@bitkyc08/opencodex 2.18.2 → 2.20.0

package/src/server/effort-policy.ts

@@ -98,6 +98,24 @@ export function effortCapAppliesTo(
  * validates against that backend. A custom responses provider (key mode) serving a
  * native-looking bare id must NOT inherit the unrelated native ladder.
  */
+/**
+ * Empty ladders mean "no effort control", not "this model cannot emit reasoning".
+ * Drop only `effort` so a Chat Completions `include_reasoning` / `reasoning.summary`
+ * request still reaches parseRequest and is not hidden by hideThinkingSummary.
+ */
+export function stripEmptyLadderEffort(
+  reasoning: unknown,
+  ladder: readonly string[] | undefined,
+): unknown {
+  if (ladder === undefined || ladder.length > 0) return reasoning;
+  if (reasoning === undefined || reasoning === null || typeof reasoning !== "object" || Array.isArray(reasoning)) {
+    return reasoning;
+  }
+  const next = { ...(reasoning as Record<string, unknown>) };
+  delete next.effort;
+  return Object.keys(next).length > 0 ? next : undefined;
+}
+
 export function supportedLadderFor(route: { provider: OcxProviderConfig; modelId: string }): string[] | undefined {
   const { provider, modelId } = route;
   if (modelInList(provider.noReasoningModels, modelId)) return [];

package/src/server/management/combo-routes.ts

@@ -65,6 +65,16 @@ import type { MetricUnavailableReason, TokPerSecondResult, CostEstimateReason, C
 import type { ManagementContext } from "./context";
 import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
 
+
+/** Management wire shape: omit default imageInput "auto" (persist/response sparse). */
+function sparseComboConfig<T extends { imageInput?: "auto" | "disabled" }>(combo: T): Omit<T, "imageInput"> & { imageInput?: "disabled" } {
+  const { imageInput, ...rest } = combo;
+  return {
+    ...rest,
+    ...(imageInput === "disabled" ? { imageInput: "disabled" as const } : {}),
+  };
+}
+
 export async function handleComboRoutes(ctx: ManagementContext): Promise<Response | null> {
   const { req, url, config, deps, convergeCodexCatalog, syncClaudeAgentDefsBestEffort } = ctx;
 
@@ -75,7 +85,7 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
       return {
         id,
         model: comboPublicModelId(id, combo),
-        ...combo,
+        ...sparseComboConfig(combo),
       };
     }) });
   }
@@ -124,10 +134,12 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
     });
     if (error) return jsonResponse({ error }, 400);
     const normalized = normalizeComboConfig(body.combo as import("../../types").OcxComboConfig);
+    // Persist only non-default identity/capability fields so config stays sparse.
     const {
       alias: normalizedAlias,
       nativeAlias: normalizedNativeAlias,
       displayName: normalizedDisplayName,
+      imageInput: normalizedImageInput,
       ...normalizedBase
     } = normalized;
     const stored: import("../../types").OcxComboConfig = {
@@ -135,6 +147,7 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
       ...(normalizedAlias ? { alias: normalizedAlias } : {}),
       ...(normalizedNativeAlias ? { nativeAlias: true } : {}),
       ...(normalizedDisplayName ? { displayName: normalizedDisplayName } : {}),
+      ...(normalizedImageInput === "disabled" ? { imageInput: "disabled" as const } : {}),
     };
     const sourceId = renameFrom ?? id;
     const previous = config.combos?.[sourceId];
@@ -221,7 +234,8 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
     }
     const catalogRefresh = await convergeCodexCatalog();
     if (shouldSyncClaudeAgentDefs) await syncClaudeAgentDefsBestEffort();
-    return jsonResponse({ success: true, id, model: newPublicModel, combo: stored, catalogRefresh });
+    // Wire shape matches persistence: omit default imageInput "auto".
+    return jsonResponse({ success: true, id, model: newPublicModel, combo: sparseComboConfig(stored), catalogRefresh });
   }
 
   if (url.pathname === "/api/combos" && req.method === "DELETE") {

package/src/server/management/config-routes.ts

@@ -85,6 +85,7 @@ import { filterRequestLogs, getRequestLogEntries, type RequestLogEntry } from ".
 import { estimateComboCost, estimateRequestCost, normalizeCostTokens, tokensPerSecond } from "../../usage/cost";
 import type { PersistedUsageAttempt } from "../../usage/log";
 import { isAllowedRequestOrigin, jsonResponse, providerManagementConfigError, publicProviderBaseUrl, safeConfigDTO } from "../auth-cors";
+import { withProviderServiceTierDTO } from "./provider-capability-config";
 import { applySystemEnvToggle } from "../system-env";
 import { getCachedStartupHealth, invalidateStartupHealthCache } from "../startup-health-cache";
 import { runWindowsTrayAction } from "../windows-tray-control";
@@ -134,8 +135,9 @@ function publicVisionSidecarSettings(
 
 export async function handleConfigRoutes(ctx: ManagementContext): Promise<Response | null> {
   const { req, url, config, deps, convergeCodexCatalog, syncClaudeAgentDefsBestEffort } = ctx;
+  const readStartupHealth = deps.getCachedStartupHealth ?? getCachedStartupHealth;
   if (url.pathname === "/api/config" && req.method === "GET") {
-    return jsonResponse(safeConfigDTO(config));
+    return jsonResponse(withProviderServiceTierDTO(safeConfigDTO(config), config));
   }
 
   if (url.pathname === "/api/config" && req.method === "PUT") {
@@ -189,7 +191,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       streamMode: config.streamMode ?? "auto",
       appOwnedMemoryBudgetMb: config.appOwnedMemoryBudgetMb ?? 256,
       codexAccountPickerEnabled: codexAccountPickerEnabled(config),
-      startupHealth: await getCachedStartupHealth(config),
+      startupHealth: await readStartupHealth(config),
       codexRuntime: {
         path: displayCodexRuntimePath(resolved.runtime.command),
         version: resolved.runtime.version,
@@ -211,7 +213,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
   }
 
   if (url.pathname === "/api/startup-health" && req.method === "GET") {
-    return jsonResponse(await getCachedStartupHealth(config));
+    return jsonResponse(await readStartupHealth(config));
   }
 
   if (url.pathname === "/api/startup-action" && req.method === "POST") {
@@ -368,7 +370,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       appOwnedMemoryBudgetMb: config.appOwnedMemoryBudgetMb ?? 256,
       codexAccountPickerEnabled: pickerIsEnabled,
       catalogRefreshPending,
-      startupHealth: await getCachedStartupHealth(config),
+      startupHealth: await readStartupHealth(config),
     });
   }
 

package/src/server/management/context.ts

@@ -1,5 +1,6 @@
 import type { OcxConfig } from "../../types";
 import type { NativeProfileApiDeps } from "../../codex/native-profile-api";
+import type { StartupHealth } from "../../codex/autostart-health";
 import type { StartupInstallAction } from "../startup-action-control";
 import type { ManagementPrincipal } from "../management-auth";
 import type { CatalogModel } from "../../codex/catalog";
@@ -7,11 +8,17 @@ import type { injectGrokConfig } from "../../grok/inject";
 import type { removeDesktop3pStandardPivot, writeDesktop3pConfig } from "../../claude/desktop-3p";
 import type { RuntimePortState } from "../../config";
 import type { CatalogDisposition, ConvergeCodex } from "../../codex/convergence-types";
+import type {
+  performCodexRestart,
+  readCodexAppServerState,
+} from "../../codex/app-server-restart-service";
 
 export interface ManagementApiDeps {
   toggleCodexMultiAgentV2?: (enabled: boolean) => void;
   toggleDefaultModeRequestUserInput?: (enabled: boolean) => void;
   createManagementConvergeCodex?: (config: Readonly<OcxConfig>) => ConvergeCodex;
+  /** Startup-health seam keeps route tests from launching platform probes. */
+  getCachedStartupHealth?: (config: Pick<OcxConfig, "codexAutoStart">) => Promise<StartupHealth>;
   /**
    * Persistence seam for route-level tests. Production leaves this unset and uses
    * `saveConfigPreservingClaudeCode`; tests that pass an in-memory fixture config
@@ -52,6 +59,16 @@ export interface ManagementApiDeps {
    * Native-main profile persistence seam for server-boundary tests. Production
    * leaves this unset, so the route creates its normal NativeProfileManager.
    */
+  /**
+   * Codex app-server restart seam (devlog/_plan/260815_gui_codex_restart).
+   * Grouped rather than three separate fields: the route is an adapter over one
+   * service, and a route test that could not stub it would really terminate the
+   * developer's own Codex app-servers.
+   */
+  codexRestartService?: {
+    readState: typeof readCodexAppServerState;
+    performRestart: typeof performCodexRestart;
+  };
   nativeProfileApi?: NativeProfileApiDeps;
 }
 

package/src/server/management/lab-routes.ts

@@ -14,6 +14,7 @@
  */
 
 import {
+  ARTIFACT_CLASSES,
   EVIDENCE_LAYERS,
   EXECUTION_MODES,
   EVENT_KINDS,
@@ -30,6 +31,7 @@ import {
   LabProjectionIncompatibleError,
   LabProjectionUnavailableError,
   LAB_QUERY_MAX_PAGE_SIZE,
+  PASSIVE_PRODUCTION_MAX_LIMIT,
   queryLabArtifactByDigest,
   queryLabArtifacts,
   queryLabCatalogEntries,
@@ -42,6 +44,15 @@ import {
   queryLabVerdicts,
   queryPassiveProductionSignals,
 } from "../../lab/query";
+import {
+  exportLocalPublicEvidence,
+  importCommunityEvidenceValue,
+  listCommunityEvidenceContext,
+  parseStrictPublicJson,
+  previewLocalPublicEvidence,
+  summarizePublicEvidenceVerification,
+  PublicEvidenceValidationError,
+} from "../../lab/public";
 import { jsonResponse } from "../auth-cors";
 import type { ManagementContext } from "./context";
 
@@ -75,20 +86,24 @@ function projectionErrorResponse(err: unknown, ctx: ManagementContext): Response
   return null;
 }
 
-function parseLimit(raw: string | null, ctx: ManagementContext): number | undefined | Response {
+function parseLimit(
+  raw: string | null,
+  ctx: ManagementContext,
+  max = LAB_QUERY_MAX_PAGE_SIZE,
+): number | undefined | Response {
   const parsed = raw === null ? undefined : parseQueryInt(raw);
   if (parsed === "invalid") {
     return errorResponse(
       "invalid_limit",
-      `limit must be an integer from 1 to ${LAB_QUERY_MAX_PAGE_SIZE}`,
+      `limit must be an integer from 1 to ${max}`,
       400,
       ctx,
     );
   }
-  if (parsed !== undefined && (parsed < 1 || parsed > LAB_QUERY_MAX_PAGE_SIZE)) {
+  if (parsed !== undefined && (parsed < 1 || parsed > max)) {
     return errorResponse(
       "invalid_limit",
-      `limit must be an integer from 1 to ${LAB_QUERY_MAX_PAGE_SIZE}`,
+      `limit must be an integer from 1 to ${max}`,
       400,
       ctx,
     );
@@ -155,7 +170,7 @@ function parseExecutionMode(raw: string | null, ctx: ManagementContext): Executi
   if (!raw) return undefined;
   const trimmed = raw.trim();
   if (!EXECUTION_MODES.includes(trimmed as ExecutionMode)) {
-    return errorResponse("invalid_execution_mode", "executionMode must be a supported execution mode", 400, ctx);
+    return errorResponse("invalid_execution_mode", "executionMode must be a supported lab execution mode", 400, ctx);
   }
   return trimmed as ExecutionMode;
 }
@@ -186,9 +201,154 @@ function paginatedEnvelope<T>(page: { items: T[]; nextCursor?: string; hasMore:
   };
 }
 
+const MAX_PUBLIC_REQUEST_BYTES = 2 * 1024 * 1024;
+
+async function readBoundedPublicJson(req: Request): Promise<unknown> {
+  const lengthRaw = req.headers.get("content-length");
+  if (lengthRaw) {
+    const length = Number(lengthRaw);
+    if (!Number.isFinite(length) || length < 0 || length > MAX_PUBLIC_REQUEST_BYTES) {
+      throw new PublicEvidenceValidationError(
+        "public_request_too_large",
+        "public evidence request exceeds 2 MiB",
+      );
+    }
+  }
+  if (!req.body) {
+    throw new PublicEvidenceValidationError("public_request_body", "JSON body is required");
+  }
+  const reader = req.body.getReader();
+  const chunks: Uint8Array[] = [];
+  let total = 0;
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > MAX_PUBLIC_REQUEST_BYTES) {
+      await reader.cancel();
+      throw new PublicEvidenceValidationError(
+        "public_request_too_large",
+        "public evidence request exceeds 2 MiB",
+      );
+    }
+    chunks.push(value);
+  }
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return parseStrictPublicJson(bytes, "public evidence request");
+}
+
+function publicEventIds(raw: unknown): string[] {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new PublicEvidenceValidationError("public_request_body", "request body must be an object");
+  }
+  const keys = Object.keys(raw);
+  if (keys.length !== 1 || keys[0] !== "eventIds") {
+    throw new PublicEvidenceValidationError("public_request_body", "only eventIds is accepted");
+  }
+  const eventIds = (raw as { eventIds?: unknown }).eventIds;
+  if (!Array.isArray(eventIds) || !eventIds.every((value) => typeof value === "string")) {
+    throw new PublicEvidenceValidationError("public_request_body", "eventIds must be a string array");
+  }
+  return eventIds as string[];
+}
+
+function publicBundleValue(raw: unknown): unknown {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new PublicEvidenceValidationError("public_request_body", "request body must be an object");
+  }
+  const keys = Object.keys(raw);
+  if (keys.length !== 1 || keys[0] !== "bundle") {
+    throw new PublicEvidenceValidationError("public_request_body", "only bundle is accepted");
+  }
+  return (raw as { bundle?: unknown }).bundle;
+}
+
+function publicErrorResponse(err: unknown, ctx: ManagementContext): Response {
+  if (err instanceof PublicEvidenceValidationError) {
+    const status = err.code === "community_cache_busy" ? 503 : 400;
+    const response = errorResponse(err.code, err.message, status, ctx);
+    if (status === 503) response.headers.set("Retry-After", "1");
+    return response;
+  }
+  const projected = projectionErrorResponse(err, ctx);
+  if (projected) return projected;
+  return errorResponse("public_evidence_internal", "internal public evidence failure", 500, ctx);
+}
+
 export async function handleLabRoutes(ctx: ManagementContext): Promise<Response | null> {
   const { url, req, config } = ctx;
   if (!url.pathname.startsWith("/api/lab")) return null;
+
+  if (req.method === "GET" && url.pathname === "/api/lab/public/community") {
+    try {
+      return jsonResponse(listCommunityEvidenceContext(), 200, req, config);
+    } catch (err) {
+      return publicErrorResponse(err, ctx);
+    }
+  }
+
+  if (req.method === "POST") {
+    if (url.pathname === "/api/lab/public/preview") {
+      try {
+        const body = await readBoundedPublicJson(req);
+        return jsonResponse(
+          previewLocalPublicEvidence({ eventIds: publicEventIds(body) }),
+          200,
+          req,
+          config,
+        );
+      } catch (err) {
+        return publicErrorResponse(err, ctx);
+      }
+    }
+    if (url.pathname === "/api/lab/public/export") {
+      try {
+        const body = await readBoundedPublicJson(req);
+        return jsonResponse(
+          exportLocalPublicEvidence({ eventIds: publicEventIds(body) }),
+          200,
+          req,
+          config,
+        );
+      } catch (err) {
+        return publicErrorResponse(err, ctx);
+      }
+    }
+    if (url.pathname === "/api/lab/public/verify") {
+      try {
+        const body = await readBoundedPublicJson(req);
+        const result = summarizePublicEvidenceVerification(publicBundleValue(body));
+        return jsonResponse(
+          result,
+          result.status === "cryptographically_valid" ? 200 : 400,
+          req,
+          config,
+        );
+      } catch (err) {
+        return publicErrorResponse(err, ctx);
+      }
+    }
+    if (url.pathname === "/api/lab/public/community/import") {
+      try {
+        const body = await readBoundedPublicJson(req);
+        return jsonResponse(
+          importCommunityEvidenceValue(publicBundleValue(body)),
+          200,
+          req,
+          config,
+        );
+      } catch (err) {
+        return publicErrorResponse(err, ctx);
+      }
+    }
+    return null;
+  }
+
   if (req.method !== "GET") return null;
 
   if (url.pathname === "/api/lab/status") {
@@ -198,7 +358,7 @@ export async function handleLabRoutes(ctx: ManagementContext): Promise<Response
   if (url.pathname === "/api/lab/production-signals") {
     const subjectId = url.searchParams.get("subjectId")?.trim();
     if (!subjectId) return errorResponse("invalid_subject", "subjectId is required", 400, ctx);
-    const limit = parseLimit(url.searchParams.get("limit"), ctx);
+    const limit = parseLimit(url.searchParams.get("limit"), ctx, PASSIVE_PRODUCTION_MAX_LIMIT);
     if (limit instanceof Response) return limit;
     try {
       return jsonResponse(queryPassiveProductionSignals(subjectId, limit), 200, req, config);
@@ -213,10 +373,7 @@ export async function handleLabRoutes(ctx: ManagementContext): Promise<Response
     if (layerParsed instanceof Response) return layerParsed;
     const suiteId = url.searchParams.get("suiteId")?.trim() || url.searchParams.get("suite")?.trim() || undefined;
     try {
-      const scenarios = queryLabCatalogEntries({
-        layer: layerParsed,
-        suiteId,
-      });
+      const scenarios = queryLabCatalogEntries({ layer: layerParsed, suiteId });
       return jsonResponse({ scenarios }, 200, req, config);
     } catch (err) {
       const mapped = projectionErrorResponse(err, ctx);
@@ -255,11 +412,7 @@ export async function handleLabRoutes(ctx: ManagementContext): Promise<Response
     const limit = parseLimit(url.searchParams.get("limit"), ctx);
     if (limit instanceof Response) return limit;
     try {
-      const page = queryLabSubjects(
-        url.searchParams.get("kind")?.trim() || undefined,
-        url.searchParams.get("cursor"),
-        limit,
-      );
+      const page = queryLabSubjects(url.searchParams.get("kind")?.trim() || undefined, url.searchParams.get("cursor"), limit);
       return jsonResponse(paginatedEnvelope(page, "subjects"), 200, req, config);
     } catch (err) {
       const mapped = projectionErrorResponse(err, ctx);
@@ -323,9 +476,10 @@ export async function handleLabRoutes(ctx: ManagementContext): Promise<Response
     const eventKind = parseEventKind(url.searchParams.get("eventKind"), ctx);
     if (eventKind instanceof Response) return eventKind;
     const excludedRaw = url.searchParams.get("excluded");
-    let excluded: boolean | undefined;
-    if (excludedRaw === "true") excluded = true;
-    else if (excludedRaw === "false") excluded = false;
+    if (excludedRaw !== null && excludedRaw !== "true" && excludedRaw !== "false") {
+      return errorResponse("invalid_excluded", "excluded must be true or false", 400, ctx);
+    }
+    const excluded = excludedRaw === "true" ? true : excludedRaw === "false" ? false : undefined;
     try {
       const page = queryLabEvents({
         eventKind,
@@ -367,6 +521,14 @@ export async function handleLabRoutes(ctx: ManagementContext): Promise<Response
     if (statusRaw && !["present", "corrupt", "purged_unavailable"].includes(statusRaw)) {
       return errorResponse("invalid_status", "status must be present, corrupt, or purged_unavailable", 400, ctx);
     }
+    if (artifactClass && !ARTIFACT_CLASSES.includes(artifactClass as (typeof ARTIFACT_CLASSES)[number])) {
+      return errorResponse(
+        "invalid_artifact_class",
+        "artifactClass must be a supported artifact class",
+        400,
+        ctx,
+      );
+    }
     try {
       const page = queryLabArtifacts({
         status: statusRaw as "present" | "corrupt" | "purged_unavailable" | undefined,
@@ -398,4 +560,4 @@ export async function handleLabRoutes(ctx: ManagementContext): Promise<Response
   }
 
   return null;
-}
+}

package/src/server/management/model-routes.ts

@@ -29,6 +29,46 @@ function readInputModalities(raw: unknown): { values?: string[]; error?: string
   }
   return { values: raw as string[] };
 }
+
+/**
+ * Custom-row reasoning ladder. Labels are validated against the Codex ladder (low..ultra)
+ * exactly like provider `modelReasoningEfforts` values; unknown labels would otherwise
+ * surface in a catalog the upstream never accepts. An empty array is meaningful (explicit
+ * "no reasoning" hides the effort control) and must be preserved, not cleared.
+ */
+function readReasoningEfforts(raw: unknown): { values?: string[]; error?: string } {
+  if (raw === undefined) return {};
+  if (!Array.isArray(raw)) return { error: "reasoningEfforts must be an array" };
+  const rejected: string[] = [];
+  const values: string[] = [];
+  for (const value of raw) {
+    if (typeof value !== "string") return { error: "reasoningEfforts must contain only strings" };
+    if (!isDeclaredReasoningEffort(value)) { rejected.push(value); continue; }
+    if (!values.includes(value)) values.push(value);
+  }
+  if (rejected.length > 0) {
+    return { error: `unsupported reasoning effort: ${rejected.join(", ")} (allowed: none, minimal, low, medium, high, xhigh, max, ultra)` };
+  }
+  // Canonical order: the catalog writes supported_reasoning_levels in input order and the
+  // fallback default picks the first entry, so a caller-chosen order must not leak through.
+  return { values: canonicalizeReasoningEfforts(values) };
+}
+
+/** Default effort must be a ladder member that the declared ladder actually includes. */
+function readDefaultReasoningEffort(raw: unknown, efforts: string[] | undefined): { value?: string; error?: string } {
+  if (raw === undefined) return {};
+  if (raw === null) return { value: undefined };
+  if (typeof raw !== "string" || !isDeclaredReasoningEffort(raw)) {
+    return { error: "defaultReasoningEffort must be one of: none, minimal, low, medium, high, xhigh, max, ultra" };
+  }
+  if (efforts === undefined || efforts.length === 0) {
+    return { error: "defaultReasoningEffort requires a non-empty reasoningEfforts ladder" };
+  }
+  if (!efforts.includes(raw)) {
+    return { error: `defaultReasoningEffort "${raw}" is not in the declared reasoningEfforts ladder` };
+  }
+  return { value: raw };
+}
 import type { CatalogModel } from "../../codex/catalog";
 import { accountBoundNativeOpenAiSlugsBySelector, catalogModelSlug, configuredNativeAliasSlugs, disabledNativeSlugs, invalidateCodexModelsCache, nativeModelRows, shouldIncludeAccountBoundNativeOpenAi, uniqueCatalogModelsForPublicList } from "../../codex/catalog";
 import { CatalogGatherBusyError } from "../../codex/catalog/provider-fetch";
@@ -71,6 +111,7 @@ import { parseRange, parseUsageSurface, summarizeUsage } from "../../usage/summa
 import { stripCodexRuntimeProviderFields } from "../../codex/auth-context";
 import { getProviderRegistryEntry } from "../../providers/registry";
 import { getDebugLogEntries } from "../../lib/debug-log-buffer";
+import { canonicalizeReasoningEfforts, isDeclaredReasoningEffort } from "../../reasoning-effort";
 import { getInjectionDebugLogEntries } from "../../lib/injection-debug-log";
 import {
   clearDebugSettings,
@@ -330,7 +371,7 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
   }
 
   if (url.pathname === "/api/custom-models" && req.method === "POST") {
-    let body: { provider?: unknown; modelId?: unknown; displayName?: unknown; contextWindow?: unknown; inputModalities?: unknown };
+    let body: { provider?: unknown; modelId?: unknown; displayName?: unknown; contextWindow?: unknown; inputModalities?: unknown; reasoningEfforts?: unknown; defaultReasoningEffort?: unknown };
     try { body = await readManagementJsonBody(req); } catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid JSON body" }, 400); }
     const provider = typeof body.provider === "string" ? body.provider.trim() : "";
     const modelId = typeof body.modelId === "string" ? body.modelId.trim() : "";
@@ -344,6 +385,10 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
     const modalities = readInputModalities(body.inputModalities);
     if (modalities.error) return jsonResponse({ error: modalities.error }, 400);
     const inputModalities = modalities.values;
+    const reasoning = readReasoningEfforts(body.reasoningEfforts);
+    if (reasoning.error) return jsonResponse({ error: reasoning.error }, 400);
+    const defaultEffort = readDefaultReasoningEffort(body.defaultReasoningEffort, reasoning.values);
+    if (defaultEffort.error) return jsonResponse({ error: defaultEffort.error }, 400);
     const existing = config.customModels ?? [];
     const newSlug = routedSlug(provider, modelId);
     if (existing.some(cm => routedSlug(cm.provider, cm.modelId) === newSlug)) {
@@ -356,6 +401,8 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
       ...(displayName ? { displayName } : {}),
       ...(contextWindow ? { contextWindow } : {}),
       ...(inputModalities && inputModalities.length > 0 ? { inputModalities } : {}),
+      ...(reasoning.values !== undefined ? { reasoningEfforts: reasoning.values } : {}),
+      ...(defaultEffort.value ? { defaultReasoningEffort: defaultEffort.value } : {}),
       addedAt: new Date().toISOString(),
     };
     config.customModels = [...existing, entry];
@@ -368,7 +415,7 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
   if (customPutMatch && req.method === "PUT") {
     let id: string;
     try { id = decodeURIComponent(customPutMatch[1]); } catch { return jsonResponse({ error: "invalid id encoding" }, 400); }
-    let body: { displayName?: unknown; contextWindow?: unknown; inputModalities?: unknown; modelId?: unknown };
+    let body: { displayName?: unknown; contextWindow?: unknown; inputModalities?: unknown; modelId?: unknown; reasoningEfforts?: unknown; defaultReasoningEffort?: unknown };
     try { body = await readManagementJsonBody(req); } catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid JSON body" }, 400); }
     const list = config.customModels ?? [];
     const idx = list.findIndex(cm => cm.id === id);
@@ -391,6 +438,33 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
       if (edited.error) return jsonResponse({ error: edited.error }, 400);
       cm.inputModalities = edited.values && edited.values.length > 0 ? edited.values : undefined;
     }
+    // `null` clears the stored ladder back to "inherit from the provider row"; `[]` stays
+    // stored as an explicit "no reasoning" override. The default effort rides along and is
+    // validated against the ladder the row ends up with.
+    if (body.reasoningEfforts !== undefined) {
+      if (body.reasoningEfforts === null) {
+        cm.reasoningEfforts = undefined;
+      } else {
+        const edited = readReasoningEfforts(body.reasoningEfforts);
+        if (edited.error) return jsonResponse({ error: edited.error }, 400);
+        cm.reasoningEfforts = edited.values;
+      }
+    }
+    if (body.defaultReasoningEffort !== undefined) {
+      const edited = readDefaultReasoningEffort(body.defaultReasoningEffort, cm.reasoningEfforts);
+      if (edited.error) return jsonResponse({ error: edited.error }, 400);
+      cm.defaultReasoningEffort = edited.value;
+    }
+    // Mirror of the POST invariant: a default only survives as a member of the final ladder.
+    // Without this, a ladder shrink/clear on a row that was created with a default leaves a
+    // stale default that re-applies itself onto the inherited ladder in the generated catalog
+    // (the GUI toggle-off path sends only reasoningEfforts, never the default).
+    if (cm.defaultReasoningEffort !== undefined) {
+      const ladder = cm.reasoningEfforts;
+      if (!ladder || ladder.length === 0 || !ladder.includes(cm.defaultReasoningEffort)) {
+        cm.defaultReasoningEffort = undefined;
+      }
+    }
     const updatedSlug = routedSlug(cm.provider, cm.modelId);
     if (list.some((other, i) => i !== idx && routedSlug(other.provider, other.modelId) === updatedSlug)) {
       return jsonResponse({ error: "duplicate model" }, 409);

package/src/server/management/model-rows.ts

@@ -91,6 +91,14 @@ export async function listManagementModelRows(config: OcxConfig): Promise<Manage
       displayName: cm.displayName,
       ...(cm.contextWindow ? { contextWindow: cm.contextWindow } : {}),
       ...(cm.inputModalities ? { inputModalities: cm.inputModalities } : {}),
+      // Stored override, not the inherited ladder: the edit dialog must show what the user
+      // set (including an explicit empty "no reasoning" ladder), not what the provider row
+      // happens to advertise today.
+      ...(Array.isArray(cm.reasoningEfforts) ? { reasoningEfforts: [...cm.reasoningEfforts] } : {}),
+      // The stored default rides along so a client reloading /api/models can restore the
+      // full edit state; the GUI has no default-effort control today, but dropping it here
+      // would make any future PUT-based edit lose it silently.
+      ...(cm.defaultReasoningEffort ? { defaultReasoningEffort: cm.defaultReasoningEffort } : {}),
     };
   });
   const publicModels = uniqueCatalogModelsForPublicList(models);

package/src/server/management/provider-capability-config.ts

@@ -0,0 +1,48 @@
+import { booleanRecordConfigError } from "../../config";
+import type { OcxConfig } from "../../types";
+
+/**
+ * Provider-management validation that belongs to the provider editor, not the
+ * request-authentication/CORS boundary. Keeping this here lets the editor
+ * evolve its capability schema without widening the auth-cors security surface.
+ */
+export function providerServiceTierConfigError(name: unknown, provider: unknown): string | null {
+  if (typeof name !== "string" || !provider || typeof provider !== "object" || Array.isArray(provider)) {
+    return null;
+  }
+  const error = booleanRecordConfigError(
+    (provider as { modelSupportsServiceTier?: unknown }).modelSupportsServiceTier,
+    "modelSupportsServiceTier",
+  );
+  return error ? `provider ${name} ${error}` : null;
+}
+
+function publicServiceTierRecord(value: unknown): Record<string, boolean> | undefined {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return undefined;
+  const entries = Object.entries(value).filter(([model, supported]) =>
+    model.trim().length > 0 && typeof supported === "boolean",
+  );
+  return Object.fromEntries(entries) as Record<string, boolean>;
+}
+
+/**
+ * Add the provider editor's capability map to the already secret-free config
+ * DTO. `safeConfigDTO` remains the owner of auth/cors redaction; this helper
+ * only projects a boolean model capability used by the management UI.
+ */
+export function withProviderServiceTierDTO(dto: unknown, config: OcxConfig): unknown {
+  if (!dto || typeof dto !== "object" || Array.isArray(dto)) return dto;
+  const root = dto as { providers?: unknown };
+  if (!root.providers || typeof root.providers !== "object" || Array.isArray(root.providers)) return dto;
+
+  const providers = root.providers as Record<string, unknown>;
+  const projectedProviders: Record<string, unknown> = { ...providers };
+  for (const [name, provider] of Object.entries(config.providers)) {
+    const dtoProvider = providers[name];
+    if (!dtoProvider || typeof dtoProvider !== "object" || Array.isArray(dtoProvider)) continue;
+    const capabilities = publicServiceTierRecord(provider.modelSupportsServiceTier);
+    if (capabilities === undefined) continue;
+    projectedProviders[name] = { ...(dtoProvider as Record<string, unknown>), modelSupportsServiceTier: capabilities };
+  }
+  return { ...root, providers: projectedProviders };
+}