@bitkyc08/opencodex 2.10.0 → 2.10.1

package/src/server/management/model-routes.ts

@@ -90,7 +90,7 @@ import {
   EXPORT_CLIENTS,
   EXPORT_CLIENT_IDS,
   OPENCODE_PROVIDER_ID,
-  buildClientConfig,
+  buildClientConfigText,
   isExportClientId,
   opencodeProxyBaseUrl,
 } from "../../clients/config-export";
@@ -104,93 +104,9 @@ import type {
 import { isPlainRecord, parseDebugLogQuery, tokPerSecondResult, unavailableCostReason, costResult, requestLogDto, stripRegistryOnlyStaticHeaders, fetchAllModels } from "./shared";
 import type { MetricUnavailableReason, TokPerSecondResult, CostEstimateReason, CostResult, MetricSource } from "./shared";
 import type { ManagementContext } from "./context";
+import { listManagementModelRows, loadExportModels } from "./model-rows";
 import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
 
-/**
- * One row of the `/api/models` list. Routed rows spread a `CatalogModel`, so the shape is
- * that model plus the identity/visibility fields this boundary computes for every row
- * regardless of source. `disabled` is always present; the rest vary by row origin.
- */
-type ManagementModelRow = Partial<CatalogModel> & {
-  provider: string;
-  id: string;
-  namespaced: string;
-  disabled: boolean;
-  native?: boolean;
-  custom?: boolean;
-  customId?: string;
-};
-
-/**
- * The exact row list `/api/models` returns. Extracted so `/api/client-config` exports the
- * models the GUI's Models tab shows — including this function's `disabled` computation,
- * which the export core (src/clients/config-export.ts) deliberately does not perform.
- */
-async function listManagementModelRows(config: OcxConfig): Promise<ManagementModelRow[]> {
-  const models = await fetchAllModels(config);
-  const disabled = new Set(config.disabledModels ?? []);
-  // Native GPT passthrough rows lead (provider "openai", bare-slug namespaced ids): sourced
-  // from the static supported set so a disabled model stays listed and re-enableable.
-  const native: ManagementModelRow[] = nativeModelRows(config).map(row => ({
-    provider: "openai",
-    id: row.slug,
-    namespaced: row.slug,
-    disabled: row.disabled,
-    native: true,
-    ...(row.contextWindow !== undefined ? { contextWindow: row.contextWindow } : {}),
-  }));
-  const customModels: ManagementModelRow[] = (config.customModels ?? []).map(cm => {
-    const namespaced = routedSlug(cm.provider, cm.modelId);
-    return {
-      provider: cm.provider,
-      id: cm.modelId,
-      namespaced,
-      disabled: [...disabled].some(stored => slugEquals(stored, cm.provider, cm.modelId)),
-      custom: true,
-      customId: cm.id,
-      displayName: cm.displayName,
-      ...(cm.contextWindow ? { contextWindow: cm.contextWindow } : {}),
-      ...(cm.inputModalities ? { inputModalities: cm.inputModalities } : {}),
-    };
-  });
-  const publicModels = uniqueCatalogModelsForPublicList(models);
-  const comboNamespaced = new Set(
-    publicModels.filter(model => model.provider === "combo").map(catalogModelSlug),
-  );
-  const visibleCustomModels = customModels.filter(model => !comboNamespaced.has(model.namespaced));
-  // Custom metadata wins when a physical live/static row resolves to the same Codex-facing
-  // slug, while a combo keeps the same precedence it has in routing and /v1/models.
-  const customNamespaced = new Set(visibleCustomModels.map(c => c.namespaced));
-  const dedupedRouted = publicModels.map((m): ManagementModelRow | null => {
-    // Codex-facing slug (one "/", slug-codec); disabledModels compares tolerate both forms.
-    const namespaced = catalogModelSlug(m);
-    if (m.provider !== "combo" && customNamespaced.has(namespaced)) return null;
-    const contextCap = providerContextCap(config, m.provider);
-    return {
-      ...m,
-      namespaced,
-      disabled: [...disabled].some(stored => (
-        stored === namespaced || slugEquals(stored, m.provider, m.id)
-      )),
-      ...(contextCap !== undefined ? { contextCap, contextCapped: m.contextCapped === true } : {}),
-    };
-  }).filter((row): row is ManagementModelRow => row !== null);
-  return [...native, ...dedupedRouted, ...visibleCustomModels];
-}
-
-/** `/api/models` row → the narrower input the client-config serializers accept. */
-function toExportModel(row: ManagementModelRow): ExportModel {
-  return {
-    namespaced: row.namespaced,
-    provider: row.provider,
-    id: row.id,
-    ...(row.native ? { native: true } : {}),
-    ...(row.displayName ? { displayName: row.displayName } : {}),
-    ...(row.contextWindow !== undefined ? { contextWindow: row.contextWindow } : {}),
-    ...(row.inputModalities ? { inputModalities: row.inputModalities } : {}),
-  };
-}
-
 /**
  * Counts read back off the SERIALIZED document rather than recomputed from the input rows.
  * `modelsWithoutLimits` drives a GUI line claiming "these models ship without limits", so it
@@ -198,17 +114,14 @@ function toExportModel(row: ManagementModelRow): ExportModel {
  * core's "authoritative context window" rule would be free to drift from it silently.
  */
 function summarizeExportedModels(client: ExportClientId, document: unknown): { modelCount: number; modelsWithoutLimits: number } {
-  if (client === "opencode") {
-    const models = (document as OpencodeGeneratedConfig).provider[OPENCODE_PROVIDER_ID].models;
-    const entries = Object.values(models);
-    return { modelCount: entries.length, modelsWithoutLimits: entries.filter(entry => entry.limit === undefined).length };
-  }
-  const models = (document as PiGeneratedConfig).providers[OPENCODE_PROVIDER_ID].models;
-  return { modelCount: models.length, modelsWithoutLimits: models.filter(entry => entry.contextWindow === undefined).length };
+  // Each client counts its own document shape. The previous branch assumed
+  // "anything that is not OpenCode must be Pi", which silently misread the
+  // moment a third client existed.
+  return EXPORT_CLIENTS[client].summarize(document);
 }
 
 export async function handleModelRoutes(ctx: ManagementContext): Promise<Response | null> {
-  const { req, url, config, deps, refreshCodexCatalogBestEffort, syncClaudeAgentDefsBestEffort } = ctx;
+  const { req, url, config, deps, convergeCodexCatalog, syncClaudeAgentDefsBestEffort } = ctx;
   // A handler persists the exact config object passed in. Production defaults to
   // the real store; tests that pass an in-memory fixture inject a no-op/spy. Do not
   // bypass this seam with a dynamic config import — doing so replaced a user's
@@ -249,9 +162,12 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
       );
     }
     const spec = EXPORT_CLIENTS[requested];
-    let rows: ManagementModelRow[];
+    let models: ExportModel[];
     try {
-      rows = await listManagementModelRows(config);
+      // The ONE loader every export surface uses. It carries the visibility
+      // filter with it, so this route and the integration routes cannot end up
+      // telling a client about different models.
+      models = await loadExportModels(config);
     } catch (error) {
       // A partial or empty `models` block reads as a valid config while offering nothing,
       // so a catalog failure is surfaced as unavailable rather than serialized. The
@@ -264,21 +180,24 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
         config,
       );
     }
-    // The export core does not filter visibility — it serializes what it is given. A model the
-    // user disabled in the Models tab is absent from /v1/models, so exporting it would hand the
-    // client a selector the proxy refuses to route.
-    const models = rows.filter(row => !row.disabled).map(toExportModel);
-    const document = buildClientConfig(requested, {
+    const built = buildClientConfigText(requested, {
       baseUrl: opencodeProxyBaseUrl(Number(url.port) || config.port, config.hostname),
       models,
       config,
     });
+    const document = built.document;
     return jsonResponse({
       client: spec.id,
       filename: spec.filename,
       destination: spec.destination(process.env),
       apiKeyEnv: spec.apiKeyEnv,
       exportHint: spec.exportHint,
+      // The client's own format and the exact bytes for it. The GUI previously
+      // re-serialized `config` as JSON, which is wrong for four of the six
+      // clients; `mediaType` also drives the download blob.
+      format: built.format,
+      mediaType: built.mediaType,
+      text: built.text,
       ...summarizeExportedModels(requested, document),
       config: document,
     }, 200, req, config);
@@ -292,8 +211,8 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
     const disabled = Array.isArray(body.models) ? body.models.filter((m): m is string => typeof m === "string") : [];
     config.disabledModels = disabled;
     persistConfig(config);
-    await refreshCodexCatalogBestEffort();
-    return jsonResponse({ ok: true, disabled });
+    const catalogRefresh = await convergeCodexCatalog();
+    return jsonResponse({ ok: true, disabled, catalogRefresh });
   }
 
   // One user-facing visibility switch spans two persisted filters: a provider allowlist and the
@@ -391,8 +310,8 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
 
     config.disabledModels = disabled;
     persistConfig(config);
-    await refreshCodexCatalogBestEffort();
-    return jsonResponse({ ok: true, scope, provider, enabled: body.enabled, disabled });
+    const catalogRefresh = await convergeCodexCatalog();
+    return jsonResponse({ ok: true, scope, provider, enabled: body.enabled, disabled, catalogRefresh });
   }
 
   if (url.pathname === "/api/custom-models" && req.method === "GET") {
@@ -430,8 +349,8 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
     };
     config.customModels = [...existing, entry];
     persistConfig(config);
-    await refreshCodexCatalogBestEffort();
-    return jsonResponse(entry, 201);
+    const catalogRefresh = await convergeCodexCatalog();
+    return jsonResponse({ ...entry, catalogRefresh }, 201);
   }
 
   const customPutMatch = url.pathname.match(/^\/api\/custom-models\/([^/]+)$/);
@@ -468,8 +387,8 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
     list[idx] = cm;
     config.customModels = list;
     persistConfig(config);
-    await refreshCodexCatalogBestEffort();
-    return jsonResponse(cm);
+    const catalogRefresh = await convergeCodexCatalog();
+    return jsonResponse({ ...cm, catalogRefresh });
   }
 
   const customDelMatch = url.pathname.match(/^\/api\/custom-models\/([^/]+)$/);
@@ -482,8 +401,8 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
     list.splice(idx, 1);
     config.customModels = list.length > 0 ? list : undefined;
     persistConfig(config);
-    await refreshCodexCatalogBestEffort();
-    return jsonResponse({ ok: true });
+    const catalogRefresh = await convergeCodexCatalog();
+    return jsonResponse({ ok: true, catalogRefresh });
   }
 
   // Per-provider catalog allowlist (issue #52): when a provider has a non-empty selectedModels list,
@@ -518,8 +437,8 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
     if (models.length > 0) config.providers[provider].selectedModels = models;
     else delete config.providers[provider].selectedModels;
     persistConfig(config);
-    await refreshCodexCatalogBestEffort();
-    return jsonResponse({ ok: true, provider, selected: models });
+    const catalogRefresh = await convergeCodexCatalog();
+    return jsonResponse({ ok: true, provider, selected: models, catalogRefresh });
   }
   return null;
 }

package/src/server/management/model-rows.ts

@@ -0,0 +1,117 @@
+/**
+ * The `/api/models` row list and its projection into export models.
+ *
+ * Extracted from model-routes.ts so `/api/client-config` and the integration
+ * routes read the SAME visible-model list. Two callers computing "which models
+ * does this user actually have" independently is how the export and the toggle
+ * would quietly disagree about what a client was told.
+ *
+ * Bodies are unchanged from their previous home; only `export` was added.
+ */
+import type { CatalogModel } from "../../codex/catalog";
+import { catalogModelSlug, nativeModelRows, uniqueCatalogModelsForPublicList } from "../../codex/catalog";
+import type { ExportModel } from "../../clients/config-export";
+import { providerContextCap } from "../../providers/context-cap";
+import { routedSlug, slugEquals } from "../../providers/slug-codec";
+import type { OcxConfig } from "../../types";
+import { fetchAllModels } from "./shared";
+
+/**
+ * One row of the `/api/models` list. Routed rows spread a `CatalogModel`, so the shape is
+ * that model plus the identity/visibility fields this boundary computes for every row
+ * regardless of source. `disabled` is always present; the rest vary by row origin.
+ */
+export type ManagementModelRow = Partial<CatalogModel> & {
+  provider: string;
+  id: string;
+  namespaced: string;
+  disabled: boolean;
+  native?: boolean;
+  custom?: boolean;
+  customId?: string;
+};
+
+/**
+ * The exact row list `/api/models` returns. Extracted so `/api/client-config` exports the
+ * models the GUI's Models tab shows — including this function's `disabled` computation,
+ * which the export core (src/clients/config-export.ts) deliberately does not perform.
+ */
+export async function listManagementModelRows(config: OcxConfig): Promise<ManagementModelRow[]> {
+  const models = await fetchAllModels(config);
+  const disabled = new Set(config.disabledModels ?? []);
+  // Native GPT passthrough rows lead (provider "openai", bare-slug namespaced ids): sourced
+  // from the static supported set so a disabled model stays listed and re-enableable.
+  const native: ManagementModelRow[] = nativeModelRows(config).map(row => ({
+    provider: "openai",
+    id: row.slug,
+    namespaced: row.slug,
+    disabled: row.disabled,
+    native: true,
+    ...(row.contextWindow !== undefined ? { contextWindow: row.contextWindow } : {}),
+  }));
+  const customModels: ManagementModelRow[] = (config.customModels ?? []).map(cm => {
+    const namespaced = routedSlug(cm.provider, cm.modelId);
+    return {
+      provider: cm.provider,
+      id: cm.modelId,
+      namespaced,
+      disabled: [...disabled].some(stored => slugEquals(stored, cm.provider, cm.modelId)),
+      custom: true,
+      customId: cm.id,
+      displayName: cm.displayName,
+      ...(cm.contextWindow ? { contextWindow: cm.contextWindow } : {}),
+      ...(cm.inputModalities ? { inputModalities: cm.inputModalities } : {}),
+    };
+  });
+  const publicModels = uniqueCatalogModelsForPublicList(models);
+  const comboNamespaced = new Set(
+    publicModels.filter(model => model.provider === "combo").map(catalogModelSlug),
+  );
+  const visibleCustomModels = customModels.filter(model => !comboNamespaced.has(model.namespaced));
+  // Custom metadata wins when a physical live/static row resolves to the same Codex-facing
+  // slug, while a combo keeps the same precedence it has in routing and /v1/models.
+  const customNamespaced = new Set(visibleCustomModels.map(c => c.namespaced));
+  const dedupedRouted = publicModels.map((m): ManagementModelRow | null => {
+    // Codex-facing slug (one "/", slug-codec); disabledModels compares tolerate both forms.
+    const namespaced = catalogModelSlug(m);
+    if (m.provider !== "combo" && customNamespaced.has(namespaced)) return null;
+    const contextCap = providerContextCap(config, m.provider);
+    return {
+      ...m,
+      namespaced,
+      disabled: [...disabled].some(stored => (
+        stored === namespaced || slugEquals(stored, m.provider, m.id)
+      )),
+      ...(contextCap !== undefined ? { contextCap, contextCapped: m.contextCapped === true } : {}),
+    };
+  }).filter((row): row is ManagementModelRow => row !== null);
+  return [...native, ...dedupedRouted, ...visibleCustomModels];
+}
+
+/** `/api/models` row → the narrower input the client-config serializers accept. */
+export function toExportModel(row: ManagementModelRow): ExportModel {
+  return {
+    namespaced: row.namespaced,
+    provider: row.provider,
+    id: row.id,
+    ...(row.native ? { native: true } : {}),
+    ...(row.displayName ? { displayName: row.displayName } : {}),
+    ...(row.contextWindow !== undefined ? { contextWindow: row.contextWindow } : {}),
+    ...(row.inputModalities ? { inputModalities: row.inputModalities } : {}),
+  };
+}
+
+/**
+ * Visible (non-disabled) rows as export models — the ONE loader both
+ * `/api/client-config` and the integration routes use, so the two can never
+ * disagree about which models a client is told about.
+ *
+ * The visibility filter lives HERE rather than at each call site: the export
+ * core serializes what it is given, so a model the user disabled in the Models
+ * tab is absent from `/v1/models` and exporting it would hand the client a
+ * selector the proxy refuses to route.
+ */
+export async function loadExportModels(config: OcxConfig): Promise<ExportModel[]> {
+  const rows = await listManagementModelRows(config);
+  return rows.filter(row => !row.disabled).map(toExportModel);
+}