refactor(shadow-call): give the intercepted model set one home

Codex's helper slug is not stable across client versions -- gpt-5.4-mini up to
0.144.x, gpt-5.6-luna from 0.145.0 -- so any surface that hard-codes it goes
stale on the next client bump. The prefix set now lives in src/lib/shadow-call.ts
and the management API reports it, so the runtime, the API and the GUI all name
the same models instead of three literals drifting apart.

The routed-id exclusion moves with it: a shadow call is always a bare native
slug, and an explicit provider/model selection must never be hijacked.

Author: lidge-jun

gui/src/pages/shadow-call-source.ts

@@ -0,0 +1,28 @@
+/**
+ * Which models the runtime actually intercepts as shadow calls.
+ *
+ * Codex's hard-coded helper slug moves between client versions (gpt-5.4-mini up
+ * to 0.144.x, gpt-5.6-luna from 0.145.0), so the GUI must render whatever the
+ * runtime reports rather than a literal baked into a label. The fallback only
+ * covers a runtime too old to send `sourceModels`.
+ */
+const FALLBACK_SOURCE_MODELS = ["gpt-5.4-mini", "gpt-5.6-luna"];
+
+export function shadowSourceModelList(sourceModels?: string[]): string[] {
+  const cleaned = Array.isArray(sourceModels)
+    ? sourceModels.filter(v => typeof v === "string" && v.trim() !== "").map(v => v.trim())
+    : [];
+  return cleaned.length > 0 ? cleaned : FALLBACK_SOURCE_MODELS;
+}
+
+/** Comma-joined source models for inline badges and warning text. */
+export function shadowSourceModelLabel(sourceModels?: string[]): string {
+  return shadowSourceModelList(sourceModels).join(", ");
+}
+
+/** Short badge form: drops the shared `gpt-` prefix to keep the row compact. */
+export function shadowSourceModelBadge(sourceModels?: string[]): string {
+  return shadowSourceModelList(sourceModels)
+    .map(id => id.replace(/^gpt-/, ""))
+    .join(", ");
+}

src/lib/shadow-call.ts

@@ -0,0 +1,30 @@
+/**
+ * Shadow-call intercept source models.
+ *
+ * Codex's hard-coded helper model is not stable across client versions: it was
+ * `gpt-5.4-mini` up to 0.144.x and became `gpt-5.6-luna` in 0.145.0. The
+ * intercept therefore matches a prefix SET, and every surface that names the
+ * intercepted model (management API, GUI badges/tooltips, CLI) reads it from
+ * here instead of hard-coding a slug that goes stale on the next client bump.
+ */
+export const DEFAULT_SHADOW_SOURCE_MODELS = ["gpt-5.4-mini", "gpt-5.6-luna"] as const;
+
+/** Normalize a persisted `sourceModels` override; falls back to the defaults. */
+export function shadowSourceModels(configured?: unknown): string[] {
+  const configuredStrings = Array.isArray(configured)
+    ? configured
+      .filter((v): v is string => typeof v === "string" && v.trim() !== "")
+      .map(v => v.trim())
+    : [];
+  return configuredStrings.length > 0 ? configuredStrings : [...DEFAULT_SHADOW_SOURCE_MODELS];
+}
+
+/**
+ * True when `modelId` is one of Codex's helper/shadow source models.
+ * Routed ids (`provider/model`) are hard-excluded: a shadow call is always a
+ * bare native slug, and an explicit routed selection must never be hijacked.
+ */
+export function isShadowSourceModel(modelId: string, configured?: unknown): boolean {
+  if (modelId.includes("/")) return false;
+  return shadowSourceModels(configured).some(prefix => modelId.startsWith(prefix));
+}

src/server/management/config-routes.ts

@@ -24,6 +24,7 @@ import {
 import { removeCredential } from "../../oauth/store";
 import { providerDestinationResolvedError } from "../../lib/destination-policy";
 import { isStreamMode } from "../../lib/bun-stream-caps";
+import { shadowSourceModels } from "../../lib/shadow-call";
 import { enrichProviderFromCatalog, listKeyLoginProviders } from "../../oauth/key-providers";
 import { deriveProviderPresets } from "../../providers/derive";
 import { providerCodexAccountMode } from "../../providers/registry";
@@ -354,7 +355,11 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
 
   if (url.pathname === "/api/shadow-call-settings" && req.method === "GET") {
     const sci = config.shadowCallIntercept ?? {};
-    return jsonResponse({ enabled: sci.enabled === true, model: sci.model ?? "" });
+    return jsonResponse({
+      enabled: sci.enabled === true,
+      model: sci.model ?? "",
+      sourceModels: shadowSourceModels(sci.sourceModels),
+    });
   }
 
   if (url.pathname === "/api/shadow-call-settings" && req.method === "PUT") {
@@ -376,7 +381,12 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
     }
     saveConfigPreservingClaudeCode(config);
     const sci = config.shadowCallIntercept;
-    return jsonResponse({ ok: true, enabled: sci.enabled === true, model: sci.model ?? "" });
+    return jsonResponse({
+      ok: true,
+      enabled: sci.enabled === true,
+      model: sci.model ?? "",
+      sourceModels: shadowSourceModels(sci.sourceModels),
+    });
   }
   return null;
 }

src/server/responses/core.ts

@@ -174,16 +174,9 @@ export function sidecarOutcomeRecorder(
 
 
 
-export const DEFAULT_SHADOW_SOURCE_MODELS = ["gpt-5.4-mini", "gpt-5.6-luna"] as const;
-
-export function isShadowSourceModel(modelId: string, configured?: unknown): boolean {
-  if (modelId.includes("/")) return false;
-  const configuredStrings = Array.isArray(configured)
-    ? configured.filter((v): v is string => typeof v === "string" && v.trim() !== "")
-    : [];
-  const prefixes = configuredStrings.length > 0 ? configuredStrings : DEFAULT_SHADOW_SOURCE_MODELS;
-  return prefixes.some(prefix => modelId.startsWith(prefix.trim()));
-}
+import { isShadowSourceModel } from "../../lib/shadow-call";
+
+export { DEFAULT_SHADOW_SOURCE_MODELS, isShadowSourceModel, shadowSourceModels } from "../../lib/shadow-call";
 
 
 

tests/responses-shadow-intercept.test.ts

@@ -4,7 +4,11 @@
  * must match a source-model set, not a single literal.
  */
 import { afterEach, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import { handleResponses, isShadowSourceModel } from "../src/server/responses";
+import { handleManagementAPI } from "../src/server/management-api";
 import type { OcxConfig } from "../src/types";
 
 const originalFetch = globalThis.fetch;
@@ -111,3 +115,59 @@ describe("shadow call intercept request path (issue #311)", () => {
     expect(response.status).toBe(404);
   });
 });
+
+/**
+ * The GUI badge/tooltip used to hard-code "5.4-mini", so it kept naming a model
+ * Codex no longer sends. The management API is the single source of truth for
+ * which models are intercepted; every client renders what it reports.
+ */
+async function withTempHome<T>(run: () => Promise<T>): Promise<T> {
+  const previousHome = process.env.OPENCODEX_HOME;
+  const dir = mkdtempSync(join(tmpdir(), "ocx-shadow-"));
+  process.env.OPENCODEX_HOME = dir;
+  try {
+    return await run();
+  } finally {
+    if (previousHome === undefined) delete process.env.OPENCODEX_HOME;
+    else process.env.OPENCODEX_HOME = previousHome;
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+async function shadowApi(config: OcxConfig, method: string, body?: unknown): Promise<Record<string, unknown>> {
+  // Management API enforces a same-origin gate; a browserless caller must look local.
+  const headers: Record<string, string> = { origin: "http://127.0.0.1:10100", host: "127.0.0.1:10100" };
+  if (body !== undefined) headers["content-type"] = "application/json";
+  const req = new Request("http://localhost/api/shadow-call-settings", {
+    method,
+    headers,
+    body: body === undefined ? undefined : JSON.stringify(body),
+  });
+  const res = await handleManagementAPI(req, new URL(req.url), config, { refreshCodexCatalog: async () => {} });
+  expect(res).not.toBeNull();
+  expect(res!.status).toBe(200);
+  return await res!.json() as Record<string, unknown>;
+}
+
+describe("shadow-call settings API reports the intercepted source models", () => {
+  test("GET reports the defaults, including the 0.145.0 helper model", async () => {
+    await withTempHome(async () => {
+      const body = await shadowApi({ port: 0, defaultProvider: "xai", providers: {} } as OcxConfig, "GET");
+      expect(body.sourceModels).toEqual(["gpt-5.4-mini", "gpt-5.6-luna"]);
+    });
+  });
+
+  test("GET and PUT report a configured override instead of the defaults", async () => {
+    await withTempHome(async () => {
+      const config = {
+        port: 0,
+        defaultProvider: "xai",
+        providers: {},
+        shadowCallIntercept: { enabled: true, model: "gpt-5.5", sourceModels: ["gpt-5.6-luna"] },
+      } as OcxConfig;
+      expect((await shadowApi(config, "GET")).sourceModels).toEqual(["gpt-5.6-luna"]);
+      const put = await shadowApi(config, "PUT", { enabled: true });
+      expect(put.sourceModels).toEqual(["gpt-5.6-luna"]);
+    });
+  });
+});