@opengeni/core 3.0.1 → 3.1.2

package/src/model-catalog.ts

@@ -1,19 +1,29 @@
 import { modelAllowedByConnections, type ConnectionModelRestrictions } from "@opengeni/db";
 import {
+  withDirectModelProviders,
   applyModelCatalogDocument,
+  CLAUDE_CONNECTION_KINDS,
+  claudeProviderId,
+  withClaudeConnectionCatalog,
+  type ClaudeConnectionCatalog,
   configuredGatewayWorkspaceProductModelIds,
   configuredGatewayOrganizationProductModelIds,
   configuredModels,
+  isModelAvailableForNewSelection,
   configuredModelNotes,
   configuredOpenRouterWorkspaceProductModelIds,
   configuredOpenRouterOrganizationProductModelIds,
+  configuredOpperWorkspaceProductModelIds,
+  configuredOpperOrganizationProductModelIds,
   configuredProviders,
   validateModelCatalogSettings,
   withCodexCatalogProvider,
   withOrganizationGatewayCatalogProvider,
   withOrganizationOpenRouterCatalogProvider,
+  withOrganizationOpperCatalogProvider,
   withWorkspaceGatewayCatalogProvider,
   withWorkspaceOpenRouterCatalogProvider,
+  withWorkspaceOpperCatalogProvider,
   withXaiSubscriptionCatalogProvider,
   WORKSPACE_GATEWAY_MODEL_ID_PREFIX,
   WORKSPACE_OPENROUTER_MODEL_ID_PREFIX,
@@ -21,6 +31,10 @@ import {
   ORGANIZATION_OPENROUTER_PROVIDER_ID,
   ORGANIZATION_GATEWAY_MODEL_ID_PREFIX,
   ORGANIZATION_OPENROUTER_MODEL_ID_PREFIX,
+  WORKSPACE_OPPER_MODEL_ID_PREFIX,
+  WORKSPACE_OPPER_PROVIDER_ID,
+  ORGANIZATION_OPPER_MODEL_ID_PREFIX,
+  ORGANIZATION_OPPER_PROVIDER_ID,
   type ConfiguredModel,
   type Settings,
 } from "@opengeni/config";
@@ -31,17 +45,21 @@ import {
   type WorkspaceModelPolicyContract,
 } from "@opengeni/contracts";
 import {
+  listConnectionsMetadata,
   getDeploymentModelCatalog,
+  listWorkspaceProviderCustomModelsByKind,
+  getWorkspaceProviderCustomModelForExecution,
+  lockActiveWorkspaceProviderCustomModelForAdmission,
   getWorkspaceGatewayCustomModelForExecution,
   getWorkspaceOpenRouterCustomModelForExecution,
   getOrganizationModelProviderCustomModelForExecution,
-  listWorkspaceGatewayCustomModels,
-  listWorkspaceOpenRouterCustomModels,
-  listOrganizationModelProviderCustomModelsForWorkspace,
+  getOrganizationModelProviderCatalogForWorkspace,
   lockActiveOrganizationModelProviderCustomModelForAdmission,
-  lockActiveWorkspaceGatewayCustomModelForAdmission,
-  lockActiveWorkspaceOpenRouterCustomModelForAdmission,
   type Database,
+  type OrganizationClaudeModelAdmissionAuthority,
+  type WorkspaceCustomModelProviderKind,
+  type WorkspaceGatewayCustomModel,
+  type WorkspaceOpenRouterCustomModel,
 } from "@opengeni/db";
 
 export type ResolvedCatalogSettings = {
@@ -70,9 +88,16 @@ export function isWorkspaceOpenRouterCustomModelId(settings: Settings, modelId:
   );
 }
 
+export function isWorkspaceOpperCustomModelId(settings: Settings, modelId: string): boolean {
+  return (
+    modelId.startsWith(WORKSPACE_OPPER_MODEL_ID_PREFIX) &&
+    !configuredOpperWorkspaceProductModelIds(settings).includes(modelId)
+  );
+}
+
 export type WorkspaceCustomModelReference = {
   scope: "workspace" | "organization";
-  providerKind: "vercel_gateway" | "openrouter";
+  providerKind: "vercel_gateway" | "openrouter" | "anthropic" | "claude_subscription" | "opper";
   upstreamModelId: string;
 };
 
@@ -80,6 +105,16 @@ export function workspaceCustomModelReference(
   settings: Settings,
   modelId: string,
 ): WorkspaceCustomModelReference | null {
+  for (const scope of ["workspace", "organization"] as const)
+    for (const kind of CLAUDE_CONNECTION_KINDS) {
+      const prefix = claudeProviderId(kind, scope) + "/";
+      if (modelId.startsWith(prefix))
+        return {
+          scope,
+          providerKind: kind,
+          upstreamModelId: modelId.slice(prefix.length),
+        };
+    }
   if (isWorkspaceGatewayCustomModelId(settings, modelId)) {
     return {
       scope: "workspace",
@@ -94,6 +129,23 @@ export function workspaceCustomModelReference(
       upstreamModelId: modelId.slice(WORKSPACE_OPENROUTER_MODEL_ID_PREFIX.length),
     };
   }
+  if (isWorkspaceOpperCustomModelId(settings, modelId)) {
+    return {
+      scope: "workspace",
+      providerKind: "opper",
+      upstreamModelId: modelId.slice(WORKSPACE_OPPER_MODEL_ID_PREFIX.length),
+    };
+  }
+  if (
+    modelId.startsWith(ORGANIZATION_OPPER_MODEL_ID_PREFIX) &&
+    !configuredOpperOrganizationProductModelIds(settings).includes(modelId)
+  ) {
+    return {
+      scope: "organization",
+      providerKind: "opper",
+      upstreamModelId: modelId.slice(ORGANIZATION_OPPER_MODEL_ID_PREFIX.length),
+    };
+  }
   if (
     modelId.startsWith(ORGANIZATION_GATEWAY_MODEL_ID_PREFIX) &&
     !configuredGatewayOrganizationProductModelIds(settings).includes(modelId)
@@ -127,6 +179,12 @@ export async function lockActiveCustomModelForAdmission(
     accountId: string;
     workspaceId: string;
     reference: WorkspaceCustomModelReference;
+    /**
+     * The accepted Claude authority this admission re-reads. Every caller
+     * states it: an organization Claude model is never admitted without it,
+     * so an omitted value would refuse that model silently.
+     */
+    claudeAuthority: OrganizationClaudeModelAdmissionAuthority | null;
   },
 ): Promise<boolean> {
   if (input.reference.scope === "organization") {
@@ -135,22 +193,18 @@ export async function lockActiveCustomModelForAdmission(
         accountId: input.accountId,
         workspaceId: input.workspaceId,
         providerKind: input.reference.providerKind,
+        ...(input.claudeAuthority ? { claudeAuthority: input.claudeAuthority } : {}),
         upstreamModelId: input.reference.upstreamModelId,
       }),
     );
   }
   return Boolean(
-    input.reference.providerKind === "openrouter"
-      ? await lockActiveWorkspaceOpenRouterCustomModelForAdmission(db, {
-          accountId: input.accountId,
-          workspaceId: input.workspaceId,
-          upstreamModelId: input.reference.upstreamModelId,
-        })
-      : await lockActiveWorkspaceGatewayCustomModelForAdmission(db, {
-          accountId: input.accountId,
-          workspaceId: input.workspaceId,
-          upstreamModelId: input.reference.upstreamModelId,
-        }),
+    await lockActiveWorkspaceProviderCustomModelForAdmission(db, {
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      providerKind: input.reference.providerKind,
+      upstreamModelId: input.reference.upstreamModelId,
+    }),
   );
 }
 
@@ -233,25 +287,48 @@ export async function resolveWorkspaceCatalogSettings(
         ? [productModelId.slice(ORGANIZATION_OPENROUTER_MODEL_ID_PREFIX.length)]
         : [],
   );
+  const retainedOpperUpstreamModelIds = retainedProductModelIds.flatMap((productModelId) =>
+    productModelId?.startsWith(WORKSPACE_OPPER_MODEL_ID_PREFIX)
+      ? [productModelId.slice(WORKSPACE_OPPER_MODEL_ID_PREFIX.length)]
+      : [],
+  );
+  const retainedOrganizationOpperUpstreamModelIds = retainedProductModelIds.flatMap(
+    (productModelId) =>
+      productModelId?.startsWith(ORGANIZATION_OPPER_MODEL_ID_PREFIX)
+        ? [productModelId.slice(ORGANIZATION_OPPER_MODEL_ID_PREFIX.length)]
+        : [],
+  );
+  // One scoped read per catalog family instead of one scoped transaction per
+  // provider kind. The batched readers keep each provider's filters, bound and
+  // overflow error. The Claude subscription flag is env-only (the catalog
+  // document never changes it), so it decides the requested kinds up front.
+  const workspaceCustomModelKinds: WorkspaceCustomModelProviderKind[] = [
+    "vercel_gateway",
+    "openrouter",
+    "opper",
+    ...(supportsOrganizationProviderReads
+      ? CLAUDE_CONNECTION_KINDS.filter(
+          (kind) => kind !== "claude_subscription" || envSettings.claudeSubscriptionEnabled,
+        )
+      : []),
+  ];
   const [
     resolved,
-    activeGatewayCustomModels,
-    activeOpenRouterCustomModels,
+    workspaceCustomModels,
     retainedGatewayCustomModels,
     retainedOpenRouterCustomModels,
-    organizationGatewayCustomModels,
-    organizationOpenRouterCustomModels,
+    organizationProviders,
     retainedOrganizationGatewayCustomModels,
     retainedOrganizationOpenRouterCustomModels,
+    directConnections,
+    retainedOpperCustomModels,
+    retainedOrganizationOpperCustomModels,
   ] = await Promise.all([
     resolveCatalogSettings(db, envSettings),
-    listWorkspaceGatewayCustomModels(db, {
-      accountId: input.accountId,
-      workspaceId: input.workspaceId,
-    }),
-    listWorkspaceOpenRouterCustomModels(db, {
+    listWorkspaceProviderCustomModelsByKind(db, {
       accountId: input.accountId,
       workspaceId: input.workspaceId,
+      providerKinds: workspaceCustomModelKinds,
     }),
     Promise.all(
       [...new Set(retainedGatewayUpstreamModelIds)].map(
@@ -274,19 +351,12 @@ export async function resolveWorkspaceCatalogSettings(
       ),
     ),
     supportsOrganizationProviderReads
-      ? listOrganizationModelProviderCustomModelsForWorkspace(db, {
+      ? getOrganizationModelProviderCatalogForWorkspace(db, {
           accountId: input.accountId,
           workspaceId: input.workspaceId,
-          providerKind: "vercel_gateway",
+          providerKinds: ["vercel_gateway", "openrouter", "opper", ...CLAUDE_CONNECTION_KINDS],
         })
-      : Promise.resolve([]),
-    supportsOrganizationProviderReads
-      ? listOrganizationModelProviderCustomModelsForWorkspace(db, {
-          accountId: input.accountId,
-          workspaceId: input.workspaceId,
-          providerKind: "openrouter",
-        })
-      : Promise.resolve([]),
+      : null,
     supportsOrganizationProviderReads
       ? Promise.all(
           [...new Set(retainedOrganizationGatewayUpstreamModelIds)].map(
@@ -313,6 +383,33 @@ export async function resolveWorkspaceCatalogSettings(
           ),
         )
       : Promise.resolve([]),
+    supportsOrganizationProviderReads
+      ? listConnectionsMetadata(db, input.workspaceId, null)
+      : Promise.resolve([]),
+    Promise.all(
+      [...new Set(retainedOpperUpstreamModelIds)].map(
+        async (upstreamModelId) =>
+          await getWorkspaceProviderCustomModelForExecution(db, {
+            accountId: input.accountId,
+            workspaceId: input.workspaceId,
+            providerKind: "opper",
+            upstreamModelId,
+          }),
+      ),
+    ),
+    supportsOrganizationProviderReads
+      ? Promise.all(
+          [...new Set(retainedOrganizationOpperUpstreamModelIds)].map(
+            async (upstreamModelId) =>
+              await getOrganizationModelProviderCustomModelForExecution(db, {
+                accountId: input.accountId,
+                workspaceId: input.workspaceId,
+                providerKind: "opper",
+                upstreamModelId,
+              }),
+          ),
+        )
+      : Promise.resolve([]),
   ]);
   const includeRetainedModels = <T extends { upstreamModelId: string }>(
     activeModels: readonly T[],
@@ -332,32 +429,91 @@ export async function resolveWorkspaceCatalogSettings(
     return customModels;
   };
   const gatewayCustomModels = includeRetainedModels(
-    activeGatewayCustomModels,
+    workspaceCustomModels.vercel_gateway as WorkspaceGatewayCustomModel[],
     retainedGatewayCustomModels,
   );
   const openRouterCustomModels = includeRetainedModels(
-    activeOpenRouterCustomModels,
+    workspaceCustomModels.openrouter as WorkspaceOpenRouterCustomModel[],
     retainedOpenRouterCustomModels,
   );
   const organizationGatewayModels = includeRetainedModels(
-    organizationGatewayCustomModels,
+    organizationProviders?.vercel_gateway.models ?? [],
     retainedOrganizationGatewayCustomModels,
   );
   const organizationOpenRouterModels = includeRetainedModels(
-    organizationOpenRouterCustomModels,
+    organizationProviders?.openrouter.models ?? [],
     retainedOrganizationOpenRouterCustomModels,
   );
+  const opperCustomModels = includeRetainedModels(
+    workspaceCustomModels.opper ?? [],
+    retainedOpperCustomModels,
+  );
+  const organizationOpperModels = includeRetainedModels(
+    organizationProviders?.opper.models ?? [],
+    retainedOrganizationOpperCustomModels,
+  );
+  const claudeConnections: ClaudeConnectionCatalog = {};
+  if (organizationProviders)
+    for (const kind of CLAUDE_CONNECTION_KINDS) {
+      const models = [...organizationProviders[kind].models];
+      const prefix = claudeProviderId(kind) + "/";
+      for (const productId of retainedProductModelIds)
+        if (productId?.startsWith(prefix)) {
+          const retained = await getOrganizationModelProviderCustomModelForExecution(db, {
+            accountId: input.accountId,
+            workspaceId: input.workspaceId,
+            providerKind: kind,
+            upstreamModelId: productId.slice(prefix.length),
+          });
+          if (retained && !models.some((model) => model.id === retained.id)) models.push(retained);
+        }
+      claudeConnections[kind] = { models };
+    }
+  const workspaceClaudeConnections: ClaudeConnectionCatalog = {};
+  if (supportsOrganizationProviderReads)
+    for (const kind of CLAUDE_CONNECTION_KINDS) {
+      if (kind === "claude_subscription" && !resolved.settings.claudeSubscriptionEnabled) continue;
+      const models = [...workspaceCustomModels[kind]];
+      const prefix = claudeProviderId(kind, "workspace") + "/";
+      for (const productId of retainedProductModelIds) {
+        if (!productId?.startsWith(prefix)) continue;
+        const retained = await getWorkspaceProviderCustomModelForExecution(db, {
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          providerKind: kind,
+          upstreamModelId: productId.slice(prefix.length),
+        });
+        if (retained && !models.some((model) => model.id === retained.id)) models.push(retained);
+      }
+      workspaceClaudeConnections[kind] = { models };
+    }
   return {
     ...resolved,
-    settings: withOrganizationOpenRouterCatalogProvider(
-      withOrganizationGatewayCatalogProvider(
-        withWorkspaceOpenRouterCatalogProvider(
-          withWorkspaceGatewayCatalogProvider(resolved.settings, gatewayCustomModels),
-          openRouterCustomModels,
+    settings: withDirectModelProviders(
+      withClaudeConnectionCatalog(
+        withClaudeConnectionCatalog(
+          withOrganizationOpperCatalogProvider(
+            withWorkspaceOpperCatalogProvider(
+              withOrganizationOpenRouterCatalogProvider(
+                withOrganizationGatewayCatalogProvider(
+                  withWorkspaceOpenRouterCatalogProvider(
+                    withWorkspaceGatewayCatalogProvider(resolved.settings, gatewayCustomModels),
+                    openRouterCustomModels,
+                  ),
+                  organizationGatewayModels,
+                ),
+                organizationOpenRouterModels,
+              ),
+              opperCustomModels,
+            ),
+            organizationOpperModels,
+          ),
+          claudeConnections,
         ),
-        organizationGatewayModels,
+        workspaceClaudeConnections,
+        "workspace",
       ),
-      organizationOpenRouterModels,
+      directConnections,
     ),
   };
 }
@@ -387,8 +543,12 @@ export type WorkspaceModelSelectionInput = {
   xaiSubscriptionActive?: boolean;
   workspaceGatewayConnectionActive?: boolean;
   workspaceOpenRouterConnectionActive?: boolean;
+  workspaceOpperConnectionActive?: boolean;
+  claudeConnections?: ClaudeConnectionCatalog;
+  workspaceClaudeConnections?: ClaudeConnectionCatalog;
   organizationGatewayConnectionActive?: boolean;
   organizationOpenRouterConnectionActive?: boolean;
+  organizationOpperConnectionActive?: boolean;
   workspaceGatewayCustomModels?: readonly {
     upstreamModelId: string;
     label?: string | null;
@@ -405,6 +565,14 @@ export type WorkspaceModelSelectionInput = {
     upstreamModelId: string;
     label?: string | null;
   }[];
+  workspaceOpperCustomModels?: readonly {
+    upstreamModelId: string;
+    label?: string | null;
+  }[];
+  organizationOpperCustomModels?: readonly {
+    upstreamModelId: string;
+    label?: string | null;
+  }[];
   credentialReadinessObservations?:
     | Readonly<Record<string, ModelCredentialReadinessObservation>>
     | undefined;
@@ -428,6 +596,23 @@ function modelDefinitionRunnable(model: ConfiguredModel): boolean {
   );
 }
 
+/**
+ * Stable fresh-selection admission, independent of transient observations.
+ * Missing catalog membership is handled by the caller's lookup. Resolver-based
+ * deployment credentials (Azure AD/managed identity) are resolved at execution;
+ * absent, stale or failed observations cannot make their definition uncreatable.
+ */
+export function isWorkspaceModelAdmissible(selection: WorkspaceModelSelection): boolean {
+  if (!modelDefinitionRunnable(selection.model) || !selection.policyAllowed) return false;
+  const source = selection.model.credentialSource;
+  if (source.kind === "deployment") {
+    return source.mechanism !== "api_key" || selection.credentialReadiness.status === "ready";
+  }
+  // Connected subscriptions and workspace/organization connections have a
+  // durable active/reauth prerequisite, unlike deployment credential resolvers.
+  return selection.credentialReadiness.status === "ready";
+}
+
 function observedCredentialReadiness(input: {
   observation: ModelCredentialReadinessObservation | undefined;
   basis: "connection" | "resolver";
@@ -487,8 +672,12 @@ function credentialReadinessFor(input: {
   xaiSubscriptionActive: boolean;
   workspaceGatewayConnectionActive: boolean;
   workspaceOpenRouterConnectionActive: boolean;
+  workspaceOpperConnectionActive: boolean;
+  claudeConnections?: ClaudeConnectionCatalog | undefined;
+  workspaceClaudeConnections?: ClaudeConnectionCatalog | undefined;
   organizationGatewayConnectionActive: boolean;
   organizationOpenRouterConnectionActive: boolean;
+  organizationOpperConnectionActive: boolean;
   observation: ModelCredentialReadinessObservation | undefined;
   nowMs: number;
   maxAgeMs: number;
@@ -496,7 +685,14 @@ function credentialReadinessFor(input: {
   const source = input.model.credentialSource;
   if (source.kind === "connected_subscription") {
     const active =
-      source.provider === "xai" ? input.xaiSubscriptionActive : input.codexSubscriptionActive;
+      source.provider === "xai"
+        ? input.xaiSubscriptionActive
+        : source.provider === "claude"
+          ? (input.model.providerId === claudeProviderId("claude_subscription", "workspace")
+              ? input.workspaceClaudeConnections
+              : input.claudeConnections
+            )?.claude_subscription?.active === true
+          : input.codexSubscriptionActive;
     return active
       ? { status: "ready", reason: null, basis: "connection", checkedAt: null }
       : {
@@ -507,10 +703,20 @@ function credentialReadinessFor(input: {
         };
   }
   if (source.kind === "workspace_connection") {
+    const claudeKind = CLAUDE_CONNECTION_KINDS.find(
+      (kind) => claudeProviderId(kind, "workspace") === input.model.providerId,
+    );
     const connectionActive =
-      input.model.providerId === WORKSPACE_OPENROUTER_PROVIDER_ID
-        ? input.workspaceOpenRouterConnectionActive
-        : input.workspaceGatewayConnectionActive;
+      input.provider?.kind === "direct-openai-workspace" ||
+      input.provider?.kind === "direct-azure-workspace"
+        ? true
+        : claudeKind
+          ? input.workspaceClaudeConnections?.[claudeKind]?.active === true
+          : input.model.providerId === WORKSPACE_OPENROUTER_PROVIDER_ID
+            ? input.workspaceOpenRouterConnectionActive
+            : input.model.providerId === WORKSPACE_OPPER_PROVIDER_ID
+              ? input.workspaceOpperConnectionActive
+              : input.workspaceGatewayConnectionActive;
     return connectionActive
       ? { status: "ready", reason: null, basis: "connection", checkedAt: null }
       : {
@@ -521,10 +727,16 @@ function credentialReadinessFor(input: {
         };
   }
   if (source.kind === "organization_connection") {
-    const connectionActive =
-      input.model.providerId === ORGANIZATION_OPENROUTER_PROVIDER_ID
+    const claudeKind = CLAUDE_CONNECTION_KINDS.find(
+      (kind) => claudeProviderId(kind) === input.model.providerId,
+    );
+    const connectionActive = claudeKind
+      ? input.claudeConnections?.[claudeKind]?.active === true
+      : input.model.providerId === ORGANIZATION_OPENROUTER_PROVIDER_ID
         ? input.organizationOpenRouterConnectionActive
-        : input.organizationGatewayConnectionActive;
+        : input.model.providerId === ORGANIZATION_OPPER_PROVIDER_ID
+          ? input.organizationOpperConnectionActive
+          : input.organizationGatewayConnectionActive;
     return connectionActive
       ? { status: "ready", reason: null, basis: "connection", checkedAt: null }
       : {
@@ -610,6 +822,8 @@ function availabilityFor(input: {
   model: ConfiguredModel;
   credentialReadiness: ModelCredentialReadinessV1;
   policyAllowed: boolean;
+  /** Blocked only because the workspace turned Opengeni credits off. */
+  creditsDisabled?: boolean;
   observation?: ModelAvailabilityObservation | undefined;
   nowMs: number;
   maxAgeMs: number;
@@ -639,7 +853,7 @@ function availabilityFor(input: {
     return {
       status: "unavailable",
       selectable: false,
-      reason: "policy_blocked",
+      reason: input.creditsDisabled ? "credits_disabled" : "policy_blocked",
       checkedAt: null,
     };
   }
@@ -683,15 +897,31 @@ export function resolveWorkspaceModelSelection(
   const xaiSettings = input.settings.supergrokSubscriptionEnabled
     ? withXaiSubscriptionCatalogProvider(codexSettings)
     : codexSettings;
-  const catalogSettings = withOrganizationOpenRouterCatalogProvider(
-    withOrganizationGatewayCatalogProvider(
-      withWorkspaceOpenRouterCatalogProvider(
-        withWorkspaceGatewayCatalogProvider(xaiSettings, input.workspaceGatewayCustomModels ?? []),
-        input.workspaceOpenRouterCustomModels ?? [],
+  const catalogSettings = withClaudeConnectionCatalog(
+    withClaudeConnectionCatalog(
+      withOrganizationOpperCatalogProvider(
+        withWorkspaceOpperCatalogProvider(
+          withOrganizationOpenRouterCatalogProvider(
+            withOrganizationGatewayCatalogProvider(
+              withWorkspaceOpenRouterCatalogProvider(
+                withWorkspaceGatewayCatalogProvider(
+                  xaiSettings,
+                  input.workspaceGatewayCustomModels ?? [],
+                ),
+                input.workspaceOpenRouterCustomModels ?? [],
+              ),
+              input.organizationGatewayCustomModels ?? [],
+            ),
+            input.organizationOpenRouterCustomModels ?? [],
+          ),
+          input.workspaceOpperCustomModels ?? [],
+        ),
+        input.organizationOpperCustomModels ?? [],
       ),
-      input.organizationGatewayCustomModels ?? [],
+      input.claudeConnections ?? {},
     ),
-    input.organizationOpenRouterCustomModels ?? [],
+    input.workspaceClaudeConnections ?? {},
+    "workspace",
   );
   const providers = new Map(
     configuredProviders(catalogSettings).map((provider) => [provider.id, provider]),
@@ -708,38 +938,62 @@ export function resolveWorkspaceModelSelection(
       ? input.credentialReadinessMaxAgeMs
       : MODEL_CREDENTIAL_READINESS_OBSERVATION_MAX_AGE_MS;
 
-  return configuredModels(catalogSettings).map((model) => {
-    const provider = providers.get(model.providerId);
-    const policyAllowed =
-      evaluateWorkspaceModelPolicy(input.policy, {
+  return configuredModels(catalogSettings)
+    .filter((model) => isModelAvailableForNewSelection(catalogSettings, model.id))
+    .map((model) => {
+      const provider = providers.get(model.providerId);
+      const verdict = evaluateWorkspaceModelPolicy(input.policy, {
         providerId: model.providerId,
         modelId: model.id,
-      }).allowed && modelAllowedByConnections(input.connectionModelRestrictions ?? {}, model.id);
-    const credentialReadiness = credentialReadinessFor({
-      model,
-      provider,
-      codexSubscriptionActive: input.codexSubscriptionActive,
-      xaiSubscriptionActive: input.xaiSubscriptionActive === true,
-      workspaceGatewayConnectionActive: input.workspaceGatewayConnectionActive === true,
-      workspaceOpenRouterConnectionActive: input.workspaceOpenRouterConnectionActive === true,
-      organizationGatewayConnectionActive: input.organizationGatewayConnectionActive === true,
-      organizationOpenRouterConnectionActive: input.organizationOpenRouterConnectionActive === true,
-      observation: input.credentialReadinessObservations?.[model.definitionVersion],
-      nowMs,
-      maxAgeMs,
-    });
-    return {
-      model,
-      credentialReadiness,
-      policyAllowed,
-      availability: availabilityFor({
+        chargesCredits: model.cost === "credits",
+      });
+      const allowedByConnections = modelAllowedByConnections(
+        input.connectionModelRestrictions ?? {},
+        model.id,
+      );
+      const policyAllowed = verdict.allowed && allowedByConnections;
+      // Name the credit switch only when it is the sole reason; an allowlist
+      // or connection restriction keeps the generic policy reason.
+      const creditsDisabled =
+        !verdict.allowed &&
+        verdict.reason === "credits" &&
+        allowedByConnections &&
+        input.policy != null &&
+        evaluateWorkspaceModelPolicy(
+          { ...input.policy, allowCreditModels: true },
+          { providerId: model.providerId, modelId: model.id, chargesCredits: true },
+        ).allowed;
+      const credentialReadiness = credentialReadinessFor({
         model,
-        credentialReadiness,
-        policyAllowed,
-        observation: input.observations?.[model.definitionVersion],
+        provider,
+        codexSubscriptionActive: input.codexSubscriptionActive,
+        xaiSubscriptionActive: input.xaiSubscriptionActive === true,
+        workspaceGatewayConnectionActive: input.workspaceGatewayConnectionActive === true,
+        workspaceOpenRouterConnectionActive: input.workspaceOpenRouterConnectionActive === true,
+        workspaceOpperConnectionActive: input.workspaceOpperConnectionActive === true,
+        claudeConnections: input.claudeConnections,
+        workspaceClaudeConnections: input.workspaceClaudeConnections,
+        organizationGatewayConnectionActive: input.organizationGatewayConnectionActive === true,
+        organizationOpenRouterConnectionActive:
+          input.organizationOpenRouterConnectionActive === true,
+        organizationOpperConnectionActive: input.organizationOpperConnectionActive === true,
+        observation: input.credentialReadinessObservations?.[model.definitionVersion],
         nowMs,
         maxAgeMs,
-      }),
-    };
-  });
+      });
+      return {
+        model,
+        credentialReadiness,
+        policyAllowed,
+        availability: availabilityFor({
+          model,
+          credentialReadiness,
+          policyAllowed,
+          creditsDisabled,
+          observation: input.observations?.[model.definitionVersion],
+          nowMs,
+          maxAgeMs,
+        }),
+      };
+    });
 }