@bitkyc08/opencodex 2.43.0 → 2.44.0

package/src/server/management/aside-profile-routes.ts

@@ -0,0 +1,231 @@
+import { redactSecretString } from "../../lib/redact";
+import { ClientPathError } from "../../clients/config-export";
+import { IntegrationMutationBusyError } from "../../integrations/mutation-flight";
+import { IntegrationWriterLockBusyError } from "../../integrations/writer-lock";
+import {
+  getAsideProfileState, listAsideProfileStates, mutateAsideProfiles, refreshAsideProfiles,
+  type AsideProfilesInput,
+} from "../../integrations/aside-profiles";
+import {
+  listAsideOperations, findAsideOperation, restoreAsideProfile, deleteAsideOperation,
+  asideOperationMatchesCurrent,
+} from "../../integrations/aside-profile-journal";
+import type { WriteRefused } from "../../integrations/writer";
+import type { ManagementContext } from "./context";
+import { readManagementJsonBody, readOptionalManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
+import { jsonResponse } from "../auth-cors";
+
+export interface AsideProfileRouteOptions {
+  input: () => AsideProfilesInput;
+  failure: (result: WriteRefused) => Response;
+}
+
+class ProfileQueryError extends Error { readonly status = 400; readonly code = "invalid_aside_profile"; }
+
+const ASIDE_INTEGRATION_PATH = "/api/client-integrations/aside";
+const ASIDE_PROFILES_PATH = "/api/client-integrations/aside/profiles";
+
+function profileId(ctx: ManagementContext): number | undefined {
+  const raw = ctx.url.searchParams.get("profile");
+  if (raw === null) return undefined;
+  if (!/^(0|[1-9][0-9]*)$/.test(raw) || !Number.isSafeInteger(Number(raw))) {
+    throw new ProfileQueryError("profile must be a nonnegative integer account ID");
+  }
+  return Number(raw);
+}
+
+function errorResponse(error: unknown, ctx: ManagementContext): Response {
+  rethrowManagementBodyTooLarge(error);
+  const detail = error as { status?: unknown; code?: unknown } | null;
+  const busy = error instanceof IntegrationMutationBusyError || error instanceof IntegrationWriterLockBusyError;
+  const status = busy ? 409 : typeof detail?.status === "number" && [400,404,409,410,500].includes(detail.status)
+    ? detail.status : error instanceof ClientPathError ? 409 : 500;
+  const code = busy ? "integration_mutation_busy"
+    : typeof detail?.code === "string" ? detail.code : "aside_profile_error";
+  return jsonResponse({
+    error: redactSecretString(error instanceof Error ? error.message : "Aside profile operation failed"),
+    code, clientId: "aside",
+  }, status, ctx.req, ctx.config);
+}
+
+function isObject(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+async function readProfileBody(req: Request, optional = false): Promise<unknown> {
+  try { return await (optional ? readOptionalManagementJsonBody(req) : readManagementJsonBody(req)); }
+  catch (error) { rethrowManagementBodyTooLarge(error); throw new ProfileQueryError("invalid JSON body"); }
+}
+
+function validateClientSelector(ctx: ManagementContext): void {
+  const client = ctx.url.searchParams.get("client");
+  if (client !== null && client !== "aside") throw new ProfileQueryError("client/profile selectors must identify Aside");
+}
+
+/** Dedicated scoped paths fail closed even when a newer client reaches an older server. */
+function nestedProfileContext(ctx: ManagementContext): { ctx: ManagementContext; action?: string } {
+  const prefix = "/api/client-integrations/aside/profiles/";
+  if (!ctx.url.pathname.startsWith(prefix)) return { ctx };
+  validateClientSelector(ctx);
+  const parts = ctx.url.pathname.slice(prefix.length).split("/");
+  const url = new URL(ctx.url);
+  if (parts.length === 1 && parts[0] === "journal") {
+    if (url.searchParams.has("profile")) throw new ProfileQueryError("Use a profile-specific journal path");
+    url.pathname = "/api/client-integrations/journal";
+    url.searchParams.set("client", "aside");
+    return { ctx: { ...ctx, url }, action: "journal" };
+  }
+  if (parts.length > 2 || !parts[0] || (parts[1] !== undefined && !["journal", "restore"].includes(parts[1]))) {
+    throw new ProfileQueryError("Invalid Aside profile path");
+  }
+  const prior = url.searchParams.get("profile");
+  if (prior !== null && prior !== parts[0]) throw new ProfileQueryError("Conflicting Aside profile selectors");
+  url.searchParams.set("profile", parts[0]);
+  url.searchParams.set("client", "aside");
+  url.pathname = parts[1] ? `/api/client-integrations/${parts[1]}` : "/api/client-integrations/aside";
+  return { ctx: { ...ctx, url }, action: parts[1] };
+}
+
+/** Own only Aside status/toggle paths; other clients keep the existing adapter. */
+export async function handleAsideProfileRoutes(
+  ctx: ManagementContext, options: AsideProfileRouteOptions,
+): Promise<Response | null> {
+  if (ctx.url.pathname !== ASIDE_INTEGRATION_PATH
+    && !ctx.url.pathname.startsWith(`${ASIDE_INTEGRATION_PATH}/`)) return null;
+  try {
+    const normalized = nestedProfileContext(ctx);
+    ctx = normalized.ctx;
+    const { req, url } = ctx;
+    validateClientSelector(ctx);
+    const id = profileId(ctx);
+    if (normalized.action === "journal") {
+      if (req.method === "GET") return asideJournalResponse(ctx, "aside", options);
+      if (req.method === "DELETE") {
+        const opId = url.searchParams.get("opId")?.trim();
+        if (!opId) throw new ProfileQueryError("opId is required");
+        return asideJournalDeleteResponse(ctx, opId, options);
+      }
+      return null;
+    }
+    if (normalized.action === "restore") {
+      if (req.method !== "POST") return null;
+      const body = await readProfileBody(req);
+      if (!isObject(body) || typeof body.opId !== "string" || !body.opId.trim()
+        || (body.confirmDrift !== undefined && typeof body.confirmDrift !== "boolean")) throw new ProfileQueryError("Invalid Aside restore request");
+      return asideRestoreResponse(ctx, { opId: body.opId.trim(), confirmDrift: body.confirmDrift === true }, options);
+    }
+    if (url.pathname === "/api/client-integrations/aside/sync") {
+      if (req.method !== "POST") return null;
+      if (id !== undefined) throw new ProfileQueryError("Aside sync uses the server's selected profiles");
+      const body = await readProfileBody(req, true);
+      if (!isObject(body) || Object.keys(body).length !== 0) throw new ProfileQueryError("Aside sync expects an empty object");
+      const results = await refreshAsideProfiles(options.input());
+      const ok = results.every(result => result.ok);
+      return jsonResponse({ ok, clientId: "aside", results }, ok ? 200 : 207, req, ctx.config);
+    }
+    if (url.pathname !== ASIDE_INTEGRATION_PATH && url.pathname !== ASIDE_PROFILES_PATH) return null;
+    if (req.method !== "GET" && req.method !== "PUT") return null;
+    if (url.pathname.endsWith("/profiles") && id !== undefined) throw new ProfileQueryError("Use a profile-specific path");
+    if (req.method === "GET") {
+      const state = id === undefined ? await listAsideProfileStates(options.input()) : await getAsideProfileState(options.input(), id);
+      return jsonResponse(state, 200, req, ctx.config);
+    }
+    const body = await readProfileBody(req);
+    if (!isObject(body) || typeof body.enabled !== "boolean") throw new ProfileQueryError("enabled must be a boolean");
+    if (body.overwriteConflict !== undefined && typeof body.overwriteConflict !== "boolean") throw new ProfileQueryError("overwriteConflict must be a boolean");
+    if (body.overwriteConflict === true && !body.enabled) throw new ProfileQueryError("overwriteConflict applies only to enabling an integration");
+    const batch = await mutateAsideProfiles(options.input(), { enabled: body.enabled, profileId: id, overwriteConflict: body.overwriteConflict === true });
+    if (id !== undefined) {
+      const result = batch.results[0];
+      if (!result) throw new Error("Aside profile mutation returned no result");
+      return result.ok ? jsonResponse(result, 200, req, ctx.config) : options.failure(result);
+    }
+    return jsonResponse(batch, batch.ok ? 200 : 207, req, ctx.config);
+  } catch (error) { return errorResponse(error, ctx); }
+}
+
+/** Profile-qualified history, including source-store provenance for imported legacy entries. */
+export async function asideJournalResponse(
+  ctx: ManagementContext, requestedClient: string | null, options: AsideProfileRouteOptions,
+): Promise<Response | null> {
+  if (requestedClient === null && !ctx.url.searchParams.has("profile")) return null;
+  if (requestedClient !== null && requestedClient !== "aside") {
+    return ctx.url.searchParams.has("profile") ? errorResponse(new ProfileQueryError("profile applies only to Aside"), ctx) : null;
+  }
+  try {
+    const id = profileId(ctx);
+    if (id !== undefined && requestedClient !== "aside") throw new ProfileQueryError("profile requires client=aside");
+    const input = options.input();
+    const aside = await listAsideOperations(input, id);
+    const rows = [...aside].sort((a, b) => b.entry.at.localeCompare(a.entry.at));
+    const newest = new Map<string, string>();
+    const ownerKey = (row: typeof rows[number]) => `${row.entry.clientId}:${row.profileId ?? row.entry.configPath}`;
+    for (const row of rows) if (!newest.has(ownerKey(row))) newest.set(ownerKey(row), row.entry.opId);
+    const operations = rows.map(row => {
+      const { entry, store } = row;
+      const snapshot = store.readSnapshot(entry).kind;
+      const latest = newest.get(ownerKey(row)) === entry.opId;
+      return {
+        opId: entry.opId, clientId: entry.clientId, kind: entry.kind, at: entry.at,
+        configPath: entry.configPath, snapshot,
+        ...(row.profileId !== undefined ? { profileId: row.profileId } : {}),
+        undoable: snapshot !== "expired" && latest && row.profileId !== undefined && asideOperationMatchesCurrent(input, row),
+        deletable: !latest,
+      };
+    });
+    return jsonResponse({ operations }, 200, ctx.req, ctx.config);
+  } catch (error) {
+    return requestedClient === null && !ctx.url.searchParams.has("profile") ? null : errorResponse(error, ctx);
+  }
+}
+
+export async function asideRestoreResponse(
+  ctx: ManagementContext, body: { opId: string; confirmDrift?: boolean }, options: AsideProfileRouteOptions,
+): Promise<Response | null> {
+  try {
+    validateClientSelector(ctx);
+    const id = profileId(ctx);
+    const input = options.input();
+    const rootEntry = input.store?.findOperation(body.opId);
+    if (rootEntry && rootEntry.clientId !== "aside") {
+      if (id !== undefined || ctx.url.searchParams.has("client")) throw new ProfileQueryError("client/profile selectors do not match the operation");
+      return null;
+    }
+    const operation = await findAsideOperation(input, body.opId, id);
+    if (!operation) {
+      if (id === undefined) return null;
+      return jsonResponse({ error: "integration operation not found", code: "integration_operation_not_found", opId: body.opId }, 404, ctx.req, ctx.config);
+    }
+    const result = await restoreAsideProfile(input, { ...body, profileId: operation.profileId });
+    return result.ok ? jsonResponse(result, 200, ctx.req, ctx.config) : options.failure(result);
+  } catch (error) {
+    if (error instanceof ClientPathError && !ctx.url.searchParams.has("profile")
+      && options.input().store?.findOperation(body.opId)?.clientId !== "aside") return null;
+    return errorResponse(error, ctx);
+  }
+}
+
+export async function asideJournalDeleteResponse(
+  ctx: ManagementContext, opId: string, options: AsideProfileRouteOptions,
+): Promise<Response | null> {
+  try {
+    validateClientSelector(ctx);
+    const id = profileId(ctx);
+    const input = options.input();
+    const rootEntry = input.store?.findOperation(opId);
+    if (rootEntry && rootEntry.clientId !== "aside") {
+      if (id !== undefined || ctx.url.searchParams.has("client")) throw new ProfileQueryError("client/profile selectors do not match the operation");
+      return null;
+    }
+    const operation = await findAsideOperation(input, opId, id);
+    if (!operation) {
+      if (id === undefined) return null;
+      return jsonResponse({ error: "integration operation not found", code: "integration_operation_not_found", opId }, 404, ctx.req, ctx.config);
+    }
+    return jsonResponse(await deleteAsideOperation(input, { opId, profileId: operation.profileId, principal: ctx.principal ?? "admin-token" }), 200, ctx.req, ctx.config);
+  } catch (error) {
+    if (error instanceof ClientPathError && !ctx.url.searchParams.has("profile")
+      && options.input().store?.findOperation(opId)?.clientId !== "aside") return null;
+    return errorResponse(error, ctx);
+  }
+}

package/src/server/management/config-routes.ts

@@ -1,3 +1,4 @@
+import type { IntegrationClientId } from "../../integrations/registry";
 import { randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
 import type { CatalogModel } from "../../codex/catalog";
@@ -8,6 +9,7 @@ import {
   deleteConfigTopLevelKey,
   hasOwnProvider,
   isValidProviderName,
+  loadConfig,
   multiAgentGuidanceEnabled,
   providerBaseUrlConfigError,
   providerHeadersConfigError,
@@ -151,10 +153,11 @@ async function sidecarVisionResponseSettings(config: OcxConfig): Promise<{
 
 /** One client's outcome from a fan-out sync. Absent from the list means "left alone". */
 interface ClientIntegrationSyncOutcome {
-  readonly client: "grok" | "claude-desktop" | "mcode";
+  readonly client: "grok" | "claude-desktop" | IntegrationClientId;
   readonly ok: boolean;
   readonly changed?: boolean;
   readonly reason?: string;
+  readonly profileId?: number;
 }
 
 /**
@@ -171,9 +174,10 @@ interface ClientIntegrationSyncOutcome {
  * does not fail the sync: Codex is the one that matters for routing, and a broken Grok file
  * should surface as a warning, not as a 500 on a command that did its main job.
  */
-async function syncEnabledClientIntegrations(
+export async function syncEnabledClientIntegrations(
   port: number | undefined,
   config: OcxConfig,
+  deps: Pick<ManagementContext["deps"], "fetchAllModels" | "writeDesktop3pConfig"> = {},
 ): Promise<ClientIntegrationSyncOutcome[]> {
   if (port === undefined) return [];
   const { claudeDesktopIntegrationEnabled, grokIntegrationEnabled } = await import("../../codex/desired-state");
@@ -196,49 +200,40 @@ async function syncEnabledClientIntegrations(
       const { writeDesktop3pConfig } = await import("../../claude/desktop-3p");
       const { desktopVisibleNativeSlugs, filterCatalogVisibleModels } = await import("../../codex/catalog");
       const { fetchAllModels } = await import("../management-api");
-      const routed = filterCatalogVisibleModels(await fetchAllModels(config), config)
-        .map(model => ({ provider: model.provider, id: model.id, contextWindow: model.contextWindow }));
-      const r = writeDesktop3pConfig(
-        port,
-        [...desktopVisibleNativeSlugs(config)],
-        routed,
-        config.apiKeys?.[0]?.key,
-        "static",
-        config.claudeCode?.desktopProfile,
-        nativeContextLimits(config),
-      );
-      out.push(r.written
-        ? { client: "claude-desktop", ok: true, changed: true }
-        : { client: "claude-desktop", ok: false, reason: r.reason ?? "Claude Desktop write failed" });
+      const models = await (deps.fetchAllModels ?? fetchAllModels)(config);
+      // Discovery admits a concurrent OFF or settings edit. Re-read outside C:
+      // the writer facade owns L and its final desired-state check under L→C.
+      const latest = loadConfig();
+      if (claudeDesktopIntegrationEnabled(latest)) {
+        const routed = filterCatalogVisibleModels(models, latest)
+          .map(model => ({ provider: model.provider, id: model.id, contextWindow: model.contextWindow }));
+        const r = (deps.writeDesktop3pConfig ?? writeDesktop3pConfig)(
+          port,
+          [...desktopVisibleNativeSlugs(latest)],
+          routed,
+          latest.apiKeys?.[0]?.key,
+          "static",
+          latest.claudeCode?.desktopProfile,
+          nativeContextLimits(latest),
+        );
+        out.push(r.written
+          ? { client: "claude-desktop", ok: true, changed: true }
+          : { client: "claude-desktop", ok: false, reason: r.reason ?? "Claude Desktop write failed" });
+      }
     } catch (error) {
       out.push({ client: "claude-desktop", ok: false, reason: error instanceof Error ? error.message : String(error) });
     }
   }
 
-  try {
-    const { refreshOwnedIntegration } = await import("../../integrations/owned-refresh");
-    const result = await refreshOwnedIntegration({
-      clientId: "mcode",
-      models: async () => {
-        const { loadExportModels } = await import("./model-rows");
-        return loadExportModels(config);
-      },
-      config,
-      port,
-    });
-    if (result) {
-      out.push(result.ok
-        ? {
-            client: "mcode",
-            ok: true,
-            changed: result.changed === true,
-            ...(result.reason ? { reason: result.reason } : {}),
-          }
-        : { client: "mcode", ok: false, reason: result.reason });
-    }
-  } catch (error) {
-    out.push({ client: "mcode", ok: false, reason: error instanceof Error ? error.message : String(error) });
-  }
+  const { refreshOwnedCatalogIntegrations } = await import("../../integrations/catalog-refresh");
+  out.push(...await refreshOwnedCatalogIntegrations({
+    models: async () => {
+      const { loadExportModels } = await import("./model-rows");
+      return loadExportModels(config);
+    },
+    config,
+    port,
+  }, ["mcode", "pi", "aside"]));
 
   return out;
 }
@@ -651,7 +646,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
     // for the on-demand command. Codex goes first because the others read its catalog.
     const integrations = result.status === "refused"
       ? []
-      : await syncEnabledClientIntegrations(runtime?.port, config);
+      : await syncEnabledClientIntegrations(runtime?.port, config, deps);
     const status = result.status === "refused" ? 409 : (result.status === "skipped" || result.ok ? 200 : 500);
     return jsonResponse({
       ...attachStaleAppServerHint(result),

package/src/server/management/context.ts

@@ -6,6 +6,7 @@ import type { StartupHealth } from "../../codex/autostart-health";
 import type { StartupInstallAction } from "../startup-action-control";
 import type { ManagementPrincipal, ManagementSessionControl } from "../management-auth";
 import type { CatalogModel } from "../../codex/catalog";
+import type { refreshOwnedCatalogIntegrations } from "../../integrations/catalog-refresh";
 import type { Paths as CodexPromptPaths } from "../../codex/prompt-layers";
 import type { injectGrokConfig } from "../../grok/inject";
 import type { removeDesktop3pStandardPivot, writeDesktop3pConfig } from "../../claude/desktop-3p";
@@ -20,6 +21,8 @@ import type {
 } from "../../codex/app-server-restart-service";
 
 export interface ManagementApiDeps {
+  /** Isolates automatic owned-client writes in route tests. */
+  refreshOwnedCatalogIntegrations?: typeof refreshOwnedCatalogIntegrations;
   /** Platform seam for capability projections; does not alter host-level startup behavior. */
   platform?: NodeJS.Platform;
   toggleCodexMultiAgentV2?: (enabled: boolean) => void;

package/src/server/management/integration-routes.ts

@@ -9,6 +9,12 @@
  * Design of record: devlog/_fin/260802_client_toggle_api/040_wp4_management_api.md.
  */
 import { readFileSync } from "node:fs";
+import { saveConfigPreservingClaudeCode } from "../../config";
+import { listAsideProfileStates, type AsideProfilesInput } from "../../integrations/aside-profiles";
+import {
+  handleAsideProfileRoutes, asideJournalResponse, asideRestoreResponse,
+  asideJournalDeleteResponse, type AsideProfileRouteOptions,
+} from "./aside-profile-routes";
 import type { IntegrationIO } from "../../integrations/config-io";
 import { matchesOperationResult } from "../../integrations/journal";
 import {
@@ -41,6 +47,8 @@ import { loadExportModels } from "./model-rows";
 
 
 const INTEGRATION_ROUTE_PREFIX = "/api/client-integrations/";
+const INTEGRATION_COLLECTION_PATH = "/api/client-integrations";
+const INTEGRATION_HISTORY_PATHS = ["/api/client-integrations/journal", "/api/client-integrations/restore"];
 export { INTEGRATION_MUTATION_TERMINAL_MS };
 
 type IntegrationStateRecord = Awaited<ReturnType<typeof readIntegrationState>>;
@@ -85,6 +93,7 @@ export interface IntegrationJournalRow {
    * is what a user reaches for right after the mistake.
    */
   deletable: boolean;
+  profileId?: number;
 }
 
 export interface IntegrationToggleBody {
@@ -181,6 +190,23 @@ function integrationStore(): IntegrationStateStore {
   return integrationMutationTestHooks?.store ?? createIntegrationStateStore();
 }
 
+function asideOptions(ctx: ManagementContext): AsideProfileRouteOptions {
+  let input: AsideProfilesInput | undefined;
+  return {
+    input: () => input ??= {
+      config: ctx.config,
+      port: Number(ctx.url.port) || ctx.config.port,
+      models: () => loadExportModels(ctx.config),
+      store: integrationStore(),
+      ...pathOverrides(),
+      io: integrationMutationTestHooks?.io,
+      lockSeams: integrationMutationTestHooks?.lockSeams,
+      persistConfig: ctx.deps.saveConfigPreservingClaudeCode ?? saveConfigPreservingClaudeCode,
+    },
+    failure: result => writerFailureResponse("aside", result, ctx),
+  };
+}
+
 async function buildIntegrationWriteInput(
   clientId: IntegrationClientId,
   ctx: ManagementContext,
@@ -331,6 +357,8 @@ async function handleJournalDelete(ctx: ManagementContext): Promise<Response> {
       code: "invalid_op_id",
     }, 400, req, ctx.config);
   }
+  const aside = await asideJournalDeleteResponse(ctx, opId, asideOptions(ctx));
+  if (aside) return aside;
   try {
     const store = integrationStore();
     const operation = store.findOperation(opId);
@@ -392,6 +420,14 @@ async function handleJournalDelete(ctx: ManagementContext): Promise<Response> {
 
 export async function handleIntegrationRoutes(ctx: ManagementContext): Promise<Response | null> {
   const { req, url } = ctx;
+  const profileOptions = asideOptions(ctx);
+  const aside = await handleAsideProfileRoutes(ctx, profileOptions);
+  if (aside) return aside;
+  if (url.searchParams.has("profile")
+    && (url.pathname === INTEGRATION_COLLECTION_PATH || url.pathname.startsWith(INTEGRATION_ROUTE_PREFIX))
+    && !INTEGRATION_HISTORY_PATHS.includes(url.pathname)) {
+    return jsonResponse({ error: "profile applies only to Aside", code: "invalid_aside_profile" }, 400, req, ctx.config);
+  }
 
   if (url.pathname === "/api/client-integrations" && req.method === "GET") {
     try {
@@ -408,8 +444,13 @@ export async function handleIntegrationRoutes(ctx: ManagementContext): Promise<R
        * later one silently — a duplicate that could only ever hide a
        * disagreement, never surface it.
        */
-      const clients = INTEGRATION_CLIENT_IDS.map(clientId =>
-        readIntegrationState({ clientId, models, config: ctx.config, port, store, ...pathOverrides() }));
+      const clients = await Promise.all(INTEGRATION_CLIENT_IDS.map(async clientId => {
+        if (clientId === "aside") {
+          try { return await listAsideProfileStates({ ...profileOptions.input(), models }); }
+          catch { /* Existing status projection retains a safe unresolved-path diagnostic. */ }
+        }
+        return readIntegrationState({ clientId, models, config: ctx.config, port, store, ...pathOverrides() });
+      }));
       return jsonResponse({ clients } satisfies IntegrationStateListEnvelope, 200, req, ctx.config);
     } catch (error) {
       return internalErrorResponse(error, ctx);
@@ -426,6 +467,8 @@ export async function handleIntegrationRoutes(ctx: ManagementContext): Promise<R
     if (requestedClient !== null && !isIntegrationClientId(requestedClient)) {
       return invalidClientResponse(ctx);
     }
+    const asideJournal = await asideJournalResponse(ctx, requestedClient, profileOptions);
+    if (asideJournal) return asideJournal;
     try {
       const store = integrationStore();
       const storedOperations = store.listOperations(requestedClient ?? undefined);
@@ -435,7 +478,7 @@ export async function handleIntegrationRoutes(ctx: ManagementContext): Promise<R
           newestByClient.set(operation.clientId, operation.opId);
         }
       }
-      const operations: IntegrationJournalRow[] = storedOperations.map(operation => {
+      let operations: IntegrationJournalRow[] = storedOperations.map(operation => {
         /*
          * Resolved against the DISK, not read off the row.
          *
@@ -481,6 +524,14 @@ export async function handleIntegrationRoutes(ctx: ManagementContext): Promise<R
           deletable: newestByClient.get(operation.clientId) !== operation.opId,
         };
       });
+      if (requestedClient === null) {
+        const profiles = await asideJournalResponse(ctx, "aside", profileOptions);
+        if (profiles?.ok) {
+          const body = await profiles.json() as IntegrationJournalEnvelope;
+          operations = [...operations.filter(row => row.clientId !== "aside"), ...body.operations]
+            .sort((a, b) => b.at.localeCompare(a.at));
+        }
+      }
       return jsonResponse({ operations } satisfies IntegrationJournalEnvelope, 200, req, ctx.config);
     } catch (error) {
       return internalErrorResponse(error, ctx);
@@ -506,6 +557,8 @@ export async function handleIntegrationRoutes(ctx: ManagementContext): Promise<R
 
     const opId = parsed.opId.trim();
     const confirmDrift = parsed.confirmDrift ?? false;
+    const asideRestore = await asideRestoreResponse(ctx, { opId, confirmDrift }, profileOptions);
+    if (asideRestore) return asideRestore;
     let restoreClientId: IntegrationClientId | undefined;
     try {
       const store = integrationStore();
@@ -570,6 +623,11 @@ export async function handleIntegrationRoutes(ctx: ManagementContext): Promise<R
   const requestedClient = decodeClientPath(url.pathname);
   if (requestedClient === null) return null;
   if (!isIntegrationClientId(requestedClient)) return invalidClientResponse(ctx);
+  // Canonical Aside paths are owned above. Never decode an alternate spelling
+  // into the legacy single-account writer or bypass profile policy/guards.
+  if (requestedClient === "aside") {
+    return jsonResponse({ error: "Use the canonical Aside profile path", code: "invalid_aside_profile_path" }, 400, req, ctx.config);
+  }
 
   if (req.method === "GET") {
     try {

package/src/server/management/logs-usage-routes.ts

@@ -111,6 +111,7 @@ export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Res
     const logs = filterRequestLogs(all, url.searchParams);
     return jsonResponse({
       timeZone: Intl.DateTimeFormat().resolvedOptions().timeZone,
+      generatedAt: Date.now(),
       total,
       logs: logs.map(requestLogDto),
     });

package/src/server/management/model-routes.ts

@@ -183,6 +183,17 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
   // bypass this seam with a dynamic config import — doing so replaced a user's
   // ~/.opencodex/config.json with the `existing-uuid` test fixture.
   const persistConfig = deps.saveConfigPreservingClaudeCode ?? saveConfigPreservingClaudeCode;
+  const convergeVisibleCatalogs = async () => {
+    const catalogRefresh = await convergeCodexCatalog();
+    const refresh = deps.refreshOwnedCatalogIntegrations
+      ?? (await import("../../integrations/catalog-refresh")).refreshOwnedCatalogIntegrations;
+    const clientIntegrations = await refresh({
+      config,
+      port: Number(url.port) || config.port,
+      models: () => loadExportModels(config),
+    });
+    return { catalogRefresh, clientIntegrations };
+  };
 
   if (url.pathname === "/api/model-discovery" && req.method === "GET") {
     const providers = Object.fromEntries(Object.entries(config.providers).map(([name, provider]) => [
@@ -518,8 +529,7 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
     const disabled = Array.isArray(body.models) ? body.models.filter((m): m is string => typeof m === "string") : [];
     config.disabledModels = disabled;
     persistConfig(config);
-    const catalogRefresh = await convergeCodexCatalog();
-    return jsonResponse({ ok: true, disabled, catalogRefresh });
+    return jsonResponse({ ok: true, disabled, ...await convergeVisibleCatalogs() });
   }
 
   // One user-facing visibility switch spans two persisted filters: a provider allowlist and the
@@ -566,7 +576,10 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
       }
       const id = value.id.trim();
       const native = value.native === true;
-      if (!id || (provider === "openai") !== native || (native && !supportedNative.has(id))) {
+      const configuredOpenAiCustom = provider === "openai" && !native && providerConfig
+        && (config.customModels ?? []).some(model => model.provider === provider && model.modelId === id);
+      if (!id || (native && (provider !== "openai" || !supportedNative.has(id)))
+        || (provider === "openai" && !native && !configuredOpenAiCustom)) {
         return jsonResponse({ error: "invalid model visibility target" }, 400);
       }
       const key = `${native ? "native" : "routed"}:${id}`;
@@ -641,8 +654,7 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
 
     config.disabledModels = disabled;
     persistConfig(config);
-    const catalogRefresh = await convergeCodexCatalog();
-    return jsonResponse({ ok: true, scope, provider, enabled: body.enabled, disabled, catalogRefresh });
+    return jsonResponse({ ok: true, scope, provider, enabled: body.enabled, disabled, ...await convergeVisibleCatalogs() });
   }
 
   if (url.pathname === "/api/custom-models" && req.method === "GET") {
@@ -852,7 +864,7 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
       delete target.selectedModels;
       delete target.modelPreset;
       persistConfig(config);
-      return jsonResponse({ ok: true, provider, mode, selected: [], catalogRefresh: await convergeCodexCatalog() });
+      return jsonResponse({ ok: true, provider, mode, selected: [], ...await convergeVisibleCatalogs() });
     }
     if (mode === "custom") {
       // Keep whatever is selected; only the marker changes, so a user can pin their edits
@@ -897,7 +909,7 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
       mode: "preset",
       appliedVersion: preset.version,
       selected: presetIds,
-      catalogRefresh: await convergeCodexCatalog(),
+      ...await convergeVisibleCatalogs(),
     });
   }
   if (url.pathname === "/api/selected-models" && req.method === "PUT") {
@@ -921,8 +933,7 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
     // re-materialize over it afterwards.
     markModelPresetDiverged(config.providers[provider]);
     persistConfig(config);
-    const catalogRefresh = await convergeCodexCatalog();
-    return jsonResponse({ ok: true, provider, selected: models, catalogRefresh });
+    return jsonResponse({ ok: true, provider, selected: models, ...await convergeVisibleCatalogs() });
   }
   return null;
 }

package/src/server/management/model-rows.ts

@@ -11,6 +11,7 @@
 import type { CatalogModel } from "../../codex/catalog";
 import {
   catalogModelSlug,
+  filterCatalogVisibleModels,
   accountBoundNativeOpenAiSlugsBySelector,
   nativeDefaultReasoningEffort,
   NATIVE_OPENAI_MODELS,
@@ -169,7 +170,11 @@ export async function listManagementModelRows(
       ...(contextCap !== undefined ? { contextCap, contextCapped: m.contextCapped === true } : {}),
     };
   }).filter((row): row is ManagementModelRow => row !== null);
-  const rows = [...native, ...dedupedRouted, ...visibleCustomModels];
+  // Manual OpenAI rows retain their routed selector but replace the bare dashboard row.
+  // Account-qualified rows remain distinct, explicitly selected routes.
+  const visibleNative = native.filter(model => model.id.includes("/")
+    || !customNamespaced.has(routedSlug(model.provider, model.id)));
+  const rows = [...visibleNative, ...dedupedRouted, ...visibleCustomModels];
   // Include disabled rows and configured aliases before the export visibility filter:
   // a hidden real `x--fast` must never become a synthetic selector for another model.
   const knownIds = config.fastRows === false ? new Set<string>() : knownEffortRowIds(config);
@@ -213,5 +218,8 @@ export function toExportModel(row: ManagementModelRow): ExportModel {
  */
 export async function loadExportModels(config: OcxConfig): Promise<ExportModel[]> {
   const rows = await listManagementModelRows(config);
-  return rows.filter(row => !row.disabled).map(toExportModel);
+  // Management deliberately lists the full roster so hidden models can be enabled.
+  // A client picker must also honor the provider selection, not just its blocklist.
+  const visibleRouted = new Set(filterCatalogVisibleModels(rows.filter(row => !row.native), config));
+  return rows.filter(row => !row.disabled && (row.native || visibleRouted.has(row))).map(toExportModel);
 }

package/src/server/management/oauth-account-routes.ts

@@ -129,6 +129,11 @@ function validateKeyName(
 export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<Response | null> {
   const { req, url, config, deps, syncClaudeAgentDefsBestEffort } = ctx;
 
+  if (url.pathname === "/api/accounts/events" && req.method === "GET") {
+    const { accountSelectionStream } = await import("./account-selection-stream");
+    return accountSelectionStream(req, () => ctx.sessionControl?.isCurrent(req, config) === true);
+  }
+
   // Which providers support real OAuth login (drives the GUI's "Log in with …" buttons).
   if (url.pathname === "/api/oauth/providers" && req.method === "GET") {
     return jsonResponse({ providers: listOAuthProviders() });
@@ -320,6 +325,8 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     if (!body.accountId) return jsonResponse({ error: "missing accountId" }, 400);
     const { setActiveAccount } = await import("../../oauth/store");
     if (!(await setActiveAccount(provider, body.accountId))) return jsonResponse({ error: "account not found" }, 404);
+    const { forgetGenericFailoverRoster } = await import("../../oauth/generic-account-failover");
+    forgetGenericFailoverRoster(provider);
     if (provider === "anthropic") {
       const { resetAnthropicRoutingForManualSelection } = await import("../../oauth/anthropic-routing");
       resetAnthropicRoutingForManualSelection(body.accountId);