[mLupine]

OpenAI's Responses API added an optional access_programs object to select a cybersecurity access program per request (access_programs.cyber: standard | daybreak_blue | daybreak_red, see https://developers.openai.com/api/docs/guides/daybreak). Some prompts fail on Daybreak-eligible models unless the program is selected, and the right value is model- and account-specific (e.g. on one ChatGPT account gpt-5.6-sol accepts daybreak_blue, rejects daybreak_red with a 400 naming the right value, and gpt-6.1-sol rejects Daybreak with a 403), so a global switch doesn't work.

This adds an optional per-alias setting in ~/.clodex/config.json:

{ "name": "sol", "providerId": "openai-oauth", "modelId": "gpt-5.6-sol", "accessPrograms": { "cyber": "daybreak_blue" } }

• Validated on load; missing or invalid values omit the field entirely (the API rejects null).
• Scoped to the alias: the alias gets its own route copy, so the canonical clodex: id and other aliases of the same model are unchanged.
• Applied on the ChatGPT/Codex OAuth WebSocket transport and on the API-key Responses route via a small fetch wrapper (src/access-programs.ts).
• Docs: README section under clodex models.

Tests: unit tests for validation/merge/fetch wrapper and alias normalization; a proxy test checking createLanguageModel receives accessPrograms only for the configured alias; a provider-factory test checking the OAuth WebSocket payload carries access_programs only when configured. pnpm test and tsc --noEmit pass.

Verified live against chatgpt.com/backend-api/codex: an alias set to daybreak_blue on gpt-5.6-sol → 200; daybreak_red → 400 "The selected model requires a different Daybreak access program. Set access_programs.cyber to daybreak_blue and try again."; unconfigured aliases unchanged.

Known limitation: clodex models --alias rewrites the alias and drops the setting (documented).

[bman654]

Thank you for this. It's a feature we wanted, and your live observations held up: on our account gpt-5.6-sol accepts daybreak_blue and returns 400 for daybreak_red, and gpt-6.1-sol returns 403 for any Daybreak program.

We're closing it in favor of #327, which ships the same capability with a different design. Reviewing this PR is what led us there:

• The value doesn't need to be hand-written. The Codex model catalog clodex already downloads lists, per model and per account, which programs a request may select (available_access_programs.cyber). On our account it predicted all 33 explicit model × program results we sent live. Native Codex chooses from that list, Blue then Red. So feat(models): add Daybreak aliases for cybersecurity work on eligible ChatGPT models #327 makes the alias opt in with clodex models --alias name=… --daybreak and takes the program from the catalog. That removes the wrong-value 400s, the ineligible-model 403s, and silently ignored typos, and the setting is saved by the CLI rather than hand-edited.
• The endpoint server needed it too. clodex server --endpoint resolves aliases through its own gateway, which didn't receive the setting. A straightforward fix there leaks the program onto the plain alias and the clodex: id, because the gateway caches one model per route. feat(models): add Daybreak aliases for cybersecurity work on eligible ChatGPT models #327 covers every serving path and keys that cache on the program.

Your fetch wrapper is reused in #327 essentially as you wrote it, and the PR credits you. Thanks again for the groundwork.