@gotcos/glasses-server 6.3.1 → 6.6.0

package/server/routes/query.ts

@@ -5,7 +5,10 @@ import { Router } from 'express'
 import { callModelStreaming } from '../lib/model-router.js'
 import { emitDisplay } from '../lib/display-bus.js'
 import { errMsg } from '../lib/utils.js'
-import { normalizeModelPreference } from '../../shared/model-preference.js'
+import { normalizeEffortPreference, normalizeModelPreference } from '../../shared/model-preference.js'
+import { QueryAttachmentError, resolveQueryAttachments } from '../lib/query-attachments.js'
+import { getMediaStore } from '../lib/media-store.js'
+import { mergeMediaAttachmentRefs } from '../../shared/media-attachment.js'
 
 const TOOL_STATUS_MESSAGES: Record<string, string> = {
   WebSearch: 'Searching web...',
@@ -16,28 +19,35 @@ const TOOL_STATUS_MESSAGES: Record<string, string> = {
 export const queryRouter = Router()
 
 queryRouter.post('/query', async (req, res) => {
-  const { query, sessionId, model, image, images, reference, globalMsgNum } = req.body
+  const { query, sessionId, model, effort, reference, globalMsgNum } = req.body
+  const activityToolMode = req.body.activityToolMode === 'off' || req.body.activityToolMode === 'preview'
+    ? req.body.activityToolMode
+    : 'status'
 
-  // Normalize: accept `images` array or legacy `image` string
-  let validImages: string[] | undefined
-  if (Array.isArray(images) && images.length > 0) {
-    // Filter to valid non-empty strings, cap at 5
-    validImages = images.filter((img: unknown) => typeof img === 'string' && img.length > 0).slice(0, 5)
-    if (validImages.length === 0) validImages = undefined
-  } else if (typeof image === 'string' && image.length > 0) {
-    // Backward compat: wrap single image as array
-    validImages = [image]
+  // Resolve durable attachment ids and legacy base64 images through one
+  // validation/normalization path before opening SSE.
+  let resolvedAttachments
+  try {
+    resolvedAttachments = await resolveQueryAttachments(req.body)
+  } catch (err) {
+    if (err instanceof QueryAttachmentError) {
+      return res.status(err.status).json({ error: err.code, detail: err.message })
+    }
+    return res.status(500).json({ error: errMsg(err) })
   }
+  const imageInputs = resolvedAttachments.inputs.length > 0 ? resolvedAttachments.inputs : undefined
+  const attachmentRefs = resolvedAttachments.refs
 
   const resolvedQuery = typeof query === 'string' ? query : ''
 
   // Vision queries can have an empty query (default to "describe what you see")
-  if ((!resolvedQuery || typeof resolvedQuery !== 'string') && !validImages) {
+  if ((!resolvedQuery || typeof resolvedQuery !== 'string') && !imageInputs) {
     return res.status(400).json({ error: 'query string or image required' })
   }
 
   // Validate model if provided
   const validModel = normalizeModelPreference(model)
+  const validEffort = normalizeEffortPreference(effort)
 
   // Validate globalMsgNum if provided
   const validGlobalMsgNum = typeof globalMsgNum === 'number' && globalMsgNum > 0
@@ -80,15 +90,40 @@ queryRouter.post('/query', async (req, res) => {
       },
       onToolStatus: (toolName) => {
         if (!done) {
-          const message = TOOL_STATUS_MESSAGES[toolName] ?? (/\s|\.{3}$/.test(toolName) ? toolName : `Using ${toolName}...`)
+          const message = activityToolMode === 'off'
+            ? 'Processing...'
+            : TOOL_STATUS_MESSAGES[toolName] ?? (/\s|\.{3}$/.test(toolName) ? toolName : `Using ${toolName}...`)
           res.write(`event: tool_status\ndata: ${JSON.stringify({ message })}\n\n`)
           emitDisplay({ type: 'tool_status', data: { message } })
         }
       },
+      // Activity lines stay on this authenticated request stream. The global
+      // display stream is intentionally unauthenticated for Even Hub recovery,
+      // so observable command/output text must never be broadcast there.
+      ...(activityToolMode === 'preview' ? {
+        onActivityLine: (line: { kind: 'input' | 'output'; text: string }) => {
+          if (!done) {
+            res.write(`event: activity_line\ndata: ${JSON.stringify(line)}\n\n`)
+          }
+        },
+      } : {}),
       onDone: (fullText, model, cliSessionId, metadata) => {
+        // Durable association is independent of the SSE socket. Backgrounding
+        // the phone cannot leave request media reserved until expiry.
+        if (resolvedAttachments.ids.length > 0) {
+          getMediaStore().associate(resolvedAttachments.ids, {
+            sessionId: sid,
+            ...(validGlobalMsgNum ? { globalMsgNum: validGlobalMsgNum } : {}),
+          }).catch((err) => console.error('[query] attachment association failed:', err))
+        }
         if (!done) {
           done = true
-          const payload = { text: fullText, sessionId: sid, model, cliSessionId, ...metadata }
+          const attachments = mergeMediaAttachmentRefs(attachmentRefs, metadata?.outputAttachments)
+          const { outputAttachments: _outputAttachments, ...runMetadata } = metadata ?? {}
+          const payload = {
+            text: fullText, sessionId: sid, model, cliSessionId, ...runMetadata,
+            ...(attachments.length > 0 ? { attachments } : {}),
+          }
           res.write(`event: done\ndata: ${JSON.stringify(payload)}\n\n`)
           emitDisplay({ type: 'done', data: payload })
           res.end()
@@ -102,13 +137,13 @@ queryRouter.post('/query', async (req, res) => {
           res.end()
         }
       },
-    }, validModel, validImages,
+    }, validModel, imageInputs,
       // Pass reference if provided (for "recall message N" feature)
       reference && typeof reference === 'object' && reference.query && reference.response
         ? { query: String(reference.query), response: String(reference.response) }
         : undefined,
       validGlobalMsgNum,
-      { abortSignal: abortController.signal },
+      { abortSignal: abortController.signal, effort: validEffort },
     )
   } catch (err: unknown) {
     if (!done) {

package/server/routes/sessions.ts

@@ -7,6 +7,7 @@ import { buildSessionLogEntry, writeSessionLog } from '../lib/session-log.js'
 import { getArchiveDayMessages } from '../lib/archive.js'
 import { localDay } from '../lib/local-day.js'
 import { clearCodexEngineSession } from '../lib/codex-engine-sessions.js'
+import { mergeMediaAttachmentRefs, type MediaAttachmentRef } from '../../shared/media-attachment.js'
 
 export const sessionsRouter = Router()
 
@@ -48,14 +49,30 @@ sessionsRouter.get('/sessions/:id/messages', (req, res) => {
     return
   }
 
-  // Pair user+assistant exchanges into client message format
-  const messages: Array<{ query: string; text: string; timestamp: number }> = []
+  // Pair user+assistant exchanges into client message format. Request refs on
+  // the user turn and output refs on the assistant turn become one safe list.
+  const messages: Array<{
+    query: string
+    text: string
+    timestamp: number
+    no?: number
+    sessionId: string
+    attachments?: MediaAttachmentRef[]
+  }> = []
   for (let i = 0; i < exchanges.length; i++) {
     const ex = exchanges[i]
     if (ex.role === 'user') {
       const next = exchanges[i + 1]
       if (next && next.role === 'assistant') {
-        messages.push({ query: ex.content, text: next.content, timestamp: next.timestamp })
+        const attachments = mergeMediaAttachmentRefs(ex.attachments, next.attachments)
+        messages.push({
+          query: ex.content,
+          text: next.content,
+          timestamp: next.timestamp,
+          sessionId: req.params.id,
+          ...((ex.globalMsgNum ?? next.globalMsgNum) != null ? { no: ex.globalMsgNum ?? next.globalMsgNum } : {}),
+          ...(attachments.length > 0 ? { attachments } : {}),
+        })
         i++ // skip the assistant exchange
       }
     }
@@ -230,7 +247,16 @@ sessionsRouter.get('/sessions/today/all-messages', (_req, res) => {
     source: 'archive' as const,
   }))
 
-  const liveMessages: Array<{ query: string; text: string; timestamp: number; chatIndex: number; sessionId: string; source: 'live' }> = []
+  const liveMessages: Array<{
+    query: string
+    text: string
+    timestamp: number
+    chatIndex: number
+    sessionId: string
+    source: 'live'
+    no?: number
+    attachments?: MediaAttachmentRef[]
+  }> = []
   const liveSessions = getActiveSessions()
   for (const session of liveSessions) {
     const sessionDay = localDay(session.lastActivity)
@@ -240,6 +266,7 @@ sessionsRouter.get('/sessions/today/all-messages', (_req, res) => {
       if (ex.role === 'user') {
         const next = session.exchanges[i + 1]
         if (next && next.role === 'assistant') {
+          const attachments = mergeMediaAttachmentRefs(ex.attachments, next.attachments)
           liveMessages.push({
             query: ex.content,
             text: next.content,
@@ -247,6 +274,8 @@ sessionsRouter.get('/sessions/today/all-messages', (_req, res) => {
             chatIndex: -1,
             sessionId: session.id,
             source: 'live',
+            ...((ex.globalMsgNum ?? next.globalMsgNum) != null ? { no: ex.globalMsgNum ?? next.globalMsgNum } : {}),
+            ...(attachments.length > 0 ? { attachments } : {}),
           })
           i++
         }

package/shared/media-attachment.ts

@@ -0,0 +1,126 @@
+// Media attachment contract — the ONE shape both the browser client and the
+// server exchange for image attachments (Release A of the image-attachments
+// plan). The public ref deliberately carries NO storage path, URL, token,
+// base64, checksum, or internal lifecycle state — those live only in the
+// server media index. Anything that persists or transmits an attachment
+// persists THIS shape (or just the id) and nothing else.
+
+export type MediaKind = 'user_photo' | 'traffic_frame' | 'generated_visual'
+
+export type MediaMime = 'image/jpeg' | 'image/png'
+
+export interface MediaAttachmentRef {
+  id: string
+  kind: MediaKind
+  mime: MediaMime
+  width: number
+  height: number
+  createdAt: string
+  label?: string
+  capturedAt?: string
+  expiresAt?: string
+}
+
+/** Hard cap on attachments per prompt — mirrored by upload validation,
+ *  query resolution, and the phone composer. */
+export const MAX_ATTACHMENTS_PER_PROMPT = 5
+
+// ── Media IDs ────────────────────────────────────────────────────────────────
+// One strict generated format, one strict validator. The id builds filesystem
+// paths on the server, so the validator rejects anything that isn't exactly
+// `m_` + 24 lowercase hex chars — no path characters can ever pass.
+
+export const MEDIA_ID_RE = /^m_[a-f0-9]{24}$/
+
+export function isValidMediaId(id: unknown): id is string {
+  return typeof id === 'string' && MEDIA_ID_RE.test(id)
+}
+
+const VALID_KINDS: ReadonlySet<string> = new Set(['user_photo', 'traffic_frame', 'generated_visual'])
+const VALID_MIMES: ReadonlySet<string> = new Set(['image/jpeg', 'image/png'])
+const MAX_LABEL_LEN = 120
+// ISO-8601 subset — what `new Date().toISOString()` emits.
+const ISO_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d{1,3})?Z$/
+
+function isIsoTimestamp(v: unknown): v is string {
+  return typeof v === 'string' && ISO_RE.test(v) && Number.isFinite(new Date(v).getTime())
+}
+
+function isDimension(v: unknown): v is number {
+  return typeof v === 'number' && Number.isInteger(v) && v > 0 && v <= 65_535
+}
+
+/** Validate an UNTRUSTED value into a MediaAttachmentRef, or null.
+ *  TypeScript types alone are not validation — every persistence and API
+ *  boundary that accepts a ref from outside must run it through here.
+ *  Returns a fresh object containing only the known fields (drops extras). */
+export function parseMediaAttachmentRef(raw: unknown): MediaAttachmentRef | null {
+  if (!raw || typeof raw !== 'object') return null
+  const r = raw as Record<string, unknown>
+  if (!isValidMediaId(r.id)) return null
+  if (typeof r.kind !== 'string' || !VALID_KINDS.has(r.kind)) return null
+  if (typeof r.mime !== 'string' || !VALID_MIMES.has(r.mime)) return null
+  if (!isDimension(r.width) || !isDimension(r.height)) return null
+  if (!isIsoTimestamp(r.createdAt)) return null
+  const ref: MediaAttachmentRef = {
+    id: r.id,
+    kind: r.kind as MediaKind,
+    mime: r.mime as MediaMime,
+    width: r.width,
+    height: r.height,
+    createdAt: r.createdAt,
+  }
+  if (typeof r.label === 'string' && r.label.length > 0) {
+    ref.label = r.label.slice(0, MAX_LABEL_LEN)
+  }
+  if (isIsoTimestamp(r.capturedAt)) ref.capturedAt = r.capturedAt
+  if (isIsoTimestamp(r.expiresAt)) ref.expiresAt = r.expiresAt
+  return ref
+}
+
+/** Validate an untrusted array of refs, dropping only the invalid entries
+ *  (a bad ref must never take the whole conversation record with it). */
+export function parseMediaAttachmentRefs(raw: unknown): MediaAttachmentRef[] {
+  if (!Array.isArray(raw)) return []
+  const out: MediaAttachmentRef[] = []
+  for (const item of raw) {
+    const ref = parseMediaAttachmentRef(item)
+    if (ref) out.push(ref)
+    if (out.length >= MAX_ATTACHMENTS_PER_PROMPT) break
+  }
+  return out
+}
+
+/** Validate, merge, and de-duplicate attachment refs from multiple untrusted
+ *  exchange surfaces. A completed Q&A pair can carry request refs on the user
+ *  turn and generated/research refs on the assistant turn; readers should see
+ *  one bounded list without trusting either persisted shape. First occurrence
+ *  wins so the request-side ref remains stable when the server echoes it back
+ *  in completion metadata. */
+export function mergeMediaAttachmentRefs(...sources: unknown[]): MediaAttachmentRef[] {
+  const out: MediaAttachmentRef[] = []
+  const seen = new Set<string>()
+  for (const source of sources) {
+    if (!Array.isArray(source)) continue
+    for (const item of source) {
+      const ref = parseMediaAttachmentRef(item)
+      if (!ref || seen.has(ref.id)) continue
+      seen.add(ref.id)
+      out.push(ref)
+      if (out.length >= MAX_ATTACHMENTS_PER_PROMPT) return out
+    }
+  }
+  return out
+}
+
+/** Validate an untrusted list of media IDs (dedup, cap, strict format). */
+export function parseMediaIdList(raw: unknown): string[] {
+  if (!Array.isArray(raw)) return []
+  const out: string[] = []
+  for (const item of raw) {
+    if (!isValidMediaId(item) || out.includes(item)) continue
+    out.push(item)
+    if (out.length >= MAX_ATTACHMENTS_PER_PROMPT) break
+  }
+  return out
+}

package/shared/model-preference.ts

@@ -1,42 +1,159 @@
-export type ClaudeModelPreference = 'opus' | 'sonnet' | 'haiku'
-export type CodexModelPreference = 'codex-high'
+export type ClaudeModelPreference = 'opus' | 'fable' | 'sonnet' | 'haiku'
+
+// Stable app-level slots. Concrete GPT model ids resolve at runtime from the
+// local Codex CLI catalog, so a shipped glasses app keeps tracking new releases.
+export type CodexModelPreference = 'codex-frontier' | 'codex-balanced'
 export type ModelPreference = ClaudeModelPreference | CodexModelPreference
 
+// Preserve the public server's established fast, broadly available default.
 export const DEFAULT_MODEL = 'sonnet' as const
-export const CODEX_HIGH_MODEL: CodexModelPreference = 'codex-high'
+export const CODEX_FRONTIER_MODEL: CodexModelPreference = 'codex-frontier'
+export const CODEX_BALANCED_MODEL: CodexModelPreference = 'codex-balanced'
+// Backward-compatible export for callers that predate the two-slot catalog.
+export const CODEX_HIGH_MODEL: CodexModelPreference = CODEX_FRONTIER_MODEL
+// Existing 6.1–6.3 installs may pin the legacy codex-high slot. Frontier is its
+// migration target; Balanced remains auto-catalog even when this override is set.
+export const CODEX_MODEL_ID = process.env.COS_CODEX_MODEL?.trim() ?? ''
+
+export type CodexReasoningEffort = 'low' | 'medium' | 'high' | 'xhigh' | 'max' | 'ultra'
+const CODEX_REASONING_EFFORT_SET = new Set<CodexReasoningEffort>(['low', 'medium', 'high', 'xhigh', 'max', 'ultra'])
+
+export function resolveConfiguredCodexReasoningEffort(): CodexReasoningEffort {
+  const raw = process.env.COS_CODEX_REASONING_EFFORT?.trim().toLowerCase()
+  return raw && CODEX_REASONING_EFFORT_SET.has(raw as CodexReasoningEffort)
+    ? raw as CodexReasoningEffort
+    : 'high'
+}
+
+export const CODEX_HIGH_REASONING_EFFORT: CodexReasoningEffort = resolveConfiguredCodexReasoningEffort()
+
+export const MODEL_OPTIONS: ModelPreference[] = [
+  'opus',
+  'fable',
+  'sonnet',
+  CODEX_FRONTIER_MODEL,
+  CODEX_BALANCED_MODEL,
+]
+
+const MODEL_SET = new Set<ModelPreference>([
+  'opus',
+  'fable',
+  'sonnet',
+  'haiku',
+  CODEX_FRONTIER_MODEL,
+  CODEX_BALANCED_MODEL,
+])
+
+// Bare Claude tier aliases resolve to the newest model in that tier at spawn.
+// The [1m] suffix keeps the large-context contract without pinning a version.
+export const CLAUDE_CLI_MODEL_ID: Record<ClaudeModelPreference, string> = {
+  opus: 'opus[1m]',
+  fable: 'fable[1m]',
+  sonnet: 'sonnet[1m]',
+  haiku: 'haiku',
+}
+
+export function resolveClaudeCliModelId(model: ClaudeModelPreference): string {
+  return CLAUDE_CLI_MODEL_ID[model] ?? CLAUDE_CLI_MODEL_ID[DEFAULT_MODEL]
+}
+
+/** Format a concrete Claude CLI model id for diagnostics. */
+export function formatResolvedModelDisplay(cliModelId: string | undefined): string {
+  if (!cliModelId) return ''
+  const oneM = cliModelId.includes('[1m]')
+  const bare = cliModelId.replace('[1m]', '')
+  const match = /^claude-([a-z]+)-(\d+(?:-\d+)*)$/.exec(bare)
+  if (!match) return cliModelId
+  const family = match[1].charAt(0).toUpperCase() + match[1].slice(1)
+  const version = match[2].split('-').join('.')
+  return `${family} ${version}${oneM ? ' (1M)' : ''}`
+}
+
+export type EffortPreference = 'high' | 'xhigh' | 'max' | 'ultracode'
+export const DEFAULT_EFFORT: EffortPreference = 'high'
+export const EFFORT_OPTIONS: EffortPreference[] = ['high', 'xhigh', 'max', 'ultracode']
+const EFFORT_SET = new Set<EffortPreference>(EFFORT_OPTIONS)
+export const ULTRACODE_KEYWORD = 'ultracode'
+
+export function isEffortPreference(value: unknown): value is EffortPreference {
+  return typeof value === 'string' && EFFORT_SET.has(value as EffortPreference)
+}
 
-// Optional codex model passed to `codex exec --model`. Empty (the default) means
-// "use whatever model your codex CLI is configured for" — so the public server
-// never pins a specific (possibly unreleased) model id. Set COS_CODEX_MODEL to
-// pin one. COS_CODEX_REASONING_EFFORT tunes the reasoning level (default high).
-export const CODEX_MODEL_ID = process.env.COS_CODEX_MODEL ?? ''
-export const CODEX_HIGH_REASONING_EFFORT = process.env.COS_CODEX_REASONING_EFFORT ?? 'high'
+export function normalizeEffortPreference(value: unknown): EffortPreference | undefined {
+  return isEffortPreference(value) ? value : undefined
+}
+
+/** Map the UI-only ultracode choice to a Claude CLI effort flag. */
+export function resolveCliEffortFlag(effort: EffortPreference): 'high' | 'xhigh' | 'max' {
+  return effort === 'ultracode' ? 'xhigh' : effort
+}
+
+// Codex Fast mode is emitted only when the selected live model advertises it.
+export const CODEX_SERVICE_TIER = 'priority'
 
-export const MODEL_OPTIONS: ModelPreference[] = ['opus', 'sonnet', 'haiku', 'codex-high']
+export function resolveCodexReasoningEffort(effort: EffortPreference | undefined): CodexReasoningEffort {
+  if (effort === 'ultracode') return 'ultra'
+  if (effort === 'max') return 'max'
+  if (effort === 'xhigh') return 'xhigh'
+  return 'high'
+}
 
-const MODEL_SET = new Set<ModelPreference>(['opus', 'sonnet', 'haiku', 'codex-high'])
+export function effortLabel(effort: EffortPreference): string {
+  switch (effort) {
+    case 'xhigh': return 'Extra High'
+    case 'max': return 'Max'
+    case 'ultracode': return 'Ultracode'
+    case 'high':
+    default:
+      return 'High'
+  }
+}
 
 export function isModelPreference(value: unknown): value is ModelPreference {
   return typeof value === 'string' && MODEL_SET.has(value as ModelPreference)
 }
 
 export function normalizeModelPreference(value: unknown): ModelPreference | undefined {
+  // Existing installs persist codex-high. Migrate it to the live frontier slot.
+  if (value === 'codex-high') return CODEX_FRONTIER_MODEL
   return isModelPreference(value) ? value : undefined
 }
 
 export function isClaudeModel(model: ModelPreference): model is ClaudeModelPreference {
-  return model === 'opus' || model === 'sonnet' || model === 'haiku'
+  return model === 'opus' || model === 'fable' || model === 'sonnet' || model === 'haiku'
 }
 
 export function isCodexModel(model: ModelPreference): model is CodexModelPreference {
-  return model === 'codex-high'
+  return model === CODEX_FRONTIER_MODEL || model === CODEX_BALANCED_MODEL
+}
+
+export interface RuntimeCodexModelLabel {
+  preference: CodexModelPreference
+  displayName: string
+}
+
+const runtimeCodexLabels: Partial<Record<CodexModelPreference, string>> = {}
+
+export function setRuntimeCodexModelLabels(options: RuntimeCodexModelLabel[]): void {
+  for (const option of options) {
+    if (!isCodexModel(option.preference)) continue
+    const label = typeof option.displayName === 'string' ? option.displayName.trim() : ''
+    if (label) runtimeCodexLabels[option.preference] = label
+  }
+}
+
+export function resetRuntimeCodexModelLabels(): void {
+  delete runtimeCodexLabels[CODEX_FRONTIER_MODEL]
+  delete runtimeCodexLabels[CODEX_BALANCED_MODEL]
 }
 
 export function modelLabel(model: ModelPreference): string {
   switch (model) {
+    case 'fable': return 'Fable'
     case 'sonnet': return 'Sonnet'
     case 'haiku': return 'Haiku'
-    case 'codex-high': return 'Codex High'
+    case 'codex-frontier': return runtimeCodexLabels[model] ?? 'GPT Frontier'
+    case 'codex-balanced': return runtimeCodexLabels[model] ?? 'GPT Balanced'
     case 'opus':
     default:
       return 'Opus'
@@ -45,9 +162,11 @@ export function modelLabel(model: ModelPreference): string {
 
 export function modelShortLabel(model: ModelPreference): string {
   switch (model) {
+    case 'fable': return 'Fable'
     case 'sonnet': return 'Sonnet'
     case 'haiku': return 'Haiku'
-    case 'codex-high': return 'Codex H'
+    case 'codex-frontier': return 'GPT Max'
+    case 'codex-balanced': return 'GPT Bal'
     case 'opus':
     default:
       return 'Opus'
@@ -56,9 +175,11 @@ export function modelShortLabel(model: ModelPreference): string {
 
 export function modelButtonLabel(model: ModelPreference): string {
   switch (model) {
+    case 'fable': return 'FABLE'
     case 'sonnet': return 'SNNT'
     case 'haiku': return 'HAIKU'
-    case 'codex-high': return 'CODEX H'
+    case 'codex-frontier': return 'GPT MAX'
+    case 'codex-balanced': return 'GPT BAL'
     case 'opus':
     default:
       return 'OPUS'
@@ -67,9 +188,11 @@ export function modelButtonLabel(model: ModelPreference): string {
 
 export function modelTag(model: ModelPreference): string {
   switch (model) {
+    case 'fable': return 'F'
     case 'sonnet': return 'S'
     case 'haiku': return 'H'
-    case 'codex-high': return 'CH'
+    case 'codex-frontier': return 'GF'
+    case 'codex-balanced': return 'GB'
     case 'opus':
     default:
       return 'O'