codex-as-api 0.6.5__tar.gz → 0.7.0__tar.gz

{codex_as_api-0.6.5 → codex_as_api-0.7.0}/.gitignore

@@ -11,3 +11,4 @@ rust/target/
 uv.lock
 ts/node_modules/
 ts/dist/
+.pnpm-store/

{codex_as_api-0.6.5 → codex_as_api-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: codex-as-api
-Version: 0.6.5
+Version: 0.7.0
 Summary: Use ChatGPT/Codex OAuth as a local OpenAI-compatible API server.
 Project-URL: Homepage, https://github.com/Eunho-J/codex-as-api
 Project-URL: Repository, https://github.com/Eunho-J/codex-as-api
@@ -18,18 +18,17 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
 Requires-Python: >=3.10
+Requires-Dist: fastapi>=0.100
+Requires-Dist: pydantic>=2.0
 Requires-Dist: regex
 Requires-Dist: tomli>=2; python_version < '3.11'
+Requires-Dist: uvicorn>=0.23
 Provides-Extra: dev
 Requires-Dist: httpx; extra == 'dev'
 Requires-Dist: mypy; extra == 'dev'
 Requires-Dist: pytest; extra == 'dev'
 Requires-Dist: ruff; extra == 'dev'
 Requires-Dist: types-regex; extra == 'dev'
-Provides-Extra: server
-Requires-Dist: fastapi>=0.100; extra == 'server'
-Requires-Dist: pydantic>=2.0; extra == 'server'
-Requires-Dist: uvicorn>=0.23; extra == 'server'
 Description-Content-Type: text/markdown
 
 # codex-as-api
@@ -43,16 +42,16 @@ Use ChatGPT / Codex OAuth as a local OpenAI-compatible API server.
 
 ## Features
 
-- **OpenAI & Anthropic compatible** — `POST /v1/chat/completions` and `POST /v1/messages` endpoints
+- **OpenAI & Anthropic compatible** — Chat Completions, Messages, and `GET /v1/models`
 - **Claude Code ready** — use Codex models directly from Claude Code CLI
 - **Streaming** — full SSE streaming for both OpenAI and Anthropic protocols
 - **Tool calling** — function calls, tool results, and parallel tool calls
 - **Image support** — generation, inspection, multimodal Chat input, and capability-gated `original` image detail in classic Responses
-- **Reasoning** — configurable effort/context, `standard` mode compatibility, persisted reasoning, and streaming thinking content
-- **Codex features** — session-aware `prompt_cache_key`, process-local Chat `response_id` continuation, subagent headers, and remote compaction
+- **Reasoning** — capability-checked effort/context, persisted reasoning, and explicit Codex reasoning extensions without fabricated Anthropic signatures
+- **Codex features** — live authenticated model discovery, session-aware `prompt_cache_key`, account-scoped Chat continuation, subagent headers, and remote compaction
 - **Codex config aware** — reads `CODEX_HOME` / `~/.codex/config.toml` for model, reasoning-effort, and context-window settings
 - **Token estimate & compaction helpers** — Anthropic-compatible `/v1/messages/count_tokens` and `/v1/messages/compact`
-- **Auto auth** — reads `~/.codex/auth.json` and auto-refreshes OAuth tokens
+- **Managed ChatGPT auth** — reads official `~/.codex/auth.json` token data and refreshes managed OAuth tokens
 - **3 implementations** — Python, TypeScript (npm), and Rust — identical behavior
 
 ## What it does
@@ -70,9 +69,17 @@ npm install -g @openai/codex
 codex login
 ```
 
-The server reads that file to obtain and refresh ChatGPT OAuth tokens automatically.
+The server reads the official nested `tokens` object from that file and refreshes
+managed ChatGPT OAuth tokens automatically. `auth_mode` may be omitted, `null`,
+or `"chatgpt"`.
 
-`tokens` and latest root-level `access_token` / `refresh_token` / `id_token` auth files are supported. `personal_access_token`-only, `agent_identity`-only, and `bedrock_api_key`-only auth files are not supported for the ChatGPT OAuth backend; rerun `codex login` if you hit that diagnostic.
+Unofficial root-level `access_token` / `refresh_token` / `id_token` fields and
+noncanonical auth-mode aliases are rejected. The official
+`"chatgptAuthTokens"` mode is also unsupported: those credentials are owned and
+refreshed by an external host application, while this standalone proxy has no
+host refresh callback. `personal_access_token`-, `agent_identity`-, and
+Bedrock-only auth files are not ChatGPT OAuth credentials; run `codex login` to
+create the supported managed-token file.
 
 ## Install & Run
 
@@ -97,7 +104,7 @@ Or from source:
 ```bash
 git clone https://github.com/Eunho-J/codex-as-api.git
 cd codex-as-api
-pip install -e ".[server]"
+pip install -e .
 codex-as-api
 ```
 
@@ -139,7 +146,7 @@ Can also be used as a library:
 import { ChatGPTOAuthProvider, createApp } from "codex-as-api";
 
 // Use the provider directly
-const provider = new ChatGPTOAuthProvider({ model: "gpt-5.5" });
+const provider = new ChatGPTOAuthProvider({ model: "gpt-5.6-sol" });
 const response = await provider.chat(
   [
     { role: "system", content: "You are helpful." },
@@ -163,9 +170,8 @@ Environment variables (Python, Rust, and TypeScript):
 |----------|---------|-------------|
 | `CODEX_AS_API_HOST` | `127.0.0.1` | Bind address |
 | `CODEX_AS_API_PORT` | `18080` | Listen port |
-| `CODEX_AS_API_MODEL` | `~/.codex/config.toml` `model`, else `gpt-5.5` | Model identifier passed to Codex backend |
+| `CODEX_AS_API_MODEL` | `~/.codex/config.toml` `model`, else live default | Model identifier passed to Codex backend |
 | `CODEX_AS_API_AUTH_PATH` | `~/.codex/auth.json` | Path to OAuth credentials file |
-| `CODEX_AS_API_CODEX_CLI_VERSION` | `0.147.0` | Override the validated Codex compatibility baseline identified in backend request `User-Agent` headers |
 | `CODEX_AS_API_RESPONSES_LITE` | `auto` | Responses Lite mode: `auto`, `on`, or `off` |
 | `CODEX_AS_API_CODEX_METADATA` | `off` | Add Codex-style per-turn `client_metadata` and related backend headers |
 | `CODEX_HOME` | `~/.codex` | Codex home directory used for `auth.json` and `config.toml` discovery |
@@ -176,29 +182,18 @@ The server also reads root-level Codex CLI settings from `~/.codex/config.toml`:
 model = "gpt-5.6-sol"
 model_reasoning_effort = "high"
 
-# Optional overrides. Without them, known models use the bundled Codex catalog values.
+# Optional explicit context values. A published live maximum still clamps them.
 model_context_window = 272000
 model_auto_compact_token_limit = 244800
 ```
 
-`CODEX_AS_API_MODEL` overrides the Codex config model. A request-level `reasoning_effort` overrides `model_reasoning_effort`; when both are omitted, known models use the Codex catalog default. The effective model, reasoning setting, and context settings are exposed from `/health`; context settings are also returned by Anthropic token-count responses.
+`CODEX_AS_API_MODEL` overrides the Codex config model. Reasoning-effort precedence is request, Codex config, then the authenticated model catalog default when present. When no request or configured model exists, the proxy selects the catalog's first `visibility: "list"` model by ascending priority, matching Codex. The effective model, reasoning setting, catalog status, and context settings are exposed from `/health`; optional reasoning and context values are `null` when neither config nor the live catalog supplies them. Context settings are also returned by Anthropic token-count responses when available.
 
 ### Supported Models
 
-| Model | Description |
-|-------|-------------|
-| `gpt-5.6` | Public alias; resolved to `gpt-5.6-sol` before the Codex OAuth request |
-| `gpt-5.6-sol` | Latest frontier agentic coding model; defaults to `low` effort in Codex |
-| `gpt-5.6-terra` | Balanced agentic coding model for everyday work; defaults to `medium` effort |
-| `gpt-5.6-luna` | Fast and affordable agentic coding model; defaults to `medium` effort |
-| `gpt-5.5` | Frontier model for complex coding, research, and real-world work |
-| `gpt-5.4` | Strong model for everyday coding |
-| `gpt-5.4-mini` | Small, fast, and cost-efficient model for simpler coding tasks |
-| `gpt-5.3-codex` | Coding-optimized model |
-| `gpt-5.3-codex-spark` | Ultra-fast coding model |
-| `gpt-5.2` | Previous generation model |
-
-Model capability behavior is driven by `config/model-capabilities.json` across Python, TypeScript, and Rust. The public `gpt-5.6` alias uses Sol's private Codex capability entry. The GPT-5.6 entries use the official Codex Responses Lite contract and a 272,000-token **Codex OAuth** context-window maximum; do not substitute the larger public API context figures for this backend. Larger config overrides are clamped to 272,000. Unknown models use conservative behavior: classic Responses payloads, no assumed parallel tool support, no automatic verbosity, reasoning-effort, or service-tier fields, and, without config overrides, the legacy 200,000-token context / 160,000-token compact thresholds.
+Models and capabilities come only from the authenticated Codex `/models` response. The proxy keeps each account/base-URL/client-version snapshot in memory for 300 seconds, invalidates it when a Responses `X-Models-Etag` changes, and never serves a static, stale, or cross-account fallback. An unavailable or malformed refresh returns `503 catalog_unavailable` before streaming headers are sent; an upstream HTTP rejection after the one allowed OAuth refresh preserves its status as `upstream_error`.
+
+Use `GET /v1/models` instead of relying on a documentation list. Every row in the fresh authenticated snapshot is returned, including its exact slug, visibility, `supported_in_api`, reasoning-summary controls, and opaque `comp_hash` compatibility identifier when supplied. A valid empty catalog returns `200` with `data: []`; health and model-default resolution then return `503 catalog_unavailable` rather than selecting a fallback. Requests must use an exact live slug; unknown explicit IDs return `404 model_not_found`.
 
 To use a different port:
 
@@ -214,6 +209,14 @@ CODEX_AS_API_HOST=0.0.0.0 codex-as-api
 
 ## API Endpoints
 
+### `GET /v1/models`
+
+Returns the current account's authenticated Codex model catalog using an OpenAI-compatible list envelope. The response includes safe routing and capability metadata but omits backend instructions and model messages.
+
+```bash
+curl http://localhost:18080/v1/models
+```
+
 ### `POST /v1/chat/completions`
 
 Standard OpenAI chat completions. Supports streaming (`stream: true`) and non-streaming.
@@ -273,15 +276,25 @@ curl http://localhost:18080/v1/chat/completions \
   }'
 ```
 
+`reasoning_content` is a response-only proxy extension. Chat request messages
+cannot replay that field losslessly and reject it instead of silently dropping
+it; continuation uses the complete provider Response items saved behind
+`previous_response_id`.
+
 ### `POST /v1/messages`
 
-Anthropic Messages API compatible endpoint. Supports streaming (`stream: true`) and non-streaming. A client model that matches the bundled Codex catalog, such as `gpt-5.6-sol`, is used for the backend call. Anthropic names and other unknown model IDs use the configured `CODEX_AS_API_MODEL` fallback. The response always preserves the client-supplied model name.
+Claude Code compatibility endpoint using the Anthropic Messages shape. It supports streaming (`stream: true`) and non-streaming only for requests carrying one valid `x-claude-code-session-id` header. A live Codex model ID routes directly. A recognized `claude-*` facade ID requires an explicit `CODEX_AS_API_MODEL` or Codex config model that is present in the same fresh catalog; it is not silently routed to a default. Other unknown IDs fail. The response preserves the client-supplied model name.
+
+This compatibility endpoint is scoped to Claude Code requests. The proxy accepts
+and strips the non-forwarded `max_tokens` and `cache_control` compatibility
+fields only when one valid `x-claude-code-session-id` header is present.
 
 ```bash
 curl http://localhost:18080/v1/messages \
   -H "Content-Type: application/json" \
   -H "x-api-key: unused" \
   -H "anthropic-version: 2023-06-01" \
+  -H "x-claude-code-session-id: example-session" \
   -d '{
     "model": "claude-sonnet-4-6",
     "max_tokens": 200,
@@ -299,6 +312,7 @@ curl -N http://localhost:18080/v1/messages \
   -H "Content-Type: application/json" \
   -H "x-api-key: unused" \
   -H "anthropic-version: 2023-06-01" \
+  -H "x-claude-code-session-id: example-session" \
   -d '{
     "model": "claude-sonnet-4-6",
     "max_tokens": 200,
@@ -310,6 +324,35 @@ curl -N http://localhost:18080/v1/messages \
   }'
 ```
 
+Codex reasoning summaries are not Anthropic signed-thinking blocks. A non-streaming response exposes real upstream reasoning only through the top-level `codex_reasoning` proxy extension. A stream emits `event: codex_reasoning_delta` with `type: "codex_reasoning_delta"`. The proxy never fabricates `thinking`, `thinking_delta`, or `signature_delta` data.
+
+Hosted Anthropic `web_search` declarations are rejected with HTTP 400 on
+Messages, token-counting, and compact requests. OpenAI Responses cannot supply
+the Anthropic server-tool provenance and encrypted lifecycle fields required to
+translate a hosted result losslessly, so the gateway does not approximate that
+protocol. Provider output containing an unexpected hosted web-search call is an
+upstream protocol error instead of a fabricated Anthropic result block.
+
+Completed responses require authoritative final token usage and a real
+`response.completed` event. Emitted function calls map to `tool_calls` or
+`tool_use`; otherwise a missing, `null`, or `true` `end_turn` maps to `stop` or
+`end_turn`, matching pinned Codex, where only explicit `false` requests another
+sampling turn. An explicit `false` completion without a representable client
+tool call is an upstream protocol error because this proxy does not implement
+Codex's internal follow-up loop. Non-streaming requests return HTTP 502 when
+the completion is nonterminal or final usage is absent; a stream that has
+already started emits an Anthropic `error` event and never emits a successful
+`message_stop`. The final response includes every required usage field, using
+`null` only where the Anthropic type permits it, plus required container,
+citation, context-management, and direct-caller fields. To preserve Claude
+Code's realtime behavior, `message_start` is sent immediately without guessed
+input-token counts; this narrow stream-start shape is Claude Code compatibility
+behavior, not generic Anthropic API parity.
+
+Generated `tool_use` blocks with `caller: {"type":"direct"}` and empty
+assistant content arrays can be replayed through the request adapter. Malformed,
+null, or server-tool caller variants still fail before transport.
+
 ### Identifier and cache behavior
 
 The two compatibility facades intentionally use the similarly named fields for
@@ -320,24 +363,31 @@ different jobs:
 | `client_metadata.session_id` | Forwarded to Codex, used as the default `prompt_cache_key`, and required when Codex metadata mode is enabled | Not used or forwarded |
 | `client_metadata.thread_id` | Codex metadata thread identity; defaults to `session_id` for a root request and preserves an explicit child thread | Not used or synthesized |
 | `prompt_cache_key` | Explicit value wins; otherwise a non-empty `client_metadata.session_id` is used; otherwise omitted | Optional proxy extension; explicit value wins, otherwise the Claude Code session header is hashed |
-| `x-claude-code-session-id` | Not used | SHA-256 of `codex-as-api:claude-code-session:<exact header value>` supplies cache affinity only |
+| `x-claude-code-session-id` | Not used | Required for the non-forwarded `max_tokens` and `cache_control` compatibility fields; its exact value also supplies hashed cache affinity |
 | `previous_response_id` | Resolves a known entry from the 256-chain process-local history and replays full input/output over HTTP; never forwarded | Non-null values return Anthropic-style HTTP 400 because normal Messages is stateless |
-| `cache_control` | Not an OpenAI Chat control | Validated as an Anthropic compatibility hint, then stripped before Codex transport |
+| `cache_control` | Not an OpenAI Chat control | Accepted only with the Claude Code session header, validated, then stripped before Codex transport |
 
 Anthropic `cache_control` is a cache-boundary annotation, not an identifier.
 This proxy accepts only `{"type":"ephemeral"}` with optional `ttl: "5m"` or
-`"1h"` at request, system, message, content-block, and tool locations. The
+`"1h"` at the top level and on supported system/content blocks and tools. The
 private Codex request has no Anthropic breakpoint or TTL fields, so accepted
 hints do not reproduce Anthropic caching semantics. Normal `/v1/messages`
 responses do not expose the Chat-only `response_id`. The custom
 `/v1/messages/compact` endpoint retains its documented local
 `previous_response_id` support.
 
+The Anthropic type permits `cache_control: null`; the proxy treats that exact
+value as omission. A non-null cache-control object is validated in full and is
+accepted only on a Claude Code request.
+
 ### `POST /v1/messages/count_tokens`
 
-Anthropic-compatible token counting helper. Codex OAuth does not expose a count-only endpoint equivalent to Anthropic's native API, so this route counts text locally and returns context-window metadata for the effective backend model. Normalized model-visible messages, tool calls, tool-result metadata, reasoning, and tool schemas are counted once. Request-envelope and generation-control fields are excluded, and image inputs use a separate fixed estimate so inline base64 data is not counted as text.
+Anthropic-compatible token counting helper. Codex OAuth does not expose a count-only endpoint equivalent to Anthropic's native API, so this route counts text locally and returns context-window metadata for the effective backend model. Normalized model-visible messages, tool calls, tool-result metadata, reasoning, and tool schemas are counted once. Request-envelope fields and the approved Claude Code `max_tokens` compatibility hint are excluded; other unsupported generation controls fail instead of becoming no-ops. Image inputs use a separate fixed estimate so inline base64 data is not counted as text.
 
-GPT-5-family text uses a bundled port of official `tiktoken` `o200k_base` `encode_ordinary`: the same Unicode pre-tokenization regex, byte-pair merge algorithm, and merge-rank data are implemented in Python, TypeScript, and Rust. Official `tiktoken` maps `gpt-5` and its `gpt-5-`-prefixed variants to [`o200k_base`](https://github.com/openai/tiktoken/blob/08a5f3b2c987ada4fc5aa1f16c643c203fa8acaa/tiktoken/model.py#L7-L20); this project applies that GPT-5-family encoding to the bundled `gpt-5.*` Codex model IDs. The project does not depend on a `tiktoken` package or download encoding data at runtime. The last upstream synchronization check was **2026-07-14**, against [`tiktoken` 0.13.0 at `08a5f3b`](https://github.com/openai/tiktoken/tree/08a5f3b2c987ada4fc5aa1f16c643c203fa8acaa); the bundled rank file SHA-256 is `446a9538cb6c348e3516120d7c08b09f57c36495e2acfffe59a5bf8b0cfb1a2d`.
+`max_tokens` and `cache_control` remain Claude Code-only compatibility hints on
+this route and require `x-claude-code-session-id` when present.
+
+Text estimation uses a bundled port of official `tiktoken` `o200k_base` `encode_ordinary`: the same Unicode pre-tokenization regex, byte-pair merge algorithm, and merge-rank data are implemented in Python, TypeScript, and Rust. It is a local estimator, not model metadata and not a substitute for a provider count API. The project does not depend on a `tiktoken` package or download encoding data at runtime. The last upstream synchronization check was **2026-07-14**, against [`tiktoken` 0.13.0 at `08a5f3b`](https://github.com/openai/tiktoken/tree/08a5f3b2c987ada4fc5aa1f16c643c203fa8acaa); the bundled rank file SHA-256 is `446a9538cb6c348e3516120d7c08b09f57c36495e2acfffe59a5bf8b0cfb1a2d`.
 
 Official Codex also has a [`ceil(UTF-8 bytes / 4)` truncation helper](https://github.com/openai/codex/blob/bd2de422aa287b97b06ca6425a10935bcf1b3731/codex-rs/utils/string/src/truncate.rs#L4-L84), but Codex documents the history estimate using that helper as [a coarse lower bound rather than a tokenizer-accurate count](https://github.com/openai/codex/blob/bd2de422aa287b97b06ca6425a10935bcf1b3731/codex-rs/core/src/context_manager/history.rs#L162-L186). This endpoint therefore uses exact `o200k_base` ordinary text tokenization instead. The complete request count remains an estimate because protocol-wrapper overhead and image cost are local constants, but the former byte-as-token and raw-payload double count that could overstate ordinary Claude Code requests by about 8x is removed.
 
@@ -354,7 +404,7 @@ curl http://localhost:18080/v1/messages/count_tokens \
 
 ### `POST /v1/messages/compact`
 
-Anthropic-compatible alias for remote conversation compaction. Accepts Anthropic Messages-shaped bodies and returns compacted checkpoint content. Bundled GPT model IDs select the matching backend model, and Claude Code effort and Fast Mode controls use the same mappings as `/v1/messages`.
+Anthropic-compatible alias for remote conversation compaction. Accepts Anthropic Messages-shaped bodies and returns compacted checkpoint content. Live GPT model IDs select the matching backend model, and Claude Code effort and Fast Mode controls use the same mappings as `/v1/messages`. Its required non-forwarded `max_tokens` and any `cache_control` hints require one valid `x-claude-code-session-id` header.
 
 ### `POST /v1/images/generations`
 
@@ -366,7 +416,7 @@ curl http://localhost:18080/v1/images/generations \
   -d '{
     "model": "gpt-5.5",
     "prompt": "a futuristic city at sunset",
-    "size": "1024x1024"
+    "size": "auto"
   }'
 ```
 
@@ -391,7 +441,7 @@ curl http://localhost:18080/v1/inspect \
 
 Compact a conversation into a checkpoint for continuation (custom endpoint). `/v1/messages/compact` provides the Anthropic-compatible alias.
 
-Compact accepts the existing private Codex `reasoning_effort` (or matching `reasoning.effort`) plus `prompt_cache_key`, supported `service_tier`, `text`, and top-level `verbosity`. A known process-local `previous_response_id` is resolved to its saved Response items and replayed as full compact input; the field is never forwarded to private Codex. Non-null caller-supplied `reasoning.mode` / `reasoning.context`, `prompt_cache_options`, cache breakpoints, `safety_identifier`, encrypted-reasoning `include`, and deprecated `prompt_cache_retention` are rejected instead of being silently dropped; explicit `null` is treated as omitted. When Responses Lite is active, the proxy follows the official private Codex builder and adds `reasoning.context: "all_turns"` on the compact wire.
+Compact accepts the existing private Codex `reasoning_effort` (or matching `reasoning.effort`) plus `prompt_cache_key`, supported `service_tier`, `text`, and top-level `verbosity`. A known process-local `previous_response_id` is resolved to its saved Response items and replayed as full compact input; the field is never forwarded to private Codex. Non-null caller-supplied `reasoning.mode` / `reasoning.context`, `prompt_cache_options`, cache breakpoints, encrypted-reasoning `include`, and deprecated `prompt_cache_retention` are rejected instead of being silently dropped; explicit `null` for those nullable compatibility controls is treated as omitted. Any supplied `safety_identifier`, including `null`, returns HTTP 400. When Responses Lite is active, the proxy follows the official private Codex builder and adds `reasoning.context: "all_turns"` on the compact wire.
 
 ```bash
 curl http://localhost:18080/v1/compact \
@@ -407,11 +457,10 @@ curl http://localhost:18080/v1/compact \
 
 ### `GET /health`
 
-Health check. Returns auth availability, configured model and reasoning effort, Codex config path, and context-window settings.
+Readiness check. It returns `200` only when OAuth is available, a fresh catalog can be loaded, and the effective model resolves. Optional catalog metadata is not a readiness requirement: `reasoning_effort`, `context_window`, and `auto_compact_token_limit` are `null` when the selected live row and explicit config do not provide them. Otherwise the route returns `503` with a typed, sanitized error instead of reporting a false healthy state. The payload exposes catalog timing and effective model settings, but never access tokens, account IDs, auth paths, upstream ETags, or upstream response bodies.
 
 ```bash
-curl http://localhost:18080/health
-# {"status":"ok","auth_available":true,"model":"gpt-5.6-sol","reasoning_effort":"high","codex_config_path":"/Users/me/.codex/config.toml","context_window":272000,"auto_compact_token_limit":244800}
+curl -i http://localhost:18080/health
 ```
 
 ## Codex-Specific Features
@@ -422,7 +471,7 @@ These features are extensions beyond the standard OpenAI API, designed for Codex
 
 `prompt_cache_key` keeps related prefixes in the same backend cache family. Use one stable, privacy-safe key per conversation or application prefix.
 
-Official Codex 0.147.0 [defaults this field to its Responses metadata session ID](https://github.com/openai/codex/blob/be6e8eac029b183056b7e4402879f15d2c85f61b/codex-rs/core/src/client.rs#L475-L487), and [projects the same value into `client_metadata.session_id`](https://github.com/openai/codex/blob/be6e8eac029b183056b7e4402879f15d2c85f61b/codex-rs/core/src/responses_metadata.rs#L219-L228), unless an explicit override is present. This proxy follows the same precedence on Chat requests: explicit `prompt_cache_key`, then a non-empty `client_metadata.session_id`, then omission. It does not generate a process-wide session or reuse `thread_id` as the cache key.
+Official Codex 0.153.3 [derives this field from Responses metadata](https://github.com/openai/codex/blob/b1a547b1f73ce86205d9222ac19cff334b3b7a2e/codex-rs/core/src/client.rs#L540-L550), unless an explicit override is present. This proxy follows the same precedence on Chat requests: explicit `prompt_cache_key`, then a non-empty `client_metadata.session_id`, then omission. It does not generate a process-wide session or reuse `thread_id` as the cache key.
 
 The private Codex OAuth HTTP and WebSocket request structures do not contain public GPT-5.6 `prompt_cache_options` or content-block `prompt_cache_breakpoint` fields. This proxy treats explicit `null` as omitted and rejects non-null controls with HTTP 400 instead of forwarding a request that the private route rejects or silently pretending the requested cache policy was applied. Use a public Responses API client when explicit cache policy or breakpoints are required. See OpenAI's [public prompt caching guide](https://developers.openai.com/api/docs/guides/prompt-caching#prompt-cache-breakpoints).
 
@@ -441,9 +490,9 @@ GPT-5.6 cache accounting is returned, when the backend supplies it, as `usage.pr
 
 ### `reasoning_effort` and `reasoning`
 
-The legacy top-level `reasoning_effort` remains supported. Known values are the case-sensitive lowercase strings `none`, `minimal`, `low`, `medium`, `high`, `xhigh`, `max`, and Codex's virtual `ultra` setting. Other non-empty model-defined values are preserved. `ultra` is sent as backend effort `max`; Codex's local proactive multi-agent behavior for `ultra` is outside this proxy.
+The legacy top-level `reasoning_effort` remains supported. Every effort is checked against the selected live model. Codex's virtual `ultra` setting resolves to the model's advertised multi-agent effort when valid, otherwise `max` when supported, otherwise the model's highest advertised non-`ultra` effort. If no valid wire effort exists, the request fails instead of inventing one.
 
-GPT-5.6 requests can instead use the public Responses-shaped object:
+Requests can instead use the Responses-shaped effort/context object:
 
 ```json
 {
@@ -453,49 +502,56 @@ GPT-5.6 requests can instead use the public Responses-shaped object:
     {"role": "user", "content": "Find migration failure modes."}
   ],
   "reasoning": {
-    "mode": "standard",
     "effort": "high",
     "context": "all_turns"
   }
 }
 ```
 
-- `mode: "standard"` is accepted as the public default and omitted from the private Codex request. If mode is explicit and neither the request nor Codex config selects an effort, the proxy sends the public GPT-5.6 default effort, `medium`.
-- `mode: "pro"` returns HTTP 400. Official Codex has no private request field or alternate model/effort mapping for Pro. Codex `ultra` and `service_tier: "priority"` are different features.
+- Non-null `mode`, including `"standard"` and `"pro"`, returns HTTP 400 because the private Codex request has no mode field or alternate model mapping. Codex `ultra` and `service_tier: "priority"` are different features.
 - `context` is `auto`, `current_turn`, or `all_turns`. Encrypted reasoning content is included automatically on generation requests so full-history continuation can replay it.
 - `reasoning_effort` and `reasoning.effort` may both be present only when equal. Conflicting values return HTTP 400.
 - Responses Lite uses `all_turns` as the Codex wire default. An explicitly different context is rejected instead of silently overwritten; use `responses_lite: false` when the backend route supports classic Responses and another context is required.
 - Remote compact keeps its existing private Codex `reasoning_effort` field but does not accept public `reasoning.mode` or `reasoning.context`.
 
-Anthropic `thinking` values map as `enabled → high`, `adaptive → medium`, and `disabled → none`. Claude Code's `output_config.effort` takes precedence over adaptive or enabled thinking and supports `low`, `medium`, `high`, `xhigh`, and `max`. Call-level `thinking.disabled` takes precedence over ambient `output_config.effort`, so Claude Code WebSearch/WebFetch auxiliary calls use `none` instead of failing the compatibility check with HTTP 400. The supported reasoning context and verbosity extensions are also available on `/v1/messages`, image generation, and inspection requests; Pro and non-null public cache policy/breakpoints or `safety_identifier` fail explicitly on the private Codex provider.
+Anthropic `thinking` values map as `enabled → high`, `adaptive → medium`, and `disabled → none`. Claude Code's `output_config.effort` takes precedence over adaptive or enabled thinking and supports `low`, `medium`, `high`, `xhigh`, and `max`. Call-level `thinking.disabled` takes precedence over ambient `output_config.effort` for representable client-side auxiliary calls such as WebFetch; hosted Anthropic WebSearch is rejected before transport because its lifecycle cannot be translated losslessly. The supported reasoning context and verbosity extensions are also available on `/v1/messages`, image generation, and inspection requests; Pro, non-null public cache policy/breakpoints, and any supplied `safety_identifier` fail explicitly on the private Codex provider.
+
+Anthropic's `JSONOutputFormat` carries a schema but no name. When Claude Code
+sends that official shape, the proxy follows pinned Codex 0.153.3 and supplies
+the transport-only name `codex_output_schema`; this label has no model-selection
+or fallback role. An explicit proxy-extension name is preserved only when it is
+already a valid Responses format name, and is never sanitized or truncated.
 
-The pinned official Codex HTTP request has no `stop` field. Omitted, `null`, and empty stop values are omitted from the private request; any non-empty OpenAI `stop` or Anthropic `stop_sequences` value returns HTTP 400 before the private transport starts.
+The pinned official Codex HTTP request has no `stop` field. Omitted OpenAI
+`stop`, or explicit OpenAI `stop: null`, is omitted from the private request;
+any other OpenAI `stop` value returns HTTP 400. Anthropic `stop_sequences`
+follows its typed API contract: omission is allowed, while explicit `null` or
+an array value returns HTTP 400 because the private transport cannot apply it.
 
 The mapping is intentionally transport-aware:
 
 | Public/facade input | Private Codex behavior |
 |---|---|
-| `reasoning.mode: "standard"` | Omit mode; send the resolved effort/context |
-| `reasoning.mode: "pro"` | HTTP 400; no official Codex alias |
+| Non-null `reasoning.mode` | HTTP 400; no private Codex field or model alias |
 | `prompt_cache_key` | Forward an explicit value; otherwise use non-empty `client_metadata.session_id` |
 | Non-null `prompt_cache_options` / breakpoint | HTTP 400; `null` is omitted and there is no private field |
-| Non-null `safety_identifier` | HTTP 400; `null` is omitted and OAuth account/thread IDs are not semantic aliases |
-| Non-empty `stop` / `stop_sequences` | HTTP 400; no private field |
+| Any supplied `safety_identifier` | HTTP 400; the optional field is non-nullable and OAuth account/thread IDs are not semantic aliases |
+| Non-null `stop` / `stop_sequences` | HTTP 400; no private field |
 | `previous_response_id` | Resolve locally and replay complete Response history over HTTP |
 | `service_tier: "fast"` | Send `service_tier: "priority"` |
 | `service_tier: "default"` | Omit the field |
 
-Authenticated tests on July 10, 2026 verified both official continuation paths with `gpt-5.6-sol`: a direct private Responses WebSocket completed a second delta request using the exact prior `response.id`, and the private HTTP endpoint completed the same continuation when the full prior input/output history was replayed. The proxy implements the HTTP replay strategy. Direct HTTP forwarding of `previous_response_id`, Pro, public cache controls, and `safety_identifier` was rejected and is not used. See OpenAI's [reasoning mode documentation](https://developers.openai.com/api/docs/guides/reasoning#reasoning-mode) and the Codex 0.147.0 [HTTP/WebSocket request structures](https://github.com/openai/codex/blob/be6e8eac029b183056b7e4402879f15d2c85f61b/codex-rs/codex-api/src/common.rs#L251-L307).
+Authenticated tests on July 10, 2026 verified both official continuation paths with `gpt-5.6-sol`: a direct private Responses WebSocket completed a second delta request using the exact prior `response.id`, and the private HTTP endpoint completed the same continuation when the full prior input/output history was replayed. The proxy implements the HTTP replay strategy. Direct HTTP forwarding of `previous_response_id`, Pro, public cache controls, and `safety_identifier` was rejected and is not used. See OpenAI's [reasoning mode documentation](https://developers.openai.com/api/docs/guides/reasoning#reasoning-mode) and the Codex 0.153.3 [HTTP/WebSocket request structures](https://github.com/openai/codex/blob/b1a547b1f73ce86205d9222ac19cff334b3b7a2e/codex-rs/codex-api/src/common.rs#L275-L350).
 
 ### `responses_lite`
 
 Controls the Codex Responses Lite request shape. Accepted values are `true`, `false`, and `"auto"`. Request value takes precedence over `CODEX_AS_API_RESPONSES_LITE`; default is `"auto"`.
 
-In `"auto"` mode, this package only uses Lite when the shared model capability table says the selected model should use it. The `gpt-5.6` alias plus Sol, Terra, and Luna use Lite automatically. Setting `responses_lite: true` forces Lite and moves tools/instructions into Lite-compatible developer input items.
+In `"auto"` mode, this package uses Lite only when the selected live catalog entry advertises it. Setting `responses_lite: true` forces the Lite request shape and moves tools/instructions into Lite-compatible developer input items.
 
 Codex implements web search and image generation for Lite models through client-side standalone tools. This proxy has no standalone tool executor, so Lite requests containing hosted `web_search` or `image_generation` tools fail explicitly instead of silently dropping the tools. When a request does not override the mode, `CODEX_AS_API_RESPONSES_LITE=off` selects the existing classic request contract if the backend route supports it.
 
-The official Codex Lite request builder removes `input_image.detail`. Accordingly, classic Responses preserve `auto`, `low`, and `high`; `original` is also preserved when the model capability advertises it. The bundled catalog enables `original` for the GPT-5.6 alias, Sol, Terra, Luna, GPT-5.5, GPT-5.4, and GPT-5.4 Mini, and rejects it for GPT-5.2 and the conservative legacy entries. Lite requests keep the image and remove only `detail` after capability validation.
+The official Codex Lite request builder has no lossless `input_image.detail` mapping. Classic Responses preserve `auto`, `low`, and `high`, plus `original` only when the live catalog advertises it. A caller-supplied image detail on Lite returns HTTP 400 instead of silently removing the requested behavior.
 
 ### Image detail
 
@@ -517,17 +573,17 @@ Chat multimodal blocks are preserved instead of being flattened to text:
 }
 ```
 
-`/v1/inspect` accepts the equivalent flat image object: `{"image_url":"data:image/...","detail":"original"}`. Recognized detail values are `auto`, `low`, `high`, and `original`; `original` additionally requires a model capability listed above. See OpenAI's [image detail guide](https://developers.openai.com/api/docs/guides/images-vision#choose-an-image-detail-level).
+`/v1/inspect` accepts the equivalent flat image object: `{"image_url":"data:image/...","detail":"original"}`. Recognized detail values are `auto`, `low`, `high`, and `original`; `original` additionally requires support in the live model catalog. See OpenAI's [image detail guide](https://developers.openai.com/api/docs/guides/images-vision#choose-an-image-detail-level).
 
 ### `safety_identifier` and verbosity
 
-The public `safety_identifier` has no equivalent private Codex request field. `ChatGPT-Account-ID`, `thread-id`, and `session-id` identify different things and are not substituted. Explicit `null` is treated as omitted; a non-null `safety_identifier` returns HTTP 400.
+The public `safety_identifier` has no equivalent private Codex request field. `ChatGPT-Account-ID`, `thread-id`, and `session-id` identify different things and are not substituted. Because this optional OpenAI field is non-nullable, any supplied value, including explicit `null`, returns HTTP 400.
 
 Standard Chat `verbosity: "low" | "medium" | "high"` maps to Responses `text.verbosity`. The existing `text` extension remains supported. Supplying both is allowed only when the values agree.
 
 ### `parallel_tool_calls`
 
-Set `parallel_tool_calls: true` to request parallel tool calls when the selected model capability allows it. The shared capability table gates this field, and Responses Lite always keeps `parallel_tool_calls` disabled.
+Classic Responses preserves an explicit `parallel_tool_calls` value without relying on a model-catalog capability that Codex does not define. Lite requests fail rather than silently disabling an explicit `true` value.
 
 ### `client_metadata` and `codex_metadata`
 
@@ -537,9 +593,9 @@ The installation ID and process window ID remain stable, while `turn_id` and `x-
 
 ### `previous_response_id`
 
-Non-streaming responses and the final streaming finish chunk expose the real upstream Responses ID as `response_id`. The provider keeps up to 256 completed chains in a process-local LRU store. Passing a known ID as `previous_response_id` prepends the saved semantic input and exact prior `response.output_item.done` items—including encrypted reasoning and tool items—to the new input, then sends one full private HTTP request. The ID itself is never forwarded and is never converted to `thread_id`.
+Non-streaming responses and the final streaming finish chunk expose the real upstream Responses ID as `response_id`. The provider keeps up to 256 completed chains in a process-local LRU store scoped to the authenticated account. Passing a known ID as `previous_response_id` under the same account prepends the saved semantic input and exact prior `response.output_item.done` items, including encrypted reasoning and tool items, then sends one full private HTTP request. When both the saved source model and current live model publish `comp_hash`, unequal values fail before sampling because automatic pre-turn compaction is not implemented; equal or unavailable hashes follow Codex's compatibility rule. The ID itself is never forwarded and is never converted to `thread_id`; another account cannot replay it.
 
-That event source is intentional: the Codex 0.147.0 SSE parser [takes semantic items from `response.output_item.done`](https://github.com/openai/codex/blob/be6e8eac029b183056b7e4402879f15d2c85f61b/codex-rs/codex-api/src/sse/responses.rs#L330-L341), while its [`response.completed` shape contains the response ID, usage, and `end_turn`](https://github.com/openai/codex/blob/be6e8eac029b183056b7e4402879f15d2c85f61b/codex-rs/codex-api/src/sse/responses.rs#L112-L160), not replay history. The authenticated private HTTP rollout likewise returned an empty `response.completed.output`; the proxy therefore commits the completed output-item events instead of treating that extra field as conversation state.
+That event source is intentional: the Codex 0.153.3 SSE parser [takes semantic items from `response.output_item.done`](https://github.com/openai/codex/blob/b1a547b1f73ce86205d9222ac19cff334b3b7a2e/codex-rs/codex-api/src/sse/responses.rs#L357-L372), while its [`response.completed` shape contains response metadata and usage](https://github.com/openai/codex/blob/b1a547b1f73ce86205d9222ac19cff334b3b7a2e/codex-rs/codex-api/src/sse/responses.rs#L118-L166), not replay history. The authenticated private HTTP rollout likewise returned an empty `response.completed.output`; the proxy therefore commits the completed output-item events instead of treating that extra field as conversation state.
 
 Only a real `response.completed` event commits a chain. Branches from an older retained ID are supported. Restarting the server or evicting an old entry removes that local state; an unknown ID returns HTTP 400 before any upstream request.
 
@@ -667,15 +723,19 @@ curl -N http://localhost:18080/v1/chat/completions \
 
 The `/v1/messages` endpoint implements the Anthropic Messages gateway shape used by Claude Code. The current request shape was reproduced with Claude Code `2.1.220`; streaming, real Codex OAuth chat, request-level GPT model routing, adaptive thinking, `--effort max`, and Fast Mode remain covered.
 
-Start the proxy first. `CODEX_AS_API_MODEL` is the fallback used when Claude Code sends a built-in Anthropic model name:
+Start the proxy first. `CODEX_AS_API_MODEL` is required when Claude Code sends a built-in `claude-*` facade model name; the configured backend must exist in the fresh authenticated catalog:
 
 ```bash
 CODEX_AS_API_MODEL=gpt-5.6-terra \
-CODEX_AS_API_RESPONSES_LITE=off \
 codex-as-api
 ```
 
-`CODEX_AS_API_RESPONSES_LITE=off` is required for Claude Code hosted WebSearch on GPT-5.6. Official Codex Responses Lite uses a client-side standalone `web.run` tool, while this gateway receives Anthropic's hosted `web_search` declaration and has no standalone executor; classic Responses preserves that hosted tool. WebFetch does not use a hosted Responses tool, but still needs the disabled-thinking precedence fix when process-level effort is enabled.
+Claude Code hosted WebSearch is not supported through this gateway, regardless
+of Responses Lite mode. Classic Responses can execute an OpenAI hosted search,
+but its output lacks the Anthropic provenance and encrypted lifecycle data
+needed for a lossless Messages response. WebFetch remains a client-side
+auxiliary request and retains the disabled-thinking precedence behavior when
+process-level effort is enabled.
 
 To keep the built-in Fable, Opus, Sonnet, and Haiku rows and append one GPT row, launch the GPT-routed Claude Code process with these variables:
 
@@ -702,7 +762,7 @@ If managed settings define an `availableModels` allowlist, that list must includ
 
 For a persistent gateway configuration, put the same variables in the `env` object in `~/.claude/settings.json`. Do that only when every Claude Code process using that config should route through codex-as-api.
 
-`ANTHROPIC_CUSTOM_MODEL_OPTION` adds one picker row. To make Terra or Luna the visible GPT row, change that value and the display text. Any bundled GPT model can also be selected directly without changing the visible row:
+`ANTHROPIC_CUSTOM_MODEL_OPTION` adds one picker row. To make another live model the visible GPT row, change that value and the display text. Any model returned by `/v1/models` can also be selected directly without changing the visible row:
 
 ```bash
 ANTHROPIC_BASE_URL=http://127.0.0.1:18080 ANTHROPIC_AUTH_TOKEN=unused \
@@ -711,9 +771,9 @@ ANTHROPIC_BASE_URL=http://127.0.0.1:18080 ANTHROPIC_AUTH_TOKEN=unused \
   claude --model gpt-5.6-luna --effort medium
 ```
 
-Known bundled GPT IDs are sent to the matching Codex backend model. Built-in Claude/Fable/Opus/Sonnet/Haiku IDs are not Codex models, so this proxy maps those requests to `CODEX_AS_API_MODEL` while preserving the selected name in the Anthropic response.
+Live Codex IDs are sent to the matching backend model. Built-in Claude/Fable/Opus/Sonnet/Haiku IDs are not Codex models, so recognized `claude-*` IDs require the explicitly configured `CODEX_AS_API_MODEL`; the proxy preserves the selected client name in the Anthropic response.
 
-`ANTHROPIC_BASE_URL` applies to the whole Claude Code process. Therefore the built-in rows remain available in the picker, but they also pass through codex-as-api and use the configured Codex fallback; the rows do not call Anthropic models in that process. To use an actual Anthropic model and GPT in parallel, keep the gateway variables out of global settings, start the GPT process with the inline command above, and start a second process normally:
+`ANTHROPIC_BASE_URL` applies to the whole Claude Code process. Therefore the built-in rows remain available in the picker, but they also pass through codex-as-api and use the explicitly configured Codex backend; the rows do not call Anthropic models in that process. To use an actual Anthropic model and GPT in parallel, keep the gateway variables out of global settings, start the GPT process with the inline command above, and start a second process normally:
 
 ```bash
 claude --model sonnet
@@ -735,19 +795,21 @@ HTTP Server (FastAPI / Axum / Express)
     |
     +---> ChatGPTOAuthProvider
             |
-            +---> ~/.codex/auth.json (OAuth tokens, auto-refresh)
+            +---> ~/.codex/auth.json (managed ChatGPT OAuth tokens, auto-refresh)
+            +---> https://chatgpt.com/backend-api/codex/models
             +---> https://chatgpt.com/backend-api/codex/responses
 ```
 
 The provider handles:
-- Token loading, proactive refresh five minutes before expiry, and refresh on 401
+- Managed ChatGPT token loading, proactive refresh five minutes before expiry, and refresh on 401
+- Fresh-only authenticated model discovery, validation, and ETag invalidation
 - OpenAI Responses API over SSE
 - `prompt_cache_key` and cache read/write accounting
-- GPT-5.6 reasoning effort/context plus `standard` mode compatibility
-- Reasoning content streaming (`reasoning_content`, `reasoning`)
+- Live catalog-gated reasoning effort and context handling
+- Real Codex reasoning extensions without fabricated Anthropic signatures
 - Tool call streaming
 - Codex-specific headers (`x-openai-subagent`, `x-openai-memgen-request`)
-- Bounded process-local `previous_response_id` history replay over private HTTP
+- Bounded, account-scoped `previous_response_id` history replay over private HTTP
 - Multimodal Chat input, image generation/inspection, and capability-gated classic `original` detail
 - Remote conversation compaction
 
@@ -756,7 +818,10 @@ The provider handles:
 The `Release` GitHub Actions workflow runs on a pushed `v*` tag. It rejects a
 tag that does not exactly match every Python, npm, and Rust version surface,
 runs the complete cross-runtime gate, and then publishes PyPI, npmjs, the
-scoped GitHub npm package, platform Rust binaries, and one GitHub Release.
+scoped GitHub npm package, deterministic platform Rust ZIP archives, and one
+GitHub Release. Each Rust archive contains the platform binary, `LICENSE`, and
+the generated `THIRD_PARTY_NOTICES.md` covering both bundled tokenizer data and
+the locked normal dependency graph across supported release targets.
 
 The workflow uses registry-supported OIDC for PyPI and npmjs. No `PYPI_TOKEN`,
 `NPM_TOKEN`, personal access token, or repository secret is required. One-time
@@ -776,9 +841,9 @@ registry setup is still required:
 After bumping every version and passing the local gate, push the matching tag:
 
 ```bash
-python scripts/check_package_versions.py --tag v0.6.5
-git tag v0.6.5
-git push origin v0.6.5
+python scripts/check_package_versions.py --tag v0.7.0
+git tag v0.7.0
+git push origin v0.7.0
 ```
 
 ## Tests
@@ -786,7 +851,7 @@ git push origin v0.6.5
 ### Python
 
 ```bash
-pip install -e ".[dev,server]"
+pip install -e ".[dev]"
 pip install httpx
 pytest tests/ -v
 ```
@@ -809,6 +874,25 @@ npm test
 
 ## Release Notes
 
+### v0.7.0
+
+- Replace bundled model capability tables with a fresh authenticated Codex
+  catalog and add `GET /v1/models` across all three runtimes.
+- Remove stale/unknown-model fallbacks, fabricated Anthropic signatures, silent
+  request downgrades, and malformed upstream recovery; return typed failures.
+- Reject hosted Anthropic WebSearch instead of translating incomplete OpenAI
+  search lifecycle data, and require authoritative completion and final usage.
+- Keep immediate Claude Code `message_start` delivery without inventing token
+  counts; final Anthropic fields are emitted only from authoritative provider data.
+- Scope continuation history and catalog state to the authenticated account,
+  validate before streaming, and make `/health` report actual readiness.
+- Require the official nested `tokens` auth layout, remove root-level and
+  noncanonical auth aliases, and reject external-host `chatgptAuthTokens`.
+- Pin the validated private contract to Codex `0.153.3` and publish the exact
+  tested artifacts to PyPI, npmjs, GitHub Packages, and GitHub Releases.
+- Install Python server dependencies with the base package so the default
+  `pip install codex-as-api` command produces a runnable server.
+
 ### v0.6.5
 
 - Align GPT-5.6 alias, Sol, Terra, and Luna context limits with Codex `0.147.0`