npm - @bitkyc08/opencodex - Versions diffs - 2.7.4 → 2.7.7 - Mend

@bitkyc08/opencodex 2.7.4 → 2.7.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (34) hide show

package/README.ko.md +6 -3
package/README.md +6 -4
package/README.zh-CN.md +4 -3
package/gui/dist/assets/index-C0xVu72_.css +1 -0
package/gui/dist/assets/index-DzEDGLZh.js +40 -0
package/gui/dist/index.html +2 -2
package/package.json +1 -1
package/src/adapters/anthropic.ts +30 -2
package/src/adapters/base.ts +10 -0
package/src/adapters/google-http.ts +37 -13
package/src/adapters/google-tool-schema.ts +5 -0
package/src/adapters/google.ts +3 -0
package/src/adapters/kiro-retry.ts +33 -13
package/src/adapters/kiro-tools.ts +4 -0
package/src/adapters/kiro.ts +5 -1
package/src/adapters/openai-responses.ts +42 -0
package/src/codex/catalog.ts +77 -7
package/src/lib/abort.ts +40 -0
package/src/lib/bounded-body.ts +202 -0
package/src/providers/registry.ts +8 -1
package/src/reasoning-effort.ts +5 -0
package/src/server/auth-cors.ts +16 -13
package/src/server/effort-policy.ts +172 -0
package/src/server/images.ts +218 -0
package/src/server/index.ts +57 -2
package/src/server/management-api.ts +28 -0
package/src/server/responses.ts +29 -1
package/src/server/search.ts +150 -0
package/src/types.ts +37 -0
package/src/web-search/index.ts +44 -10
package/src/web-search/loop.ts +165 -112
package/src/web-search/progress-stream.ts +329 -0
package/gui/dist/assets/index-66dPs6l_.js +0 -40
package/gui/dist/assets/index-D7o1qwy-.css +0 -1

package/gui/dist/index.html CHANGED Viewed

@@ -16,8 +16,8 @@
         } catch (e) {}
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-66dPs6l_.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-D7o1qwy-.css">
+    <script type="module" crossorigin src="/assets/index-DzEDGLZh.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-C0xVu72_.css">
   </head>
   <body>
     <div id="root"></div>

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@bitkyc08/opencodex",
-  "version": "2.7.4",
+  "version": "2.7.7",
   "description": "Universal provider proxy for OpenAI Codex — use any LLM with Codex CLI/App/SDK",
   "type": "module",
   "main": "./bin/package-main.mjs",

package/src/adapters/anthropic.ts CHANGED Viewed

@@ -487,9 +487,37 @@ function toolsToAnthropicFormat(parsed: OcxParsedRequest, toolNames: { toWire: (
   return converted;
 }
+// Codex multi-agent v2 stamps a Responses-only `encrypted: true` marker on
+// collaboration tool schemas (openai/codex 5f4d06ef; issue #85). It is an
+// annotation for the ChatGPT backend only. Anthropic input_schema is strict
+// JSON Schema; strip the marker defensively everywhere it can appear as a
+// schema keyword, while preserving properties literally named "encrypted".
+const ENCRYPTED_MARKER_NAME_BAG_KEYS = new Set(["properties", "patternProperties", "$defs", "definitions"]);
+const ENCRYPTED_MARKER_LITERAL_VALUE_KEYS = new Set(["const", "default", "enum", "examples"]);
+function stripEncryptedMarker(node: unknown, inNameBag = false): unknown {
+  if (Array.isArray(node)) return node.map(item => stripEncryptedMarker(item));
+  if (!node || typeof node !== "object") return node;
+  const out: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(node as Record<string, unknown>)) {
+    if (inNameBag) {
+      out[key] = stripEncryptedMarker(value);
+    } else if (key !== "encrypted") {
+      out[key] = ENCRYPTED_MARKER_LITERAL_VALUE_KEYS.has(key)
+        ? value
+        : stripEncryptedMarker(value, ENCRYPTED_MARKER_NAME_BAG_KEYS.has(key));
+    }
+  }
+  return out;
+}
 function normalizeAnthropicInputSchema(schema: unknown): Record<string, unknown> {
-  const obj = schema && typeof schema === "object" && !Array.isArray(schema)
-    ? schema as Record<string, unknown>
+  const stripped = stripEncryptedMarker(schema);
+  const obj = stripped && typeof stripped === "object" && !Array.isArray(stripped)
+    ? stripped as Record<string, unknown>
     : {};
   // Anthropic rejects root-level missing type and oneOf/anyOf/allOf in input_schema.
   // Normalize the root only: ensure type:"object" + properties, flatten root composition

package/src/adapters/base.ts CHANGED Viewed

@@ -9,6 +9,12 @@ export interface IncomingMeta {
 export interface ProviderAdapter {
   name: string;
+  /**
+   * Convert an already-read provider HTTP error into client-safe text. This hook must be pure and
+   * return fully redacted output: callers may pass untrusted provider headers and payload text.
+   */
+  formatErrorBody?(status: number, headers: Headers, payloadText: string): string;
   /**
    * Build the upstream request. May be async: adapters that resolve a short-lived credential
    * (e.g. Vertex AI ADC token) return a Promise. Sync adapters return the object directly; callers
@@ -39,6 +45,10 @@ export interface AdapterRequest {
 }
 export interface AdapterFetchContext {
+  /** Remains attached to the returned response body after the response headers arrive. */
   abortSignal?: AbortSignal;
+  /** Deadline for receiving response headers on each attempt, not for consuming the response body. */
   timeoutMs?: number;
+  /** Return final non-2xx responses untouched so the caller can own the error-body read. */
+  returnRawErrors?: boolean;
 }

package/src/adapters/google-http.ts CHANGED Viewed

@@ -1,5 +1,7 @@
 import type { AdapterFetchContext, AdapterRequest } from "./base";
 import { isQuotaExhaustedBody, retryableGoogleStatus, safeGoogleHttpErrorMessage } from "./google-errors";
+import { clearableDeadline } from "../lib/abort";
+import { readBoundedResponseBody } from "../lib/bounded-body";
 import { abortError, sleepWithAbort } from "../lib/upstream-retry";
 const GOOGLE_RETRY_ATTEMPTS = 3;
@@ -23,14 +25,28 @@ function retryDelayMs(attempt: number, headers?: Headers): number {
   return Math.floor(exp * (0.8 + Math.random() * 0.4));
 }
-function signalWithAttemptTimeout(parent: AbortSignal | undefined, timeoutMs: number): AbortSignal {
-  const timeout = AbortSignal.timeout(timeoutMs);
-  return parent ? AbortSignal.any([parent, timeout]) : timeout;
+function cancelResponseBodyBestEffort(res: Response): void {
+  try {
+    const cancellation = res.body?.cancel();
+    if (cancellation) void cancellation.catch(() => {});
+  } catch {
+    // Cancellation is cleanup only; retries must not wait for or fail because of it.
+  }
 }
-async function normalizeFinalGoogleError(label: string, res: Response): Promise<Response> {
+async function boundedBodyText(res: Response, signal?: AbortSignal): Promise<string> {
+  try {
+    const body = await readBoundedResponseBody(res, { signal });
+    return body.displaySafe ? body.text : "";
+  } catch (error) {
+    if (signal?.aborted) throw error;
+    return "";
+  }
+}
+async function normalizeFinalGoogleError(label: string, res: Response, signal?: AbortSignal): Promise<Response> {
   if (res.ok) return res;
-  const payloadText = await res.clone().text().catch(() => "");
+  const payloadText = await boundedBodyText(res, signal);
   const headers = new Headers(res.headers);
   headers.delete("content-encoding");
   headers.delete("content-length");
@@ -51,17 +67,25 @@ export async function fetchGoogleWithRetry(label: string, request: AdapterReques
   for (let attempt = 0; attempt < GOOGLE_RETRY_ATTEMPTS; attempt++) {
     if (ctx.abortSignal?.aborted) throw abortError(ctx.abortSignal);
     try {
-      const res = await fetch(request.url, {
-        method: request.method, headers: request.headers, body: request.body,
-        signal: signalWithAttemptTimeout(ctx.abortSignal, timeoutMs),
-      });
+      const attemptTimeout = clearableDeadline(timeoutMs, ctx.abortSignal);
+      let res: Response;
+      try {
+        res = await fetch(request.url, {
+          method: request.method, headers: request.headers, body: request.body,
+          signal: attemptTimeout.signal,
+        });
+      } finally {
+        // Only the header timer is cleared. The composed signal still contains the parent, so a
+        // caller abort after headers continue to cancel consumption of the returned response body.
+        attemptTimeout.clear();
+      }
       if (!retryableGoogleStatus(res.status) || attempt === GOOGLE_RETRY_ATTEMPTS - 1) {
-        return normalizeFinalGoogleError(label, res);
+        return ctx.returnRawErrors ? res : normalizeFinalGoogleError(label, res, ctx.abortSignal);
       }
       // A 429 may be a transient rate limit (retry) or hard quota exhaustion (do NOT retry —
       // it won't recover for hours and burns retries). Peek the body to tell them apart.
-      if (res.status === 429) {
-        const peek = await res.clone().text().catch(() => "");
+      if (res.status === 429 && !ctx.returnRawErrors) {
+        const peek = await boundedBodyText(res, ctx.abortSignal);
         if (isQuotaExhaustedBody(peek)) {
           const headers = new Headers(res.headers);
           headers.delete("content-encoding");
@@ -71,7 +95,7 @@ export async function fetchGoogleWithRetry(label: string, request: AdapterReques
           });
         }
       }
-      await res.body?.cancel().catch(() => {});
+      cancelResponseBodyBestEffort(res);
       await sleepWithAbort(retryDelayMs(attempt, res.headers), ctx.abortSignal);
     } catch (err) {
       if (ctx.abortSignal?.aborted) throw err;

package/src/adapters/google-tool-schema.ts CHANGED Viewed

@@ -4,11 +4,16 @@ type Schema = Record<string, unknown>;
 // emits full JSON-Schema (draft 2020-12) tool definitions, so passing them through verbatim makes
 // CCA reject the whole request with "Request contains an invalid argument" / "Unknown name ...".
 // Every keyword below was confirmed live against the Antigravity backend to trigger a 400.
+// `encrypted` is Codex's Responses-only marker (openai/codex 5f4d06ef, PR #26210) stamped on v2
+// collaboration tool schemas (spawn_agent/send_message/followup_task `message`); CCA rejects it
+// with 400 "Unknown name \"encrypted\"" (issue #85). It is an annotation for the ChatGPT backend
+// only, so dropping it never changes tool behavior.
 const DROPPED_SCHEMA_KEYS = new Set([
   "$schema", "$id", "$comment", "$ref", "$defs", "definitions",
   "examples", "patternProperties", "if", "then", "else",
   "uniqueItems", "additionalItems", "unevaluatedProperties", "unevaluatedItems",
   "dependentRequired", "dependentSchemas", "propertyNames", "contains",
+  "encrypted",
 ]);
 const MAX_DEREF_DEPTH = 64;

package/src/adapters/google.ts CHANGED Viewed

@@ -15,6 +15,7 @@ import { isAllowedToolChoice, namespacedToolName, toolAllowedByChoice } from "..
 import { contentPartsToText, parseDataUrl } from "./image";
 import { getVertexAccessToken } from "../lib/gcp-adc";
 import { fetchAntigravityWithRetry, fetchVertexWithRetry } from "./google-http";
+import { safeAntigravityHttpErrorMessage, safeVertexHttpErrorMessage } from "./google-errors";
 import { isVertexTruncationReason, vertexTruncationErrorMessage } from "./google-truncation";
 import { ANTIGRAVITY_REQUEST_UA, antigravitySessionId, isLikelyRealThoughtSignature, sanitizeAntigravityClaudeSignatures } from "./google-antigravity-wire";
 import { sanitizeGeminiToolParameters } from "./google-tool-schema";
@@ -206,6 +207,8 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
       ? {
           fetchResponse: (request: AdapterRequest, ctx?: AdapterFetchContext): Promise<Response> =>
             (provider.googleMode === "cloud-code-assist" ? fetchAntigravityWithRetry : fetchVertexWithRetry)(request, ctx),
+          formatErrorBody: (status: number, _headers: Headers, payloadText: string): string =>
+            (provider.googleMode === "cloud-code-assist" ? safeAntigravityHttpErrorMessage : safeVertexHttpErrorMessage)(status, payloadText),
         }
       : {}),

package/src/adapters/kiro-retry.ts CHANGED Viewed

@@ -1,5 +1,7 @@
 import type { AdapterFetchContext, AdapterRequest } from "./base";
 import { safeKiroHttpErrorMessage } from "./kiro-errors";
+import { clearableDeadline } from "../lib/abort";
+import { readBoundedResponseBody } from "../lib/bounded-body";
 import { abortError, isConnectionResetError, sleepWithAbort } from "../lib/upstream-retry";
 const KIRO_RETRY_ATTEMPTS = 3;
@@ -27,18 +29,28 @@ function retryDelayMs(attempt: number, headers?: Headers): number {
   return Math.floor(exp * (0.8 + Math.random() * 0.4));
 }
-function signalWithAttemptTimeout(parent: AbortSignal | undefined, timeoutMs: number): AbortSignal {
-  const timeout = AbortSignal.timeout(timeoutMs);
-  return parent ? AbortSignal.any([parent, timeout]) : timeout;
+function cancelResponseBodyBestEffort(res: Response): void {
+  try {
+    const cancellation = res.body?.cancel();
+    if (cancellation) void cancellation.catch(() => {});
+  } catch {
+    // Cancellation is cleanup only; retries must not wait for or fail because of it.
+  }
 }
 function retryableKiroFetchError(err: unknown): boolean {
   return isConnectionResetError(err) || (err instanceof Error && err.name === "TimeoutError");
 }
-async function normalizeFinalKiroHttpError(res: Response): Promise<Response> {
+async function normalizeFinalKiroHttpError(res: Response, signal?: AbortSignal): Promise<Response> {
   if (res.ok) return res;
-  const payloadText = await res.clone().text().catch(() => "");
+  let payloadText = "";
+  try {
+    const body = await readBoundedResponseBody(res, { signal });
+    if (body.displaySafe) payloadText = body.text;
+  } catch (error) {
+    if (signal?.aborted) throw error;
+  }
   const headers = new Headers(res.headers);
   headers.delete("content-encoding");
   headers.delete("content-length");
@@ -55,14 +67,22 @@ export async function fetchKiroWithRetry(request: AdapterRequest, ctx: AdapterFe
   for (let attempt = 0; attempt < KIRO_RETRY_ATTEMPTS; attempt++) {
     if (ctx.abortSignal?.aborted) throw abortError(ctx.abortSignal);
     try {
-      const res = await fetch(request.url, {
-        method: request.method,
-        headers: request.headers,
-        body: request.body,
-        signal: signalWithAttemptTimeout(ctx.abortSignal, timeoutMs),
-      });
-      if (!retryableKiroStatus(res.status) || attempt === KIRO_RETRY_ATTEMPTS - 1) return normalizeFinalKiroHttpError(res);
-      await res.body?.cancel().catch(() => {});
+      const attemptTimeout = clearableDeadline(timeoutMs, ctx.abortSignal);
+      let res: Response;
+      try {
+        res = await fetch(request.url, {
+          method: request.method,
+          headers: request.headers,
+          body: request.body,
+          signal: attemptTimeout.signal,
+        });
+      } finally {
+        attemptTimeout.clear();
+      }
+      if (!retryableKiroStatus(res.status) || attempt === KIRO_RETRY_ATTEMPTS - 1) {
+        return ctx.returnRawErrors ? res : normalizeFinalKiroHttpError(res, ctx.abortSignal);
+      }
+      cancelResponseBodyBestEffort(res);
       await sleepWithAbort(retryDelayMs(attempt, res.headers), ctx.abortSignal);
     } catch (err) {
       if (ctx.abortSignal?.aborted) throw err;

package/src/adapters/kiro-tools.ts CHANGED Viewed

@@ -41,6 +41,10 @@ const KIRO_REJECTED_SCHEMA_KEYS = new Set([
   "contains",
   "unevaluatedProperties",
   "unevaluatedItems",
+  // Codex's Responses-only `encrypted: true` marker (openai/codex 5f4d06ef) stamped on v2
+  // collaboration tool schemas. Kiro/Bedrock validators reject a narrower, undocumented schema
+  // subset (issue #85 class); the marker is a ChatGPT-backend annotation with no meaning here.
+  "encrypted",
 ]);
 // Keys whose values are maps of *property/definition name -> schema* (not schema keywords). Their

package/src/adapters/kiro.ts CHANGED Viewed

@@ -5,7 +5,7 @@ import { resolveKiroApiRegion, resolveKiroProfileArn } from "../oauth/kiro";
 import { KIRO_MODEL_CONTEXT_WINDOWS, normalizeKiroModelId } from "../providers/kiro-models";
 import { modelRecordValue } from "../reasoning-effort";
 import { parseKiroEvent } from "./kiro-events";
-import { safeKiroErrorMessage } from "./kiro-errors";
+import { safeKiroErrorMessage, safeKiroHttpErrorMessage } from "./kiro-errors";
 import { appendFallbackText, toolCallFallbackText, toolResultFallbackText } from "./kiro-tool-fallback";
 import { KiroThinkingParser } from "./kiro-thinking";
 import { isCompleteKiroToolInput, kiroTruncationErrorMessage } from "./kiro-truncation";
@@ -552,6 +552,10 @@ export function createKiroAdapter(provider: OcxProviderConfig): ProviderAdapter
       return fetchKiroWithRetry(request, ctx);
     },
+    formatErrorBody(status: number, headers: Headers, payloadText: string): string {
+      return safeKiroHttpErrorMessage(status, headers, payloadText);
+    },
     // Non-streaming path used by the web-search sidecar loop (loop.ts runs each iteration
     // non-streamed so it can inspect tool calls). CW only ever event-streams, so we drain the
     // same decoder into an array. Without this, any Codex request that includes the web_search

package/src/adapters/openai-responses.ts CHANGED Viewed

@@ -21,6 +21,7 @@ export const FORWARD_HEADERS = [
   "x-codex-turn-state",
   "x-codex-window-id",
   "x-oai-attestation",
+  "x-openai-subagent",
   "x-responsesapi-include-timing-metrics",
 ];
@@ -174,6 +175,46 @@ function stripPreviousResponseId(body: unknown, strip: boolean): unknown {
   return rest;
 }
+/**
+ * Hosted tool types whose server-side function names collide with the client tools Codex
+ * declares for the matching app skill. Codex sends BOTH (e.g. hosted `image_generation` plus a
+ * declared `image_gen.imagegen` function/namespace tool for the imagegen skill). The ChatGPT
+ * backend tolerates the pair, but the platform `/v1/responses` rejects it:
+ * `Invalid Value: 'tools'. Function 'image_gen.imagegen' conflicts with a hosted tool in the
+ * same request.` Keyed hosted-type → conflicting client tool-name prefix; the hosted entry is
+ * dropped (the declared tool wins — Codex executes the skill client-side either way).
+ */
+const HOSTED_TOOL_NAME_CONFLICTS: ReadonlyArray<{ hostedType: string; namePrefix: string }> = [
+  { hostedType: "image_generation", namePrefix: "image_gen" },
+];
+/**
+ * Drop hosted tools whose names collide with declared function/namespace tools (see
+ * HOSTED_TOOL_NAME_CONFLICTS). Only applies on the API-key platform path: the ChatGPT backend
+ * ("forward" mode) accepts the pair, and stripping there would disable native imagegen. No-op
+ * (returns the original reference) when nothing matches.
+ */
+function stripConflictingHostedTools(body: unknown): unknown {
+  if (!isPlainObject(body) || !Array.isArray(body.tools)) return body;
+  const allTools = body.tools;
+  const conflicting = HOSTED_TOOL_NAME_CONFLICTS.filter(c =>
+    allTools.some(t => {
+      if (!isPlainObject(t) || typeof t.name !== "string") return false;
+      if (t.type === "namespace") return t.name === c.namePrefix;
+      return t.name === c.namePrefix || t.name.startsWith(`${c.namePrefix}.`);
+    }),
+  );
+  if (conflicting.length === 0) return body;
+  const tools = allTools.filter(t => {
+    const type = isPlainObject(t) && typeof t.type === "string" ? t.type : undefined;
+    if (!type) return true;
+    return !conflicting.some(c => c.hostedType === type);
+  });
+  return tools.length === allTools.length ? body : { ...body, tools };
+}
 /**
  * Remove hosted tool entries the target native slug rejects, so the OAuth-passthrough body never
  * carries a tool the upstream model 400s on. No-op (returns the original reference) when nothing
@@ -236,6 +277,7 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
         forward || parsed._previousResponseInputExpanded === true,
       );
       if (forward) outBody = repairOrphanedInputItems(outBody, unexpandedMiss);
+      else outBody = stripConflictingHostedTools(outBody);
       return {
         url,
         method: "POST",

package/src/codex/catalog.ts CHANGED Viewed

@@ -303,6 +303,20 @@ type RawEntry = Record<string, unknown>;
 type RawCatalog = { models?: RawEntry[]; [k: string]: unknown };
 const JAWCODE_CATALOG_AUGMENT_PROVIDERS = new Set(["opencode-go"]);
+/**
+ * Exact provider/model pairs whose discovery endpoint advertises them but whose inference backend
+ * rejects them. Apply this after live/static/metadata sources converge so no source can resurrect
+ * an uncallable picker row. Remove an entry once authenticated inference proves it usable again.
+ */
+const ROUTED_MODEL_COMPATIBILITY_EXCLUSIONS = new Set([
+  // Issue #82: Zen Go /models advertises HY3, but Console Go rejects it as outside the lite list.
+  "opencode-go/hy3-preview",
+]);
+function isRoutedModelCompatibilityExcluded(slug: string): boolean {
+  return ROUTED_MODEL_COMPATIBILITY_EXCLUSIONS.has(slug);
+}
 /**
  * Image/video GENERATION model families. opencodex routes chat/coding models into Codex; media-
  * generation models (Grok image/video, DALL·E, Imagen, Sora, Veo, …) are useless to a coding agent
@@ -328,6 +342,7 @@ export function isMediaGenerationModelId(id: string): boolean {
 }
 function shouldExposeRoutedModel(model: CatalogModel): boolean {
+  if (isRoutedModelCompatibilityExcluded(`${model.provider}/${model.id}`)) return false;
   if (model.provider === "cursor" && model.id === "gemini-3-pro-image-preview") return true;
   return !isMediaGenerationModelId(model.id);
 }
@@ -554,6 +569,18 @@ function codexCommandCandidates(): string[] {
   return unique(candidates);
 }
+/**
+ * Windows probe guard: only PE/batch launchers can be spawned as processes. Anything
+ * else pulled from the shim state (the extensionless Git-Bash sh backup
+ * `codex.opencodex-real`, `.ps1` scripts) risks falling through to the cmd/ShellExecute
+ * document-association path — Windows then OPENS the file in the user's editor
+ * (e.g. VS Code) on every `codex` launch instead of executing it.
+ */
+export function isSpawnableCodexCandidate(path: string, platform: NodeJS.Platform = process.platform): boolean {
+  if (platform !== "win32") return true;
+  return /\.(cmd|bat|exe|com)$/i.test(path);
+}
 function codexShimCommandCandidates(): string[] {
   try {
     const state = JSON.parse(readFileSync(join(getConfigDir(), "codex-shim.json"), "utf8")) as {
@@ -567,7 +594,7 @@ function codexShimCommandCandidates(): string[] {
     for (const file of files) {
       for (const value of [file.backupPath, file.originalPath, file.wrapperPath]) {
         if (typeof value !== "string" || value.length === 0) continue;
-        if (process.platform === "win32" && value.toLowerCase().endsWith(".ps1")) continue;
+        if (!isSpawnableCodexCandidate(value)) continue;
         out.push(value);
       }
     }
@@ -1027,6 +1054,27 @@ function applyConfigHintsToCachedModels(name: string, prov: OcxProviderConfig, m
   return models.map(model => applyProviderConfigHints(name, prov, model, contextCap));
 }
+/**
+ * TRUE when `liveId` is a dated release of the configured alias `configuredId`:
+ * `<configuredId>-YYYYMMDD` (Anthropic's convention for superseded-but-callable models).
+ */
+export function isDatedVariantId(liveId: string, configuredId: string): boolean {
+  if (!liveId.startsWith(`${configuredId}-`)) return false;
+  return /^\d{8}$/.test(liveId.slice(configuredId.length + 1));
+}
+// Same-signature dedupe: Codex polls /v1/models frequently, and an unchanged drop list
+// repeated on every poll is pure noise. Warn once per provider until the id set changes.
+const lastDropWarnSignature = new Map<string, string>();
+function warnDroppedConfiguredIdsOnce(name: string, droppedConfiguredIds: string[]): void {
+  const signature = [...droppedConfiguredIds].sort().join(",");
+  if (lastDropWarnSignature.get(name) === signature) return;
+  lastDropWarnSignature.set(name, signature);
+  console.warn(
+    `[opencodex] Provider model discovery for "${name}" omitted configured model ids; dropping them from the authoritative live catalog: ${droppedConfiguredIds.join(", ")}.`,
+  );
+}
 function isGlm52ModelId(id: string): boolean {
   const normalized = id.toLowerCase();
   return normalized === "glm-5.2" || normalized === "glm-5.2[1m]";
@@ -1133,15 +1181,28 @@ async function fetchProviderModels(name: string, prov: OcxProviderConfig, ttlMs:
       ...catalogHintsFromModelsApiItem(name, m),
     }, contextCap));
     const liveIds = new Set(live.map(m => m.id));
-    const droppedConfiguredIds = configured.filter(m => !liveIds.has(m.id)).map(m => m.id);
+    // Dated-release aliases (Anthropic pattern): older models may appear in the live catalog
+    // ONLY under their dated id (claude-haiku-4-5-20251001) while the config names the
+    // API-valid alias (claude-haiku-4-5). Such aliases are real, callable models — keep them
+    // in the authoritative catalog (alias id, hints from the dated live entry) instead of
+    // dropping them and warning on every poll.
+    const droppedConfiguredIds: string[] = [];
+    for (const m of configured) {
+      if (liveIds.has(m.id)) continue;
+      const dated = live.find(l => isDatedVariantId(l.id, m.id));
+      if (dated) {
+        // Reapply config hints so alias-keyed overrides (modelContextWindows etc.) win.
+        live.push(applyProviderConfigHints(name, prov, { ...dated, id: m.id }, contextCap));
+      } else {
+        droppedConfiguredIds.push(m.id);
+      }
+    }
     if (live.length === 0) {
       console.warn(
         `[opencodex] Provider model discovery for "${name}" returned an authoritative empty catalog; ${droppedConfiguredIds.length > 0 ? `dropping configured model ids: ${droppedConfiguredIds.join(", ")}` : "no models will be exposed"}.`,
       );
     } else if (droppedConfiguredIds.length > 0) {
-      console.warn(
-        `[opencodex] Provider model discovery for "${name}" omitted configured model ids; dropping them from the authoritative live catalog: ${droppedConfiguredIds.join(", ")}.`,
-      );
+      warnDroppedConfiguredIdsOnce(name, droppedConfiguredIds);
     }
     setCached(name, live);
     return live;
@@ -1329,9 +1390,10 @@ export function mergeCatalogEntriesForSync(
   }
   let finalRoutedEntries = routedEntries;
-  if (routedEntries.length === 0 && catalogModels.some(m => typeof m.slug === "string" && (m.slug as string).includes("/"))) {
+  const preservingExistingRouted = routedEntries.length === 0
+    && catalogModels.some(m => typeof m.slug === "string" && (m.slug as string).includes("/"));
+  if (preservingExistingRouted) {
     finalRoutedEntries = catalogModels.filter(m => typeof m.slug === "string" && (m.slug as string).includes("/"));
-    console.warn(`[opencodex] catalog sync: routed model fetch returned empty; preserving ${finalRoutedEntries.length} existing routed entr${finalRoutedEntries.length === 1 ? "y" : "ies"} on disk.`);
   } else {
     const freshSlugs = new Set(routedEntries.flatMap(entry => typeof entry.slug === "string" ? [entry.slug] : []));
     const preservedForeignRouted = catalogModels.filter(m => {
@@ -1341,6 +1403,14 @@ export function mergeCatalogEntriesForSync(
     });
     finalRoutedEntries = [...routedEntries, ...preservedForeignRouted];
   }
+  // Reapply final catalog policy to rows preserved from disk. Those rows bypass
+  // gatherRoutedModels, so filtering only the freshly gathered list can resurrect an excluded id.
+  finalRoutedEntries = finalRoutedEntries.filter(entry =>
+    typeof entry.slug !== "string" || !isRoutedModelCompatibilityExcluded(entry.slug)
+  );
+  if (preservingExistingRouted) {
+    console.warn(`[opencodex] catalog sync: routed model fetch returned empty; preserving ${finalRoutedEntries.length} existing routed entr${finalRoutedEntries.length === 1 ? "y" : "ies"} on disk.`);
+  }
   const mergedEntries = [...native, ...finalRoutedEntries].map(m => {
     const normalized = normalizeServiceTiers(m);

package/src/lib/abort.ts CHANGED Viewed

@@ -3,6 +3,46 @@ export interface LinkedAbortSignal {
   cleanup: () => void;
 }
+export interface ClearableDeadline {
+  /** Parent-linked signal passed to fetch; remains parent-linked after clear(). */
+  signal: AbortSignal;
+  /** Stable reason object used when this deadline wins the abort race. */
+  timeoutReason: DOMException;
+  /** True only when this deadline, rather than the parent, fired first. */
+  didExpire: () => boolean;
+  /** Clear only the timer. Never aborts the deadline controller or detaches the parent. */
+  clear: () => void;
+}
+/**
+ * Response-header deadline whose timer can be cleared without severing body-lifetime cancellation.
+ *
+ * `signalWithTimeout().cleanup()` intentionally removes its parent listener and is therefore suited
+ * to operations that are completely finished at cleanup. A fetch response body is different: once
+ * headers arrive the deadline ends, but the original parent/client signal must remain attached to
+ * the body. `AbortSignal.any()` supplies that direct lifetime link while `clear()` owns only the
+ * timer.
+ */
+export function clearableDeadline(timeoutMs: number, parent?: AbortSignal): ClearableDeadline {
+  const deadline = new AbortController();
+  const timeoutReason = new DOMException("Timeout elapsed", "TimeoutError");
+  let timer: ReturnType<typeof setTimeout> | undefined = setTimeout(() => {
+    timer = undefined;
+    if (!deadline.signal.aborted) deadline.abort(timeoutReason);
+  }, timeoutMs);
+  const signal = parent ? AbortSignal.any([parent, deadline.signal]) : deadline.signal;
+  return {
+    signal,
+    timeoutReason,
+    didExpire: () => signal.aborted && signal.reason === timeoutReason,
+    clear: () => {
+      if (timer !== undefined) clearTimeout(timer);
+      timer = undefined;
+    },
+  };
+}
 export function signalWithTimeout(timeoutMs: number, parent?: AbortSignal): LinkedAbortSignal {
   const controller = new AbortController();
   const timeout = setTimeout(() => {