@bitkyc08/opencodex 2.73.0 → 2.74.0

package/src/providers/registry/entries-extended.ts

@@ -37,6 +37,10 @@ import {
   MINIMAX_MODEL_CONTEXT_WINDOWS,
   MINIMAX_M3_REASONING_EFFORTS,
   MINIMAX_M3_REASONING_EFFORT_MAP,
+  MINIMAX_M31_FLASH_PREVIEW,
+  MINIMAX_M31_REASONING_EFFORTS,
+  MINIMAX_M31_DEFAULT_REASONING_EFFORT,
+  MINIMAX_REASONING_SPLIT_MODELS,
   THINKING_TOGGLE_EFFORTS,
   THINKING_TOGGLE_MAP,
   ZHIPU_BIGMODEL_MODELS,
@@ -1020,22 +1024,24 @@ export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
     id: "minimax", label: "MiniMax — Coding Plan", baseUrl: "https://api.minimax.io/v1", adapter: "openai-chat", authKind: "key",
     dashboardUrl: "https://platform.minimax.io", defaultModel: "MiniMax-M3", models: MINIMAX_MODELS,
     modelContextWindows: MINIMAX_MODEL_CONTEXT_WINDOWS,
-    modelReasoningEfforts: { "MiniMax-M3": MINIMAX_M3_REASONING_EFFORTS },
-    modelDefaultReasoningEfforts: { "MiniMax-M3": "medium" },
+    modelReasoningEfforts: { "MiniMax-M3": MINIMAX_M3_REASONING_EFFORTS, [MINIMAX_M31_FLASH_PREVIEW]: MINIMAX_M31_REASONING_EFFORTS },
+    modelDefaultReasoningEfforts: { "MiniMax-M3": "medium", [MINIMAX_M31_FLASH_PREVIEW]: MINIMAX_M31_DEFAULT_REASONING_EFFORT },
     modelReasoningEffortMap: { "MiniMax-M3": MINIMAX_M3_REASONING_EFFORT_MAP },
     preserveReasoningContentModels: MINIMAX_MODELS,
     // MiniMax-M3 low effort maps to thinking disabled, so a legitimate tool
     // round can carry no reasoning at all; only replay real recorded text,
     // never a fabricated placeholder (chatgpt-codex-connector P2 on #1205).
     requiresReasoningPlaceholderModels: [],
-    reasoningSplitModels: MINIMAX_MODELS,
+    // M3.1-Flash-Preview ignores reasoning_split and always answers with reasoning_content,
+    // so it stays off the split/details lists and replays as a reasoning_content string.
+    reasoningSplitModels: MINIMAX_REASONING_SPLIT_MODELS,
     // With reasoning_split the upstream returns thinking as a structured
     // reasoning_details array (cumulative text snapshots per stream chunk) and
     // requires that array back verbatim on the next turn — a reasoning_content
     // string replay is the native-format pass-back the docs say is unsupported.
     // Evidence: platform.minimax.io/docs/guides/text-m3-function-call and
     // /docs/api-reference/text-openai-api (verified 2026-09-01).
-    reasoningDetailsModels: MINIMAX_MODELS,
+    reasoningDetailsModels: MINIMAX_REASONING_SPLIT_MODELS,
     thinkingToggleModels: ["MiniMax-M3"],
     jawcodeBundle: "minimax", metadataModelIdNormalize: "case-insensitive", note: "Subscription Key or API Key",
   },
@@ -1043,13 +1049,13 @@ export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
     id: "minimax-cn", label: "MiniMax — Coding Plan (CN)", baseUrl: "https://api.minimaxi.com/v1", adapter: "openai-chat", authKind: "key",
     dashboardUrl: "https://platform.minimaxi.com", defaultModel: "MiniMax-M3", models: MINIMAX_MODELS,
     modelContextWindows: MINIMAX_MODEL_CONTEXT_WINDOWS,
-    modelReasoningEfforts: { "MiniMax-M3": MINIMAX_M3_REASONING_EFFORTS },
-    modelDefaultReasoningEfforts: { "MiniMax-M3": "medium" },
+    modelReasoningEfforts: { "MiniMax-M3": MINIMAX_M3_REASONING_EFFORTS, [MINIMAX_M31_FLASH_PREVIEW]: MINIMAX_M31_REASONING_EFFORTS },
+    modelDefaultReasoningEfforts: { "MiniMax-M3": "medium", [MINIMAX_M31_FLASH_PREVIEW]: MINIMAX_M31_DEFAULT_REASONING_EFFORT },
     modelReasoningEffortMap: { "MiniMax-M3": MINIMAX_M3_REASONING_EFFORT_MAP },
     preserveReasoningContentModels: MINIMAX_MODELS,
     requiresReasoningPlaceholderModels: [],
-    reasoningSplitModels: MINIMAX_MODELS,
-    reasoningDetailsModels: MINIMAX_MODELS,
+    reasoningSplitModels: MINIMAX_REASONING_SPLIT_MODELS,
+    reasoningDetailsModels: MINIMAX_REASONING_SPLIT_MODELS,
     thinkingToggleModels: ["MiniMax-M3"],
     jawcodeBundle: "minimax", metadataModelIdNormalize: "case-insensitive", note: "中国区 Subscription Key",
   },

package/src/providers/registry/model-seeds.ts

@@ -123,17 +123,30 @@ export const ZAI_GLM_5X_REASONING_EFFORTS: Record<string, string[]> = {
 };
 // 260710 MiniMax models and context windows: Tier-2 evidence in
 // devlog/_plan/260710_provider_hardening/002_research_cn.md.
+// 260930 MiniMax-M3.1-Flash-Preview: Token Plan / MiniMax Code only, 1M context, thinking
+// always on (effort none or thinking disabled answers 400 code 2013), omitted effort = max.
+// It returns thinking as reasoning_content and ignores reasoning_split. The live /v1/models
+// roster does not list it yet. Evidence: devlog/_plan/260930_minimax_m31_flash_preview/.
+export const MINIMAX_M31_FLASH_PREVIEW = "MiniMax-M3.1-Flash-Preview";
 export const MINIMAX_MODELS = [
+  MINIMAX_M31_FLASH_PREVIEW,
   "MiniMax-M3",
   "MiniMax-M2.7", "MiniMax-M2.7-highspeed",
   "MiniMax-M2.5", "MiniMax-M2.5-highspeed",
   "MiniMax-M2.1", "MiniMax-M2.1-highspeed",
   "MiniMax-M2",
 ];
+/** The eight-id roster every MiniMax preset seeded from 2026-07-10 until the preview landed. */
+export const MINIMAX_MODELS_BEFORE_M31 = MINIMAX_MODELS.filter(id => id !== MINIMAX_M31_FLASH_PREVIEW);
+/** Models that honour reasoning_split and answer with structured reasoning_details. */
+export const MINIMAX_REASONING_SPLIT_MODELS = MINIMAX_MODELS_BEFORE_M31;
 export const MINIMAX_MODEL_CONTEXT_WINDOWS: Record<string, number> = Object.fromEntries(
-  MINIMAX_MODELS.map(id => [id, id === "MiniMax-M3" ? 1_000_000 : 204_800]),
+  MINIMAX_MODELS.map(id => [id, id === "MiniMax-M3" || id === MINIMAX_M31_FLASH_PREVIEW ? 1_000_000 : 204_800]),
 );
 export const MINIMAX_M3_REASONING_EFFORTS = ["low", "medium", "high", "xhigh", "max"];
+/** Identity efforts on the wire; no map, so none omits the field instead of disabling thinking. */
+export const MINIMAX_M31_REASONING_EFFORTS = ["low", "medium", "high", "xhigh", "max"];
+export const MINIMAX_M31_DEFAULT_REASONING_EFFORT = "max";
 export const MINIMAX_M3_REASONING_EFFORT_MAP: Record<string, string> = {
   none: "disabled",
   minimal: "disabled",

package/src/providers/stale-model-roster-migration.ts

@@ -0,0 +1,101 @@
+/**
+ * Add registry models to a saved roster that is still the previous registry seed.
+ *
+ * `enrichProviderFromRegistry` copies the registry's `models` only when a row has none, so
+ * every config saved while an older roster was current keeps that roster forever. That is
+ * the right posture for a hand-edited list and the wrong one for an untouched seed: a model
+ * the vendor added never reaches the install, and when the vendor's live `/models` roster
+ * does not list it either, nothing else can surface it.
+ *
+ * This rewrites one thing: a saved `models` list that is still byte-for-byte the roster
+ * this file names as `from`, on a provider that still carries the registry adapter, and
+ * only while the registry currently seeds `to`. A list the user changed does not match and
+ * is left alone. For each added id it also fills a per-model context window and default
+ * effort, but only inside a container the row already has: enrichment fills those records
+ * all-or-nothing, so creating one here would hide the rest of the registry seed.
+ * Same shape and restraint as `stale-context-window-migration`.
+ */
+import { PROVIDER_REGISTRY } from "./registry";
+import {
+  MINIMAX_M31_DEFAULT_REASONING_EFFORT,
+  MINIMAX_M31_FLASH_PREVIEW,
+  MINIMAX_MODELS,
+  MINIMAX_MODELS_BEFORE_M31,
+  MINIMAX_MODEL_CONTEXT_WINDOWS,
+} from "./registry/model-seeds";
+import type { OcxConfig } from "../types";
+
+export interface StaleModelRoster {
+  /** Registry provider id whose saved rows may carry the old roster. */
+  provider: string;
+  /** The exact saved roster this migration may replace, and nothing else. */
+  from: readonly string[];
+  to: readonly string[];
+  /** Per-model seed values for the added ids, written only into containers that exist. */
+  contextWindows?: Readonly<Record<string, number>>;
+  defaultReasoningEfforts?: Readonly<Record<string, string>>;
+}
+
+export interface StaleModelRosterProjection {
+  config: OcxConfig;
+  changed: boolean;
+  warnings: string[];
+}
+
+/**
+ * MiniMax-M3.1-Flash-Preview (2026-09-30). MiniMax's /v1/models roster does not list the
+ * preview, so live discovery cannot add it; the catalog keeps it only when it is configured.
+ */
+export const STALE_MODEL_ROSTERS: readonly StaleModelRoster[] = ["minimax", "minimax-cn"].map(provider => ({
+  provider,
+  from: MINIMAX_MODELS_BEFORE_M31,
+  to: MINIMAX_MODELS,
+  contextWindows: { [MINIMAX_M31_FLASH_PREVIEW]: MINIMAX_MODEL_CONTEXT_WINDOWS[MINIMAX_M31_FLASH_PREVIEW]! },
+  defaultReasoningEfforts: { [MINIMAX_M31_FLASH_PREVIEW]: MINIMAX_M31_DEFAULT_REASONING_EFFORT },
+}));
+
+function sameList(value: unknown, expected: readonly string[]): boolean {
+  return Array.isArray(value)
+    && value.length === expected.length
+    && value.every((item, index) => item === expected[index]);
+}
+
+function registrySeeds(provider: string, adapter: unknown, roster: readonly string[]): boolean {
+  const entry = PROVIDER_REGISTRY.find(row => row.id === provider);
+  return entry !== undefined && entry.adapter === adapter && sameList(entry.models, roster);
+}
+
+function fillExisting<T>(container: Record<string, T> | undefined, values: Readonly<Record<string, T>> | undefined, ids: readonly string[]): void {
+  if (!container || !values) return;
+  for (const id of ids) {
+    const value = values[id];
+    if (value !== undefined && !Object.prototype.hasOwnProperty.call(container, id)) container[id] = value;
+  }
+}
+
+/** Pure projection. The caller decides whether to persist. */
+export function projectStaleModelRosters(
+  config: OcxConfig,
+  entries: readonly StaleModelRoster[] = STALE_MODEL_ROSTERS,
+): StaleModelRosterProjection {
+  const warnings: string[] = [];
+  let changed = false;
+
+  for (const entry of entries) {
+    const prov = config.providers?.[entry.provider];
+    if (!prov) continue;
+    if (!registrySeeds(entry.provider, prov.adapter, entry.to)) continue;
+    if (!sameList(prov.models, entry.from)) continue;
+    const added = entry.to.filter(id => !entry.from.includes(id));
+    prov.models = [...entry.to];
+    fillExisting(prov.modelContextWindows, entry.contextWindows, added);
+    fillExisting(prov.modelDefaultReasoningEfforts, entry.defaultReasoningEfforts, added);
+    changed = true;
+    warnings.push(
+      `added ${added.join(", ")} to the saved "${entry.provider}" model list, which was still `
+      + "the previous registry seed.",
+    );
+  }
+
+  return { config, changed, warnings };
+}

package/src/providers/xai-fast-model.ts

@@ -0,0 +1,85 @@
+import type { FastWire, OcxParsedRequest, OcxProviderConfig } from "../types";
+
+/**
+ * Grok OAuth Fast is a serving lane, not a tier.
+ *
+ * The Grok OAuth gateway lists `grok-4.7` and `grok-4.7-build-fast` as two models, but they are one model
+ * on two lanes (same effort ladder, image input, 500k limit and advertised defaults). Measured live on
+ * 2026-09-30: build-fast is 1.5-1.7x faster end to end, while `service_tier: "priority"` on grok-4.7 bought
+ * no measurable speed and cost ~5.9x the ticks per output token (build-fast costs ~2x).
+ * Evidence: devlog/_plan/260930_grok47_build_unify/010_probe-evidence.md.
+ *
+ * So on the OAuth lane only, a Fast grok-4.7 request is SERIALIZED as the build-fast id and sends no tier.
+ * The logical id stays grok-4.7 everywhere else (parsed.modelId, route, policy, usage attempt), so effort,
+ * sampling strips and operator overrides keep resolving against grok-4.7. Key auth never reaches this
+ * (build-fast is not on the public API) and keeps priority processing.
+ */
+export const XAI_OAUTH_FAST_MODELS: Readonly<Record<string, string>> = Object.freeze({
+  "grok-4.7": "grok-4.7-build-fast",
+});
+
+/** Serving-lane ids that must not be published as rows of their own. */
+export const XAI_OAUTH_FAST_VARIANT_IDS: ReadonlySet<string> = new Set(Object.values(XAI_OAUTH_FAST_MODELS));
+
+export function xaiOauthFastModel(
+  providerName: string,
+  provider: Pick<OcxProviderConfig, "authMode">,
+  modelId: string,
+): string | undefined {
+  // Same predicate the transport uses to select the Grok CLI gateway (xai-transport.ts).
+  if (providerName !== "xai" || provider.authMode !== "oauth") return undefined;
+  return Object.hasOwn(XAI_OAUTH_FAST_MODELS, modelId) ? XAI_OAUTH_FAST_MODELS[modelId] : undefined;
+}
+
+function modelVariantFastWire(variant: string): FastWire {
+  return { kind: "model-variant", canonicalToWire: { priority: variant }, foreignCallerTiers: "drop" };
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+
+/**
+ * Settle the serialized model for the final route. Runs after decideTier on every (re)normalization, so it
+ * also undoes an override a previous route in the same request installed: core-normalize only rewrites
+ * `raw.model` when the route id differs from parsed.modelId, and a same-id fallback (xai/grok-4.7 on key
+ * auth) would otherwise inherit the variant.
+ *
+ * The caller's Fast intent (options.serviceTier, raw.service_tier) is left in place for such re-runs; the
+ * `drop` decision is what keeps the tier off this wire (canonical-forward.ts, openai-chat.ts).
+ */
+export function applyXaiOauthFastModel(
+  parsed: OcxParsedRequest,
+  route: { providerName: string; provider: Pick<OcxProviderConfig, "authMode" | "fastWire">; modelId: string },
+  logCtx?: { wireModel?: string },
+): void {
+  const raw = isRecord(parsed._rawBody) ? parsed._rawBody : undefined;
+  const previous = parsed._wireModelOverride;
+  // The lane switch replaces the registry's service-tier Fast only. The xai registry entry declares no
+  // FastWire, so a provider-level `fastWire` is always the operator's own (service-tier.ts reads it
+  // first): that decision carries a wire value they verified, and it is sent unchanged.
+  const variant = parsed.options.tierDecision?.kind === "set" && route.provider.fastWire === undefined
+    ? xaiOauthFastModel(route.providerName, route.provider, route.modelId)
+    : undefined;
+  if (!variant) {
+    if (previous === undefined) return;
+    delete parsed._wireModelOverride;
+    if (raw && raw.model === previous) raw.model = route.modelId;
+    if (logCtx?.wireModel === previous) delete logCtx.wireModel;
+    return;
+  }
+  const observation = parsed.options.tierObservation;
+  if (observation) {
+    // The lane switch is the Fast wire. A service_tier echo says nothing about it, so it can neither
+    // confirm nor deny Fast here (and never unlocks priority pricing, which needs confirmation).
+    parsed.options.tierObservation = {
+      ...observation,
+      fastWire: modelVariantFastWire(variant),
+      responseTierAuthoritative: false,
+    };
+  }
+  parsed.options.tierDecision = { kind: "drop" };
+  parsed._wireModelOverride = variant;
+  if (raw) raw.model = variant;
+  if (logCtx) logCtx.wireModel = variant;
+}

package/src/server/auth-cors.ts

@@ -1258,6 +1258,7 @@ export function safeConfigDTO(config: OcxConfig): unknown {
     // The GUI's browser-open toggle reads and writes this; absent means the
     // historical auto-open behavior.
     oauthOpenBrowser: config.oauthOpenBrowser !== false,
+    showCodexCredits: config.showCodexCredits === true,
     providers,
   };
 }

package/src/server/background-lifecycle.ts

@@ -79,8 +79,8 @@ function startProcessLoops(applyPolicy: PolicyApply): ProcessLoops {
       .catch(() => {
         // The next tick adopts it.
       });
-    // Opt-in: the tick is a no-op unless catalogAutoRefresh.enabled is true, and the
-    // interval is unref'd, so a default install pays one dormant timer. The scheduler
+    // Default-on: explicit false or a zero cadence makes ticks dormant. Both startup
+    // and interval timers are unref'd. The scheduler
     // module keeps every heavy import inside its tick, so naming it statically here
     // costs a module record and nothing else.
     startCatalogAutoRefresh();

package/src/server/management/config-routes.ts

@@ -367,6 +367,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       // Absent means the historical auto-open, so the GUI can render the toggle
       // without having to know that `undefined` and `true` mean the same thing.
       oauthOpenBrowser: config.oauthOpenBrowser !== false,
+      showCodexCredits: config.showCodexCredits === true,
       // Absent means off (today's Design B injection), so the GUI/CLI render a plain switch.
       codexDesktopAuthless: config.codexDesktopAuthless === true,
       // Absent keeps Design B remote compaction; true selects the dedicated provider identity.
@@ -462,6 +463,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       codexAccountPickerEnabled?: unknown;
       codexQuotaAutoRefresh?: unknown;
       oauthOpenBrowser?: unknown;
+      showCodexCredits?: unknown;
       ultraFastTier?: unknown;
       fastRows?: unknown;
       codexMainAccountHardLock?: unknown;
@@ -477,6 +479,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       && body.codexAccountPickerEnabled === undefined
       && body.codexQuotaAutoRefresh === undefined
       && body.oauthOpenBrowser === undefined
+      && body.showCodexCredits === undefined
       && body.ultraFastTier === undefined
       && body.fastRows === undefined
       && body.codexMainAccountHardLock === undefined
@@ -485,11 +488,14 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       && body.compactionRouting === undefined
       && body.compactionRecovery === undefined
       && body.memoryModels === undefined) {
-      return jsonResponse({ error: "provide codexAutoStart, streamMode, appOwnedMemoryBudgetMb, codexAccountPickerEnabled, codexQuotaAutoRefresh, oauthOpenBrowser, ultraFastTier, fastRows, codexMainAccountHardLock, codexDesktopAuthless, codexClientCompaction, compactionRouting, compactionRecovery, or memoryModels" }, 400);
+      return jsonResponse({ error: "provide codexAutoStart, streamMode, appOwnedMemoryBudgetMb, codexAccountPickerEnabled, codexQuotaAutoRefresh, oauthOpenBrowser, showCodexCredits, ultraFastTier, fastRows, codexMainAccountHardLock, codexDesktopAuthless, codexClientCompaction, compactionRouting, compactionRecovery, or memoryModels" }, 400);
     }
     if (body.codexAutoStart !== undefined && typeof body.codexAutoStart !== "boolean") {
       return jsonResponse({ error: "codexAutoStart boolean is required" }, 400);
     }
+    if (body.showCodexCredits !== undefined && typeof body.showCodexCredits !== "boolean") {
+      return jsonResponse({ error: "showCodexCredits boolean is required" }, 400);
+    }
     if (body.oauthOpenBrowser !== undefined && typeof body.oauthOpenBrowser !== "boolean") {
       return jsonResponse({ error: "oauthOpenBrowser boolean is required" }, 400);
     }
@@ -574,6 +580,8 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       hasCodexQuotaAutoRefresh: Object.hasOwn(config, "codexQuotaAutoRefresh"),
       oauthOpenBrowser: config.oauthOpenBrowser,
       hasOauthOpenBrowser: Object.hasOwn(config, "oauthOpenBrowser"),
+      showCodexCredits: config.showCodexCredits,
+      hasShowCodexCredits: Object.hasOwn(config, "showCodexCredits"),
       ultraFastTier: config.ultraFastTier,
       hasUltraFastTier: Object.hasOwn(config, "ultraFastTier"),
       fastRows: config.fastRows,
@@ -610,6 +618,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       } else if (body.codexAccountPickerEnabled === false) {
         config.codexAccountPickerEnabled = false;
       }
+      if (typeof body.showCodexCredits === "boolean") config.showCodexCredits = body.showCodexCredits;
       if (typeof body.oauthOpenBrowser === "boolean") {
         config.oauthOpenBrowser = body.oauthOpenBrowser;
       }
@@ -664,6 +673,8 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       if (previousSettings.hasCodexQuotaAutoRefresh) {
         config.codexQuotaAutoRefresh = previousSettings.codexQuotaAutoRefresh;
       } else deleteConfigTopLevelKey(config, "codexQuotaAutoRefresh");
+      if (previousSettings.hasShowCodexCredits) config.showCodexCredits = previousSettings.showCodexCredits;
+      else deleteConfigTopLevelKey(config, "showCodexCredits");
       if (previousSettings.hasOauthOpenBrowser) {
         config.oauthOpenBrowser = previousSettings.oauthOpenBrowser;
       } else deleteConfigTopLevelKey(config, "oauthOpenBrowser");
@@ -729,6 +740,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       codexAccountPickerEnabled: pickerIsEnabled,
       codexQuotaAutoRefresh: quotaAutoRefreshSettings(config),
       oauthOpenBrowser: config.oauthOpenBrowser !== false,
+      showCodexCredits: config.showCodexCredits === true,
       catalogRefreshPending,
       fastRows: config.fastRows !== false,
       codexDesktopAuthless: authlessIsEnabled,

package/src/server/management/oauth-account-routes.ts

@@ -292,12 +292,18 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
       // browser profile other than the OS default, or on a different machine
       // than the proxy. Declining changes nothing else: the URL is still
       // returned below and every login surface renders it with a copy button.
+      //
+      // The launch outcome is returned rather than discarded, the same contract the Codex
+      // account login already keeps: a login whose browser never opened otherwise reads as one
+      // that did, and the dashboard can only say so if it is told. `openUrl` answers within its
+      // short settle window and never rejects.
       const { shouldOpenBrowserForLogin } = await import("../../oauth/open-browser-choice");
+      let browserLaunch: "started" | "failed" | "skipped" = "skipped";
       if (authUrl && !deviceCode && shouldOpenBrowserForLogin(body.openBrowser, config)) {
         const { openUrl } = await import("../../lib/open-url");
-        void openUrl(authUrl);
+        browserLaunch = (await openUrl(authUrl)).status === "started" ? "started" : "failed";
       }
-      return jsonResponse({ url: authUrl, instructions, deviceCode });
+      return jsonResponse({ url: authUrl, instructions, deviceCode, browserLaunch });
     } catch (err) {
       if (err instanceof OAuthMutationBusyError) throw err;
       const message = err instanceof Error ? err.message : String(err);

package/src/server/responses/core-normalize.ts

@@ -38,6 +38,7 @@ import { isInjectionDebugEnabled } from "../../lib/debug-settings";
 import { injectionDebugLog } from "../../lib/injection-debug-log";
 import { recordAttemptRequestedEffort } from "../request-log";
 import type { ResolvedFastPolicy } from "../../providers/fastwire";
+import { applyXaiOauthFastModel } from "../../providers/xai-fast-model";
 
 export const MAX_FAST_WIRE_CAPABILITY_WARNINGS = 256;
 
@@ -246,6 +247,8 @@ export async function applyFinalRouteRequestNormalization(args: {
     inboundWire,
     fastPolicy,
   );
+  // xAI OAuth Fast is a serving-lane switch: serialize the variant id, keep the logical id for policy.
+  applyXaiOauthFastModel(parsed, route, logCtx);
   if (modelServiceTierSupport === false) {
     logCtx.requestedServiceTier = undefined;
     logCtx.requestedSpeedLabel = undefined;

package/src/server/startup-health-cache.ts

@@ -5,6 +5,8 @@ import { deriveStartupHealth, type StartupHealth } from "../codex/autostart-heal
 import { getCodexRoutingKind } from "../codex/inject";
 import { diagnoseCodexShim } from "../codex/shim";
 import { durableBunPath } from "../lib/bun-runtime";
+import { selfLaunchArgv } from "../lib/self-launch-argv";
+import { desktopStartupOwnership } from "../service/desktop-startup";
 import type { OcxConfig } from "../types";
 import { truncateRetainedUtf8 } from "../lib/admission";
 
@@ -90,7 +92,9 @@ export function markStartupHealthDiagnosticStale(value: StartupHealth): StartupH
     // Mirror deriveStartupHealth's choice: an already-registered service is refreshed in
     // place. Hardcoding installService here silently undid that for every stale-cache
     // read, which is the path the dashboard hits while a probe is revalidating.
-    recommendedCommand: value.routingKind === "custom-local" || value.routingKind === "unknown"
+    recommendedCommand: value.routingKind === "opencodex-local" && value.desktop?.owned
+      ? null
+      : value.routingKind === "custom-local" || value.routingKind === "unknown"
       ? value.commands.restoreNative
       : value.serviceInstalled && !value.serviceConflict
         ? value.commands.repairService
@@ -101,6 +105,7 @@ export function markStartupHealthDiagnosticStale(value: StartupHealth): StartupH
 function conservativeFallback(config: Pick<OcxConfig, "codexAutoStart">): StartupHealth {
   const shim = diagnoseCodexShim();
   return deriveStartupHealth({
+    desktop: desktopStartupOwnership(),
     routingKind: getCodexRoutingKind(),
     autostartEnabled: codexAutoStartEnabled(config),
     serviceInstalled: false,
@@ -121,7 +126,7 @@ function runProbe(config: Pick<OcxConfig, "codexAutoStart">): Promise<StartupHea
   const bun = durableBunPath();
   const cli = join(import.meta.dir, "..", "cli", "index.ts");
   return new Promise(resolve => {
-    execFile(bun, [cli, "__startup-health"], {
+    execFile(bun, selfLaunchArgv(["__startup-health"], { sourceEntrypoint: cli }), {
       encoding: "utf8",
       env: process.env,
       timeout: PROBE_TIMEOUT_MS,

package/src/service/desktop-startup.ts

@@ -0,0 +1,93 @@
+import { execFileSync } from "node:child_process";
+import { accessSync, constants, readFileSync, realpathSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { readPid } from "../config/process-state";
+import { resolveServiceOwnership, sameServiceOwnershipSubject, type ServiceOwnershipResolution } from "./state";
+
+export interface DesktopStartupDiagnostic {
+  /** Durable desktop claim; failed supervision does not release ownership. */
+  owned: boolean;
+  loginEnabled: boolean;
+  running: boolean;
+  viable: boolean;
+}
+
+/** A login item alone is insufficient: the same app must own and supervise this proxy. */
+export function deriveDesktopStartup(facts: Omit<DesktopStartupDiagnostic, "viable">): DesktopStartupDiagnostic {
+  return { ...facts, viable: facts.owned && facts.loginEnabled && facts.running };
+}
+
+function run(command: string, args: string[]): string {
+  return execFileSync(command, args, { encoding: "utf8", timeout: 750, maxBuffer: 128 * 1024, stdio: ["ignore", "pipe", "pipe"] }).trim();
+}
+
+interface DesktopStartupDeps {
+  platform?: NodeJS.Platform;
+  home?: string;
+  uid?: number;
+  ownership?: () => ServiceOwnershipResolution;
+  readPid?: () => number | null;
+  run?: typeof run;
+}
+
+/** Cheap ownership-only snapshot: no launchd/process probes on the server request path. */
+export function desktopStartupOwnership(deps: DesktopStartupDeps = {}): DesktopStartupDiagnostic | undefined {
+  if ((deps.platform ?? process.platform) !== "darwin") return undefined;
+  const owner = (deps.ownership ?? resolveServiceOwnership)();
+  return owner.kind === "owned" && owner.ownership.owner === "desktop"
+    ? deriveDesktopStartup({ owned: true, loginEnabled: false, running: false }) : undefined;
+}
+
+function processIdentity(pid: number, execute: typeof run): { parent: number; executable: string } | null {
+  const row = /^(\d+)\s+(.+)$/.exec(execute("/bin/ps", ["-p", String(pid), "-o", "ppid=,comm="]));
+  return row ? { parent: Number(row[1]), executable: realpathSync(row[2]!) } : null;
+}
+
+/** Read-only macOS desktop ownership, login registration and live parent/child checks. */
+export function diagnoseMacDesktopStartup(deps: DesktopStartupDeps = {}): DesktopStartupDiagnostic | undefined {
+  if ((deps.platform ?? process.platform) !== "darwin") return undefined;
+  const ownership = deps.ownership ?? resolveServiceOwnership;
+  const owner = ownership();
+  if (owner.kind !== "owned" || owner.ownership.owner !== "desktop") return undefined;
+  const facts = { owned: true, loginEnabled: false, running: false };
+  const execute = deps.run ?? run;
+  const pidReader = deps.readPid ?? readPid;
+  try {
+    const home = deps.home ?? homedir();
+    const id = readFileSync(join(home, "Library", "Application Support", "com.opencodex.desktop", "install-id"), "utf8").trim();
+    if (id !== owner.ownership.installId) return deriveDesktopStartup(facts);
+    const path = join(home, "Library", "LaunchAgents", "OpenCodex.plist");
+    const plist = JSON.parse(execute("/usr/bin/plutil", ["-convert", "json", "-o", "-", path]));
+    const args = plist.ProgramArguments;
+    if (plist.Label !== "OpenCodex" || plist.RunAtLoad !== true || !Array.isArray(args)
+      || args.length !== 2 || args[1] !== "--autostart" || typeof args[0] !== "string"
+      || !args[0].endsWith("/Contents/MacOS/opencodex-desktop")
+      || (plist.Program !== undefined && plist.Program !== args[0])) return deriveDesktopStartup(facts);
+    const app = realpathSync(args[0]);
+    const proxy = realpathSync(join(dirname(app), "ocx"));
+    accessSync(app, constants.X_OK);
+    accessSync(proxy, constants.X_OK);
+    const domain = `gui/${deps.uid ?? process.getuid!()}`;
+    const disabled = execute("/bin/launchctl", ["print-disabled", domain]);
+    const loaded = execute("/bin/launchctl", ["print", `${domain}/OpenCodex`]);
+    const program = /^\s*program = (.+)$/m.exec(loaded)?.[1];
+    const loadedPath = /^\s*path = (.+)$/m.exec(loaded)?.[1];
+    facts.loginEnabled = /^\s*disabled services = \{[\s\S]*\}\s*$/.test(disabled)
+      && !/"OpenCodex"\s*=>\s*(?:disabled|true)/.test(disabled)
+      && program !== undefined && realpathSync(program) === app
+      && loadedPath !== undefined && realpathSync(loadedPath) === realpathSync(path);
+    const pid = pidReader();
+    if (pid !== null) {
+      const child = processIdentity(pid, execute);
+      const parent = child && child.parent > 1 ? processIdentity(child.parent, execute) : null;
+      facts.running = child?.executable === proxy && parent?.executable === app && pidReader() === pid;
+    }
+    const currentOwner = ownership();
+    if (currentOwner.kind === "unknown" || !sameServiceOwnershipSubject(owner, currentOwner)) facts.running = false;
+    return deriveDesktopStartup(facts);
+  } catch {
+    // Unreadable launchd/process evidence never grants protection or releases the claim.
+    return deriveDesktopStartup({ ...facts, running: false });
+  }
+}

package/src/types/config.ts

@@ -527,6 +527,8 @@ export interface OcxConfig {
    * the guess is wrong.
    */
   oauthOpenBrowser?: boolean;
+  /** Display Codex credits on account cards; display only, default off. */
+  showCodexCredits?: boolean;
   /**
    * @deprecated Compatibility-only limit for bounded legacy usage readers.
    * `GET /api/usage` always aggregates the complete ledger.
@@ -853,13 +855,14 @@ export interface OcxConfig {
    */
   quotaResetNotify?: OcxQuotaResetNotifyConfig;
   /**
-   * Periodic provider model-catalog refresh (issue #3630). Absent means off: no timer, no
-   * refresh pass, no outcome record.
+   * Periodic provider model-catalog refresh (issue #3630). Absent means on at the hourly
+   * default; `enabled: false` or `intervalMinutes: 0` turns it off.
    *
-   * Off by default for the same reason every optional subsystem here is: a refresh spends a
-   * live /models call against every enabled provider, and this repository's rule is that a
-   * default install runs no detection code and starts no live timer work. Not in
-   * `getDefaultConfig()` — absence is the only default state this feature has.
+   * It started opt-in, and that is why GPT-6.1 Sol never reached an install without a
+   * release: nobody had turned the section on, so the authenticated Codex roster that
+   * announces a new model was never re-read. One hourly pass costs a live /models call per
+   * enabled provider, which is the price of new models appearing on their own. Not in
+   * `getDefaultConfig()` — absence is the default state.
    */
   catalogAutoRefresh?: OcxCatalogAutoRefreshConfig;
   /** Active provider context limits; native long windows remain within their supported ceilings. */
@@ -1645,14 +1648,12 @@ export interface OcxQuotaResetNotifyConfig {
 /**
  * Periodic model-catalog auto-refresh settings (issue #3630).
  *
- * Every field is optional and the whole section defaults to off. Each tick converges the
+ * Every field is optional and an absent section runs hourly. Each tick converges the
  * served catalog the same way `ocx sync` does, which costs a live /models call against
- * every enabled provider — so an install that never asked for this must run no refresh
- * code and start no timer, matching the optional-subsystem rule the rest of this file
- * follows.
+ * every enabled provider; set `enabled: false` to keep the catalog to explicit syncs.
  */
 export interface OcxCatalogAutoRefreshConfig {
-  /** Master switch. Default false — no scheduler, no tick, no upstream calls. */
+  /** Master switch. Default true; false leaves the timer dormant with no upstream calls. */
   enabled?: boolean;
   /**
    * Minutes between refresh ticks. Default 60, floor 15, and 0 keeps the timer dormant

package/src/types/provider.ts

@@ -197,8 +197,10 @@ export interface FastWire {
    * `service_tier` request field; `cursor-variant` is a MODEL-VARIANT switch, because
    * Cursor has no tier field — its fast product is a different model id
    * (`claude-opus-5-thinking-high-fast`) or a `{id:"fast"}` request parameter for Grok.
+   * `model-variant` is internal only (config validation rejects it): the xAI OAuth Fast lane switch in
+   * src/providers/xai-fast-model.ts, whose only wire value is the serialized model id.
    */
-  kind: "service-tier" | "anthropic-speed" | "cursor-variant";
+  kind: "service-tier" | "anthropic-speed" | "cursor-variant" | "model-variant";
   /** Canonical tier name to upstream wire spelling. */
   canonicalToWire: Readonly<Record<string, string>>;
   /** Policy for non-canonical caller-provided tier values. */

package/src/types/request.ts

@@ -50,6 +50,8 @@ export interface OcxParsedRequest {
   _responseModelId?: string;
   /** Selected OpenAI API virtual-model id retained after it rewrites the upstream wire model. */
   _openAiVirtualSelectedModelId?: string;
+  /** Serialized-only model id (xAI OAuth Fast lane); policy keeps reading `modelId`. */
+  _wireModelOverride?: string;
   previousResponseId?: string;
   context: OcxContext;
   stream: boolean;

package/src/usage/log.ts

@@ -645,7 +645,8 @@ function normalizeAttemptTierOutcome(raw: unknown): AttemptTierOutcome | null {
     && outcome.wireKind !== null
     && outcome.wireKind !== "service-tier"
     && outcome.wireKind !== "anthropic-speed"
-    && outcome.wireKind !== "cursor-variant") return null;
+    && outcome.wireKind !== "cursor-variant"
+    && outcome.wireKind !== "model-variant") return null;
   if ("wireValue" in outcome && outcome.wireValue !== null && typeof outcome.wireValue !== "string") return null;
   if ("fastDowngradeReason" in outcome
     && (typeof outcome.fastDowngradeReason !== "string"
@@ -665,6 +666,7 @@ function normalizeAttemptTierOutcome(raw: unknown): AttemptTierOutcome | null {
       || outcome.wireKind === "service-tier"
       || outcome.wireKind === "anthropic-speed"
       || outcome.wireKind === "cursor-variant"
+      || outcome.wireKind === "model-variant"
       ? { wireKind: outcome.wireKind }
       : {}),
     ...(outcome.wireValue === null