fix(codex): gate gpt-5.6 native models by entitlement

src/codex/catalog/native-models.ts

@@ -3,6 +3,9 @@ export const NATIVE_DAYBREAK_BLUE_MODEL = "gpt-daybreak-blue-latest";
 
 /** Native ChatGPT/Codex ids whose availability is proven per authenticated account. */
 export const ACCOUNT_GATED_NATIVE_OPENAI_MODELS: ReadonlySet<string> = new Set([
+  "gpt-5.6-sol",
+  "gpt-5.6-terra",
+  "gpt-5.6-luna",
   NATIVE_DAYBREAK_BLUE_MODEL,
 ]);
 
@@ -58,8 +61,8 @@ export function nativeOpenAiCapabilitySourceSlug(slug: string): string {
  * discover it on a clean install.
  *
  * Availability is not static: catalog sync and Pool routing require the account's authenticated
- * `/models` roster to contain the slug. An unconfirmed or unentitled account never receives the
- * request. `disabledModels` remains the independent user visibility control.
+ * `/models` roster to contain account-gated slugs. An unconfirmed or unentitled account never
+ * receives the request. `disabledModels` remains the independent user visibility control.
  *
  * Devlog: 260816_codexrs_multiagent_v2_and_history_perf/011 §4-bis.
  */

tests/agent-task-recovery.test.ts

@@ -540,7 +540,7 @@ describe("agent task recovery (opt-in, default off)", () => {
 
     const response = await post(
       routedConfig(),
-      "gpt-5.6-sol",
+      "gpt-5.5",
       encryptedInput(),
       codexHeaders(),
     );

tests/bearer-admission-routed-provider.test.ts

@@ -57,7 +57,7 @@ function mixedConfig(): OcxConfig {
         baseUrl: "https://chatgpt.com/backend-api/codex",
         authMode: "forward",
         codexAccountMode: "direct",
-        defaultModel: "gpt-5.6-luna",
+        defaultModel: "gpt-5.5",
       },
       gateway: {
         adapter: "openai-chat",
@@ -153,7 +153,7 @@ describe("#2132 bearer admission does not require a ChatGPT credential for route
 
     const server = startServer(0);
     try {
-      const response = await postResponses(server.url, "gpt-5.6-luna");
+      const response = await postResponses(server.url, "gpt-5.5");
 
       // This is the #1686 guarantee and it must survive: a native route genuinely needs the
       // stored credential, so it fails BEFORE any upstream I/O rather than forwarding ours.
@@ -175,7 +175,7 @@ describe("#2132 bearer admission does not require a ChatGPT credential for route
 
     const server = startServer(0);
     try {
-      const response = await postResponses(server.url, "gpt-5.6-luna");
+      const response = await postResponses(server.url, "gpt-5.5");
 
       expect(response.status).toBe(200);
       expect(nativeAuth).toEqual([`Bearer ${stored}`]);
@@ -213,7 +213,7 @@ describe("an admission bearer never reaches a canonical ChatGPT transport, whate
           adapter: "openai-responses",
           baseUrl: "https://chatgpt.com/backend-api/codex",
           authMode: "forward",
-          defaultModel: "gpt-5.6-luna",
+          defaultModel: "gpt-5.5",
         },
       },
     } as OcxConfig;
@@ -225,7 +225,7 @@ describe("an admission bearer never reaches a canonical ChatGPT transport, whate
 
     const server = startServer(0);
     try {
-      const response = await postResponses(server.url, "mirror/gpt-5.6-luna");
+      const response = await postResponses(server.url, "mirror/gpt-5.5");
 
       // Fail-before-I/O is the contract (src/codex/auth-context.ts): the only two acceptable
       // outcomes for an admission bearer are replaced-with-stored-main, or refused. Reaching
@@ -247,7 +247,7 @@ describe("an admission bearer never reaches a canonical ChatGPT transport, whate
 
     const server = startServer(0);
     try {
-      await postResponses(server.url, "mirror/gpt-5.6-luna");
+      await postResponses(server.url, "mirror/gpt-5.5");
 
       expect(nativeAuth.join("|")).not.toContain(ADMISSION_SECRET);
       for (const sent of nativeAuth) expect(sent).toBe(`Bearer ${stored}`);

tests/claude-desktop-native-context.test.ts

@@ -5,6 +5,10 @@ import { join } from "node:path";
 import { buildClaudeDesktopState } from "../src/server/management/shared";
 import { nativeOpenAiContextWindow, visibleNativeSlugs } from "../src/codex/catalog";
 import { generateDesktop3pModels } from "../src/claude/desktop-3p";
+import {
+  resetCodexModelEntitlementCacheForTests,
+  seedCodexModelEntitlementsForTests,
+} from "../src/codex/model-entitlements";
 import type { OcxConfig } from "../src/types";
 
 /**
@@ -24,6 +28,8 @@ const config = {
 } as unknown as OcxConfig;
 
 test("buildClaudeDesktopState gives native rows their real context window", async () => {
+  // Sol/Terra/Luna are account-gated; this test is about window metadata, so confirm them.
+  seedCodexModelEntitlementsForTests("main", ["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna"]);
   const home = tempHome();
   const prev = process.env.OPENCODEX_CLAUDE_DESKTOP_CONFIG_DIR;
   process.env.OPENCODEX_CLAUDE_DESKTOP_CONFIG_DIR = home;
@@ -44,6 +50,7 @@ test("buildClaudeDesktopState gives native rows their real context window", asyn
     if (prev === undefined) delete process.env.OPENCODEX_CLAUDE_DESKTOP_CONFIG_DIR;
     else process.env.OPENCODEX_CLAUDE_DESKTOP_CONFIG_DIR = prev;
     rmSync(home, { recursive: true, force: true });
+    resetCodexModelEntitlementCacheForTests();
   }
 });
 

tests/claude-models-discovery.test.ts

@@ -3,6 +3,9 @@ import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { saveConfig } from "../src/config";
+import {
+  resetCodexModelEntitlementCacheForTests,
+} from "../src/codex/model-entitlements";
 import { handleManagementAPI } from "../src/server/management-api";
 import { startServer } from "../src/server";
 import type { OcxConfig } from "../src/types";
@@ -25,6 +28,7 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  resetCodexModelEntitlementCacheForTests();
   if (previousHome === undefined) delete process.env.OPENCODEX_HOME;
   else process.env.OPENCODEX_HOME = previousHome;
   isolatedCodexHome?.restore();
@@ -159,6 +163,23 @@ test("OpenAI list shape and Codex catalog shape stay unchanged", async () => {
 });
 
 test("Codex discovery applies the OpenAI context cap to native rows (#1430)", async () => {
+  writeFileSync(join(isolatedCodexHome!.path, "auth.json"), JSON.stringify({
+    tokens: { access_token: "context-cap-access", account_id: "context-cap-account" },
+  }), "utf8");
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = (async (input, init) => {
+    const request = new Request(input, init);
+    const url = new URL(request.url);
+    if (request.method === "GET" && url.pathname === "/backend-api/codex/models") {
+      const entitled = request.headers.get("authorization") === "Bearer context-cap-access"
+        && request.headers.get("chatgpt-account-id") === "context-cap-account";
+      const slugs = entitled ? ["gpt-5.6-sol"] : [];
+      return Response.json({
+        models: slugs.map(slug => ({ slug, supported_in_api: true, visibility: "list" })),
+      });
+    }
+    return originalFetch(request);
+  }) as typeof fetch;
   const config = configWithStaticModels();
   config.providers.openai = {
     adapter: "openai-responses",
@@ -186,6 +207,7 @@ test("Codex discovery applies the OpenAI context cap to native rows (#1430)", as
     });
   } finally {
     await server.stop(true);
+    globalThis.fetch = originalFetch;
   }
 });
 

tests/codex-auth-api.test.ts

@@ -3485,7 +3485,7 @@ describe("codex-auth API", () => {
       listOpenAiForwardSidecarCandidates(config),
       new Headers(),
       config,
-      { exactAccount: { accountId: "pool-delete", modelId: "gpt-5.6-sol" } },
+      { exactAccount: { accountId: "pool-delete", modelId: "gpt-5.5" } },
     );
     expect(exactSidecar?.authContext).toMatchObject({
       accountId: "pool-delete",

tests/codex-auth-context.test.ts

@@ -450,7 +450,7 @@ describe("Codex auth context", () => {
     });
     let discoveries = 0;
     await expect(resolveCodexAuthContext(new Headers(), config(), "pool", {
-      modelId: "gpt-5.6-sol",
+      modelId: "gpt-5.5",
       resolveCodexModelEntitlements: async () => {
         discoveries += 1;
         throw new Error("must not run");
@@ -479,7 +479,7 @@ describe("Codex auth context", () => {
 
     const exactContext = await resolveCodexAuthContext(headers, cfg, "direct", {
       accountId: "pool-a",
-      modelId: "gpt-5.6-sol",
+      modelId: "gpt-5.5",
     });
     expect(exactContext).toMatchObject({
       kind: "pool",
@@ -493,7 +493,7 @@ describe("Codex auth context", () => {
       _codexAccountOverride: { accessToken: "fixed_pool_token", chatgptAccountId: "fixed_pool_acc" },
     });
     expect(cfg.activeCodexAccountId).toBe("pool-b");
-    await expect(resolveCodexAuthContext(headers, cfg, "pool", { modelId: "gpt-5.6-sol" }))
+    await expect(resolveCodexAuthContext(headers, cfg, "pool", { modelId: "gpt-5.5" }))
       .resolves.toMatchObject({ kind: "pool", accountId: "pool-b" });
   });
 
@@ -706,15 +706,15 @@ describe("Codex auth context", () => {
 
     // The pool path honors the order: pool-b outranks pool-a, so an unbound request
     // prefers pool-b.
-    await expect(resolveCodexAuthContext(new Headers(), cfg, "pool", { modelId: "gpt-5.6-sol" }))
+    await expect(resolveCodexAuthContext(new Headers(), cfg, "pool", { modelId: "gpt-5.5" }))
       .resolves.toMatchObject({ kind: "pool", accountId: "pool-b" });
 
     // An exact selector names pool-a: it must resolve to pool-a even though pool-b is
     // ordered earlier. Selection order is a tiebreak inside the eligible pool, never a
     // way to redirect a request that already named its account.
     await expect(resolveCodexAuthContext(new Headers(), cfg, "pool", {
       accountId: "pool-a",
-      modelId: "gpt-5.6-sol",
+      modelId: "gpt-5.5",
     })).resolves.toMatchObject({
       kind: "pool",
       accountId: "pool-a",
@@ -735,7 +735,7 @@ describe("Codex auth context", () => {
 
     await expect(resolveCodexAuthContext(new Headers(), cfg, "pool", {
       accountId: MAIN_CODEX_ACCOUNT_ID,
-      modelId: "gpt-5.6-sol",
+      modelId: "gpt-5.5",
     })).resolves.toMatchObject({
       kind: "main-pool",
       accountId: MAIN_CODEX_ACCOUNT_ID,
@@ -841,7 +841,7 @@ describe("Codex auth context", () => {
     expect(isCodexAuthContextUsable(captured, cfg)).toBe(true);
     await expect(resolveCodexAuthContext(new Headers(), cfg, "pool", {
       accountId: "pool-a",
-      modelId: "gpt-5.6-sol",
+      modelId: "gpt-5.5",
     })).rejects.toThrow("Selected Codex account is unavailable");
     expect(cfg.activeCodexAccountId).toBe("pool-a");
     await expect(resolveCodexAuthContext(new Headers(), cfg, "pool"))
@@ -868,7 +868,7 @@ describe("Codex auth context", () => {
 
     await expect(resolveCodexAuthContext(new Headers(), cfg, "pool", {
       accountId: "pool-a",
-      modelId: "gpt-5.6-sol",
+      modelId: "gpt-5.5",
     })).rejects.toThrow("Selected Codex account needs reauthentication");
     expect(cfg.activeCodexAccountId).toBe("pool-b");
   });
@@ -885,7 +885,7 @@ describe("Codex auth context", () => {
 
     await expect(resolveCodexAuthContext(new Headers(), cfg, "pool", {
       accountId: "pool-a",
-      modelId: "gpt-5.6-sol",
+      modelId: "gpt-5.5",
     })).rejects.toThrow("Selected Codex account is unavailable");
     expect(cfg.activeCodexAccountId).toBe("pool-a");
   });
@@ -905,18 +905,18 @@ describe("Codex auth context", () => {
       recordCodexUpstreamOutcome(cfg, "pool-a", 429, {
         resetAt: Math.floor((now + 60 * 60_000) / 1_000),
         now,
-        modelId: "gpt-5.6-sol",
+        modelId: "gpt-5.5",
         fixedAccount: true,
       });
       Date.now = () => now + CODEX_QUOTA_PROBE_INTERVAL_MS;
 
       await expect(resolveCodexAuthContext(new Headers(), cfg, "pool", {
         accountId: "pool-a",
-        modelId: "gpt-5.6-sol",
+        modelId: "gpt-5.5",
       })).rejects.toBeInstanceOf(CodexAccountCooldownError);
 
       const ordinaryProbe = await resolveCodexAuthContext(new Headers(), cfg, "pool", {
-        modelId: "gpt-5.6-sol",
+        modelId: "gpt-5.5",
       });
       expect(ordinaryProbe).toMatchObject({ kind: "pool", accountId: "pool-a" });
       expect(ordinaryProbe.kind === "pool" ? ordinaryProbe.probeLeaseId : undefined).toBeTruthy();
@@ -1079,20 +1079,20 @@ describe("Codex auth context", () => {
       });
 
       // Spark owns a separate quota, so Terra can use the same account.
-      await expect(resolveCodexAuthContext(headers, cfg, "pool", { modelId: "gpt-5.6-terra" }))
+      await expect(resolveCodexAuthContext(headers, cfg, "pool", { modelId: "gpt-5.4" }))
         .resolves.toMatchObject({ kind: "pool", accountId: "pool-a" });
       await expect(resolveCodexAuthContext(headers, cfg, "pool", { modelId: "gpt-5.3-codex-spark" }))
         .rejects.toBeInstanceOf(CodexAccountCooldownError);
 
       recordCodexUpstreamOutcome(cfg, "pool-a", 429, {
         now,
         resetAt,
-        modelId: "gpt-5.6-terra",
+        modelId: "gpt-5.4",
       });
 
       // Terra and Luna stay in the shared native quota group, while Spark keeps
       // its independent cooldown instead of being overwritten by Terra's 429.
-      await expect(resolveCodexAuthContext(headers, cfg, "pool", { modelId: "gpt-5.6-luna" }))
+      await expect(resolveCodexAuthContext(headers, cfg, "pool", { modelId: "gpt-5.4-mini" }))
         .rejects.toBeInstanceOf(CodexAccountCooldownError);
       await expect(resolveCodexAuthContext(headers, cfg, "pool", { modelId: "gpt-5.3-codex-spark" }))
         .rejects.toBeInstanceOf(CodexAccountCooldownError);
@@ -1104,7 +1104,7 @@ describe("Codex auth context", () => {
         retryAfter: "60",
         modelId: "gpt-5.3-codex-spark",
       });
-      await expect(resolveCodexAuthContext(headers, cfg, "pool", { modelId: "gpt-5.6-terra" }))
+      await expect(resolveCodexAuthContext(headers, cfg, "pool", { modelId: "gpt-5.4" }))
         .rejects.toBeInstanceOf(CodexAccountCooldownError);
     } finally {
       Date.now = originalNow;
@@ -1137,7 +1137,7 @@ describe("Codex auth context", () => {
       Date.now = () => now;
       // Establish the shared-scope binding first. The Spark fallback below must
       // create a second binding rather than replacing this one.
-      await expect(resolveCodexAuthContext(headers, cfg, "pool", { modelId: "gpt-5.6-terra" }))
+      await expect(resolveCodexAuthContext(headers, cfg, "pool", { modelId: "gpt-5.4" }))
         .resolves.toMatchObject({ kind: "pool", accountId: "pool-a" });
 
       recordCodexUpstreamOutcome(cfg, "pool-a", 429, {
@@ -1149,7 +1149,7 @@ describe("Codex auth context", () => {
       await expect(resolveCodexAuthContext(headers, cfg, "pool", { modelId: "gpt-5.3-codex-spark" }))
         .resolves.toMatchObject({ kind: "pool", accountId: "pool-b" });
       expect(cfg.activeCodexAccountId).toBe("pool-a");
-      await expect(resolveCodexAuthContext(headers, cfg, "pool", { modelId: "gpt-5.6-terra" }))
+      await expect(resolveCodexAuthContext(headers, cfg, "pool", { modelId: "gpt-5.4" }))
         .resolves.toMatchObject({ kind: "pool", accountId: "pool-a" });
       // This second Spark request proves routing retained the peer choice for
       // the Spark affinity instead of relying on an auth-layer substitution.
@@ -1182,7 +1182,7 @@ describe("Codex auth context", () => {
       recordCodexUpstreamOutcome(cfg, "pool-a", 429, {
         now,
         resetAt,
-        modelId: "gpt-5.6-terra",
+        modelId: "gpt-5.4",
       });
 
       const probeAt = now + CODEX_QUOTA_PROBE_INTERVAL_MS;
@@ -1205,7 +1205,7 @@ describe("Codex auth context", () => {
       Date.now = () => probeAt + 1;
       await expect(resolveCodexAuthContext(headers, cfg, "pool", { modelId: "gpt-5.3-codex-spark" }))
         .resolves.toMatchObject({ kind: "pool", accountId: "pool-a" });
-      await expect(resolveCodexAuthContext(headers, cfg, "pool", { modelId: "gpt-5.6-luna" }))
+      await expect(resolveCodexAuthContext(headers, cfg, "pool", { modelId: "gpt-5.4-mini" }))
         .resolves.toMatchObject({ kind: "pool", probeQuotaScope: "shared" });
     } finally {
       Date.now = originalNow;

tests/codex-catalog-restore.test.ts

@@ -270,6 +270,8 @@ describe("Codex catalog restore", () => {
 
     const r = runScript(codexHome, opencodexHome, `
       const { syncCatalogModels } = require("./src/codex/catalog");
+      const { seedCodexModelEntitlementsForTests } = require("./src/codex/model-entitlements");
+      seedCodexModelEntitlementsForTests("__main__", ["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna"]);
       (async () => {
         const result = await syncCatalogModels({
           port: 10100,
@@ -291,6 +293,9 @@ describe("Codex catalog restore", () => {
   test("sync advertises documented Codex-native additions omitted by the bundled catalog", () => {
     const catalogPath = join(codexHome, "catalog.json");
     writeFileSync(join(codexHome, "config.toml"), 'model_catalog_json = "catalog.json"\n', "utf8");
+    writeFileSync(join(codexHome, "auth.json"), JSON.stringify({
+      tokens: { access_token: "catalog-main-access", account_id: "catalog-main-account" },
+    }), "utf8");
     writeFileSync(catalogPath, JSON.stringify({
       models: [
         {
@@ -314,6 +319,19 @@ describe("Codex catalog restore", () => {
 
     const r = runScript(codexHome, opencodexHome, `
       const { syncCatalogModels } = require("./src/codex/catalog");
+      globalThis.fetch = async (input, init) => {
+        const request = new Request(input, init);
+        const url = new URL(request.url);
+        if (request.method !== "GET" || url.pathname !== "/backend-api/codex/models") {
+          throw new Error("unexpected fetch: " + request.method + " " + url.href);
+        }
+        const entitled = request.headers.get("authorization") === "Bearer catalog-main-access"
+          && request.headers.get("chatgpt-account-id") === "catalog-main-account";
+        const slugs = entitled ? ["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna"] : [];
+        return Response.json({
+          models: slugs.map(slug => ({ slug, supported_in_api: true, visibility: "list" })),
+        });
+      };
       (async () => {
         const result = await syncCatalogModels({
           port: 10100,