@yansigit/opencodex 2.33.0 → 2.35.0

package/src/types/config.ts

@@ -255,8 +255,19 @@ export interface OcxSubagentRole {
   enabled?: boolean;
 }
 
+export interface OcxConfigRebaseProvenance {
+  version: 1;
+  deletedTopLevelKeys: string[];
+}
+
 export interface OcxConfig {
   port: number;
+  autonomousRemediation?: {
+    enabled?: boolean;
+    instanceId?: string;
+    threshold?: number;
+    rollingWindowMs?: number;
+  };
   /** Opt in to one identical-turn retry when a Responses completion has no text or tool call. */
   emptyCompletionRetry?: boolean;
   /**
@@ -276,6 +287,22 @@ export interface OcxConfig {
   managementUsageMaxReadBytes?: number;
   providers: Record<string, OcxProviderConfig>;
   defaultProvider: string;
+  /** Persisted state for newly discovered provider models (#2464). Absent keeps legacy "on" behavior. */
+  modelDiscovery?: {
+    newModelPolicy?: "on" | "off";
+    knownModels?: Record<string, {
+      ids: string[];
+      removed: string[];
+      updatedAt: string;
+      /** Consecutive successful discoveries in which an active id was absent. */
+      missing?: Record<string, number>;
+    }>;
+    recentArrivals?: Record<string, Array<{ id: string; at: string }>>;
+  };
+  /** Enable the shipped model alias patterns for providers without an override. */
+  defaultModelAliases?: boolean;
+  /** Explicit top-level deletion intent used by stale whole-config rebases. */
+  configRebaseProvenance?: OcxConfigRebaseProvenance | Record<string, unknown>;
   /** OpenAI provider-contract migration marker (v2 = single `openai` provider with account mode). */
   openaiProviderTierVersion?: 1 | 2;
   /** One-time migration marker for Antigravity's static-catalog defaults. */
@@ -294,12 +321,7 @@ export interface OcxConfig {
    * into a selector-qualified group; Codex still advertises only the first 5 visible rows.
    */
   subagentModels?: string[];
-  /**
-   * Named specialist roles the parent may spawn: id, when-to-use description,
-   * model, optional effort, and child developer instructions. Max 8 roles and
-   * 5 unique enabled models (the spawn picker window). Do not store
-   * `model_fallback` here — use `subagentModelFallbackByModel`.
-   */
+  /** Named specialist roles the parent may spawn by id. */
   subagentRoles?: OcxSubagentRole[];
   /**
    * Project enabled roles into marker-owned `$CODEX_HOME/agents/ocx-<id>.toml`.
@@ -338,6 +360,10 @@ export interface OcxConfig {
    * reject the whole role file as an unknown field (#1190).
    */
   subagentModelFallbackByModel?: Record<string, string[]>;
+  /**
+   * Ordered candidates for spawned sub-agents, globally or keyed by role/model.
+   */
+  subagentCandidates?: string[] | Record<string, string[]>;
   /**
    * TTL (ms) for cached sub-agent model availability probes. Default 60_000.
    */
@@ -402,9 +428,7 @@ export interface OcxConfig {
    * remain unchanged),
    * `{{effort}}` -> injectionEffort, `{{roster}}` -> the resolved sub-agent roster
    * block ("" when nothing resolves), `{{fallback}}` -> the configured subagent
-   * model fallback guidance block ("" when unset), `{{roles}}` -> the compact
-   * enabled role catalog ("" when none). A custom prompt replaces the built-in
-   * body; include `{{roles}}` to keep the catalog.
+   * model fallback guidance block ("" when unset).
    */
   injectionPrompt?: string;
   /**
@@ -468,12 +492,12 @@ export interface OcxConfig {
    * Routed parents get v2 tools; Sol/Terra can still spawn Grok/Claude (issue #92).
    */
   keepNativeChatGptOnV1?: boolean;
-  /** Experimental routed target for eligible native V2 root parents. */
+  /** Optional v2-native parent override for spawn_agent routing. */
   v2NativeParentOverride?: { enabled?: boolean; model?: string };
   /** Experimental, default-off ChatGPT recovery for encrypted V2 routed tasks. */
   agentTaskRecovery?: {
     enabled?: boolean;
-    /** ChatGPT model used by the recovery request. Default: gpt-5.6-luna. */
+    /** ChatGPT model used by the recovery request. Default: gpt-5.6-sol. */
     model?: string;
     /** Recovery request timeout in milliseconds. Default: 45000. */
     timeoutMs?: number;
@@ -516,6 +540,13 @@ export interface OcxConfig {
    * those are unset — Bun's fetch honors them for all outbound calls; localhost is excluded.
    */
   proxy?: string;
+  /**
+   * Hosts that bypass `proxy` for OpenCodex's own outbound provider calls, merged into
+   * NO_PROXY at startup. Accepts a comma-separated string (NO_PROXY syntax) or an array.
+   * Loopback is always excluded regardless of this setting, and an inherited NO_PROXY is
+   * preserved — this ADDS entries, it never replaces the environment.
+   */
+  noProxy?: string | string[];
   /**
    * Upstream stall timeout (seconds). After this many seconds of no upstream data, emits
    * response.incomplete. Default 300. Min 1.
@@ -587,6 +618,15 @@ export interface OcxConfig {
    * selector map remains visible for compatibility with hand-written configurations.
    */
   codexAccountPickerEnabled?: boolean;
+  /**
+   * Show the GPT-5.3-Codex-Spark weekly window on Codex quota surfaces. Default false.
+   *
+   * Spark is a single-model window that reads 0% for most operators, and on a multi-account
+   * pool it doubles the bar count for information almost nobody acts on. Hidden by default and
+   * revealed by an explicit `true`; a malformed value reads as hidden rather than rejecting the
+   * whole config.
+   */
+  showCodexSparkQuota?: boolean;
   /** Active pool account id for next session. undefined = main (passthrough as-is). */
   activeCodexAccountId?: string;
   /** Auto-switch threshold (0-100). Default 80. 0 = disabled. */
@@ -617,10 +657,22 @@ export interface OcxConfig {
     stickyLimit?: number;
   };
   /**
-   * Opt-in Cursor OAuth account pool. Default OFF.
-   * Sticky `_clientThreadId` affinity + bounded 429/auth failover when ≥2 OAuth accounts exist.
-   * Does not wire weighted-round-robin `CursorCredentialRouter`.
+   * Generic OAuth multi-account 429 failover (#2568). Presence-driven by default.
+   *
+   * Rotates to another logged-in account of the SAME provider when one is rate-limited, for
+   * OAuth providers that have no pool of their own — xAI, Cursor, Kimi, GitHub Copilot,
+   * Antigravity, Nous. The Codex pool and the Anthropic pool own their own rotation and are
+   * excluded; this setting changes neither.
+   *
+   * With the key absent, rotation activates when a provider has 2 or more eligible stored
+   * accounts — the same consent rule API-key pools already apply to a 2+ key pool (#2568d). A
+   * single account is a strict no-op. Set `false` to keep strict single-account behaviour;
+   * `providers.<name>.oauthAccountFailover` overrides this per provider.
    */
+  oauthAccountFailover?: {
+    enabled?: boolean;
+  };
+  /** Cursor OAuth account pool rotation for api2.cursor.sh. */
   cursorAccountPool?: {
     enabled?: boolean;
   };

package/src/types/provider.ts

@@ -119,6 +119,15 @@ export interface TierObservationContext {
   fastWire: FastWire | null;
   demandDecision: "force-fast" | "force-default" | "inherit";
   callerTier?: string;
+  /**
+   * Whether the destination's echoed `service_tier` is authoritative about Fast scheduling.
+   *
+   * The ChatGPT-internal Codex backend returns `service_tier: "default"` on turns that were in
+   * fact scheduled as priority, so treating its echo as a downgrade produced a false
+   * `response-declined` on every Fast request (#2558). Absent means "assume authoritative",
+   * preserving the behaviour for the public API where the echo does mean what it says.
+   */
+  responseTierAuthoritative?: boolean;
 }
 
 export type TierDecision =
@@ -131,6 +140,12 @@ export type TierDecision =
  * retries are allowed; OAuth/forward credentials and local runtimes are never replayed.
  */
 export interface OcxProviderConfig {
+  /** Optional short provider namespace used only at request/catalog presentation time. */
+  alias?: string;
+  /** Native model id -> short, slash-free request alias. */
+  modelAliases?: Record<string, string>;
+  /** Override the global built-in model-alias switch for this provider. */
+  defaultAliases?: boolean;
   adapter: string;
   /**
    * Codex tool calling mode for routed models.
@@ -227,6 +242,19 @@ export interface OcxProviderConfig {
    * link-local, or unique-local upstreams. Metadata endpoints remain blocked.
    */
   allowPrivateNetwork?: boolean;
+  /**
+   * ChatGPT Codex backend WebSocket upstream transport.
+   * Defaults to false (routes streaming turns over standard HTTP/SSE).
+   * Set `true` to opt into the faster responses_websockets transport.
+   * `OCX_CODEX_WS_UPSTREAM=true` or `1` also enables it when this is omitted;
+   * `false` and `0` disable it. Invalid or absent values default to HTTP/SSE.
+   */
+  wsUpstream?: boolean;
+  /**
+   * Maximum WebSocket request frame size in bytes before routing over standard HTTP/SSE.
+   * Defaults to CODEX_WS_CREATE_FRAME_LIMIT_BYTES (~16 MiB minus margin).
+   */
+  maxWsFrameBytes?: number;
   /**
    * Pin the HTTP version used for upstream provider requests. Bun's fetch negotiates
    * HTTP/2 via TLS ALPN by default; some Cloudflare-fronted SSE endpoints hang on
@@ -284,6 +312,33 @@ export interface OcxProviderConfig {
    * full set so the user can pick). See devlog issue_052_provider-model-allowlist.
    */
   selectedModels?: string[];
+  /** Override for newly discovered models. Absent/"inherit" uses the install policy. */
+  newModelPolicy?: "on" | "off" | "inherit";
+  /**
+   * Model-preset marker for `selectedModels` (#2465). Absent means "all", exactly today's
+   * semantics — an existing provider is never narrowed by an upgrade.
+   *
+   * The preset is a SEED, not a lock: `selectedModels` holds concrete ids materialized from
+   * the shipped rules, so every existing consumer and older binaries keep working against a
+   * plain allowlist. Divergence is detected at the WRITE path rather than by diffing — any user
+   * edit while the mode is "preset" flips it to "custom", after which the proxy never
+   * re-materializes. That collapses upgrade reconciliation to a version compare.
+   *
+   * Deliberately distinct from `deriveProviderPresets`, which curates WHICH PROVIDERS to offer.
+   * This curates which MODELS a provider exposes; the code says "model preset" throughout.
+   */
+  modelPreset?: {
+    mode: "preset" | "all" | "custom";
+    /** MODEL_PRESETS version materialized into `selectedModels`. */
+    appliedVersion?: number;
+    appliedAt?: string;
+    /**
+     * Set when materialization matched nothing and the provider fell back to "all". A preset
+     * must never write an empty allowlist, because empty means ALL and would silently
+     * un-curate; the fallback marker lets the next convergence retry.
+     */
+    fallback?: "preset-empty";
+  };
   /** Provider-wide fallback when context metadata is absent; otherwise caps the reported window. */
   contextWindow?: number;
   /** Per-model fallback when context metadata is absent; otherwise caps the reported window. */
@@ -327,6 +382,16 @@ export interface OcxProviderConfig {
    * providers whose registry entry declares authKind "local" (management API enforces).
    */
   authMode?: "key" | "forward" | "oauth" | "local";
+  /**
+   * Per-provider override for generic OAuth multi-account 429 failover (#2568).
+   *
+   * Rotation is presence-driven by default — 2+ logged-in accounts activate it — so this exists
+   * for the operator who accepts rotation on one provider and refuses it on another. An explicit
+   * boolean here beats the global `oauthAccountFailover` and beats presence.
+   */
+  oauthAccountFailover?: {
+    enabled?: boolean;
+  };
   /** Allow an explicitly key/oauth provider to run without a credential (for keyless local proxies). */
   keyOptional?: boolean;
   /**
@@ -359,6 +424,18 @@ export interface OcxProviderConfig {
    * Responses backend rejects Codex summary-delivery fields for that model.
    */
   modelSupportsReasoningSummaries?: Record<string, boolean>;
+  /**
+   * Model-specific Codex Responses verbosity capability. Set false when the upstream ignores
+   * `text.verbosity`; the catalog hides the no-op picker and the Responses adapter strips stale
+   * or caller-supplied values while preserving other `text` fields.
+   */
+  modelSupportsVerbosity?: Record<string, boolean>;
+  /**
+   * Provider-wide Codex Responses verbosity capability, applied to models the per-model map
+   * does not enumerate (a live-discovered id, for example). Materialized from the registry at
+   * seed/enrich time so the catalog hint pass never has to read PROVIDER_REGISTRY.
+   */
+  supportsVerbosity?: boolean;
   /**
    * Per-model wire value for Responses `stream_options.reasoning_summary_delivery`.
    * Presence also advertises reasoning-summary support for that routed model.
@@ -526,8 +603,9 @@ export interface OcxProviderConfig {
    * Google adapter mode. "ai-studio" (default) = Generative Language API + x-goog-api-key.
    * "vertex" = Vertex AI project/location endpoints with GCP ADC (or x-goog-api-key).
    * "cloud-code-assist" = Google Antigravity (Cloud Code Assist) OAuth + CCA envelope.
+   * "ai-studio-web" = browser-relayed AI Studio Playground/Build session.
    */
-  googleMode?: "ai-studio" | "vertex" | "cloud-code-assist";
+  googleMode?: "ai-studio" | "vertex" | "cloud-code-assist" | "ai-studio-web";
   /** Vertex AI GCP project id (or GOOGLE_CLOUD_PROJECT / GCLOUD_PROJECT env). */
   project?: string;
   /** Vertex AI location, e.g. "us-central1" or "global" (or GOOGLE_CLOUD_LOCATION env). */

package/src/types/request.ts

@@ -70,6 +70,10 @@ export interface OcxParsedRequest {
   _clientThreadId?: string;
   /** True when promptCacheKey is a shared cache cohort rather than a conversation identity. */
   _promptCacheKeyIsSharedCohort?: boolean;
+  /** Provider-private Command Code session affinity id, stable across in-process request mutation. */
+  _commandCodeSessionId?: string;
+  /** Cursor-only thread owner; may be an opaque process-local Desktop session/thread identity. */
+  _cursorClientThreadId?: string;
   /** Conversation/provider/account/model-bound namespace for reasoning replay state. */
   _reasoningReplayScope?: OcxReasoningReplayScopeRef;
   /**
@@ -88,7 +92,7 @@ export interface OcxParsedRequest {
    */
   _cursorIsolateConversation?: boolean;
   /** Account-scoped, non-secret Kiro request metadata selected with the OAuth access token. */
-  _kiroAuthContext?: Pick<KiroOAuthMetadata, "profileArn" | "apiRegion" | "ssoRegion">;
+  _kiroAuthContext?: Pick<KiroOAuthMetadata, "profileArn" | "apiRegion" | "ssoRegion" | "authType">;
   /** Provider-private continuation metadata resolved from the Responses previous_response_id chain. */
   _providerContinuation?: OcxProviderContinuationState;
   /** Persisted continuation considered only after the final physical route is known. */
@@ -196,8 +200,14 @@ export interface OcxImageContent {
   detail?: string;
 }
 
-/** A user/developer message content part: text or an image (vision). */
-export type OcxContentPart = OcxTextContent | OcxImageContent;
+export interface OcxVideoContent {
+  type: "video";
+  /** A base64 `data:` URL from an OpenAI-compatible `video_url` part. */
+  videoUrl: string;
+}
+
+/** A user/developer message content part: text or native media. */
+export type OcxContentPart = OcxTextContent | OcxImageContent | OcxVideoContent;
 
 export interface OcxThinkingContent {
   type: "thinking";
@@ -258,13 +268,9 @@ export interface OcxRequestOptions {
   /**
    * Responses `text.format` (json_schema / json_object), preserved for adapters whose
    * upstream wire has an equivalent. The openai-chat adapter re-nests it as chat
-   * `response_format`, the exact inverse of responseFormatToText in src/chat/inbound.ts; the
-   * Google adapter lowers supported requests to Gemini JSON mode (`responseMimeType` /
-   * `responseSchema`) but skips requests with tools, Claude models, or image-capable models.
-   * The `openai-chat` adapter can omit it for models in `noStructuredOutputModels`; Kiro
-   * rejects structured output via `_structuredOutput`; and Cursor has no structured-output
-   * wire field and rejects the request before transport.
-   * Native passthrough does not consume this option and forwards `_rawBody.text` verbatim.
+   * `response_format`, the exact inverse of responseFormatToText in src/chat/inbound.ts.
+   * The native passthrough ignores it (it forwards `_rawBody.text` verbatim) and Kiro
+   * keeps rejecting structured output via `_structuredOutput`.
    */
   textFormat?: {
     type: "json_schema" | "json_object";
@@ -290,10 +296,12 @@ export type GoogleSafetyThreshold =
   | "BLOCK_ONLY_HIGH"
   | "BLOCK_NONE"
   | "OFF";
+
 export interface GoogleSafetySetting {
   category: GoogleSafetyCategory;
   threshold: GoogleSafetyThreshold;
 }
+
 export interface GoogleProviderOptions {
   thinkingBudget?: number;
   includeThoughts?: boolean;

package/src/types/tools.ts

@@ -32,30 +32,49 @@ export function namespacedToolName(namespace: string | undefined, name: string):
 }
 
 /**
- * Codex 0.149 unified-exec name normalization.
+ * Codex unified-exec name normalization.
  *
  * Codex's code-mode shell tool is declared as `exec` (a freeform custom tool whose own
  * description mentions the nested `await tools.exec_command(...)` helper). Routed models —
  * DeepSeek in particular — sometimes echo that helper name as the tool-call name, emitting
- * `exec_command` instead of the declared `exec`. Accept the legacy shell bridge names only
- * when the request catalog actually declares `exec` and does not itself declare the legacy
- * name (an MCP server may legitimately advertise `exec_command` under its own namespace).
+ * `exec_command` or `apply_patch` instead of the declared `exec`. Accept these nested helper
+ * names only when the request catalog actually declares `exec` and does not itself declare the
+ * emitted name (an MCP server may legitimately advertise one under its own namespace). Some
+ * hosted adapters also strip a unique namespace prefix or replace its separator with `_`; those
+ * forms are accepted only when one declaration can be identified unambiguously.
  */
 const LEGACY_SHELL_BRIDGE_TOOL_NAMES = ["exec_command", "shell_command"] as const;
+const CODE_MODE_HELPER_TOOL_NAMES = [...LEGACY_SHELL_BRIDGE_TOOL_NAMES, "apply_patch"] as const;
 
 export function normalizeDeclaredToolName(
   name: string,
   declared: ReadonlySet<string> | undefined,
 ): string {
-  if (!declared || !declared.has("exec")) return name;
+  if (!declared) return name;
   if (declared.has(name)) return name;
-  // When the catalog explicitly declares any legacy shell bridge name, the environment
-  // genuinely exposes that tool — turn normalization off so a call is never mis-routed
-  // to `exec`.
-  if ((LEGACY_SHELL_BRIDGE_TOOL_NAMES as readonly string[]).some(legacy => declared.has(legacy))) {
-    return name;
+  if (declared.has("exec")) {
+    // When the catalog explicitly declares any legacy shell bridge name, the environment
+    // genuinely exposes that tool — turn normalization off so a call is never mis-routed
+    // to `exec`.
+    if ((LEGACY_SHELL_BRIDGE_TOOL_NAMES as readonly string[]).some(legacy => declared.has(legacy))) {
+      return name;
+    }
+    if ((CODE_MODE_HELPER_TOOL_NAMES as readonly string[]).includes(name)) {
+      return "exec";
+    }
+  }
+  // Models may strip a namespace prefix or replace separators with underscores. Resolve only
+  // when exactly one declaration matches, so an ambiguous bare name remains fail-closed.
+  let matched: string | undefined;
+  for (const dec of declared) {
+    const matchesSuffix = !name.includes(":") && !name.includes("__")
+      && (dec.endsWith(`:${name}`) || dec.endsWith(`__${name}`));
+    const matchesSanitized = dec.replace(/[^A-Za-z0-9_-]/g, "_") === name;
+    if (!matchesSuffix && !matchesSanitized) continue;
+    if (matched !== undefined) return name;
+    matched = dec;
   }
-  return (LEGACY_SHELL_BRIDGE_TOOL_NAMES as readonly string[]).includes(name) ? "exec" : name;
+  return matched ?? name;
 }
 
 export function toolChoiceAliases(tool: Pick<OcxTool, "namespace" | "name">): string[] {

package/src/types.ts

@@ -66,6 +66,7 @@ export type {
   OcxApiKeyEntry,
   OcxClientIntegrationsConfig,
   OcxSubagentRole,
+  OcxConfigRebaseProvenance,
   OcxConfig,
   OcxAccountPoolRotationStrategy,
   OcxComboStrategy,

package/src/usage/command-code-manifest.ts

@@ -0,0 +1,116 @@
+import type { Cost4, ExpectedPriceOverlay } from "./expected-prices";
+
+export interface CommandCodeModelPricing {
+  id: string;
+  name: string;
+  slug?: string;
+  contextWindow?: number;
+  cost4: Cost4;
+}
+
+export const COMMAND_CODE_MODELS_DATA_URL = "https://commandcode.ai/models.data";
+export const COMMAND_CODE_PRICING_SOURCE = "https://commandcode.ai/models + https://commandcode.ai/models.data";
+
+/**
+ * Parse Command Code models and 4-tuple per-1M token rates from the Turbo-stream
+ * payload served by https://commandcode.ai/models.data.
+ */
+export function parseCommandCodeModelsData(raw: unknown): CommandCodeModelPricing[] {
+  if (!Array.isArray(raw) || raw.length < 10) return [];
+  const modelIndices = raw[9];
+  if (!Array.isArray(modelIndices)) return [];
+
+  const resolve = (val: unknown): unknown => {
+    if (typeof val === "number") {
+      if (val < 0) return val === -5 ? null : undefined;
+      if (val < raw.length) return raw[val];
+    }
+    return val;
+  };
+
+  const results: CommandCodeModelPricing[] = [];
+  for (const idx of modelIndices) {
+    if (typeof idx !== "number" || idx < 0 || idx >= raw.length) continue;
+    const obj = raw[idx];
+    if (!obj || typeof obj !== "object" || Array.isArray(obj)) continue;
+
+    const fields: Record<string, unknown> = {};
+    for (const [k, v] of Object.entries(obj)) {
+      if (!k.startsWith("_")) continue;
+      const keyIdx = Number.parseInt(k.slice(1), 10);
+      if (!Number.isFinite(keyIdx) || keyIdx < 0 || keyIdx >= raw.length) continue;
+      const keyName = raw[keyIdx];
+      if (typeof keyName === "string" && keyName.length > 0) {
+        fields[keyName] = resolve(v);
+      }
+    }
+
+    const id = typeof fields.id === "string" ? fields.id.trim() : "";
+    if (!id) continue;
+
+    const name = typeof fields.name === "string" && fields.name.trim() ? fields.name.trim() : id;
+    const slug = typeof fields.slug === "string" && fields.slug.trim() ? fields.slug.trim() : undefined;
+    const contextWindow = typeof fields.contextWindow === "number" && Number.isFinite(fields.contextWindow)
+      ? fields.contextWindow
+      : undefined;
+
+    const input = typeof fields.inputCost === "number" && Number.isFinite(fields.inputCost) && fields.inputCost >= 0
+      ? fields.inputCost
+      : 0;
+    const output = typeof fields.outputCost === "number" && Number.isFinite(fields.outputCost) && fields.outputCost >= 0
+      ? fields.outputCost
+      : 0;
+    const cacheRead = typeof fields.cacheReadCost === "number" && Number.isFinite(fields.cacheReadCost) && fields.cacheReadCost >= 0
+      ? fields.cacheReadCost
+      : 0;
+    const cacheWrite = typeof fields.cacheWriteCost === "number" && Number.isFinite(fields.cacheWriteCost) && fields.cacheWriteCost >= 0
+      ? fields.cacheWriteCost
+      : 0;
+
+    results.push({
+      id,
+      name,
+      ...(slug ? { slug } : {}),
+      ...(contextWindow !== undefined ? { contextWindow } : {}),
+      cost4: { input, output, cacheRead, cacheWrite },
+    });
+  }
+
+  return results;
+}
+
+/**
+ * Fetch and decode the latest Command Code model pricing from commandcode.ai.
+ */
+export async function fetchCommandCodeModelPricing(options?: {
+  url?: string;
+  signal?: AbortSignal;
+  fetchFn?: typeof fetch;
+}): Promise<CommandCodeModelPricing[]> {
+  const fetcher = options?.fetchFn ?? fetch;
+  const url = options?.url ?? COMMAND_CODE_MODELS_DATA_URL;
+  const res = await fetcher(url, { signal: options?.signal });
+  if (!res.ok) throw new Error(`Failed to fetch Command Code models data: ${res.status}`);
+  const data = await res.json();
+  return parseCommandCodeModelsData(data);
+}
+
+/**
+ * Convert parsed Command Code models to opencodex ExpectedPriceOverlay entries.
+ */
+export function commandCodePricingToExpectedOverlays(
+  models: readonly CommandCodeModelPricing[],
+  verifiedAt = "2026-08-26",
+): ExpectedPriceOverlay[] {
+  return models
+    .filter(m => m.cost4.input > 0 || m.cost4.output > 0 || m.cost4.cacheRead > 0 || m.cost4.cacheWrite > 0)
+    .map(m => ({
+      provider: "command-code",
+      modelId: m.id,
+      cost4: m.cost4,
+      source: COMMAND_CODE_PRICING_SOURCE,
+      verifiedAt,
+      status: "verified",
+    }));
+}
+

package/src/usage/cost.ts

@@ -253,7 +253,7 @@ function resolveMatchedPriceExact(
   const verifiedOverride = overlays === EXPECTED_PRICE_OVERLAYS
     ? findVerifiedPriceOverride(provider, modelId)
     : undefined;
-  if (verifiedOverride && validCost4(verifiedOverride.cost4) && hasNonZeroCost(verifiedOverride.cost4)) {
+  if (verifiedOverride && verifiedOverride.status !== "unverified" && validCost4(verifiedOverride.cost4) && hasNonZeroCost(verifiedOverride.cost4)) {
     return {
       provider,
       modelId,
@@ -261,7 +261,7 @@ function resolveMatchedPriceExact(
       source: "expected",
       sourceRef: verifiedOverride.source,
       verifiedAt: verifiedOverride.verifiedAt,
-      status: "verified",
+      status: verifiedOverride.status,
     };
   }
   const metadataProvider = resolveMetadataProvider(provider);