Merge pull request #848 from AAEE86/codex-dynamic-client-profile

feat(codex): add dynamic CLI client profile

apps/aether-gateway/src/ai_serving/api.rs

@@ -69,9 +69,9 @@ pub(crate) use aether_ai_formats::api::{
     OPENAI_VIDEO_REMIX_SYNC_PLAN_KIND,
 };
 pub(crate) use aether_ai_formats::protocol::stream::CanonicalUsage as StreamingCanonicalUsage;
-/// Codex client identity headers re-exported for out-of-crate probe binaries,
-/// which must reach `aether_ai_formats` through this seam.
-pub use aether_ai_formats::{CODEX_CLIENT_ORIGINATOR, CODEX_CLIENT_USER_AGENT};
+/// Codex client identity accessors re-exported for out-of-crate probe binaries,
+/// which must reach the runtime profile through this seam.
+pub use aether_ai_formats::{codex_client_originator, codex_client_user_agent};
 pub(crate) use aether_ai_formats::{CODEX_RESPONSES_LITE_HEADER, UPSTREAM_IS_STREAM_KEY};
 
 pub(crate) fn parse_direct_request_body(

apps/aether-gateway/src/ai_serving/planner/standard/codex/tests.rs

@@ -505,9 +505,12 @@ fn projects_uuid_prompt_cache_identity_into_missing_session_headers() {
     assert_eq!(headers.get("x-client-request-id"), None);
     assert_eq!(
         headers.get("user-agent").map(String::as_str),
-        Some(aether_ai_formats::CODEX_CLIENT_USER_AGENT)
+        Some(aether_ai_formats::codex_client_user_agent().as_str())
+    );
+    assert_eq!(
+        headers.get("originator"),
+        Some(&aether_ai_formats::codex_client_originator())
     );
-    assert_eq!(headers.get("originator"), Some(&"codex_cli_rs".to_string()));
     assert!(!headers.contains_key("version"));
     assert_eq!(headers.get("x-openai-fedramp"), Some(&"true".to_string()));
     assert_eq!(
@@ -615,9 +618,12 @@ fn injects_only_codex_client_headers_for_images_requests() {
     );
     assert_eq!(
         headers.get("user-agent").map(String::as_str),
-        Some(aether_ai_formats::CODEX_CLIENT_USER_AGENT)
+        Some(aether_ai_formats::codex_client_user_agent().as_str())
+    );
+    assert_eq!(
+        headers.get("originator"),
+        Some(&aether_ai_formats::codex_client_originator())
     );
-    assert_eq!(headers.get("originator"), Some(&"codex_cli_rs".to_string()));
     assert!(!headers.contains_key("version"));
     assert_eq!(headers.get("x-openai-fedramp"), Some(&"true".to_string()));
     for name in ["x-client-request-id", "session-id", "thread-id"] {
@@ -699,9 +705,12 @@ fn preserves_client_context_headers_and_enforces_codex_provider_identity() {
     );
     assert_eq!(
         headers.get("user-agent").map(String::as_str),
-        Some(aether_ai_formats::CODEX_CLIENT_USER_AGENT)
+        Some(aether_ai_formats::codex_client_user_agent().as_str())
+    );
+    assert_eq!(
+        headers.get("originator"),
+        Some(&aether_ai_formats::codex_client_originator())
     );
-    assert_eq!(headers.get("originator"), Some(&"codex_cli_rs".to_string()));
     assert_eq!(
         headers
             .keys()
@@ -763,9 +772,12 @@ fn compact_projects_uuid_prompt_cache_identity_into_session_headers() {
     assert_eq!(headers.get("x-client-request-id"), None);
     assert_eq!(
         headers.get("user-agent").map(String::as_str),
-        Some(aether_ai_formats::CODEX_CLIENT_USER_AGENT)
+        Some(aether_ai_formats::codex_client_user_agent().as_str())
+    );
+    assert_eq!(
+        headers.get("originator"),
+        Some(&aether_ai_formats::codex_client_originator())
     );
-    assert_eq!(headers.get("originator"), Some(&"codex_cli_rs".to_string()));
     assert!(!headers.contains_key("version"));
     assert_eq!(headers.get("x-openai-fedramp"), Some(&"true".to_string()));
     assert_eq!(

apps/aether-gateway/src/ai_serving/pure/mod.rs

@@ -184,7 +184,7 @@ pub(crate) use aether_ai_formats::{
     openai_responses_request_operation, openai_responses_synthetic_reasoning_item_id,
     strip_incompatible_openai_responses_reasoning_items,
     strip_incompatible_openai_responses_reasoning_items_with_policy, ApiOperation, ClientSurface,
-    CODEX_CLIENT_VERSION, OPENAI_RESPONSES_OPERATION_COMPACT,
+    OPENAI_RESPONSES_OPERATION_COMPACT,
 };
 
 pub(crate) fn plan_kind_matches_api_operation(

apps/aether-gateway/src/bin/aether-codex-ws-probe.rs

@@ -7,7 +7,7 @@
 #[path = "support/responses_ws_probe.rs"]
 mod responses_ws_probe;
 
-use aether_gateway::{CODEX_CLIENT_ORIGINATOR, CODEX_CLIENT_USER_AGENT};
+use aether_gateway::{codex_client_originator, codex_client_user_agent};
 use clap::Parser;
 use http::header::{AUTHORIZATION, USER_AGENT};
 use http::{HeaderMap, HeaderName, HeaderValue};
@@ -78,14 +78,12 @@ fn handshake_headers(access_token: &str, account_id: &str) -> Result<HeaderMap,
     let mut headers = HeaderMap::new();
     headers.insert(AUTHORIZATION, bearer_authorization_value(access_token)?);
     headers.insert(HeaderName::from_static("chatgpt-account-id"), account_id);
-    headers.insert(
-        USER_AGENT,
-        HeaderValue::from_static(CODEX_CLIENT_USER_AGENT),
-    );
-    headers.insert(
-        HeaderName::from_static("originator"),
-        HeaderValue::from_static(CODEX_CLIENT_ORIGINATOR),
-    );
+    let user_agent = HeaderValue::from_str(&codex_client_user_agent())
+        .map_err(|_| ProbeFailure::MissingConfiguration)?;
+    headers.insert(USER_AGENT, user_agent);
+    let originator = HeaderValue::from_str(&codex_client_originator())
+        .map_err(|_| ProbeFailure::MissingConfiguration)?;
+    headers.insert(HeaderName::from_static("originator"), originator);
     Ok(headers)
 }
 
@@ -111,6 +109,18 @@ mod tests {
         assert!(headers.contains_key("chatgpt-account-id"));
         assert!(headers.contains_key(USER_AGENT));
         assert!(headers.contains_key("originator"));
+        assert_eq!(
+            headers
+                .get(USER_AGENT)
+                .and_then(|value| value.to_str().ok()),
+            Some(aether_gateway::codex_client_user_agent().as_str())
+        );
+        assert_eq!(
+            headers
+                .get("originator")
+                .and_then(|value| value.to_str().ok()),
+            Some(aether_gateway::codex_client_originator().as_str())
+        );
         assert_eq!(
             CodexResponsesProbeProfile::sent_header_names(),
             vec![

apps/aether-gateway/src/codex_profile.rs

@@ -0,0 +1,468 @@
+//! Codex 客户端画像的运行时发布与官方 CLI 版本刷新。
+
+use std::collections::BTreeMap;
+use std::future::Future;
+use std::time::Duration;
+
+use aether_runtime_state::RuntimeState;
+use futures_util::StreamExt as _;
+use reqwest::{redirect::Policy, Client};
+use semver::Version;
+use serde::{Deserialize, Serialize};
+use tracing::{info, warn};
+
+use crate::AppState;
+
+const CLI_RELEASE_ENDPOINT: &str = "https://registry.npmjs.org/@openai%2Fcodex/latest";
+const PROFILE_CACHE_KEY: &str = "aether:codex:client-profile:v1";
+const PROFILE_CACHE_TTL: Duration = Duration::from_secs(30 * 24 * 60 * 60);
+const PROFILE_REFRESH_INTERVAL: Duration = Duration::from_secs(24 * 60 * 60);
+const RELEASE_CONNECT_TIMEOUT: Duration = Duration::from_secs(10);
+const RELEASE_REQUEST_TIMEOUT: Duration = Duration::from_secs(30);
+const MAX_RELEASE_BYTES: usize = 256 * 1024;
+const CLI_TARGETS: [&str; 6] = [
+    "darwin-arm64",
+    "darwin-x64",
+    "linux-arm64",
+    "linux-x64",
+    "win32-arm64",
+    "win32-x64",
+];
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct NpmRelease {
+    name: String,
+    version: String,
+    optional_dependencies: BTreeMap<String, String>,
+}
+
+#[derive(Debug, Deserialize, Serialize)]
+struct CachedProfile {
+    version: String,
+    verified_at_unix_secs: u64,
+}
+
+#[derive(Debug, thiserror::Error)]
+enum ProfileRefreshError {
+    #[error("Codex CLI release client initialization failed: {0}")]
+    Client(#[from] reqwest::Error),
+    #[error("Codex CLI release request returned HTTP {0}")]
+    HttpStatus(u16),
+    #[error("Codex CLI release response exceeded {MAX_RELEASE_BYTES} bytes")]
+    ResponseTooLarge,
+    #[error("Codex CLI release metadata is invalid")]
+    InvalidMetadata,
+    #[error("Codex CLI release version is older than the active profile")]
+    Rollback,
+    #[error("Codex CLI profile cache operation failed: {0}")]
+    Cache(String),
+}
+
+fn version_sequence(version: &str) -> Result<u64, ProfileRefreshError> {
+    let parsed = Version::parse(version).map_err(|_| ProfileRefreshError::InvalidMetadata)?;
+    if !parsed.pre.is_empty()
+        || !parsed.build.is_empty()
+        || parsed.major > 999
+        || parsed.minor > 999
+        || parsed.patch > 999
+    {
+        return Err(ProfileRefreshError::InvalidMetadata);
+    }
+    Ok(1 + parsed.major * 1_000_000 + parsed.minor * 1_000 + parsed.patch)
+}
+
+/// 校验官方 npm stable 标签及六个平台依赖来自同一版本发布。
+fn parse_cli_release(bytes: &[u8]) -> Result<String, ProfileRefreshError> {
+    if bytes.len() > MAX_RELEASE_BYTES {
+        return Err(ProfileRefreshError::ResponseTooLarge);
+    }
+    let release = serde_json::from_slice::<NpmRelease>(bytes)
+        .map_err(|_| ProfileRefreshError::InvalidMetadata)?;
+    let sequence = version_sequence(&release.version)?;
+    if sequence == 0
+        || release.name != "@openai/codex"
+        || CLI_TARGETS.iter().any(|target| {
+            release
+                .optional_dependencies
+                .get(&format!("@openai/codex-{target}"))
+                != Some(&format!("npm:@openai/codex@{}-{target}", release.version))
+        })
+    {
+        return Err(ProfileRefreshError::InvalidMetadata);
+    }
+    Ok(release.version)
+}
+
+fn refresh_enabled_from(value: Option<&str>) -> bool {
+    !value.is_some_and(|value| {
+        matches!(
+            value.trim().to_ascii_lowercase().as_str(),
+            "0" | "false" | "off"
+        )
+    })
+}
+
+fn refresh_enabled() -> bool {
+    refresh_enabled_from(
+        std::env::var("AETHER_CODEX_CLIENT_PROFILE_REFRESH")
+            .ok()
+            .as_deref(),
+    )
+}
+
+fn fixed_version_from(value: Option<&str>) -> Option<String> {
+    let value = value?.trim();
+    if value.is_empty() || version_sequence(value).is_err() {
+        None
+    } else {
+        Some(value.to_owned())
+    }
+}
+
+fn fixed_version_override() -> Option<String> {
+    let value = std::env::var("AETHER_CODEX_CLIENT_VERSION").ok()?;
+    let version = fixed_version_from(Some(&value));
+    if version.is_none() {
+        warn!(
+            event_name = "codex_client_profile_fixed_version_invalid",
+            "AETHER_CODEX_CLIENT_VERSION is invalid; using cached or built-in profile"
+        );
+    }
+    version
+}
+
+fn build_release_client() -> Result<Client, ProfileRefreshError> {
+    Client::builder()
+        .https_only(true)
+        .no_proxy()
+        .redirect(Policy::none())
+        .connect_timeout(RELEASE_CONNECT_TIMEOUT)
+        .timeout(RELEASE_REQUEST_TIMEOUT)
+        .build()
+        .map_err(ProfileRefreshError::Client)
+}
+
+async fn fetch_latest_cli_version(client: &Client) -> Result<String, ProfileRefreshError> {
+    let response = client
+        .get(CLI_RELEASE_ENDPOINT)
+        .send()
+        .await
+        .map_err(ProfileRefreshError::Client)?;
+    if !response.status().is_success() {
+        return Err(ProfileRefreshError::HttpStatus(response.status().as_u16()));
+    }
+    if response
+        .content_length()
+        .is_some_and(|length| length > MAX_RELEASE_BYTES as u64)
+    {
+        return Err(ProfileRefreshError::ResponseTooLarge);
+    }
+
+    let mut bytes = Vec::new();
+    let mut stream = response.bytes_stream();
+    while let Some(chunk) = stream.next().await {
+        let chunk = chunk.map_err(ProfileRefreshError::Client)?;
+        if bytes.len().saturating_add(chunk.len()) > MAX_RELEASE_BYTES {
+            return Err(ProfileRefreshError::ResponseTooLarge);
+        }
+        bytes.extend_from_slice(&chunk);
+    }
+    parse_cli_release(&bytes)
+}
+
+async fn restore_cached_profile(runtime: &RuntimeState) -> Result<(), ProfileRefreshError> {
+    let Some(raw) = runtime
+        .kv_get(PROFILE_CACHE_KEY)
+        .await
+        .map_err(|err| ProfileRefreshError::Cache(err.to_string()))?
+    else {
+        return Ok(());
+    };
+    let cached = serde_json::from_str::<CachedProfile>(&raw)
+        .map_err(|_| ProfileRefreshError::InvalidMetadata)?;
+    if let Some(version) =
+        cached_version_to_restore(&cached, &aether_ai_formats::codex_client_version())?
+    {
+        aether_ai_formats::set_codex_cli_version(&version)
+            .map_err(|_| ProfileRefreshError::InvalidMetadata)?;
+        info!(
+            event_name = "codex_client_profile_restored",
+            version = %version,
+            verified_at_unix_secs = cached.verified_at_unix_secs,
+            "restored cached Codex CLI profile"
+        );
+    }
+    Ok(())
+}
+
+fn cached_version_to_restore(
+    cached: &CachedProfile,
+    active_version: &str,
+) -> Result<Option<String>, ProfileRefreshError> {
+    let cached_sequence = version_sequence(&cached.version)?;
+    let active_sequence = version_sequence(active_version)?;
+    Ok((cached_sequence >= active_sequence).then(|| cached.version.clone()))
+}
+
+async fn refresh_once_with_fetch<F, Fut>(
+    runtime: &RuntimeState,
+    fixed_version: Option<&str>,
+    refresh_is_enabled: bool,
+    fetch_latest: F,
+) -> Result<String, ProfileRefreshError>
+where
+    F: FnOnce() -> Fut,
+    Fut: Future<Output = Result<String, ProfileRefreshError>>,
+{
+    if let Some(version) = fixed_version {
+        aether_ai_formats::set_codex_cli_version(version)
+            .map_err(|_| ProfileRefreshError::InvalidMetadata)?;
+        return Ok(version.to_owned());
+    }
+
+    if let Err(error) = restore_cached_profile(runtime).await {
+        // 缓存损坏或暂时不可用不应阻断官方版本检查；当前进程继续使用旧画像。
+        warn!(
+            event_name = "codex_client_profile_cache_restore_failed",
+            error = %error,
+            "could not restore cached Codex CLI profile"
+        );
+    }
+    if !refresh_is_enabled {
+        return Ok(aether_ai_formats::codex_client_version());
+    }
+
+    let version = fetch_latest().await?;
+    let current = aether_ai_formats::codex_client_version();
+    if version_sequence(&version)? < version_sequence(&current)? {
+        return Err(ProfileRefreshError::Rollback);
+    }
+
+    let cached = CachedProfile {
+        version: version.clone(),
+        verified_at_unix_secs: chrono::Utc::now().timestamp().max(0) as u64,
+    };
+    let serialized =
+        serde_json::to_string(&cached).map_err(|_| ProfileRefreshError::InvalidMetadata)?;
+    aether_ai_formats::set_codex_cli_version(&version)
+        .map_err(|_| ProfileRefreshError::InvalidMetadata)?;
+    if let Err(error) = runtime
+        .kv_set(PROFILE_CACHE_KEY, serialized, Some(PROFILE_CACHE_TTL))
+        .await
+    {
+        // 本地画像已经完成原子替换；缓存写失败只影响下次进程启动的恢复。
+        warn!(
+            event_name = "codex_client_profile_cache_write_failed",
+            error = %error,
+            "published Codex CLI profile locally but could not persist the cache"
+        );
+    }
+    Ok(version)
+}
+
+async fn refresh_once(runtime: &RuntimeState) -> Result<String, ProfileRefreshError> {
+    let fixed_version = fixed_version_override();
+    refresh_once_with_fetch(
+        runtime,
+        fixed_version.as_deref(),
+        refresh_enabled(),
+        || async {
+            let client = build_release_client()?;
+            fetch_latest_cli_version(&client).await
+        },
+    )
+    .await
+}
+
+pub(crate) async fn prewarm(runtime: &RuntimeState) -> Result<String, String> {
+    refresh_once(runtime).await.map_err(|err| err.to_string())
+}
+
+pub(crate) fn spawn_worker(app: AppState) -> tokio::task::JoinHandle<()> {
+    crate::task_runtime::spawn_singleton_worker(
+        app,
+        crate::task_runtime::TASK_KEY_CODEX_CLIENT_PROFILE,
+        |app| async move {
+            let mut interval = tokio::time::interval(PROFILE_REFRESH_INTERVAL);
+            interval.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Delay);
+            // 启动阶段由 prewarm 完成一次检查；后台任务只负责后续每日刷新，避免重复建连。
+            interval.tick().await;
+            loop {
+                interval.tick().await;
+                match refresh_once(app.runtime_state()).await {
+                    Ok(version) => info!(
+                        event_name = "codex_client_profile_refreshed",
+                        version = %version,
+                        "refreshed Codex CLI profile"
+                    ),
+                    Err(error) => warn!(
+                        event_name = "codex_client_profile_refresh_failed",
+                        error = %error,
+                        "keeping the previous Codex CLI profile after refresh failure"
+                    ),
+                }
+            }
+        },
+    )
+}
+
+#[cfg(test)]
+mod tests {
+    use std::sync::{
+        atomic::{AtomicBool, Ordering},
+        Mutex, OnceLock,
+    };
+    use std::time::Duration;
+
+    use aether_runtime_state::{MemoryRuntimeStateConfig, RuntimeState};
+
+    use super::{
+        cached_version_to_restore, fixed_version_from, parse_cli_release, refresh_enabled_from,
+        refresh_once_with_fetch, CachedProfile, ProfileRefreshError, PROFILE_CACHE_KEY,
+    };
+
+    static PROFILE_TEST_LOCK: OnceLock<Mutex<()>> = OnceLock::new();
+
+    struct ProfileRestore(aether_ai_formats::CodexClientProfile);
+
+    impl Drop for ProfileRestore {
+        fn drop(&mut self) {
+            aether_ai_formats::set_codex_client_profile(self.0.clone());
+        }
+    }
+
+    fn profile_restore_guard() -> (std::sync::MutexGuard<'static, ()>, ProfileRestore) {
+        let lock = PROFILE_TEST_LOCK.get_or_init(|| Mutex::new(()));
+        let guard = lock.lock().expect("profile test lock");
+        let restore = ProfileRestore(aether_ai_formats::codex_client_profile());
+        (guard, restore)
+    }
+
+    #[test]
+    fn accepts_only_one_verified_cli_release_for_all_targets() {
+        let body = serde_json::json!({
+            "name": "@openai/codex",
+            "version": "0.200.1",
+            "optionalDependencies": {
+                "@openai/codex-darwin-arm64": "npm:@openai/[email protected]",
+                "@openai/codex-darwin-x64": "npm:@openai/[email protected]",
+                "@openai/codex-linux-arm64": "npm:@openai/[email protected]",
+                "@openai/codex-linux-x64": "npm:@openai/[email protected]",
+                "@openai/codex-win32-arm64": "npm:@openai/[email protected]",
+                "@openai/codex-win32-x64": "npm:@openai/[email protected]"
+            }
+        });
+        assert_eq!(
+            parse_cli_release(&serde_json::to_vec(&body).unwrap()).unwrap(),
+            "0.200.1"
+        );
+    }
+
+    #[test]
+    fn rejects_incomplete_platform_release() {
+        let body = serde_json::json!({
+            "name": "@openai/codex",
+            "version": "0.200.1",
+            "optionalDependencies": {}
+        });
+        assert!(parse_cli_release(&serde_json::to_vec(&body).unwrap()).is_err());
+    }
+
+    #[test]
+    fn refresh_and_fixed_version_environment_policies_are_strict() {
+        assert!(!refresh_enabled_from(Some("off")));
+        assert!(!refresh_enabled_from(Some(" FALSE ")));
+        assert!(refresh_enabled_from(None));
+        assert_eq!(
+            fixed_version_from(Some(" 0.200.1 ")).as_deref(),
+            Some("0.200.1")
+        );
+        assert!(fixed_version_from(Some("0.200.1-beta.1")).is_none());
+        assert!(fixed_version_from(Some("1.2")).is_none());
+    }
+
+    #[test]
+    fn cached_profile_never_rewinds_active_profile() {
+        let cached = CachedProfile {
+            version: "0.200.1".to_string(),
+            verified_at_unix_secs: 1,
+        };
+        assert_eq!(
+            cached_version_to_restore(&cached, "0.200.0").unwrap(),
+            Some("0.200.1".to_string())
+        );
+        assert_eq!(cached_version_to_restore(&cached, "0.201.0").unwrap(), None);
+    }
+
+    #[tokio::test]
+    async fn cache_hit_is_restored_without_network_when_refresh_is_disabled() {
+        let (_lock, _restore) = profile_restore_guard();
+        let runtime = RuntimeState::memory(MemoryRuntimeStateConfig::default());
+        runtime
+            .kv_set(
+                PROFILE_CACHE_KEY,
+                serde_json::to_string(&CachedProfile {
+                    version: "0.200.1".to_string(),
+                    verified_at_unix_secs: 1,
+                })
+                .unwrap(),
+                Some(Duration::from_secs(60)),
+            )
+            .await
+            .unwrap();
+
+        let result = refresh_once_with_fetch(&runtime, None, false, || async {
+            Err(ProfileRefreshError::HttpStatus(599))
+        })
+        .await
+        .unwrap();
+
+        assert_eq!(result, "0.200.1");
+        assert_eq!(aether_ai_formats::codex_client_version(), "0.200.1");
+    }
+
+    #[tokio::test]
+    async fn refresh_failure_keeps_previous_profile() {
+        let (_lock, _restore) = profile_restore_guard();
+        let runtime = RuntimeState::memory(MemoryRuntimeStateConfig::default());
+        let before = aether_ai_formats::codex_client_profile();
+        let result = refresh_once_with_fetch(&runtime, None, true, || async {
+            Err(ProfileRefreshError::HttpStatus(503))
+        })
+        .await;
+
+        assert!(matches!(result, Err(ProfileRefreshError::HttpStatus(503))));
+        assert_eq!(aether_ai_formats::codex_client_profile(), before);
+    }
+
+    #[tokio::test]
+    async fn fixed_version_override_skips_network_and_publishes_profile() {
+        let (_lock, _restore) = profile_restore_guard();
+        let runtime = RuntimeState::memory(MemoryRuntimeStateConfig::default());
+        let fetch_called = AtomicBool::new(false);
+        let result = refresh_once_with_fetch(&runtime, Some("0.220.0"), true, || async {
+            fetch_called.store(true, Ordering::SeqCst);
+            Ok("0.221.0".to_string())
+        })
+        .await
+        .unwrap();
+
+        assert_eq!(result, "0.220.0");
+        assert!(!fetch_called.load(Ordering::SeqCst));
+        assert_eq!(aether_ai_formats::codex_client_version(), "0.220.0");
+    }
+
+    #[tokio::test]
+    async fn rollback_is_rejected_without_replacing_profile() {
+        let (_lock, _restore) = profile_restore_guard();
+        aether_ai_formats::set_codex_cli_version("0.220.0").unwrap();
+        let runtime = RuntimeState::memory(MemoryRuntimeStateConfig::default());
+        let result =
+            refresh_once_with_fetch(&runtime, None, true, || async { Ok("0.219.9".to_string()) })
+                .await;
+
+        assert!(matches!(result, Err(ProfileRefreshError::Rollback)));
+        assert_eq!(aether_ai_formats::codex_client_version(), "0.220.0");
+    }
+}

apps/aether-gateway/src/handlers/admin/provider/query/models/mod.rs

@@ -594,11 +594,12 @@ async fn provider_query_fetch_models_for_key(
         });
     }
 
+    let dynamic_client_version = aether_ai_formats::codex_client_version();
     let client_version = is_codex.then(|| {
         codex_catalog
             .as_ref()
             .map(|catalog| catalog.client_version.as_str())
-            .unwrap_or(crate::ai_serving::CODEX_CLIENT_VERSION)
+            .unwrap_or(dynamic_client_version.as_str())
     });
     let outcome =
         match fetch_models_from_transports_for_management(state.app(), &transports, client_version)

apps/aether-gateway/src/lib.rs

@@ -37,6 +37,7 @@ mod bark_push;
 mod cache;
 mod client_session_affinity;
 mod clock;
+mod codex_profile;
 mod constants;
 mod control;
 mod data;
@@ -90,12 +91,12 @@ mod usage;
 mod video_tasks;
 mod wallet_runtime;
 
+pub use self::ai_serving::api::{codex_client_originator, codex_client_user_agent};
 pub(crate) use self::ai_serving::api::{
     AiControlPlanRequest, EXECUTION_RUNTIME_STREAM_DECISION_ACTION,
     EXECUTION_RUNTIME_SYNC_DECISION_ACTION, GEMINI_FILES_DOWNLOAD_PLAN_KIND,
     OPENAI_VIDEO_CONTENT_PLAN_KIND,
 };
-pub use self::ai_serving::api::{CODEX_CLIENT_ORIGINATOR, CODEX_CLIENT_USER_AGENT};
 pub(crate) use self::ai_serving::{
     AiExecutionDecision, AiExecutionPlanPayload, AiStreamAttempt, AiSyncAttempt,
 };

apps/aether-gateway/src/main.rs

@@ -2513,6 +2513,20 @@ async fn run() -> Result<(), Box<dyn std::error::Error>> {
             );
         }
     }
+    match state.prewarm_codex_client_profile().await {
+        Ok(version) => {
+            info!(
+                codex_client_version = %version,
+                "prewarmed Codex client profile"
+            );
+        }
+        Err(err) => {
+            warn!(
+                error = %err,
+                "failed to refresh Codex client profile; built-in or cached profile remains active"
+            );
+        }
+    }
     match prewarm_direct_h2c_sender_cache_from_env_for_startup().await {
         Ok(Some(report)) => {
             if report.failed_targets > 0 {

apps/aether-gateway/src/model_fetch/catalog.rs

@@ -99,7 +99,7 @@ pub(crate) fn normalize_codex_client_version(raw: Option<&str>) -> NormalizedCod
             used_fallback: false,
         },
         None => NormalizedCodexClientVersion {
-            value: crate::ai_serving::CODEX_CLIENT_VERSION.to_string(),
+            value: aether_ai_formats::codex_client_version(),
             used_fallback: true,
         },
     }
@@ -1521,7 +1521,7 @@ where
     .await?;
     let scope = target.credential_scope()?;
     let state = runtime.codex_catalog_runtime_state();
-    let mut version = Version::parse(crate::ai_serving::CODEX_CLIENT_VERSION).ok()?;
+    let mut version = Version::parse(&aether_ai_formats::codex_client_version()).ok()?;
     if let Some(recent) =
         read_recent_codex_catalog_client_version(state, provider_id, key_id, scope).await
     {
@@ -2463,7 +2463,7 @@ mod tests {
             .expect("management context");
         assert_eq!(
             initial.client_version,
-            crate::ai_serving::CODEX_CLIENT_VERSION
+            aether_ai_formats::codex_client_version()
         );
         assert!(initial.models.is_none());
 
@@ -2500,7 +2500,7 @@ mod tests {
             .unwrap();
         assert_eq!(
             rebound.client_version,
-            crate::ai_serving::CODEX_CLIENT_VERSION
+            aether_ai_formats::codex_client_version()
         );
         assert!(rebound.models.is_none());
     }
@@ -2557,7 +2557,10 @@ mod tests {
             format!("1.2.3-{}", "x".repeat(CODEX_CLIENT_VERSION_MAX_LEN)),
         ] {
             let normalized = normalize_codex_client_version(Some(&raw));
-            assert_eq!(normalized.as_str(), crate::ai_serving::CODEX_CLIENT_VERSION);
+            assert_eq!(
+                normalized.as_str(),
+                aether_ai_formats::codex_client_version()
+            );
             assert!(normalized.used_fallback());
             assert!(!catalog_lkg_key(&target(), normalized.as_str()).contains(&raw));
         }
@@ -3753,7 +3756,11 @@ mod tests {
             .await
             .expect("seed legacy cache");
 
-        let load = load_one(&runtime, &version(crate::ai_serving::CODEX_CLIENT_VERSION)).await;
+        let load = load_one(
+            &runtime,
+            &version(&aether_ai_formats::codex_client_version()),
+        )
+        .await;
         assert!(load.snapshot(TEST_PROVIDER_ID, TEST_KEY_ID).is_none());
         assert_eq!(runtime.execution_count(), 1);
     }

apps/aether-gateway/src/state/core.rs

@@ -53,6 +53,7 @@ use super::super::router::RequestAdmissionError;
 use super::super::{control::GatewayControlDecision, error::GatewayError};
 use super::super::{provider_transport, usage};
 
+use crate::codex_profile::spawn_worker as spawn_codex_client_profile_worker;
 use crate::maintenance::spawn_account_self_check_worker;
 use crate::maintenance::spawn_audit_cleanup_worker;
 use crate::maintenance::spawn_db_maintenance_worker;
@@ -148,6 +149,10 @@ fn system_config_key_affects_provider_transport_snapshot(key: &str) -> bool {
 }
 
 impl AppState {
+    pub async fn prewarm_codex_client_profile(&self) -> Result<String, String> {
+        crate::codex_profile::prewarm(self.runtime_state()).await
+    }
+
     pub async fn prewarm_chat_pii_redaction_runtime_config(&self) -> Result<bool, String> {
         crate::privacy::read_chat_pii_redaction_runtime_config(self)
             .await
@@ -2332,6 +2337,10 @@ impl AppState {
             crate::task_runtime::TASK_KEY_MODEL_FETCH_WORKER,
             spawn_model_fetch_worker(background_state.clone()),
         );
+        supervise_worker(
+            crate::task_runtime::TASK_KEY_CODEX_CLIENT_PROFILE,
+            Some(spawn_codex_client_profile_worker(background_state.clone())),
+        );
         supervise_worker(
             crate::task_runtime::TASK_KEY_VIDEO_TASK_POLLER,
             spawn_video_task_poller(background_state.clone()),

apps/aether-gateway/src/task_runtime/mod.rs

@@ -24,6 +24,7 @@ pub(crate) const TASK_KEY_USAGE_QUEUE_WORKER: &str = "usage.queue.worker";
 pub(crate) const TASK_KEY_USAGE_COUNTER_FLUSH: &str = "usage.counter.flush.worker";
 pub(crate) const TASK_KEY_VIDEO_TASK_POLLER: &str = "video.task.poller";
 pub(crate) const TASK_KEY_MODEL_FETCH_WORKER: &str = "model.fetch.worker";
+pub(crate) const TASK_KEY_CODEX_CLIENT_PROFILE: &str = "maintenance.codex.client.profile";
 pub(crate) const TASK_KEY_PROVIDER_QUOTA_RESET: &str = "provider.quota.reset.worker";
 pub(crate) const TASK_KEY_ACCOUNT_SELF_CHECK: &str = "account.self_check.worker";
 pub(crate) const TASK_KEY_POOL_SCORE_REBUILD: &str = "pool.score.rebuild.worker";
@@ -202,6 +203,14 @@ const TASK_DEFINITIONS: &[TaskDefinition] = &[
         true,
         RETRY_ONCE,
     ),
+    TaskDefinition::new(
+        TASK_KEY_CODEX_CLIENT_PROFILE,
+        TaskKind::Scheduled,
+        "daily",
+        true,
+        true,
+        RETRY_ONCE,
+    ),
     TaskDefinition::new(
         TASK_KEY_PROVIDER_QUOTA_RESET,
         TaskKind::Scheduled,

apps/aether-gateway/src/tests/ai_execute/stream/image.rs

@@ -421,7 +421,7 @@ async fn gateway_executes_codex_image_stream_via_local_decision_gate_after_oauth
     );
     assert_eq!(
         seen_execution_runtime_request.headers["user-agent"],
-        aether_ai_formats::CODEX_CLIENT_USER_AGENT
+        aether_ai_formats::codex_client_user_agent()
     );
     assert_eq!(
         seen_execution_runtime_request.headers["originator"],

apps/aether-gateway/src/tests/ai_execute/sync/image.rs

@@ -1119,7 +1119,7 @@ async fn gateway_executes_codex_image_sync_via_local_decision_gate_after_oauth_r
     );
     assert_eq!(
         seen_execution_runtime_request.headers["user-agent"],
-        aether_ai_formats::CODEX_CLIENT_USER_AGENT
+        aether_ai_formats::codex_client_user_agent()
     );
     assert_eq!(
         seen_execution_runtime_request.headers["originator"],

apps/aether-gateway/src/tests/control/admin/provider_query.rs

@@ -560,12 +560,12 @@ async fn gateway_recovers_codex_slug_only_models_from_a_stale_legacy_cache_impl(
                     plan.url,
                     format!(
                         "https://chatgpt.com/backend-api/codex/models?client_version={}",
-                        aether_ai_formats::CODEX_CLIENT_VERSION
+                        aether_ai_formats::codex_client_version()
                     )
                 );
                 assert_eq!(
                     plan.headers.get("user-agent").map(String::as_str),
-                    Some(aether_ai_formats::CODEX_CLIENT_USER_AGENT)
+                    Some(aether_ai_formats::codex_client_user_agent().as_str())
                 );
                 assert_eq!(plan.provider_api_format, "openai:responses");
                 Json(json!({
@@ -764,7 +764,7 @@ async fn gateway_handles_admin_provider_query_models_falls_back_to_codex_preset_
                     plan.url,
                     format!(
                         "https://chatgpt.com/backend-api/codex/models?client_version={}",
-                        aether_ai_formats::CODEX_CLIENT_VERSION
+                        aether_ai_formats::codex_client_version()
                     )
                 );
                 Json(json!({