@bitkyc08/opencodex 2.42.0 → 2.43.0

package/src/codex/catalog/metadata.ts

@@ -38,10 +38,12 @@ import type { RawEntry } from "./parsing";
 import { readCurrentCatalogOrCache, readCurrentCodexCatalog, readCurrentCodexModelsCache, unique } from "./bundled";
 import { trustedAccountBoundNativeCatalogSlug, visibleCodexAccountSelectors } from "./account-models";
 import { CODEX_NATIVE_ALIAS_CATALOG_KIND } from "./kinds";
+import { RESERVE_METADATA_SOURCE_FIELD } from "./reserve";
 import {
   ACCOUNT_GATED_NATIVE_OPENAI_MODELS,
   NATIVE_DAYBREAK_BLUE_MODEL,
   NATIVE_GPT6_ASTRA_MODEL,
+  NATIVE_RESERVE_MODEL,
   NATIVE_OPENAI_CAPABILITY_ALIAS_MODELS,
   NATIVE_OPENAI_MODELS,
   SELF_DESCRIBED_NATIVE_OPENAI_MODELS,
@@ -70,10 +72,7 @@ export {
 export const DOCUMENTED_NATIVE_OPENAI_ADDITIONS = [
   "gpt-5.3-codex-spark",
   "gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna",
-  // Preemptive leak-based registration: no shipped codex-rs catalog carries it, so without this
-  // entry an install WITH a live catalog would drop the row that native-models.ts deliberately
-  // ungated. Listing it here keeps the bare slug reachable so a request actually dispatches and
-  // reports the upstream status.
+  // The shipped pin also backfills older installed Codex catalogs that predate Astra.
   NATIVE_GPT6_ASTRA_MODEL,
 ];
 
@@ -671,7 +670,7 @@ function isAccountBoundOpenAiNativeSlug(slug: string): boolean {
  * malformed and minimal hand-written rows. It cannot distinguish a genuine upstream observation
  * from a complete row typed by hand into `$CODEX_HOME/models_cache.json`: there is no signature,
  * source identity, or server attestation to check. A full-shape forged row is accepted, and
- * `observedFullShapeRowIsAccepted` in tests/native-model-toggle.test.ts pins that so nobody
+ * `observedFullShapeRowIsAccepted` in tests/codex-integration/native-model-toggle.test.ts pins that so nobody
  * later mistakes this predicate for a security boundary.
  *
  * That is acceptable here because the file is user-owned and written by Codex itself: anyone
@@ -700,14 +699,44 @@ function observedAccountBoundNativeSlug(entry: RawEntry): string | undefined {
   const accountBound = trustedAccountBoundNativeCatalogSlug(entry);
   const slug = accountBound ?? (typeof entry.slug === "string" ? entry.slug : "");
   if (!isAccountBoundOpenAiNativeSlug(slug)
-    || entry.supported_in_api !== true
+    || (entry.supported_in_api !== true && !(slug === NATIVE_RESERVE_MODEL && entry.supported_in_api === false))
+    || (slug === NATIVE_RESERVE_MODEL && entry[RESERVE_METADATA_SOURCE_FIELD] !== undefined
+      && entry[RESERVE_METADATA_SOURCE_FIELD] !== NATIVE_RESERVE_MODEL)
     || !hasNativeCatalogRowShape(entry)
-    || (entry.visibility !== "list" && entry[ACCOUNT_BOUND_OBSERVED_NATIVE_MARKER] !== true)) {
+    || (entry.visibility !== "list" && entry[ACCOUNT_BOUND_OBSERVED_NATIVE_MARKER] !== true
+      && !(slug === NATIVE_RESERVE_MODEL && entry.visibility === "hide"))) {
     return undefined;
   }
   return slug;
 }
 
+/** Prefer a genuine bare observation; an adapted OCX row must never become native evidence. */
+export function observedReserveCatalogSource(
+  entries: readonly RawEntry[],
+  mainSelectors: readonly string[],
+): RawEntry | null {
+  const actual = entries.filter(entry => observedAccountBoundNativeSlug(entry) === NATIVE_RESERVE_MODEL);
+  const bare = actual.find(entry => entry.slug === NATIVE_RESERVE_MODEL);
+  const qualified = actual.find(entry => entry[RESERVE_METADATA_SOURCE_FIELD] === NATIVE_RESERVE_MODEL
+    && typeof entry.slug === "string"
+    && mainSelectors.includes(entry.slug.slice(0, entry.slug.indexOf("/"))));
+  const selected = bare ?? qualified;
+  if (!selected) return null;
+  const source = structuredClone(selected);
+  if (!bare) {
+    const prefix = `${String(source.slug).split("/")[0]} / `;
+    if (typeof source.display_name === "string" && source.display_name.startsWith(prefix)) {
+      source.display_name = source.display_name.slice(prefix.length);
+    }
+  }
+  source.slug = NATIVE_RESERVE_MODEL;
+  delete source.opencodex_catalog_kind;
+  delete source[RESERVE_METADATA_SOURCE_FIELD];
+  delete source[ACCOUNT_BOUND_OBSERVED_NATIVE_MARKER];
+  delete source[ACCOUNT_BOUND_OBSERVED_SELECTORS_MARKER];
+  return source;
+}
+
 /**
  * Return exact, previously observed account-native rows that are not in the static release set.
  * The result is used only to carry a hidden observation across startup cache invalidation.
@@ -748,7 +777,8 @@ export function accountBoundNativeOpenAiSlugs(
 ): string[] {
   const observed = observedEntries.flatMap(entry => {
     const slug = observedAccountBoundNativeSlug(entry);
-    return slug === undefined ? [] : [slug];
+    // Reserve belongs only to the Codex-specific opt-in builder, not generic native exports.
+    return slug === undefined || slug === NATIVE_RESERVE_MODEL ? [] : [slug];
   });
   return unique([...NATIVE_OPENAI_MODELS, ...observed]);
 }
@@ -775,7 +805,7 @@ export function accountBoundNativeOpenAiSlugsBySelector(
   );
   for (const entry of observedEntries) {
     const slug = observedAccountBoundNativeSlug(entry);
-    if (slug === undefined || SUPPORTED_NATIVE_OPENAI_SLUGS.has(slug)) continue;
+    if (slug === undefined || slug === NATIVE_RESERVE_MODEL || SUPPORTED_NATIVE_OPENAI_SLUGS.has(slug)) continue;
     const generated = trustedAccountBoundNativeCatalogSlug(entry);
     const generatedSelector = generated === undefined || typeof entry.slug !== "string"
       ? undefined

package/src/codex/catalog/native-models.ts

@@ -1,14 +1,9 @@
+/** Reserve wire identity, not a globally available native catalog registration. */
+export const NATIVE_RESERVE_MODEL = "gpt-reserve";
+
 /** ChatGPT/Codex wire id observed for the account-native Daybreak Blue surface. */
 export const NATIVE_DAYBREAK_BLUE_MODEL = "gpt-daybreak-blue-latest";
 
-/**
- * Leaked Responses API identifier for the announced next-generation OpenAI model
- * (2026-09-03: OpenAI teased the launch on X; community probes report `gpt-6-astra` returning
- * the same 404 as other internal staging slugs where an arbitrary slug returns 400).
- * Registered preemptively so an entitled account can route it the moment it ships, before any
- * codex-rs catalog carries it. Unlike Daybreak it is NOT wire-normalized to a serving id —
- * the leaked slug IS the wire id.
- */
 /**
  * SHIPPED as of 2026-09-03: openai/codex `ed391d4dd` (#42607, bundled model catalog) and
  * `1f7b99922` (#42619, Amazon Bedrock catalogs). The registration is no longer speculative —
@@ -27,11 +22,32 @@ export const NATIVE_DAYBREAK_BLUE_MODEL = "gpt-daybreak-blue-latest";
  */
 export const NATIVE_GPT6_ASTRA_MODEL = "gpt-6-astra";
 
-/** Native ChatGPT/Codex ids whose availability is proven per authenticated account. */
+/**
+ * Native ChatGPT/Codex ids whose availability is proven per authenticated account.
+ *
+ * Membership is expensive: it hides the row from the catalog, `/v1/models`, the dashboard and
+ * the desktop projection until an authenticated `/models` roster confirms it, AND it makes
+ * `auth-context.ts` refuse the request before it is sent. Both halves fail closed on ABSENCE of
+ * evidence, not on a denial.
+ *
+ * The flagship models are deliberately NOT here (owner decision, 2026-09-04). #3442 made
+ * discovery ask upstream under an adequate client version, which guarantees the QUESTION is
+ * fair but cannot guarantee an ANSWER: an unconfirmed account, a timed-out fetch, or a shard
+ * that has not caught up all produce the same silent disappearance, and a model vanishing from
+ * the picker reads as "opencodex lost my model" rather than "upstream did not confirm it".
+ * Listing them unconditionally means the request dispatches and the user sees the real upstream
+ * status. `disabledModels` remains the visibility lever.
+ *
+ * The cost, accepted knowingly: Pool routing no longer prefers an account that owns the model,
+ * so a multi-account user may take one upstream 400 and one alternate retry where they used to
+ * be routed straight to the owner. Nothing unsafe — each account still sends its own credential
+ * — and `gpt-6-astra` has shipped this way since 6f634eddc.
+ *
+ * `gpt-daybreak-blue-latest` stays gated. It has no shipped catalog row anywhere, so absence is
+ * the only signal that exists for it, and the ungating decision was scoped to the flagships.
+ * Evidence: devlog/_plan/260904_flagship_native_always_visible/.
+ */
 export const ACCOUNT_GATED_NATIVE_OPENAI_MODELS: ReadonlySet<string> = new Set([
-  "gpt-5.6-sol",
-  "gpt-5.6-terra",
-  "gpt-5.6-luna",
   NATIVE_DAYBREAK_BLUE_MODEL,
 ]);
 
@@ -144,3 +160,28 @@ export const NATIVE_OPENAI_MODELS = [
 ];
 
 export const SUPPORTED_NATIVE_OPENAI_SLUGS = new Set(NATIVE_OPENAI_MODELS);
+
+/**
+ * Natives that retain the physical main account as a read-free sentinel during a native-main
+ * drain, instead of reading as unavailable and letting the subagent fallback chain advance.
+ *
+ * This used to be spelled `ACCOUNT_GATED_NATIVE_OPENAI_MODELS`, which was never what it meant:
+ * the sentinel protects the atomic main claim so a routed fallback cannot bypass it, and that
+ * has nothing to do with entitlement. The two sets were identical in practice, so the accident
+ * went unnoticed until the flagships were ungated (2026-09-04) and the predicate would have
+ * flipped false — letting a drain silently rewrite the operator's configured subagent model.
+ *
+ * It is an explicit list rather than `SUPPORTED_NATIVE_OPENAI_SLUGS`, which would have widened
+ * the sentinel to `gpt-5.5`, `gpt-5.4`, `gpt-5.4-mini` and `gpt-5.3-codex-spark` as well. Those
+ * models were never covered, and widening would turn "fell back and answered" into a
+ * maintenance error for the most commonly configured fallback slug in the repo. Membership is
+ * the set the drain behaviour was actually reasoned about: the account-gated natives plus the
+ * flagships that just left that set.
+ */
+export const NATIVE_MAIN_DRAIN_SENTINEL_MODELS: ReadonlySet<string> = new Set([
+  ...ACCOUNT_GATED_NATIVE_OPENAI_MODELS,
+  "gpt-5.6-sol",
+  "gpt-5.6-terra",
+  "gpt-5.6-luna",
+  NATIVE_GPT6_ASTRA_MODEL,
+]);

package/src/codex/catalog/parsing.ts

@@ -2,7 +2,7 @@ import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { copyFileSync, existsSync, mkdirSync, readFileSync, realpathSync } from "node:fs";
 import { delimiter, dirname, join, resolve } from "node:path";
-import { atomicWriteFile, expandUserPath, getConfigDir, websocketsEnabled } from "../../config";
+import { atomicWriteFile, expandUserPath, getConfigDir, loadConfig, ultraFastTierEnabled, websocketsEnabled } from "../../config";
 import { CODEX_CONFIG_PATH, CODEX_MODELS_CACHE_PATH, DEFAULT_CATALOG_PATH, readRootTomlString, resolveCodexConfigPath } from "../paths";
 import { clearModelCache, DEFAULT_MODEL_CACHE_TTL_MS, getFreshCached, getStaleCached, isModelsFetchCoolingDown, markModelsFetchFailure, setCached } from "../model-cache";
 import { buildModelsRequest, resolveModelsAuthToken } from "../../oauth";
@@ -35,6 +35,7 @@ import { NATIVE_OPENAI_CONTEXT_OVERRIDES, SUPPORTED_NATIVE_OPENAI_SLUGS, UPSTREA
 import { clampAutoCompactTokenLimit } from "../../providers/auto-compact-budget";
 import { trustedAccountBoundNativeCatalogSlug } from "./account-models";
 import { CODEX_NATIVE_ALIAS_CATALOG_KIND } from "./kinds";
+import { NATIVE_GPT6_ASTRA_MODEL } from "./native-models";
 
 export function legacyCatalogBackupPath(): string {
   return join(getConfigDir(), "catalog-backup.json");
@@ -95,6 +96,8 @@ export const CODEX_PROVIDER_MODEL_CATALOG_KIND = "provider-model-v1";
 export interface CatalogModel {
   id: string;
   provider: string;
+  /** Canonical or configured short alias for the provider segment. */
+  providerAlias?: string | null;
   /** Public Codex-facing slug override (used by combo aliases). */
   alias?: string;
   /** Explicit combo takeover of a bare OpenAI-native catalog id. */
@@ -303,7 +306,98 @@ const NO_FAST_TIER_NATIVE_SLUGS = new Set([
   "gpt-5.3-codex-spark",
 ]);
 
+/** Does this row already carry an `ultrafast` tier the operator put there themselves? */
+/**
+ * Read the opt-in from the live config, ONCE per catalog build.
+ *
+ * `deriveEntry` and its call sites are pure `RawEntry -> RawEntry` transforms with no
+ * config parameter, so the flag is resolved here rather than threaded through all of them.
+ * It is memoized because `normalizeRoutedCatalogEntry` runs per entry in a sync loop, and
+ * `loadConfig()` chmods the config dir, hardens three secrets, reads the file and runs a
+ * full Zod parse — doing that once per catalog row would be a real cost for one boolean.
+ * Callers holding a config still pass `opts.ultraFastTier` explicitly, which bypasses this
+ * entirely and is what the tests do. A read failure means OFF, matching `.catch(false)`.
+ */
+let ultraFastOptInCache: { value: boolean; at: number } | null = null;
+const ULTRA_FAST_OPT_IN_TTL_MS = 5_000;
+
+function ultraFastTierOptIn(): boolean {
+  const now = Date.now();
+  if (ultraFastOptInCache && now - ultraFastOptInCache.at < ULTRA_FAST_OPT_IN_TTL_MS) {
+    return ultraFastOptInCache.value;
+  }
+  let value = false;
+  try {
+    value = ultraFastTierEnabled(loadConfig());
+  } catch {
+    value = false;
+  }
+  ultraFastOptInCache = { value, at: now };
+  return value;
+}
+
+/** Test seam: drop the memoized opt-in so a config change is observed immediately. */
+export function resetUltraFastTierOptInCache(): void {
+  ultraFastOptInCache = null;
+}
+
+function entryDeclaresUltraFast(entry: RawEntry): boolean {
+  const tiers = entry.service_tiers;
+  const declaredInTiers = Array.isArray(tiers) && tiers.some(tier => (
+    !!tier && typeof tier === "object" && "id" in tier
+    && String((tier as { id?: unknown }).id).trim().toLowerCase() === "ultrafast"
+  ));
+  const speeds = entry.additional_speed_tiers;
+  const declaredInSpeeds = Array.isArray(speeds) && speeds.some(speed => (
+    typeof speed === "string" && speed.trim().toLowerCase() === "ultrafast"
+  ));
+  return declaredInTiers || declaredInSpeeds;
+}
+
+/**
+ * Keep the operator's `ultrafast` and drop everything else.
+ *
+ * A routed row must not inherit the native template's `priority` tier, which is the whole
+ * reason this strip exists. Preserving the supplied tier without this narrowing would
+ * smuggle Fast onto third-party providers under an unrelated flag.
+ */
+function retainOnlyUltraFastTier(entry: RawEntry): void {
+  const tiers = entry.service_tiers;
+  const keptTiers = Array.isArray(tiers)
+    ? tiers.filter(tier => (
+      !!tier && typeof tier === "object" && "id" in tier
+      && String((tier as { id?: unknown }).id).trim().toLowerCase() === "ultrafast"
+    ))
+    : [];
+  if (keptTiers.length > 0) entry.service_tiers = keptTiers;
+  else delete entry.service_tiers;
+
+  const speeds = entry.additional_speed_tiers;
+  const keptSpeeds = Array.isArray(speeds)
+    ? speeds.filter(speed => typeof speed === "string" && speed.trim().toLowerCase() === "ultrafast")
+    : [];
+  if (keptSpeeds.length > 0) entry.additional_speed_tiers = keptSpeeds;
+  else delete entry.additional_speed_tiers;
+
+  // A default of `priority` on a row that now only offers ultrafast would name a tier the
+  // row no longer carries.
+  if (String(entry.service_tier ?? "").trim().toLowerCase() !== "ultrafast") delete entry.service_tier;
+  if (String(entry.default_service_tier ?? "").trim().toLowerCase() !== "ultrafast") {
+    delete entry.default_service_tier;
+  }
+}
+
 export function normalizeServiceTiers(entry: RawEntry): RawEntry {
+  // Repair only the old built-in Astra speed copy on persisted native/account rows.
+  // A custom description (and every other field) remains user-owned.
+  const nativeSlug = trustedAccountBoundNativeCatalogSlug(entry) ?? entry.slug;
+  if (nativeSlug === NATIVE_GPT6_ASTRA_MODEL && Array.isArray(entry.service_tiers)) {
+    entry.service_tiers = entry.service_tiers.map(tier =>
+      tier && typeof tier === "object" && tier.id === "priority"
+        && tier.description === "1.5x speed, increased usage"
+        ? { ...tier, description: "2x speed, increased usage" } : tier,
+    );
+  }
   // Strip service tiers for models that do not actually support the Fast tier.
   if (typeof entry.slug === "string" && NO_FAST_TIER_NATIVE_SLUGS.has(entry.slug)) {
     delete entry.service_tier;
@@ -502,6 +596,8 @@ export function ensureStrictCatalogFields(
 export type MultiAgentMode = "v1" | "default" | "v2";
 
 export interface MultiAgentModeOptions {
+  /** Caller-owned source metadata already defines the default for these projected rows. */
+  preserveDefaultMultiAgentVersion?: (entry: RawEntry) => boolean;
   /**
    * When the catalog is in v2 mode, stamp ChatGPT-native rows as v1 instead.
    * Routed parents get v2 (plaintext child tasks). Native Sol/Terra stay on v1
@@ -577,6 +673,7 @@ export function applyMultiAgentMode(
     // Restore upstream defaults: clear any stale forced multi_agent_version and
     // re-apply upstream pins from the snapshot for native entries that have one.
     for (const entry of entries) {
+      if (options.preserveDefaultMultiAgentVersion?.(entry)) continue;
       const slug = typeof entry.slug === "string" ? entry.slug : "";
       const nativeAlias = entry.opencodex_catalog_kind === CODEX_NATIVE_ALIAS_CATALOG_KIND;
       const routedNativeSlug = slug.startsWith(`${OPENAI_CODEX_PROVIDER_ID}/`)
@@ -612,17 +709,34 @@ export function normalizeRoutedCatalogEntry(
   entry: RawEntry,
   parallelToolCalls = false,
   toolMode?: "code_mode_only" | "shell" | string,
+  opts?: { ultraFastTier?: boolean },
 ): RawEntry {
   delete entry.model_messages;
   delete entry.tool_mode;
   applyRoutedCodexToolMode(entry, toolMode);
   delete entry.multi_agent_version;
+  delete entry.multi_agent_reasoning_effort;
   delete entry.use_responses_lite;
   delete entry.supports_websockets;
-  delete entry.additional_speed_tiers;
-  delete entry.service_tier;
-  delete entry.service_tiers;
-  delete entry.default_service_tier;
+  /*
+   * Tier metadata is stripped from routed rows because a row cloned from a native template
+   * would otherwise hand a third-party provider OpenAI's tiers.
+   *
+   * The opt-in carves out exactly one case: an `ultrafast` the OPERATOR put in their own
+   * catalog. #3429's reporter added it by hand and watched a regeneration delete it every
+   * time. Preserving what they wrote is not the same as advertising a tier — upstream
+   * publishes only `priority`, and synthesizing an ultrafast row is what PR #2994 was
+   * closed for. So this keeps a supplied tier and still never invents one.
+   */
+  const keepUltraFast = (opts?.ultraFastTier ?? ultraFastTierOptIn()) && entryDeclaresUltraFast(entry);
+  if (!keepUltraFast) {
+    delete entry.additional_speed_tiers;
+    delete entry.service_tier;
+    delete entry.service_tiers;
+    delete entry.default_service_tier;
+  } else {
+    retainOnlyUltraFastTier(entry);
+  }
   // Routed rows cloned from native templates must not inherit OpenAI-only summary delivery.
   // Explicit provider/model metadata is re-applied after this normalization step.
   delete entry.supports_reasoning_summaries;