@bitkyc08/opencodex 2.42.0 → 2.43.0

package/src/server/management/oauth-account-routes.ts

@@ -30,7 +30,7 @@ import { enrichProviderFromCatalog, listKeyLoginProviders } from "../../oauth/ke
 import { deriveProviderPresets } from "../../providers/derive";
 import { providerCodexAccountMode } from "../../providers/registry";
 import { routedSlug, slugEquals } from "../../providers/slug-codec";
-import { clearAccountQuotaCache, clearProviderQuotaCache, fetchProviderAccountQuotas, fetchProviderQuotaReports, hasPassiveAccountQuota, readPassiveProviderAccountQuotas, supportsPerAccountQuota } from "../../providers/quota";
+import { clearAccountQuotaCache, clearProviderQuotaCache, fetchProviderAccountQuotas, fetchProviderApiKeyQuotas, fetchProviderQuotaReports, providerOAuthAccountQuotaMode, providerApiKeyQuotaMode, readPassiveProviderAccountQuotas } from "../../providers/quota";
 import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
 import { clearThreadAccountMap } from "../../codex/routing";
 import {
@@ -254,7 +254,8 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
   if (url.pathname === "/api/oauth/accounts" && req.method === "GET") {
     const provider = (url.searchParams.get("provider") ?? "").trim().toLowerCase();
     if (!isPublicOAuthProvider(provider)) return jsonResponse({ error: "unknown oauth provider" }, 400);
-    const status = getLoginStatus(provider);
+    const quotaMode = providerOAuthAccountQuotaMode(provider);
+    const quotaProvider = config.providers[provider];
     const { getAccountSet } = await import("../../oauth/store");
     const {
       oauthAccountHealthFields,
@@ -274,26 +275,26 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
               needsReauth: summary.needsReauth === true,
               reauthReason: summary.needsReauth === true ? "refresh_failed" : undefined,
             });
-          return { ...summary, ...oauthAccountHealthFields(provider, summary.id, health) };
+          return { ...summary, ...oauthAccountHealthFields(provider, summary.id, health), quotaMode };
         }),
       };
     };
     // Per-account rate limits: Anthropic reports usage per credential, so every logged-in
     // account can show its own 5h/weekly bars (not just the active one). Opt-in via ?quota=1
     // so the plain account list stays a cheap local read; ?refresh=1 bypasses the TTL.
-    const wantQuota = url.searchParams.get("quota") === "1" && supportsPerAccountQuota(provider);
+    const wantQuota = url.searchParams.get("quota") === "1" && quotaMode === "probe";
     // Meta publishes no quota endpoint: its usage is observed in-band on streaming turns
     // and read back from the cache here. `?refresh=1` is accepted and ignored on this
     // path rather than rejected -- the GUI sends it for every provider on a manual
     // refresh, and a 400 would report an error for what is simply a no-op.
-    const passiveQuota = url.searchParams.get("quota") === "1" && hasPassiveAccountQuota(provider);
+    const passiveQuota = url.searchParams.get("quota") === "1" && quotaMode === "passive";
     if (!wantQuota && !passiveQuota) return jsonResponse(projectAccounts());
     const forceRefresh = url.searchParams.get("refresh") === "1";
     // Probing may refresh the active credential and mark needsReauth — project health
     // from the post-probe store so the response is not stale.
     const rows = passiveQuota
       ? readPassiveProviderAccountQuotas(provider)
-      : await fetchProviderAccountQuotas(provider, forceRefresh);
+      : await fetchProviderAccountQuotas(provider, forceRefresh, quotaProvider);
     const byId = new Map(rows.map(row => [row.accountId, row]));
     const projected = projectAccounts();
     return jsonResponse({
@@ -301,10 +302,13 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
       accounts: projected.accounts.map(account => {
         const row = byId.get(account.id);
         if (!row) return account;
+        if (config.providers[provider] !== quotaProvider || row.isCurrent?.() === false) {
+          return { ...account, quota: null, quotaUnavailable: true };
+        }
         return {
           ...account,
           quota: row.quota,
-          ...(row.unavailable ? { quotaUnavailable: true } : {}),
+          ...(quotaMode === "probe" ? { quotaUnavailable: row.unavailable === true } : {}),
         };
       }),
     });
@@ -333,8 +337,10 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
   if (url.pathname === "/api/oauth/accounts/pool" && req.method === "GET") {
     const provider = (url.searchParams.get("provider") ?? "").trim().toLowerCase();
     if (provider !== "anthropic") {
-      // Generic OAuth pool-settings contract (#695 slice 1): persisted per provider, inert until
-      // the selector consumes it. Codex keeps /api/codex-auth; api-key providers have no pool.
+      // Generic OAuth pool-settings contract (#695 slice 1): persisted per provider. `strategy`
+      // and `autoSwitchThreshold` stay inert until the selector consumes them; `enabled` already
+      // governs the pre-dispatch account preference. Codex keeps /api/codex-auth; api-key
+      // providers have no pool.
       const { poolSettingsCapability, genericPoolSettingsDto } = await import("../../oauth/pool-settings-capability");
       const prov = config.providers[provider];
       if (!provider || !prov || poolSettingsCapability(provider, prov) !== "generic") {
@@ -570,7 +576,29 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     const name = (url.searchParams.get("name") ?? "").trim();
     if (!name || !isValidProviderName(name) || !hasOwnProvider(config.providers, name)) return jsonResponse({ error: "unknown provider" }, 404);
     const { listProviderApiKeys } = await import("../../providers/api-keys");
-    return jsonResponse(listProviderApiKeys(config, name));
+    const projectKeys = () => {
+      const listed = listProviderApiKeys(config, name);
+      const provider = config.providers[name];
+      const quotaMode = provider ? providerApiKeyQuotaMode(name, provider) : "unsupported";
+      return { ...listed, keys: listed.keys.map(key => ({ ...key, quotaMode })) };
+    };
+    const initial = projectKeys();
+    if (url.searchParams.get("quota") !== "1" || !initial.keys.some(key => key.quotaMode === "probe")) {
+      return jsonResponse(initial);
+    }
+    const rows = await fetchProviderApiKeyQuotas(config, name, url.searchParams.get("refresh") === "1");
+    const byId = new Map(rows.map(row => [row.keyId, row]));
+    const current = projectKeys();
+    return jsonResponse({
+      activeId: current.activeId,
+      keys: current.keys.map(key => {
+        const row = byId.get(key.id);
+        if (!row || key.quotaMode !== "probe") return key;
+        if (!row.isCurrent()) return { ...key, quota: null, quotaUnavailable: true };
+        // Internal identity/epoch checks never enter the JSON DTO.
+        return { ...key, quota: row.quota, quotaUnavailable: row.unavailable === true };
+      }),
+    });
   }
   if (url.pathname === "/api/providers/keys" && req.method === "POST") {
     const body = await readManagementJsonBodyOr(req, {}) as { name?: string; key?: string; label?: string };

package/src/server/management/provider-routes.ts

@@ -41,10 +41,12 @@ import { fetchCursorUsableModels } from "../../adapters/cursor/live-models";
 import { parseAntigravityAvailableModels } from "../../providers/antigravity-models";
 import { enrichProviderFromCatalog, listKeyLoginProviders } from "../../oauth/key-providers";
 import { deriveProviderPresets, providerConfigSeed } from "../../providers/derive";
+import { initializeProviderModelSelection } from "../../providers/initial-model-selection";
 import { effectiveGoogleMode, providerCodexAccountMode, providerMatchesRegistryTransport } from "../../providers/registry";
 import {
   extractModelEnvelopeRows,
   extractProviderModelItems,
+  isRegistryModelDiscoveryUrl,
   readBoundedDiscoveryJson,
   resolveProviderModelDiscovery,
 } from "../../providers/model-discovery";
@@ -102,6 +104,7 @@ import { refreshUserCostOverlays } from "../../usage/user-cost-overlays";
 import { redactSecretString } from "../../lib/redact";
 import {
   XAI_RESPONSES_OPT_IN_MODELS,
+  XAI_RESPONSES_DEFAULT_VERSION,
   xaiResponsesOptInState,
 } from "../../providers/xai-responses-opt-in";
 import { dropProviderCustomModels } from "../../providers/provider-id-rewrite";
@@ -286,6 +289,10 @@ function adoptProviderEditorCandidate(live: OcxConfig, persisted: OcxConfig): vo
   else live.customModels = structuredClone(persisted.customModels);
   if (persisted.providerContextCaps === undefined) delete live.providerContextCaps;
   else live.providerContextCaps = structuredClone(persisted.providerContextCaps);
+  if (persisted.disabledModels === undefined) delete live.disabledModels;
+  else live.disabledModels = [...persisted.disabledModels];
+  if (persisted.modelDiscovery === undefined) delete live.modelDiscovery;
+  else live.modelDiscovery = structuredClone(persisted.modelDiscovery);
 }
 
 /**
@@ -391,10 +398,11 @@ function applyProviderPatchFields(
     const modelAdapters = { ...(next.modelAdapters ?? {}) };
     for (const model of XAI_RESPONSES_OPT_IN_MODELS) {
       if (rawBody.xaiResponsesOptIn) modelAdapters[model] = "openai-responses";
-      else delete modelAdapters[model];
+      else modelAdapters[model] = "openai-chat";
     }
     if (Object.keys(modelAdapters).length > 0) next.modelAdapters = modelAdapters;
     else delete next.modelAdapters;
+    next.xaiResponsesDefaultVersion = Math.max(next.xaiResponsesDefaultVersion ?? 0, XAI_RESPONSES_DEFAULT_VERSION);
     touched = true;
   }
   if (Object.hasOwn(rawBody, "requestPacing")) {
@@ -830,8 +838,15 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       const changed = !isDeepStrictEqual(providerEditorConfigDTO(persisted), nextResult.value);
       if (!changed) return { changed: false, value: candidate };
 
+      for (const [name, provider] of Object.entries(candidate.config.providers)) {
+        if (!Object.hasOwn(persisted.providers, name)) {
+          initializeProviderModelSelection(name, provider, undefined, candidate.config);
+        }
+      }
       persisted.defaultProvider = candidate.config.defaultProvider;
       persisted.providers = structuredClone(candidate.config.providers);
+      persisted.disabledModels = candidate.config.disabledModels;
+      persisted.modelDiscovery = candidate.config.modelDiscovery;
       for (const name of candidate.removedProviders) {
         dropProviderCustomModels(persisted, name);
         setProviderContextCap(persisted, name, false);
@@ -993,6 +1008,18 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     // completed during that wait remains authoritative instead of being overwritten by the
     // older ownership snapshot used to admit this POST.
     restorePersistedAliasOverlays(prov, config.providers[name]);
+    // The add/edit form omits wire choices. Read after DNS so a concurrent switch
+    // remains authoritative, including the marker that protects it on the next boot.
+    if (name === "xai") {
+      const latest = config.providers[name];
+      if (!Object.hasOwn(body.provider, "modelAdapters") && latest?.modelAdapters) {
+        prov.modelAdapters = { ...latest.modelAdapters };
+      }
+      if (latest?.xaiResponsesDefaultVersion !== undefined) {
+        prov.xaiResponsesDefaultVersion = latest.xaiResponsesDefaultVersion;
+      }
+    }
+    initializeProviderModelSelection(name, prov, config.providers[name], config);
     config.providers[name] = stripRegistryOnlyStaticHeaders(name, prov);
     if (body.setDefault === true) config.defaultProvider = name;
     save(config);
@@ -1236,16 +1263,20 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     const discovery = resolveProviderModelDiscovery(name, prov);
     const started = Date.now();
     try {
+      // Same canonical-URL TUN transparency as catalog discovery: the registry's
+      // own fixed discovery URL survives purely-benchmark (Clash/Surge/Mihomo
+      // fake-IP) DNS without proxy env.
+      const outboundDependencies = { isCanonicalUrl: isRegistryModelDiscoveryUrl };
       const res = method === "POST"
         ? await providerOutboundPost(name, prov, modelsUrl, {
           headers,
           body: JSON.stringify({ project }),
           signal: AbortSignal.timeout(8000),
-        })
+        }, outboundDependencies)
         : await providerOutboundGet(name, prov, modelsUrl, {
           headers,
           signal: AbortSignal.timeout(8000),
-        });
+        }, outboundDependencies);
       const latencyMs = Date.now() - started;
       const redirectError = await providerRedirectError(res, modelsUrl);
       if (redirectError) {

package/src/server/management/quota-reset-routes.ts

@@ -0,0 +1,57 @@
+/**
+ * Read-only view of recently detected quota resets.
+ *
+ * Loaded on demand from src/server/management-api.ts, which is the FOURTH entry in the protected
+ * set of tests/core-lab-boundary.test.ts — added precisely because eagerly importing handlers
+ * there put ~70 modules on every dashboard request. A static import here would make this
+ * subsystem the next instance of that bug.
+ *
+ * Authentication is inherited: every /api route passes through requireManagementAuth before the
+ * chain runs, so a read-only GET adds no auth code of its own. It spends no user identity and
+ * mutates nothing.
+ */
+
+import { jsonResponse } from "../auth-cors";
+import type { ManagementContext } from "./context";
+
+const DEFAULT_LIMIT = 20;
+const MAX_LIMIT = 100;
+
+export async function handleQuotaResetRoutes(ctx: ManagementContext): Promise<Response | null> {
+  const { url, req, config } = ctx;
+  if (url.pathname !== "/api/quota-resets") return null;
+  if (req.method !== "GET") return null;
+
+  const rawLimit = url.searchParams.get("limit");
+  if (rawLimit !== null && !/^\d+$/.test(rawLimit)) {
+    return jsonResponse(
+      { error: { code: "invalid_limit", message: "limit must be a non-negative integer" } },
+      400,
+      req,
+      config,
+    );
+  }
+  const limit = rawLimit === null
+    ? DEFAULT_LIMIT
+    : Math.min(MAX_LIMIT, Number.parseInt(rawLimit, 10));
+
+  // Imported here rather than at module scope so a dashboard request that never touches this
+  // route does not load the store or its state file.
+  const [{ listRecentQuotaResetEvents }, { isQuotaResetNotificationEnabled }] = await Promise.all([
+    import("../../quota/reset-seen-store"),
+    import("../../quota/reset-notify-config"),
+  ]);
+
+  // `enabled` is reported alongside the events because an empty list is ambiguous on its own:
+  // it means either "nothing has reset" or "detection was never turned on", and an operator
+  // debugging a missing notification needs to tell those apart.
+  return jsonResponse(
+    {
+      enabled: isQuotaResetNotificationEnabled(),
+      events: listRecentQuotaResetEvents(limit),
+    },
+    200,
+    req,
+    config,
+  );
+}

package/src/server/management/route-registry.ts

@@ -1,20 +1,20 @@
 /**
  * Declared inventory of every reachable management route.
  *
- * DECLARED, not harvested. A grep cannot see this surface: 18 routes are registered
+ * DECLARED, not harvested. A grep cannot see this surface: 19 routes are registered
  * through a regex, an `endsWith`, a `pathname.slice`, a prefix decode, a path constant, or a
  * negated `pathname !== "…"` guard, and two of those are live routes whose only textual
  * trace is the negated form. For `GET /api/storage` an equality scan finds solely the dead
  * shadowed copy in `logs-usage-routes.ts` and never the live one.
  *
  * This module is pure DATA and must stay that way. It is imported by
- * `src/server/management-api.ts`, which `tests/core-lab-boundary.test.ts` protects: a user
+ * `src/server/management-api.ts`, which `tests/lab/core-lab-boundary.test.ts` protects: a user
  * with one provider and no Lab must execute no Lab code. Route paths are strings, so
  * declaring `/api/lab/status` here creates no module edge. Never import a handler, and
  * never import anything from `src/lab/`. The `module` field names the owning file as text
  * for exactly this reason.
  *
- * Reconciliation lives in `tests/management-route-registry.test.ts`, which resolves
+ * Reconciliation lives in `tests/server/management-route-registry.test.ts`, which resolves
  * `(method, path)` pairs from source and fails loudly on a route whose method it cannot
  * determine. Adding a route without declaring it here fails that test.
  */
@@ -169,6 +169,7 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   // server/management/integration-routes
   { method: "GET", path: "/api/client-integrations", module: "server/management/integration-routes", mutates: false },
   { method: "GET", path: "/api/client-integrations/journal", module: "server/management/integration-routes", mutates: false },
+  { method: "DELETE", path: "/api/client-integrations/journal", module: "server/management/integration-routes", mutates: true, exempt: { reason: "deferred-verb", why: "Retiring one rollback row is a dashboard-local cleanup; the CLI verb that would drive it is owed by a later work-phase and is not implemented here.", owner: "260904_priority65_closeout WP7", ownerDoc: "devlog/_plan/260904_priority65_closeout/060_wp7_rollback_journal_crud.md" } },
   { method: "POST", path: "/api/client-integrations/restore", module: "server/management/integration-routes", mutates: true },
   // server/management/lab-automation-routes
   { method: "GET", path: "/api/lab/automation", module: "server/management/lab-automation-routes", mutates: false, exempt: { reason: "local-transport", why: "ocx lab reads the same rows from the local SQLite projection; src/cli/lab.ts imports ../lab/query directly and never fetches /api/lab." } },
@@ -275,6 +276,8 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "POST", path: "/api/providers/test", module: "server/management/provider-routes", mutates: true },
   { method: "PUT", path: "/api/providers", module: "server/management/provider-routes", mutates: true, exempt: { reason: "deferred-verb", why: "Issue #3280 scopes this atomic batch endpoint to the GUI JSON editor; a matching CLI verb is outside wp5 and remains owed.", owner: "wp5-followup", ownerDoc: "devlog/_plan/260903_bug_drawdown_bcda/050_phase5.md" } },
   { method: "PUT", path: "/api/provider-context-caps", module: "server/management/provider-routes", mutates: true },
+  // server/management/quota-reset-routes
+  { method: "GET", path: "/api/quota-resets", module: "server/management/quota-reset-routes", mutates: false, mechanism: "negated-guard" },
   // server/management/request-history-routes
   { method: "GET", path: "/api/request-history", module: "server/management/request-history-routes", mutates: false },
   // server/management/routing-analytics-routes
@@ -300,7 +303,7 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "GET", path: "/api/system/memory", module: "server/management/system-routes", mutates: false },
   { method: "GET", path: "/api/system/windows-replace-retries", module: "server/management/system-routes", mutates: false },
   { method: "POST", path: "/api/system/restart", module: "server/management/system-routes", mutates: true },
-  // --- Routes an equality scan of their own file cannot see (18). ---
+  // --- Routes an equality scan of their own file cannot see (19). ---
   // Each carries `mechanism`; the reconciliation test counts these separately.
   { method: "GET", path: "/api/storage", module: "server/management/storage-log-guard-routes", mutates: false, mechanism: "negated-guard" },
   { method: "GET", path: "/api/routing-analytics", module: "server/management/routing-analytics-routes", mutates: false, mechanism: "negated-guard" },

package/src/server/management/shared.ts

@@ -1,4 +1,6 @@
 import { randomUUID } from "node:crypto";
+import { captureInitialSelectionBaseline, finalizeInitialModelSelection } from "../../providers/initial-model-selection-runtime";
+import { initialModelSelectionPending } from "../../providers/initial-model-selection";
 import { readFileSync } from "node:fs";
 import type { CatalogModel } from "../../codex/catalog";
 import { catalogModelSlug, invalidateCodexModelsCache, nativeModelRows, uniqueCatalogModelsForPublicList } from "../../codex/catalog";
@@ -53,6 +55,7 @@ import { drainAndShutdown } from "../lifecycle";
 import { filterRequestLogs, getRequestLogEntries, type RequestLogEntry } from "../request-log";
 import { estimateComboCost, estimateRequestCost, serviceTierContext, normalizeCostTokens, tokensPerSecond } from "../../usage/cost";
 import type { PersistedUsageAttempt } from "../../usage/log";
+import { usageModelPriceOptions } from "../../usage/model-identity";
 import { isAllowedRequestOrigin, jsonResponse, providerManagementConfigError, publicProviderBaseUrl, safeConfigDTO } from "../auth-cors";
 import { applySystemEnvToggle } from "../system-env";
 
@@ -93,7 +96,7 @@ export type CostResult =
   | { kind: "value"; estimate: NonNullable<ReturnType<typeof estimateRequestCost>>; estimateReasons: CostEstimateReason[] }
   | { kind: "unavailable"; reason: MetricUnavailableReason };
 
-export type MetricSource = Pick<RequestLogEntry, "provider" | "model" | "durationMs" | "usageStatus" | "usage" | "requestedServiceTier" | "configuredServiceTier" | "responseServiceTier" | "tierOutcome"> & {
+export type MetricSource = Pick<RequestLogEntry, "provider" | "model" | "durationMs" | "usageStatus" | "usage" | "requestedServiceTier" | "configuredServiceTier" | "responseServiceTier" | "tierOutcome" | "routeDecision"> & {
   attempts?: readonly PersistedUsageAttempt[];
 };
 
@@ -132,8 +135,8 @@ export function unavailableCostReason(entry: MetricSource): MetricUnavailableRea
 export function costResult(entry: MetricSource): CostResult {
   const tier = serviceTierContext(entry);
   const estimate = entry.attempts?.length
-    ? estimateComboCost(entry.attempts, undefined, tier)
-    : estimateRequestCost({ provider: entry.provider, model: entry.model, usage: entry.usage, usageStatus: entry.usageStatus, serviceTier: tier });
+    ? estimateComboCost(entry.attempts.map(attempt => ({ ...attempt, ...usageModelPriceOptions(entry, attempt) })), undefined, tier)
+    : estimateRequestCost({ provider: entry.provider, model: entry.model, usage: entry.usage, usageStatus: entry.usageStatus, serviceTier: tier, ...usageModelPriceOptions(entry, entry) });
   if (!estimate) return { kind: "unavailable", reason: unavailableCostReason(entry) };
   const estimateReasons = [
     entry.usageStatus === "estimated" || entry.usage?.estimated ? "usage_estimated" as const : undefined,
@@ -162,7 +165,7 @@ export function requestLogDto(entry: RequestLogEntry): Record<string, unknown> {
           ...attempt,
           displayMetrics: {
             tokPerSecond: tokPerSecondResult(attempt),
-            cost: costResult({ ...attempt, attempts: undefined, requestedServiceTier: entry.requestedServiceTier, configuredServiceTier: entry.configuredServiceTier, responseServiceTier: entry.responseServiceTier }),
+            cost: costResult({ ...attempt, attempts: undefined, routeDecision: entry.routeDecision, requestedServiceTier: entry.requestedServiceTier, configuredServiceTier: entry.configuredServiceTier, responseServiceTier: entry.responseServiceTier }),
           },
         })),
       }
@@ -178,7 +181,13 @@ export function requestLogDto(entry: RequestLogEntry): Record<string, unknown> {
  */
 export async function fetchAllModels(config: OcxConfig): Promise<CatalogModel[]> {
   const { gatherRoutedModels } = await import("../../codex/catalog");
-  return gatherRoutedModels(config);
+  const baseline = captureInitialSelectionBaseline(config);
+  if (!baseline) return gatherRoutedModels(config);
+  const outcomes: Array<{ provider: string; state: "authoritative" | "degraded" }> = [];
+  const models = await gatherRoutedModels(config, { providerModelOutcomes: outcomes });
+  finalizeInitialModelSelection(config, baseline, uniqueCatalogModelsForPublicList(models),
+    outcomes.filter(outcome => outcome.state === "authoritative").map(outcome => outcome.provider));
+  return models;
 }
 
 export interface GrokCandidateModel {
@@ -187,6 +196,11 @@ export interface GrokCandidateModel {
   native: boolean;
 }
 
+/** Configuration pickers may retain disabled choices, but never offer provisional models. */
+export async function fetchInitializedModels(config: OcxConfig): Promise<CatalogModel[]> {
+  return (await fetchAllModels(config)).filter(model => !initialModelSelectionPending(config.providers[model.provider]));
+}
+
 /**
  * The model list `syncGrokConfig` would inject, BEFORE the user's exclusions. The Grok
  * page needs this to show a switch for a model the user has already excluded — such a

package/src/server/management/system-routes.ts

@@ -15,8 +15,9 @@
  * further: it is the proxy's previous_response_id continuation store, so a
  * growing responseState.totalBytes under rising observed memory points at
  * conversation retention rather than the runtime allocator. Spill counts,
- * payload-byte totals, tombstones, and failure counters remain finite scalars;
- * response ids, filenames, digests, paths, and payload content never leave the owner.
+ * payload-byte totals, tombstones, failure counters, fixed health/error enums,
+ * and event timestamps remain finite scalars; response ids, raw errors,
+ * filenames, digests, paths, and payload content never leave the owner.
  *
  * `activeTurnCount` / `isDraining` are scalar lifecycle counters for the
  * dashboard drain-and-restart confirm UX — never request bodies or IDs.

package/src/server/management-api.ts

@@ -101,8 +101,8 @@ const managementConvergenceBindings = new WeakMap<object, Readonly<{
  * Namespace match for management route prefixes: exact hit or a child path, never a
  * prefix collision (`/api/labfoo` must not match `/api/lab`).
  */
-function pathInManagementNamespace(pathname: string, prefix: string): boolean {
-  return pathname === prefix || pathname.startsWith(`${prefix}/`);
+function pathInManagementNamespace(pathname: string, prefix: string, includeChildren = true): boolean {
+  return pathname === prefix || (includeChildren && pathname.startsWith(`${prefix}/`));
 }
 
 /**
@@ -132,6 +132,17 @@ async function handleLabRoutesOnDemand(ctx: ManagementContext): Promise<Response
   return handleLabRoutes(ctx);
 }
 
+/**
+ * Lazy like the Lab and routing-profile handlers, and for the same recorded reason: this file is
+ * mounted for every dashboard request, so a static import would put the quota-reset store and
+ * its config resolution on all of them.
+ */
+async function handleQuotaResetRoutesOnDemand(ctx: ManagementContext): Promise<Response | null> {
+  if (!pathInManagementNamespace(ctx.url.pathname, "/api/quota-resets", false)) return null;
+  const { handleQuotaResetRoutes } = await import("./management/quota-reset-routes");
+  return handleQuotaResetRoutes(ctx);
+}
+
 export async function handleManagementAPI(
   req: Request,
   url: URL,
@@ -229,6 +240,7 @@ export async function handleManagementAPI(
     ??     (await handleStorageLogGuardRoutes(ctx))
     ??     (await handleLogsUsageRoutes(ctx))
     ??     (await handleRequestHistoryRoutes(ctx))
+    ??     (await handleQuotaResetRoutesOnDemand(ctx))
     ??     (await handleRoutingAnalyticsRoutes(ctx))
     ??     (await handleRoutingProfileRoutesOnDemand(ctx))
     ??     (await handleProviderRoutes(ctx))

package/src/server/ports.ts

@@ -1,5 +1,15 @@
 import { createServer } from "node:net";
 
+/** Temporary bind probes must not let accepted peers hold server.close() open. */
+function createProbeServer(): ReturnType<typeof createServer> {
+  const server = createServer();
+  server.on("connection", socket => {
+    socket.on("error", () => socket.destroy());
+    socket.destroy();
+  });
+  return server;
+}
+
 /**
  * True when an error means "this port/address is already bound" — the only bind failure
  * that is safe to answer with a retry on another port. Bun/Node surface it as
@@ -15,7 +25,7 @@ export function isAddrInUse(err: unknown): boolean {
 
 export async function isPortAvailable(port: number, hostname = "127.0.0.1"): Promise<boolean> {
   return await new Promise(resolve => {
-    const server = createServer();
+    const server = createProbeServer();
     // Fail closed: EACCES / EADDRNOTAVAIL / EPERM / unknown listen errors mean the
     // requested bind is not available. Only the listening event reports free.
     server.once("error", () => resolve(false));
@@ -133,7 +143,7 @@ export function setEphemeralPortAllocatorForTests(
 async function allocateEphemeralPort(hostname: string): Promise<number> {
   if (ephemeralAllocator) return ephemeralAllocator(hostname);
   return await new Promise<number>((resolve, reject) => {
-    const server = createServer();
+    const server = createProbeServer();
     server.once("error", reject);
     server.once("listening", () => {
       const address = server.address();