@bitkyc08/opencodex 2.80.0 → 2.82.0

package/src/codex/catalog/bundled.ts

@@ -39,6 +39,10 @@ import {
   parsePersistedCodexRuntime,
   peekCodexRuntimeProcessCache,
   resolveAndPersistCodexRuntime,
+  resolveAndPersistCodexRuntimeAsync,
+  codexRuntimeSelectionIdentity,
+  codexRuntimeStateEpoch,
+  execCodexFileAsync,
 } from "../runtime";
 import type {
   DeepReadonly,
@@ -63,7 +67,9 @@ export type ReadonlyRawCatalog = DeepReadonly<RawCatalog>;
 interface BundledCatalogMemo {
   /** Selected runtime identity; must change when doctor/sync picks a different binary. */
   readonly key: string;
+  readonly inputs: string;
   readonly expiresAt: number;
+  readonly refreshAt: number;
   readonly epoch: number;
   readonly valueIdentity: string;
   readonly value: ReadonlyRawCatalog | null;
@@ -76,6 +82,9 @@ export interface BundledCatalogCacheState {
 
 let bundledCatalogEpoch = 0;
 let bundledCatalogCache: BundledCatalogMemo | null = null;
+let bundledCatalogRetry: { inputs: string; epoch: number; after: number } | null = null;
+let bundledCatalogFlight: { inputs: string; epoch: number; controller: AbortController; promise: Promise<ReadonlyRawCatalog | null> } | null = null;
+const catalogAlwaysCurrent = () => true;
 
 function cloneAndDeepFreeze<T>(value: T): DeepReadonly<T> {
   const clone = (current: unknown): unknown => {
@@ -110,14 +119,18 @@ function publishBundledCatalogCache(
   const epoch = ++bundledCatalogEpoch;
   bundledCatalogCache = {
     key,
+    inputs: codexRuntimeSelectionIdentity({ discoverAlternatives: false }),
     expiresAt,
+    refreshAt: Math.min(expiresAt, Date.now() + 15_000),
     epoch,
     valueIdentity: `bundled:${epoch}`,
     value: value === null ? null : cloneAndDeepFreeze(value),
   };
+  bundledCatalogRetry = null;
 }
 
 function clearBundledCatalogCache(): void {
+  bundledCatalogFlight?.controller.abort();
   bundledCatalogEpoch += 1;
   bundledCatalogCache = null;
 }
@@ -162,12 +175,17 @@ export type ExecFile = (
     windowsHide: boolean;
     shell?: boolean;
     windowsVerbatimArguments?: boolean;
+    signal?: AbortSignal;
+    maxBuffer?: number;
   },
 ) => string;
 
 export interface BundledCatalogDeps {
+  /** Already-observed source for server clamping; null never triggers a probe. */
+  observedCatalog?: ReadonlyRawCatalog | null;
   commandCandidates?: () => string[];
   execFileSync?: ExecFile;
+  execFile?: (...args: Parameters<ExecFile>) => Promise<string>;
   onEffortClamp?: (diagnostic: EffortClampDiagnostic) => void;
   configDir?: string;
   env?: NodeJS.ProcessEnv;
@@ -224,11 +242,11 @@ export function codexShimCommandCandidates(): string[] {
   }
 }
 
-export function runCodexDebugModels(
+export function runCodexDebugModels<T>(
   command: string,
-  execFile: ExecFile,
+  execFile: (...args: Parameters<ExecFile>) => T,
   deps: Pick<BundledCatalogDeps, "env" | "platform" | "existsSync"> = {},
-): string {
+): T {
   const args = ["debug", "models", "--bundled"];
   const invocation = codexExecInvocation(command, args, deps.platform ?? process.platform, {
     env: deps.env,
@@ -238,23 +256,19 @@ export function runCodexDebugModels(
     encoding: "utf8" as const,
     stdio: ["ignore", "pipe", "ignore"] as ["ignore", "pipe", "ignore"],
     timeout: 10_000,
+    maxBuffer: 64 * 1024 * 1024,
     windowsHide: true,
     ...invocation.options,
   });
 }
 
-export function loadBundledCodexCatalog(deps: BundledCatalogDeps = {}): ReadonlyRawCatalog | null {
-  const useCache = !deps.commandCandidates && !deps.execFileSync && !deps.configDir && !deps.env;
-  const execFile = deps.execFileSync ?? (execFileSync as unknown as ExecFile);
-  // Prefer the single resolved runtime so sync/clamp never probe a different binary
-  // than OpenCodex will launch. Tests may inject commandCandidates to stub probing.
-  let cacheKey: string | null = null;
-  const candidates = deps.commandCandidates?.() ?? (() => {
-    const resolved = resolveAndPersistCodexRuntime({
+function bundledRuntimeDeps(deps: BundledCatalogDeps) {
+  return {
       // Forward an INJECTED execFileSync only. Passing the real one unconditionally made
       // resolveCacheKey() bail out (it refuses to memoize injected-dep resolves), so every
       // catalog read re-ran the ~1s `codex --version` probe even on a warm cache hit.
       ...(deps.execFileSync ? { execFileSync: deps.execFileSync } : {}),
+      ...(deps.execFile ? { execFile: deps.execFile } : {}),
       configDir: deps.configDir,
       env: deps.env,
       platform: deps.platform,
@@ -266,28 +280,41 @@ export function loadBundledCodexCatalog(deps: BundledCatalogDeps = {}): Readonly
       // which alone can exceed the 3s budget `ocx claude` allows /api/claude-code. Priority
       // selection is identical either way; callers wanting discovery diagnostics opt in.
       discoverAlternatives: deps.discoverAlternatives ?? false,
-    });
-    if (useCache) {
-      cacheKey = bundledRuntimeKey(resolved.runtime);
-    }
-    return [resolved.runtime.command];
-  })();
+  };
+}
+
+function* bundledCatalogSteps(
+  candidates: string[],
+  cacheKey: string | null,
+  current: () => boolean = () => true,
+  publishFailure = true,
+): Generator<string, ReadonlyRawCatalog | null, string | null> {
+  if (cacheKey && bundledCatalogCache?.key === cacheKey && current()) {
+    // The driver validated this same command/version under the new pin/env inputs.
+    // Re-stamp the memo even if its TTL is due, so failed refresh keeps confirmed rows.
+    bundledCatalogCache = { ...bundledCatalogCache,
+      inputs: codexRuntimeSelectionIdentity({ discoverAlternatives: false }) };
+  }
   if (
-    useCache
-    && cacheKey
+    cacheKey
     && bundledCatalogCache
     && bundledCatalogCache.key === cacheKey
+    && bundledCatalogCache.inputs === codexRuntimeSelectionIdentity({ discoverAlternatives: false })
     && bundledCatalogCache.expiresAt > Date.now()
   ) {
+    if (!current()) return null;
+    bundledCatalogCache = { ...bundledCatalogCache, refreshAt: Date.now() + 15_000 };
     return bundledCatalogCache.value === null
       ? null
       : cloneAndDeepFreeze(bundledCatalogCache.value);
   }
   for (const command of unique(candidates)) {
-    try {
-      const catalog = parseCatalogJson(runCodexDebugModels(command, execFile, deps));
+      if (!current()) return null;
+      const output = yield command;
+      if (!current()) return null;
+      const catalog = output === null ? null : parseCatalogJson(output);
       if (catalog && findNativeTemplate(catalog)) {
-        if (useCache && cacheKey) {
+        if (cacheKey) {
           publishBundledCatalogCache(
             cacheKey,
             Date.now() + BUNDLED_CATALOG_CACHE_MS,
@@ -297,9 +324,8 @@ export function loadBundledCodexCatalog(deps: BundledCatalogDeps = {}): Readonly
         }
         return cloneAndDeepFreeze(catalog);
       }
-    } catch { /* try next candidate */ }
   }
-  if (useCache && cacheKey) {
+  if (cacheKey && (publishFailure || bundledCatalogCache?.key !== cacheKey || !bundledCatalogCache?.value) && current()) {
     publishBundledCatalogCache(
       cacheKey,
       Date.now() + BUNDLED_CATALOG_CACHE_MS,
@@ -309,6 +335,109 @@ export function loadBundledCodexCatalog(deps: BundledCatalogDeps = {}): Readonly
   return null;
 }
 
+/** Explicit synchronous CLI driver; request readers use the snapshot below. */
+export function loadBundledCodexCatalog(deps: BundledCatalogDeps = {}): ReadonlyRawCatalog | null {
+  const useCache = !deps.commandCandidates && !deps.execFileSync && !deps.execFile && !deps.configDir && !deps.env;
+  const resolved = deps.commandCandidates ? null : resolveAndPersistCodexRuntime(bundledRuntimeDeps(deps));
+  const inputs = codexRuntimeSelectionIdentity(bundledRuntimeDeps(deps));
+  const steps = bundledCatalogSteps(deps.commandCandidates?.() ?? [resolved!.runtime.command],
+    useCache ? bundledRuntimeKey(resolved!.runtime) : null,
+    () => inputs === codexRuntimeSelectionIdentity(bundledRuntimeDeps(deps)));
+  let step = steps.next();
+  while (!step.done) {
+    let output: string | null = null;
+    try { output = runCodexDebugModels(step.value, deps.execFileSync ?? (execFileSync as unknown as ExecFile), deps); }
+    catch { /* try next candidate */ }
+    step = steps.next(output);
+  }
+  return step.value;
+}
+
+/** Same candidate/parser authority, with version and bundled-model execs off the event loop. */
+export function loadBundledCodexCatalogAsync(
+  deps: BundledCatalogDeps = {},
+  isCurrent: () => boolean = catalogAlwaysCurrent,
+  signal?: AbortSignal,
+): Promise<ReadonlyRawCatalog | null> {
+  if (signal?.aborted || !isCurrent()) return Promise.resolve(null);
+  const view = (promise: Promise<ReadonlyRawCatalog | null>) => {
+    if (!signal) return promise.then(value => isCurrent() ? value : null);
+    let abort: (() => void) | undefined;
+    return Promise.race([promise, new Promise<null>(resolve => {
+      abort = () => resolve(null);
+      signal.addEventListener("abort", abort, { once: true });
+      if (signal.aborted) abort();
+    })]).then(value => isCurrent() && !signal.aborted ? value : null)
+      .finally(() => { if (abort) signal.removeEventListener("abort", abort); });
+  };
+  const runtimeDeps = bundledRuntimeDeps(deps);
+  const inputs = codexRuntimeSelectionIdentity(runtimeDeps);
+  const epoch = bundledCatalogEpoch;
+  const useCache = !deps.commandCandidates && !deps.execFileSync && !deps.execFile && !deps.configDir && !deps.env;
+  if (useCache && bundledCatalogFlight?.inputs === inputs && bundledCatalogFlight.epoch === epoch) {
+    return view(bundledCatalogFlight.promise);
+  }
+  const controller = new AbortController();
+  const flight = { inputs, epoch, controller, promise: Promise.resolve<ReadonlyRawCatalog | null>(null) };
+  if (useCache && !signal && isCurrent === catalogAlwaysCurrent) {
+    bundledCatalogFlight?.controller.abort();
+    bundledCatalogFlight = flight;
+  }
+  const abort = () => controller.abort();
+  signal?.addEventListener("abort", abort, { once: true });
+  if (signal?.aborted) abort();
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  let deadlineReached = false;
+  const work = (async () => {
+    const active = () => !controller.signal.aborted && isCurrent() && bundledCatalogEpoch === epoch;
+    const resolved = deps.commandCandidates ? null : await resolveAndPersistCodexRuntimeAsync({ ...runtimeDeps, signal: controller.signal },
+      () => active() && codexRuntimeSelectionIdentity(runtimeDeps) === inputs);
+    if (!active() || (!deps.commandCandidates && !resolved)) return null;
+    flight.inputs = codexRuntimeSelectionIdentity(runtimeDeps);
+    const runtimeEpoch = codexRuntimeStateEpoch();
+    const current = () => active() && runtimeEpoch === codexRuntimeStateEpoch()
+      && flight.inputs === codexRuntimeSelectionIdentity(runtimeDeps);
+    const steps = bundledCatalogSteps(deps.commandCandidates?.() ?? [resolved!.runtime.command],
+      useCache ? bundledRuntimeKey(resolved!.runtime) : null, current, false);
+    let step = steps.next();
+    while (!step.done) {
+      let output: string | null = null;
+      try { output = await runCodexDebugModels(step.value,
+        (file, args, options) => (deps.execFile ?? execCodexFileAsync)(file, args, { ...options, signal: controller.signal }), deps); }
+      catch { /* preserve last confirmed evidence on failure */ }
+      step = steps.next(output);
+    }
+    return step.value;
+  })().catch(() => null);
+  flight.promise = Promise.race([work, new Promise<null>(resolve => {
+    timer = setTimeout(() => { deadlineReached = true; controller.abort(); resolve(null); }, 45_000);
+    timer.unref?.();
+  })]).then(value => {
+    if (useCache && value === null && (!controller.signal.aborted || deadlineReached)
+      && isCurrent() && bundledCatalogEpoch === epoch
+      && flight.inputs === codexRuntimeSelectionIdentity(runtimeDeps)) {
+      bundledCatalogRetry = { inputs: flight.inputs, epoch, after: Date.now() + BUNDLED_CATALOG_CACHE_MS };
+    }
+    return value;
+  }).finally(() => {
+    clearTimeout(timer);
+    signal?.removeEventListener("abort", abort);
+    controller.abort();
+    if (bundledCatalogFlight === flight) bundledCatalogFlight = null;
+  });
+  return view(flight.promise);
+}
+
+/** Serve only the same selection's last confirmed catalog; refresh never holds a request. */
+export function bundledCodexCatalogSnapshot(): ReadonlyRawCatalog | null {
+  const inputs = codexRuntimeSelectionIdentity({ discoverAlternatives: false });
+  const memo = bundledCatalogCache?.inputs === inputs ? bundledCatalogCache : null;
+  const cooling = bundledCatalogRetry?.inputs === inputs && bundledCatalogRetry.epoch === bundledCatalogEpoch
+    && bundledCatalogRetry.after > Date.now();
+  if ((!memo || memo.refreshAt <= Date.now()) && !cooling) void loadBundledCodexCatalogAsync().catch(() => { /* bounded retry */ });
+  return memo?.value ? cloneAndDeepFreeze(memo.value) : null;
+}
+
 export type CatalogGatherProcessLocalObservation =
   | Readonly<{ state: "unused" }>
   | Readonly<{ state: "used"; epoch: number; valueIdentity: string }>;
@@ -524,7 +653,7 @@ export function loadCatalogForSync(path: string): RawCatalog | null {
 
 export function readCurrentCatalogOrCache(): RawCatalog | null {
   const path = readCodexCatalogPath();
-  const bundled = isDefaultCatalogPath(path) ? loadBundledCodexCatalog() : null;
+  const bundled = isDefaultCatalogPath(path) ? bundledCodexCatalogSnapshot() : null;
   if (bundled) return JSON.parse(JSON.stringify(bundled)) as RawCatalog;
   return readCatalog(path) ?? readCatalog(activeCodexModelsCachePath());
 }
@@ -547,7 +676,7 @@ export function readCurrentCodexModelsCache(): RawCatalog | null {
 
 export function loadCatalogTemplate(): RawEntry | null {
   const catalogPath = readCodexCatalogPath();
-  const bundled = loadBundledCodexCatalog();
+  const bundled = bundledCodexCatalogSnapshot();
   // Template inheritance only. The validity gates in this file keep `findNativeTemplate`
   // so a catalog carrying only a newly launched native row stays valid (#2813).
   const native = findSupportedNativeTemplate(readCatalog(catalogPath))

package/src/codex/catalog/combo-member.ts

@@ -218,6 +218,7 @@ export function resolveComboCatalogMember(
   contextCap?: number,
   callerFallback?: ComboCatalogMemberFallback,
   metadataModelIdCaseFold?: boolean,
+  metadataConfigDir?: string,
 ): CatalogModel | undefined {
   const existing = memberByKey.get(targetKey(target));
   const prov = providers.get(target.provider);
@@ -275,7 +276,7 @@ export function resolveComboCatalogMember(
     // supplies a vision sidecar. Apply the same provider hints used for thin
     // rows before deriving a combo from this complete row.
     const hinted = prov && isModelVisionSidecarConsumer(prov, existing.id)
-      ? applyProviderConfigHints(target.provider, prov, existing, contextCap, metadataModelIdCaseFold)
+      ? applyProviderConfigHints(target.provider, prov, existing, contextCap, metadataModelIdCaseFold, undefined, metadataConfigDir)
       : existing;
     const capped = applyProviderContextCap(hinted.contextWindow, contextCap);
     if (capped === undefined || capped === existing.contextWindow) {
@@ -298,7 +299,7 @@ export function resolveComboCatalogMember(
     provider: target.provider,
   };
   const hinted = prov
-    ? applyProviderConfigHints(target.provider, prov, base, contextCap, metadataModelIdCaseFold)
+    ? applyProviderConfigHints(target.provider, prov, base, contextCap, metadataModelIdCaseFold, undefined, metadataConfigDir)
     : base;
   const hintedContext = typeof hinted.contextWindow === "number" && hinted.contextWindow > 0
     ? hinted.contextWindow

package/src/codex/catalog/control-plane.ts

@@ -0,0 +1,45 @@
+import { CODEX_INTERNAL_OPENAI_MODELS, isCodexControlPlaneModel } from "../control-plane-models";
+import { COMBO_NAMESPACE } from "../../combos";
+import { CODEX_NATIVE_ALIAS_CATALOG_KIND } from "./kinds";
+import { NATIVE_RESERVE_MODEL, SUPPORTED_NATIVE_OPENAI_SLUGS } from "./native-models";
+import { isReserveCatalogProjection } from "./reserve";
+import { pinnedNativeModelRows } from "./pinned-models";
+import type { RawEntry } from "./parsing";
+
+/** Hidden ordinary natives qualify; Reserve, account choices and routed aliases do not. */
+export function hasOrdinaryNativeOpenAiRow(entries: readonly RawEntry[]): boolean {
+  return entries.some(entry => typeof entry.slug === "string"
+    && !entry.slug.includes("/")
+    && SUPPORTED_NATIVE_OPENAI_SLUGS.has(entry.slug)
+    && entry.slug !== NATIVE_RESERVE_MODEL
+    && !isReserveCatalogProjection(entry)
+    && entry.opencodex_catalog_kind !== CODEX_NATIVE_ALIAS_CATALOG_KIND
+    && entry.owned_by !== COMBO_NAMESPACE);
+}
+
+/** Keep internal reviewer metadata separate from native synthesis, picker ordering and account clones. */
+export function withCodexControlPlaneRows(
+  entries: RawEntry[],
+  sourceRows: readonly RawEntry[],
+  includeNativeOpenAi: boolean,
+  wsEnabled: boolean,
+): RawEntry[] {
+  const models = entries.filter(entry => !isCodexControlPlaneModel(entry.slug));
+  if (!includeNativeOpenAi || !hasOrdinaryNativeOpenAiRow(models)) return models;
+  for (const slug of CODEX_INTERNAL_OPENAI_MODELS) {
+    const source = sourceRows.find(entry => entry.slug === slug)
+      ?? pinnedNativeModelRows().find(entry => entry.slug === slug);
+    // A pin without the row degrades to Codex's own task-model fallback rather than failing the
+    // whole catalog write.
+    if (!source) continue;
+    const row: RawEntry = structuredClone(source);
+    row.visibility = "hide";
+    if (wsEnabled) row.supports_websockets = true;
+    else {
+      delete row.supports_websockets;
+      delete row.prefer_websockets;
+    }
+    models.push(row);
+  }
+  return models;
+}

package/src/codex/catalog/effort.ts

@@ -1,3 +1,5 @@
+import { hasOrdinaryNativeOpenAiRow } from "./control-plane";
+import { isCodexControlPlaneModel } from "../control-plane-models";
 import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { copyFileSync, existsSync, mkdirSync, readFileSync, realpathSync } from "node:fs";
@@ -45,6 +47,7 @@ import {
   displayCodexRuntimePath,
   persistEffortClamp,
   resolveAndPersistCodexRuntime,
+  getCodexRuntimeSnapshot,
   UNCLAMPABLE_REASONING_EFFORTS,
   type EffortClampDiagnostic,
 } from "../runtime";
@@ -84,8 +87,14 @@ export function shouldApplyNativeEffortClamp(
     && isCanonicalOpenAiForwardProvider(provider);
 }
 
-export function catalogModelEfforts(slugs: readonly string[]): Map<string, string[]> {
-  const out = new Map<string, string[]>();
+export interface CatalogModelLadder {
+  readonly efforts: string[];
+  readonly defaultEffort?: string;
+}
+
+/** Each slug's reasoning ladder and default as the written Codex catalog offers them. */
+export function catalogModelLadders(slugs: readonly string[]): Map<string, CatalogModelLadder> {
+  const out = new Map<string, CatalogModelLadder>();
   if (slugs.length === 0) return out;
   const catalog = readCatalog(readCodexCatalogPath());
   if (!catalog) return out;
@@ -99,11 +108,19 @@ export function catalogModelEfforts(slugs: readonly string[]): Map<string, strin
       ? entry.supported_reasoning_levels as Array<{ effort?: string }>
       : [];
     const efforts = levels.flatMap(l => typeof l.effort === "string" ? [l.effort] : []);
-    if (efforts.length > 0) out.set(callerSlug, efforts);
+    if (efforts.length === 0) continue;
+    const defaultEffort = typeof entry.default_reasoning_level === "string" && efforts.includes(entry.default_reasoning_level)
+      ? entry.default_reasoning_level
+      : undefined;
+    out.set(callerSlug, defaultEffort === undefined ? { efforts } : { efforts, defaultEffort });
   }
   return out;
 }
 
+export function catalogModelEfforts(slugs: readonly string[]): Map<string, string[]> {
+  return new Map([...catalogModelLadders(slugs)].map(([slug, ladder]) => [slug, ladder.efforts]));
+}
+
 export function catalogEntryEfforts(entry: RawEntry): string[] {
   const levels = Array.isArray(entry.supported_reasoning_levels)
     ? entry.supported_reasoning_levels as Array<{ effort?: string }>
@@ -364,7 +381,9 @@ export function supportedCodexReasoningEffortsFromObservedCatalog(
 }
 
 export function codexSupportedReasoningEfforts(deps: BundledCatalogDeps = {}): ReadonlySet<string> | null {
-  return supportedCodexReasoningEffortsFromObservedCatalog(loadBundledCodexCatalog(deps));
+  return supportedCodexReasoningEffortsFromObservedCatalog(
+    deps.observedCatalog !== undefined ? deps.observedCatalog : loadBundledCodexCatalog(deps),
+  );
 }
 
 export function clampedDefaultEffort(original: string, surviving: readonly string[]): string {
@@ -385,7 +404,7 @@ export function clampEntryToCodexSupportedEfforts(
   entry: RawEntry,
   supported: ReadonlySet<string> | null,
 ): void {
-  if (!supported) return;
+  if (!supported || isCodexControlPlaneModel(entry.slug)) return;
   const levels = Array.isArray(entry.supported_reasoning_levels)
     ? entry.supported_reasoning_levels as Array<{ effort?: string }>
     : null;
@@ -532,6 +551,14 @@ export function clampCatalogModelsToObservedCodexSupport(
     else index += 1;
   }
 
+  // Only Reserve rows are currently omitted above; ordinary natives keep a fallback ladder.
+  // Also repair a persisted orphan so a removed Reserve can never leave a reviewer behind.
+  if (!hasOrdinaryNativeOpenAiRow(models)) {
+    for (let index = models.length - 1; index >= 0; index -= 1) {
+      if (isCodexControlPlaneModel(models[index]!.slug)) models.splice(index, 1);
+    }
+  }
+
   return {
     removedEfforts: [...removed].sort(),
     affectedModels: affected,
@@ -548,7 +575,11 @@ export function clampCatalogModelsToCodexSupport(models: RawEntry[], deps: Bundl
 
   let runtimePath = "codex";
   let runtimeVersion: string | null = null;
-  if (!deps.commandCandidates) {
+  if (deps.observedCatalog !== undefined && !deps.commandCandidates) {
+    const snapshot = getCodexRuntimeSnapshot();
+    runtimePath = snapshot.runtime.command;
+    runtimeVersion = snapshot.runtime.version;
+  } else if (!deps.commandCandidates) {
     try {
       const resolved = resolveAndPersistCodexRuntime({
         execFileSync: deps.execFileSync,

package/src/codex/catalog/gather-capture.ts

@@ -32,6 +32,7 @@ import {
   type OAuthActiveTokenObservation,
 } from "../../oauth";
 import { getAccountSet } from "../../oauth/store";
+import { mayResolveModelsOAuth } from "../../oauth/model-discovery-auth";
 import type { OcxConfig, OcxProviderConfig } from "../../types";
 import { modelInList } from "../../types";
 import { CODEX_REASONING_LEVELS, codexEffortRank, configuredReasoningEfforts, modelRecordValue, sanitizeCodexReasoningEfforts } from "../../reasoning-effort";
@@ -147,6 +148,8 @@ export interface CapturedModelsRequest {
 }
 
 export interface CapturedProviderGather {
+  /** Public metadata reads and refreshes stay bound to this admission root. */
+  readonly metadataConfigDir: string;
   readonly name: string;
   readonly provider: OcxProviderConfig;
   readonly discovery: ResolvedProviderModelDiscovery;
@@ -353,6 +356,7 @@ export function captureProviderGather(
   retainConfiguredModelIds?: ReadonlySet<string>,
   config?: Pick<OcxConfig, "providers">,
 ): CapturedProviderGather {
+  const metadataConfigDir = getConfigDir();
   const enriched = detachedClone(withCanonicalOpenAiForwardAuthDefault(name, configured));
   enrichProviderFromRegistry(name, enriched);
   const registryTransportMatch = providerMatchesRegistryTransport(name, enriched);
@@ -389,15 +393,15 @@ export function captureProviderGather(
     ? authResolver.resolve(name, provider)
     : undefined;
   // A refreshing capture carries the stored origin so accounts on different hosts keep separate
-  // flights. The send is rebuilt from the auth the gather resolves, and the observed path never
+  // flights. Host-scoped auth rebuilds its request; B retains its configured captured target. Observed capture never
   // reads the live store.
   const oauthApiBaseUrl = observedAuth
     ? observedAuth.oauthApiBaseUrl
-    : authResolver.kind === "refreshing" && provider.authMode === "oauth"
+    : authResolver.kind === "refreshing" && provider.authMode === "oauth" && mayResolveModelsOAuth(name, provider)
       ? getOAuthCredentialApiBaseUrl(name)
       : undefined;
   const request = captureModelsRequest(name, provider, oauthApiBaseUrl);
-  const refreshingOAuthAccountId = !observedAuth && authResolver.kind === "refreshing" && provider.authMode === "oauth"
+  const refreshingOAuthAccountId = !observedAuth && authResolver.kind === "refreshing" && provider.authMode === "oauth" && mayResolveModelsOAuth(name, provider)
     ? getAccountSet(name)?.activeAccountId
     : undefined;
   const resolved = resolveProviderModelDiscovery(name, provider);
@@ -427,6 +431,7 @@ export function captureProviderGather(
   const effectiveAlias = effectiveProviderAliasDecision(name, configured, config);
   return Object.freeze({
     name,
+    metadataConfigDir,
     provider,
     discovery,
     policy,
@@ -481,6 +486,7 @@ export function captureGatherFlight(
     providerGraphIdentity: keyedGatherIdentity("catalog-gather-provider-graph-v1",
       providers.map(provider => ({
         name: provider.name,
+        metadataConfigDir: provider.metadataConfigDir,
         // `fetch` is a caller-owned transport executor, not admitted state: the
         // outbound transport honors it so a caller can supply its own HTTP path.
         // It is the one member of a provider row that is legitimately a function,
@@ -531,6 +537,7 @@ function providerCatalogFingerprint(name: string, prov: OcxProviderConfig): Reco
     live: prov.liveModels ?? null,
     base: prov.baseUrl ?? "",
     adapter: prov.adapter ?? "",
+    instance: prov.anthropicOAuthInstance ?? null,
     models: [...(prov.models ?? [])].sort(),
     retain: [...(prov.retainModels ?? [])].sort(),
     selected: [...(prov.selectedModels ?? [])].sort(),

package/src/codex/catalog/model-hints.ts

@@ -35,7 +35,7 @@ import { modelInList } from "../../types";
 import { CODEX_REASONING_LEVELS, codexEffortRank, configuredReasoningEfforts, modelRecordValue, sanitizeCodexReasoningEfforts } from "../../reasoning-effort";
 import { isModelVisionSidecarConsumer } from "../../vision/eligibility";
 import { getModelMetadata, getModelMetadataCaseInsensitive, listModelMetadata, resolveMetadataProvider, type ModelMetadata } from "../../generated/model-metadata";
-import { enrichProviderFromRegistry, shouldCaseFoldMetadataModelId } from "../../providers/derive";
+import { azureVendorModelMetadata, enrichProviderFromRegistry, shouldCaseFoldMetadataModelId } from "../../providers/derive";
 import {
   captureFastPolicyAuthority,
   fastPolicyForModel,
@@ -217,9 +217,11 @@ export function routedMaxOutputTokens(
   model: CatalogModel,
   metadataId = model.id,
   metadataModelIdCaseFold?: boolean,
+  metadataConfigDir?: string,
 ): number | undefined {
   const discovered = positiveSafeInteger(model.maxOutputTokens);
-  const generated = generatedMaxOutputTokens(providerName, model.id, metadataId, metadataModelIdCaseFold);
+  const generated = positiveSafeInteger(azureVendorModelMetadata(provider.baseUrl, metadataId, metadataConfigDir)?.maxTokens)
+    ?? generatedMaxOutputTokens(providerName, model.id, metadataId, metadataModelIdCaseFold);
   const configured = positiveSafeInteger(
     modelRecordValue(provider.modelMaxOutputTokens, model.id),
   );
@@ -255,6 +257,7 @@ export function applyProviderConfigHints(
   providerCap?: number,
   metadataModelIdCaseFold?: boolean,
   effectiveAlias?: string | null,
+  metadataConfigDir?: string,
 ): CatalogModel {
   const staticPolicy = resolveModelPolicy({
     providerName: name,
@@ -276,13 +279,14 @@ export function applyProviderConfigHints(
     : model.providerAlias;
   const configuredCap = staticPolicy.model.contextWindow ?? configuredContextWindow(prov, model.id);
   const configuredMaxInput = staticPolicy.model.maxInputTokens;
-  const maxOutputTokens = routedMaxOutputTokens(name, prov, model, model.id, metadataModelIdCaseFold);
+  const azureMetadata = azureVendorModelMetadata(prov.baseUrl, model.id, metadataConfigDir);
+  const maxOutputTokens = routedMaxOutputTokens(name, prov, model, model.id, metadataModelIdCaseFold, metadataConfigDir);
   const configuredAutoCompact = configuredAutoCompactTokenLimit(prov, model.id);
   // The resolver owns exact capability precedence and legacy exact/colon-family/case-fold fallback.
   // Removing an exact capability row therefore returns this projection to legacy-map inference.
-  let inputModalities = staticPolicy.model.inputModalities
-    ? [...staticPolicy.model.inputModalities]
-    : undefined;
+  const resolvedModalities = staticPolicy.model.inputModalities ?? model.inputModalities
+    ?? (azureMetadata?.input ? modelInputModalities({ id: model.id, input_modalities: azureMetadata.input }, undefined) : undefined);
+  let inputModalities = resolvedModalities ? [...resolvedModalities] : undefined;
   // The shared vision-sidecar consumer predicate keeps catalog advertisement and request-time
   // planning aligned. The catalog must still advertise image input — the Codex app
   // gates attachments client-side on input_modalities, and a text-only entry would block images
@@ -319,6 +323,7 @@ export function applyProviderConfigHints(
     ...(typeof model.maxInputTokens === "number" && model.maxInputTokens > 0 ? { maxInputTokens: model.maxInputTokens } : {}),
   });
   const hintedWindow = projectedLimits.contextWindow
+    ?? positiveSafeInteger(azureMetadata?.contextWindow)
     ?? (providerCap !== undefined ? resolveUnknownRoutedContextWindow(providerCap) : undefined);
   const hinted = {
     ...modelWithoutServiceTier,
@@ -383,8 +388,9 @@ export function catalogHintsFromProviderConfig(
   contextCap?: number,
   metadataModelIdCaseFold?: boolean,
   effectiveAlias?: string | null,
+  metadataConfigDir?: string,
 ): Partial<CatalogModel> {
-  const hinted = applyProviderConfigHints(name, prov, { id, provider: name }, contextCap, metadataModelIdCaseFold, effectiveAlias);
+  const hinted = applyProviderConfigHints(name, prov, { id, provider: name }, contextCap, metadataModelIdCaseFold, effectiveAlias, metadataConfigDir);
   const { provider: _provider, id: _id, ...hints } = hinted;
   return hints;
 }
@@ -396,8 +402,9 @@ export function applyConfigHintsToCachedModels(
   contextCap?: number,
   metadataModelIdCaseFold?: boolean,
   effectiveAlias?: string | null,
+  metadataConfigDir?: string,
 ): CatalogModel[] {
-  return models.map(model => applyProviderConfigHints(name, prov, model, contextCap, metadataModelIdCaseFold, effectiveAlias));
+  return models.map(model => applyProviderConfigHints(name, prov, model, contextCap, metadataModelIdCaseFold, effectiveAlias, metadataConfigDir));
 }
 
 /** Catalog slugs whose configured model must not gain a missing synthetic max rung. */

package/src/codex/catalog/model-visibility.ts

@@ -230,6 +230,7 @@ export function mergeConfiguredModelsIntoLiveCatalog(opts: {
   seedVertexDefault?: boolean;
   retainComboTargets?: boolean;
   metadataModelIdCaseFold?: boolean;
+  metadataConfigDir?: string;
 }): { models: CatalogModel[]; droppedConfiguredIds: string[] } {
   const {
     name,
@@ -240,6 +241,7 @@ export function mergeConfiguredModelsIntoLiveCatalog(opts: {
     seedVertexDefault,
     retainComboTargets = true,
     metadataModelIdCaseFold,
+    metadataConfigDir,
   } = opts;
   const out = [...opts.models];
   const present = new Set(out.map(model => model.id));
@@ -248,7 +250,7 @@ export function mergeConfiguredModelsIntoLiveCatalog(opts: {
     if (present.has(candidate.id)) continue;
     const dated = out.find(live => isDatedVariantId(live.id, candidate.id));
     if (dated) {
-      out.push(applyProviderConfigHints(name, prov, { ...dated, id: candidate.id }, contextCap, metadataModelIdCaseFold));
+      out.push(applyProviderConfigHints(name, prov, { ...dated, id: candidate.id }, contextCap, metadataModelIdCaseFold, undefined, metadataConfigDir));
       present.add(candidate.id);
       continue;
     }