feat(sse): restore GPT-6 Astra effort aliases and Codex 0.153.4 pin (#13026)

Three related things that genuinely belong together: the registry and suffix splitter not knowing Astra while the live catalog serves it, the Codex client pin Astra requires, and dropping `next/font/google` so a production image build does not reach fonts.googleapis.com.

---

Validated in one consolidated worktree cut from `release/v3.8.51`, boarded with the other 19 PRs of this batch. Two in-batch conflicts, both additive and resolved by keeping each side: the `ENVIRONMENT.md` table (#13035 + #13011) and the `chatHelpers.ts` import block (#12975 on the tip + #13017).

- `typecheck:core` clean; `check:dashboard-typecheck` OK (206 pre-existing, within baseline); `check:changelog-integrity` OK; `check:docs-counts` migrations ✓
- complexity 2816 / baseline 3218 and cognitive-complexity 1271 / baseline 1437 — both under baseline
- 531 of 532 focused assertions green across the batch's 46 test files
- `check-file-size` rebaselined for the batch's real growth (annotation `_rebaseline_2026_09_11_mergebatch_v3851_houminxi`, landed on #13038), attributed per PR

The single red is **not this batch**: `tests/unit/combo/quota-weighted-strategy.test.ts` → "A/B isolation: 7 hard-empty + 2 at 0.5% + 1 at 40%, floor=1" asserts an order between two connections of identical weight and flakes on the pure tip too — 2 failures in 4 runs at `origin/release/v3.8.51` with nothing from this batch applied.

⚠️ base-red inherited: #12732 — `Docs Gates`, `Merge integrity`, `No new ESLint warnings`, `Unit Tests fast-path` and `Fast Quality Gates` reproduce on the pure tip (provider count 356 vs the 358 the modules define, SKILL.md drift, and `open-sse/utils/stream.ts` at 3115 > frozen 3098, untouched here).

Thanks @HouMinXi — the live evidence on these (X500 logs, `storage.sqlite` state, real `/v1/models` probes, the 36-minute outage write-up) is what let a 20-PR batch be reviewed as a unit.

tests/snapshots/provider/translate-path.json

@@ -1311,16 +1311,16 @@
         "Authorization": "Bearer <TOK>",
         "Content-Type": "application/json",
         "Openai-Beta": "responses=experimental",
-        "User-Agent": "codex-cli/0.153.2 (<OS>; <ARCH>)",
-        "Version": "0.153.2",
+        "User-Agent": "codex-cli/0.153.4 (<OS>; <ARCH>)",
+        "Version": "0.153.4",
         "X-Codex-Beta-Features": "responses_websockets"
       },
       "nonStream": {
         "Authorization": "Bearer <TOK>",
         "Content-Type": "application/json",
         "Openai-Beta": "responses=experimental",
-        "User-Agent": "codex-cli/0.153.2 (<OS>; <ARCH>)",
-        "Version": "0.153.2",
+        "User-Agent": "codex-cli/0.153.4 (<OS>; <ARCH>)",
+        "Version": "0.153.4",
         "X-Codex-Beta-Features": "responses_websockets"
       },
       "oauth": {
@@ -1328,8 +1328,8 @@
         "Authorization": "Bearer <TOK>",
         "Content-Type": "application/json",
         "Openai-Beta": "responses=experimental",
-        "User-Agent": "codex-cli/0.153.2 (<OS>; <ARCH>)",
-        "Version": "0.153.2",
+        "User-Agent": "codex-cli/0.153.4 (<OS>; <ARCH>)",
+        "Version": "0.153.4",
         "X-Codex-Beta-Features": "responses_websockets"
       }
     },

tests/unit/agentrouter-chatcore-protocols.test.ts

@@ -112,7 +112,7 @@ test("AgentRouter Responses requests automatically use the native Responses prot
       body: structuredClone(body),
       headers: new Headers({ accept: "application/json", originator: "codex_cli_rs" }),
     },
-    userAgent: "codex_cli_rs/0.149.0",
+    userAgent: "codex_cli_rs/0.153.4",
   });
 
   assert.ok(captured);
@@ -176,7 +176,7 @@ test("AgentRouter OpenAI Chat requests automatically use the native Chat protoco
       body: structuredClone(body),
       headers: new Headers({ accept: "application/json" }),
     },
-    userAgent: "codex_cli_rs/0.149.0",
+    userAgent: "codex_cli_rs/0.153.4",
   });
 
   assert.equal(result.success, true);
@@ -304,7 +304,7 @@ test("AgentRouter Responses streaming stays native without a connection protocol
       body: structuredClone(body),
       headers: new Headers({ accept: "text/event-stream", originator: "codex_cli_rs" }),
     },
-    userAgent: "codex_cli_rs/0.149.0",
+    userAgent: "codex_cli_rs/0.153.4",
   });
 
   assert.equal(result.success, true);
@@ -383,7 +383,7 @@ test("AgentRouter OpenAI Chat streaming stays native without a connection protoc
       body: structuredClone(body),
       headers: new Headers({ accept: "text/event-stream" }),
     },
-    userAgent: "codex_cli_rs/0.149.0",
+    userAgent: "codex_cli_rs/0.153.4",
   });
 
   assert.equal(result.success, true);

tests/unit/claude-codex-identity-version-sync.test.ts

@@ -127,3 +127,39 @@ test("test 7: live-empty GitHub catalog path does not call persist", () => {
   const liveWindow = src.slice(liveIdx, start);
   assert.match(liveWindow, /buildApiDiscoveryResponse\s*\(/);
 });
+
+test("Codex client version locksteps Dockerfile @openai/codex and env override", () => {
+  const dockerfile = fs.readFileSync(path.join(process.cwd(), "Dockerfile"), "utf8");
+  const match = dockerfile.match(/@openai\/codex@([0-9]+\.[0-9]+\.[0-9]+)/);
+  assert.ok(match, "Dockerfile must pin @openai/codex@x.y.z");
+  const pinned = match[1];
+  assert.notEqual(pinned, "0.149.0");
+  assert.equal(codexCfg.DEFAULT_CODEX_CLIENT_VERSION, pinned);
+  assert.equal(codexCfg.getCodexClientVersion(), pinned);
+  assert.equal(codexCfg.getCodexDefaultHeaders().Version, pinned);
+  assert.equal(
+    codexCfg.getCodexCliRsHeaders()["User-Agent"],
+    `codex_cli_rs/${pinned}`,
+  );
+});
+
+test("test 7: live-empty GitHub catalog path does not call persist", () => {
+  const src = fs.readFileSync(
+    path.join(process.cwd(), "src/app/api/providers/[id]/models/route.ts"),
+    "utf8",
+  );
+  // The githubCatalogModels fallback must use buildResponse, not buildApiDiscoveryResponse.
+  const idx = src.indexOf("Codex live catalog unavailable — using GitHub model catalog");
+  assert.ok(idx > 0);
+  const start = src.lastIndexOf("if (githubCatalogModels", idx);
+  const end = src.indexOf("if (cachedDiscoveryModels", idx);
+  assert.ok(start > 0 && end > start);
+  const window = src.slice(start, end);
+  assert.match(window, /buildResponse\s*\(/);
+  assert.doesNotMatch(window, /buildApiDiscoveryResponse\s*\(/);
+
+  const liveIdx = src.lastIndexOf("if (liveModels && liveModels.length > 0)");
+  assert.ok(liveIdx > 0 && liveIdx < start);
+  const liveWindow = src.slice(liveIdx, start);
+  assert.match(liveWindow, /buildApiDiscoveryResponse\s*\(/);
+});

tests/unit/codex-astra.test.ts

@@ -0,0 +1,109 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { getModelsByProviderId } from "../../open-sse/config/providerModels.ts";
+import { CodexExecutor } from "../../open-sse/executors/codex.ts";
+import { openaiToOpenAIResponsesRequest } from "../../open-sse/translator/request/openai-responses/toResponses.ts";
+import { getModelSpec } from "../../src/shared/constants/modelSpecs.ts";
+import { getPricingForModel } from "../../src/shared/constants/pricing.ts";
+import { getCodexFastCostMultiplier } from "../../src/lib/usage/costCalculator.ts";
+
+const MODEL = "gpt-6-astra";
+const EFFORTS = ["ultra", "max", "xhigh", "high", "medium", "low"] as const;
+
+test.after(async () => {
+  const { resetDbInstance } = await import("../../src/lib/db/core.ts");
+  resetDbInstance();
+});
+
+test("Codex exposes Astra and its effort variants with live OAuth limits", () => {
+  const ids = [MODEL, ...EFFORTS.map((effort) => `${MODEL}-${effort}`)];
+  for (const provider of ["codex", "codex-app-server"]) {
+    const models = getModelsByProviderId(provider);
+    assert.deepEqual(
+      models.filter((model) => model.id.startsWith(MODEL)).map((model) => model.id),
+      ids
+    );
+    for (const id of ids) {
+      const model = models.find((entry) => entry.id === id);
+      assert.ok(model, `${provider}/${id}`);
+      assert.equal(model.contextLength, 872000);
+      assert.equal(model.maxInputTokens, 872000);
+      assert.equal(model.maxOutputTokens, 128000);
+      assert.equal(model.targetFormat, "openai-responses");
+      assert.equal(model.toolCalling, true);
+      assert.equal(model.supportsReasoning, true);
+      assert.equal(model.supportsVision, true);
+      assert.equal(model.supportsXHighEffort, true);
+    }
+    assert.deepEqual(
+      models.slice(0, ids.length).map((model) => model.id),
+      ids
+    );
+  }
+});
+
+test("Astra specs retain the public context window separately from Codex limits", () => {
+  const spec = getModelSpec(MODEL);
+  assert.equal(spec?.contextWindow, 1050000);
+  assert.equal(spec?.maxOutputTokens, 128000);
+  assert.equal(spec?.supportsTools, true);
+  assert.equal(spec?.supportsVision, true);
+  assert.equal(spec?.supportsThinking, true);
+});
+
+test("Astra effort aliases reach Codex as the base model and supported wire effort", () => {
+  const executor = new CodexExecutor();
+  for (const effort of EFFORTS) {
+    const model = `${MODEL}-${effort}`;
+    const result = executor.transformRequest(model, { model, input: [] }, false, {
+      requestEndpointPath: "/responses",
+    });
+    assert.equal(result.model, MODEL, effort);
+    assert.equal(result.reasoning.effort, effort === "ultra" ? "max" : effort, effort);
+  }
+});
+
+test("Chat-to-Codex translation preserves Astra max reasoning", () => {
+  const translated = openaiToOpenAIResponsesRequest(
+    MODEL,
+    { model: MODEL, messages: [{ role: "user", content: "test" }], reasoning_effort: "max" },
+    true,
+    {}
+  );
+  const result = new CodexExecutor().transformRequest(MODEL, translated, true, {
+    requestEndpointPath: "/chat/completions",
+  });
+  assert.equal(result.model, MODEL);
+  assert.equal(result.reasoning.effort, "max");
+});
+
+test("Astra parenthesized effort overrides preserve the reasoning summary", () => {
+  for (const effort of ["max", "ultra"]) {
+    const model = `${MODEL}(${effort})`;
+    const result = new CodexExecutor().transformRequest(
+      model,
+      { model, input: [], reasoning: { effort: "low", summary: "detailed" } },
+      false,
+      { requestEndpointPath: "/responses" }
+    );
+    assert.equal(result.model, MODEL);
+    assert.equal(result.reasoning.effort, "max");
+    assert.equal(result.reasoning.summary, "detailed");
+  }
+});
+
+test("Astra Codex pricing and Fast multiplier match the Codex credit rate card", () => {
+  for (const model of [MODEL, ...EFFORTS.map((effort) => `${MODEL}-${effort}`)]) {
+    const pricing = getPricingForModel("cx", model);
+    assert.ok(pricing, model);
+    assert.equal(pricing.input, 10);
+    assert.equal(pricing.cached, 1);
+    assert.equal(pricing.output, 50);
+    assert.equal(pricing.reasoning, 50);
+    assert.equal(getCodexFastCostMultiplier("codex", model, "priority"), 2.5);
+    assert.equal(getCodexFastCostMultiplier("cx", model, "fast"), 2.5);
+    assert.equal(getCodexFastCostMultiplier("codex", model, "default"), 1);
+  }
+  assert.equal(getCodexFastCostMultiplier("openai", MODEL, "priority"), 1);
+});

tests/unit/codex-gpt56-catalog.test.ts

@@ -29,7 +29,7 @@ test("Codex catalog exposes the GPT-5.6 lineup in configured priority order", ()
   ];
 
   assert.deepEqual(
-    models.slice(0, expectedIds.length).map((model) => model.id),
+    models.filter((model) => model.id.startsWith("gpt-5.6-")).map((model) => model.id),
     expectedIds
   );
 

tests/unit/executor-codex-gpt56-lite-ultra.test.ts

@@ -70,6 +70,12 @@ test("Responses Lite must not strip parallel_tool_calls for GPT-5.6 luna max-tie
   assert.equal(capturedBodies[0].parallel_tool_calls, true);
 });
 
+test("Responses Lite preserves parallel tool calls for Astra ultra delegation", async () => {
+  const capturedBodies = await runLiteRequest("gpt-6-astra-ultra");
+  assert.equal(capturedBodies.length, 1);
+  assert.equal(capturedBodies[0].parallel_tool_calls, true);
+});
+
 test("Responses Lite still forces parallel_tool_calls:false for non-delegation GPT-5.5", async () => {
   const capturedBodies = await runLiteRequest("gpt-5.5");
   assert.equal(

tests/unit/executor-codex.test.ts

@@ -184,10 +184,10 @@ test("CodexExecutor.buildHeaders binds workspace ids and disables SSE accept for
   assert.equal(standardHeaders.Authorization, "Bearer codex-token");
   assert.equal(standardHeaders.Accept, "text/event-stream");
   assert.equal(standardHeaders["chatgpt-account-id"], "workspace-1");
-  assert.equal(standardHeaders.Version, "0.153.2");
+  assert.equal(standardHeaders.Version, "0.153.4");
   assert.equal(standardHeaders["Openai-Beta"], "responses=experimental");
   assert.equal(standardHeaders["X-Codex-Beta-Features"], "responses_websockets");
-  assert.equal(standardHeaders["User-Agent"], "codex-cli/0.153.2 (Windows 10.0.26200; x64)");
+  assert.equal(standardHeaders["User-Agent"], "codex-cli/0.153.4 (Windows 10.0.26200; x64)");
   assert.equal(compactHeaders.Accept, "application/json");
 });
 
@@ -213,7 +213,7 @@ test("CodexExecutor.buildHeaders honors safe env overrides for Version and User-
     },
     () => {
       const headers = executor.buildHeaders({ accessToken: "codex-token" }, true);
-      assert.equal(headers.Version, "0.153.2");
+      assert.equal(headers.Version, "0.153.4");
       assert.equal(headers["User-Agent"], "custom-codex/9.9.9");
     }
   );

tests/unit/openai-gpt56-catalog.test.ts

@@ -4,10 +4,14 @@ import assert from "node:assert/strict";
 import { getModelsByProviderId } from "../../open-sse/config/providerModels.ts";
 import { getModelSpec } from "../../src/shared/constants/modelSpecs.ts";
 import { getPricingForModel } from "../../src/shared/constants/pricing.ts";
+import { getUnsupportedParams } from "../../open-sse/config/providerRegistry.ts";
+import { DefaultExecutor } from "../../open-sse/executors/default.ts";
+import { resolveChatCoreTargetFormat } from "../../open-sse/handlers/chatCore/targetFormat.ts";
+import { openaiToOpenAIResponsesRequest } from "../../open-sse/translator/request/openai-responses/toResponses.ts";
 
-const EXPECTED_MODELS = ["gpt-5.6", "gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna"];
+const EXPECTED_MODELS = ["gpt-6-astra", "gpt-5.6", "gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna"];
 
-test("OpenAI API catalog exposes the public GPT-5.6 family and keeps GPT-5.4", () => {
+test("OpenAI API catalog puts Astra before GPT-5.6 and keeps GPT-5.4", () => {
   const models = getModelsByProviderId("openai");
 
   assert.deepEqual(
@@ -38,8 +42,9 @@ test("OpenAI API catalog exposes the public GPT-5.6 family and keeps GPT-5.4", (
   }
 });
 
-test("OpenAI API GPT-5.6 pricing matches the published standard tier", () => {
+test("OpenAI API Astra and GPT-5.6 pricing matches the published standard tier", () => {
   const expectedPricing = {
+    "gpt-6-astra": { input: 10, cached: 1, cache_creation: 12.5, output: 50 },
     "gpt-5.6": { input: 5, cached: 0.5, cache_creation: 6.25, output: 30 },
     "gpt-5.6-sol": { input: 5, cached: 0.5, cache_creation: 6.25, output: 30 },
     "gpt-5.6-terra": { input: 2.5, cached: 0.25, cache_creation: 3.125, output: 15 },
@@ -55,3 +60,72 @@ test("OpenAI API GPT-5.6 pricing matches the published standard tier", () => {
     assert.equal(pricing.output, expected.output, `${modelId} output`);
   }
 });
+
+test("OpenAI Astra declares unsupported sampling parameters for the chat pipeline", () => {
+  assert.deepEqual(getUnsupportedParams("openai", "gpt-6-astra"), [
+    "temperature",
+    "top_p",
+    "top_logprobs",
+    "logprobs",
+  ]);
+});
+
+test("OpenAI Astra tool requests use Responses and retain each supported reasoning effort", async () => {
+  const model = "gpt-6-astra";
+  assert.equal(
+    resolveChatCoreTargetFormat({
+      provider: "openai",
+      resolvedModel: model,
+      apiFormat: undefined,
+      customModelTargetFormat: undefined,
+      providerSpecificData: null,
+    }).targetFormat,
+    "openai-responses"
+  );
+  const originalFetch = globalThis.fetch;
+  const captured: Array<{ url: string; body: Record<string, unknown> }> = [];
+  globalThis.fetch = async (url, init) => {
+    captured.push({ url: String(url), body: JSON.parse(String(init?.body || "{}")) });
+    return new Response(JSON.stringify({ id: "resp_astra", object: "response", output: [] }), {
+      status: 200,
+      headers: { "Content-Type": "application/json" },
+    });
+  };
+  try {
+    for (const effort of ["low", "medium", "high", "xhigh", "max", "none", "minimal"]) {
+      const body = openaiToOpenAIResponsesRequest(
+        model,
+        {
+          model,
+          messages: [{ role: "user", content: "Call the test tool." }],
+          reasoning_effort: effort,
+          tools: [
+            {
+              type: "function",
+              function: { name: "test_tool", parameters: { type: "object", properties: {} } },
+            },
+          ],
+        },
+        false,
+        {}
+      );
+      await new DefaultExecutor("openai").execute({
+        model,
+        body,
+        stream: false,
+        credentials: { apiKey: "test-openai-key" },
+      });
+      const request = captured.at(-1)!;
+      assert.equal(request.url, "https://api.openai.com/v1/responses");
+      assert.equal(request.body.model, model);
+      assert.equal(
+        (request.body.reasoning as { effort: string }).effort,
+        effort === "none" || effort === "minimal" ? "low" : effort
+      );
+      assert.ok(Array.isArray(request.body.input));
+      assert.equal((request.body.tools as Array<{ name: string }>)[0].name, "test_tool");
+    }
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});