@bitkyc08/opencodex 2.80.0 → 2.82.0

package/src/codex/catalog/operator-tiers.ts

@@ -0,0 +1,38 @@
+import type { RawEntry } from "./parsing";
+
+/** Match the opt-in tier spelling without coercing malformed catalog values to strings. */
+function isUltraFast(value: unknown): boolean {
+  return typeof value === "string" && value.trim().toLowerCase() === "ultrafast";
+}
+
+/** Recognize an explicitly supplied Ultra Fast descriptor by its string-valued id. */
+function isUltraFastDescriptor(value: unknown): boolean {
+  return value !== null && typeof value === "object" && "id" in value && isUltraFast(value.id);
+}
+
+/** Restore only exact-row operator metadata, after fresh provider capabilities are applied. */
+export function preserveOperatorUltraFastTiers(entry: RawEntry, previous: RawEntry | undefined, enabled: boolean): void {
+  // A native template or stale row is not authority for this opt-in. Keep all other fresh
+  // tier policy, including Fast, while replacing only Ultra Fast from the exact persisted row.
+  for (const [field, matches] of [
+    ["service_tiers", isUltraFastDescriptor],
+    ["additional_speed_tiers", isUltraFast],
+  ] as const) {
+    const current = entry[field];
+    const fresh = Array.isArray(current) ? current.filter(value => !matches(value)) : [];
+    const old = previous?.[field];
+    const supplied = enabled && Array.isArray(old) ? old.find(matches) : undefined;
+    if (supplied !== undefined) {
+      entry[field] = [...fresh, structuredClone(supplied)];
+    } else if (Array.isArray(current) && fresh.length !== current.length) {
+      if (fresh.length > 0) entry[field] = fresh;
+      else delete entry[field];
+    }
+  }
+  const hasDeclaration = (Array.isArray(entry.service_tiers) && entry.service_tiers.some(isUltraFastDescriptor))
+    || (Array.isArray(entry.additional_speed_tiers) && entry.additional_speed_tiers.some(isUltraFast));
+  for (const field of ["service_tier", "default_service_tier"] as const) {
+    if (enabled && hasDeclaration && previous && isUltraFast(previous[field])) entry[field] = previous[field];
+    else if (isUltraFast(entry[field])) delete entry[field];
+  }
+}

package/src/codex/catalog/parsing.ts

@@ -1,3 +1,4 @@
+import { isCodexControlPlaneModel } from "../control-plane-models";
 import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { copyFileSync, existsSync, mkdirSync, readFileSync, realpathSync } from "node:fs";
@@ -700,7 +701,7 @@ export function catalogEntryIsNativeChatGpt(entry: RawEntry): boolean {
     && entry.use_responses_lite === true
     && hasNativeOpenAiCapabilityMetadata(routedNativeSlug)
   ) return true;
-  if (UPSTREAM_NATIVE_ENTRIES.has(slug) || SUPPORTED_NATIVE_OPENAI_SLUGS.has(slug)) return true;
+  if (isCodexControlPlaneModel(slug) || UPSTREAM_NATIVE_ENTRIES.has(slug) || SUPPORTED_NATIVE_OPENAI_SLUGS.has(slug)) return true;
   return false;
 }
 

package/src/codex/catalog/provider-models.ts

@@ -1,3 +1,4 @@
+import { isAnthropicOAuthInstance } from "../../providers/anthropic-instance";
 import { effectiveProviderAlias, effectiveProviderAliasDecision } from "../../providers/default-aliases";
 import { initialModelSelectionPending } from "../../providers/initial-model-selection";
 import { execFileSync } from "node:child_process";
@@ -28,17 +29,19 @@ import {
 } from "../model-cache";
 import {
   buildModelsRequest,
-  getValidAccessTokenSnapshot,
+  getModelsOAuthAccessSnapshot,
   observeActiveOAuthAccessToken,
   resolveModelsAuthToken,
   type OAuthActiveTokenObservation,
 } from "../../oauth";
+import { mayResolveModelsOAuth } from "../../oauth/model-discovery-auth";
 import type { OcxConfig, OcxProviderConfig } from "../../types";
 import { modelInList } from "../../types";
 import { CODEX_REASONING_LEVELS, codexEffortRank, configuredReasoningEfforts, modelRecordValue, sanitizeCodexReasoningEfforts } from "../../reasoning-effort";
 import { isModelVisionSidecarConsumer } from "../../vision/eligibility";
 import { getModelMetadata, getModelMetadataCaseInsensitive, listModelMetadata, resolveMetadataProvider, type ModelMetadata } from "../../generated/model-metadata";
 import { enrichProviderFromRegistry, shouldCaseFoldMetadataModelId } from "../../providers/derive";
+import { isAzureModelMetadataDestination, refreshAzureModelMetadata } from "../../providers/azure-model-metadata";
 import {
   captureFastPolicyAuthority,
   fastPolicyForModel,
@@ -145,7 +148,8 @@ export function observedModelsAuthResolver(
         return { apiKey: resolveProviderApiKey(provider.apiKey), observed: true };
       }
 
-      const observation = observeActiveOAuthAccessToken(name, authStoreBuffer);
+      const observation: OAuthActiveTokenObservation = mayResolveModelsOAuth(name, provider)
+        ? observeActiveOAuthAccessToken(name, authStoreBuffer) : { kind: "missing" };
       outcomes.push({ provider: name, state: observation.kind });
       if (observation.kind !== "available") return { apiKey: undefined, observed: true };
       return {
@@ -166,7 +170,8 @@ export async function fetchProviderModelsWithAuth(
   contextCap: number | undefined,
   resolveAuth: ModelsAuthResolver,
 ): Promise<ProviderModelsResult> {
-  const { name, provider: prov, discovery, metadataModelIdCaseFold } = captured;
+  const { name, provider: prov, discovery, metadataModelIdCaseFold, metadataConfigDir } = captured;
+  const azureMetadata = isAzureModelMetadataDestination(prov.baseUrl);
   const observed = (
     models: CatalogModel[],
     state: CatalogGatherProviderModelOutcome["state"],
@@ -179,9 +184,10 @@ export async function fetchProviderModelsWithAuth(
   // generation, so a request started with the former account cannot later publish its result.
   const cacheGeneration = captureModelCacheGeneration(name);
   const isCurrentCacheGeneration = () => isModelCacheGenerationCurrent(name, cacheGeneration);
-  const anthropicSelection = name === "anthropic" && prov.authMode === "oauth"
+  const anthropicSelection = isAnthropicOAuthInstance(name) && prov.authMode === "oauth" && mayResolveModelsOAuth(name, prov)
     ? captureOAuthAccountSelection(name) : null;
   if (prov.authMode === "forward") return observed([], "authoritative"); // ChatGPT backend has no /models
+  if (azureMetadata) await refreshAzureModelMetadata(prov.baseUrl, metadataConfigDir);
   const seedVertexDefault = prov.adapter === "google"
     && prov.googleMode === "vertex"
     && (prov.models?.length ?? 0) === 0
@@ -200,7 +206,7 @@ export async function fetchProviderModelsWithAuth(
   const configured: CatalogModel[] = configuredIds.map(id => ({
     id,
     provider: name,
-    ...catalogHintsFromProviderConfig(name, prov, id, contextCap, metadataModelIdCaseFold, captured.effectiveAlias),
+    ...catalogHintsFromProviderConfig(name, prov, id, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir),
   }));
   const withConfiguredRetention = (
     models: CatalogModel[],
@@ -216,6 +222,7 @@ export async function fetchProviderModelsWithAuth(
       seedVertexDefault,
       retainComboTargets: options?.retainComboTargets,
       metadataModelIdCaseFold,
+      metadataConfigDir,
     });
     if (
       options?.warnDrops === true
@@ -248,7 +255,7 @@ export async function fetchProviderModelsWithAuth(
       }
       return observed(ids.map(id => {
         const hints = catalogHintsFromProviderConfig(name, prov, id, contextCap,
-          metadataModelIdCaseFold, captured.effectiveAlias);
+          metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir);
         const observedWindow = kiroObservedContextWindow(id);
         return { id, provider: name, ...hints,
           ...(observedWindow !== undefined
@@ -257,9 +264,11 @@ export async function fetchProviderModelsWithAuth(
     }
     return observed(configured, "authoritative");
   }
-  const auth: ModelsAuthResolution = captured.observedAuth ?? (resolveAuth.kind === "refreshing"
+  const auth: ModelsAuthResolution = prov.authMode === "oauth" && !mayResolveModelsOAuth(name, prov)
+    ? { apiKey: undefined, observed: resolveAuth.kind === "observed" }
+    : captured.observedAuth ?? (resolveAuth.kind === "refreshing"
     ? prov.authMode === "oauth"
-      ? await getValidAccessTokenSnapshot(name)
+      ? await getModelsOAuthAccessSnapshot(name, prov)
         .then(snapshot => ({
           apiKey: snapshot.accessToken,
           observed: false,
@@ -274,7 +283,8 @@ export async function fetchProviderModelsWithAuth(
     : resolveAuth.resolve(name, prov));
   const apiKey = auth.apiKey;
   const maySendAnthropicDiscovery = () => {
-    if (name !== "anthropic" || prov.authMode !== "oauth") return true;
+    if (!isAnthropicOAuthInstance(name) || prov.authMode !== "oauth") return true;
+    if (!mayResolveModelsOAuth(name, prov)) return false;
     const selected = captureOAuthAccountSelection(name);
     const row = auth.oauthAccountId ? getAccountCredentialWithStatus(name, auth.oauthAccountId) : null;
     return !!anthropicSelection && !!selected && !!row && !row.paused && !row.needsReauth
@@ -290,7 +300,7 @@ export async function fetchProviderModelsWithAuth(
     : [{
       id: prov.defaultModel,
       provider: name,
-      ...catalogHintsFromProviderConfig(name, prov, prov.defaultModel, contextCap, metadataModelIdCaseFold, captured.effectiveAlias),
+      ...catalogHintsFromProviderConfig(name, prov, prov.defaultModel, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir),
     }];
   const vertexDefaultSeed = seedVertexDefault ? configured[0] : undefined;
   const withVertexDefaultSeed = (models: CatalogModel[]): CatalogModel[] => (
@@ -312,13 +322,13 @@ export async function fetchProviderModelsWithAuth(
     const fresh = getFreshCached(name, ttlMs, Date.now(), authorityIdentity);
     if (fresh) {
       return observed(withConfiguredRetention(
-        applyConfigHintsToCachedModels(name, prov, fresh, contextCap, metadataModelIdCaseFold, captured.effectiveAlias),
+        applyConfigHintsToCachedModels(name, prov, fresh, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir),
       ), "authoritative");
     }
     const scopedStale = getStaleCached(name, authorityIdentity);
     if (isModelsFetchCoolingDown(name, undefined, undefined, authorityIdentity) && scopedStale) {
       return observed(withConfiguredRetention(
-        applyConfigHintsToCachedModels(name, prov, scopedStale, contextCap, metadataModelIdCaseFold, captured.effectiveAlias),
+        applyConfigHintsToCachedModels(name, prov, scopedStale, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir),
       ), "degraded");
     }
     const live = await fetchCodeBuddyModels(profile, apiKey);
@@ -326,7 +336,7 @@ export async function fetchProviderModelsWithAuth(
       const discovered = live.models.map(id => ({
         id,
         provider: name,
-        ...catalogHintsFromProviderConfig(name, prov, id, contextCap, metadataModelIdCaseFold, captured.effectiveAlias),
+        ...catalogHintsFromProviderConfig(name, prov, id, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir),
       }));
       const forCache = withConfiguredRetention(discovered, { retainComboTargets: false });
       if (!setCached(name, forCache, Date.now(), cacheGeneration, authorityIdentity)) {
@@ -342,7 +352,7 @@ export async function fetchProviderModelsWithAuth(
     }
     const stale = getStaleCached(name, authorityIdentity);
     return observed(withConfiguredRetention(
-      stale ? applyConfigHintsToCachedModels(name, prov, stale, contextCap, metadataModelIdCaseFold, captured.effectiveAlias) : configured,
+      stale ? applyConfigHintsToCachedModels(name, prov, stale, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir) : configured,
     ), "degraded");
   }
   if (name === "zed" && prov.adapter === "zed") {
@@ -355,14 +365,14 @@ export async function fetchProviderModelsWithAuth(
     const cached = getFreshCached(name, ttlMs, Date.now(), authorityIdentity);
     if (cached) {
       return observed(
-        withConfiguredRetention(applyConfigHintsToCachedModels(name, prov, cached, contextCap, metadataModelIdCaseFold, captured.effectiveAlias)),
+        withConfiguredRetention(applyConfigHintsToCachedModels(name, prov, cached, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir)),
         "authoritative",
       );
     }
     const stale = getStaleCached(name, authorityIdentity);
     if (isModelsFetchCoolingDown(name, undefined, undefined, authorityIdentity) && stale) {
       return observed(
-        withConfiguredRetention(applyConfigHintsToCachedModels(name, prov, stale, contextCap, metadataModelIdCaseFold, captured.effectiveAlias)),
+        withConfiguredRetention(applyConfigHintsToCachedModels(name, prov, stale, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir)),
         "degraded",
       );
     }
@@ -382,7 +392,7 @@ export async function fetchProviderModelsWithAuth(
           ...(model.maxOutputTokens ? { maxOutputTokens: model.maxOutputTokens } : {}),
           ...(model.supportsImages ? { inputModalities: ["text", "image"] } : {}),
           ...(reasoningEfforts?.length ? { reasoningEfforts } : {}),
-          ...catalogHintsFromProviderConfig(name, prov, model.id, contextCap, metadataModelIdCaseFold, captured.effectiveAlias),
+          ...catalogHintsFromProviderConfig(name, prov, model.id, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir),
         } as CatalogModel;
       });
       const forCache = withConfiguredRetention(discovered, { retainComboTargets: false });
@@ -397,7 +407,7 @@ export async function fetchProviderModelsWithAuth(
         markProviderDiscoveryFailed(name, { reason: "provider" });
       }
       return observed(
-        withConfiguredRetention(stale ? applyConfigHintsToCachedModels(name, prov, stale, contextCap, metadataModelIdCaseFold, captured.effectiveAlias) : configured),
+        withConfiguredRetention(stale ? applyConfigHintsToCachedModels(name, prov, stale, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir) : configured),
         "degraded",
       );
     }
@@ -413,13 +423,13 @@ export async function fetchProviderModelsWithAuth(
     const fresh = getFreshCached(name, ttlMs, Date.now(), authorityIdentity);
     if (fresh) {
       return observed(withConfiguredRetention(
-        applyConfigHintsToCachedModels(name, prov, fresh, contextCap, metadataModelIdCaseFold, captured.effectiveAlias),
+        applyConfigHintsToCachedModels(name, prov, fresh, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir),
       ), "authoritative");
     }
     const scopedStale = getStaleCached(name, authorityIdentity);
     if (isModelsFetchCoolingDown(name) && scopedStale) {
       return observed(withConfiguredRetention(
-        applyConfigHintsToCachedModels(name, prov, scopedStale, contextCap, metadataModelIdCaseFold, captured.effectiveAlias),
+        applyConfigHintsToCachedModels(name, prov, scopedStale, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir),
       ), "degraded");
     }
     const live = await fetchQoderModels(profile, apiKey);
@@ -427,7 +437,7 @@ export async function fetchProviderModelsWithAuth(
       const discovered = live.models.map(id => ({
         id,
         provider: name,
-        ...catalogHintsFromProviderConfig(name, prov, id, contextCap, metadataModelIdCaseFold, captured.effectiveAlias),
+        ...catalogHintsFromProviderConfig(name, prov, id, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir),
       }));
       const forCache = withConfiguredRetention(discovered, { retainComboTargets: false });
       if (!setCached(name, forCache, Date.now(), cacheGeneration, authorityIdentity)) {
@@ -443,7 +453,7 @@ export async function fetchProviderModelsWithAuth(
     }
     const stale = getStaleCached(name, authorityIdentity);
     return observed(withConfiguredRetention(
-      stale ? applyConfigHintsToCachedModels(name, prov, stale, contextCap, metadataModelIdCaseFold, captured.effectiveAlias) : configured,
+      stale ? applyConfigHintsToCachedModels(name, prov, stale, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir) : configured,
     ), "degraded");
   }
   if (prov.adapter === "devin") {
@@ -458,7 +468,7 @@ export async function fetchProviderModelsWithAuth(
     const cachedDevin = getFreshCached(name, ttlMs, Date.now(), authorityIdentity);
     if (cachedDevin) {
       return observed(
-        withConfiguredRetention(applyConfigHintsToCachedModels(name, prov, cachedDevin)),
+        withConfiguredRetention(applyConfigHintsToCachedModels(name, prov, cachedDevin, undefined, undefined, undefined, metadataConfigDir)),
         "authoritative",
       );
     }
@@ -466,7 +476,7 @@ export async function fetchProviderModelsWithAuth(
       const cooling = getStaleCached(name, authorityIdentity);
       return observed(
         withConfiguredRetention(
-          cooling ? applyConfigHintsToCachedModels(name, prov, cooling) : configured,
+          cooling ? applyConfigHintsToCachedModels(name, prov, cooling, undefined, undefined, undefined, metadataConfigDir) : configured,
         ),
         "degraded",
       );
@@ -508,7 +518,7 @@ export async function fetchProviderModelsWithAuth(
           // record and the vision-sidecar rewrite keep winning — the live
           // value survives only when none of them applies.
           ...(liveResult.inputModalities[id]?.length ? { inputModalities: liveResult.inputModalities[id] } : {}),
-          ...catalogHintsFromProviderConfig(name, prov, id, contextCap, metadataModelIdCaseFold, captured.effectiveAlias),
+          ...catalogHintsFromProviderConfig(name, prov, id, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir),
         } as CatalogModel;
       });
       const forCache = withConfiguredRetention(result, { retainComboTargets: false });
@@ -524,7 +534,7 @@ export async function fetchProviderModelsWithAuth(
     }
     const stale = getStaleCached(name, authorityIdentity);
     return observed(
-      withConfiguredRetention(stale ? applyConfigHintsToCachedModels(name, prov, stale) : configured),
+      withConfiguredRetention(stale ? applyConfigHintsToCachedModels(name, prov, stale, undefined, undefined, undefined, metadataConfigDir) : configured),
       "degraded",
     );
   }
@@ -541,7 +551,7 @@ export async function fetchProviderModelsWithAuth(
     const cachedCursor = getFreshCached(name, ttlMs, Date.now(), authorityIdentity);
     if (cachedCursor) {
       return observed(
-        withConfiguredRetention(applyConfigHintsToCachedModels(name, prov, cachedCursor, undefined, metadataModelIdCaseFold, captured.effectiveAlias)),
+        withConfiguredRetention(applyConfigHintsToCachedModels(name, prov, cachedCursor, undefined, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir)),
         "authoritative",
       );
     }
@@ -549,7 +559,7 @@ export async function fetchProviderModelsWithAuth(
       const cooling = getStaleCached(name, authorityIdentity);
       return observed(
         withConfiguredRetention(
-          cooling ? applyConfigHintsToCachedModels(name, prov, cooling, undefined, metadataModelIdCaseFold, captured.effectiveAlias) : configured,
+          cooling ? applyConfigHintsToCachedModels(name, prov, cooling, undefined, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir) : configured,
         ),
         "degraded",
       );
@@ -595,7 +605,7 @@ export async function fetchProviderModelsWithAuth(
     const staleCursor = getStaleCached(name, authorityIdentity);
     return observed(
       withConfiguredRetention(
-        staleCursor ? applyConfigHintsToCachedModels(name, prov, staleCursor, undefined, metadataModelIdCaseFold, captured.effectiveAlias) : configured,
+        staleCursor ? applyConfigHintsToCachedModels(name, prov, staleCursor, undefined, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir) : configured,
       ),
       "degraded",
     );
@@ -613,7 +623,7 @@ export async function fetchProviderModelsWithAuth(
   if (fresh) {
     return observed(
       withConfiguredRetention(
-        withVertexDefaultSeed(applyConfigHintsToCachedModels(name, prov, fresh, contextCap, metadataModelIdCaseFold, captured.effectiveAlias)),
+        withVertexDefaultSeed(applyConfigHintsToCachedModels(name, prov, fresh, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir)),
       ),
       "authoritative",
     ); // dedups Codex's frequent /v1/models polling within the TTL
@@ -625,7 +635,7 @@ export async function fetchProviderModelsWithAuth(
     return observed(
       withConfiguredRetention(
         stale
-          ? withVertexDefaultSeed(applyConfigHintsToCachedModels(name, prov, stale, contextCap, metadataModelIdCaseFold, captured.effectiveAlias))
+          ? withVertexDefaultSeed(applyConfigHintsToCachedModels(name, prov, stale, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir))
           : failedDiscoveryConfigured,
       ),
       "degraded",
@@ -633,7 +643,7 @@ export async function fetchProviderModelsWithAuth(
   }
   // The captured request predates any refresh, so a refreshing gather rebuilds it
   // from the auth it resolved: the token and its origin, together.
-  const request = resolveAuth.kind === "refreshing"
+  const request = resolveAuth.kind === "refreshing" && name !== "anthropic2"
     ? captureModelsRequest(name, prov, auth.oauthApiBaseUrl)
     : captured.request;
   const url = request.url;
@@ -653,7 +663,7 @@ export async function fetchProviderModelsWithAuth(
   const failedDiscoveryFallback = (
     failure: ProviderModelDiscoveryFailure,
   ): { models: CatalogModel[]; fallback: "stale" | "configured"; shouldLog: boolean } => {
-    if (!isCurrentCacheGeneration()) {
+    if (!isCurrentCacheGeneration() || !maySendAnthropicDiscovery()) {
       return {
         models: withConfiguredRetention(failedDiscoveryConfigured),
         fallback: "configured",
@@ -670,7 +680,7 @@ export async function fetchProviderModelsWithAuth(
     return {
       models: withConfiguredRetention(
         stale
-          ? withVertexDefaultSeed(applyConfigHintsToCachedModels(name, prov, stale, contextCap, metadataModelIdCaseFold, captured.effectiveAlias))
+          ? withVertexDefaultSeed(applyConfigHintsToCachedModels(name, prov, stale, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir))
           : failedDiscoveryConfigured,
       ),
       fallback: stale ? "stale" : "configured",
@@ -748,7 +758,7 @@ export async function fetchProviderModelsWithAuth(
       return observed(models, "degraded");
     }
     if (antigravity) {
-      const live = antigravity.map(model => applyProviderConfigHints(name, prov, {
+      const upstream: CatalogModel[] = antigravity.map(model => ({
         id: model.id,
         provider: name,
         // Only an exact discovered wire map proves a new model's selectable effort ladder.
@@ -760,8 +770,9 @@ export async function fetchProviderModelsWithAuth(
         } : {}),
         ...(model.contextWindow ? { contextWindow: model.contextWindow } : {}),
         ...(model.inputModalities ? { inputModalities: model.inputModalities } : {}),
-      }, contextCap, metadataModelIdCaseFold, captured.effectiveAlias));
-      const forCache = withConfiguredRetention(live, { retainComboTargets: false });
+      }));
+      const live = applyConfigHintsToCachedModels(name, prov, upstream, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir);
+      const forCache = azureMetadata ? upstream : withConfiguredRetention(live, { retainComboTargets: false });
       if (!isCurrentCacheGeneration()) {
         return observed(withConfiguredRetention(configured), "degraded");
       }
@@ -775,7 +786,7 @@ export async function fetchProviderModelsWithAuth(
         return observed(withConfiguredRetention(configured), "degraded");
       }
       markProviderDiscoveryOk(name, live.length);
-      return observed(withConfiguredRetention(forCache, { warnDrops: true }), "authoritative");
+      return observed(withConfiguredRetention(azureMetadata ? live : forCache, { warnDrops: true }), "authoritative");
     }
     const googleAiStudio = effectiveGoogleMode(name, prov) === "ai-studio"
       ? extractGoogleAiStudioModelItems(bounded.value, discovery.maxModels)
@@ -814,7 +825,7 @@ export async function fetchProviderModelsWithAuth(
         provider: prov,
       }).catch(() => undefined)
       : undefined;
-    const live = items.map(m => {
+    const upstream: CatalogModel[] = items.map(m => {
       const ownedBy = boundedOwnedBy(m.owned_by);
       // Precedence: the authoritative /v1/models row wins; /api/show fills only metadata the
       // models-API row does not carry. applyProviderConfigHints then applies explicit
@@ -830,22 +841,25 @@ export async function fetchProviderModelsWithAuth(
           ? { inputModalities: ["text", "image"] as string[] }
           : {}),
       };
-      return applyProviderConfigHints(name, prov, {
+      return {
         id: m.id,
         provider: name,
         ...(ownedBy ? { owned_by: ownedBy } : {}),
         ...discoveredHints,
-      }, contextCap, metadataModelIdCaseFold, captured.effectiveAlias);
+      };
     })
       .filter(m => shouldExposeProviderModel(name, m.id));
+    const live = applyConfigHintsToCachedModels(name, prov, upstream, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir);
     // Capture the count BEFORE the alias/configured augmentation below pushes extra rows into
     // `live`; otherwise configured entries would be reported as discovered ones.
     const liveModelCount = live.length;
     // Dated-release aliases + configured retention (compat allow-list, combo targets,
     // Vertex default). Cache without combo retention so a later gather re-applies the
     // current capture's retain set on read (warm-cache OCX-111 / #1308).
-    const forCache = withConfiguredRetention(live, { retainComboTargets: false });
-    const returned = withConfiguredRetention(forCache, { warnDrops: true });
+    // Azure hints depend on the admitted config root. Keep only upstream evidence in the
+    // shared TTL/stale cache; every read reapplies metadata and retention for its own root.
+    const forCache = azureMetadata ? upstream : withConfiguredRetention(live, { retainComboTargets: false });
+    const returned = withConfiguredRetention(azureMetadata ? live : forCache, { warnDrops: true });
     const droppedConfiguredIds = configured
       .map(model => model.id)
       .filter(id => !returned.some(model => model.id === id));
@@ -854,7 +868,7 @@ export async function fetchProviderModelsWithAuth(
         `[opencodex] Provider model discovery for "${name}" returned an authoritative empty catalog; ${droppedConfiguredIds.length > 0 ? `dropping configured model ids: ${droppedConfiguredIds.join(", ")}` : "no models will be exposed"}.`,
       );
     }
-    if (!setCached(name, forCache, Date.now(), cacheGeneration)) {
+    if (!maySendAnthropicDiscovery() || !setCached(name, forCache, Date.now(), cacheGeneration)) {
       return observed(withConfiguredRetention(configured), "degraded");
     }
     markProviderDiscoveryOk(name, liveModelCount);

package/src/codex/catalog/retained-sync.ts

@@ -2,7 +2,7 @@ import { projectAntigravitySelectedModels } from "../../providers/antigravity-ef
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { initializeConfigOwnership } from "../../lib/config-ownership";
-import { getConfigDir, loadConfig, websocketsEnabled, withConfigMutationLockSync } from "../../config";
+import { getConfigDir, loadConfig, ultraFastTierEnabled, websocketsEnabled, withConfigMutationLockSync } from "../../config";
 import { shouldSyncCodexOnStart } from "../desired-state";
 import { legacyCustomModelCatalogSlugs } from "../custom-model-catalog-migration";
 import { getCodexHome } from "../paths";
@@ -54,7 +54,7 @@ import {
   upstreamNativeEntry,
 } from "./metadata";
 import { trustedAccountBoundNativeCatalogSlug } from "./account-models";
-import { bundledCatalogCacheState, loadBundledCodexCatalog } from "./bundled";
+import { bundledCatalogCacheState, bundledCodexCatalogSnapshot, loadBundledCodexCatalogAsync } from "./bundled";
 import { isMultiAgentV2Enabled } from "../features";
 import { clampCatalogModelsToCodexSupport } from "./effort";
 import { suppressedSyntheticMaxCatalogSlugs } from "./model-hints";
@@ -155,7 +155,7 @@ function optionalFileBytes(path: string): string | null {
 }
 
 function loadCatalogForRetainedSync(path: string): RawCatalog | null {
-  const bundled = isDefaultCatalogPath(path) ? loadBundledCodexCatalog() : null;
+  const bundled = isDefaultCatalogPath(path) ? bundledCodexCatalogSnapshot() : null;
   if (bundled) return JSON.parse(JSON.stringify(bundled)) as RawCatalog;
   const active = readCatalog(path);
   // A valid configured custom file remains the content authority even when it has no bare native
@@ -508,6 +508,7 @@ function writeRetainedCatalogSync({
     }).filter(entry => trustedAccountBoundNativeCatalogSlug(entry) !== undefined)
     : [];
   catalog.models = mergeCatalogEntriesFromObservedState({
+    ultraFastTier: ultraFastTierEnabled(config),
     modelPickerOrder,
     accountSelectors,
     catalogModels: catalogModelsForMerge,
@@ -542,7 +543,7 @@ function writeRetainedCatalogSync({
     },
   });
   applyNativeAccessPrograms(catalog.models, modelEntitlements, accountTargets);
-  clampCatalogModelsToCodexSupport(catalog.models);
+  clampCatalogModelsToCodexSupport(catalog.models, { observedCatalog: bundledCodexCatalogSnapshot() });
   finalizeAutoReviewModelOverride(catalog.models, catalogModelsForMerge, config);
   // Last mutation before serialization; see `enforceCatalogSlugUniqueness` for why the ordering
   // against the effort clamp is load-bearing rather than cosmetic.
@@ -623,6 +624,8 @@ export async function syncCatalogModels(
     await resolvePendingInitialModelSelection(config);
   }
   const owningCodexHome = getCodexHome();
+  // Settle before reading content and its matching evidence; no pre-refresh catalog is reused.
+  await loadBundledCodexCatalogAsync();
   const preflightRead = readRetainedCatalogSync(config);
   if (preflightRead === null) {
     return {
@@ -643,7 +646,6 @@ export async function syncCatalogModels(
   // The persisted runtime selection is covered by the filesystem evidence above
   // rather than by a process epoch; see `retainedCatalogProcessEvidence` for why
   // the in-memory runtime memo cannot be baselined honestly from this path.
-  loadBundledCodexCatalog();
   const prepared: RetainedCatalogSyncRead = {
     ...preflightRead,
     evidence: retainedCatalogSyncEvidence(config, preflightRead.catalogPath, preflightRead.catalog),

package/src/codex/catalog/routed-gather.ts

@@ -347,6 +347,7 @@ async function gatherRoutedModelsUncached(
     lists.flat(),
     config,
     capture.openAiApiPolicy,
+    activeProviders.find(provider => provider.name === OPENAI_API_PROVIDER_ID)?.metadataConfigDir,
   );
   const apiProvider = activeProviders.find(provider => provider.name === OPENAI_API_PROVIDER_ID);
   // Trusted reconstruction replaces whole rows, including the earlier Fast hints.
@@ -363,12 +364,16 @@ async function gatherRoutedModelsUncached(
   const metadataModelIdCaseFoldByProvider = new Map(
     activeProviders.map(provider => [provider.name, provider.metadataModelIdCaseFold]),
   );
+  const metadataConfigDirByProvider = new Map(
+    activeProviders.map(provider => [provider.name, provider.metadataConfigDir]),
+  );
   const all = augmentRoutedModelsWithMetadata(
     apiAugmented,
     activeProviders.map(provider => provider.name),
     config.providers,
     config,
     metadataModelIdCaseFoldByProvider,
+    metadataConfigDirByProvider,
   )
     // Drop image/video generation models (e.g. Grok image/video) by default. Cursor's static catalog
     // intentionally mirrors Cursor's public model table, including Gemini image preview, so the
@@ -511,6 +516,7 @@ async function gatherRoutedModelsUncached(
         providerContextCap(config, target.provider),
         nativeAliasFallback,
         metadataModelIdCaseFoldByProvider.get(target.provider),
+        metadataConfigDirByProvider.get(target.provider),
       ))
       .filter((member): member is CatalogModel => member !== undefined);
     const derived = deriveComboCatalogModel(id, combo, members);
@@ -591,7 +597,7 @@ async function gatherRoutedModelsUncached(
         id: cm.modelId,
         provider: cm.provider,
         ...(nativeAliasMaxOutputTokens !== undefined ? { maxOutputTokens: nativeAliasMaxOutputTokens } : {}),
-      }, cm.modelId, metadataModelIdCaseFoldByProvider.get(cm.provider))
+      }, cm.modelId, metadataModelIdCaseFoldByProvider.get(cm.provider), metadataConfigDirByProvider.get(cm.provider))
       : nativeAliasMaxOutputTokens;
     const configuredAutoCompact = configuredAutoCompactTokenLimit(rawProvider, cm.modelId);
     const customAutoCompactTokenLimit = codexForwardNativeCapabilityAlias
@@ -827,6 +833,7 @@ function augmentRoutedModelsWithCapturedOpenAiApiRows(
   models: CatalogModel[],
   config: OcxConfig,
   policy: CatalogTrustedOpenAiApiPolicySnapshot,
+  metadataConfigDir?: string,
 ): CatalogModel[] {
   if (policy.state !== "captured" || !policy.models) return models;
   const configured = config.providers[OPENAI_API_PROVIDER_ID];
@@ -862,6 +869,8 @@ function augmentRoutedModelsWithCapturedOpenAiApiRows(
         ? { provider: OPENAI_API_PROVIDER_ID, id, maxOutputTokens: policy.modelMaxOutputTokens[id] }
         : existingById.get(id) ?? { provider: OPENAI_API_PROVIDER_ID, id },
       policy.virtualModels?.[id]?.wireModelId ?? id,
+      undefined,
+      metadataConfigDir,
     );
     return {
       provider: OPENAI_API_PROVIDER_ID,
@@ -920,6 +929,7 @@ export function augmentRoutedModelsWithMetadata(
   providers?: Record<string, OcxProviderConfig>,
   caps?: Pick<OcxConfig, "providerContextCaps">,
   metadataModelIdCaseFoldByProvider?: ReadonlyMap<string, boolean>,
+  metadataConfigDirByProvider?: ReadonlyMap<string, string>,
 ): CatalogModel[] {
   const out = [...models];
   const indexByKey = new Map(out.map((model, index) => [`${model.provider}/${model.id}`, index]));
@@ -947,6 +957,8 @@ export function augmentRoutedModelsWithMetadata(
             seeded,
             contextCap,
             metadataModelIdCaseFoldByProvider?.get(provider),
+            undefined,
+            metadataConfigDirByProvider?.get(provider),
           )
           : seeded;
         continue;
@@ -969,6 +981,8 @@ export function augmentRoutedModelsWithMetadata(
             model,
             contextCap,
             metadataModelIdCaseFoldByProvider?.get(provider),
+            undefined,
+            metadataConfigDirByProvider?.get(provider),
           )
           : {}),
       });

package/src/codex/catalog-auto-refresh-sources.ts

@@ -34,10 +34,9 @@ export async function refreshCatalogAutoRefreshSources(
   current: () => boolean,
 ): Promise<void> {
   // Runtime selection also supplies the roster's trusted client version after an upgrade.
-  await bestEffortSource(async active => {
-    const { loadBundledCodexCatalog } = await import("./catalog/bundled");
-    if (active() && current()) loadBundledCodexCatalog();
-    // The synchronous loader bounds its selected-runtime subprocess probes itself.
+  await bestEffortSource(async (active, signal) => {
+    const { loadBundledCodexCatalogAsync } = await import("./catalog/bundled");
+    if (active() && current()) await loadBundledCodexCatalogAsync({}, () => active() && current(), signal);
   });
   if (!current()) return;
   await bestEffortSource(async active => {

package/src/codex/catalog-auto-refresh.ts

@@ -50,6 +50,14 @@ let generation = 0;
 /** setInterval does not skip a firing while the previous callback is still awaiting. */
 let inFlight = false;
 
+/** Refreshes already-connected clients after a changed catalog; owned by the server lifecycle. */
+export type CatalogChangedClientFanout =
+  (isCurrent: () => boolean) => Promise<ReadonlyArray<{ readonly ok: boolean }>>;
+let clientFanout: CatalogChangedClientFanout | null = null;
+export function setCatalogAutoRefreshClientFanout(fanout: CatalogChangedClientFanout | null): void {
+  clientFanout = fanout;
+}
+
 /** Read only a regular file, with a byte limit even if it grows after the stat. */
 function readBoundedRegularFile(path: string, maxBytes: number): string | null {
   let fd: number | undefined;
@@ -259,6 +267,17 @@ async function tick(): Promise<void> {
         ? "[catalog-auto-refresh] served model set changed; running Codex sessions keep the old list until restarted (ocx sync --restart-codex)"
         : "[catalog-auto-refresh] served model set changed");
     }
+    const fanout = clientFanout;
+    if (outcome.changed && fanout) {
+      const current = () => entryGeneration === generation;
+      try {
+        const failed = (await fanout(current)).filter(result => !result.ok).length;
+        // Outcomes can contain private paths and reasons; only the failure count leaves this hook.
+        if (current() && failed > 0) console.warn(`[catalog-auto-refresh] ${failed} client integration(s) were not refreshed; ocx sync retries them`);
+      } catch {
+        if (current()) console.warn("[catalog-auto-refresh] client integrations were not refreshed; ocx sync retries them");
+      }
+    }
   } catch {
     // A failed refresh is not an error worth surfacing: the next tick tries again.
   } finally {