@bitkyc08/opencodex 2.76.0 → 2.77.0

package/src/server/management/integration-routes.ts

@@ -24,7 +24,8 @@ import {
   type IntegrationClientId,
 } from "../../integrations/registry";
 import { detectRaycast, type RaycastInstall } from "../../integrations/raycast-detect";
-import { readIntegrationState } from "../../integrations/state";
+import { readIntegrationState, readOwnedDroidReasoningDefaults } from "../../integrations/state";
+import { droidReasoningModels, validateDroidReasoningDefaults } from "../../clients/config-export";
 import { createIntegrationStateStore, type IntegrationStateStore } from "../../integrations/store";
 import {
   applyIntegrationCoordinated,
@@ -74,6 +75,10 @@ export type IntegrationStateEnvelope = {
    * the shared `IntegrationStatus`, which describes the file, not the app.
    */
   raycast?: RaycastInstall;
+  droidReasoning?: {
+    models: Array<{ model: string; label: string; efforts: string[] }>;
+    defaults: Record<string, string>;
+  };
 } & IntegrationStateRecord;
 
 export interface IntegrationStateListEnvelope {
@@ -241,12 +246,14 @@ async function buildIntegrationWriteInput(
   clientId: IntegrationClientId,
   ctx: ManagementContext,
   store: IntegrationStateStore,
+  droidReasoningDefaults?: Record<string, string>,
 ): Promise<IntegrationWriteInput> {
   return {
     clientId,
     models: await loadExportModels(ctx.config),
     config: ctx.config,
     port: Number(ctx.url.port) || ctx.config.port,
+    ...(droidReasoningDefaults === undefined ? {} : { droidReasoningDefaults: { ...droidReasoningDefaults } }),
     store,
     io: integrationMutationTestHooks?.io,
     ...pathOverrides(),
@@ -265,6 +272,7 @@ async function buildIntegrationPreviewInput(
   clientId: IntegrationClientId,
   ctx: ManagementContext,
   store: IntegrationStateStore,
+  droidReasoningDefaults?: Record<string, string>,
 ): Promise<{ input: IntegrationWriteInput; identity: string } | null> {
   const snapshot = previewExportSnapshot(ctx.config);
   // No cached roster means no honest snapshot to plan against. Gathering one here would make a
@@ -277,6 +285,7 @@ async function buildIntegrationPreviewInput(
       models: snapshot.models,
       config: ctx.config,
       port: Number(ctx.url.port) || ctx.config.port,
+      ...(droidReasoningDefaults === undefined ? {} : { droidReasoningDefaults: { ...droidReasoningDefaults } }),
       store,
       io: integrationMutationTestHooks?.io,
       ...pathOverrides(),
@@ -309,6 +318,31 @@ function invalidClientResponse(ctx: ManagementContext): Response {
   }, 400, ctx.req, ctx.config);
 }
 
+function isStringRecord(value: unknown): value is Record<string, string> {
+  return value !== null && typeof value === "object" && !Array.isArray(value)
+    && Object.values(value).every(item => typeof item === "string");
+}
+
+function invalidDroidDefaultsResponse(ctx: ManagementContext, message: string): Response {
+  return jsonResponse({ error: message, code: "invalid_droid_reasoning_defaults" }, 400, ctx.req, ctx.config);
+}
+
+function readDroidReasoningDefaults(
+  ctx: ManagementContext,
+  body: Record<string, unknown>,
+  clientId: string,
+  operation: IntegrationPlanOperation,
+): Record<string, string> | Response | undefined {
+  if (!Object.hasOwn(body, "droidReasoningDefaults")) return undefined;
+  if (clientId !== "droid" || (operation !== "apply" && operation !== "overwrite")) {
+    return invalidDroidDefaultsResponse(ctx, "droidReasoningDefaults is allowed only for Droid apply or overwrite");
+  }
+  const defaults = body.droidReasoningDefaults;
+  return isStringRecord(defaults)
+    ? defaults
+    : invalidDroidDefaultsResponse(ctx, "droidReasoningDefaults must map model names to effort strings");
+}
+
 /**
  * No cached model roster, so there is nothing honest to plan against.
  *
@@ -364,6 +398,7 @@ function stalePlanGuard(
   request: PreviewRequest,
   fingerprint: string,
   capturedIdentity: string | null,
+  droidReasoningDefaults?: Record<string, string>,
 ): {
   revalidate: NonNullable<CoordinatedIntegrationOptions["revalidate"]>;
   response: () => Response | null;
@@ -379,7 +414,7 @@ function stalePlanGuard(
        * without ever swapping the roster this mutation is about to use.
        */
       if (exportSnapshotIdentity(ctx.config) !== capturedIdentity) {
-        const refreshed = await buildIntegrationPreviewInput(clientId, ctx, store);
+        const refreshed = await buildIntegrationPreviewInput(clientId, ctx, store, droidReasoningDefaults);
         stale = refreshed === null ? "unavailable" : previewIntegration(refreshed.input, request);
         return { ok: false, reason: "conflict", state: "conflict", clientId, message: "the model roster changed while confirming" };
       }
@@ -723,9 +758,17 @@ export async function handleIntegrationRoutes(ctx: ManagementContext): Promise<R
         code: "invalid_preview_operation",
       }, 400, req, ctx.config);
     }
+    const droidDefaults = readDroidReasoningDefaults(ctx, parsed, previewClient, operation);
+    if (droidDefaults instanceof Response) return droidDefaults;
     try {
-      const captured = await buildIntegrationPreviewInput(previewClient as IntegrationClientId, ctx, integrationStore());
+      const captured = await buildIntegrationPreviewInput(
+        previewClient as IntegrationClientId, ctx, integrationStore(), droidDefaults,
+      );
       if (!captured) return previewUnavailableResponse(ctx);
+      if (droidDefaults !== undefined) {
+        const invalid = validateDroidReasoningDefaults(captured.input.models, droidDefaults);
+        if (invalid) return invalidDroidDefaultsResponse(ctx, invalid);
+      }
       return jsonResponse(previewIntegration(captured.input, { operation }), 200, req, ctx.config);
     } catch (error) {
       return internalErrorResponse(error, ctx);
@@ -907,7 +950,15 @@ export async function handleIntegrationRoutes(ctx: ManagementContext): Promise<R
       // process spawn, and no other client's read should pay for it.
       const envelope: IntegrationStateEnvelope = requestedClient === "raycast"
         ? { ...state, raycast: (raycastDetectTestHook ?? detectRaycast)() }
-        : state;
+        : requestedClient === "droid"
+          ? {
+              ...state,
+              droidReasoning: {
+                models: droidReasoningModels(input.models),
+                defaults: readOwnedDroidReasoningDefaults(input),
+              },
+            }
+          : state;
       return jsonResponse(envelope, 200, req, ctx.config);
     } catch (error) {
       return internalErrorResponse(error, ctx);
@@ -944,6 +995,8 @@ export async function handleIntegrationRoutes(ctx: ManagementContext): Promise<R
   const requestedOperation: IntegrationPlanOperation = parsed.enabled
     ? (parsed.overwriteConflict === true ? "overwrite" : "apply")
     : "disable";
+  const droidDefaults = readDroidReasoningDefaults(ctx, parsed, requestedClient, requestedOperation);
+  if (droidDefaults instanceof Response) return droidDefaults;
   const binding = planBindingOf(parsed);
   if (binding === "half") return halfBoundResponse(ctx);
   if (binding === "unknown-operation" || (binding !== "none" && binding.operation !== requestedOperation)) {
@@ -964,11 +1017,15 @@ export async function handleIntegrationRoutes(ctx: ManagementContext): Promise<R
      */
     const boundToggle = binding === "none"
       ? null
-      : await buildIntegrationPreviewInput(requestedClient, ctx, integrationStore());
+      : await buildIntegrationPreviewInput(requestedClient, ctx, integrationStore(), droidDefaults);
     if (binding !== "none" && boundToggle === null) return previewUnavailableResponse(ctx);
     const input = boundToggle
       ? boundToggle.input
-      : await buildIntegrationWriteInput(requestedClient, ctx, integrationStore());
+      : await buildIntegrationWriteInput(requestedClient, ctx, integrationStore(), droidDefaults);
+    if (droidDefaults !== undefined) {
+      const invalid = validateDroidReasoningDefaults(input.models, droidDefaults);
+      if (invalid) return invalidDroidDefaultsResponse(ctx, invalid);
+    }
     const guard = binding === "none" ? null : stalePlanGuard(
       requestedClient,
       ctx,
@@ -976,6 +1033,7 @@ export async function handleIntegrationRoutes(ctx: ManagementContext): Promise<R
       { operation: binding.operation },
       binding.fingerprint,
       boundToggle === null ? null : boundToggle.identity,
+      droidDefaults,
     );
     const result = await runIntegrationMutationFlight(
       requestedClient,

package/src/server/management/link-routes.ts

@@ -86,7 +86,7 @@ function port(value: unknown): value is number {
   return typeof value === "number" && Number.isInteger(value) && value >= 1 && value <= 65535;
 }
 
-/** A paired GUI session. Only hub runtimes issue these. */
+/** A GUI session redeemed from an operator-created, one-use pairing grant. */
 function pairedSession(ctx: ManagementContext): boolean {
   return ctx.principal === "gui-session"
     && ctx.sessionControl?.isPaired(ctx.req, ctx.config) === true;
@@ -96,9 +96,8 @@ function pairedSession(ctx: ManagementContext): boolean {
  * A paired session, or on a standalone runtime the current loopback-issued session that reached
  * the public listener bound to a loopback hostname. The loopback bootstrap mints that session
  * without a credential, so this is casual-path protection like POST /api/github/star, not a
- * secret-backed boundary like the admin token. Hubs keep the paired-only rule. Join admits this
- * session too: turning a Child on from its own dashboard is the point of the route, and the
- * dashboard warns first that the restart briefly interrupts running Codex turns.
+ * secret-backed boundary like the admin token. Hubs keep the paired-only rule. Durable operations
+ * that require operator approval, such as joining this machine as a Child, use pairedSession.
  */
 function dashboardSession(ctx: ManagementContext): boolean {
   if (pairedSession(ctx)) return true;
@@ -113,9 +112,10 @@ function adminLoopback(ctx: ManagementContext): boolean {
   return ctx.principal === "admin-token" && ctx.trustedLoopbackIngress;
 }
 
-function auth(ctx: ManagementContext, kind: "dashboard" | "admin" | "either"): Response | null {
+function auth(ctx: ManagementContext, kind: "dashboard" | "paired" | "admin" | "either"): Response | null {
   if (ctx.guiSessionIssuance === "tailscale-identity") return fail("tailscale_session_refused", "Tailscale identity sessions cannot use link routes.", 403);
   const allowed = kind === "dashboard" ? dashboardSession(ctx)
+    : kind === "paired" ? pairedSession(ctx)
     : kind === "admin" ? adminLoopback(ctx)
       : dashboardSession(ctx) || adminLoopback(ctx);
   return allowed ? null : fail("forbidden", "The required link authorization was not present.", 403);
@@ -131,9 +131,14 @@ function joinPortMatches(ctx: ManagementContext): boolean {
   return live !== undefined && live === ctx.config.port;
 }
 
-/** Whether `POST /api/link/join` would pass its admission, role and port gates for this caller. */
-function joinAvailable(ctx: ManagementContext): boolean {
-  return dashboardSession(ctx) && (ctx.config.runtimeRole ?? "standalone") === "standalone" && joinPortMatches(ctx);
+type LinkJoinDenied = "pairing_required" | "standalone_required" | "join_port_mismatch";
+
+/** Read-only explanation of the join gates, in the same order as `POST /api/link/join`. */
+function joinDenied(ctx: ManagementContext): LinkJoinDenied | null {
+  if (!pairedSession(ctx)) return "pairing_required";
+  if ((ctx.config.runtimeRole ?? "standalone") !== "standalone") return "standalone_required";
+  if (!joinPortMatches(ctx)) return "join_port_mismatch";
+  return null;
 }
 
 function runnerFor(ctx: ManagementContext): SshRunner {
@@ -549,9 +554,9 @@ export async function handleLinkRoutes(ctx: ManagementContext, suppliedState?: L
   if (!isLinkPath(path)) return null;
   if (ctx.guiSessionIssuance === "tailscale-identity") return fail("tailscale_session_refused", "Tailscale identity sessions cannot use link routes.", 403);
   if (url.pathname === "/api/link/join" && req.method === "POST") {
-    // The same dashboard admission as the Home side. Every refusal below runs before link state
-    // is read and before any SSH.
-    const denied = auth(ctx, "dashboard");
+    // Joining durably redirects local client traffic, so a credentiallessly bootstrapped loopback
+    // session is insufficient. Every refusal below runs before link state and before any SSH.
+    const denied = auth(ctx, "paired");
     if (denied) return denied;
     if ((ctx.config.runtimeRole ?? "standalone") !== "standalone") return fail("standalone_required", "Client initiated links require standalone runtime mode.", 409);
     if (!joinPortMatches(ctx)) return fail("join_port_mismatch", "OpenCodex is not running on its configured port, so it cannot restart as a Child.", 409);
@@ -578,9 +583,11 @@ export async function handleLinkRoutes(ctx: ManagementContext, suppliedState?: L
       const failure = state.compensationFailures?.get(store.links[0].id);
       if (failure) Object.assign(dto.child, { state: "failed" as const, since: failure.since, reason: failure.reason });
     }
-    // A dashboard session also learns whether it may join as a Child. The admin-token answer stays
+    // A dashboard session also learns why it cannot join as a Child. The admin-token answer stays
     // the exact K16 document that `ocx link status` validates key by key.
-    const body: LinkStatusDto & { joinAvailable?: boolean } = ctx.principal === "gui-session" ? { ...dto, joinAvailable: joinAvailable(ctx) } : dto;
+    const denial = ctx.principal === "gui-session" ? joinDenied(ctx) : null;
+    const body: LinkStatusDto & { joinAvailable?: boolean; joinDenied?: LinkJoinDenied | null } = ctx.principal === "gui-session"
+      ? { ...dto, joinAvailable: denial === null, joinDenied: denial } : dto;
     return Response.json(body, { headers: { "cache-control": "no-store" } });
   }
   if (url.pathname === "/api/link/candidates" && req.method === "GET") {

package/src/server/management/model-row-export-metadata.ts

@@ -0,0 +1,150 @@
+/**
+ * Effective export metadata for custom `/api/models` rows.
+ *
+ * A custom row's own fields are the operator's stored OVERRIDE. `/api/models` returns them
+ * verbatim because the edit dialog must show what the user set — including an explicit empty
+ * "no reasoning" ladder — not what the provider happens to advertise today. But a client
+ * export has to serialize what the proxy will actually route: the canonical resolved catalog
+ * metadata for the same `provider/modelId`. `listManagementModelRows` resolves that
+ * projection here and attaches it additively, so the editor's raw fields and the exporter's
+ * effective fields can never overwrite each other.
+ *
+ * Sources are the ones the routed-row projection already uses — the gathered catalog row for
+ * the same slug (the gather materializes custom rows with provider/native inheritance), the
+ * registry-enriched provider config, and the ladder resolution in `model-rows.ts`. No
+ * independent provider fact tables, and no per-model fetch: everything comes from the roster
+ * and config already in hand.
+ */
+import { enrichProviderFromRegistry } from "../../providers/derive";
+import { modelRecordValue } from "../../reasoning-effort";
+import { configuredReasoningSummarySupport } from "../../codex/catalog/model-hints";
+import type { CatalogModel } from "../../codex/catalog";
+import type { OcxConfig } from "../../types";
+import {
+  knownReasoningSupport,
+  knownToolsSupport,
+  type EffectiveModelExportMetadata,
+} from "../../clients/config-export/contracts";
+
+/** The stored-override fields a custom row carries, exactly as `config.customModels` writes them. */
+export interface CustomRowOverrideSource {
+  provider: string;
+  id: string;
+  contextWindow?: number;
+  inputModalities?: string[];
+  /** Explicit ladder; `[]` is a declaration ("no rungs"), not an absence. */
+  reasoningEfforts?: string[];
+  defaultReasoningEffort?: string;
+}
+
+/**
+ * Resolve the effective export metadata for one custom row.
+ *
+ * Explicit custom overrides win; resolved gathered facts precede provider-config fallbacks.
+ * `effectiveReasoningEfforts` is
+ * supplied by the caller because its resolution (declared ladder first, then the enriched
+ * provider maps, then the pinned native table, then the catalog hints) lives with the other
+ * ladder readers in `model-rows.ts`; here it is an input, resolved once per row.
+ */
+export function customRowExportMetadata(
+  config: OcxConfig,
+  source: CustomRowOverrideSource,
+  catalogRow: CatalogModel | undefined,
+  effectiveReasoningEfforts: string[] | undefined,
+): EffectiveModelExportMetadata {
+  const provider = config.providers[source.provider];
+  // The same registry hydration the other per-model readers at this boundary perform, so a
+  // custom row whose provider declares facts only in the registry still inherits them. The
+  // per-model records are cloned first because the enrichment fills and folds them in place.
+  const enriched = provider === undefined ? undefined : {
+    ...provider,
+    ...(provider.modelContextWindows ? { modelContextWindows: { ...provider.modelContextWindows } } : {}),
+    ...(provider.modelInputModalities ? { modelInputModalities: { ...provider.modelInputModalities } } : {}),
+    ...(provider.modelCapabilities ? { modelCapabilities: { ...provider.modelCapabilities } } : {}),
+    ...(provider.modelReasoningEfforts ? { modelReasoningEfforts: { ...provider.modelReasoningEfforts } } : {}),
+    ...(provider.modelDefaultReasoningEfforts
+      ? { modelDefaultReasoningEfforts: { ...provider.modelDefaultReasoningEfforts } }
+      : {}),
+  };
+  if (enriched) enrichProviderFromRegistry(source.provider, enriched);
+
+  // Gathered resolved context first after the explicit override: the gather already ran the
+  // canonical precedence (operator maps, registry, native clamps) and may have applied a
+  // tighter cap than a config map read here would suggest. Re-reading the config maps ahead
+  // of it would duplicate that policy and could widen past an observed tighter window.
+  const contextWindow = source.contextWindow
+    ?? catalogRow?.contextWindow
+    ?? modelRecordValue(enriched?.modelContextWindows, source.id)
+    ?? enriched?.contextWindow;
+  // Same declaration chain `declaredModelInputModalities` reads, as the fallback when neither
+  // the override nor the gathered row says anything.
+  const declaredModalities = enriched === undefined ? undefined : (
+    enriched.modelCapabilities?.[source.id]?.inputModalities
+      ?? modelRecordValue(enriched.modelInputModalities, source.id)
+  );
+  const inputModalities = source.inputModalities ?? catalogRow?.inputModalities ?? declaredModalities;
+  // The gathered row carries what the materializer already resolved; for a rosterless row the
+  // same reader the materializer uses answers from the provider config, so both paths agree.
+  const supportsReasoningSummaries = catalogRow?.supportsReasoningSummaries
+    ?? configuredReasoningSummarySupport(provider, source.id);
+  const defaultReasoningEffort = declaredDefaultWithin(
+    effectiveReasoningEfforts,
+    defaultEffort(source, catalogRow, provider),
+  );
+  return {
+    ...(contextWindow !== undefined ? { contextWindow } : {}),
+    ...(catalogRow?.maxInputTokens !== undefined ? { maxInputTokens: catalogRow.maxInputTokens } : {}),
+    ...(catalogRow?.maxOutputTokens !== undefined ? { maxTokens: catalogRow.maxOutputTokens } : {}),
+    ...(inputModalities !== undefined ? { inputModalities: [...inputModalities] } : {}),
+    ...(effectiveReasoningEfforts !== undefined ? { reasoningEfforts: [...effectiveReasoningEfforts] } : {}),
+    ...(defaultReasoningEffort !== undefined ? { defaultReasoningEffort } : {}),
+    ...(knownToolsSupport({
+      capabilities: catalogRow?.capabilities,
+      parallelToolCalls: catalogRow?.parallelToolCalls,
+    }) === true ? { supportsTools: true } : {}),
+    ...(knownReasoningSupport({ reasoningEfforts: effectiveReasoningEfforts, supportsReasoningSummaries }) === true
+      ? { supportsReasoning: true }
+      : {}),
+    ...(supportsReasoningSummaries !== undefined ? { supportsReasoningSummaries } : {}),
+  };
+}
+
+/**
+ * The declared default, suppressed unless it is a member of the effective ladder. An empty
+ * ladder has no rung to default to, and a default the ladder does not contain describes an
+ * effort the proxy would never send — the same rule the settings route applies when it
+ * rejects a default "not in the declared reasoningEfforts ladder", applied here so an export
+ * never ships a default the row cannot act on.
+ */
+function declaredDefaultWithin(
+  effectiveReasoningEfforts: string[] | undefined,
+  declared: string | undefined,
+): string | undefined {
+  if (declared === undefined) return undefined;
+  if (effectiveReasoningEfforts === undefined) return declared;
+  return effectiveReasoningEfforts.includes(declared) ? declared : undefined;
+}
+
+/**
+ * The declared default, and nothing else. The ladder-preference fallback
+ * (`effectiveModelDefaultReasoningEffort`'s medium → low → first) fabricates a default no
+ * source declared; it is right for the picker's own preference order but wrong for an export
+ * that claims to carry provider truth, so this projection stops at:
+ *
+ * 1. the explicit custom default (an override always wins),
+ * 2. the gathered catalog row's declared default (the gather only lets it ride when it is a
+ *    member of the effective ladder),
+ * 3. the operator's per-model record — the same raw map the routed-row reader consults.
+ *
+ * `declaredDefaultWithin` then drops the answer when it is not a member of the effective
+ * ladder, empty ladder included.
+ */
+function defaultEffort(
+  source: CustomRowOverrideSource,
+  catalogRow: CatalogModel | undefined,
+  provider: { modelDefaultReasoningEfforts?: Record<string, string> } | undefined,
+): string | undefined {
+  if (source.defaultReasoningEffort) return source.defaultReasoningEffort;
+  if (catalogRow?.defaultReasoningEffort) return catalogRow.defaultReasoningEffort;
+  return modelRecordValue(provider?.modelDefaultReasoningEfforts, source.id) ?? undefined;
+}

package/src/server/management/model-rows.ts

@@ -9,6 +9,7 @@
  * Bodies are unchanged from their previous home; only `export` was added.
  */
 import type { CatalogModel } from "../../codex/catalog";
+import { antigravityFamilyDisabled } from "../../providers/antigravity-effort-families";
 import { observeModelCacheRevision } from "../../codex/model-cache";
 import {
   captureExportConfigAdmission,
@@ -30,7 +31,13 @@ import {
   catalogModelEfforts,
 } from "../../codex/catalog";
 import { SUPPORTED_NATIVE_OPENAI_SLUGS } from "../../codex/catalog/native-models";
-import type { ExportModel } from "../../clients/config-export";
+import {
+  knownReasoningSupport,
+  knownToolsSupport,
+  type EffectiveModelExportMetadata,
+  type ExportModel,
+} from "../../clients/config-export/contracts";
+import { customRowExportMetadata } from "./model-row-export-metadata";
 import { providerContextCap } from "../../providers/context-cap";
 import { isVisionReasoningEffort, modelRecordValue, sanitizeCodexReasoningEfforts } from "../../reasoning-effort";
 import { routedSlug, slugEquals } from "../../providers/slug-codec";
@@ -78,6 +85,28 @@ export type ManagementModelRow = Partial<CatalogModel> & {
    * config — so this compares values against what the model would inherit anyway.
    */
   reasoningOverridden?: boolean;
+  /**
+   * Tool support a canonical source positively asserts (native identity, a catalog row's
+   * `"tools"` capability, or the parallel-call opt-in — the same evidence
+   * `src/routing/capability.ts` counts). A row without positive evidence stays absent:
+   * unknown is not false.
+   */
+  supportsTools?: boolean;
+  /**
+   * True when a canonical source positively asserts reasoning (a non-empty effective ladder
+   * or delivered reasoning summaries). Absent means unknown, never "cannot reason": an empty
+   * ladder only says the effort is not adjustable.
+   */
+  supportsReasoning?: boolean;
+  /**
+   * Effective export projection for a row, resolved from canonical sources only — for a
+   * custom row the full effective view (the raw override fields above stay exactly what the
+   * editor wrote), for routed and native rows the authoritative declared default where the
+   * row's own `defaultReasoningEffort` is the picker's preference order instead. Additive on
+   * `/api/models`, and its PRESENCE is the authority signal: an absent field inside it means
+   * "no declared value", never "fall back to the row".
+   */
+  exportMetadata?: EffectiveModelExportMetadata;
 };
 
 /** Resolve the exact text and source shown for one routed discovered model. */
@@ -322,6 +351,13 @@ export async function listManagementModelRows(
       ...(row.autoCompactTokenLimit !== undefined
         ? { autoCompactTokenLimit: row.autoCompactTokenLimit }
         : {}),
+      // The pinned default above IS the declared default for a native row — no heuristic
+      // touches it — so the authoritative projection carries it verbatim and exists even
+      // when empty, which is what tells an export consumer "absence means no default"
+      // rather than "fall back to the row".
+      exportMetadata: {
+        ...(defaultReasoningEffort !== undefined ? { defaultReasoningEffort } : {}),
+      },
     };
   });
   const customModels: ManagementModelRow[] = (config.customModels ?? []).map(cm => {
@@ -374,6 +410,34 @@ export async function listManagementModelRows(
   // the guard and the value) re-read the same file thousands of times on a large roster.
   const routedSlugs = publicModels.filter(m => m.provider !== "combo").map(m => routedSlug(m.provider, m.id));
   const catalogLadders = catalogModelEfforts([...new Set(routedSlugs)]);
+  // The gathered roster, keyed once by Codex-facing slug. A custom row looks itself up here —
+  // the gather materializes custom rows with the provider/native inheritance the catalog
+  // publishes, so this is the canonical resolved metadata the export must preserve, and no
+  // per-model fetch ever happens to obtain it.
+  const rosterByNamespaced = new Map(publicModels.map(model => [catalogModelSlug(model), model] as const));
+  const customRowsWithExportMetadata = visibleCustomModels.map(model => {
+    const catalogRow = rosterByNamespaced.get(model.namespaced);
+    // The gathered materialization's ladder is authoritative when it has one: it already
+    // folded the explicit override in and then applied the canonical bounds (the native
+    // clamp for a capability-backed id, learned refusals), so re-declaring the raw override
+    // here would undo a bound. Two raw values still win: the explicit empty ladder — "no
+    // rungs" is an operator statement no normalization may fill in, even against a stale
+    // gathered row — and any override with no gathered ladder behind it.
+    const declaredEfforts = Array.isArray(model.reasoningEfforts) && model.reasoningEfforts.length === 0
+      ? model.reasoningEfforts
+      : catalogRow?.reasoningEfforts !== undefined
+        ? catalogRow.reasoningEfforts
+        : model.reasoningEfforts;
+    return {
+      ...model,
+      exportMetadata: customRowExportMetadata(
+        config,
+        model,
+        catalogRow,
+        effectiveModelReasoningEfforts(config, model.provider, model.id, declaredEfforts, catalogLadders),
+      ),
+    };
+  });
   const dedupedRouted = publicModels.map((m): ManagementModelRow | null => {
     // Codex-facing slug (one "/", slug-codec); disabledModels compares tolerate both forms.
     const namespaced = catalogModelSlug(m);
@@ -395,7 +459,7 @@ export async function listManagementModelRows(
       ...m,
       ...displayName,
       namespaced,
-      disabled: [...disabled].some(stored => (
+      disabled: antigravityFamilyDisabled(config, m, models) || [...disabled].some(stored => (
         (!nativeAlias && stored === namespaced) || slugEquals(stored, m.provider, m.id)
       )),
       ...(contextCap !== undefined ? { contextCap, contextCapped: m.contextCapped === true } : {}),
@@ -407,13 +471,25 @@ export async function listManagementModelRows(
       ...(routed ? { reasoningOverridden: reasoningOverrideFor(config, m.provider, m.id, catalogLadders) } : {}),
       ...(inputModalitiesDeclared !== undefined ? { inputModalitiesDeclared } : {}),
       ...(contextWindowDeclared !== undefined ? { contextWindowDeclared } : {}),
+      // The authoritative export default is the GATHERED row's own declared default — never
+      // the picker value above, whose medium → low → first fallback invents a default no
+      // source declared. The object exists even when empty: its presence is what tells
+      // `toExportModel` and the CLI that an absent default means "no default", not "fall
+      // back to the row". A default outside the effective ladder is dropped for the same
+      // reason the settings route rejects one: the proxy would never send it.
+      exportMetadata: {
+        ...(m.defaultReasoningEffort !== undefined
+          && (reasoningEfforts === undefined || reasoningEfforts.includes(m.defaultReasoningEffort))
+          ? { defaultReasoningEffort: m.defaultReasoningEffort }
+          : {}),
+      },
     };
   }).filter((row): row is ManagementModelRow => row !== null);
   // Manual OpenAI rows retain their routed selector but replace the bare dashboard row.
   // Account-qualified rows remain distinct, explicitly selected routes.
   const visibleNative = native.filter(model => model.id.includes("/")
     || !customNamespaced.has(routedSlug(model.provider, model.id)));
-  const rows = [...visibleNative, ...dedupedRouted, ...visibleCustomModels];
+  const rows = [...visibleNative, ...dedupedRouted, ...customRowsWithExportMetadata];
   // Include disabled rows and configured aliases before the export visibility filter:
   // a hidden real `x--fast` must never become a synthetic selector for another model.
   const knownIds = config.fastRows === false ? new Set<string>() : knownEffortRowIds(config);
@@ -422,6 +498,23 @@ export async function listManagementModelRows(
     const pending = initialModelSelectionPending(config.providers[row.provider]);
     const modelCosts = Object.hasOwn(config.providers, row.provider)
       ? config.providers[row.provider]?.modelCosts : undefined;
+    // Derived once here so the wire row carries the same booleans the export projection
+    // serializes; the CLI reads /api/models and cannot re-derive them without duplicating
+    // this policy. Custom rows read their effective view from `exportMetadata`; routed and
+    // native rows read their own evidence.
+    const supportsTools = row.exportMetadata?.supportsTools
+      ?? row.supportsTools
+      ?? knownToolsSupport({
+        capabilities: row.capabilities,
+        parallelToolCalls: row.parallelToolCalls,
+        native: row.native,
+      });
+    const supportsReasoning = row.exportMetadata?.supportsReasoning
+      ?? row.supportsReasoning
+      ?? knownReasoningSupport({
+        reasoningEfforts: row.reasoningEfforts,
+        supportsReasoningSummaries: row.supportsReasoningSummaries,
+      });
     return {
       ...row,
       ...(!row.native && modelCosts !== undefined && Object.hasOwn(modelCosts, row.id)
@@ -429,12 +522,52 @@ export async function listManagementModelRows(
       ...(pending ? { disabled: true, initialSelectionPending: true } : {}),
       fastRowAvailable: !row.disabled && !pending
         && !knownIds.has(fastRowId(row.namespaced)) && catalogFastRowEligible(config, row),
+      // An explicit false survives; derivation itself is true-or-nothing.
+      ...(typeof supportsTools === "boolean" ? { supportsTools } : {}),
+      ...(typeof supportsReasoning === "boolean" ? { supportsReasoning } : {}),
     };
   });
 }
 
-/** `/api/models` row → the narrower input the client-config serializers accept. */
+/**
+ * `/api/models` row → the narrower input the client-config serializers accept.
+ *
+ * A row's `exportMetadata`, when present, is the authority: custom rows project through it
+ * because their own fields are stored overrides (an absent field means "not overridden"),
+ * and routed/native rows carry the declared default in it because the row-level
+ * `defaultReasoningEffort` is the picker's preference order, whose medium → low → first
+ * fallback fabricates a default no source declared.
+ */
 export function toExportModel(row: ManagementModelRow): ExportModel {
+  const effective = row.exportMetadata;
+  const contextWindow = effective?.contextWindow ?? row.contextWindow;
+  const maxTokens = effective?.maxTokens ?? row.maxOutputTokens;
+  const maxInputTokens = effective?.maxInputTokens ?? row.maxInputTokens;
+  const inputModalities = effective?.inputModalities ?? row.inputModalities;
+  const reasoningEfforts = effective?.reasoningEfforts ?? row.reasoningEfforts;
+  // The projection is the authority on the default. When it exists, an absent default means
+  // NO declared default — falling back to the row would reintroduce the picker's synthetic
+  // medium/low value, which is exactly what this projection exists to keep out of exports.
+  // Rows without a projection (native-era shapes, hand-built rows) keep the row's own value.
+  const defaultReasoningEffort = effective !== undefined
+    ? effective.defaultReasoningEffort
+    : row.defaultReasoningEffort;
+  const supportsReasoningSummaries = effective?.supportsReasoningSummaries ?? row.supportsReasoningSummaries;
+  // Projection first, then the row's own explicit boolean (an external producer may state
+  // false, which is evidence), and only then derivation from positive evidence.
+  const supportsTools = effective?.supportsTools
+    ?? row.supportsTools
+    ?? knownToolsSupport({
+      capabilities: row.capabilities,
+      parallelToolCalls: row.parallelToolCalls,
+      native: row.native,
+    });
+  const supportsReasoning = effective?.supportsReasoning
+    ?? row.supportsReasoning
+    ?? knownReasoningSupport({
+      reasoningEfforts: row.reasoningEfforts,
+      supportsReasoningSummaries: row.supportsReasoningSummaries,
+    });
   return {
     namespaced: row.namespaced,
     provider: row.provider,
@@ -442,11 +575,17 @@ export function toExportModel(row: ManagementModelRow): ExportModel {
     fastRowAvailable: row.fastRowAvailable === true,
     ...(row.native ? { native: true } : {}),
     ...(row.displayName && row.displayNameSource !== "fallback" ? { displayName: row.displayName } : {}),
-    ...(row.contextWindow !== undefined ? { contextWindow: row.contextWindow } : {}),
-    ...(row.maxOutputTokens !== undefined ? { maxTokens: row.maxOutputTokens } : {}),
-    ...(row.inputModalities ? { inputModalities: row.inputModalities } : {}),
-    ...(row.reasoningEfforts ? { reasoningEfforts: row.reasoningEfforts } : {}),
-    ...(row.defaultReasoningEffort ? { defaultReasoningEffort: row.defaultReasoningEffort } : {}),
+    ...(contextWindow !== undefined ? { contextWindow } : {}),
+    ...(maxTokens !== undefined ? { maxTokens } : {}),
+    ...(maxInputTokens !== undefined ? { maxInputTokens } : {}),
+    ...(inputModalities ? { inputModalities } : {}),
+    // An empty array is a declaration ("no rungs"), and `[]` is truthy: it survives here.
+    ...(reasoningEfforts ? { reasoningEfforts } : {}),
+    ...(defaultReasoningEffort ? { defaultReasoningEffort } : {}),
+    // An explicit false is evidence and survives; only derivation is true-or-nothing.
+    ...(typeof supportsTools === "boolean" ? { supportsTools } : {}),
+    ...(typeof supportsReasoning === "boolean" ? { supportsReasoning } : {}),
+    ...(supportsReasoningSummaries !== undefined ? { supportsReasoningSummaries } : {}),
   };
 }