@bitkyc08/opencodex 2.63.0 → 2.64.0-preview.20260923

package/src/codex/auth-context.ts

@@ -1,3 +1,4 @@
+import { codexAccountPriorityFailbackEnabled } from "./account-priority";
 import type { PoolQuotaWriter } from "./quota-types";
 import { createHash, timingSafeEqual } from "node:crypto";
 import {
@@ -80,6 +81,7 @@ import { CODEX_RESERVE_HELPER_UNSUPPORTED_MESSAGE, isCodexReserveHelperUnsupport
 import type { DataPlaneAdmission } from "../server/auth-cors";
 import { getMainReserveAuthorization, isMainReserveAuthorizationLive, nativeUserIdClaims, type MainReserveAuthorization } from "./reserve-availability";
 import { UpstreamRetryEvidenceError } from "../lib/upstream-retry";
+import { getEffectiveCodexAutoSwitchThreshold } from "./account-auto-switch";
 
 /**
  * A request-owned bearer cannot inspect the physical main credential for its plan, but cached
@@ -90,7 +92,7 @@ import { UpstreamRetryEvidenceError } from "../lib/upstream-retry";
  * request that already brought its own credential (#3157).
  */
 function requestOwnedMainPinHasQuotaHeadroom(config: OcxConfig): boolean {
-  const threshold = config.autoSwitchThreshold ?? 80;
+  const threshold = getEffectiveCodexAutoSwitchThreshold(config, MAIN_CODEX_ACCOUNT_ID);
   if (threshold <= 0) return true;
   const usage = computeCodexUsageScore(getAccountQuota(MAIN_CODEX_ACCOUNT_ID));
   return usage >= CODEX_UNKNOWN_USAGE_SCORE || usage < threshold;
@@ -121,6 +123,7 @@ export function requestOwnedMainPinState(
   policy: CodexAuthPolicyConfig,
   requestScopedMainCredential: boolean,
   fixedAccountId: string | undefined,
+  quotaScope?: CodexQuotaScope,
 ): { candidate: boolean; preserve: boolean } {
   const candidate = requestScopedMainCredential
     && fixedAccountId === undefined
@@ -130,7 +133,9 @@ export function requestOwnedMainPinState(
     && requestOwnedMainPinHasQuotaHeadroom(config);
   return {
     candidate,
-    preserve: candidate && !(callerMatchesObservedMain(headers) && isMainAccountHardLocked(policy)),
+    preserve: candidate && !(callerMatchesObservedMain(headers)
+      && (isMainAccountHardLocked(policy)
+        || getCodexQuotaHealthSnapshot(MAIN_CODEX_ACCOUNT_ID, quotaScope)?.cooldownUntil)),
   };
 }
 
@@ -181,6 +186,42 @@ function poolStateEligible(
   return fixedAccountId === undefined && !requestScopedMainCredential;
 }
 
+/**
+ * Does main have a live credential for a request that carries main's own bearer?
+ *
+ * The one expression final authentication and every preview must agree on, for the same reason
+ * `poolStateEligible` is: preview exists to predict the resolution, and a preview that scores main
+ * differently hands subagent fallback a different account than the one that serves (#4850).
+ *
+ * A forwardable request-owned bearer IS main's live credential -- it is exactly what would be
+ * sent if selection named main -- so the honest answer is yes, without reading the stored
+ * credential. An effective manual pin answers yes as it always did. The answer is no while the
+ * physical identity is fenced for a different reason, because retained recovery and a profile
+ * drain must keep main out of routing even for a request holding its own bearer.
+ */
+export function requestOwnedMainCredentialIsLive(inputs: {
+  preserveRequestOwnedMainPin: boolean;
+  requestScopedMainCredential: boolean;
+  nativeMainTrafficBlocked: boolean;
+  mainProfileDraining: boolean;
+  /**
+   * The caller's own credential is one of the Pool subscriptions currently in cooldown.
+   *
+   * Final authentication only. Cooldown identity is not modelled by preview and never was --
+   * `callerIsCooledPoolAccount` has no other caller -- because it decides a refusal rather than
+   * which account serves, so a preview that scores main while the resolution refuses still hands
+   * subagent fallback the right account. Passed explicitly at both preview sites so the asymmetry
+   * is stated rather than inherited from a default.
+   */
+  callerOwnsCooledPoolSubscription: boolean;
+}): boolean {
+  return inputs.preserveRequestOwnedMainPin
+    || (inputs.requestScopedMainCredential
+      && !inputs.nativeMainTrafficBlocked
+      && !inputs.mainProfileDraining
+      && !inputs.callerOwnsCooledPoolSubscription);
+}
+
 /**
  * May this request own Pool affinity state at all?
  *
@@ -598,6 +639,20 @@ function selectedCodexToken(headers: Headers): { accessToken: string; chatgptAcc
   };
 }
 
+/**
+ * The workspace account id a request-owned `main` credential materializes under, or
+ * `undefined` when the caller's headers carry none. This is the `chatgpt-account-id`
+ * `materializeCodexUpstreamAuth` would set for a caller-owned `{ kind: "main" }` context,
+ * read here without touching a credential store so a rotation gate can compare workspace
+ * scope before a send is ever built.
+ */
+export function callerCodexWorkspaceAccountId(headers: Headers): string | undefined {
+  const explicit = headers.get("chatgpt-account-id");
+  if (explicit) return explicit;
+  const bearer = headers.get("authorization")?.replace(/^Bearer\s+/i, "").trim();
+  return bearer ? extractAccountId(undefined, bearer) : undefined;
+}
+
 function assertMaterializedReserve(headers: Headers, ctx: CodexAuthContext, options: CodexAuthMaterializationOptions): void {
   if (!requiresReserveAuthorization(options.config, options.modelId, options.admission)) return;
   assertReserveAdmission(options.config!);
@@ -702,6 +757,31 @@ function callerIsCooledPoolAccount(headers: Headers, config: OcxConfig, accountI
   return true;
 }
 
+/**
+ * Does the caller's own credential belong to a Pool subscription that is currently cooled?
+ *
+ * The cooldown fallback below asks this of the SELECTED account, which was sufficient while a
+ * request-owned bearer could not make main a candidate: the cooled account was the selection, so
+ * the question and the refusal sat at the same place. Once main takes part in ordering (#5019) the
+ * cooled account is no longer selected, and serving its own credential as main would resurrect the
+ * cooldown it is inside — so eligibility has to ask the same question of every cooled sibling.
+ *
+ * `callerIsCooledPoolAccount` fails closed on an unreadable caller identity, which is preserved
+ * here: an opaque bearer counts as owning any cooled subscription rather than escaping it.
+ */
+function callerOwnsAnyCooledPoolSubscription(
+  headers: Headers,
+  config: OcxConfig,
+  quotaScope: CodexQuotaScope | undefined,
+): boolean {
+  for (const account of config.codexAccounts ?? []) {
+    if (account.id === MAIN_CODEX_ACCOUNT_ID) continue;
+    if (!getCodexQuotaHealthSnapshot(account.id, quotaScope)?.cooldownUntil) continue;
+    if (callerIsCooledPoolAccount(headers, config, account.id)) return true;
+  }
+  return false;
+}
+
 function captureObservedMainWriter(): MainQuotaWriter | undefined {
   const identityKey = getObservedMainQuotaIdentityKey();
   return identityKey === undefined ? undefined : {
@@ -856,15 +936,31 @@ export async function resolveCodexAuthContext(
     throw new CodexReserveUnavailableError();
   }
   const fixedAccountId = reserve ? MAIN_CODEX_ACCOUNT_ID : options.accountId;
-  const {
-    candidate: requestOwnedMainPinCandidate,
-    preserve: preserveRequestOwnedMainPin,
-  } = requestOwnedMainPinState(headers, config, policy, requestScopedMainCredential, fixedAccountId);
+  const quotaScope = codexQuotaScopeForModel(options.modelId);
+  // Pool pins and fallback must not resurrect an observed main credential that is cooling
+  // down. Unrelated caller-owned credentials and explicit Direct keep their own policy.
+  // The identity match and scoped health read are memory-only; never probe the auth file.
+  const callerOwnedMainPoolCooldown = () => mode === "pool" && callerMatchesObservedMain(headers)
+    ? getCodexQuotaHealthSnapshot(MAIN_CODEX_ACCOUNT_ID, quotaScope)
+    : null;
+  const assertCallerOwnedMainPoolNotCooled = () => {
+    const cooldown = callerOwnedMainPoolCooldown();
+    if (cooldown?.cooldownUntil) {
+      throw new CodexAccountCooldownError(
+        MAIN_CODEX_ACCOUNT_ID, cooldown.cooldownUntil, cooldown.cooldownSource, cooldown.quotaScope,
+      );
+    }
+  };
+  const mainPinState = () => requestOwnedMainPinState(
+    headers, config, policy, requestScopedMainCredential, fixedAccountId, quotaScope,
+  );
+  const requestOwnedMainPinCandidate = mainPinState().candidate;
   // During an owned startup, equality cannot be established until recovery and the
   // memory-only policy binding finish. This read-only fence never probes a foreign home.
   if (policy.codexMainAccountHardLock === true && requestOwnedMainPinCandidate && isMainAccountPolicyBindingPending()) {
     throw new CodexMainProfileDrainingError();
   }
+  const preserveRequestOwnedMainPin = () => mainPinState().preserve;
   if (fixedAccountId !== undefined && options.excludeAccountId !== undefined) {
     throw new Error("Codex auth context cannot select and exclude an account simultaneously");
   }
@@ -878,6 +974,7 @@ export async function resolveCodexAuthContext(
         throw new CodexMainProfileDrainingError();
       }
       if (callerMatchesObservedMain(headers)) assertMainAccountPolicy(policy);
+      assertCallerOwnedMainPoolNotCooled();
       if (reserve) {
         const selected = materializeCodexUpstreamAuth(headers, { kind: "main", accountId: null }, { config: policy });
         const token = selectedCodexToken(selected);
@@ -897,6 +994,7 @@ export async function resolveCodexAuthContext(
         }
       }
       if (callerMatchesObservedMain(headers)) assertMainAccountPolicy(policy);
+      assertCallerOwnedMainPoolNotCooled();
       return { kind: "main", accountId: null };
     }
 
@@ -946,13 +1044,13 @@ export async function resolveCodexAuthContext(
   // is the one exception where that exclusion is selection evidence in the opposite direction.
   // Validate the caller's own gated-model roster before using it, and fall through to a Pool model
   // detour when it lacks the grant. This branch performs no physical-main credential read.
-  if (preserveRequestOwnedMainPin) {
+  if (preserveRequestOwnedMainPin()) {
     const callerEntitled = !options.modelId
       || !ACCOUNT_GATED_NATIVE_OPENAI_MODELS.has(options.modelId)
       || await (
         options.isDirectCallerEntitledToCodexModel ?? isDirectCallerEntitledToCodexModel
       )(headers, options.modelId);
-    if (callerEntitled && !(callerMatchesObservedMain(headers) && isMainAccountHardLocked(policy))) {
+    if (callerEntitled && preserveRequestOwnedMainPin()) {
       return { kind: "main", accountId: null };
     }
   }
@@ -1001,7 +1099,21 @@ export async function resolveCodexAuthContext(
   const nativeMainSelectionOnly = !nativeMainTrafficBlocked
     && selectionAdmission?.mainProfileDraining === true;
   let accountId: string;
-  const quotaScope = codexQuotaScopeForModel(options.modelId);
+  // Answering this with the manual-pin predicate made `codexAccountUnusableReason` report
+  // `main_credential_unavailable` for every UNPINNED request, so `getEligiblePoolAccounts` never
+  // listed main and the strategy compared only the stored accounts. With one stored sibling the
+  // pool degraded to "stored account until it cannot serve, then main", discarding the usage,
+  // priority and reset ordering the operator configured (#5019).
+  const requestOwnedMainCredentialLive = () => requestOwnedMainCredentialIsLive({
+    preserveRequestOwnedMainPin: preserveRequestOwnedMainPin(),
+    requestScopedMainCredential,
+    nativeMainTrafficBlocked,
+    mainProfileDraining: selectionAdmission?.mainProfileDraining === true,
+    // Keeps the cooled account as the selection when the caller owns it, so the refusal is still
+    // produced by the cooldown machinery below rather than by a second rule beside it.
+    callerOwnsCooledPoolSubscription: requestScopedMainCredential
+      && callerOwnsAnyCooledPoolSubscription(headers, config, quotaScope),
+  });
   try {
     const excludeAccountIds = nativeMainReadsForbidden
       ? new Set([MAIN_CODEX_ACCOUNT_ID])
@@ -1042,13 +1154,15 @@ export async function resolveCodexAuthContext(
       // it. Retained recovery makes main wholly ineligible so pool routing continues.
       nativeMainSelectionOnly,
       isMainAccountTokenLive: requestScopedMainCredential
-        // Main stays excluded from this request's model roster below. This synthetic liveness is
-        // consulted only by shared-state preservation, so a caller-owned pin survives a model
-        // detour without reading or selecting the physical main credential.
-        ? () => preserveRequestOwnedMainPin
+        // Main stays excluded from this request's model roster below, so an account-gated model
+        // still cannot be served from a candidacy this answer creates. Everything else -- pool
+        // eligibility, shared-state preservation, and a caller-owned pin surviving a model detour
+        // -- is answered without reading or selecting the physical main credential.
+        ? requestOwnedMainCredentialLive
         : options.isMainAccountTokenLive,
       modelEligibleAccountIds,
       deniedModelAccountIds,
+      requestOwnedMainCredential: requestScopedMainCredential,
       // Request-scoped and deliberately absent from `sharedStateSelectionOptions`: one
       // conversation's attachments say nothing about where unrelated threads should be served.
       retainAccountForUploadedFiles: options.retainAccountForUploadedFiles === true,
@@ -1098,6 +1212,16 @@ export async function resolveCodexAuthContext(
     const selected = resolution.status === "selected" ? resolution.accountId : null;
     affinityDecision = resolution.affinity;
     transientProbe = resolution.status === "selected" ? resolution.transientProbe : undefined;
+    // Main now takes part in ordering when the request carries its own main bearer (#5019), so
+    // selection can name it outright rather than only through the no-candidate fallback below.
+    // Serve that selection from the credential the request arrived with: the read fence above
+    // forbids this request from claiming, reading or reconciling the stored main profile, and a
+    // request-owned credential owns no Pool state, so there is nothing here to claim, prime or
+    // cool down. Hand back any trial first -- no Pool account is being sent to.
+    if (selected === MAIN_CODEX_ACCOUNT_ID && requestScopedMainCredential) {
+      releaseTransientProbeGrant();
+      return await resolveCallerOwnedMainContext();
+    }
     if (!selected) {
       // A retry that excluded a failed Pool account may still use the validated caller-owned
       // main credential. Treating every exclusion as if main itself had failed strands a healthy
@@ -1202,13 +1326,17 @@ export async function resolveCodexAuthContext(
   // unprimed (dashboard never opened, or startup prime was blocked). Kick a
   // best-effort prime so the NEXT routing decision has real scores. This never
   // blocks the current request, and the helper's single-flight guard collapses
-  // repeated triggers into one pass.
-  if (fixedAccountId === undefined && !nativeMainReadsForbidden && !getAccountQuota(accountId)) {
+  // repeated triggers into one pass. Opt-in priority failback also refreshes inactive
+  // accounts; that path has a five-minute attempt limit inside the prime helper.
+  const priorityFailback = codexAccountPriorityFailbackEnabled(config, accountId);
+  if (fixedAccountId === undefined && !nativeMainReadsForbidden
+    && (!getAccountQuota(accountId) || priorityFailback)) {
+    const reason = priorityFailback ? "priority-failback" : "pre-route";
     if (options.primeCodexPoolQuotas) {
-      void options.primeCodexPoolQuotas(config, "pre-route").catch(() => {});
+      void options.primeCodexPoolQuotas(config, reason).catch(() => {});
     } else {
       import("./auth-api")
-        .then(({ primeCodexPoolQuotas }) => primeCodexPoolQuotas(config, "pre-route"))
+        .then(({ primeCodexPoolQuotas }) => primeCodexPoolQuotas(config, reason))
         .catch(() => {});
     }
   }

package/src/codex/catalog/build-entries.ts

@@ -437,7 +437,8 @@ export interface ObservedCatalogMergePolicy {
 export const CANONICAL_NATIVE_CATALOG_CONTENT_POLICY: Readonly<
   Pick<ObservedCatalogMergePolicy, "nativeBackfillSlugs" | "unsupportedNativeEntries">
 > = Object.freeze({
-  nativeBackfillSlugs: Object.freeze([...NATIVE_OPENAI_MODELS]),
+  // A getter: configured natives join NATIVE_OPENAI_MODELS after this module loads.
+  get nativeBackfillSlugs() { return Object.freeze([...NATIVE_OPENAI_MODELS]); },
   unsupportedNativeEntries: "drop",
 });
 

package/src/codex/catalog/effort.ts

@@ -444,6 +444,10 @@ export interface CatalogEffortCompatibility {
   readonly affectedModels: readonly string[];
 }
 
+// These parser-valid sentinels do not appear in native model ladders, so absence from an
+// observed bundled catalog is not evidence that the selected Codex runtime rejects them.
+const CODEX_PARSER_SENTINEL_EFFORTS = new Set(["none", "minimal"]);
+
 /**
  * Report which reasoning efforts in a catalog the local Codex runtime would reject, without
  * changing anything.
@@ -463,9 +467,11 @@ export function catalogEffortCompatibility(
   const unsupported = new Set<string>();
   const affected: string[] = [];
   for (const entry of models) {
-    const rejected = catalogEntryEfforts(entry).filter(effort => !supported.has(effort));
+    const accepts = (effort: string): boolean => supported.has(effort)
+      || CODEX_PARSER_SENTINEL_EFFORTS.has(effort);
+    const rejected = catalogEntryEfforts(entry).filter(effort => !accepts(effort));
     const fallback = typeof entry.default_reasoning_level === "string"
-      && !supported.has(entry.default_reasoning_level)
+      && !accepts(entry.default_reasoning_level)
       ? [entry.default_reasoning_level]
       : [];
     if (rejected.length === 0 && fallback.length === 0) continue;

package/src/codex/catalog/metadata.ts

@@ -41,6 +41,7 @@ import { CODEX_NATIVE_ALIAS_CATALOG_KIND } from "./kinds";
 import { RESERVE_METADATA_SOURCE_FIELD } from "./reserve";
 import {
   ACCOUNT_GATED_NATIVE_OPENAI_MODELS,
+  NATIVE_GPT6_CONTEXT,
   NATIVE_DAYBREAK_BLUE_MODEL,
   NATIVE_GPT6_ASTRA_MINOR_MODEL,
   NATIVE_GPT6_ASTRA_MODEL,
@@ -52,10 +53,13 @@ import {
   SELF_DESCRIBED_NATIVE_OPENAI_MODELS,
   SUPPORTED_NATIVE_OPENAI_SLUGS,
   RETIRED_NATIVE_OPENAI_MODELS,
+  configuredNativeOpenAiModels,
   hasNativeOpenAiCapabilityMetadata,
+  isConfiguredNativeOpenAiModel,
   isNativeOpenAiCapabilityAliasModel,
   nativeOpenAiAliasPresentation,
   nativeOpenAiCapabilitySourceSlug,
+  subscribeConfiguredNativeOpenAiModels,
 } from "./native-models";
 import { cachedAvailableAccountGatedNativeModels } from "../model-entitlements";
 import { MAIN_CODEX_ACCOUNT_ID } from "../main-account";
@@ -186,15 +190,16 @@ export const NATIVE_OPENAI_CONTEXT_OVERRIDES: Record<string, { contextWindow?: n
   // family's measured 922,000 clamp — advertising 922,000 here over-stated the ceiling by 50k.
   // maxInputTokens is clamped to the resolved window by nativeOpenAiMaxInputTokens, so this reads
   // 272,000 by default and 872,000 only under the long-window opt-in.
-  [NATIVE_GPT6_ASTRA_MODEL]: { contextWindow: 272_000, maxContextWindow: 872_000, maxInputTokens: 872_000 },
+  [NATIVE_GPT6_ASTRA_MODEL]: { ...NATIVE_GPT6_CONTEXT },
   // Sol and Luna ship the same 272,000 / 872,000 pair in their roster rows (probe of
   // /backend-api/codex/models?client_version=0.155.0, 2026-09-23). Unmeasured here, so they take
   // the row's own ceiling rather than the GPT-5.6 family's measured 922,000.
-  [NATIVE_GPT6_SOL_MODEL]: { contextWindow: 272_000, maxContextWindow: 872_000, maxInputTokens: 872_000 },
-  [NATIVE_GPT6_LUNA_MODEL]: { contextWindow: 272_000, maxContextWindow: 872_000, maxInputTokens: 872_000 },
+  [NATIVE_GPT6_SOL_MODEL]: { ...NATIVE_GPT6_CONTEXT },
+  [NATIVE_GPT6_LUNA_MODEL]: { ...NATIVE_GPT6_CONTEXT },
   // Astra Minor borrows Astra's row, so it inherits Astra's numbers. No account we hold can reach
   // it, so this is inheritance, not a measurement.
-  [NATIVE_GPT6_ASTRA_MINOR_MODEL]: { contextWindow: 272_000, maxContextWindow: 872_000, maxInputTokens: 872_000 },
+  [NATIVE_GPT6_ASTRA_MINOR_MODEL]: { ...NATIVE_GPT6_CONTEXT },
+  // Configured natives (providers.openai.models) are added at registration with the same pair.
 };
 
 // Snapshot rows plus roster-captured rows the snapshot lacks (see pinned-models.ts).
@@ -562,7 +567,8 @@ function upstreamNativeEntryForSlug(slug: string): RawEntry | undefined {
   // Keyed on the SOURCE so an alias of a self-described row (gpt-6-astra-minor -> gpt-6-astra)
   // is admitted the same way an alias of a GPT-5.6 row (Daybreak -> Sol) always was; for a
   // self-described slug itself the source is the slug, so nothing else changes.
-  if (!sourceSlug.startsWith("gpt-5.6-") && !SELF_DESCRIBED_NATIVE_OPENAI_MODELS.has(sourceSlug)) {
+  if (!sourceSlug.startsWith("gpt-5.6-") && !SELF_DESCRIBED_NATIVE_OPENAI_MODELS.has(sourceSlug)
+    && !isConfiguredNativeOpenAiModel(slug)) {
     return undefined;
   }
   const source = PINNED_UPSTREAM_MODELS.get(sourceSlug);
@@ -621,6 +627,24 @@ export const UPSTREAM_NATIVE_ENTRIES: Map<string, RawEntry> = new Map(
   }),
 );
 
+// Configured natives join the three per-slug tables in place: other modules hold these exact
+// objects, so a replacement would go unseen. Built-in ids are never configured, so a removal
+// cannot delete a built-in row.
+subscribeConfiguredNativeOpenAiModels((current, removed) => {
+  for (const slug of removed) {
+    PINNED_NATIVE_CAPABILITY_ENTRIES.delete(slug);
+    UPSTREAM_NATIVE_ENTRIES.delete(slug);
+    delete NATIVE_OPENAI_CONTEXT_OVERRIDES[slug];
+  }
+  for (const slug of current) {
+    const pinned = pinnedNativeCapabilityEntry(slug);
+    if (pinned) PINNED_NATIVE_CAPABILITY_ENTRIES.set(slug, pinned);
+    const upstream = upstreamNativeEntryForSlug(slug);
+    if (upstream) UPSTREAM_NATIVE_ENTRIES.set(slug, upstream);
+    NATIVE_OPENAI_CONTEXT_OVERRIDES[slug] = { ...NATIVE_GPT6_CONTEXT };
+  }
+});
+
 export function upstreamNativeEntry(slug: string): RawEntry | null {
   const entry = UPSTREAM_NATIVE_ENTRIES.get(slug);
   if (!entry) return null;
@@ -672,7 +696,9 @@ export function shouldUpgradeToUpstreamEntry(entry: RawEntry): boolean {
 export function nativeOpenAiSlugs(): string[] {
   const live = catalogNativeSlugs();
   const availableGated = cachedAvailableAccountGatedNativeModels();
-  const candidates = live.length > 0 ? unique([...live, ...DOCUMENTED_NATIVE_OPENAI_ADDITIONS]) : NATIVE_OPENAI_MODELS;
+  const candidates = live.length > 0
+    ? unique([...live, ...DOCUMENTED_NATIVE_OPENAI_ADDITIONS, ...configuredNativeOpenAiModels()])
+    : NATIVE_OPENAI_MODELS;
   return candidates.filter(slug => (
     !ACCOUNT_GATED_NATIVE_OPENAI_MODELS.has(slug) || availableGated.has(slug)
   ));
@@ -881,5 +907,5 @@ function catalogNativeSlugs(): string[] {
 export function listCatalogNativeSlugs(): string[] {
   // Ensure documented additions (e.g. gpt-6-astra) appear even when the bundled catalog
   // predates the slug — mirrors nativeOpenAiSlugs() which already merges them for /v1/models.
-  return unique([...catalogNativeSlugs(), ...DOCUMENTED_NATIVE_OPENAI_ADDITIONS]);
+  return unique([...catalogNativeSlugs(), ...DOCUMENTED_NATIVE_OPENAI_ADDITIONS, ...configuredNativeOpenAiModels()]);
 }

package/src/codex/catalog/native-models.ts

@@ -48,6 +48,17 @@ export const NATIVE_GPT6_LUNA_MODEL = "gpt-6-luna";
  */
 export const NATIVE_GPT6_ASTRA_MINOR_MODEL = "gpt-6-astra-minor";
 
+/**
+ * Context pair every GPT-6 native ships in its upstream row: a 272,000-token default window
+ * against an 872,000-token ceiling (and input limit) reached only through the long-window opt-in.
+ * The built-in GPT-6 rows and every configured native (below) inherit this one value.
+ */
+export const NATIVE_GPT6_CONTEXT: Readonly<{ contextWindow: number; maxContextWindow: number; maxInputTokens: number }> =
+  Object.freeze({ contextWindow: 272_000, maxContextWindow: 872_000, maxInputTokens: 872_000 });
+
+/** Pinned row a configured native borrows its capability metadata from. */
+export const CONFIGURED_NATIVE_OPENAI_TEMPLATE_MODEL = NATIVE_GPT6_SOL_MODEL;
+
 /**
  * Native ChatGPT/Codex ids whose availability is proven per authenticated account.
  *
@@ -132,7 +143,7 @@ export const NATIVE_OPENAI_CAPABILITY_ALIAS_MODELS = Object.freeze(
 );
 
 export function isNativeOpenAiCapabilityAliasModel(slug: string): boolean {
-  return Object.hasOwn(NATIVE_OPENAI_CAPABILITY_SOURCES, slug);
+  return Object.hasOwn(NATIVE_OPENAI_CAPABILITY_SOURCES, slug) || configuredNativeSlugs.has(slug);
 }
 
 /**
@@ -151,7 +162,8 @@ export function hasNativeOpenAiCapabilityMetadata(slug: string): boolean {
 }
 
 export function nativeOpenAiCapabilitySourceSlug(slug: string): string {
-  return NATIVE_OPENAI_CAPABILITY_SOURCES[slug] ?? slug;
+  return NATIVE_OPENAI_CAPABILITY_SOURCES[slug]
+    ?? (configuredNativeSlugs.has(slug) ? CONFIGURED_NATIVE_OPENAI_TEMPLATE_MODEL : slug);
 }
 
 /**
@@ -171,7 +183,22 @@ export const NATIVE_OPENAI_ALIAS_PRESENTATION: Readonly<Record<string, { display
 });
 
 export function nativeOpenAiAliasPresentation(slug: string): { displayName: string; description: string } | undefined {
-  return NATIVE_OPENAI_ALIAS_PRESENTATION[slug];
+  return NATIVE_OPENAI_ALIAS_PRESENTATION[slug]
+    ?? (configuredNativeSlugs.has(slug) ? configuredNativePresentation(slug) : undefined);
+}
+
+/** `gpt-6-nova` -> `GPT-6-Nova`, the same casing upstream uses for its own GPT-6 rows. */
+export function configuredNativeOpenAiDisplayName(slug: string): string {
+  return slug.split("-").map((part, index) => (
+    index === 0 ? part.toUpperCase() : part.charAt(0).toUpperCase() + part.slice(1)
+  )).join("-");
+}
+
+function configuredNativePresentation(slug: string): { displayName: string; description: string } {
+  return {
+    displayName: configuredNativeOpenAiDisplayName(slug),
+    description: "OpenAI native model added through providers.openai.models; uses GPT-6-Sol capabilities.",
+  };
 }
 
 /**
@@ -190,17 +217,87 @@ export function nativeOpenAiAliasPresentation(slug: string): { displayName: stri
  *
  * Devlog: 260816_codexrs_multiagent_v2_and_history_perf/011 §4-bis.
  */
-export const NATIVE_OPENAI_MODELS = [
+const BUILT_IN_NATIVE_OPENAI_MODELS: readonly string[] = Object.freeze([
   "gpt-5.5",
   "gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna",
   NATIVE_DAYBREAK_BLUE_MODEL,
   NATIVE_GPT6_ASTRA_MODEL,
   NATIVE_GPT6_SOL_MODEL, NATIVE_GPT6_LUNA_MODEL,
   NATIVE_GPT6_ASTRA_MINOR_MODEL,
-];
+]);
+
+/**
+ * The built-in list plus every configured native, appended in config order. The array and the Set
+ * below are shared by reference across the catalog, `/v1/models` and the dashboard, so
+ * registration edits them in place rather than replacing them.
+ */
+export const NATIVE_OPENAI_MODELS: string[] = [...BUILT_IN_NATIVE_OPENAI_MODELS];
 
 export const SUPPORTED_NATIVE_OPENAI_SLUGS = new Set(NATIVE_OPENAI_MODELS);
 
+/**
+ * Configured natives: bare `gpt-*` ids an operator lists under `providers.openai.models` on the
+ * canonical Codex forward provider, so a new upstream GPT model needs a config entry rather than a
+ * release — the way a Claude id listed under `providers.anthropic.models` already works.
+ *
+ * A configured native borrows `gpt-6-sol`'s pinned row (ladder, modalities, instructions, speed
+ * tiers) under its own generated name, uses the GPT-6 272k/872k context pair, and is never
+ * account-gated. Filtering the config lives in `src/config/derived-registries.ts`; this module stays
+ * import-free because the GUI bundles it. Registration runs inside `loadConfig` and every config
+ * persist/reconcile path, so any process that loads config — `ocx ensure` included — sees it.
+ */
+const configuredNativeSlugs = new Set<string>();
+type ConfiguredNativeListener = (current: readonly string[], removed: readonly string[]) => void;
+const configuredNativeListeners: ConfiguredNativeListener[] = [];
+
+const CONFIGURED_NATIVE_SLUG = /^gpt-[a-z0-9][a-z0-9.-]*$/;
+
+/** Whether a bare id may become a configured native (shape, not built in, not retired or reserve). */
+export function isEligibleConfiguredNativeOpenAiModel(id: string): boolean {
+  return CONFIGURED_NATIVE_SLUG.test(id)
+    && !BUILT_IN_NATIVE_OPENAI_MODELS.includes(id)
+    && !RETIRED_NATIVE_OPENAI_MODELS.has(id)
+    && id !== NATIVE_RESERVE_MODEL;
+}
+
+export function configuredNativeOpenAiModels(): readonly string[] {
+  return [...configuredNativeSlugs];
+}
+
+export function isConfiguredNativeOpenAiModel(slug: string): boolean {
+  return configuredNativeSlugs.has(slug);
+}
+
+/** Replace the configured set. Ineligible ids are ignored; built-in entries are never touched. */
+export function setConfiguredNativeOpenAiModels(ids: readonly string[]): void {
+  const next = [...new Set(ids.filter(isEligibleConfiguredNativeOpenAiModel))];
+  const previous = [...configuredNativeSlugs];
+  if (next.length === previous.length && next.every((id, index) => id === previous[index])) return;
+  const removed = previous.filter(id => !next.includes(id));
+  for (const id of previous) {
+    configuredNativeSlugs.delete(id);
+    SUPPORTED_NATIVE_OPENAI_SLUGS.delete(id);
+    const index = NATIVE_OPENAI_MODELS.indexOf(id);
+    if (index >= 0) NATIVE_OPENAI_MODELS.splice(index, 1);
+  }
+  for (const id of next) {
+    configuredNativeSlugs.add(id);
+    SUPPORTED_NATIVE_OPENAI_SLUGS.add(id);
+    NATIVE_OPENAI_MODELS.push(id);
+  }
+  for (const listener of configuredNativeListeners) listener(next, removed);
+}
+
+/** Keep derived tables in step; the listener runs immediately with the current set. */
+export function subscribeConfiguredNativeOpenAiModels(listener: ConfiguredNativeListener): void {
+  configuredNativeListeners.push(listener);
+  listener(configuredNativeOpenAiModels(), []);
+}
+
+export function resetConfiguredNativeOpenAiModelsForTests(): void {
+  setConfiguredNativeOpenAiModels([]);
+}
+
 /**
  * Natives this runtime used to ship that upstream has since retired.
  *

package/src/codex/catalog/parsing.ts

@@ -194,6 +194,8 @@ export const ROUTED_MODEL_COMPATIBILITY_EXCLUSIONS = new Set([
    * keep appearing with its capabilities broken. Excluding the slug is what actually takes
    * it out of the routed catalog.
    */
+  "deepseek/deepseek-v4-pro",
+  "opencode-go/deepseek-v4-pro",
   "command-code/deepseek-deepseek-v4-pro",
   "commandcode/deepseek-deepseek-v4-pro",
   "orcarouter/deepseek-deepseek-v4-pro",

package/src/codex/catalog/provider-models.ts

@@ -56,6 +56,7 @@ import { cursorLiveRosterScope, recordLiveCursorClaudeModels, recordLiveCursorMa
 import { fetchQoderModels } from "../../adapters/qoder/live-models";
 import { resolveQoderProfile } from "../../adapters/qoder/profiles";
 import { fetchDevinUsableModels } from "../../adapters/devin/live-models";
+import { resolveDevinApiBaseUrl } from "../../oauth/devin/api-base";
 import { isCanonicalOpenAiForwardProvider, OPENAI_API_PROVIDER_ID, OPENAI_CODEX_PROVIDER_ID } from "../../providers/openai-tiers";
 import {
   COMBO_NAMESPACE,
@@ -216,11 +217,15 @@ export async function fetchProviderModelsWithAuth(
     return observed(configured, "authoritative");
   }
   const auth: ModelsAuthResolution = captured.observedAuth ?? (resolveAuth.kind === "refreshing"
-    ? prov.authMode === "oauth" && effectiveGoogleMode(name, prov) === "cloud-code-assist"
+    ? prov.authMode === "oauth" && (
+      effectiveGoogleMode(name, prov) === "cloud-code-assist"
+      || prov.adapter === "devin"
+    )
       ? await getValidAccessTokenSnapshot(name)
         .then(snapshot => ({
           apiKey: snapshot.accessToken,
           observed: false,
+          ...(snapshot.apiBaseUrl ? { oauthApiBaseUrl: snapshot.apiBaseUrl } : {}),
           ...(snapshot.projectId ? { oauthProjectId: snapshot.projectId } : {}),
         }))
         .catch(() => ({ apiKey: undefined, observed: false }))
@@ -289,10 +294,13 @@ export async function fetchProviderModelsWithAuth(
   }
   if (prov.adapter === "devin") {
     if (!apiKey) return observed(configured, "degraded");
-    // Devin's usable-model list is entitlement-specific. Bind cache reads/writes to an
-    // irreversible credential fingerprint so a credential switch cannot observe another
-    // account's roster or stale fallback (the Qoder precedent above).
-    const authorityIdentity = createHash("sha256").update(apiKey).digest("hex");
+    // Both the credential and its validated tenant destination own this roster.
+    // The registered Devin route ignores a saved baseUrl override; discovery must
+    // use that same fixed destination when the stored tenant URL is invalid.
+    const configuredBase = name === "devin" ? getProviderRegistryEntry(name)?.baseUrl ?? prov.baseUrl : prov.baseUrl;
+    const destination = resolveDevinApiBaseUrl(auth.oauthApiBaseUrl ?? configuredBase);
+    const authorityIdentity = createHash("sha256")
+      .update(JSON.stringify([apiKey, destination])).digest("hex");
     const cachedDevin = getFreshCached(name, ttlMs, Date.now(), authorityIdentity);
     if (cachedDevin) {
       return observed(
@@ -309,7 +317,12 @@ export async function fetchProviderModelsWithAuth(
         "degraded",
       );
     }
-    const liveResult = await fetchDevinUsableModels({ apiKey, baseUrl: prov.baseUrl });
+    // The OAuth snapshot owns both values: never combine one account's durable
+    // key with the registry's default host or another account's tenant host.
+    const liveResult = await fetchDevinUsableModels({
+      apiKey,
+      baseUrl: destination,
+    });
     if (liveResult.ok) {
       // Live catalog is the source of truth — use the discovered base models
       // directly, not a filtered subset of the static seed.