable while a sibling `turbo` silently absorbed the
+  // selection. The native id wins when the roster actually publishes it, because only then is
+  // the literal spelling known to name a real row.
+  const namesNativeId = ids.some(id => id === selection);
+  const qualified = !namesNativeId && selection.startsWith(`${provider}/`)
     ? selection
     : routedSlug(provider, selection);
   const selectionKey = slugEquivalenceKey(qualified);
-  const matched: string[] = [];
-  let exact: string | undefined;
-  for (const id of knownIds) {
+  for (const id of ids) {
     if (slugEquivalenceKey(routedSlug(provider, id)) !== selectionKey) continue;
     matched.push(id);
     if (id === selection || `${provider}/${id}` === selection) exact = id;

package/src/providers/vercel-gateway-routing.ts

@@ -0,0 +1,108 @@
+import type { OcxProviderConfig, VercelGatewayRouting } from "../types";
+import { sanitizeLogMetadataString } from "../lib/redact";
+
+const ROUTING_KEYS = new Set(["order", "only", "sort"]);
+const SORT_VALUES = new Set(["cost", "ttft", "tps"]);
+const MAX_PROVIDER_SLUGS = 64;
+
+function isPlainRecord(value: unknown): value is Record<string, unknown> {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+
+export function isCanonicalVercelGatewayTarget(baseUrl: string): boolean {
+  try {
+    const url = new URL(baseUrl);
+    return url.origin === "https://ai-gateway.vercel.sh"
+      && !url.username
+      && !url.password
+      && !url.search
+      && !url.hash
+      && url.pathname.replace(/\/+$/, "") === "/v1";
+  } catch {
+    return false;
+  }
+}
+
+function routingPreferenceError(value: unknown, field: string): string | null {
+  if (!isPlainRecord(value)) return `${field} must be a plain object`;
+  const unknown = Object.keys(value).find(key => !ROUTING_KEYS.has(key));
+  if (unknown) {
+    const sanitized = sanitizeLogMetadataString(unknown);
+    return `${field} contains unknown field "${sanitized ?? "unknown"}"`;
+  }
+
+  for (const listField of ["order", "only"] as const) {
+    const list = value[listField];
+    if (list === undefined) continue;
+    if (!Array.isArray(list) || list.length === 0 || list.length > MAX_PROVIDER_SLUGS) {
+      return `${field}.${listField} must contain 1-${MAX_PROVIDER_SLUGS} provider slugs`;
+    }
+    const seen = new Set<string>();
+    for (const slug of list) {
+      if (typeof slug !== "string" || !slug.trim() || slug !== slug.trim() || slug.length > 128) {
+        return `${field}.${listField} must contain nonblank trimmed provider slugs up to 128 characters`;
+      }
+      if (seen.has(slug)) return `${field}.${listField} must not contain duplicate provider slugs`;
+      seen.add(slug);
+    }
+  }
+  if (value.sort !== undefined && (typeof value.sort !== "string" || !SORT_VALUES.has(value.sort))) {
+    return `${field}.sort must be "cost", "ttft", or "tps"`;
+  }
+  if (value.order === undefined && value.only === undefined && value.sort === undefined) {
+    return `${field} must define order, only, or sort`;
+  }
+  return null;
+}
+
+export function vercelGatewayRoutingConfigError(provider: OcxProviderConfig): string | null {
+  const hasDefault = provider.vercelGatewayRouting !== undefined;
+  const hasModels = provider.modelVercelGatewayRouting !== undefined;
+  if (!hasDefault && !hasModels) return null;
+  if (provider.adapter !== "openai-chat") {
+    return "Vercel AI Gateway routing preferences require the openai-chat adapter";
+  }
+  if (!isCanonicalVercelGatewayTarget(provider.baseUrl)) {
+    return "Vercel AI Gateway routing preferences require the canonical https://ai-gateway.vercel.sh/v1 baseUrl";
+  }
+  if (hasDefault) {
+    const error = routingPreferenceError(provider.vercelGatewayRouting, "vercelGatewayRouting");
+    if (error) return error;
+  }
+  if (hasModels) {
+    const routes = provider.modelVercelGatewayRouting;
+    if (!isPlainRecord(routes)) return "modelVercelGatewayRouting must be a plain object";
+    for (const [modelId, preference] of Object.entries(routes)) {
+      if (!modelId.trim() || modelId !== modelId.trim()) {
+        return "modelVercelGatewayRouting keys must be nonblank trimmed model ids";
+      }
+      const sanitizedModel = sanitizeLogMetadataString(modelId) ?? "model";
+      const error = routingPreferenceError(preference, `modelVercelGatewayRouting.${sanitizedModel}`);
+      if (error) return error;
+    }
+  }
+  return null;
+}
+
+export function resolveVercelGatewayRouting(
+  provider: OcxProviderConfig,
+  modelId: string,
+): VercelGatewayRouting | undefined {
+  if (!isCanonicalVercelGatewayTarget(provider.baseUrl)) return undefined;
+  const modelRoutes = provider.modelVercelGatewayRouting;
+  return modelRoutes && Object.hasOwn(modelRoutes, modelId)
+    ? modelRoutes[modelId]
+    : provider.vercelGatewayRouting;
+}
+
+export function vercelGatewayProviderPayload(
+  preference: VercelGatewayRouting,
+): Record<string, unknown> {
+  return {
+    ...(preference.order ? { order: [...preference.order] } : {}),
+    ...(preference.only ? { only: [...preference.only] } : {}),
+    ...(preference.sort ? { sort: preference.sort } : {}),
+  };
+}

package/src/router.ts

@@ -33,6 +33,7 @@ import {
 } from "./providers/openai-tiers";
 import { decodeRoutedModelIdOrThrow, encodeRoutedModelId } from "./providers/slug-codec";
 import { resolveModelAlias } from "./providers/default-aliases";
+import { resolveBlockedModelRedirect } from "./lib/shadow-call";
 import { getStaleCached } from "./codex/model-cache";
 import { codexAccountNamespaceEntries } from "./codex/account-namespaces";
 import {
@@ -353,6 +354,10 @@ export function routedProviderConfig(providerName: string, provider: OcxProvider
       && registryEntry.requiresAdjacentResponsesToolResults !== undefined
       ? { requiresAdjacentResponsesToolResults: registryEntry.requiresAdjacentResponsesToolResults }
       : {}),
+    ...(provider.annotateEmptyToolOutputs === undefined
+      && registryEntry.annotateEmptyToolOutputs !== undefined
+      ? { annotateEmptyToolOutputs: registryEntry.annotateEmptyToolOutputs }
+      : {}),
     ...(provider.fastWire === undefined && registryEntry.fastWire !== undefined
       ? {
         fastWire: cloneFastWire(registryEntry.fastWire),
@@ -489,7 +494,7 @@ export function comboRouteDecisionTrace(
       reason: "combo-pick",
       candidateIndex: pick.targetIndex,
       ...(combo
-        ? { tieBreak: combo.strategy === "round-robin" ? "round-robin" : "failover" }
+        ? { tieBreak: combo.strategy }
         : {}),
     },
     candidates: combo ? comboRouteCandidates(config, pick, combo) : undefined,
@@ -506,19 +511,23 @@ function isBareOpenAiFamilyModel(modelId: string): boolean {
 }
 
 function routeResult(
+  config: OcxConfig | undefined,
   providerName: string,
   provider: OcxProviderConfig,
   modelId: string,
   routeKind: RouteDecisionKind,
   routeReason: string,
 ): RouteResult {
+  const redirected = resolveBlockedModelRedirect(config, modelId);
+  const effectiveModelId = redirected ?? modelId;
+  const effectiveRouteReason = redirected ? "blocked-model-redirect" : routeReason;
   const codexAccountMode = providerCodexAccountMode(providerName, provider);
   return {
     providerName,
     provider: routedProviderConfig(providerName, provider),
-    modelId,
+    modelId: effectiveModelId,
     routeKind,
-    routeReason,
+    routeReason: effectiveRouteReason,
     ...(codexAccountMode ? { codexAccountMode } : {}),
   };
 }
@@ -621,7 +630,7 @@ function routeModelInternal(
         throw new NoEnabledOpenAiProviderError(nativeModelId);
       }
       return {
-        ...routeResult(OPENAI_CODEX_PROVIDER_ID, provider, nativeModelId, "explicit-account", "account-namespace"),
+        ...routeResult(config, OPENAI_CODEX_PROVIDER_ID, provider, nativeModelId, "explicit-account", "account-namespace"),
         // Exact account injection uses the pool credential machinery even when the canonical
         // provider is globally Direct. The fixed id bypasses pool selection entirely.
         codexAccountMode: "pool",
@@ -666,7 +675,7 @@ function routeModelInternal(
       // itself a known model (e.g. orcarouter/auto). Route it whole instead of stripping to the
       // remainder, which would send a bare `auto` the upstream cannot resolve.
       if (known.includes(modelId)) {
-        return routeResult(provName, prov, modelId, "explicit-provider", "explicit-provider-namespace");
+        return routeResult(config, provName, prov, modelId, "explicit-provider", "explicit-provider-namespace");
       }
       // Codex-facing alias ids (`provider/vendor-model`) decode back to the native
       // slash id via an exact known-id lookup; raw full-slash selectors keep working.
@@ -676,6 +685,7 @@ function routeModelInternal(
         ? decoded
         : resolveModelAlias(config, prov, known, requestedModel) ?? decoded;
       return routeResult(
+        config,
         provName,
         prov,
         nativeModel,
@@ -689,7 +699,7 @@ function routeModelInternal(
   if (isBareOpenAiFamilyModel(modelId)) {
     const provider = config.providers[OPENAI_CODEX_PROVIDER_ID];
     if (provider && provider.disabled !== true) {
-      return routeResult(OPENAI_CODEX_PROVIDER_ID, provider, modelId, "native", "native-family");
+      return routeResult(config, OPENAI_CODEX_PROVIDER_ID, provider, modelId, "native", "native-family");
     }
     throw new NoEnabledOpenAiProviderError(modelId);
   }
@@ -697,7 +707,7 @@ function routeModelInternal(
   for (const [provName, prov] of activeProviderEntries(config)) {
     if (prov.defaultModel === modelId
       || (typeof prov.defaultModel === "string" && encodeRoutedModelId(prov.defaultModel) === modelId)) {
-      return routeResult(provName, prov, prov.defaultModel as string, "explicit-provider", "configured-default-model");
+      return routeResult(config, provName, prov, prov.defaultModel as string, "explicit-provider", "configured-default-model");
     }
   }
 
@@ -708,7 +718,7 @@ function routeModelInternal(
     if (prov.models && Array.isArray(prov.models)) {
       const hit = (prov.models as string[]).find(id => id === modelId || encodeRoutedModelId(id) === modelId);
       if (hit !== undefined) {
-        return routeResult(provName, prov, hit, "explicit-provider", "configured-model-list");
+        return routeResult(config, provName, prov, hit, "explicit-provider", "configured-model-list");
       }
     }
   }
@@ -728,7 +738,7 @@ function routeModelInternal(
   }
   if (aliasMatches[0]) {
     const match = aliasMatches[0];
-    return routeResult(match.provider, config.providers[match.provider], match.model, "explicit-provider", "model-alias");
+    return routeResult(config, match.provider, config.providers[match.provider], match.model, "explicit-provider", "model-alias");
   }
 
   if (config.defaultProvider === LEGACY_CHATGPT_PROVIDER_ID) {
@@ -737,7 +747,7 @@ function routeModelInternal(
   if (hasOwnProvider(config.providers, config.defaultProvider)) {
     const defaultProv = config.providers[config.defaultProvider];
     if (defaultProv.disabled === true) throw new Error(`Default provider is disabled: ${config.defaultProvider}`);
-    return routeResult(config.defaultProvider, defaultProv, modelId, "default-provider", "default-provider");
+    return routeResult(config, config.defaultProvider, defaultProv, modelId, "default-provider", "default-provider");
   }
 
   throw new Error(`No provider configured for model: ${modelId}`);
@@ -763,7 +773,7 @@ export function routeModel(
       reason: route.routeReason,
       ...(route.combo ? { candidateIndex: route.combo.targetIndex } : {}),
       ...(combo
-        ? { tieBreak: combo.strategy === "round-robin" ? "round-robin" : "failover" }
+        ? { tieBreak: combo.strategy }
         : {}),
     },
     candidates: route.routeKind === "combo" && route.combo && combo
@@ -786,7 +796,7 @@ function routeByKnownModelPattern(config: OcxConfig, modelId: string): RouteResu
       );
       if (matchingProvider) {
         const [provName, prov] = matchingProvider;
-        return routeResult(provName, prov, modelId, "explicit-provider", "model-pattern");
+        return routeResult(config, provName, prov, modelId, "explicit-provider", "model-pattern");
       }
       // Deliberately no "first provider with an Anthropic adapter" fallback here. Picking by
       // object insertion order, without checking `models`, `selectedModels`, `disabledModels` or

package/src/server/auth-cors.ts

@@ -1,4 +1,5 @@
 import { timingSafeEqual } from "node:crypto";
+import { extractAccountId } from "../oauth/chatgpt";
 import { formatErrorResponse } from "../bridge";
 import {
   codexAutoStartEnabled,
@@ -27,6 +28,7 @@ import { providerConfigSeed } from "../providers/derive";
 import type { OcxConfig, OcxProviderConfig } from "../types";
 import { openRouterRoutingConfigError } from "../providers/openrouter-routing";
 import { modelAutoCompactTokenLimitsConfigError } from "../providers/auto-compact-budget";
+import { vercelGatewayRoutingConfigError } from "../providers/vercel-gateway-routing";
 import { googleVertexLocationConfigError } from "../providers/google-vertex-location";
 import { xaiResponsesOptInState } from "../providers/xai-responses-opt-in";
 
@@ -403,6 +405,10 @@ export const AUTH_MATRIX: readonly ApiAuthMatrixRow[] = [
   { endpoint: "/v1/chat/completions", bearer: "accepted", dedicated: "accepted", xApiKey: "rejected" },
   { endpoint: "/v1/messages", bearer: "accepted", dedicated: "accepted", xApiKey: "accepted" },
   { endpoint: "/v1/models", bearer: "accepted", dedicated: "accepted", xApiKey: "accepted" },
+  // #809: least-privilege catalog read for remote Codex clients. Same admission set as
+  // /v1/models and for the same reason — it forwards no caller credential upstream — so a
+  // remote client no longer needs an admin token just to read the model catalog.
+  { endpoint: "/v1/catalog", bearer: "accepted", dedicated: "accepted", xApiKey: "accepted" },
 ];
 
 /** Whether `token` is the environment-provided management secret. */
@@ -431,6 +437,14 @@ export function validateForwardAdmissionCredential(headers: Headers, config: Ocx
   if (bearer && isProxyAdmissionSecret(bearer, config)) throw new ForwardAdmissionCredentialError();
 }
 
+/** Whether Authorization carries a caller-owned native Codex credential safe to forward. */
+export function hasForwardableCodexBearer(headers: Headers, config: OcxConfig): boolean {
+  const bearer = headers.get("authorization")?.replace(/^Bearer\s+/i, "").trim();
+  const accountId = headers.get("chatgpt-account-id")?.trim()
+    || (bearer ? extractAccountId(undefined, bearer) : undefined);
+  return !!bearer && !!accountId && !isProxyAdmissionSecret(bearer, config);
+}
+
 /**
  * Resolving form of `hasValidApiAuth`: identical header precedence, identical
  * decision, but it names the admission instead of collapsing it to a boolean.
@@ -568,6 +582,11 @@ export function providerManagementConfigError(name: unknown, provider: unknown):
     delete canonicalCandidate.modelContextWindows;
     // User-owned soft compaction policy; it does not alter the canonical transport seed.
     delete canonicalCandidate.modelAutoCompactTokenLimits;
+    // Same category: annotating empty tool outputs is a user-owned request-shaping preference,
+    // not part of the canonical transport seed. Without this the field is accepted by
+    // validation and then rejected by the seed comparison, so canonical OpenAI could never
+    // set OR clear it — the value was admitted and then refused in the same request.
+    delete canonicalCandidate.annotateEmptyToolOutputs;
     const canonical = seed && sameCanonicalProviderSeed(canonicalCandidate, seed);
     if (!canonical) {
       return `provider ${name} must equal the canonical built-in provider seed`;
@@ -636,6 +655,9 @@ export function providerManagementConfigError(name: unknown, provider: unknown):
   if (raw.responsesSnapshotRepair !== undefined && typeof raw.responsesSnapshotRepair !== "boolean") {
     return `provider ${name} responsesSnapshotRepair must be a boolean`;
   }
+  if (raw.xaiResponsesXSearch !== undefined && typeof raw.xaiResponsesXSearch !== "boolean") {
+    return `provider ${name} xaiResponsesXSearch must be a boolean`;
+  }
   const defaultMaxOutputError = positiveIntegerConfigError(raw.defaultMaxOutputTokens, "defaultMaxOutputTokens");
   if (defaultMaxOutputError) return `provider ${name} ${defaultMaxOutputError}`;
   const maxOutputError = positiveIntegerRecordConfigError(raw.modelMaxOutputTokens, "modelMaxOutputTokens");
@@ -647,6 +669,8 @@ export function providerManagementConfigError(name: unknown, provider: unknown):
   if (structuredOutputOptOutError) return `provider ${name} ${structuredOutputOptOutError}`;
   const openRouterError = openRouterRoutingConfigError(typed);
   if (openRouterError) return `provider ${name} ${openRouterError}`;
+  const vercelError = vercelGatewayRoutingConfigError(typed);
+  if (vercelError) return `provider ${name} ${vercelError}`;
   if (typed.authMode === "local") {
     // "local" bypasses key-requirement enforcement (api-keys/key-failover treat non-oauth/
     // forward as key auth; openai-chat skips credential checks for local). Only providers
@@ -725,6 +749,8 @@ export function safeConfigDTO(config: OcxConfig): unknown {
       "modelMaxOutputTokens",
       "openRouterRouting",
       "modelOpenRouterRouting",
+      "vercelGatewayRouting",
+      "modelVercelGatewayRouting",
       "reasoningEfforts",
       "modelReasoningEfforts",
       "reasoningWireFormat",

package/src/server/catalog-download.ts

@@ -0,0 +1,73 @@
+/**
+ * Shared serialization for the model catalog, used by both the management route
+ * (`GET /api/catalog`) and the least-privilege data-plane route
+ * (`GET|HEAD /v1/catalog`, issue #809).
+ *
+ * The point of the shared module is that the two routes must emit the *same
+ * bytes*. A remote Codex client previously had to be handed an admin token just
+ * to read the catalog, which is the least-privilege violation #809 is about; the
+ * fix is a second route on the data plane, never a widened management boundary.
+ * If each route serialized independently they would drift, and the data-plane
+ * copy is the one nobody looks at in the dashboard.
+ */
+import { createHash } from "node:crypto";
+
+/**
+ * Upper bound for the REMOTE route only.
+ *
+ * The first version of this used 32 MiB and applied it to both routes, which was
+ * wrong twice over. The repository supports up to 2,000 discovered models, and a
+ * 2,000-row catalog serializes to roughly 92 MB — so 32 MiB rejected a valid
+ * supported catalog, and applying it to `/api/catalog` turned a working
+ * management response into a 507 for those operators.
+ *
+ * 256 MiB clears the supported bound with room to spare while still refusing a
+ * file that could only be corrupt or hostile. The management route is not
+ * subject to it at all: it is a local dashboard read whose behavior predates
+ * this module and must not change.
+ */
+export const MAX_REMOTE_CATALOG_BYTES = 256 * 1024 * 1024;
+
+export interface SerializedCatalog {
+  /** Serialized catalog JSON, or null when no catalog could be materialized. */
+  body: string | null;
+  /** Strong ETag over `body`, present only when `body` is. */
+  etag?: string;
+  /** Byte length of `body`, present only when `body` is. */
+  bytes?: number;
+}
+
+export function catalogEtag(body: string): string {
+  return `"${createHash("sha256").update(body).digest("hex")}"`;
+}
+
+/**
+ * Read and serialize the persisted catalog once.
+ *
+ * Returns `{ body: null }` for every unreadable case — absent file, unreadable
+ * file, malformed JSON — because `readCatalog` already collapses those into
+ * `null` and the routes render them identically as a 404. Distinguishing them
+ * here would invite one route to leak a filesystem path in an error message.
+ *
+ * Deliberately does NOT apply a size ceiling: a size policy belongs to the route
+ * that serves the bytes, not to the shared serializer both planes depend on.
+ */
+export async function serializePersistedCatalog(): Promise<SerializedCatalog> {
+  const { readCatalog, readCodexCatalogPath } = await import("../codex/catalog");
+  const catalog = readCatalog(readCodexCatalogPath());
+  if (!catalog) return { body: null };
+  const body = JSON.stringify(catalog);
+  const bytes = Buffer.byteLength(body, "utf8");
+  return { body, etag: catalogEtag(body), bytes };
+}
+
+/**
+ * The authoritative Codex version for a catalog response, or undefined.
+ *
+ * Never fabricated: when no runtime is persisted the header is omitted rather
+ * than guessed, so a client cannot mistake "unknown" for a specific version.
+ */
+export async function persistedCodexVersion(): Promise<string | undefined> {
+  const { loadPersistedCodexRuntime } = await import("../codex/runtime");
+  return loadPersistedCodexRuntime()?.selectedVersion ?? undefined;
+}

package/src/server/chat-native.ts

@@ -21,6 +21,7 @@ import { isModelTextOnly } from "../vision";
 import {
   applyUpstreamRecoveryInit,
   fetchWithResetRetry,
+  fetchWithTransientRetry,
   prepareSameTarget429Wait,
   type UpstreamSendRecovery,
 } from "../lib/upstream-retry";
@@ -33,6 +34,7 @@ import {
   rateLimitRetryDelayMs,
   rateLimitRetryPolicyFor,
   rotateProviderTransportOn429,
+  transientRetryPolicyFor,
 } from "../providers/key-failover";
 import { fastPolicyForModel } from "../providers/service-tier";
 import type { RouteResult } from "../router";
@@ -204,7 +206,11 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
 
   const send = async (request: AdapterRequest, recovery?: "rate-limit-429" | "key-429"): Promise<Response> => {
     try {
-      return await fetchWithResetRetry(
+      // #2643: opted-in key-auth openai-chat providers retry pre-stream transient statuses on
+      // the native chat lane too; everyone else keeps reset-only semantics.
+      const transientPolicy = transientRetryPolicyFor(activeProvider);
+      const fetchWithPolicy = transientPolicy ? fetchWithTransientRetry : fetchWithResetRetry;
+      return await fetchWithPolicy(
         (transportRecovery?: UpstreamSendRecovery) => {
           noteAttemptSend(attempt, logCtx.usageLogInputTokens, transportRecovery ?? recovery);
           return fetchWithHeaderTimeout(
@@ -223,7 +229,11 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
             }),
           );
         },
-        { abortSignal: upstream.signal, label: safeHostLabel(request.url) },
+        {
+          abortSignal: upstream.signal,
+          label: safeHostLabel(request.url),
+          ...(transientPolicy ? { attempts: transientPolicy.attempts } : {}),
+        },
       );
     } finally {
       request.releaseBodyObservation?.();

package/src/server/gui-static.ts

@@ -127,7 +127,10 @@ export function serveGuiFile(
   const ext = extname(filePath);
   const contentType = MIME_TYPES[ext] || "application/octet-stream";
   if (ext === ".html") return htmlResponse(filePath, session);
-  return new Response(Bun.file(filePath), {
+  // Snapshot bytes before returning the response. Bun.file is lazy: if gui/dist is replaced
+  // after Bun frames the response but before the stream finishes, its Content-Length can
+  // describe the old file while the body comes from the new one (#2792).
+  return new Response(readFileSync(filePath), {
     headers: { "Content-Type": contentType, ...browserSecurityHeaders() },
   });
 }