@bitkyc08/opencodex 2.43.0 → 2.44.0

package/src/server/claude-messages.ts

@@ -10,8 +10,9 @@ import { FORWARD_HEADERS } from "../adapters/openai-responses";
 import { sseFieldValue } from "../lib/sse-decoder";
 import { enforceAnthropicImageLimits, sniffImageDimensions } from "../adapters/anthropic-image-guard";
 import { normalizeAnthropicImages } from "../adapters/anthropic-image-normalize";
-import { AnthropicRequestError, anthropicToResponsesTranslation, extractOcxEffortDirective, extractOcxRouteDirective, resolveInboundModel, type ClaudeCacheKeySource } from "../claude/inbound";
-import { resolveDesktop3pAlias } from "../claude/desktop-3p";
+import { AnthropicRequestError, DesktopModelMappingUnavailableError, anthropicToResponsesTranslation, extractOcxEffortDirective, extractOcxRouteDirective, resolveInboundModel, type ClaudeCacheKeySource } from "../claude/inbound";
+import { isKnownDesktop3pModelId, resolveDesktop3pAlias } from "../claude/desktop-3p";
+import { resolveAlias, claudeCodeNativeAlias } from "../claude/alias";
 import { recordDesktopRequest } from "../claude/desktop-health";
 import { stripOneMillionMarker } from "../claude/context-windows";
 import { captureClaudeInbound } from "../claude/inbound-debug";
@@ -72,17 +73,37 @@ type Rec = Record<string, unknown>;
  * resolve a synthetic one.
  */
 function decodeClaudeFastSelector(raw: string, cc?: OcxConfig["claudeCode"]): string {
-  const exact = resolveInboundModel(raw, cc);
-  if (exact !== raw || !raw.endsWith("--fast")) return exact;
-  const bare = raw.slice(0, -"--fast".length);
+  const model = stripOneMillionMarker(raw);
+  const exact = resolveInboundModel(model, cc);
+  if (!model.endsWith("--fast")) return exact;
+  const fullMapping = cc?.modelMap?.[model];
+  if (resolveAlias(model) || isKnownDesktop3pModelId(model)
+    || (typeof fullMapping === "string" && fullMapping.length > 0)) return exact;
+  const bare = model.slice(0, -"--fast".length);
+  // A classifier fallback is not an exact match for a registered Desktop base.
+  // Preserve established non-Desktop fallback behavior while decoding that base first.
+  if (exact !== model && !resolveDesktop3pAlias(bare)) return exact;
   const decodedBase = resolveInboundModel(bare, cc);
   return decodedBase === bare ? exact : `${decodedBase}--fast`;
 }
 
+/** Restore the reversible Fable picker alias before Anthropic passthrough checks. */
+function decodeFablePickerAlias(raw: string, cc?: OcxConfig["claudeCode"]): string {
+  const decoded = resolveInboundModel(raw, cc);
+  if (!decoded.startsWith("claude-fable-")) return raw;
+  return claudeCodeNativeAlias(decoded) === raw ? decoded : raw;
+}
+
 function isRec(v: unknown): v is Rec {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 
+function desktopMappingUnavailableResponse(error: DesktopModelMappingUnavailableError): Response {
+  const response = anthropicErrorResponse(503, error.message, "api_error", "desktop_model_mapping_unavailable");
+  response.headers.set("Retry-After", "1");
+  return response;
+}
+
 /** Resolve Claude-only sidecar overrides without mutating the shared server config. */
 export function buildClaudeReplayConfig(config: OcxConfig): OcxConfig {
   return {
@@ -649,6 +670,9 @@ async function handleClaudeMessagesWithBudget(
         effortOverride = extractOcxEffortDirective(anthropicBody);
       }
     }
+    if (isRec(anthropicBody) && typeof anthropicBody.model === "string") {
+      anthropicBody.model = decodeFablePickerAlias(anthropicBody.model, config.claudeCode);
+    }
     if (isRec(anthropicBody) && typeof anthropicBody.model === "string") {
       requestedModel = anthropicBody.model;
       // Decode for Fast only. A Claude alias is `claude-ocx-<provider>--<model>`, so it
@@ -712,8 +736,10 @@ async function handleClaudeMessagesWithBudget(
     cacheKeySource = translation.cacheKeySource;
   } catch (err) {
     const overflow = isTranslatorBudgetExceededError(err);
-    const status = overflow ? 413 : err instanceof AnthropicRequestError ? 400 : 500;
+    const unavailable = err instanceof DesktopModelMappingUnavailableError;
+    const status = overflow ? 413 : unavailable ? 503 : err instanceof AnthropicRequestError ? 400 : 500;
     if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, status, { closeReason: "non_stream" });
+    if (unavailable) return desktopMappingUnavailableResponse(err);
     return anthropicErrorResponse(
       status,
       overflow ? "request translation buffer exceeded the safe limit" : err instanceof Error ? err.message : String(err),
@@ -1056,6 +1082,7 @@ export async function handleClaudeCountTokens(
   try {
     body = await readAnthropicBody(req, translatorBudget);
   } catch (err) {
+    if (err instanceof DesktopModelMappingUnavailableError) return desktopMappingUnavailableResponse(err);
     if (err instanceof AnthropicRequestError) return anthropicErrorResponse(400, err.message);
     return anthropicErrorResponse(500, err instanceof Error ? err.message : String(err));
   } finally { translatorBudget.dispose(); }
@@ -1066,36 +1093,44 @@ export async function handleClaudeCountTokens(
   if (typeof raw.model !== "string" || raw.model.length === 0) {
     return anthropicErrorResponse(400, "model is required");
   }
-  let model = raw.model;
-  // Case-insensitive [1m] strip (audit 021 #7 — the CLI matches /\[1m\]/i).
-  const stripped = stripOneMillionMarker(model);
-  if (stripped !== model) {
-    model = stripped;
-    raw.model = model;
-  }
-  // ocx-route override (devlog 072): keep count_tokens consistent with messages.
-  const countRoute = extractOcxRouteDirective(raw);
-  if (countRoute) {
-    model = stripOneMillionMarker(countRoute);
-    raw.model = model;
-  }
-  // Fast-only: count_tokens never parsed an effort row, so it must not start. It returns a
-  // token estimate and sends no tier, so only the IDENTITY is corrected - without this the
-  // synthetic id reaches native passthrough as a model Anthropic has never heard of.
-  const countFastRow = parseFastOnlyRowId(
-    config, () => decodeClaudeFastSelector(model, config.claudeCode),
-  );
-  if (countFastRow) {
-    model = countFastRow.baseId;
+  try {
+    let model = raw.model;
+    // Case-insensitive [1m] strip (audit 021 #7 — the CLI matches /\[1m\]/i).
+    const stripped = stripOneMillionMarker(model);
+    if (stripped !== model) {
+      model = stripped;
+      raw.model = model;
+    }
+    // ocx-route override (devlog 072): keep count_tokens consistent with messages.
+    const countRoute = extractOcxRouteDirective(raw);
+    if (countRoute) {
+      model = stripOneMillionMarker(countRoute);
+      raw.model = model;
+    }
+    model = decodeFablePickerAlias(model, config.claudeCode);
     raw.model = model;
+    // Fast-only: count_tokens never parsed an effort row, so it must not start. It returns a
+    // token estimate and sends no tier, so only the IDENTITY is corrected - without this the
+    // synthetic id reaches native passthrough as a model Anthropic has never heard of.
+    const countFastRow = parseFastOnlyRowId(
+      config, () => decodeClaudeFastSelector(model, config.claudeCode),
+    );
+    if (countFastRow) {
+      model = countFastRow.baseId;
+      raw.model = model;
+    }
+    captureClaudeInbound("count_tokens", raw, resolveInboundModel(model, config.claudeCode), req.headers.get("anthropic-beta") ?? undefined);
+    if (wantsNativePassthrough(req, config, requestPolicy, model)) {
+      return await anthropicNativePassthrough(req, config, { model, provider: "anthropic-native", surface: "claude" }, undefined, raw, "/v1/messages/count_tokens");
+    }
+    const inputTokens = estimateClaudeRequestTokens(raw, model);
+    return new Response(JSON.stringify({ input_tokens: inputTokens }), {
+      status: 200,
+      headers: { "Content-Type": "application/json" },
+    });
+  } catch (error) {
+    if (error instanceof DesktopModelMappingUnavailableError) return desktopMappingUnavailableResponse(error);
+    if (error instanceof AnthropicRequestError) return anthropicErrorResponse(400, error.message);
+    throw error;
   }
-  captureClaudeInbound("count_tokens", raw, resolveInboundModel(model, config.claudeCode), req.headers.get("anthropic-beta") ?? undefined);
-  if (wantsNativePassthrough(req, config, requestPolicy, model)) {
-    return await anthropicNativePassthrough(req, config, { model, provider: "anthropic-native", surface: "claude" }, undefined, raw, "/v1/messages/count_tokens");
-  }
-  const inputTokens = estimateClaudeRequestTokens(raw, model);
-  return new Response(JSON.stringify({ input_tokens: inputTokens }), {
-    status: 200,
-    headers: { "Content-Type": "application/json" },
-  });
 }

package/src/server/grok-responses-snapshot-repair.ts

@@ -0,0 +1,333 @@
+/** Strict terminal reconstruction selected by the Grok compatibility marker. */
+import type { TranslatorBudget } from "../lib/translator-budget";
+import { MAX_COMPLETED_OUTPUT_ITEMS, MAX_COMPLETED_OUTPUT_ITEM_SOURCE_BYTES } from "./relay";
+import { sseDataPayload, type SseBlockRewrite } from "./sse-payload-rewrite";
+import { isPlainObject, jsonBlock, type RetainedOutputItem } from "./responses-snapshot-codec";
+
+type SparseTerminalOpenItem = {
+  type: string;
+  id?: string;
+  sourceBytes: number;
+};
+
+type SparseTerminalCompletedItem = RetainedOutputItem & {
+  visibleToGrok: boolean;
+};
+
+const MAX_GROK_OPEN_ITEM_IDENTITY_BYTES = MAX_COMPLETED_OUTPUT_ITEM_SOURCE_BYTES;
+
+const GROK_TERMINAL_OUTPUT_ITEM_TYPES = new Set([
+  "message",
+  "reasoning",
+  "function_call",
+  "custom_tool_call",
+  "web_search_call",
+  "code_interpreter_call",
+  "mcp_call",
+]);
+
+function hasValidOptionalId(item: Record<string, unknown>): boolean {
+  return !("id" in item)
+    || (typeof item.id === "string" && item.id.trim().length > 0);
+}
+
+function hasCompletedStatusWhenPresent(item: Record<string, unknown>): boolean {
+  return !("status" in item) || item.status === "completed";
+}
+
+function isNullableString(value: unknown): boolean {
+  return value === null || typeof value === "string";
+}
+
+function isValidOutputMessagePart(part: unknown): boolean {
+  if (!isPlainObject(part)) return false;
+  if (part.type === "output_text") {
+    return typeof part.text === "string"
+      && (!("annotations" in part) || Array.isArray(part.annotations))
+      && (!("logprobs" in part) || part.logprobs === null || Array.isArray(part.logprobs));
+  }
+  return part.type === "refusal" && typeof part.refusal === "string";
+}
+
+function isValidReasoningPart(part: unknown, type: "summary_text" | "reasoning_text"): boolean {
+  return isPlainObject(part) && part.type === type && typeof part.text === "string";
+}
+
+function isValidWebSearchAction(value: unknown): boolean {
+  if (!isPlainObject(value)) return false;
+  if (value.type === "search") {
+    return typeof value.query === "string"
+      && (!("sources" in value) || value.sources === null || (Array.isArray(value.sources)
+        && value.sources.every(source => isPlainObject(source)
+          && typeof source.type === "string" && typeof source.url === "string")));
+  }
+  if (value.type === "open_page") {
+    return !("url" in value) || isNullableString(value.url);
+  }
+  if (value.type === "find" || value.type === "find_in_page") {
+    return typeof value.url === "string" && typeof value.pattern === "string";
+  }
+  return false;
+}
+
+function isValidCodeInterpreterOutput(value: unknown): boolean {
+  return isPlainObject(value)
+    && ((value.type === "logs" && typeof value.logs === "string")
+      || (value.type === "image" && typeof value.url === "string"));
+}
+
+/**
+ * Validate the pre-field-backfill item carried by a real output_item.done.
+ * Missing ids, message status, and output-text annotations are allowed because
+ * the always-on field backfill safely supplies only those schema defaults.
+ * Contradictory values and semantic content repairs are never accepted as
+ * proof that an empty terminal snapshot was sparse.
+ */
+function trustedGrokCompletedItem(
+  item: Record<string, unknown>,
+): { visibleToGrok: boolean } | null {
+  if (!hasValidOptionalId(item) || !hasCompletedStatusWhenPresent(item)) return null;
+
+  if (item.type === "message") {
+    if (item.role !== "assistant" || !Array.isArray(item.content)) return null;
+    if (!(item.content as unknown[]).every(isValidOutputMessagePart)) return null;
+    if ("phase" in item && item.phase !== "commentary" && item.phase !== "final_answer") return null;
+    return {
+      // grok-build currently turns only output_text parts into final Assistant
+      // content; refusal parts do not satisfy its visible-content gate.
+      visibleToGrok: item.content.some(part => isPlainObject(part)
+        && part.type === "output_text" && typeof part.text === "string" && part.text.length > 0),
+    };
+  }
+
+  if (item.type === "reasoning") {
+    if (!Array.isArray(item.summary)
+      || !item.summary.every(part => isValidReasoningPart(part, "summary_text"))) return null;
+    if ("content" in item && item.content !== null
+      && (!Array.isArray(item.content)
+        || !item.content.every(part => isValidReasoningPart(part, "reasoning_text")))) return null;
+    if ("encrypted_content" in item && !isNullableString(item.encrypted_content)) return null;
+    return { visibleToGrok: false };
+  }
+
+  if (item.type === "function_call") {
+    if (typeof item.call_id !== "string" || item.call_id.trim().length === 0
+      || typeof item.name !== "string" || item.name.trim().length === 0
+      || typeof item.arguments !== "string") return null;
+    return { visibleToGrok: true };
+  }
+
+  if (item.type === "custom_tool_call") {
+    if (typeof item.call_id !== "string" || item.call_id.trim().length === 0
+      || typeof item.name !== "string" || item.name.trim().length === 0
+      || typeof item.input !== "string") return null;
+    return { visibleToGrok: false };
+  }
+
+  if (item.type === "web_search_call") {
+    if (item.status !== "completed" || !isValidWebSearchAction(item.action)) return null;
+    return { visibleToGrok: false };
+  }
+
+  if (item.type === "code_interpreter_call") {
+    if (item.status !== "completed"
+      || typeof item.container_id !== "string" || item.container_id.trim().length === 0
+      || ("code" in item && !isNullableString(item.code))
+      || ("outputs" in item && item.outputs !== null
+        && (!Array.isArray(item.outputs) || !item.outputs.every(isValidCodeInterpreterOutput)))) return null;
+    return { visibleToGrok: false };
+  }
+
+  if (item.type === "mcp_call") {
+    if (typeof item.arguments !== "string"
+      || typeof item.name !== "string" || item.name.trim().length === 0
+      || typeof item.server_label !== "string" || item.server_label.trim().length === 0
+      || ("approval_request_id" in item && !isNullableString(item.approval_request_id))
+      || ("error" in item && !isNullableString(item.error))
+      || ("output" in item && !isNullableString(item.output))) return null;
+    return { visibleToGrok: false };
+  }
+
+  return null;
+}
+
+function plausibleGrokOpenItem(
+  item: Record<string, unknown>,
+): Omit<SparseTerminalOpenItem, "sourceBytes"> | null {
+  const type = typeof item.type === "string" ? item.type : "";
+  if (!GROK_TERMINAL_OUTPUT_ITEM_TYPES.has(type) || !hasValidOptionalId(item)) return null;
+  if ("status" in item && item.status !== "in_progress") return null;
+  if (type === "message") {
+    if ("role" in item && item.role !== "assistant") return null;
+    if ("content" in item && !Array.isArray(item.content)) return null;
+  }
+  return {
+    type,
+    ...(typeof item.id === "string" ? { id: item.id } : {}),
+  };
+}
+
+/**
+ * Narrow client repair for grok-build's Responses consumer.
+ *
+ * grok-build streams text deltas but builds its durable Assistant item only
+ * from response.completed.response.output. Some native Responses streams put
+ * the durable items in output_item.done and finish with a missing or explicit
+ * empty output. Reconstruct only from real, unique, contiguous, bounded done
+ * events whose raw semantics are already valid. Any ambiguity stays byte-level
+ * fail-closed; the provider-opt-in snapshot repair above is unchanged.
+ */
+export function createGrokResponsesSparseTerminalBlockRewrite(
+  budget?: TranslatorBudget,
+): SseBlockRewrite {
+  const openItems = new Map<number, SparseTerminalOpenItem>();
+  const completedItems = new Map<number, SparseTerminalCompletedItem>();
+  let aggregateItemBytes = 0;
+  let aggregateOpenItemBytes = 0;
+  let tainted = false;
+  let hasVisibleOutput = false;
+
+  const clearRetained = (): void => {
+    const retainedBytes = aggregateItemBytes + aggregateOpenItemBytes;
+    if (retainedBytes > 0) {
+      budget?.releaseRetained(retainedBytes, { kind: "retained_collectors" });
+    }
+    openItems.clear();
+    completedItems.clear();
+    aggregateItemBytes = 0;
+    aggregateOpenItemBytes = 0;
+    hasVisibleOutput = false;
+  };
+
+  const reset = (): void => {
+    clearRetained();
+    tainted = false;
+  };
+
+  const taintAndRelease = (): void => {
+    clearRetained();
+    tainted = true;
+  };
+
+  const retainCompletedItem = (
+    index: number,
+    item: Record<string, unknown>,
+    visibleToGrok: boolean,
+  ): void => {
+    if (tainted) return;
+    const sourceBytes = Buffer.byteLength(JSON.stringify(item), "utf8");
+    if (sourceBytes > MAX_COMPLETED_OUTPUT_ITEM_SOURCE_BYTES
+      || completedItems.size >= MAX_COMPLETED_OUTPUT_ITEMS
+      || aggregateItemBytes + sourceBytes > MAX_COMPLETED_OUTPUT_ITEM_SOURCE_BYTES) {
+      taintAndRelease();
+      return;
+    }
+    budget?.chargeRetained(sourceBytes, { kind: "retained_collectors" });
+    completedItems.set(index, { item, sourceBytes, visibleToGrok });
+    aggregateItemBytes += sourceBytes;
+    hasVisibleOutput = hasVisibleOutput || visibleToGrok;
+  };
+
+  const closeOpenItem = (index: number): void => {
+    const open = openItems.get(index);
+    if (!open) return;
+    openItems.delete(index);
+    aggregateOpenItemBytes -= open.sourceBytes;
+    budget?.releaseRetained(open.sourceBytes, { kind: "retained_collectors" });
+  };
+
+  const rewrite: SseBlockRewrite = (block: string): readonly string[] => {
+    const payload = sseDataPayload(block);
+    if (payload === null) return [block];
+    if (payload === "[DONE]") {
+      reset();
+      return [block];
+    }
+
+    let parsed: unknown;
+    try {
+      parsed = JSON.parse(payload);
+    } catch {
+      taintAndRelease();
+      return [block];
+    }
+    if (!isPlainObject(parsed) || typeof parsed.type !== "string") {
+      taintAndRelease();
+      return [block];
+    }
+
+    const type = parsed.type;
+    const outputIndex = Number.isInteger(parsed.output_index) && (parsed.output_index as number) >= 0
+      ? parsed.output_index as number
+      : undefined;
+
+    if (type === "response.output_item.added") {
+      const open = isPlainObject(parsed.item) ? plausibleGrokOpenItem(parsed.item) : null;
+      if (outputIndex === undefined || !open
+        || openItems.has(outputIndex) || completedItems.has(outputIndex)
+        || openItems.size >= MAX_COMPLETED_OUTPUT_ITEMS) {
+        taintAndRelease();
+      } else if (!tainted) {
+        const sourceBytes = Buffer.byteLength(JSON.stringify(open), "utf8");
+        if (sourceBytes > MAX_COMPLETED_OUTPUT_ITEM_SOURCE_BYTES
+          || aggregateOpenItemBytes + sourceBytes > MAX_GROK_OPEN_ITEM_IDENTITY_BYTES) {
+          taintAndRelease();
+        } else {
+          budget?.chargeRetained(sourceBytes, { kind: "retained_collectors" });
+          openItems.set(outputIndex, { ...open, sourceBytes });
+          aggregateOpenItemBytes += sourceBytes;
+        }
+      }
+      return [block];
+    }
+
+    if (type === "response.output_item.done") {
+      const item = isPlainObject(parsed.item) ? parsed.item : null;
+      const proof = item ? trustedGrokCompletedItem(item) : null;
+      if (outputIndex === undefined || !proof || completedItems.has(outputIndex)) {
+        taintAndRelease();
+        return [block];
+      }
+      const open = openItems.get(outputIndex);
+      const doneId = typeof item!.id === "string" ? item!.id : undefined;
+      if (open && (open.type !== item!.type || open.id !== doneId)) {
+        taintAndRelease();
+        return [block];
+      }
+      closeOpenItem(outputIndex);
+      retainCompletedItem(outputIndex, item!, proof.visibleToGrok);
+      return [block];
+    }
+
+    const isTerminal = type === "response.completed"
+      || type === "response.failed"
+      || type === "response.incomplete";
+    if (!isTerminal) return [block];
+
+    let out = block;
+    if (type === "response.completed" && !tainted && isPlainObject(parsed.response)) {
+      const response = parsed.response;
+      const output = response.output;
+      const terminalStatusConsistent = !("status" in response) || response.status === "completed";
+      const outputIsAuthoritative = Array.isArray(output) && output.length > 0;
+      const outputIsSparse = !("output" in response)
+        || (Array.isArray(output) && output.length === 0);
+      if (!outputIsAuthoritative && outputIsSparse && terminalStatusConsistent
+        && completedItems.size > 0 && openItems.size === 0 && hasVisibleOutput) {
+        const ordered = [...completedItems.entries()].sort(([left], [right]) => left - right);
+        if (ordered.every(([index], position) => index === position)) {
+          out = jsonBlock({
+            ...parsed,
+            response: { ...response, output: ordered.map(([, retained]) => retained.item) },
+          });
+        }
+      }
+    }
+    reset();
+    return [out];
+  };
+
+  rewrite.dispose = reset;
+  return rewrite;
+}
+

package/src/server/index.ts

@@ -183,7 +183,8 @@ export { disableResponsesRequestTimeout, linkAbortSignal } from "./responses";
 import { handleClaudeCountTokens, handleClaudeMessages } from "./claude-messages";
 import { handleChatCompletions } from "./chat-completions";
 import { anthropicErrorResponse } from "../claude/outbound";
-import { buildDesktop3pRegistry } from "../claude/desktop-3p";
+import { buildDesktop3pRegistry, generateDesktop3pModels } from "../claude/desktop-3p";
+import { buildDesktopDiscoveryInputs } from "../claude/desktop-discovery-inputs";
 import { runClaudeAuthModeMigration } from "../claude/auth-mode-migration";
 import {
   bindNativeMainStartupLifecycle,
@@ -1358,6 +1359,10 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
         if (!isAllowedRequestOrigin(req, policy)) {
           return withCors(formatErrorResponse(403, "origin_rejected", "cross-origin data-plane request blocked"), req, policy);
         }
+        const wantsDesktopConfig = url.searchParams.get("format") === "desktop-config";
+        if (wantsDesktopConfig && (url.searchParams.get("ids") === "cli" || url.searchParams.has("client_version"))) {
+          return jsonResponse({ error: "Desktop config format cannot use CLI or client-version selectors" }, 400, req, policy);
+        }
         // The Integrations page reports whether a Cursor client has reached this proxy; the
         // recorder keeps only a bounded User-Agent value and a timestamp, in memory.
         recordCursorSeen(req.headers);
@@ -1380,7 +1385,7 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
           }
           throw error;
         }
-        const { accountBoundNativeOpenAiSlugsBySelector, applyNativeVisibility, buildCatalogEntries, configuredNativeAliasSlugs, desktopAllowlistSuppressedNativeSlugs, disabledNativeSlugs, exactComboCatalogSlugs, loadCatalogTemplate, NATIVE_OPENAI_MODELS, nativeContextLimits, nativeInputModalities, nativeOpenAiContextWindow, nativeOpenAiMaxOutputTokens, nativeOpenAiContextTier, nativeOpenAiSlugs, nativeReasoningEfforts, nativeDefaultReasoningEffort, orderForSubagents, filterCatalogVisibleModels, shouldIncludeAccountBoundNativeOpenAi, shouldIncludeNativeOpenAi, uniqueCatalogModelsForRawPublicList, visibleCodexAccountSelectors, visibleNativeSlugs, desktopVisibleNativeSlugs } = await import("../codex/catalog");
+        const { accountBoundNativeOpenAiSlugsBySelector, applyNativeVisibility, buildCatalogEntries, configuredNativeAliasSlugs, desktopAllowlistSuppressedNativeSlugs, disabledNativeSlugs, exactComboCatalogSlugs, loadCatalogTemplate, NATIVE_OPENAI_MODELS, nativeContextLimits, nativeInputModalities, nativeOpenAiContextWindow, nativeOpenAiMaxOutputTokens, nativeOpenAiContextTier, nativeOpenAiSlugs, nativeReasoningEfforts, nativeDefaultReasoningEffort, shouldIncludeAccountBoundNativeOpenAi, shouldIncludeNativeOpenAi, uniqueCatalogModelsForRawPublicList, visibleCodexAccountSelectors, visibleNativeSlugs, desktopVisibleNativeSlugs } = await import("../codex/catalog");
         const { ACCOUNT_GATED_NATIVE_OPENAI_MODELS } = await import("../codex/catalog/native-models");
         const includeNativeOpenAi = shouldIncludeNativeOpenAi(config);
         const includeAccountBoundNativeOpenAi = shouldIncludeAccountBoundNativeOpenAi(config);
@@ -1430,11 +1435,12 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
         const accountNativeSlugs = [...new Set(
           [...accountNativeSlugsBySelector.values()].flatMap(slugs => [...slugs]),
         )];
-        const desktopNativeSlugs = desktopVisibleNativeSlugs(config).filter(slug => (
-          !ACCOUNT_GATED_NATIVE_OPENAI_MODELS.has(slug) || availableBareGatedNativeSlugs.has(slug)
-        ));
-        const goEnabled = filterCatalogVisibleModels(goModels, config);
-        const goOrdered = orderForSubagents(goEnabled, config.subagentModels);
+        const desktopInputs = buildDesktopDiscoveryInputs({
+          config, models: goModels, modelEntitlements,
+          desktopNativeCandidates: desktopVisibleNativeSlugs(config),
+        });
+        const desktopNativeSlugs = desktopInputs.nativeSlugs;
+        const goOrdered = desktopInputs.routedModels;
         // Claude Code / Claude Desktop gateway model discovery (GET /v1/models with
         // Anthropic-style headers; 003 G1-G8 + devlog 131). Entries use the official
         // ModelInfo shape incl. capabilities (effort ladder / thinking) — Desktop 3P can
@@ -1443,7 +1449,7 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
         // aliases; legacy claude-ocx-* ids keep decoding via resolveAlias. Detection:
         // anthropic-version header (Claude Code sends it) or explicit ?flavor=anthropic.
         // Codex catalog (client_version) and the OpenAI list shape below stay byte-identical.
-        const wantsAnthropicList = req.headers.get("anthropic-version") !== null
+        const wantsAnthropicList = wantsDesktopConfig || req.headers.get("anthropic-version") !== null
           || url.searchParams.get("flavor") === "anthropic";
         /**
          * Whether a NATIVE slug may carry a Fast sibling.
@@ -1477,12 +1483,22 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
           catalogFastRowEligible(config, m);
 
         if (wantsAnthropicList && !url.searchParams.has("client_version")) {
+          if (wantsDesktopConfig) {
+            const models = config.claudeCode?.enabled === false ? [] : generateDesktop3pModels(
+              desktopInputs.nativeSlugs, desktopInputs.routedModels,
+              config.claudeCode?.desktopProfile, desktopInputs.nativeContextCap,
+            );
+            const response = jsonResponse({ version: 1, models }, 200, req, policy);
+            response.headers.set("Cache-Control", "no-store");
+            return response;
+          }
           if (config.claudeCode?.enabled === false) return jsonResponse({ data: [] }, 200, req, policy);
           // Build Desktop 3P registry so inbound alias resolution works for subsequent requests.
           buildDesktop3pRegistry(
             desktopNativeSlugs,
-            goOrdered.map(m => ({ provider: m.provider, id: m.id, contextWindow: m.contextWindow })),
+            desktopInputs.routedModels,
             config.claudeCode?.desktopProfile,
+            desktopInputs.nativeContextCap,
           );
           const { buildAnthropicModelInfos } = await import("../claude/model-info");
           const { resolveAutoContext } = await import("../claude/context-windows");
@@ -1503,7 +1519,7 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
             resolveAutoContext(config.claudeCode),
             idStyle,
             activeDesktop3pAlias,
-            nativeContextLimits(config),
+            desktopInputs.nativeContextCap,
             config.fastMode,
             // Explicit opt-out omits the Fast predicate.
             config.fastRows !== false

package/src/server/management/account-selection-stream.ts

@@ -0,0 +1,70 @@
+import { currentAccountSelectionRevision, subscribeAccountSelections } from "../../lib/account-selection-events";
+import { registerOptionalShutdownHook } from "../../lib/optional-shutdown-hooks";
+
+const MAX_SELECTION_STREAMS = 64;
+const HEARTBEAT_MS = 15_000;
+const encoder = new TextEncoder();
+const connections = new Set<() => void>();
+
+/** The management boundary admits the request; every frame revalidates current authority. */
+export function accountSelectionStream(request: Request, validate: () => boolean): Response {
+  const authorized = () => {
+    try { return validate() === true; } catch { return false; }
+  };
+  if (!authorized()) return Response.json({ error: "Management session is no longer authorized" }, { status: 401 });
+  if (connections.size >= MAX_SELECTION_STREAMS) {
+    return Response.json({ error: "Too many account selection streams" }, {
+      status: 429, headers: { "Retry-After": "15" },
+    });
+  }
+  let cleanup = () => {};
+  const body = new ReadableStream<Uint8Array>({
+    start(controller) {
+      let closed = false;
+      let unsubscribe = () => {};
+      let heartbeat: ReturnType<typeof setInterval> | undefined;
+      const close = () => {
+        if (closed) return;
+        closed = true;
+        unsubscribe();
+        if (heartbeat) clearInterval(heartbeat);
+        request.signal.removeEventListener("abort", close);
+        connections.delete(close);
+        try { controller.close(); } catch { /* The consumer may already have cancelled. */ }
+      };
+      cleanup = close;
+      const send = (frame: string) => {
+        if (closed) return;
+        if (!authorized()) {
+          // Error clears queued frames as well, so a revoked consumer cannot drain them.
+          try { controller.error(new DOMException("Management session is no longer authorized", "NotAllowedError")); }
+          finally { close(); }
+          return;
+        }
+        // Reconnection sends a ready event, so a slow reader can reconcile without an
+        // unbounded queue or silently dropping a provider's latest invalidation.
+        if (controller.desiredSize !== null && controller.desiredSize <= 0) { close(); return; }
+        try { controller.enqueue(encoder.encode(frame)); } catch { close(); }
+      };
+      connections.add(close);
+      registerOptionalShutdownHook("account-selection-streams", () => {
+        for (const finish of [...connections]) finish();
+      });
+      if (request.signal.aborted) { close(); return; }
+      request.signal.addEventListener("abort", close, { once: true });
+      unsubscribe = subscribeAccountSelections(event => {
+        send(`event: account-selection\ndata: ${JSON.stringify(event)}\n\n`);
+      });
+      send(`event: ready\ndata: ${JSON.stringify({ revision: currentAccountSelectionRevision() })}\n\n`);
+      if (closed) return;
+      heartbeat = setInterval(() => send(": heartbeat\n\n"), HEARTBEAT_MS);
+      heartbeat.unref?.();
+    },
+    cancel() { cleanup(); },
+  }, { highWaterMark: 16 });
+  return new Response(body, { headers: {
+    "Content-Type": "text/event-stream; charset=utf-8",
+    "Cache-Control": "no-cache, no-transform",
+    "X-Accel-Buffering": "no",
+  } });
+}