talon-agent 5.25.1 → 5.26.1

package/README.md

@@ -487,6 +487,7 @@ Config file: `~/.talon/config.json`
 | `model`                    | `"default"`  | Default model. Interpretation depends on the active backend.                                                            |
 | `agyBinary`                | ---          | Path to the Antigravity `agy` executable. `AGY_BINARY` overrides it. |
 | `codexApiKey`              | ---          | Codex-only OpenAI API key. Prefer this over `openaiApiKey` for Codex API-key auth. `codex login` takes precedence over shared `openaiApiKey`. |
+| `codexChatGptDefaultModel` | ---          | Model a ChatGPT-login Codex session falls back to when a model is rejected or none is set. Default: the Codex CLI's own default for the account (from `~/.codex/models_cache.json`). `TALON_CODEX_CHATGPT_MODEL` overrides it. |
 | `concurrency`              | `1`          | Max concurrent AI queries (1--20)                                                                                       |
 | `pulse`                    | `true`       | Periodic group engagement                                                                                               |
 | `heartbeat`                | `false`      | Background maintenance agent                                                                                            |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "talon-agent",
-  "version": "5.25.1",
+  "version": "5.26.1",
   "description": "Multi-frontend AI agent with full tool access, streaming, cron jobs, and plugin system",
   "author": "The Falconry",
   "license": "Apache-2.0",

package/src/backend/agy/one-shot.ts

@@ -33,6 +33,7 @@ import {
   type AgyResult,
   type AgyStepUpdate,
 } from "./events.js";
+import { abortLogLine } from "../../core/agents/abort-reason.js";
 
 const ts = (): string => new Date().toISOString().slice(11, 19);
 
@@ -257,20 +258,39 @@ export async function runOneShotAgent(
       appendLog,
       ...(onAssistantText ? { onAssistantText } : {}),
       aborted: abortController.signal.aborted,
+      abortSignal: abortController.signal,
     });
   } catch (err) {
+    // settleOneShot already logged its own failure — just pass it on.
+    if (err instanceof AgyOneShotError) throw err;
     const msg = err instanceof Error ? err.message : String(err);
     if (abortController.signal.aborted || /abort/i.test(msg)) {
-      await appendLog(`\n### [${ts()}] Aborted\nRun aborted by timeout.\n`);
+      await appendLog(
+        `\n### [${ts()}] Aborted\n${abortLogLine(abortController.signal)}\n`,
+      );
       return;
     }
     logWarn("agent", `agy one-shot run failed: ${msg}`);
     await appendLog(`\n### [${ts()}] Error\n${msg}\n`);
+    // Surface it: a swallowed failure is recorded as a successful run by
+    // cron, heartbeat and the task table.
+    throw new AgyOneShotError(msg, { cause: err });
   } finally {
     unregisterMcpScope(scope);
   }
 }
 
+/**
+ * An agy one-shot that failed: no result, a non-SUCCESS turn, or a spawn
+ * error. Thrown so callers record the run as failed rather than ok.
+ */
+class AgyOneShotError extends Error {
+  constructor(message: string, options?: { cause?: unknown }) {
+    super(message, options);
+    this.name = "AgyOneShotError";
+  }
+}
+
 /** Report the run's answer + usage, or its failure, to the log. */
 async function settleOneShot(inputs: {
   outcome: SpawnOutcome;
@@ -278,10 +298,14 @@ async function settleOneShot(inputs: {
   appendLog: (text: string) => Promise<void>;
   onAssistantText?: OneShotAgentParams["onAssistantText"];
   aborted: boolean;
+  abortSignal?: AbortSignal;
 }): Promise<OneShotUsage | void> {
   const { outcome, appendLog } = inputs;
   if (inputs.aborted) {
-    await appendLog(`\n### [${ts()}] Aborted\nRun aborted by timeout.\n`);
+    const line = inputs.abortSignal
+      ? abortLogLine(inputs.abortSignal)
+      : "Run aborted.";
+    await appendLog(`\n### [${ts()}] Aborted\n${line}\n`);
     return;
   }
   if (!outcome.result) {
@@ -290,7 +314,14 @@ async function settleOneShot(inputs: {
       : outcome.stderr.trim() || `agy exited ${outcome.code ?? "n/a"}`;
     logWarn("agent", `agy one-shot produced no result: ${reason}`);
     await appendLog(`\n### [${ts()}] Error\n${reason}\n`);
-    return;
+    throw new AgyOneShotError(reason);
+  }
+  if (outcome.result.status && outcome.result.status !== "SUCCESS") {
+    // logResult already wrote the "Turn <status>" section.
+    const reason =
+      outcome.result.error?.trim() || `agy turn ${outcome.result.status}`;
+    logWarn("agent", `agy one-shot turn ${outcome.result.status}: ${reason}`);
+    throw new AgyOneShotError(reason);
   }
   const response = outcome.result.response ?? "";
   if (response.trim()) {

package/src/backend/claude-sdk/model-provider.ts

@@ -71,19 +71,68 @@ function isSelectedModel(currentModel: string, candidateId: string): boolean {
 
 // ── Public API ─────────────────────────────────────────────────────────────
 
-export async function resolveModel(
-  query: string,
-): Promise<UnifiedModelResolution> {
-  const canonicalId = resolveModelId(query);
-  const model = getModel(canonicalId);
+const ONE_MILLION_SUFFIX = "[1m]";
 
-  if (model) {
+/**
+ * Split a `[1m]` context-variant suffix off a query ("opus[1m]" →
+ * { stem: "opus", oneMillion: true }). Claude Code accepts the suffix on
+ * any alias or id; the SDK's `supportedModels()` list does not enumerate
+ * the suffixed forms, so the catalog can't match them directly.
+ */
+function splitOneMillion(query: string): { stem: string; oneMillion: boolean } {
+  const trimmed = query.trim();
+  if (trimmed.toLowerCase().endsWith(ONE_MILLION_SUFFIX)) {
     return {
-      kind: "exact",
-      model: toUnified(model),
-      storedValue: model.id,
+      stem: trimmed.slice(0, -ONE_MILLION_SUFFIX.length).trim(),
+      oneMillion: true,
     };
   }
+  return { stem: trimmed, oneMillion: false };
+}
+
+/**
+ * Exact-match a query against the registry: its id/alias directly, or —
+ * for a `[1m]` query the registry doesn't list — the base model, returned
+ * as a 1M variant whose id keeps the suffix so the SDK actually selects
+ * the 1M context window.
+ *
+ * The SDK reports no context-window metadata per model, so there's no
+ * evidence to reject a `[1m]` request on; the binary is the authority.
+ * The one form refused is `default[1m]`: "default" is a moving target,
+ * not an alias Claude Code suffixes.
+ */
+function resolveExactUnified(query: string): UnifiedModelInfo | undefined {
+  const direct = getModel(resolveModelId(query));
+  if (direct) return toUnified(direct);
+
+  const { stem, oneMillion } = splitOneMillion(query);
+  if (!oneMillion || !stem) return undefined;
+  const baseId = resolveModelId(stem);
+  const base = getModel(baseId);
+  if (!base || stem.toLowerCase() === "default") return undefined;
+
+  // Pass the SDK a form it knows: the canonical id when it's concrete, the
+  // user's own stem when the canonical is the "default" alias (e.g. "opus"
+  // folds into "default" when default currently serves Opus).
+  const sdkStem = baseId === "default" ? stem : baseId;
+  const displayName = /\(1m context\)/i.test(base.displayName)
+    ? base.displayName
+    : `${base.displayName} (1M context)`;
+  return {
+    ...toUnified(base),
+    id: `${sdkStem}${ONE_MILLION_SUFFIX}`,
+    displayName,
+    contextWindow: 1_000_000,
+  };
+}
+
+export async function resolveModel(
+  query: string,
+): Promise<UnifiedModelResolution> {
+  const exact = resolveExactUnified(query);
+  if (exact) {
+    return { kind: "exact", model: exact, storedValue: exact.id };
+  }
 
   // No exact match -- try a substring search across display names and aliases
   const allModels = getModels(PROVIDER_ID);
@@ -112,9 +161,7 @@ export async function resolveModel(
 export async function getModelInfo(
   id: string,
 ): Promise<UnifiedModelInfo | undefined> {
-  const canonicalId = resolveModelId(id);
-  const model = getModel(canonicalId);
-  return model ? toUnified(model) : undefined;
+  return resolveExactUnified(id);
 }
 
 export async function getSettingsPresentation(

package/src/backend/codex/auth.ts

@@ -293,10 +293,39 @@ export function detectCodexAuth(
  * `"not supported when using Codex with a ChatGPT account"`. Match on
  * that substring (case-insensitive, generous on whitespace) so a
  * future wording shift still trips a soft-match.
+ *
+ * Also matches the 404 "model … does not exist or you do not have
+ * access" shape ({@link isCodexModelNotFoundError}): a model retired for
+ * the account is the same situation from the caller's point of view.
  */
 export function isChatGptModelMismatchError(message: string): boolean {
-  return /not\s+supported\s+when\s+using\s+codex\s+with\s+a\s+chatgpt\s+account/i.test(
-    message,
+  if (
+    /not\s+supported\s+when\s+using\s+codex\s+with\s+a\s+chatgpt\s+account/i.test(
+      message,
+    )
+  ) {
+    return true;
+  }
+  return isCodexModelNotFoundError(message);
+}
+
+/**
+ * Detect the "model retired / not granted" 404 the ChatGPT Codex endpoint
+ * returns once a model is withdrawn from an account:
+ *
+ *   `unexpected status 404 Not Found: The model \`gpt-5.5\` does not exist
+ *    or you do not have access to it.`
+ *
+ * Every Codex cron run hit exactly this from 2026-09-24 onward. It is as
+ * definitive as the 400 mismatch — the server names the model and says
+ * the account can't use it — so it takes the same fallback/learning path.
+ * Requires both the 404 status and the "model … does not exist" wording
+ * so an unrelated 404 (a missing MCP resource, a bad URL) can't trip it.
+ */
+export function isCodexModelNotFoundError(message: string): boolean {
+  return (
+    /\b404\b/.test(message) &&
+    /\bmodel\b[^\n]{0,120}?\bdoes\s+not\s+exist\b/i.test(message)
   );
 }
 

package/src/backend/codex/constants.ts

@@ -37,14 +37,28 @@ export const CODEX_SYSTEM_PROMPT_SUFFIX = codexSystemPromptSuffix("telegram");
 export const CODEX_DEFAULT_MODEL = "gpt-5-codex";
 
 /**
- * Default model used by the Codex backend when the user is signed in
- * via ChatGPT OAuth (`~/.codex/auth.json` `auth_mode: "chatgpt"`).
- * The `gpt-5-codex` model is rejected with a 400
- * `invalid_request_error` ("not supported when using Codex with a
- * ChatGPT account") on this auth path; `gpt-5.5` is the supported
- * flagship for ChatGPT users.
+ * Last-resort default model for the Codex backend when the user is signed
+ * in via ChatGPT OAuth (`~/.codex/auth.json` `auth_mode: "chatgpt"`).
+ * The `gpt-5-codex` model is rejected with a 400 `invalid_request_error`
+ * ("not supported when using Codex with a ChatGPT account") on this auth
+ * path.
+ *
+ * This is only the floor of the resolution ladder — see
+ * `getCodexChatGptDefaultModel()` in `models.ts`, which prefers (1) an
+ * explicit operator override, then (2) the Codex CLI's own default for the
+ * signed-in account (the first listed model in `~/.codex/models_cache.json`
+ * by priority). `gpt-6-astra` is the first entry of the model catalog
+ * bundled with codex-cli 0.154. The previous value, `gpt-5.5`, was retired
+ * for ChatGPT accounts in Sep 2026: every run on it returned
+ * `404 The model gpt-5.5 does not exist or you do not have access to it`.
+ */
+export const CODEX_CHATGPT_DEFAULT_MODEL = "gpt-6-astra";
+
+/**
+ * Environment override for the ChatGPT-OAuth default model. Takes
+ * precedence over the `codexChatGptDefaultModel` config key.
  */
-export const CODEX_CHATGPT_DEFAULT_MODEL = "gpt-5.5";
+export const CODEX_CHATGPT_MODEL_ENV = "TALON_CODEX_CHATGPT_MODEL";
 
 /**
  * ThreadOptions permission settings shared by both the chat handler and

package/src/backend/codex/discovery.ts

@@ -72,6 +72,8 @@ interface CodexCacheModelEntry {
   description?: string;
   visibility?: "list" | "hide" | string;
   supported_in_api?: boolean;
+  /** Picker order — lower sorts first; the CLI's default is the lowest. */
+  priority?: number;
   context_window?: number;
   default_reasoning_level?: string;
   supported_reasoning_levels?: Array<{
@@ -351,6 +353,33 @@ export async function fetchOpenAiModels(
  * Non-existent cache file throws so the caller's catch path logs it
  * at debug level and the picker falls back to curated.
  */
+/**
+ * The Codex CLI's own default for the account: the listed, API-callable
+ * entry with the lowest `priority`. First entry wins ties, matching the
+ * CLI's stable sort. `null` when nothing qualifies.
+ */
+function cliDefaultModel(
+  data: ReadonlyArray<CodexCacheModelEntry | null | undefined>,
+): string | null {
+  let best: string | null = null;
+  let bestPriority = Number.POSITIVE_INFINITY;
+  for (const entry of data) {
+    if (!entry || typeof entry.slug !== "string" || !entry.slug) continue;
+    if (entry.visibility === "hide" || entry.supported_in_api === false) {
+      continue;
+    }
+    const priority =
+      typeof entry.priority === "number" && Number.isFinite(entry.priority)
+        ? entry.priority
+        : Number.MAX_SAFE_INTEGER;
+    if (priority < bestPriority) {
+      bestPriority = priority;
+      best = entry.slug;
+    }
+  }
+  return best;
+}
+
 export async function loadCodexCacheModels(): Promise<void> {
   const path = getCodexCachePath();
   let raw: string;
@@ -381,6 +410,7 @@ export async function loadCodexCacheModels(): Promise<void> {
   const state = getState();
   state.discoveredModels.clear();
   state.discoveredModelMetadata.clear();
+  state.discoveredDefaultModel = cliDefaultModel(data);
   let kept = 0;
   let dropped = 0;
   for (const entry of data) {
@@ -429,6 +459,7 @@ export async function loadCodexCacheModels(): Promise<void> {
   const fetchedAt = json.fetched_at ?? "unknown";
   log(
     "agent",
-    `Codex: loaded ${kept} models from ${path} (fetched_at=${fetchedAt}, filtered ${dropped} hidden/api-disabled entries)`,
+    `Codex: loaded ${kept} models from ${path} (fetched_at=${fetchedAt}, filtered ${dropped} hidden/api-disabled entries` +
+      `${state.discoveredDefaultModel ? `, CLI default ${state.discoveredDefaultModel}` : ""})`,
   );
 }

package/src/backend/codex/factory.ts

@@ -28,10 +28,7 @@ import { initCodexAgent, getCodexAuthInfo } from "./init.js";
 import { handleMessage as codexHandleMessage } from "./handler/index.js";
 import { runOneShotAgent as codexRunOneShotAgent } from "./one-shot.js";
 import { resetState as resetCodexState } from "./state.js";
-import {
-  CODEX_DEFAULT_MODEL,
-  CODEX_CHATGPT_DEFAULT_MODEL,
-} from "./constants.js";
+import { CODEX_DEFAULT_MODEL } from "./constants.js";
 import {
   resolveModel as codexResolveModel,
   getModelInfo as codexGetModelInfo,
@@ -40,6 +37,7 @@ import {
   getProviderModels as codexGetProviderModels,
   formatModelError as codexFormatModelError,
   listModels as codexListModels,
+  getCodexChatGptDefaultModel,
 } from "./models.js";
 
 const codexFactory: BackendFactory = {
@@ -71,7 +69,7 @@ const codexFactory: BackendFactory = {
       getDefaultModelId: () => {
         const auth = getCodexAuthInfo();
         return auth?.mode === "chatgpt"
-          ? CODEX_CHATGPT_DEFAULT_MODEL
+          ? getCodexChatGptDefaultModel()
           : CODEX_DEFAULT_MODEL;
       },
       getRawModelInfo: (id) => codexGetModelInfo(id),

package/src/backend/codex/handler/message.ts

@@ -45,7 +45,6 @@ import {
 import {
   codexSystemPromptSuffix,
   CODEX_DEFAULT_MODEL,
-  CODEX_CHATGPT_DEFAULT_MODEL,
   CODEX_THREAD_PERMISSIONS,
 } from "../constants.js";
 import {
@@ -64,6 +63,7 @@ import {
   chatGptFallbackFor,
   getModelInfo,
   isCodexOAuthIncompat,
+  getCodexChatGptDefaultModel,
 } from "../models.js";
 import { supportsReasoningLevel } from "../../../core/models/reasoning-levels.js";
 import { toCodexReasoningEffort } from "../effort.js";
@@ -142,7 +142,7 @@ async function maybeFallbackForChatGptMismatch(
   const isOAuth = authInfo?.mode === "chatgpt";
   const silent =
     isOAuth &&
-    activeModel !== CODEX_CHATGPT_DEFAULT_MODEL &&
+    activeModel !== getCodexChatGptDefaultModel() &&
     isSilentOAuthExitError(probeText);
 
   if (!explicit && !silent) return undefined;
@@ -170,7 +170,7 @@ async function maybeFallbackForChatGptMismatch(
   }
 
   const fallbackModel =
-    chatGptFallbackFor(activeModel) ?? CODEX_CHATGPT_DEFAULT_MODEL;
+    chatGptFallbackFor(activeModel) ?? getCodexChatGptDefaultModel();
   if (fallbackModel === activeModel) return undefined;
 
   // Only EXPLICIT mismatch errors are persisted as OAuth-incompat —
@@ -227,8 +227,8 @@ function buildTurnPrompt(params: QueryParams): string {
 /**
  * Codex accepts arbitrary model strings; we pass through whatever the
  * caller resolved (chat-settings → config) and fall back to the auth-aware
- * default: `gpt-5-codex` when an API key is present, `gpt-5.5` when only
- * ChatGPT OAuth is configured (because `gpt-5-codex` is rejected with a
+ * default: `gpt-5-codex` when an API key is present, the resolved ChatGPT
+ * default (`getCodexChatGptDefaultModel`) when only ChatGPT OAuth is configured (because `gpt-5-codex` is rejected with a
  * 400 on ChatGPT-mode accounts). A model known to be OAuth-incompat on a
  * ChatGPT-OAuth account is swapped pre-emptively rather than letting the
  * first turn fail.
@@ -237,13 +237,13 @@ function resolveCodexModel(chatId: string, requested: string | undefined) {
   const authInfo = getCodexAuthInfo();
   const authAwareDefault =
     authInfo?.mode === "chatgpt"
-      ? CODEX_CHATGPT_DEFAULT_MODEL
+      ? getCodexChatGptDefaultModel()
       : CODEX_DEFAULT_MODEL;
   const requestedModel = requested ?? authAwareDefault;
   let activeModel = requestedModel;
   if (authInfo?.mode === "chatgpt" && isCodexOAuthIncompat(requestedModel)) {
     const fallback =
-      chatGptFallbackFor(requestedModel) ?? CODEX_CHATGPT_DEFAULT_MODEL;
+      chatGptFallbackFor(requestedModel) ?? getCodexChatGptDefaultModel();
     // Guard against a learned-but-no-fallback case — only swap when the
     // fallback is actually different from what we'd already run.
     if (fallback !== requestedModel) {

package/src/backend/codex/models.ts

@@ -37,6 +37,36 @@ import { awaitDiscovery, hasAttemptedDiscovery } from "./discovery.js";
 import { getState } from "./state.js";
 import { getCodexAuthInfo } from "./init.js";
 import { isKnownOAuthIncompat } from "./oauth-incompat.js";
+import {
+  CODEX_CHATGPT_DEFAULT_MODEL,
+  CODEX_CHATGPT_MODEL_ENV,
+} from "./constants.js";
+
+/**
+ * The model a ChatGPT-OAuth Codex session runs when nothing more specific
+ * applies — the target of every pre-emptive OAuth swap and mismatch
+ * fallback. Resolution order:
+ *
+ *   1. `TALON_CODEX_CHATGPT_MODEL` env var (operator override);
+ *   2. `codexChatGptDefaultModel` in config;
+ *   3. the Codex CLI's own default for the signed-in account (first
+ *      listed model in `~/.codex/models_cache.json` by priority), unless
+ *      Talon has already learned that id fails on this account;
+ *   4. {@link CODEX_CHATGPT_DEFAULT_MODEL}, the bundled floor.
+ *
+ * Hardcoding a single id is what broke in Sep 2026: OpenAI retired
+ * `gpt-5.5` for ChatGPT accounts and every run 404'd until a release.
+ */
+export function getCodexChatGptDefaultModel(): string {
+  const env = process.env[CODEX_CHATGPT_MODEL_ENV]?.trim();
+  if (env) return env;
+  const state = getState();
+  const configured = state.config?.codexChatGptDefaultModel?.trim();
+  if (configured) return configured;
+  const discovered = state.discoveredDefaultModel;
+  if (discovered && !isKnownOAuthIncompat(discovered)) return discovered;
+  return CODEX_CHATGPT_DEFAULT_MODEL;
+}
 
 /**
  * Codex-specific model metadata extension.
@@ -56,15 +86,26 @@ export interface CodexModelInfo extends UnifiedModelInfo {
  * Curated metadata for models we recognise.
  *
  * Order matters: `getSettingsPresentation` lists curated models in
- * this order, and `gpt-5.5` is intentionally first because it's the
- * broadest-access flagship (works on both auth modes) — the safe
- * default for Talon-on-Codex deployments where the operator hasn't
- * explicitly picked a model.
+ * this order, and the current flagship is intentionally first — the
+ * safe default for Talon-on-Codex deployments where the operator hasn't
+ * explicitly picked a model. (`gpt-5.5` held that slot until it was
+ * retired for ChatGPT accounts in Sep 2026.)
  *
  * Discovered-but-not-curated ids are appended at the end (synthesised
  * with minimal metadata), so the curated entries always render first.
  */
 export const CODEX_MODELS: CodexModelInfo[] = [
+  {
+    // Flagship of the catalog bundled with codex-cli 0.154 and the floor
+    // of the ChatGPT default ladder (`getCodexChatGptDefaultModel`).
+    // No context window here: the account's models_cache.json supplies it.
+    id: "gpt-6-astra",
+    displayName: "GPT-6 Astra",
+    provider: "openai",
+    providerName: "OpenAI",
+    selectable: true,
+    reasoning: true,
+  },
   {
     id: "gpt-5.5",
     displayName: "GPT-5.5",
@@ -149,19 +190,20 @@ export function isCodexOAuthIncompat(id: string): boolean {
  *
  * Returns `undefined` when:
  *   - The id isn't recognised as OAuth-incompat (caller can skip).
- *   - The id IS the broadest-access flagship (`gpt-5.5`) itself — no
- *     further fallback exists; if even `gpt-5.5` fails, the credential
- *     is the problem, not the model.
+ *   - The id IS the resolved ChatGPT default
+ *     ({@link getCodexChatGptDefaultModel}) itself — no further fallback
+ *     exists; if even the default fails, the credential is the problem,
+ *     not the model.
  *
- * For everything else returns `gpt-5.5` as the verified-working OAuth
- * default. (The curated table has only `gpt-5-codex` flagged as
+ * For everything else returns the resolved ChatGPT default. (The curated table has only `gpt-5-codex` flagged as
  * `apiKeyOnly: true`; runtime-learned entries cover the rest:
  * `gpt-5.4`, `gpt-5.4-mini`, `gpt-5.3-codex`, `gpt-5.2`, etc.)
  */
 export function chatGptFallbackFor(id: string): string | undefined {
   if (!isCodexOAuthIncompat(id)) return undefined;
-  if (id === "gpt-5.5") return undefined;
-  return "gpt-5.5";
+  const fallback = getCodexChatGptDefaultModel();
+  if (id === fallback) return undefined;
+  return fallback;
 }
 
 /**