@oh-my-pi/pi-catalog 18.1.6 → 18.1.9

package/CHANGELOG.md

@@ -2,6 +2,30 @@
 
 ## [Unreleased]
 
+## [18.1.9] - 2026-09-04
+
+### Added
+
+- Added the `delegation-bias` capability for tuning how agents delegate work to subagents.
+
+### Changed
+
+- Adjusted subagent delegation for GPT-6 and newer OpenAI models to reduce unnecessary delegation.
+
+### Fixed
+
+- Fixed `/login zai` for Z.AI GLM Coding Plan by supporting the provider’s updated authentication flow, including local desktop sign-in, remote paste-code completion, and the configurable `ZAI_OAUTH_REDIRECT_URI`.
+
+## [18.1.8] - 2026-09-03
+
+### Added
+
+- Added GPT-6 Astra to the OpenAI Codex model catalog, including support for configuration updates and requests using the freeform `apply_patch` tool.
+
+### Fixed
+
+- Fixed `omp models refresh` so revoked ChatGPT account tokens no longer prevent the remaining OpenAI Codex models from being discovered.
+
 ## [18.1.6] - 2026-09-03
 
 ### Added

package/dist/types/compat/axes.d.ts

@@ -36,6 +36,14 @@ export interface AxisDef {
 }
 /** Effort tiers accepted by taxonomy collapse/override vocabulary (`Effort` ∪ `"off"`). */
 export declare const EFFORT_TIERS: readonly string[];
+/**
+ * How hard agent prompts push subagent delegation for a model lineage
+ * (`delegation-bias` axis). `eager` is the unassigned default: the prompt
+ * actively pushes fan-out. `restrained` keeps fan-out for genuinely parallel
+ * slices but forbids reflexive scouts and single-agent babysitting. `gated`
+ * forbids subagents unless the user or a skill asks.
+ */
+export declare const DELEGATION_BIASES: readonly ["eager", "restrained", "gated"];
 /** Narrow a KDL string to an effort tier (`Effort` ∪ `"off"`). */
 export declare function isEffortTier(value: string): value is Effort | "off";
 /** Narrow a KDL string to a thinking control mode. */

package/dist/types/compat/delegation.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Delegation bias: how hard the coding agent's prompts push subagent
+ * delegation for a model lineage. Authored on the `delegation-bias` catalog
+ * axis in `rules/classes/*.kdl` so appetite corrections live beside the other
+ * lineage truths instead of as revision compares in TypeScript.
+ *
+ * Resolved through the cascade at prompt-build time (session start, model
+ * switch) rather than baked onto `Model`: bundled rows are frozen by the
+ * generator, and the bias is read once per prompt rebuild, not per request.
+ */
+import type { Model } from "../types.js";
+import { DELEGATION_BIASES } from "./axes.js";
+/** One of `DELEGATION_BIASES`; see that constant for the semantics of each tier. */
+export type DelegationBias = (typeof DELEGATION_BIASES)[number];
+/**
+ * Delegation bias for a built model; `eager` when no rule assigns one.
+ * Callers: system-prompt and tool-description rendering in the coding agent.
+ */
+export declare function resolveDelegationBias(model: Model): DelegationBias;

package/dist/types/compat/types.d.ts

@@ -407,7 +407,7 @@ export interface CompiledOAuthRequest {
     headers: Record<string, string>;
     timeoutMs?: number;
 }
-/** Loopback callback configuration for authorization-code logins. */
+/** Callback transport configuration for authorization-code logins. */
 export interface CompiledCallback {
     port: number;
     path: string;
@@ -415,8 +415,10 @@ export interface CompiledCallback {
     redirectUri?: CompiledAuthValue;
     portFallback: boolean;
     manualOnly: boolean;
+    /** Temporarily receive a custom-scheme redirect through the native OS handler. */
+    nativeScheme: boolean;
 }
-/** Authorization-code login through the loopback callback server. */
+/** Authorization-code login through a loopback, native-scheme, or manual callback. */
 export interface CompiledOAuthCodeLogin {
     kind: "oauth-code";
     clientId?: CompiledAuthValue;

package/dist/types/discovery/codex.d.ts

@@ -26,6 +26,13 @@ export interface CodexModelDiscoveryOptions {
 export interface CodexModelDiscoveryResult {
     models: ModelSpec<"openai-codex-responses">[];
     etag?: string;
+    /**
+     * Set when the backend rejected the credential itself (401/403, e.g.
+     * `token_revoked`); `models` is empty. A definitive per-account denial,
+     * unlike the `null` result for transport/parse failures, so multi-account
+     * discovery can skip the account instead of aborting.
+     */
+    rejectedStatus?: 401 | 403;
 }
 /**
  * Fetches model metadata from Codex backend and normalizes it for pi model management.

package/dist/types/types.d.ts

@@ -700,6 +700,13 @@ export interface ResolvedOpenAIResponsesCompat extends ResolvedOpenAISharedCompa
      * transport; earlier ids reject the value.
      */
     supportsAllTurnsReasoningContext: boolean;
+    /**
+     * Whether a `configuration_update` input item may change `reasoning.effort`
+     * mid-conversation while the request-level effort stays byte-stable for
+     * prompt caching. Rule-owned: GPT-6 Astra only; every other model rejects
+     * the item type with 400.
+     */
+    supportsConfigurationUpdate: boolean;
     /** Inject the `# Juice: 0 !important` developer item when reasoning is forced off (gpt-5.6+). */
     requiresReasoningOffJuiceInstruction: boolean;
     /**

package/dist/types/wire/codex.d.ts

@@ -4,8 +4,12 @@
 export declare const CODEX_BASE_URL = "https://chatgpt.com/backend-api";
 /**
  * Pinned OpenAI Codex client version (corresponds to @openai/codex package version).
+ *
+ * The backend version-gates model availability against this value on both
+ * `/models?client_version=` and `/responses` (`gpt-6-astra` requires ≥ 0.153.0);
+ * an older pin silently hides newer SKUs from discovery.
  */
-export declare const CODEX_CLIENT_VERSION = "0.144.1";
+export declare const CODEX_CLIENT_VERSION = "0.153.0";
 export declare const OPENAI_HEADERS: {
     readonly BETA: "OpenAI-Beta";
     /** Codex feature-negotiation header; values identify opt-in wire protocols. */
@@ -28,18 +32,32 @@ export declare const OPENAI_HEADERS: {
     readonly ATTESTATION: "x-oai-attestation";
     /** Client-declared data residency for region-pinned enterprise workspaces. */
     readonly RESIDENCY: "x-openai-internal-codex-residency";
+    /**
+     * Model routing hint (codex-rs `X_CODEX_ROUTING_HINT_HEADER`): `model=<slug>`
+     * or `model=<slug>;tier=<service_tier>`; sent on every ChatGPT-OAuth
+     * Responses, compaction, and WebSocket handshake request. Built by
+     * {@link codexRoutingHint}.
+     */
+    readonly ROUTING_HINT: "x-codex-routing-hint";
 };
 export declare const OPENAI_HEADER_VALUES: {
     readonly BETA_RESPONSES: "responses=experimental";
     readonly BETA_RESPONSES_WEBSOCKETS_V2: "responses_websockets=2026-02-06";
     readonly REMOTE_COMPACTION_V2: "remote_compaction_v2";
-    readonly ORIGINATOR_CODEX: "pi";
+    readonly ORIGINATOR_CODEX: "omp";
 };
 export declare const URL_PATHS: {
     readonly RESPONSES: "/responses";
     readonly CODEX_RESPONSES: "/codex/responses";
 };
 export declare const JWT_CLAIM_PATH: "https://api.openai.com/auth";
+/**
+ * Build the `x-codex-routing-hint` value for a request (codex-rs
+ * `build_routing_hint_header`): the requested model slug plus the explicit
+ * service tier when one is set. Callers set it only on ChatGPT-OAuth requests
+ * to the Codex backend; API-key OpenAI traffic never carries it.
+ */
+export declare function codexRoutingHint(model: string, serviceTier: string | null | undefined): string;
 /**
  * Extract account ID from a Codex JWT access token.
  * Returns undefined if the token is not a valid Codex JWT.

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-catalog",
-	"version": "18.1.6",
+	"version": "18.1.9",
 	"description": "Model catalog for omp: bundled model database, provider discovery descriptors, model identity, classification, and equivalence",
 	"homepage": "https://omp.sh",
 	"author": "Stencil Labs, Inc.",
@@ -35,12 +35,12 @@
 		"gen:proto": "bun scripts/generate-protocols.ts"
 	},
 	"dependencies": {
-		"@oh-my-pi/omptype": "18.1.6",
-		"@oh-my-pi/pi-utils": "18.1.6"
+		"@oh-my-pi/omptype": "18.1.9",
+		"@oh-my-pi/pi-utils": "18.1.9"
 	},
 	"devDependencies": {
 		"@bgotink/kdl": "0.4.0",
-		"@oh-my-pi/pi-ai": "18.1.6",
+		"@oh-my-pi/pi-ai": "18.1.9",
 		"@types/bun": "^1.3.14"
 	},
 	"engines": {

package/src/compat/axes.ts

@@ -44,6 +44,15 @@ const EFFORTS = ["minimal", "low", "medium", "high", "xhigh", "max"] as const;
 
 /** Effort tiers accepted by taxonomy collapse/override vocabulary (`Effort` ∪ `"off"`). */
 export const EFFORT_TIERS: readonly string[] = [...EFFORTS, "off"];
+
+/**
+ * How hard agent prompts push subagent delegation for a model lineage
+ * (`delegation-bias` axis). `eager` is the unassigned default: the prompt
+ * actively pushes fan-out. `restrained` keeps fan-out for genuinely parallel
+ * slices but forbids reflexive scouts and single-agent babysitting. `gated`
+ * forbids subagents unless the user or a skill asks.
+ */
+export const DELEGATION_BIASES = ["eager", "restrained", "gated"] as const;
 const THINKING_MODES = [
 	"effort",
 	"budget",
@@ -128,6 +137,7 @@ export const AXES: Readonly<Record<string, AxisDef>> = {
 	"strict-responses-pairing": wire("strictResponsesPairing", ["openai-responses"]),
 	"requires-reasoning-off-juice-instruction": wire("requiresReasoningOffJuiceInstruction", ["openai-responses"]),
 	"supports-all-turns-reasoning-context": wire("supportsAllTurnsReasoningContext", ["openai-responses"]),
+	"supports-configuration-update": wire("supportsConfigurationUpdate", ["openai-responses"]),
 	"strip-deepseek-special-tokens": wire("stripDeepseekSpecialTokens", OAI),
 	"stream-markup-healing-pattern": wire("streamMarkupHealingPattern", OAI, "scalar", [
 		"kimi",
@@ -260,6 +270,7 @@ export const AXES: Readonly<Record<string, AxisDef>> = {
 	"context-promotion-target": { key: "contextPromotionTarget", set: "catalog", shape: "scalar" },
 	"context-window-floor": { key: "contextWindowFloor", set: "catalog", shape: "scalar" },
 	"cost-patch": { key: "costPatch", set: "catalog", shape: "object" },
+	"delegation-bias": { key: "delegationBias", set: "catalog", shape: "scalar", values: DELEGATION_BIASES },
 	"edit-revision": { key: "editRevision", set: "catalog", shape: "scalar" },
 	"input-modalities": { key: "inputModalities", set: "catalog", shape: "array", values: ["text", "image"] },
 	"limits-patch": { key: "limitsPatch", set: "catalog", shape: "object" },

package/src/compat/delegation.ts

@@ -0,0 +1,37 @@
+/**
+ * Delegation bias: how hard the coding agent's prompts push subagent
+ * delegation for a model lineage. Authored on the `delegation-bias` catalog
+ * axis in `rules/classes/*.kdl` so appetite corrections live beside the other
+ * lineage truths instead of as revision compares in TypeScript.
+ *
+ * Resolved through the cascade at prompt-build time (session start, model
+ * switch) rather than baked onto `Model`: bundled rows are frozen by the
+ * generator, and the bias is read once per prompt rebuild, not per request.
+ */
+import type { Model } from "../types";
+import { DELEGATION_BIASES } from "./axes";
+import { resolveCascade } from "./cascade";
+
+/** One of `DELEGATION_BIASES`; see that constant for the semantics of each tier. */
+export type DelegationBias = (typeof DELEGATION_BIASES)[number];
+
+function isDelegationBias(value: unknown): value is DelegationBias {
+	return typeof value === "string" && (DELEGATION_BIASES as readonly string[]).includes(value);
+}
+
+/**
+ * Delegation bias for a built model; `eager` when no rule assigns one.
+ * Callers: system-prompt and tool-description rendering in the coding agent.
+ */
+export function resolveDelegationBias(model: Model): DelegationBias {
+	const { identity } = model;
+	const bias = resolveCascade({
+		provider: model.provider,
+		class: identity.class,
+		model: model.id,
+		reasoning: Boolean(model.reasoning),
+		...(identity.family !== undefined && { family: identity.family }),
+		...(identity.revision !== undefined && { revision: identity.revision }),
+	}).catalog.delegationBias;
+	return isDelegationBias(bias) ? bias : "eager";
+}

package/src/compat/resolve.ts

@@ -714,6 +714,7 @@ function resolveOpenAIResponsesPolicy(
 		supportsImageDetailOriginal: !isXaiHost && !modelMatchesHost(hostModel, "githubCopilot"),
 		supportsReasoningSummary: !isXaiHost,
 		supportsAllTurnsReasoningContext: false,
+		supportsConfigurationUpdate: false,
 		requiresReasoningOffJuiceInstruction: false,
 		stripImageInput: false,
 		thinkingLoopGuard: undefined,
@@ -815,6 +816,7 @@ function pickResponsesOnly(compat: ResolvedOpenAIResponsesCompat): ResponsesOnly
 		supportsImageDetailOriginal: compat.supportsImageDetailOriginal,
 		supportsObfuscationOptOut: compat.supportsObfuscationOptOut,
 		supportsAllTurnsReasoningContext: compat.supportsAllTurnsReasoningContext,
+		supportsConfigurationUpdate: compat.supportsConfigurationUpdate,
 		officialEndpoint: compat.officialEndpoint,
 		harmonyLeakMitigation: compat.harmonyLeakMitigation,
 		cacheControlFormat: compat.cacheControlFormat,

package/src/compat/rules/README.md

@@ -271,7 +271,7 @@ auth "anthropic" {
         state "hex"                              // hex | uuid | none
         authorize-params { code "true" }         // standard=#false drops client_id/response_type/redirect_uri/scope/PKCE/state
         instructions "Complete login in your browser…"
-        callback port=54545 path="/callback" hostname="localhost" redirect-uri="…" redirect-uri-env="VAR" port-fallback=#true manual-only=#false
+        callback port=54545 path="/callback" hostname="localhost" redirect-uri="…" redirect-uri-env="VAR" port-fallback=#true manual-only=#false native-scheme=#false
         token url="https://api.anthropic.com/v1/oauth/token" body="json" { params { state "{state}" } headers { X "y" } }
         credential {
             access "access_token"                // dot path; `claim="a|b"` reads JWT claims; `literal="…"` pins a value

package/src/compat/rules/auth/openai-codex.kdl

@@ -8,7 +8,7 @@ auth "openai-codex" {
 		authorize-params {
 			id_token_add_organizations "true"
 			codex_cli_simplified_flow "true"
-			originator "pi"
+			originator "omp"
 		}
 		instructions "A browser window should open. Complete login to finish."
 		// OpenAI only allowlists this exact URI; a busy port must fail rather than fall back.

package/src/compat/rules/auth/zai-coding-plan.kdl

@@ -4,9 +4,13 @@ auth "zai-coding-plan" {
 		client-id "client_P8X5CMWmlaRO9gyO-KSqtg" env="ZAI_OAUTH_CLIENT_ID"
 		authorize-url "https://chat.z.ai/api/oauth/authorize" env="ZAI_OAUTH_AUTHORIZE_URL"
 		// No PKCE: matches ZCode's authorize request verbatim.
-		// ZCode registers this exact loopback URI; any other host/port is rejected (#10245).
-		callback port=9999 path="/callback" hostname="127.0.0.1" redirect-uri="http://127.0.0.1:9999/callback" port-fallback=#false
-		instructions "Complete Z.ai login in your browser. If the browser cannot reach this machine, paste the final redirect URL or authorization code when prompted."
+		// Z.AI's server-side allowlist now rejects every loopback redirect_uri for
+		// this client (#10745); only ZCode's desktop scheme still validates. On a
+		// supported local desktop, temporarily receive that scheme and restore its
+		// previous handler. Remote and unsupported sessions retain manual input.
+		// `redirect-uri-env` lets users adapt to further allowlist shifts without a release.
+		callback port=0 redirect-uri="zcode://zai-auth/callback" redirect-uri-env="ZAI_OAUTH_REDIRECT_URI" manual-only=#true native-scheme=#true
+		instructions "Complete Z.ai login in your browser. On supported local desktops, omp captures the zcode:// callback and restores its previous handler automatically. You can also paste the final redirect URL or authorization code when prompted."
 		token url="https://zcode.z.ai/api/v1/oauth/token" url-env="ZAI_OAUTH_TOKEN_URL" body="json" standard=#false {
 			params {
 				provider "zai"

package/src/compat/rules/classes/openai.kdl

@@ -30,6 +30,22 @@ class "openai" {
 		thinking-efforts "low" "medium" "high" "xhigh" "max"
 		requires-reasoning-off-juice-instruction #true
 	}
+	// Delegation appetite is a lineage trait. GPT-5.6 was trained on Codex's
+	// "no subagents unless asked" developer message; GPT-6 fans out on its own
+	// and over-delegates under Claude-calibrated prompts (reflexive scouts,
+	// single-agent babysitting), so it gets the restrained tier instead.
+	revision "=5.6" {
+		delegation-bias "gated"
+	}
+	revision ">=6" {
+		delegation-bias "restrained"
+	}
+	// GPT-6 Astra changes reasoning effort mid-conversation through a
+	// `configuration_update` input item so the request-level effort (and the
+	// cached prompt prefix) stays put; every other SKU 400s on the item type.
+	models "gpt-6-astra" {
+		supports-configuration-update #true
+	}
 	// Codex SKUs: the advertised 400K figure includes the output budget; the
 	// true prompt window is 272K. Spark budgets are its own family's.
 	family "codex" {

package/src/compat/rules/providers/openai-codex.kdl

@@ -69,9 +69,9 @@ provider "openai-codex" {
 				}
 			}
 		}
-		// First-party GPT-5 Responses SKUs support the freeform apply_patch
+		// First-party GPT-5/GPT-6 Responses SKUs support the freeform apply_patch
 		// custom tool with a Lark grammar.
-		revision ">=5 <6" {
+		revision ">=5 <7" {
 			apply-patch-tool-type "freeform"
 		}
 	}

package/src/compat/rules/providers/openai.kdl

@@ -40,7 +40,7 @@ provider "openai" {
 				reasoning-disable-mode "none-effort"
 			}
 		}
-		revision ">=5 <6" {
+		revision ">=5 <7" {
 			apply-patch-tool-type "freeform"
 		}
 	}

package/src/compat/rules.json

@@ -6224,7 +6224,46 @@
 				}
 			},
 			{
-				"source": "classes/openai.kdl:36",
+				"source": "classes/openai.kdl:37",
+				"class": "openai",
+				"revision": [
+					{
+						"op": "=",
+						"revision": "5.6.0"
+					}
+				],
+				"catalog": {
+					"delegationBias": "gated"
+				}
+			},
+			{
+				"source": "classes/openai.kdl:40",
+				"class": "openai",
+				"revision": [
+					{
+						"op": ">=",
+						"revision": "6.0.0"
+					}
+				],
+				"catalog": {
+					"delegationBias": "restrained"
+				}
+			},
+			{
+				"source": "classes/openai.kdl:46",
+				"class": "openai",
+				"models": [
+					{
+						"kind": "exact",
+						"value": "gpt-6-astra"
+					}
+				],
+				"wire": {
+					"supportsConfigurationUpdate": true
+				}
+			},
+			{
+				"source": "classes/openai.kdl:52",
 				"class": "openai",
 				"family": "codex",
 				"revision": [
@@ -10650,7 +10689,7 @@
 					},
 					{
 						"op": "<",
-						"revision": "6.0.0"
+						"revision": "7.0.0"
 					}
 				],
 				"catalog": {
@@ -10955,7 +10994,7 @@
 					},
 					{
 						"op": "<",
-						"revision": "6.0.0"
+						"revision": "7.0.0"
 					}
 				],
 				"catalog": {
@@ -14919,7 +14958,7 @@
 					"authorizeParams": {
 						"id_token_add_organizations": "true",
 						"codex_cli_simplified_flow": "true",
-						"originator": "pi"
+						"originator": "omp"
 					},
 					"clientId": {
 						"value": "app_EMoamEEZ73f0CkXaXp7hrann"
@@ -14934,6 +14973,7 @@
 						"hostname": "localhost",
 						"portFallback": false,
 						"manualOnly": false,
+						"nativeScheme": false,
 						"redirectUri": {
 							"value": "http://localhost:1455/auth/callback"
 						}
@@ -15031,7 +15071,8 @@
 						"path": "/callback",
 						"hostname": "localhost",
 						"portFallback": true,
-						"manualOnly": false
+						"manualOnly": false,
+						"nativeScheme": false
 					},
 					"token": {
 						"url": {
@@ -15153,16 +15194,20 @@
 						]
 					},
 					"callback": {
-						"port": 9999,
+						"port": 0,
 						"path": "/callback",
-						"hostname": "127.0.0.1",
-						"portFallback": false,
-						"manualOnly": false,
+						"hostname": "localhost",
+						"portFallback": true,
+						"manualOnly": true,
+						"nativeScheme": true,
 						"redirectUri": {
-							"value": "http://127.0.0.1:9999/callback"
+							"value": "zcode://zai-auth/callback",
+							"env": [
+								"ZAI_OAUTH_REDIRECT_URI"
+							]
 						}
 					},
-					"instructions": "Complete Z.ai login in your browser. If the browser cannot reach this machine, paste the final redirect URL or authorization code when prompted.",
+					"instructions": "Complete Z.ai login in your browser. On supported local desktops, omp captures the zcode:// callback and restores its previous handler automatically. You can also paste the final redirect URL or authorization code when prompted.",
 					"token": {
 						"url": {
 							"value": "https://zcode.z.ai/api/v1/oauth/token",
@@ -15203,7 +15248,7 @@
 				"refresh": {
 					"kind": "none"
 				},
-				"callbackPort": 9999,
+				"callbackPort": 0,
 				"pasteCode": true
 			},
 			{
@@ -15330,7 +15375,8 @@
 						"path": "/callback",
 						"hostname": "localhost",
 						"portFallback": true,
-						"manualOnly": false
+						"manualOnly": false,
+						"nativeScheme": false
 					},
 					"token": {
 						"url": {
@@ -15417,7 +15463,8 @@
 						"path": "/callback",
 						"hostname": "127.0.0.1",
 						"portFallback": true,
-						"manualOnly": false
+						"manualOnly": false,
+						"nativeScheme": false
 					},
 					"token": {
 						"url": {
@@ -15497,7 +15544,8 @@
 						"path": "/oauth-callback",
 						"hostname": "127.0.0.1",
 						"portFallback": true,
-						"manualOnly": false
+						"manualOnly": false,
+						"nativeScheme": false
 					},
 					"token": {
 						"url": {
@@ -15595,7 +15643,8 @@
 						"path": "/oauth2callback",
 						"hostname": "127.0.0.1",
 						"portFallback": true,
-						"manualOnly": false
+						"manualOnly": false,
+						"nativeScheme": false
 					},
 					"token": {
 						"url": {
@@ -15861,6 +15910,7 @@
 						"hostname": "localhost",
 						"portFallback": true,
 						"manualOnly": false,
+						"nativeScheme": false,
 						"redirectUri": {
 							"env": [
 								"GITLAB_REDIRECT_URI"
@@ -15955,6 +16005,7 @@
 						"hostname": "localhost",
 						"portFallback": true,
 						"manualOnly": true,
+						"nativeScheme": false,
 						"redirectUri": {
 							"value": "vscode://gitlab.gitlab-workflow/authentication"
 						}

package/src/compat/types.ts

@@ -422,7 +422,7 @@ export interface CompiledOAuthRequest {
 	timeoutMs?: number;
 }
 
-/** Loopback callback configuration for authorization-code logins. */
+/** Callback transport configuration for authorization-code logins. */
 export interface CompiledCallback {
 	port: number;
 	path: string;
@@ -430,9 +430,11 @@ export interface CompiledCallback {
 	redirectUri?: CompiledAuthValue;
 	portFallback: boolean;
 	manualOnly: boolean;
+	/** Temporarily receive a custom-scheme redirect through the native OS handler. */
+	nativeScheme: boolean;
 }
 
-/** Authorization-code login through the loopback callback server. */
+/** Authorization-code login through a loopback, native-scheme, or manual callback. */
 export interface CompiledOAuthCodeLogin {
 	kind: "oauth-code";
 	clientId?: CompiledAuthValue;

package/src/discovery/codex.ts

@@ -110,6 +110,13 @@ export interface CodexModelDiscoveryOptions {
 export interface CodexModelDiscoveryResult {
 	models: ModelSpec<"openai-codex-responses">[];
 	etag?: string;
+	/**
+	 * Set when the backend rejected the credential itself (401/403, e.g.
+	 * `token_revoked`); `models` is empty. A definitive per-account denial,
+	 * unlike the `null` result for transport/parse failures, so multi-account
+	 * discovery can skip the account instead of aborting.
+	 */
+	rejectedStatus?: 401 | 403;
 }
 
 /**
@@ -139,6 +146,9 @@ export async function fetchCodexModels(options: CodexModelDiscoveryOptions): Pro
 			continue;
 		}
 
+		if (response.status === 401 || response.status === 403) {
+			return { models: [], rejectedStatus: response.status };
+		}
 		if (!response.ok) {
 			continue;
 		}