cartethyia 2.5.9 → 2.6.0

package/src/providers/integrations/buddy/workbuddy/quota.ts

@@ -1,161 +1,161 @@
-import type { FetchLike, ProviderQuotaResult } from "../../../quota/quota-contracts";
-import type { QuotaCollectionContext } from "../../../quota/quota-support";
-import { providerBaseUrl } from "../../../provider-metadata";
-import {
-  buildWorkBuddyUserAgent,
-  getWorkBuddyClientVersion,
-  getWorkBuddyCnClientVersion,
-  getWorkBuddyCliVersion,
-} from "../../../operations/client-versions";
-import { WORKBUDDY_DOMAIN } from "./shared";
-import { fetchTencentBillingQuota } from "../buddy-quota-shared";
-import { fetchBuddyRequestUsage, type BuddyUsageResult } from "../buddy-usage-shared";
-import { buddyAccountUid } from "../buddy-oauth-shared";
-
-/**
- * WorkBuddy international billing quota.
- *
- * Endpoint: POST https://www.workbuddy.ai/v2/billing/meter/get-user-resource
- * Request:  Authorization: Bearer <accessToken||apiKey>, desktop-client headers,
- *           X-User-Id for the account UID, and the reference filter envelope
- *           (ProductCode p_tcaca, statuses [0, 3], 101-year package window).
- * Response: { code: 0, data: { Response: { Data: { Accounts: [...] } } } }
- *
- * Same Tencent billing envelope as CodeBuddy CN, so the parsing is the shared
- * one in `buddy-quota-shared.ts`; only the endpoint and identity headers are
- * WorkBuddy-specific.
- */
-
-/**
- * The CN billing realm's host.
- *
- * The reference bills the CN realm here rather than on the CN chat host
- * (`www.workbuddy.cn`): billing is a separate service, and the chat host does
- * not serve the meter path.
- */
-const WORKBUDDY_CN_BILLING_BASE_URL = "https://www.codebuddy.cn";
-
-export const WORKBUDDY_USAGE_URL =
-  `${providerBaseUrl("workbuddy")}/v2/billing/meter/get-user-resource`;
-
-async function billingHeaders(
-  domain: string,
-  clientVersion: string,
-  enterpriseId?: string,
-): Promise<Record<string, string>> {
-  return {
-    "User-Agent": buildWorkBuddyUserAgent(clientVersion, getWorkBuddyCliVersion()),
-    "X-Product": "SaaS",
-    "X-Domain": domain,
-    "X-Requested-With": "XMLHttpRequest",
-    "X-CodeBuddy-Request": "1",
-    "Accept-Language": "en-US",
-    ...(enterpriseId === undefined || enterpriseId.length === 0
-      ? {}
-      : { "X-Tenant-Id": enterpriseId, "X-Enterprise-Id": enterpriseId }),
-  };
-}
-
-/**
- * Fetches WorkBuddy quota via the Tencent billing endpoint.
- *
- * Auth: `Authorization: Bearer <credential>` (api_key and oauth both use
- * Bearer; the caller passes the resolved secret).
- */
-export async function fetchWorkBuddyQuota(
-  credential: string,
-  fetcher: FetchLike,
-  context?: QuotaCollectionContext,
-): Promise<ProviderQuotaResult> {
-  return fetchWorkBuddyQuotaFor({
-    providerId: "workbuddy",
-    display: "WorkBuddy",
-    domain: WORKBUDDY_DOMAIN,
-    credential,
-    fetcher,
-    ...(context === undefined ? {} : { context }),
-  });
-}
-
-export async function fetchWorkBuddyCnQuota(
-  credential: string,
-  fetcher: FetchLike,
-  context?: QuotaCollectionContext,
-): Promise<ProviderQuotaResult> {
-  return fetchWorkBuddyQuotaFor({
-    providerId: "workbuddycn",
-    display: "WorkBuddy CN",
-    domain: "www.workbuddy.cn",
-    credential,
-    fetcher,
-    ...(context === undefined ? {} : { context }),
-  });
-}
-
-async function fetchWorkBuddyQuotaFor(args: {
-  readonly providerId: "workbuddy" | "workbuddycn";
-  readonly display: string;
-  readonly domain: string;
-  readonly credential: string;
-  readonly fetcher: FetchLike;
-  readonly context?: QuotaCollectionContext;
-}): Promise<ProviderQuotaResult> {
-  const { providerId, display, domain, credential, fetcher, context } = args;
-  const authState = typeof context?.auth_state === "object" && context?.auth_state !== null
-    ? (context.auth_state as Record<string, unknown>)
-    : undefined;
-  const enterpriseId = typeof authState?.enterpriseId === "string" ? authState.enterpriseId : undefined;
-  const clientVersion = providerId === "workbuddycn"
-    ? getWorkBuddyCnClientVersion()
-    : getWorkBuddyClientVersion();
-  // The reference bills the CN realm on `www.codebuddy.cn`, not the chat host:
-  // the billing realm is a different service from the one that serves chat,
-  // and the CN chat host answers the meter path with an HTML error page.
-  const billingBase = providerId === "workbuddycn" ? WORKBUDDY_CN_BILLING_BASE_URL : providerBaseUrl(providerId);
-  return fetchTencentBillingQuota({
-    source: providerId,
-    display,
-    url: `${billingBase}/v2/billing/meter/get-user-resource`,
-    headers: await billingHeaders(domain, clientVersion, enterpriseId),
-    credential,
-    fetcher,
-    defaultPlan: display,
-    uid: buddyAccountUid(credential),
-  });
-}
-
-/**
- * Real credit deductions for one WorkBuddy account.
- *
- * Mirrors {@link fetchWorkBuddyQuotaFor} in every respect but the endpoint —
- * same billing host, same client-version identity headers, same account UID —
- * because the usage-detail surface is the billing meter's other read.
- */
-export async function fetchWorkBuddyRequestUsage(
-  credential: string,
-  fetcher: FetchLike,
-  args: {
-    readonly providerId?: "workbuddy" | "workbuddycn";
-    readonly days?: number;
-    readonly context?: QuotaCollectionContext;
-  } = {},
-): Promise<BuddyUsageResult> {
-  const providerId = args.providerId ?? "workbuddy";
-  const domain = providerId === "workbuddycn" ? "www.workbuddy.cn" : WORKBUDDY_DOMAIN;
-  const authState = typeof args.context?.auth_state === "object" && args.context?.auth_state !== null
-    ? (args.context.auth_state as Record<string, unknown>)
-    : undefined;
-  const enterpriseId = typeof authState?.enterpriseId === "string" ? authState.enterpriseId : undefined;
-  const clientVersion = providerId === "workbuddycn"
-    ? getWorkBuddyCnClientVersion()
-    : getWorkBuddyClientVersion();
-  return fetchBuddyRequestUsage({
-    url: `${providerBaseUrl(providerId)}/billing/meter/get-user-request-usage`,
-    headers: await billingHeaders(domain, clientVersion, enterpriseId),
-    credential,
-    fetcher,
-    days: args.days ?? 30,
-    uid: buddyAccountUid(credential),
-  });
-}
-
+import type { FetchLike, ProviderQuotaResult } from "../../../quota/quota-contracts";
+import type { QuotaCollectionContext } from "../../../quota/quota-support";
+import { providerBaseUrl } from "../../../provider-metadata";
+import {
+  buildWorkBuddyUserAgent,
+  getWorkBuddyClientVersion,
+  getWorkBuddyCnClientVersion,
+  getWorkBuddyCliVersion,
+} from "../../../operations/client-versions";
+import { WORKBUDDY_DOMAIN } from "./shared";
+import { fetchTencentBillingQuota } from "../buddy-quota-shared";
+import { fetchBuddyRequestUsage, type BuddyUsageResult } from "../buddy-usage-shared";
+import { buddyAccountUid } from "../buddy-oauth-shared";
+
+/**
+ * WorkBuddy international billing quota.
+ *
+ * Endpoint: POST https://www.workbuddy.ai/v2/billing/meter/get-user-resource
+ * Request:  Authorization: Bearer <accessToken||apiKey>, desktop-client headers,
+ *           X-User-Id for the account UID, and the reference filter envelope
+ *           (ProductCode p_tcaca, statuses [0, 3], 101-year package window).
+ * Response: { code: 0, data: { Response: { Data: { Accounts: [...] } } } }
+ *
+ * Same Tencent billing envelope as CodeBuddy CN, so the parsing is the shared
+ * one in `buddy-quota-shared.ts`; only the endpoint and identity headers are
+ * WorkBuddy-specific.
+ */
+
+/**
+ * The CN billing realm's host.
+ *
+ * The reference bills the CN realm here rather than on the CN chat host
+ * (`www.workbuddy.cn`): billing is a separate service, and the chat host does
+ * not serve the meter path.
+ */
+const WORKBUDDY_CN_BILLING_BASE_URL = "https://www.codebuddy.cn";
+
+export const WORKBUDDY_USAGE_URL =
+  `${providerBaseUrl("workbuddy")}/v2/billing/meter/get-user-resource`;
+
+async function billingHeaders(
+  domain: string,
+  clientVersion: string,
+  enterpriseId?: string,
+): Promise<Record<string, string>> {
+  return {
+    "User-Agent": buildWorkBuddyUserAgent(clientVersion, getWorkBuddyCliVersion()),
+    "X-Product": "SaaS",
+    "X-Domain": domain,
+    "X-Requested-With": "XMLHttpRequest",
+    "X-CodeBuddy-Request": "1",
+    "Accept-Language": "en-US",
+    ...(enterpriseId === undefined || enterpriseId.length === 0
+      ? {}
+      : { "X-Tenant-Id": enterpriseId, "X-Enterprise-Id": enterpriseId }),
+  };
+}
+
+/**
+ * Fetches WorkBuddy quota via the Tencent billing endpoint.
+ *
+ * Auth: `Authorization: Bearer <credential>` (api_key and oauth both use
+ * Bearer; the caller passes the resolved secret).
+ */
+export async function fetchWorkBuddyQuota(
+  credential: string,
+  fetcher: FetchLike,
+  context?: QuotaCollectionContext,
+): Promise<ProviderQuotaResult> {
+  return fetchWorkBuddyQuotaFor({
+    providerId: "workbuddy",
+    display: "WorkBuddy",
+    domain: WORKBUDDY_DOMAIN,
+    credential,
+    fetcher,
+    ...(context === undefined ? {} : { context }),
+  });
+}
+
+export async function fetchWorkBuddyCnQuota(
+  credential: string,
+  fetcher: FetchLike,
+  context?: QuotaCollectionContext,
+): Promise<ProviderQuotaResult> {
+  return fetchWorkBuddyQuotaFor({
+    providerId: "workbuddycn",
+    display: "WorkBuddy CN",
+    domain: "www.workbuddy.cn",
+    credential,
+    fetcher,
+    ...(context === undefined ? {} : { context }),
+  });
+}
+
+async function fetchWorkBuddyQuotaFor(args: {
+  readonly providerId: "workbuddy" | "workbuddycn";
+  readonly display: string;
+  readonly domain: string;
+  readonly credential: string;
+  readonly fetcher: FetchLike;
+  readonly context?: QuotaCollectionContext;
+}): Promise<ProviderQuotaResult> {
+  const { providerId, display, domain, credential, fetcher, context } = args;
+  const authState = typeof context?.auth_state === "object" && context?.auth_state !== null
+    ? (context.auth_state as Record<string, unknown>)
+    : undefined;
+  const enterpriseId = typeof authState?.enterpriseId === "string" ? authState.enterpriseId : undefined;
+  const clientVersion = providerId === "workbuddycn"
+    ? getWorkBuddyCnClientVersion()
+    : getWorkBuddyClientVersion();
+  // The reference bills the CN realm on `www.codebuddy.cn`, not the chat host:
+  // the billing realm is a different service from the one that serves chat,
+  // and the CN chat host answers the meter path with an HTML error page.
+  const billingBase = providerId === "workbuddycn" ? WORKBUDDY_CN_BILLING_BASE_URL : providerBaseUrl(providerId);
+  return fetchTencentBillingQuota({
+    source: providerId,
+    display,
+    url: `${billingBase}/v2/billing/meter/get-user-resource`,
+    headers: await billingHeaders(domain, clientVersion, enterpriseId),
+    credential,
+    fetcher,
+    defaultPlan: display,
+    uid: buddyAccountUid(credential),
+  });
+}
+
+/**
+ * Real credit deductions for one WorkBuddy account.
+ *
+ * Mirrors {@link fetchWorkBuddyQuotaFor} in every respect but the endpoint —
+ * same billing host, same client-version identity headers, same account UID —
+ * because the usage-detail surface is the billing meter's other read.
+ */
+export async function fetchWorkBuddyRequestUsage(
+  credential: string,
+  fetcher: FetchLike,
+  args: {
+    readonly providerId?: "workbuddy" | "workbuddycn";
+    readonly days?: number;
+    readonly context?: QuotaCollectionContext;
+  } = {},
+): Promise<BuddyUsageResult> {
+  const providerId = args.providerId ?? "workbuddy";
+  const domain = providerId === "workbuddycn" ? "www.workbuddy.cn" : WORKBUDDY_DOMAIN;
+  const authState = typeof args.context?.auth_state === "object" && args.context?.auth_state !== null
+    ? (args.context.auth_state as Record<string, unknown>)
+    : undefined;
+  const enterpriseId = typeof authState?.enterpriseId === "string" ? authState.enterpriseId : undefined;
+  const clientVersion = providerId === "workbuddycn"
+    ? getWorkBuddyCnClientVersion()
+    : getWorkBuddyClientVersion();
+  return fetchBuddyRequestUsage({
+    url: `${providerBaseUrl(providerId)}/billing/meter/get-user-request-usage`,
+    headers: await billingHeaders(domain, clientVersion, enterpriseId),
+    credential,
+    fetcher,
+    days: args.days ?? 30,
+    uid: buddyAccountUid(credential),
+  });
+}
+

package/src/providers/integrations/claude/claude-quota.ts

@@ -1,4 +1,4 @@
-import { createHash } from "node:crypto";
+import { sha256Hex } from "../../../shared/hash";
 import { TtlCache } from "../../../persistence/ttl-cache";
 import type { FetchLike, ProviderQuotaResult, ProviderQuotaWindow } from "../../quota/quota-contracts";
 import { authCredential, getJson, percentWindow, record, text, number } from "../../quota/quota-contracts";
@@ -102,7 +102,7 @@ export async function fetchClaudeQuota(
   credential: string,
   fetcher: FetchLike,
 ): Promise<ProviderQuotaResult> {
-  const key = createHash("sha256").update(credential).digest("hex");
+  const key = sha256Hex(credential);
   const cached = quotaCache.get(key);
   if (cached !== undefined) return cached;
   if (quotaCooldown.get(key) !== undefined) {

package/src/providers/integrations/claude/claude-user-profiles.ts

@@ -1,3 +1,5 @@
+import { sha256Hex } from "../../../shared/hash";
+
 /**
  * Claude User Profiles REST client.
  *
@@ -32,7 +34,6 @@
  * (`claude-quota.ts:137-142`); **any future dispatch-time caller must catch and
  * continue**, because a profile lookup is metadata, not routing.
  */
-import { createHash } from "node:crypto";
 import { TtlCache } from "../../../persistence/ttl-cache";
 import { providerBaseUrl } from "../../provider-metadata";
 import type { FetchLike } from "../../quota/quota-contracts";
@@ -166,7 +167,7 @@ async function requestUserProfiles(
 }
 
 function credentialKey(credential: string): string {
-  return createHash("sha256").update(credential).digest("hex");
+  return sha256Hex(credential);
 }
 
 /** Query string built exactly as the donor builds it (`:152-157`). */

package/src/providers/integrations/claude/claude.ts

@@ -484,14 +484,13 @@ export class ClaudeAdapter implements ProviderAdapter {
         type: "text",
         text: createClaudeBillingText(firstUserText(request), retryCliVersion),
       };
-      const parsedBody = JSON.parse(requestBody) as Record<string, unknown>;
-      const existingSystem = Array.isArray(parsedBody["system"])
-        ? (parsedBody["system"] as unknown[])
+      const existingSystem = Array.isArray(payload["system"])
+        ? (payload["system"] as unknown[])
         : [];
       const retryBody = isClaudeCodeOAuth
         ? patchClaudeCchBody(
             JSON.stringify({
-              ...parsedBody,
+              ...payload,
               system: [
                 retryBilling,
                 ...existingSystem.filter(

package/src/providers/integrations/cline/cline.ts

@@ -8,7 +8,6 @@ import { completeRequiredSchema, isRecord } from "../../../protocol/codecs";
 import { providerBaseUrl } from "../../provider-metadata";
 import { getCachedModelDiscovery } from "../../operations/model-discovery-cache";
 import { defineModel } from "../../provider-model-definition";
-import { openrouterFreeRoster } from "../../discovery/openrouter-free-roster";
 import { clinePlatform, clinePlatformVersion } from "../../operations/cli-platform";
 import {
   getClineCliVersion,
@@ -502,25 +501,112 @@ export async function fetchClineFreeModelIds(
 }
 
 /**
- * Static seed for Cline's free tier.
+ * Static seed for Cline: the zero-cost tier and the Cline Pass roster.
  *
  * Every id here is materialized into the `models` table at boot with
  * `source: "builtin"`, and `seedBundledModels` deletes any builtin row this
  * list no longer declares. That makes the list the *owner* of these rows: an id
  * Cline retires from its roster keeps its catalog card — and its route — until
  * it is removed here, because nothing else prunes a builtin row. The seed is
- * therefore kept to ids Cline currently serves on the free tier; a stale entry
- * is a card that can only ever fail a probe.
+ * therefore kept to ids Cline currently serves; a stale entry is a card that
+ * can only ever fail a probe.
  *
  * Cline's live roster (`/ai/cline/recommended-models`, read by
  * `fetchClineRecommendedModels`) is the authority for what is routable right
  * now, and "Fetch models" reconciles against it. This list is the offline seed
  * that makes a fresh install usable before the first fetch.
+ *
+ * Both sections came from a live probe of that endpoint with a real key, not
+ * from the OpenRouter listing Cline is backed by — the two disagree, and the
+ * endpoint's own buckets are what the account can route. It is its own list
+ * rather than {@link openrouterFreeRoster}, which Kilo and OpenRouter still
+ * use: one list for three providers is right for a catalog fact and wrong for
+ * an account fact.
+ *
+ * This is a floor, and live discovery still finds every id the account can
+ * route — including any absent here. A manual fetch is unaffected by what this
+ * list declares.
+ */
+interface ClineSeedRow {
+  readonly id: string;
+  readonly ctx: number;
+  readonly out: number;
+  readonly vision?: boolean;
+}
+
+function clineRow(
+  rows: readonly ClineSeedRow[],
+  extra: { free?: boolean; proOnly?: boolean },
+): readonly ModelDefinition[] {
+  return rows.map((row) =>
+    defineModel({
+      id: row.id,
+      providerId: CLINE_PROVIDER_ID,
+      wireFamily: "chat",
+      endpoint: CLINE_CHAT_PATH,
+      ctx: row.ctx,
+      out: row.out,
+      vision: row.vision ?? false,
+      reasoning: true,
+      toolCall: true,
+      ...(extra.free === true ? { free: true, freeTier: true } : {}),
+      ...(extra.proOnly === true ? { proOnly: true } : {}),
+    }),
+  );
+}
+
+/**
+ * The zero-cost tier, exactly as this account's `free` bucket publishes it.
+ *
+ * Probed against `/ai/cline/recommended-models` with a live key, not inferred
+ * from the OpenRouter listing. That matters because the two disagree: the
+ * `/models` listing names 17 `:free` ids, while the account's own `free` bucket
+ * names 5 and shares none of them. The listing is the upstream catalog; the
+ * bucket is what this account can actually route, and only the second is a
+ * fact worth seeding.
+ *
+ * Two ids carry the `cline-free/` prefix. That prefix is Cline's own namespace,
+ * not a tier marker — membership of the bucket is what makes a row free.
  */
-export const CLINE_MODELS: readonly ModelDefinition[] = openrouterFreeRoster({
-  providerId: CLINE_PROVIDER_ID,
-  endpoint: CLINE_CHAT_PATH,
-});
+const CLINE_FREE_ROWS: readonly ClineSeedRow[] = [
+  { id: "reflection/beam-free", ctx: 128_000, out: 32_000 },
+  { id: "cline-free/nemotron-3.5-super-vl", ctx: 1_000_000, out: 131_072, vision: true },
+  { id: "nvidia/nemotron-3.5-lightning-free", ctx: 1_000_000, out: 65_536 },
+  { id: "poolside/laguna-s-2.1-free", ctx: 262_144, out: 32_768 },
+  { id: "cline-free/solar-mini4", ctx: 524_288, out: 131_072 },
+];
+
+/**
+ * The Cline Pass subscription roster, as the account's `clinePass` bucket
+ * publishes it.
+ *
+ * Seeded with `proOnly`, matching how the buddy roster marks a row a free plan
+ * is refused: dispatching one without a subscription 401s, so the card should
+ * say so rather than fail at request time. Discovery reads `clineAccountHasPass`
+ * first and only asks for these rows when the account has one.
+ */
+const CLINE_PASS_ROWS: readonly ClineSeedRow[] = [
+  { id: "cline-pass/kimi-k3.1-pro", ctx: 1_000_000, out: 32_000 },
+  { id: "cline-pass/minimax-m3.1-flash", ctx: 1_000_000, out: 128_000 },
+  { id: "cline-pass/deepseek-v4.1-flash-1017", ctx: 1_000_000, out: 128_000 },
+  { id: "cline-pass/deepseek-v4.1-flash", ctx: 1_000_000, out: 128_000 },
+  { id: "cline-pass/mimo-v2.6-flash", ctx: 1_000_000, out: 128_000 },
+  { id: "cline-pass/mimo-v2.6-pro", ctx: 1_000_000, out: 128_000 },
+  { id: "cline-pass/glm-5.3", ctx: 1_000_000, out: 64_000 },
+  { id: "cline-pass/deepseek-v4-pro", ctx: 1_000_000, out: 128_000 },
+  { id: "cline-pass/qwen3.8-max", ctx: 1_000_000, out: 65_536 },
+  { id: "cline-pass/muse-spark-1.3-contributor", ctx: 1_000_000, out: 65_536 },
+  { id: "cline-pass/kimi-k3", ctx: 1_000_000, out: 32_000 },
+  { id: "cline-pass/glm-5.3-flash", ctx: 1_000_000, out: 32_000 },
+  { id: "cline-pass/qwen3.7-plus", ctx: 1_000_000, out: 65_536 },
+  { id: "cline-pass/qwen3.7-max", ctx: 1_000_000, out: 65_536 },
+  { id: "cline-pass/minimax-m3", ctx: 512_000, out: 64_000 },
+];
+
+export const CLINE_MODELS: readonly ModelDefinition[] = [
+  ...clineRow(CLINE_FREE_ROWS, { free: true }),
+  ...clineRow(CLINE_PASS_ROWS, { proOnly: true }),
+];
 
 
 export function createClineAdapter(fetchImpl?: typeof fetch): ProviderAdapter {

package/src/providers/integrations/codex/codex.ts

@@ -369,16 +369,21 @@ function authHeadersForCodex(
 }
 
 /**
- * Path of the Codex model registry, relative to the ChatGPT backend root.
+ * Paths of the Codex model registry, in the order they are tried.
  *
- * Donor `packages/catalog/src/discovery/codex.ts:9` tries `/codex/models` first
- * and `/models` second. Only the first path is used here: it is the one the
- * donor's own tests assert against
- * (`packages/coding-agent/test/model-discovery.test.ts:568,598`), and the
- * fallback exists upstream to accommodate relay base URLs this adapter does not
- * support.
+ * The donor tries `/codex/models` first and `/models` second
+ * (`packages/catalog/src/discovery/codex.ts:9`), both relative to the
+ * `https://chatgpt.com/backend-api` root (`packages/catalog/src/wire/codex.ts:5`)
+ * — so the first candidate is the same URL this file always used.
+ *
+ * The fallback used to be omitted on the ground that it exists upstream only
+ * for relay base URLs this adapter does not support. It is restored because
+ * fetching models failed outright with no listing endpoint reported: a single
+ * candidate means one upstream shape change removes discovery entirely, while
+ * trying both costs one extra request only when the first misses.
  */
-const CODEX_MODELS_PATH = "/backend-api/codex/models";
+const CODEX_MODELS_PATHS = ["/backend-api/codex/models", "/backend-api/models"] as const;
+const CODEX_MODELS_PATH = CODEX_MODELS_PATHS[0];
 
 /**
  * Shapes a client version may take for the `client_version` query parameter.
@@ -410,7 +415,7 @@ const CODEX_CLIENT_VERSION_PATTERN = /^\d+\.\d+\.\d+$/;
  */
 export function buildCodexModelsUrl(
   baseUrl: string,
-  path = CODEX_MODELS_PATH,
+  path: string = CODEX_MODELS_PATH,
   clientVersion = getCodexVersion(),
 ): string {
   const root = baseUrl.replace(/\/+$/, "");
@@ -471,39 +476,58 @@ export async function discoverCodexModels(input: {
       ? {}
       : { "x-openai-internal-codex-residency": residency }),
   };
+  const fetcher = input.fetcher ?? globalThis.fetch;
+  const root = input.baseUrl ?? DEFAULT_CHATGPT_BASE_URL;
+  let entries: readonly unknown[] | undefined;
   try {
-    const response = await (input.fetcher ?? globalThis.fetch)(
-      buildCodexModelsUrl(input.baseUrl ?? DEFAULT_CHATGPT_BASE_URL, CODEX_MODELS_PATH, version),
-      {
-        method: "GET",
-        headers,
-        ...(input.signal === undefined ? {} : { signal: input.signal }),
-      },
-    );
-    if (!response.ok) return null;
-    const payload = (await response.json()) as unknown;
-    const entries = boundedUpstreamArray(isRecord(payload) ? payload["models"] : undefined);
-    if (entries === undefined) return null;
-    const byId = new Map<string, ModelDefinition>();
-    for (const entry of entries) {
-      if (!isRecord(entry)) continue;
-      const id = sanitizeUpstreamLabel(entry["slug"] ?? entry["id"]);
-      if (id === undefined) continue;
-      const contextLimit = boundedUpstreamNumber(entry["context_window"], { min: 1, max: 1_000_000_000 });
-      const outputLimit = boundedUpstreamNumber(entry["max_output_tokens"], { min: 1, max: 1_000_000_000 });
-      byId.set(
-        id,
-        codexResponsesModel(
-          id,
-          contextLimit ?? DEFAULT_CODEX_DISCOVERY_CONTEXT_LIMIT,
-          outputLimit ?? DEFAULT_CODEX_DISCOVERY_OUTPUT_LIMIT,
-        ),
-      );
+    // Each candidate is tried in order and the first usable roster wins. The
+    // loop is what the donor does (`packages/catalog/src/discovery/codex.ts:138`);
+    // a non-200 or an unparseable body just advances to the next path, and
+    // exhausting them is the same "no roster" outcome as before.
+    for (const path of CODEX_MODELS_PATHS) {
+      let response: Response;
+      try {
+        response = await fetcher(buildCodexModelsUrl(root, path, version), {
+          method: "GET",
+          headers,
+          ...(input.signal === undefined ? {} : { signal: input.signal }),
+        });
+      } catch {
+        continue;
+      }
+      if (!response.ok) continue;
+      let payload: unknown;
+      try {
+        payload = (await response.json()) as unknown;
+      } catch {
+        continue;
+      }
+      const found = boundedUpstreamArray(isRecord(payload) ? payload["models"] : undefined);
+      if (found === undefined) continue;
+      entries = found;
+      break;
     }
-    return [...byId.values()].sort((a, b) => a.modelId.localeCompare(b.modelId));
   } catch {
     return null;
   }
+  if (entries === undefined) return null;
+  const byId = new Map<string, ModelDefinition>();
+  for (const entry of entries) {
+    if (!isRecord(entry)) continue;
+    const id = sanitizeUpstreamLabel(entry["slug"] ?? entry["id"]);
+    if (id === undefined) continue;
+    const contextLimit = boundedUpstreamNumber(entry["context_window"], { min: 1, max: 1_000_000_000 });
+    const outputLimit = boundedUpstreamNumber(entry["max_output_tokens"], { min: 1, max: 1_000_000_000 });
+    byId.set(
+      id,
+      codexResponsesModel(
+        id,
+        contextLimit ?? DEFAULT_CODEX_DISCOVERY_CONTEXT_LIMIT,
+        outputLimit ?? DEFAULT_CODEX_DISCOVERY_OUTPUT_LIMIT,
+      ),
+    );
+  }
+  return [...byId.values()].sort((a, b) => a.modelId.localeCompare(b.modelId));
 }
 
 /** Reads just enough of an untyped body to tell SSE from JSON, then replays it. */