@bitkyc08/opencodex 2.1.8 → 2.1.9

package/src/vision/describe.ts

@@ -2,6 +2,7 @@ import type { OcxProviderConfig } from "../types";
 import { FORWARD_HEADERS } from "../adapters/openai-responses";
 import { signalWithTimeout } from "../abort";
 import { parseSidecarSSE } from "../web-search/parse";
+import type { SidecarOutcomeRecorder } from "../web-search/executor";
 
 export interface VisionSettings {
   model: string;
@@ -39,7 +40,7 @@ function validateImageUrl(url: string): string | null {
 
 /**
  * Describe ONE image via a gpt vision model through the ChatGPT forward backend — the path that has
- * native image input. Reuses the caller's forwarded OAuth headers. The user's own request text is
+ * native image input. Reuses selected forwarded OAuth headers. The user's own request text is
  * passed as context so the description is focused. Never throws — returns `{error}` on failure.
  */
 export async function describeImage(
@@ -47,9 +48,10 @@ export async function describeImage(
   detail: string | undefined,
   contextText: string,
   forwardProvider: OcxProviderConfig,
-  incomingHeaders: Headers,
+  selectedForwardHeaders: Headers,
   settings: VisionSettings,
   abortSignal?: AbortSignal,
+  recordOutcome?: SidecarOutcomeRecorder,
 ): Promise<DescribeOutcome> {
   const invalid = validateImageUrl(imageUrl);
   if (invalid) return { text: "", error: invalid };
@@ -57,7 +59,7 @@ export async function describeImage(
   const headers: Record<string, string> = { "Content-Type": "application/json" };
   if (forwardProvider.headers) Object.assign(headers, forwardProvider.headers);
   for (const h of FORWARD_HEADERS) {
-    const v = incomingHeaders.get(h);
+    const v = selectedForwardHeaders.get(h);
     if (v) headers[h] = v;
   }
   const content: unknown[] = [];
@@ -86,6 +88,7 @@ export async function describeImage(
       body: JSON.stringify(body),
       signal: linkedSignal.signal,
     });
+    recordOutcome?.(res.status);
     if (!res.ok) {
       const t = await res.text().catch(() => "");
       return { text: "", error: `vision sidecar HTTP ${res.status}: ${t.slice(0, 200)}` };
@@ -96,6 +99,7 @@ export async function describeImage(
     if (!parsed.text.trim() && parsed.error) return { text: "", error: parsed.error };
     return { text: parsed.text };
   } catch (e) {
+    recordOutcome?.(e instanceof Error && e.name === "TimeoutError" ? "timeout" : "connect_error");
     return { text: "", error: e instanceof Error ? e.message : String(e) };
   } finally {
     linkedSignal.cleanup();

package/src/vision/index.ts

@@ -1,6 +1,8 @@
 import type { OcxConfig, OcxContentPart, OcxMessage, OcxParsedRequest, OcxProviderConfig, OcxTextContent } from "../types";
 import { modelInList } from "../types";
 import { describeImage, type VisionSettings } from "./describe";
+import type { CodexAuthContext } from "../codex-auth-context";
+import type { SidecarOutcomeRecorder } from "../web-search/executor";
 
 export { describeImage } from "./describe";
 
@@ -66,12 +68,13 @@ export function planVisionSidecar(
   modelId: string,
   parsed: OcxParsedRequest,
   incomingHeaders: Headers,
+  authContext: CodexAuthContext = { kind: "main", accountId: null },
 ): VisionPlan | undefined {
   if (!modelInList(provider.noVisionModels, modelId)) return undefined;
   if (!messagesHaveImage(parsed)) return undefined;
   const cfg = config.visionSidecar ?? {};
   if (cfg.enabled === false) return undefined;
-  if (!incomingHeaders.get("authorization")) return undefined;
+  if (authContext.kind === "main" && !incomingHeaders.get("authorization")) return undefined;
   const forwardProvider = findForwardProvider(config);
   if (!forwardProvider) return undefined;
   return {
@@ -105,9 +108,10 @@ function renderDescription(out: { text: string; error?: string }): OcxTextConten
 export async function describeImagesInPlace(
   parsed: OcxParsedRequest,
   forwardProvider: OcxProviderConfig,
-  incomingHeaders: Headers,
+  selectedForwardHeaders: Headers,
   settings: VisionSettings,
   abortSignal?: AbortSignal,
+  recordSidecarOutcome?: SidecarOutcomeRecorder,
 ): Promise<void> {
   // 1. Gather every image part across messages, each with its own message's text as context.
   const jobs: ImageJob[] = [];
@@ -130,7 +134,7 @@ export async function describeImagesInPlace(
 
   // 2. Describe all images with bounded concurrency (order preserved).
   const outcomes = await runBounded(jobs, VISION_CONCURRENCY, j =>
-    describeImage(j.imageUrl, j.detail, j.contextText, forwardProvider, incomingHeaders, settings, abortSignal));
+    describeImage(j.imageUrl, j.detail, j.contextText, forwardProvider, selectedForwardHeaders, settings, abortSignal, recordSidecarOutcome));
 
   // 3. Rebuild each message, replacing image parts with their descriptions in order.
   let oi = 0;

package/src/web-search/executor.ts

@@ -2,6 +2,7 @@ import type { OcxProviderConfig } from "../types";
 import { FORWARD_HEADERS } from "../adapters/openai-responses";
 import { signalWithTimeout } from "../abort";
 import { parseSidecarSSE, type WebSearchResult } from "./parse";
+import type { CodexUpstreamOutcome } from "../codex-routing";
 
 export interface SidecarSettings {
   model: string;
@@ -24,10 +25,11 @@ const IMAGE_INSTRUCTION =
 
 /** A search result, or an `error` string when the search couldn't run (surfaced as a tool result). */
 export type SidecarOutcome = WebSearchResult & { error?: string };
+export type SidecarOutcomeRecorder = (outcome: CodexUpstreamOutcome) => void;
 
 /**
  * Execute ONE web search via the gpt-mini sidecar through the ChatGPT forward backend — the only path
- * with a real server-side web_search. Reuses the caller's forwarded OAuth headers (the forward adapter
+ * with a real server-side web_search. Reuses selected forwarded OAuth headers (the forward adapter
  * has no key of its own), replays the hosted web_search tool config verbatim, and runs the mini at
  * minimal reasoning. Never throws — returns `{error}` so the caller injects a graceful tool result.
  */
@@ -35,14 +37,15 @@ export async function runWebSearch(
   query: string,
   hostedTool: Record<string, unknown>,
   forwardProvider: OcxProviderConfig,
-  incomingHeaders: Headers,
+  selectedForwardHeaders: Headers,
   settings: SidecarSettings,
   abortSignal?: AbortSignal,
+  recordOutcome?: SidecarOutcomeRecorder,
 ): Promise<SidecarOutcome> {
   const headers: Record<string, string> = { "Content-Type": "application/json" };
   if (forwardProvider.headers) Object.assign(headers, forwardProvider.headers);
   for (const h of FORWARD_HEADERS) {
-    const v = incomingHeaders.get(h);
+    const v = selectedForwardHeaders.get(h);
     if (v) headers[h] = v;
   }
   const body = {
@@ -67,12 +70,14 @@ export async function runWebSearch(
       body: JSON.stringify(body),
       signal: linkedSignal.signal,
     });
+    recordOutcome?.(res.status);
     if (!res.ok) {
       const t = await res.text().catch(() => "");
       return { text: "", sources: [], error: `sidecar HTTP ${res.status}: ${t.slice(0, 200)}` };
     }
     return await parseSidecarSSE(res);
   } catch (e) {
+    recordOutcome?.(e instanceof Error && e.name === "TimeoutError" ? "timeout" : "connect_error");
     return { text: "", sources: [], error: e instanceof Error ? e.message : String(e) };
   } finally {
     linkedSignal.cleanup();

package/src/web-search/index.ts

@@ -1,6 +1,7 @@
 import type { OcxConfig, OcxParsedRequest, OcxProviderConfig } from "../types";
 import { modelInList } from "../types";
 import type { SidecarSettings } from "./executor";
+import type { CodexAuthContext } from "../codex-auth-context";
 
 export { runWithWebSearch } from "./loop";
 export { buildWebSearchTool, extractHostedWebSearch, WEB_SEARCH_TOOL_NAME } from "./synthetic-tool";
@@ -40,11 +41,12 @@ export function planWebSearch(
   incomingHeaders: Headers,
   provider: OcxProviderConfig,
   modelId: string,
+  authContext: CodexAuthContext = { kind: "main", accountId: null },
 ): SidecarPlan | undefined {
   if (!parsed._webSearch || isPassthrough) return undefined;
   const cfg = config.webSearchSidecar ?? {};
   if (cfg.enabled === false) return undefined;
-  if (!incomingHeaders.get("authorization")) return undefined; // not logged into ChatGPT → sidecar can't run
+  if (authContext.kind === "main" && !incomingHeaders.get("authorization")) return undefined; // not logged into ChatGPT → sidecar can't run
   const forwardProvider = findForwardProvider(config);
   if (!forwardProvider) return undefined;
   return {

package/src/web-search/loop.ts

@@ -2,7 +2,7 @@ import type { ProviderAdapter } from "../adapters/base";
 import type { AdapterEvent, OcxMessage, OcxParsedRequest, OcxProviderConfig } from "../types";
 import { namespacedToolName } from "../types";
 import { bridgeToResponsesSSE } from "../bridge";
-import { runWebSearch, type SidecarSettings } from "./executor";
+import { runWebSearch, type SidecarOutcomeRecorder, type SidecarSettings } from "./executor";
 import { formatWebSearchResult } from "./format-result";
 import { WEB_SEARCH_TOOL_NAME } from "./synthetic-tool";
 
@@ -92,11 +92,12 @@ export interface WebSearchLoopDeps {
   adapter: ProviderAdapter;
   forwardProvider: OcxProviderConfig;
   hostedTool: Record<string, unknown>;
-  incomingHeaders: Headers;
+  selectedForwardHeaders: Headers;
   settings: SidecarSettings;
   maxSearches: number;
   forceEmptyResponseId?: boolean;
   abortSignal?: AbortSignal;
+  recordSidecarOutcome?: SidecarOutcomeRecorder;
 }
 
 /**
@@ -106,7 +107,7 @@ export interface WebSearchLoopDeps {
  * streamed Responses SSE. web_search calls are executed internally and never relayed to Codex.
  */
 export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Response> {
-  const { parsed, adapter, incomingHeaders, forwardProvider, hostedTool, settings, maxSearches, abortSignal } = deps;
+  const { parsed, adapter, selectedForwardHeaders, forwardProvider, hostedTool, settings, maxSearches, abortSignal, recordSidecarOutcome } = deps;
   if (!adapter.parseResponse) return jsonError(500, "web-search sidecar requires a non-streaming adapter");
 
   const messages: OcxMessage[] = [...parsed.context.messages];
@@ -128,7 +129,7 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
       ...parsed, stream: false,
       context: { ...parsed.context, messages, tools: forceAnswer ? toolsNoWebSearch : allTools },
     };
-    const request = adapter.buildRequest(iterParsed, { headers: incomingHeaders });
+    const request = adapter.buildRequest(iterParsed, { headers: selectedForwardHeaders });
     let resp: Response;
     try {
       resp = await fetch(request.url, {
@@ -166,7 +167,7 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
         outcome = { text: "", sources: [], error: "the model called web_search with an empty query" };
         searchesExecuted++;
       } else {
-        outcome = await runWebSearch(call.query, hostedTool, forwardProvider, incomingHeaders, settings, abortSignal);
+        outcome = await runWebSearch(call.query, hostedTool, forwardProvider, selectedForwardHeaders, settings, abortSignal, recordSidecarOutcome);
         searchesExecuted++;
         if (outcome.error) failedQueries.add(normalizeQuery(call.query));
       }

package/src/ws-bridge.ts

@@ -1,8 +1,11 @@
 import type { ServerWebSocket } from "bun";
 import { FORWARD_HEADERS } from "./adapters/openai-responses";
+import type { CodexAuthContext } from "./codex-auth-context";
+import { headersForCodexAuthContext } from "./codex-auth-context";
+import type { ResponsesTerminalStatus } from "./bridge";
 
 const OPEN = 1;
-const TERMINAL_TYPES = new Set(["response.completed", "response.failed", "response.incomplete"]);
+type ResponsesTerminalReporter = (status: ResponsesTerminalStatus) => void;
 const SAFE_RESPONSE_HEADER_EXACT = new Set([
   "retry-after",
   "x-request-id",
@@ -15,6 +18,7 @@ const SAFE_RESPONSE_HEADER_EXACT = new Set([
 
 export interface WsData {
   headers?: Headers; // selected inbound upgrade headers only; never store full cookies/handshake internals
+  authContext?: CodexAuthContext; // immutable account decision made at upgrade time
   cancel?: () => void; // cancels the in-flight stream reader/fetch
   turnId?: number; // monotonically increasing per socket; prevents stale frames after replacement turns
 }
@@ -25,15 +29,26 @@ export class WsSendDroppedError extends Error {
   }
 }
 
-export function selectForwardHeaders(headers: Headers): Headers {
+export function selectForwardHeaders(
+  headers: Headers,
+  codexOverride?: { accessToken: string; chatgptAccountId: string },
+): Headers {
   const selected = new Headers();
   for (const name of FORWARD_HEADERS) {
     const value = headers.get(name);
     if (value) selected.set(name, value);
   }
+  if (codexOverride) {
+    selected.set("authorization", `Bearer ${codexOverride.accessToken}`);
+    selected.set("chatgpt-account-id", codexOverride.chatgptAccountId);
+  }
   return selected;
 }
 
+export function selectForwardHeadersForAuthContext(headers: Headers, ctx: CodexAuthContext): Headers {
+  return headersForCodexAuthContext(headers, ctx);
+}
+
 export function safeResponseHeaders(headers: Headers): Record<string, string> {
   const out: Record<string, string> = {};
   for (const [name, value] of headers) {
@@ -41,7 +56,7 @@ export function safeResponseHeaders(headers: Headers): Record<string, string> {
     if (
       SAFE_RESPONSE_HEADER_EXACT.has(lower) ||
       lower.startsWith("x-ratelimit-") ||
-      /^x-codex(?:-[a-z0-9-]+)?-(primary|secondary)-(used-percent|window-minutes|reset-at)$/.test(lower) ||
+      /^x-codex(?:-[a-z0-9-]+)?-(primary|secondary|tertiary)-(used-percent|window-minutes|reset-at)$/.test(lower) ||
       /^x-codex(?:-[a-z0-9-]+)?-limit-name$/.test(lower)
     ) {
       out[lower] = value;
@@ -126,6 +141,19 @@ function payloadType(payload: string): string | null {
   }
 }
 
+function terminalStatusFromType(type: string): ResponsesTerminalStatus | null {
+  switch (type) {
+    case "response.completed":
+      return "completed";
+    case "response.failed":
+      return "failed";
+    case "response.incomplete":
+      return "incomplete";
+    default:
+      return null;
+  }
+}
+
 function protocolError(message: string): Record<string, unknown> {
   return {
     type: "protocol_error",
@@ -141,11 +169,19 @@ function sendProtocolError(ws: ServerWebSocket<WsData>, status: number, message:
 export async function pumpResponsesSseToWebSocket(
   ws: ServerWebSocket<WsData>,
   sseStream: ReadableStream<Uint8Array>,
-  options: { isCurrent?: () => boolean } = {},
+  options: { isCurrent?: () => boolean; onTerminal?: ResponsesTerminalReporter } = {},
 ): Promise<void> {
   const reader = sseStream.getReader();
   const isCurrent = options.isCurrent ?? (() => true);
+  let clientCancelled = false;
+  let terminalReported = false;
+  const reportTerminal = (status: ResponsesTerminalStatus) => {
+    if (terminalReported || clientCancelled || !isCurrent()) return;
+    terminalReported = true;
+    options.onTerminal?.(status);
+  };
   const cancel = () => {
+    clientCancelled = true;
     void reader.cancel().catch(() => {});
   };
   ws.data.cancel = cancel;
@@ -159,6 +195,7 @@ export async function pumpResponsesSseToWebSocket(
     if (payload === "[DONE]") return false;
     const type = payloadType(payload);
     if (!type) {
+      reportTerminal("incomplete");
       sendProtocolError(ws, 502, "Invalid JSON payload in upstream SSE frame");
       terminalSeen = true;
       void reader.cancel().catch(() => {});
@@ -166,7 +203,9 @@ export async function pumpResponsesSseToWebSocket(
     }
     if (terminalSeen) return true;
     sendTextFrame(ws, payload);
-    if (TERMINAL_TYPES.has(type)) {
+    const terminalStatus = terminalStatusFromType(type);
+    if (terminalStatus) {
+      reportTerminal(terminalStatus);
       terminalSeen = true;
       void reader.cancel().catch(() => {});
       return true;
@@ -191,11 +230,13 @@ export async function pumpResponsesSseToWebSocket(
       const payload = parseSseBlock(buffer);
       if (payload) handlePayload(payload);
     }
-    if (!terminalSeen && isCurrent()) {
+    if (!terminalSeen && isCurrent() && !clientCancelled) {
+      reportTerminal("incomplete");
       sendProtocolError(ws, 502, "Upstream stream ended before response terminal event");
     }
   } catch (err) {
     if (!terminalSeen && isCurrent() && ws.readyState === OPEN) {
+      if (!(err instanceof WsSendDroppedError)) reportTerminal("incomplete");
       sendProtocolError(ws, 502, err instanceof Error ? err.message : String(err));
     }
   } finally {
@@ -206,6 +247,7 @@ export async function pumpResponsesSseToWebSocket(
 export function sendResponsesJsonAsEvents(
   ws: ServerWebSocket<WsData>,
   response: Record<string, unknown>,
+  onTerminal?: ResponsesTerminalReporter,
 ): void {
   const output = Array.isArray(response.output) ? response.output : [];
   sendJsonFrame(ws, {
@@ -226,6 +268,7 @@ export function sendResponsesJsonAsEvents(
     type: `response.${finalStatus}` as "response.completed" | "response.failed" | "response.incomplete",
     response: { ...response, status: finalStatus },
   });
+  onTerminal?.(finalStatus);
 }
 
 function errorPayloadFromText(text: string): Record<string, unknown> {
@@ -247,6 +290,7 @@ export async function sendResponseToWebSocket(
   ws: ServerWebSocket<WsData>,
   response: Response,
   isCurrent: () => boolean,
+  options: { onTerminal?: ResponsesTerminalReporter } = {},
 ): Promise<void> {
   if (!isCurrent()) {
     await response.body?.cancel().catch(() => {});
@@ -262,6 +306,7 @@ export async function sendResponseToWebSocket(
 
   const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
   if (!response.body) {
+    options.onTerminal?.("incomplete");
     sendJsonFrame(ws, buildWsErrorFrame(502, {
       type: "protocol_error",
       code: "websocket_protocol_error",
@@ -271,7 +316,7 @@ export async function sendResponseToWebSocket(
   }
 
   if (contentType.includes("text/event-stream")) {
-    await pumpResponsesSseToWebSocket(ws, response.body, { isCurrent });
+    await pumpResponsesSseToWebSocket(ws, response.body, { isCurrent, onTerminal: options.onTerminal });
     return;
   }
 
@@ -279,7 +324,7 @@ export async function sendResponseToWebSocket(
     const text = await response.text();
     if (!isCurrent()) return;
     const json = JSON.parse(text) as Record<string, unknown>;
-    sendResponsesJsonAsEvents(ws, json);
+    sendResponsesJsonAsEvents(ws, json, options.onTerminal);
     return;
   }
 
@@ -289,7 +334,7 @@ export async function sendResponseToWebSocket(
     return;
   }
   if (looksLikeSse(prefix)) {
-    await pumpResponsesSseToWebSocket(ws, stream, { isCurrent });
+    await pumpResponsesSseToWebSocket(ws, stream, { isCurrent, onTerminal: options.onTerminal });
     return;
   }
 
@@ -298,10 +343,11 @@ export async function sendResponseToWebSocket(
   const trimmed = text.trim();
   if (trimmed.startsWith("{")) {
     const json = JSON.parse(trimmed) as Record<string, unknown>;
-    sendResponsesJsonAsEvents(ws, json);
+    sendResponsesJsonAsEvents(ws, json, options.onTerminal);
     return;
   }
 
+  options.onTerminal?.("incomplete");
   sendJsonFrame(ws, buildWsErrorFrame(502, {
     type: "protocol_error",
     code: "websocket_protocol_error",

package/gui/dist/assets/index-dCS-lwCM.css

@@ -1 +0,0 @@
-:root{--lightningcss-light:initial;--lightningcss-dark: ;color-scheme:light dark;--bg:var(--lightningcss-light,#f6f7f9)var(--lightningcss-dark,#0c0d11);--rail:var(--lightningcss-light,#fff)var(--lightningcss-dark,#101218);--surface:var(--lightningcss-light,#fff)var(--lightningcss-dark,#15171d);--raised:var(--lightningcss-light,#f1f2f5)var(--lightningcss-dark,#1c1f27);--raised-hover:var(--lightningcss-light,#e8eaee)var(--lightningcss-dark,#242833);--border:var(--lightningcss-light,#e2e4e9)var(--lightningcss-dark,#2a2e39);--border-soft:var(--lightningcss-light,#ededf1)var(--lightningcss-dark,#20242d);--hover:var(--lightningcss-light,#11131c09)var(--lightningcss-dark,#ffffff06);--text:var(--lightningcss-light,#16181d)var(--lightningcss-dark,#edeef2);--muted:var(--lightningcss-light,#5b6270)var(--lightningcss-dark,#a3a9b5);--faint:var(--lightningcss-light,#868d9b)var(--lightningcss-dark,#6b7280);--accent:var(--lightningcss-light,#4f46e5)var(--lightningcss-dark,#6366f1);--accent-hover:var(--lightningcss-light,#4338ca)var(--lightningcss-dark,#818cf8);--accent-ink:#fff;--accent-soft:var(--lightningcss-light,#4f46e51a)var(--lightningcss-dark,#6366f129);--accent-ring:var(--lightningcss-light,#4f46e566)var(--lightningcss-dark,#6366f180);--green:var(--lightningcss-light,#047857)var(--lightningcss-dark,#34d399);--green-soft:var(--lightningcss-light,#0596691a)var(--lightningcss-dark,#34d39921);--red:var(--lightningcss-light,#b91c1c)var(--lightningcss-dark,#f87171);--red-soft:var(--lightningcss-light,#b91c1c17)var(--lightningcss-dark,#f8717121);--amber:var(--lightningcss-light,#b45309)var(--lightningcss-dark,#fbbf24);--amber-soft:var(--lightningcss-light,#b453091a)var(--lightningcss-dark,#fbbf2421);--radius:8px;--radius-sm:5px;--radius-xs:4px;--font:-apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, system-ui, "Helvetica Neue", sans-serif;--mono:ui-monospace, "SF Mono", "JetBrains Mono", "Cascadia Code", Menlo, Consolas, monospace;--shadow:0 1px 2px var(--lightningcss-light,#1018280f)var(--lightningcss-dark,#00000080), 0 10px 28px var(--lightningcss-light,#10182812)var(--lightningcss-dark,#0000004d);--shadow-sm:0 1px 2px var(--lightningcss-light,#1018280f)var(--lightningcss-dark,#0006)}@media (prefers-color-scheme:dark){:root{--lightningcss-light: ;--lightningcss-dark:initial}}:root[data-theme=light]{--lightningcss-light:initial;--lightningcss-dark: ;color-scheme:light}:root[data-theme=dark]{--lightningcss-light: ;--lightningcss-dark:initial;color-scheme:dark}*{box-sizing:border-box}html,body,#root{height:100%}body{background:var(--bg);color:var(--text);font-family:var(--font);-webkit-font-smoothing:antialiased;text-rendering:optimizelegibility;margin:0;font-size:14px;line-height:1.5}a{color:var(--accent-hover);text-decoration:none}a:hover{text-decoration:underline}code,.mono{font-family:var(--mono);font-size:.92em}h1,h2,h3,h4{letter-spacing:-.01em;margin:0;font-weight:650}::selection{background:var(--accent-soft)}input[type=checkbox],input[type=radio]{accent-color:var(--accent)}::-webkit-scrollbar{width:10px;height:10px}::-webkit-scrollbar-thumb{background:var(--border);border:2px solid var(--bg);border-radius:99px}::-webkit-scrollbar-thumb:hover{background:var(--faint)}:focus-visible{outline:2px solid var(--accent-ring);outline-offset:2px;border-radius:4px}.app{grid-template-columns:232px 1fr;min-height:100dvh;display:grid}.sidebar{border-right:1px solid var(--border);background:var(--rail);flex-direction:column;align-self:start;gap:4px;height:100dvh;padding:18px 14px;display:flex;position:sticky;top:0}.brand{align-items:center;gap:10px;padding:6px 8px 14px;display:flex}.brand-logo{background:var(--text);flex-shrink:0;width:26px;height:26px;-webkit-mask:url(/logo.png) 50%/contain no-repeat;mask:url(/logo.png) 50%/contain no-repeat}.brand .name{letter-spacing:-.02em;font-size:15px;font-weight:700;line-height:26px}.brand .ver{font-family:var(--mono);color:var(--muted);background:var(--raised);border:1px solid var(--border);border-radius:99px;align-self:center;padding:2px 6px;font-size:10px;line-height:1}.nav-item{border-radius:var(--radius-sm);text-align:left;cursor:pointer;width:100%;color:var(--muted);font:inherit;background:0 0;border:none;align-items:center;gap:10px;padding:8px 10px;font-size:13.5px;font-weight:500;transition:background .12s,color .12s;display:flex}.nav-item:hover{background:var(--raised);color:var(--text)}.nav-item.active{background:var(--accent-soft);color:var(--text)}.nav-item svg{width:17px;height:17px;color:var(--faint);flex-shrink:0}.nav-item.active svg{color:var(--accent)}.sidebar-foot{flex-direction:column;gap:2px;margin-top:auto;padding-top:12px;display:flex}.sidebar-link{color:var(--muted);border-radius:var(--radius-sm);align-items:center;gap:9px;padding:8px 10px;font-size:13px;display:flex}.sidebar-link:hover{background:var(--raised);color:var(--text);text-decoration:none}.sidebar-link svg{width:16px;height:16px}.theme-toggle{text-align:left;cursor:pointer;width:100%;color:var(--muted);font:inherit;border-radius:var(--radius-sm);background:0 0;border:none;align-items:center;gap:9px;padding:8px 10px;font-size:13px;transition:background .12s,color .12s;display:flex}.theme-toggle:hover{background:var(--raised);color:var(--text)}.theme-toggle svg{flex-shrink:0;width:16px;height:16px}.theme-toggle .mode{text-transform:capitalize}.stop-toggle{color:var(--red)}.stop-toggle:hover{background:var(--red-soft);color:var(--red)}.stop-toggle:disabled{opacity:.5;cursor:default}.main{min-width:0}.main-inner{max-width:980px;margin:0 auto;padding:32px 36px 64px}.page-head{justify-content:space-between;align-items:center;gap:16px;margin-bottom:6px;display:flex}.page-head h2{font-size:19px}.page-sub{color:var(--muted);max-width:70ch;margin:4px 0 22px;font-size:13.5px}.page-sub b{color:var(--text);font-weight:600}.btn{border-radius:var(--radius-sm);font:inherit;cursor:pointer;white-space:nowrap;border:1px solid #0000;justify-content:center;align-items:center;gap:7px;padding:7px 14px;font-size:13px;font-weight:550;transition:background .12s,border-color .12s,opacity .12s;display:inline-flex}.btn svg{width:15px;height:15px}.btn:disabled{opacity:.55;cursor:default}.btn-primary{background:var(--accent);color:var(--accent-ink)}.btn-primary:hover:not(:disabled){background:var(--accent-hover)}.btn-ghost{background:var(--raised);color:var(--text);border-color:var(--border)}.btn-ghost:hover:not(:disabled){background:var(--raised-hover)}.btn-danger{color:var(--red);background:0 0;border-color:#f871714d}.btn-danger:hover:not(:disabled){background:var(--red-soft)}.btn-sm{border-radius:var(--radius-xs);padding:4px 9px;font-size:12px}.btn-icon{padding:5px}.card{background:var(--surface);border:1px solid var(--border);border-radius:var(--radius)}.panel{background:var(--surface);border:1px solid var(--border);border-radius:var(--radius);padding:18px}.panel-accent{background:linear-gradient(180deg, var(--accent-soft), transparent 120%), var(--surface);border-color:#7c5cff47}.stat-row{grid-template-columns:repeat(4,1fr);gap:12px;margin-bottom:28px;display:grid}.stat{background:var(--surface);border:1px solid var(--border);border-radius:var(--radius);padding:14px 16px;transition:border-color .12s}.stat:hover{border-color:var(--accent-ring)}.stat .label{color:var(--muted);text-transform:uppercase;letter-spacing:.05em;align-items:center;gap:6px;margin-bottom:9px;font-size:11px;font-weight:600;display:flex}.stat .label svg{width:14px;height:14px}.stat .value{letter-spacing:-.02em;font-size:24px;font-weight:700;line-height:1.1}.stat .value.mono{font-family:var(--mono);font-size:19px}.model-group-head{color:var(--muted);text-transform:uppercase;letter-spacing:.04em;align-items:baseline;gap:8px;margin:0 0 8px;font-size:12px;font-weight:600;display:flex}.model-group-head .count{font-family:var(--mono);text-transform:none;letter-spacing:0;color:var(--faint);font-weight:500}.model-grid{grid-template-columns:repeat(auto-fill,minmax(220px,1fr));gap:8px;display:grid}.model-card{background:var(--surface);border:1px solid var(--border);border-radius:var(--radius-sm);padding:10px 12px;transition:border-color .12s,background .12s}.model-card:hover{border-color:var(--accent-ring);background:var(--hover)}.model-card .id{font-family:var(--mono);letter-spacing:-.01em;color:var(--text);font-size:13px;font-weight:600}.badge{font-size:11px;font-weight:600;font-family:var(--mono);letter-spacing:.01em;border-radius:99px;align-items:center;gap:5px;padding:2px 8px;display:inline-flex}.badge-accent{background:var(--accent-soft);color:var(--accent-hover)}.badge-green{background:var(--green-soft);color:var(--green)}.badge-amber{background:var(--amber-soft);color:var(--amber)}.badge-muted{background:var(--raised);color:var(--muted);border:1px solid var(--border)}.dot{border-radius:50%;flex-shrink:0;width:7px;height:7px}.dot-green{background:var(--green);box-shadow:0 0 0 3px var(--green-soft)}.dot-red{background:var(--red);box-shadow:0 0 0 3px var(--red-soft)}.tbl{border-collapse:collapse;width:100%;font-size:13px}.tbl thead th{text-align:left;color:var(--muted);text-transform:uppercase;letter-spacing:.04em;border-bottom:1px solid var(--border);padding:9px 12px;font-size:11.5px;font-weight:600}.tbl tbody td{border-bottom:1px solid var(--border-soft);padding:10px 12px}.tbl tbody tr:last-child td{border-bottom:none}.tbl tbody tr:hover td{background:var(--hover)}.tbl .num{text-align:right;font-family:var(--mono)}.tbl-wrap{border:1px solid var(--border);border-radius:var(--radius);overflow-x:auto}.input,textarea.input{border-radius:var(--radius-sm);background:var(--raised);border:1px solid var(--border);width:100%;color:var(--text);font:inherit;padding:8px 11px;font-size:13px;transition:border-color .12s}.input::placeholder{color:var(--faint)}.input:focus{border-color:var(--accent);outline:none}textarea.input{resize:vertical;font-family:var(--mono);line-height:1.55}.field-label{color:var(--muted);margin-bottom:5px;font-size:12px;font-weight:500;display:block}select.input{appearance:none}.select-sm{border-radius:var(--radius-sm);background:var(--raised);border:1px solid var(--border);color:var(--text);font:inherit;cursor:pointer;padding:5px 8px;font-size:13px;transition:border-color .12s}.select-sm:focus{border-color:var(--accent);outline:none}.select-sm:disabled{opacity:.5;cursor:default}.switch{cursor:pointer;background:var(--lightningcss-light,#c5c9d2)var(--lightningcss-dark,#3a3f4b);border:none;border-radius:99px;flex-shrink:0;width:34px;height:19px;padding:0;transition:background .15s;position:relative}.switch.on{background:var(--accent)}.switch:disabled{opacity:.6;cursor:default}.switch .knob{background:#fff;border-radius:50%;width:15px;height:15px;transition:left .15s;position:absolute;top:2px;left:2px;box-shadow:0 1px 2px #1018284d}.switch.on .knob{left:17px}.muted{color:var(--muted)}.faint{color:var(--faint)}.row{align-items:center;gap:10px;display:flex}.spread{justify-content:space-between;align-items:center;gap:12px;display:flex}.stack{flex-direction:column;display:flex}.chip{font-family:var(--mono);background:var(--raised);border:1px solid var(--border);border-radius:var(--radius-xs);color:var(--text);padding:1px 7px;font-size:12px}.empty{text-align:center;border:1px dashed var(--border);border-radius:var(--radius);color:var(--muted);padding:56px 20px}.empty svg{width:30px;height:30px;color:var(--faint);margin-bottom:12px}.empty .title{color:var(--text);margin-bottom:6px;font-weight:600}.notice{border-radius:var(--radius-sm);align-items:center;gap:8px;margin-bottom:14px;padding:9px 12px;font-size:13px;display:flex}.notice svg{flex-shrink:0;width:15px;height:15px}.notice-ok{background:var(--green-soft);color:var(--green)}.notice-err{background:var(--red-soft);color:var(--red)}.h-section{color:var(--text);align-items:center;gap:8px;margin:30px 0 12px;font-size:13px;font-weight:600;display:flex}.h-section .count{color:var(--muted);font-weight:500;font-family:var(--mono);font-size:12px}.spin{border:2px solid var(--border);border-top-color:var(--accent);border-radius:50%;width:14px;height:14px;animation:.7s linear infinite spin;display:inline-block}@keyframes spin{to{transform:rotate(360deg)}}@media (prefers-reduced-motion:reduce){*{transition:none!important;animation:none!important}}.modal-overlay{-webkit-backdrop-filter:blur(2px);backdrop-filter:blur(2px);z-index:50;background:var(--lightningcss-light,#11131c73)var(--lightningcss-dark,#0009);justify-content:center;align-items:flex-start;padding:8vh 16px;display:flex;position:fixed;inset:0}.modal-card{background:var(--surface);border:1px solid var(--border);border-radius:var(--radius);width:100%;max-width:520px;box-shadow:var(--shadow);max-height:84vh;padding:20px;overflow-y:auto}.modal-head{justify-content:space-between;align-items:center;margin-bottom:16px;display:flex}.modal-head h3{font-size:16px}.setup-guide{border:1px solid var(--border);border-radius:var(--radius-sm);margin-bottom:4px;padding:8px 12px;font-size:13px}.setup-guide summary{cursor:pointer;color:var(--accent-hover);font-weight:500}.setup-guide summary:hover{text-decoration:underline}.setup-guide a{color:var(--accent-hover)}.list-row{text-align:left;border-radius:var(--radius-sm);border:1px solid var(--border);background:var(--raised);cursor:pointer;width:100%;color:var(--text);font:inherit;justify-content:space-between;align-items:center;gap:10px;padding:11px 13px;transition:background .12s,border-color .12s;display:flex}.list-row:hover{background:var(--raised-hover);border-color:var(--accent-ring)}.list-row .title{font-size:14px;font-weight:600}.list-row .sub{color:var(--muted);margin-top:2px;font-size:12px}.prov-card{justify-content:space-between;align-items:flex-start;gap:12px;padding:15px 16px;display:flex}.link-btn{color:var(--accent-hover);font:inherit;cursor:pointer;background:0 0;border:none;padding:6px 2px;font-size:13px;text-decoration:underline}@media (width<=760px){.app{grid-template-columns:1fr}.sidebar{z-index:20;border-right:none;border-bottom:1px solid var(--border);background:var(--rail);flex-flow:wrap;align-items:center;gap:0;min-width:0;height:auto;padding:0 10px;position:sticky;top:0}.brand{flex:auto;order:1;width:auto;padding:10px 4px}.sidebar-foot{flex-direction:row;flex:none;order:2;gap:4px;margin:0;padding:0}.sidebar-foot .sidebar-link{display:none}.theme-toggle{justify-content:center;min-width:44px;min-height:44px;padding:8px}.theme-toggle .mode{display:none}.sidebar nav{overscroll-behavior-x:contain;border-top:1px solid var(--border-soft);scrollbar-width:none;flex-direction:row;flex:100%;order:3;gap:2px;min-width:0;margin:0;padding:4px 0 8px;display:flex;overflow-x:auto}.sidebar nav::-webkit-scrollbar{display:none}.nav-item{white-space:nowrap;width:auto;min-height:44px;padding:9px 14px;font-size:14px}.main-inner{padding:22px 18px 48px}.stat-row{grid-template-columns:repeat(2,minmax(0,1fr))}.tbl{min-width:460px}}