@bitkyc08/opencodex 2.42.0 → 2.43.0

package/src/server/management/combo-routes.ts

@@ -52,7 +52,7 @@ import {
   setDebugSettings,
   type DebugFlag,
 } from "../../lib/debug-settings";
-import type { OcxClaudeCodeConfig, OcxConfig, OcxCustomModel, OcxProviderConfig } from "../../types";
+import type { OcxClaudeCodeConfig, OcxComboConfig, OcxConfig, OcxCustomModel, OcxProviderConfig } from "../../types";
 import { drainAndShutdown } from "../lifecycle";
 import { reconcileLiveStateStores } from "../../lib/state-store-registrations";
 import { filterRequestLogs, getRequestLogEntries, type RequestLogEntry } from "../request-log";
@@ -66,6 +66,7 @@ import type { MetricUnavailableReason, TokPerSecondResult, CostEstimateReason, C
 import type { ManagementContext } from "./context";
 import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
 import { shadowCallTargetError } from "./shadow-call-validation";
+import { COMBO_DEFAULT_WAIT_FOR_COOLDOWN_MS } from "../../combos";
 
 
 /**
@@ -75,15 +76,29 @@ import { shadowCallTargetError } from "./shadow-call-validation";
  * materialized in every user's config.json.
  */
 function sparseComboConfig<T extends {
+  cooldownMs?: number;
+  waitForCooldownMs?: number;
   imageInput?: "auto" | "disabled";
   reasoningEffortMode?: "strict" | "adaptive";
-}>(combo: T): Omit<T, "imageInput" | "reasoningEffortMode"> & {
+}>(combo: T): Omit<T, "cooldownMs" | "waitForCooldownMs" | "imageInput" | "reasoningEffortMode"> & {
+  cooldownMs?: number;
+  waitForCooldownMs?: number;
   imageInput?: "disabled";
   reasoningEffortMode?: "adaptive";
 } {
-  const { imageInput, reasoningEffortMode, ...rest } = combo;
+  const {
+    cooldownMs,
+    waitForCooldownMs,
+    imageInput,
+    reasoningEffortMode,
+    ...rest
+  } = combo;
   return {
     ...rest,
+    ...(cooldownMs !== undefined ? { cooldownMs } : {}),
+    ...(waitForCooldownMs !== undefined && waitForCooldownMs !== COMBO_DEFAULT_WAIT_FOR_COOLDOWN_MS
+      ? { waitForCooldownMs }
+      : {}),
     ...(imageInput === "disabled" ? { imageInput: "disabled" as const } : {}),
     ...(reasoningEffortMode === "adaptive" ? { reasoningEffortMode: "adaptive" as const } : {}),
   };
@@ -141,13 +156,28 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
       comboPublicModelId,
       normalizeComboConfig,
     } = await import("../../combos");
-    const error = comboConfigError(id, body.combo, config.providers, {
+    const sourceId = renameFrom ?? id;
+    const previous = config.combos?.[sourceId];
+    if (!isPlainRecord(body.combo)) {
+      return jsonResponse({ error: "combo must be an object" }, 400);
+    }
+    const requestedCombo: Record<string, unknown> = body.combo;
+    const effectiveCombo = {
+      ...requestedCombo,
+      ...(!Object.hasOwn(requestedCombo, "cooldownMs") && previous?.cooldownMs !== undefined
+        ? { cooldownMs: previous.cooldownMs }
+        : {}),
+      ...(!Object.hasOwn(requestedCombo, "waitForCooldownMs") && previous?.waitForCooldownMs !== undefined
+        ? { waitForCooldownMs: previous.waitForCooldownMs }
+        : {}),
+    };
+    const error = comboConfigError(id, effectiveCombo, config.providers, {
       requireEnabledTarget: true,
       combos: config.combos,
-      excludeComboId: renameFrom ?? id,
+      excludeComboId: sourceId,
     });
     if (error) return jsonResponse({ error }, 400);
-    const normalized = normalizeComboConfig(body.combo as import("../../types").OcxComboConfig);
+    const normalized = normalizeComboConfig(effectiveCombo as unknown as OcxComboConfig);
     // Persist only non-default identity/capability fields so config stays sparse.
     // Capability defaults (`imageInput`, `reasoningEffortMode`) go through the same
     // helper the GET/PUT responses use, so the wire shape and the stored shape cannot drift.
@@ -157,14 +187,12 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
       displayName: normalizedDisplayName,
       ...normalizedBase
     } = sparseComboConfig(normalized);
-    const stored: import("../../types").OcxComboConfig = {
+    const stored: OcxComboConfig = {
       ...normalizedBase,
       ...(normalizedAlias ? { alias: normalizedAlias } : {}),
       ...(normalizedNativeAlias ? { nativeAlias: true } : {}),
       ...(normalizedDisplayName ? { displayName: normalizedDisplayName } : {}),
     };
-    const sourceId = renameFrom ?? id;
-    const previous = config.combos?.[sourceId];
     const oldPublicModel = previous ? comboPublicModelId(sourceId, previous) : null;
     const newPublicModel = comboPublicModelId(id, normalized);
     const disabledIdentityChanged = previous !== undefined && (

package/src/server/management/config-routes.ts

@@ -41,6 +41,15 @@ import { clearProviderQuotaCache, fetchProviderQuotaReports } from "../../provid
 import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
 import { clearThreadAccountMap } from "../../codex/routing";
 import { primeCodexPoolQuotas } from "../../codex/auth-api";
+import { isSelectableCodexPoolAccount } from "../../codex/account-id";
+import { isCodexAccountPriorityKey } from "../../codex/account-priority";
+import { MAIN_CODEX_ACCOUNT_ID } from "../../codex/main-account";
+import { getAccountQuota } from "../../codex/quota";
+import {
+  codexQuotaAutoRefreshStatus,
+  runCodexQuotaAutoRefresh,
+} from "../../codex/quota-auto-refresh";
+import { getMainAccountHardLockStatus } from "../../codex/main-account-hard-lock";
 import {
   codexAccountPickerEnabled,
   initializeDefaultCodexAccountNamespaces,
@@ -106,6 +115,13 @@ import type { MetricUnavailableReason, TokPerSecondResult, CostEstimateReason, C
 import type { ManagementContext } from "./context";
 import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
 
+function quotaAutoRefreshSettings(config: OcxConfig) {
+  return Object.fromEntries(Object.entries(config.codexQuotaAutoRefresh ?? {}).map(([id, setting]) => [
+    id,
+    { fiveHour: setting.fiveHour === true, weekly: setting.weekly === true },
+  ]));
+}
+
 async function sidecarVisionResponseSettings(config: OcxConfig): Promise<{
   model: string;
   reasoning: string;
@@ -300,9 +316,15 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       streamMode: config.streamMode ?? "auto",
       appOwnedMemoryBudgetMb: config.appOwnedMemoryBudgetMb ?? 256,
       codexAccountPickerEnabled: codexAccountPickerEnabled(config),
+      codexQuotaAutoRefresh: quotaAutoRefreshSettings(config),
       // Absent means hidden, so the GUI renders the switch without having to know that
       // `undefined` and `false` mean the same thing.
       showCodexSparkQuota: config.showCodexSparkQuota === true,
+      // Absent means off, same convention: the GUI renders a plain switch without
+      // needing to know that `undefined` and `false` mean the same thing here.
+      ultraFastTier: config.ultraFastTier === true,
+      codexMainAccountHardLock: config.codexMainAccountHardLock === true,
+      mainAccountHardLock: getMainAccountHardLockStatus(config),
       // Absent means the historical auto-open, so the GUI can render the toggle
       // without having to know that `undefined` and `true` mean the same thing.
       oauthOpenBrowser: config.oauthOpenBrowser !== false,
@@ -392,18 +414,24 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       streamMode?: unknown;
       appOwnedMemoryBudgetMb?: unknown;
       codexAccountPickerEnabled?: unknown;
+      codexQuotaAutoRefresh?: unknown;
       oauthOpenBrowser?: unknown;
       showCodexSparkQuota?: unknown;
+      ultraFastTier?: unknown;
+      codexMainAccountHardLock?: unknown;
       codexDesktopAuthless?: unknown;
     };
     if (body.codexAutoStart === undefined
       && body.streamMode === undefined
       && body.appOwnedMemoryBudgetMb === undefined
       && body.codexAccountPickerEnabled === undefined
+      && body.codexQuotaAutoRefresh === undefined
       && body.oauthOpenBrowser === undefined
       && body.showCodexSparkQuota === undefined
+      && body.ultraFastTier === undefined
+      && body.codexMainAccountHardLock === undefined
       && body.codexDesktopAuthless === undefined) {
-      return jsonResponse({ error: "provide codexAutoStart, streamMode, appOwnedMemoryBudgetMb, codexAccountPickerEnabled, oauthOpenBrowser, showCodexSparkQuota, or codexDesktopAuthless" }, 400);
+      return jsonResponse({ error: "provide codexAutoStart, streamMode, appOwnedMemoryBudgetMb, codexAccountPickerEnabled, codexQuotaAutoRefresh, oauthOpenBrowser, showCodexSparkQuota, ultraFastTier, codexMainAccountHardLock, or codexDesktopAuthless" }, 400);
     }
     if (body.codexAutoStart !== undefined && typeof body.codexAutoStart !== "boolean") {
       return jsonResponse({ error: "codexAutoStart boolean is required" }, 400);
@@ -421,9 +449,36 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
     if (body.showCodexSparkQuota !== undefined && typeof body.showCodexSparkQuota !== "boolean") {
       return jsonResponse({ error: "showCodexSparkQuota boolean is required" }, 400);
     }
+    if (body.ultraFastTier !== undefined && typeof body.ultraFastTier !== "boolean") {
+      return jsonResponse({ error: "ultraFastTier boolean is required" }, 400);
+    }
+    if (body.codexMainAccountHardLock !== undefined && typeof body.codexMainAccountHardLock !== "boolean") {
+      return jsonResponse({ error: "codexMainAccountHardLock boolean is required" }, 400);
+    }
     if (body.codexDesktopAuthless !== undefined && typeof body.codexDesktopAuthless !== "boolean") {
       return jsonResponse({ error: "codexDesktopAuthless boolean is required" }, 400);
     }
+    let quotaAutoRefreshChange: { id: string; window: "fiveHour" | "weekly"; enabled: boolean } | undefined;
+    if (body.codexQuotaAutoRefresh !== undefined) {
+      if (!isPlainRecord(body.codexQuotaAutoRefresh)) {
+        return jsonResponse({ error: "codexQuotaAutoRefresh must be an object" }, 400);
+      }
+      const change = body.codexQuotaAutoRefresh;
+      const id = typeof change.id === "string" ? change.id.trim() : "";
+      if (!isCodexAccountPriorityKey(id)) return jsonResponse({ error: "Invalid account id format" }, 400);
+      if (change.window !== "fiveHour" && change.window !== "weekly") {
+        return jsonResponse({ error: "window must be fiveHour or weekly" }, 400);
+      }
+      if (typeof change.enabled !== "boolean") return jsonResponse({ error: "enabled must be a boolean" }, 400);
+      const exists = id === MAIN_CODEX_ACCOUNT_ID
+        || (config.codexAccounts ?? []).some(account => isSelectableCodexPoolAccount(account) && account.id === id);
+      if (!exists) return jsonResponse({ error: "Account not found" }, 404);
+      const status = codexQuotaAutoRefreshStatus(config, id, getAccountQuota(id));
+      if (change.enabled && !status[change.window === "fiveHour" ? "fiveHourAvailable" : "weeklyAvailable"]) {
+        return jsonResponse({ error: "Quota window is not available for this account" }, 409);
+      }
+      quotaAutoRefreshChange = { id, window: change.window, enabled: change.enabled };
+    }
     if (body.appOwnedMemoryBudgetMb !== undefined && (
       typeof body.appOwnedMemoryBudgetMb !== "number"
       || !Number.isInteger(body.appOwnedMemoryBudgetMb)
@@ -443,10 +498,16 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       hasCodexAccountNamespaces: Object.hasOwn(config, "codexAccountNamespaces"),
       codexAccountPickerEnabled: config.codexAccountPickerEnabled,
       hasCodexAccountPickerEnabled: Object.hasOwn(config, "codexAccountPickerEnabled"),
+      codexQuotaAutoRefresh: config.codexQuotaAutoRefresh,
+      hasCodexQuotaAutoRefresh: Object.hasOwn(config, "codexQuotaAutoRefresh"),
       oauthOpenBrowser: config.oauthOpenBrowser,
       hasOauthOpenBrowser: Object.hasOwn(config, "oauthOpenBrowser"),
       showCodexSparkQuota: config.showCodexSparkQuota,
       hasShowCodexSparkQuota: Object.hasOwn(config, "showCodexSparkQuota"),
+      ultraFastTier: config.ultraFastTier,
+      hasUltraFastTier: Object.hasOwn(config, "ultraFastTier"),
+      codexMainAccountHardLock: config.codexMainAccountHardLock,
+      hasCodexMainAccountHardLock: Object.hasOwn(config, "codexMainAccountHardLock"),
       codexDesktopAuthless: config.codexDesktopAuthless,
       hasCodexDesktopAuthless: Object.hasOwn(config, "codexDesktopAuthless"),
     };
@@ -479,8 +540,25 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       if (typeof body.showCodexSparkQuota === "boolean") {
         config.showCodexSparkQuota = body.showCodexSparkQuota;
       }
+      // Off deletes the key rather than persisting `false`: absent is the documented
+      // default, and a written `false` would survive as a decision nobody made.
+      if (body.ultraFastTier === true) config.ultraFastTier = true;
+      else if (body.ultraFastTier === false) deleteConfigTopLevelKey(config, "ultraFastTier");
+      if (body.codexMainAccountHardLock === true) config.codexMainAccountHardLock = true;
+      else if (body.codexMainAccountHardLock === false) deleteConfigTopLevelKey(config, "codexMainAccountHardLock");
       if (body.codexDesktopAuthless === true) config.codexDesktopAuthless = true;
       else if (body.codexDesktopAuthless === false) deleteConfigTopLevelKey(config, "codexDesktopAuthless");
+      if (quotaAutoRefreshChange) {
+        const { id, window, enabled } = quotaAutoRefreshChange;
+        const setting = { ...(config.codexQuotaAutoRefresh?.[id] ?? {}) };
+        if (enabled) setting[window] = true;
+        else delete setting[window];
+        const all = { ...(config.codexQuotaAutoRefresh ?? {}) };
+        if (Object.keys(setting).length > 0) all[id] = setting;
+        else delete all[id];
+        if (Object.keys(all).length > 0) config.codexQuotaAutoRefresh = all;
+        else deleteConfigTopLevelKey(config, "codexQuotaAutoRefresh");
+      }
       pickerIsEnabled = codexAccountPickerEnabled(config);
       (deps.saveConfigPreservingClaudeCode ?? saveConfigPreservingClaudeCode)(config);
     } catch (error) {
@@ -497,12 +575,21 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       if (previousSettings.hasCodexAccountPickerEnabled) {
         config.codexAccountPickerEnabled = previousSettings.codexAccountPickerEnabled;
       } else deleteConfigTopLevelKey(config, "codexAccountPickerEnabled");
+      if (previousSettings.hasCodexQuotaAutoRefresh) {
+        config.codexQuotaAutoRefresh = previousSettings.codexQuotaAutoRefresh;
+      } else deleteConfigTopLevelKey(config, "codexQuotaAutoRefresh");
       if (previousSettings.hasOauthOpenBrowser) {
         config.oauthOpenBrowser = previousSettings.oauthOpenBrowser;
       } else deleteConfigTopLevelKey(config, "oauthOpenBrowser");
       if (previousSettings.hasShowCodexSparkQuota) {
         config.showCodexSparkQuota = previousSettings.showCodexSparkQuota;
       } else deleteConfigTopLevelKey(config, "showCodexSparkQuota");
+      if (previousSettings.hasUltraFastTier) {
+        config.ultraFastTier = previousSettings.ultraFastTier;
+      } else deleteConfigTopLevelKey(config, "ultraFastTier");
+      if (previousSettings.hasCodexMainAccountHardLock) {
+        config.codexMainAccountHardLock = previousSettings.codexMainAccountHardLock;
+      } else deleteConfigTopLevelKey(config, "codexMainAccountHardLock");
       if (previousSettings.hasCodexDesktopAuthless) {
         config.codexDesktopAuthless = previousSettings.codexDesktopAuthless;
       } else deleteConfigTopLevelKey(config, "codexDesktopAuthless");
@@ -522,16 +609,20 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       ? catalogRefreshIsPending(catalogRefresh)
       : false;
     invalidateStartupHealthCache();
+    if (quotaAutoRefreshChange) void runCodexQuotaAutoRefresh(config);
     return jsonResponse({
       ok: true,
       codexAutoStart: codexAutoStartEnabled(config),
       streamMode: config.streamMode ?? "auto",
       appOwnedMemoryBudgetMb: config.appOwnedMemoryBudgetMb ?? 256,
       codexAccountPickerEnabled: pickerIsEnabled,
+      codexQuotaAutoRefresh: quotaAutoRefreshSettings(config),
       oauthOpenBrowser: config.oauthOpenBrowser !== false,
       catalogRefreshPending,
       showCodexSparkQuota: config.showCodexSparkQuota === true,
       codexDesktopAuthless: authlessIsEnabled,
+      codexMainAccountHardLock: config.codexMainAccountHardLock === true,
+      mainAccountHardLock: getMainAccountHardLockStatus(config),
       startupHealth: await readStartupHealth(config),
     });
   }
@@ -679,7 +770,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
     }
     // Reject ONLY a model we can prove is blind. An id nothing knows about stays
     // allowed: the operator may be ahead of our catalog, and the runtime never
-    // required catalog membership (`tests/vision-reasoning-contract.test.ts`
+    // required catalog membership (`tests/vision/vision-reasoning-contract.test.ts`
     // pins `custom-vision` → 200). The catalog is read ONCE and reused for the
     // rejection body, so a 400 cannot cost two provider fetches.
     if (body.vision && typeof body.vision.model === "string" && body.vision.model !== "") {

package/src/server/management/integration-routes.ts

@@ -76,6 +76,15 @@ export interface IntegrationJournalRow {
   configPath: string;
   snapshot: "none" | "stored" | "expired";
   undoable: boolean;
+  /**
+   * May the operator retire this row?
+   *
+   * Computed HERE, not in the GUI, because the DELETE route enforces the same
+   * rule and two copies of it would drift. False for a client newest row: it
+   * is the undo entry point (`undoable` above keys off exactly this), and it
+   * is what a user reaches for right after the mistake.
+   */
+  deletable: boolean;
 }
 
 export interface IntegrationToggleBody {
@@ -293,6 +302,94 @@ function writerFailureResponse(
   }, 500, ctx.req, ctx.config);
 }
 
+/**
+ * Who asked for this deletion, as an audit value that is safe to persist.
+ *
+ * The tombstone lives in an append-only log the user can read, so this must be
+ * a principal NAME and nothing else -- never the admin token, a session id, or
+ * a filesystem path. `principal` is undefined only in direct-dispatch tests,
+ * which the auth gate documents as the untrusted admin-token case.
+ */
+function journalDeletePrincipal(ctx: ManagementContext): string {
+  return ctx.principal ?? "admin-token";
+}
+
+/**
+ * Retire one journal row at the operator request.
+ *
+ * The opId travels in the QUERY STRING, matching DELETE
+ * /api/codex-auth/accounts?id= -- the repository other DELETE-by-identifier. A
+ * body on DELETE is legal but unevenly handled by intermediaries, and there is
+ * nothing here a query cannot carry.
+ */
+async function handleJournalDelete(ctx: ManagementContext): Promise<Response> {
+  const { req, url } = ctx;
+  const opId = url.searchParams.get("opId")?.trim();
+  if (!opId) {
+    return jsonResponse({
+      error: "opId must be a non-empty string",
+      code: "invalid_op_id",
+    }, 400, req, ctx.config);
+  }
+  try {
+    const store = integrationStore();
+    const operation = store.findOperation(opId);
+    if (!operation) {
+      // Already retired, or never existed. Both are 404: the tombstone hides
+      // the row from findOperation, so a double-click is idempotent here
+      // rather than a second deletion of something.
+      return jsonResponse({
+        error: "integration operation not found",
+        code: "integration_operation_not_found",
+        opId,
+      }, 404, req, ctx.config);
+    }
+    /*
+     * The newest row per client is refused, and refused by the SERVER even
+     * though the GUI already hides its button. The button is a courtesy; this
+     * is the rule. An admin-token caller has no GUI at all.
+     *
+     * Re-read immediately before the write: a restore that landed while the
+     * dialog was open appends a new row and changes which opId is newest.
+     */
+    const newest = store.listOperations(operation.clientId, 1)[0];
+    if (newest?.opId === opId) {
+      return jsonResponse({
+        error: "the newest operation for a client cannot be deleted",
+        code: "integration_journal_newest_protected",
+        clientId: operation.clientId,
+        opId,
+      }, 409, req, ctx.config);
+    }
+
+    store.retireOperation({
+      tombstone: opId,
+      at: new Date().toISOString(),
+      by: journalDeletePrincipal(ctx),
+    });
+
+    /*
+     * Snapshot bytes go too, and go AFTER the tombstone -- the same post-commit
+     * ordering appendOperation uses (journal.ts rule 1). If this fails, the row
+     * is still retired and retentionDegraded discloses the leftover file; the
+     * reverse order would delete a user backup for a deletion that then failed
+     * to record.
+     */
+    const pruned = store.pruneSnapshots(operation.clientId);
+    if (pruned.ok) store.clearPruneFailure(operation.clientId);
+    else store.markPruneFailure(operation.clientId, pruned.error);
+
+    return jsonResponse({
+      ok: true,
+      opId,
+      clientId: operation.clientId,
+      snapshotRemoved: pruned.ok,
+    }, 200, req, ctx.config);
+  } catch (error) {
+    return internalErrorResponse(error, ctx);
+  }
+}
+
 export async function handleIntegrationRoutes(ctx: ManagementContext): Promise<Response | null> {
   const { req, url } = ctx;
 
@@ -319,6 +416,10 @@ export async function handleIntegrationRoutes(ctx: ManagementContext): Promise<R
     }
   }
 
+  if (url.pathname === "/api/client-integrations/journal" && req.method === "DELETE") {
+    return handleJournalDelete(ctx);
+  }
+
   if (url.pathname === "/api/client-integrations/journal") {
     if (req.method !== "GET") return null;
     const requestedClient = url.searchParams.get("client");
@@ -371,6 +472,13 @@ export async function handleIntegrationRoutes(ctx: ManagementContext): Promise<R
             const current = currentConfigText(operation.configPath);
             return current === undefined ? false : matchesOperationResult(operation, current);
           })(),
+          /*
+           * Deliberately NOT an `undoable` derivative. The two axes are
+           * independent: an expired row is undoable-false and deletable-true,
+           * which is the pairing this route exists to produce -- a row whose
+           * bytes are gone previously carried no action at all.
+           */
+          deletable: newestByClient.get(operation.clientId) !== operation.opId,
         };
       });
       return jsonResponse({ operations } satisfies IntegrationJournalEnvelope, 200, req, ctx.config);

package/src/server/management/model-routes.ts

@@ -154,6 +154,7 @@ import { isPlainRecord, parseDebugLogQuery, tokPerSecondResult, unavailableCostR
 import type { MetricUnavailableReason, TokPerSecondResult, CostEstimateReason, CostResult, MetricSource } from "./shared";
 import type { ManagementContext } from "./context";
 import { listManagementModelRows, loadExportModels } from "./model-rows";
+import { initialModelSelectionPending } from "../../providers/initial-model-selection";
 import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
 import {
   hasModelPreset,
@@ -536,6 +537,9 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
     }
 
     const providerConfig = hasOwnProvider(config.providers, provider) ? config.providers[provider] : undefined;
+    if (initialModelSelectionPending(providerConfig)) {
+      return jsonResponse({ error: "Initial model discovery is pending. Refresh the model list and retry.", code: "initial_model_selection_pending" }, 409);
+    }
     const isVirtualComboNamespace = provider === COMBO_NAMESPACE && !preservesPhysicalComboProvider(config);
     if (!providerConfig && provider !== "openai" && !isVirtualComboNamespace) {
       return jsonResponse({ error: "unknown model visibility provider" }, 400);
@@ -836,7 +840,13 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
     if (mode !== "preset" && mode !== "all" && mode !== "custom") {
       return jsonResponse({ error: "mode must be preset, all, or custom" }, 400);
     }
+    if (mode === "preset" && !hasModelPreset(provider)) {
+      return jsonResponse({ error: `no model preset is shipped for provider '${provider}'` }, 400);
+    }
     const target = config.providers[provider];
+    if (initialModelSelectionPending(target)) {
+      return jsonResponse({ error: "Initial model discovery is pending. Refresh the model list and retry.", code: "initial_model_selection_pending" }, 409);
+    }
     if (mode === "all") {
       // Same effect as today's empty-list PUT: no allowlist, no marker to reconcile.
       delete target.selectedModels;
@@ -851,9 +861,6 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
       persistConfig(config);
       return jsonResponse({ ok: true, provider, mode, selected: [...(target.selectedModels ?? [])] });
     }
-    if (!hasModelPreset(provider)) {
-      return jsonResponse({ error: `no model preset is shipped for provider '${provider}'` }, 400);
-    }
     const models = await fetchAllModels(config);
     const catalogIds = models.filter(m => m.provider === provider).map(m => m.id);
     const presetIds = materializeModelPreset(provider, catalogIds);
@@ -900,6 +907,9 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
     if (!provider || !hasOwnProvider(config.providers, provider)) {
       return jsonResponse({ error: "unknown provider" }, provider ? 404 : 400);
     }
+    if (initialModelSelectionPending(config.providers[provider])) {
+      return jsonResponse({ error: "Initial model discovery is pending. Refresh the model list and retry.", code: "initial_model_selection_pending" }, 409);
+    }
     const models = Array.isArray(body.models)
       ? [...new Set(body.models.filter((m): m is string => typeof m === "string"))]
       : [];

package/src/server/management/model-rows.ts

@@ -27,6 +27,9 @@ import { routedSlug, slugEquals } from "../../providers/slug-codec";
 import type { OcxConfig } from "../../types";
 import { ensureCodexEntitlementFreshness } from "../../codex/model-entitlements";
 import { fetchAllModels } from "./shared";
+import { initialModelSelectionPending } from "../../providers/initial-model-selection";
+import { catalogFastRowEligible, fastRowId } from "../fast-row";
+import { knownEffortRowIds } from "../effort-row";
 
 /**
  * One row of the `/api/models` list. Routed rows spread a `CatalogModel`, so the shape is
@@ -38,9 +41,11 @@ export type ManagementModelRow = Partial<CatalogModel> & {
   id: string;
   namespaced: string;
   disabled: boolean;
+  initialSelectionPending?: boolean;
   native?: boolean;
   custom?: boolean;
   customId?: string;
+  fastRowAvailable?: boolean;
   displayNameOverride?: string;
   displayNameSource?: "operator" | "provider" | "fallback";
 };
@@ -164,7 +169,20 @@ export async function listManagementModelRows(
       ...(contextCap !== undefined ? { contextCap, contextCapped: m.contextCapped === true } : {}),
     };
   }).filter((row): row is ManagementModelRow => row !== null);
-  return [...native, ...dedupedRouted, ...visibleCustomModels];
+  const rows = [...native, ...dedupedRouted, ...visibleCustomModels];
+  // Include disabled rows and configured aliases before the export visibility filter:
+  // a hidden real `x--fast` must never become a synthetic selector for another model.
+  const knownIds = config.fastRows === false ? new Set<string>() : knownEffortRowIds(config);
+  for (const row of rows) knownIds.add(row.namespaced);
+  return rows.map(row => {
+    const pending = initialModelSelectionPending(config.providers[row.provider]);
+    return {
+      ...row,
+      ...(pending ? { disabled: true, initialSelectionPending: true } : {}),
+      fastRowAvailable: !row.disabled && !pending
+        && !knownIds.has(fastRowId(row.namespaced)) && catalogFastRowEligible(config, row),
+    };
+  });
 }
 
 /** `/api/models` row → the narrower input the client-config serializers accept. */
@@ -173,6 +191,7 @@ export function toExportModel(row: ManagementModelRow): ExportModel {
     namespaced: row.namespaced,
     provider: row.provider,
     id: row.id,
+    fastRowAvailable: row.fastRowAvailable === true,
     ...(row.native ? { native: true } : {}),
     ...(row.displayName && row.displayNameSource !== "fallback" ? { displayName: row.displayName } : {}),
     ...(row.contextWindow !== undefined ? { contextWindow: row.contextWindow } : {}),

package/src/server/management/native-integration-routes.ts

@@ -17,9 +17,11 @@
  * Design of record: devlog/_fin/260803_integrations_toggle_all/030 (routes),
  * 011 (Claude Code), 012 (Grok).
  */
+import { join } from "node:path";
 import { loadConfig, saveConfigPreservingClaudeCode } from "../../config";
 import { readRuntimePort } from "../../config/process-state";
 import { desktopVisibleNativeSlugs, filterCatalogVisibleModels, nativeContextLimits } from "../../codex/catalog";
+import { getCodexHome } from "../../codex/paths";
 import { providerContextCap } from "../../providers/context-cap";
 import { OPENAI_CODEX_PROVIDER_ID } from "../../providers/openai-tiers";
 import { inspectDesktop3pConfigLibrary, removeDesktop3pStandardPivot, writeDesktop3pConfig } from "../../claude/desktop-3p";
@@ -682,8 +684,9 @@ export async function handleNativeIntegrationRoutes(ctx: ManagementContext): Pro
 
   if (url.pathname === "/api/native-integrations" && req.method === "GET") {
     const { getConfigPath } = await import("../../config");
+    const codexConfigPath = join(getCodexHome(), "config.toml");
     return jsonResponse({
-      clients: [claudeStatus(config, getConfigPath()), grokStatus(config), codexStatus(config, getConfigPath()), desktopStatus(config)],
+      clients: [claudeStatus(config, getConfigPath()), grokStatus(config), codexStatus(config, codexConfigPath), desktopStatus(config)],
     } satisfies NativeStatusListEnvelope);
   }