@yansigit/opencodex 2.33.1 → 2.35.0

package/src/oauth/index.ts

@@ -58,11 +58,20 @@ export interface OAuthAccessSnapshot {
   /** Cloud Code Assist project selected during Antigravity login. */
   projectId?: string;
   /** Safe request-routing subset; refresh-only Kiro client secrets never leave the credential store. */
-  kiro?: Pick<KiroOAuthMetadata, "profileArn" | "apiRegion" | "ssoRegion">;
+  kiro?: Pick<KiroOAuthMetadata, "profileArn" | "apiRegion" | "ssoRegion" | "authType">;
+  /**
+   * Allowlisted GitHub Copilot API origin belonging to THIS account.
+   *
+   * Copilot pins its bearer to an account-scoped regional host, and the initial route already
+   * pairs the two (`core.ts` resolves transport with `getOAuthCredentialApiBaseUrl`). Account
+   * failover must carry the pairing across the rotation; without it, account B's token is sent to
+   * account A's origin (#2568d).
+   */
+  apiBaseUrl?: string;
 }
 
 export interface ObservedOAuthAccessSnapshot extends OAuthAccessSnapshot {
-  /** Allowlisted provider API origin consumed by GitHub Copilot model discovery. */
+  /** Retained for callers that predate `apiBaseUrl` moving onto the base snapshot. */
   apiBaseUrl?: string;
 }
 
@@ -351,24 +360,43 @@ export function publicOAuthAuthenticationErrorMessage(error: unknown): string {
 }
 
 function accessSnapshot(provider: string, accountId: string, cred: OAuthCredentials): OAuthAccessSnapshot {
+  // Derived, not read back: a stored `authType` is trusted when present, but a credential imported
+  // before the field existed still routes correctly because the client pair implies SSO OIDC.
+  const kiroAuthType = cred.kiro?.authType
+    ?? (cred.kiro?.clientId && cred.kiro?.clientSecret ? "aws_sso_oidc" as const : undefined);
   const storedKiroRouting = {
     ...(cred.kiro?.profileArn ? { profileArn: cred.kiro.profileArn } : {}),
     ...(cred.kiro?.apiRegion ? { apiRegion: cred.kiro.apiRegion } : {}),
     ...(cred.kiro?.ssoRegion ? { ssoRegion: cred.kiro.ssoRegion } : {}),
   };
+  // `authType` is a property OF the account, not routing the environment can substitute for, so it
+  // is merged after the environment fallback decision rather than counting as stored routing.
+  // Folding it into `storedKiroRouting` would make a client-pair-only credential look non-empty
+  // and silently disable `environmentKiroRoutingMetadata()` for it.
+  const kiroAuthTypeRouting = kiroAuthType ? { authType: kiroAuthType } : {};
+  // Validated here, not at the call site: an unvalidated origin from a legacy or crafted
+  // credential must never travel with a bearer, and dropping it makes the transport fall back to
+  // the canonical host rather than to whatever the previous account was using.
+  const copilotApiBaseUrl = provider === "github-copilot"
+    ? validateCopilotApiBaseUrl(cred.apiBaseUrl)
+    : undefined;
   return {
     provider,
     accountId,
     generation: credentialGeneration(cred),
     accessToken: cred.access,
     ...(cred.projectId ? { projectId: cred.projectId } : {}),
+    ...(copilotApiBaseUrl ? { apiBaseUrl: copilotApiBaseUrl } : {}),
     // Stored account metadata remains authoritative. Metadata-less legacy/environment credentials
     // may use explicit environment routing, but never borrow the currently signed-in local CLI account.
     ...(provider === "kiro"
       ? {
-          kiro: Object.keys(storedKiroRouting).length > 0
-            ? storedKiroRouting
-            : environmentKiroRoutingMetadata() ?? {},
+          kiro: {
+            ...(Object.keys(storedKiroRouting).length > 0
+              ? storedKiroRouting
+              : environmentKiroRoutingMetadata() ?? {}),
+            ...kiroAuthTypeRouting,
+          },
         }
       : {}),
   };
@@ -499,6 +527,22 @@ export async function getValidAccessTokenForAccount(provider: string, accountId:
   return (await resolveAccessSnapshotForAccount(provider, accountId)).accessToken;
 }
 
+/**
+ * Account-scoped resolver returning the FULL snapshot, not just the bearer.
+ *
+ * A rotator that swaps only the token silently mixes credential generations: Antigravity pairs
+ * an account-matched `projectId` with its token (see the pairing comment in
+ * server/responses/core.ts), Kiro carries routing metadata, and Copilot's observed snapshot
+ * carries an account-specific API origin. Reading those back from "whichever account is active"
+ * after a rotation is exactly the mixing this returns in one piece to prevent (#2568).
+ */
+export async function getValidAccessSnapshotForAccount(
+  provider: string,
+  accountId: string,
+): Promise<OAuthAccessSnapshot> {
+  return resolveAccessSnapshotForAccount(provider, accountId);
+}
+
 /** Terminal refresh failures (revoked/rotated-away grants) — retrying cannot succeed. */
 function isTerminalRefreshError(err: unknown): boolean {
   const msg = (err instanceof Error ? err.message : String(err)).toLowerCase();
@@ -1094,6 +1138,14 @@ export function upsertOAuthProvider(config: OcxConfig, provider: string): void {
   if (existing?.modelCosts !== undefined) {
     next.modelCosts = existing.modelCosts;
   }
+  // The per-provider account-failover opt-out is operator intent about SPENDING, and the login
+  // path is exactly where losing it does damage: adding a second account both rebuilds this row
+  // from the preset and creates the 2-account quorum that turns presence-driven rotation on
+  // (#2568d). Dropping the opt-out here would enable the thing the operator switched off, at the
+  // moment they were doing something unrelated.
+  if (existing?.oauthAccountFailover !== undefined) {
+    next.oauthAccountFailover = existing.oauthAccountFailover;
+  }
   if (existing && getProviderRegistryEntry(provider)?.allowKeyAuthOverride === true) {
     // Shared sanitizeApiKeyValue trim / no-CRLF checks from api-key pool writes.
     let storedApiKey = sanitizeApiKeyValue(existing.apiKey);

package/src/oauth/key-providers.ts

@@ -20,7 +20,8 @@ export const KEY_LOGIN_PROVIDERS: Record<string, KeyLoginProvider> = deriveKeyLo
  * caller didn't already supply. Lets the vision/reasoning classification actually reach the saved
  * config (the GUI/API only send adapter/baseUrl/apiKey/defaultModel). No-op for unknown names.
  *
- * `modelSupportsReasoningSummaries` is deliberately excluded from what gets persisted. It is
+ * `modelSupportsReasoningSummaries` and the verbosity capability are deliberately excluded from
+ * what gets persisted. They are
  * registry-only metadata resolved at runtime, and this function feeds a config that is about to
  * be written to disk. Persisting today's registry defaults would freeze them as the user's own
  * overrides: a later registry correction — say we learn a model's backend rejects summary
@@ -31,9 +32,17 @@ export const KEY_LOGIN_PROVIDERS: Record<string, KeyLoginProvider> = deriveKeyLo
 export function enrichProviderFromCatalog(name: string, prov: OcxProviderConfig): void {
   const hadOwnSummaries = Object.hasOwn(prov, "modelSupportsReasoningSummaries");
   const submittedSummaries = prov.modelSupportsReasoningSummaries;
+  const hadOwnVerbosity = Object.hasOwn(prov, "modelSupportsVerbosity");
+  const submittedVerbosity = prov.modelSupportsVerbosity;
+  const hadOwnProviderVerbosity = Object.hasOwn(prov, "supportsVerbosity");
+  const submittedProviderVerbosity = prov.supportsVerbosity;
   enrichProviderFromRegistry(name, prov);
   if (hadOwnSummaries) prov.modelSupportsReasoningSummaries = submittedSummaries;
   else delete prov.modelSupportsReasoningSummaries;
+  if (hadOwnVerbosity) prov.modelSupportsVerbosity = submittedVerbosity;
+  else delete prov.modelSupportsVerbosity;
+  if (hadOwnProviderVerbosity) prov.supportsVerbosity = submittedProviderVerbosity;
+  else delete prov.supportsVerbosity;
 }
 
 export function isKeyLoginProvider(name: string): boolean {

package/src/oauth/kiro.ts

@@ -28,6 +28,7 @@ import {
 } from "./kiro-credentials";
 import { homedir } from "node:os";
 import { getAccountSet, saveAccountCredential } from "./store";
+import { KIRO_BUILDER_ID_SERVICE_PROFILE_ARN } from "../adapters/kiro-constants";
 
 const DEFAULT_REGION = "us-east-1";
 const REFRESH_URL = "https://prod.{region}.auth.desktop.kiro.dev/refreshToken";
@@ -473,6 +474,50 @@ export function resolveKiroProfileArn(account?: Pick<KiroOAuthMetadata, "profile
   return readImportedKiroCredential()?.profileArn;
 }
 
+/**
+ * Resolve the profileArn actually SENT upstream, which is not always the account's own.
+ *
+ * An AWS Builder ID account authenticates through SSO OIDC and never receives an account-scoped
+ * profile ARN, so gated models reject its requests with a `profileArn`-demanding
+ * `ValidationException`. The Kiro CLI handles this by carrying a fixed service profile on Builder
+ * ID requests, and this mirrors that.
+ *
+ * Deliberately separate from `resolveKiroProfileArn`: that resolver answers "what is this
+ * account's profile", and callers that ask it — region inference, account matching, continuation
+ * scoping — must keep receiving `undefined` here. Only request construction uses this function.
+ *
+ * The fallback is gated on `authType === "aws_sso_oidc"` rather than on a missing ARN, so a
+ * `kiro_desktop` account whose profile import failed keeps producing its actionable error instead
+ * of silently borrowing a service profile that does not describe it.
+ */
+export function resolveKiroRequestProfileArn(
+  account?: Pick<KiroOAuthMetadata, "profileArn" | "authType">,
+): string | undefined {
+  return resolveKiroRequestProfile(account).profileArn;
+}
+
+/**
+ * The profileArn to send, together with WHY it was chosen.
+ *
+ * The request builder must decide the wire envelope from the same evaluation that produced the
+ * ARN. Re-deriving "is this Builder ID" from the account context alone would miss the accountless
+ * path, where the auth type comes from the locally imported credential instead: the fallback would
+ * be sent while the request was shaped as an enterprise IDE call, which is not a combination the
+ * vendor client ever produces.
+ */
+export function resolveKiroRequestProfile(
+  account?: Pick<KiroOAuthMetadata, "profileArn" | "authType">,
+): { profileArn: string | undefined; builderIdFallback: boolean } {
+  const own = resolveKiroProfileArn(account);
+  if (own) return { profileArn: own, builderIdFallback: false };
+  const authType = account !== undefined
+    ? account.authType
+    : readImportedKiroCredential()?.authType;
+  return authType === "aws_sso_oidc"
+    ? { profileArn: KIRO_BUILDER_ID_SERVICE_PROFILE_ARN, builderIdFallback: true }
+    : { profileArn: undefined, builderIdFallback: false };
+}
+
 async function kiroTokenRefreshError(response: Response): Promise<KiroTokenRefreshError> {
   let oauthError: string | undefined;
   try {

package/src/oauth/login-cli.ts

@@ -67,7 +67,7 @@ export function warnIfLiveReloadSkipped(result: LocalProviderReloadResult | null
 export async function handleLogin(provider?: string): Promise<void> {
   const name = (provider ?? "").trim().toLowerCase();
   if (name === "google-aistudio" || name === "aistudio" || name === "gemini-aistudio") {
-    return handleAiStudioBridgeLogin();
+    return handleAiStudioLogin();
   }
   if (isPublicOAuthProvider(name)) return handleOAuthLogin(name);
   if (isKeyLoginProvider(name)) return handleKeyLogin(name);
@@ -79,15 +79,10 @@ export async function handleLogin(provider?: string): Promise<void> {
   process.exit(1);
 }
 
-async function handleAiStudioBridgeLogin(): Promise<void> {
-  const live = await findLiveProxy();
-  const port = live?.port ?? 10100;
-  const bridgeUrl = "http://127.0.0.1:" + port + "/aistudio/bridge";
-
+async function handleAiStudioLogin(): Promise<void> {
   console.log("\n🌐 Google AI Studio Sign-In & Session Setup:");
   console.log("   Option 1: Paste Session Token from the Brave/Chrome extension popup (Passkey-friendly)");
-  console.log("   Option 2: Open native macOS sign-in window");
-  console.log("   Option 3: Open browser bridge page (" + bridgeUrl + ")\n");
+  console.log("   Option 2: Open native macOS sign-in window\n");
 
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
   try {
@@ -100,20 +95,25 @@ async function handleAiStudioBridgeLogin(): Promise<void> {
       saveAiStudioSessionFromToken(choice);
       console.log("\n✅ Session token imported successfully! Saved to ~/.opencodex/aistudio-session.json");
     } else if (process.platform === "darwin") {
-      const { getAiStudioNativeDaemonSourcePath } = await import("./aistudio-native-daemon");
-      const swiftSrc = getAiStudioNativeDaemonSourcePath();
+      const { runAiStudioNativeLogin } = await import("./aistudio-native-daemon");
       console.log("\n🚀 Opening native Google AI Studio login window...");
-      const proc = Bun.spawn(["swift", swiftSrc, "--login"], {
-        stdout: "inherit",
-        stderr: "inherit",
-      });
-      const code = await proc.exited;
-      if (code === 0) {
-        console.log("\n✅ Google AI Studio authenticated successfully! Session saved to ~/.opencodex/aistudio-session.json");
+      const result = await runAiStudioNativeLogin();
+      if (result.kind === "cancelled") {
+        console.log("\nNative Google AI Studio login cancelled.");
+        return;
+      }
+      if (result.kind === "unsupported") {
+        console.error("\nGoogle AI Studio native login is only available on macOS.");
+        return;
+      }
+      if (result.kind === "failed") {
+        console.error(`\n${result.error}`);
+        return;
       }
+      console.log("\n✅ Google AI Studio authenticated successfully! Session saved to ~/.opencodex/aistudio-session.json");
     } else {
-      console.log("\n🌐 Opening bridge page in your browser: " + bridgeUrl);
-      openUrl(bridgeUrl);
+      console.error("\nGoogle AI Studio native login is only available on macOS. Paste a session token from the extension instead.");
+      return;
     }
   } finally {
     rl.close();
@@ -134,7 +134,6 @@ async function handleAiStudioBridgeLogin(): Promise<void> {
     console.log("\n   ✓ Configured 'google-aistudio' in ~/.opencodex/config.json");
   }
 
-  openUrl(bridgeUrl);
   const reload = await notifyRunningProxy("google-aistudio");
   console.log("\n✅ Ready! Use models with 'google-aistudio' provider in your coding agents.");
   warnIfLiveReloadSkipped(reload);

package/src/oauth/types.ts

@@ -1,6 +1,16 @@
 /** Minimal OAuth types, ported from jawcode packages/ai/src/utils/oauth/types.ts. */
 export type OAuthCredentialSource = "oauth" | "local-cli" | "credential-file" | "environment" | "manual";
 
+/**
+ * How the account authenticated. Mirrors `KiroAuthType` in `./kiro-credentials`, restated here so
+ * the credential-store types do not depend on the SQLite import module.
+ *
+ * `aws_sso_oidc` covers AWS Builder ID, which never issues an account-scoped CodeWhisperer
+ * profile ARN; the adapter needs that distinction to tell a Builder ID account apart from a
+ * `kiro_desktop` account whose profile import merely failed.
+ */
+export type KiroCredentialAuthType = "kiro_desktop" | "aws_sso_oidc";
+
 /** Account-scoped Kiro data required for refresh and request routing. */
 export interface KiroOAuthMetadata {
   profileArn?: string;
@@ -8,6 +18,11 @@ export interface KiroOAuthMetadata {
   apiRegion?: string;
   clientId?: string;
   clientSecret?: string;
+  /**
+   * Non-secret routing signal. Derived from the presence of a device-registration client pair, so
+   * it stays accurate even though `clientId`/`clientSecret` never leave the credential store.
+   */
+  authType?: KiroCredentialAuthType;
 }
 
 export type OAuthCredentials = {

package/src/providers/codex-capacity.ts

@@ -14,6 +14,9 @@ export const CODEX_CAPACITY_MAX_QUOTA_AGE_MS = 30 * 60_000;
 export type CodexCapacityQuota = {
   fiveHourPercent?: number;
   fiveHourResetAt?: number;
+  shortPercent?: number;
+  shortResetAt?: number;
+  shortWindowSeconds?: number;
   weeklyPercent?: number;
   weeklyResetAt?: number;
   monthlyPercent?: number;
@@ -106,7 +109,7 @@ function futureResetMs(value: unknown, now: number): number | undefined {
 
 function hasKnownQuotaWindow(quota: CodexCapacityQuota | null): quota is CodexCapacityQuota {
   if (!quota) return false;
-  return normalizedPercent(quota.fiveHourPercent) !== undefined
+  return normalizedPercent(quota.fiveHourPercent ?? quota.shortPercent) !== undefined
     || normalizedPercent(quota.weeklyPercent) !== undefined
     || normalizedPercent(quota.monthlyPercent) !== undefined
     || !!quota.customWindows?.some(window => normalizedPercent(window.percent) !== undefined);
@@ -197,7 +200,7 @@ export function aggregateCodexPoolCapacity(
       && now - quota.updatedAt <= CODEX_CAPACITY_MAX_QUOTA_AGE_MS;
     if (quota && !quotaFresh) staleQuotaAccounts += 1;
     const standard = quota ? [
-      ["fiveHour", quota.fiveHourPercent, quota.fiveHourResetAt],
+      ["fiveHour", quota.fiveHourPercent ?? quota.shortPercent, quota.fiveHourResetAt ?? quota.shortResetAt],
       ["weekly", quota.weeklyPercent, quota.weeklyResetAt],
       ["monthly", quota.monthlyPercent, quota.monthlyResetAt],
     ] as const : [];

package/src/providers/command-code-efforts.ts

@@ -9,12 +9,44 @@ const COMMAND_CODE_MODEL_EFFORTS = {
     efforts: ["high", "max"],
     profileUrl: "https://commandcode.ai/models/deepseek-v4-flash",
   },
-  // Ox Alpha (stealth preview, added in Command Code v1.31.0): free 1M-context
-  // reasoning model on every plan. The profile does not publish an effort ladder,
-  // so mirror the OpenRouter contract (reasoning mandatory; max/high/low).
-  "stealth/ox-alpha": {
-    efforts: ["low", "high", "max"],
-    profileUrl: "https://commandcode.ai/models/ox-alpha",
+  /*
+   * Three live routes that reached the catalog without an effort ladder (#2647).
+   * Without a row here the model advertises no efforts at all, so a client that
+   * sends one gets it stripped or rejected rather than honored.
+   *
+   * PROVENANCE, stated plainly: these three ladders are the reporter's
+   * (darwintree, #2647), recorded as reported and NOT independently verified.
+   * All three profileUrls return HTTP 200, but commandcode.ai renders these
+   * pages client-side and ships the ladder inside a serialized React payload
+   * whose `reasoningEfforts` array is EMPTY in the delivered HTML. There is no
+   * fetchable statement of these ladders to check them against.
+   *
+   * Do not assume the refresh path launders this. It does not:
+   * `parsedProfileEfforts` below matches prose of the form
+   * "Reasoning efforts ... are supported;", and `grep -c -i 'reasoning efforts'`
+   * against the live pages returns 0 — for these three AND for the older rows
+   * (deepseek-v4-pro, GLM-5.3, muse-spark-1.2 all measured 0 on 2026-08-27).
+   * So `refreshCommandCodeReasoningEfforts` returns undefined and the caller
+   * keeps whatever is written here, indefinitely. The self-correction mechanism
+   * is currently dead for EVERY row in this table, which is a pre-existing
+   * defect worth its own fix (teach the parser to read the embedded payload),
+   * not something these three rows introduced.
+   *
+   * The practical consequence: a wrong ladder here stays wrong until a human
+   * changes it. It degrades safely — an effort the upstream rejects surfaces as
+   * an error rather than silent corruption — but it does not self-heal.
+   */
+  "deepseek/deepseek-v4-flash-vision-exp": {
+    efforts: ["high", "max"],
+    profileUrl: "https://commandcode.ai/models/deepseek-v4-flash-vision-exp",
+  },
+  "gpt-5.6-luna": {
+    efforts: ["low", "medium", "high", "xhigh", "max"],
+    profileUrl: "https://commandcode.ai/models/gpt-5-6-luna",
+  },
+  "google/gemini-3.7-flash": {
+    efforts: ["low", "medium", "high"],
+    profileUrl: "https://commandcode.ai/models/gemini-3-7-flash",
   },
   // Keys must match the EXACT upstream /provider/v1/models ids (GLM ships as
   // `zai-org/GLM-5.3`, not `zai-org/glm-5.3`). The table doubles as the router's

package/src/providers/context-cap.ts

@@ -1,4 +1,5 @@
 import type { OcxConfig } from "../types";
+import { deleteConfigTopLevelKey } from "../config/rebase-provenance";
 
 export const DEFAULT_PROVIDER_CONTEXT_CAP = 350_000;
 
@@ -50,7 +51,7 @@ export function setProviderContextCap(config: OcxConfig, provider: string, enabl
     delete next[provider];
   }
   if (Object.keys(next).length > 0) config.providerContextCaps = next;
-  else delete config.providerContextCaps;
+  else deleteConfigTopLevelKey(config, "providerContextCaps");
 }
 
 /**
@@ -71,12 +72,12 @@ export function setGlobalContextCapValue(config: OcxConfig, value: number, apply
 /** Enable the cap for every named provider at the current value, or clear all caps. */
 export function setAllProviderContextCaps(config: OcxConfig, providerNames: string[], enabled: boolean): void {
   if (!enabled) {
-    delete config.providerContextCaps;
+    deleteConfigTopLevelKey(config, "providerContextCaps");
     return;
   }
   const value = globalContextCapValue(config);
   const next: Record<string, number> = {};
   for (const name of providerNames) next[name] = value;
   if (Object.keys(next).length > 0) config.providerContextCaps = next;
-  else delete config.providerContextCaps;
+  else deleteConfigTopLevelKey(config, "providerContextCaps");
 }

package/src/providers/default-aliases.ts

@@ -0,0 +1,65 @@
+import type { OcxConfig, OcxProviderConfig } from "../types";
+
+export const MODEL_ALIAS_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+
+/** Ordered, most-specific-first built-in aliases. Updated with the provider registry. */
+export const DEFAULT_MODEL_ALIASES: ReadonlyArray<{ match: RegExp; alias: string }> = [
+  { match: /^claude-opus-5/, alias: "opus" },
+  { match: /^claude-sonnet-5/, alias: "sonnet" },
+  { match: /^claude-haiku/, alias: "haiku" },
+  { match: /^gemini-3(?:\.\d+)?-pro/, alias: "g3p" },
+  { match: /^gemini-3(?:\.\d+)?-flash/, alias: "g3f" },
+  { match: /^deepseek-v4/, alias: "ds4" },
+  { match: /^grok-4/, alias: "grok" },
+];
+
+export interface EffectiveModelAlias { alias: string; source: "user" | "builtin" }
+
+function builtinRule(id: string): { match: RegExp; alias: string } | undefined {
+  const tail = id.slice(id.lastIndexOf("/") + 1);
+  return DEFAULT_MODEL_ALIASES.find(rule => rule.match.test(id) || rule.match.test(tail));
+}
+
+export function defaultAliasesEnabled(config: Pick<OcxConfig, "defaultModelAliases">, provider: OcxProviderConfig): boolean {
+  return provider.defaultAliases ?? config.defaultModelAliases ?? false;
+}
+
+export function effectiveModelAliases(
+  config: Pick<OcxConfig, "defaultModelAliases">,
+  provider: OcxProviderConfig,
+  knownIds: Iterable<string>,
+): Map<string, EffectiveModelAlias> {
+  const result = new Map<string, EffectiveModelAlias>();
+  for (const [id, alias] of Object.entries(provider.modelAliases ?? {})) {
+    if (typeof alias === "string" && MODEL_ALIAS_PATTERN.test(alias)) result.set(id, { alias, source: "user" });
+  }
+  if (!defaultAliasesEnabled(config, provider)) return result;
+  const claims = new Map<string, string[]>();
+  for (const id of knownIds) {
+    if (result.has(id)) continue;
+    const rule = builtinRule(id);
+    if (!rule) continue;
+    const key = rule.alias.toLowerCase();
+    claims.set(key, [...(claims.get(key) ?? []), id]);
+  }
+  for (const [alias, ids] of claims) {
+    if (ids.length !== 1) continue;
+    const id = ids[0]!;
+    // Catalog drift must skip, never shadow, a native id or explicit user alias.
+    if ([...knownIds].some(candidate => candidate.toLowerCase() === alias)) continue;
+    if ([...result.values()].some(value => value.alias.toLowerCase() === alias)) continue;
+    result.set(id, { alias: builtinRule(id)!.alias, source: "builtin" });
+  }
+  return result;
+}
+
+export function resolveModelAlias(
+  config: Pick<OcxConfig, "defaultModelAliases">,
+  provider: OcxProviderConfig,
+  knownIds: Iterable<string>,
+  requested: string,
+): string | undefined {
+  const needle = requested.toLowerCase();
+  return [...effectiveModelAliases(config, provider, knownIds)]
+    .find(([, value]) => value.alias.toLowerCase() === needle)?.[0];
+}

package/src/providers/derive.ts

@@ -392,6 +392,32 @@ function serviceTierModelDefaultsFor(
     : undefined;
 }
 
+/**
+ * Materialize the registry's verbosity opt-out into the provider config at seed/enrich time.
+ *
+ * The catalog hint pass must not read PROVIDER_REGISTRY: a gather flight captures its registry
+ * authority up front and forbids any later read, so consulting the registry per model turned
+ * every hint pass into a post-lookup read and dropped a custom-destination flight's own
+ * discovery result (tests/codex-gather-authority.test.ts).
+ *
+ * Registry values go in first so an explicit user entry still wins, matching
+ * `applyReasoningSummaryDefaults`. `supportsVerbosity` is the provider-wide default, expanded
+ * across the seeded model list so an id discovered later still inherits it through the same
+ * Record the hint pass already reads.
+ */
+function applyVerbosityDefaults(prov: OcxProviderConfig, entry: ProviderRegistryEntry | undefined): void {
+  if (!entry) return;
+  const perModel = entry.modelSupportsVerbosity;
+  if (!perModel && entry.supportsVerbosity === undefined) return;
+  prov.modelSupportsVerbosity = {
+    ...(perModel ?? {}),
+    ...(prov.modelSupportsVerbosity ?? {}),
+  };
+  if (entry.supportsVerbosity !== undefined) {
+    prov.supportsVerbosity ??= entry.supportsVerbosity;
+  }
+}
+
 /**
  * Last-resort enrichment for a provider whose NAME matches no registry id.
  *
@@ -429,6 +455,7 @@ export function enrichProviderFromRegistry(name: string, prov: OcxProviderConfig
     // destinations, so a templated or overridable base URL cannot be claimed by it.
     enrichReasoningSummariesByDestination(prov);
     applyServiceTierModelDefaults(prov, serviceTierModelDefaultsFor(registryEntryForProviderDestination(prov), prov));
+    applyVerbosityDefaults(prov, registryEntryForProviderDestination(prov));
     return;
   }
   const explicitDirectReasoning: DirectReasoningEffortOverrides = {
@@ -493,6 +520,7 @@ export function enrichProviderFromRegistry(name: string, prov: OcxProviderConfig
   if (prov.preserveResponsesReasoningContent === undefined && entry.preserveResponsesReasoningContent !== undefined) prov.preserveResponsesReasoningContent = entry.preserveResponsesReasoningContent;
   applyReasoningSummaryDefaults(prov, entry.modelSupportsReasoningSummaries);
   applyServiceTierModelDefaults(prov, serviceTierModelDefaultsFor(entry, prov));
+  applyVerbosityDefaults(prov, entry);
   // Registry-only repair policy (#938): fill only when the runtime provider has
   // no explicit policy, and deep-clone so saved/user values never alias the
   // registry constant.

package/src/providers/fastwire.ts

@@ -246,6 +246,7 @@ export function tierObservationContext(
   policy: ResolvedFastPolicy,
   fastMode: boolean | undefined,
   callerTier: string | undefined,
+  responseTierAuthoritative?: boolean,
 ): TierObservationContext {
   return {
     capability: policy.capability,
@@ -253,6 +254,7 @@ export function tierObservationContext(
     fastWire: policy.fastWire,
     demandDecision: fastMode === true ? "force-fast" : fastMode === false ? "force-default" : "inherit",
     ...(callerTier !== undefined ? { callerTier } : {}),
+    ...(responseTierAuthoritative !== undefined ? { responseTierAuthoritative } : {}),
   };
 }
 
@@ -344,7 +346,11 @@ export function createAdapterTierMetadata(
 
   const responseCanConfirmFast = effectiveFastRequested
     && context.eligibility === "eligible"
-    && wireValue !== null;
+    && wireValue !== null
+    // A destination whose echo is not authoritative can neither confirm nor deny Fast. The
+    // ChatGPT-internal Codex backend echoes "default" on priority-scheduled turns, so believing
+    // it reported every Fast request as `response-declined` (#2558).
+    && context.responseTierAuthoritative !== false;
   return {
     outcome,
     observeResponseServiceTier(value: unknown) {