dsh-plugin-subscriptions 0.5.3 → 0.6.0

package/lib/model-defaults.d.ts

@@ -0,0 +1,23 @@
+import { type ProviderId } from './auth/store.js';
+/** One model id → its configured default reasoning effort id. */
+export type ModelDefaultMap = Readonly<Record<string, string>>;
+/** Provider route → model defaults. */
+export type ModelDefaults = Readonly<Partial<Record<ProviderId, ModelDefaultMap>>>;
+/** Absolute path of the defaults file. */
+export declare function modelDefaultsFilePath(): string;
+/**
+ * The last load failure, or a warning about entries that were skipped while
+ * loading; consumers only use it for diagnostics.
+ */
+export declare function modelDefaultsLoadError(): unknown;
+/** A detached snapshot for the RPC surface (render + diffing). */
+export declare function modelDefaultsSnapshot(): ModelDefaults;
+/**
+ * Set or clear one model's configured default effort, then persist. The
+ * memory snapshot updates only after the atomic write succeeds, so a failed
+ * write never leaves the live state ahead of the file.
+ * @param provider - the subscription provider route.
+ * @param model - the wire model id.
+ * @param effort - the effort id, or undefined to clear the override.
+ */
+export declare function setDefaultEffort(provider: ProviderId, model: string, effort: string | undefined): Promise<void>;

package/lib/model-defaults.js

@@ -0,0 +1,237 @@
+/**
+ * Per-model default reasoning effort overrides — the durable half of the
+ * Settings page's per-model "default effort" pickers.
+ *
+ * The file lives at `~/.dsh/plugins/subscriptions/model-defaults.json`
+ * (mode 0600, atomic replace). Shape: `{ "<provider>": { "<model id>": "<effort>" } }`.
+ * An absent entry means "follow the provider's own default": the `Default`
+ * chip the model picker shows when the discovered catalog advertises no
+ * default at all.
+ *
+ * Writes are single-process and atomic, but *not* as serialised as the rest
+ * of the page: the Settings page disables only the row being saved, so two
+ * rows saved back to back can overlap. The write chain below serialises them,
+ * so no update is lost to a read-modify-write race. Every read comes from the
+ * in-memory snapshot, so the on-disk file only needs to survive a restart: a
+ * malformed file reads as empty and is rewritten on the next save, never
+ * taking the plugin down with it.
+ */
+import { chmod, mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { dshHomePath } from '@deepseek-ai/dsh-home-paths';
+import { PROVIDER_IDS } from './auth/store.js';
+/** Absolute path of the defaults file. */
+export function modelDefaultsFilePath() {
+    return dshHomePath('plugins', 'subscriptions', 'model-defaults.json');
+}
+const EMPTY = Object.freeze({});
+/** In-memory snapshot read by every consumer (adapters, RPC). */
+let current = EMPTY;
+/** One lazy load of the on-disk file (read once per process). */
+let ready;
+/** Last load failure, surfaced to callers that care; defaults stay empty. */
+let loadError;
+/**
+ * Serialises every write: the read-modify-write sequence must not interleave,
+ * or a fast second save would compute its snapshot from the stale `current`
+ * and silently drop the first update (the UI disables only the row being
+ * saved, so overlaps are reachable).
+ */
+let writeChain = Promise.resolve();
+/**
+ * Validate one persisted provider section: a string→string map, or undefined.
+ * Malformed *entries* are skipped, not the whole section: one bad value (a
+ * hand edit losing its quotes) must not silently un-configure every model in
+ * that provider. What was dropped is reported so the caller can surface it
+ * instead of the loss disappearing.
+ */
+function sanitizeProvider(value, dropped) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return undefined;
+    const entries = {};
+    for (const [model, effort] of Object.entries(value)) {
+        if (typeof effort !== 'string' || effort.length === 0) {
+            dropped.push(model);
+            continue;
+        }
+        entries[model] = effort;
+    }
+    if (Object.keys(entries).length === 0)
+        return undefined;
+    return Object.freeze(entries);
+}
+/** Validate the raw document: only known providers, malformed sections dropped. */
+function sanitizeDefaults(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return { defaults: EMPTY, dropped: [] };
+    const record = value;
+    const result = {};
+    const dropped = [];
+    for (const provider of PROVIDER_IDS) {
+        const section = sanitizeProvider(record[provider], dropped);
+        if (section !== undefined)
+            result[provider] = section;
+    }
+    return { defaults: Object.freeze(result), dropped };
+}
+/** Read and validate the on-disk file; a missing file reads as empty. */
+async function loadFile(path) {
+    let text;
+    try {
+        text = await readFile(path, 'utf8');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return EMPTY;
+        throw error;
+    }
+    try {
+        const { defaults, dropped } = sanitizeDefaults(JSON.parse(text));
+        if (dropped.length > 0)
+            loadError = new Error(`subscriptions model defaults: ${dropped.length} malformed entr${dropped.length === 1 ? 'y' : 'ies'} skipped (${dropped.join(', ')}); fix or delete the file`);
+        return defaults;
+    }
+    catch {
+        throw new Error(`subscriptions model defaults at ${path} are not valid JSON; fix or delete the file`);
+    }
+}
+/** Resolve the module state once from disk; failures leave the defaults empty. */
+async function ensureReady() {
+    ready ??= loadFile(modelDefaultsFilePath()).then((loaded) => {
+        current = loaded;
+        // loadFile itself sets loadError for skipped entries; do not clobber it.
+    }, (error) => {
+        loadError = error;
+        current = EMPTY;
+    });
+    return ready;
+}
+/** Persist a snapshot atomically with owner-only permissions. */
+async function atomicPersist(defaults, path) {
+    await mkdir(dirname(path), { recursive: true });
+    const tmp = `${path}.tmp-${process.pid}-${Math.random().toString(36).slice(2)}`;
+    try {
+        await writeFile(tmp, JSON.stringify(defaults, null, 2), { mode: 0o600 });
+        await chmod(tmp, 0o600);
+        await rename(tmp, path);
+    }
+    catch (error) {
+        await rm(tmp, { force: true });
+        throw error;
+    }
+}
+let persistDefaults = atomicPersist;
+/**
+ * Clone one provider section, or undefined when nothing is configured for it.
+ * The clone is prototype-less: model ids are provider-supplied catalog data
+ * used as object keys, and consumers index the section directly (the RPC
+ * catalog in index.ts does), so an id like `toString` would otherwise yield an
+ * inherited *function* where a string is declared.
+ */
+function sectionOf(defaults, provider) {
+    const section = defaults[provider];
+    if (section === undefined)
+        return undefined;
+    return Object.assign(Object.create(null), section);
+}
+/**
+ * Ready the defaults store.
+ * @internal Exported for tests; index.ts calls it at apply time so every
+ * later synchronous read sees the persisted state.
+ */
+export async function loadModelDefaults() {
+    await ensureReady();
+}
+/**
+ * The last load failure, or a warning about entries that were skipped while
+ * loading; consumers only use it for diagnostics.
+ */
+export function modelDefaultsLoadError() {
+    return loadError;
+}
+/**
+ * The configured default effort for one model, or undefined when none (the
+ * picker then follows the provider's own default).
+ * @internal Exported for the adapters' `defaultEffortOf` options.
+ */
+export function defaultEffortOf(provider, model) {
+    const section = current[provider];
+    if (section === undefined)
+        return undefined;
+    // Own-property lookup: a model id is provider-supplied catalog data, and a
+    // plain index would inherit from Object.prototype for names like
+    // `toString`, handing a *function* to mergeReasoning (which then throws and
+    // breaks that model's resolution).
+    return Object.prototype.hasOwnProperty.call(section, model) ? section[model] : undefined;
+}
+/** A detached snapshot for the RPC surface (render + diffing). */
+export function modelDefaultsSnapshot() {
+    const result = {};
+    for (const provider of PROVIDER_IDS) {
+        const section = sectionOf(current, provider);
+        if (section !== undefined)
+            result[provider] = section;
+    }
+    return Object.freeze(result);
+}
+/**
+ * Set or clear one model's configured default effort, then persist. The
+ * memory snapshot updates only after the atomic write succeeds, so a failed
+ * write never leaves the live state ahead of the file.
+ * @param provider - the subscription provider route.
+ * @param model - the wire model id.
+ * @param effort - the effort id, or undefined to clear the override.
+ */
+export function setDefaultEffort(provider, model, effort) {
+    // Chained behind every earlier write: the snapshot `current` is read inside
+    // the chain, so two overlapping saves cannot lose either update. The caller
+    // receives the promise of its own write (a rejection propagates), not the
+    // shared chain.
+    const run = writeChain.then(async () => {
+        await ensureReady();
+        const section = { ...sectionOf(current, provider) ?? {} };
+        if (effort === undefined) {
+            delete section[model];
+        }
+        else {
+            section[model] = effort;
+        }
+        const next = { ...current };
+        if (Object.keys(section).length === 0) {
+            delete next[provider];
+        }
+        else {
+            next[provider] = Object.freeze(section);
+        }
+        const frozen = Object.freeze(next);
+        await persistDefaults(frozen, modelDefaultsFilePath());
+        current = frozen;
+    });
+    // Keep the chain alive even when one write fails, or every later save would
+    // be stuck behind the rejected promise. The caller has already received the
+    // rejection through `run`.
+    writeChain = run.catch(() => undefined);
+    return run;
+}
+/**
+ * Drop the in-memory state and the cached load. Test-only: lets a suite
+ * unwind the lazy singleton before the next `loadModelDefaults`.
+ * @internal Exported for tests only; not part of the plugin's public surface.
+ */
+export async function resetModelDefaultsForTests() {
+    current = EMPTY;
+    ready = undefined;
+    loadError = undefined;
+    writeChain = Promise.resolve();
+    persistDefaults = atomicPersist;
+}
+/**
+ * Test-only seam: replace the atomic persistence so a failure happens on the
+ * real write path. Proves a failed write propagates to the caller and does
+ * not wedge the write chain (resetModelDefaultsForTests restores the real
+ * implementation).
+ * @internal Exported for tests only.
+ */
+export function overridePersistForTests(persist) {
+    persistDefaults = persist;
+}

package/lib/providers/claude.d.ts

@@ -12,6 +12,7 @@ import type { AttachmentStore } from '@deepseek-ai/dsh-attachment';
 import type { TranslatableMessage } from '../translate/resolved.js';
 import { AccountTokenManager } from './accounts.js';
 import type { CatalogPersistence, DiscoveredModel, FetchFn, ModelEntry, ProviderUsage } from './common.js';
+import type { RateLimitResetReader, RateLimitWait } from './rate-limit.js';
 export declare const CLAUDE_CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
 export declare const CLAUDE_AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
 export declare const CLAUDE_TOKEN_URL = "https://claude.ai/v1/oauth/token";
@@ -22,6 +23,20 @@ export declare const CLAUDE_SCOPE = "org:create_api_key user:profile user:infere
 export declare const CLAUDE_CALLBACK_PATH = "/callback";
 /** Refresh when the access token has less than this much life left. */
 export declare const CLAUDE_PREEMPT_MS: number;
+/**
+ * Reads the reset instant of the Anthropic window that rejected a request.
+ *
+ * `anthropic-ratelimit-unified-*` is the subscription-plan family — the one
+ * Claude Code renders as "resets 3pm" — and is the only header that names the
+ * window which actually rejected this request. The per-bucket
+ * `anthropic-ratelimit-{requests,tokens,input-tokens,output-tokens}-reset`
+ * headers are deliberately not read: they are rollover snapshots attached to
+ * every response, so on a 429 they cannot say which bucket refused, and the
+ * earliest of them is typically the bucket that still had room — a wait that
+ * lands straight back in the closed window. They reach the operator through
+ * `rateLimitDiagnostics` instead.
+ */
+export declare const claudeRateLimitReset: RateLimitResetReader;
 /**
  * The subscription endpoint only serves requests presenting as Claude Code,
  * so these headers impersonate the CLI; the harness attribution user-agent
@@ -78,12 +93,18 @@ export interface ClaudeAdapterOptions {
     discovery: boolean;
     fetchFn?: FetchFn;
     onWarn?: (message: string) => void;
-    /** Max retries on a retryable failure before giving up; matches Claude Code's own client-side retry count. Defaults to the dsh-llm default (2) when unset. */
-    maxRetries?: number;
+    /** How long this route may hold a turn open waiting for a rate-limit window; defaults to waiting on, six-hour ceiling. */
+    rateLimit?: RateLimitWait;
     /** Resolve the attachment service per request; absent means image requests fail loudly. */
     resolveAttachments?: () => AttachmentStore | undefined;
     /** Durable catalog store seeding capability metadata across restarts. */
     catalogStore?: CatalogPersistence;
+    /**
+     * Per-model default reasoning effort override (the Settings page's picker).
+     * Returns the user-configured default for one model, or undefined to follow
+     * the provider's own default.
+     */
+    defaultEffortOf?: (model: string) => string | undefined;
 }
 /**
  * Assemble the Anthropic request body.
@@ -118,7 +139,7 @@ export declare class ClaudeAdapter extends LlmAdapter {
     private discovered;
     private staticModels;
     providerInfo(provider: string): LlmProviderInfo;
-    providerRetryPolicy(provider: string): import("@deepseek-ai/dsh-llm").ResolvedRetryPolicy | undefined;
+    providerRetryPolicy(provider: string): import("@deepseek-ai/dsh-llm").ResolvedRetryPolicy;
     listModels(provider: string): Promise<readonly LlmModelInfo[]>;
     /** The provider's own catalog: union of every account, or one account when named. */
     listOwnModels(provider: string, account?: string, signal?: AbortSignal): Promise<readonly LlmModelInfo[]>;

package/lib/providers/claude.js

@@ -4,12 +4,13 @@
  * the Anthropic Messages API with the Claude Code identity headers.
  */
 import { execFileSync } from 'node:child_process';
-import { EMPTY_RESPONSE_CODE, errorChain, LlmAdapter, LlmError, ReasoningEffortId, resolveRetryPolicy } from '@deepseek-ai/dsh-llm';
+import { EMPTY_RESPONSE_CODE, errorChain, LlmAdapter, LlmError, ReasoningEffortId } from '@deepseek-ai/dsh-llm';
 import { resolveImages } from '../translate/resolved.js';
 import { markMessageCache, streamAnthropic, toAnthropicMessages, toAnthropicSystem, toAnthropicTools, } from '../translate/anthropic.js';
-import { httpLlmError, idleWatchdog, mapFetchFailure, ModelCatalogCache, discoverAcrossAccounts, discoverOrRetryAuth, isDiscoveryAborted, isMissingOrInvalidCredential, oauthEndpointError, OAuthEndpointError, } from './common.js';
+import { httpLlmError, idleWatchdog, mapFetchFailure, mergeReasoning, ModelCatalogCache, discoverAcrossAccounts, discoverOrRetryAuth, isDiscoveryAborted, isMissingOrInvalidCredential, oauthEndpointError, OAuthEndpointError, } from './common.js';
 import { AccountTokenManager, DISCOVERY_TIMEOUT_MS, unionAccountCatalogs } from './accounts.js';
 import { proxiedFetch } from '../http.js';
+import { DEFAULT_RATE_LIMIT_WAIT, DEFAULT_RETRY, earliestReset, jsonBody, resetFromFields, resetInstantFromHeader, subscriptionRetryPolicy, } from './rate-limit.js';
 export const CLAUDE_CLIENT_ID = '9d1c250a-e61b-44d9-88ed-5944d1962f5e';
 export const CLAUDE_AUTHORIZE_URL = 'https://claude.ai/oauth/authorize';
 export const CLAUDE_TOKEN_URL = 'https://claude.ai/v1/oauth/token';
@@ -22,6 +23,30 @@ const CLAUDE_CONTEXT_WINDOW = 200_000;
 const CLAUDE_DEFAULT_MAX_TOKENS = 32_000;
 /** Refresh when the access token has less than this much life left. */
 export const CLAUDE_PREEMPT_MS = 5 * 60_000;
+/**
+ * Body fields Anthropic uses to name a reset instant, read when the unified
+ * headers are absent.
+ */
+const CLAUDE_RESET_FIELDS = ['resets_at', 'resetsAt', 'reset_at', 'retry_after'];
+/**
+ * Reads the reset instant of the Anthropic window that rejected a request.
+ *
+ * `anthropic-ratelimit-unified-*` is the subscription-plan family — the one
+ * Claude Code renders as "resets 3pm" — and is the only header that names the
+ * window which actually rejected this request. The per-bucket
+ * `anthropic-ratelimit-{requests,tokens,input-tokens,output-tokens}-reset`
+ * headers are deliberately not read: they are rollover snapshots attached to
+ * every response, so on a 429 they cannot say which bucket refused, and the
+ * earliest of them is typically the bucket that still had room — a wait that
+ * lands straight back in the closed window. They reach the operator through
+ * `rateLimitDiagnostics` instead.
+ */
+export const claudeRateLimitReset = (response, body, now) => {
+    const unified = earliestReset(resetInstantFromHeader(response, 'anthropic-ratelimit-unified-reset', now), resetInstantFromHeader(response, 'anthropic-ratelimit-unified-fallback-reset', now));
+    if (unified !== undefined)
+        return unified;
+    return resetFromFields(jsonBody(body), CLAUDE_RESET_FIELDS, now);
+};
 /**
  * The subscription endpoint only serves requests presenting as Claude Code,
  * so these headers impersonate the CLI; the harness attribution user-agent
@@ -324,14 +349,6 @@ export async function fetchClaudeModels(session, fetchFn = proxiedFetch, signal)
     }
     return models;
 }
-/**
- * Claude Code's own SDK retry shape: exponential backoff starting at 1s,
- * doubling per attempt, capped at 60s, plus jitter. `maxRetries` is the
- * count of retries after the first attempt (Claude Code defaults to 10).
- */
-const CLAUDE_RETRY_INITIAL_DELAY_MS = 1_000;
-const CLAUDE_RETRY_MAX_DELAY_MS = 60_000;
-const CLAUDE_RETRY_JITTER_RATIO = 0.2;
 /** The Claude 4.5 family accepts image input. */
 const CLAUDE_MODALITIES = ['text', 'image'];
 /**
@@ -433,17 +450,7 @@ export class ClaudeAdapter extends LlmAdapter {
         return { id: provider, name: 'Claude (Subscription)' };
     }
     providerRetryPolicy(provider) {
-        if (this.options.maxRetries === undefined)
-            return undefined;
-        return resolveRetryPolicy({
-            mode: 'normal',
-            maxRetries: this.options.maxRetries,
-            backoff: {
-                initialDelayMs: CLAUDE_RETRY_INITIAL_DELAY_MS,
-                maxDelayMs: CLAUDE_RETRY_MAX_DELAY_MS,
-                jitterRatio: CLAUDE_RETRY_JITTER_RATIO,
-            },
-        }, `claude: provider "${provider}" retryPolicy`);
+        return subscriptionRetryPolicy(DEFAULT_RETRY, this.options.rateLimit ?? DEFAULT_RATE_LIMIT_WAIT, `claude: provider "${provider}" retryPolicy`);
     }
     async listModels(provider) {
         const own = await this.listOwnModels(provider);
@@ -498,7 +505,7 @@ export class ClaudeAdapter extends LlmAdapter {
     async resolveOwnModel(provider, model) {
         const disc = await this.discovered(model);
         const configured = this.options.models.find(entry => entry.id === model);
-        const reasoning = disc?.reasoning;
+        const reasoning = mergeReasoning(this.options.defaultEffortOf?.(model), disc?.reasoning);
         return {
             provider,
             id: model,
@@ -532,8 +539,12 @@ export class ClaudeAdapter extends LlmAdapter {
                 session = await this.options.tokens.session(account, true);
                 response = await this.request(options, session, watchdog.signal);
             }
-            if (!response.ok)
-                throw await httpLlmError(response, 'claude API');
+            if (!response.ok) {
+                throw await httpLlmError(response, 'claude API', {
+                    rateLimitReset: claudeRateLimitReset,
+                    ...this.options.onWarn === undefined ? {} : { onWarn: this.options.onWarn },
+                });
+            }
             if (response.body === null) {
                 throw new LlmError('claude API returned no response body', EMPTY_RESPONSE_CODE);
             }

package/lib/providers/codex.d.ts

@@ -12,12 +12,24 @@ import type { AttachmentStore } from '@deepseek-ai/dsh-attachment';
 import type { ResponsesRequestInput } from '../translate/responses.js';
 import { AccountTokenManager } from './accounts.js';
 import type { CatalogPersistence, DiscoveredModel, FetchFn, ModelEntry, ProviderUsage } from './common.js';
+import type { RateLimitResetReader, RateLimitWait } from './rate-limit.js';
 export declare const CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 export declare const CODEX_AUTHORIZE_URL = "https://auth.openai.com/oauth/authorize";
 export declare const CODEX_TOKEN_URL = "https://auth.openai.com/oauth/token";
 export declare const CODEX_API_URL = "https://chatgpt.com/backend-api/codex/responses";
 /** Refresh when the access token has less than this much life left. */
 export declare const CODEX_PREEMPT_MS: number;
+/**
+ * Reads the reset instant of the Codex window that rejected a request.
+ *
+ * Body only. The `x-codex-{primary,secondary}-reset-after-seconds` headers are
+ * rollover snapshots the backend attaches to every response, one per window,
+ * so they say nothing about which window refused: a burst 429 that would clear
+ * in seconds still carries a primary rollover hours out, and reading it would
+ * park the turn for those hours. They reach the operator through
+ * `rateLimitDiagnostics` instead.
+ */
+export declare const codexRateLimitReset: RateLimitResetReader;
 /**
  * Fast tier (the codex CLI's "fast mode"): the Responses `service_tier` wire
  * value for priority processing, mirroring codex-rs
@@ -114,6 +126,14 @@ export interface CodexAdapterOptions {
     catalogStore?: CatalogPersistence;
     /** Per-account catalog bound for the picker union (defaults to {@link DISCOVERY_TIMEOUT_MS}). */
     discoveryTimeoutMs?: number;
+    /** How long this route may hold a turn open waiting for a rate-limit window; defaults to waiting on, six-hour ceiling. */
+    rateLimit?: RateLimitWait;
+    /**
+     * Per-model default reasoning effort override (the Settings page's picker).
+     * Returns the user-configured default for one model, or undefined to follow
+     * the provider's own default.
+     */
+    defaultEffortOf?: (model: string) => string | undefined;
     /**
      * Per-request speed lookup (the composer Speed toggle's host half). Returns
      * whether this session's current choice sends the model on the fast tier;
@@ -144,6 +164,7 @@ export declare class CodexAdapter extends LlmAdapter {
     /** Persisted cache for the default account; a throwaway cache for any other. */
     private catalogFor;
     providerInfo(provider: string): LlmProviderInfo;
+    providerRetryPolicy(provider: string): import("@deepseek-ai/dsh-llm").ResolvedRetryPolicy;
     private staticModels;
     listModels(provider: string): Promise<readonly LlmModelInfo[]>;
     /** The provider's own catalog: union of every account, or one account when named. */

package/lib/providers/codex.js

@@ -8,9 +8,10 @@ import { attributionHeaders, EMPTY_RESPONSE_CODE, errorChain, LlmAdapter, LlmErr
 import { decodeJwtPayload } from '../auth/jwt.js';
 import { resolveImages } from '../translate/resolved.js';
 import { streamResponses, toResponsesInput, toResponsesTools } from '../translate/responses.js';
-import { httpLlmError, idleWatchdog, mapFetchFailure, ModelCatalogCache, discoverAcrossAccounts, discoverOrRetryAuth, isDiscoveryAborted, isMissingOrInvalidCredential, oauthEndpointError, OAuthEndpointError, } from './common.js';
+import { effortDisplayName, httpLlmError, idleWatchdog, mapFetchFailure, mergeReasoning, ModelCatalogCache, discoverAcrossAccounts, discoverOrRetryAuth, isDiscoveryAborted, isMissingOrInvalidCredential, oauthEndpointError, OAuthEndpointError, } from './common.js';
 import { AccountTokenManager, DISCOVERY_TIMEOUT_MS, unionAccountCatalogs } from './accounts.js';
 import { proxiedFetch } from '../http.js';
+import { DEFAULT_RATE_LIMIT_WAIT, DEFAULT_RETRY, jsonBody, resetFromFields, subscriptionRetryPolicy, } from './rate-limit.js';
 export const CODEX_CLIENT_ID = 'app_EMoamEEZ73f0CkXaXp7hrann';
 export const CODEX_AUTHORIZE_URL = 'https://auth.openai.com/oauth/authorize';
 export const CODEX_TOKEN_URL = 'https://auth.openai.com/oauth/token';
@@ -21,6 +22,23 @@ const CODEX_CONTEXT_WINDOW = 400_000;
 const CODEX_DEFAULT_MAX_TOKENS = 128_000;
 /** Refresh when the access token has less than this much life left. */
 export const CODEX_PREEMPT_MS = 5 * 60_000;
+/**
+ * Body fields the backend uses to name a reset. A window-exhaustion rejection
+ * carries `usage_limit_reached` with the seconds left on the window — the case
+ * that used to classify as a terminal quota and never be retried at all.
+ */
+const CODEX_RESET_FIELDS = ['resets_in_seconds', 'reset_after_seconds', 'resets_at', 'reset_at'];
+/**
+ * Reads the reset instant of the Codex window that rejected a request.
+ *
+ * Body only. The `x-codex-{primary,secondary}-reset-after-seconds` headers are
+ * rollover snapshots the backend attaches to every response, one per window,
+ * so they say nothing about which window refused: a burst 429 that would clear
+ * in seconds still carries a primary rollover hours out, and reading it would
+ * park the turn for those hours. They reach the operator through
+ * `rateLimitDiagnostics` instead.
+ */
+export const codexRateLimitReset = (_response, body, now) => resetFromFields(jsonBody(body), CODEX_RESET_FIELDS, now);
 /** Default instruction when the request carries no system prompt. */
 const DEFAULT_CODEX_INSTRUCTIONS = 'You are Codex, a coding agent based on GPT-5. '
     + 'Help the user with their software engineering tasks.';
@@ -292,10 +310,6 @@ export const CODEX_MODELS_URL = 'https://chatgpt.com/backend-api/codex/models';
  * the range of current codex CLI releases.
  */
 export const CODEX_CLIENT_VERSION = '0.147.0';
-/** Display name for a wire reasoning-effort value. */
-function effortName(effort) {
-    return effort === 'xhigh' ? 'Extra High' : effort.charAt(0).toUpperCase() + effort.slice(1);
-}
 /**
  * Whether a catalog entry advertises the fast tier. Mirrors codex-rs
  * `ModelPreset::supports_fast_mode`: a `service_tiers` id matching the fast
@@ -341,7 +355,7 @@ export async function fetchCodexModels(session, fetchFn = proxiedFetch, signal)
             .filter(level => typeof level.effort === 'string' && level.effort.length > 0)
             .map(level => ({
             id: ReasoningEffortId(level.effort),
-            name: effortName(level.effort),
+            name: effortDisplayName(level.effort),
             ...level.description === undefined ? {} : { description: level.description },
         }));
         const defaultEffort = typeof entry.default_reasoning_level === 'string'
@@ -499,6 +513,9 @@ export class CodexAdapter extends LlmAdapter {
     providerInfo(provider) {
         return { id: provider, name: 'ChatGPT (Codex)' };
     }
+    providerRetryPolicy(provider) {
+        return subscriptionRetryPolicy(DEFAULT_RETRY, this.options.rateLimit ?? DEFAULT_RATE_LIMIT_WAIT, `codex: provider "${provider}" retryPolicy`);
+    }
     staticModels(provider) {
         return this.options.models.map(model => ({
             provider,
@@ -618,9 +635,15 @@ export class CodexAdapter extends LlmAdapter {
     /** Capability resolution of the provider's own models (the pool resolves members here). */
     async resolveOwnModel(provider, model) {
         // Discovered metadata (when discovery is on) wins over the static entry;
-        // the static entry wins over the built-in defaults.
+        // the static entry wins over the built-in defaults. A configured default
+        // effort merges over both.
         const discovered = await this.discovered(model);
         const configured = this.options.models.find(entry => entry.id === model);
+        // `extendable` only while falling back to the built-in list: that one is
+        // known to trail the backend, so a configured level it omits still has to
+        // be selectable. A discovered catalog is the truth about what the model
+        // accepts, and a stale override must not be forced onto every request.
+        const reasoning = mergeReasoning(this.options.defaultEffortOf?.(model), discovered?.reasoning ?? { efforts: CODEX_EFFORTS, defaultEffort: CODEX_DEFAULT_EFFORT }, { extendable: discovered?.reasoning === undefined });
         return {
             provider,
             id: model,
@@ -629,7 +652,7 @@ export class CodexAdapter extends LlmAdapter {
             inputModalities: configured?.inputModalities ?? CODEX_MODALITIES,
             context: { contextWindow: discovered?.contextWindow ?? configured?.contextWindow ?? CODEX_CONTEXT_WINDOW },
             defaultMaxTokens: configured?.maxTokens ?? CODEX_DEFAULT_MAX_TOKENS,
-            reasoning: discovered?.reasoning ?? { efforts: CODEX_EFFORTS, defaultEffort: CODEX_DEFAULT_EFFORT },
+            ...(reasoning === undefined ? {} : { reasoning }),
         };
     }
     async *stream(options) {
@@ -654,8 +677,12 @@ export class CodexAdapter extends LlmAdapter {
                 session = await this.options.tokens.session(account, true);
                 response = await this.request(options, session, watchdog.signal);
             }
-            if (!response.ok)
-                throw await httpLlmError(response, 'codex API');
+            if (!response.ok) {
+                throw await httpLlmError(response, 'codex API', {
+                    rateLimitReset: codexRateLimitReset,
+                    ...this.options.onWarn === undefined ? {} : { onWarn: this.options.onWarn },
+                });
+            }
             if (response.body === null) {
                 throw new LlmError('codex API returned no response body', EMPTY_RESPONSE_CODE);
             }