@bitkyc08/opencodex 2.62.0-preview.20260923 → 2.63.0-preview.20260923

package/src/adapters/devin/live-models.ts

@@ -21,6 +21,9 @@ export const DEVIN_STATIC_MODELS = [
   "gpt-5-6-sol",
   "gpt-5-6-luna",
   "gpt-5-6-terra",
+  // 260923 preemptive: GPT-6 Sol and Luna (OpenAI announced 2026-09-22) added ahead of this provider's own catalog; mirrors the GPT-5.6 Sol/Luna rows.
+  "gpt-6-sol",
+  "gpt-6-luna",
   "claude-opus-4-8",
   "claude-fable-5-1",
   "claude-sonnet-5",
@@ -55,7 +58,11 @@ export const DEVIN_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
   "gpt-5-6-luna": 1_000_000,
   "gpt-5-6-terra": 1_000_000,
   "gpt-6-astra": 1_000_000,
+  "gpt-6-sol": 1_000_000,
+  "gpt-6-luna": 1_000_000,
   "claude-opus-4-8": 1_000_000,
+  // 260923: read from the live catalog (devin/claude-opus-5-5 context_length 1_000_000).
+  "claude-opus-5-5": 1_000_000,
   "claude-opus-5": 1_000_000,
   "claude-fable-5-1": 1_000_000,
   "claude-sonnet-5": 1_000_000,

package/src/adapters/devin.ts

@@ -612,7 +612,7 @@ export function createDevinAdapter(
       // The signed-in account's tenant decides the host, not the static registry
       // entry: an EU or FedStart account that used provider.baseUrl would send
       // every RPC to the US server it is not provisioned on.
-      const host = resolveDevinApiServer(provider.baseUrl, credentialProviderId);
+      const host = resolveDevinApiServer(provider.baseUrl, credentialProviderId, apiKey);
       // One catalog read per turn serves model-UID resolution, the input
       // ceiling, and the chat pre-flight inside streamChatEvents. Failures are
       // not cached, so a second read would only pay another fetch timeout on
@@ -642,10 +642,11 @@ export function createDevinAdapter(
         const maxOutputTokens = resolveDevinMaxOutputTokens(
           provider, modelUid, parsed.options.maxOutputTokens,
         );
-        // The reset-retry wrapper waits out a 429 that states its own recovery
-        // delay ("limit will reset in 35 seconds") and replays the identical
-        // request — but only while zero events have been yielded, so a
-        // post-output failure still takes the terminal path untouched.
+        // An admitted HTTP turn owns globally shared capacity until this call
+        // emits. Never retain that capacity while waiting out a provider 429:
+        // preserve the typed reset delay in generated diagnostic wording,
+        // never the raw trailer text that may reflect a credential. The
+        // refusal returns immediately so the caller can release its slot.
         for await (const event of streamChatEventsWithResetRetry({
           apiKey,
           apiServerUrl: host,
@@ -664,6 +665,7 @@ export function createDevinAdapter(
           },
           signal: incoming.abortSignal,
         }, {
+          maxWaitMs: 0,
           execution: {
             executor: incoming.providerFetch,
             sendBudget: incoming.sendBudget,

package/src/adapters/kiro/reasoning.ts

@@ -23,7 +23,12 @@ export const KIRO_NATIVE_EFFORT_FIELDS: Record<string, "reasoning" | "output_con
   "gpt-5.6-sol": "reasoning",
   "gpt-5.6-terra": "reasoning",
   "gpt-5.6-luna": "reasoning",
+  // 260923 preemptive (see kiro-models.ts): same native field as the GPT-5.6 family.
+  "gpt-6-sol": "reasoning",
+  "gpt-6-luna": "reasoning",
   "claude-opus-5": "output_config",
+  // 260923 preemptive (see kiro-models.ts): same Claude-specific field as Opus 5.
+  "claude-opus-5.5": "output_config",
 };
 
 export const KIRO_NATIVE_EFFORTS = ["low", "medium", "high", "xhigh", "max"];

package/src/adapters/openai-responses/passthrough.ts

@@ -329,11 +329,11 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
       outBody = stripUnsupportedReasoningSummaryDelivery(outBody, parsed.modelId);
       // #4587: on a bridged provider, hand the destination back the search call and result the
       // proxy executed on its behalf, in place of the hosted cell the caller replays. Scoped to
-      // this destination and recorded by the bridge itself, so a provider without the opt-in
-      // computes no identity and keeps the body reference it already had. This runs before the
-      // query backfill below because a restored cell is no longer a web_search_call to repair.
+      // its exact conversation and serving identity and recorded by the bridge itself, so a
+      // provider without the opt-in computes no identity and keeps the body reference it already
+      // had. This runs before query backfill because a restored cell is no longer one to repair.
       if (provider.webSearchBridge?.enabled === true) {
-        outBody = restoreBridgedWebSearchCalls(outBody, bridgeSearchReplayScope(provider.baseUrl));
+        outBody = restoreBridgedWebSearchCalls(outBody, bridgeSearchReplayScope(parsed._reasoningReplayScope));
       }
       // Repair stored history from before the bridge emitted both keys, in either
       // direction: a conversation that already recorded a web_search_call replays it

package/src/adapters/openai-responses/tool-output-recovery.ts

@@ -289,9 +289,11 @@ export function backfillWebSearchQueries(body: unknown): unknown {
  *   - It never restores a call id the body already carries. If the history somehow holds that
  *     `function_call` too, emitting a second one would be a duplicate the upstream must reject.
  *
- * Entries are scoped to the upstream destination, so a history replayed against a different
- * provider cannot resurrect a call that provider never made. Callers pass `undefined` for any
- * provider without the bridge armed, and the common path then returns the original reference.
+ * Entries are scoped to the caller principal, conversation and exact serving identity, so a
+ * history replayed by another caller or against a different provider, model, destination or
+ * credential cannot resurrect a call that pairing never made. Callers pass `undefined` for any
+ * provider without the bridge armed and for a caller with no principal, and the common path then
+ * returns the original reference.
  */
 export function restoreBridgedWebSearchCalls(body: unknown, destinationScope: string | undefined): unknown {
   if (destinationScope === undefined) return body;

package/src/claude/desktop-gateway-state.ts

@@ -1,4 +1,4 @@
-import { mutatePersistedConfig } from "../config";
+import { adoptPersistedClaudeCode, mutatePersistedConfig } from "../config";
 import type { OcxConfig } from "../types";
 import { emptyDesktopProfile, type DesktopProfile } from "./desktop-profile";
 
@@ -30,9 +30,14 @@ export function persistCommittedDesktopGateway(
   try {
     const outcome = mutatePersistedConfig(current => {
       recordCommittedDesktopGateway(current, profile, fingerprint, appliedAt);
-      return { changed: true, value: true };
+      return { changed: true, value: structuredClone(current.claudeCode) };
     });
     if (outcome.status === "unavailable") return { ok: false, reason: outcome.reason };
+    adoptPersistedClaudeCode(snapshot, outcome.value);
+    // The mode/profile pair IS the committed transaction, not mergeable state.
+    // Without an armed baseline the three-way adopt cannot prove the live leaves
+    // unchanged and keeps a stale live desktopMode over the bytes just saved, so
+    // pin both leaves to the committed subtree after the disjoint-leaf merge.
     recordCommittedDesktopGateway(snapshot, profile, fingerprint, appliedAt);
     return { ok: true };
   } catch {

package/src/claude/desktop-policy.ts

@@ -1,5 +1,5 @@
 /** Read-only, privacy-safe Windows policy diagnosis for Claude Desktop 3P. */
-import { spawnSync } from "node:child_process";
+import { execFile, spawnSync } from "node:child_process";
 import { win32 } from "node:path";
 import { resolveTrustedWindowsSystemDirectory } from "../lib/windows-elevation";
 import { decodeWindowsTextBytes } from "../lib/windows-text";
@@ -23,6 +23,11 @@ export type ClaudeDesktopPolicyProbeRunner = (
   args: readonly string[],
 ) => ClaudeDesktopPolicyProbeResult;
 
+export type ClaudeDesktopPolicyAsyncProbeRunner = (
+  file: string,
+  args: readonly string[],
+) => Promise<ClaudeDesktopPolicyProbeResult>;
+
 export interface ClaudeDesktopPolicyProbeOptions {
   readonly platform?: NodeJS.Platform;
   readonly run?: ClaudeDesktopPolicyProbeRunner;
@@ -54,6 +59,38 @@ const defaultPolicyProbeRunner: ClaudeDesktopPolicyProbeRunner = (file, args) =>
   };
 };
 
+/**
+ * Translates an `execFile` callback into the probe contract. Exit codes arrive
+ * as numeric `error.code`; spawn failures carry a string errno; a timeout kill
+ * surfaces as `killed`/`SIGTERM` rather than `ETIMEDOUT`. A killed child is a
+ * TIMEOUT, never a spawn failure — the process started fine and ran out of time,
+ * so `spawnFailed` stays false or diagnostics conflate "did not start" with
+ * "ran too long".
+ */
+export function classifyExecFileProbeResult(
+  error: (Error & { readonly code?: number | string; readonly killed?: boolean }) | null,
+  stdout: Uint8Array | undefined,
+): ClaudeDesktopPolicyProbeResult {
+  const errorCode = error?.code;
+  return {
+    status: error === null ? 0 : typeof errorCode === "number" ? errorCode : null,
+    stdout: stdout === undefined ? "" : decodeWindowsTextBytes(stdout),
+    timedOut: errorCode === "ETIMEDOUT" || error?.killed === true,
+    spawnFailed: error !== null && error.killed !== true && typeof errorCode !== "number" && errorCode !== "ETIMEDOUT",
+  };
+}
+
+const defaultAsyncPolicyProbeRunner: ClaudeDesktopPolicyAsyncProbeRunner = (file, args) => new Promise((resolve) => {
+  execFile(file, [...args], {
+    encoding: "buffer",
+    maxBuffer: 64 * 1024,
+    timeout: POLICY_PROBE_TIMEOUT_MS,
+    windowsHide: true,
+  }, (error, stdout) => {
+    resolve(classifyExecFileProbeResult(error, stdout));
+  });
+});
+
 function usable(result: ClaudeDesktopPolicyProbeResult): boolean {
   return !result.timedOut && !result.spawnFailed && result.status !== null;
 }
@@ -108,6 +145,73 @@ export function probeClaudeDesktopPolicy(
   return parentListsPolicyKey(parent.stdout) ? "unknown" : "absent";
 }
 
+/** Non-blocking variant for the long-lived server request path. */
+export async function probeClaudeDesktopPolicyAsync(
+  options: Omit<ClaudeDesktopPolicyProbeOptions, "run"> & { readonly run?: ClaudeDesktopPolicyAsyncProbeRunner } = {},
+): Promise<ClaudeDesktopPolicyState> {
+  const platform = options.platform ?? process.platform;
+  if (platform !== "win32") return "not_applicable";
+
+  let regExe: string;
+  try {
+    const systemDirectory = (options.resolveSystemDirectory ?? resolveTrustedWindowsSystemDirectory)();
+    regExe = win32.join(systemDirectory, "reg.exe");
+  } catch {
+    return "unknown";
+  }
+
+  const run = options.run ?? defaultAsyncPolicyProbeRunner;
+  try {
+    const policy = await run(regExe, ["query", CLAUDE_POLICY_KEY, "/reg:64"]);
+    if (!usable(policy)) return "unknown";
+    if (policy.status === 0) return "present";
+    if (policy.status !== 1) return "unknown";
+
+    const parent = await run(regExe, ["query", CLAUDE_POLICY_PARENT_KEY, "/reg:64"]);
+    if (!usable(parent) || parent.status !== 0) return "unknown";
+    return parentListsPolicyKey(parent.stdout) ? "unknown" : "absent";
+  } catch {
+    return "unknown";
+  }
+}
+
+const POLICY_CACHE_TTL_MS = 30_000;
+
+export function createCachedClaudeDesktopPolicyProbe(
+  probe: () => Promise<ClaudeDesktopPolicyState>,
+  ttlMs = POLICY_CACHE_TTL_MS,
+  now = performance.now,
+): () => Promise<ClaudeDesktopPolicyState> {
+  let cached: { state: ClaudeDesktopPolicyState; expiresAt: number } | undefined;
+  let refresh: Promise<ClaudeDesktopPolicyState> | undefined;
+  return () => {
+    const currentTime = now();
+    if (cached && cached.expiresAt > currentTime) return Promise.resolve(cached.state);
+    if (refresh) return refresh;
+    refresh = probe().then((state) => {
+      cached = { state, expiresAt: now() + ttlMs };
+      return state;
+    }).finally(() => {
+      refresh = undefined;
+    });
+    return refresh;
+  };
+}
+
+const cachedProductionProbe = createCachedClaudeDesktopPolicyProbe(
+  () => probeClaudeDesktopPolicyAsync(),
+);
+
+/** Coalesces status polling and bounds registry refreshes to one per cache interval. */
+export function getCachedClaudeDesktopPolicy(
+  options: Omit<ClaudeDesktopPolicyProbeOptions, "run"> = {},
+): Promise<ClaudeDesktopPolicyState> {
+  const cacheable = options.resolveSystemDirectory === undefined
+    && (options.platform === undefined || options.platform === process.platform);
+  if (cacheable) return cachedProductionProbe();
+  return probeClaudeDesktopPolicyAsync(options);
+}
+
 /** State-only health projection shared by CLI, apply, and management status. */
 export function claudeDesktopPolicyHealth(
   state: ClaudeDesktopPolicyState,

package/src/cli/config-command.ts

@@ -5,6 +5,7 @@ import { VISION_REASONING_EFFORTS, isVisionReasoningEffort } from "../reasoning-
 import type { OcxConfig } from "../types";
 import { normalizeVisionReasoningForModel } from "../vision/reasoning";
 import type { ServiceApiTokenState } from "../lib/service-secrets";
+import { redactUrlForLog } from "../lib/redact";
 import { CliUsageError, printData, rejectArgs, runCliAction, takeFlag } from "./runtime-api";
 
 const USAGE = `Usage:
@@ -17,12 +18,13 @@ const USAGE = `Usage:
   ocx config import <path|-> --yes [--json]`;
 
 /**
- * Keys whose VALUE is a credential and must never be printed or exported.
+ * Keys whose VALUE is a credential and must never be printed by display commands.
+ * `config export` writes the raw config so an export can restore credentials; it does
+ * not call `redact`.
  *
- * `webhookUrl` is here because for Slack and Discord the URL itself is the authorization:
- * anyone holding it can post to the channel. It looks like configuration rather than a secret,
- * which is exactly why it needs to be named explicitly — none of the other patterns match it,
- * so `ocx config show` printed it and `config export` wrote it to disk in the clear.
+ * URL-valued credentials must be named explicitly: `webhookUrl` matches none of the
+ * other patterns, and a proxy URL's userinfo is handled by the `proxy` branch in
+ * `redact` rather than by masking the whole value.
  */
 const SECRET_KEYS = /^(apiKey|key|accessToken|refreshToken|idToken|token|password|clientSecret|webhookUrl)$/i;
 const BLOCKED_SEGMENTS = new Set(["__proto__", "prototype", "constructor"]);
@@ -97,6 +99,19 @@ async function readRemoteHubConfigNote(config: OcxConfig): Promise<ReturnType<ty
 }
 
 function redact(value: unknown, key = ""): unknown {
+  if (key === "proxy" && typeof value === "string") {
+    // "direct" and credential-less proxy URLs carry no secret and stay readable; only a
+    // URL with userinfo is masked, and then only its credentials — host and port stay
+    // visible so the output still says WHERE traffic goes. A non-URL value that is not
+    // "direct" cannot be proven credential-free, so it is masked whole.
+    if (!value || value === "direct") return value;
+    try {
+      const parsed = new URL(value);
+      return parsed.username || parsed.password ? redactUrlForLog(value) : value;
+    } catch {
+      return "********";
+    }
+  }
   if (SECRET_KEYS.test(key) && typeof value === "string") return value ? "********" : value;
   // `client.priorCatalog` is the base64 catalog snapshot connect took before overwriting the
   // local one — up to 64 MB of it (src/config.ts). Printed in full it buried `runtimeRole` and
@@ -211,7 +226,7 @@ export async function handleConfigCommand(argv: string[]): Promise<number> {
       const path = args.shift();
       if (!path) throw new CliUsageError("config path is required", USAGE);
       rejectArgs(args, USAGE);
-      const value = redact(getPath(readConfigDiagnostics().config, path), path.split(".").at(-1));
+      const value = redact(getPath(readConfigDiagnostics().config, path), pathSegments(path).at(-1));
       if (wantsJson || typeof value === "object") console.log(JSON.stringify(value, null, 2));
       else console.log(String(value));
       return;
@@ -257,7 +272,7 @@ export async function handleConfigCommand(argv: string[]): Promise<number> {
           ? "config changed while applying this update; retry"
           : `config is ${outcome.reason}`);
       }
-      printData({ ok: true, path, value: redact(savedValue, path.split(".").at(-1)) }, wantsJson,
+      printData({ ok: true, path, value: redact(savedValue, pathSegments(path).at(-1)) }, wantsJson,
         [`${action === "unset" ? "Unset" : "Set"} ${path}.`]);
       return;
     }

package/src/cli/doctor.ts

@@ -14,6 +14,7 @@ import { getConfigDir, getConfigPath, readConfigDiagnostics } from "../config";
 import { readPid } from "../config/process-state";
 import { probeUncleanExitState } from "./status";
 import { findLiveProxy, probeHostname, type LiveProxy } from "../server/proxy-liveness";
+import { directLocalHttpFetch } from "../server/direct-local-http";
 import { BUN_RUNTIME_SOURCES } from "../lib/bun-runtime";
 import type { BunRuntimeSource } from "../lib/bun-runtime";
 import { maskAccountId } from "../lib/privacy";
@@ -1073,12 +1074,15 @@ export interface DefaultModelExposure {
 
 /** Exactly the catalog's own `RawEntry` shape, so an on-disk row needs no conversion. */
 type CatalogVisibilityRow = Record<string, unknown>;
+type ExposedModelsFetch = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+const EXPOSED_MODELS_MAX_ROWS = 10_000;
+const EXPOSED_MODEL_ID_MAX_LENGTH = 1_024;
 
 export interface DefaultModelExposureDeps {
   readConfiguredModelFn?: () => string | null;
   /** The live proxy doctor already resolved, or null/absent when none is running. */
   live?: LiveProxy | null;
-  fetchFn?: typeof fetch;
+  fetchFn?: ExposedModelsFetch;
   readCatalogModelsFn?: () => readonly CatalogVisibilityRow[] | null;
 }
 
@@ -1091,18 +1095,24 @@ export interface DefaultModelExposureDeps {
  * data-plane admission on a non-loopback bind (`isApiAuthRequired`), and doctor deliberately
  * holds no data-plane key, so a remote-bound proxy always falls through to the catalog.
  */
-async function fetchExposedModelIds(live: LiveProxy, fetchFn: typeof fetch): Promise<Set<string> | null> {
+async function fetchExposedModelIds(live: LiveProxy, fetchFn: ExposedModelsFetch): Promise<Set<string> | null> {
   try {
+    // directLocalHttpFetch never follows redirects and aborts past its byte cap, so the
+    // unbounded-body and redirect cases are covered below the JSON parse, not by options here.
     const res = await fetchFn(`http://${probeHostname(live.hostname)}:${live.port}/v1/models`, {
       signal: AbortSignal.timeout(EXPOSED_MODELS_TIMEOUT_MS),
     });
     if (!res.ok) return null;
     const body = await res.json() as { data?: unknown };
     if (!Array.isArray(body?.data)) return null;
+    if (body.data.length > EXPOSED_MODELS_MAX_ROWS) return null;
     const ids = new Set<string>();
     for (const row of body.data) {
       const id = (row as { id?: unknown } | null)?.id;
-      if (typeof id === "string" && id.length > 0) ids.add(id);
+      if (typeof id !== "string") return null;
+      if (id.length === 0) continue;
+      if (id.length > EXPOSED_MODEL_ID_MAX_LENGTH) return null;
+      ids.add(id);
     }
     return ids;
   } catch {
@@ -1158,7 +1168,7 @@ export async function collectDefaultModelExposure(
   }
 
   const live = deps.live ?? null;
-  const proxyIds = live ? await fetchExposedModelIds(live, deps.fetchFn ?? fetch) : null;
+  const proxyIds = live ? await fetchExposedModelIds(live, deps.fetchFn ?? directLocalHttpFetch) : null;
   const catalogIds = catalogExposedModelIds((deps.readCatalogModelsFn ?? defaultCatalogModels)());
   if (proxyIds === null && catalogIds === null) {
     return {

package/src/codex/catalog/effort.ts

@@ -277,11 +277,38 @@ export function applyReasoningLevels(
  * accident disappeared, and the sync path's else-branch
  * (`applyReasoningLevels(entry, ["low","medium","high","xhigh"])`) would have truncated the
  * shipped ladder, silently dropping `max` and `ultra`.
+ *
+ * Membership means "new-ladder native: keep the pinned ladder, never synthesize old-ladder top
+ * rungs" — NOT "advertise ultra". Returning false for a self-described row would be worse, not
+ * safer: every false branch (`finishUpstreamNativeEntry`, the persisted-row path in
+ * build-entries) calls `ensureUltraReasoningLevel`, which would hand `ultra` to `gpt-6-luna`.
+ * Whether `ultra` is added is decided separately by `nativeLadderIncludesUltra`.
+ *
+ * A capability alias of a self-described row qualifies through its source (`gpt-6-astra-minor`
+ * borrows `gpt-6-astra`), the same way Daybreak Blue qualifies through `gpt-5.6-sol`.
  */
 export function isGpt56NativeSlug(slug: string): boolean {
   if (slug.includes("/")) return false;
-  if (SELF_DESCRIBED_NATIVE_OPENAI_MODELS.has(slug)) return true;
-  return nativeOpenAiCapabilitySourceSlug(slug).startsWith("gpt-5.6-");
+  const sourceSlug = nativeOpenAiCapabilitySourceSlug(slug);
+  if (SELF_DESCRIBED_NATIVE_OPENAI_MODELS.has(sourceSlug)) return true;
+  return sourceSlug.startsWith("gpt-5.6-");
+}
+
+/**
+ * Whether a new-ladder native may advertise `ultra`.
+ *
+ * GPT-5.6 keeps its historical behaviour (always advertised; the wire clamp maps it down). A
+ * self-described GPT-6 row answers from its OWN pinned ladder, or its source's for an alias:
+ * the 2026-09-23 roster probe (`/backend-api/codex/models?client_version=0.155.0`) ships
+ * `gpt-6-sol` with low..ultra but `gpt-6-luna` with low..max, and advertising a rung upstream
+ * never listed would let a subagent spawn request an effort the model does not have.
+ */
+export function nativeLadderIncludesUltra(slug: string): boolean {
+  const sourceSlug = nativeOpenAiCapabilitySourceSlug(slug);
+  if (!SELF_DESCRIBED_NATIVE_OPENAI_MODELS.has(sourceSlug)) return true;
+  const levels = UPSTREAM_NATIVE_ENTRIES.get(sourceSlug)?.supported_reasoning_levels;
+  return Array.isArray(levels)
+    && (levels as Array<{ effort?: string }>).some(level => level?.effort === "ultra");
 }
 
 export function ensureGpt56ReasoningLevels(entry: RawEntry): void {
@@ -289,8 +316,12 @@ export function ensureGpt56ReasoningLevels(entry: RawEntry): void {
     ? entry.supported_reasoning_levels as Array<Partial<CodexReasoningLevel>>
     : [];
   const out = [...levels];
-  // max is a real native rung on the 5.6 family — always restored; ultra always advertised.
-  for (const effort of ["max", "ultra"]) {
+  // max is a real native rung on the 5.6 family — always restored. ultra is advertised unless
+  // the slug's pinned ladder (or its source's) stops short of it, as gpt-6-luna's does.
+  const wanted = typeof entry.slug === "string" && !nativeLadderIncludesUltra(entry.slug)
+    ? ["max"]
+    : ["max", "ultra"];
+  for (const effort of wanted) {
     if (out.some(level => level.effort === effort)) continue;
     out.push(CODEX_REASONING_LEVELS.find(level => level.effort === effort)
       ?? { effort, description: `${effort} reasoning` });

package/src/codex/catalog/metadata.ts

@@ -31,7 +31,7 @@ import {
 import type { NormalizedComboConfig } from "../../combos/types";
 import { providerDestinationResolvedError } from "../../lib/destination-policy";
 import { redactSecretString } from "../../lib/redact";
-import upstreamModelsSnapshot from "../data/upstream-models.json";
+import { pinnedNativeModelRows } from "./pinned-models";
 
 
 import type { RawEntry } from "./parsing";
@@ -42,7 +42,10 @@ import { RESERVE_METADATA_SOURCE_FIELD } from "./reserve";
 import {
   ACCOUNT_GATED_NATIVE_OPENAI_MODELS,
   NATIVE_DAYBREAK_BLUE_MODEL,
+  NATIVE_GPT6_ASTRA_MINOR_MODEL,
   NATIVE_GPT6_ASTRA_MODEL,
+  NATIVE_GPT6_LUNA_MODEL,
+  NATIVE_GPT6_SOL_MODEL,
   NATIVE_RESERVE_MODEL,
   NATIVE_OPENAI_CAPABILITY_ALIAS_MODELS,
   NATIVE_OPENAI_MODELS,
@@ -59,7 +62,10 @@ import { MAIN_CODEX_ACCOUNT_ID } from "../main-account";
 export { CODEX_NATIVE_ALIAS_CATALOG_KIND } from "./kinds";
 export {
   NATIVE_DAYBREAK_BLUE_MODEL,
+  NATIVE_GPT6_ASTRA_MINOR_MODEL,
   NATIVE_GPT6_ASTRA_MODEL,
+  NATIVE_GPT6_LUNA_MODEL,
+  NATIVE_GPT6_SOL_MODEL,
   NATIVE_OPENAI_CAPABILITY_ALIAS_MODELS,
   NATIVE_OPENAI_MODELS,
   SELF_DESCRIBED_NATIVE_OPENAI_MODELS,
@@ -75,6 +81,10 @@ export const DOCUMENTED_NATIVE_OPENAI_ADDITIONS = [
   "gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna",
   // The shipped pin also backfills older installed Codex catalogs that predate Astra.
   NATIVE_GPT6_ASTRA_MODEL,
+  // Same backfill for Sol and Luna from the roster pin: the live roster serves them only to
+  // client_version >= 0.155.0, so an installed catalog built by an older client lacks them.
+  // Astra Minor is deliberately absent: it is gated, and nativeOpenAiSlugs() would drop it anyway.
+  NATIVE_GPT6_SOL_MODEL, NATIVE_GPT6_LUNA_MODEL,
 ];
 
 export function configuredNativeAliasSlugs(
@@ -177,11 +187,24 @@ export const NATIVE_OPENAI_CONTEXT_OVERRIDES: Record<string, { contextWindow?: n
   // maxInputTokens is clamped to the resolved window by nativeOpenAiMaxInputTokens, so this reads
   // 272,000 by default and 872,000 only under the long-window opt-in.
   [NATIVE_GPT6_ASTRA_MODEL]: { contextWindow: 272_000, maxContextWindow: 872_000, maxInputTokens: 872_000 },
+  // Sol and Luna ship the same 272,000 / 872,000 pair in their roster rows (probe of
+  // /backend-api/codex/models?client_version=0.155.0, 2026-09-23). Unmeasured here, so they take
+  // the row's own ceiling rather than the GPT-5.6 family's measured 922,000.
+  [NATIVE_GPT6_SOL_MODEL]: { contextWindow: 272_000, maxContextWindow: 872_000, maxInputTokens: 872_000 },
+  [NATIVE_GPT6_LUNA_MODEL]: { contextWindow: 272_000, maxContextWindow: 872_000, maxInputTokens: 872_000 },
+  // Astra Minor borrows Astra's row, so it inherits Astra's numbers. No account we hold can reach
+  // it, so this is inheritance, not a measurement.
+  [NATIVE_GPT6_ASTRA_MINOR_MODEL]: { contextWindow: 272_000, maxContextWindow: 872_000, maxInputTokens: 872_000 },
 };
 
+// Snapshot rows plus roster-captured rows the snapshot lacks (see pinned-models.ts).
 const PINNED_UPSTREAM_MODELS: Map<string, RawEntry> = new Map(
-  ((upstreamModelsSnapshot as unknown as { models?: RawEntry[] }).models ?? [])
-    .flatMap(model => typeof model.slug === "string" ? [[model.slug, model] as const] : []),
+  (pinnedNativeModelRows() as unknown as ReadonlyArray<RawEntry>)
+    // Upstream stopped shipping top-level `base_instructions` (openai/codex #43604); every row
+    // still carries `model_messages.instructions_template`. Derive at projection time so the
+    // pinned JSON stays byte-identical to upstream while `hasNativeCatalogRowShape` and the alias
+    // rewrite in `upstreamNativeEntryForSlug` keep seeing the field they test for.
+    .flatMap(model => typeof model.slug === "string" ? [[model.slug, withDerivedBaseInstructions(model)] as const] : []),
 );
 
 function pinnedNativeCapabilityEntry(slug: string): RawEntry | undefined {
@@ -536,14 +559,19 @@ function upstreamNativeEntryForSlug(slug: string): RawEntry | undefined {
   // reserved for slugs that genuinely borrow another model's identity. The allowlist is explicit
   // rather than "has a pinned entry", which would also admit gpt-5.5/gpt-5.2/codex-auto-review into
   // the sync-replacement authority this map carries.
-  if (!sourceSlug.startsWith("gpt-5.6-") && !SELF_DESCRIBED_NATIVE_OPENAI_MODELS.has(slug)) {
+  // Keyed on the SOURCE so an alias of a self-described row (gpt-6-astra-minor -> gpt-6-astra)
+  // is admitted the same way an alias of a GPT-5.6 row (Daybreak -> Sol) always was; for a
+  // self-described slug itself the source is the slug, so nothing else changes.
+  if (!sourceSlug.startsWith("gpt-5.6-") && !SELF_DESCRIBED_NATIVE_OPENAI_MODELS.has(sourceSlug)) {
     return undefined;
   }
   const source = PINNED_UPSTREAM_MODELS.get(sourceSlug);
   if (!source) return undefined;
   if (slug === sourceSlug) return withDerivedBaseInstructions(source);
 
-  const alias = structuredClone(source) as RawEntry;
+  // Derive before cloning: Astra ships only model_messages, and an alias row without
+  // base_instructions fails the native row-shape checks just as its source would.
+  const alias = structuredClone(withDerivedBaseInstructions(source)) as RawEntry;
   alias.slug = slug;
   const presentation = nativeOpenAiAliasPresentation(slug);
   if (!presentation) return undefined; // an alias with no product identity must not ship a wrong one

package/src/codex/catalog/native-models.ts

@@ -22,6 +22,32 @@ export const NATIVE_DAYBREAK_BLUE_MODEL = "gpt-daybreak-blue-latest";
  */
 export const NATIVE_GPT6_ASTRA_MODEL = "gpt-6-astra";
 
+/**
+ * GPT-6 Sol and Luna, announced 2026-09-22 (https://openai.com/index/introducing-gpt-6-sol-and-luna/).
+ *
+ * SELF-DESCRIBED: the authenticated roster probe on 2026-09-23
+ * (`/backend-api/codex/models?client_version=0.155.0`, main account) returned a full row for each,
+ * pinned verbatim in `src/codex/data/roster-pinned-models.json` because codex-rs has not bundled
+ * them yet. Sol ships low..ultra; Luna ships low..max and must not be widened to ultra.
+ *
+ * Not account-gated, for the same owner decision that ungated `gpt-6-astra`: the rows list 24
+ * plans, and hiding a flagship until a roster confirms it reads as opencodex losing the model.
+ * Listing them means the request dispatches and the user sees the real upstream status.
+ */
+export const NATIVE_GPT6_SOL_MODEL = "gpt-6-sol";
+export const NATIVE_GPT6_LUNA_MODEL = "gpt-6-luna";
+
+/**
+ * Unreleased GPT-6 Astra variant. No public row exists anywhere — neither the codex-rs bundle nor
+ * the 2026-09-23 main-account roster probe carries it — so it is ACCOUNT-GATED: hidden and
+ * request-refused until an authenticated `/models` roster lists it for that account. Absence is
+ * the only signal that exists for it, which is exactly the Daybreak Blue situation.
+ *
+ * Capability metadata is borrowed from `gpt-6-astra` (a capability alias); presentation is its
+ * own. No minimum client version is recorded for it: none has been measured.
+ */
+export const NATIVE_GPT6_ASTRA_MINOR_MODEL = "gpt-6-astra-minor";
+
 /**
  * Native ChatGPT/Codex ids whose availability is proven per authenticated account.
  *
@@ -49,6 +75,8 @@ export const NATIVE_GPT6_ASTRA_MODEL = "gpt-6-astra";
  */
 export const ACCOUNT_GATED_NATIVE_OPENAI_MODELS: ReadonlySet<string> = new Set([
   NATIVE_DAYBREAK_BLUE_MODEL,
+  // Same footing as Daybreak: no shipped row, so absence is the only evidence available.
+  NATIVE_GPT6_ASTRA_MINOR_MODEL,
 ]);
 
 /**
@@ -65,6 +93,7 @@ export const ACCOUNT_GATED_NATIVE_OPENAI_MODELS: ReadonlySet<string> = new Set([
  */
 const NATIVE_OPENAI_CAPABILITY_SOURCES: Readonly<Record<string, string>> = Object.freeze({
   [NATIVE_DAYBREAK_BLUE_MODEL]: "gpt-5.6-sol",
+  [NATIVE_GPT6_ASTRA_MINOR_MODEL]: NATIVE_GPT6_ASTRA_MODEL,
 });
 
 /**
@@ -72,14 +101,17 @@ const NATIVE_OPENAI_CAPABILITY_SOURCES: Readonly<Record<string, string>> = Objec
  *
  * Membership authorizes `upstreamNativeEntryForSlug` to return the pinned entry directly. It is
  * an explicit list, not a structural `PINNED_UPSTREAM_MODELS.has(slug)` predicate: the pin also
- * holds `gpt-5.5`, `gpt-5.2` and `codex-auto-review`, and admitting those into
+ * holds `gpt-5.5`, `codex-auto-review` and the Daybreak rows, and admitting those into
  * `UPSTREAM_NATIVE_ENTRIES` would newly authorize replacing their persisted catalog rows during
  * sync — an invariant that map's own comment reserves for the GPT-5.6 family. The snapshot
  * keeps rows this runtime does not expose, which is exactly why presence in the pin cannot be
- * the predicate: `gpt-5.4` and `gpt-5.4-mini` are still pinned after their retirement.
+ * the predicate: `gpt-5.4` is still pinned (hidden, with an upgrade to Terra) after its retirement.
  */
 export const SELF_DESCRIBED_NATIVE_OPENAI_MODELS: ReadonlySet<string> = new Set([
   NATIVE_GPT6_ASTRA_MODEL,
+  // Rows come from roster-pinned-models.json via pinnedNativeModelRows(), not the codex-rs pin.
+  NATIVE_GPT6_SOL_MODEL,
+  NATIVE_GPT6_LUNA_MODEL,
 ]);
 
 /**
@@ -132,6 +164,10 @@ export const NATIVE_OPENAI_ALIAS_PRESENTATION: Readonly<Record<string, { display
     displayName: "Daybreak Blue",
     description: "Frontier general-purpose model with safeguards for defensive cybersecurity work.",
   },
+  [NATIVE_GPT6_ASTRA_MINOR_MODEL]: {
+    displayName: "GPT-6-Astra-Minor",
+    description: "Unreleased GPT-6 Astra variant; shown only when your account's Codex roster lists it.",
+  },
 });
 
 export function nativeOpenAiAliasPresentation(slug: string): { displayName: string; description: string } | undefined {
@@ -159,6 +195,8 @@ export const NATIVE_OPENAI_MODELS = [
   "gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna",
   NATIVE_DAYBREAK_BLUE_MODEL,
   NATIVE_GPT6_ASTRA_MODEL,
+  NATIVE_GPT6_SOL_MODEL, NATIVE_GPT6_LUNA_MODEL,
+  NATIVE_GPT6_ASTRA_MINOR_MODEL,
 ];
 
 export const SUPPORTED_NATIVE_OPENAI_SLUGS = new Set(NATIVE_OPENAI_MODELS);
@@ -204,4 +242,7 @@ export const NATIVE_MAIN_DRAIN_SENTINEL_MODELS: ReadonlySet<string> = new Set([
   "gpt-5.6-terra",
   "gpt-5.6-luna",
   NATIVE_GPT6_ASTRA_MODEL,
+  // Astra Minor arrives through the gated spread above; Sol and Luna are ungated flagships.
+  NATIVE_GPT6_SOL_MODEL,
+  NATIVE_GPT6_LUNA_MODEL,
 ]);