@gotcos/glasses-server 6.3.1 → 6.6.0

package/server/routes/display.ts

@@ -2,15 +2,28 @@
 // Any connected glasses client receives real-time query responses
 // regardless of which interface submitted the query
 
-import { Router } from 'express'
-import { onDisplay, emitDisplay } from '../lib/display-bus.js'
+import { Router, type Response } from 'express'
+import {
+  emitDisplay,
+  getDisplayWatermark,
+  onDisplay,
+  replayDisplayEvents,
+  type PublishedDisplayEvent,
+} from '../lib/display-bus.js'
 
 export const displayRouter = Router()
 
-// Replay buffer — last N events so reconnecting clients don't miss in-flight data
-const REPLAY_BUFFER_SIZE = 20
-let eventId = 0
-const replayBuffer: Array<{ id: number; type: string; data: string }> = []
+function writeEvent(res: Response, event: PublishedDisplayEvent): void {
+  const data = JSON.stringify({
+    ...event.data,
+    _cosDisplayCursor: {
+      bootId: event.bootId,
+      eventId: event.eventId,
+      publishedAt: event.publishedAt,
+    },
+  })
+  res.write(`id: ${event.bootId}:${event.eventId}\nevent: ${event.type}\ndata: ${data}\n\n`)
+}
 
 displayRouter.get('/display-stream', (req, res) => {
   res.writeHead(200, {
@@ -25,15 +38,29 @@ displayRouter.get('/display-stream', (req, res) => {
   // Tell EventSource to retry quickly on disconnect (3s instead of browser default ~5-10s)
   res.write('retry: 3000\n\n')
 
-  // Replay missed events if client sends Last-Event-ID (browser does this automatically)
-  const lastId = parseInt(req.headers['last-event-id'] as string, 10)
-  if (!isNaN(lastId) && lastId > 0) {
-    const missed = replayBuffer.filter(e => e.id > lastId)
-    for (const e of missed) {
-      res.write(`id: ${e.id}\nevent: ${e.type}\ndata: ${e.data}\n\n`)
-    }
-    if (missed.length > 0) {
-      console.log(`[display-bus] Replayed ${missed.length} events for reconnecting client (from id ${lastId})`)
+  const headerCursor = String(req.headers['last-event-id'] ?? '')
+  const [headerBootId, headerEventId] = headerCursor.includes(':')
+    ? headerCursor.split(':', 2)
+    : ['', headerCursor]
+  const cursorBootId = String(req.query.bootId ?? headerBootId ?? '') || null
+  const cursorEventId = Number(req.query.eventId ?? headerEventId ?? 0)
+  const replay = replayDisplayEvents(cursorBootId, Number.isFinite(cursorEventId) ? cursorEventId : 0)
+
+  // Ready is a transport handshake, not proof that replay was consumed. It
+  // must precede application events so build 188 can finish admission first.
+  const watermark = getDisplayWatermark()
+  res.write(`event: ready\ndata: ${JSON.stringify(watermark)}\n\n`)
+  if (replay.gap) {
+    res.write(`event: replay_gap\ndata: ${JSON.stringify({
+      reason: replay.reason,
+      requested: { bootId: cursorBootId, eventId: cursorEventId },
+      watermark,
+      oldestEventId: replay.oldestEventId,
+    })}\n\n`)
+  } else {
+    for (const event of replay.events) writeEvent(res, event)
+    if (replay.events.length > 0) {
+      console.log(`[display-bus] Replayed ${replay.events.length} publish-owned events after ${cursorEventId}`)
     }
   }
 
@@ -43,13 +70,7 @@ displayRouter.get('/display-stream', (req, res) => {
   }, 15_000)
 
   const unsub = onDisplay((event) => {
-    eventId++
-    const data = JSON.stringify(event.data)
-    // Buffer for replay
-    replayBuffer.push({ id: eventId, type: event.type, data })
-    if (replayBuffer.length > REPLAY_BUFFER_SIZE) replayBuffer.shift()
-    // Send with id for Last-Event-ID tracking
-    try { res.write(`id: ${eventId}\nevent: ${event.type}\ndata: ${data}\n\n`) } catch { /* client gone */ }
+    try { writeEvent(res, event) } catch { /* client gone */ }
   })
 
   req.on('close', () => {

package/server/routes/health.ts

@@ -3,12 +3,19 @@ import { execFile } from 'node:child_process'
 import { statSync } from 'node:fs'
 import { resolve } from 'node:path'
 import { COS_SCRIPTS_DIR, COS_MODE, PYTHON_BIN } from '../lib/python-bridge.js'
-import { serverMetrics } from '../index.js'
+import { serverMetrics } from '../lib/server-metrics.js'
+import { getServerInstanceId } from '../lib/server-instance-id.js'
 import { isSileroAvailable } from '../lib/vad-silero.js'
 import { getAvailableCliSessionId } from '../lib/claude-bridge.js'
 import { isWhisperLocalAvailable, getWhisperHealth } from '../lib/whisper-local.js'
 import { getOpenAIWhisperBudgetState } from '../lib/openai-whisper-budget.js'
 import { getKeyStatus } from '../lib/openai-key.js'
+import {
+  getCodexModelCatalog,
+  getCodexModelCatalogSnapshot,
+} from '../lib/codex-model-catalog.js'
+import { isMediaProcessingReady } from '../lib/image-safety.js'
+import { G2_LENS_VARIANT_CAPABILITY } from '../lib/media-store.js'
 
 export const healthRouter = Router()
 
@@ -106,6 +113,8 @@ healthRouter.get('/health', async (_req, res) => {
     cos_pipeline: COS_MODE,
     whisper: isWhisperLocalAvailable(),
     iphoneAsrCandidates: process.env.COS_IOS_ASR_CANDIDATES === '1',
+    mediaProcessingReady: await isMediaProcessingReady(),
+    g2LensVariant: G2_LENS_VARIANT_CAPABILITY,
   }
   const voice = {
     hasKey: keyStatus.hasKey,
@@ -117,7 +126,15 @@ healthRouter.get('/health', async (_req, res) => {
   const whisper_health = getWhisperHealth()
   const openai_whisper_budget = getOpenAIWhisperBudgetState()
 
-  res.json({ ...checks, features, voice, whisper_health, openai_whisper_budget })
+  const codex_models = getCodexModelCatalogSnapshot()
+  res.json({ ...checks, features, voice, whisper_health, openai_whisper_budget, codex_models })
+})
+
+// Stable app slots backed by Codex's live model/list catalog. This route is
+// authenticated by the global /api middleware; ?refresh=1 forces discovery.
+healthRouter.get('/models', async (req, res) => {
+  const catalog = await getCodexModelCatalog(req.query.refresh === '1')
+  res.json({ ...catalog, serverInstanceId: getServerInstanceId() })
 })
 
 // GET /api/cli-session — returns current CLI session ID for cross-device resume

package/server/routes/media.ts

@@ -0,0 +1,285 @@
+// Media attachment API (Release A) — authenticated upload, lifecycle, and
+// content endpoints backed by server/lib/media-store.ts.
+//
+//   POST   /api/media                 — upload images (base64 JSON batch)
+//   POST   /api/media/reserve         — bind staged media to a queue item
+//   POST   /api/media/associate       — bind media to a run/message (replay-safe)
+//   POST   /api/media/release         — drop staged/reserved media (cancel path)
+//   GET    /api/media/:id             — metadata (public ref + availability)
+//   GET    /api/media/:id/content     — bytes (?variant=phone|thumb)
+//   DELETE /api/media/:id             — delete UNASSOCIATED media only
+//
+// Uploads accept uploaded bytes only — no remote URLs, no filesystem paths,
+// no data-URI passthrough. The dedicated body parser (mediaBodyParser) is
+// mounted BEFORE the global express.json() so a maximum valid batch
+// (8 MiB decoded ≈ 10.7 MiB base64) doesn't trip the global 10 MB limit;
+// the allowance stays scoped to /api/media.
+
+import { Router, json, type Request, type Response } from 'express'
+import { readFileSync } from 'node:fs'
+import {
+  MAX_ATTACHMENTS_PER_PROMPT,
+  isValidMediaId,
+  parseMediaIdList,
+  type MediaAttachmentRef,
+} from '../../shared/media-attachment.js'
+import {
+  G2_LENS_VARIANT_CAPABILITY,
+  getMediaStore,
+  MediaStoreError,
+} from '../lib/media-store.js'
+import {
+  ImageSafetyError,
+  MAX_BATCH_BYTES,
+  isMediaProcessingReady,
+  strictBase64Decode,
+} from '../lib/image-safety.js'
+
+// Route-scoped parser: 16 MB covers the max valid batch after base64 + JSON
+// overhead. Mounted only for /api/media in server/index.ts — the global
+// server limit is unchanged.
+export const mediaBodyParser = json({ limit: '16mb' })
+
+export const mediaRouter = Router()
+
+const MEDIA_ERROR_STATUS: Record<string, number> = {
+  media_not_found: 404,
+  media_expired: 410,
+  media_unavailable: 503,
+  media_conflict: 409,
+}
+
+const SAFETY_ERROR_STATUS: Record<string, number> = {
+  invalid_base64: 400,
+  unsupported_format: 400,
+  image_too_large: 400,
+  dimensions_too_large: 400,
+  corrupt_image: 400,
+  media_processing_unavailable: 503,
+  normalization_failed: 500,
+}
+
+function sendMediaError(res: Response, err: unknown): void {
+  if (err instanceof MediaStoreError) {
+    res.status(MEDIA_ERROR_STATUS[err.code] ?? 500).json({ error: err.code })
+    return
+  }
+  if (err instanceof ImageSafetyError) {
+    const status = SAFETY_ERROR_STATUS[err.code] ?? 500
+    res.status(status).json({
+      error: err.code,
+      ...(err.code === 'media_processing_unavailable' ? { mediaProcessingReady: false } : {}),
+    })
+    return
+  }
+  console.error('[media] unexpected error:', err)
+  res.status(500).json({ error: 'media_internal_error' })
+}
+
+function safeString(v: unknown, max: number): string | undefined {
+  return typeof v === 'string' && v.trim().length > 0 ? v.trim().slice(0, max) : undefined
+}
+
+// ── Upload ───────────────────────────────────────────────────────────────────
+
+mediaRouter.post('/media', async (req: Request, res: Response) => {
+  try {
+    const body = req.body ?? {}
+    const rawImages = Array.isArray(body.images) ? body.images : []
+    if (rawImages.length === 0) {
+      res.status(400).json({ error: 'no_images' })
+      return
+    }
+    if (rawImages.length > MAX_ATTACHMENTS_PER_PROMPT) {
+      res.status(400).json({ error: 'too_many_images', max: MAX_ATTACHMENTS_PER_PROMPT })
+      return
+    }
+    // Release A: only phone photos enter through this route. Traffic frames
+    // and generated visuals arrive via the Release C run-scoped publisher.
+    const kind = body.kind === undefined || body.kind === 'user_photo' ? 'user_photo' : null
+    if (!kind) {
+      res.status(400).json({ error: 'unsupported_kind' })
+      return
+    }
+    if (!(await isMediaProcessingReady())) {
+      res.status(503).json({ error: 'media_processing_unavailable', mediaProcessingReady: false })
+      return
+    }
+
+    // Decode + total-batch gate before any normalization work.
+    const decoded: Array<{ bytes: Buffer; label?: string; capturedAt?: string }> = []
+    let totalBytes = 0
+    for (const raw of rawImages) {
+      const item = raw && typeof raw === 'object' ? raw as Record<string, unknown> : {}
+      const bytes = strictBase64Decode(item.data)
+      totalBytes += bytes.length
+      if (totalBytes > MAX_BATCH_BYTES) {
+        res.status(400).json({ error: 'batch_too_large', maxBytes: MAX_BATCH_BYTES })
+        return
+      }
+      decoded.push({
+        bytes,
+        label: safeString(item.label, 120),
+        capturedAt: safeString(item.capturedAt, 40),
+      })
+    }
+
+    const sessionId = safeString(body.sessionId, 64)
+    const store = getMediaStore()
+    const attachments: MediaAttachmentRef[] = []
+    for (const img of decoded) {
+      attachments.push(await store.ingestImage({
+        bytes: img.bytes,
+        kind,
+        label: img.label,
+        capturedAt: img.capturedAt,
+        sessionId,
+      }))
+    }
+    res.json({ attachments })
+  } catch (err) {
+    sendMediaError(res, err)
+  }
+})
+
+// ── Lifecycle ────────────────────────────────────────────────────────────────
+
+mediaRouter.post('/media/reserve', async (req: Request, res: Response) => {
+  try {
+    const ids = parseMediaIdList(req.body?.ids)
+    const clientQueueItemId = safeString(req.body?.clientQueueItemId, 120)
+    if (ids.length === 0 || !clientQueueItemId) {
+      res.status(400).json({ error: 'ids_and_client_queue_item_id_required' })
+      return
+    }
+    const attachments = await getMediaStore().reserve(ids, {
+      clientQueueItemId,
+      sessionId: safeString(req.body?.sessionId, 64),
+    })
+    res.json({ ok: true, attachments })
+  } catch (err) {
+    sendMediaError(res, err)
+  }
+})
+
+mediaRouter.post('/media/associate', async (req: Request, res: Response) => {
+  try {
+    const ids = parseMediaIdList(req.body?.ids)
+    if (ids.length === 0) {
+      res.status(400).json({ error: 'ids_required' })
+      return
+    }
+    const globalMsgNum = typeof req.body?.globalMsgNum === 'number' && req.body.globalMsgNum > 0
+      ? Math.floor(req.body.globalMsgNum) : undefined
+    await getMediaStore().associate(ids, {
+      sessionId: safeString(req.body?.sessionId, 64),
+      runId: safeString(req.body?.runId, 120),
+      globalMsgNum,
+    })
+    res.json({ ok: true })
+  } catch (err) {
+    sendMediaError(res, err)
+  }
+})
+
+mediaRouter.post('/media/release', async (req: Request, res: Response) => {
+  try {
+    const ids = parseMediaIdList(req.body?.ids)
+    if (ids.length === 0) {
+      res.status(400).json({ error: 'ids_required' })
+      return
+    }
+    await getMediaStore().release(ids, {
+      sessionId: safeString(req.body?.sessionId, 64),
+      clientQueueItemId: safeString(req.body?.clientQueueItemId, 120),
+    })
+    res.json({ ok: true })
+  } catch (err) {
+    sendMediaError(res, err)
+  }
+})
+
+// ── Reads ────────────────────────────────────────────────────────────────────
+
+mediaRouter.get('/media/:id', (req: Request, res: Response) => {
+  const id = req.params.id
+  if (!isValidMediaId(id)) {
+    res.status(400).json({ error: 'invalid_media_id' })
+    return
+  }
+  const store = getMediaStore()
+  const rec = store.getRecord(id)
+  if (!rec || rec.lifecycle === 'deleted') {
+    res.status(404).json({ error: 'media_not_found' })
+    return
+  }
+  const content = store.getContent(id, 'phone')
+  res.json({
+    attachment: rec.ref,
+    contentAvailable: content.status === 'ok',
+    ...(content.status === 'expired' ? { expired: true } : {}),
+  })
+})
+
+mediaRouter.get('/media/:id/content', async (req: Request, res: Response) => {
+  const id = req.params.id
+  if (!isValidMediaId(id)) {
+    res.status(400).json({ error: 'invalid_media_id' })
+    return
+  }
+  // 'g2' (Release B) — exact 288x144 grayscale PNG for the lens, generated
+  // lazily and cached beside the asset.
+  const variant = req.query.variant === 'thumb' ? 'thumb' : req.query.variant === 'g2' ? 'g2' : 'phone'
+  const content = variant === 'g2'
+    ? await getMediaStore().getG2Content(id)
+    : getMediaStore().getContent(id, variant)
+  if (content.status === 'not_found') {
+    res.status(404).json({ error: 'media_not_found' })
+    return
+  }
+  if (content.status === 'expired') {
+    res.status(410).json({ error: 'media_expired' })
+    return
+  }
+  if (content.status === 'unavailable') {
+    res.status(503).json({ error: 'media_unavailable' })
+    return
+  }
+  try {
+    // Read + send the buffer directly: content-length is exact and no
+    // filesystem path semantics leak into the response.
+    const bytes = readFileSync(content.path)
+    res.status(200)
+    res.setHeader('Content-Type', content.mime)
+    res.setHeader('Cache-Control', 'private, no-store')
+    res.setHeader('X-Content-Type-Options', 'nosniff')
+    if (variant === 'g2') {
+      res.setHeader('X-COS-G2-Variant', G2_LENS_VARIANT_CAPABILITY)
+      // Even Hub loads the app from a different origin. Without an expose
+      // header, browser fetch can receive this value but cannot read it.
+      res.setHeader('Access-Control-Expose-Headers', 'X-COS-G2-Variant')
+    }
+    res.setHeader('Content-Length', String(bytes.length))
+    res.end(bytes)
+  } catch (err) {
+    sendMediaError(res, err)
+  }
+})
+
+mediaRouter.delete('/media/:id', async (req: Request, res: Response) => {
+  const id = req.params.id
+  if (!isValidMediaId(id)) {
+    res.status(400).json({ error: 'invalid_media_id' })
+    return
+  }
+  try {
+    const deleted = await getMediaStore().deleteUnassociated(id)
+    if (!deleted) {
+      res.status(404).json({ error: 'media_not_found' })
+      return
+    }
+    res.json({ deleted: true })
+  } catch (err) {
+    sendMediaError(res, err)
+  }
+})

package/server/routes/message-ref.ts

@@ -18,6 +18,7 @@ import { resolve } from 'path'
 import { getActiveSessions } from '../lib/conversation.js'
 import { dataPath } from '../lib/data-dir.js'
 import { localDay } from '../lib/local-day.js'
+import { mergeMediaAttachmentRefs, type MediaAttachmentRef } from '../../shared/media-attachment.js'
 
 // v6.3.0 — read archives from the SAME persistent location the archive-mirror
 // writes to (~/.cos-glasses/data/archive via dataPath), not a package-relative
@@ -31,6 +32,7 @@ export interface ResolvedGlobalMessage {
   date: string
   query: string
   response: string
+  attachments?: MediaAttachmentRef[]
 }
 
 interface ExchangeLike {
@@ -38,11 +40,12 @@ interface ExchangeLike {
   content?: string
   timestamp?: number
   globalMsgNum?: number
+  attachments?: unknown
 }
 
 /** Pair the stamped exchange with its other half: a user turn pairs forward
  *  to the next assistant turn; an assistant turn pairs backward. */
-function pairExchange(exchanges: ExchangeLike[], i: number): { query: string; response: string } {
+function pairExchange(exchanges: ExchangeLike[], i: number): { query: string; response: string; attachments: MediaAttachmentRef[] } {
   const hit = exchanges[i]
   const user = hit.role === 'user'
     ? hit
@@ -50,14 +53,21 @@ function pairExchange(exchanges: ExchangeLike[], i: number): { query: string; re
   const assistant = hit.role === 'assistant'
     ? hit
     : exchanges.slice(i + 1).find((e) => e?.role === 'assistant')
-  return { query: user?.content ?? '', response: assistant?.content ?? '' }
+  return {
+    query: user?.content ?? '',
+    response: assistant?.content ?? '',
+    attachments: mergeMediaAttachmentRefs(user?.attachments, assistant?.attachments),
+  }
 }
 
 function scanExchanges(exchanges: ExchangeLike[], num: number, date: string): ResolvedGlobalMessage | null {
   for (let i = 0; i < exchanges.length; i++) {
     if (exchanges[i]?.globalMsgNum !== num) continue
-    const { query, response } = pairExchange(exchanges, i)
-    return { globalMsgNum: num, date, query, response }
+    const { query, response, attachments } = pairExchange(exchanges, i)
+    return {
+      globalMsgNum: num, date, query, response,
+      ...(attachments.length > 0 ? { attachments } : {}),
+    }
   }
   return null
 }
@@ -96,7 +106,7 @@ export function readArchiveChatNumbered(
   dir: string,
   date: string,
   chatIndex: number,
-): Array<{ query: string; text: string; timestamp: number; no?: number }> {
+): Array<{ query: string; text: string; timestamp: number; no?: number; attachments?: MediaAttachmentRef[] }> {
   // Defense-in-depth against path traversal — `date` builds a `${date}.json`
   // path. The archive route also validates, but this is exported/reused.
   if (!/^\d{4}-\d{2}-\d{2}$/.test(date)) return []
@@ -109,17 +119,19 @@ export function readArchiveChatNumbered(
   const chat = (Array.isArray(day?.chats) ? day.chats : []).find((c) => c?.id === chatIndex)
   if (!chat) return []
   const exchanges: ExchangeLike[] = Array.isArray(chat.exchanges) ? chat.exchanges : []
-  const out: Array<{ query: string; text: string; timestamp: number; no?: number }> = []
+  const out: Array<{ query: string; text: string; timestamp: number; no?: number; attachments?: MediaAttachmentRef[] }> = []
   for (let i = 0; i < exchanges.length; i++) {
     const ex = exchanges[i]
     if (ex?.role !== 'user') continue
     const next = exchanges[i + 1]
     if (next?.role !== 'assistant') continue
+    const attachments = mergeMediaAttachmentRefs(ex.attachments, next.attachments)
     out.push({
       query: ex.content ?? '',
       text: next.content ?? '',
       timestamp: next.timestamp ?? ex.timestamp ?? 0,
       no: ex.globalMsgNum ?? next.globalMsgNum,
+      ...(attachments.length > 0 ? { attachments } : {}),
     })
     i++
   }

package/server/routes/openai-compat.ts

@@ -7,6 +7,10 @@ import { Router } from 'express'
 import { preWarmCLI, logLatency } from '../lib/claude-bridge.js'
 import { callModelStreaming } from '../lib/model-router.js'
 import { normalizeModelPreference, DEFAULT_MODEL, type ModelPreference } from '../../shared/model-preference.js'
+import {
+  getCodexModelCatalog,
+  resolveCodexPreferenceForModelId,
+} from '../lib/codex-model-catalog.js'
 import { tryInstantResponse } from '../lib/response-cache.js'
 import crypto from 'node:crypto'
 
@@ -70,23 +74,31 @@ function validateAuth(req: any, res: any): boolean {
   return true
 }
 
-// Resolve model from OpenAI-compatible model ids. Defaults to Haiku for
-// "Hey Even" speed; Opus/Sonnet/Haiku/Codex High can be explicitly selected.
+// Resolve model from OpenAI-compatible ids, stable app slots, or concrete ids
+// currently advertised by the live Codex catalog.
 function resolveModel(model?: string, _query?: string): ModelPreference {
   const normalized = normalizeModelPreference(model)
   if (normalized) return normalized
+  if (model) {
+    const catalogPreference = resolveCodexPreferenceForModelId(model)
+    if (catalogPreference) return catalogPreference
+  }
   if (model === 'cos-opus') return 'opus'
+  if (model === 'cos-fable') return 'fable'
   if (model === 'cos-sonnet') return 'sonnet'
   if (model === 'cos-haiku') return 'haiku'
-  if (model === 'cos-codex-high' || model === 'cos-codex') return 'codex-high'
+  if (model === 'cos-gpt-frontier' || model === 'cos-codex-high' || model === 'cos-codex') return 'codex-frontier'
+  if (model === 'cos-gpt-balanced') return 'codex-balanced'
   return normalizeModelPreference(process.env.COS_G2_DEFAULT_MODEL) ?? DEFAULT_MODEL
 }
 
 const MODEL_NAMES: Record<ModelPreference, string> = {
   opus: 'cos-opus',
+  fable: 'cos-fable',
   sonnet: 'cos-sonnet',
   haiku: 'cos-haiku',
-  'codex-high': 'cos-codex-high',
+  'codex-frontier': 'cos-gpt-frontier',
+  'codex-balanced': 'cos-gpt-balanced',
 }
 
 // Extract the user's latest message from the OpenAI messages array
@@ -247,6 +259,7 @@ openaiCompatRouter.post('/v1/chat/completions', async (req, res) => {
   let resolveInflight: (text: string) => void
   let rejectInflight: (err: any) => void
   const inflightPromise = new Promise<string>((res, rej) => { resolveInflight = res; rejectInflight = rej })
+  void inflightPromise.catch(() => { /* duplicate waiters observe the original rejection */ })
   inflightQueries.set(dedupKey, { promise: inflightPromise, timestamp: Date.now() })
 
   // ── Streaming response (SSE) ──
@@ -381,12 +394,23 @@ openaiCompatRouter.post('/v1/chat/completions', async (req, res) => {
     const fullText = await new Promise<string>((resolve, reject) => {
       let result = ''
       let nsFirstChunkMs = -1
+      let settled = false
+      const fail = (error: unknown) => {
+        if (settled) return
+        settled = true
+        const err = error instanceof Error ? error : new Error(String(error))
+        rejectInflight!(err)
+        inflightQueries.delete(dedupKey)
+        reject(err)
+      }
       callModelStreaming(query, currentSessionIdNS, {
         onChunk: (text) => {
           if (nsFirstChunkMs < 0) nsFirstChunkMs = Date.now() - requestReceivedAt
           result += text
         },
         onDone: (fullText) => {
+          if (settled) return
+          settled = true
           const text = fullText || result
           resolveInflight!(text)
           inflightQueries.delete(dedupKey)
@@ -404,13 +428,13 @@ openaiCompatRouter.post('/v1/chat/completions', async (req, res) => {
           resolve(text)
         },
         onError: (error) => {
-          rejectInflight!(new Error(error))
-          inflightQueries.delete(dedupKey)
-          reject(new Error(error))
+          fail(new Error(error))
         },
         onToolStatus: () => {},
         onStart: () => {},
-      }, resolvedModel, undefined, undefined, undefined, { lightweight: true }).then(sid => { g2SessionId = sid })
+      }, resolvedModel, undefined, undefined, undefined, { lightweight: true })
+        .then(sid => { g2SessionId = sid })
+        .catch(fail)
     })
 
     res.json({
@@ -433,14 +457,23 @@ openaiCompatRouter.post('/v1/chat/completions', async (req, res) => {
 })
 
 // GET /v1/models — required by some clients for model discovery
-openaiCompatRouter.get('/v1/models', (_req, res) => {
+openaiCompatRouter.get('/v1/models', async (_req, res) => {
+  const catalog = await getCodexModelCatalog()
   res.json({
     object: 'list',
-    data: [
+	    data: [
 	      { id: 'cos-opus', object: 'model', created: 1709251200, owned_by: 'cos' },
+	      { id: 'cos-fable', object: 'model', created: 1709251200, owned_by: 'cos' },
 	      { id: 'cos-sonnet', object: 'model', created: 1709251200, owned_by: 'cos' },
 	      { id: 'cos-haiku', object: 'model', created: 1709251200, owned_by: 'cos' },
-	      { id: 'cos-codex-high', object: 'model', created: 1709251200, owned_by: 'cos' },
+	      { id: 'cos-gpt-frontier', object: 'model', created: 1709251200, owned_by: 'cos' },
+	      { id: 'cos-gpt-balanced', object: 'model', created: 1709251200, owned_by: 'cos' },
+	      ...catalog.options.filter(option => option.id).map(option => ({
+	        id: option.id,
+	        object: 'model',
+	        created: 1709251200,
+	        owned_by: 'openai',
+	      })),
 	    ],
 	  })
 	})