@bitkyc08/opencodex 2.52.0 → 2.53.0

package/src/server/management/provider-routes.ts

@@ -1,3 +1,4 @@
+import { modelCapabilitiesConfigError, mergeModelCapabilities } from "../../config/provider-validation";
 import { randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { isDeepStrictEqual } from "node:util";
@@ -15,6 +16,7 @@ import {
   mutatePersistedConfig,
   nonBlankStringArrayConfigError,
   normalizeNonBlankStringArray,
+  normalizeAutoReviewModelOverrides,
   providerBaseUrlConfigError,
   providerHeadersConfigError,
   requestPacingConfigError,
@@ -34,7 +36,7 @@ import {
   upsertOAuthProvider,
 } from "../../oauth";
 import { captureConfigTopLevelRollback } from "../../config/rebase-provenance";
-import { mergeModelPinnedEfforts, modelPinnedEffortsConfigError, pinnedReasoningEffortConfigError } from "../../config/provider-validation";
+import { canonicalAutoReviewModelKey, mergeModelPinnedEfforts, modelPinnedEffortsConfigError, pinnedReasoningEffortConfigError } from "../../config/provider-validation";
 import { replaceProviderAccountSet } from "../../oauth/store";
 import { providerDestinationResolvedError } from "../../lib/destination-policy";
 import { reconcileLiveStateStores } from "../../lib/state-store-registrations";
@@ -257,7 +259,10 @@ function providerEditorCandidate(
     if (namespaceCollision) return { ok: false, status: 409, error: namespaceCollision, code: "provider_namespace_conflict" };
     const merged = mergeProviderEditorRow(persisted.providers[name], baseline.providers[name], publicProvider);
     const transportCandidate = providerTransportValidationCandidate(merged as unknown as Record<string, unknown>);
-    const providerError = providerManagementConfigError(name, transportCandidate)
+    // The editor merges onto the persisted row, so stored operator overlays (selectedModels,
+    // disabled, …) ride along in the candidate. They are owned by their own write boundaries;
+    // the seed check must only pin the canonical transport/auth keys.
+    const providerError = providerManagementConfigError(name, transportCandidate, { allowOperatorOverlays: true })
       ?? providerEmptyToolOutputConfigError(name, transportCandidate)
       ?? providerServiceTierConfigError(name, transportCandidate);
     if (providerError) return { ok: false, status: 400, error: providerError, code: "invalid_provider" };
@@ -287,6 +292,13 @@ function providerEditorCandidate(
     if (provider.modelPinnedReasoningEfforts !== undefined) {
       provider.modelPinnedReasoningEfforts = validated.config.providers[name]!.modelPinnedReasoningEfforts;
     }
+    const normalized = validated.config.providers[name]!;
+    if (normalized.autoReviewModel === undefined) delete provider.autoReviewModel;
+    else provider.autoReviewModel = normalized.autoReviewModel;
+    if (normalized.autoReviewModelOverrides === undefined) delete provider.autoReviewModelOverrides;
+    else provider.autoReviewModelOverrides = normalized.autoReviewModelOverrides;
+    if (normalized.modelCapabilities === undefined) delete provider.modelCapabilities;
+    else provider.modelCapabilities = normalized.modelCapabilities;
   }
   return { ok: true, config: candidate, removedProviders };
 }
@@ -490,6 +502,14 @@ function applyProviderPatchFields(
     }
     touched = true;
   }
+  if (Object.hasOwn(rawBody, "modelCapabilities")) {
+    const error = modelCapabilitiesConfigError(rawBody.modelCapabilities, true);
+    if (error) return { error };
+    const capabilities = mergeModelCapabilities(next.modelCapabilities, rawBody.modelCapabilities);
+    if (capabilities === undefined) delete next.modelCapabilities;
+    else next.modelCapabilities = capabilities;
+    touched = true;
+  }
   if (Object.hasOwn(rawBody, "modelContextWindows")) {
     const value = rawBody.modelContextWindows;
     if (value === null) {
@@ -518,6 +538,61 @@ function applyProviderPatchFields(
     if (error) return { error };
     touched = true;
   }
+  if (Object.hasOwn(rawBody, "autoReviewModel")) {
+    const value = rawBody.autoReviewModel;
+    if (value === null || value === "") {
+      delete next.autoReviewModel;
+    } else if (typeof value === "string" && value.trim()) {
+      next.autoReviewModel = value.trim();
+    } else {
+      return { error: "autoReviewModel must be a catalog selector string or null" };
+    }
+    touched = true;
+  }
+  if (Object.hasOwn(rawBody, "autoReviewModelOverrides")) {
+    const value = rawBody.autoReviewModelOverrides;
+    if (value === null) {
+      delete next.autoReviewModelOverrides;
+    } else if (isPlainRecord(value)) {
+      const merged: Record<string, string> = { ...(next.autoReviewModelOverrides ?? {}) };
+      const existingByCanonical = new Map<string, string>();
+      for (const existingKey of Object.keys(merged)) {
+        existingByCanonical.set(canonicalAutoReviewModelKey(existingKey), existingKey);
+      }
+      const submittedCanonicalKeys = new Set<string>();
+      for (const [model, target] of Object.entries(value)) {
+        const key = model.trim();
+        if (["__proto__", "prototype", "constructor"].includes(key)) {
+          return { error: "autoReviewModelOverrides keys must be non-reserved model ids" };
+        }
+        const canonicalKey = canonicalAutoReviewModelKey(model);
+        // Uniqueness is enforced before the tombstone branch: a clear and a set that normalize to
+        // the same key would otherwise resolve in object order instead of being rejected.
+        if (submittedCanonicalKeys.has(canonicalKey)) {
+          return { error: "autoReviewModelOverrides keys must be unique after trimming and slash normalization" };
+        }
+        submittedCanonicalKeys.add(canonicalKey);
+        if (target === null || target === "") {
+          const previousKey = existingByCanonical.get(canonicalKey);
+          if (previousKey !== undefined) delete merged[previousKey];
+          if (Object.hasOwn(merged, key)) delete merged[key];
+          continue;
+        }
+        if (typeof target !== "string" || !target.trim()) {
+          return { error: "autoReviewModelOverrides values must be catalog selectors, null, or empty to remove" };
+        }
+        const previousKey = existingByCanonical.get(canonicalKey);
+        if (previousKey !== undefined && previousKey !== key) delete merged[previousKey];
+        merged[key] = target.trim();
+        existingByCanonical.set(canonicalKey, key);
+      }
+      if (Object.keys(merged).length > 0) next.autoReviewModelOverrides = merged;
+      else delete next.autoReviewModelOverrides;
+    } else {
+      return { error: "autoReviewModelOverrides must be a plain object or null" };
+    }
+    touched = true;
+  }
   if (Object.hasOwn(rawBody, "modelAutoCompactTokenLimits")) {
     const value = rawBody.modelAutoCompactTokenLimits;
     const error = modelAutoCompactTokenLimitsConfigError(value, {
@@ -784,6 +859,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       models: p.models ?? [],
       contextWindow: p.contextWindow,
       modelContextWindows: p.modelContextWindows,
+      modelCapabilities: p.modelCapabilities,
       pinnedReasoningEffort: p.pinnedReasoningEffort,
       modelPinnedReasoningEfforts: p.modelPinnedReasoningEfforts,
       modelAutoCompactTokenLimits: p.modelAutoCompactTokenLimits,
@@ -829,6 +905,9 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     const providerError = providerManagementConfigError(
       name,
       providerTransportValidationCandidate(provider as unknown as Record<string, unknown>),
+      // Reload validates a row straight off disk, which legitimately carries stored
+      // operator overlays; only the canonical transport/auth keys need to match the seed.
+      { allowOperatorOverlays: true },
     )
       ?? providerEmptyToolOutputConfigError(name, provider);
     if (providerError) return jsonResponse({ error: "provider reload target invalid" }, 409);
@@ -996,6 +1075,11 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     try { body = await readManagementJsonBody(req); } catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid JSON body" }, 400); }
     const name = typeof body.name === "string" ? body.name.trim() : "";
     if (!isPlainRecord(body.provider)) return jsonResponse({ error: "provider must be a plain object" }, 400);
+    // Same prohibition as PATCH: the canonical OpenAI row never carries these fields, and a clear
+    // form would otherwise be normalized away before the merged-row guard could see it.
+    if (name === "openai" && (Object.hasOwn(body.provider, "autoReviewModel") || Object.hasOwn(body.provider, "autoReviewModelOverrides"))) {
+      return jsonResponse({ error: "provider openai must not include autoReviewModel or autoReviewModelOverrides" }, 400);
+    }
     const existing = config.providers[name];
     const aliasOwnershipError = providerAliasOverlayOwnershipError(body.provider, existing);
     if (aliasOwnershipError) return jsonResponse({ error: aliasOwnershipError }, 400);
@@ -1069,6 +1153,29 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     // erase hand-edited per-model prices from Logs/Usage estimates.
     const existingCosts = config.providers[name]?.modelCosts;
     if (existingCosts && !prov.modelCosts) prov.modelCosts = existingCosts;
+    // The add/edit form also omits auto-review selectors. Preserve hand-configured
+    // provider-wide and per-model targets across an unrelated overwrite; clearing is
+    // explicit through PATCH with null.
+    const submittedAutoReviewModel = Object.hasOwn(body.provider, "autoReviewModel");
+    const submittedAutoReviewOverrides = Object.hasOwn(body.provider, "autoReviewModelOverrides");
+    const existingAutoReviewModel = config.providers[name]?.autoReviewModel;
+    if (!submittedAutoReviewModel && existingAutoReviewModel && !prov.autoReviewModel) prov.autoReviewModel = existingAutoReviewModel;
+    const existingAutoReviewOverrides = config.providers[name]?.autoReviewModelOverrides;
+    if (!submittedAutoReviewOverrides && existingAutoReviewOverrides && !prov.autoReviewModelOverrides) {
+      prov.autoReviewModelOverrides = { ...existingAutoReviewOverrides };
+    }
+    if (prov.autoReviewModel !== undefined) {
+      if (typeof prov.autoReviewModel === "string" && prov.autoReviewModel.trim()) {
+        prov.autoReviewModel = prov.autoReviewModel.trim();
+      } else {
+        delete prov.autoReviewModel;
+      }
+    }
+    if (prov.autoReviewModelOverrides !== undefined) {
+      const normalizedOverrides = normalizeAutoReviewModelOverrides(prov.autoReviewModelOverrides);
+      if (normalizedOverrides) prov.autoReviewModelOverrides = normalizedOverrides;
+      else delete prov.autoReviewModelOverrides;
+    }
     // And to the per-provider account-failover opt-out (#2568d). `ProviderPayload` has no
     // member for it either, so an add/edit save structurally cannot carry it — and dropping it
     // silently ENABLES rotation, because activation is presence-driven once the knob is gone.
@@ -1117,6 +1224,11 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     // completed during that wait remains authoritative instead of being overwritten by the
     // older ownership snapshot used to admit this POST.
     restorePersistedAliasOverlays(prov, config.providers[name]);
+    const capabilities = Object.hasOwn(body.provider, "modelCapabilities")
+      ? mergeModelCapabilities(undefined, prov.modelCapabilities)
+      : mergeModelCapabilities(config.providers[name]?.modelCapabilities, undefined);
+    if (capabilities === undefined) delete prov.modelCapabilities;
+    else prov.modelCapabilities = capabilities;
     // The add/edit form omits wire choices. Read after DNS so a concurrent switch
     // remains authoritative, including the marker that protects it on the next boot.
     if (name === "xai") {
@@ -1260,6 +1372,12 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     if (Object.hasOwn(rawBody, "apiKey")) {
       return jsonResponse({ error: "apiKey cannot be patched here; use the provider API-key endpoints" }, 400);
     }
+    // The canonical OpenAI row rejects these fields outright on create. A PATCH that only clears
+    // or restates them would otherwise slip past the merged-row guard and answer 200, which reads
+    // as acceptance for a field the provider does not support.
+    if (name === "openai" && (Object.hasOwn(rawBody, "autoReviewModel") || Object.hasOwn(rawBody, "autoReviewModelOverrides"))) {
+      return jsonResponse({ error: "provider openai must not include autoReviewModel or autoReviewModelOverrides" }, 400);
+    }
     const applied = applyProviderPatchFields(name, config.providers[name]!, rawBody, keys, config);
     if ("error" in applied) return jsonResponse({ error: applied.error }, 400);
     const next = applied.next;
@@ -1271,6 +1389,10 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
         : providerManagementConfigError(
             name,
             providerTransportValidationCandidate(next as unknown as Record<string, unknown>),
+            // PATCH merges the mask onto the persisted row, which legitimately carries
+            // stored operator overlays (selectedModels, disabled, …); only the canonical
+            // transport/auth keys need to match the seed.
+            { allowOperatorOverlays: true },
           )
           ?? providerEmptyToolOutputConfigError(name, next);
       if (providerError) return jsonResponse({ error: providerError }, 400);
@@ -1314,6 +1436,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
           : providerManagementConfigError(
               name,
               providerTransportValidationCandidate(replay.next as unknown as Record<string, unknown>),
+              { allowOperatorOverlays: true },
             )
             ?? providerEmptyToolOutputConfigError(name, replay.next);
         if (syncError) {

package/src/server/management/remote-workspace-routes.ts

@@ -0,0 +1,140 @@
+import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
+import { remoteWorkspaceEnabled } from "../../remote-control/workspace-activation";
+import type { ManagementContext } from "./context";
+import { isRemoteWorkspaceAgentProfile } from "../../remote-control/workspace-agent-protocol";
+
+const REMOTE_WORKSPACE_PREFIX = "/api/remote-workspace";
+
+function response(body: unknown, status = 200): Response {
+  return Response.json(body, { status, headers: { "cache-control": "no-store" } });
+}
+
+function sessionOnly(ctx: ManagementContext): Response | null {
+  return ctx.principal === "gui-session"
+    ? null
+    : response({ error: "A dashboard session is required for Remote Workspace changes." }, 403);
+}
+
+async function jsonObject(req: Request): Promise<Record<string, unknown>> {
+  let value: unknown;
+  try { value = await readManagementJsonBody(req); } catch (error) { rethrowManagementBodyTooLarge(error); throw new Error("Remote Workspace request body must be JSON."); }
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("Remote Workspace request body must be an object.");
+  }
+  return value as Record<string, unknown>;
+}
+
+function exactBodyKeys(
+  body: Record<string, unknown>,
+  required: readonly string[],
+  optional: readonly string[] = [],
+): void {
+  const allowed = new Set([...required, ...optional]);
+  if (required.some(key => !Object.hasOwn(body, key))
+    || Object.keys(body).some(key => !allowed.has(key))) {
+    throw new Error("Remote Workspace request body contains invalid fields.");
+  }
+}
+
+export async function handleRemoteWorkspaceRoutes(ctx: ManagementContext): Promise<Response | null> {
+  const { req, url, config } = ctx;
+  if (!url.pathname.startsWith(REMOTE_WORKSPACE_PREFIX)) return null;
+  if (url.pathname.length > REMOTE_WORKSPACE_PREFIX.length
+    && url.pathname[REMOTE_WORKSPACE_PREFIX.length] !== "/") return null;
+  if (!remoteWorkspaceEnabled(config)) {
+    return response({ available: false, reason: "Remote Workspace requires this OpenCodex instance to run as a hub." }, 409);
+  }
+  if (req.method !== "GET") {
+    const denied = sessionOnly(ctx);
+    if (denied) return denied;
+  }
+  if (ctx.deps.remoteWorkspaceStopping?.()) return response({ error: "Remote Workspace is stopping." }, 503);
+  const runtime = await import("../../remote-control/workspace-runtime");
+  if (ctx.deps.remoteWorkspaceStopping?.()) return response({ error: "Remote Workspace is stopping." }, 503);
+  const hub = ctx.deps.remoteWorkspaceHub ?? runtime.remoteWorkspaceHubForConfig(config);
+  const sessions = ctx.deps.remoteWorkspaceSessions ?? runtime.remoteWorkspaceSessionsForConfig(config);
+  ctx.deps.onRemoteWorkspaceShutdown?.(async () => {
+    const sessions = ctx.deps.remoteWorkspaceSessions ?? runtime.initializedRemoteWorkspaceSessionsForConfig(config);
+    const hub = ctx.deps.remoteWorkspaceHub ?? runtime.initializedRemoteWorkspaceHubForConfig(config);
+    try { await sessions?.shutdown(); } finally { hub?.closeAllConnections(); }
+  });
+  if (url.pathname === "/api/remote-workspace" && req.method === "GET") {
+    return response({
+      available: true,
+      devices: hub.listDevices(),
+      runtimes: await sessions.availability(),
+      sessions: sessions.list(),
+    });
+  }
+  if (url.pathname === "/api/remote-workspace/pairing" && req.method === "POST") {
+    const denied = sessionOnly(ctx);
+    if (denied) return denied;
+    try {
+      return response(hub.createPairingGrant(), 201);
+    } catch (error) {
+      rethrowManagementBodyTooLarge(error);
+      return response({ error: error instanceof Error ? error.message : "Remote Workspace pairing failed." }, 429);
+    }
+  }
+  const match = /^\/api\/remote-workspace\/devices\/([0-9a-f-]+)$/i.exec(url.pathname);
+  if (match && req.method === "DELETE") {
+    const denied = sessionOnly(ctx);
+    if (denied) return denied;
+    if (!hub.revokeDevice(match[1]!)) return response({ error: "Remote Workspace device not found." }, 404);
+    await Promise.all(sessions.list()
+      .filter(session => session.deviceId === match[1] && session.status !== "stopped")
+      .map(session => sessions.stop(session.id)));
+    return response({ ok: true });
+  }
+  if (url.pathname === "/api/remote-workspace/sessions" && req.method === "GET") {
+    return response({ sessions: sessions.list() });
+  }
+  if (url.pathname === "/api/remote-workspace/runtimes" && req.method === "GET") {
+    return response({ runtimes: await sessions.availability() });
+  }
+  if (url.pathname === "/api/remote-workspace/sessions" && req.method === "POST") {
+    const denied = sessionOnly(ctx);
+    if (denied) return denied;
+    try {
+      const body = await jsonObject(req);
+      exactBodyKeys(body, ["profile", "deviceId", "rootId"], ["accessMode"]);
+      if (!isRemoteWorkspaceAgentProfile(body.profile)
+        || typeof body.deviceId !== "string"
+        || typeof body.rootId !== "string"
+        || (body.accessMode !== undefined && body.accessMode !== "read-only" && body.accessMode !== "workspace")) {
+        throw new Error("profile, deviceId, rootId, and a valid accessMode are required.");
+      }
+      return response(await sessions.create({
+        profile: body.profile,
+        deviceId: body.deviceId,
+        rootId: body.rootId,
+        accessMode: body.accessMode === "workspace" ? "workspace" : "read-only",
+      }), 201);
+    } catch (error) {
+      rethrowManagementBodyTooLarge(error);
+      return response({ error: error instanceof Error ? error.message : "Remote Workspace session failed." }, 409);
+    }
+  }
+  const promptMatch = /^\/api\/remote-workspace\/sessions\/([0-9a-f-]+)\/prompt$/i.exec(url.pathname);
+  if (promptMatch && req.method === "POST") {
+    const denied = sessionOnly(ctx);
+    if (denied) return denied;
+    try {
+      const body = await jsonObject(req);
+      exactBodyKeys(body, ["prompt"]);
+      return response(sessions.submitPrompt(promptMatch[1]!, body.prompt), 202);
+    } catch (error) {
+      rethrowManagementBodyTooLarge(error);
+      return response({ error: error instanceof Error ? error.message : "Remote Workspace turn failed." }, 409);
+    }
+  }
+  const sessionMatch = /^\/api\/remote-workspace\/sessions\/([0-9a-f-]+)$/i.exec(url.pathname);
+  if (sessionMatch && req.method === "DELETE") {
+    const denied = sessionOnly(ctx);
+    if (denied) return denied;
+    return await sessions.stop(sessionMatch[1]!)
+      ? response({ ok: true })
+      : response({ error: "Remote Workspace session not found." }, 404);
+  }
+  return response({ error: "Unknown Remote Workspace operation." }, 404);
+}

package/src/server/management/route-registry.ts

@@ -91,11 +91,17 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "GET", path: "/api/codex-auth/active", module: "codex/auth-api", mutates: false },
   { method: "GET", path: "/api/codex-auth/login-status", module: "codex/auth-api", mutates: false },
   { method: "GET", path: "/api/codex-auth/quota", module: "codex/auth-api", mutates: false },
+  { method: "GET", path: "/api/codex-auth/quota/history", module: "codex/auth-api", mutates: false },
   { method: "GET", path: "/api/codex-auth/reset-credits", module: "codex/auth-api", mutates: false },
   { method: "PATCH", path: "/api/codex-auth/pool-strategy", module: "codex/auth-api", mutates: true },
   { method: "POST", path: "/api/codex-auth/accounts", module: "codex/auth-api", mutates: true },
   { method: "POST", path: "/api/codex-auth/accounts/clear-cooldown", module: "codex/auth-api", mutates: true },
   { method: "POST", path: "/api/codex-auth/accounts/refresh", module: "codex/auth-api", mutates: true },
+  // codex/main-device-reauth-api (#3898): the native-main device reauth namespace;
+  // /api/codex-auth/login stays pool-only and keeps rejecting __main__.
+  { method: "POST", path: "/api/codex-auth/main/reauth-device", module: "codex/main-device-reauth-api", mutates: true },
+  { method: "GET", path: "/api/codex-auth/main/reauth-device", module: "codex/main-device-reauth-api", mutates: false },
+  { method: "DELETE", path: "/api/codex-auth/main/reauth-device", module: "codex/main-device-reauth-api", mutates: true },
   { method: "POST", path: "/api/codex-auth/login", module: "codex/auth-api", mutates: true },
   { method: "POST", path: "/api/codex-auth/login/cancel", module: "codex/auth-api", mutates: true },
   { method: "POST", path: "/api/codex-auth/login/code", module: "codex/auth-api", mutates: true },
@@ -322,6 +328,15 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "POST", path: "/api/storage/codex-logs/protect", module: "server/management/storage-log-guard-routes", mutates: true },
   { method: "POST", path: "/api/storage/codex-logs/repair", module: "server/management/storage-log-guard-routes", mutates: true },
   { method: "POST", path: "/api/storage/codex-logs/unprotect", module: "server/management/storage-log-guard-routes", mutates: true },
+  // server/management/remote-workspace-routes
+  { method: "GET", path: "/api/remote-workspace", module: "server/management/remote-workspace-routes", mutates: false, exempt: { reason: "deferred-verb", why: "The first Remote Workspace slice exposes Hub status through the authenticated dashboard; a distinct CLI Hub-status verb is still owed and must not be confused with the Executor-local status command.", owner: "remote-workspace-cli-followup", ownerDoc: "docs-site/src/content/docs/reference/management-api.md" } },
+  { method: "GET", path: "/api/remote-workspace/runtimes", module: "server/management/remote-workspace-routes", mutates: false, exempt: { reason: "deferred-verb", why: "The first Remote Workspace slice exposes Hub runtime availability through the authenticated dashboard; a distinct CLI Hub-status verb is still owed.", owner: "remote-workspace-cli-followup", ownerDoc: "docs-site/src/content/docs/reference/management-api.md" } },
+  { method: "GET", path: "/api/remote-workspace/sessions", module: "server/management/remote-workspace-routes", mutates: false, exempt: { reason: "deferred-verb", why: "The first Remote Workspace slice exposes Hub session snapshots through the authenticated dashboard; a distinct CLI Hub-status verb is still owed.", owner: "remote-workspace-cli-followup", ownerDoc: "docs-site/src/content/docs/reference/management-api.md" } },
+  { method: "POST", path: "/api/remote-workspace/pairing", module: "server/management/remote-workspace-routes", mutates: true, exempt: { reason: "session-only", why: "Creating a device enrollment grant authorizes another computer, so only a dashboard consent session may request one." } },
+  { method: "POST", path: "/api/remote-workspace/sessions", module: "server/management/remote-workspace-routes", mutates: true, exempt: { reason: "session-only", why: "Starting a Hub-authenticated model session against a remote computer requires an interactive dashboard consent session." } },
+  { method: "POST", path: "/api/remote-workspace/sessions/{id}/prompt", module: "server/management/remote-workspace-routes", mutates: true, mechanism: "regex", exempt: { reason: "session-only", why: "A prompt can execute tools on the selected remote computer and therefore requires an interactive dashboard consent session." } },
+  { method: "DELETE", path: "/api/remote-workspace/devices/{id}", module: "server/management/remote-workspace-routes", mutates: true, mechanism: "regex", exempt: { reason: "session-only", why: "Revoking a Remote Workspace computer is an interactive dashboard identity action, not an admin-token automation verb." } },
+  { method: "DELETE", path: "/api/remote-workspace/sessions/{id}", module: "server/management/remote-workspace-routes", mutates: true, mechanism: "regex", exempt: { reason: "session-only", why: "Stopping an interactive Remote Workspace model session belongs to the dashboard session that controls it." } },
   // server/management/system-routes
   { method: "GET", path: "/api/system/health", module: "server/management/system-routes", mutates: false },
   { method: "GET", path: "/api/system/memory", module: "server/management/system-routes", mutates: false },

package/src/server/management/usage-aggregate-cache.ts

@@ -23,6 +23,7 @@ import {
 
 interface RetainedUsageAggregate {
   accumulator: UsageSummaryAccumulator;
+  usageIncomplete: boolean;
   revision: UsageLogRevision | null;
   identityKey: string;
   revisionKey: string;
@@ -35,6 +36,7 @@ interface RetainedUsageAggregate {
 
 export interface UsageAggregateResult {
   accumulator: UsageSummaryAccumulator;
+  usageIncomplete: boolean;
   revision: UsageLogRevision | null;
   processedThroughBytes: number;
   overlayVersion: number;
@@ -75,6 +77,7 @@ function resultFrom(
 ): UsageAggregateResult {
   return {
     accumulator: state.accumulator,
+    usageIncomplete: state.usageIncomplete,
     revision: state.revision,
     processedThroughBytes: state.processedThroughBytes,
     overlayVersion: state.overlayVersion,
@@ -99,6 +102,7 @@ function makeRetainedAggregate(
 ): RetainedUsageAggregate {
   return {
     accumulator,
+    usageIncomplete: scan.oversizedRows > 0,
     revision: scan.revision,
     identityKey: usageLogIdentityKey(scan.revision),
     revisionKey: usageLogRevisionKey(scan.revision),
@@ -126,9 +130,6 @@ async function rebuildAggregate(options: UsageAggregateOptions): Promise<UsageAg
           apiKeyAccumulator?.add(entry);
         },
       });
-      if (scan.oversizedRows > 0) {
-        throw new Error("usage ledger contains an oversized row");
-      }
       if (userCostOverlayVersion() !== overlayVersion || currentTimeZone() !== timeZone) {
         lastError = new Error("usage aggregation inputs changed during rebuild");
         continue;
@@ -138,7 +139,10 @@ async function rebuildAggregate(options: UsageAggregateOptions): Promise<UsageAg
       const result = publishRetainedAggregate(state);
       if (apiKeyAccumulator && options.configuredApiKeyIds) {
         cacheApiKeyUsageFromRollup(
-          apiKeyAccumulator.snapshot(),
+          {
+            ...apiKeyAccumulator.snapshot(),
+            ...(state.usageIncomplete ? { usageIncomplete: true as const, usageIncompleteReason: "oversized_rows" as const } : {}),
+          },
           options.configuredApiKeyIds,
           state.identityKey,
           state.revision?.size ?? 0,
@@ -180,8 +184,8 @@ async function appendAggregate(
   let rebuildAfterUnpin = false;
   try {
     // Clone first and publish only after the scanner verifies the captured
-    // suffix. A callback error, mutation, or oversized row leaves retained
-    // state byte-for-byte untouched.
+    // suffix. A callback error or mutation leaves retained state untouched.
+    // Skipped oversized rows retain the normal rows with an explicit diagnostic.
     const candidate = state.accumulator.clone();
     const scan = await scanUsageLedgerCooperatively({
       startAtBytes: state.processedThroughBytes,
@@ -189,10 +193,6 @@ async function appendAggregate(
       expectedProcessedThroughDigest: state.processedThroughDigest,
       onEntry: entry => candidate.add(entry),
     });
-    if (scan.oversizedRows > 0) {
-      if (retainedAggregate === state) retainedAggregate = null;
-      throw new Error("usage ledger contains an oversized row");
-    }
     if (userCostOverlayVersion() !== state.overlayVersion || currentTimeZone() !== state.timeZone) {
       if (retainedAggregate === state) retainedAggregate = null;
       rebuildAfterUnpin = true;
@@ -200,6 +200,9 @@ async function appendAggregate(
       const next: RetainedUsageAggregate = {
         ...state,
         accumulator: candidate,
+        // A partial unterminated row can be scanned again on the next append.
+        // Preserve a boolean diagnostic rather than double-counting omissions.
+        usageIncomplete: state.usageIncomplete || scan.oversizedRows > 0,
         revision: scan.revision,
         identityKey: usageLogIdentityKey(scan.revision),
         revisionKey: usageLogRevisionKey(scan.revision),
@@ -329,7 +332,6 @@ async function rebuildFilteredAggregate(
     const accumulator = createUsageSummaryAccumulator({ filter, mode: "row-unique", window });
     try {
       const scan = await scanUsageLedgerCooperatively({ onEntry: entry => accumulator.add(entry) });
-      if (scan.oversizedRows > 0) throw new Error("usage ledger contains an oversized row");
       if (userCostOverlayVersion() !== overlayVersion || currentTimeZone() !== timeZone) {
         lastError = new Error("usage aggregation inputs changed during filtered scan");
         continue;
@@ -362,10 +364,6 @@ async function appendFilteredAggregate(
       expectedProcessedThroughDigest: state.processedThroughDigest,
       onEntry: entry => candidate.add(entry),
     });
-    if (scan.oversizedRows > 0) {
-      if (retainedFilteredAggregates.get(key) === state) retainedFilteredAggregates.delete(key);
-      throw new Error("usage ledger contains an oversized row");
-    }
     if (userCostOverlayVersion() !== state.overlayVersion || currentTimeZone() !== state.timeZone) {
       if (retainedFilteredAggregates.get(key) === state) retainedFilteredAggregates.delete(key);
       rebuildAfterUnpin = true;
@@ -373,6 +371,7 @@ async function appendFilteredAggregate(
       const next: RetainedUsageAggregate = {
         ...state,
         accumulator: candidate,
+        usageIncomplete: state.usageIncomplete || scan.oversizedRows > 0,
         revision: scan.revision,
         identityKey: usageLogIdentityKey(scan.revision),
         revisionKey: usageLogRevisionKey(scan.revision),

package/src/server/management/usage-summary-cache.ts

@@ -2,6 +2,8 @@ import { enforceAppOwnedMemoryBudget, type RetainedStoreSnapshot } from "../../l
 import type { UsageSummary } from "../../usage/summary";
 
 export type CachedUsageSummary = UsageSummary & {
+  usageIncomplete?: true;
+  usageIncompleteReason?: "oversized_rows";
   historyTruncated: boolean;
   truncatedPrefixBytes: number;
   entriesTruncated: boolean;

package/src/server/management-api.ts

@@ -1,3 +1,4 @@
+import { remoteWorkspaceEnabled } from "../remote-control/workspace-activation";
 import { randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
 import type { CatalogModel } from "../codex/catalog";
@@ -149,6 +150,20 @@ async function handleGrokCouponRoutesOnDemand(ctx: ManagementContext): Promise<R
   return handleGrokCouponRoutes(ctx);
 }
 
+async function handleRemoteWorkspaceRoutesOnDemand(ctx: ManagementContext): Promise<Response | null> {
+  if (!pathInManagementNamespace(ctx.url.pathname, "/api/remote-workspace")) return null;
+  if (!remoteWorkspaceEnabled(ctx.config)) {
+    return Response.json({ available: false, reason: "Remote Workspace requires Hub mode and OCX_REMOTE_WORKSPACE_ENABLED=1.", devices: [], runtimes: {}, sessions: [] }, {
+      status: ctx.req.method === "GET" ? 200 : 404, headers: { "cache-control": "no-store" },
+    });
+  }
+  if (ctx.req.method !== "GET" && ctx.principal !== "gui-session") {
+    return Response.json({ error: "A dashboard session is required for Remote Workspace changes." }, { status: 403 });
+  }
+  const { handleRemoteWorkspaceRoutes } = await import("./management/remote-workspace-routes");
+  return handleRemoteWorkspaceRoutes(ctx);
+}
+
 export async function handleManagementAPI(
   req: Request,
   url: URL,
@@ -242,6 +257,7 @@ export async function handleManagementAPI(
   let routed: Response | null;
   try {
     routed = handleSessionRoutes(ctx)
+    ??     (await handleRemoteWorkspaceRoutesOnDemand(ctx))
     ??     (await handleConfigRoutes(ctx))
     ??     (await handleStorageLogGuardRoutes(ctx))
     ??     (await handleLogsUsageRoutes(ctx))
@@ -388,6 +404,13 @@ export async function handleManagementAPI(
   }
 
   if (url.pathname.startsWith("/api/codex-auth/")) {
+    // Native-main device reauth (#3898): a dedicated namespace the generic
+    // codex-auth dispatch must not swallow (it would 404 as an unknown pool
+    // route). Same management origin/auth/session wrapping as every /api/*.
+    if (url.pathname === "/api/codex-auth/main/reauth-device") {
+      const { handleMainDeviceReauthAPI } = await import("../codex/main-device-reauth-api");
+      return handleMainDeviceReauthAPI(req, url, config);
+    }
     const { handleCodexAuthAPI } = await import("../codex/auth-api");
     const { ConfigMutationLockError } = await import("../config");
     const { CodexCredentialRefreshLockTimeoutError } = await import("../codex/account-store");

package/src/server/ports.ts

@@ -1,5 +1,22 @@
 import { createServer } from "node:net";
 
+/** An auxiliary bind cannot be repaired by selecting a different public port. */
+export class AuxiliaryListenerBindError extends Error {
+  constructor(
+    readonly listener: "unauthenticatedLoopbackListener" | "hub.managementIngress",
+    readonly port: number,
+    readonly hostname: string,
+    cause: unknown,
+  ) {
+    super(
+      `Could not bind ${listener} at ${hostname}:${port}. `
+      + `Check that listener's address and port; the public proxy port was not retried.`,
+      { cause },
+    );
+    this.name = "AuxiliaryListenerBindError";
+  }
+}
+
 /** Temporary bind probes must not let accepted peers hold server.close() open. */
 function createProbeServer(): ReturnType<typeof createServer> {
   const server = createServer();

package/src/server/relay-eager.ts

@@ -26,6 +26,7 @@
 
 import {
   adapterEofIncompleteFrame,
+  type CodexSafetyBufferingFilterOptions,
   createSseTerminalOutputBoundary,
   doneFrame,
   failedTailFrame,
@@ -84,6 +85,8 @@ export type EagerRelayOptions = {
   postCancelDrainBytes?: number;
   /** Last known upstream failure to preserve when EOF would otherwise become adapter_eof. */
   upstreamError?: string;
+  /** Optional client-facing hint policy; inspection retains original frames. */
+  terminalBoundary?: CodexSafetyBufferingFilterOptions;
   /** Injectable clock for tests. */
   now?: () => number;
 };
@@ -114,7 +117,7 @@ export function relaySseEagerBounded(
   const terminalEncoder = new TextEncoder();
   const adapterEofFrame = adapterEofIncompleteFrame(terminalEncoder);
   const terminalSentinel = doneFrame(terminalEncoder);
-  const terminalBoundary = createSseTerminalOutputBoundary();
+  const terminalBoundary = createSseTerminalOutputBoundary(opts?.terminalBoundary);
   const activeRewrite: SseBlockRewrite | undefined = hooks.rewriteBlocks
     ?? (hooks.rewritePayload ? payloadRewriteAsBlockRewrite(hooks.rewritePayload) : undefined);
   const encodeFailedTail = (error: unknown): Uint8Array | null => {