@bitkyc08/opencodex 2.83.0 → 2.86.0

package/src/protocols/settings.ts

@@ -64,6 +64,7 @@ export interface ProtocolRolloutSettings {
   managedMessagesNative: boolean;
   managedMessagesNativeOAuth: boolean;
   directEncoders: boolean;
+  antigravityDirect: boolean;
   shadowPlan: boolean;
 }
 
@@ -101,6 +102,12 @@ export function resolveProtocolSettings(config: ProtocolConfig, providerName?: s
       // OAuth extension is meaningless without the key-auth path it extends.
       managedMessagesNativeOAuth: managedMessagesNative && nativeOn("managedMessagesNativeOAuth"),
       directEncoders: on("directEncoders"),
+      // Default on: an absent switch takes the Antigravity direct lane, which falls back to the
+      // bridge per request whenever its eligibility rule declines. Only an explicit `false` turns
+      // it off; a non-boolean value or a malformed container fails closed like every other switch.
+      antigravityDirect: validContainers && (Object.hasOwn(rollout, "antigravityDirect")
+        ? rollout.antigravityDirect === true
+        : true),
       shadowPlan: on("shadowPlan"),
     }),
   });
@@ -145,6 +152,7 @@ export function protocolPolicyRevision(config: ProtocolConfig & Pick<OcxConfig,
       secondarySettings.rollout.managedMessagesNative,
       secondarySettings.rollout.managedMessagesNativeOAuth,
       settings.rollout.directEncoders,
+      settings.rollout.antigravityDirect,
       settings.rollout.shadowPlan,
     ],
   });

package/src/providers/anthropic-billing-ownership.ts

@@ -0,0 +1,74 @@
+import type { OcxProviderConfig } from "../types";
+import { resolveAnthropicMessagesUrl } from "../adapters/anthropic";
+import { providerApiKeySelectionIsCurrent } from "./api-key-selection";
+import { hasKeyPoolFailover } from "./key-failover";
+import type { OcxConfig } from "../types";
+import { registerProviderResponseProvenance } from "./request-pacing";
+import { isEgressTransparentExecutor, markEgressTransparentExecutor } from "../lib/provider-egress";
+
+interface BillingSendOwnership {
+  readonly providerName: string;
+  readonly provider: OcxProviderConfig;
+  readonly target: string;
+}
+const responseOwners = new WeakMap<Response, BillingSendOwnership | null>();
+registerProviderResponseProvenance(responseOwners);
+
+/** Runs inside connection policy, after plugin/header rewrites, at the physical fetch. */
+export function anthropicBillingPhysicalFetch(
+  physicalFetch: typeof globalThis.fetch,
+  providerName: string,
+  provider: OcxProviderConfig,
+): typeof globalThis.fetch {
+  const wrapped = (async (input, init) => {
+    const target = input instanceof Request ? input.url : String(input);
+    const headers = new Headers(init?.headers ?? (input instanceof Request ? input.headers : undefined));
+    const selection = provider._apiKeyAttempt;
+    const ownsCredential = provider.apiKeyTransport === "bearer"
+      ? headers.get("authorization") === `Bearer ${provider.apiKey}` && !headers.has("x-api-key")
+      : headers.get("x-api-key") === provider.apiKey && !headers.has("authorization");
+    const ownsKey = provider.adapter === "anthropic" && (provider.authMode === undefined || provider.authMode === "key")
+      && hasKeyPoolFailover(provider) && selection !== undefined && provider.apiKey !== undefined
+      && ownsCredential
+      && target === resolveAnthropicMessagesUrl(provider);
+    const owner: BillingSendOwnership | null = ownsKey ? Object.freeze({
+      providerName, target,
+      provider: Object.freeze({ ...provider,
+        _apiKeyAttempt: Object.freeze({ ...selection }),
+        headers: Object.freeze({ ...provider.headers }),
+        apiKeyPool: provider.apiKeyPool?.map(entry => Object.freeze({ ...entry })),
+      }),
+    }) : null;
+    // No await between capturing the selected credential and invoking the actual send.
+    const response = await physicalFetch(input, init);
+    // An executor reusing a Response across physical sends cannot assign it two owners.
+    responseOwners.set(response, responseOwners.has(response) ? null : owner);
+    return response;
+  }) as typeof globalThis.fetch;
+  return isEgressTransparentExecutor(physicalFetch) ? markEgressTransparentExecutor(wrapped) : wrapped;
+}
+
+/** Immutable response ownership, matched to the attempted route and still-current selection. */
+export function anthropicBillingResponseOwner(
+  response: Response, config: OcxConfig, providerName: string, attemptedProvider: OcxProviderConfig,
+): OcxProviderConfig | null {
+  const owner = responseOwners.get(response);
+  if (!owner || owner.providerName !== providerName || owner.target !== resolveAnthropicMessagesUrl(attemptedProvider)) return null;
+  const sent = owner.provider;
+  const current = config.providers[providerName];
+  if (!current || current.adapter !== sent.adapter || current.adapter !== "anthropic"
+    || (current.authMode !== undefined && current.authMode !== "key") || !hasKeyPoolFailover(current)) return null;
+  const sentTransport = sent.apiKeyTransport ?? "x-api-key";
+  if ((current.apiKeyTransport ?? "x-api-key") !== sentTransport
+    || (attemptedProvider.apiKeyTransport ?? "x-api-key") !== sentTransport) return null;
+  // Configured headers can change billing/account ownership independently of key selection.
+  const headerShape = (provider: OcxProviderConfig) => JSON.stringify(Object.entries(provider.headers ?? {}).sort(([a], [b]) => a.localeCompare(b)));
+  if (headerShape(current) !== headerShape(sent)) return null;
+  const attempted = attemptedProvider._apiKeyAttempt;
+  if (!attempted || attemptedProvider.apiKey !== sent.apiKey || attemptedProvider.baseUrl !== sent.baseUrl
+    || attemptedProvider.authMode !== sent.authMode || attemptedProvider.adapter !== sent.adapter
+    || attempted.entryId !== sent._apiKeyAttempt?.entryId || attempted.reference !== sent._apiKeyAttempt?.reference
+    || attempted.revision !== sent._apiKeyAttempt?.revision
+    || !providerApiKeySelectionIsCurrent(config, providerName, sent)) return null;
+  return sent;
+}

package/src/providers/anthropic-billing-recovery.ts

@@ -0,0 +1,31 @@
+import type { OcxConfig, OcxProviderConfig } from "../types";
+import { isNonReplayableResponse } from "../lib/upstream-retry";
+import { anthropicBillingResponseOwner } from "./anthropic-billing-ownership";
+import { readAnthropicBillingRefusal } from "./anthropic-billing-refusal";
+import { hasKeyPoolFailover, rotateProviderTransportOnAnthropicBilling } from "./key-failover";
+import type { OcxProviderTransport } from "./xai-transport";
+
+/**
+ * Whether a provider can recover a credit-balance refusal by key rotation. This is an
+ * eligibility predicate for send accounting, not a recovery site: the one billing recovery
+ * loop in adapter-dispatch.ts keeps its own `hasKeyPoolFailover` guard.
+ */
+export function isAnthropicBillingKeyPool(provider: OcxProviderConfig): boolean {
+  return provider.adapter === "anthropic" && hasKeyPoolFailover(provider);
+}
+
+/** Pre-output billing recovery cools the refused key for the credit-balance window. */
+export async function rotateAnthropicBillingKeyOnResponse(
+  response: Response, config: OcxConfig, providerName: string, attemptedProvider: OcxProviderConfig,
+  options: { signal?: AbortSignal; promptCacheKey?: string } = {},
+): Promise<OcxProviderTransport | null> {
+  if (options.signal?.aborted || isNonReplayableResponse(response)
+    || !anthropicBillingResponseOwner(response, config, providerName, attemptedProvider)) return null;
+  if (!await readAnthropicBillingRefusal(response, options.signal) || options.signal?.aborted) return null;
+  // Reading is asynchronous: fence a late refusal against manual selection or key replacement.
+  const owner = anthropicBillingResponseOwner(response, config, providerName, attemptedProvider);
+  if (!owner) return null;
+  return rotateProviderTransportOnAnthropicBilling(config, providerName, owner, {
+    attemptedKey: owner.apiKey, attemptedSelection: owner._apiKeyAttempt, promptCacheKey: options.promptCacheKey,
+  });
+}

package/src/providers/anthropic-billing-refusal.ts

@@ -0,0 +1,55 @@
+/** Pure credit-balance evidence, independent of OAuth account routing. */
+import { readBoundedResponseBody } from "../lib/bounded-body";
+const MAX_BILLING_REFUSAL_BYTES = 8 * 1024;
+const BILLING_REFUSAL_DEADLINE_MS = 250;
+// Keep the whole-message credit-balance pattern used by anthropic-account-refusal.
+const CREDIT_BALANCE_REFUSAL = /^Your credit balance is too low to access the Anthropic API\.(?: Please go to Plans & Billing to upgrade or purchase credits\.)?$/i;
+const BILLING_ERROR_TYPES = new Set(["invalid_request_error", "billing_error", "permission_error"]);
+const ACCOUNT_REFUSAL_CODES = new Set(["subscription_required", "insufficient_quota", "permission_denied"]);
+
+function record(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+/** Only an Anthropic error envelope with exact billing wording is evidence. */
+export function isAnthropicBillingRefusal(status: number, payload: unknown): boolean {
+  if (status !== 400 && status !== 402) return false;
+  if (!record(payload) || payload.type !== "error" || !record(payload.error)) return false;
+  const error = payload.error;
+  if (typeof error.type !== "string" || !BILLING_ERROR_TYPES.has(error.type)
+    || typeof error.message !== "string" || Buffer.byteLength(error.message, "utf8") > MAX_BILLING_REFUSAL_BYTES) return false;
+  if (error.code != null && (typeof error.code !== "string" || !ACCOUNT_REFUSAL_CODES.has(error.code))) return false;
+  return CREDIT_BALANCE_REFUSAL.test(error.message.trim());
+}
+
+/** Bounded combo evidence after existing HTTP error formatting, before any output. */
+export function isAnthropicBillingFailure(status: number, message: string, code?: string | null): boolean {
+  if (status !== 400 && status !== 402 || Buffer.byteLength(message, "utf8") > MAX_BILLING_REFUSAL_BYTES) return false;
+  if (code != null && !BILLING_ERROR_TYPES.has(code) && !ACCOUNT_REFUSAL_CODES.has(code)) return false;
+  let text = message.trim();
+  const prefix = `Provider error ${status}: `;
+  if (text.startsWith(prefix)) text = text.slice(prefix.length);
+  try { return isAnthropicBillingRefusal(status, JSON.parse(text)); } catch { /* Exact prose needs a structured type. */ }
+  return typeof code === "string" && BILLING_ERROR_TYPES.has(code)
+    && isAnthropicBillingRefusal(status, { type: "error", error: { type: code, message: text } });
+}
+
+/** Inspect a clone, never the terminal body; the shared reader owns interruption/cleanup. */
+export async function readAnthropicBillingRefusal(response: Response, signal?: AbortSignal): Promise<boolean> {
+  if (signal?.aborted || (response.status !== 400 && response.status !== 402)) return false;
+  const contentType = response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
+  if (!contentType || !/^application\/(?:json|[a-z0-9.+-]+\+json)$/.test(contentType)) return false;
+  try {
+    const deadline = AbortSignal.timeout(BILLING_REFUSAL_DEADLINE_MS);
+    const body = await readBoundedResponseBody(response.clone(), {
+      signal: signal ? AbortSignal.any([signal, deadline]) : deadline,
+      maxBytes: MAX_BILLING_REFUSAL_BYTES, fatalUtf8: true,
+      totalTimeoutMs: BILLING_REFUSAL_DEADLINE_MS,
+    });
+    if (signal?.aborted || !body.displaySafe || body.truncated || body.timedOut || body.oversized) return false;
+    return isAnthropicBillingRefusal(response.status, JSON.parse(body.text));
+  } catch {
+    // Untrusted malformed, unreadable and invalid UTF-8 bodies confer no authority.
+    return false;
+  }
+}

package/src/providers/anthropic-reset-admission.ts

@@ -0,0 +1,62 @@
+/**
+ * Put one Anthropic account back into the pool after a settled reset grant.
+ *
+ * A fresh usage read lifts a 429 quota cooldown whose rejected windows read
+ * open, whatever its deadline source (#6989), but a grant should not have to
+ * wait for one: the grant itself lifts admission, as far as its evidence goes:
+ *
+ * - `claimedAt` is when the operation was first journaled, before its first
+ *   claim was sent. A refusal recorded at or after it may already describe the
+ *   post-reset account (another request can be refused while the claim is in
+ *   flight), so it stays.
+ * - `cleared` is the window list the canonical settlement reported. The
+ *   cooldown is lifted only when those windows cover every window its refusal
+ *   named; an empty or partial list leaves it in place.
+ *
+ * Whatever the routing outcome (other than a newer refusal), the cached bars
+ * are dropped and usage is reread with its own request: joining a read that
+ * started before the grant could republish the pre-reset bars, and a fresh
+ * reading is what lets usage recovery release a cooldown the cleared
+ * list did not cover. The reread is best-effort; the grant is already spent.
+ *
+ * Model-family exclusions are not cleared here. Only that reread may release
+ * one, and only when its payload proves the family is no longer rejected.
+ */
+import { anthropicRoutingFor, type AnthropicQuotaWindow } from "../oauth/anthropic-routing";
+import type { AnthropicInstanceId } from "./anthropic-instance";
+import { fetchAnthropicAccountQuota } from "./quota/anthropic-account-quota";
+import { forgetCachedProviderAccountQuota } from "./quota/account-cache";
+import { anthropicCooldownRecoveryFor } from "./quota/anthropic-cooldown-recovery";
+
+export interface AnthropicResetAdmissionEvidence {
+  /** Journal time of the operation's first record, written before the first claim was sent. */
+  claimedAt: number;
+  /** Windows the canonical settlement reported cleared (reset-grant window names). */
+  cleared: readonly string[];
+}
+
+const QUOTA_WINDOW_FOR_RESET_WINDOW: Readonly<Record<string, AnthropicQuotaWindow>> = {
+  five_hour: "five-hour",
+  seven_day: "weekly",
+};
+
+export async function admitAnthropicAccountAfterReset(
+  instance: AnthropicInstanceId,
+  accountId: string,
+  evidence: AnthropicResetAdmissionEvidence,
+): Promise<void> {
+  const cleared = new Set<AnthropicQuotaWindow>();
+  for (const window of evidence.cleared) {
+    const quotaWindow = QUOTA_WINDOW_FOR_RESET_WINDOW[window];
+    if (quotaWindow) cleared.add(quotaWindow);
+  }
+  const outcome = anthropicRoutingFor(instance).clearAnthropicAccountCooldownForReset(accountId, evidence.claimedAt, cleared);
+  if (outcome === "newer") return;
+  // Move any usage read that started before the grant onto a stale generation
+  // before dropping the cached row, so it cannot republish the pre-reset bars.
+  // "cleared" and "uncovered" already advanced the generation in routing (an
+  // uncovered entry moved with it, so the reread below can still recover it).
+  if (outcome === "absent") anthropicCooldownRecoveryFor(instance).noteAnthropicCooldownMutation(accountId);
+  forgetCachedProviderAccountQuota(instance, accountId);
+  await fetchAnthropicAccountQuota(instance, accountId, true, undefined, true);
+}

package/src/providers/anthropic-reset-grant-ledger.ts

@@ -44,6 +44,8 @@ interface OperationRecord {
   status: "open" | "settled";
   code?: string;
   resetsLeft?: number | null;
+  /** Windows the settled claim reported cleared; absent on records written before this field. */
+  cleared?: string[];
   attempts: number;
   leaseUntil: number;
   createdAt: number;
@@ -64,7 +66,7 @@ export interface AnthropicResetOperationIdentity {
 
 export type AnthropicResetBegin =
   | { kind: "execute"; attempt: number }
-  | { kind: "replay"; code: string; resetsLeft: number | null; settledAt: number }
+  | { kind: "replay"; code: string; resetsLeft: number | null; settledAt: number; claimedAt: number; cleared: string[] }
   | { kind: "identity-mismatch" }
   | { kind: "in-flight" }
   | { kind: "expired" }
@@ -102,7 +104,9 @@ function isRecordShape(value: unknown): value is OperationRecord {
   return typeof record.accountId === "string" && typeof record.grantId === "string"
     && typeof record.orgDigest === "string" && (record.status === "open" || record.status === "settled")
     && typeof record.attempts === "number" && typeof record.leaseUntil === "number"
-    && typeof record.createdAt === "number" && typeof record.updatedAt === "number";
+    && typeof record.createdAt === "number" && typeof record.updatedAt === "number"
+    && (record.cleared === undefined
+      || Array.isArray(record.cleared) && record.cleared.every(window => typeof window === "string"));
 }
 
 /** Missing file → empty journal. Present but unreadable → throws; never an empty fallback. */
@@ -197,7 +201,10 @@ export function beginAnthropicResetOperation(
         return { kind: "identity-mismatch" };
       }
       if (existing.status === "settled") {
-        return { kind: "replay", code: existing.code ?? "unavailable", resetsLeft: existing.resetsLeft ?? null, settledAt: existing.updatedAt };
+        return {
+          kind: "replay", code: existing.code ?? "unavailable", resetsLeft: existing.resetsLeft ?? null,
+          settledAt: existing.updatedAt, claimedAt: existing.createdAt, cleared: existing.cleared ?? [],
+        };
       }
       if (existing.leaseUntil > now) return { kind: "in-flight" };
       if (now - existing.createdAt >= ANTHROPIC_RESET_RETRY_WINDOW_MS) return { kind: "expired" };
@@ -232,6 +239,12 @@ export function beginAnthropicResetOperation(
 export interface AnthropicResetSettlement {
   code: string;
   resetsLeft: number | null;
+  /** When the canonical (first) settlement was journaled, not when this caller arrived. */
+  settledAt: number;
+  /** When the operation was first journaled, before its first claim was sent. */
+  claimedAt: number;
+  /** Windows the canonical settlement reported cleared. */
+  cleared: string[];
 }
 
 /**
@@ -241,7 +254,7 @@ export interface AnthropicResetSettlement {
  * throws, because an answer with no journal entry cannot be reported as durable.
  */
 export function settleAnthropicResetOperation(
-  settlement: { operationId: string; code: string; resetsLeft: number | null },
+  settlement: { operationId: string; code: string; resetsLeft: number | null; cleared?: readonly string[] },
   options: AnthropicResetLedgerOptions = {},
 ): AnthropicResetSettlement {
   const now = options.now ?? Date.now();
@@ -250,14 +263,23 @@ export function settleAnthropicResetOperation(
     const journal = readJournal(filePath);
     const existing = journal.operations[settlement.operationId];
     if (!existing) throw new AnthropicResetLedgerError("unavailable");
-    if (existing.status === "settled") return { code: existing.code ?? "unavailable", resetsLeft: existing.resetsLeft ?? null };
+    if (existing.status === "settled") {
+      return {
+        code: existing.code ?? "unavailable", resetsLeft: existing.resetsLeft ?? null,
+        settledAt: existing.updatedAt, claimedAt: existing.createdAt, cleared: existing.cleared ?? [],
+      };
+    }
     existing.status = "settled";
     existing.code = settlement.code;
     existing.resetsLeft = settlement.resetsLeft;
+    existing.cleared = [...(settlement.cleared ?? [])];
     existing.leaseUntil = 0;
     existing.updatedAt = now;
     writeJournal(filePath, journal, now);
-    return { code: settlement.code, resetsLeft: settlement.resetsLeft };
+    return {
+      code: settlement.code, resetsLeft: settlement.resetsLeft, settledAt: now,
+      claimedAt: existing.createdAt, cleared: [...existing.cleared],
+    };
   });
 }
 

package/src/providers/antigravity-account-roster.ts

@@ -0,0 +1,102 @@
+import { getConfigDir } from "../config/paths";
+import { ANTIGRAVITY_MODEL_ALIASES, canonicalAntigravityUsageModel, type AntigravityAvailableModel } from "./antigravity-models";
+
+/**
+ * Per-account Antigravity model rosters, taken from each account's own live
+ * `:fetchAvailableModels` discovery.
+ *
+ * Google gates models per account, not per client. Measured 2026-10-14: one account lists
+ * `claude-sonnet-4-6` / `claude-opus-4-6-thinking` and answers 404 "Requested entity was not
+ * found" for every `claude-{opus,sonnet}-5-5-*` id, while other accounts list only the 5.5
+ * families. Gemini 4 Argon is likewise Ultra / Enterprise only. Google documents Claude 5.5 as
+ * needing a directly billed, non-trial Pro or Ultra plan and rolls it out gradually, so the static
+ * lineup is a superset and only discovery says what one account can actually call.
+ *
+ * The catalog already exposes only the ACTIVE account's discovered rows (an authoritative live
+ * roster drops static rows it did not return). This store keeps every account's last roster so
+ * that account selection can prefer an account that lists the requested model, instead of
+ * landing a 5.5 request on a 4.6-only account. Absence of a roster is "unknown", never "no":
+ * an account that was never active during discovery stays fully usable.
+ */
+
+/** A roster older than this is treated as unknown; entitlements change with plan and rollout. */
+export const ANTIGRAVITY_ACCOUNT_ROSTER_TTL_MS = 6 * 60 * 60 * 1000;
+
+interface AccountRoster {
+  readonly ids: ReadonlySet<string>;
+  readonly modelIds: readonly string[];
+  readonly observedAt: number;
+}
+
+const rosters = new Map<string, AccountRoster>();
+
+function rosterKey(providerName: string, accountId: string): string {
+  return `${getConfigDir()}\0${providerName}\0${accountId}`;
+}
+
+/** Record one account's discovered roster: picker ids, representative wire ids, and tier wire ids. */
+export function recordAntigravityAccountRoster(
+  providerName: string,
+  accountId: string,
+  models: readonly AntigravityAvailableModel[],
+  now = Date.now(),
+): void {
+  if (!providerName || !accountId) return;
+  const ids = new Set<string>();
+  for (const model of models) {
+    ids.add(model.id);
+    ids.add(model.wireModelId);
+    for (const wire of Object.values(model.effortWireModelIds ?? {})) if (wire) ids.add(wire);
+  }
+  rosters.set(rosterKey(providerName, accountId), {
+    ids,
+    modelIds: models.map(model => model.id),
+    observedAt: now,
+  });
+}
+
+function freshRoster(providerName: string, accountId: string, now: number): AccountRoster | undefined {
+  const roster = rosters.get(rosterKey(providerName, accountId));
+  if (!roster || now - roster.observedAt > ANTIGRAVITY_ACCOUNT_ROSTER_TTL_MS) return undefined;
+  return roster;
+}
+
+/** The picker ids one account's last discovery returned, or `undefined` when unknown. */
+export function antigravityAccountRosterModelIds(
+  providerName: string,
+  accountId: string,
+  now = Date.now(),
+): readonly string[] | undefined {
+  return freshRoster(providerName, accountId, now)?.modelIds;
+}
+
+/**
+ * Whether one account's roster lists `modelId`: `true` / `false` from its last discovery,
+ * `undefined` when that account has no fresh roster. A picker id, one of its tier wire ids, or a
+ * compatibility alias of either all count as listed.
+ */
+export function antigravityAccountSupportsModel(
+  providerName: string,
+  accountId: string,
+  modelId: string,
+  now = Date.now(),
+): boolean | undefined {
+  const roster = freshRoster(providerName, accountId, now);
+  if (!roster) return undefined;
+  const id = modelId.trim();
+  if (!id) return undefined;
+  if (roster.ids.has(id)) return true;
+  const canonical = canonicalAntigravityUsageModel(id);
+  if (roster.ids.has(canonical)) return true;
+  const alias = Object.hasOwn(ANTIGRAVITY_MODEL_ALIASES, id) ? ANTIGRAVITY_MODEL_ALIASES[id] : undefined;
+  return alias !== undefined && roster.ids.has(alias);
+}
+
+/** Forget rosters (one account, or all). For account removal and tests. */
+export function clearAntigravityAccountRosters(providerName?: string, accountId?: string): void {
+  if (providerName && accountId) {
+    rosters.delete(rosterKey(providerName, accountId));
+    return;
+  }
+  rosters.clear();
+}

package/src/providers/antigravity-models.ts

@@ -17,6 +17,21 @@ import { readAntigravityWireSnapshot, writeAntigravityWireSnapshot, type Antigra
 /** Current Antigravity Flash generation. */
 const GEMINI_FLASH_CURRENT = "gemini-3.8-flash";
 
+/**
+ * Gemini 4 Argon. Like 3.8 it publishes one wire id per tier (`-low/-medium/-high`) and no
+ * `-tiered` row, verified 2026-10-14 against live CCA. CCA serves these ids only to the CLI
+ * User-Agent (see antigravityUserAgentForWireModel), and only to AI Ultra / Enterprise accounts.
+ */
+const GEMINI_ARGON = "gemini-4-argon";
+
+/**
+ * Claude 5.5 on Antigravity: one wire id per tier (`-low/-medium/-high`), each 1,000,000 tokens
+ * with image input, observed in live CCA discovery on 2026-10-03
+ * (devlog/_fin/261003_release_lane_c). They ride the IDE User-Agent like every non-Argon model.
+ */
+const CLAUDE_OPUS_55 = "claude-opus-5-5";
+const CLAUDE_SONNET_55 = "claude-sonnet-5-5";
+
 /**
  * Previous Flash generation — still served, still picker-visible.
  *
@@ -75,6 +90,15 @@ const ANTIGRAVITY_WIRE_MODELS = [
 ];
 
 const ANTIGRAVITY_PICKER_MODEL_BY_WIRE_ID: Record<string, string> = {
+  "claude-opus-5-5-low": CLAUDE_OPUS_55,
+  "claude-opus-5-5-medium": CLAUDE_OPUS_55,
+  "claude-opus-5-5-high": CLAUDE_OPUS_55,
+  "claude-sonnet-5-5-low": CLAUDE_SONNET_55,
+  "claude-sonnet-5-5-medium": CLAUDE_SONNET_55,
+  "claude-sonnet-5-5-high": CLAUDE_SONNET_55,
+  "gemini-4-argon-low": GEMINI_ARGON,
+  "gemini-4-argon-medium": GEMINI_ARGON,
+  "gemini-4-argon-high": GEMINI_ARGON,
   "gemini-3.8-flash-low": "gemini-3.8-flash",
   "gemini-3.8-flash-medium": "gemini-3.8-flash",
   "gemini-3.8-flash-high": "gemini-3.8-flash",
@@ -164,8 +188,11 @@ function collapsesIntoKnownPickerModel(candidateId: string): boolean {
 // Claude Opus: effort → thinkingConfig.thinkingLevel (CLIProxyAPI proven pattern).
 export const ANTIGRAVITY_MODEL_EFFORTS: Record<string, string[]> = {
   // No `minimal`: Google documents it as an error for this generation, and CCA exposes only
-  // the three tiers.
+  // the three tiers. Argon documents the same ladder (`minimal` is an HTTP 400).
+  [GEMINI_ARGON]: ["low", "medium", "high"],
   "gemini-3.8-flash": ["low", "medium", "high"],
+  [CLAUDE_OPUS_55]: ["low", "medium", "high"],
+  [CLAUDE_SONNET_55]: ["low", "medium", "high"],
   "gemini-3.7-flash": ["low", "medium", "high"],
   "gemini-3.1-pro": ["low", "high"],
   "claude-sonnet-4-6": ["low", "medium", "high", "max"],
@@ -175,7 +202,23 @@ export const ANTIGRAVITY_MODEL_EFFORTS: Record<string, string[]> = {
 // ── Effort → wire model map for Gemini base models ──
 const ANTIGRAVITY_EFFORT_WIRE_MAP: Record<string, Record<string, string>> = {
   // 3.8 publishes one wire id per tier and no `-tiered` row, so its efforts ride the suffix.
-  // This is the 3.6 shape, not the 3.7 one.
+  // This is the 3.6 shape, not the 3.7 one. Argon has the same shape.
+  [GEMINI_ARGON]: {
+    low: "gemini-4-argon-low",
+    medium: "gemini-4-argon-medium",
+    high: "gemini-4-argon-high",
+  },
+  // Claude 5.5 publishes the same per-tier suffix family.
+  [CLAUDE_OPUS_55]: {
+    low: "claude-opus-5-5-low",
+    medium: "claude-opus-5-5-medium",
+    high: "claude-opus-5-5-high",
+  },
+  [CLAUDE_SONNET_55]: {
+    low: "claude-sonnet-5-5-low",
+    medium: "claude-sonnet-5-5-medium",
+    high: "claude-sonnet-5-5-high",
+  },
   "gemini-3.8-flash": {
     low: "gemini-3.8-flash-low",
     medium: "gemini-3.8-flash-medium",
@@ -198,7 +241,7 @@ const ANTIGRAVITY_EFFORT_WIRE_MAP: Record<string, Record<string, string>> = {
  * `gemini-3.1-pro` is deliberately absent: its `high` rung is `gemini-pro-agent`, which carries
  * no tier suffix, so there the level is the only thing naming the effort.
  */
-const ANTIGRAVITY_SUFFIX_TIER_MODELS = new Set(["gemini-3.8-flash"]);
+const ANTIGRAVITY_SUFFIX_TIER_MODELS = new Set([GEMINI_ARGON, "gemini-3.8-flash", CLAUDE_OPUS_55, CLAUDE_SONNET_55]);
 
 function completeDiscoveredEffortWireModelIds(
   pickerId: string,
@@ -223,7 +266,11 @@ function completeDiscoveredEffortWireModelIds(
 // ── Default effort per Gemini base model ──
 const ANTIGRAVITY_DEFAULT_EFFORT: Record<string, string> = {
   // Google's documented thinking_level default, and the tier CCA marks `recommended`.
+  [GEMINI_ARGON]: "medium",
   "gemini-3.8-flash": "medium",
+  // Matches the discovered-family default (medium), so static and live resolution agree.
+  [CLAUDE_OPUS_55]: "medium",
+  [CLAUDE_SONNET_55]: "medium",
   "gemini-3.1-pro": "high",
 };
 
@@ -285,9 +332,25 @@ export const ANTIGRAVITY_MODEL_ALIASES: Record<string, string> = {
   ...ANTIGRAVITY_COMPATIBILITY_MODEL_ALIASES,
 };
 
-// Picker-visible: collapsed base models only.
+// Static picker lineup: collapsed base models only, exactly "3.8 / 4 / 5.5 / 5.5" (2026-10-14).
+// Anything else reaches the picker only when live discovery returns it.
 export const ANTIGRAVITY_MODELS = [
   GEMINI_FLASH_CURRENT,
+  GEMINI_ARGON,
+  CLAUDE_OPUS_55,
+  CLAUDE_SONNET_55,
+];
+
+/**
+ * Every base id the routing and discovery rules recognise: the static lineup plus models that
+ * left it. Removing a model from the picker must not change how a saved selection routes or how
+ * a discovered row collapses, so these legacy bases stay known here. Live discovery on
+ * 2026-10-14 no longer returns gemini-3.7-flash(-tiered) or the gemini-3.1-pro wire ids (both
+ * 404), but still returns the Claude 4.6 rows and gpt-oss-120b-medium, which therefore keep
+ * appearing through discovery.
+ */
+export const ANTIGRAVITY_KNOWN_PICKER_MODELS: readonly string[] = [
+  ...ANTIGRAVITY_MODELS,
   GEMINI_FLASH_PREVIOUS,
   "gemini-3.1-pro",
   "gemini-3.1-flash-image",
@@ -297,11 +360,20 @@ export const ANTIGRAVITY_MODELS = [
 ];
 
 function isKnownAntigravityPickerModelId(value: string): boolean {
-  return isValidModelDiscoveryModelId(value) && ANTIGRAVITY_MODELS.includes(value);
+  return isValidModelDiscoveryModelId(value) && ANTIGRAVITY_KNOWN_PICKER_MODELS.includes(value);
 }
 
 // Context windows from the upstream `:fetchAvailableModels` maxTokens per model.
 const ANTIGRAVITY_WIRE_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
+  "claude-opus-5-5-low": 1_000_000,
+  "claude-opus-5-5-medium": 1_000_000,
+  "claude-opus-5-5-high": 1_000_000,
+  "claude-sonnet-5-5-low": 1_000_000,
+  "claude-sonnet-5-5-medium": 1_000_000,
+  "claude-sonnet-5-5-high": 1_000_000,
+  "gemini-4-argon-low": 1_048_576,
+  "gemini-4-argon-medium": 1_048_576,
+  "gemini-4-argon-high": 1_048_576,
   "gemini-3.8-flash-low": 1_048_576,
   "gemini-3.8-flash-medium": 1_048_576,
   "gemini-3.8-flash-high": 1_048_576,
@@ -316,7 +388,10 @@ const ANTIGRAVITY_WIRE_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
 
 export const ANTIGRAVITY_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
   // Collapsed base IDs — explicit entries for the picker.
+  [GEMINI_ARGON]: 1_048_576,
   "gemini-3.8-flash": 1_048_576,
+  [CLAUDE_OPUS_55]: 1_000_000,
+  [CLAUDE_SONNET_55]: 1_000_000,
   "gemini-3.7-flash": 1_048_576,
   "gemini-3.1-pro": 1_048_576,
   // Wire IDs and aliases via derivation.
@@ -330,6 +405,9 @@ export const ANTIGRAVITY_MODEL_CONTEXT_WINDOWS: Record<string, number> = {
 };
 
 export const ANTIGRAVITY_MODEL_INPUT_MODALITIES: Record<string, string[]> = {
+  [GEMINI_ARGON]: ["text", "image"],
+  [CLAUDE_OPUS_55]: ["text", "image"],
+  [CLAUDE_SONNET_55]: ["text", "image"],
   // Google documents 3.7 Flash as also accepting video, audio and PDF, but this proxy
   // carries only text and image parts (`OcxImageContent`, src/types.ts) and the Codex
   // catalog normalizes `input_modalities` against a closed enum. Advertising a modality
@@ -641,7 +719,7 @@ export function resolveAntigravityWireModelId(modelId: string, baseUrl?: string)
  * IS the effort, and sending both creates a contradictory request.
  */
 export function isAntigravitySuffixModelId(modelId: string): boolean {
-  return !(ANTIGRAVITY_MODELS as string[]).includes(modelId);
+  return !ANTIGRAVITY_KNOWN_PICKER_MODELS.includes(modelId);
 }
 
 /** The reasoning tier a retired Flash id used to encode, if it is one. */
@@ -753,7 +831,7 @@ export function resolveAntigravityEffortWireModel(
 // summary aggregation consults this reverse map so one call model = one usage row.
 const ANTIGRAVITY_USAGE_BASE_BY_ID: Record<string, string> = (() => {
   const rev: Record<string, string> = {};
-  for (const base of ANTIGRAVITY_MODELS) rev[base] = base;
+  for (const base of ANTIGRAVITY_KNOWN_PICKER_MODELS) rev[base] = base;
   for (const [base, effortMap] of Object.entries(ANTIGRAVITY_EFFORT_WIRE_MAP)) {
     rev[base] = base;
     for (const wire of Object.values(effortMap)) rev[wire] = base;