@bitkyc08/opencodex 2.76.0 → 2.77.0

package/src/codex/auth-api/main-account-probe.ts

@@ -16,14 +16,15 @@ import { getMainAccountPlan, isMainAccountTokenVerifiablyLive, MAIN_CODEX_ACCOUN
 import { captureConfigGeneration } from "../../lib/state-store-sweeper";
 import { captureMainAccountIdentityGeneration, clearMainAccountInfoCache, getMainAccountInfoCache, getMainQuotaCredentialGeneration, isMainAccountIdentityGenerationLive, isMainQuotaWriterLive, matchesMainQuotaCredential, observeMainQuotaCredential, setMainAccountCredentialPresence, setMainAccountInfoCache } from "../main-account-cache";
 import type { MainQuotaWriter, MainAccountInfo } from "../main-account-cache";
-import type { CodexQuotaRefreshOutcome } from "../quota-refresh-outcome";
+import { isCodexTerminalAuthCode } from "../quota-refresh-outcome";
+import type { CodexQuotaRefreshOutcome, CodexTerminalAuthCode } from "../quota-refresh-outcome";
 import { observeMainReserveRevocation } from "../reserve-availability";
 import type { AdmissionLease } from "../../lib/admission";
 import { nonEmptyPlan } from "./runtime-config";
 import { tryAcquireNativeMainProfileClaim } from "../native-main-admission";
 import { WHAM_REQUEST_TIMEOUT_MS } from "../quota-recovery-timing";
 import { withNativeMainCredentialClaim, isNativeMainClaimUnavailable } from "./http";
-import { MAIN_TERMINAL_AUTH_CODES, readMainAuthErrorCode, currentQuotaDispatchSequence, nextQuotaDispatchSequence, isQuotaDispatchCurrent, publishQuotaDispatch } from "./pool-quota-probe";
+import { readMainAuthErrorCode, currentQuotaDispatchSequence, nextQuotaDispatchSequence, isQuotaDispatchCurrent, publishQuotaDispatch } from "./pool-quota-probe";
 
 /**
  * Last reset-credit count this process parsed for the main account, tagged with the
@@ -79,14 +80,18 @@ function sharedMainQuotaPacingEnabled(config: OcxConfig): boolean {
  * itself would make a real 401 permanently transient.
  */
 export async function isTerminalMainAuthResponse(resp: Response, accessTokenLive: boolean): Promise<boolean> {
-  if (resp.status === 401) {
-    if (!accessTokenLive) return true;
-    const code = await readMainAuthErrorCode(resp);
-    return typeof code === "string" && MAIN_TERMINAL_AUTH_CODES.has(code);
-  }
-  if (resp.status !== 403) return false;
+  return (await classifyMainAuthResponse(resp, accessTokenLive)).terminal;
+}
+
+/** As `isTerminalMainAuthResponse`, also naming the provider code that made it terminal. */
+async function classifyMainAuthResponse(
+  resp: Response,
+  accessTokenLive: boolean,
+): Promise<{ terminal: boolean; code?: CodexTerminalAuthCode }> {
+  if (resp.status !== 401 && resp.status !== 403) return { terminal: false };
   const code = await readMainAuthErrorCode(resp);
-  return typeof code === "string" && MAIN_TERMINAL_AUTH_CODES.has(code);
+  if (isCodexTerminalAuthCode(code)) return { terminal: true, code };
+  return { terminal: resp.status === 401 && !accessTokenLive };
 }
 
 export interface MainResetQuotaProof {
@@ -103,6 +108,8 @@ export interface MainAccountInfoFetchResult {
   quotaRefresh?: CodexQuotaRefreshOutcome;
   /** Internal dispatch fence for diagnostics only; never copied into a public DTO or cache. */
   quotaRefreshGeneration?: number;
+  /** This current-credential usage response supplied terminal auth evidence; never public. */
+  terminalAuthFailure?: true;
   /** Whether this attempt safely inspected the physical native-main credential. */
   credentialChecked: boolean;
   /** Meaningful only when credentialChecked is true. */
@@ -288,7 +295,8 @@ export async function fetchMainAccountInfoWhileOwned(
       const resp = admission.response;
       quotaPhase = "publish";
       if (!resp.ok) {
-        const terminalAuthFailure = await isTerminalMainAuthResponse(resp, isMainAccountTokenVerifiablyLive());
+        const authFailure = await classifyMainAuthResponse(resp, isMainAccountTokenVerifiablyLive());
+        const terminalAuthFailure = authFailure.terminal;
         const retried = await retryMainAccountInfoIfIdentityChanged(requestAccountId, retriesRemaining, nativeMainLease, explicitRefresh, paced);
         if (retried) return retried;
         if (!isQuotaDispatchCurrent(dispatchSequence) || !credentialIsCurrent()) {
@@ -302,10 +310,15 @@ export async function fetchMainAccountInfoWhileOwned(
           if (diagnosticStillLive) quotaRefreshGeneration = captureMainAccountIdentityGeneration();
           markAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID, writerGeneration);
         }
+        // Keep the last-known plan visible: after a plan change revokes the session, the plan the
+        // account HAD is what tells the operator why it stopped working.
         return {
-          info: EMPTY_MAIN_ACCOUNT_INFO, credentialChecked: true, hasCredential: true,
-          quotaRefresh: { status: "http_error", httpStatus: resp.status },
+          info: { ...EMPTY_MAIN_ACCOUNT_INFO, plan: nonEmptyPlan(cached?.plan) ?? nonEmptyPlan(getMainAccountPlan()) },
+          credentialChecked: true, hasCredential: true,
+          quotaRefresh: { status: "http_error", httpStatus: resp.status,
+            ...(authFailure.code ? { code: authFailure.code } : {}) },
           quotaRefreshGeneration,
+          ...(terminalAuthFailure ? { terminalAuthFailure: true as const } : {}),
         };
       }
       quotaPhase = "body";

package/src/codex/auth-api/pool-mode-gate.ts

@@ -1,3 +1,4 @@
+import { codexAccountUsesCreditsAfterLimit } from "../account-credit-use";
 import { nextCodexUsageQueryAt, nextQuotaQueryDelay, pruneRemovedCodexPoolUsageAccounts } from "../quota-query-backoff";
 import { CODEX_PRIORITY_FAILBACK_REFRESH_MS } from "../account-priority";
 import { codexQuotaHasFreshUsage } from "../quota-observation-freshness";
@@ -6,8 +7,8 @@ import { getAccountQuota, isCompleteCodexQuotaRecoverySnapshot } from "../quota"
 import { reconcileMainCodexAccountRuntimeState } from "../account-lifecycle";
 import { claimDueCodexQuotaRecoveryProbes, settleCodexQuotaRecoveryProbe } from "../routing";
 import { readCodexTokens } from "../auth-collision";
-import { isAccountNeedsReauth, markAccountNeedsReauth } from "../account-runtime-state";
-import { getValidMainAccountToken, MainAccountTokenRefreshError, MAIN_CODEX_ACCOUNT_ID, getMainAccountPlan } from "../main-account";
+import { isAccountNeedsReauth } from "../account-runtime-state";
+import { getValidMainAccountToken, MAIN_CODEX_ACCOUNT_ID, getMainAccountPlan } from "../main-account";
 import { captureConfigGeneration, registerStateSweepAfterTick } from "../../lib/state-store-sweeper";
 import { observeMainQuotaCredential, getMainQuotaCredentialGeneration, captureMainAccountIdentityGeneration, isMainAccountIdentityGenerationLive } from "../main-account-cache";
 import { getMainAccountHardLockStatus } from "../main-account-hard-lock";
@@ -58,7 +59,7 @@ export async function runCodexCooldownRecoveryProbes(config: OcxConfig, now = Da
         // Defence in depth: independent scopes are already excluded at the claim site.
         // Generic WHAM must never clear Reserve even if claim selection changes.
         const recovered = (claim.scope === undefined || claim.scope === "shared")
-          && isCompleteCodexQuotaRecoverySnapshot(result.freshQuota ?? null, result.freshPlan ?? account.plan);
+          && isCompleteCodexQuotaRecoverySnapshot(result.freshQuota ?? null, result.freshPlan ?? account.plan, codexAccountUsesCreditsAfterLimit(config, claim.accountId));
         settleCodexQuotaRecoveryProbe(claim, recovered, {
           credentialGeneration: result.freshCredentialGeneration,
         }, now);
@@ -100,18 +101,14 @@ export async function runMainAccountHardLockRecovery(config: OcxConfig): Promise
     if (getMainAccountHardLockStatus(config).state !== "blocked"
       || isAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID)) return;
     const identityGeneration = captureMainAccountIdentityGeneration();
-    const writerGeneration = captureConfigGeneration();
     try {
       // Refresh can require an exclusive credential claim: never hold WHAM's shared
       // claim while obtaining a valid token. The runtime lease spans both operations.
       const prepared = await getValidMainAccountToken({ preserveReauth: true });
       if (!prepared) return;
       observeMainQuotaCredential(prepared.accessToken, prepared.chatgptAccountId);
-    } catch (error) {
-      if (error instanceof MainAccountTokenRefreshError && error.reason === "reauth"
-        && isMainAccountIdentityGenerationLive(identityGeneration)) {
-        markAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID, writerGeneration);
-      }
+    } catch {
+      // Native refresh retains its own grant-scoped refusal; global quarantine would outlive it.
       return;
     }
     if (isAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID)) return;

package/src/codex/auth-api/pool-quota-probe.ts

@@ -15,14 +15,12 @@ import { WHAM_REQUEST_TIMEOUT_MS } from "../quota-recovery-timing";
 import { claimQuotaRecovery, fencePropagatedQuotaRecovery, quotaRecoveryTerminalFor, releaseQuotaRecovery, settleQuotaRecovery, settleQuotaRecoveryTerminal } from "../quota-401-recovery";
 import { seedLoginRowsForTests } from "./login-state";
 import { nonEmptyPlan } from "./runtime-config";
+import { CODEX_TERMINAL_AUTH_CODES } from "../quota-refresh-outcome";
 
 export const POOL_CACHE_TTL = 5 * 60_000;
 export const POOL_QUOTA_REFRESH_CONCURRENCY = 4;
 
-export const MAIN_TERMINAL_AUTH_CODES = new Set([
-  "invalid_workspace_selected",
-  "invalid_refresh_token",
-]);
+export const MAIN_TERMINAL_AUTH_CODES: ReadonlySet<string> = new Set(CODEX_TERMINAL_AUTH_CODES);
 
 export async function readMainAuthErrorCode(resp: Response): Promise<unknown> {
   try {

package/src/codex/auth-api/reset-credit-service.ts

@@ -1,3 +1,4 @@
+import { codexAccountUsesCreditsAfterLimit } from "../account-credit-use";
 import { getValidCodexToken, isCodexAccountGenerationLive, readCodexAccountRecord, CodexCredentialGenerationConflictError } from "../account-store";
 import { isCompleteCodexQuotaRecoverySnapshot } from "../quota";
 import { reconcileMainCodexAccountRuntimeState } from "../account-lifecycle";
@@ -233,7 +234,7 @@ async function refreshAfterManualReset(
         && proof.credentialGeneration === auth.mainProof.credentialGeneration
         && proof.writer.identityKey === auth.mainProof.writer.identityKey
         && proof.writer.identityGeneration === auth.mainProof.writer.identityGeneration
-        && isCompleteCodexQuotaRecoverySnapshot(result.freshQuota ?? null, result.info.plan);
+        && isCompleteCodexQuotaRecoverySnapshot(result.freshQuota ?? null, result.info.plan, codexAccountUsesCreditsAfterLimit(getRuntimeConfig(config), accountId));
       for (const claim of claims) settleManualResetCooldown(getRuntimeConfig(config), claim, recovered);
       return manualResetAuthStillLive(accountId, auth) ? result.freshResetCredits : undefined;
     }
@@ -255,7 +256,7 @@ async function refreshAfterManualReset(
     const record = readCodexAccountRecord(accountId);
     const recovered = didReset && record?.credential?.chatgptAccountId === auth.chatgptAccountId
       && (result.quotaProbeAttempted?.dispatchSequence ?? 0) > afterDispatchSequence
-      && isCompleteCodexQuotaRecoverySnapshot(result.freshQuota ?? null, result.freshPlan ?? account.plan);
+      && isCompleteCodexQuotaRecoverySnapshot(result.freshQuota ?? null, result.freshPlan ?? account.plan, codexAccountUsesCreditsAfterLimit(getRuntimeConfig(config), accountId));
     for (const claim of claims) settleManualResetCooldown(getRuntimeConfig(config), claim, recovered, {
       credentialGeneration: result.freshCredentialGeneration,
       refreshLineage: result.resetRefreshLineage,

package/src/codex/auth-context.ts

@@ -1,3 +1,4 @@
+import { hasSpendableCodexCredits } from "./quota-types";
 import { noteMainAccountActivity } from "./main-account-external-usage";
 import { codexAccountPriorityFailbackEnabled } from "./account-priority";
 import type { PoolQuotaWriter } from "./quota-types";
@@ -16,7 +17,7 @@ import {
 import { isAccountNeedsReauth, markAccountNeedsReauth } from "./account-runtime-state";
 import { ConfigMutationLockError } from "../config";
 import { NativeProfileError } from "./native-profile-types";
-import { isCodexAccountUsable } from "./account-usability";
+import { codexAccountUnusableReason, isCodexAccountUsable } from "./account-usability";
 import { reconcileMainCodexAccountRuntimeState } from "./account-lifecycle";
 import {
   MAIN_CODEX_ACCOUNT_ID,
@@ -102,7 +103,7 @@ import { getEffectiveCodexAutoSwitchThreshold } from "./account-auto-switch";
 function requestOwnedMainPinHasQuotaHeadroom(config: OcxConfig): boolean {
   const threshold = getEffectiveCodexAutoSwitchThreshold(config, MAIN_CODEX_ACCOUNT_ID);
   if (threshold <= 0) return true;
-  const usage = computeCodexUsageScore(getAccountQuota(MAIN_CODEX_ACCOUNT_ID));
+  const usage = computeCodexUsageScore(getAccountQuota(MAIN_CODEX_ACCOUNT_ID), undefined, Date.now(), codexAccountUsesCreditsAfterLimit(config, MAIN_CODEX_ACCOUNT_ID));
   return usage >= CODEX_UNKNOWN_USAGE_SCORE || usage < threshold;
 }
 
@@ -378,9 +379,11 @@ export class CodexAuthContextError extends Error {
 }
 
 export class CodexPoolAuthenticationError extends Error {
-  constructor(message = "OpenAI account pool has no usable account credential") {
+  readonly quarantinedMain: boolean;
+  constructor(message = "OpenAI account pool has no usable account credential", options?: { quarantinedMain?: boolean }) {
     super(message);
     this.name = "CodexPoolAuthenticationError";
+    this.quarantinedMain = options?.quarantinedMain === true;
   }
 }
 
@@ -530,7 +533,7 @@ export class CodexMainAccountCreditsOffError extends CodexAccountCooldownError {
     super(MAIN_CODEX_ACCOUNT_ID, resetAt ?? 0);
     this.name = "CodexMainAccountCreditsOffError";
     this.resetAt = resetAt;
-    this.message = "Codex main account reached its usage limit, and spending ChatGPT credits is off for it."
+    this.message = "Codex main account reached its usage limit, and spending ChatGPT credits is off or no fresh spendable balance is available."
       + " Choose another account, wait for the limit to reset, or allow the main account under \"Use credits\" in Codex Auth.";
   }
 }
@@ -723,7 +726,8 @@ export function unwrapUpstreamRetryEvidenceError(error: unknown): unknown {
  * file, which several callers are forbidden to open, so every long window counts instead.
  */
 function mainCreditsHoldResetAt(config: Pick<OcxConfig, "creditCodexAccountIds">): number | undefined {
-  if (codexAccountUsesCreditsAfterLimit(config, MAIN_CODEX_ACCOUNT_ID)) return undefined;
+  if (codexAccountUsesCreditsAfterLimit(config, MAIN_CODEX_ACCOUNT_ID)
+    && hasSpendableCodexCredits(getMainPolicyQuota())) return undefined;
   return codexUsageLimitResetAt(getMainPolicyQuota(), undefined, Date.now());
 }
 
@@ -920,7 +924,7 @@ export function shouldMarkAccountNeedsReauthForCodexAuthFailure(cause: unknown):
     && !(cause instanceof CodexCredentialRefreshBusyError)
     && !(cause instanceof CodexCredentialRefreshStaleError)
     && !(cause instanceof MainAuthJsonChangedDuringRefreshError)
-    && !(cause instanceof MainAccountTokenRefreshError && cause.reason === "transient")
+    && !(cause instanceof MainAccountTokenRefreshError)
     && !(cause instanceof NativeProfileError && cause.retryable)
     && !(cause instanceof DOMException && cause.name === "AbortError")
     && !(cause instanceof ConfigMutationLockError);
@@ -1314,7 +1318,12 @@ export async function resolveCodexAuthContext(
             "Selected Codex account does not support this model",
           );
         }
-        throw new CodexPoolAuthenticationError("Selected Codex account is unavailable");
+        const mainReason = fixedAccountId === MAIN_CODEX_ACCOUNT_ID && !nativeMainReadsForbidden
+          && !policy.pausedCodexAccountIds?.includes(fixedAccountId)
+          ? codexAccountUnusableReason(config, fixedAccountId, selectionOptions) : undefined;
+        throw new CodexPoolAuthenticationError("Selected Codex account is unavailable", {
+          quarantinedMain: mainReason === "needs_reauth",
+        });
       }
       // Recovery or a turn drain deliberately makes physical main unobservable.
       // If no healthy pool route is available, report the temporary fence rather
@@ -1339,7 +1348,12 @@ export async function resolveCodexAuthContext(
             : "Codex accounts that support this model are currently unavailable",
         );
       }
-      throw new CodexPoolAuthenticationError();
+      throw new CodexPoolAuthenticationError(undefined, {
+        quarantinedMain: !nativeMainReadsForbidden
+          && options.excludeAccountId !== MAIN_CODEX_ACCOUNT_ID
+          && !policy.pausedCodexAccountIds?.includes(MAIN_CODEX_ACCOUNT_ID)
+          && codexAccountUnusableReason(config, MAIN_CODEX_ACCOUNT_ID, selectionOptions) === "needs_reauth",
+      });
     }
     accountId = selected;
     if (accountId === MAIN_CODEX_ACCOUNT_ID) assertMainAccountPolicy(policy);
@@ -1370,10 +1384,15 @@ export async function resolveCodexAuthContext(
         throw new CodexPoolAuthenticationError("Selected Codex account is unavailable");
       }
       if (isAccountNeedsReauth(accountId)) {
-        throw new CodexPoolAuthenticationError("Selected Codex account needs reauthentication");
+        throw new CodexPoolAuthenticationError("Selected Codex account needs reauthentication", {
+          quarantinedMain: accountId === MAIN_CODEX_ACCOUNT_ID && !nativeMainReadsForbidden,
+        });
       }
-      if (!isCodexAccountUsable(config, accountId, selectionOptions)) {
-        throw new CodexPoolAuthenticationError("Selected Codex account is unavailable");
+      const unusableReason = codexAccountUnusableReason(config, accountId, selectionOptions);
+      if (unusableReason !== undefined) {
+        throw new CodexPoolAuthenticationError("Selected Codex account is unavailable", {
+          quarantinedMain: accountId === MAIN_CODEX_ACCOUNT_ID && unusableReason === "needs_reauth",
+        });
       }
     }
   } catch (cause) {

package/src/codex/catalog/aggregation.ts

@@ -1,4 +1,5 @@
 import { execFileSync } from "node:child_process";
+import { collapseAntigravityPublicModels } from "../../providers/antigravity-effort-families";
 import { createHash } from "node:crypto";
 import { copyFileSync, existsSync, mkdirSync, readFileSync, realpathSync } from "node:fs";
 import { delimiter, dirname, join, resolve } from "node:path";
@@ -504,6 +505,7 @@ export function resolveSlugAliasCollisions(goModels: CatalogModel[]): Set<Catalo
 }
 
 export function uniqueCatalogModelsForPublicList(goModels: CatalogModel[]): CatalogModel[] {
+  goModels = collapseAntigravityPublicModels(goModels);
   const collisionSkipped = resolveSlugAliasCollisions(goModels);
   const comboPublicSlugs = new Set(goModels
     .filter(model => model.provider === COMBO_NAMESPACE)
@@ -525,6 +527,7 @@ export function uniqueCatalogModelsForPublicList(goModels: CatalogModel[]): Cata
 }
 
 export function uniqueCatalogModelsForRawPublicList(goModels: CatalogModel[]): CatalogModel[] {
+  goModels = collapseAntigravityPublicModels(goModels);
   const publicId = (model: CatalogModel): string => model.alias ?? `${model.provider}/${model.id}`;
   const comboPublicIds = new Set(goModels
     .filter(model => model.provider === COMBO_NAMESPACE)

package/src/codex/catalog/model-hints.ts

@@ -295,7 +295,8 @@ export function applyProviderConfigHints(
     inputModalities = base.includes("image") ? [...base] : [...base, "image"];
   }
   const reasoningEfforts = configuredReasoningEfforts(prov, model.id);
-  const suppressSyntheticMax = modelRecordValue(prov.modelSuppressSyntheticMax, model.id) === true;
+  const suppressSyntheticMax = modelRecordValue(prov.modelSuppressSyntheticMax, model.id)
+    ?? (model.antigravityEffortWireModelIds !== undefined);
   const defaultReasoningEffort = staticPolicy.model.defaultReasoningEffort ?? model.defaultReasoningEffort;
   const supportsReasoningSummaries = staticPolicy.model.supportsReasoningSummaries;
   const supportsVerbosity = staticPolicy.model.supportsVerbosity;

package/src/codex/catalog/model-visibility.ts

@@ -1,4 +1,5 @@
 import { effectiveProviderAlias, effectiveProviderAliasDecision } from "../../providers/default-aliases";
+import { antigravityFamilyDisabled, collapseAntigravityPublicModels, projectAntigravitySelectedModels } from "../../providers/antigravity-effort-families";
 import { XAI_OAUTH_FAST_VARIANT_IDS } from "../../providers/xai-fast-model";
 import { initialModelSelectionPending } from "../../providers/initial-model-selection";
 import { execFileSync } from "node:child_process";
@@ -267,7 +268,7 @@ export function mergeConfiguredModelsIntoLiveCatalog(opts: {
 
 export function filterCatalogVisibleModels(
   models: CatalogModel[],
-  config: Pick<OcxConfig, "disabledModels" | "providers">,
+  config: Pick<OcxConfig, "disabledModels" | "providers" | "modelDiscovery">,
 ): CatalogModel[] {
   const disabled = new Set(config.disabledModels ?? []);
   const allowByProvider = new Map<string, Set<string>>();
@@ -289,12 +290,14 @@ export function filterCatalogVisibleModels(
     // Two catalog stages with different equivalence relations is the exact bug class
     // this change exists to remove.
     if (Array.isArray(sel) && sel.length > 0) {
-      allowByProvider.set(name, new Set(sel.map(model => slugEquivalenceKey(routedSlug(name, model)))));
+      allowByProvider.set(name, new Set(projectAntigravitySelectedModels(name, sel, models)
+        .map(model => slugEquivalenceKey(routedSlug(name, model)))));
     }
   }
-  return models.filter(m => {
+  return collapseAntigravityPublicModels(models).filter(m => {
     if (initialModelSelectionPending(config.providers[m.provider])) return false;
     if (config.providers[m.provider]?.disabled === true) return false;
+    if (antigravityFamilyDisabled(config, m, models)) return false;
     const nativeAlias = m.provider === COMBO_NAMESPACE && m.nativeAlias === true;
     // disabledModels may be stored raw (canonical) or encoded (legacy UI writes).
     for (const stored of disabled) {

package/src/codex/catalog/parsing.ts

@@ -113,6 +113,8 @@ export interface CatalogModel {
   displayName?: string;
   owned_by?: string;
   reasoningEfforts?: string[];
+  /** Exact CCA family evidence, retained through the in-memory discovery cache. */
+  antigravityEffortWireModelIds?: Partial<Record<"low" | "medium" | "high", string>>;
   /** Suppress only catalog synthesis of a missing max rung; provider-declared max survives. */
   suppressSyntheticMax?: boolean;
   defaultReasoningEffort?: string;

package/src/codex/catalog/provider-models.ts

@@ -751,20 +751,29 @@ export async function fetchProviderModelsWithAuth(
       const live = antigravity.map(model => applyProviderConfigHints(name, prov, {
         id: model.id,
         provider: name,
-        // CCA only exposes a numeric thinking budget. Until the adapter owns an exact Codex
-        // effort-to-wire mapping for a newly discovered model, do not advertise a false ladder.
-        reasoningEfforts: [],
+        // Only an exact discovered wire map proves a new model's selectable effort ladder.
+        reasoningEfforts: Object.keys(model.effortWireModelIds ?? {}),
+        ...(model.effortWireModelIds ? {
+          antigravityEffortWireModelIds: model.effortWireModelIds,
+          suppressSyntheticMax: true,
+          defaultReasoningEffort: model.effortWireModelIds.medium ? "medium" : "high",
+        } : {}),
         ...(model.contextWindow ? { contextWindow: model.contextWindow } : {}),
         ...(model.inputModalities ? { inputModalities: model.inputModalities } : {}),
       }, contextCap, metadataModelIdCaseFold, captured.effectiveAlias));
       const forCache = withConfiguredRetention(live, { retainComboTargets: false });
-      if (!setCached(name, forCache, Date.now(), cacheGeneration)) {
+      if (!isCurrentCacheGeneration()) {
         return observed(withConfiguredRetention(configured), "degraded");
       }
+      // Save exact family routes before publishing synthetic IDs. These synchronous writes
+      // cannot interleave with a credential-generation change; failure keeps the prior cache.
       registerAntigravityDiscoveredWireModels(prov.baseUrl, antigravity, {
         provider: name,
         cacheGeneration,
       });
+      if (!setCached(name, forCache, Date.now(), cacheGeneration)) {
+        return observed(withConfiguredRetention(configured), "degraded");
+      }
       markProviderDiscoveryOk(name, live.length);
       return observed(withConfiguredRetention(forCache, { warnDrops: true }), "authoritative");
     }

package/src/codex/catalog/retained-sync.ts

@@ -1,3 +1,4 @@
+import { projectAntigravitySelectedModels } from "../../providers/antigravity-effort-families";
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { initializeConfigOwnership } from "../../lib/config-ownership";
@@ -465,7 +466,7 @@ function writeRetainedCatalogSync({
       provider.disabled !== true
         && Array.isArray(provider.selectedModels)
         && provider.selectedModels.length > 0
-        ? [[name, new Set(provider.selectedModels)] as const]
+        ? [[name, new Set(projectAntigravitySelectedModels(name, provider.selectedModels, goModels))] as const]
         : []
     )),
   );

package/src/codex/chatgpt-refresh-failure.ts

@@ -0,0 +1,56 @@
+/** Closed diagnostic vocabulary; provider descriptions and unknown codes never escape. */
+const REFRESH_DIAGNOSTIC_CODES = [
+  "invalid_grant", "refresh_token_invalidated", "token_invalidated", "refresh_token_reused",
+  "refresh_token_expired", "invalid_client", "invalid_request", "server_error",
+  "temporarily_unavailable", "rate_limit_exceeded", "unsupported_grant_type", "invalid_scope",
+] as const;
+export type ChatgptRefreshDiagnosticCode = typeof REFRESH_DIAGNOSTIC_CODES[number];
+export type ChatgptRefreshFailure = {
+  reason: "expired" | "revoked" | "unknown";
+  code?: ChatgptRefreshDiagnosticCode;
+};
+
+/** HTTP availability failures cannot establish that a refresh grant was revoked. */
+export function classifyChatgptRefreshFailure(status: number, body: string): ChatgptRefreshFailure {
+  if (body.length > 16_384) return { reason: "unknown" };
+  let payload: unknown;
+  try { payload = JSON.parse(body); } catch { return { reason: "unknown" }; }
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return { reason: "unknown" };
+  const row = payload as Record<string, unknown>;
+  let exactCode: string | undefined;
+  let description = typeof row.error_description === "string" ? row.error_description : "";
+  if (typeof row.error === "string") {
+    exactCode = row.error.trim() || undefined;
+  } else if (row.error !== undefined) {
+    if (!row.error || typeof row.error !== "object" || Array.isArray(row.error)) return { reason: "unknown" };
+    const error = row.error as Record<string, unknown>;
+    if (error.code !== undefined && typeof error.code !== "string") return { reason: "unknown" };
+    exactCode = typeof error.code === "string" ? error.code.trim() || undefined : undefined;
+    if (typeof error.message === "string") description = `${error.message} ${description}`;
+  }
+  const code = (REFRESH_DIAGNOSTIC_CODES as readonly unknown[]).includes(exactCode)
+    ? exactCode as ChatgptRefreshDiagnosticCode : undefined;
+  let reason: ChatgptRefreshFailure["reason"] = "unknown";
+  if (status === 400 || status === 401 || status === 403) {
+    if (["invalid_grant", "refresh_token_invalidated", "token_invalidated", "refresh_token_reused"].includes(exactCode ?? "")) {
+      reason = "revoked";
+    } else if (exactCode === "refresh_token_expired") {
+      reason = "expired";
+    } else if (status === 400 && exactCode === undefined) {
+      // Preserve description-only OAuth 400 compatibility; a named code always wins.
+      if (description.includes("invalidated") || description.includes("revoked")) reason = "revoked";
+      else if (description.includes("expired")) reason = "expired";
+    }
+  }
+  return { reason, ...(code ? { code } : {}) };
+}
+
+/** Endpoint verdict only: no credential identity, body, or arbitrary upstream string. */
+export function noteChatgptRefreshFailure(
+  kind: "pool" | "native main",
+  status: number,
+  failure: ChatgptRefreshFailure,
+): void {
+  console.warn(`[codex] ${kind} refresh: ${failure.reason === "unknown" ? "transient" : "reauth"}`
+    + ` status=${status} code=${failure.code ?? "none"}`);
+}

package/src/codex/convergence.ts

@@ -1,3 +1,4 @@
+import { projectAntigravitySelectedModels } from "../providers/antigravity-effort-families";
 import { join } from "node:path";
 
 import { getConfigDir, saveConfigPreservingClaudeCode, websocketsEnabled, withExpectedConfigGenerationSync } from "../config";
@@ -347,7 +348,7 @@ function prepareCatalog(
   const selectedModelsByProvider = new Map<string, ReadonlySet<string>>(
     enabledProviders.flatMap(([name, provider]) => (
       Array.isArray(provider.selectedModels) && provider.selectedModels.length > 0
-        ? [[name, new Set(provider.selectedModels)] as const]
+        ? [[name, new Set(projectAntigravitySelectedModels(name, provider.selectedModels, routedModels))] as const]
         : []
     )),
   );