@iislee/opencodex 2.31.0 → 2.35.0

package/src/codex/catalog/provider-fetch.ts

@@ -38,13 +38,15 @@ import {
   serviceTierSupportFromPolicy,
 } from "../../providers/service-tier";
 import type { FastPolicyAuthority } from "../../providers/fastwire";
-import { effectiveGoogleMode, getProviderRegistryEntry, providerMatchesRegistryTransport } from "../../providers/registry";
+import { effectiveGoogleMode, getProviderRegistryEntry, providerMatchesRegistryTransport, registryEntryForProviderDestination } from "../../providers/registry";
 import { parseAntigravityAvailableModels, registerAntigravityDiscoveredWireModels } from "../../providers/antigravity-models";
 import { applyProviderContextCap, providerContextCap, resolveUnknownRoutedContextWindow } from "../../providers/context-cap";
-import { routedSlug, slugEquals, slugsEquivalent } from "../../providers/slug-codec";
+import { clampAutoCompactTokenLimit } from "../../providers/auto-compact-budget";
+import { routedSlug, slugEquals, slugEquivalenceKey, slugsEquivalent } from "../../providers/slug-codec";
 import { CODEX_GPT5_IDENTITY_LINE } from "../../adapters/identity";
 import { filterCursorConfiguredModelsByLiveDiscovery } from "../../adapters/cursor/discovery";
 import { fetchCursorUsableModels } from "../../adapters/cursor/live-models";
+import { recordLiveCursorMaxModeModels } from "../../adapters/cursor/catalog";
 import { isCanonicalOpenAiForwardProvider, OPENAI_API_PROVIDER_ID, OPENAI_CODEX_PROVIDER_ID } from "../../providers/openai-tiers";
 import {
   COMBO_NAMESPACE,
@@ -75,7 +77,7 @@ import { createAdmissionGate, ResourceAdmissionError, type AdmissionMetrics } fr
 
 import { CODEX_CUSTOM_MODEL_CATALOG_KIND, JAWCODE_CATALOG_AUGMENT_PROVIDERS, catalogModelSlug, shouldExposeRoutedModel } from "./parsing";
 import type { CatalogModel } from "./parsing";
-import { disabledNativeSlugs, hasComboTargets, isNativeOpenAiCapabilityAliasModel, NATIVE_GPT56_MAX_INPUT_TOKENS, nativeContextLimits, nativeDefaultReasoningEffort, nativeInputModalities, nativeOpenAiContextWindow, nativeOpenAiMaxInputTokens, nativeOpenAiSlugs, nativeParallelToolCalls, nativeReasoningEfforts } from "./metadata";
+import { disabledNativeSlugs, hasComboTargets, isNativeOpenAiCapabilityAliasModel, NATIVE_GPT56_MAX_INPUT_TOKENS, nativeContextLimits, nativeDefaultReasoningEffort, nativeInputModalities, nativeOpenAiAutoCompactTokenLimit, nativeOpenAiContextWindow, nativeOpenAiMaxInputTokens, nativeOpenAiSlugs, nativeParallelToolCalls, nativeReasoningEfforts } from "./metadata";
 import { deriveComboCatalogModel, normalizedOpenAiApiSignature, openAiApiCollisionWarnings, replaceLastComboCatalogOmissions, warnUncataloguedComboOnce } from "./aggregation";
 import type { ComboCatalogOmission } from "./aggregation";
 import type { CatalogGatherProviderAuthEvidence } from "./filesystem-evidence";
@@ -579,10 +581,12 @@ function providerCatalogFingerprint(name: string, prov: OcxProviderConfig): Reco
     ctx: prov.contextWindow ?? null,
     ctxW: prov.modelContextWindows ?? null,
     maxIn: prov.modelMaxInputTokens ?? null,
+    autoCompact: prov.modelAutoCompactTokenLimits ?? null,
     inMod: prov.modelInputModalities ?? null,
     re: prov.modelReasoningEfforts ?? null,
     defRe: prov.modelDefaultReasoningEfforts ?? null,
     rsSum: prov.modelSupportsReasoningSummaries ?? null,
+    verbosity: prov.modelSupportsVerbosity ?? null,
     rsDel: prov.modelReasoningSummaryDelivery ?? null,
     serviceTier: prov.modelSupportsServiceTier ?? null,
     noVis: [...(prov.noVisionModels ?? [])].sort(),
@@ -633,6 +637,17 @@ export function configuredMaxInputTokens(prov: OcxProviderConfig, id: string): n
   return typeof configured === "number" && configured > 0 ? configured : undefined;
 }
 
+export function configuredAutoCompactTokenLimit(
+  prov: OcxProviderConfig | undefined,
+  id: string,
+): number | undefined {
+  if (!prov) return undefined;
+  const configured = modelRecordValue(prov.modelAutoCompactTokenLimits, id);
+  return typeof configured === "number" && Number.isSafeInteger(configured) && configured > 0
+    ? configured
+    : undefined;
+}
+
 function configuredReasoningSummarySupport(prov: OcxProviderConfig | undefined, id: string): boolean | undefined {
   if (!prov) return undefined;
   const explicit = modelRecordValue(prov.modelSupportsReasoningSummaries, id);
@@ -640,10 +655,26 @@ function configuredReasoningSummarySupport(prov: OcxProviderConfig | undefined,
   return modelRecordValue(prov.modelReasoningSummaryDelivery, id) !== undefined ? true : undefined;
 }
 
-export function applyProviderConfigHints(name: string, prov: OcxProviderConfig, model: CatalogModel, providerCap?: number): CatalogModel {
+function configuredVerbositySupport(name: string, prov: OcxProviderConfig | undefined, id: string): boolean | undefined {
+  const explicit = prov ? modelRecordValue(prov.modelSupportsVerbosity, id) : undefined;
+  if (explicit !== undefined) return explicit;
+  if (!prov) return undefined;
   void name;
+  // Provider-wide fallback for ids the per-model map does not enumerate — a live-discovered
+  // model would otherwise re-advertise a control the upstream accepts and ignores.
+  //
+  // Read from the PROVIDER CONFIG, never from PROVIDER_REGISTRY. A gather flight captures its
+  // registry authority up front and forbids any later registry read, so consulting the registry
+  // here made a custom-destination flight fall back to "configured" instead of serving its own
+  // discovery result (tests/codex-gather-authority.test.ts). `applyVerbosityDefaults` in
+  // providers/derive.ts materializes the registry default into the config at seed/enrich time.
+  return prov.supportsVerbosity;
+}
+
+export function applyProviderConfigHints(name: string, prov: OcxProviderConfig, model: CatalogModel, providerCap?: number): CatalogModel {
   const configuredCap = configuredContextWindow(prov, model.id);
   const configuredMaxInput = configuredMaxInputTokens(prov, model.id);
+  const configuredAutoCompact = configuredAutoCompactTokenLimit(prov, model.id);
   let inputModalities = configuredInputModalities(prov, model.id);
   // Vision-sidecar coverage: `noVisionModels` marks models whose images the PROXY describes
   // (src/vision/index.ts). The catalog must still advertise image input for them — the Codex app
@@ -656,6 +687,7 @@ export function applyProviderConfigHints(name: string, prov: OcxProviderConfig,
   const reasoningEfforts = configuredReasoningEfforts(prov, model.id);
   const defaultReasoningEffort = modelRecordValue(prov.modelDefaultReasoningEfforts, model.id) ?? model.defaultReasoningEffort;
   const supportsReasoningSummaries = configuredReasoningSummarySupport(prov, model.id);
+  const supportsVerbosity = configuredVerbositySupport(name, prov, model.id);
   const fastPolicy = fastPolicyForModel(prov, model.id, name);
   const supportsServiceTier = serviceTierSupportFromPolicy(fastPolicy);
   const {
@@ -684,11 +716,11 @@ export function applyProviderConfigHints(name: string, prov: OcxProviderConfig,
       : {}),
     ...(defaultReasoningEffort ? { defaultReasoningEffort } : {}),
     ...(typeof supportsReasoningSummaries === "boolean" ? { supportsReasoningSummaries } : {}),
+    ...(typeof supportsVerbosity === "boolean" ? { supportsVerbosity } : {}),
     ...(typeof supportsServiceTier === "boolean" ? { supportsServiceTier } : {}),
     ...(supportsServiceTier === true && fastPolicy.fastTierDescription !== undefined
       ? { fastTierDescription: fastPolicy.fastTierDescription }
       : {}),
-    ...(prov.adapter === "kiro" ? { supportsVerbosity: false } : {}),
     // Default-on for openai-chat providers (explicit false opts out); other adapters
     // advertise only on explicit opt-in.
     ...(prov.parallelToolCalls === true || (prov.adapter === "openai-chat" && prov.parallelToolCalls !== false)
@@ -697,10 +729,31 @@ export function applyProviderConfigHints(name: string, prov: OcxProviderConfig,
     ...(prov.codexToolMode !== undefined ? { codexToolMode: prov.codexToolMode } : {}),
   };
   const capped = applyProviderContextCap(hinted.contextWindow, providerCap);
-  if (providerCap !== undefined && capped !== hinted.contextWindow) {
-    return { ...hinted, contextWindow: capped, contextCap: providerCap, contextCapped: true };
-  }
-  return providerCap !== undefined ? { ...hinted, contextCap: providerCap, contextCapped: false } : hinted;
+  const withCap = providerCap !== undefined
+    ? capped !== hinted.contextWindow
+      ? { ...hinted, contextWindow: capped, contextCap: providerCap, contextCapped: true }
+      : { ...hinted, contextCap: providerCap, contextCapped: false }
+    : hinted;
+  const contextWindow = typeof withCap.contextWindow === "number" && withCap.contextWindow > 0
+    ? withCap.contextWindow
+    : undefined;
+  const boundedMaxInput = typeof withCap.maxInputTokens === "number" && withCap.maxInputTokens > 0
+    ? (contextWindow !== undefined ? Math.min(withCap.maxInputTokens, contextWindow) : withCap.maxInputTokens)
+    : undefined;
+  const withHardBounds = boundedMaxInput !== undefined && boundedMaxInput !== withCap.maxInputTokens
+    ? { ...withCap, maxInputTokens: boundedMaxInput }
+    : withCap;
+  const softCandidates = [model.autoCompactTokenLimit, configuredAutoCompact]
+    .filter((value): value is number => typeof value === "number" && value > 0);
+  if (contextWindow === undefined || softCandidates.length === 0) return withHardBounds;
+  return {
+    ...withHardBounds,
+    autoCompactTokenLimit: clampAutoCompactTokenLimit(
+      contextWindow,
+      boundedMaxInput,
+      Math.min(...softCandidates),
+    ),
+  };
 }
 
 export function catalogHintsFromProviderConfig(name: string, prov: OcxProviderConfig, id: string, contextCap?: number): Partial<CatalogModel> {
@@ -727,6 +780,7 @@ interface ComboCatalogMemberFallback {
   readonly contextWindow?: number;
   /** Input ceiling when it is lower than the window (native GPT-5.6: 922k under 1.05M). */
   readonly maxInputTokens?: number;
+  readonly autoCompactTokenLimit?: number;
   readonly inputModalities?: readonly string[];
   readonly reasoningEfforts?: readonly string[];
 }
@@ -755,26 +809,33 @@ export function resolveComboCatalogMember(
   if (prov?.disabled === true) return undefined;
 
   const withFallbackMetadata = (member: CatalogModel): CatalogModel => {
-    if (!fallback) return member;
     const contextWindow = typeof member.contextWindow === "number" && member.contextWindow > 0
       ? member.contextWindow
       : undefined;
-    const addMaxInput = contextWindow !== undefined
+    const addMaxInput = fallback !== undefined && contextWindow !== undefined
       && !(typeof member.maxInputTokens === "number" && member.maxInputTokens > 0);
+    const effectiveMaxInput = addMaxInput
+      ? Math.min(fallback?.maxInputTokens ?? contextWindow!, contextWindow!)
+      : member.maxInputTokens;
+    const softCandidates = [member.autoCompactTokenLimit, fallback?.autoCompactTokenLimit]
+      .filter((value): value is number => typeof value === "number" && value > 0);
+    const autoCompactTokenLimit = contextWindow !== undefined && softCandidates.length > 0
+      ? clampAutoCompactTokenLimit(contextWindow, effectiveMaxInput, Math.min(...softCandidates))
+      : member.autoCompactTokenLimit;
+    const adjustAutoCompact = autoCompactTokenLimit !== member.autoCompactTokenLimit;
     const addModalities = (!Array.isArray(member.inputModalities) || member.inputModalities.length === 0)
-      && fallback.inputModalities !== undefined;
+      && fallback?.inputModalities !== undefined;
     const addReasoning = member.reasoningEfforts === undefined
-      && fallback.reasoningEfforts !== undefined;
-    if (!addMaxInput && !addModalities && !addReasoning) return member;
+      && fallback?.reasoningEfforts !== undefined;
+    if (!addMaxInput && !adjustAutoCompact && !addModalities && !addReasoning) return member;
     return {
       ...member,
       // Never claim a larger input budget than the window, and prefer the model's own
       // measured ceiling when the fallback carries one.
-      ...(addMaxInput
-        ? { maxInputTokens: Math.min(fallback.maxInputTokens ?? contextWindow!, contextWindow!) }
-        : {}),
-      ...(addModalities ? { inputModalities: [...fallback.inputModalities!] } : {}),
-      ...(addReasoning ? { reasoningEfforts: [...fallback.reasoningEfforts!] } : {}),
+      ...(addMaxInput ? { maxInputTokens: effectiveMaxInput } : {}),
+      ...(adjustAutoCompact && autoCompactTokenLimit !== undefined ? { autoCompactTokenLimit } : {}),
+      ...(addModalities ? { inputModalities: [...fallback!.inputModalities!] } : {}),
+      ...(addReasoning ? { reasoningEfforts: [...fallback!.reasoningEfforts!] } : {}),
     };
   };
 
@@ -855,6 +916,20 @@ export function resolveComboCatalogMember(
   const maxInputTokens = effectiveMaxInput !== undefined
     ? Math.min(effectiveMaxInput, contextWindow)
     : contextWindow;
+  const softCandidates = [
+    hinted.autoCompactTokenLimit,
+    base.autoCompactTokenLimit,
+    fallback?.autoCompactTokenLimit,
+    configuredAutoCompactTokenLimit(prov, target.model),
+  ].filter((value): value is number => typeof value === "number" && value > 0);
+  // A generic 128k synthesis is a catalog compatibility fallback, not evidence
+  // that a configured soft policy has an authoritative window to clamp against.
+  const hasAuthoritativeAutoCompactBasis = hintedContext !== undefined
+    || fallbackContext !== undefined
+    || contextCap !== undefined;
+  const autoCompactTokenLimit = hasAuthoritativeAutoCompactBasis && softCandidates.length > 0
+    ? clampAutoCompactTokenLimit(contextWindow, maxInputTokens, Math.min(...softCandidates))
+    : undefined;
 
   return {
     ...hinted,
@@ -862,6 +937,7 @@ export function resolveComboCatalogMember(
     ...(reasoningEfforts !== undefined ? { reasoningEfforts } : {}),
     contextWindow,
     maxInputTokens,
+    ...(autoCompactTokenLimit !== undefined ? { autoCompactTokenLimit } : {}),
     ...(fallbackCapped ? { contextCap, contextCapped: true as const } : {}),
   };
 }
@@ -1242,6 +1318,9 @@ async function fetchProviderModelsWithAuth(
     });
     if (liveResult.ok) {
       const available = filterCursorConfiguredModelsByLiveDiscovery(configured, liveResult.models);
+      // Live Max-Mode evidence feeds the umbrella resolver's ultra gate
+      // (devlog 260828_cursor_umbrella_catalog; union with static evidence).
+      recordLiveCursorMaxModeModels(liveResult.maxModeModels ?? []);
       const result = available.length > 0 ? available : configured;
       // Cache the discovery-filtered roster without combo retention so a later
       // gather can re-apply the current capture's retain set on read.
@@ -1568,7 +1647,24 @@ export function filterCatalogVisibleModels(
   const allowByProvider = new Map<string, Set<string>>();
   for (const [name, prov] of Object.entries(config.providers)) {
     const sel = prov.selectedModels;
-    if (Array.isArray(sel) && sel.length > 0) allowByProvider.set(name, new Set(sel));
+    // Keyed the way `sync.ts` keys the same list, so a slash-bearing native id and
+    // the encoded slug the Codex picker displays are one entry rather than two. A
+    // bare `Set(sel)` matched only the native form, so an allowlist written from the
+    // displayed slug — which `ocx models remove` also accepts — hid every model it
+    // was meant to keep.
+    //
+    // The key is deliberately lossy: `p/a/b` and `p/a-b` collapse to one entry, so a
+    // provider publishing both spellings has them selected together. That is a real
+    // limitation, pinned by the tests below and tracked as a follow-up; it is NOT
+    // fixed here. Resolving selections against the current roster instead was tried
+    // and rejected — the roster is an incomplete dictionary (live discovery can omit
+    // a published id), so it produces the same over-grant while additionally
+    // disagreeing with the `slugEquivalenceKey` contract `sync.ts` uses at merge time.
+    // Two catalog stages with different equivalence relations is the exact bug class
+    // this change exists to remove.
+    if (Array.isArray(sel) && sel.length > 0) {
+      allowByProvider.set(name, new Set(sel.map(model => slugEquivalenceKey(routedSlug(name, model)))));
+    }
   }
   return models.filter(m => {
     const nativeAlias = m.provider === COMBO_NAMESPACE && m.nativeAlias === true;
@@ -1580,7 +1676,7 @@ export function filterCatalogVisibleModels(
       if (slugEquals(stored, m.provider, m.id)) return false;
     }
     const allow = allowByProvider.get(m.provider);
-    return !allow || allow.has(m.id);
+    return !allow || allow.has(slugEquivalenceKey(routedSlug(m.provider, m.id)));
   });
 }
 
@@ -1921,6 +2017,7 @@ async function gatherRoutedModelsUncached(
         // stay separate fields because routed/API rows of the same family run a wider window.
         // Falls back to the window for slugs with no separate ceiling.
         maxInputTokens: Math.min(nativeOpenAiMaxInputTokens(slug, openaiContextCap) ?? contextWindow, contextWindow),
+        autoCompactTokenLimit: nativeOpenAiAutoCompactTokenLimit(slug, openaiContextCap),
         inputModalities: nativeInputModalities(slug),
         reasoningEfforts: nativeReasoningEfforts(slug),
         ...(nativeParallelToolCalls(slug) ? { parallelToolCalls: true } : {}),
@@ -1937,18 +2034,23 @@ async function gatherRoutedModelsUncached(
   for (const id of listComboIds(config)) {
     const combo = getCombo(config, id);
     if (!combo) continue;
+    const comboNativeLimits = nativeContextLimits(config);
     const nativeContextWindow = combo.nativeAlias && combo.alias
-      ? nativeOpenAiContextWindow(combo.alias, nativeContextLimits(config))
+      ? nativeOpenAiContextWindow(combo.alias, comboNativeLimits)
       : undefined;
     const nativeAliasMaxInput = combo.nativeAlias && combo.alias
       ? (combo.alias.startsWith("gpt-5.6-") || combo.alias.includes("daybreak")
         ? NATIVE_GPT56_MAX_INPUT_TOKENS
         : nativeOpenAiMaxInputTokens(combo.alias) ?? nativeOpenAiContextWindow(combo.alias))
       : undefined;
+    const nativeAliasAutoCompact = combo.nativeAlias && combo.alias
+      ? nativeOpenAiAutoCompactTokenLimit(combo.alias, comboNativeLimits)
+      : undefined;
     const nativeAliasFallback = combo.nativeAlias && combo.alias && nativeContextWindow !== undefined
       ? {
         contextWindow: nativeContextWindow,
         ...(nativeAliasMaxInput !== undefined ? { maxInputTokens: nativeAliasMaxInput } : {}),
+        ...(nativeAliasAutoCompact !== undefined ? { autoCompactTokenLimit: nativeAliasAutoCompact } : {}),
         inputModalities: nativeInputModalities(combo.alias),
         reasoningEfforts: nativeReasoningEfforts(combo.alias),
       }
@@ -2011,9 +2113,23 @@ async function gatherRoutedModelsUncached(
     const nativeAliasMaxInputTokens = codexForwardNativeCapabilityAlias
       ? nativeOpenAiMaxInputTokens(cm.modelId, customNativeLimits)
       : undefined;
-    const customMaxInputTokens = nativeAliasMaxInputTokens !== undefined && customContextWindow !== undefined
-      ? Math.min(nativeAliasMaxInputTokens, customContextWindow)
-      : nativeAliasMaxInputTokens;
+    const configuredMaxInput = rawProvider
+      ? configuredMaxInputTokens(rawProvider, cm.modelId)
+      : undefined;
+    const hardMaxCandidates = [nativeAliasMaxInputTokens, configuredMaxInput]
+      .filter((value): value is number => typeof value === "number" && value > 0);
+    const customMaxInputTokens = hardMaxCandidates.length > 0
+      ? Math.min(
+        ...hardMaxCandidates,
+        ...(customContextWindow !== undefined ? [customContextWindow] : []),
+      )
+      : undefined;
+    const configuredAutoCompact = configuredAutoCompactTokenLimit(rawProvider, cm.modelId);
+    const customAutoCompactTokenLimit = codexForwardNativeCapabilityAlias
+      ? nativeOpenAiAutoCompactTokenLimit(cm.modelId, customNativeLimits)
+      : customContextWindow !== undefined && configuredAutoCompact !== undefined
+        ? clampAutoCompactTokenLimit(customContextWindow, customMaxInputTokens, configuredAutoCompact)
+        : undefined;
     const nativeAliasDefaultEffort = codexForwardNativeCapabilityAlias
       ? nativeDefaultReasoningEffort(cm.modelId)
       : undefined;
@@ -2034,6 +2150,7 @@ async function gatherRoutedModelsUncached(
         : codexForwardNativeCapabilityAlias ? { displayName: "Daybreak Blue" } : {}),
       ...(customContextWindow !== undefined ? { contextWindow: customContextWindow } : {}),
       ...(customMaxInputTokens !== undefined ? { maxInputTokens: customMaxInputTokens } : {}),
+      ...(customAutoCompactTokenLimit !== undefined ? { autoCompactTokenLimit: customAutoCompactTokenLimit } : {}),
       ...(cm.inputModalities
         ? { inputModalities: cm.inputModalities }
         : codexForwardNativeCapabilityAlias ? { inputModalities: nativeInputModalities(cm.modelId) } : {}),
@@ -2079,10 +2196,18 @@ async function gatherRoutedModelsUncached(
     // along when it is actually a member — otherwise a provider default like "xhigh" would
     // re-apply onto a narrower custom ladder and override the fallback in applyReasoningLevels.
     const effectiveLadder = base.reasoningEfforts ?? replaced?.reasoningEfforts;
+    const mergedMaxInputCandidates = [base.maxInputTokens, replaced?.maxInputTokens]
+      .filter((value): value is number => typeof value === "number" && value > 0);
+    const mergedMaxInput = mergedMaxInputCandidates.length > 0
+      ? Math.min(...mergedMaxInputCandidates)
+      : undefined;
     const merged: CatalogModel = replaced ? {
       ...base,
       ...(base.contextWindow === undefined && replaced.contextWindow !== undefined ? { contextWindow: replaced.contextWindow } : {}),
-      ...(base.maxInputTokens === undefined && replaced.maxInputTokens !== undefined ? { maxInputTokens: replaced.maxInputTokens } : {}),
+      ...(mergedMaxInput !== undefined ? { maxInputTokens: mergedMaxInput } : {}),
+      ...(base.autoCompactTokenLimit === undefined && replaced.autoCompactTokenLimit !== undefined
+        ? { autoCompactTokenLimit: replaced.autoCompactTokenLimit }
+        : {}),
       ...(base.inputModalities === undefined && replaced.inputModalities !== undefined ? { inputModalities: replaced.inputModalities } : {}),
       ...(base.reasoningEfforts === undefined && replaced.reasoningEfforts !== undefined ? { reasoningEfforts: replaced.reasoningEfforts } : {}),
       ...(base.defaultReasoningEffort === undefined && replaced.defaultReasoningEffort !== undefined
@@ -2099,14 +2224,36 @@ async function gatherRoutedModelsUncached(
     // (#349/#344). Deliberately NOT the full applyProviderConfigHints pass — custom rows are a
     // user override, so their explicit contextWindow / inputModalities / reasoning fields must be
     // preserved verbatim (the hint pass would cap context and overwrite modalities from registry).
+    const mergedContext = typeof merged.contextWindow === "number" && merged.contextWindow > 0
+      ? merged.contextWindow
+      : undefined;
+    const boundedMergedMaxInput = typeof merged.maxInputTokens === "number" && merged.maxInputTokens > 0
+      ? (mergedContext !== undefined ? Math.min(merged.maxInputTokens, mergedContext) : merged.maxInputTokens)
+      : undefined;
+    const mergedWithHardBounds = boundedMergedMaxInput !== undefined
+      && boundedMergedMaxInput !== merged.maxInputTokens
+      ? { ...merged, maxInputTokens: boundedMergedMaxInput }
+      : merged;
+    const mergedSoftCandidates = [mergedWithHardBounds.autoCompactTokenLimit, configuredAutoCompact]
+      .filter((value): value is number => typeof value === "number" && value > 0);
+    const mergedWithAutoCompact: CatalogModel = mergedContext !== undefined && mergedSoftCandidates.length > 0
+      ? {
+        ...mergedWithHardBounds,
+        autoCompactTokenLimit: clampAutoCompactTokenLimit(
+          mergedContext,
+          boundedMergedMaxInput,
+          Math.min(...mergedSoftCandidates),
+        ),
+      }
+      : mergedWithHardBounds;
     const enrichedProvider = enrichedByName.get(cm.provider) ?? rawProvider;
-    if (enrichedProvider && modelInList(enrichedProvider.noVisionModels, merged.id)) {
-      const current = merged.inputModalities ?? ["text"];
+    if (enrichedProvider && modelInList(enrichedProvider.noVisionModels, mergedWithAutoCompact.id)) {
+      const current = mergedWithAutoCompact.inputModalities ?? ["text"];
       if (!current.includes("image")) {
-        return { ...merged, inputModalities: [...current, "image"] };
+        return { ...mergedWithAutoCompact, inputModalities: [...current, "image"] };
       }
     }
-    return merged;
+    return mergedWithAutoCompact;
   });
   // Custom rows override discovered rows that encode to the same Codex-facing slug.
   const customKeys = new Set(customModels.map(c => routedSlug(c.provider, c.id)));
@@ -2162,7 +2309,15 @@ function augmentRoutedModelsWithCapturedOpenAiApiRows(
       ? Math.min(officialContext, userContext ?? officialContext, providerCap ?? officialContext)
       : undefined;
     const maxInputTokens = typeof officialMaxInput === "number"
-      ? Math.min(officialMaxInput, userMaxInput ?? officialMaxInput)
+      ? Math.min(
+        officialMaxInput,
+        userMaxInput ?? officialMaxInput,
+        contextWindow ?? officialMaxInput,
+      )
+      : undefined;
+    const configuredAutoCompact = configuredAutoCompactTokenLimit(configured, id);
+    const autoCompactTokenLimit = contextWindow !== undefined && configuredAutoCompact !== undefined
+      ? clampAutoCompactTokenLimit(contextWindow, maxInputTokens, configuredAutoCompact)
       : undefined;
     return {
       provider: OPENAI_API_PROVIDER_ID,
@@ -2170,6 +2325,7 @@ function augmentRoutedModelsWithCapturedOpenAiApiRows(
       owned_by: OPENAI_API_PROVIDER_ID,
       ...(contextWindow ? { contextWindow } : {}),
       ...(maxInputTokens ? { maxInputTokens } : {}),
+      ...(autoCompactTokenLimit !== undefined ? { autoCompactTokenLimit } : {}),
       ...(policy.modelInputModalities?.[id] ? { inputModalities: [...policy.modelInputModalities[id]!] } : {}),
       ...(policy.modelReasoningEfforts?.[id] ? { reasoningEfforts: [...policy.modelReasoningEfforts[id]!] } : {}),
     };

package/src/codex/catalog/sync.ts

@@ -41,7 +41,7 @@ import {
 } from "../model-entitlements";
 
 
-import { CODEX_CUSTOM_MODEL_CATALOG_KIND, CODEX_PROVIDER_MODEL_CATALOG_KIND, activeCodexModelsCachePath, applyCatalogMetadata, applyMultiAgentMode, applyNativeOpenAiContextOverride, applyRoutedCodexToolMode, catalogBackupPathFor, catalogHasRoutedEntries, catalogModelSlug, ensureStrictCatalogFields, findNativeTemplate, isDefaultCatalogPath, isRoutedModelCompatibilityExcluded, legacyCatalogBackupPath, normalizeRoutedCatalogEntry, normalizeServiceTiers, readCatalog, readCatalogBackup, readCodexCatalogPath, readNativeBaseline } from "./parsing";
+import { CODEX_CUSTOM_MODEL_CATALOG_KIND, CODEX_PROVIDER_MODEL_CATALOG_KIND, activeCodexModelsCachePath, applyCatalogMetadata, applyMultiAgentMode, applyNativeOpenAiContextOverride, applyRoutedCodexToolMode, catalogBackupPathFor, catalogHasRoutedEntries, catalogModelSlug, ensureStrictCatalogFields, findNativeTemplate, isDefaultCatalogPath, isRoutedModelCompatibilityExcluded, legacyCatalogBackupPath, normalizeRoutedCatalogEntry, normalizeServiceTiers, readCatalog, readCatalogBackup, readCodexCatalogPath, readCodexCatalogPathForHome, readConfiguredAutoReviewModel, readNativeBaseline } from "./parsing";
 import type { CatalogModel, MultiAgentMode, RawCatalog, RawEntry } from "./parsing";
 import { accountBoundNativeOpenAiSlugs, accountBoundNativeOpenAiSlugsBySelector, applyNativeVisibility, CODEX_NATIVE_ALIAS_CATALOG_KIND, desktopAllowlistSuppressedNativeSlugs, disabledNativeSlugs, isNativeAliasCatalogEntry, isUnsupportedOpenAiNativeSlug, NATIVE_OPENAI_MODELS, nativeContextLimits, observedAccountBoundNativeEntries, shouldIncludeAccountBoundNativeOpenAi, shouldIncludeNativeOpenAi, shouldUpgradeToUpstreamEntry, SUPPORTED_NATIVE_OPENAI_SLUGS, upstreamNativeEntry, type NativeContextLimitsInput } from "./metadata";
 import {
@@ -1158,7 +1158,7 @@ export function mergeCatalogEntriesForSync(
       isNativeAliasCatalogEntry(entry) && typeof entry.slug === "string" ? [entry.slug] : []
     )),
   ),
-  openaiContextCap?: number,
+  openaiContextCap?: NativeContextLimitsInput,
   keepNativeChatGptOnV1 = false,
 ): RawEntry[] {
   // Retained for source compatibility with the original helper contract. Raw provider ids must
@@ -1403,6 +1403,130 @@ function catalogModelsForMergeWithNativeRecovery(
   ]);
 }
 
+const AUTO_REVIEW_MODEL_CONTROL_CHARS = /[\u0000-\u001f\u007f-\u009f\u2028\u2029\s]/;
+
+export function isValidAutoReviewModel(value: unknown): value is string {
+  if (typeof value !== "string") return false;
+  const trimmed = value.trim();
+  return Boolean(trimmed)
+    && trimmed.length <= 1024
+    && !AUTO_REVIEW_MODEL_CONTROL_CHARS.test(trimmed);
+}
+
+export type AutoReviewModelOverrideResult = "absent" | "applied" | "invalid" | "unresolved";
+
+function isRoutedCatalogEntry(entry: RawEntry): boolean {
+  const slug = typeof entry.slug === "string" ? entry.slug : "";
+  return slug.includes("/")
+    || (typeof entry.description === "string" && entry.description.startsWith("Routed via opencodex → "));
+}
+
+function clearAutoReviewModelOverride(
+  models: readonly RawEntry[],
+  sourceModels: readonly RawEntry[] = [],
+): void {
+  const observedModels = [...models, ...sourceModels];
+  const configuredValues = new Set(observedModels.flatMap(entry => {
+    const value = entry?.auto_review_model_override;
+    return typeof value === "string" && value.trim() ? [value] : [];
+  }));
+  const globalStamp = configuredValues.size === 1
+    && observedModels.some(entry => {
+      const value = entry.auto_review_model_override;
+      return isRoutedCatalogEntry(entry)
+        && typeof value === "string"
+        && value.trim().length > 0
+        && configuredValues.has(value);
+    })
+    && observedModels.every(entry => {
+      const value = entry?.auto_review_model_override;
+      return value === null
+        || value === undefined
+        || (typeof value === "string" && configuredValues.has(value));
+    });
+  for (const entry of models) {
+    if (!entry || typeof entry !== "object") continue;
+    const current = entry.auto_review_model_override;
+    if (isRoutedCatalogEntry(entry)
+      || (globalStamp && typeof current === "string" && configuredValues.has(current))) {
+      entry.auto_review_model_override = null;
+    }
+  }
+}
+
+function warnAutoReviewModelDiagnostic(
+  reason: "invalid" | "unresolved",
+  configured: string,
+): void {
+  const safeConfigured = JSON.stringify(redactSecretString(configured));
+  const detail = reason === "unresolved"
+    ? "the selector was not found in the final catalog"
+    : "the selector format is invalid";
+  console.warn(
+    `[opencodex] auto_review_model ${detail} (${safeConfigured}); preserving normal upstream auto-review behavior.`,
+  );
+}
+
+function preserveNativeAutoReviewModelOverrides(
+  models: readonly RawEntry[],
+  sourceModels: readonly RawEntry[],
+): void {
+  const existing = new Map<string, string | null>();
+  for (const entry of sourceModels) {
+    const slug = typeof entry.slug === "string" ? entry.slug : undefined;
+    const value = entry.auto_review_model_override;
+    if (!slug || isRoutedCatalogEntry(entry)) continue;
+    if (typeof value === "string" || value === null) existing.set(slug, value);
+  }
+  for (const entry of models) {
+    const slug = typeof entry.slug === "string" ? entry.slug : undefined;
+    if (!slug || isRoutedCatalogEntry(entry) || !existing.has(slug)) continue;
+    entry.auto_review_model_override = existing.get(slug) ?? null;
+  }
+}
+
+export function applyAutoReviewModelOverride(
+  models: RawEntry[] | undefined,
+  autoReviewModel: string | null | undefined,
+  sourceModels: readonly RawEntry[] = [],
+): AutoReviewModelOverrideResult {
+  if (!models || !Array.isArray(models)) return "absent";
+  if (autoReviewModel === null || autoReviewModel === undefined) {
+    clearAutoReviewModelOverride(models, sourceModels);
+    return "absent";
+  }
+  const trimmed = autoReviewModel.trim();
+  if (!trimmed) {
+    clearAutoReviewModelOverride(models, sourceModels);
+    return "absent";
+  }
+  if (!isValidAutoReviewModel(trimmed)) {
+    clearAutoReviewModelOverride(models, sourceModels);
+    warnAutoReviewModelDiagnostic("invalid", trimmed);
+    return "invalid";
+  }
+  if (!configuredCatalogEntry(models, trimmed)) {
+    clearAutoReviewModelOverride(models, sourceModels);
+    warnAutoReviewModelDiagnostic("unresolved", trimmed);
+    return "unresolved";
+  }
+  for (const entry of models) {
+    if (entry && typeof entry === "object") {
+      entry.auto_review_model_override = trimmed;
+    }
+  }
+  return "applied";
+}
+
+/** Apply the root Codex auto-review selector after the final catalog merge. */
+export function finalizeAutoReviewModelOverride(
+  models: RawEntry[] | undefined,
+  sourceModels: readonly RawEntry[] = [],
+): AutoReviewModelOverrideResult {
+  if (models && sourceModels.length > 0) preserveNativeAutoReviewModelOverrides(models, sourceModels);
+  return applyAutoReviewModelOverride(models, readConfiguredAutoReviewModel(), sourceModels);
+}
+
 function writeRetainedCatalogSync({
   config,
   goModels,
@@ -1596,6 +1720,7 @@ function writeRetainedCatalogSync({
     },
   });
   clampCatalogModelsToCodexSupport(catalog.models);
+  finalizeAutoReviewModelOverride(catalog.models, catalogModelsForMerge);
 
   const added = goEntries.length + accountBoundEntries.length;
   const content = `${JSON.stringify(catalog, null, 2)}\n`;
@@ -1832,11 +1957,12 @@ export function invalidateCodexModelsCacheWithPermit(
     // The catalog-only sync override applies here too so an explicit refresh
     // keeps the cache consistent with the catalog it just wrote.
     if (!shouldSyncCodexOnStart(loadConfig()) && options?.allowWhenDesiredDisabled !== true) return false;
-    const catalogPath = readCodexCatalogPath();
+    const catalogPath = readCodexCatalogPathForHome(owningCodexHome);
     if (!existsSync(catalogPath)) return false;
     const catalog = JSON.parse(readFileSync(catalogPath, "utf8"));
     const models = catalog.models ?? catalog;
-    const currentCache = readCatalog(activeCodexModelsCachePath());
+    const cachePath = join(owningCodexHome, "models_cache.json");
+    const currentCache = readCatalog(cachePath);
     const existingSlugs = new Set(models.flatMap((entry: RawEntry) =>
       typeof entry.slug === "string" ? [entry.slug] : []));
     const currentConfig = loadConfig();
@@ -1864,7 +1990,7 @@ export function invalidateCodexModelsCacheWithPermit(
       models: [...models, ...observedAccountModels],
     };
     replaceCodexModelsCache(permit, owningCodexHome, {
-      path: activeCodexModelsCachePath(),
+      path: cachePath,
       content: `${JSON.stringify(wrapper, null, 2)}\n`,
     });
     return true;

package/src/codex/catalog.ts

@@ -9,7 +9,7 @@ export { applyProviderConfigHints, isDatedVariantId, filterCatalogVisibleModels,
 export type { GatherRoutedModelsOptions } from "./catalog/provider-fetch";
 export { deriveComboCatalogModel, exactComboCatalogSlugs, getLastComboCatalogOmissions, resetOpenAiApiCatalogWarningStateForTests, uniqueCatalogModelsForPublicList, uniqueCatalogModelsForRawPublicList, buildComboCatalogOmission, comboCatalogOmissionReason, summarizeComboCatalogOmissions } from "./catalog/aggregation";
 export type { ComboCatalogOmission, ComboCatalogOmissionReason } from "./catalog/aggregation";
-export { MAX_SPAWN_AGENT_MODEL_OVERRIDES, CANONICAL_NATIVE_CATALOG_CONTENT_POLICY, effectiveSubagentRoster, buildCatalogEntries, mergeCatalogEntriesFromObservedState, resetCatalogRuntimeStateForTests, orderForSubagents, mergeCatalogEntriesForSync, syncCatalogModels, restoreCodexCatalog, invalidateCodexModelsCache } from "./catalog/sync";
+export { MAX_SPAWN_AGENT_MODEL_OVERRIDES, CANONICAL_NATIVE_CATALOG_CONTENT_POLICY, effectiveSubagentRoster, buildCatalogEntries, mergeCatalogEntriesFromObservedState, resetCatalogRuntimeStateForTests, orderForSubagents, mergeCatalogEntriesForSync, syncCatalogModels, restoreCodexCatalog, invalidateCodexModelsCache, finalizeAutoReviewModelOverride } from "./catalog/sync";
 export type { ObservedCatalogMergeInput } from "./catalog/sync";
 export type { SpawnAgentSurface, SubagentRosterExclusionReason, EffectiveSubagentModel, SubagentRosterExclusion, EffectiveSubagentRoster } from "./catalog/sync";
 export { accountBoundNativeDisplayName, accountBoundNativeModelSlugs, CODEX_ACCOUNT_BOUND_CATALOG_KIND, trustedAccountBoundNativeCatalogSlug, visibleCodexAccountSelectors } from "./catalog/account-models";

package/src/codex/codex-write-lock.ts

@@ -93,6 +93,8 @@ export interface CodexWriteLockOptions {
   admitted: CodexWriteWitness;
   /** Authoritative synchronous re-read while N and C are both held. */
   readAdmissionUnderLock(): CodexWriteWitness;
+  /** Positively authorized migration of an already-routed pre-substrate home. */
+  adoption?: { readonly direction: "apply" | "remove" };
 }
 
 /**
@@ -304,7 +306,7 @@ export async function withCodexWriteLock<T>(
 
     let transaction: ReturnType<typeof openCodexCoordinatorTransaction> | undefined;
     try {
-      transaction = openCodexCoordinatorTransaction(databasePath);
+      transaction = openCodexCoordinatorTransaction(databasePath, options.adoption);
     } catch (error) {
       // Only contention retries. A malformed database, an unsafe path, or an
       // identity failure will fail identically forever; telling a caller to retry

package/src/codex/convergence-types.ts

@@ -34,7 +34,7 @@ export interface CodexIntegrationRecord {
 }
 
 export interface CodexHistoryState {
-  status: "converged" | "pending" | "running" | "blocked" | "unknown" | "not-evaluated";
+  status: "adoption-pending" | "converged" | "pending" | "running" | "blocked" | "unknown" | "not-evaluated";
   /**
    * Why it is not converged, when it is not. These are terminal observations
    * for one attempt, not reasons to collapse the durable retry schedule.