Bump the default model IDs across every preset file and the downstream
defaults that mirror them:
- claude-opus-4-8 / anthropic/claude-opus-4.8 / global.anthropic.claude-opus-4-8
-> claude-opus-5, covering all three naming forms
- gpt-5.5 and the bare gpt-5.6 -> gpt-5.6-sol
- gemini-3.5-flash -> gemini-3.6-flash
Add gemini-3.6-flash to the built-in pricing seed (1.50 in / 7.50 out /
0.15 cache read per million). The seed runs INSERT OR IGNORE on every
startup, so existing databases pick the row up without overriding prices
the user edited by hand.
Advance the Claude Desktop opus route ID in step with the frontend SSOT:
CURRENT_OPUS_ROUTE_ID becomes claude-opus-5 and claude-opus-4-8 takes over
the LEGACY slot, so route IDs stored in existing user configs still resolve
through is_compatible_opus_route_alias.
Also sync omo.ts recommendations, form placeholders, the SudoCode partner
blurb and all four locales, plus the preset assertions that pin these IDs.
- PackyCode: packyapi.com -> www.packyapi.ai across all 8 app presets;
drop the api-slb.packyapi.com endpoint candidate
- RightCode: right.codes -> www.rightapi.ai across 7 app presets, keeping
the /claude and /codex/v1 path split and adding the www prefix that the
Codex-side endpoints were missing
- ClaudeAPI: site -> www.apito.ai, referral -> console.apito.ai/agent/...,
endpoint -> gw.apito.ai (Claude Code and Claude Desktop only)
- APINebula: apinebula.com -> apinebula.ai across all 8 app presets,
including the endpoint inside the Codex config.toml template
- SudoCode.chat: referral link only, /register -> /sign-up with new aff
and utm parameters (7 app presets); SudoCode.us is a different company
and is untouched
READMEs (en/zh/ja/de) carry the same URL updates. Brand names, icons,
i18n promo keys and README copy are deliberately unchanged.
Seed claude-opus-5 at $5/$25 per MTok with $0.50 cache read and $6.25
cache creation, matching the Opus 4.8 tier. Verified against models.dev
and the official Anthropic models overview. Fast mode ($10/$50) is a
separate billing path and is deliberately left out of the table.
New model id, so seed only; no repair entry and no SCHEMA_VERSION bump.
Bring back the AICoding (aicoding.sh) provider preset that was dropped
in 910ca3b4, covering claude, claudeDesktop, codex, gemini, hermes,
opencode and openclaw, along with the partnerPromotion.aicoding string
in zh/en/ja and the sponsor entry in the three READMEs.
Model ids follow the current baseline rather than the pre-removal
values: gpt-5.5 for Codex, gemini-3.5-flash for Gemini, and
claude-opus-4-8 / claude-sonnet-5 for the Anthropic-relay presets.
OpenClaw costs use standard list pricing, consistent with its peers.
The icon, the logo asset, the zh-TW string and the legacy id in
codex_history_migration.rs were never removed and are reused as-is.
Add a sync-to-r2 job that downloads the published release assets,
generates the website download manifest, uploads both to the
cc-switch-releases bucket (dl.ccswitch.io), and prunes versions
beyond the latest five. The job skips itself when R2 secrets are
not configured, so forks and the current pipeline are unaffected.
Generalize the Codex Responses-to-Chat tool media mechanism from 6c9d444c
to the remaining protocol bridges, so image-bearing tool results are never
tokenized as base64 text on any conversion path:
- Claude-to-Chat: tool_result images become native image_url parts,
batched into one synthetic user message after the tool message batch.
- Claude-to-Responses: JSON-string, MCP, and nested variants are restored
as native input_image parts inside function_call_output.
- Codex/GrokBuild-to-Anthropic: non-standard tool images are restored as
Anthropic image blocks (case-insensitive data:/http prefix parsing).
- Claude-to-Gemini: Gemini 3 uses multimodal functionResponse.parts;
older models get inlineData parts in the same user turn. The new
InlineImagesOnly scope keeps remote URLs and malformed data URLs in the
legacy text form instead of emitting fileData the API would reject.
Shared changes in tool_media:
- Centralize the plan/queue/flush helpers used by both Chat bridges.
- strip_and_clamp_media_from_tool_value clamps residual base64 inside
parsed JSON strings at any nesting depth before re-serialization.
- Emitted Chat parts no longer carry cache_control or
prompt_cache_breakpoint, preserving the strip-all-cache_control
contract that strict upstreams (GLM/Qwen) depend on.
- Media detection now requires full convertibility, keeping detection
and extraction symmetric by construction.
The media sanitizer detects and strips the new shapes symmetrically
(Chat string tool results, Anthropic string tool results, Gemini
inlineData/fileData and functionResponse.parts); the legacy typed-block
replacement runs first so replacement stays a superset of detection and
cache_control survives on replaced Anthropic blocks.
No-media tool outputs keep byte-identical legacy representations on all
bridges to protect prompt-cache prefixes.
The Responses->Chat conversion serialized image-bearing *_output items
into role:"tool" text via canonical_json_string, so view_image results
were tokenized as base64 text (~9000x inflation). Codex replays full
history every turn, so sessions hit context-limit 400s and wedged
(#4465, #5663).
- add proxy/tool_media: shared detection/strip/clamp walker for tool
output media (typed input_image / image_url / input_file /
input_audio, Anthropic source and MCP data+mimeType image shapes,
untyped data: image_url, whole-string bare data URLs)
- transform_codex_chat: replace media blocks in place with marker text
so tool content stays a plain string, and flush the extracted media
as one synthetic role:"user" message after each consecutive tool
batch; media-free traffic stays byte-identical to keep prompt-cache
prefixes stable
- media_sanitizer: detect and strip tool-output media symmetrically
(including JSON-string outputs) so reactive image stripping can heal
upstream modality rejections
- forwarder: regression tests pinning the reactive trigger and the
context-limit-400 non-trigger
E2E against Kimi K3 through the proxy: the replayed turn stays ~12k
input tokens with 99% cache hit, versus ~85k+ of base64 text per
replay before.
Add the grok_session icon to DataSourceBar and the Grok Build labels
for the app filter and data-source breakdown in all four locales
(zh/en/ja/zh-TW).
Grok CLI's official OAuth mode cannot be routed through the local proxy
(empty config is the mode switch, so there is no injection point), which
left official-mode usage invisible. Add session_usage_grokbuild to
import usage from ~/.grok/sessions updates.jsonl:
- Only turn_completed events carry usage; each event is the independent
per-turn total (accumulated across inference loops within one prompt),
so events are imported at face value. Do not reintroduce differencing
of adjacent events: counters reset every turn and differencing would
massively under-record.
- Cost priority: reported costUsdTicks (1 tick = 1e-10 USD) wins when
complete, because the backfill only repairs rows with total <= 0 and
can never correct a positive mispriced value; local pricing fills the
breakdown and raises a drift warning above max(1% of reported, 1e-6).
costIsPartial marks the reported value a lower bound: prefer a full
local recompute when the model is priced, else record the lower bound.
- Idempotency key grok_session:{session}:{prompt_id}:{model} anchors on
the upstream per-turn UUID (index fallback only when prompt_id is
empty), so rewind truncation cannot shift keys and double count;
orphan rows from truncated turns are kept since the tokens were spent.
- Anti double-count vs proxy takeover: 10min settle window plus a
time-window guard over recent grokbuild proxy activity; guarded skips
never mark files as synced.
- Seed grok-4.5-build pricing 2/6/0.30, back-derived from exact
costUsdTicks samples (cache read bills at 0.30, not the listed 0.50).
- Map _grok_session to a friendly provider display name and refresh the
takeover-capability comment in services/proxy.rs.
The cost backfill hardcoded codex|gemini as cache-inclusive apps, so
grokbuild TOTAL-semantics rows were priced on full input tokens with
cache reads double-counted. Converge the writer (proxy logger and
calculator) and the backfill recompute onto a single
sql_helpers::is_cache_inclusive_app predicate backed by the existing
CACHE_INCLUSIVE_APP_TYPES constant, and add a regression test for the
grokbuild backfill path.
Add SuperGrok subscription usage display, following the existing
Claude Code / Codex official-subscription pattern (protocol ported
from steipete/CodexBar):
- New subscription_grok service: reads Grok CLI credentials from
~/.grok/auth.json, calls the grok.com GrokBuildBilling gRPC-web
endpoint, and parses the response via heuristic protobuf scanning
(used percent, reset time, zero-usage special case)
- Transient failures (network errors, HTTP 408, gRPC deadline/
cancelled) propagate as Err so the frontend retries and keeps the
last good value; auth failures map to Expired with a re-login hint
- Tier naming by reset distance: weekly limit, monthly, or a new
"credits" tier (i18n added for zh/en/ja/zh-TW; tray shows "c")
- New get_xai_oauth_quota command: xai_oauth providers (managed
SuperGrok OAuth accounts) query the same billing endpoint with
their bound account token; ProviderCard auto-renders the quota
footer for them and hides the usage-script entry, and the tray /
usage-script path routes xai_oauth providers to the managed
account instead of the host app's CLI credentials
- UsageScriptModal: drop the config-content heuristic for official
detection; category === "official" is the single source of truth
Claude-Session: https://claude.ai/code/session_01LSNvhEfuoJHaQLZcYQgBU5
- Original sort mode now shows official > prime partner > sponsors
(preset file order, aligned with the README sponsor table) >
non-sponsors sorted by display name
- Physically reorder sponsor entries in all 8 preset files to match
the README sponsor table order; add group marker comments
- Drop stale section comments in openclaw/hermes preset files
- Update ProviderPresetSelector tests for the new ordering
- Reorder the sponsor table into the new priority order across all four
locale READMEs (en/zh/ja/de).
- Update RunAPI's benefit line to a 10% first-top-up discount (was
"contact support for a ¥14 credit").
Point the RunAPI invite link at https://runapi.co/register?aff=iOKB
across all 7 app presets (apiKeyUrl) and the four README sponsor rows
(banner + CTA), which previously used the bare runapi.co homepage with
no referral tag. The websiteUrl and runapi.co API endpoints stay bare,
so the aff code never enters a request URL.
Move the ClaudeCN invite link to https://claudecn.ai/register?aff=HEL9
across all 7 app presets (apiKeyUrl) and the four README sponsor rows
(banner + CTA, which previously pointed at the bare .top domain with no
referral tag). The websiteUrl and claudecn.top API endpoints are kept
unchanged, so only the registration/referral link moves to the new
domain and code.
Point the pinned Kimi K2.7 Code banner at the Moonshot growth CDN
(kimi-zh.png for the ZH README, kimi-en.png for en/ja/de) instead of
the in-repo assets. Alt text and the aff=cc-switch links are unchanged.
Refresh the ZetaAPI invite link from /go/ccs to /go/u117 across all
7 app presets (apiKeyUrl) and the four README locales. The historical
CHANGELOG entry and the api.zetaapi.ai endpoints / bare websiteUrl are
left untouched so the referral code stays out of request URLs.
Refresh the APINebula invite link from /02rw5X to /VjM74M across all
8 app presets (apiKeyUrl) and the four README locales. Bare-domain
websiteUrl and /v1 API endpoints are left untouched so the referral
code never leaks into request URLs.
Grok Build previously reused the whole Codex preset list, leaking
cn_official providers and Codex default models into the Grok CLI form.
Replace the inline filter with a standalone, independently maintained
preset module (no data linkage to codexProviderPresets):
- drop cn_official direct providers and open-source-only hosts
(SiliconFlow/ModelScope/Novita/Nvidia/AtlasCloud/OpenCode Go) that
have no Grok models upstream
- keep aggregators and third-party relays with grok-4.5 as the default
model (x-ai/grok-4.5 for OpenRouter-style namespaced routers)
- move the Grok Official seed entry into the presets module
- add standalone integrity tests; retarget the form's chat-mapping test
since no openai_chat preset remains in the list
Add a "Grok Official" preset and seed (grokbuild-official) whose empty
config represents the official login state: no custom [model.*] tables
are written, so Grok CLI falls back to its built-in xAI OAuth login and
cc-switch never touches those credentials.
Backend:
- Seed entry in OFFICIAL_SEEDS plus ensure_grokbuild_official_provider
command for on-demand repair (the one-shot master seeding flag is
already set for existing databases).
- Split validation into syntax-only (empty allowed) for live reads,
writes and official snapshots, keeping the full custom-model shape
check for non-official provider writes and imports. Backup/restore
can now round-trip an official-state live file.
- Manual import (command layer only) recognizes an official-state live
config and imports it as the official entry set as current, matching
the Codex official-login import outcome. Startup auto-import keeps
rejecting official-state live so a deleted official entry is never
resurrected on launch: startup import only captures real user data
as "default" and never manufactures official entries.
- Manual import also ensures the official entry before importing
(claude-desktop precedent) and after a successful custom import, so
first-time users end up with default + official like other apps.
- Proxy takeover guards skip or reject official-state live configs in
all three takeover paths, consistent with the official-provider
takeover ban.
Frontend:
- Grok Official preset entry in the GrokBuild form: official category
hides connection fields and passes the raw config through untouched.
- Filter managed-OAuth presets out of the GrokBuild preset list; they
were never wired for this app and produced keyless broken configs.
Tests cover seed presence, official round-trip, ensure-after-deletion,
and the four import scenarios including startup non-resurrection.
Tauri invoke rejects with the backend's serialized error string, not an
Error object, so reading `.message` produced an empty toast for every
failed live-config import. Route the rejection through
extractErrorMessage with a generic i18n fallback.
Also invalidate the providers query on import failure: the import
command can have visible side effects before erroring (e.g. GrokBuild
ensures its official entry prior to a failing import), and the list
must reflect them without a manual refresh.
Managed-OAuth providers (github_copilot / codex_oauth / xai_oauth) need
proxy takeover to inject credentials, but the "needs routing" badge and
the switch-time warning only keyed off apiFormat — missing OAuth providers
whose upstream format is native (e.g. the new Codex xAI Grok OAuth preset
on openai_responses).
- Add isOAuthProviderType / OAUTH_PROVIDER_TYPES as the SSOT for OAuth types
- Extract providerNeedsRouting() as the authoritative predicate: managed
OAuth always needs routing (the backend rejects these accounts' direct
connection) regardless of apiFormat or Claude Desktop mode
- ProviderCard badges (claude / codex / claude-desktop) and the switch
warning consume the shared predicate instead of raw apiFormat
- Gate the warning on per-app routing readiness: claude-desktop uses
isProxyRunning (backend takeover status has no such field), other apps
use isProxyTakeover — fixes false warnings on Desktop and missing
warnings when the proxy runs but the app isn't taken over
- Force proxy mode for all managed-OAuth providers in the Claude Desktop
form (lock the mode toggle), not only xai_oauth
- Add unit tests for providerNeedsRouting, the switch routing gate, and
Desktop OAuth preset enforcement
- i18n(zh/en/ja/zh-TW): add notifications.proxyReasonManagedOAuth
Add a managed "xAI (Grok) OAuth" Codex provider that routes through the
local proxy to api.x.ai via the shared Grok CLI OAuth identity, plus the
native-Responses compatibility layer that makes Codex 0.142+ traffic work
against xAI's strict upstream serde parser.
Provider:
- codex.rs: recognize the xai_oauth placeholder in extract_auth, hard-pin
the base URL to api.x.ai and the tool profile to native Responses
- forwarder.rs: treat xAI OAuth auth failures as non-retryable
- presets + ProviderForm/CodexFormFields: managed OAuth preset that hides
the api key/endpoint fields and derives the provider type across apps
Native Responses compatibility (gated on is_xai_oauth, so no other
provider is affected):
- transform_codex_responses_namespace: flatten Codex's private
namespace/plugin tool declarations into top-level function tools on the
request; restore the flat function_call names back to {name, namespace}
on the response (streaming and non-streaming) so the client matches its
own namespaced tool registry
- transform_codex_responses_xai_sanitize: strip the OpenAI-backend-private
fields xAI rejects (external_web_access, prompt_cache_retention,
safety_identifier, the additional_tools carrier, tool_search, ...) with
deterministic removals that keep the prompt-cache prefix stable
- wire both into the native passthrough after the request transform;
response restore runs in a dedicated handler so the generic passthrough
hot path is untouched
Ports the proven approach of sub2api's Grok Responses gateway. Verified
with a 4-round codex -> xAI OAuth workload: all tasks green, zero upstream
errors.
Treat Grok like Claude/OpenCode: install via the official xAI installer
(POSIX shell / Windows PowerShell), keep npm as fallback, discover
~/.grok/bin, and anchor updates to `grok update` only for native installs.
Schema v16 wipes codex_session detail rows, _codex_session rollups and
Codex rollout cursors inside the migration savepoint (cursor deletion
uses pure shape matching so CODEX_HOME drift cannot orphan cursors);
the next session sync re-imports history from source JSONL under the
corrected importer. Fresh installs traverse the same branch as a no-op.
Add a manual "Rebuild Codex usage" maintenance action (single-flight,
hard-fail backup before reset, unconditional refresh notification even
when reimport is empty or fails after reset) with a destructive confirm
dialog, result toast and four-locale strings. Historical proxy-side
duplicate rows are intentionally left untouched; history whose source
JSONL was already deleted cannot be reconstructed.
Derive request ids from upstream envelope ids (Codex/OpenAI top-level
id, Gemini responseId, Claude message id with non-empty filtering)
scoped as session:{app_type}:{provider_id}:{id} for non-Claude sources;
Claude keeps bare session:{id} to preserve session-log convergence.
The logger now queries and conditionally writes under a single
connection guard: identical semantic replays return without writing or
notifying, session_log rows may be upgraded by proxy, and same-id
different-semantic responses land on a deterministic SHA-256 collision
fallback key instead of being overwritten. Fixes the random-UUID
INSERT OR REPLACE duplication behind #5496.
Rewrite the Codex session importer: identify forks by forked_from_id or
subagent thread_spawn.parent_thread_id (conflicts defer), anchor thread
identity to the rollout filename UUID, and align child token_count
signatures against the parent rollout as a strict prefix so replayed
parent history only establishes the cumulative baseline and is never
imported as child usage. Ambiguous alignments defer without advancing
the cursor and recover once the parent appears; parent signatures are
cached per (path, cutoff).
Fixes the 3x-20x double counting behind #5335/#5433 while keeping
reference-type subagents fully counted (#5381).
Detect codex_session rows sharing the same model/token fingerprint
within the dedup window under a different request_id. Predicates reuse
the COALESCE(data_source,'proxy') shape so the existing expression
index serves the lookup. Wired up by the Codex importer rewrite.
Replace per-insert usage notifications with a single notification per
sync pass, guard all sync entry points (startup backfill, 60s loop,
manual sync) behind a process-wide single-flight tokio mutex, and move
blocking file/DB work onto spawn_blocking with MissedTickBehavior::Skip.
Extend SessionSyncResult with deferredFiles/suspectedDuplicates
observability fields (saturating aggregation) and add a test seam that
counts notifications even without an injected AppHandle.
API-key preset pointing at https://api.x.ai/v1 with wire_api =
"responses": xAI serves the Responses API natively, so no route
takeover conversion is needed. Ships a grok-4.5 catalog entry
(500K context, parallel tools, text+image) so the model shows up
under Codex's strict catalog parsing. This is deliberately not a
managed-account preset: providerType stays absent, pinned by a
regression test alongside the Claude-side xAI OAuth presets.
grok-4.5 is the default model of the xAI presets but had no pricing
row, so usage dashboards recorded zero cost for it. Official list
price: $2 input / $6 output / $0.50 cached read per 1M tokens.
Seed-only change: the startup INSERT OR IGNORE backfills existing
databases; no repair entry needed for a missing row.
Document the xAI OAuth flow (discovery, device, token, and API endpoints)
in the zh/en/ja manuals. State explicitly that the integration reuses the
public OAuth client identity and scopes registered for the official Grok
CLI rather than a CC Switch registration, and strengthen the shared
account-backed proxy note back to an explicit warning covering account
restriction and suspension risk.
Add XaiOAuthSection (device-code login, account list, default selection)
backed by the generalized useManagedAuth hook, wire it into the Auth
Center and both Claude provider forms, and expose model fetching for
signed-in accounts.
- Accounts requiring re-auth stay visible in the account selector as
disabled items with an expired badge instead of silently vanishing.
- Auth status refetches periodically so a revoked refresh token surfaces
without reloading the panel.
- All strings ship in zh/en/ja/zh-TW; a locale coverage test pins every
required key in all four locales.
Register the xai_oauth provider type constant and add xAI (Grok) presets
targeting grok-4.5. The Desktop preset routes branded claude-* model IDs
to grok-4.5 upstream so it passes Desktop's third-party model validation.
Add an xAI OAuth manager using the OAuth 2.0 Device Authorization Grant
with endpoints resolved from xAI's OIDC discovery document. All HTTP goes
through the app-managed proxy client.
- Managed provider kind xai_oauth: forced openai_responses wire format,
pinned api.x.ai base URL, bearer injection gated to the xAI origin,
tokens registered for log redaction, single-auth-key takeover policy.
- Token cache cannot bypass account state: cache hits re-validate account
usability, refresh commits run under the mutation lock with a
refresh-token CAS check, and pending logins are re-checked before an
account is persisted.
- Refresh classification: 401/403 with any body and 400 with a non-JSON
body mark the account for re-auth; 429/5xx stay transient.
- Shared auth_* commands dispatch to xAI with guard types mirroring the
Copilot/Codex branches.
Codex >= 0.144.5 requires supports_reasoning_summaries in every external
model catalog entry and rejects the whole file at startup when it is
missing, which bricks both the CLI and the desktop app.
The ProxyChat catalog template is cloned from dynamic sources first
(models_cache.json, then `codex debug models --bundled`). models_cache.json
is shared by every Codex install on the machine and each version serializes
its own ModelInfo shape, so the cache's field set follows whichever process
wrote it last and cannot be assumed to satisfy the current external-catalog
schema. Deleting the generated catalog never helped: any provider save or
switch regenerated it from the same stale template.
Backfill parser-required fields (explicit whitelist, currently only
supports_reasoning_summaries) from the bundled static template when the
dynamic template lacks them. Optional capability fields are deliberately
NOT backfilled so their missing-means-parser-default semantics survive,
and existing values always win.
The Kimi For Coding subscription reports its K3 model under the short
id `k3` (no `kimi-` prefix), whereas the regular Moonshot API still uses
the full `kimi-k3`. Seed a `k3` alias row right after `kimi-k3` at the
same official list price ($3/M in, $15/M out, $0.30/M cache read) so
coding-plan usage is priced correctly. Mirrors the existing
hunyuan-hy3/hy3 bare-alias precedent.
Pricing is matched by exact model id, so this does not touch the
`kimi-for-coding` endpoint alias (intentionally unpriced, subscription
semantics) nor risk prefix mismatches. Seed-only, no schema bump.
Document API key and ChatGPT OAuth routing flows for using Codex models in Claude Code, including configuration screenshots and troubleshooting guidance.
Jason