@bitkyc08/opencodex 2.40.0 → 2.42.0

package/src/oauth/chatgpt.ts

@@ -5,6 +5,10 @@ import { generatePKCE } from "./pkce";
 const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 const AUTH_URL = "https://auth.openai.com/oauth/authorize";
 const TOKEN_URL = "https://auth.openai.com/oauth/token";
+
+/** Shared with the deviceauth grant in `./chatgpt-device`: same public PKCE client. */
+export const CHATGPT_CLIENT_ID = CLIENT_ID;
+export const CHATGPT_TOKEN_URL = TOKEN_URL;
 const SCOPE = "openid profile email offline_access api.connectors.read api.connectors.invoke";
 const CALLBACK_PORT = 1455;
 const CALLBACK_PATH = "/auth/callback";
@@ -46,9 +50,17 @@ export function extractEmail(idToken?: string, accessToken?: string): string | u
   return undefined;
 }
 
-function credsFromToken(data: Record<string, unknown>): OAuthCredentials {
+export function credsFromToken(data: Record<string, unknown>): OAuthCredentials {
   const idToken = typeof data.id_token === "string" ? data.id_token : undefined;
-  const accessToken = data.access_token as string;
+  // This parses a response from an external boundary, so the access token is
+  // validated rather than cast. A 200 carrying no access_token would otherwise
+  // resolve a login as successful with an undefined credential, which then gets
+  // silently declined at persistence — a success message and no account.
+  const accessToken = typeof data.access_token === "string" && data.access_token.length > 0
+    ? data.access_token
+    : undefined;
+  if (!accessToken) throw new Error("ChatGPT token response missing access token");
+  const refreshToken = typeof data.refresh_token === "string" ? data.refresh_token : "";
   // ?? only guards null/undefined; NaN or a string expires_in would otherwise
   // produce a NaN expiry that never compares as expired, and a negative duration
   // would stamp an already-past expiry — both block refresh semantics.
@@ -62,7 +74,7 @@ function credsFromToken(data: Record<string, unknown>): OAuthCredentials {
   const expires = Number.isFinite(computedExpires) ? computedExpires : Date.now() + 3600 * 1000;
   return {
     access: accessToken,
-    refresh: (data.refresh_token as string) ?? "",
+    refresh: refreshToken,
     expires,
     accountId: extractAccountId(idToken, accessToken),
     email: extractEmail(idToken, accessToken),
@@ -135,7 +147,22 @@ function safeErrorDescription(resp: Response): Promise<string> {
   });
 }
 
-export async function loginChatGPT(ctrl: OAuthController, opts?: { forceLogin?: boolean }): Promise<OAuthCredentials> {
+/**
+ * How the user proves identity. `browser` runs the localhost:1455 callback flow;
+ * `device` runs the deviceauth grant, which needs no local browser or listener
+ * and is the only workable path on a headless or remote hub (#3366).
+ */
+export type ChatGPTLoginFlow = "browser" | "device";
+
+export async function loginChatGPT(
+  ctrl: OAuthController,
+  opts?: { forceLogin?: boolean; flow?: ChatGPTLoginFlow },
+): Promise<OAuthCredentials> {
+  if (opts?.flow === "device") {
+    // Imported lazily so the callback flow does not pay for a module it never uses.
+    const { loginChatGPTDevice } = await import("./chatgpt-device");
+    return loginChatGPTDevice(ctrl);
+  }
   const flow = new ChatGPTOAuthFlow(ctrl);
   if (opts?.forceLogin) flow.forceLogin = true;
   return flow.login();

package/src/oauth/generic-account-failover.ts

@@ -202,11 +202,11 @@ export function rotateGenericOAuthAccountOn429(
   // A single stored account has nowhere to go; rotating to itself would just replay the 429.
   if (!set || set.accounts.length < 2) return null;
 
-  const parsed = parseRetryAfterMs(retryAfterHeader, now);
+  const parsed = parseRetryAfterMs(retryAfterHeader, now, { preserveImmediate: true });
   // An account whose allowance is provably spent gets a reset-aligned cooldown instead of
   // the default minute: retrying it every 60s until the window rolls over is pure waste.
   // A Retry-After from upstream still wins — it is the server's own instruction.
-  const exhausted = parsed === null ? exhaustedCooldownMs(providerName, failedAccountId, now) : null;
+  const exhausted = parsed === undefined ? exhaustedCooldownMs(providerName, failedAccountId, now) : null;
   const cooldownMs = exhausted ?? Math.min(parsed ?? DEFAULT_COOLDOWN_MS, MAX_COOLDOWN_MS);
   health.set(healthKey(providerName, failedAccountId), {
     cooldownUntil: now + cooldownMs,

package/src/oauth/index.ts

@@ -34,11 +34,12 @@ import { loginXai, refreshXaiToken, XAI_LOCAL_CLI_DETACH_WARNING, XaiTokenReques
 import { ANTHROPIC_OAUTH_BETA, AnthropicTokenError, loginAnthropic, refreshAnthropicToken } from "./anthropic";
 import { loginKimi, refreshKimiToken } from "./kimi";
 import { loginNous, NousTokenError, refreshNousToken, clearNousRefreshIntent, RefreshIntentIOError } from "./nous";
-import { loginChatGPT, refreshChatGPTToken } from "./chatgpt";
+import { loginChatGPT, refreshChatGPTToken, type ChatGPTLoginFlow } from "./chatgpt";
 import { loginAntigravity, refreshAntigravityToken } from "./google-antigravity";
 import { loginCursor, refreshCursorToken } from "./cursor";
 import { loginGithubCopilot, refreshGithubCopilotToken, validateCopilotApiBaseUrl } from "./github-copilot";
 import { loginCommandCode, refreshCommandCodeToken } from "./command-code";
+import { loginMetaMuse, refreshMetaMuseToken } from "./meta-muse";
 import { ANTIGRAVITY_REQUEST_UA } from "../adapters/google-antigravity-wire";
 import { deriveOAuthDefaultModel, deriveOAuthProviderConfig } from "../providers/derive";
 import { apiKeyPoolEntryId, sanitizeApiKeyValue } from "../providers/api-keys";
@@ -160,7 +161,17 @@ function verdictKey(p:string,a:string,c:OAuthCredentials){return `${p}\0${a}\0${
 function cached(p:string,a:string,c:OAuthCredentials,now:()=>number){const k=verdictKey(p,a,c),u=permanentRefreshFailures.get(k);if(u===undefined)return false;if(u<=now()){permanentRefreshFailures.delete(k);return false;}return true;}
 export function sweepExpiredXaiPermanentFailureVerdicts(now=Date.now()):number{let removed=0;for(const[key,until]of permanentRefreshFailures){if(until>now)continue;permanentRefreshFailures.delete(key);removed+=1;}return removed;}
 
-export interface LoginOpts { forceLogin?: boolean; /** When set, persist into this account slot and require matching identity. */ reauthAccountId?: string }
+export interface LoginOpts {
+  forceLogin?: boolean;
+  /** When set, persist into this account slot and require matching identity. */
+  reauthAccountId?: string;
+  /**
+   * ChatGPT only: `device` selects the deviceauth grant instead of the
+   * localhost:1455 callback flow, for hosts with no browser or no loopback
+   * listener (#3366). Ignored by every other provider.
+   */
+  flow?: ChatGPTLoginFlow;
+}
 
 export interface LoginFlowLifecycle {
   /** Runs after background credential/config persistence settles, before status becomes done. */
@@ -228,6 +239,16 @@ export const OAUTH_PROVIDERS: Record<string, OAuthProviderDef> = {
     providerConfig: oauthConfig("kimi"),
     defaultModel: oauthDefaultModel("kimi"),
   },
+  "meta-muse": {
+    login: ctrl => loginMetaMuse(ctrl),
+    refresh: refreshMetaMuseToken,
+    providerConfig: oauthConfig("meta-muse"),
+    defaultModel: oauthDefaultModel("meta-muse"),
+    // Static API key that Meta scopes to its own CLI. Never generate unattended traffic
+    // on it — same posture as anthropic, for the same reason: the vendor restricts use
+    // outside its own client, so every exchange stays attributable to a user action.
+    defaultRefreshPolicy: "disabled",
+  },
   nous: {
     // Nous Portal device-grant login (RFC 8628) against portal.nousresearch.com.
     // The access token is the per-request inference JWT (scope inference:invoke).
@@ -271,7 +292,7 @@ export const OAUTH_PROVIDERS: Record<string, OAuthProviderDef> = {
     defaultRefreshPolicy: "lazy-only",
   },
   chatgpt: {
-    login: loginChatGPT,
+    login: (ctrl, opts) => loginChatGPT(ctrl, { forceLogin: opts?.forceLogin, flow: opts?.flow }),
     refresh: (rt) => refreshChatGPTToken(rt),
     providerConfig: { adapter: "openai-responses", baseUrl: "https://chatgpt.com/backend-api/codex", authMode: "forward" as const },
     defaultModel: "gpt-5.4",

package/src/oauth/log.ts

@@ -23,6 +23,9 @@ const FORBIDDEN_NORMALIZED = new Set([
   "oauth_code",
   "code_verifier",
   "clientsecret",
+  // Device-flow polling handle. Not a token, but it is the bearer of an
+  // in-flight authorization and must not be logged.
+  "device_auth_id",
 ]);
 
 function isForbiddenFieldKey(key: string): boolean {

package/src/oauth/meta-muse.ts

@@ -0,0 +1,235 @@
+/**
+ * Meta Muse Code credential import.
+ *
+ * The Muse Code CLI signs in through a browser device-approval flow and stores the
+ * result in two places: `~/.config/muse/auth.json` is a POINTER carrying no secret, and
+ * the secret itself lives in the macOS Keychain under service
+ * `ai.meta.dev.credentials`, account `meta`.
+ *
+ * Two measured facts shape this module (devlog/_plan/260903_muse_spark_plan_oauth/003):
+ *
+ * 1. The Keychain payload holds BOTH an `access_token` and an `api_key`, and only the
+ *    `api_key` authenticates the Model API — the OAuth access token returns 401
+ *    `invalid_api_key`. So this is a static-key credential, not a refreshable one.
+ * 2. Meta scopes that credential to the Muse Code CLI in writing. Reusing it here is an
+ *    UNSUPPORTED path the repository owner opted into deliberately, which is why the
+ *    warning below fires before anything is read and why the provider sits in the GUI's
+ *    HIGH_RISK ToS map.
+ *
+ * This module never spawns the CLI. A login that finds no credential explains what to
+ * run rather than running it: `muse login` is interactive with no machine-readable mode,
+ * so a spawned child could outlive cancellation, and polling for the pointer file would
+ * be satisfied instantly by the one already on disk — reimporting the OLD account on a
+ * force-login.
+ */
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { sanitizeApiKeyValue } from "../providers/api-keys";
+import type { OAuthController, OAuthCredentials } from "./types";
+
+const MUSE_POINTER_PATH = join(homedir(), ".config", "muse", "auth.json");
+const KEYCHAIN_SERVICE = "ai.meta.dev.credentials";
+const KEYCHAIN_ACCOUNT = "meta";
+const MODELS_URL = "https://api.meta.ai/v1/models";
+const VALIDATE_TIMEOUT_MS = 10_000;
+const KEYCHAIN_TIMEOUT_MS = 5_000;
+
+/**
+ * Shown BEFORE any credential is read.
+ *
+ * `login-cli.ts` passes `onProgress` straight to `console.log` and never reads the
+ * registry note, so this is the CLI's only warning surface. The GUI ignores it because
+ * `OAuthTosWarningModal` has already been acknowledged by then.
+ */
+const CONSENT_WARNING = [
+  "Meta scopes the Muse Code credential to the Muse Code CLI.",
+  "Using it here is UNSUPPORTED: Meta does not authorize subscription coverage outside its own CLI,",
+  "how these calls settle is not observable from the API, and you should treat every call as billable.",
+  "The imported key is copied into OpenCodex's auth store (~/.opencodex/auth.json, 0600).",
+  "Supported alternative: the meta-model provider with your own key (META_MODEL_API_KEY).",
+].join(" ");
+
+/** The Keychain payload. `access_token` is deliberately unused — it 401s (003 §B). */
+interface MuseKeychainSecret {
+  api_key?: unknown;
+  access_token?: unknown;
+}
+
+interface MusePointer {
+  providers?: { meta?: { mechanism?: unknown; storage?: unknown; user_email?: unknown } };
+}
+
+/** Injected so tests never touch the real Keychain, filesystem, platform, or network. */
+export interface MuseImportDeps {
+  platform?: string;
+  readPointer?: () => Promise<string | null>;
+  readKeychain?: (signal?: AbortSignal) => Promise<string | null>;
+  fetchImpl?: typeof fetch;
+}
+
+async function defaultReadPointer(): Promise<string | null> {
+  try {
+    return await Bun.file(MUSE_POINTER_PATH).text();
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * `security` can block indefinitely — the Keychain may raise an interactive approval
+ * prompt, and on a headless or locked machine nobody answers it. Without a deadline the
+ * login would hang before the validation timeout below is even created, so the bound
+ * lives here rather than only around the fetch.
+ */
+async function defaultReadKeychain(signal?: AbortSignal): Promise<string | null> {
+  const deadline = signal
+    ? AbortSignal.any([signal, AbortSignal.timeout(KEYCHAIN_TIMEOUT_MS)])
+    : AbortSignal.timeout(KEYCHAIN_TIMEOUT_MS);
+  let proc: Bun.Subprocess<"ignore", "pipe", "pipe"> | undefined;
+  try {
+    proc = Bun.spawn(
+      ["security", "find-generic-password", "-s", KEYCHAIN_SERVICE, "-a", KEYCHAIN_ACCOUNT, "-w"],
+      { stdout: "pipe", stderr: "pipe" },
+    );
+    const child = proc;
+    const finished = Promise.all([new Response(child.stdout).text(), child.exited]);
+    const timedOut = new Promise<null>((resolve) => {
+      if (deadline.aborted) { resolve(null); return; }
+      deadline.addEventListener("abort", () => resolve(null), { once: true });
+    });
+    const settled = await Promise.race([finished, timedOut]);
+    if (settled === null) return null;
+    const [out, code] = settled;
+    if (code !== 0) return null;
+    const trimmed = out.trim();
+    return trimmed.length > 0 ? trimmed : null;
+  } catch {
+    return null;
+  } finally {
+    // A prompt still on screen keeps the child alive after the race resolves.
+    if (proc && proc.exitCode === null) { try { proc.kill(); } catch { /* already gone */ } }
+  }
+}
+
+const INSTALL_HINT =
+  "Install it from https://dev.meta.ai/install.sh, run `muse login`, then retry.";
+
+function normalizedEmail(value: unknown): string | undefined {
+  if (typeof value !== "string") return undefined;
+  const trimmed = value.trim().toLowerCase();
+  return trimmed.length > 0 ? trimmed : undefined;
+}
+
+/**
+ * Import the credential the Muse Code CLI already holds.
+ *
+ * Every refusal names what the user should do. None of them includes the credential.
+ */
+export async function loginMetaMuse(
+  ctrl: OAuthController = {},
+  deps: MuseImportDeps = {},
+): Promise<OAuthCredentials> {
+  // Before ANY read: the CLI has no other warning surface.
+  ctrl.onProgress?.(CONSENT_WARNING);
+
+  const platform = deps.platform ?? process.platform;
+  if (platform !== "darwin") {
+    throw new Error(
+      "Meta Muse Code login is macOS-only: the CLI stores its credential in the macOS Keychain, "
+        + "and no other platform's storage has been verified. Use the meta-model provider with your own key instead.",
+    );
+  }
+
+  const pointerRaw = await (deps.readPointer ?? defaultReadPointer)();
+  if (pointerRaw === null) {
+    throw new Error(`Muse Code CLI credential not found at ${MUSE_POINTER_PATH}. ${INSTALL_HINT}`);
+  }
+
+  let pointer: MusePointer;
+  try {
+    pointer = JSON.parse(pointerRaw) as MusePointer;
+  } catch {
+    throw new Error(`Muse Code credential file at ${MUSE_POINTER_PATH} is not valid JSON. Run \`muse login\` to rewrite it.`);
+  }
+
+  const meta = pointer.providers?.meta;
+  if (!meta || meta.mechanism !== "oauth") {
+    throw new Error("The Muse Code credential file has no signed-in Meta account. Run `muse login`, then retry.");
+  }
+  // A different storage backend is a shape we have not measured; refuse rather than guess.
+  if (meta.storage !== "keychain") {
+    throw new Error(
+      `Muse Code stored its credential with an unsupported backend (${String(meta.storage)}); only the macOS Keychain is verified.`,
+    );
+  }
+
+  const secretRaw = await (deps.readKeychain ?? defaultReadKeychain)(ctrl.signal);
+  if (secretRaw === null) {
+    throw new Error(
+      "Could not read the Muse Code credential from the macOS Keychain within 5s. Approve the Keychain prompt, or run `muse login` again.",
+    );
+  }
+
+  let secret: MuseKeychainSecret;
+  try {
+    secret = JSON.parse(secretRaw) as MuseKeychainSecret;
+  } catch {
+    throw new Error("The Muse Code Keychain entry is not valid JSON. Run `muse login` to rewrite it.");
+  }
+
+  // access_token is present but 401s against the Model API (003 §B) — never fall back to it.
+  const apiKey = sanitizeApiKeyValue(secret.api_key);
+  if (!apiKey) {
+    throw new Error("The Muse Code Keychain entry carries no usable API key. Run `muse login` again.");
+  }
+  if (!/^LLM\|\d+\|[A-Za-z0-9_-]{10,}$/.test(apiKey)) {
+    throw new Error("The Muse Code credential is not in the expected Meta API key format. Run `muse login` again.");
+  }
+
+  ctrl.onProgress?.("Validating the imported Meta credential…");
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  // ctrl.signal is OPTIONAL and the CLI controller supplies none: AbortSignal.any([undefined])
+  // throws a TypeError, which would fail every CLI login right after the warning printed.
+  const signal = ctrl.signal
+    ? AbortSignal.any([ctrl.signal, AbortSignal.timeout(VALIDATE_TIMEOUT_MS)])
+    : AbortSignal.timeout(VALIDATE_TIMEOUT_MS);
+  let response: Response;
+  try {
+    response = await fetchImpl(MODELS_URL, {
+      headers: { Authorization: `Bearer ${apiKey}`, Accept: "application/json" },
+      signal,
+    });
+  } catch (error) {
+    if (ctrl.signal?.aborted) throw ctrl.signal.reason ?? new DOMException("Meta Muse login aborted", "AbortError");
+    throw new Error(`Could not reach the Meta Model API to validate the credential: ${(error as Error).message}`);
+  }
+  if (!response.ok) {
+    throw new Error(
+      `The Muse Code credential was rejected by the Meta Model API (HTTP ${response.status}). Run \`muse login\` again.`,
+    );
+  }
+
+  return {
+    access: apiKey,
+    // Static key: there is nothing to exchange, so refresh carries the same value.
+    refresh: apiKey,
+    expires: Number.MAX_SAFE_INTEGER,
+    // `email`, not `accountId`: the account list masks email for display, and store.ts
+    // already falls back to it for slot identity, so multi-account still works.
+    ...(normalizedEmail(meta.user_email) ? { email: normalizedEmail(meta.user_email) } : {}),
+    source: "local-cli",
+  };
+}
+
+/**
+ * Static-key refresh, exactly like Command Code's.
+ *
+ * This deliberately does NOT re-read the Keychain. Generic refresh writes its result into
+ * the slot being refreshed, so if the user ran `muse login` with a DIFFERENT account in
+ * between, a re-import would silently overwrite one stored identity with another. Only an
+ * explicit login may import.
+ */
+export async function refreshMetaMuseToken(apiKey: string): Promise<OAuthCredentials> {
+  if (!apiKey) throw new Error("Meta Muse Code API key missing; run `ocx login meta-muse`");
+  return { access: apiKey, refresh: apiKey, expires: Number.MAX_SAFE_INTEGER, source: "local-cli" };
+}

package/src/providers/antigravity-models.ts

@@ -13,14 +13,27 @@ import { isModelCacheGenerationCurrent } from "../codex/model-cache";
 // ── Wire IDs (what CCA :fetchAvailableModels returns) ──
 
 /** Current Antigravity Flash generation. */
-const GEMINI_FLASH_CURRENT = "gemini-3.7-flash";
+const GEMINI_FLASH_CURRENT = "gemini-3.8-flash";
 
 /**
- * Wire ID that CCA actually accepts for the current Flash generation.
- * Google renamed the model to include a `-tiered` suffix; the picker-visible
- * ID stays `gemini-3.7-flash` (stripped by `pickerModelIdForDiscoveredWireId`).
+ * Previous Flash generation — still served, still picker-visible.
+ *
+ * 3.6 vanished from CCA the moment 3.7 shipped, which is why RETIRED_FLASH_TIERS exists. 3.8
+ * did not do that: Google documents 3.7 Flash as "remains fully supported", and a 2026-09-03
+ * :fetchAvailableModels call returns 3.8, 3.7 AND 3.6 wire ids together. Retiring 3.7 here
+ * would strand a model the backend is actively serving.
+ */
+const GEMINI_FLASH_PREVIOUS = "gemini-3.7-flash";
+
+/**
+ * Wire ID that CCA accepts for the RETIRED-tier redirect target (currently 3.7).
+ *
+ * Google renamed 3.7 to carry a `-tiered` suffix; the picker-visible ID stays
+ * `gemini-3.7-flash` (stripped by `pickerModelIdForDiscoveredWireId`). This constant is named
+ * for its ROLE, not for the current generation: 3.8 is current and has no `-tiered` id, so a
+ * name like GEMINI_FLASH_WIRE_ID would now point readers at the wrong model.
  */
-const GEMINI_FLASH_WIRE_ID = "gemini-3.7-flash-tiered";
+const GEMINI_RETIRED_FLASH_TARGET_WIRE_ID = "gemini-3.7-flash-tiered";
 
 /**
  * Retired Flash ids → the reasoning tier they used to encode.
@@ -60,6 +73,9 @@ const ANTIGRAVITY_WIRE_MODELS = [
 ];
 
 const ANTIGRAVITY_PICKER_MODEL_BY_WIRE_ID: Record<string, string> = {
+  "gemini-3.8-flash-low": "gemini-3.8-flash",
+  "gemini-3.8-flash-medium": "gemini-3.8-flash",
+  "gemini-3.8-flash-high": "gemini-3.8-flash",
   "gemini-3.1-pro-low": "gemini-3.1-pro",
   "gemini-pro-agent": "gemini-3.1-pro",
 };
@@ -143,6 +159,9 @@ function collapsesIntoKnownPickerModel(candidateId: string): boolean {
 // Gemini models: effort → wire model suffix (official agy UI pattern).
 // Claude Opus: effort → thinkingConfig.thinkingLevel (CLIProxyAPI proven pattern).
 export const ANTIGRAVITY_MODEL_EFFORTS: Record<string, string[]> = {
+  // No `minimal`: Google documents it as an error for this generation, and CCA exposes only
+  // the three tiers.
+  "gemini-3.8-flash": ["low", "medium", "high"],
   "gemini-3.7-flash": ["low", "medium", "high"],
   "gemini-3.1-pro": ["low", "high"],
   "claude-sonnet-4-6": ["low", "medium", "high", "max"],
@@ -151,12 +170,32 @@ export const ANTIGRAVITY_MODEL_EFFORTS: Record<string, string[]> = {
 
 // ── Effort → wire model map for Gemini base models ──
 const ANTIGRAVITY_EFFORT_WIRE_MAP: Record<string, Record<string, string>> = {
+  // 3.8 publishes one wire id per tier and no `-tiered` row, so its efforts ride the suffix.
+  // This is the 3.6 shape, not the 3.7 one.
+  "gemini-3.8-flash": {
+    low: "gemini-3.8-flash-low",
+    medium: "gemini-3.8-flash-medium",
+    high: "gemini-3.8-flash-high",
+  },
   "gemini-3.1-pro": {
     low: "gemini-3.1-pro-low",
     high: "gemini-pro-agent",
   },
 };
 
+/**
+ * Base models whose every effort maps to a wire id that ALREADY encodes the tier.
+ *
+ * Sending `thinkingLevel` beside such a suffix states the effort twice, and CCA does not reject
+ * the contradiction — a `-low` wire id paired with `HIGH` returns 200, so the tier that actually
+ * ran becomes unknowable from the response. Membership also makes static resolution
+ * byte-identical to the discovery path, which never emits a thinking level.
+ *
+ * `gemini-3.1-pro` is deliberately absent: its `high` rung is `gemini-pro-agent`, which carries
+ * no tier suffix, so there the level is the only thing naming the effort.
+ */
+const ANTIGRAVITY_SUFFIX_TIER_MODELS = new Set(["gemini-3.8-flash"]);
+
 function completeDiscoveredEffortWireModelIds(
   pickerId: string,
   available: ReadonlyMap<string, Record<string, unknown>>,
@@ -178,6 +217,8 @@ function completeDiscoveredEffortWireModelIds(
 
 // ── Default effort per Gemini base model ──
 const ANTIGRAVITY_DEFAULT_EFFORT: Record<string, string> = {
+  // Google's documented thinking_level default, and the tier CCA marks `recommended`.
+  "gemini-3.8-flash": "medium",
   "gemini-3.1-pro": "high",
 };
 
@@ -198,7 +239,7 @@ const ANTIGRAVITY_THINKING_LEVELS = new Set(["low", "medium", "high"]);
  * Models not listed here use themselves as the wire ID.
  */
 const ANTIGRAVITY_PICKER_TO_WIRE: Record<string, string> = {
-  "gemini-3.7-flash": GEMINI_FLASH_WIRE_ID,
+  "gemini-3.7-flash": GEMINI_RETIRED_FLASH_TARGET_WIRE_ID,
 };
 
 /** Map a picker-visible base model to its CCA wire ID. Identity when no mapping exists. */
@@ -230,7 +271,7 @@ const ANTIGRAVITY_COMPATIBILITY_MODEL_ALIASES: Record<string, string> = {
   // because `parseAntigravityAvailableModels` uses THIS map to keep a stale CCA
   // payload from republishing a dead wire id as a picker row.
   ...Object.fromEntries(
-    Object.keys(RETIRED_FLASH_TIERS).map(retired => [retired, GEMINI_FLASH_WIRE_ID]),
+    Object.keys(RETIRED_FLASH_TIERS).map(retired => [retired, GEMINI_RETIRED_FLASH_TARGET_WIRE_ID]),
   ),
 };
 
@@ -242,6 +283,7 @@ export const ANTIGRAVITY_MODEL_ALIASES: Record<string, string> = {
 // Picker-visible: collapsed base models only.
 export const ANTIGRAVITY_MODELS = [
   GEMINI_FLASH_CURRENT,
+  GEMINI_FLASH_PREVIOUS,
   "gemini-3.1-pro",
   "gemini-3.1-flash-image",
   "claude-sonnet-4-6",
@@ -255,6 +297,9 @@ function isKnownAntigravityPickerModelId(value: string): boolean {
 
 // Context windows from the upstream `:fetchAvailableModels` maxTokens per model.
 const ANTIGRAVITY_WIRE_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
+  "gemini-3.8-flash-low": 1_048_576,
+  "gemini-3.8-flash-medium": 1_048_576,
+  "gemini-3.8-flash-high": 1_048_576,
   "gemini-3.7-flash-tiered": 1_048_576,
   "gemini-3.1-pro-low": 1_048_576,
   "gemini-pro-agent": 1_048_576,
@@ -266,6 +311,7 @@ const ANTIGRAVITY_WIRE_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
 
 export const ANTIGRAVITY_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
   // Collapsed base IDs — explicit entries for the picker.
+  "gemini-3.8-flash": 1_048_576,
   "gemini-3.7-flash": 1_048_576,
   "gemini-3.1-pro": 1_048_576,
   // Wire IDs and aliases via derivation.
@@ -283,6 +329,7 @@ export const ANTIGRAVITY_MODEL_INPUT_MODALITIES: Record<string, string[]> = {
   // carries only text and image parts (`OcxImageContent`, src/types.ts) and the Codex
   // catalog normalizes `input_modalities` against a closed enum. Advertising a modality
   // the wire cannot carry would be a promise we break at request time.
+  "gemini-3.8-flash": ["text", "image"],
   "gemini-3.7-flash": ["text", "image"],
   "gemini-3.1-pro": ["text", "image"],
   "gemini-3.1-flash-image": ["text", "image"],
@@ -609,13 +656,15 @@ export function resolveAntigravityEffortWireModel(
     };
   }
 
-  // Rule 0: retired Flash id — Google has taken the wire id offline, so route to the
-  // current generation and carry the tier the retired id encoded. This runs BEFORE the
-  // suffix check because those ids are aliases, and rule 1 would drop the tier.
+  // Rule 0: retired Flash id — Google has taken the wire id offline, so route to the 3.7
+  // redirect target and carry the tier the retired id encoded. (3.7, not "the current
+  // generation": 3.8 is current but these ids were retired onto 3.7, which is still served.)
+  // This runs BEFORE the suffix check because those ids are aliases, and rule 1 would drop
+  // the tier.
   const retiredTier = retiredAntigravityFlashTier(modelId);
   if (retiredTier) {
     return {
-      wireModelId: GEMINI_FLASH_WIRE_ID,
+      wireModelId: GEMINI_RETIRED_FLASH_TARGET_WIRE_ID,
       thinkingLevel: effort ? resolveAntigravityThinkingLevel(effort) ?? retiredTier : retiredTier,
     };
   }
@@ -638,8 +687,17 @@ export function resolveAntigravityEffortWireModel(
   // Rule 2/3: mapped Gemini base model.
   const effortMap = ANTIGRAVITY_EFFORT_WIRE_MAP[modelId];
   if (effortMap) {
-    if (effort && effort in effortMap) {
-      return { wireModelId: effortMap[effort]!, thinkingLevel: effort };
+    const suffixTiered = ANTIGRAVITY_SUFFIX_TIER_MODELS.has(modelId);
+    // Normalize FIRST for suffix-tiered models. The discovery path clamps max/xhigh/ultra to
+    // `high` before its own lookup, so a static path that skipped the clamp answered `medium`
+    // for the same request: one input, two tiers, decided by whether discovery happened to run.
+    const requested = suffixTiered && effort
+      ? resolveAntigravityThinkingLevel(effort) ?? effort
+      : effort;
+    if (requested && requested in effortMap) {
+      const wireModelId = effortMap[requested]!;
+      // The suffix already names the tier; see ANTIGRAVITY_SUFFIX_TIER_MODELS.
+      return suffixTiered ? { wireModelId } : { wireModelId, thinkingLevel: requested };
     }
     const defaultEffort = ANTIGRAVITY_DEFAULT_EFFORT[modelId]!;
     return { wireModelId: effortMap[defaultEffort]! };

package/src/providers/command-code-efforts.ts

@@ -103,6 +103,21 @@ const COMMAND_CODE_MODEL_EFFORTS = {
   // 2026-08-13: direct upstream POST with low/medium/high/xhigh/max all 200,
   // ultra 400; reasoningTokens differentiated 114..253; proxy previously stripped
   // the field so effort changes had no effect).
+  //
+  // 1.3 shipped 2026-09-02 as the same-shaped successor to 1.2 (Command Code
+  // publishes meta/muse-spark-1.3 and meta/muse-spark-1.3-contributor alongside
+  // the 1.2 pair, and Zen serves muse-spark-1.3-contributor over the same
+  // /responses wire). It carries the 1.2 ladder because it IS the 1.2 spec: the
+  // upstream ladder statement is per-family, and a narrower guess here would
+  // strip an effort the gateway accepts. Additive — 1.2 and 1.1 stay live.
+  "meta/muse-spark-1.3": {
+    efforts: ["low", "medium", "high", "xhigh", "max"],
+    profileUrl: "https://commandcode.ai/models/meta-muse-spark-1.3",
+  },
+  "meta/muse-spark-1.3-contributor": {
+    efforts: ["low", "medium", "high", "xhigh", "max"],
+    profileUrl: "https://commandcode.ai/models/meta-muse-spark-1.3-contributor",
+  },
   "meta/muse-spark-1.2": {
     efforts: ["low", "medium", "high", "xhigh", "max"],
     profileUrl: "https://commandcode.ai/models/meta-muse-spark-1.2",

package/src/providers/free-directory.ts

@@ -82,7 +82,10 @@ const CONNECTABLE: Record<string, ConnectableOverride> = {
   "cloudflare-ai": openAi("https://api.cloudflare.com/client/v4/accounts/{account_id}/ai/v1", "https://dash.cloudflare.com/?to=/:account/ai/workers-ai", { supportLevel: "supported", verification: "official", documentationUrl: "https://developers.cloudflare.com/workers-ai/configuration/open-ai-compatibility/", discovery: "static", liveModels: false, models: ["@cf/meta/llama-3.3-70b-instruct-fp8-fast", "@cf/qwen/qwq-32b"] }),
   cohere: openAi("https://api.cohere.com/compatibility/v1", "https://dashboard.cohere.com/api-keys", { supportLevel: "supported", verification: "official", documentationUrl: "https://docs.cohere.com/reference/list-models", modelsUrl: "https://api.cohere.com/compatibility/v1/models" }),
   friendliai: openAi("https://api.friendli.ai/serverless/v1", "https://suite.friendli.ai", { modelsUrl: "https://api.friendli.ai/serverless/v1/models" }),
-  gemini: { baseUrl: "https://generativelanguage.googleapis.com", dashboardUrl: "https://aistudio.google.com/apikey", adapter: "google", authKind: "key", supportLevel: "supported", verification: "official", documentationUrl: "https://ai.google.dev/api/models", lastVerified: LAST_VERIFIED, discovery: "live", liveModels: true, googleMode: "ai-studio", models: ["gemini-3.7-flash", "gemini-3.6-flash", "gemini-3.5-flash", "gemini-3.5-flash-lite", "gemini-3.1-pro-preview"] },
+  // `lastVerified` is row-specific here: the model list was re-checked against ai.google.dev
+  // on 2026-09-03 when 3.8 was added. Bumping the shared LAST_VERIFIED instead would stamp
+  // that date on every other provider row, none of which was re-checked.
+  gemini: { baseUrl: "https://generativelanguage.googleapis.com", dashboardUrl: "https://aistudio.google.com/apikey", adapter: "google", authKind: "key", supportLevel: "supported", verification: "official", documentationUrl: "https://ai.google.dev/api/models", lastVerified: "2026-09-03", discovery: "live", liveModels: true, googleMode: "ai-studio", models: ["gemini-3.8-flash", "gemini-3.7-flash", "gemini-3.6-flash", "gemini-3.5-flash", "gemini-3.5-flash-lite", "gemini-3.1-pro-preview"] },
   "github-models": openAi("https://models.github.ai/inference", "https://github.com/settings/tokens", { supportLevel: "supported", verification: "official", documentationUrl: "https://docs.github.com/en/github-models/prototyping-with-ai-models", discovery: "static", liveModels: false, models: ["openai/gpt-4.1", "meta/llama-4-scout-17b-16e-instruct"] }),
   groq: openAi("https://api.groq.com/openai/v1", "https://console.groq.com/keys", { supportLevel: "supported", verification: "official", documentationUrl: "https://console.groq.com/docs/api-reference#models" }),
   hackclub: openAi("https://ai.hackclub.com/proxy/v1", "https://ai.hackclub.com", { modelsUrl: "https://ai.hackclub.com/proxy/v1/models" }),