@bitkyc08/opencodex 2.40.0 → 2.41.0

package/src/server/management/logs-usage-routes.ts

@@ -47,13 +47,11 @@ import {
 } from "../../storage/policy-job";
 import {
   currentUsageLogRevision,
-  readUsageSnapshotForManagement,
   usageLogIdentityKey,
   usageLogRevisionKey,
-  type PersistedUsageEntry,
 } from "../../usage/log";
 import { getUsageDebugLogEntries } from "../../usage/debug";
-import { USAGE_RANGES, USAGE_SURFACES, parseRange, parseUsageSurface, projectUsageSummary, rangeWindow, summarizeUsage, type UsageRange, type UsageSummary, type UsageSurface } from "../../usage/summary";
+import { USAGE_RANGES, USAGE_SURFACES, parseRange, parseUsageSurface, rangeWindow, type UsageRange, type UsageSummary, type UsageSurface } from "../../usage/summary";
 import { stripCodexRuntimeProviderFields } from "../../codex/auth-context";
 import { getProviderRegistryEntry } from "../../providers/registry";
 import { getDebugLogEntries } from "../../lib/debug-log-buffer";
@@ -83,7 +81,7 @@ import {
   getUsageSummaryCacheEntry,
   setUsageSummaryCacheEntry,
 } from "./usage-summary-cache";
-import { cacheApiKeyUsageFromSnapshot } from "./api-key-usage";
+import { getFilteredUsageAggregate, getUsageAggregate } from "./usage-aggregate-cache";
 
 function nextLocalMidnight(now: number): number {
   const next = new Date(now);
@@ -92,7 +90,6 @@ function nextLocalMidnight(now: number): number {
 }
 
 function usageSummaryExpiresAt(
-  _entries: PersistedUsageEntry[],
   _range: UsageRange,
   _surface: UsageSurface,
   now: number,
@@ -105,29 +102,6 @@ function refreshedUsageSummary<T extends UsageSummary & { historyTruncated: bool
   return { ...summary, since, generatedAt: now };
 }
 
-/**
- * Timestamp bounds of the rows the bounded reader actually loaded.
- *
- * Deliberately computed over the whole snapshot, BEFORE `summarizeUsage` applies the range
- * and surface predicates: truncation is a property of the read, not of the query, so the
- * window that matters to a client is the one the reader could see. It is not a completeness
- * claim and must never be presented as one. `usage.jsonl` is appended when a request
- * COMPLETES while each row carries the request START time, so a long-running request can be
- * appended after shorter ones that started later — meaning the oldest loaded timestamp does
- * not bound what the dropped prefix contains (#1497).
- */
-function snapshotWindow(entries: PersistedUsageEntry[]): { start: number | null; end: number | null } {
-  let start: number | null = null;
-  let end: number | null = null;
-  for (const entry of entries) {
-    const at = entry.timestamp;
-    if (typeof at !== "number" || !Number.isFinite(at)) continue;
-    if (start === null || at < start) start = at;
-    if (end === null || at > end) end = at;
-  }
-  return { start, end };
-}
-
 export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Response | null> {
   const { req, url, config, deps, syncClaudeAgentDefsBestEffort } = ctx;
 
@@ -195,18 +169,16 @@ export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Res
   if (url.pathname === "/api/usage" && req.method === "GET") {
     const range = parseRange(url.searchParams.get("range"));
     const surface = parseUsageSurface(url.searchParams.get("surface"));
-    // Applied to the OUTGOING payload only. A filtered summary must never reach
-    // the cache or the warm loop below: the key is `range:surface`, so a
-    // filtered entry stored under it would be served to the next unfiltered
-    // caller, dashboard included.
+    // A filtered summary must never reach the cache or the warm loop below:
+    // the key is `range:surface`, so a filtered entry stored under it would be
+    // served to the next unfiltered caller, dashboard included.
     const filter = {
       provider: url.searchParams.get("provider"),
       model: url.searchParams.get("model"),
       apiKeyId: url.searchParams.get("apiKeyId"),
     };
-    const project = <T extends UsageSummary>(summary: T, entries?: PersistedUsageEntry[]) =>
-      projectUsageSummary(summary, filter, entries);
-    const filterRequested = Boolean(filter.provider ?? filter.model ?? filter.apiKeyId);
+    const filterRequested = [filter.provider, filter.model, filter.apiKeyId]
+      .some(value => typeof value === "string" && value.trim() !== "");
     const now = Date.now();
     try {
       const cacheKey = `${range}:${surface}`;
@@ -214,52 +186,68 @@ export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Res
       const observed = currentUsageLogRevision();
       const identityKey = `${usageLogIdentityKey(observed)}\0${effectiveReadLimit}`;
       const observedSize = observed?.size ?? 0;
+      const observedTimeZone = Intl.DateTimeFormat().resolvedOptions().timeZone;
       const cached = getUsageSummaryCacheEntry(cacheKey);
       if (cached
-        // A filtered response is re-summarised from entries, which a cached
-        // summary does not carry. Serving it from cache would mean projecting
-        // over collapsed breakdown rows again — the exact defect the
-        // re-summarisation replaced. The unfiltered cache stays warm either
-        // way; only the filtered caller pays for the read.
+        // Filtered responses have their own full-scan singleflight and never
+        // read or write this cache.
         && !filterRequested
         && cached.identityKey === identityKey
         && cached.maxReadBytes === effectiveReadLimit
         && cached.overlayVersion === userCostOverlayVersion()
+        && cached.timeZone === observedTimeZone
         && now < cached.freshUntil
         && now < cached.expiresAt
         && observedSize >= cached.lastSeenSize) {
         return jsonResponse(refreshedUsageSummary(cached.summary, range, now));
       }
       if (cached && !filterRequested) discardUsageSummaryCacheEntry(cacheKey);
-      // Capture the overlay version BEFORE reading/computing: the cache entry
-      // must be stamped with the version the summary was priced under. Reading
-      // it again at stamp time could cache an old-price summary as current,
-      // and the next request would then accept stale pricing for the whole
-      // cache lifetime.
-      const overlayVersion = userCostOverlayVersion();
-      const snapshot = await readUsageSnapshotForManagement(effectiveReadLimit);
+      if (filterRequested) {
+        const filteredAggregate = await getFilteredUsageAggregate(filter);
+        const accumulator = filteredAggregate.accumulator;
+        return jsonResponse({
+          ...accumulator.summarize(range, now, surface),
+          historyTruncated: false,
+          truncatedPrefixBytes: 0,
+          entriesTruncated: false,
+          entriesDropped: 0,
+          snapshotWindowStart: accumulator.snapshotWindow.start,
+          snapshotWindowEnd: accumulator.snapshotWindow.end,
+        });
+      }
+
+      const configuredApiKeyIds = (config.apiKeys ?? []).map(key => key.id);
+      const aggregate = await getUsageAggregate({
+        now,
+        configuredApiKeyIds,
+        managementUsageMaxReadBytes: effectiveReadLimit,
+      });
+      const baseAccumulator = aggregate.accumulator;
       const revisionReadAt = Date.now();
-      const window = snapshotWindow(snapshot.entries);
-      const summary = {
-        ...summarizeUsage(snapshot.entries, range, now, surface),
-        historyTruncated: snapshot.truncatedPrefixBytes > 0 || snapshot.entriesTruncated,
-        truncatedPrefixBytes: snapshot.truncatedPrefixBytes,
-        entriesTruncated: snapshot.entriesTruncated,
-        entriesDropped: snapshot.entriesDropped,
-        snapshotWindowStart: window.start,
-        snapshotWindowEnd: window.end,
+      const freshUntil = now + 60_000;
+      const snapshotIdentity = `${usageLogIdentityKey(aggregate.revision)}\0${effectiveReadLimit}`;
+      const revisionKey = `${usageLogRevisionKey(aggregate.revision)}\0${effectiveReadLimit}`;
+      const lastSeenSize = aggregate.revision?.size ?? 0;
+      const baseReadMetadata = {
+        historyTruncated: false,
+        truncatedPrefixBytes: 0,
+        entriesTruncated: false,
+        entriesDropped: 0,
+        snapshotWindowStart: baseAccumulator.snapshotWindow.start,
+        snapshotWindowEnd: baseAccumulator.snapshotWindow.end,
+      } as const;
+      const requestedSummary = {
+        ...baseAccumulator.summarize(range, now, surface),
+        ...baseReadMetadata,
       };
-      if (userCostOverlayVersion() !== overlayVersion) {
-        // The overlay changed while the summary was being computed, so this
-        // summary may mix old and new prices. Serve it uncached: the next
-        // request recomputes against the settled overlay instead of caching a
-        // mixed-price entry under either version.
-        return jsonResponse(project(summary, snapshot.entries));
+      const currentOverlayVersion = userCostOverlayVersion();
+      const currentTimeZone = Intl.DateTimeFormat().resolvedOptions().timeZone;
+      if (currentOverlayVersion !== aggregate.overlayVersion
+        || currentTimeZone !== aggregate.timeZone) {
+        // The aggregate is internally consistent, but an input changed after
+        // its scan. Serve it uncached and let the next request rebuild.
+        return jsonResponse(requestedSummary);
       }
-      const freshUntil = now + 60_000;
-      const snapshotIdentity = `${usageLogIdentityKey(snapshot.revision)}\0${effectiveReadLimit}`;
-      const revisionKey = `${usageLogRevisionKey(snapshot.revision)}\0${effectiveReadLimit}`;
-      const lastSeenSize = snapshot.revision?.size ?? 0;
       // Derived from the canonical constants rather than re-listed: a subset
       // literal type-checks perfectly happily, so a range added to the union
       // and forgotten here would never be warmed and never invalidated
@@ -268,21 +256,19 @@ export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Res
       const surfaces: readonly UsageSurface[] = USAGE_SURFACES;
       for (const nextRange of ranges) {
         for (const nextSurface of surfaces) {
-          const nextSummary = nextRange === range && nextSurface === surface ? summary : {
-            ...summarizeUsage(snapshot.entries, nextRange, now, nextSurface),
-            historyTruncated: summary.historyTruncated,
-            truncatedPrefixBytes: summary.truncatedPrefixBytes,
-            entriesTruncated: summary.entriesTruncated,
-            entriesDropped: summary.entriesDropped,
-            snapshotWindowStart: summary.snapshotWindowStart,
-            snapshotWindowEnd: summary.snapshotWindowEnd,
-          };
+          const nextSummary = nextRange === range && nextSurface === surface
+              ? requestedSummary
+              : {
+                ...baseAccumulator.summarize(nextRange, now, nextSurface),
+                ...baseReadMetadata,
+              };
           setUsageSummaryCacheEntry(`${nextRange}:${nextSurface}`, {
             revisionKey,
             identityKey: snapshotIdentity,
             maxReadBytes: effectiveReadLimit,
-            overlayVersion,
-            expiresAt: usageSummaryExpiresAt(snapshot.entries, nextRange, nextSurface, now),
+            overlayVersion: aggregate.overlayVersion,
+            timeZone: aggregate.timeZone,
+            expiresAt: usageSummaryExpiresAt(nextRange, nextSurface, now),
             freshUntil,
             lastSeenSize,
             revisionReadAt,
@@ -290,16 +276,7 @@ export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Res
           });
         }
       }
-      cacheApiKeyUsageFromSnapshot(
-        snapshot.entries,
-        (config.apiKeys ?? []).map(key => key.id),
-        usageLogIdentityKey(snapshot.revision),
-        snapshot.revision?.size ?? 0,
-        snapshot.truncatedPrefixBytes > 0 || snapshot.entriesTruncated,
-        effectiveReadLimit,
-        now,
-      );
-      return jsonResponse(project(summary, snapshot.entries));
+      return jsonResponse(requestedSummary);
     } catch {
       return jsonResponse({
         range,

package/src/server/management/provider-routes.ts

@@ -1,5 +1,6 @@
 import { randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
+import { isDeepStrictEqual } from "node:util";
 import type { CatalogModel } from "../../codex/catalog";
 import { catalogModelSlug, invalidateCodexModelsCache, nativeModelRows, uniqueCatalogModelsForPublicList } from "../../codex/catalog";
 import { clearGatherRoutedModelsInflight } from "../../codex/catalog/provider-fetch";
@@ -11,6 +12,7 @@ import {
   isValidProviderName,
   modelDisplayNamesConfigError,
   multiAgentGuidanceEnabled,
+  mutatePersistedConfig,
   nonBlankStringArrayConfigError,
   normalizeNonBlankStringArray,
   providerBaseUrlConfigError,
@@ -19,6 +21,7 @@ import {
   readConfigAdmissionSnapshot,
   saveConfigPreservingClaudeCode,
   upstreamHttpVersionConfigError,
+  validateConfigCandidate,
   withConfigMutationLockSync,
 } from "../../config";
 import {
@@ -77,7 +80,17 @@ import { drainAndShutdown } from "../lifecycle";
 import { filterRequestLogs, getRequestLogEntries, type RequestLogEntry } from "../request-log";
 import { estimateComboCost, estimateRequestCost, normalizeCostTokens, tokensPerSecond } from "../../usage/cost";
 import type { PersistedUsageAttempt } from "../../usage/log";
-import { isAllowedRequestOrigin, jsonResponse, providerManagementConfigError, publicProviderBaseUrl, safeConfigDTO } from "../auth-cors";
+import {
+  isAllowedRequestOrigin,
+  jsonResponse,
+  parseProviderEditorConfigDTO,
+  providerEditorConfigDTO,
+  providerManagementConfigError,
+  publicProviderBaseUrl,
+  safeConfigDTO,
+  type ProviderEditorConfigDTO,
+  type ProviderEditorProviderDTO,
+} from "../auth-cors";
 import { providerServiceTierConfigError } from "./provider-capability-config";
 import { providerEmptyToolOutputConfigError } from "../../config/provider-validation";
 import { applySystemEnvToggle } from "../system-env";
@@ -86,10 +99,12 @@ import {
   LOCAL_PROVIDER_RELOAD_PATH,
 } from "../../lib/local-provider-reload-contract";
 import { refreshUserCostOverlays } from "../../usage/user-cost-overlays";
+import { redactSecretString } from "../../lib/redact";
 import {
   XAI_RESPONSES_OPT_IN_MODELS,
   xaiResponsesOptInState,
 } from "../../providers/xai-responses-opt-in";
+import { dropProviderCustomModels } from "../../providers/provider-id-rewrite";
 
 import { isPlainRecord, parseDebugLogQuery, tokPerSecondResult, unavailableCostReason, costResult, requestLogDto, stripRegistryOnlyStaticHeaders, fetchAllModels } from "./shared";
 import type { MetricUnavailableReason, TokPerSecondResult, CostEstimateReason, CostResult, MetricSource } from "./shared";
@@ -163,6 +178,116 @@ function restorePersistedAliasOverlays(target: OcxProviderConfig, existing: OcxP
   }
 }
 
+type ProviderEditorCandidateResult =
+  | { ok: true; config: OcxConfig; removedProviders: string[] }
+  | { ok: false; status: 400 | 409; error: string; code: string };
+
+type ProviderEditorMutationValue = ProviderEditorCandidateResult;
+
+function mergeProviderEditorRow(
+  persisted: OcxProviderConfig | undefined,
+  baseline: ProviderEditorProviderDTO | undefined,
+  next: ProviderEditorProviderDTO,
+): OcxProviderConfig {
+  const merged = structuredClone(persisted ?? {}) as Record<string, unknown>;
+  const fields = new Set([...Object.keys(baseline ?? {}), ...Object.keys(next)]);
+  for (const field of fields) {
+    const baselineHasField = baseline !== undefined && Object.hasOwn(baseline, field);
+    const nextHasField = Object.hasOwn(next, field);
+    if (
+      baselineHasField === nextHasField
+      && (!baselineHasField || isDeepStrictEqual(baseline[field], next[field]))
+    ) {
+      continue;
+    }
+    if (nextHasField) merged[field] = structuredClone(next[field]);
+    else delete merged[field];
+  }
+  return merged as unknown as OcxProviderConfig;
+}
+
+/** Build and validate a complete candidate without mutating the caller's snapshot. */
+function providerEditorCandidate(
+  persisted: OcxConfig,
+  baseline: ProviderEditorConfigDTO,
+  next: ProviderEditorConfigDTO,
+): ProviderEditorCandidateResult {
+  const candidate = structuredClone(persisted);
+  const removedProviders = Object.keys(persisted.providers)
+    .filter(name => !Object.hasOwn(next.providers, name));
+
+  for (const name of removedProviders) {
+    const dependentCombos = Object.entries(persisted.combos ?? {})
+      .filter(([, combo]) => combo.targets.some(target => target.provider === name))
+      .map(([id]) => id)
+      .sort((a, b) => a.localeCompare(b));
+    if (dependentCombos.length > 0) {
+      return {
+        ok: false,
+        status: 409,
+        error: `cannot delete provider ${JSON.stringify(redactSecretString(name))} while combos depend on it`,
+        code: "provider_has_dependent_combos",
+      };
+    }
+  }
+
+  const providers: Record<string, OcxProviderConfig> = Object.create(null);
+  for (const [name, publicProvider] of Object.entries(next.providers)) {
+    if (!isValidProviderName(name)) {
+      return {
+        ok: false,
+        status: 400,
+        error: "provider name must use letters, numbers, dot, underscore, or hyphen and cannot be a reserved object key",
+        code: "invalid_provider_name",
+      };
+    }
+    const namespaceCollision = codexAccountNamespaceProviderCollisionError(candidate.codexAccountNamespaces, name);
+    if (namespaceCollision) return { ok: false, status: 409, error: namespaceCollision, code: "provider_namespace_conflict" };
+    const merged = mergeProviderEditorRow(persisted.providers[name], baseline.providers[name], publicProvider);
+    const transportCandidate = providerTransportValidationCandidate(merged as unknown as Record<string, unknown>);
+    const providerError = providerManagementConfigError(name, transportCandidate)
+      ?? providerEmptyToolOutputConfigError(name, transportCandidate)
+      ?? providerServiceTierConfigError(name, transportCandidate);
+    if (providerError) return { ok: false, status: 400, error: providerError, code: "invalid_provider" };
+    providers[name] = merged;
+  }
+
+  const defaultProvider = next.defaultProvider.trim();
+  const selectedDefault = providers[defaultProvider];
+  if (!selectedDefault) {
+    return { ok: false, status: 400, error: "defaultProvider must name a configured provider", code: "invalid_default_provider" };
+  }
+  if (selectedDefault.disabled === true) {
+    return { ok: false, status: 400, error: "defaultProvider cannot be disabled", code: "default_provider_disabled" };
+  }
+
+  candidate.defaultProvider = defaultProvider;
+  candidate.providers = providers;
+  for (const name of removedProviders) {
+    dropProviderCustomModels(candidate, name);
+    setProviderContextCap(candidate, name, false);
+  }
+  const validated = validateConfigCandidate(candidate);
+  if (!validated.ok) {
+    return { ok: false, status: 400, error: validated.error, code: "invalid_provider_editor_config" };
+  }
+  return { ok: true, config: candidate, removedProviders };
+}
+
+function adoptProviderEditorCandidate(live: OcxConfig, persisted: OcxConfig): void {
+  live.defaultProvider = persisted.defaultProvider;
+  for (const name of Object.keys(live.providers)) {
+    if (!Object.hasOwn(persisted.providers, name)) delete live.providers[name];
+  }
+  for (const [name, provider] of Object.entries(persisted.providers)) {
+    live.providers[name] = structuredClone(provider);
+  }
+  if (persisted.customModels === undefined) delete live.customModels;
+  else live.customModels = structuredClone(persisted.customModels);
+  if (persisted.providerContextCaps === undefined) delete live.providerContextCaps;
+  else live.providerContextCaps = structuredClone(persisted.providerContextCaps);
+}
+
 /**
  * Apply the recognized PATCH field mask onto a provider copy. The caller runs this once
  * for validation and again inside the config mutation lock against the newest provider,
@@ -649,6 +774,98 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     return jsonResponse({ success: true, name, catalogRefresh });
   }
 
+  if (url.pathname === "/api/providers" && req.method === "PUT") {
+    let rawBody: unknown;
+    try {
+      rawBody = await readManagementJsonBody(req);
+    } catch (error) {
+      rethrowManagementBodyTooLarge(error);
+      return jsonResponse({ error: "invalid JSON body" }, 400);
+    }
+    if (!isPlainRecord(rawBody)) {
+      return jsonResponse({ error: "provider batch body must be a plain object", code: "invalid_provider_editor_body" }, 400);
+    }
+    const bodyKeys = Object.keys(rawBody);
+    if (bodyKeys.length !== 2 || !Object.hasOwn(rawBody, "baseline") || !Object.hasOwn(rawBody, "next")) {
+      return jsonResponse({ error: "provider batch body must contain only baseline and next", code: "invalid_provider_editor_body" }, 400);
+    }
+    const baselineResult = parseProviderEditorConfigDTO(rawBody.baseline);
+    if (!baselineResult.ok) return jsonResponse({ error: baselineResult.error, code: baselineResult.code }, 400);
+    const nextResult = parseProviderEditorConfigDTO(rawBody.next);
+    if (!nextResult.ok) return jsonResponse({ error: nextResult.error, code: nextResult.code }, 400);
+
+    const observed = readConfigAdmissionSnapshot();
+    if (observed.kind !== "read" || observed.diagnostics.source !== "file" || observed.diagnostics.error !== null) {
+      return jsonResponse({ error: "provider config is unavailable", code: "provider_config_unavailable" }, 409);
+    }
+    if (!isDeepStrictEqual(providerEditorConfigDTO(observed.diagnostics.config), baselineResult.value)) {
+      return jsonResponse({ error: "provider editor baseline is stale", code: "stale_provider_editor_baseline" }, 409);
+    }
+    const preview = providerEditorCandidate(observed.diagnostics.config, baselineResult.value, nextResult.value);
+    if (!preview.ok) return jsonResponse({ error: preview.error, code: preview.code }, preview.status);
+
+    // DNS/SSRF validation happens before the persistence callback. The callback repeats every
+    // synchronous check against a fresh snapshot and rejects a changed baseline, so this awaited
+    // phase can never authorize a stale provider set.
+    for (const [name, provider] of Object.entries(preview.config.providers)) {
+      const allowBenchmarkAddresses = name === "openai" && isCanonicalOpenAiForwardProvider(provider);
+      const resolvedError = await providerDestinationResolvedError(name, provider, { allowBenchmarkAddresses });
+      if (resolvedError) return jsonResponse({ error: resolvedError, code: "invalid_provider_destination" }, 400);
+    }
+
+    const outcome = mutatePersistedConfig<ProviderEditorMutationValue>(persisted => {
+      if (!isDeepStrictEqual(providerEditorConfigDTO(persisted), baselineResult.value)) {
+        return {
+          changed: false,
+          value: {
+            ok: false,
+            status: 409,
+            error: "provider editor baseline is stale",
+            code: "stale_provider_editor_baseline",
+          },
+        };
+      }
+      const candidate = providerEditorCandidate(persisted, baselineResult.value, nextResult.value);
+      if (!candidate.ok) return { changed: false, value: candidate };
+      const changed = !isDeepStrictEqual(providerEditorConfigDTO(persisted), nextResult.value);
+      if (!changed) return { changed: false, value: candidate };
+
+      persisted.defaultProvider = candidate.config.defaultProvider;
+      persisted.providers = structuredClone(candidate.config.providers);
+      for (const name of candidate.removedProviders) {
+        dropProviderCustomModels(persisted, name);
+        setProviderContextCap(persisted, name, false);
+      }
+      return {
+        changed: true,
+        value: {
+          ok: true,
+          config: structuredClone(persisted),
+          removedProviders: candidate.removedProviders,
+        },
+      };
+    });
+    if (outcome.status === "unavailable") {
+      const code = outcome.reason === "conflict" ? "provider_config_conflict" : "provider_config_unavailable";
+      return jsonResponse({ error: "provider config changed before it could be saved", code }, 409);
+    }
+    if (!outcome.value.ok) {
+      return jsonResponse({ error: outcome.value.error, code: outcome.value.code }, outcome.value.status);
+    }
+
+    adoptProviderEditorCandidate(config, outcome.value.config);
+    reconcileLiveStateStores();
+    refreshUserCostOverlays(outcome.value.config);
+    clearGatherRoutedModelsInflight();
+    (deps.clearProviderQuotaCache ?? clearProviderQuotaCache)();
+    clearAccountQuotaCache();
+    clearKeyCooldowns();
+    clearModelCache();
+    (deps.clearThreadAccountMap ?? clearThreadAccountMap)();
+    const catalogRefresh = await convergeCodexCatalog();
+    return jsonResponse({ success: true, catalogRefresh });
+  }
+
   // Add (or overwrite) a single provider. Merges into the live in-memory config and
   // persists — existing providers' real keys are never round-tripped (unlike PUT /api/config,
   // which would re-save the masked keys from GET). Live routing picks it up immediately.

package/src/server/management/route-registry.ts

@@ -273,6 +273,7 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "PATCH", path: "/api/providers", module: "server/management/provider-routes", mutates: true },
   { method: "POST", path: "/api/providers", module: "server/management/provider-routes", mutates: true },
   { method: "POST", path: "/api/providers/test", module: "server/management/provider-routes", mutates: true },
+  { method: "PUT", path: "/api/providers", module: "server/management/provider-routes", mutates: true, exempt: { reason: "deferred-verb", why: "Issue #3280 scopes this atomic batch endpoint to the GUI JSON editor; a matching CLI verb is outside wp5 and remains owed.", owner: "wp5-followup", ownerDoc: "devlog/_plan/260903_bug_drawdown_bcda/050_phase5.md" } },
   { method: "PUT", path: "/api/provider-context-caps", module: "server/management/provider-routes", mutates: true },
   // server/management/request-history-routes
   { method: "GET", path: "/api/request-history", module: "server/management/request-history-routes", mutates: false },