@bitkyc08/opencodex 2.84.0 → 2.86.0

package/src/clients/config-export/qoder.ts

@@ -0,0 +1,93 @@
+import { homedir } from "node:os";
+import { isAbsolute, join } from "node:path";
+import { isLoopbackHostname, shouldInjectApiAuthHeader } from "../../codex/loopback-target";
+import { formatSelectorConjunction } from "../../integrations/merge";
+import { ClientPathError } from "../config-export";
+import type { ExportContext, ManagedContribution, OpencodeLaunchEnv } from "./contracts";
+import { LOOPBACK_API_KEY_PLACEHOLDER, OPENCODE_PROVIDER_ID } from "./constants";
+import { authoritativeContextWindow, normalizeExportModels } from "./model-metadata";
+
+/**
+ * Qoder's configuration directory: `QODER_CONFIG_DIR` when set, otherwise `~/.qoder`
+ * (https://docs.qoder.com/cli/settings-reference). Export and detection both resolve it here.
+ * A relative override is refused because opencodex and Qoder would anchor it to different cwds.
+ */
+export function qoderHomeDir(env: OpencodeLaunchEnv = process.env, home: string = homedir()): string {
+  const override = env.QODER_CONFIG_DIR?.trim();
+  if (!override) return join(home, ".qoder");
+  if (override === "~") return home;
+  if (override.startsWith("~/") || override.startsWith("~\\")) return join(home, override.slice(2));
+  if (!isAbsolute(override)) {
+    throw new ClientPathError(
+      `QODER_CONFIG_DIR must be an absolute path or start with ~; "${override}" depends on the working directory, `
+      + "so opencodex and Qoder would disagree about which file it names.",
+    );
+  }
+  return override;
+}
+
+export function qoderConfigPath(env: OpencodeLaunchEnv = process.env, home: string = homedir()): string {
+  return join(qoderHomeDir(env, home), "settings.json");
+}
+
+/** Qoder IDE and qodercli share this provider and custom-model catalog. */
+export function buildQoderClientConfig(ctx: ExportContext) {
+  if (shouldInjectApiAuthHeader(ctx.config) || !isLoopbackHostname(new URL(ctx.baseUrl).hostname)) {
+    throw new Error("Qoder's placeholder API key requires a loopback-only listener.");
+  }
+  return qoderDocument(ctx);
+}
+
+function qoderDocument(ctx: ExportContext) {
+  const models = normalizeExportModels(ctx.models);
+  return {
+    providers: {
+      [OPENCODE_PROVIDER_ID]: {
+        type: "openai-compatible",
+        protocol: "openai",
+        displayName: "opencodex",
+        baseUrl: ctx.baseUrl,
+        apiKey: LOOPBACK_API_KEY_PLACEHOLDER,
+        ...(models[0] ? { defaultModel: models[0].namespaced } : {}),
+        models: models.map(model => ({ model: model.namespaced })),
+      },
+    },
+    modelConfigs: {
+      customModels: models.map(model => ({
+        provider: OPENCODE_PROVIDER_ID,
+        apiKey: LOOPBACK_API_KEY_PLACEHOLDER,
+        model: model.namespaced,
+        baseURL: ctx.baseUrl,
+        displayName: model.namespaced,
+        maxInputTokens: authoritativeContextWindow(model.contextWindow) ?? 128000,
+      })),
+    },
+  };
+}
+
+export type QoderGeneratedConfig = ReturnType<typeof buildQoderClientConfig>;
+
+export function summarizeQoder(document: unknown): { modelCount: number; modelsWithoutLimits: number } {
+  const models = (document as QoderGeneratedConfig | undefined)?.modelConfigs?.customModels ?? [];
+  return { modelCount: models.length, modelsWithoutLimits: 0 };
+}
+
+export function buildQoderContribution(ctx: ExportContext): ManagedContribution {
+  // The writer gates admission before applying. Classification and disable must
+  // still work after the operator changes the proxy to a non-loopback bind.
+  const doc = qoderDocument(ctx);
+  return {
+    clientId: "qoder",
+    fragments: [
+      { path: ["providers", OPENCODE_PROVIDER_ID], value: doc.providers[OPENCODE_PROVIDER_ID] },
+      ...doc.modelConfigs.customModels.map(model => {
+        const selector = formatSelectorConjunction([
+          { field: "provider", value: OPENCODE_PROVIDER_ID },
+          { field: "model", value: model.model },
+        ]);
+        if (selector === null) throw new Error("Qoder model ID cannot be represented by a managed array selector.");
+        return { path: ["modelConfigs", "customModels", selector], value: model };
+      }),
+    ],
+  };
+}

package/src/clients/config-export.ts

@@ -24,6 +24,7 @@ import { existsSync, lstatSync, readFileSync, realpathSync, statSync } from "nod
 import { basename, dirname, isAbsolute, join, resolve, win32 } from "node:path";
 import { shouldInjectApiAuthHeader, standaloneCodexRoutingTarget } from "../codex/inject";
 import { FORMAT_MEDIA_TYPE, serializeDocument, type ConfigFormat } from "../integrations/serialize";
+import { fileIO } from "../integrations/config-io";
 import { canonicalizeReasoningEfforts } from "../reasoning-effort";
 import { expandFastExportModels } from "./config-export/fast-models";
 import { probeHostname } from "../server/proxy-liveness";
@@ -81,6 +82,8 @@ import {
 
 export type { CommandCodeGeneratedConfig, CommandCodeModelEntry, CommandCodeProviderBlock };
 export { buildCommandCodeClientConfig, summarizeCommandCode, buildCommandCodeContribution, commandCodeProviderRoot };
+import { buildQoderClientConfig, summarizeQoder, buildQoderContribution, qoderConfigPath } from "./config-export/qoder";
+export { buildQoderClientConfig, qoderConfigPath, qoderHomeDir, type QoderGeneratedConfig } from "./config-export/qoder";
 
 
 
@@ -475,10 +478,8 @@ export type ZcodePathIO = {
   readText: (path: string) => { kind: "text"; text: string } | { kind: "missing" } | { kind: "failed"; code?: string };
 };
 const zcodePathIO: ZcodePathIO = {
-  readText: path => {
-    try { return { kind: "text", text: readFileSync(path, "utf8") }; }
-    catch (error) { return (error as NodeJS.ErrnoException).code === "ENOENT" ? { kind: "missing" } : { kind: "failed" }; }
-  },
+  /** Shares the integration reader's four-MiB limit and regular-file-only bootstrap contract. */
+  readText: path => fileIO().readText(path),
 };
 export class ZcodeSettingsPathError extends ClientPathError {}
 
@@ -1429,6 +1430,18 @@ export function clineSettingsDir(env: OpencodeLaunchEnv = process.env, home: str
 }
 
 export const EXPORT_CLIENTS: Record<ExportClientId, ExportClientSpec> = {
+  qoder: {
+    id: "qoder",
+    filename: "qoder-settings.json",
+    destination: env => qoderConfigPath(env),
+    apiKeyEnv: "",
+    exportHint: "Qoder reads a non-secret placeholder from settings.json; loopback needs no key.",
+    build: buildQoderClientConfig,
+    format: "json",
+    summarize: summarizeQoder,
+    buildContribution: buildQoderContribution,
+    loopbackOnly: true,
+  },
   opencode: {
     id: "opencode",
     filename: "opencode.json",

package/src/codex/auth-api/pool-mode-gate.ts

@@ -25,6 +25,7 @@ import type { PoolQuotaResult } from "./pool-quota-probe";
 import { fetchMainAccountInfoAttempt, fetchMainAccountInfo, MAIN_CACHE_TTL } from "./main-account-probe";
 import { fetchPoolAccountQuota, PoolQuotaProbeBusyError, POOL_CACHE_TTL, POOL_QUOTA_REFRESH_CONCURRENCY } from "./pool-quota-probe";
 import { getRuntimeConfig, configuredPoolAccount, mapWithConcurrency } from "./runtime-config";
+import { trackBackgroundWork } from "../../lib/background-work";
 
 let primeInFlight: Promise<void> | null = null;
 let lastPriorityFailbackPrimeAt: number | undefined;
@@ -259,7 +260,9 @@ export async function primeCodexPoolQuotas(
       && now - lastPriorityFailbackPrimeAt < CODEX_PRIORITY_FAILBACK_REFRESH_MS) return;
     lastPriorityFailbackPrimeAt = now;
   }
-  primeInFlight = (async () => {
+  // Tracked because most callers do not await it, yet it holds the native-main claim
+  // database open; whoever removes that directory settles it first (see background-work).
+  primeInFlight = trackBackgroundWork(`codex-pool-quota-prime:${reason}`, (async () => {
     const pool = (runtimeConfig.codexAccounts ?? []).filter(isSelectableCodexPoolAccount);
     const stale = pool.filter(a => {
       const q = getAccountQuota(a.id);
@@ -344,7 +347,7 @@ export async function primeCodexPoolQuotas(
     if (process.env.OPENCODEX_DEBUG_QUOTA === "1") {
       console.warn(`[codex-quota] prime done (reason=${reason}, pool=${pool.length}, refreshed=${stale.length})`);
     }
-  })().finally(() => { primeInFlight = null; });
+  })().finally(() => { primeInFlight = null; }));
   return primeInFlight;
 }
 

package/src/codex/auth-context.ts

@@ -51,6 +51,7 @@ import {
 // The half-open TRANSIENT-HOLD lease (#4701). Not the quota-cooldown probe lease imported from
 // ./routing above -- different module, different domain, and a request never holds both.
 import { releaseTransientProbe } from "../routing/probe-lease";
+import { trackBackgroundWork } from "../lib/background-work";
 import {
   codexConversationIdentity,
   recordCodexThreadLineage,
@@ -66,7 +67,8 @@ import {
 import { ACCOUNT_GATED_NATIVE_OPENAI_MODELS, NATIVE_RESERVE_MODEL } from "./catalog/native-models";
 import type { CodexCooldownSource, CodexQuotaScope } from "./routing";
 import { maskAccountId } from "../lib/privacy";
-import { formatErrorResponse } from "../bridge";
+import { formatErrorResponse, formatUsageLimitReachedResponse } from "../bridge";
+import { nextCodexPoolRecoveryAt } from "./routing/pool-recovery";
 import { CODEX_UNKNOWN_USAGE_SCORE, getAccountQuota, getMainPolicyQuota, parseUsageQuota, parseMainPolicyUsageQuota, setAccountQuotaFromParsed } from "./quota";
 import { codexAccountUsesCreditsAfterLimit, codexUsageLimitResetAt } from "./account-credit-use";
 import type { CodexAccountMode, OcxConfig, OcxProviderConfig } from "../types";
@@ -523,6 +525,11 @@ export class CodexAccountCooldownError extends Error {
 
 export class CodexMainAccountHardLockError extends CodexAccountCooldownError {
   readonly resetAt?: number;
+  /**
+   * Earliest known recovery of another stored pool account, set only when an unpinned pool
+   * selection reached main (#7046). A hint for the client's retry time; never routing input.
+   */
+  poolRecoveryAt?: number;
 
   constructor(resetAt?: number, thresholds = resolveMainAccountHardLockThresholds(undefined)) {
     super(MAIN_CODEX_ACCOUNT_ID, resetAt ?? 0);
@@ -935,16 +942,40 @@ export function cooldownErrorMessage(err: CodexAccountCooldownError, accountSele
     + ` (source: ${err.cooldownSource ?? "default"}).${recovery}`;
 }
 
+/**
+ * The soonest a main hard-lock refusal is worth retrying: a sibling pool account's known
+ * recovery when it comes first, otherwise main's own reset (#7046). A pool hint is held to at
+ * least {@link MAIN_HARD_LOCK_MIN_POOL_RETRY_MS} so a hold about to lapse cannot turn the refusal
+ * into a tight retry loop. Null when neither time is known and still in the future.
+ */
+export const MAIN_HARD_LOCK_MIN_POOL_RETRY_MS = 60_000;
+export function mainHardLockRetryAt(err: CodexMainAccountHardLockError, now: number): number | null {
+  const future = (value: number | undefined): number | null =>
+    typeof value === "number" && Number.isFinite(value) && value > now ? value : null;
+  const main = future(err.resetAt);
+  const pool = future(err.poolRecoveryAt);
+  const poolRetryAt = pool === null ? null : Math.max(pool, now + MAIN_HARD_LOCK_MIN_POOL_RETRY_MS);
+  if (poolRetryAt !== null && (main === null || poolRetryAt < main)) return poolRetryAt;
+  return main;
+}
+
 /** HTTP form of {@link cooldownErrorMessage}, carrying Retry-After for well-behaved clients. */
 export function cooldownErrorResponse(
   err: CodexAccountCooldownError,
   now = Date.now(),
   accountSelector?: string,
 ): Response {
+  if (err instanceof CodexMainAccountHardLockError) {
+    // A local policy refusal with a known horizon, not a transient throttle (#7046): Codex keeps
+    // a Goal active and sleeps through `rate_limit_exceeded` for the whole Retry-After, but
+    // stops on `usage_limit_reached` and shows the reset. The guard itself is unchanged.
+    const retryAt = mainHardLockRetryAt(err, now);
+    return formatUsageLimitReachedResponse(cooldownErrorMessage(err, accountSelector), retryAt,
+      retryAt === null ? null : Math.max(1, Math.ceil((retryAt - now) / 1000)));
+  }
   const res = formatErrorResponse(429, "rate_limit_error", cooldownErrorMessage(err, accountSelector));
   const headers = new Headers(res.headers);
-  if (!(err instanceof CodexReserveUnavailableError)
-    && (!(err instanceof CodexMainAccountHardLockError) || err.resetAt !== undefined)) {
+  if (!(err instanceof CodexReserveUnavailableError)) {
     headers.set("Retry-After", String(Math.max(1, Math.ceil((err.cooldownUntil - now) / 1000))));
   }
   return new Response(res.body, { status: res.status, headers });
@@ -1044,11 +1075,51 @@ async function awaitMainAccountPolicyBindingSettled(
   if (!settled) throw new CodexMainProfileDrainingError();
 }
 
+/**
+ * Resolve the credential for one Codex turn. A main hard-lock reached through unpinned pool
+ * selection is annotated with the earliest known pool recovery, so the refusal can name a retry
+ * time that a sibling account may meet (#7046).
+ */
 export async function resolveCodexAuthContext(
   headers: Headers,
   config: OcxConfig,
   mode: CodexAccountMode,
   options: ResolveCodexAuthContextOptions = {},
+): Promise<CodexAuthContext> {
+  // Filled by the inner resolver with the request's own fenced model evidence, so the hint obeys it.
+  const eligibility: RecoveryHintEligibility = {};
+  try {
+    return await resolveCodexAuthContextUnannotated(headers, config, mode, options, eligibility);
+  } catch (error) {
+    if (error instanceof CodexMainAccountHardLockError && mode === "pool" && options.accountId === undefined
+      && options.excludeAccountId !== MAIN_CODEX_ACCOUNT_ID
+      && !requiresReserveAuthorization(options.codexAuthPolicy ?? config, options.modelId, options.admission)
+      // An account-gated model with no resolved roster has no known eligible sibling.
+      && (!options.modelId || !ACCOUNT_GATED_NATIVE_OPENAI_MODELS.has(options.modelId)
+        || eligibility.modelEligibleAccountIds !== undefined)) {
+      try {
+        const now = Date.now();
+        error.poolRecoveryAt = nextCodexPoolRecoveryAt(config, now, codexQuotaScopeForModel(options.modelId), {
+          deniedAccountIds: eligibility.deniedModelAccountIds,
+          eligibleAccountIds: eligibility.modelEligibleAccountIds,
+        });
+      } catch { /* the hint is optional; the refusal stands without it */ }
+    }
+    throw error;
+  }
+}
+
+interface RecoveryHintEligibility {
+  modelEligibleAccountIds?: ReadonlySet<string>;
+  deniedModelAccountIds?: ReadonlySet<string>;
+}
+
+async function resolveCodexAuthContextUnannotated(
+  headers: Headers,
+  config: OcxConfig,
+  mode: CodexAccountMode,
+  options: ResolveCodexAuthContextOptions = {},
+  eligibility: RecoveryHintEligibility = {},
 ): Promise<CodexAuthContext> {
   const writerGeneration = captureConfigGeneration();
   const policy = options.codexAuthPolicy ?? config;
@@ -1256,6 +1327,7 @@ export async function resolveCodexAuthContext(
     const modelEligibleAccountIds = entitledAccountIds
       ? new Set([...entitledAccountIds].filter(candidate => !excludeAccountIds?.has(candidate)))
       : undefined;
+    eligibility.modelEligibleAccountIds = modelEligibleAccountIds;
     // #4768: the flagships stay visible and never fail closed, so this is evidence routing may
     // ORDER by, not evidence it may refuse on. Read synchronously from rosters discovery has
     // already gathered -- no upstream fetch joins the request path for the most commonly
@@ -1273,6 +1345,7 @@ export async function resolveCodexAuthContext(
       undefined,
       { excludeAccountIds },
     );
+    eligibility.deniedModelAccountIds = deniedModelAccountIds;
     const selectionOptions = {
       // Temporary switch drain keeps the candidate until the atomic claim rejects
       // it. Retained recovery makes main wholly ineligible so pool routing continues.
@@ -1475,9 +1548,10 @@ export async function resolveCodexAuthContext(
     if (options.primeCodexPoolQuotas) {
       void options.primeCodexPoolQuotas(config, reason).catch(() => {});
     } else {
-      import("./auth-api")
+      // Tracked from the import on: the prime registers itself only once the module resolves.
+      void trackBackgroundWork(`codex-pool-quota-prime-import:${reason}`, import("./auth-api")
         .then(({ primeCodexPoolQuotas }) => primeCodexPoolQuotas(config, reason))
-        .catch(() => {});
+        .catch(() => {}));
     }
   }
   // Snapshot (not just the deadline) so a refused request can report WHY it is cooled:

package/src/codex/autostart-health.ts

@@ -35,6 +35,7 @@ export interface StartupHealthInputs {
   shimHealthy: boolean;
   platform: NodeJS.Platform;
   diagnosticStale?: boolean;
+  shimActivationPending?: boolean;
   routingAdoption?: RoutingAdoptionEvidence;
 }
 
@@ -55,6 +56,8 @@ export interface StartupHealth {
   serviceConflict: boolean;
   shimInstalled: boolean;
   shimHealthy: boolean;
+  /** Intact PATH-overlay shim this process could not see active; activate it rather than repair it. */
+  shimActivationPending?: boolean;
   shimCoverage: ShimCoverage;
   serviceSupported: boolean;
   platform: NodeJS.Platform;
@@ -171,6 +174,7 @@ export function collectStartupHealth(
     serviceSupported: service.supported,
     shimInstalled: shim.installed,
     shimHealthy: shim.healthy,
+    ...(shim.activationPending ? { shimActivationPending: true } : {}),
     platform: process.platform,
     ...(routingAdoption ? { routingAdoption } : {}),
   });

package/src/codex/catalog/build-entries.ts

@@ -48,7 +48,8 @@ import { NATIVE_RESERVE_MODEL } from "./native-models";
 import { isReserveCatalogProjection, type ReserveCatalogProjection } from "./reserve";
 import { deriveEntry, finishUpstreamNativeEntry, isExactComboCatalogEntry } from "./derive-entry";
 import { PICKER_ORDER_PRIORITY_BASE, SPAWN_PRIORITY_FIELD } from "./subagent-roster";
-import { preserveOperatorUltraFastTiers } from "./operator-tiers";
+import { applyConfiguredUltraFast } from "./configured-tiers";
+import { applyNativeUltraFastTier } from "./native-ultrafast";
 
 export interface ObservedCatalogEntryBuildInput {
   readonly template: RawEntry | null;
@@ -473,6 +474,8 @@ export function applyFullModelPickerOrder(entries: RawEntry[], order: readonly s
 export interface ObservedCatalogMergeInput {
   /** Preserve operator-supplied Ultra Fast only from the exact persisted routed row. */
   readonly ultraFastTier?: boolean;
+  /** Current captured wire declarations; disk rows and templates never populate this set. */
+  readonly configuredUltraFastSlugs?: ReadonlySet<string>;
   readonly catalogModels: readonly RawEntry[];
   readonly baselineCatalogModels: readonly RawEntry[];
   readonly routedEntries: readonly RawEntry[];
@@ -514,6 +517,7 @@ export interface ObservedCatalogMergeInput {
  */
 export function mergeCatalogEntriesFromObservedState({
   ultraFastTier = false,
+  configuredUltraFastSlugs = new Set(),
   catalogModels,
   baselineCatalogModels,
   routedEntries,
@@ -865,7 +869,7 @@ export function mergeCatalogEntriesFromObservedState({
     if (typeof entry.slug !== "string" || !entry.slug.includes("/")
       || isNativeAliasCatalogEntry(entry) || isExactComboCatalogEntry(entry, exactComboSlugs)
       || trustedAccountBoundNativeCatalogSlug(entry) !== undefined) continue;
-    preserveOperatorUltraFastTiers(entry, operatorRows.get(entry.slug), ultraFastTier);
+    applyConfiguredUltraFast(entry, operatorRows.get(entry.slug), configuredUltraFastSlugs.has(entry.slug), ultraFastTier);
   }
   const finalRoutedEntrySet = new Set(finalRoutedEntries);
   const degradedPreservedCount = preservedRoutedEntries.filter(entry => {
@@ -932,6 +936,11 @@ export function mergeCatalogEntriesFromObservedState({
         );
       }
     }
+    // Native Astra/Sol rows (bare and account-bound) gain or lose the documented Ultrafast
+    // choice with the switch; aliases, combos and reserve projections keep their own tiers.
+    if (!reserveProjection && !exactCombo && m.owned_by !== COMBO_NAMESPACE && !isNativeAliasCatalogEntry(e)) {
+      applyNativeUltraFastTier(e, ultraFastTier);
+    }
     if (wsEnabled) e.supports_websockets = true;
     else {
       delete e.supports_websockets;

package/src/codex/catalog/configured-tiers.ts

@@ -0,0 +1,50 @@
+import { COMBO_NAMESPACE } from "../../combos";
+import type { ResolvedFastPolicy } from "../../providers/fastwire";
+import { catalogModelSlug, type CatalogModel, type RawEntry } from "./parsing";
+import { preserveOperatorUltraFastTiers } from "./operator-tiers";
+
+const MANAGED_ULTRAFAST = "opencodex_managed_ultrafast";
+
+/** Advertise Ultra Fast only when the eligible final wire explicitly maps that exact tier. */
+export function supportsConfiguredUltraFast(policy: ResolvedFastPolicy | undefined): boolean {
+  return policy?.eligibility === "eligible"
+    && policy.fastWire?.kind === "service-tier"
+    && policy.fastWire.canonicalToWire.ultrafast === "ultrafast";
+}
+
+/** Carry captured capability to the pure merge without treating persisted metadata as authority. */
+export function configuredUltraFastSlugs(models: readonly CatalogModel[]): ReadonlySet<string> {
+  const declarations = new Map<string, boolean>();
+  for (const model of models) {
+    const slug = catalogModelSlug(model);
+    const supported = model.provider !== COMBO_NAMESPACE && model.nativeAlias !== true
+      && model.supportsServiceTier === true && model.supportsUltraFastTier === true;
+    // A conflicting duplicate cannot lend its capability to the surviving row.
+    declarations.set(slug, supported && declarations.get(slug) !== false);
+  }
+  return new Set([...declarations].filter(([, supported]) => supported).map(([slug]) => slug));
+}
+
+/** Apply current configuration, or retain an independently supplied exact-row operator tier. */
+export function applyConfiguredUltraFast(
+  entry: RawEntry,
+  previous: RawEntry | undefined,
+  configured: boolean,
+  retainOperatorTier: boolean,
+): void {
+  // This marker only rejects stale generated metadata; it never authorizes a new tier.
+  const wasManaged = previous?.[MANAGED_ULTRAFAST] === entry.slug;
+  preserveOperatorUltraFastTiers(entry, wasManaged || configured ? undefined : previous, retainOperatorTier);
+  delete entry[MANAGED_ULTRAFAST];
+  if (!configured) return;
+  entry.service_tiers = [...(Array.isArray(entry.service_tiers) ? entry.service_tiers : []), {
+    id: "ultrafast",
+    name: "Ultra Fast",
+    description: "Higher speed and usage; provider access required",
+  }];
+  entry.additional_speed_tiers = [
+    ...(Array.isArray(entry.additional_speed_tiers) ? entry.additional_speed_tiers : []), "ultrafast",
+  ];
+  // Advertising a selectable capability does not opt the user into its increased usage.
+  entry[MANAGED_ULTRAFAST] = entry.slug;
+}

package/src/codex/catalog/effort.ts

@@ -204,6 +204,8 @@ export function applyCatalogModelMetadata(entry: RawEntry, model?: CatalogModel)
  * Two real sources exist and both are consulted here, in the same precedence the
  * writers use (`applyCatalogMetadata` runs first, the model's own fields
  * overwrite it): the `CatalogModel` and the generated jawcode metadata table.
+ * Vendor-ID fallback windows are estimates for client budgets, recorded separately rather
+ * than promoted to serving-provider assertions.
  * Reading only the model would silently drop every provider whose capabilities
  * live in that table.
  */
@@ -230,7 +232,8 @@ function stampCapabilityProvenance(entry: RawEntry, model: CatalogModel): void {
   entry.opencodex_capability_provenance = {
     provider: model.provider,
     model_id: model.id,
-    ...(contextWindow !== undefined ? { context_window: contextWindow } : {}),
+    ...(contextWindow !== undefined && !model.contextWindowInference ? { context_window: contextWindow } : {}),
+    ...(model.contextWindowInference ? { inferred_context_window: contextWindow, context_window_inference: { ...model.contextWindowInference } } : {}),
     ...(inputModalities !== undefined ? { input_modalities: [...inputModalities] } : {}),
     ...(Array.isArray(model.capabilities) && model.capabilities.length > 0
       ? { capabilities: [...model.capabilities] }

package/src/codex/catalog/model-hints.ts

@@ -1,5 +1,7 @@
+import { canInferVendorContext, vendorContextInference } from "./vendor-context";
 import { effectiveProviderAlias, effectiveProviderAliasDecision } from "../../providers/default-aliases";
 import { initialModelSelectionPending } from "../../providers/initial-model-selection";
+import { supportsConfiguredUltraFast } from "./configured-tiers";
 import { execFileSync } from "node:child_process";
 import { createHash, createHmac, randomBytes } from "node:crypto";
 import { copyFileSync, existsSync, mkdirSync, readFileSync, realpathSync } from "node:fs";
@@ -250,6 +252,7 @@ export function configuredReasoningSummarySupport(prov: OcxProviderConfig | unde
   return modelRecordValue(prov.modelReasoningSummaryDelivery, id) !== undefined ? true : undefined;
 }
 
+/** Reapply configured limits and captured wire capabilities without trusting stale discovery hints. */
 export function applyProviderConfigHints(
   name: string,
   prov: OcxProviderConfig,
@@ -309,7 +312,12 @@ export function applyProviderConfigHints(
   // owns catalog publication, including an explicit provider-level false.
   const supportsServiceTier = serviceTierSupportFromPolicy(fastPolicy);
   const {
+    contextWindowInference: _staleContextInference,
+    contextWindow: _previousContextWindow,
+    contextCap: previousContextCap,
+    contextCapped: previousContextCapped,
     supportsServiceTier: _staleServiceTier,
+    supportsUltraFastTier: _staleUltraFastTier,
     fastTierDescription: _staleFastTierDescription,
     providerAlias: _staleProviderAlias,
     suppressSyntheticMax: _staleSuppressSyntheticMax,
@@ -317,16 +325,23 @@ export function applyProviderConfigHints(
   } = model;
   // 已发现窗口只允许被配置值压低；缺窗口时，已开的 Context cap 就是实际窗口。
   const discoveredWindow = githubCopilotCatalogContextWindow(name, prov, model.id,
-    typeof model.contextWindow === "number" && model.contextWindow > 0 ? model.contextWindow : undefined);
+    !model.contextWindowInference && typeof model.contextWindow === "number" && model.contextWindow > 0 ? model.contextWindow : undefined);
   const projectedLimits = clampObservedModelLimits(staticPolicy.model, {
     ...(discoveredWindow !== undefined ? { contextWindow: discoveredWindow } : {}),
     ...(typeof model.maxInputTokens === "number" && model.maxInputTokens > 0 ? { maxInputTokens: model.maxInputTokens } : {}),
   });
+  const azureWindow = positiveSafeInteger(azureMetadata?.contextWindow);
+  const inferredWindow = projectedLimits.contextWindow === undefined && azureWindow === undefined && canInferVendorContext(name, prov)
+    ? vendorContextInference(model.id) : undefined;
   const hintedWindow = projectedLimits.contextWindow
-    ?? positiveSafeInteger(azureMetadata?.contextWindow)
+    ?? azureWindow
+    ?? inferredWindow?.contextWindow
     ?? (providerCap !== undefined ? resolveUnknownRoutedContextWindow(providerCap) : undefined);
   const hinted = {
     ...modelWithoutServiceTier,
+    ...(!model.contextWindowInference && previousContextCap !== undefined
+      ? { contextCap: previousContextCap, contextCapped: previousContextCapped } : {}),
+    ...(inferredWindow ? { contextWindowInference: inferredWindow } : {}),
     ...(displayName !== undefined ? { displayName } : {}),
     ...(providerAlias !== undefined ? { providerAlias } : {}),
     ...(hintedWindow !== undefined ? { contextWindow: hintedWindow } : {}),
@@ -343,6 +358,7 @@ export function applyProviderConfigHints(
     ...(typeof supportsReasoningSummaries === "boolean" ? { supportsReasoningSummaries } : {}),
     ...(typeof supportsVerbosity === "boolean" ? { supportsVerbosity } : {}),
     ...(typeof supportsServiceTier === "boolean" ? { supportsServiceTier } : {}),
+    supportsUltraFastTier: supportsConfiguredUltraFast(fastPolicy),
     ...(supportsServiceTier === true && fastPolicy.fastTierDescription !== undefined
       ? { fastTierDescription: fastPolicy.fastTierDescription }
       : {}),
@@ -431,7 +447,9 @@ export function suppressedSyntheticMaxCatalogSlugs(
   }
   return slugs;
 }
-export const QUIET_AUTHORITATIVE_CATALOG_PROVIDERS = new Set(["kimi", "xai"]);
+// google-antigravity: the static lineup is an entitlement superset (Claude 5.5 and Gemini 4 Argon
+// are per-account), so a live roster that omits some of it is the expected case, not drift.
+export const QUIET_AUTHORITATIVE_CATALOG_PROVIDERS = new Set(["kimi", "xai", "google-antigravity"]);
 
 export const CALLABLE_CONFIGURED_COMPATIBILITY_MODELS: Readonly<Record<string, ReadonlySet<string>>> = {
   // CodeBuddy's vendor defaults are real callable selectors — both the bundled manifests

package/src/codex/catalog/native-ultrafast.ts

@@ -0,0 +1,106 @@
+import type { RawEntry } from "./parsing";
+import { trustedAccountBoundNativeCatalogSlug } from "./account-models";
+import { NATIVE_GPT6_ASTRA_MODEL, NATIVE_GPT61_SOL_MODEL } from "./native-models";
+
+/**
+ * The Ultrafast speed choice OpenAI documents for GPT-6 Astra and GPT-6.1 Sol
+ * (https://developers.openai.com/api/docs/guides/ultrafast-mode and
+ * https://learn.chatgpt.com/docs/agent-configuration/speed, checked 2026-10-13).
+ *
+ * The upstream bundled catalog lists only `priority` for both models; ChatGPT's live model
+ * list adds Ultrafast for eligible plans. Codex stops consulting that live list once
+ * `model_catalog_json` points at our generated catalog, so without this row the speed picker
+ * never offers Ultrafast. The `ultraFastTier` switch is the operator's statement that their
+ * plan is eligible; the description still says the tier requires one.
+ */
+export const NATIVE_ULTRAFAST_SERVICE_TIER: Readonly<{ id: string; name: string; description: string }> = Object.freeze({
+  id: "ultrafast",
+  name: "Ultrafast",
+  description: "Lower latency, increased usage; requires an eligible plan",
+});
+
+export const NATIVE_ULTRAFAST_MODELS: ReadonlySet<string> = new Set([NATIVE_GPT6_ASTRA_MODEL, NATIVE_GPT61_SOL_MODEL]);
+
+function isUltraFastId(value: unknown): boolean {
+  return typeof value === "string" && value.trim().toLowerCase() === "ultrafast";
+}
+
+function isUltraFastDescriptor(value: unknown): boolean {
+  return value !== null && typeof value === "object" && "id" in value && isUltraFastId((value as { id: unknown }).id);
+}
+
+/**
+ * Provenance marker naming the tier fields this module added to a row. Ownership is never
+ * inferred from a descriptor's text: an operator may have written the very same entry, and only
+ * a row carrying this marker has anything for the switch to withdraw.
+ */
+export const NATIVE_ULTRAFAST_PROVENANCE_FIELD = "opencodex_generated_service_tiers";
+type TierField = "service_tiers" | "additional_speed_tiers";
+
+function generatedFields(entry: RawEntry): Set<TierField> {
+  const raw = entry[NATIVE_ULTRAFAST_PROVENANCE_FIELD];
+  const fields = new Set<TierField>();
+  if (Array.isArray(raw)) {
+    for (const value of raw) if (value === "service_tiers" || value === "additional_speed_tiers") fields.add(value);
+  }
+  return fields;
+}
+
+function isGeneratedDescriptor(value: unknown): boolean {
+  if (!isUltraFastDescriptor(value)) return false;
+  const tier = value as Record<string, unknown>;
+  return Object.keys(tier).length === 3
+    && tier.id === NATIVE_ULTRAFAST_SERVICE_TIER.id
+    && tier.name === NATIVE_ULTRAFAST_SERVICE_TIER.name
+    && tier.description === NATIVE_ULTRAFAST_SERVICE_TIER.description;
+}
+
+/** Bare native rows and trusted account-bound clones of the two Ultrafast models. */
+export function nativeUltraFastSlug(entry: RawEntry): string | undefined {
+  const slug = trustedAccountBoundNativeCatalogSlug(entry)
+    ?? (typeof entry.slug === "string" && !entry.slug.includes("/") ? entry.slug : undefined);
+  return slug !== undefined && NATIVE_ULTRAFAST_MODELS.has(slug) ? slug : undefined;
+}
+
+/**
+ * Add (enabled) or withdraw (disabled) the documented Ultrafast choice on an eligible native row.
+ *
+ * Enabling appends the descriptor to `service_tiers` and "ultrafast" to the deprecated
+ * `additional_speed_tiers` mirror, after the existing Fast tier and only when absent, and records
+ * each field it filled in the provenance marker. A repeated sync is a no-op and an
+ * operator-written Ultrafast entry wins. Disabling removes only what the marker names (and only
+ * the unedited generated descriptor), then drops the marker; rows without it are left as they
+ * are. The catalog default tier is never set.
+ */
+export function applyNativeUltraFastTier(entry: RawEntry, enabled: boolean): void {
+  const owned = generatedFields(entry);
+  if (nativeUltraFastSlug(entry) === undefined) {
+    delete entry[NATIVE_ULTRAFAST_PROVENANCE_FIELD];
+    return;
+  }
+  const tiers = Array.isArray(entry.service_tiers) ? entry.service_tiers : undefined;
+  const speeds = Array.isArray(entry.additional_speed_tiers) ? entry.additional_speed_tiers : undefined;
+  if (enabled) {
+    if (!tiers?.some(isUltraFastDescriptor)) {
+      entry.service_tiers = [...(tiers ?? []), { ...NATIVE_ULTRAFAST_SERVICE_TIER }];
+      owned.add("service_tiers");
+    }
+    if (!speeds?.some(isUltraFastId)) {
+      entry.additional_speed_tiers = [...(speeds ?? []), NATIVE_ULTRAFAST_SERVICE_TIER.id];
+      owned.add("additional_speed_tiers");
+    }
+    if (owned.size > 0) entry[NATIVE_ULTRAFAST_PROVENANCE_FIELD] = [...owned].sort();
+    return;
+  }
+  delete entry[NATIVE_ULTRAFAST_PROVENANCE_FIELD];
+  if (owned.has("service_tiers") && tiers) {
+    const kept = tiers.filter(tier => !isGeneratedDescriptor(tier));
+    if (kept.length > 0) entry.service_tiers = kept;
+    else delete entry.service_tiers;
+  }
+  if (owned.has("additional_speed_tiers") && speeds) {
+    const kept = speeds.filter(speed => !isUltraFastId(speed));
+    if (kept.length > 0) entry.additional_speed_tiers = kept;
+    else delete entry.additional_speed_tiers;
+  }
+}