@bitkyc08/opencodex 2.7.34 → 2.7.35

package/src/codex/quota.ts

@@ -11,15 +11,24 @@ export type WhamUsageResponse = {
   email?: string | null;
   plan_type?: string | null;
   rate_limit?: {
-    primary_window?: { used_percent?: number; reset_at?: number };
-    secondary_window?: { used_percent?: number; reset_at?: number };
-    tertiary_window?: { used_percent?: number; reset_at?: number };
+    // Live WHAM payloads send explicit nulls for absent windows (issue #315 repro).
+    primary_window?: WhamUsageWindow | null;
+    secondary_window?: WhamUsageWindow | null;
+    tertiary_window?: WhamUsageWindow | null;
   };
   rate_limit_reset_credits?: {
     available_count: number;
   } | null;
 };
 
+type WhamUsageWindow = {
+  used_percent?: number;
+  reset_at?: number;
+  limit_window_seconds?: number;
+};
+
+const MONTHLY_WINDOW_MIN_SECONDS = 28 * 24 * 60 * 60;
+
 const accountQuota = new Map<string, StoredAccountQuota>();
 
 export const CODEX_UNKNOWN_USAGE_SCORE = 100;
@@ -49,6 +58,13 @@ function hasKnownQuotaValue(quota: Omit<StoredAccountQuota, "updatedAt">): boole
     .some(value => typeof value === "number" && Number.isFinite(value));
 }
 
+function isExplicitMonthlyWindow(window: WhamUsageWindow | null | undefined): boolean {
+  const seconds = window?.limit_window_seconds;
+  return typeof seconds === "number"
+    && Number.isFinite(seconds)
+    && seconds >= MONTHLY_WINDOW_MIN_SECONDS;
+}
+
 export function updateAccountQuota(
   accountId: string,
   weekly: unknown,
@@ -110,16 +126,30 @@ export function parseUsageQuota(data: WhamUsageResponse): Omit<StoredAccountQuot
 
   const quota: Omit<StoredAccountQuota, "updatedAt"> = {};
   const thirtyDayOnly = data.plan_type?.trim().toLowerCase() === "go" || data.plan_type?.trim().toLowerCase() === "free";
-  // primary_window was the 5h window; it now carries weekly data for GPT plans.
-  // secondary_window is the legacy weekly source; prefer primary when present.
-  const primaryPercent = normalizeUsagePercent(data.rate_limit.primary_window?.used_percent);
-  const secondaryPercent = normalizeUsagePercent(data.rate_limit.secondary_window?.used_percent);
-  const weeklyPercent = primaryPercent ?? secondaryPercent;
-  const monthlyPercent = normalizeUsagePercent(data.rate_limit.tertiary_window?.used_percent);
-  const primaryResetAt = normalizeResetAt(data.rate_limit.primary_window?.reset_at);
-  const secondaryResetAt = normalizeResetAt(data.rate_limit.secondary_window?.reset_at);
-  const weeklyResetAt = primaryPercent !== undefined ? primaryResetAt : secondaryResetAt;
-  const monthlyResetAt = normalizeResetAt(data.rate_limit.tertiary_window?.reset_at);
+  const primaryWindow = data.rate_limit.primary_window;
+  const secondaryWindow = data.rate_limit.secondary_window;
+  const tertiaryWindow = data.rate_limit.tertiary_window;
+  const primaryPercent = normalizeUsagePercent(primaryWindow?.used_percent);
+  const secondaryPercent = normalizeUsagePercent(secondaryWindow?.used_percent);
+  const tertiaryPercent = normalizeUsagePercent(tertiaryWindow?.used_percent);
+  const primaryResetAt = normalizeResetAt(primaryWindow?.reset_at);
+  const secondaryResetAt = normalizeResetAt(secondaryWindow?.reset_at);
+  const tertiaryResetAt = normalizeResetAt(tertiaryWindow?.reset_at);
+  const primaryIsMonthly = isExplicitMonthlyWindow(primaryWindow);
+
+  // [Decision Log]
+  // - 목적과 의도: distinguish weekly and roughly monthly WHAM primary windows without plan-name guesses.
+  // - 기존 구현 및 제약 조건: primary meant weekly, and older responses omit limit_window_seconds.
+  // - 검토한 주요 대안: exact-duration matching, plan-specific mapping, and a duration lower bound.
+  // - 선택한 방식: only an explicit primary duration of at least 28 days changes it to monthly.
+  // - 다른 대안 대신 이 방식을 선택한 이유: it accepts calendar-month variance and preserves legacy payloads.
+  // - 장점, 단점 및 영향: Team monthly quotas classify correctly; unknown durations remain weekly by design.
+  const weeklyPercent = primaryIsMonthly ? secondaryPercent : primaryPercent ?? secondaryPercent;
+  const weeklyResetAt = primaryIsMonthly
+    ? secondaryResetAt
+    : primaryPercent !== undefined ? primaryResetAt : secondaryResetAt;
+  const monthlyPercent = primaryIsMonthly ? primaryPercent ?? tertiaryPercent : tertiaryPercent;
+  const monthlyResetAt = primaryIsMonthly && primaryPercent !== undefined ? primaryResetAt : tertiaryResetAt;
   if (thirtyDayOnly) {
     if (monthlyPercent !== undefined) {
       quota.monthlyPercent = monthlyPercent;

package/src/index.ts

@@ -19,3 +19,4 @@ export type {
   OcxTool,
   AdapterEvent,
 } from "./types";
+// release-train: preview publish gate for v2.7.35-preview.20260723

package/src/lib/sse-decoder.ts

@@ -0,0 +1,84 @@
+export interface ServerSentEvent {
+  event?: string;
+  data: string;
+}
+
+/**
+ * Decode text/event-stream records across arbitrary fetch chunk boundaries.
+ *
+ * The final record is dispatched at EOF even when the upstream omits the trailing blank line or
+ * final newline. That matters for compatible APIs that place a terminal event in the last bytes of
+ * the body: dropping that record turns a successful response into an adapter_eof failure.
+ */
+export async function* decodeServerSentEvents(
+  source: ReadableStream<Uint8Array>,
+  options?: { signal?: AbortSignal },
+): AsyncGenerator<ServerSentEvent> {
+  const reader = source.getReader();
+  const decoder = new TextDecoder();
+  let buffer = "";
+  let event: string | undefined;
+  let dataLines: string[] = [];
+  // Prompt cancellation channel: an abort cancels the underlying reader directly, which
+  // settles any in-flight read() so a consumer's iterator.return() cannot hang behind an
+  // idle upstream (a plain generator return waits for the pending await first).
+  const signal = options?.signal;
+  const onAbort = () => { reader.cancel(signal?.reason).catch(() => { /* already closed */ }); };
+  if (signal?.aborted) onAbort();
+  else signal?.addEventListener("abort", onAbort, { once: true });
+
+  const dispatch = (): ServerSentEvent | undefined => {
+    if (dataLines.length === 0) {
+      event = undefined;
+      return undefined;
+    }
+    const record = { ...(event ? { event } : {}), data: dataLines.join("\n") };
+    event = undefined;
+    dataLines = [];
+    return record;
+  };
+
+  const acceptLine = (rawLine: string): ServerSentEvent | undefined => {
+    const line = rawLine.endsWith("\r") ? rawLine.slice(0, -1) : rawLine;
+    if (line === "") return dispatch();
+    if (line.startsWith(":")) return undefined;
+
+    const colon = line.indexOf(":");
+    const field = colon < 0 ? line : line.slice(0, colon);
+    let value = colon < 0 ? "" : line.slice(colon + 1);
+    if (value.startsWith(" ")) value = value.slice(1);
+
+    if (field === "event") event = value;
+    else if (field === "data") dataLines.push(value);
+    return undefined;
+  };
+
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (value) buffer += decoder.decode(value, { stream: !done });
+
+      let newline: number;
+      while ((newline = buffer.indexOf("\n")) >= 0) {
+        const record = acceptLine(buffer.slice(0, newline));
+        buffer = buffer.slice(newline + 1);
+        if (record) yield record;
+      }
+
+      if (!done) continue;
+      buffer += decoder.decode();
+      if (buffer.length > 0) {
+        const record = acceptLine(buffer);
+        buffer = "";
+        if (record) yield record;
+      }
+      const finalRecord = dispatch();
+      if (finalRecord) yield finalRecord;
+      break;
+    }
+  } finally {
+    signal?.removeEventListener("abort", onAbort);
+    try { await reader.cancel(); } catch { /* already closed/errored */ }
+    try { reader.releaseLock(); } catch { /* already released */ }
+  }
+}

package/src/providers/antigravity-models.ts

@@ -47,6 +47,13 @@ const ANTIGRAVITY_DEFAULT_EFFORT: Record<string, string> = {
   "gemini-3.1-pro": "high",
 };
 
+const ANTIGRAVITY_THINKING_LEVELS = new Set(["minimal", "low", "medium", "high"]);
+
+function resolveAntigravityThinkingLevel(effort: string): string | undefined {
+  if (effort === "xhigh" || effort === "max" || effort === "ultra") return "high";
+  return ANTIGRAVITY_THINKING_LEVELS.has(effort) ? effort : undefined;
+}
+
 // ── Visible client aliases (kept for saved-config compat, not picker-visible) ──
 const ANTIGRAVITY_VISIBLE_MODEL_ALIASES: Record<string, string> = {
   "gemini-3.1-pro-high": "gemini-pro-agent",
@@ -152,10 +159,9 @@ export function resolveAntigravityEffortWireModel(
   }
 
   // Rule 4: Claude models — effort via thinkingConfig only (no suffix variants).
-  // Anthropic adaptive thinking supports low/medium/high/max for both Sonnet 4.6 and Opus 4.6.
-  // CLIProxyAPI proves CCA accepts thinkingConfig on base IDs (validation confirmed).
+  // CCA validates this field as Google's ThinkingLevel enum, whose highest value is `high`.
   if (/^claude-/.test(modelId) && effort) {
-    return { wireModelId: modelId, thinkingLevel: effort };
+    return { wireModelId: modelId, thinkingLevel: resolveAntigravityThinkingLevel(effort) };
   }
 
   // Rule 5: everything else.

package/src/server/chat-completions.ts

@@ -0,0 +1,258 @@
+/**
+ * OpenAI Chat Completions inbound (/v1/chat/completions) for GitHub Copilot App
+ * and other OpenAI-compatible clients.
+ *
+ * Translate-and-replay: Chat Completions body -> /v1/responses via handleResponses,
+ * then bridge the Responses output back to Chat Completions SSE/JSON.
+ */
+import { FORWARD_HEADERS } from "../adapters/openai-responses";
+import { ChatCompletionsRequestError, chatCompletionsToResponsesBody } from "../chat/inbound";
+import {
+  chatCompletionsErrorResponse,
+  collectChatCompletion,
+  isChatCompletionsStreamError,
+  responsesJsonToChatCompletion,
+  responsesSseToChatCompletionsSse,
+} from "../chat/outbound";
+import { estimateTokens } from "../lib/token-estimate";
+import { routeModel } from "../router";
+import type { OcxConfig } from "../types";
+import { readJsonRequestBody } from "./request-decompress";
+import {
+  addFinalRequestLog,
+  httpStatusForTerminalStatus,
+  recordFirstOutput,
+  type RequestLogContext,
+  type RequestLogEntry,
+} from "./request-log";
+import { responseWithDeferredRequestLog } from "./relay";
+import { handleResponses } from "./responses";
+
+type Rec = Record<string, unknown>;
+
+function isRec(v: unknown): v is Rec {
+  return !!v && typeof v === "object" && !Array.isArray(v);
+}
+async function readChatBody(req: Request): Promise<unknown> {
+  try {
+    return await readJsonRequestBody(req);
+  } catch (err) {
+    throw new ChatCompletionsRequestError(err instanceof Error && err.message ? err.message : "Invalid JSON body");
+  }
+}
+
+export async function handleChatCompletions(
+  req: Request,
+  config: OcxConfig,
+  logCtx: RequestLogContext,
+  logIds?: { requestId: string; start: number },
+): Promise<Response> {
+  let chatBody: unknown;
+  let internalBody: Rec;
+  try {
+    chatBody = await readChatBody(req);
+    internalBody = chatCompletionsToResponsesBody(chatBody);
+  } catch (err) {
+    const status = err instanceof ChatCompletionsRequestError ? 400 : 500;
+    if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, status, { closeReason: "non_stream" });
+    return chatCompletionsErrorResponse(status, err instanceof Error ? err.message : String(err));
+  }
+
+  const requestedModel = (chatBody as Rec).model as string;
+  const stream = internalBody.stream === true;
+  // Routed adapters only support streamed turns; always stream internally and fold
+  // for non-streaming clients.
+  internalBody.stream = true;
+
+  let nativeRoute = false;
+  let directRoute = false;
+  try {
+    const route = routeModel(config, internalBody.model as string);
+    logCtx.model = route.modelId;
+    logCtx.providerAdapter = route.provider.adapter;
+    logCtx.requestedModel = requestedModel;
+    logCtx.provider = route.providerName;
+    if (route.provider.adapter === "openai-responses") {
+      nativeRoute = true;
+      directRoute = route.codexAccountMode === "direct";
+      // ChatGPT backend rejects store:true and unsupported sampling knobs.
+      internalBody.store = false;
+      delete internalBody.max_output_tokens;
+      delete internalBody.temperature;
+      delete internalBody.top_p;
+      delete internalBody.stop;
+      delete internalBody.user;
+    } else if (internalBody.store === undefined) {
+      internalBody.store = false;
+    }
+    if (route.provider.adapter === "openai-chat" && internalBody.text !== undefined) {
+      if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, 400, { closeReason: "non_stream" });
+      return chatCompletionsErrorResponse(400, "response_format is not supported for routed openai-chat models");
+    }
+    if (route.provider.adapter === "cursor" || route.provider.adapter === "kiro") {
+      const raw = chatBody as Rec;
+      const parts: string[] = [];
+      if (raw.messages !== undefined) parts.push(JSON.stringify(raw.messages));
+      if (raw.tools !== undefined) parts.push(JSON.stringify(raw.tools));
+      logCtx.usageLogInputTokens = Math.max(1, estimateTokens(parts.join("\n"), requestedModel));
+    }
+    if (internalBody.reasoning !== undefined) {
+      const { supportedLadderFor } = await import("./effort-policy");
+      const ladder = supportedLadderFor({ provider: route.provider, modelId: route.modelId });
+      if (ladder !== undefined && ladder.length === 0) delete internalBody.reasoning;
+    }
+  } catch {
+    /* unknown model: let handleResponses shape the 404 */
+  }
+  void nativeRoute;
+
+  const headers = new Headers({ "content-type": "application/json" });
+  for (const name of FORWARD_HEADERS) {
+    if (name === "authorization" && !directRoute) continue;
+    const value = req.headers.get(name);
+    if (value) headers.set(name, value);
+  }
+  // Prefer main ChatGPT auth so OpenAI-backed sidecars remain reachable on routed turns.
+  if (!directRoute) try {
+    const { getMainAccountToken } = await import("../codex/main-account");
+    const token = getMainAccountToken();
+    if (token) {
+      headers.set("authorization", `Bearer ${token.accessToken}`);
+      headers.set("chatgpt-account-id", token.chatgptAccountId);
+    }
+  } catch {
+    /* optional */
+  }
+
+  const internalReq = new Request("http://localhost/v1/responses", {
+    method: "POST",
+    headers,
+    body: JSON.stringify(internalBody),
+  });
+
+  let nativeLogged = false;
+  const finalizeNativeLog = (status: number, meta: { terminalStatus?: RequestLogEntry["terminalStatus"]; closeReason: "terminal" | "client_cancel" }) => {
+    if (!logIds || nativeLogged) return;
+    nativeLogged = true;
+    addFinalRequestLog(logIds.requestId, logIds.start, logCtx, status, meta);
+  };
+  const upstream = await handleResponses(internalReq, config, logCtx, {
+    abortSignal: req.signal,
+    ...(logIds ? { onFirstOutput: () => recordFirstOutput(logCtx, logIds.start) } : {}),
+    onNativePassthroughTerminal: status => finalizeNativeLog(httpStatusForTerminalStatus(status), { terminalStatus: status, closeReason: "terminal" }),
+    onNativePassthroughCancel: () => finalizeNativeLog(499, { closeReason: "client_cancel" }),
+  });
+  const response = logIds
+    ? responseWithDeferredRequestLog(upstream, logIds.requestId, logIds.start, logCtx)
+    : upstream;
+
+  if (!response.ok) {
+    let message = `upstream error (${response.status})`;
+    try {
+      const text = await response.text();
+      try {
+        const parsed = JSON.parse(text) as { error?: { message?: string; type?: string } | string; message?: string };
+        const nested = typeof parsed?.error === "object" && parsed.error ? parsed.error.message : undefined;
+        const flat = typeof parsed?.error === "string" ? parsed.error : parsed?.message;
+        message = nested || flat || (text ? `upstream error (${response.status}): ${text.slice(0, 400)}` : message);
+      } catch {
+        if (text) message = `upstream error (${response.status}): ${text.slice(0, 400)}`;
+      }
+    } catch { /* keep fallback */ }
+    const retryAfter = response.headers.get("retry-after");
+    return new Response(JSON.stringify({
+      error: {
+        message,
+        type: response.status === 401 ? "authentication_error"
+          : response.status === 429 ? "rate_limit_error"
+          : response.status >= 500 ? "server_error"
+          : "invalid_request_error",
+        param: null,
+        code: null,
+      },
+    }), {
+      status: response.status,
+      headers: {
+        "Content-Type": "application/json",
+        ...(retryAfter ? { "Retry-After": retryAfter } : {}),
+      },
+    });
+  }
+
+  const contentType = response.headers.get("content-type") ?? "";
+  if (contentType.includes("text/event-stream") && response.body) {
+    const chatSse = responsesSseToChatCompletionsSse(response.body, requestedModel);
+    if (stream) {
+      // Stream failures surface as an error SSE frame then abort the body — never a
+      // success completion that embeds `[error] ...` + clean [DONE].
+      return new Response(chatSse, {
+        status: 200,
+        headers: {
+          "Content-Type": "text/event-stream; charset=utf-8",
+          "Cache-Control": "no-cache",
+          Connection: "keep-alive",
+        },
+      });
+    }
+    try {
+      const completion = await collectChatCompletion(chatSse, requestedModel);
+      return new Response(JSON.stringify(completion), {
+        status: 200,
+        headers: { "Content-Type": "application/json" },
+      });
+    } catch (err) {
+      if (isChatCompletionsStreamError(err)) {
+        return chatCompletionsErrorResponse(err.status, err.message, err.type);
+      }
+      return chatCompletionsErrorResponse(
+        502,
+        err instanceof Error ? err.message : String(err),
+        "server_error",
+      );
+    }
+  }
+
+  // Defensive: JSON despite stream:true.
+  let json: unknown;
+  try {
+    json = await response.json();
+  } catch {
+    return chatCompletionsErrorResponse(502, "internal replay returned a non-JSON response", "server_error");
+  }
+  const status = (json as Rec)?.status;
+  if (status === "failed") {
+    const error = (json as { error?: { message?: string } }).error;
+    return chatCompletionsErrorResponse(502, error?.message ?? "upstream request failed", "server_error");
+  }
+  const completion = responsesJsonToChatCompletion(json, requestedModel);
+  if (!stream) {
+    return new Response(JSON.stringify(completion), {
+      status: 200,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
+
+  // Streaming client + JSON upstream: synthesize a minimal Chat Completions stream.
+  const encoder = new TextEncoder();
+  const id = typeof completion.id === "string" ? completion.id : `chatcmpl-${Date.now()}`;
+  const created = typeof completion.created === "number" ? completion.created : Math.floor(Date.now() / 1000);
+  const message = isRec((completion.choices as Rec[] | undefined)?.[0])
+    ? ((completion.choices as Rec[])[0] as Rec).message as Rec | undefined
+    : undefined;
+  const content = message && typeof message.content === "string" ? message.content : "";
+  const frames = [
+    `data: ${JSON.stringify({ id, object: "chat.completion.chunk", created, model: requestedModel, choices: [{ index: 0, delta: { role: "assistant", content: "" }, finish_reason: null }] })}\n\n`,
+    ...(content
+      ? [`data: ${JSON.stringify({ id, object: "chat.completion.chunk", created, model: requestedModel, choices: [{ index: 0, delta: { content }, finish_reason: null }] })}\n\n`]
+      : []),
+    `data: ${JSON.stringify({ id, object: "chat.completion.chunk", created, model: requestedModel, choices: [{ index: 0, delta: {}, finish_reason: "stop" }], usage: completion.usage })}\n\n`,
+    "data: [DONE]\n\n",
+  ];
+  return new Response(encoder.encode(frames.join("")), {
+    status: 200,
+    headers: {
+      "Content-Type": "text/event-stream; charset=utf-8",
+      "Cache-Control": "no-cache",
+    },
+  });
+}

package/src/server/gui-static.ts

@@ -92,6 +92,7 @@ export function rootFallbackPayload() {
       health: "/healthz",
       models: "/v1/models",
       responses: "/v1/responses",
+      chatCompletions: "/v1/chat/completions",
       management: "/api/*",
     },
   };

package/src/server/index.ts

@@ -117,6 +117,7 @@ export {
 import { disableResponsesRequestTimeout, handleResponses, handleResponsesCompact } from "./responses";
 export { disableResponsesRequestTimeout, linkAbortSignal } from "./responses";
 import { handleClaudeCountTokens, handleClaudeMessages } from "./claude-messages";
+import { handleChatCompletions } from "./chat-completions";
 import { anthropicErrorResponse } from "../claude/outbound";
 import { buildDesktop3pRegistry } from "../claude/desktop-3p";
 import { handleImages } from "./images";
@@ -248,6 +249,9 @@ export function startServer(port?: number) {
       }
 
       if (url.pathname === "/v1/models" && req.method === "GET") {
+        // Model discovery never forwards Authorization upstream, so the broader admission
+        // set (Authorization / x-api-key / x-opencodex-api-key) is safe here and required by
+        // remote OpenAI-style bearer clients and Claude gateway discovery (anthropic-version).
         const apiAuthError = requireApiAuth(req, config, "data-plane");
         if (apiAuthError) return withCors(apiAuthError, req, config);
         if (!isAllowedRequestOrigin(req, config)) {
@@ -467,6 +471,25 @@ export function startServer(port?: number) {
         return withCors(response, req, config);
       }
 
+
+      // OpenAI Chat Completions inbound (GitHub Copilot App / OpenAI-compatible clients).
+      if (url.pathname === "/v1/chat/completions" && req.method === "POST") {
+        disableResponsesRequestTimeout(req, requestServer);
+        if (isDraining()) {
+          return new Response("Service shutting down", { status: 503, headers: { ...corsHeaders(req, config), "Retry-After": "5" } });
+        }
+        const apiAuthError = requireResponsesApiAuth(req, config);
+        if (apiAuthError) return withCors(apiAuthError, req, config);
+        if (!isAllowedRequestOrigin(req, config)) {
+          return withCors(formatErrorResponse(403, "origin_rejected", "cross-origin data-plane request blocked"), req, config);
+        }
+        const start = Date.now();
+        const requestId = nextRequestLogId(start);
+        const logCtx: RequestLogContext = { model: "unknown", provider: "unknown" };
+        const response = await handleChatCompletions(req, config, logCtx, { requestId, start });
+        return withCors(response, req, config);
+      }
+
       // Data-plane guard: unknown /v1/* paths must fail with JSON 404, never fall through to the
       // GUI static handler (extensionless paths would get index.html with HTTP 200 and codex-rs
       // endpoint clients — memories/*, realtime/* — would surface confusing
@@ -620,6 +643,7 @@ export function startServer(port?: number) {
 
   console.log(`🚀 opencodex proxy running on http://localhost:${actualPort}`);
   console.log(`   POST /v1/responses → provider translation`);
+  console.log(`   POST /v1/chat/completions → OpenAI-compatible clients`);
   console.log(`   GET  /healthz      → health check`);
   console.log(`   GET  /api/*        → management API`);
   console.log(`   GET  /             → GUI dashboard`);

package/src/server/management-api.ts

@@ -526,6 +526,9 @@ export async function handleManagementAPI(req: Request, url: URL, config: OcxCon
       name, adapter: p.adapter, baseUrl: publicProviderBaseUrl(p.baseUrl), defaultModel: p.defaultModel,
       hasApiKey: !!p.apiKey,
       allowPrivateNetwork: p.allowPrivateNetwork === true,
+      liveModels: p.liveModels !== false,
+      models: p.models ?? [],
+      authMode: p.authMode,
       disabled: p.disabled === true,
       codexAccountMode: providerCodexAccountMode(name, p),
     })));
@@ -673,6 +676,12 @@ export async function handleManagementAPI(req: Request, url: URL, config: OcxCon
      touched = true;
    }
 
+   if (Object.hasOwn(rawBody, "liveModels")) {
+     if (typeof rawBody.liveModels !== "boolean") return jsonResponse({ error: "liveModels must be a boolean" }, 400);
+     next.liveModels = rawBody.liveModels;
+     touched = true;
+   }
+
     if (!touched) return jsonResponse({ error: "no recognized fields to update" }, 400);
 
     // A disabled-only toggle preserves the v2 fast lane: it changes routing eligibility,

package/src/server/responses.ts

@@ -509,6 +509,31 @@ export function sidecarOutcomeRecorder(
     : undefined;
 }
 
+/** Codex client hard-coded helper/shadow models: 0.145.0 uses gpt-5.6-luna; older clients gpt-5.4-mini. */
+const DEFAULT_SHADOW_SOURCE_MODELS = ["gpt-5.4-mini", "gpt-5.6-luna"] as const;
+
+/**
+ * True when `modelId` is a Codex client shadow/helper source model eligible for the
+ * shadowCallIntercept rewrite. Slash-prefixed ids (`openai/gpt-5.6-luna`) are deliberate
+ * routed requests, never client shadow calls — hard-excluded even for configured
+ * overrides. `configured` arrives unvalidated from disk (config.ts top-level parse is
+ * passthrough), so non-string entries are filtered rather than trusted.
+ *
+ * Known tradeoff (issue #311 review): matching is model-id based, so with the intercept
+ * enabled a FOREGROUND bare `gpt-5.6-luna` turn is also rewritten — the same blunt
+ * "ALL matching requests" semantics the feature has always documented for gpt-5.4-mini.
+ * The proxy has no reliable helper-call signal in the request today; users who run Luna
+ * as a foreground model can scope the intercept with `sourceModels: ["gpt-5.4-mini"]`.
+ */
+export function isShadowSourceModel(modelId: string, configured?: unknown): boolean {
+  if (modelId.includes("/")) return false;
+  const configuredStrings = Array.isArray(configured)
+    ? configured.filter((v): v is string => typeof v === "string" && v.trim() !== "")
+    : [];
+  const prefixes = configuredStrings.length > 0 ? configuredStrings : DEFAULT_SHADOW_SOURCE_MODELS;
+  return prefixes.some(prefix => modelId.startsWith(prefix.trim()));
+}
+
 /** Account id to attribute log labels / upstream outcomes to (pool + rotation-injected main). */
 export function codexLogAccountId(authCtx: CodexAuthContext): string | null {
   return authCtx.kind === "pool" || authCtx.kind === "main-pool" ? authCtx.accountId : null;
@@ -946,9 +971,10 @@ export async function handleResponses(
   logCtx.configuredServiceTier = readConfiguredCodexServiceTier();
   logCtx.configuredSpeedLabel = requestLogSpeedLabel(logCtx.configuredServiceTier);
 
-  // Shadow call intercept: rewrite Codex Desktop's hard-coded gpt-5.4-mini helper calls
+  // Shadow call intercept: rewrite Codex's hard-coded helper calls
+  // (gpt-5.4-mini on older clients, gpt-5.6-luna on 0.145.0+)
   const _sci = config.shadowCallIntercept;
-  if (_sci?.enabled && _sci.model && parsed.modelId.startsWith("gpt-5.4-mini")) {
+  if (_sci?.enabled && _sci.model && isShadowSourceModel(parsed.modelId, _sci.sourceModels)) {
     const _sciOriginal = parsed.modelId;
     parsed.modelId = _sci.model;
     if (parsed._rawBody && typeof parsed._rawBody === "object") {

package/src/types.ts

@@ -482,15 +482,18 @@ export interface OcxConfig {
   /** 사용자가 대시보드에서 직접 추가한 커스텀 모델 목록. */
   customModels?: OcxCustomModel[];
   /**
-   * Shadow call intercept: redirect Codex Desktop's hard-coded gpt-5.4-mini helper calls
-   * (title generation, commit messages, skill orchestration) to a user-chosen model.
+   * Shadow call intercept: redirect Codex's hard-coded helper calls (title generation,
+   * commit messages, skill orchestration) to a user-chosen model. Default intercepted
+   * source models: gpt-5.4-mini (older clients) and gpt-5.6-luna (Codex 0.145.0+).
    * Opt-in; disabled by default. When enabled, effort is forced to low.
    */
   shadowCallIntercept?: {
-    /** When true, all gpt-5.4-mini* requests are rewritten to the configured model. */
+    /** When true, requests for known shadow/helper source models are rewritten to the configured model. */
     enabled?: boolean;
     /** Replacement model id (e.g. "gpt-5.5"). */
     model?: string;
+    /** Optional override of intercepted source-model prefixes (default: gpt-5.4-mini, gpt-5.6-luna). */
+    sourceModels?: string[];
   };
   /**
    * 3-state multi-agent surface override: