feat: take the context window from the backend instead of guessing it

[saucam]

Follow-up to #341, which patched a stale window table. This removes the reason the table could go stale.

The problem

codeoid inferred every context window from a substring table over model ids. That's wrong the moment a model ships — claude-opus-5-5 inferred to the 200k fallback while every turn reported 1,000,000 — and everything sized against it was off by 5×: the percent-of-window display, the fork seed budget, and the auto-rotate occupancy that decides when a session rolls. Auto-rotate was firing at roughly a fifth of real capacity.

The backends already knew. codeoid was discarding it.

Audited across every backend, because they disagree on how they publish it

You asked me to make sure this works for all of them. It needed two ingresses, not one:

Backend	Publishes	Where	Status
claude	per turn	result.modelUsage[model].contextWindow	received, was discarded
codex	per turn	thread/tokenUsage/updated → tokenUsage.modelContextWindow	was on the wire, unread
qwen	per model, pre-turn	catalog contextWindowSize	was parsed, then dropped
gemini	nothing	direct API response carries none	inference floor
openai	nothing	same	inference floor
pi	nothing	same	inference floor
acp (gemini-cli)	nothing	ACP publishes no limits	inference floor

Two of the three were already arriving and being thrown away:

• qwen's is the best signal any backend gives — it's known before the first turn, which is exactly when the daemon would otherwise have to guess. normalizeModelCatalog projected the catalog down to id/label/description and dropped the window.
• codex's arrived on a notification the provider already handled, reading two of its three fields. Pinned from the codex binary's own serde descriptors: struct ThreadTokenUsage with 3 elements / modelContextWindow.

So the design is: two ingresses, one cache. Catalog (pre-turn, when a backend publishes it) and turn result (post-turn). Both land in a (provider, model)-keyed cache, persisted — so it survives a restart, and the first session to learn a model's window teaches every later one. A window is a property of the model, not of whoever ran the turn.

The tables stay — demoted, on purpose

This can't go to zero hardcoding, and I'd rather say so than imply otherwise:

• Nothing knows the window before a turn completes on the two per-turn backends (a ModelInfo there carries none).
• Four backends report nothing at all.

So an inferred floor is structurally required. It's now the last resort instead of the only answer, it stays a positive number so a silent backend never divides percent-of-window by zero, and the reported value is sticky per session: a provider that reports on turn 1 and not turn 5 hasn't said the window changed, and flapping back to inference would oscillate the number between correct and wrong.

Fixed at the source too

The Claude provider derived the turn's model from Object.keys(modelUsage)[0]. That map is keyed by every model a turn touched, ordered by insertion — and a Haiku side-call (title generation) routinely sits in front of the model that did the work. Measured live, one opus turn:

{ "claude-haiku-4-5-20251001": {...}, "claude-opus-5-5": {...} }

So an Opus turn was labelled Haiku in canonical history — and reading a window off that first entry would have reported 200k for a 1M turn, i.e. the same bug at the point meant to cure it. The SDK names the primary model on its init message; that's used now.

Verification

Every ingress is mutation-tested — dropping the session's preference, codex's field, or qwen's field each turns a test red:

• session-reported-window.test.ts (new): reported beats inference; inference still answers pre-turn and when a backend reports nothing; sticky across an omitting turn; follows a changed window; hands limits up for caching; per-provider ingress table including the four silent backends.
• models.test.ts: cache keyed per (provider, model), survives a restart, refuses 0/negative/unknown, latest report wins.
• provider-codex.test.ts + the fake-codex fixture (which was missing the third field entirely).
• provider-qwen.test.ts: the real 0.1.8 catalog shape now carries the window.
• context-windows.test.ts: reported outranks the per-model table and the per-provider default; ignored when absent/non-positive.

bun run typecheck · bun run lint · bun test → 2613 pass, 19 skip, 0 fail. Web: 553 pass.

Possible next step, not done here

Gemini's models.get exposes inputTokenLimit, so gemini could join the catalog ingress with an extra API call at startup. I left it out — it's a new network call on a path that currently makes none, and the four silent backends are correct-by-fallback today.

🤖 Generated with Claude Code