fix(codex): Fast mode (service tier) toggle + /fast command (closes tiann#898) (tiann#904)

* test: reproduce issue tiann#898 (Codex fast mode service tier)

* fix(codex): add Fast mode (service tier) toggle and /fast command (closes tiann#898)

* feat(codex+web): Fast mode UI toggle with full persistence

Wires the Codex Fast mode (service tier) end-to-end so it can be toggled
from the web composer and survives reload/handoff:

- shared: serviceTier on Session/SessionPatch, session-alive payload,
  resume target, and a SessionServiceTierRequest schema
- cli: AgentSessionBase carries serviceTier through keepAlive; runCodex
  syncs it to the session instance
- hub: service_tier column (schema v10 + migration), store setter,
  sessionCache + syncEngine plumbing, POST /sessions/:id/service-tier
- web: api.setServiceTier + mutation, a Fast/Standard toggle in the
  composer settings (gated to Codex GPT-5.5/5.4), and StatusBar now
  reflects the real tier instead of the effort heuristic

Refs tiann#898

* fix(codex): preserve unset/persisted service tier on startup keepalive

Addresses HAPI Bot [Major] on PR tiann#904: applyCurrentConfigToSession ran
setServiceTier(currentServiceTier ?? null) on wrapper-ready, collapsing the
untouched `undefined` state into explicit Standard. The immediate
setCollaborationMode keepalive then persisted serviceTier: null, silently
downgrading resumed Fast sessions and disabling account-default Fast.

- Seed currentServiceTier from the persisted session (sessionInfo.serviceTier),
  so a resumed Fast thread keeps running Fast.
- Only call setServiceTier when the tier is explicit (!== undefined), preserving
  the three-state omit semantics at the keepalive boundary.
- Add regression tests: persisted Fast is re-asserted; untouched omits the tier.

* feat(codex+web): gate Fast toggle on catalog-advertised service tier

The Fast toggle was gated on a model-name regex (gpt-5.5/5.4), which still
showed a no-op control to API-key users — Fast credits only apply with
ChatGPT login. Codex's model/list catalog advertises the service tiers
actually available for each model in the current auth/plan context, so gate
on that instead:

- cli: capture serviceTiers (ids) per model in ModelListItem + normalizeModel
- shared: CodexModelSummary.serviceTiers (flows through the existing
  getSessionCodexModels pass-through; no hub change needed)
- web: codexModelAdvertisesFastTier(sessionModel, models) replaces the regex;
  SessionChat gates the toggle on it (hidden while the catalog is
  loading/errored). The toggle now only appears when toggling it will
  actually take effect.

Refs tiann#898

* fix(codex): make explicit Standard service tier sticky across resume

Addresses HAPI Bot [Major] (round 2): a single persisted null conflated
"untouched" with "explicit Standard". A user who turned Fast off persisted
null, but startup mapped null -> undefined (untouched) and omitted serviceTier,
so an account/thread-default Fast could silently return after restart/resume.

Introduce a distinct stored representation:
- 'fast' / 'standard' are explicit user choices; null/undefined = untouched.
- Translate 'standard' -> Codex app-server serviceTier: null ONLY when building
  thread/turn params (toAppServerServiceTier); untouched omits the field.
- /fast off now stores 'standard'; the web Standard option sends 'standard'.
- Tighten SessionServiceTierRequest to enum(['fast','standard']) so stray tier
  strings are never forwarded.

Tests: sticky-Standard-on-resume regression; turn/thread params translate
'standard'->null and omit on untouched; hub route applies fast/standard and
rejects unsupported values + local sessions.

Refs tiann#898

* fix(codex): recognize real Fast tier (id 'priority', name 'Fast') in catalog gate

Live E2E against an authed Codex session revealed the model catalog advertises
the Fast tier with id 'priority' and display name 'Fast' (not id 'fast'), so the
/fast/i gate — which only saw tier ids — wrongly hid the toggle for valid
ChatGPT users on gpt-5.5/gpt-5.4. Capture both the tier id and name as
lowercased tokens so the existing name-based match recognizes 'Fast'. The sent
value stays 'fast' (the documented service_tier value / raw additionalSpeedTiers
request tier). Verified end-to-end: gpt-5.5/gpt-5.4 gate on, gpt-5.4-mini off.

Refs tiann#898

* fix(codex): preserve service tier across session resume

Resuming a Codex session spawns a fresh session (serviceTier null) and merges
the old one in. Unlike model/effort/permissionMode, serviceTier was neither
threaded through the resume spawn nor preserved in mergeSessionData, so a
resumed Fast (or explicit Standard) session silently reverted to the account
default.

Thread serviceTier through the spawn path like its siblings:
- hub: resumeSession passes session.serviceTier to spawnSession; rpcGateway +
  syncEngine carry it in the spawn RPC payload; mergeSessionData preserves it
  old->new (safety net).
- cli: SpawnSessionOptions.serviceTier; apiMachine forwards it; buildCliArgs
  emits --service-tier for codex; the codex command parses it; runCodex seeds
  currentServiceTier from the spawn override first (opts.serviceTier ??
  sessionInfo.serviceTier), so a resumed thread immediately runs the right tier.

Verified end-to-end: set Fast -> kill process -> reopen -> resumed session (new
id) still runs Fast. Tests: buildCliArgs --service-tier (codex only), runCodex
spawn-override seed, mergeSessionData service-tier preservation.

Refs tiann#898

* fix(codex): send advertised 'priority' tier id for Fast, not 'fast'

The model catalog advertises the Fast tier with request id 'priority' (display
name 'Fast'), and OpenAI docs confirm service_tier='fast' maps to the request
value 'priority'. The app-server serviceTier override is a raw request value
that does not validate unknown strings (a live probe accepted 'bogus-xyz'), so
sending 'fast' risks being silently ignored — no Fast applied.

Translate the stored 'fast' state to app-server 'priority' at the thread/turn
param boundary (toAppServerServiceTier); the stored/UI/command representation
stays 'fast'/'standard'. Verified live: a turn with serviceTier='priority' runs
and consumes the Fast-tier rate budget.

Addresses HAPI Bot [Major]. Refs tiann#898

* fix(codex): validate --service-tier CLI value (fast|standard)

Addresses HAPI Bot [Minor]: the internal --service-tier spawn arg accepted any
non-empty string, unlike the web /service-tier enum, so a malformed value could
be seeded into currentServiceTier and persisted via keepalive. Parse it to
'fast'|'standard' and reject anything else, matching the web endpoint.

Refs tiann#898

Author: swear01

cli/src/agent/sessionBase.ts

@@ -26,6 +26,7 @@ export type AgentSessionBaseOptions<Mode> = {
     model?: SessionModel;
     modelReasoningEffort?: SessionModelReasoningEffort;
     effort?: SessionEffort;
+    serviceTier?: string | null;
     collaborationMode?: SessionCollaborationMode;
 };
 
@@ -50,6 +51,7 @@ export class AgentSessionBase<Mode> {
     protected model?: SessionModel;
     protected modelReasoningEffort?: SessionModelReasoningEffort;
     protected effort?: SessionEffort;
+    protected serviceTier?: string | null;
     protected collaborationMode?: SessionCollaborationMode;
 
     constructor(opts: AgentSessionBaseOptions<Mode>) {
@@ -68,6 +70,7 @@ export class AgentSessionBase<Mode> {
         this.model = opts.model;
         this.modelReasoningEffort = opts.modelReasoningEffort;
         this.effort = opts.effort;
+        this.serviceTier = opts.serviceTier;
         this.collaborationMode = opts.collaborationMode;
 
         this.queue.onBatchConsumed = (localIds) => this.client.emitMessagesConsumed(localIds);
@@ -137,13 +140,15 @@ export class AgentSessionBase<Mode> {
             model?: SessionModel
             modelReasoningEffort?: SessionModelReasoningEffort
             effort?: SessionEffort
+            serviceTier?: string | null
             collaborationMode?: SessionCollaborationMode
         } | undefined {
         if (
             this.permissionMode === undefined
             && this.model === undefined
             && this.modelReasoningEffort === undefined
             && this.effort === undefined
+            && this.serviceTier === undefined
             && this.collaborationMode === undefined
         ) {
             return undefined;
@@ -153,6 +158,7 @@ export class AgentSessionBase<Mode> {
             model: this.model,
             modelReasoningEffort: this.modelReasoningEffort,
             effort: this.effort,
+            serviceTier: this.serviceTier,
             collaborationMode: this.collaborationMode
         };
     }
@@ -173,6 +179,14 @@ export class AgentSessionBase<Mode> {
         return this.effort;
     }
 
+    getServiceTier(): string | null | undefined {
+        return this.serviceTier;
+    }
+
+    setServiceTier(serviceTier: string | null): void {
+        this.serviceTier = serviceTier;
+    }
+
     getCollaborationMode(): SessionCollaborationMode | undefined {
         return this.collaborationMode;
     }

cli/src/agent/sessionFactory.test.ts

@@ -74,6 +74,7 @@ function createSession(): Session {
         model: null,
         modelReasoningEffort: null,
         effort: null,
+        serviceTier: null,
         permissionMode: undefined,
         collaborationMode: undefined
     }

cli/src/api/api.extraHeaders.test.ts

@@ -137,6 +137,7 @@ describe('API extra headers integration', () => {
             model: null,
             modelReasoningEffort: null,
             effort: null,
+            serviceTier: null,
             permissionMode: undefined,
             collaborationMode: undefined
         })

cli/src/api/api.ts

@@ -98,6 +98,7 @@ export class ApiClient {
             model: raw.model,
             modelReasoningEffort: raw.modelReasoningEffort,
             effort: raw.effort,
+            serviceTier: raw.serviceTier,
             permissionMode: raw.permissionMode,
             collaborationMode: raw.collaborationMode
         }
@@ -147,6 +148,7 @@ export class ApiClient {
             model: raw.model,
             modelReasoningEffort: raw.modelReasoningEffort,
             effort: raw.effort,
+            serviceTier: raw.serviceTier,
             permissionMode: raw.permissionMode,
             collaborationMode: raw.collaborationMode
         }

cli/src/api/apiMachine.ts

@@ -249,7 +249,7 @@ export class ApiMachineClient {
 
     setRPCHandlers({ spawnSession, stopSession, requestShutdown }: MachineRpcHandlers): void {
         this.rpcHandlerManager.registerHandler(RPC_METHODS.SpawnHappySession, async (params: any) => {
-            const { directory, sessionId, resumeSessionId, machineId, approvedNewDirectoryCreation, agent, model, effort, modelReasoningEffort, yolo, permissionMode, token, sessionType, worktreeName } = params || {}
+            const { directory, sessionId, resumeSessionId, machineId, approvedNewDirectoryCreation, agent, model, effort, modelReasoningEffort, yolo, permissionMode, serviceTier, token, sessionType, worktreeName } = params || {}
 
             if (!directory) {
                 throw new Error('Directory is required')
@@ -272,6 +272,7 @@ export class ApiMachineClient {
                 modelReasoningEffort,
                 yolo,
                 permissionMode,
+                serviceTier,
                 token,
                 sessionType,
                 worktreeName

cli/src/api/apiSession.ts

@@ -573,6 +573,7 @@ export class ApiSessionClient extends EventEmitter {
             model?: SessionModel
             modelReasoningEffort?: string | null
             effort?: string | null
+            serviceTier?: string | null
             collaborationMode?: SessionCollaborationMode
         }
     ): void {

cli/src/codex/appServerTypes.ts

@@ -34,6 +34,12 @@ export interface ModelListItem {
         description?: string;
     }>;
     defaultReasoningEffort?: string | null;
+    serviceTiers?: Array<{
+        id?: string;
+        name?: string;
+        description?: string;
+    }>;
+    defaultServiceTier?: string | null;
     isDefault?: boolean;
     [key: string]: unknown;
 }
@@ -63,6 +69,11 @@ export interface CollaborationModeListResponse {
 export interface ThreadStartParams {
     model?: string;
     modelProvider?: string;
+    /**
+     * Service tier override (e.g. 'fast'). `null` selects the standard tier
+     * explicitly; omit to inherit the account/thread default.
+     */
+    serviceTier?: string | null;
     cwd?: string;
     approvalPolicy?: ApprovalPolicy;
     sandbox?: SandboxMode;
@@ -161,6 +172,11 @@ export interface TurnStartParams {
     approvalPolicy?: ApprovalPolicy;
     sandboxPolicy?: SandboxPolicy;
     model?: string;
+    /**
+     * Service tier override for this turn and subsequent turns (e.g. 'fast').
+     * `null` selects the standard tier explicitly; omit to leave it unchanged.
+     */
+    serviceTier?: string | null;
     effort?: ReasoningEffort;
     summary?: ReasoningSummary;
     personality?: string;

cli/src/codex/loop.ts

@@ -16,6 +16,11 @@ export interface EnhancedMode {
     model?: string;
     collaborationMode: CodexCollaborationMode;
     modelReasoningEffort?: ReasoningEffort;
+    /**
+     * Service tier override. `undefined` leaves it untouched (account default),
+     * `'fast'` enables Fast mode, `null` selects the standard tier explicitly.
+     */
+    serviceTier?: string | null;
 }
 
 interface LoopOptions {

cli/src/codex/runCodex.test.ts

@@ -5,13 +5,15 @@ const mockCodexSession = vi.hoisted(() => ({
     setPermissionMode: vi.fn(),
     setModel: vi.fn(),
     setModelReasoningEffort: vi.fn(),
+    setServiceTier: vi.fn(),
     setCollaborationMode: vi.fn(),
     stopKeepAlive: vi.fn()
 }))
 
 const harness = vi.hoisted(() => ({
     bootstrapArgs: [] as Array<Record<string, unknown>>,
     loopArgs: [] as Array<Record<string, unknown>>,
+    sessionInfo: { serviceTier: null as string | null } as Record<string, unknown>,
     session: {
         onUserMessage: vi.fn(),
         onCancelQueuedMessage: vi.fn(),
@@ -26,14 +28,16 @@ vi.mock('@/agent/sessionFactory', () => ({
         harness.bootstrapArgs.push(options)
         return {
             api: {},
-            session: harness.session
+            session: harness.session,
+            sessionInfo: harness.sessionInfo
         }
     }),
     bootstrapExistingSession: vi.fn(async (options: Record<string, unknown>) => {
         harness.bootstrapArgs.push(options)
         return {
             api: {},
-            session: harness.session
+            session: harness.session,
+            sessionInfo: harness.sessionInfo
         }
     })
 }))
@@ -103,12 +107,14 @@ describe('runCodex', () => {
     beforeEach(() => {
         harness.bootstrapArgs.length = 0
         harness.loopArgs.length = 0
+        harness.sessionInfo = { serviceTier: null }
         harness.session.onUserMessage.mockReset()
         harness.session.onCancelQueuedMessage.mockReset()
         harness.session.rpcHandlerManager.registerHandler.mockReset()
         mockCodexSession.setPermissionMode.mockReset()
         mockCodexSession.setModel.mockReset()
         mockCodexSession.setModelReasoningEffort.mockReset()
+        mockCodexSession.setServiceTier.mockReset()
         mockCodexSession.setCollaborationMode.mockReset()
         lifecycleMock.registerProcessHandlers.mockClear()
         lifecycleMock.cleanupAndExit.mockClear()
@@ -140,6 +146,61 @@ describe('runCodex', () => {
         expect(mockCodexSession.setCollaborationMode).toHaveBeenLastCalledWith('plan')
     })
 
+    it('preserves a persisted Fast service tier on startup', async () => {
+        harness.sessionInfo = { serviceTier: 'fast' }
+
+        await runCodexImpl({
+            existingSessionId: 'hapi-session-1',
+            workingDirectory: '/tmp/project',
+            resumeSessionId: 'codex-thread-1'
+        } as Parameters<typeof runCodex>[0])
+
+        // The first keepalive sync must re-assert Fast, not collapse it.
+        expect(mockCodexSession.setServiceTier).toHaveBeenCalledWith('fast')
+        expect(mockCodexSession.setServiceTier).not.toHaveBeenCalledWith(null)
+    })
+
+    it('keeps an explicit Standard service tier sticky on startup', async () => {
+        harness.sessionInfo = { serviceTier: 'standard' }
+
+        await runCodexImpl({
+            existingSessionId: 'hapi-session-1',
+            workingDirectory: '/tmp/project',
+            resumeSessionId: 'codex-thread-1'
+        } as Parameters<typeof runCodex>[0])
+
+        // Explicit Standard must survive resume (not be dropped to untouched),
+        // so later turns keep sending app-server serviceTier: null.
+        expect(mockCodexSession.setServiceTier).toHaveBeenCalledWith('standard')
+    })
+
+    it('prefers the spawn-time service tier override when resuming (hub passes Fast)', async () => {
+        // On resume the hub spawns a fresh session (serviceTier null in the new
+        // row) and passes the old tier via opts; the override must win so the
+        // resumed thread immediately runs Fast.
+        harness.sessionInfo = { serviceTier: null }
+
+        await runCodexImpl({
+            workingDirectory: '/tmp/project',
+            resumeSessionId: 'codex-thread-1',
+            serviceTier: 'fast'
+        } as Parameters<typeof runCodex>[0])
+
+        expect(mockCodexSession.setServiceTier).toHaveBeenCalledWith('fast')
+    })
+
+    it('does not collapse an untouched service tier into explicit Standard on startup', async () => {
+        harness.sessionInfo = { serviceTier: null }
+
+        await runCodexImpl({
+            workingDirectory: '/tmp/project'
+        } as Parameters<typeof runCodex>[0])
+
+        // Untouched (account-default) sessions must omit the tier entirely so
+        // the keepalive never persists serviceTier: null over the default.
+        expect(mockCodexSession.setServiceTier).not.toHaveBeenCalled()
+    })
+
     it('replays transcript history when attaching a new Hapi session to an existing Codex thread', async () => {
         await runCodexImpl({
             workingDirectory: '/tmp/project',