@bitkyc08/opencodex 2.23.0-preview.20260816 → 2.24.0

package/src/routing/health.ts

@@ -372,6 +372,20 @@ export function healthEvidenceForCandidate(input: HealthEvidenceInput): RouteHea
   return evidence;
 }
 
+/**
+ * Deterministic latency score in [0,1] from the recorded p50, shared by the health
+ * composite and the standalone `optimize.latency` term so the two cannot drift apart.
+ *
+ * An unmeasured candidate scores the NEUTRAL midpoint, not 0. Punishing it into last
+ * place would make selection depend on which candidate happened to be exercised first,
+ * which is the order-dependence this scoring exists to remove.
+ */
+export function latencyScoreFromEvidence(evidence: RouteHealthEvidence | undefined): number {
+  const p50 = evidence?.recentLatencyMs;
+  if (p50 === undefined) return 0.5;
+  return Math.max(0, Math.min(1, 1 - p50 / HEALTH_SCORE_CONSTANTS.LATENCY_TARGET_MS));
+}
+
 /**
  * Deterministic health score in [0,1]. Returns null when evidence is unknown
  * (no samples) so callers can apply the profile's unknownEvidence policy.
@@ -383,15 +397,12 @@ export function healthScore(evidence: RouteHealthEvidence | undefined, now = Dat
   if (!evidence.sampleCount || evidence.sampleCount < 1) return null;
   const successRate = evidence.successRate ?? 0;
   const incompleteRate = evidence.incompleteStreamRate ?? 0;
-  const p50 = evidence.recentLatencyMs;
-  const latencyScore = p50 === undefined
-    ? 0.5
-    : Math.max(0, Math.min(1, 1 - p50 / HEALTH_SCORE_CONSTANTS.LATENCY_TARGET_MS));
+  const latency = latencyScoreFromEvidence(evidence);
   const consecutive = evidence.failures ?? 0;
   const recoveryScore = 1 - Math.min(1, consecutive / 5);
   const composite = HEALTH_SCORE_CONSTANTS.SUCCESS_WEIGHT * successRate
     + HEALTH_SCORE_CONSTANTS.INCOMPLETE_WEIGHT * (1 - incompleteRate)
-    + HEALTH_SCORE_CONSTANTS.LATENCY_WEIGHT * latencyScore
+    + HEALTH_SCORE_CONSTANTS.LATENCY_WEIGHT * latency
     + HEALTH_SCORE_CONSTANTS.RECOVERY_WEIGHT * recoveryScore;
   const confidence = Math.min(1, evidence.sampleCount / HEALTH_SCORE_CONSTANTS.MIN_CONFIDENCE_SAMPLES);
   const softAvoid = evidence.softAvoidUntilMs !== undefined && evidence.softAvoidUntilMs > now

package/src/routing/history/schema.ts

@@ -3,7 +3,7 @@
  *
  * `usage.jsonl` remains the canonical append-only evidence ledger;
  * `routing-history.sqlite` is a disposable, rebuildable query projection
- * (ADR-1/ADR-8 in devlog/_plan/260804_router_intelligence/000_master_plan.md).
+ * (ADR-1/ADR-8 in devlog/_fin/260804_router_intelligence/000_master_plan.md).
  */
 
 export const HISTORY_SCHEMA_VERSION = 1;

package/src/routing/trace.ts

@@ -2,7 +2,7 @@
  * Route decision trace: bounded, versioned, privacy-safe evidence of WHY a
  * provider/model/account was selected for a request (RI-01).
  *
- * Contract rules (devlog/_plan/260804_router_intelligence/000_master_plan.md):
+ * Contract rules (devlog/_fin/260804_router_intelligence/000_master_plan.md):
  * - One trace per routing decision; fallback EXECUTION attempts stay in the
  *   usage entry's existing `attempts[]` array, never in this trace.
  * - Never persists prompts, message bodies, tool payloads, credentials,

package/src/server/auth-cors.ts

@@ -16,6 +16,7 @@ import {
   retryOn429PolicyConfigError,
   requestPacingConfigError,
   sanitizeModelCostsForDisplay,
+  upstreamHttpVersionConfigError,
 } from "../config";
 import { providerDestinationConfigError } from "../lib/destination-policy";
 import { redactSecretString } from "../lib/redact";
@@ -310,10 +311,20 @@ function secretEquals(actual: string, expected: string | undefined): boolean {
  * point at, and a sentinel string in the id would collide with a hand-edited
  * entry that happens to be named `loopback`.
  */
+/**
+ * HOW an admission credential was presented.
+ *
+ * The credential IDENTITY (which key matched) and its PRESENTATION (which header carried it)
+ * are different facts, and #1686 needs both: a proxy secret arriving as a bearer on the
+ * Responses transport is admissible, but only if the upstream credential is then guaranteed to
+ * be substituted. Collapsing the two is what made that flow unexpressible.
+ */
+export type DataPlaneAdmissionSource = "loopback" | "dedicated" | "bearer" | "x-api-key";
+
 export type DataPlaneAdmission =
-  | { kind: "configured"; keyId: string }
-  | { kind: "environment" }
-  | { kind: "loopback" };
+  | { kind: "configured"; keyId: string; source: DataPlaneAdmissionSource }
+  | { kind: "environment"; source: DataPlaneAdmissionSource }
+  | { kind: "loopback"; source: "loopback" };
 
 /**
  * Which admission secret `token` is, or null when it is none of them.
@@ -324,12 +335,16 @@ export type DataPlaneAdmission =
  * discarded, which is what makes per-key attribution possible without touching
  * the admission decision itself.
  */
-export function resolveDataPlaneAdmissionSecret(token: string, config: Pick<OcxConfig, "apiKeys">): DataPlaneAdmission | null {
+export function resolveDataPlaneAdmissionSecret(
+  token: string,
+  config: Pick<OcxConfig, "apiKeys">,
+  source: DataPlaneAdmissionSource = "dedicated",
+): DataPlaneAdmission | null {
   const actual = token.trim();
   if (!actual) return null;
-  if (secretEquals(actual, configuredApiAuthToken(config))) return { kind: "environment" };
+  if (secretEquals(actual, configuredApiAuthToken(config))) return { kind: "environment", source };
   for (const k of config.apiKeys ?? []) {
-    if (secretEquals(actual, k.key)) return { kind: "configured", keyId: k.id };
+    if (secretEquals(actual, k.key)) return { kind: "configured", keyId: k.id, source };
   }
   return null;
 }
@@ -376,8 +391,12 @@ export interface ApiAuthMatrixRow {
  * against every cell rather than reading the table back to itself.
  */
 export const AUTH_MATRIX: readonly ApiAuthMatrixRow[] = [
-  { endpoint: "/v1/responses", bearer: "rejected", dedicated: "required", xApiKey: "rejected" },
-  { endpoint: "/v1/chat/completions", bearer: "rejected", dedicated: "required", xApiKey: "rejected" },
+  // #1686: a bearer that is one of OUR admission secrets is now accepted here. It is safe
+  // because materializeCodexUpstreamAuth substitutes the stored main credential rather than
+  // forwarding it; a bearer that is NOT our secret stays unadmitted and remains Codex Direct
+  // passthrough, so the two bearer domains still never mix. `x-api-key` is still rejected.
+  { endpoint: "/v1/responses", bearer: "accepted", dedicated: "accepted", xApiKey: "rejected" },
+  { endpoint: "/v1/chat/completions", bearer: "accepted", dedicated: "accepted", xApiKey: "rejected" },
   { endpoint: "/v1/messages", bearer: "accepted", dedicated: "accepted", xApiKey: "accepted" },
   { endpoint: "/v1/models", bearer: "accepted", dedicated: "accepted", xApiKey: "accepted" },
 ];
@@ -414,13 +433,15 @@ export function validateForwardAdmissionCredential(headers: Headers, config: Ocx
  */
 export function resolveApiAuth(req: Request, config: RequestPolicyView): DataPlaneAdmission | null {
   // A loopback bind never reads a token at all, so there is no key to name.
-  if (!isApiAuthRequired(config)) return { kind: "loopback" };
-  const actual = req.headers.get("x-opencodex-api-key")?.trim()
-    || req.headers.get("authorization")?.replace(/^Bearer\s+/i, "").trim()
-    // Anthropic-SDK clients (Claude Code with ANTHROPIC_API_KEY) authenticate via x-api-key.
-    || req.headers.get("x-api-key")?.trim();
-  if (!actual) return null;
-  return resolveDataPlaneAdmissionSecret(actual, config);
+  if (!isApiAuthRequired(config)) return { kind: "loopback", source: "loopback" };
+  const dedicated = req.headers.get("x-opencodex-api-key")?.trim();
+  if (dedicated) return resolveDataPlaneAdmissionSecret(dedicated, config, "dedicated");
+  const bearer = req.headers.get("authorization")?.replace(/^Bearer\s+/i, "").trim();
+  if (bearer) return resolveDataPlaneAdmissionSecret(bearer, config, "bearer");
+  // Anthropic-SDK clients (Claude Code with ANTHROPIC_API_KEY) authenticate via x-api-key.
+  const apiKey = req.headers.get("x-api-key")?.trim();
+  if (apiKey) return resolveDataPlaneAdmissionSecret(apiKey, config, "x-api-key");
+  return null;
 }
 
 export function hasValidApiAuth(req: Request, config: RequestPolicyView): boolean {
@@ -438,14 +459,23 @@ export function requireApiAuth(req: Request, config: RequestPolicyView, _kind: "
  * domains can never be confused.
  */
 export function resolveResponsesApiAuth(req: Request, config: RequestPolicyView): DataPlaneAdmission | null {
-  if (!isApiAuthRequired(config)) return { kind: "loopback" };
-  // Dedicated header ONLY. `Authorization` on these transports may belong to
-  // Codex Direct passthrough, and the two bearer domains must stay unconfusable.
-  const actual = req.headers.get("x-opencodex-api-key")?.trim();
-  if (!actual) return null;
-  return resolveDataPlaneAdmissionSecret(actual, config);
+  if (!isApiAuthRequired(config)) return { kind: "loopback", source: "loopback" };
+  // The dedicated header still WINS, because it is unambiguous.
+  const dedicated = req.headers.get("x-opencodex-api-key")?.trim();
+  if (dedicated) return resolveDataPlaneAdmissionSecret(dedicated, config, "dedicated");
+  // #1686: a bearer may also be one of OUR admission secrets. Rejecting it outright meant a
+  // Codex client configured with `env_key` could not reach Direct at all. Admitting it is only
+  // safe because the upstream credential is then SUBSTITUTED rather than forwarded -- see
+  // materializeCodexUpstreamAuth. A bearer that is NOT our secret stays unadmitted here and
+  // remains Codex Direct passthrough, so the two bearer domains still never mix.
+  const bearer = req.headers.get("authorization")?.replace(/^Bearer\s+/i, "").trim();
+  if (bearer) return resolveDataPlaneAdmissionSecret(bearer, config, "bearer");
+  // `x-api-key` is deliberately NOT accepted on this transport.
+  return null;
 }
 
+
+
 export function requireResponsesApiAuth(req: Request, config: RequestPolicyView): Response | null {
   if (resolveResponsesApiAuth(req, config)) return null;
   return formatErrorResponse(401, "authentication_error", "opencodex API key required");
@@ -463,6 +493,37 @@ function sameCanonicalProviderSeed(actual: Record<string, unknown>, expected: Oc
   return actualKeys.every(key => JSON.stringify(actual[key]) === JSON.stringify((expected as unknown as Record<string, unknown>)[key]));
 }
 
+function positiveWindowValue(value: unknown): boolean {
+  return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+}
+
+/**
+ * Shape-check the two context overlays before the canonical seed comparison drops them.
+ *
+ * `null` means "clear this" and is normalized by the PATCH field mask, but this validator
+ * also runs for POST and reload, where a whole provider object lands on disk verbatim. A
+ * `null` surviving there would be a value no reader expects, so full objects must carry a
+ * real number or omit the field.
+ */
+function nativeContextOverlayError(raw: Record<string, unknown>): string | null {
+  if (Object.hasOwn(raw, "contextWindow") && !positiveWindowValue(raw.contextWindow)) {
+    return "provider openai contextWindow must be a positive safe integer";
+  }
+  if (Object.hasOwn(raw, "modelContextWindows")) {
+    const windows = raw.modelContextWindows;
+    if (typeof windows !== "object" || windows === null || Array.isArray(windows)) {
+      return "provider openai modelContextWindows must be a plain object";
+    }
+    for (const [model, value] of Object.entries(windows as Record<string, unknown>)) {
+      if (model.trim() === "") return "provider openai modelContextWindows keys must be nonblank model ids";
+      if (!positiveWindowValue(value)) {
+        return "provider openai modelContextWindows values must be positive safe integers";
+      }
+    }
+  }
+  return null;
+}
+
 /**
  * Validate a provider object arriving at the management write boundary. Returns an error
  * string, or null when the provider may be persisted. Caller-controlled names/fields are
@@ -492,6 +553,15 @@ export function providerManagementConfigError(name: unknown, provider: unknown):
     delete canonicalCandidate.modelCosts;
     // requestPacing is a user-owned transport overlay, not part of the canonical seed.
     delete canonicalCandidate.requestPacing;
+    // Context windows are the same kind of user-owned overlay as requestPacing: the operator
+    // narrowing what their own native rows advertise. They can only ever LOWER the measured
+    // window (see nativeOpenAiContextWindow), so admitting them cannot widen what the proxy
+    // claims. Validated first — this function also guards POST/reload, where nothing
+    // normalizes the shape afterwards, so a bad value would reach disk.
+    const contextOverlayError = nativeContextOverlayError(raw);
+    if (contextOverlayError) return contextOverlayError;
+    delete canonicalCandidate.contextWindow;
+    delete canonicalCandidate.modelContextWindows;
     const canonical = seed && sameCanonicalProviderSeed(canonicalCandidate, seed);
     if (!canonical) {
       return `provider ${name} must equal the canonical built-in provider seed`;
@@ -520,6 +590,10 @@ export function providerManagementConfigError(name: unknown, provider: unknown):
   if (requestPacingError) {
     return `provider ${JSON.stringify(redactSecretString(name))} ${requestPacingError}`;
   }
+  const upstreamHttpVersionError = upstreamHttpVersionConfigError(raw.upstreamHttpVersion);
+  if (upstreamHttpVersionError) {
+    return `provider ${JSON.stringify(redactSecretString(name))} ${upstreamHttpVersionError}`;
+  }
   const modelCostsError = providerModelCostsConfigError(raw.modelCosts);
   if (modelCostsError) {
     // The provider name is caller-controlled and can be token-shaped; redact and JSON-escape
@@ -640,6 +714,7 @@ export function safeConfigDTO(config: OcxConfig): unknown {
       "noTopPModels",
       "noPenaltyModels",
       "noStructuredOutputModels",
+      "upstreamHttpVersion",
       "autoToolChoiceOnlyModels",
       "preserveReasoningContentModels",
       "requiresReasoningPlaceholderModels",

package/src/server/chat-completions.ts

@@ -37,6 +37,7 @@ import {
 import { responseWithDeferredRequestLog } from "./relay";
 import { handleResponses } from "./responses";
 import type { AdmissionLease } from "../lib/admission";
+import type { DataPlaneAdmission } from "./auth-cors";
 import { tryClaimNativeMainProfileForTurn } from "../codex/native-main-admission";
 import {
   createTranslatorBudget,
@@ -64,7 +65,7 @@ export async function handleChatCompletions(
   req: Request,
   config: OcxConfig,
   logCtx: RequestLogContext,
-  logIds?: { requestId: string; start: number; turnAdmissionLease?: AdmissionLease },
+  logIds?: { requestId: string; start: number; turnAdmissionLease?: AdmissionLease; admission?: DataPlaneAdmission },
 ): Promise<Response> {
   const translatorBudget = createTranslatorBudget();
   try {
@@ -83,7 +84,7 @@ async function handleChatCompletionsWithBudget(
   config: OcxConfig,
   logCtx: RequestLogContext,
   translatorBudget: TranslatorBudget,
-  logIds?: { requestId: string; start: number; turnAdmissionLease?: AdmissionLease },
+  logIds?: { requestId: string; start: number; turnAdmissionLease?: AdmissionLease; admission?: DataPlaneAdmission },
 ): Promise<Response> {
   let chatBody: Rec;
   try {
@@ -251,6 +252,9 @@ async function handleChatCompletionsWithBudget(
   };
   const upstream = await handleResponses(internalReq, config, logCtx, {
     ...(logIds?.turnAdmissionLease ? { turnAdmissionLease: logIds.turnAdmissionLease } : {}),
+    // #1686: the Chat surface translates its body and replays here, so the admission fact has
+    // to ride along or a bearer-admitted Chat caller would still be refused by Direct.
+    ...(logIds?.admission ? { admission: logIds.admission } : {}),
     abortSignal: req.signal,
     // Body is Responses-shaped by now, but the client spoke Chat Completions.
     inboundWire: "chat",

package/src/server/chat-native.ts

@@ -7,6 +7,7 @@ import {
   isChatCompletionsStreamError,
 } from "../chat/outbound";
 import { classifyError, CYBER_POLICY_ERROR_CODE, isCyberPolicyCode } from "../lib/errors";
+import type { AdmissionLease } from "../lib/admission";
 import { readBoundedResponseBody } from "../lib/bounded-body";
 import { redactSecretString } from "../lib/redact";
 import { resolveClientRetryAfter } from "../lib/retry-after";
@@ -39,6 +40,7 @@ import {
   type RequestLogContext,
 } from "./request-log";
 import { jsonCompletionSse, nativeChatSse, structuredError, usageFromChat } from "./chat-native-sse";
+import { registerTurn, unregisterTurn } from "./lifecycle";
 
 type Rec = Record<string, unknown>;
 
@@ -78,7 +80,7 @@ interface HandleNativeChatOptions {
   req: Request;
   config: OcxConfig;
   logCtx: RequestLogContext;
-  logIds?: { requestId: string; start: number };
+  logIds?: { requestId: string; start: number; turnAdmissionLease?: AdmissionLease };
   route: RouteResult;
   chatBody: Rec;
   requestedModel: string;
@@ -122,6 +124,21 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
 
   const upstream = new AbortController();
   const cleanupAbort = linkAbortSignal(upstream, req.signal);
+  // nativeChatSse already owns the translated stream's async pull/cancel path.
+  // Bind the lease to that same controller and its terminal callbacks instead
+  // of adding another trackStreamLifetime wrapper (unsafe on bundled Bun#32111).
+  let streamTurnRegistered = false;
+  const transferTurnToStream = () => {
+    const lease = logIds?.turnAdmissionLease;
+    if (!lease || typeof (lease as { bindAbortController?: unknown }).bindAbortController !== "function") return;
+    registerTurn(upstream, lease);
+    streamTurnRegistered = true;
+  };
+  const releaseStreamTurn = () => {
+    if (!streamTurnRegistered) return;
+    streamTurnRegistered = false;
+    unregisterTurn(upstream);
+  };
   const connectMs = config.connectTimeoutMs ?? 200_000;
   let activeProvider: OcxProviderConfig = route.provider;
   let activeAdapter: ProviderAdapter = createOpenAIChatAdapter(activeProvider);
@@ -276,6 +293,7 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
 
   const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
   if (contentType.includes("text/event-stream") && response.body) {
+    if (requestedStream) transferTurnToStream();
     const stream = nativeChatSse(response.body, {
       requestedModel,
       translatorBudget,
@@ -287,13 +305,21 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
       },
       ...(requestedStream ? {
         onTerminal: (status: number, message?: string) => {
-          cleanupAbort();
-          finishLog(status, message, "terminal");
+          try {
+            cleanupAbort();
+            finishLog(status, message, "terminal");
+          } finally {
+            releaseStreamTurn();
+          }
         },
         onCancel: () => {
-          cleanupAbort();
-          upstream.abort();
-          finishLog(499, undefined, "client_cancel");
+          try {
+            cleanupAbort();
+            upstream.abort();
+            finishLog(499, undefined, "client_cancel");
+          } finally {
+            releaseStreamTurn();
+          }
         },
       } : {}),
     });

package/src/server/index.ts

@@ -958,7 +958,7 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
             : idsParam === "desktop"
               ? "desktop3p" as const
               : (/^claude-code\//i.test(req.headers.get("user-agent") ?? "") ? "readable" as const : "desktop3p" as const);
-          const data = buildAnthropicModelInfos([...desktopVisibleNativeSlugs(config)], goOrdered, resolveAutoContext(config.claudeCode), idStyle, activeDesktop3pAlias);
+          const data = buildAnthropicModelInfos([...desktopVisibleNativeSlugs(config)], goOrdered, resolveAutoContext(config.claudeCode), idStyle, activeDesktop3pAlias, providerContextCap(config, OPENAI_CODEX_PROVIDER_ID));
           return jsonResponse({ data }, 200, req, policy);
         }
         if (url.searchParams.has("client_version")) {
@@ -1092,7 +1092,7 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
         return runAdmittedHttpTurn(req, policy, async turnAdmissionLease => {
           let response: Response;
           try {
-            response = await handleResponsesCompact(req, config, logCtx, turnAdmissionLease);
+            response = await handleResponsesCompact(req, config, logCtx, turnAdmissionLease, admission);
           } catch {
             response = formatErrorResponse(500, "server_error", "Unexpected compact request failure");
           }
@@ -1214,6 +1214,7 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
         return runAdmittedHttpTurn(req, policy, async turnAdmissionLease => {
           const response = await handleResponses(req, config, logCtx, {
             turnAdmissionLease,
+            admission,
             onRequestBodyRead: () => disableResponsesRequestTimeout(req, requestServer),
             abortSignal: req.signal,
             onFirstOutput: () => recordFirstOutput(logCtx, start),
@@ -1302,7 +1303,7 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
           inboundProtocol: "chat",
         };
         return runAdmittedHttpTurn(req, policy, async turnAdmissionLease => withCors(
-          await handleChatCompletions(req, config, logCtx, { requestId, start, turnAdmissionLease }),
+          await handleChatCompletions(req, config, logCtx, { requestId, start, turnAdmissionLease, admission }),
           req,
           config,
         ));
@@ -1569,6 +1570,7 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
           try {
             let terminalRecorder: ((status: ResponsesTerminalStatus, httpStatusOverride?: number) => void) | undefined;
             const response = await handleResponses(req, config, logCtx, {
+              ...(wsAdmission ? { admission: wsAdmission } : {}),
               forceEmptyResponseId: true,
               inboundTransport: "websocket",
               abortSignal: turnAbort.signal,

package/src/server/management/agent-settings-routes.ts

@@ -31,7 +31,7 @@ import { deriveProviderPresets } from "../../providers/derive";
 import { providerCodexAccountMode } from "../../providers/registry";
 import { routedSlug, slugEquals } from "../../providers/slug-codec";
 import { clearProviderQuotaCache, fetchProviderQuotaReports } from "../../providers/quota";
-import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
+import { isCanonicalOpenAiForwardProvider, OPENAI_CODEX_PROVIDER_ID } from "../../providers/openai-tiers";
 import { clearThreadAccountMap } from "../../codex/routing";
 import { primeCodexPoolQuotas } from "../../codex/auth-api";
 import { DEFAULT_PROVIDER_CONTEXT_CAP, globalContextCapValue, providerContextCap, providerContextCaps, setAllProviderContextCaps, setGlobalContextCapValue, setProviderContextCap } from "../../providers/context-cap";
@@ -207,6 +207,7 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
         current.apiKeys?.[0]?.key,
         "static",
         current.claudeCode.desktopProfile,
+        providerContextCap(current, OPENAI_CODEX_PROVIDER_ID),
       );
       if (result.written && result.fingerprint) {
         current.claudeCode = { ...current.claudeCode, desktopProfile: { ...current.claudeCode.desktopProfile, appliedFingerprint: result.fingerprint, appliedAt: new Date().toISOString() } };
@@ -885,6 +886,7 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
         latest.apiKeys?.[0]?.key,
         mode,
         state.profile,
+        providerContextCap(latest, OPENAI_CODEX_PROVIDER_ID),
       );
       if (!result.written) return jsonResponse({ error: result.reason ?? "Claude Desktop apply failed", saved: true, path: result.path }, 500);
       // Persist applied fingerprint + timestamp so GUI can show saved-vs-applied state.
@@ -976,7 +978,7 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
       if (isDisabled(m.provider, m.id)) continue;
       aliases.push({ id: claudeCodeAlias(m.provider, m.id), display_name: `${m.id} (${m.provider})` });
     }
-    const contextWindows = buildClaudeContextWindows([...visibleNativeSlugs(config)], models);
+    const contextWindows = buildClaudeContextWindows([...visibleNativeSlugs(config)], models, providerContextCap(config, OPENAI_CODEX_PROVIDER_ID));
     const webSearchOverride = config.claudeCode?.webSearchSidecar;
     const visionOverride = config.claudeCode?.visionSidecar;
     // Auto is a RESOLUTION, recomputed per request — never stored state. Detection is
@@ -1005,6 +1007,8 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
       smallFastModel: config.claudeCode?.smallFastModel ?? "",
       tierModels: config.claudeCode?.tierModels ?? {},
       modelMap: config.claudeCode?.modelMap ?? {},
+      classifierModel: config.claudeCode?.classifierModel ?? "",
+      classifierFallbacks: config.claudeCode?.classifierFallbacks ?? [],
       systemEnv: config.claudeCode?.systemEnv === true,
       autoConnectSupported: process.platform === "darwin",
       maxContextTokens: config.claudeCode?.maxContextTokens ?? null,
@@ -1042,7 +1046,7 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
       return prototype === Object.prototype || prototype === null;
     };
     if (!isPlainObject(parsedBody)) return jsonResponse({ error: "body must be an object" }, 400);
-    const body = parsedBody as { enabled?: unknown; authMode?: unknown; model?: unknown; smallFastModel?: unknown; modelMap?: unknown; systemEnv?: unknown; fastMode?: unknown; maxContextTokens?: unknown; alwaysEnableEffort?: unknown; tierModels?: unknown; autoContext?: unknown; autoCompactWindow?: unknown; blockedSkills?: unknown; injectAgents?: unknown; webSearchSidecar?: unknown; visionSidecar?: unknown };
+    const body = parsedBody as { enabled?: unknown; authMode?: unknown; model?: unknown; smallFastModel?: unknown; modelMap?: unknown; classifierModel?: unknown; classifierFallbacks?: unknown; systemEnv?: unknown; fastMode?: unknown; maxContextTokens?: unknown; alwaysEnableEffort?: unknown; tierModels?: unknown; autoContext?: unknown; autoCompactWindow?: unknown; blockedSkills?: unknown; injectAgents?: unknown; webSearchSidecar?: unknown; visionSidecar?: unknown };
     for (const field of ["webSearchSidecar", "visionSidecar"] as const) {
       const section = body[field];
       if (section === undefined || section === null) continue;
@@ -1182,13 +1186,31 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
       }
       nextFastMode = body.fastMode === null ? undefined : body.fastMode;
     }
-    for (const field of ["model", "smallFastModel"] as const) {
+    for (const field of ["model", "smallFastModel", "classifierModel"] as const) {
       const value = body[field];
       if (value === undefined) continue;
       if (typeof value !== "string") return jsonResponse({ error: `${field} must be a string` }, 400);
       if (value.trim() === "") delete next[field];
       else next[field] = value.trim();
     }
+    if (body.classifierFallbacks !== undefined) {
+      if (body.classifierFallbacks === null) {
+        delete next.classifierFallbacks;
+      } else {
+        if (!Array.isArray(body.classifierFallbacks)) {
+          return jsonResponse({ error: "classifierFallbacks must be an array of strings, or null" }, 400);
+        }
+        const list: string[] = [];
+        for (const entry of body.classifierFallbacks) {
+          if (typeof entry !== "string" || entry.trim() === "") {
+            return jsonResponse({ error: "classifierFallbacks entries must be non-empty strings" }, 400);
+          }
+          list.push(entry.trim());
+        }
+        if (list.length > 0) next.classifierFallbacks = list;
+        else delete next.classifierFallbacks;
+      }
+    }
     if (body.modelMap !== undefined) {
       if (body.modelMap === null) {
         delete next.modelMap;

package/src/server/management/config-routes.ts

@@ -37,7 +37,7 @@ import { deriveProviderPresets } from "../../providers/derive";
 import { providerCodexAccountMode } from "../../providers/registry";
 import { routedSlug, slugEquals } from "../../providers/slug-codec";
 import { clearProviderQuotaCache, fetchProviderQuotaReports } from "../../providers/quota";
-import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
+import { isCanonicalOpenAiForwardProvider, OPENAI_CODEX_PROVIDER_ID } from "../../providers/openai-tiers";
 import { clearThreadAccountMap } from "../../codex/routing";
 import { primeCodexPoolQuotas } from "../../codex/auth-api";
 import {
@@ -118,6 +118,74 @@ async function sidecarVisionResponseSettings(config: OcxConfig): Promise<{
   return { model, reasoning, models };
 }
 
+/** One client's outcome from a fan-out sync. Absent from the list means "left alone". */
+interface ClientIntegrationSyncOutcome {
+  readonly client: "grok" | "claude-desktop";
+  readonly ok: boolean;
+  readonly changed?: boolean;
+  readonly reason?: string;
+}
+
+/**
+ * Re-inject every client integration the operator has switched ON.
+ *
+ * Only Codex used to run here, so a catalog change reached Codex and nothing else: a Grok
+ * fence or a written Desktop profile kept the context windows it was created with until the
+ * next `ocx start`. The startup path already gates each client on its own toggle
+ * (`src/cli/index.ts`), and this is that same fan-out for the on-demand command.
+ *
+ * A client that is OFF is omitted from the result rather than reported as skipped — the
+ * caller has to be able to tell "not touched" from "tried and failed". A client that fails
+ * does not fail the sync: Codex is the one that matters for routing, and a broken Grok file
+ * should surface as a warning, not as a 500 on a command that did its main job.
+ */
+async function syncEnabledClientIntegrations(
+  port: number | undefined,
+  config: OcxConfig,
+): Promise<ClientIntegrationSyncOutcome[]> {
+  if (port === undefined) return [];
+  const { claudeDesktopIntegrationEnabled, grokIntegrationEnabled } = await import("../../codex/desired-state");
+  const out: ClientIntegrationSyncOutcome[] = [];
+
+  if (grokIntegrationEnabled(config)) {
+    try {
+      const { syncGrokConfig } = await import("../../grok/sync");
+      const r = await syncGrokConfig(port, config, config.hostname ? { hostname: config.hostname } : {});
+      out.push(r.ok
+        ? { client: "grok", ok: true, changed: r.changed === true }
+        : { client: "grok", ok: false, reason: r.message });
+    } catch (error) {
+      out.push({ client: "grok", ok: false, reason: error instanceof Error ? error.message : String(error) });
+    }
+  }
+
+  if (claudeDesktopIntegrationEnabled(config)) {
+    try {
+      const { writeDesktop3pConfig } = await import("../../claude/desktop-3p");
+      const { desktopVisibleNativeSlugs, filterCatalogVisibleModels } = await import("../../codex/catalog");
+      const { fetchAllModels } = await import("../management-api");
+      const routed = filterCatalogVisibleModels(await fetchAllModels(config), config)
+        .map(model => ({ provider: model.provider, id: model.id, contextWindow: model.contextWindow }));
+      const r = writeDesktop3pConfig(
+        port,
+        [...desktopVisibleNativeSlugs(config)],
+        routed,
+        config.apiKeys?.[0]?.key,
+        "static",
+        config.claudeCode?.desktopProfile,
+        providerContextCap(config, OPENAI_CODEX_PROVIDER_ID),
+      );
+      out.push(r.written
+        ? { client: "claude-desktop", ok: true, changed: true }
+        : { client: "claude-desktop", ok: false, reason: r.reason ?? "Claude Desktop write failed" });
+    } catch (error) {
+      out.push({ client: "claude-desktop", ok: false, reason: error instanceof Error ? error.message : String(error) });
+    }
+  }
+
+  return out;
+}
+
 function publicVisionSidecarSettings(
   config: OcxConfig,
   vision: Awaited<ReturnType<typeof sidecarVisionResponseSettings>>,
@@ -387,10 +455,19 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
     // Never use the server-captured startup object for a durable integration
     // decision. A toggle may have persisted while this process was gathering.
     const runtime = readRuntimePort(process.pid);
-    const result = await syncModelsToCodex(runtime?.port, loadConfig(), null);
+    const config = loadConfig();
+    const result = await syncModelsToCodex(runtime?.port, config, null);
+    // A sync used to stop here, so a Grok fence or a Desktop profile kept whatever
+    // context windows it was written with while the Codex catalog moved on. The
+    // startup path already fans out to every enabled client; this is the same fan-out
+    // for the on-demand command. Codex goes first because the others read its catalog.
+    const integrations = result.status === "refused"
+      ? []
+      : await syncEnabledClientIntegrations(runtime?.port, config);
     const status = result.status === "refused" ? 409 : (result.status === "skipped" || result.ok ? 200 : 500);
     return jsonResponse({
       ...attachStaleAppServerHint(result),
+      ...(integrations.length > 0 ? { integrations } : {}),
       ...(result.ok ? {} : { error: result.message }),
     }, status);
   }

package/src/server/management/context.ts

@@ -62,7 +62,7 @@ export interface ManagementApiDeps {
    * leaves this unset, so the route creates its normal NativeProfileManager.
    */
   /**
-   * Codex app-server restart seam (devlog/_plan/260815_gui_codex_restart).
+   * Codex app-server restart seam (devlog/_fin/260815_gui_codex_restart).
    * Grouped rather than three separate fields: the route is an adapter over one
    * service, and a route test that could not stub it would really terminate the
    * developer's own Codex app-servers.

package/src/server/management/model-rows.ts

@@ -62,6 +62,7 @@ export async function listManagementModelRows(config: OcxConfig): Promise<Manage
           metadataSlug: slug,
           disabled: disabled.has(`${selector}/${slug}`) || disabled.has(slug),
           contextWindow: undefined,
+          maxInputTokens: undefined,
         })))
     : [];
   const native: ManagementModelRow[] = [...nativeRows, ...accountNativeRows].map(row => {
@@ -77,6 +78,10 @@ export async function listManagementModelRows(config: OcxConfig): Promise<Manage
       ...(defaultReasoningEffort ? { defaultReasoningEffort } : {}),
       inputModalities: nativeInputModalities(row.slug),
       ...(row.contextWindow !== undefined ? { contextWindow: row.contextWindow } : {}),
+      // The input ceiling is a separate number from the window for GPT-5.6 (922k under
+      // 1.05M). Dropping it here made /api/models describe a native row as if the whole
+      // window were usable as input, which is the claim the measurement disproved.
+      ...(row.maxInputTokens !== undefined ? { maxInputTokens: row.maxInputTokens } : {}),
     };
   });
   const customModels: ManagementModelRow[] = (config.customModels ?? []).map(cm => {