@bitkyc08/opencodex 2.12.0 → 2.13.0

package/src/server/management/agent-settings-routes.ts

@@ -224,6 +224,7 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
     const {
       isMultiAgentV2Enabled, hasAgentsMaxThreads, getLogicalMaxThreads,
       getAgentsEnabled, getAgentsMaxDepth, getSubagentDeveloperInstructions,
+      getMultiAgentModeHintText,
     } = await import("../../codex/features");
     const enabled = isMultiAgentV2Enabled();
     return jsonResponse({
@@ -234,6 +235,7 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
       agentsEnabled: getAgentsEnabled(),
       agentsMaxDepth: getAgentsMaxDepth(),
       subagentDeveloperInstructions: getSubagentDeveloperInstructions(),
+      multiAgentModeHintText: getMultiAgentModeHintText(),
       // max_depth is V1-only upstream; this is the global-flag statement, derived
       // server-side so no client can present it as an effective V2 limit.
       agentsMaxDepthAppliesWhenV2Disabled: !enabled,
@@ -247,6 +249,7 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
       agentsEnabled?: unknown;
       agentsMaxDepth?: unknown;
       subagentDeveloperInstructions?: unknown;
+      multiAgentModeHintText?: unknown;
     };
     try { body = await readManagementJsonBody(req); } catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid JSON body" }, 400); }
     const wantsFlag = body.enabled !== undefined;
@@ -255,8 +258,9 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
     const wantsAgentsEnabled = body.agentsEnabled !== undefined;
     const wantsMaxDepth = body.agentsMaxDepth !== undefined;
     const wantsSubagentInstructions = body.subagentDeveloperInstructions !== undefined;
-    if (!wantsFlag && !wantsThreads && !wantsMode && !wantsAgentsEnabled && !wantsMaxDepth && !wantsSubagentInstructions) {
-      return jsonResponse({ error: "body must set enabled, multiAgentMode, maxConcurrentThreadsPerSession, agentsEnabled, agentsMaxDepth, and/or subagentDeveloperInstructions" }, 400);
+    const wantsModeHintText = body.multiAgentModeHintText !== undefined;
+    if (!wantsFlag && !wantsThreads && !wantsMode && !wantsAgentsEnabled && !wantsMaxDepth && !wantsSubagentInstructions && !wantsModeHintText) {
+      return jsonResponse({ error: "body must set enabled, multiAgentMode, maxConcurrentThreadsPerSession, agentsEnabled, agentsMaxDepth, subagentDeveloperInstructions, and/or multiAgentModeHintText" }, 400);
     }
     if (wantsFlag && typeof body.enabled !== "boolean") return jsonResponse({ error: "body.enabled must be a boolean" }, 400);
     if (wantsMode && body.multiAgentMode !== "v1" && body.multiAgentMode !== "default" && body.multiAgentMode !== "v2") {
@@ -280,6 +284,14 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
     if (wantsSubagentInstructions && body.subagentDeveloperInstructions !== null && typeof body.subagentDeveloperInstructions !== "string") {
       return jsonResponse({ error: "body.subagentDeveloperInstructions must be a string or null" }, 400);
     }
+    // null unsets the upstream key (effort-derived policy resumes); an empty/whitespace
+    // string is rejected because codex-rs treats any present hint as an override that
+    // suppresses even the Ultra-derived Proactive message (Option<String>, no blank
+    // special-case in effective_multi_agent_mode).
+    if (wantsModeHintText && body.multiAgentModeHintText !== null
+        && (typeof body.multiAgentModeHintText !== "string" || body.multiAgentModeHintText.trim().length === 0)) {
+      return jsonResponse({ error: "body.multiAgentModeHintText must be a non-empty string or null" }, 400);
+    }
     const mode = wantsMode ? body.multiAgentMode as "v1" | "default" | "v2" : undefined;
     const modeFlag = mode === "v2" ? true : mode === "v1" ? false : undefined;
     if (wantsFlag && modeFlag !== undefined && body.enabled !== modeFlag) {
@@ -288,8 +300,18 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
     const {
       isMultiAgentV2Enabled, hasAgentsMaxThreads, getLogicalMaxThreads, transitionMultiAgentV2,
       getAgentsEnabled, getAgentsMaxDepth, getSubagentDeveloperInstructions,
-      setAgentsEnabled, setAgentsMaxDepth, setSubagentDeveloperInstructions,
+      getMultiAgentModeHintText, probeCodexSupportsModeHint, setAgentsEnabled, setAgentsMaxDepth,
+      setSubagentDeveloperInstructions, setMultiAgentModeHintText, MODE_HINT_UNSUPPORTED_ERROR,
     } = await import("../../codex/features");
+    // Probe the capability before any combined-request mutation. The scalar writer
+    // repeats this check, but doing it here prevents an earlier flag/mode/agents
+    // write from landing before an unsupported runtime returns 502.
+    if (wantsModeHintText && body.multiAgentModeHintText !== null
+        && probeCodexSupportsModeHint() === false) {
+      return jsonResponse({
+        error: `writing multiAgentModeHintText failed: ${MODE_HINT_UNSUPPORTED_ERROR}`,
+      }, 502);
+    }
     const warnings: string[] = [];
     const requestedFlag = wantsFlag ? body.enabled as boolean : modeFlag;
     if (requestedFlag !== undefined || wantsThreads) {
@@ -322,6 +344,7 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
     if (wantsAgentsEnabled) scalarWrites.push({ field: "agentsEnabled", run: () => setAgentsEnabled(body.agentsEnabled as boolean | null) });
     if (wantsMaxDepth) scalarWrites.push({ field: "agentsMaxDepth", run: () => setAgentsMaxDepth(body.agentsMaxDepth as number | null) });
     if (wantsSubagentInstructions) scalarWrites.push({ field: "subagentDeveloperInstructions", run: () => setSubagentDeveloperInstructions(body.subagentDeveloperInstructions as string | null) });
+    if (wantsModeHintText) scalarWrites.push({ field: "multiAgentModeHintText", run: () => setMultiAgentModeHintText(body.multiAgentModeHintText as string | null) });
     const landed: string[] = [];
     for (const write of scalarWrites) {
       try {
@@ -353,6 +376,7 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
       agentsEnabled: getAgentsEnabled(),
       agentsMaxDepth: getAgentsMaxDepth(),
       subagentDeveloperInstructions: getSubagentDeveloperInstructions(),
+      multiAgentModeHintText: getMultiAgentModeHintText(),
       agentsMaxDepthAppliesWhenV2Disabled: !enabled,
       warnings,
       catalogRefresh,

package/src/server/management/lab-automation-routes.ts

@@ -0,0 +1,206 @@
+/**
+ * CL-08 Compatibility Lab automation management API.
+ *
+ * - GET  /api/lab/automation
+ * - PUT  /api/lab/automation
+ * - GET /api/lab/automation/runs
+ * - POST /api/lab/automation/run
+ * - POST /api/lab/automation/runs/:id/cancel
+ *
+ * Read endpoints never trigger scheduler ticks or evidence collection.
+ */
+
+import { readConfigDiagnostics, getConfigDir } from "../../config";
+import {
+  buildLabAutomationStatus,
+  cancelLabAutomationRun,
+  enqueueManualLabRun,
+  reconcileLabAutomationQueue,
+  startLabAutomationScheduler,
+  stopLabAutomationScheduler,
+} from "../../lab/automation/orchestrator";
+import { planManualLabRun } from "../../lab/automation/planner";
+import {
+  loadLabAutomationState,
+  normalizeLabAutomationRoutesV1,
+} from "../../lab/automation/persistence";
+import {
+  loadLabAutomationConfig,
+  saveLabAutomationConfig,
+} from "../../lab/automation/config-persistence";
+import { normalizeLabAutomationPolicyV1 } from "../../lab/automation/policy";
+import { listLabAutomationRuns } from "../../lab/automation/runs-query";
+import type { LabAutomationLayer, LabAutomationPolicyV1 } from "../../lab/automation/types";
+import { LabAutomationError } from "../../lab/automation/types";
+import { jsonResponse } from "../auth-cors";
+import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
+import type { ManagementContext } from "./context";
+import { isPlainRecord } from "./shared";
+
+const AUTOMATION_LAYERS: readonly LabAutomationLayer[] = [
+  "protocol_conformance",
+  "live_route_compatibility",
+  "task_effectiveness",
+];
+const MANUAL_RUN_KEYS = new Set(["evidenceLayer", "scenarioId", "providerName", "modelId"]);
+
+function automationErrorResponse(code: string, message: string, status: number, ctx: ManagementContext): Response {
+  return jsonResponse({ error: { code, message } }, status, ctx.req, ctx.config);
+}
+
+function hasUnknownKeys(value: Record<string, unknown>, allowed: ReadonlySet<string>): boolean {
+  return Object.keys(value).some((key) => !allowed.has(key));
+}
+
+function parseLimit(raw: string | null, ctx: ManagementContext): number | Response {
+  if (raw === null) return 50;
+  const trimmed = raw.trim();
+  if (trimmed.length === 0) return 50;
+  const value = Number(trimmed);
+  if (!Number.isInteger(value) || value < 1 || value > 100) {
+    return automationErrorResponse("invalid_limit", "limit must be an integer from 1 to 100", 400, ctx);
+  }
+  return value;
+}
+
+function applySchedulerPolicy(policy: LabAutomationPolicyV1, configDir?: string): void {
+  reconcileLabAutomationQueue(configDir);
+  if (policy.enabled) {
+    startLabAutomationScheduler(configDir);
+  } else {
+    stopLabAutomationScheduler(configDir);
+  }
+}
+
+export async function handleLabAutomationRoutes(ctx: ManagementContext): Promise<Response | null> {
+  const { url, req, config } = ctx;
+  if (!url.pathname.startsWith("/api/lab/automation")) return null;
+
+  const configDir = getConfigDir();
+
+  if (url.pathname === "/api/lab/automation" && req.method === "GET") {
+    return jsonResponse(buildLabAutomationStatus(configDir), 200, req, config);
+  }
+
+  if (url.pathname === "/api/lab/automation/runs" && req.method === "GET") {
+    const limit = parseLimit(url.searchParams.get("limit"), ctx);
+    if (limit instanceof Response) return limit;
+    const cursor = url.searchParams.get("cursor")?.trim() || undefined;
+    try {
+      const status = buildLabAutomationStatus(configDir);
+      const runsPage = listLabAutomationRuns(loadLabAutomationState(configDir), limit, cursor);
+      return jsonResponse({
+        runs: runsPage.items,
+        hasMore: runsPage.hasMore,
+        ...(runsPage.nextCursor ? { nextCursor: runsPage.nextCursor } : {}),
+        counters: status.counters,
+      }, 200, req, config);
+    } catch (error) {
+      if (error instanceof LabAutomationError && error.code === "invalid_cursor") {
+        return automationErrorResponse(error.code, error.message, 400, ctx);
+      }
+      throw error;
+    }
+  }
+
+  const cancelMatch = url.pathname.match(/^\/api\/lab\/automation\/runs\/([^/]+)\/cancel$/);
+  if (cancelMatch && req.method === "POST") {
+    let runId: string;
+    try {
+      runId = decodeURIComponent(cancelMatch[1]!);
+    } catch {
+      return automationErrorResponse("invalid_run_id", "run id is not valid percent-encoding", 400, ctx);
+    }
+    const cancelled = cancelLabAutomationRun(runId, configDir);
+    if (!cancelled) return automationErrorResponse("not_found", "unknown or non-cancellable run", 404, ctx);
+    return jsonResponse({ cancelled: true, runId }, 200, req, config);
+  }
+
+  if (url.pathname === "/api/lab/automation/run" && req.method === "POST") {
+    try {
+      const body = await readManagementJsonBody(req);
+      if (!isPlainRecord(body)) return automationErrorResponse("invalid_body", "body must be an object", 400, ctx);
+      if (hasUnknownKeys(body, MANUAL_RUN_KEYS)) {
+        return automationErrorResponse("invalid_body", "manual run body contains unknown fields", 400, ctx);
+      }
+      const evidenceLayer = body.evidenceLayer;
+      const scenarioId = body.scenarioId;
+      if (typeof evidenceLayer !== "string" || !AUTOMATION_LAYERS.includes(evidenceLayer as LabAutomationLayer)) {
+        return automationErrorResponse("invalid_layer", "evidenceLayer must be a supported automation layer", 400, ctx);
+      }
+      if (typeof scenarioId !== "string" || scenarioId.length === 0) {
+        return automationErrorResponse("invalid_scenario", "scenarioId is required", 400, ctx);
+      }
+      let ocxConfig: import("../../types").OcxConfig | undefined;
+      try {
+        ocxConfig = readConfigDiagnostics().config;
+      } catch {
+        ocxConfig = config;
+      }
+      const planned = planManualLabRun({
+        evidenceLayer: evidenceLayer as LabAutomationLayer,
+        scenarioId,
+        providerName: typeof body.providerName === "string" ? body.providerName : undefined,
+        modelId: typeof body.modelId === "string" ? body.modelId : undefined,
+        config: ocxConfig,
+        configDir,
+      });
+      // This endpoint is intentionally synchronous: completion is the acknowledgement boundary.
+      // Existing harness execution limits provide the route-level deadline, and disconnects cancel
+      // through Request.signal instead of leaving orphaned provider work running.
+      const record = await enqueueManualLabRun(planned, configDir, req.signal);
+      if (!record) return automationErrorResponse("enqueue_failed", "manual run could not be enqueued", 500, ctx);
+      return jsonResponse({ run: record, trigger: "manual" }, 200, req, config);
+    } catch (error) {
+      rethrowManagementBodyTooLarge(error);
+      if (error instanceof LabAutomationError) {
+        return automationErrorResponse(error.code, error.message, 400, ctx);
+      }
+      return automationErrorResponse("server_error", "manual run failed", 500, ctx);
+    }
+  }
+
+  if (url.pathname === "/api/lab/automation" && req.method === "PUT") {
+    try {
+      const body = await readManagementJsonBody(req);
+      if (!isPlainRecord(body)) return automationErrorResponse("invalid_body", "body must be an object", 400, ctx);
+      // Only policy/routes are authoritative. Other top-level properties are ignored rather than
+      // treated as injectable process-local capabilities (for example a fake routeExecutor).
+      let { policy, routes } = loadLabAutomationConfig(configDir);
+      if (body.policy !== undefined) {
+        if (!isPlainRecord(body.policy)) return automationErrorResponse("invalid_policy", "policy must be an object", 400, ctx);
+        const incoming = body.policy as Record<string, unknown>;
+        const mergedLayers = incoming.layers === undefined
+          ? policy.layers
+          : isPlainRecord(incoming.layers)
+            ? { ...policy.layers, ...incoming.layers }
+            : incoming.layers;
+        policy = normalizeLabAutomationPolicyV1({
+          ...policy,
+          ...incoming,
+          layers: mergedLayers,
+        });
+      }
+      if (body.routes !== undefined) {
+        if (!isPlainRecord(body.routes)) return automationErrorResponse("invalid_routes", "routes must be an object", 400, ctx);
+        routes = normalizeLabAutomationRoutesV1(body.routes);
+      }
+
+      // One atomic rename publishes policy and routes as a coherent generation. A failed write
+      // leaves the previous generation authoritative and scheduler reconciliation is not applied.
+      if (body.policy !== undefined || body.routes !== undefined) {
+        saveLabAutomationConfig(policy, routes, configDir);
+      }
+      applySchedulerPolicy(policy, configDir);
+      return jsonResponse(buildLabAutomationStatus(configDir), 200, req, config);
+    } catch (error) {
+      rethrowManagementBodyTooLarge(error);
+      if (error instanceof LabAutomationError) {
+        return automationErrorResponse(error.code, error.message, 400, ctx);
+      }
+      return automationErrorResponse("server_error", "automation policy update failed", 500, ctx);
+    }
+  }
+
+  return automationErrorResponse("not_found", "unknown resource", 404, ctx);
+}

package/src/server/management/lab-routes.ts

@@ -40,6 +40,7 @@ import {
   queryLabSubjectById,
   queryLabSubjects,
   queryLabVerdicts,
+  queryPassiveProductionSignals,
 } from "../../lab/query";
 import { jsonResponse } from "../auth-cors";
 import type { ManagementContext } from "./context";
@@ -194,6 +195,18 @@ export async function handleLabRoutes(ctx: ManagementContext): Promise<Response
     return jsonResponse(queryLabStatus(), 200, req, config);
   }
 
+  if (url.pathname === "/api/lab/production-signals") {
+    const subjectId = url.searchParams.get("subjectId")?.trim();
+    if (!subjectId) return errorResponse("invalid_subject", "subjectId is required", 400, ctx);
+    const limit = parseLimit(url.searchParams.get("limit"), ctx);
+    if (limit instanceof Response) return limit;
+    try {
+      return jsonResponse(queryPassiveProductionSignals(subjectId, limit), 200, req, config);
+    } catch {
+      return errorResponse("invalid_subject", "subjectId must be an exact Lab route subject id", 400, ctx);
+    }
+  }
+
   if (url.pathname === "/api/lab/catalog") {
     const layerRaw = url.searchParams.get("layer");
     const layerParsed = layerRaw ? parseLayer(layerRaw, ctx) : undefined;

package/src/server/management/logs-usage-routes.ts

@@ -261,6 +261,7 @@ export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Res
         days: [],
         models: [],
         providers: [],
+        accounts: [],
         historyTruncated: false,
         truncatedPrefixBytes: 0,
         entriesTruncated: false,

package/src/server/management/oauth-account-routes.ts

@@ -29,7 +29,7 @@ import { enrichProviderFromCatalog, listKeyLoginProviders } from "../../oauth/ke
 import { deriveProviderPresets } from "../../providers/derive";
 import { providerCodexAccountMode } from "../../providers/registry";
 import { routedSlug, slugEquals } from "../../providers/slug-codec";
-import { clearProviderQuotaCache, fetchProviderAccountQuotas, fetchProviderQuotaReports, supportsPerAccountQuota } from "../../providers/quota";
+import { clearAccountQuotaCache, clearProviderQuotaCache, fetchProviderAccountQuotas, fetchProviderQuotaReports, supportsPerAccountQuota } from "../../providers/quota";
 import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
 import { clearThreadAccountMap } from "../../codex/routing";
 import {
@@ -69,6 +69,13 @@ import type { MetricUnavailableReason, TokPerSecondResult, CostEstimateReason, C
 import type { ManagementContext } from "./context";
 import { readManagementJsonBody, readManagementJsonBodyOr, rethrowManagementBodyTooLarge } from "./body";
 import { codexAccountNamespaceProviderCollisionError } from "../../codex/account-namespace-match";
+import { ACCOUNT_IMPORT_DEADLINE_MS, ACCOUNT_IMPORT_MAX_REQUEST_BYTES } from "../../oauth/account-import";
+import { readBoundedJsonRequestBody } from "../request-decompress";
+
+// ACCOUNT_IMPORT_DEADLINE_MS is the shared CLI/server import window. Individual
+// provider requests keep their own shorter timeouts; this is only the server-side
+// backstop for the admitted batch. A disconnected request aborts immediately
+// through req.signal below.
 
 /**
  * Parses a bounded JSON object body, or null. Malformed JSON is swallowed; an
@@ -384,6 +391,55 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     return jsonResponse({ ok: true, cleared });
   }
 
+  if (url.pathname === "/api/oauth/accounts/import" && req.method === "POST") {
+    const controller = new AbortController();
+    const abortRequest = () => controller.abort();
+    if (req.signal.aborted) abortRequest();
+    else req.signal.addEventListener("abort", abortRequest, { once: true });
+    const deadline = setTimeout(abortRequest, ACCOUNT_IMPORT_DEADLINE_MS);
+    try {
+      let rawBody: unknown;
+      try {
+        rawBody = await readBoundedJsonRequestBody(
+          req,
+          ACCOUNT_IMPORT_MAX_REQUEST_BYTES,
+          undefined,
+          { signal: controller.signal },
+        );
+      } catch {
+        if (controller.signal.aborted) return jsonResponse({ code: "import_cancelled" }, 408);
+        return jsonResponse({ code: "invalid_document" }, 400);
+      }
+      if (!isPlainRecord(rawBody)) return jsonResponse({ code: "invalid_document" }, 400);
+      const provider = typeof rawBody.provider === "string" ? rawBody.provider : "";
+      const format = typeof rawBody.format === "string" ? rawBody.format : "";
+      const { importAccounts } = await import("../../oauth/account-import");
+      const imported = await importAccounts({
+        provider,
+        format,
+        document: rawBody.document,
+        signal: controller.signal,
+      });
+      const changed = imported.ok
+        ? imported.result.importedCount > 0 || imported.result.updatedCount > 0
+        : imported.changed === true;
+      if (changed) {
+        reconcileLiveStateStores();
+        const { clearModelCache } = await import("../../codex/model-cache");
+        const { clearGatherRoutedModelsInflight } = await import("../../codex/catalog");
+        clearModelCache(provider);
+        clearGatherRoutedModelsInflight();
+        clearProviderQuotaCache();
+        clearAccountQuotaCache(provider);
+      }
+      if (!imported.ok) return jsonResponse({ code: imported.code }, imported.status);
+      return jsonResponse(imported.result);
+    } finally {
+      clearTimeout(deadline);
+      req.signal.removeEventListener("abort", abortRequest);
+    }
+  }
+
   if (url.pathname === "/api/oauth/accounts/alias" && req.method === "PUT") {
     const body = await readManagementJsonBodyOr(req, {}) as { provider?: unknown; accountId?: unknown; alias?: unknown };
     const provider = typeof body.provider === "string" ? body.provider.trim().toLowerCase() : "";

package/src/server/management/provider-routes.ts

@@ -8,6 +8,8 @@ import {
   hasOwnProvider,
   isValidProviderName,
   multiAgentGuidanceEnabled,
+  nonBlankStringArrayConfigError,
+  normalizeNonBlankStringArray,
   providerBaseUrlConfigError,
   providerHeadersConfigError,
   saveConfigPreservingClaudeCode,
@@ -205,6 +207,19 @@ function applyProviderPatchFields(
     }
     touched = true;
   }
+  if (Object.hasOwn(rawBody, "noStructuredOutputModels")) {
+    const value = rawBody.noStructuredOutputModels;
+    if (value === null) {
+      delete next.noStructuredOutputModels;
+    } else {
+      const error = nonBlankStringArrayConfigError(value, "noStructuredOutputModels");
+      if (error) return { error };
+      const models = normalizeNonBlankStringArray(value as string[]);
+      if (models.length > 0) next.noStructuredOutputModels = models;
+      else delete next.noStructuredOutputModels;
+    }
+    touched = true;
+  }
 
   // headers is the one object-valued field in the mask. PATCH semantics merge it
   // shallowly into the existing block so a single fingerprint header can be added
@@ -291,6 +306,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       models: p.models ?? [],
       contextWindow: p.contextWindow,
       modelContextWindows: p.modelContextWindows,
+      noStructuredOutputModels: p.noStructuredOutputModels,
       authMode: p.authMode,
       apiKeyTransport: p.apiKeyTransport,
       disabled: p.disabled === true,

package/src/server/management/routing-profile-routes.ts

@@ -16,10 +16,9 @@ import {
   routingProfileIssues,
 } from "../../routing/profile";
 import { evaluatePolicyProfile, type PolicyCandidateEvidence, type PolicyRequestEvidence } from "../../routing/evaluator";
-import { candidateCapabilityEvidence } from "../../routing/capability";
-import { policyCandidateHealthEvidence } from "../../routing/health";
+import { assemblePolicyCandidateEvidence } from "../../routing/compatibility/assemble";
 import { quotaEvidenceForCandidate } from "../../routing/quota";
-import { costEvidenceForCandidate } from "../../routing/cost";
+import { routedProviderConfig } from "../../router";
 import { saveConfigPreservingClaudeCode } from "../../config";
 import { reconcileLiveStateStores } from "../../lib/state-store-registrations";
 import { isPlainRecord } from "./shared";
@@ -41,6 +40,7 @@ function profileDto(config: Parameters<typeof getRoutingProfile>[0], id: string)
     optimize: profile.optimize,
     limits: profile.limits,
     unknownEvidence: profile.unknownEvidence,
+    ...(profile.compatibility ? { compatibility: profile.compatibility } : {}),
   };
 }
 
@@ -98,26 +98,11 @@ function parseCandidateEvidence(raw: unknown): PolicyCandidateEvidence[] | null
 function assembleCandidateEvidence(
   config: OcxConfig,
   profile: NonNullable<ReturnType<typeof getRoutingProfile>>,
+  now: number,
 ): PolicyCandidateEvidence[] {
-  // Match execution: fill the same candidate evidence the router would
-  // assemble, so dry-run/evaluate reports the same eligibility as real routing
-  // instead of treating every capability as unknown. Cost is always present so
-  // evaluate mode can surface the profile limit even without a usage estimate.
-  return profile.candidates.map(candidate => ({
-    provider: candidate.provider,
-    model: candidate.model,
-    capability: candidateCapabilityEvidence(config, candidate.provider, candidate.model),
-    health: policyCandidateHealthEvidence(config, candidate),
-    quota: quotaEvidenceForCandidate({
-      provider: candidate.provider,
-      model: candidate.model,
-    }),
-    cost: costEvidenceForCandidate({
-      provider: candidate.provider,
-      model: candidate.model,
-      limitUsd: profile.limits.maxEstimatedCostUsd,
-    }),
-  }));
+  return assemblePolicyCandidateEvidence(config, profile, now, {
+    routedProviderConfig,
+  });
 }
 
 function storedProfile(
@@ -370,13 +355,16 @@ export async function handleRoutingProfileRoutes(ctx: ManagementContext): Promis
     if (!ok) {
       return jsonResponse({ error: { code: "invalid_evidence", message: "evidence must be an object" } }, 400, req, config);
     }
+    // One clock read for both assembly and evaluation keeps freshness, health,
+    // and trace timestamps mutually consistent with the production router.
+    const now = Date.now();
     const candidateEvidence = body.candidates === undefined
-      ? assembleCandidateEvidence(config, resolvedProfile)
+      ? assembleCandidateEvidence(config, resolvedProfile, now)
       : parseCandidateEvidence(body.candidates);
     if (candidateEvidence === null) {
       return jsonResponse({ error: { code: "invalid_candidates", message: "candidates must be an array of evidence objects" } }, 400, req, config);
     }
-    const result = evaluatePolicyProfile(config, profile, evidence, candidateEvidence);
+    const result = evaluatePolicyProfile(config, profile, evidence, candidateEvidence, now);
     return jsonResponse(result, 200, req, config);
   }
 

package/src/server/management-api.ts

@@ -69,6 +69,7 @@ import { handleOauthAccountRoutes } from "./management/oauth-account-routes";
 import { handleComboRoutes } from "./management/combo-routes";
 import { handleSystemRoutes } from "./management/system-routes";
 import { handleLabRoutes } from "./management/lab-routes";
+import { handleLabAutomationRoutes } from "./management/lab-automation-routes";
 import { handleSidebarRoutes } from "./management/sidebar-routes";
 import { handleIntegrationRoutes } from "./management/integration-routes";
 import { handleNativeIntegrationRoutes } from "./management/native-integration-routes";
@@ -188,6 +189,7 @@ export async function handleManagementAPI(
     ??     (await handleOauthAccountRoutes(ctx))
     ??     (await handleComboRoutes(ctx))
     ??     (await handleSystemRoutes(ctx))
+    ??     (await handleLabAutomationRoutes(ctx))
     ??     (await handleLabRoutes(ctx))
       ?? (await handleSidebarRoutes(ctx));
   } catch (error) {

package/src/server/management-auth.ts

@@ -13,6 +13,14 @@ import {
 } from "node:fs";
 import { dirname, join } from "node:path";
 import { adminApiTokenFilePath } from "../lib/admin-secrets";
+import {
+  LOCAL_MANAGEMENT_CAPABILITY_HEADER,
+  LOCAL_MANAGEMENT_CAPABILITY_EXPIRES_AT_HEADER,
+  LOCAL_MANAGEMENT_EXPECTED_PID_HEADER,
+  LOCAL_MANAGEMENT_NONCE_HEADER,
+  parseExpectedLocalManagementPid,
+  verifyLocalManagementReadCapability,
+} from "../lib/local-management-capability";
 import {
   SYSTEM_RESTART_CAPABILITY_HEADER,
   SYSTEM_RESTART_EXPECTED_PID_HEADER,
@@ -34,6 +42,9 @@ import {
 
 const GUI_SESSION_TTL_MS = 5 * 60_000;
 const GUI_SESSION_LIMIT = 128;
+const LOCAL_READ_REPLAY_LIMIT = 256;
+const consumedLocalReadCapabilities = new Map<string, number>();
+const admittedLocalReadRequests = new WeakSet<Request>();
 
 interface GuiSessionRecord {
   csrfToken: string;
@@ -253,10 +264,15 @@ export function issueGuiSession(
  * minted for a browser, and it only authorizes a mutation after the origin and the
  * per-session CSRF token match. Consent-bearing routes must key off this value
  * rather than off request headers, which the token holder can forge freely.
- * `system-restart-capability` is a process-scoped HMAC accepted only for the exact
- * restart route and bound to the current process PID and listening port.
+ * The capability principals are process-scoped HMACs bound to the current process
+ * PID and listening port. Local reads are accepted only for two exact GET paths;
+ * restart remains a separate wire contract for its exact POST.
  */
-export type ManagementPrincipal = "admin-token" | "gui-session" | "system-restart-capability";
+export type ManagementPrincipal =
+  | "admin-token"
+  | "gui-session"
+  | "local-read-capability"
+  | "system-restart-capability";
 
 export interface LocalManagementAuthContext {
   attestationSecret: string;
@@ -291,6 +307,53 @@ function hasSystemRestartCapability(
   );
 }
 
+function hasLocalReadCapability(
+  req: Request,
+  local: LocalManagementAuthContext | undefined,
+): boolean {
+  // requireManagementAuth and managementPrincipal inspect the same Request in
+  // sequence. Preserve that one admission without accepting a replayed request.
+  if (admittedLocalReadRequests.has(req)) return true;
+  if (!local || req.method !== "GET") return false;
+  let url: URL;
+  try {
+    url = new URL(req.url);
+  } catch {
+    return false;
+  }
+  // Do not let a future query-bearing variant silently inherit this narrow grant.
+  if (url.search !== "") return false;
+  const expectedPid = parseExpectedLocalManagementPid(
+    req.headers.get(LOCAL_MANAGEMENT_EXPECTED_PID_HEADER),
+  );
+  if (expectedPid.kind !== "present" || expectedPid.pid !== local.pid) return false;
+  const expiresAtRaw = req.headers.get(LOCAL_MANAGEMENT_CAPABILITY_EXPIRES_AT_HEADER);
+  if (!expiresAtRaw || !/^[1-9]\d*$/.test(expiresAtRaw)) return false;
+  const expiresAt = Number(expiresAtRaw);
+  if (!Number.isSafeInteger(expiresAt)) return false;
+  const capability = req.headers.get(LOCAL_MANAGEMENT_CAPABILITY_HEADER);
+  const now = Date.now();
+  if (!verifyLocalManagementReadCapability(
+    local.attestationSecret,
+    req.headers.get(LOCAL_MANAGEMENT_NONCE_HEADER),
+    req.method,
+    url.pathname,
+    local.pid,
+    local.port,
+    expiresAt,
+    capability,
+    now,
+  )) return false;
+  for (const [consumed, retainedUntil] of consumedLocalReadCapabilities) {
+    if (retainedUntil <= now) consumedLocalReadCapabilities.delete(consumed);
+  }
+  if (!capability || consumedLocalReadCapabilities.has(capability)) return false;
+  if (consumedLocalReadCapabilities.size >= LOCAL_READ_REPLAY_LIMIT) return false;
+  consumedLocalReadCapabilities.set(capability, expiresAt);
+  admittedLocalReadRequests.add(req);
+  return true;
+}
+
 /**
  * The principal for a request that already passed `requireManagementAuth`. Kept as a
  * separate resolution (rather than a changed return type) so every existing caller
@@ -305,6 +368,7 @@ export function managementPrincipal(
   local?: LocalManagementAuthContext,
 ): ManagementPrincipal | null {
   if (hasSystemRestartCapability(req, local)) return "system-restart-capability";
+  if (hasLocalReadCapability(req, local)) return "local-read-capability";
   if (!state.available) return null;
   const actual = req.headers.get("x-opencodex-api-key")?.trim()
     || req.headers.get("authorization")?.replace(/^Bearer\s+/i, "").trim();
@@ -322,6 +386,7 @@ export function requireManagementAuth(
   local?: LocalManagementAuthContext,
 ): Response | null {
   if (hasSystemRestartCapability(req, local)) return null;
+  if (hasLocalReadCapability(req, local)) return null;
   if (!state.available) {
     return Response.json({
       error: "management API unavailable",