@bitkyc08/opencodex 2.6.26-preview.20260705 → 2.6.28-preview.20260707

package/src/server/management-api.ts

@@ -0,0 +1,628 @@
+import { readFileSync } from "node:fs";
+import type { CatalogModel } from "../codex/catalog";
+import { invalidateCodexModelsCache } from "../codex/catalog";
+import {
+  DEFAULT_SUBAGENT_MODELS,
+  codexAutoStartEnabled,
+  hasOwnProvider,
+  isValidProviderName,
+  providerBaseUrlConfigError,
+  providerHeadersConfigError,
+  saveConfig,
+} from "../config";
+import {
+  clearLoginState,
+  getLoginStatus,
+  isOAuthProvider,
+  listOAuthProviders,
+  startLoginFlow,
+  upsertOAuthProvider,
+} from "../oauth";
+import { removeCredential } from "../oauth/store";
+import { enrichProviderFromCatalog, listKeyLoginProviders } from "../oauth/key-providers";
+import { deriveProviderPresets } from "../providers/derive";
+import { fetchProviderQuotaReports } from "../providers/quota";
+import { DEFAULT_PROVIDER_CONTEXT_CAP, globalContextCapValue, providerContextCap, providerContextCaps, setAllProviderContextCaps, setGlobalContextCapValue, setProviderContextCap } from "../providers/context-cap";
+import { readUsageEntries } from "../usage/log";
+import { parseRange, summarizeUsage } from "../usage/summary";
+import { stripCodexRuntimeProviderFields } from "../codex/auth-context";
+import type { OcxConfig, OcxProviderConfig } from "../types";
+import { drainAndShutdown } from "./lifecycle";
+import { filterRequestLogs, getRequestLogEntries } from "./request-log";
+import { isAllowedRequestOrigin, jsonResponse, providerManagementConfigError, publicProviderBaseUrl, safeConfigDTO } from "./auth-cors";
+
+// Single source of truth = package.json (../ from src/), so /healthz + the GUI badge match the
+// installed npm version instead of a stale hardcode.
+export const VERSION = (() => {
+  try {
+    return JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf8")).version as string;
+  } catch {
+    return "0.0.0";
+  }
+})();
+
+export async function handleManagementAPI(req: Request, url: URL, config: OcxConfig): Promise<Response | null> {
+  if (!isAllowedRequestOrigin(req, config)) {
+    return jsonResponse({ error: "cross-origin request blocked" }, 403, req, config);
+  }
+  // Management bodies are small JSON (provider names, key ids, settings). Reject oversized
+  // payloads before any handler buffers them — the data plane has its own decompression cap.
+  if (req.method === "POST" || req.method === "PUT") {
+    const contentLength = Number(req.headers.get("content-length") ?? "0");
+    if (Number.isFinite(contentLength) && contentLength > 2 * 1024 * 1024) {
+      return jsonResponse({ error: "request body too large" }, 413, req, config);
+    }
+  }
+  async function refreshCodexCatalogBestEffort(): Promise<void> {
+    try {
+      const { refreshCodexModelCatalog } = await import("../codex/refresh");
+      await refreshCodexModelCatalog(config);
+    } catch {
+      /* catalog absent */
+    }
+  }
+
+  if (url.pathname === "/api/config" && req.method === "GET") {
+    return jsonResponse(safeConfigDTO(config));
+  }
+
+  if (url.pathname === "/api/config" && req.method === "PUT") {
+    return jsonResponse({ error: "Full config PUT is disabled. Use /api/providers POST for provider changes." }, 405);
+  }
+
+  if (url.pathname === "/api/settings" && req.method === "GET") {
+    return jsonResponse({
+      codexAutoStart: codexAutoStartEnabled(config),
+      port: config.port,
+      hostname: config.hostname ?? "127.0.0.1",
+    });
+  }
+
+  if (url.pathname === "/api/settings" && req.method === "PUT") {
+    let body: { codexAutoStart?: unknown };
+    try { body = await req.json(); } catch { return jsonResponse({ error: "invalid JSON body" }, 400); }
+    if (typeof body.codexAutoStart !== "boolean") {
+      return jsonResponse({ error: "codexAutoStart boolean is required" }, 400);
+    }
+    config.codexAutoStart = body.codexAutoStart;
+    saveConfig(config);
+    return jsonResponse({ ok: true, codexAutoStart: codexAutoStartEnabled(config) });
+  }
+
+  if (url.pathname === "/api/sync" && req.method === "POST") {
+    const { syncModelsToCodex } = await import("../codex/sync");
+    const result = await syncModelsToCodex(undefined, config, null);
+    return jsonResponse({
+      ...result,
+      staleAppServerHint: "If Codex App still shows an older model list, restart its long-lived app-server process after sync.",
+    }, result.ok ? 200 : 500);
+  }
+
+  if (url.pathname === "/api/update/check" && req.method === "GET") {
+    const { checkForUpdate, normalizeUpdateChannel } = await import("../update/job");
+    const rawTag = url.searchParams.get("tag");
+    if (rawTag && rawTag !== "latest" && rawTag !== "preview") {
+      return jsonResponse({ error: "tag must be latest or preview" }, 400);
+    }
+    return jsonResponse(checkForUpdate(normalizeUpdateChannel(rawTag)));
+  }
+
+  if (url.pathname === "/api/update/run" && req.method === "POST") {
+    const { normalizeUpdateChannel, startUpdateJob, UpdateJobError } = await import("../update/job");
+    let body: { tag?: unknown; restart?: unknown };
+    try { body = await req.json(); } catch { return jsonResponse({ error: "invalid JSON body" }, 400); }
+    if (body.tag !== undefined && body.tag !== "latest" && body.tag !== "preview") {
+      return jsonResponse({ error: "tag must be latest or preview" }, 400);
+    }
+    if (body.restart !== undefined && typeof body.restart !== "boolean") {
+      return jsonResponse({ error: "restart boolean is required" }, 400);
+    }
+    try {
+      return jsonResponse({ ok: true, job: startUpdateJob(normalizeUpdateChannel(body.tag as string | undefined), body.restart !== false) });
+    } catch (err) {
+      if (err instanceof UpdateJobError) {
+        return jsonResponse({ error: err.message, code: err.code }, err.status);
+      }
+      return jsonResponse({ error: err instanceof Error ? err.message : String(err) }, 500);
+    }
+  }
+
+  if (url.pathname === "/api/update/status" && req.method === "GET") {
+    const { readUpdateJob } = await import("../update/job");
+    const job = readUpdateJob(url.searchParams.get("jobId"));
+    if (!job) return jsonResponse({ error: "update job not found" }, 404);
+    return jsonResponse({ ok: true, job });
+  }
+
+  if (url.pathname === "/api/sidecar-settings" && req.method === "GET") {
+    const ws = config.webSearchSidecar ?? {};
+    const vs = config.visionSidecar ?? {};
+    return jsonResponse({
+      webSearch: { model: ws.model ?? "gpt-5.4-mini", reasoning: ws.reasoning ?? "low" },
+      vision: { model: vs.model ?? "gpt-5.4-mini" },
+    });
+  }
+
+  if (url.pathname === "/api/sidecar-settings" && req.method === "PUT") {
+    let body: { webSearch?: { model?: string; reasoning?: string }; vision?: { model?: string } };
+    try { body = await req.json(); } catch { return jsonResponse({ error: "invalid JSON body" }, 400); }
+    if (body.webSearch) {
+      config.webSearchSidecar = { ...config.webSearchSidecar };
+      if (typeof body.webSearch.model === "string") config.webSearchSidecar.model = body.webSearch.model;
+      if (typeof body.webSearch.reasoning === "string") config.webSearchSidecar.reasoning = body.webSearch.reasoning;
+    }
+    if (body.vision) {
+      config.visionSidecar = { ...config.visionSidecar };
+      if (typeof body.vision.model === "string") config.visionSidecar.model = body.vision.model;
+    }
+    saveConfig(config);
+    const ws = config.webSearchSidecar ?? {};
+    const vs = config.visionSidecar ?? {};
+    return jsonResponse({
+      ok: true,
+      webSearch: { model: ws.model ?? "gpt-5.4-mini", reasoning: ws.reasoning ?? "low" },
+      vision: { model: vs.model ?? "gpt-5.4-mini" },
+    });
+  }
+
+  if (url.pathname === "/api/logs" && req.method === "GET") {
+    return jsonResponse(filterRequestLogs(getRequestLogEntries(), url.searchParams));
+  }
+
+  if (url.pathname === "/api/usage" && req.method === "GET") {
+    const range = parseRange(url.searchParams.get("range"));
+    const now = Date.now();
+    try {
+      return jsonResponse(summarizeUsage(readUsageEntries(), range, now));
+    } catch {
+      return jsonResponse({
+        range,
+        since: null,
+        generatedAt: now,
+        summary: {
+          requests: 0,
+          measuredRequests: 0,
+          reportedRequests: 0,
+          unreportedRequests: 0,
+          unsupportedRequests: 0,
+          estimatedRequests: 0,
+          inputTokens: 0,
+          outputTokens: 0,
+          cachedInputTokens: 0,
+          reasoningOutputTokens: 0,
+          totalTokens: 0,
+          coverageRatio: 0,
+        },
+        days: [],
+        models: [],
+        providers: [],
+        error: "read_failed",
+      });
+    }
+  }
+
+  if (url.pathname === "/api/provider-quotas" && req.method === "GET") {
+    const forceRefresh = url.searchParams.get("refresh") === "1" || url.searchParams.get("refresh") === "true";
+    return jsonResponse(await fetchProviderQuotaReports(config, forceRefresh));
+  }
+
+  if (url.pathname === "/api/providers" && req.method === "GET") {
+    return jsonResponse(Object.entries(config.providers).map(([name, p]) => ({
+      name, adapter: p.adapter, baseUrl: publicProviderBaseUrl(p.baseUrl), defaultModel: p.defaultModel,
+      hasApiKey: !!p.apiKey,
+      disabled: p.disabled === true,
+    })));
+  }
+
+  // Add (or overwrite) a single provider. Merges into the live in-memory config and
+  // persists — existing providers' real keys are never round-tripped (unlike PUT /api/config,
+  // which would re-save the masked keys from GET). Live routing picks it up immediately.
+  if (url.pathname === "/api/providers" && req.method === "POST") {
+    let body: { name?: string; provider?: OcxProviderConfig; setDefault?: boolean };
+    try { body = await req.json(); } catch { return jsonResponse({ error: "invalid JSON body" }, 400); }
+    const name = body.name?.trim();
+    const prov = body.provider ? stripCodexRuntimeProviderFields(body.provider) : undefined;
+    if (!name || !prov?.adapter || !prov?.baseUrl) {
+      return jsonResponse({ error: "name, provider.adapter and provider.baseUrl are required" }, 400);
+    }
+    if (!isValidProviderName(name)) {
+      return jsonResponse({ error: "provider name must use letters, numbers, dot, underscore, or hyphen and cannot be a reserved object key" }, 400);
+    }
+    const providerError = providerManagementConfigError(name, prov);
+    if (providerError) return jsonResponse({ error: providerError }, 400);
+    // Catalog providers (e.g. ollama-cloud) carry a models + vision/reasoning classification the GUI
+    // doesn't send — merge it in so the sidecars are gated correctly.
+    enrichProviderFromCatalog(name, prov);
+    const { saveConfig: save } = await import("../config");
+    // Overwriting an existing provider must not drop its multi-key pool: carry it over, then
+    // let the (possibly new) apiKey join the pool as the active entry.
+    const existingPool = config.providers[name]?.apiKeyPool;
+    if (existingPool && !prov.apiKeyPool) prov.apiKeyPool = existingPool;
+    config.providers[name] = prov;
+    if (body.setDefault) config.defaultProvider = name;
+    save(config);
+    if (prov.apiKey && prov.apiKeyPool) {
+      const { addProviderApiKey } = await import("../providers/api-keys");
+      addProviderApiKey(config, name, prov.apiKey);
+    }
+    const { clearModelCache } = await import("../codex/model-cache");
+    clearModelCache(name);
+    await refreshCodexCatalogBestEffort();
+    return jsonResponse({ success: true, name });
+  }
+
+  if (url.pathname === "/api/providers" && req.method === "PATCH") {
+    const name = url.searchParams.get("name")?.trim();
+    if (!name || !isValidProviderName(name) || !hasOwnProvider(config.providers, name)) return jsonResponse({ error: "unknown provider" }, 404);
+    let body: { disabled?: unknown };
+    try { body = await req.json(); } catch { return jsonResponse({ error: "invalid JSON body" }, 400); }
+    if (typeof body.disabled !== "boolean") return jsonResponse({ error: "disabled boolean is required" }, 400);
+    if (body.disabled && name === config.defaultProvider) {
+      return jsonResponse({ error: "cannot disable the default provider; set another default first" }, 400);
+    }
+    const { saveConfig: save } = await import("../config");
+    config.providers[name] = { ...config.providers[name], disabled: body.disabled };
+    save(config);
+    await refreshCodexCatalogBestEffort();
+    return jsonResponse({ success: true, name, disabled: body.disabled });
+  }
+
+  if (url.pathname === "/api/providers" && req.method === "DELETE") {
+    const name = url.searchParams.get("name")?.trim();
+    if (!name || !isValidProviderName(name) || !hasOwnProvider(config.providers, name)) return jsonResponse({ error: "unknown provider" }, 404);
+    if (name === config.defaultProvider) return jsonResponse({ error: "cannot delete the default provider; set another default first" }, 400);
+    const { saveConfig: save } = await import("../config");
+    delete config.providers[name];
+    setProviderContextCap(config, name, false);
+    save(config);
+    const { clearModelCache: clearCache } = await import("../codex/model-cache");
+    clearCache(name);
+    await refreshCodexCatalogBestEffort();
+    return jsonResponse({ success: true });
+  }
+
+  if (url.pathname === "/api/models" && req.method === "GET") {
+    const models = await fetchAllModels(config);
+    const disabled = new Set(config.disabledModels ?? []);
+    return jsonResponse(models.map(m => {
+      const namespaced = `${m.provider}/${m.id}`;
+      const contextCap = providerContextCap(config, m.provider);
+      return {
+        ...m,
+        namespaced,
+        disabled: disabled.has(namespaced),
+        ...(contextCap !== undefined ? { contextCap, contextCapped: m.contextCapped === true } : {}),
+      };
+    }));
+  }
+
+  if (url.pathname === "/api/provider-context-caps" && req.method === "GET") {
+    return jsonResponse({ cap: DEFAULT_PROVIDER_CONTEXT_CAP, value: globalContextCapValue(config), caps: providerContextCaps(config) });
+  }
+
+  if (url.pathname === "/api/provider-context-caps" && req.method === "PUT") {
+    let body: { provider?: unknown; enabled?: unknown; value?: unknown; setAll?: unknown };
+    try { body = await req.json(); } catch { return jsonResponse({ error: "invalid JSON body" }, 400); }
+    const { saveConfig: save } = await import("../config");
+    const { clearModelCache } = await import("../codex/model-cache");
+    const respond = () => jsonResponse({ ok: true, cap: DEFAULT_PROVIDER_CONTEXT_CAP, value: globalContextCapValue(config), caps: providerContextCaps(config) });
+
+    // Branch 1: set the global cap value and re-point every enabled provider to it.
+    if (body.value !== undefined) {
+      if (typeof body.value !== "number" || !Number.isFinite(body.value) || body.value <= 0) {
+        return jsonResponse({ error: "value must be a positive number" }, 400);
+      }
+      const affected = Object.keys(providerContextCaps(config));
+      setGlobalContextCapValue(config, body.value);
+      save(config);
+      for (const provider of affected) clearModelCache(provider);
+      await refreshCodexCatalogBestEffort();
+      return respond();
+    }
+
+    // Branch 2: enable/clear the cap for every provider at once.
+    if (body.setAll !== undefined) {
+      if (typeof body.setAll !== "boolean") {
+        return jsonResponse({ error: "setAll must be a boolean" }, 400);
+      }
+      const before = Object.keys(providerContextCaps(config));
+      const names = Object.keys(config.providers);
+      setAllProviderContextCaps(config, names, body.setAll);
+      save(config);
+      for (const provider of new Set([...before, ...names])) clearModelCache(provider);
+      await refreshCodexCatalogBestEffort();
+      return respond();
+    }
+
+    // Branch 3: existing per-provider toggle (enable writes the current global value).
+    if (typeof body.provider !== "string" || typeof body.enabled !== "boolean") {
+      return jsonResponse({ error: "provider string and enabled boolean are required" }, 400);
+    }
+    const provider = body.provider.trim();
+    if (!isValidProviderName(provider)) {
+      return jsonResponse({ error: "provider name must use letters, numbers, dot, underscore, or hyphen and cannot be a reserved object key" }, 400);
+    }
+    if (!hasOwnProvider(config.providers, provider)) {
+      return jsonResponse({ error: "unknown provider" }, 404);
+    }
+    setProviderContextCap(config, provider, body.enabled);
+    save(config);
+    clearModelCache(provider);
+    await refreshCodexCatalogBestEffort();
+    return respond();
+  }
+
+  // Enable/disable models: which routed models Codex sees. PUT hides them from the catalog +
+  // /v1/models and invalidates Codex's 5-min models cache so it applies on the next turn.
+  if (url.pathname === "/api/disabled-models" && req.method === "PUT") {
+    let body: { models?: unknown };
+    try { body = await req.json(); } catch { return jsonResponse({ error: "invalid JSON body" }, 400); }
+    const disabled = Array.isArray(body.models) ? body.models.filter((m): m is string => typeof m === "string") : [];
+    config.disabledModels = disabled;
+    const { saveConfig: save } = await import("../config");
+    save(config);
+    await refreshCodexCatalogBestEffort();
+    return jsonResponse({ ok: true, disabled });
+  }
+
+  // Which providers support real OAuth login (drives the GUI's "Log in with …" buttons).
+  if (url.pathname === "/api/oauth/providers" && req.method === "GET") {
+    return jsonResponse({ providers: listOAuthProviders() });
+  }
+
+  // API-key "login" providers (open dashboard → paste key). Drives the GUI's key-provider picker.
+  if (url.pathname === "/api/key-providers" && req.method === "GET") {
+    return jsonResponse({ providers: listKeyLoginProviders() });
+  }
+
+  // Complete GUI picker presets, derived from the canonical provider registry. The GUI is a
+  // standalone Vite package, so it consumes this runtime view instead of importing repo-root src.
+  if (url.pathname === "/api/provider-presets" && req.method === "GET") {
+    return jsonResponse({ providers: deriveProviderPresets() });
+  }
+
+  // Subagent model picker: which ≤5 routed models Codex's spawn_agent advertises (it shows the
+  // first 5 routed catalog entries). PUT reorders the injected catalog so the chosen ones lead.
+  if (url.pathname === "/api/subagent-models" && req.method === "GET") {
+    const models = await fetchAllModels(config);
+    const disabled = new Set(config.disabledModels ?? []);
+    // Native gpt (passthrough) are also valid subagent picks — they're picker-visible models in the
+    // catalog, just buried by priority. List them first so the user can feature them over routed.
+    const { listCatalogNativeSlugs } = await import("../codex/catalog");
+    const available = [
+      ...listCatalogNativeSlugs(),
+      ...models.map(m => `${m.provider}/${m.id}`),
+    ].filter(ns => !disabled.has(ns));
+    return jsonResponse({ chosen: config.subagentModels ?? [], available });
+  }
+  if (url.pathname === "/api/subagent-models" && req.method === "PUT") {
+    let body: { models?: unknown };
+    try { body = await req.json(); } catch { return jsonResponse({ error: "invalid JSON body" }, 400); }
+    const chosen = Array.isArray(body.models) ? body.models.filter((m): m is string => typeof m === "string").slice(0, 5) : [];
+    config.subagentModels = chosen;
+    const { saveConfig: save } = await import("../config");
+    save(config);
+    await refreshCodexCatalogBestEffort();
+    return jsonResponse({ ok: true, applied: chosen });
+  }
+
+  // Per-provider catalog allowlist (issue #52): when a provider has a non-empty selectedModels list,
+  // only those ids ship to Codex's catalog / /v1/models. GET returns the CURRENT selection plus the
+  // FULL available set per provider (unfiltered — the picker needs everything to choose from).
+  if (url.pathname === "/api/selected-models" && req.method === "GET") {
+    const models = await fetchAllModels(config);
+    const available: Record<string, string[]> = {};
+    for (const m of models) (available[m.provider] ??= []).push(m.id);
+    const selected: Record<string, string[]> = {};
+    for (const [name, prov] of Object.entries(config.providers)) {
+      if (Array.isArray(prov.selectedModels) && prov.selectedModels.length > 0) selected[name] = [...prov.selectedModels];
+    }
+    return jsonResponse({ selected, available });
+  }
+  if (url.pathname === "/api/selected-models" && req.method === "PUT") {
+    let body: { provider?: unknown; models?: unknown };
+    try { body = await req.json(); } catch { return jsonResponse({ error: "invalid JSON body" }, 400); }
+    const provider = typeof body.provider === "string" ? body.provider : "";
+    if (!provider || !hasOwnProvider(config.providers, provider)) {
+      return jsonResponse({ error: "unknown provider" }, provider ? 404 : 400);
+    }
+    const models = Array.isArray(body.models)
+      ? [...new Set(body.models.filter((m): m is string => typeof m === "string"))]
+      : [];
+    // Empty list clears the allowlist (provider reverts to exposing all models).
+    if (models.length > 0) config.providers[provider].selectedModels = models;
+    else delete config.providers[provider].selectedModels;
+    const { saveConfig: save } = await import("../config");
+    save(config);
+    await refreshCodexCatalogBestEffort();
+    return jsonResponse({ ok: true, provider, selected: models });
+  }
+
+  // OAuth login (xai now; anthropic/kimi in cycle 2). Starts the flow and returns the auth URL;
+  // the provider's loopback callback server (inside this process) captures the redirect in the
+  // background, then the credential is persisted. The GUI opens the URL and polls /api/oauth/status.
+  if (url.pathname === "/api/oauth/login" && req.method === "POST") {
+    const body = await req.json().catch(() => ({})) as { provider?: string; addAccount?: boolean };
+    const provider = (body.provider ?? "").trim().toLowerCase();
+    if (!isOAuthProvider(provider)) return jsonResponse({ error: "unknown oauth provider" }, 400);
+    try {
+      // addAccount forces a fresh browser identity (skips local-CLI token import) so a
+      // SECOND account can be added instead of re-importing the first one.
+      const { url: authUrl, instructions } = await startLoginFlow(provider, body.addAccount ? { forceLogin: true } : undefined);
+      upsertOAuthProvider(config, provider); // mutate LIVE config — routing sees it without restart
+      if (authUrl) {
+        // Open the browser server-side (the proxy runs on the user's machine) — the GUI's
+        // window.open is popup-blocked because it runs after an await, not a direct click.
+        const { openUrl } = await import("../lib/open-url");
+        openUrl(authUrl);
+      }
+      return jsonResponse({ url: authUrl, instructions });
+    } catch (err) {
+      return jsonResponse({ error: err instanceof Error ? err.message : String(err) }, 409);
+    }
+  }
+
+  if (url.pathname === "/api/oauth/status" && req.method === "GET") {
+    const provider = (url.searchParams.get("provider") ?? "").trim().toLowerCase();
+    return jsonResponse(getLoginStatus(provider));
+  }
+
+  if (url.pathname === "/api/oauth/logout" && req.method === "POST") {
+    const provider = (url.searchParams.get("provider") ?? "").trim().toLowerCase();
+    if (!isOAuthProvider(provider)) return jsonResponse({ error: "unknown oauth provider" }, 400);
+    removeCredential(provider);
+    clearLoginState(provider);
+    return jsonResponse({ success: true });
+  }
+
+  // Multiauth account management: list a provider's logged-in accounts, switch the active
+  // one, or remove one. Emails are masked; tokens never leave the store.
+  if (url.pathname === "/api/oauth/accounts" && req.method === "GET") {
+    const provider = (url.searchParams.get("provider") ?? "").trim().toLowerCase();
+    if (!isOAuthProvider(provider)) return jsonResponse({ error: "unknown oauth provider" }, 400);
+    const status = getLoginStatus(provider);
+    return jsonResponse({ activeAccountId: status.activeAccountId ?? null, accounts: status.accounts ?? [] });
+  }
+  if (url.pathname === "/api/oauth/accounts/active" && req.method === "PUT") {
+    const body = await req.json().catch(() => ({})) as { provider?: string; accountId?: string };
+    const provider = (body.provider ?? "").trim().toLowerCase();
+    if (!isOAuthProvider(provider)) return jsonResponse({ error: "unknown oauth provider" }, 400);
+    if (!body.accountId) return jsonResponse({ error: "missing accountId" }, 400);
+    const { setActiveAccount } = await import("../oauth/store");
+    if (!setActiveAccount(provider, body.accountId)) return jsonResponse({ error: "account not found" }, 404);
+    const { clearProviderQuotaCache } = await import("../providers/quota");
+    clearProviderQuotaCache();
+    return jsonResponse({ ok: true, provider, activeAccountId: body.accountId });
+  }
+  if (url.pathname === "/api/oauth/accounts" && req.method === "DELETE") {
+    const provider = (url.searchParams.get("provider") ?? "").trim().toLowerCase();
+    const id = url.searchParams.get("id") ?? "";
+    if (!isOAuthProvider(provider)) return jsonResponse({ error: "unknown oauth provider" }, 400);
+    if (!id) return jsonResponse({ error: "missing id" }, 400);
+    const { removeAccount, getAccountSet } = await import("../oauth/store");
+    if (!removeAccount(provider, id)) return jsonResponse({ error: "account not found" }, 404);
+    if (!getAccountSet(provider)) clearLoginState(provider);
+    const { clearProviderQuotaCache } = await import("../providers/quota");
+    clearProviderQuotaCache();
+    return jsonResponse({ ok: true });
+  }
+
+  // Multi-key pool for API-key providers (same GUI dropdown as OAuth multiauth): list masked
+  // keys, add one (upserts + activates), switch the active key, or remove one. `apiKey` always
+  // mirrors the active entry so routing is untouched.
+  if (url.pathname === "/api/providers/keys" && req.method === "GET") {
+    const name = (url.searchParams.get("name") ?? "").trim();
+    if (!name || !isValidProviderName(name) || !hasOwnProvider(config.providers, name)) return jsonResponse({ error: "unknown provider" }, 404);
+    const { listProviderApiKeys } = await import("../providers/api-keys");
+    return jsonResponse(listProviderApiKeys(config, name));
+  }
+  if (url.pathname === "/api/providers/keys" && req.method === "POST") {
+    const body = await req.json().catch(() => ({})) as { name?: string; key?: string; label?: string };
+    const name = (body.name ?? "").trim();
+    if (!name || !isValidProviderName(name) || !hasOwnProvider(config.providers, name)) return jsonResponse({ error: "unknown provider" }, 404);
+    if (typeof body.key !== "string" || !body.key.trim()) return jsonResponse({ error: "key is required" }, 400);
+    const { addProviderApiKey } = await import("../providers/api-keys");
+    const result = addProviderApiKey(config, name, body.key, body.label);
+    if ("error" in result) return jsonResponse({ error: result.error }, 400);
+    const { clearModelCache } = await import("../codex/model-cache");
+    clearModelCache(name);
+    const { clearProviderQuotaCache } = await import("../providers/quota");
+    clearProviderQuotaCache();
+    const { clearKeyCooldowns } = await import("../providers/key-failover");
+    clearKeyCooldowns(name); // manual key management resets 429 cooldown state
+    return jsonResponse({ ok: true, id: result.id }, 201);
+  }
+  if (url.pathname === "/api/providers/keys/active" && req.method === "PUT") {
+    const body = await req.json().catch(() => ({})) as { name?: string; id?: string };
+    const name = (body.name ?? "").trim();
+    if (!name || !isValidProviderName(name) || !hasOwnProvider(config.providers, name)) return jsonResponse({ error: "unknown provider" }, 404);
+    if (!body.id) return jsonResponse({ error: "missing id" }, 400);
+    const { setActiveProviderApiKey } = await import("../providers/api-keys");
+    if (!setActiveProviderApiKey(config, name, body.id)) return jsonResponse({ error: "key not found" }, 404);
+    const { clearModelCache } = await import("../codex/model-cache");
+    clearModelCache(name);
+    const { clearProviderQuotaCache } = await import("../providers/quota");
+    clearProviderQuotaCache();
+    const { clearKeyCooldowns } = await import("../providers/key-failover");
+    clearKeyCooldowns(name); // manual key management resets 429 cooldown state
+    return jsonResponse({ ok: true, name, activeId: body.id });
+  }
+  if (url.pathname === "/api/providers/keys" && req.method === "DELETE") {
+    const name = (url.searchParams.get("name") ?? "").trim();
+    const id = url.searchParams.get("id") ?? "";
+    if (!name || !isValidProviderName(name) || !hasOwnProvider(config.providers, name)) return jsonResponse({ error: "unknown provider" }, 404);
+    if (!id) return jsonResponse({ error: "missing id" }, 400);
+    const { removeProviderApiKey } = await import("../providers/api-keys");
+    if (!removeProviderApiKey(config, name, id)) return jsonResponse({ error: "key not found" }, 404);
+    const { clearModelCache } = await import("../codex/model-cache");
+    clearModelCache(name);
+    const { clearProviderQuotaCache } = await import("../providers/quota");
+    clearProviderQuotaCache();
+    const { clearKeyCooldowns } = await import("../providers/key-failover");
+    clearKeyCooldowns(name); // manual key management resets 429 cooldown state
+    return jsonResponse({ ok: true });
+  }
+
+  // ---------------------------------------------------------------------------
+  // API Keys management
+  // ---------------------------------------------------------------------------
+  if (url.pathname === "/api/keys" && req.method === "GET") {
+    const keys = config.apiKeys ?? [];
+    return jsonResponse({ keys: keys.map(k => ({ id: k.id, name: k.name, prefix: k.key.slice(0, 8) + "...", createdAt: k.createdAt })), endpoint: `http://${config.hostname ?? "127.0.0.1"}:${config.port ?? 10100}/v1/responses` }, 200, req, config);
+  }
+
+  if (url.pathname === "/api/keys" && req.method === "POST") {
+    const body = await req.json() as { name?: string };
+    const name = (body.name ?? "").trim() || "default";
+    // Generate key from provider keys hash + random salt
+    const providerKeys = Object.values(config.providers).map(p => p.apiKey ?? "").filter(Boolean).join("|");
+    const salt = crypto.randomUUID();
+    const hashInput = `${providerKeys}|${salt}|${Date.now()}`;
+    const hashBuf = new Bun.CryptoHasher("sha256").update(hashInput).digest();
+    const key = "ocx_" + Buffer.from(hashBuf).toString("hex").slice(0, 40);
+    const entry = { id: crypto.randomUUID(), name, key, createdAt: new Date().toISOString() };
+    config.apiKeys = [...(config.apiKeys ?? []), entry];
+    saveConfig(config);
+    return jsonResponse({ id: entry.id, name: entry.name, key: entry.key, createdAt: entry.createdAt }, 201, req, config);
+  }
+
+  if (url.pathname === "/api/keys" && req.method === "DELETE") {
+    const body = await req.json() as { id?: string };
+    if (!body.id) return jsonResponse({ error: "id required" }, 400, req, config);
+    config.apiKeys = (config.apiKeys ?? []).filter(k => k.id !== body.id);
+    saveConfig(config);
+    return jsonResponse({ success: true }, 200, req, config);
+  }
+
+  if (url.pathname === "/api/stop" && req.method === "POST") {
+    const { restoreNativeCodex } = await import("../codex/inject");
+    const { stopServiceIfInstalled } = await import("../service");
+    stopServiceIfInstalled();
+    const restore = restoreNativeCodex();
+    setTimeout(async () => {
+      await drainAndShutdown(undefined, config.shutdownTimeoutMs ?? 5000);
+      process.exit(0);
+    }, 200);
+    return jsonResponse(restore.success
+      ? { success: true, message: "Proxy stopping, native Codex restored." }
+      : { success: false, message: `Proxy stopping, but native Codex restore failed: ${restore.message}. Run \`ocx restore\`.` });
+  }
+
+  if (url.pathname.startsWith("/api/codex-auth/")) {
+    const { handleCodexAuthAPI } = await import("../codex/auth-api");
+    return handleCodexAuthAPI(req, url, config);
+  }
+
+  return null;
+}
+
+/**
+ * Live routed-provider models for the proxy's /api/* and /v1/models endpoints. Delegates to the
+ * canonical, TTL-cached `gatherRoutedModels` (single source of truth) — so the GUI/codex endpoints
+ * share the same fetch, the same per-provider cache (dedups Codex's frequent /v1/models polling),
+ * and the same stale fallback when a provider blips, instead of a parallel uncached copy.
+ */
+export async function fetchAllModels(config: OcxConfig): Promise<CatalogModel[]> {
+  const { gatherRoutedModels } = await import("../codex/catalog");
+  return gatherRoutedModels(config);
+}

package/src/{proxy-liveness.ts → server/proxy-liveness.ts}

@@ -9,7 +9,7 @@
  *
  * Lives outside cli.ts (which dispatches argv at module top level) so tests can import it.
  */
-import { loadConfig, readPid, readRuntimePort } from "./config";
+import { loadConfig, readPid, readRuntimePort } from "../config";
 
 export interface HealthzIdentity {
   service?: unknown;