@bitkyc08/opencodex 2.81.0 → 2.83.0

package/src/codex/catalog/provider-models.ts

@@ -1,3 +1,6 @@
+import { fetchCopilotAutoModels, copilotPickerModels, copilotRequiresAuto } from "../../providers/github-copilot-auto";
+import { resolveGithubCopilotTransport } from "../../providers/github-copilot-transport";
+import { resolveCopilotApiBaseUrl } from "../../oauth/github-copilot";
 import { isAnthropicOAuthInstance } from "../../providers/anthropic-instance";
 import { effectiveProviderAlias, effectiveProviderAliasDecision } from "../../providers/default-aliases";
 import { initialModelSelectionPending } from "../../providers/initial-model-selection";
@@ -41,6 +44,7 @@ import { CODEX_REASONING_LEVELS, codexEffortRank, configuredReasoningEfforts, mo
 import { isModelVisionSidecarConsumer } from "../../vision/eligibility";
 import { getModelMetadata, getModelMetadataCaseInsensitive, listModelMetadata, resolveMetadataProvider, type ModelMetadata } from "../../generated/model-metadata";
 import { enrichProviderFromRegistry, shouldCaseFoldMetadataModelId } from "../../providers/derive";
+import { isAzureModelMetadataDestination, refreshAzureModelMetadata } from "../../providers/azure-model-metadata";
 import {
   captureFastPolicyAuthority,
   fastPolicyForModel,
@@ -163,13 +167,15 @@ export function observedModelsAuthResolver(
     },
   };
 }
+/** Project captured discovery through config hints and retention; Auto-only Copilot exposes only Auto. */
 export async function fetchProviderModelsWithAuth(
   captured: CapturedProviderGather,
   ttlMs: number,
   contextCap: number | undefined,
   resolveAuth: ModelsAuthResolver,
 ): Promise<ProviderModelsResult> {
-  const { name, provider: prov, discovery, metadataModelIdCaseFold } = captured;
+  const { name, provider: prov, discovery, metadataModelIdCaseFold, metadataConfigDir } = captured;
+  const azureMetadata = isAzureModelMetadataDestination(prov.baseUrl);
   const observed = (
     models: CatalogModel[],
     state: CatalogGatherProviderModelOutcome["state"],
@@ -185,6 +191,7 @@ export async function fetchProviderModelsWithAuth(
   const anthropicSelection = isAnthropicOAuthInstance(name) && prov.authMode === "oauth" && mayResolveModelsOAuth(name, prov)
     ? captureOAuthAccountSelection(name) : null;
   if (prov.authMode === "forward") return observed([], "authoritative"); // ChatGPT backend has no /models
+  if (azureMetadata) await refreshAzureModelMetadata(prov.baseUrl, metadataConfigDir);
   const seedVertexDefault = prov.adapter === "google"
     && prov.googleMode === "vertex"
     && (prov.models?.length ?? 0) === 0
@@ -203,7 +210,7 @@ export async function fetchProviderModelsWithAuth(
   const configured: CatalogModel[] = configuredIds.map(id => ({
     id,
     provider: name,
-    ...catalogHintsFromProviderConfig(name, prov, id, contextCap, metadataModelIdCaseFold, captured.effectiveAlias),
+    ...catalogHintsFromProviderConfig(name, prov, id, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir),
   }));
   const withConfiguredRetention = (
     models: CatalogModel[],
@@ -219,6 +226,7 @@ export async function fetchProviderModelsWithAuth(
       seedVertexDefault,
       retainComboTargets: options?.retainComboTargets,
       metadataModelIdCaseFold,
+      metadataConfigDir,
     });
     if (
       options?.warnDrops === true
@@ -251,7 +259,7 @@ export async function fetchProviderModelsWithAuth(
       }
       return observed(ids.map(id => {
         const hints = catalogHintsFromProviderConfig(name, prov, id, contextCap,
-          metadataModelIdCaseFold, captured.effectiveAlias);
+          metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir);
         const observedWindow = kiroObservedContextWindow(id);
         return { id, provider: name, ...hints,
           ...(observedWindow !== undefined
@@ -278,6 +286,27 @@ export async function fetchProviderModelsWithAuth(
       : { apiKey: await resolveModelsAuthToken(name, prov), observed: false }
     : resolveAuth.resolve(name, prov));
   const apiKey = auth.apiKey;
+  if (name === "github-copilot" && apiKey) {
+    const transport = resolveGithubCopilotTransport({ ...prov, apiKey }, prov.authMode === "oauth"
+      ? resolveCopilotApiBaseUrl(auth.oauthApiBaseUrl) : undefined);
+    try {
+      const models = await fetchCopilotAutoModels(transport, AbortSignal.timeout(8_000), undefined, ttlMs);
+      const picker = copilotPickerModels(prov, models).map(/** Apply configured hints to the permission-filtered account catalog without changing upstream metadata. */
+        model => applyProviderConfigHints(name, prov, {
+        id: model.id, provider: name,
+        ...catalogHintsFromModelsApiItem(name, model as ProviderModelsApiItem),
+      }, contextCap, metadataModelIdCaseFold, captured.effectiveAlias));
+      if (!isCurrentCacheGeneration()) return observed(configured, "degraded");
+      markProviderDiscoveryOk(name, picker.length);
+      // Retain callable manual/combo selectors, but do not advertise named selection
+      // for an Auto-only account even when its saved configuration still contains it.
+      return observed(copilotRequiresAuto(prov, models)
+        ? picker : withConfiguredRetention(picker, { warnDrops: true }), "authoritative");
+    } catch {
+      if (isCurrentCacheGeneration()) markProviderDiscoveryFailed(name, { reason: "provider" });
+      return observed(configured, "degraded");
+    }
+  }
   const maySendAnthropicDiscovery = () => {
     if (!isAnthropicOAuthInstance(name) || prov.authMode !== "oauth") return true;
     if (!mayResolveModelsOAuth(name, prov)) return false;
@@ -296,7 +325,7 @@ export async function fetchProviderModelsWithAuth(
     : [{
       id: prov.defaultModel,
       provider: name,
-      ...catalogHintsFromProviderConfig(name, prov, prov.defaultModel, contextCap, metadataModelIdCaseFold, captured.effectiveAlias),
+      ...catalogHintsFromProviderConfig(name, prov, prov.defaultModel, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir),
     }];
   const vertexDefaultSeed = seedVertexDefault ? configured[0] : undefined;
   const withVertexDefaultSeed = (models: CatalogModel[]): CatalogModel[] => (
@@ -318,13 +347,13 @@ export async function fetchProviderModelsWithAuth(
     const fresh = getFreshCached(name, ttlMs, Date.now(), authorityIdentity);
     if (fresh) {
       return observed(withConfiguredRetention(
-        applyConfigHintsToCachedModels(name, prov, fresh, contextCap, metadataModelIdCaseFold, captured.effectiveAlias),
+        applyConfigHintsToCachedModels(name, prov, fresh, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir),
       ), "authoritative");
     }
     const scopedStale = getStaleCached(name, authorityIdentity);
     if (isModelsFetchCoolingDown(name, undefined, undefined, authorityIdentity) && scopedStale) {
       return observed(withConfiguredRetention(
-        applyConfigHintsToCachedModels(name, prov, scopedStale, contextCap, metadataModelIdCaseFold, captured.effectiveAlias),
+        applyConfigHintsToCachedModels(name, prov, scopedStale, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir),
       ), "degraded");
     }
     const live = await fetchCodeBuddyModels(profile, apiKey);
@@ -332,7 +361,7 @@ export async function fetchProviderModelsWithAuth(
       const discovered = live.models.map(id => ({
         id,
         provider: name,
-        ...catalogHintsFromProviderConfig(name, prov, id, contextCap, metadataModelIdCaseFold, captured.effectiveAlias),
+        ...catalogHintsFromProviderConfig(name, prov, id, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir),
       }));
       const forCache = withConfiguredRetention(discovered, { retainComboTargets: false });
       if (!setCached(name, forCache, Date.now(), cacheGeneration, authorityIdentity)) {
@@ -348,7 +377,7 @@ export async function fetchProviderModelsWithAuth(
     }
     const stale = getStaleCached(name, authorityIdentity);
     return observed(withConfiguredRetention(
-      stale ? applyConfigHintsToCachedModels(name, prov, stale, contextCap, metadataModelIdCaseFold, captured.effectiveAlias) : configured,
+      stale ? applyConfigHintsToCachedModels(name, prov, stale, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir) : configured,
     ), "degraded");
   }
   if (name === "zed" && prov.adapter === "zed") {
@@ -361,14 +390,14 @@ export async function fetchProviderModelsWithAuth(
     const cached = getFreshCached(name, ttlMs, Date.now(), authorityIdentity);
     if (cached) {
       return observed(
-        withConfiguredRetention(applyConfigHintsToCachedModels(name, prov, cached, contextCap, metadataModelIdCaseFold, captured.effectiveAlias)),
+        withConfiguredRetention(applyConfigHintsToCachedModels(name, prov, cached, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir)),
         "authoritative",
       );
     }
     const stale = getStaleCached(name, authorityIdentity);
     if (isModelsFetchCoolingDown(name, undefined, undefined, authorityIdentity) && stale) {
       return observed(
-        withConfiguredRetention(applyConfigHintsToCachedModels(name, prov, stale, contextCap, metadataModelIdCaseFold, captured.effectiveAlias)),
+        withConfiguredRetention(applyConfigHintsToCachedModels(name, prov, stale, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir)),
         "degraded",
       );
     }
@@ -388,7 +417,7 @@ export async function fetchProviderModelsWithAuth(
           ...(model.maxOutputTokens ? { maxOutputTokens: model.maxOutputTokens } : {}),
           ...(model.supportsImages ? { inputModalities: ["text", "image"] } : {}),
           ...(reasoningEfforts?.length ? { reasoningEfforts } : {}),
-          ...catalogHintsFromProviderConfig(name, prov, model.id, contextCap, metadataModelIdCaseFold, captured.effectiveAlias),
+          ...catalogHintsFromProviderConfig(name, prov, model.id, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir),
         } as CatalogModel;
       });
       const forCache = withConfiguredRetention(discovered, { retainComboTargets: false });
@@ -403,7 +432,7 @@ export async function fetchProviderModelsWithAuth(
         markProviderDiscoveryFailed(name, { reason: "provider" });
       }
       return observed(
-        withConfiguredRetention(stale ? applyConfigHintsToCachedModels(name, prov, stale, contextCap, metadataModelIdCaseFold, captured.effectiveAlias) : configured),
+        withConfiguredRetention(stale ? applyConfigHintsToCachedModels(name, prov, stale, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir) : configured),
         "degraded",
       );
     }
@@ -419,13 +448,13 @@ export async function fetchProviderModelsWithAuth(
     const fresh = getFreshCached(name, ttlMs, Date.now(), authorityIdentity);
     if (fresh) {
       return observed(withConfiguredRetention(
-        applyConfigHintsToCachedModels(name, prov, fresh, contextCap, metadataModelIdCaseFold, captured.effectiveAlias),
+        applyConfigHintsToCachedModels(name, prov, fresh, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir),
       ), "authoritative");
     }
     const scopedStale = getStaleCached(name, authorityIdentity);
     if (isModelsFetchCoolingDown(name) && scopedStale) {
       return observed(withConfiguredRetention(
-        applyConfigHintsToCachedModels(name, prov, scopedStale, contextCap, metadataModelIdCaseFold, captured.effectiveAlias),
+        applyConfigHintsToCachedModels(name, prov, scopedStale, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir),
       ), "degraded");
     }
     const live = await fetchQoderModels(profile, apiKey);
@@ -433,7 +462,7 @@ export async function fetchProviderModelsWithAuth(
       const discovered = live.models.map(id => ({
         id,
         provider: name,
-        ...catalogHintsFromProviderConfig(name, prov, id, contextCap, metadataModelIdCaseFold, captured.effectiveAlias),
+        ...catalogHintsFromProviderConfig(name, prov, id, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir),
       }));
       const forCache = withConfiguredRetention(discovered, { retainComboTargets: false });
       if (!setCached(name, forCache, Date.now(), cacheGeneration, authorityIdentity)) {
@@ -449,7 +478,7 @@ export async function fetchProviderModelsWithAuth(
     }
     const stale = getStaleCached(name, authorityIdentity);
     return observed(withConfiguredRetention(
-      stale ? applyConfigHintsToCachedModels(name, prov, stale, contextCap, metadataModelIdCaseFold, captured.effectiveAlias) : configured,
+      stale ? applyConfigHintsToCachedModels(name, prov, stale, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir) : configured,
     ), "degraded");
   }
   if (prov.adapter === "devin") {
@@ -464,7 +493,7 @@ export async function fetchProviderModelsWithAuth(
     const cachedDevin = getFreshCached(name, ttlMs, Date.now(), authorityIdentity);
     if (cachedDevin) {
       return observed(
-        withConfiguredRetention(applyConfigHintsToCachedModels(name, prov, cachedDevin)),
+        withConfiguredRetention(applyConfigHintsToCachedModels(name, prov, cachedDevin, undefined, undefined, undefined, metadataConfigDir)),
         "authoritative",
       );
     }
@@ -472,7 +501,7 @@ export async function fetchProviderModelsWithAuth(
       const cooling = getStaleCached(name, authorityIdentity);
       return observed(
         withConfiguredRetention(
-          cooling ? applyConfigHintsToCachedModels(name, prov, cooling) : configured,
+          cooling ? applyConfigHintsToCachedModels(name, prov, cooling, undefined, undefined, undefined, metadataConfigDir) : configured,
         ),
         "degraded",
       );
@@ -514,7 +543,7 @@ export async function fetchProviderModelsWithAuth(
           // record and the vision-sidecar rewrite keep winning — the live
           // value survives only when none of them applies.
           ...(liveResult.inputModalities[id]?.length ? { inputModalities: liveResult.inputModalities[id] } : {}),
-          ...catalogHintsFromProviderConfig(name, prov, id, contextCap, metadataModelIdCaseFold, captured.effectiveAlias),
+          ...catalogHintsFromProviderConfig(name, prov, id, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir),
         } as CatalogModel;
       });
       const forCache = withConfiguredRetention(result, { retainComboTargets: false });
@@ -530,7 +559,7 @@ export async function fetchProviderModelsWithAuth(
     }
     const stale = getStaleCached(name, authorityIdentity);
     return observed(
-      withConfiguredRetention(stale ? applyConfigHintsToCachedModels(name, prov, stale) : configured),
+      withConfiguredRetention(stale ? applyConfigHintsToCachedModels(name, prov, stale, undefined, undefined, undefined, metadataConfigDir) : configured),
       "degraded",
     );
   }
@@ -547,7 +576,7 @@ export async function fetchProviderModelsWithAuth(
     const cachedCursor = getFreshCached(name, ttlMs, Date.now(), authorityIdentity);
     if (cachedCursor) {
       return observed(
-        withConfiguredRetention(applyConfigHintsToCachedModels(name, prov, cachedCursor, undefined, metadataModelIdCaseFold, captured.effectiveAlias)),
+        withConfiguredRetention(applyConfigHintsToCachedModels(name, prov, cachedCursor, undefined, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir)),
         "authoritative",
       );
     }
@@ -555,7 +584,7 @@ export async function fetchProviderModelsWithAuth(
       const cooling = getStaleCached(name, authorityIdentity);
       return observed(
         withConfiguredRetention(
-          cooling ? applyConfigHintsToCachedModels(name, prov, cooling, undefined, metadataModelIdCaseFold, captured.effectiveAlias) : configured,
+          cooling ? applyConfigHintsToCachedModels(name, prov, cooling, undefined, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir) : configured,
         ),
         "degraded",
       );
@@ -601,7 +630,7 @@ export async function fetchProviderModelsWithAuth(
     const staleCursor = getStaleCached(name, authorityIdentity);
     return observed(
       withConfiguredRetention(
-        staleCursor ? applyConfigHintsToCachedModels(name, prov, staleCursor, undefined, metadataModelIdCaseFold, captured.effectiveAlias) : configured,
+        staleCursor ? applyConfigHintsToCachedModels(name, prov, staleCursor, undefined, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir) : configured,
       ),
       "degraded",
     );
@@ -619,7 +648,7 @@ export async function fetchProviderModelsWithAuth(
   if (fresh) {
     return observed(
       withConfiguredRetention(
-        withVertexDefaultSeed(applyConfigHintsToCachedModels(name, prov, fresh, contextCap, metadataModelIdCaseFold, captured.effectiveAlias)),
+        withVertexDefaultSeed(applyConfigHintsToCachedModels(name, prov, fresh, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir)),
       ),
       "authoritative",
     ); // dedups Codex's frequent /v1/models polling within the TTL
@@ -631,7 +660,7 @@ export async function fetchProviderModelsWithAuth(
     return observed(
       withConfiguredRetention(
         stale
-          ? withVertexDefaultSeed(applyConfigHintsToCachedModels(name, prov, stale, contextCap, metadataModelIdCaseFold, captured.effectiveAlias))
+          ? withVertexDefaultSeed(applyConfigHintsToCachedModels(name, prov, stale, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir))
           : failedDiscoveryConfigured,
       ),
       "degraded",
@@ -676,7 +705,7 @@ export async function fetchProviderModelsWithAuth(
     return {
       models: withConfiguredRetention(
         stale
-          ? withVertexDefaultSeed(applyConfigHintsToCachedModels(name, prov, stale, contextCap, metadataModelIdCaseFold, captured.effectiveAlias))
+          ? withVertexDefaultSeed(applyConfigHintsToCachedModels(name, prov, stale, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir))
           : failedDiscoveryConfigured,
       ),
       fallback: stale ? "stale" : "configured",
@@ -754,7 +783,7 @@ export async function fetchProviderModelsWithAuth(
       return observed(models, "degraded");
     }
     if (antigravity) {
-      const live = antigravity.map(model => applyProviderConfigHints(name, prov, {
+      const upstream: CatalogModel[] = antigravity.map(model => ({
         id: model.id,
         provider: name,
         // Only an exact discovered wire map proves a new model's selectable effort ladder.
@@ -766,8 +795,9 @@ export async function fetchProviderModelsWithAuth(
         } : {}),
         ...(model.contextWindow ? { contextWindow: model.contextWindow } : {}),
         ...(model.inputModalities ? { inputModalities: model.inputModalities } : {}),
-      }, contextCap, metadataModelIdCaseFold, captured.effectiveAlias));
-      const forCache = withConfiguredRetention(live, { retainComboTargets: false });
+      }));
+      const live = applyConfigHintsToCachedModels(name, prov, upstream, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir);
+      const forCache = azureMetadata ? upstream : withConfiguredRetention(live, { retainComboTargets: false });
       if (!isCurrentCacheGeneration()) {
         return observed(withConfiguredRetention(configured), "degraded");
       }
@@ -781,7 +811,7 @@ export async function fetchProviderModelsWithAuth(
         return observed(withConfiguredRetention(configured), "degraded");
       }
       markProviderDiscoveryOk(name, live.length);
-      return observed(withConfiguredRetention(forCache, { warnDrops: true }), "authoritative");
+      return observed(withConfiguredRetention(azureMetadata ? live : forCache, { warnDrops: true }), "authoritative");
     }
     const googleAiStudio = effectiveGoogleMode(name, prov) === "ai-studio"
       ? extractGoogleAiStudioModelItems(bounded.value, discovery.maxModels)
@@ -820,7 +850,7 @@ export async function fetchProviderModelsWithAuth(
         provider: prov,
       }).catch(() => undefined)
       : undefined;
-    const live = items.map(m => {
+    const upstream: CatalogModel[] = items.map(m => {
       const ownedBy = boundedOwnedBy(m.owned_by);
       // Precedence: the authoritative /v1/models row wins; /api/show fills only metadata the
       // models-API row does not carry. applyProviderConfigHints then applies explicit
@@ -836,22 +866,25 @@ export async function fetchProviderModelsWithAuth(
           ? { inputModalities: ["text", "image"] as string[] }
           : {}),
       };
-      return applyProviderConfigHints(name, prov, {
+      return {
         id: m.id,
         provider: name,
         ...(ownedBy ? { owned_by: ownedBy } : {}),
         ...discoveredHints,
-      }, contextCap, metadataModelIdCaseFold, captured.effectiveAlias);
+      };
     })
       .filter(m => shouldExposeProviderModel(name, m.id));
+    const live = applyConfigHintsToCachedModels(name, prov, upstream, contextCap, metadataModelIdCaseFold, captured.effectiveAlias, metadataConfigDir);
     // Capture the count BEFORE the alias/configured augmentation below pushes extra rows into
     // `live`; otherwise configured entries would be reported as discovered ones.
     const liveModelCount = live.length;
     // Dated-release aliases + configured retention (compat allow-list, combo targets,
     // Vertex default). Cache without combo retention so a later gather re-applies the
     // current capture's retain set on read (warm-cache OCX-111 / #1308).
-    const forCache = withConfiguredRetention(live, { retainComboTargets: false });
-    const returned = withConfiguredRetention(forCache, { warnDrops: true });
+    // Azure hints depend on the admitted config root. Keep only upstream evidence in the
+    // shared TTL/stale cache; every read reapplies metadata and retention for its own root.
+    const forCache = azureMetadata ? upstream : withConfiguredRetention(live, { retainComboTargets: false });
+    const returned = withConfiguredRetention(azureMetadata ? live : forCache, { warnDrops: true });
     const droppedConfiguredIds = configured
       .map(model => model.id)
       .filter(id => !returned.some(model => model.id === id));

package/src/codex/catalog/retained-sync.ts

@@ -2,7 +2,7 @@ import { projectAntigravitySelectedModels } from "../../providers/antigravity-ef
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { initializeConfigOwnership } from "../../lib/config-ownership";
-import { getConfigDir, loadConfig, websocketsEnabled, withConfigMutationLockSync } from "../../config";
+import { getConfigDir, loadConfig, ultraFastTierEnabled, websocketsEnabled, withConfigMutationLockSync } from "../../config";
 import { shouldSyncCodexOnStart } from "../desired-state";
 import { legacyCustomModelCatalogSlugs } from "../custom-model-catalog-migration";
 import { getCodexHome } from "../paths";
@@ -54,7 +54,7 @@ import {
   upstreamNativeEntry,
 } from "./metadata";
 import { trustedAccountBoundNativeCatalogSlug } from "./account-models";
-import { bundledCatalogCacheState, loadBundledCodexCatalog } from "./bundled";
+import { bundledCatalogCacheState, bundledCodexCatalogSnapshot, loadBundledCodexCatalogAsync } from "./bundled";
 import { isMultiAgentV2Enabled } from "../features";
 import { clampCatalogModelsToCodexSupport } from "./effort";
 import { suppressedSyntheticMaxCatalogSlugs } from "./model-hints";
@@ -155,7 +155,7 @@ function optionalFileBytes(path: string): string | null {
 }
 
 function loadCatalogForRetainedSync(path: string): RawCatalog | null {
-  const bundled = isDefaultCatalogPath(path) ? loadBundledCodexCatalog() : null;
+  const bundled = isDefaultCatalogPath(path) ? bundledCodexCatalogSnapshot() : null;
   if (bundled) return JSON.parse(JSON.stringify(bundled)) as RawCatalog;
   const active = readCatalog(path);
   // A valid configured custom file remains the content authority even when it has no bare native
@@ -508,6 +508,7 @@ function writeRetainedCatalogSync({
     }).filter(entry => trustedAccountBoundNativeCatalogSlug(entry) !== undefined)
     : [];
   catalog.models = mergeCatalogEntriesFromObservedState({
+    ultraFastTier: ultraFastTierEnabled(config),
     modelPickerOrder,
     accountSelectors,
     catalogModels: catalogModelsForMerge,
@@ -542,7 +543,7 @@ function writeRetainedCatalogSync({
     },
   });
   applyNativeAccessPrograms(catalog.models, modelEntitlements, accountTargets);
-  clampCatalogModelsToCodexSupport(catalog.models);
+  clampCatalogModelsToCodexSupport(catalog.models, { observedCatalog: bundledCodexCatalogSnapshot() });
   finalizeAutoReviewModelOverride(catalog.models, catalogModelsForMerge, config);
   // Last mutation before serialization; see `enforceCatalogSlugUniqueness` for why the ordering
   // against the effort clamp is load-bearing rather than cosmetic.
@@ -623,6 +624,8 @@ export async function syncCatalogModels(
     await resolvePendingInitialModelSelection(config);
   }
   const owningCodexHome = getCodexHome();
+  // Settle before reading content and its matching evidence; no pre-refresh catalog is reused.
+  await loadBundledCodexCatalogAsync();
   const preflightRead = readRetainedCatalogSync(config);
   if (preflightRead === null) {
     return {
@@ -643,7 +646,6 @@ export async function syncCatalogModels(
   // The persisted runtime selection is covered by the filesystem evidence above
   // rather than by a process epoch; see `retainedCatalogProcessEvidence` for why
   // the in-memory runtime memo cannot be baselined honestly from this path.
-  loadBundledCodexCatalog();
   const prepared: RetainedCatalogSyncRead = {
     ...preflightRead,
     evidence: retainedCatalogSyncEvidence(config, preflightRead.catalogPath, preflightRead.catalog),

package/src/codex/catalog/routed-gather.ts

@@ -347,6 +347,7 @@ async function gatherRoutedModelsUncached(
     lists.flat(),
     config,
     capture.openAiApiPolicy,
+    activeProviders.find(provider => provider.name === OPENAI_API_PROVIDER_ID)?.metadataConfigDir,
   );
   const apiProvider = activeProviders.find(provider => provider.name === OPENAI_API_PROVIDER_ID);
   // Trusted reconstruction replaces whole rows, including the earlier Fast hints.
@@ -363,12 +364,16 @@ async function gatherRoutedModelsUncached(
   const metadataModelIdCaseFoldByProvider = new Map(
     activeProviders.map(provider => [provider.name, provider.metadataModelIdCaseFold]),
   );
+  const metadataConfigDirByProvider = new Map(
+    activeProviders.map(provider => [provider.name, provider.metadataConfigDir]),
+  );
   const all = augmentRoutedModelsWithMetadata(
     apiAugmented,
     activeProviders.map(provider => provider.name),
     config.providers,
     config,
     metadataModelIdCaseFoldByProvider,
+    metadataConfigDirByProvider,
   )
     // Drop image/video generation models (e.g. Grok image/video) by default. Cursor's static catalog
     // intentionally mirrors Cursor's public model table, including Gemini image preview, so the
@@ -511,6 +516,7 @@ async function gatherRoutedModelsUncached(
         providerContextCap(config, target.provider),
         nativeAliasFallback,
         metadataModelIdCaseFoldByProvider.get(target.provider),
+        metadataConfigDirByProvider.get(target.provider),
       ))
       .filter((member): member is CatalogModel => member !== undefined);
     const derived = deriveComboCatalogModel(id, combo, members);
@@ -591,7 +597,7 @@ async function gatherRoutedModelsUncached(
         id: cm.modelId,
         provider: cm.provider,
         ...(nativeAliasMaxOutputTokens !== undefined ? { maxOutputTokens: nativeAliasMaxOutputTokens } : {}),
-      }, cm.modelId, metadataModelIdCaseFoldByProvider.get(cm.provider))
+      }, cm.modelId, metadataModelIdCaseFoldByProvider.get(cm.provider), metadataConfigDirByProvider.get(cm.provider))
       : nativeAliasMaxOutputTokens;
     const configuredAutoCompact = configuredAutoCompactTokenLimit(rawProvider, cm.modelId);
     const customAutoCompactTokenLimit = codexForwardNativeCapabilityAlias
@@ -827,6 +833,7 @@ function augmentRoutedModelsWithCapturedOpenAiApiRows(
   models: CatalogModel[],
   config: OcxConfig,
   policy: CatalogTrustedOpenAiApiPolicySnapshot,
+  metadataConfigDir?: string,
 ): CatalogModel[] {
   if (policy.state !== "captured" || !policy.models) return models;
   const configured = config.providers[OPENAI_API_PROVIDER_ID];
@@ -862,6 +869,8 @@ function augmentRoutedModelsWithCapturedOpenAiApiRows(
         ? { provider: OPENAI_API_PROVIDER_ID, id, maxOutputTokens: policy.modelMaxOutputTokens[id] }
         : existingById.get(id) ?? { provider: OPENAI_API_PROVIDER_ID, id },
       policy.virtualModels?.[id]?.wireModelId ?? id,
+      undefined,
+      metadataConfigDir,
     );
     return {
       provider: OPENAI_API_PROVIDER_ID,
@@ -920,6 +929,7 @@ export function augmentRoutedModelsWithMetadata(
   providers?: Record<string, OcxProviderConfig>,
   caps?: Pick<OcxConfig, "providerContextCaps">,
   metadataModelIdCaseFoldByProvider?: ReadonlyMap<string, boolean>,
+  metadataConfigDirByProvider?: ReadonlyMap<string, string>,
 ): CatalogModel[] {
   const out = [...models];
   const indexByKey = new Map(out.map((model, index) => [`${model.provider}/${model.id}`, index]));
@@ -947,6 +957,8 @@ export function augmentRoutedModelsWithMetadata(
             seeded,
             contextCap,
             metadataModelIdCaseFoldByProvider?.get(provider),
+            undefined,
+            metadataConfigDirByProvider?.get(provider),
           )
           : seeded;
         continue;
@@ -969,6 +981,8 @@ export function augmentRoutedModelsWithMetadata(
             model,
             contextCap,
             metadataModelIdCaseFoldByProvider?.get(provider),
+            undefined,
+            metadataConfigDirByProvider?.get(provider),
           )
           : {}),
       });

package/src/codex/catalog-auto-refresh-sources.ts

@@ -34,10 +34,9 @@ export async function refreshCatalogAutoRefreshSources(
   current: () => boolean,
 ): Promise<void> {
   // Runtime selection also supplies the roster's trusted client version after an upgrade.
-  await bestEffortSource(async active => {
-    const { loadBundledCodexCatalog } = await import("./catalog/bundled");
-    if (active() && current()) loadBundledCodexCatalog();
-    // The synchronous loader bounds its selected-runtime subprocess probes itself.
+  await bestEffortSource(async (active, signal) => {
+    const { loadBundledCodexCatalogAsync } = await import("./catalog/bundled");
+    if (active() && current()) await loadBundledCodexCatalogAsync({}, () => active() && current(), signal);
   });
   if (!current()) return;
   await bestEffortSource(async active => {

package/src/codex/catalog-auto-refresh.ts

@@ -50,6 +50,14 @@ let generation = 0;
 /** setInterval does not skip a firing while the previous callback is still awaiting. */
 let inFlight = false;
 
+/** Refreshes already-connected clients after a changed catalog; owned by the server lifecycle. */
+export type CatalogChangedClientFanout =
+  (isCurrent: () => boolean) => Promise<ReadonlyArray<{ readonly ok: boolean }>>;
+let clientFanout: CatalogChangedClientFanout | null = null;
+export function setCatalogAutoRefreshClientFanout(fanout: CatalogChangedClientFanout | null): void {
+  clientFanout = fanout;
+}
+
 /** Read only a regular file, with a byte limit even if it grows after the stat. */
 function readBoundedRegularFile(path: string, maxBytes: number): string | null {
   let fd: number | undefined;
@@ -259,6 +267,17 @@ async function tick(): Promise<void> {
         ? "[catalog-auto-refresh] served model set changed; running Codex sessions keep the old list until restarted (ocx sync --restart-codex)"
         : "[catalog-auto-refresh] served model set changed");
     }
+    const fanout = clientFanout;
+    if (outcome.changed && fanout) {
+      const current = () => entryGeneration === generation;
+      try {
+        const failed = (await fanout(current)).filter(result => !result.ok).length;
+        // Outcomes can contain private paths and reasons; only the failure count leaves this hook.
+        if (current() && failed > 0) console.warn(`[catalog-auto-refresh] ${failed} client integration(s) were not refreshed; ocx sync retries them`);
+      } catch {
+        if (current()) console.warn("[catalog-auto-refresh] client integrations were not refreshed; ocx sync retries them");
+      }
+    }
   } catch {
     // A failed refresh is not an error worth surfacing: the next tick tries again.
   } finally {

package/src/codex/catalog.ts

@@ -4,7 +4,7 @@ export { isMediaGenerationModelId, shouldExposeRoutedModel, readCodexCatalogPath
 export type { CatalogModel, MultiAgentMode } from "./catalog/parsing";
 export { accountBoundNativeOpenAiSlugs, accountBoundNativeOpenAiSlugsBySelector, CODEX_NATIVE_ALIAS_CATALOG_KIND, NATIVE_DAYBREAK_BLUE_MODEL, NATIVE_GPT6_ASTRA_MODEL, NATIVE_GPT56_CONTEXT_WINDOW, NATIVE_GPT56_MAX_INPUT_TOKENS, NATIVE_GPT56_OPT_IN_CONTEXT_WINDOW, NATIVE_OPENAI_CAPABILITY_ALIAS_MODELS, NATIVE_OPENAI_MODELS, configuredNativeAliasSlugs, desktopAllowlistSuppressedNativeSlugs, isNativeAliasCatalogEntry, isNativeOpenAiCapabilityAliasModel, nativeContextLimits, nativeOpenAiCapabilitySourceSlug, nativeOpenAiContextWindow, nativeOpenAiMaxInputTokens, nativeOpenAiMaxOutputTokens, nativeOpenAiContextTier, disabledNativeSlugs, visibleNativeSlugs, desktopVisibleNativeSlugs, nativeModelRows, applyNativeVisibility, observedAccountBoundNativeEntries, observedAccountBoundNativeOpenAiSlugs, upstreamNativeEntry, nativeOpenAiSlugs, listCatalogNativeSlugs, nativeInputModalities, nativeReasoningEfforts, nativeDefaultReasoningEffort, shouldIncludeAccountBoundNativeOpenAi, shouldIncludeNativeOpenAi, type NativeContextLimits, type NativeContextLimitsInput } from "./catalog/metadata";
 export { isSpawnableCodexCandidate, codexExecInvocation, loadBundledCodexCatalog, materializeBundledCodexCatalog, loadCatalogTemplate } from "./catalog/bundled";
-export { nativeEffortClamp, shouldApplyNativeEffortClamp, catalogModelEfforts, codexSupportedReasoningEfforts, clampedDefaultEffort, clampEntryToCodexSupportedEfforts, clampCatalogModelsToCodexSupport } from "./catalog/effort";
+export { nativeEffortClamp, shouldApplyNativeEffortClamp, catalogModelEfforts, catalogModelLadders, codexSupportedReasoningEfforts, clampedDefaultEffort, clampEntryToCodexSupportedEfforts, clampCatalogModelsToCodexSupport } from "./catalog/effort";
 export { applyProviderConfigHints, isDatedVariantId, filterCatalogVisibleModels, gatherRoutedModels, clearGatherRoutedModelsInflight, augmentRoutedModelsWithRegistryOpenAiApiRows, augmentRoutedModelsWithMetadata, resolveComboCatalogMember, configuredComboTargetModelsByProvider } from "./catalog/provider-fetch";
 export { deriveComboCatalogModel, exactComboCatalogSlugs, getLastComboCatalogOmissions, resetOpenAiApiCatalogWarningStateForTests, uniqueCatalogModelsForPublicList, uniqueCatalogModelsForRawPublicList, buildComboCatalogOmission, comboCatalogOmissionReason, summarizeComboCatalogOmissions } from "./catalog/aggregation";
 export type { ComboCatalogOmission, ComboCatalogOmissionReason } from "./catalog/aggregation";

package/src/codex/codex-home-owner.ts

@@ -39,6 +39,9 @@ function provenAbsent(path: string): boolean {
   catch (error) { return absent(error) && provenAbsent(parent); }
 }
 
+/** A missing directory entry is a no-op; dangling links and unreadable homes are not. */
+export function codexHomeIsAbsent(home: string): boolean { return provenAbsent(home); }
+
 function validJournal(value: unknown): value is Record<string, unknown> {
   if (!value || typeof value !== "object" || Array.isArray(value)) return false;
   const journal = value as Record<string, unknown>;