@bitkyc08/opencodex 2.40.0 → 2.42.0

package/src/codex/auth-api.ts

@@ -274,6 +274,69 @@ function quotaForPlan<T extends Omit<StoredAccountQuota, "updatedAt"> | StoredAc
   } as T;
 }
 
+/**
+ * Last reset-credit count this process parsed for the main account, tagged with the
+ * physical ChatGPT account it was read from.
+ *
+ * It is deliberately memory-only. The quota store is keyed by the stable `__main__`
+ * ALIAS, and `~/.codex/auth.json` can be swapped for another account while the proxy is
+ * not running — `reconcileMainCodexAccountRuntimeState` only purges alias-keyed state
+ * when it observes the id CHANGE, and its first observation after a restart has nothing
+ * to compare against. A disk-hydrated `__main__` entry can therefore belong to the
+ * previous login, so filling the DTO from it would show one account's tickets on
+ * another's card. Pool accounts have no such hole because their store key IS the account
+ * id. Binding the value to `requestAccountId` keeps the fill honest: after a restart the
+ * badge simply waits for the first usage response that carries the summary.
+ */
+let mainResetCreditsProvenance: { accountId: string; credits: number } | null = null;
+
+function rememberMainResetCredits(accountId: string | null, credits: number | undefined): void {
+  if (accountId === null || credits === undefined) return;
+  mainResetCreditsProvenance = { accountId, credits };
+}
+
+/** Forget the remembered count when the physical main identity is no longer the same. */
+function mainResetCreditsForCurrentIdentity(): number | undefined {
+  if (!mainResetCreditsProvenance) return undefined;
+  const currentAccountId = getMainChatgptAccountId();
+  if (currentAccountId === null) return undefined;
+  if (currentAccountId !== mainResetCreditsProvenance.accountId) {
+    mainResetCreditsProvenance = null;
+    return undefined;
+  }
+  return mainResetCreditsProvenance.credits;
+}
+
+/**
+ * The main account is the only account whose DTO quota comes from the raw WHAM parse
+ * result instead of the merged store: `poolAccountDto` serializes what
+ * `commitPoolQuotaResponse` read back out of `getAccountQuota()`, while the main DTO
+ * spreads `mainInfo.quota` directly. `/wham/usage` carries `rate_limit_reset_credits`
+ * only intermittently, and the store exists to bridge that gap
+ * (`setAccountQuotaFromParsed` carries an existing `resetCredits` forward when the new
+ * snapshot omits it), so the main card lost its ticket badge on every response that
+ * happened to omit the summary while pool cards kept theirs.
+ *
+ * Only `resetCredits` is carried, deliberately, and only from an identity-tagged
+ * in-process observation rather than the alias-keyed store. The window fields have
+ * *clearing* semantics — a monthly-only snapshot must drop a stale weekly value (#382) —
+ * so reinstating the whole stored object would resurrect a window the parse meant to
+ * clear whenever the store write was refused by generation gating. A freshly parsed value
+ * always wins, including `0`: zero is defined, so it never takes the fill branch.
+ */
+function mainQuotaWithCarriedResetCredits(
+  parsed: Omit<StoredAccountQuota, "updatedAt">,
+): StoredAccountQuota {
+  const carried = parsed.resetCredits === undefined
+    ? mainResetCreditsForCurrentIdentity()
+    : undefined;
+  return {
+    ...parsed,
+    ...(carried !== undefined ? { resetCredits: carried } : {}),
+    updatedAt: getAccountQuota(MAIN_CODEX_ACCOUNT_ID)?.updatedAt ?? Date.now(),
+  };
+}
+
 function poolAccountDto(
   account: CodexAccount,
   quotaResult: PoolQuotaResult,
@@ -836,6 +899,9 @@ async function fetchMainAccountInfoWhileOwned(
     const plan = nonEmptyPlan(data.plan_type) ?? nonEmptyPlan(cached?.plan) ?? nonEmptyPlan(getMainAccountPlan());
     const quota = parseUsageQuota({ ...data, ...(plan ? { plan_type: plan } : {}) });
     const freshResetCredits = quota?.resetCredits;
+    // Tag the count with the identity it was read from, so a later response that omits the
+    // summary can restore the badge without ever crossing an account boundary.
+    rememberMainResetCredits(requestAccountId, freshResetCredits);
     const result = {
       email: data.email ?? null,
       plan,
@@ -1640,10 +1706,7 @@ export async function listCodexAuthAccountsSnapshot(
     hasCredential: hasMainCredential,
     needsReauth: mainNeedsReauth,
     quota: mainInfo.quota ? {
-      ...quotaForPlan({
-        ...mainInfo.quota,
-        updatedAt: getAccountQuota(MAIN_CODEX_ACCOUNT_ID)?.updatedAt ?? Date.now(),
-      }, mainInfo.plan),
+      ...quotaForPlan(mainQuotaWithCarriedResetCredits(mainInfo.quota), mainInfo.plan),
     } : null,
     ...oauthAccountHealthFields("codex", MAIN_CODEX_ACCOUNT_ID, mainHealth),
   };
@@ -2167,7 +2230,15 @@ export async function handleCodexAuthAPI(
   }
 
   if (url.pathname === "/api/codex-auth/login" && req.method === "POST") {
-    const body = (await req.json().catch(() => ({}))) as { id?: string; reauth?: boolean; openBrowser?: unknown };
+    const body = (await req.json().catch(() => ({}))) as {
+      id?: string;
+      reauth?: boolean;
+      openBrowser?: unknown;
+      device?: unknown;
+    };
+    // Device mode: no local browser, no loopback listener. The only way to add
+    // an account to a headless hub (#3366).
+    const useDeviceFlow = body.device === true;
     const requestedAccountId = body.id?.trim();
     const reauth = body.reauth === true;
     if (requestedAccountId && !isValidCodexAccountId(requestedAccountId)) {
@@ -2197,13 +2268,20 @@ export async function handleCodexAuthAPI(
     codexAuthLoginState.set(flowId, loginOwner);
     try {
       const { startLoginFlow, getLoginStatus, publicOAuthAuthenticationErrorMessage } = await import("../oauth");
-      const result = await startLoginFlow("chatgpt", { forceLogin: true });
+      const result = await startLoginFlow("chatgpt", {
+        forceLogin: true,
+        ...(useDeviceFlow ? { flow: "device" as const } : {}),
+      });
 
       // Open the browser server-side (same pattern as /api/oauth/login in management-api.ts).
       // The GUI's window.open is popup-blocked because it runs after an await, not a direct click.
       // Both login routes share one resolver so this surface cannot drift from the other.
       const { shouldOpenBrowserForLogin } = await import("../oauth/open-browser-choice");
-      if (result.url && shouldOpenBrowserForLogin(body.openBrowser, runtimeConfig)) {
+      // A device flow's URL is a verification page the user opens on ANOTHER
+      // machine. Opening it on the hub host is useless at best, and on a
+      // headless host it fails. `deviceCode` is the same signal the generic
+      // OAuth login route uses to make this decision.
+      if (result.url && !result.deviceCode && shouldOpenBrowserForLogin(body.openBrowser, runtimeConfig)) {
         const { openUrl } = await import("../lib/open-url");
         openUrl(result.url);
       }
@@ -2211,7 +2289,14 @@ export async function handleCodexAuthAPI(
       (async () => {
         try {
           let completed = false;
-          for (let i = 0; i < 150; i++) {
+          // The device grant lives 15 minutes and the whole point is that the
+          // user walks to another device to enter the code. A 5-minute server
+          // budget would kill the flow at minute five while the grant is still
+          // valid. The extra 30 attempts past 450 are settlement margin: a user
+          // who authorizes in the final seconds still needs the token exchange
+          // and credential write to land before this loop gives up.
+          const pollAttempts = useDeviceFlow ? 480 : 150;
+          for (let i = 0; i < pollAttempts; i++) {
             await new Promise(r => setTimeout(r, 2000));
             const st = getLoginStatus("chatgpt");
             if (st.done && st.loggedIn) {
@@ -2437,7 +2522,15 @@ export async function handleCodexAuthAPI(
       })();
 
       setCodexLoginState(flowId, { status: "pending" });
-      return jsonResponse({ ok: true, flowId, url: result.url, instructions: result.instructions });
+      return jsonResponse({
+        ok: true,
+        flowId,
+        url: result.url,
+        instructions: result.instructions,
+        // Dropped before #3366: every device-code surface renders this field,
+        // so withholding it left the GUI and CLI with no code to show.
+        ...(result.deviceCode ? { deviceCode: result.deviceCode } : {}),
+      });
     } catch (e) {
       if (codexAuthLoginState.get(flowId) === loginOwner) codexAuthLoginState.delete(flowId);
       const msg = e instanceof Error ? e.message : String(e);

package/src/codex/catalog/aggregation.ts

@@ -162,6 +162,12 @@ export function deriveComboCatalogModel(
     contextWindow,
     ...members.map(member => member.maxInputTokens ?? member.contextWindow!),
   );
+  const knownMaxOutputTokens = members
+    .map(member => member.maxOutputTokens)
+    .filter((value): value is number => typeof value === "number" && value > 0);
+  const maxOutputTokens = knownMaxOutputTokens.length === members.length
+    ? Math.min(...knownMaxOutputTokens)
+    : undefined;
   const autoCompactTokenLimit = Math.min(
     ...members.map(member => clampAutoCompactTokenLimit(
       member.contextWindow!,
@@ -180,6 +186,7 @@ export function deriveComboCatalogModel(
     owned_by: COMBO_NAMESPACE,
     contextWindow,
     maxInputTokens,
+    ...(maxOutputTokens !== undefined ? { maxOutputTokens } : {}),
     autoCompactTokenLimit,
     ...(hasLimitingContextCapMetadata ? { contextCapped } : {}),
     inputModalities,
@@ -320,6 +327,7 @@ export function normalizedOpenAiApiSignature(model: CatalogModel): string {
     id: model.id,
     contextWindow: model.contextWindow ?? null,
     maxInputTokens: model.maxInputTokens ?? null,
+    maxOutputTokens: model.maxOutputTokens ?? null,
     autoCompactTokenLimit: model.autoCompactTokenLimit ?? null,
     inputModalities: [...new Set(model.inputModalities ?? [])].sort(),
     reasoningEfforts: [...new Set(model.reasoningEfforts ?? [])].sort(),

package/src/codex/catalog/effort.ts

@@ -35,7 +35,7 @@ import upstreamModelsSnapshot from "../data/upstream-models.json";
 import { generatedModelMetadata, readCatalog, readCodexCatalogPath } from "./parsing";
 import type { CatalogModel, RawEntry } from "./parsing";
 import { UPSTREAM_NATIVE_ENTRIES } from "./metadata";
-import { nativeOpenAiCapabilitySourceSlug } from "./native-models";
+import { nativeOpenAiCapabilitySourceSlug, SELF_DESCRIBED_NATIVE_OPENAI_MODELS } from "./native-models";
 import { loadBundledCodexCatalog } from "./bundled";
 import type { BundledCatalogDeps, ReadonlyRawCatalog } from "./bundled";
 import { deriveEntry } from "./sync";
@@ -258,8 +258,21 @@ export function applyReasoningLevels(
     : efforts.find(effort => effort !== "none" && effort !== "minimal") ?? efforts[0];
 }
 
+/**
+ * Native slugs entitled to the full GPT-5.6-era ladder (low..ultra, with max restored).
+ *
+ * The name is historical: membership is about the LADDER, not the model generation. `gpt-6-astra`
+ * qualifies because upstream ships it with the same six rungs
+ * (`supported_reasoning_levels` low/medium/high/xhigh/max/ultra, #42607). It used to qualify only
+ * as a side effect of borrowing Sol's capability source; once it became self-described that
+ * accident disappeared, and the sync path's else-branch
+ * (`applyReasoningLevels(entry, ["low","medium","high","xhigh"])`) would have truncated the
+ * shipped ladder, silently dropping `max` and `ultra`.
+ */
 export function isGpt56NativeSlug(slug: string): boolean {
-  return !slug.includes("/") && nativeOpenAiCapabilitySourceSlug(slug).startsWith("gpt-5.6-");
+  if (slug.includes("/")) return false;
+  if (SELF_DESCRIBED_NATIVE_OPENAI_MODELS.has(slug)) return true;
+  return nativeOpenAiCapabilitySourceSlug(slug).startsWith("gpt-5.6-");
 }
 
 export function ensureGpt56ReasoningLevels(entry: RawEntry): void {

package/src/codex/catalog/metadata.ts

@@ -41,10 +41,14 @@ import { CODEX_NATIVE_ALIAS_CATALOG_KIND } from "./kinds";
 import {
   ACCOUNT_GATED_NATIVE_OPENAI_MODELS,
   NATIVE_DAYBREAK_BLUE_MODEL,
+  NATIVE_GPT6_ASTRA_MODEL,
   NATIVE_OPENAI_CAPABILITY_ALIAS_MODELS,
   NATIVE_OPENAI_MODELS,
+  SELF_DESCRIBED_NATIVE_OPENAI_MODELS,
   SUPPORTED_NATIVE_OPENAI_SLUGS,
+  hasNativeOpenAiCapabilityMetadata,
   isNativeOpenAiCapabilityAliasModel,
+  nativeOpenAiAliasPresentation,
   nativeOpenAiCapabilitySourceSlug,
 } from "./native-models";
 import { cachedAvailableAccountGatedNativeModels } from "../model-entitlements";
@@ -52,16 +56,25 @@ import { MAIN_CODEX_ACCOUNT_ID } from "../main-account";
 export { CODEX_NATIVE_ALIAS_CATALOG_KIND } from "./kinds";
 export {
   NATIVE_DAYBREAK_BLUE_MODEL,
+  NATIVE_GPT6_ASTRA_MODEL,
   NATIVE_OPENAI_CAPABILITY_ALIAS_MODELS,
   NATIVE_OPENAI_MODELS,
+  SELF_DESCRIBED_NATIVE_OPENAI_MODELS,
   SUPPORTED_NATIVE_OPENAI_SLUGS,
+  hasNativeOpenAiCapabilityMetadata,
   isNativeOpenAiCapabilityAliasModel,
+  nativeOpenAiAliasPresentation,
   nativeOpenAiCapabilitySourceSlug,
 } from "./native-models";
 
 export const DOCUMENTED_NATIVE_OPENAI_ADDITIONS = [
   "gpt-5.3-codex-spark",
   "gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna",
+  // Preemptive leak-based registration: no shipped codex-rs catalog carries it, so without this
+  // entry an install WITH a live catalog would drop the row that native-models.ts deliberately
+  // ungated. Listing it here keeps the bare slug reachable so a request actually dispatches and
+  // reports the upstream status.
+  NATIVE_GPT6_ASTRA_MODEL,
 ];
 
 export function configuredNativeAliasSlugs(
@@ -161,6 +174,12 @@ export const NATIVE_OPENAI_CONTEXT_OVERRIDES: Record<string, { contextWindow?: n
   // ChatGPT account."`), so the promotion rests on a report from an account that has
   // access rather than on a probe. Treat it as the weaker evidence of the four.
   [NATIVE_DAYBREAK_BLUE_MODEL]: { contextWindow: NATIVE_GPT56_CONTEXT_WINDOW, maxContextWindow: NATIVE_GPT56_MAX_INPUT_TOKENS, maxInputTokens: NATIVE_GPT56_MAX_INPUT_TOKENS },
+  // gpt-6-astra ships its own numbers (upstream models.json, #42607): a 272,000 default window
+  // against an 872,000 ceiling. It is NOT in NATIVE_GPT56_FAMILY, so it must not inherit that
+  // family's measured 922,000 clamp — advertising 922,000 here over-stated the ceiling by 50k.
+  // maxInputTokens is clamped to the resolved window by nativeOpenAiMaxInputTokens, so this reads
+  // 272,000 by default and 872,000 only under the long-window opt-in.
+  [NATIVE_GPT6_ASTRA_MODEL]: { contextWindow: 272_000, maxContextWindow: 872_000, maxInputTokens: 872_000 },
 };
 
 const PINNED_UPSTREAM_MODELS: Map<string, RawEntry> = new Map(
@@ -246,13 +265,36 @@ export function nativeContextLimits(
 }
 
 /** Apply the user levers to an authoritative value. */
+/**
+ * The ceiling a native slug may be RAISED to by a user lever, or undefined when it has no
+ * separate long window.
+ *
+ * This is what makes the dashboard's 1M opt-in work: without an opt-in ceiling a lever can only
+ * ever narrow the advertised window, so the toggle would appear to do nothing. The GPT-5.6 family
+ * shares one measured ceiling; a self-described native carries its own in
+ * `NATIVE_OPENAI_CONTEXT_OVERRIDES.maxContextWindow` (`gpt-6-astra` ships 872,000 against a
+ * 272,000 default), and reading it per-slug is what keeps the toggle honest for a model whose
+ * ceiling is not the family's.
+ */
+function longWindowOptInCeiling(slug: string): number | undefined {
+  if (NATIVE_GPT56_FAMILY.has(slug)) return NATIVE_GPT56_MAX_INPUT_TOKENS;
+  const override = NATIVE_OPENAI_CONTEXT_OVERRIDES[slug];
+  const defaultWindow = positiveInt(override?.contextWindow);
+  const longWindow = positiveInt(override?.maxContextWindow);
+  if (defaultWindow === undefined || longWindow === undefined || longWindow <= defaultWindow) {
+    return undefined;
+  }
+  return longWindow;
+}
+
 function narrowToLimits(raw: number | undefined, slug: string, input: NativeContextLimitsInput): number | undefined {
   if (raw === undefined) return undefined;
   const limits = asLimits(input);
   const overlay = positiveInt(limits.modelWindows?.[slug]) ?? positiveInt(limits.providerWindow);
   const cap = positiveInt(limits.cap);
-  if (NATIVE_GPT56_FAMILY.has(slug)) {
-    const ceiling = NATIVE_GPT56_MAX_INPUT_TOKENS;
+  const optInCeiling = longWindowOptInCeiling(slug);
+  if (optInCeiling !== undefined) {
+    const ceiling = optInCeiling;
     const chosen = overlay ?? cap ?? raw;
     const window = Math.min(chosen, ceiling);
     return overlay !== undefined && cap !== undefined ? Math.min(window, cap) : window;
@@ -271,6 +313,11 @@ export function nativeOpenAiContextWindow(slug: string, limits?: NativeContextLi
   return narrowToLimits(raw, slug, limits);
 }
 
+export function nativeOpenAiMaxOutputTokens(slug: string): number | undefined {
+  const sourceSlug = nativeOpenAiCapabilitySourceSlug(slug);
+  return positiveInt(getModelMetadata("openai", sourceSlug)?.maxTokens);
+}
+
 /**
  * Long-context tier for a native slug as a (default, long) pair, for clients that let the user
  * pick a window per request (Cursor's local-agent "Context" selector). The pair is the family's
@@ -491,15 +538,23 @@ export function applyNativeVisibility(
 
 function upstreamNativeEntryForSlug(slug: string): RawEntry | undefined {
   const sourceSlug = nativeOpenAiCapabilitySourceSlug(slug);
-  if (!sourceSlug.startsWith("gpt-5.6-")) return undefined;
+  // A self-described native returns its OWN pinned row; the alias-cloning branch below stays
+  // reserved for slugs that genuinely borrow another model's identity. The allowlist is explicit
+  // rather than "has a pinned entry", which would also admit gpt-5.5/gpt-5.4/gpt-5.4-mini into
+  // the sync-replacement authority this map carries.
+  if (!sourceSlug.startsWith("gpt-5.6-") && !SELF_DESCRIBED_NATIVE_OPENAI_MODELS.has(slug)) {
+    return undefined;
+  }
   const source = PINNED_UPSTREAM_MODELS.get(sourceSlug);
   if (!source) return undefined;
-  if (slug === sourceSlug) return source;
+  if (slug === sourceSlug) return withDerivedBaseInstructions(source);
 
   const alias = structuredClone(source) as RawEntry;
   alias.slug = slug;
-  alias.display_name = "Daybreak Blue";
-  alias.description = "Frontier general-purpose model with safeguards for defensive cybersecurity work.";
+  const presentation = nativeOpenAiAliasPresentation(slug);
+  if (!presentation) return undefined; // an alias with no product identity must not ship a wrong one
+  alias.display_name = presentation.displayName;
+  alias.description = presentation.description;
   if (typeof alias.base_instructions === "string") {
     alias.base_instructions = identifyRoutedModel(alias.base_instructions, slug);
   }
@@ -516,6 +571,27 @@ function upstreamNativeEntryForSlug(slug: string): RawEntry | undefined {
   return alias;
 }
 
+/**
+ * Backfill `base_instructions` from `model_messages.instructions_template` when upstream ships
+ * only the latter.
+ *
+ * `gpt-6-astra` is the first pinned row to arrive without a top-level `base_instructions`; every
+ * other native carries both. That field is not decorative here — `hasNativeCatalogRowShape`,
+ * `findNativeTemplate` and `findSupportedNativeTemplate` all test for it, so a row missing it is
+ * not recognized as a native catalog row at all. The two fields hold the same prompt upstream, so
+ * deriving one from the other preserves upstream's content while keeping this codebase's row
+ * shape intact. The pinned JSON is left byte-identical to upstream; only the projection fills in.
+ */
+function withDerivedBaseInstructions(entry: RawEntry): RawEntry {
+  if (typeof entry.base_instructions === "string" && entry.base_instructions.length > 0) return entry;
+  const messages = entry.model_messages;
+  const template = messages && typeof messages === "object" && !Array.isArray(messages)
+    ? (messages as Record<string, unknown>).instructions_template
+    : undefined;
+  if (typeof template !== "string" || template.length === 0) return entry;
+  return { ...entry, base_instructions: template };
+}
+
 export const UPSTREAM_NATIVE_ENTRIES: Map<string, RawEntry> = new Map(
   [...NATIVE_OPENAI_MODELS, ...NATIVE_OPENAI_CAPABILITY_ALIAS_MODELS].flatMap(slug => {
     const entry = upstreamNativeEntryForSlug(slug);
@@ -531,10 +607,44 @@ export function upstreamNativeEntry(slug: string): RawEntry | null {
   return clone;
 }
 
+/**
+ * Product label for a native slug whose custom row inherits native metadata.
+ *
+ * An alias carries a hand-written presentation because upstream never described it. A
+ * self-described native gets its label from its own pinned row instead, so the two kinds answer
+ * through one accessor and no caller has to know which it holds.
+ */
+export function nativeOpenAiCapabilityDisplayName(slug: string): string | undefined {
+  const presentation = nativeOpenAiAliasPresentation(slug);
+  if (presentation) return presentation.displayName;
+  const pinned = UPSTREAM_NATIVE_ENTRIES.get(slug);
+  return typeof pinned?.display_name === "string" ? pinned.display_name : undefined;
+}
+
+/**
+ * Slugs whose persisted row may be replaced by the pinned snapshot even when it carries a real
+ * display name — because THIS codebase wrote that name from a guess.
+ *
+ * `shouldUpgradeToUpstreamEntry`'s normal rule ("upgrade only fallback-quality rows, where
+ * `display_name === slug`") assumes any row with a real label came from upstream and is therefore
+ * authoritative. That assumption broke for `gpt-6-astra`: opencodex shipped a speculative row with
+ * a hand-written "GPT-6 Astra" label and a provisional description while the slug was still a leak.
+ * Those rows are already on disk in every install that ran that release, and they look genuine, so
+ * without this list they would survive every future sync and permanently shadow the real shipped
+ * metadata — the wrong label, the wrong 922k ceiling, the wrong priority.
+ *
+ * Membership is a statement about opencodex's own history, not about upstream. Add a slug only
+ * when a released version of this project wrote a fabricated row for it.
+ */
+const SELF_AUTHORED_NATIVE_ROWS: ReadonlySet<string> = new Set([NATIVE_GPT6_ASTRA_MODEL]);
+
 export function shouldUpgradeToUpstreamEntry(entry: RawEntry): boolean {
-  return typeof entry.slug === "string"
-    && UPSTREAM_NATIVE_ENTRIES.has(entry.slug)
-    && entry.display_name === entry.slug;
+  if (typeof entry.slug !== "string" || !UPSTREAM_NATIVE_ENTRIES.has(entry.slug)) return false;
+  if (entry.display_name === entry.slug) return true;
+  // A row this project authored from a guess is not evidence of upstream truth, however genuine
+  // its display name looks. Replace it once, from the pin.
+  return SELF_AUTHORED_NATIVE_ROWS.has(entry.slug)
+    && entry.display_name !== UPSTREAM_NATIVE_ENTRIES.get(entry.slug)?.display_name;
 }
 
 export function nativeOpenAiSlugs(): string[] {

package/src/codex/catalog/native-models.ts

@@ -1,6 +1,32 @@
 /** ChatGPT/Codex wire id observed for the account-native Daybreak Blue surface. */
 export const NATIVE_DAYBREAK_BLUE_MODEL = "gpt-daybreak-blue-latest";
 
+/**
+ * Leaked Responses API identifier for the announced next-generation OpenAI model
+ * (2026-09-03: OpenAI teased the launch on X; community probes report `gpt-6-astra` returning
+ * the same 404 as other internal staging slugs where an arbitrary slug returns 400).
+ * Registered preemptively so an entitled account can route it the moment it ships, before any
+ * codex-rs catalog carries it. Unlike Daybreak it is NOT wire-normalized to a serving id —
+ * the leaked slug IS the wire id.
+ */
+/**
+ * SHIPPED as of 2026-09-03: openai/codex `ed391d4dd` (#42607, bundled model catalog) and
+ * `1f7b99922` (#42619, Amazon Bedrock catalogs). The registration is no longer speculative —
+ * `src/codex/data/upstream-models.json` now pins the real row, so this slug is SELF-DESCRIBED
+ * and must not borrow another model's capability metadata.
+ *
+ * Still NOT wire-normalized: unlike Daybreak the slug IS the wire id.
+ *
+ * Deliberately NOT account-gated (owner decision, 2026-09-04, reaffirmed during rollout).
+ * Upstream `available_in_plans` lists 23 plans including `free`, but the model is rolling out,
+ * so a given account's Codex surface may still answer
+ * `"The 'gpt-6-astra' model is not supported when using Codex with a ChatGPT account."`
+ * — the same refusal Daybreak returns. Gating on an entitlement roster would hide the row until
+ * that roster catches up; listing it means the request dispatches and the real upstream status
+ * is what the user sees. Evidence: devlog/_plan/260904_astra_release_alignment/021.
+ */
+export const NATIVE_GPT6_ASTRA_MODEL = "gpt-6-astra";
+
 /** Native ChatGPT/Codex ids whose availability is proven per authenticated account. */
 export const ACCOUNT_GATED_NATIVE_OPENAI_MODELS: ReadonlySet<string> = new Set([
   "gpt-5.6-sol",
@@ -25,6 +51,19 @@ const NATIVE_OPENAI_CAPABILITY_SOURCES: Readonly<Record<string, string>> = Objec
   [NATIVE_DAYBREAK_BLUE_MODEL]: "gpt-5.6-sol",
 });
 
+/**
+ * Native slugs that carry their OWN pinned upstream row rather than an alias's borrowed one.
+ *
+ * Membership authorizes `upstreamNativeEntryForSlug` to return the pinned entry directly. It is
+ * an explicit list, not a structural `PINNED_UPSTREAM_MODELS.has(slug)` predicate: the pin also
+ * holds `gpt-5.5`, `gpt-5.4` and `gpt-5.4-mini`, and admitting those into
+ * `UPSTREAM_NATIVE_ENTRIES` would newly authorize replacing their persisted catalog rows during
+ * sync — an invariant that map's own comment reserves for the GPT-5.6 family.
+ */
+export const SELF_DESCRIBED_NATIVE_OPENAI_MODELS: ReadonlySet<string> = new Set([
+  NATIVE_GPT6_ASTRA_MODEL,
+]);
+
 /**
  * Native ids whose capability metadata is inherited from another pinned native row.
  *
@@ -46,10 +85,41 @@ export function isNativeOpenAiCapabilityAliasModel(slug: string): boolean {
   return Object.hasOwn(NATIVE_OPENAI_CAPABILITY_SOURCES, slug);
 }
 
+/**
+ * Native slugs whose Codex-forward CUSTOM row inherits authoritative native metadata.
+ *
+ * Two shapes qualify and the distinction matters only to `upstreamNativeEntryForSlug`:
+ * a capability ALIAS borrows another model's pinned row, while a SELF-DESCRIBED native has its
+ * own. Every consumer that asks "does this custom row get real native capabilities and a real
+ * product label" wants both, which is why they call this rather than the alias check —
+ * `gpt-6-astra` stopped being an alias when its own row was pinned, and gating on
+ * `isNativeOpenAiCapabilityAliasModel` alone would have silently demoted it to a bare-slug label
+ * with no inherited ladder.
+ */
+export function hasNativeOpenAiCapabilityMetadata(slug: string): boolean {
+  return isNativeOpenAiCapabilityAliasModel(slug) || SELF_DESCRIBED_NATIVE_OPENAI_MODELS.has(slug);
+}
+
 export function nativeOpenAiCapabilitySourceSlug(slug: string): string {
   return NATIVE_OPENAI_CAPABILITY_SOURCES[slug] ?? slug;
 }
 
+/**
+ * Presentation identity per capability alias. Capability metadata (context, ladder, modalities)
+ * is inherited from the source model; the NAME and description are the alias's own product
+ * identity — hardcoding one alias's label would present every other alias as the wrong product.
+ */
+export const NATIVE_OPENAI_ALIAS_PRESENTATION: Readonly<Record<string, { displayName: string; description: string }>> = Object.freeze({
+  [NATIVE_DAYBREAK_BLUE_MODEL]: {
+    displayName: "Daybreak Blue",
+    description: "Frontier general-purpose model with safeguards for defensive cybersecurity work.",
+  },
+});
+
+export function nativeOpenAiAliasPresentation(slug: string): { displayName: string; description: string } | undefined {
+  return NATIVE_OPENAI_ALIAS_PRESENTATION[slug];
+}
+
 /**
  * Native OpenAI model ids that this release can route and restore with authoritative metadata.
  *
@@ -70,6 +140,7 @@ export const NATIVE_OPENAI_MODELS = [
   "gpt-5.5", "gpt-5.4", "gpt-5.4-mini", "gpt-5.3-codex-spark",
   "gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna",
   NATIVE_DAYBREAK_BLUE_MODEL,
+  NATIVE_GPT6_ASTRA_MODEL,
 ];
 
 export const SUPPORTED_NATIVE_OPENAI_SLUGS = new Set(NATIVE_OPENAI_MODELS);

package/src/codex/catalog/parsing.ts

@@ -31,7 +31,7 @@ import { redactSecretString } from "../../lib/redact";
 import upstreamModelsSnapshot from "../data/upstream-models.json";
 
 
-import { NATIVE_OPENAI_CONTEXT_OVERRIDES, SUPPORTED_NATIVE_OPENAI_SLUGS, UPSTREAM_NATIVE_ENTRIES, isNativeOpenAiCapabilityAliasModel, nativeMultiAgentVersion, nativeOpenAiAutoCompactTokenLimit, nativeOpenAiContextWindow, nativeOpenAiMaxInputTokens, type NativeContextLimitsInput } from "./metadata";
+import { NATIVE_OPENAI_CONTEXT_OVERRIDES, SUPPORTED_NATIVE_OPENAI_SLUGS, UPSTREAM_NATIVE_ENTRIES, hasNativeOpenAiCapabilityMetadata, nativeMultiAgentVersion, nativeOpenAiAutoCompactTokenLimit, nativeOpenAiContextWindow, nativeOpenAiMaxInputTokens, type NativeContextLimitsInput } from "./metadata";
 import { clampAutoCompactTokenLimit } from "../../providers/auto-compact-budget";
 import { trustedAccountBoundNativeCatalogSlug } from "./account-models";
 import { CODEX_NATIVE_ALIAS_CATALOG_KIND } from "./kinds";
@@ -112,6 +112,8 @@ export interface CatalogModel {
   defaultReasoningEffort?: string;
   contextWindow?: number;
   maxInputTokens?: number;
+  /** Model-scoped output-token ceiling; omitted when no authoritative value is known. */
+  maxOutputTokens?: number;
   /** Soft client compaction threshold; hard context/input limits remain authoritative. */
   autoCompactTokenLimit?: number;
   contextCap?: number;
@@ -524,7 +526,7 @@ export function catalogEntryIsNativeChatGpt(entry: RawEntry): boolean {
   if (
     entry.opencodex_catalog_kind === CODEX_CUSTOM_MODEL_CATALOG_KIND
     && entry.use_responses_lite === true
-    && isNativeOpenAiCapabilityAliasModel(routedNativeSlug)
+    && hasNativeOpenAiCapabilityMetadata(routedNativeSlug)
   ) return true;
   if (UPSTREAM_NATIVE_ENTRIES.has(slug) || SUPPORTED_NATIVE_OPENAI_SLUGS.has(slug)) return true;
   return false;
@@ -582,7 +584,7 @@ export function applyMultiAgentMode(
         : "";
       const codexForwardCapabilityAlias = entry.opencodex_catalog_kind === CODEX_CUSTOM_MODEL_CATALOG_KIND
         && entry.use_responses_lite === true
-        && isNativeOpenAiCapabilityAliasModel(routedNativeSlug)
+        && hasNativeOpenAiCapabilityMetadata(routedNativeSlug)
         ? routedNativeSlug
         : undefined;
       const upstreamPin = nativeAlias