@bitkyc08/opencodex 2.40.0 → 2.41.0

package/src/providers/antigravity-models.ts

@@ -13,14 +13,27 @@ import { isModelCacheGenerationCurrent } from "../codex/model-cache";
 // ── Wire IDs (what CCA :fetchAvailableModels returns) ──
 
 /** Current Antigravity Flash generation. */
-const GEMINI_FLASH_CURRENT = "gemini-3.7-flash";
+const GEMINI_FLASH_CURRENT = "gemini-3.8-flash";
 
 /**
- * Wire ID that CCA actually accepts for the current Flash generation.
- * Google renamed the model to include a `-tiered` suffix; the picker-visible
- * ID stays `gemini-3.7-flash` (stripped by `pickerModelIdForDiscoveredWireId`).
+ * Previous Flash generation — still served, still picker-visible.
+ *
+ * 3.6 vanished from CCA the moment 3.7 shipped, which is why RETIRED_FLASH_TIERS exists. 3.8
+ * did not do that: Google documents 3.7 Flash as "remains fully supported", and a 2026-09-03
+ * :fetchAvailableModels call returns 3.8, 3.7 AND 3.6 wire ids together. Retiring 3.7 here
+ * would strand a model the backend is actively serving.
+ */
+const GEMINI_FLASH_PREVIOUS = "gemini-3.7-flash";
+
+/**
+ * Wire ID that CCA accepts for the RETIRED-tier redirect target (currently 3.7).
+ *
+ * Google renamed 3.7 to carry a `-tiered` suffix; the picker-visible ID stays
+ * `gemini-3.7-flash` (stripped by `pickerModelIdForDiscoveredWireId`). This constant is named
+ * for its ROLE, not for the current generation: 3.8 is current and has no `-tiered` id, so a
+ * name like GEMINI_FLASH_WIRE_ID would now point readers at the wrong model.
  */
-const GEMINI_FLASH_WIRE_ID = "gemini-3.7-flash-tiered";
+const GEMINI_RETIRED_FLASH_TARGET_WIRE_ID = "gemini-3.7-flash-tiered";
 
 /**
  * Retired Flash ids → the reasoning tier they used to encode.
@@ -60,6 +73,9 @@ const ANTIGRAVITY_WIRE_MODELS = [
 ];
 
 const ANTIGRAVITY_PICKER_MODEL_BY_WIRE_ID: Record<string, string> = {
+  "gemini-3.8-flash-low": "gemini-3.8-flash",
+  "gemini-3.8-flash-medium": "gemini-3.8-flash",
+  "gemini-3.8-flash-high": "gemini-3.8-flash",
   "gemini-3.1-pro-low": "gemini-3.1-pro",
   "gemini-pro-agent": "gemini-3.1-pro",
 };
@@ -143,6 +159,9 @@ function collapsesIntoKnownPickerModel(candidateId: string): boolean {
 // Gemini models: effort → wire model suffix (official agy UI pattern).
 // Claude Opus: effort → thinkingConfig.thinkingLevel (CLIProxyAPI proven pattern).
 export const ANTIGRAVITY_MODEL_EFFORTS: Record<string, string[]> = {
+  // No `minimal`: Google documents it as an error for this generation, and CCA exposes only
+  // the three tiers.
+  "gemini-3.8-flash": ["low", "medium", "high"],
   "gemini-3.7-flash": ["low", "medium", "high"],
   "gemini-3.1-pro": ["low", "high"],
   "claude-sonnet-4-6": ["low", "medium", "high", "max"],
@@ -151,12 +170,32 @@ export const ANTIGRAVITY_MODEL_EFFORTS: Record<string, string[]> = {
 
 // ── Effort → wire model map for Gemini base models ──
 const ANTIGRAVITY_EFFORT_WIRE_MAP: Record<string, Record<string, string>> = {
+  // 3.8 publishes one wire id per tier and no `-tiered` row, so its efforts ride the suffix.
+  // This is the 3.6 shape, not the 3.7 one.
+  "gemini-3.8-flash": {
+    low: "gemini-3.8-flash-low",
+    medium: "gemini-3.8-flash-medium",
+    high: "gemini-3.8-flash-high",
+  },
   "gemini-3.1-pro": {
     low: "gemini-3.1-pro-low",
     high: "gemini-pro-agent",
   },
 };
 
+/**
+ * Base models whose every effort maps to a wire id that ALREADY encodes the tier.
+ *
+ * Sending `thinkingLevel` beside such a suffix states the effort twice, and CCA does not reject
+ * the contradiction — a `-low` wire id paired with `HIGH` returns 200, so the tier that actually
+ * ran becomes unknowable from the response. Membership also makes static resolution
+ * byte-identical to the discovery path, which never emits a thinking level.
+ *
+ * `gemini-3.1-pro` is deliberately absent: its `high` rung is `gemini-pro-agent`, which carries
+ * no tier suffix, so there the level is the only thing naming the effort.
+ */
+const ANTIGRAVITY_SUFFIX_TIER_MODELS = new Set(["gemini-3.8-flash"]);
+
 function completeDiscoveredEffortWireModelIds(
   pickerId: string,
   available: ReadonlyMap<string, Record<string, unknown>>,
@@ -178,6 +217,8 @@ function completeDiscoveredEffortWireModelIds(
 
 // ── Default effort per Gemini base model ──
 const ANTIGRAVITY_DEFAULT_EFFORT: Record<string, string> = {
+  // Google's documented thinking_level default, and the tier CCA marks `recommended`.
+  "gemini-3.8-flash": "medium",
   "gemini-3.1-pro": "high",
 };
 
@@ -198,7 +239,7 @@ const ANTIGRAVITY_THINKING_LEVELS = new Set(["low", "medium", "high"]);
  * Models not listed here use themselves as the wire ID.
  */
 const ANTIGRAVITY_PICKER_TO_WIRE: Record<string, string> = {
-  "gemini-3.7-flash": GEMINI_FLASH_WIRE_ID,
+  "gemini-3.7-flash": GEMINI_RETIRED_FLASH_TARGET_WIRE_ID,
 };
 
 /** Map a picker-visible base model to its CCA wire ID. Identity when no mapping exists. */
@@ -230,7 +271,7 @@ const ANTIGRAVITY_COMPATIBILITY_MODEL_ALIASES: Record<string, string> = {
   // because `parseAntigravityAvailableModels` uses THIS map to keep a stale CCA
   // payload from republishing a dead wire id as a picker row.
   ...Object.fromEntries(
-    Object.keys(RETIRED_FLASH_TIERS).map(retired => [retired, GEMINI_FLASH_WIRE_ID]),
+    Object.keys(RETIRED_FLASH_TIERS).map(retired => [retired, GEMINI_RETIRED_FLASH_TARGET_WIRE_ID]),
   ),
 };
 
@@ -242,6 +283,7 @@ export const ANTIGRAVITY_MODEL_ALIASES: Record<string, string> = {
 // Picker-visible: collapsed base models only.
 export const ANTIGRAVITY_MODELS = [
   GEMINI_FLASH_CURRENT,
+  GEMINI_FLASH_PREVIOUS,
   "gemini-3.1-pro",
   "gemini-3.1-flash-image",
   "claude-sonnet-4-6",
@@ -255,6 +297,9 @@ function isKnownAntigravityPickerModelId(value: string): boolean {
 
 // Context windows from the upstream `:fetchAvailableModels` maxTokens per model.
 const ANTIGRAVITY_WIRE_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
+  "gemini-3.8-flash-low": 1_048_576,
+  "gemini-3.8-flash-medium": 1_048_576,
+  "gemini-3.8-flash-high": 1_048_576,
   "gemini-3.7-flash-tiered": 1_048_576,
   "gemini-3.1-pro-low": 1_048_576,
   "gemini-pro-agent": 1_048_576,
@@ -266,6 +311,7 @@ const ANTIGRAVITY_WIRE_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
 
 export const ANTIGRAVITY_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
   // Collapsed base IDs — explicit entries for the picker.
+  "gemini-3.8-flash": 1_048_576,
   "gemini-3.7-flash": 1_048_576,
   "gemini-3.1-pro": 1_048_576,
   // Wire IDs and aliases via derivation.
@@ -283,6 +329,7 @@ export const ANTIGRAVITY_MODEL_INPUT_MODALITIES: Record<string, string[]> = {
   // carries only text and image parts (`OcxImageContent`, src/types.ts) and the Codex
   // catalog normalizes `input_modalities` against a closed enum. Advertising a modality
   // the wire cannot carry would be a promise we break at request time.
+  "gemini-3.8-flash": ["text", "image"],
   "gemini-3.7-flash": ["text", "image"],
   "gemini-3.1-pro": ["text", "image"],
   "gemini-3.1-flash-image": ["text", "image"],
@@ -609,13 +656,15 @@ export function resolveAntigravityEffortWireModel(
     };
   }
 
-  // Rule 0: retired Flash id — Google has taken the wire id offline, so route to the
-  // current generation and carry the tier the retired id encoded. This runs BEFORE the
-  // suffix check because those ids are aliases, and rule 1 would drop the tier.
+  // Rule 0: retired Flash id — Google has taken the wire id offline, so route to the 3.7
+  // redirect target and carry the tier the retired id encoded. (3.7, not "the current
+  // generation": 3.8 is current but these ids were retired onto 3.7, which is still served.)
+  // This runs BEFORE the suffix check because those ids are aliases, and rule 1 would drop
+  // the tier.
   const retiredTier = retiredAntigravityFlashTier(modelId);
   if (retiredTier) {
     return {
-      wireModelId: GEMINI_FLASH_WIRE_ID,
+      wireModelId: GEMINI_RETIRED_FLASH_TARGET_WIRE_ID,
       thinkingLevel: effort ? resolveAntigravityThinkingLevel(effort) ?? retiredTier : retiredTier,
     };
   }
@@ -638,8 +687,17 @@ export function resolveAntigravityEffortWireModel(
   // Rule 2/3: mapped Gemini base model.
   const effortMap = ANTIGRAVITY_EFFORT_WIRE_MAP[modelId];
   if (effortMap) {
-    if (effort && effort in effortMap) {
-      return { wireModelId: effortMap[effort]!, thinkingLevel: effort };
+    const suffixTiered = ANTIGRAVITY_SUFFIX_TIER_MODELS.has(modelId);
+    // Normalize FIRST for suffix-tiered models. The discovery path clamps max/xhigh/ultra to
+    // `high` before its own lookup, so a static path that skipped the clamp answered `medium`
+    // for the same request: one input, two tiers, decided by whether discovery happened to run.
+    const requested = suffixTiered && effort
+      ? resolveAntigravityThinkingLevel(effort) ?? effort
+      : effort;
+    if (requested && requested in effortMap) {
+      const wireModelId = effortMap[requested]!;
+      // The suffix already names the tier; see ANTIGRAVITY_SUFFIX_TIER_MODELS.
+      return suffixTiered ? { wireModelId } : { wireModelId, thinkingLevel: requested };
     }
     const defaultEffort = ANTIGRAVITY_DEFAULT_EFFORT[modelId]!;
     return { wireModelId: effortMap[defaultEffort]! };

package/src/providers/command-code-efforts.ts

@@ -103,6 +103,21 @@ const COMMAND_CODE_MODEL_EFFORTS = {
   // 2026-08-13: direct upstream POST with low/medium/high/xhigh/max all 200,
   // ultra 400; reasoningTokens differentiated 114..253; proxy previously stripped
   // the field so effort changes had no effect).
+  //
+  // 1.3 shipped 2026-09-02 as the same-shaped successor to 1.2 (Command Code
+  // publishes meta/muse-spark-1.3 and meta/muse-spark-1.3-contributor alongside
+  // the 1.2 pair, and Zen serves muse-spark-1.3-contributor over the same
+  // /responses wire). It carries the 1.2 ladder because it IS the 1.2 spec: the
+  // upstream ladder statement is per-family, and a narrower guess here would
+  // strip an effort the gateway accepts. Additive — 1.2 and 1.1 stay live.
+  "meta/muse-spark-1.3": {
+    efforts: ["low", "medium", "high", "xhigh", "max"],
+    profileUrl: "https://commandcode.ai/models/meta-muse-spark-1.3",
+  },
+  "meta/muse-spark-1.3-contributor": {
+    efforts: ["low", "medium", "high", "xhigh", "max"],
+    profileUrl: "https://commandcode.ai/models/meta-muse-spark-1.3-contributor",
+  },
   "meta/muse-spark-1.2": {
     efforts: ["low", "medium", "high", "xhigh", "max"],
     profileUrl: "https://commandcode.ai/models/meta-muse-spark-1.2",

package/src/providers/free-directory.ts

@@ -82,7 +82,10 @@ const CONNECTABLE: Record<string, ConnectableOverride> = {
   "cloudflare-ai": openAi("https://api.cloudflare.com/client/v4/accounts/{account_id}/ai/v1", "https://dash.cloudflare.com/?to=/:account/ai/workers-ai", { supportLevel: "supported", verification: "official", documentationUrl: "https://developers.cloudflare.com/workers-ai/configuration/open-ai-compatibility/", discovery: "static", liveModels: false, models: ["@cf/meta/llama-3.3-70b-instruct-fp8-fast", "@cf/qwen/qwq-32b"] }),
   cohere: openAi("https://api.cohere.com/compatibility/v1", "https://dashboard.cohere.com/api-keys", { supportLevel: "supported", verification: "official", documentationUrl: "https://docs.cohere.com/reference/list-models", modelsUrl: "https://api.cohere.com/compatibility/v1/models" }),
   friendliai: openAi("https://api.friendli.ai/serverless/v1", "https://suite.friendli.ai", { modelsUrl: "https://api.friendli.ai/serverless/v1/models" }),
-  gemini: { baseUrl: "https://generativelanguage.googleapis.com", dashboardUrl: "https://aistudio.google.com/apikey", adapter: "google", authKind: "key", supportLevel: "supported", verification: "official", documentationUrl: "https://ai.google.dev/api/models", lastVerified: LAST_VERIFIED, discovery: "live", liveModels: true, googleMode: "ai-studio", models: ["gemini-3.7-flash", "gemini-3.6-flash", "gemini-3.5-flash", "gemini-3.5-flash-lite", "gemini-3.1-pro-preview"] },
+  // `lastVerified` is row-specific here: the model list was re-checked against ai.google.dev
+  // on 2026-09-03 when 3.8 was added. Bumping the shared LAST_VERIFIED instead would stamp
+  // that date on every other provider row, none of which was re-checked.
+  gemini: { baseUrl: "https://generativelanguage.googleapis.com", dashboardUrl: "https://aistudio.google.com/apikey", adapter: "google", authKind: "key", supportLevel: "supported", verification: "official", documentationUrl: "https://ai.google.dev/api/models", lastVerified: "2026-09-03", discovery: "live", liveModels: true, googleMode: "ai-studio", models: ["gemini-3.8-flash", "gemini-3.7-flash", "gemini-3.6-flash", "gemini-3.5-flash", "gemini-3.5-flash-lite", "gemini-3.1-pro-preview"] },
   "github-models": openAi("https://models.github.ai/inference", "https://github.com/settings/tokens", { supportLevel: "supported", verification: "official", documentationUrl: "https://docs.github.com/en/github-models/prototyping-with-ai-models", discovery: "static", liveModels: false, models: ["openai/gpt-4.1", "meta/llama-4-scout-17b-16e-instruct"] }),
   groq: openAi("https://api.groq.com/openai/v1", "https://console.groq.com/keys", { supportLevel: "supported", verification: "official", documentationUrl: "https://console.groq.com/docs/api-reference#models" }),
   hackclub: openAi("https://ai.hackclub.com/proxy/v1", "https://ai.hackclub.com", { modelsUrl: "https://ai.hackclub.com/proxy/v1/models" }),

package/src/providers/registry.ts

@@ -435,6 +435,32 @@ const OPENAI_API_GPT56_VIRTUAL_MODELS: Record<string, { wireModelId: string; rea
   "gpt-5.6-luna-pro": { wireModelId: "gpt-5.6-luna", reasoningMode: "pro" },
 };
 const OPENAI_API_GPT56_REASONING_EFFORTS = ["low", "medium", "high", "xhigh", "max"];
+/*
+ * Meta Model API (https://api.meta.ai/v1) — published ladder, deliberately NOT the
+ * house set. dev.meta.ai/docs/reasoning lists "none", "minimal", "low", "medium",
+ * "high", "xhigh" and then excludes "none" for this family: "not supported by Muse
+ * Spark and returns HTTP 400". "max" and "ultra" are absent from the vendor's list
+ * entirely, so appending one by family resemblance would invent a wire value.
+ *
+ * Corroborated on a second surface: an unauthenticated OpenCode Zen probe of
+ * muse-spark-1.3-contributor-free (2026-09-03) accepted minimal..xhigh, rejected
+ * max/ultra with `unknown variant`, and rejected none with "does not support none
+ * with this model".
+ */
+const META_MUSE_REASONING_EFFORTS = ["minimal", "low", "medium", "high", "xhigh"];
+/*
+ * Identity wire map. `requestToCodexEffort` (src/reasoning-effort.ts) rewrites
+ * `minimal` to `low` unless a model-scoped wire map says otherwise, so without this
+ * the picker would advertise an effort the wire never sends — and a registry-array
+ * assertion would pass while the request body was wrong. Identity because Meta's
+ * values ARE the Codex names.
+ */
+const META_MUSE_REASONING_EFFORT_MAP: Record<string, string> = Object.fromEntries(
+  META_MUSE_REASONING_EFFORTS.map(effort => [effort, effort]),
+);
+/** Both Muse Spark 1.3 tiers publish a 1,048,576-token window (dev.meta.ai/docs/models). */
+const META_MUSE_CONTEXT_WINDOW = 1_048_576;
+const META_MUSE_MODELS = ["muse-spark-1.3", "muse-spark-1.3-contributor"];
 /**
  * Daybreak program aliases. These `-latest` ids are the stable contract: OpenAI repoints
  * them at newer snapshots over time (red -> gpt-5.6-cyber, blue -> gpt-5.6-sol as of
@@ -552,6 +578,8 @@ const COMMAND_CODE_IMAGE_MODELS = [
   "gpt-5.6-sol",
   "MiniMaxAI/MiniMax-M3",
   "moonshotai/Kimi-K3",
+  "meta/muse-spark-1.3",
+  "meta/muse-spark-1.3-contributor",
   "meta/muse-spark-1.2",
   "meta/muse-spark-1.2-contributor",
 ] as const;
@@ -1446,6 +1474,74 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     },
     virtualModels: OPENAI_API_GPT56_VIRTUAL_MODELS,
   },
+  /* [Decision Log]
+  - 목적과 의도: Reach Meta's Muse Spark models directly on Meta's own Model API, instead of only through the Command Code and OpenCode Zen resellers already in this registry.
+  - 기존 구현 및 제약 조건: Meta publishes both POST /v1/responses and POST /v1/chat/completions at https://api.meta.ai/v1, and no API key was issued for this change — every value here comes from the published spec (devlog/_plan/260903_muse_spark_plan_oauth/001).
+  - 검토한 주요 대안: register as openai-chat; use provider id "meta"; enable live discovery; wire the Muse Code subscription credential as OAuth.
+  - 선택한 방식: an openai-responses key provider under the id "meta-model", with a static two-model roster and no OAuth.
+  - 다른 대안 대신 이 방식을 선택한 이유: Meta calls Responses "the recommended default for new work ... OpenAI-compatible and exposes the full feature set", carrying reasoning replay and native input_image that Chat would forfeit. The id is "meta-model" because "meta" would capture the LIVE Command Code selector meta/muse-spark-1.3 at router.ts's provider-prefix branch, and would derive META_API_KEY — the Muse Code CLI's variable, not this API's MODEL_API_KEY.
+  - 장점, 단점 및 영향: users reach Muse Spark without a reseller; discovery stays off until an authenticated /v1/models payload is actually observed, so an unseen roster (Meta also serves image and voice families here) cannot leak into the picker.
+  */
+  {
+    id: "meta-model",
+    label: "Meta Model API",
+    adapter: "openai-responses",
+    baseUrl: "https://api.meta.ai/v1",
+    authKind: "key",
+    dashboardUrl: "https://dev.meta.ai/docs/authentication",
+    defaultModel: "muse-spark-1.3",
+    models: META_MUSE_MODELS,
+    // Static roster: no authenticated /v1/models payload was ever observed (the only
+    // contact was an unauthenticated GET returning 401 invalid_api_key), and Meta serves
+    // non-agent families on this same base URL. Turning discovery on would publish an
+    // unseen roster into the picker.
+    liveModels: false,
+    // A user may already own a custom provider named "meta-model" pointing elsewhere;
+    // without this, registry transport canonicalization would retarget it and send their
+    // saved key to Meta.
+    preserveCustomDestination: true,
+    modelContextWindows: Object.fromEntries(META_MUSE_MODELS.map(id => [id, META_MUSE_CONTEXT_WINDOW])),
+    // text+image only. Meta also documents video, audio (degraded on 1.3), and PDF, but
+    // the catalog modality enum is text/image and over-advertising poisons the exported
+    // client config (see tests/catalog-input-modality-enum.test.ts).
+    modelInputModalities: Object.fromEntries(META_MUSE_MODELS.map(id => [id, ["text", "image"] as ["text", "image"]])),
+    modelReasoningEfforts: Object.fromEntries(META_MUSE_MODELS.map(id => [id, META_MUSE_REASONING_EFFORTS])),
+    modelReasoningEffortMap: Object.fromEntries(META_MUSE_MODELS.map(id => [id, META_MUSE_REASONING_EFFORT_MAP])),
+    // No defaultMaxOutputTokens: Meta publishes none. The only number in its docs
+    // (131072) appears inside a third-party config sample, and the protocol pages call
+    // the real limit "model-dependent".
+    // Meta names its variable MODEL_API_KEY, but the env var opencodex reads is derived
+    // from the provider id (META_MODEL_API_KEY). Saying only Meta's name would send a
+    // user to export a variable this proxy never reads.
+    note: "Pay-as-you-go Meta Model API. Get a key at https://dev.meta.ai (Meta calls it MODEL_API_KEY; export it here as META_MODEL_API_KEY) — a Meta developer account needs a payment method before it can serve requests, and every call is metered per token. A Muse Code subscription does NOT work here: Meta scopes that credential to the Muse Code CLI and bills any other key pay-as-you-go (dev.meta.ai/docs/muse-code/subscriptions). The Contributor tier (muse-spark-1.3-contributor) is cheap because Meta trains on your prompts — about 92% off input, 95% off output, 99% off cached input; do not send confidential material through it. Muse Spark is also reachable through resellers: command-code carries both tiers, opencode-go serves only muse-spark-1.3-contributor.",
+  },
+  /* [Decision Log]
+  - 목적과 의도: Let an operator who already signed the Muse Code CLI in reach Muse Spark with that credential, instead of provisioning a second key.
+  - 기존 구현 및 제약 조건: The CLI stores a pointer at ~/.config/muse/auth.json and the secret in the macOS Keychain (ai.meta.dev.credentials/meta). Measured: the OAuth access_token 401s on /v1/models while the sibling api_key returns 200, so the usable artifact is a static key, not a refreshable token.
+  - 검토한 주요 대안: spawn `muse login` and poll; reimplement Meta's device grant; treat it as a second key preset; ship nothing.
+  - 선택한 방식: an import-only, macOS-only OAuth provider that reads the existing credential, validates it once, and never spawns or reimplements anything.
+  - 다른 대안 대신 이 방식을 선택한 이유: `muse login` has no non-interactive mode, so a spawned child could outlive cancellation, and polling for the pointer file is satisfied instantly by the one already on disk — reimporting the OLD account on a force-login. Reimplementing the grant would mean guessing a client id the vendor does not publish.
+  - 장점, 단점 및 영향: no new credential to provision, and the id is distinct from meta-model so neither pool contaminates the other. Meta scopes this credential to its own CLI, so the provider carries a HIGH_RISK ToS warning, a CLI-side warning before any read, and a note that says plainly what is unsupported.
+  */
+  {
+    id: "meta-muse",
+    label: "Meta Muse Code (CLI credential)",
+    adapter: "openai-responses",
+    baseUrl: "https://api.meta.ai/v1",
+    authKind: "oauth",
+    oauthId: "meta-muse",
+    dashboardUrl: "https://dev.meta.ai",
+    defaultModel: "muse-spark-1.3",
+    models: META_MUSE_MODELS,
+    // Same reason as meta-model: the authenticated roster carries muse-image-1.0 and
+    // muse-voice-transcribe-1.0, which this Responses-agent provider cannot drive.
+    liveModels: false,
+    modelContextWindows: Object.fromEntries(META_MUSE_MODELS.map(id => [id, META_MUSE_CONTEXT_WINDOW])),
+    modelInputModalities: Object.fromEntries(META_MUSE_MODELS.map(id => [id, ["text", "image"] as ["text", "image"]])),
+    modelReasoningEfforts: Object.fromEntries(META_MUSE_MODELS.map(id => [id, META_MUSE_REASONING_EFFORTS])),
+    modelReasoningEffortMap: Object.fromEntries(META_MUSE_MODELS.map(id => [id, META_MUSE_REASONING_EFFORT_MAP])),
+    note: "Reuses the API key the Muse Code CLI stores after `muse login` (macOS only; requires the CLI installed and signed in). Meta scopes that credential to the Muse Code CLI, so this is an UNSUPPORTED use: Meta does not authorize subscription coverage outside its own CLI, how these calls settle is not observable from the API, and you should treat every call as billable against your account. The imported key is copied into OpenCodex's auth store. Meta reports subscription window usage inside streaming responses, but OpenCodex does not yet read or display it, and there is no endpoint to query it on demand. Rate limits apply per team, not per key. For a supported path use the meta-model provider with your own key (export it as META_MODEL_API_KEY).",
+  },
   {
     id: "umans",
     label: "Umans AI Coding Plan",
@@ -1487,25 +1583,33 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     - 다른 대안 대신 이 방식을 선택한 이유: OpenCode Go documents sibling models on Chat or Anthropic endpoints, and an exact registry default preserves both those routes and explicit opt-out precedence.
     - 장점, 단점 및 영향: Each listed model reaches `/responses` from every inbound surface without changing siblings; a future upstream endpoint change requires an evidence-backed registry update.
     */
-    modelWireDefaults: { "gpt-5.6-luna": "openai-responses", "muse-spark-1.2-contributor": "openai-responses" },
+    modelWireDefaults: {
+      "gpt-5.6-luna": "openai-responses",
+      "muse-spark-1.3-contributor": "openai-responses",
+      "muse-spark-1.2-contributor": "openai-responses",
+    },
     modelContextWindows: {
       "kimi-k3": KIMI_K3_STANDARD_CONTEXT_WINDOW,
       // The DeepSeek vision preview id is metadata-only here: the Go roster is
       // discovered live, so it applies the moment the gateway serves the id.
       [DEEPSEEK_VISION_PREVIEW_MODEL]: 1_048_576,
-      // Muse Spark 1.2 Contributor serves a 1,048,576-token (1M) context window over
+      // Muse Spark Contributor serves a 1,048,576-token (1M) context window over
       // /responses on Zen Go, matching its 1.1 sibling (Meta developer docs, verified 2026-08-28).
       // Without this declaration the catalog falls back to 128k, capping real usable context.
+      // 1.3 ships the same window as 1.2 and is served from the same Zen Go roster.
+      "muse-spark-1.3-contributor": 1_048_576,
       "muse-spark-1.2-contributor": 1_048_576,
     },
     modelInputModalities: {
       "kimi-k3": ["text", "image"],
       // Experimental DeepSeek vision preview — expected to merge into deepseek-v4-flash later.
       [DEEPSEEK_VISION_PREVIEW_MODEL]: ["text", "image"],
-      // Muse Spark 1.2 Contributor is natively multimodal on Zen Go: it accepts input_image
+      // Muse Spark Contributor is natively multimodal on Zen Go: it accepts input_image
       // parts over /responses (probed 2026-08-26). Without this declaration the catalog
       // advertises it text-only and the Codex app blocks image attachments client-side with
       // "This model does not support image inputs" before the request ever reaches the proxy.
+      // 1.3 is the same-shaped successor and Command Code documents it as multimodal.
+      "muse-spark-1.3-contributor": ["text", "image"],
       "muse-spark-1.2-contributor": ["text", "image"],
     },
     modelReasoningEfforts: {
@@ -1736,13 +1840,17 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
   // devlog/_plan/260710_provider_hardening/001_research_frontier.md.
   {
     id: "google", label: "Google Gemini", adapter: "google", baseUrl: "https://generativelanguage.googleapis.com", authKind: "key", featured: true,
-    dashboardUrl: "https://aistudio.google.com/apikey", defaultModel: "gemini-3.5-flash", models: ["gemini-3.6-flash", "gemini-3.5-flash", "gemini-3.5-flash-lite", "gemini-3.1-pro-preview", "gemini-3.7-flash"],
-    modelContextWindows: { "gemini-3.6-flash": 1_048_576, "gemini-3.5-flash": 1_000_000, "gemini-3.5-flash-lite": 1_048_576, "gemini-3.7-flash": 1_048_576 },
-    modelInputModalities: { "gemini-3.6-flash": ["text", "image"], "gemini-3.5-flash-lite": ["text", "image"], "gemini-3.7-flash": ["text", "image"] },
+    dashboardUrl: "https://aistudio.google.com/apikey", defaultModel: "gemini-3.5-flash", models: ["gemini-3.8-flash", "gemini-3.6-flash", "gemini-3.5-flash", "gemini-3.5-flash-lite", "gemini-3.1-pro-preview", "gemini-3.7-flash"],
+    modelContextWindows: { "gemini-3.8-flash": 1_048_576, "gemini-3.6-flash": 1_048_576, "gemini-3.5-flash": 1_000_000, "gemini-3.5-flash-lite": 1_048_576, "gemini-3.7-flash": 1_048_576 },
+    modelInputModalities: { "gemini-3.8-flash": ["text", "image"], "gemini-3.6-flash": ["text", "image"], "gemini-3.5-flash-lite": ["text", "image"], "gemini-3.7-flash": ["text", "image"] },
     modelReasoningEfforts: {
+      // 3.7 and 3.8 omit `minimal`: Google documents it as a validation error on both model
+      // pages, so advertising it hands the user a rung the API rejects. 3.5/3.6 keep theirs —
+      // their pages still list it, and this unit has no evidence to change them.
+      "gemini-3.8-flash": ["low", "medium", "high"],
+      "gemini-3.7-flash": ["low", "medium", "high"],
       "gemini-3.6-flash": ["minimal", "low", "medium", "high"],
       "gemini-3.5-flash": ["minimal", "low", "medium", "high"],
-      "gemini-3.7-flash": ["minimal", "low", "medium", "high"],
       "gemini-3.1-pro-preview": ["low", "medium", "high"],
     },
     jawcodeBundle: "google", extraMetadataAliases: ["gemini"],
@@ -1750,7 +1858,7 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
   // 2026-07-10: defaultModel is frozen pending Vertex-specific Tier-2 evidence; Gemini API
   // evidence from ai.google.dev does not establish Vertex publisher availability.
   { id: "google-vertex", label: "Google Vertex AI", adapter: "google", baseUrl: "https://aiplatform.googleapis.com", authKind: "key", dashboardUrl: "https://console.cloud.google.com/vertex-ai", defaultModel: "gemini-3-pro", googleMode: "vertex", jawcodeBundle: "google", extraMetadataAliases: ["gemini-vertex"] },
-  { id: "google-antigravity", label: "Google Antigravity", adapter: "google", baseUrl: "https://daily-cloudcode-pa.googleapis.com", authKind: "oauth", allowBaseUrlOverride: true, dashboardUrl: "https://antigravity.google", models: ANTIGRAVITY_MODELS, liveModels: true, defaultModel: "gemini-3.7-flash", modelContextWindows: ANTIGRAVITY_MODEL_CONTEXT_WINDOWS, modelInputModalities: ANTIGRAVITY_MODEL_INPUT_MODALITIES, modelReasoningEfforts: ANTIGRAVITY_MODEL_EFFORTS, googleMode: "cloud-code-assist", jawcodeBundle: "google", extraMetadataAliases: ["antigravity", "gemini-antigravity"] },
+  { id: "google-antigravity", label: "Google Antigravity", adapter: "google", baseUrl: "https://daily-cloudcode-pa.googleapis.com", authKind: "oauth", allowBaseUrlOverride: true, dashboardUrl: "https://antigravity.google", models: ANTIGRAVITY_MODELS, liveModels: true, defaultModel: "gemini-3.8-flash", modelContextWindows: ANTIGRAVITY_MODEL_CONTEXT_WINDOWS, modelInputModalities: ANTIGRAVITY_MODEL_INPUT_MODALITIES, modelReasoningEfforts: ANTIGRAVITY_MODEL_EFFORTS, googleMode: "cloud-code-assist", jawcodeBundle: "google", extraMetadataAliases: ["antigravity", "gemini-antigravity"] },
   { id: "azure-openai", label: "Azure OpenAI", adapter: "azure-openai", baseUrl: "https://{resource}.openai.azure.com/openai", authKind: "key", featured: true, dashboardUrl: "https://portal.azure.com" },
   { id: "ollama", label: "Ollama (local)", adapter: "openai-chat", baseUrl: "http://localhost:11434/v1", authKind: "local", allowPrivateNetworkByDefault: true, allowBaseUrlOverride: true, featured: true, note: "Local — key usually blank" },
   { id: "vllm", label: "vLLM (local)", adapter: "openai-chat", baseUrl: "http://localhost:8000/v1", authKind: "local", allowPrivateNetworkByDefault: true, allowBaseUrlOverride: true, featured: true, note: "Local — key usually blank" },

package/src/responses/code-mode-helper-compat.ts

@@ -21,7 +21,7 @@ function unwrapPatchInput(value: string): string {
  * Convert a nested Code Mode helper call into unified-exec JavaScript.
  *
  * Parsed values are serialized as data, never interpolated as source, so command and patch text
- * cannot escape the generated call. Invalid structured shell payloads are also passed as data so
+ * cannot escape the generated call. Invalid structured helper payloads are also passed as data so
  * nested-tool validation can reject them without evaluating provider text as JavaScript.
  */
 export function compileCodeModeHelperInput(argumentsText: unknown, toolName: string): string {
@@ -46,5 +46,8 @@ export function compileCodeModeHelperInput(argumentsText: unknown, toolName: str
     args.cmd = args.command;
     delete args.command;
   }
+  if (toolName === "write_stdin") {
+    return `const result = await tools.write_stdin(${JSON.stringify(args)});\ntext(result);`;
+  }
   return `const result = await tools.exec_command(${JSON.stringify(args)});\ntext(result);`;
 }

package/src/responses/state.ts

@@ -1469,14 +1469,14 @@ function ensureLoaded(): void {
 
 type SnapshotWriteOutcome = "stable" | "unstable" | "failed";
 
-async function writeBoundedSnapshot(path: string): Promise<SnapshotWriteOutcome> {
+async function writeBoundedSnapshot(path: string, attemptLimit: number): Promise<SnapshotWriteOutcome> {
   // Serialize writers so concurrent flush + debounce cannot race on temps / ACL (#612).
   const previous = persistGate;
   let release!: () => void;
   persistGate = new Promise<void>(resolve => { release = resolve; });
   await previous;
   try {
-    for (let attempt = 0; attempt < MAX_SNAPSHOT_REWRITE_ATTEMPTS; attempt += 1) {
+    for (let attempt = 0; attempt < attemptLimit; attempt += 1) {
       const revision = stateRevision;
       const entries: Array<[string, unknown]> = [];
       let total = 0;
@@ -1579,12 +1579,13 @@ async function persistNow(path: string, awaitFollowUp = false): Promise<void> {
     persistTimer = null;
   }
   pendingPersistPath = null;
-  let outcome = await writeBoundedSnapshot(path);
+  const attemptLimit = awaitFollowUp ? MAX_SNAPSHOT_REWRITE_ATTEMPTS : 1;
+  let outcome = await writeBoundedSnapshot(path, attemptLimit);
   if (outcome === "unstable" && awaitFollowUp) {
     if (persistTimer) clearTimeout(persistTimer);
     persistTimer = null;
     pendingPersistPath = null;
-    outcome = await writeBoundedSnapshot(path);
+    outcome = await writeBoundedSnapshot(path, attemptLimit);
   }
   if (outcome === "stable") drainPendingSpillUnlinks();
   else if (outcome === "unstable" && !awaitFollowUp) schedulePersistAt(path, true);