@bitkyc08/opencodex 2.60.0 → 2.61.0-preview.20260922

package/src/server/claude-messages.ts

@@ -7,6 +7,12 @@
  * unchanged. The Responses output (SSE or JSON) is converted back to Anthropic shape.
  */
 import { FORWARD_HEADERS } from "../adapters/openai-responses";
+import {
+  admissionModelDeniedResponse,
+  AdmissionModelDeniedError,
+  assertRouteAllowedByScope,
+  resolveAdmissionModelScope,
+} from "./admission-model-scope";
 import { jsonUtf8Bytes } from "../lib/json-byte-size";
 import { sseFieldValue } from "../lib/sse-decoder";
 import { enforceAnthropicImageLimits, sniffImageDimensions } from "../adapters/anthropic-image-guard";
@@ -18,7 +24,14 @@ import { recordDesktopRequest } from "../claude/desktop-health";
 import { stripOneMillionMarker } from "../claude/context-windows";
 import { captureClaudeInbound } from "../claude/inbound-debug";
 import { analyzeClaudeCompatibility, isClaudeCompatibilityMode } from "../claude/compatibility";
-import { isTransientUpstreamStatus } from "../lib/upstream-retry";
+import {
+  applyReplayRefusalClientHeaders,
+  carryReplayRefusal,
+  isReplayRefusalResponse,
+  isTransientUpstreamStatus,
+  REPLAY_REFUSED_STATUS,
+  UPSTREAM_RESET_REPLAY_REFUSED_CODE,
+} from "../lib/upstream-retry";
 import { resolveClientRetryAfter } from "../lib/retry-after";
 import {
   anthropicErrorBody,
@@ -815,6 +828,13 @@ async function handleClaudeMessagesWithBudget(
   // verified live 2026-07-11). Strip them for that route; routed providers keep them.
   try {
     const route = routeModel(config, internalBody.model as string, evidenceFromBody(internalBody));
+    // Same reason as the native Chat lane: this route can be sent from here, so
+    // the key's scope is applied before the wire is settled.
+    assertRouteAllowedByScope(
+      resolveAdmissionModelScope(config, logIds?.admission),
+      String(internalBody.model ?? ""),
+      route,
+    );
     // Settle the wire once so the sampling decision below reads the effective
     // adapter rather than the provider-wide default (#404).
     route.staticPolicy = captureRouteStaticPolicy(
@@ -847,6 +867,11 @@ async function handleClaudeMessagesWithBudget(
       if (ladder !== undefined && ladder.length === 0) delete internalBody.reasoning;
     }
   } catch (err) {
+    if (err instanceof AdmissionModelDeniedError) {
+      logCtx.requestedModel = requestedModel;
+      if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, 403, { closeReason: "non_stream" });
+      return admissionModelDeniedResponse(err);
+    }
     if (err instanceof UnknownRoutingPolicyError) {
       logCtx.requestedModel = requestedModel;
       if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, 404, { closeReason: "non_stream" });
@@ -961,6 +986,9 @@ async function handleClaudeMessagesWithBudget(
   const response = logIds ? responseWithDeferredRequestLog(upstream, logIds.requestId, logIds.start, logCtx) : upstream;
 
   if (!response.ok) {
+    // Read the shared provenance verdict before consuming and re-wrapping the body. A refusal
+    // and an ordinary provider rate limit are both 429, so the status cannot distinguish them.
+    const replayRefusal = isReplayRefusalResponse(response);
     // Re-shape the OpenAI-style error envelope into the Anthropic one, preserving status.
     let message = `upstream error (${response.status})`;
     try {
@@ -975,14 +1003,16 @@ async function handleClaudeMessagesWithBudget(
       }
     } catch { /* keep fallback message */ }
     const upstreamRetryAfter = response.headers.get("retry-after");
-    const retryAfter = resolveClientRetryAfter({
-      status: response.status,
-      message,
-      upstreamRetryAfter,
-    })
-      // Instant-retry "0" is a valid client directive but rejected by cooldown parsers.
-      // Preserve it so it still wins over the transient "2" fallback (claude-529 mapping).
-      ?? (upstreamRetryAfter?.trim() === "0" ? "0" : undefined);
+    const retryAfter = replayRefusal
+      ? undefined
+      : resolveClientRetryAfter({
+          status: response.status,
+          message,
+          upstreamRetryAfter,
+        })
+        // Instant-retry "0" is a valid client directive but rejected by cooldown parsers.
+        // Preserve it so it still wins over the transient "2" fallback (claude-529 mapping).
+        ?? (upstreamRetryAfter?.trim() === "0" ? "0" : undefined);
     // Transient upstream 5xx (already retried pre-stream, 010): reclassify as Anthropic
     // 529 overloaded_error so the Claude Code client applies its built-in backoff retry
     // instead of dying on a fatal api_error (260716 sol-builder incident). The request
@@ -993,16 +1023,24 @@ async function handleClaudeMessagesWithBudget(
     const nativeMainFence = response.status === 503
       && upstreamRetryAfter?.trim() === "1"
       && message === CODEX_MAIN_PROFILE_MAINTENANCE_MESSAGE;
-    const transient = !nativeMainFence && isTransientUpstreamStatus(response.status);
-    const outStatus = nativeMainFence ? 503 : transient ? 529 : response.status;
-    const out = new Response(JSON.stringify(anthropicErrorBody(outStatus, message)), {
+    const transient = !replayRefusal && !nativeMainFence && isTransientUpstreamStatus(response.status);
+    const outStatus = replayRefusal
+      ? REPLAY_REFUSED_STATUS
+      : nativeMainFence ? 503 : transient ? 529 : response.status;
+    const outHeaders = new Headers({ "Content-Type": "application/json" });
+    if (retryAfter) outHeaders.set("Retry-After", retryAfter);
+    else if (transient) outHeaders.set("Retry-After", "2");
+    if (replayRefusal) applyReplayRefusalClientHeaders(outHeaders);
+    const out = new Response(JSON.stringify(anthropicErrorBody(
+      outStatus,
+      message,
+      undefined,
+      replayRefusal ? UPSTREAM_RESET_REPLAY_REFUSED_CODE : undefined,
+    )), {
       status: outStatus,
-      headers: {
-        "Content-Type": "application/json",
-        ...(retryAfter ? { "Retry-After": retryAfter } : (transient ? { "Retry-After": "2" } : {})),
-      },
+      headers: outHeaders,
     });
-    return out;
+    return carryReplayRefusal(response, out);
   }
 
   const contentType = response.headers.get("content-type") ?? "";

package/src/server/grok-responses-snapshot-repair.ts

@@ -1,8 +1,13 @@
 /** Strict terminal reconstruction selected by the Grok compatibility marker. */
 import type { TranslatorBudget } from "../lib/translator-budget";
 import { MAX_COMPLETED_OUTPUT_ITEMS, MAX_COMPLETED_OUTPUT_ITEM_SOURCE_BYTES } from "./relay";
-import { sseDataPayload, type SseBlockRewrite } from "./sse-payload-rewrite";
+import { replaceSseDataPayload, sseDataPayload, type SseBlockRewrite } from "./sse-payload-rewrite";
 import { isPlainObject, jsonBlock, type RetainedOutputItem } from "./responses-snapshot-codec";
+import {
+  requestToolScope,
+  type RequestToolScope,
+  type RequestToolScopeCorrespondence,
+} from "./responses-request-tool-scope";
 
 type SparseTerminalOpenItem = {
   type: string;
@@ -16,6 +21,20 @@ type SparseTerminalCompletedItem = RetainedOutputItem & {
 
 const MAX_GROK_OPEN_ITEM_IDENTITY_BYTES = MAX_COMPLETED_OUTPUT_ITEM_SOURCE_BYTES;
 
+/** Terminal event this repair publishes when it refused to reconstruct a call faithfully. */
+export const GROK_REFUSED_TERMINAL_EVENT_TYPE = "response.incomplete";
+
+/** `incomplete_details.reason` carried by that terminal. */
+export const GROK_FORBIDDEN_TOOL_CALL_REASON = "forbidden_tool_call";
+
+/** An upstream-supplied name reaches the terminal message; keep it bounded. */
+const MAX_REPORTED_TOOL_NAME_CHARS = 100;
+
+export function forbiddenToolCallMessage(name: string): string {
+  return `routed provider called "${name.slice(0, MAX_REPORTED_TOOL_NAME_CHARS)}", `
+    + "which this request's tool selection excludes; the reconstructed output omits that call";
+}
+
 const GROK_TERMINAL_OUTPUT_ITEM_TYPES = new Set([
   "message",
   "reasoning",
@@ -167,6 +186,45 @@ function plausibleGrokOpenItem(
   };
 }
 
+/**
+ * Publish the refusal on the terminal itself rather than as a silent omission.
+ *
+ * The ordinary reconstruction replaces only the data payload's `output`, so its event name still
+ * describes the payload. A refusal does not: the turn no longer completed the way the upstream
+ * said it did, so the event line moves with the status instead of leaving a client to read a
+ * clean finish off an unchanged `event: response.completed`.
+ */
+function refusedTerminalBlock(
+  block: string,
+  parsed: Record<string, unknown>,
+  response: Record<string, unknown>,
+  output: readonly Record<string, unknown>[],
+  refusedName: string | undefined,
+): string {
+  const payload = JSON.stringify({
+    ...parsed,
+    type: GROK_REFUSED_TERMINAL_EVENT_TYPE,
+    response: {
+      ...response,
+      status: "incomplete",
+      output,
+      incomplete_details: {
+        reason: GROK_FORBIDDEN_TOOL_CALL_REASON,
+        ...(refusedName === undefined ? {} : { message: forbiddenToolCallMessage(refusedName) }),
+      },
+    },
+  });
+  const rewritten = replaceSseDataPayload(block, payload);
+  const newline = block.includes("\r\n") ? "\r\n" : "\n";
+  let eventRewritten = false;
+  const lines = rewritten.split(/\r?\n/).map(line => {
+    if (eventRewritten || !line.startsWith("event:")) return line;
+    eventRewritten = true;
+    return `event: ${GROK_REFUSED_TERMINAL_EVENT_TYPE}`;
+  });
+  return lines.join(newline);
+}
+
 /**
  * Narrow client repair for grok-build's Responses consumer.
  *
@@ -176,12 +234,26 @@ function plausibleGrokOpenItem(
  * empty output. Reconstruct only from real, unique, contiguous, bounded done
  * events whose raw semantics are already valid. Any ambiguity stays byte-level
  * fail-closed; the provider-opt-in snapshot repair above is unchanged.
+ *
+ * The terminal this publishes is one the upstream never sent, so it carries only what the final
+ * outbound request still authorized. A client call outside that request's tool selection is left
+ * out and the terminal says so explicitly. The declaration guard downstream answers the other
+ * half of the question — whether a name was declared at all — and keeps policing the raw stream,
+ * which this rewrite never edits.
  */
 export function createGrokResponsesSparseTerminalBlockRewrite(
   budget?: TranslatorBudget,
+  outboundRequestBody?: unknown,
+  toolIdentityCorrespondence?: RequestToolScopeCorrespondence,
 ): SseBlockRewrite {
+  const toolScope: RequestToolScope | undefined = requestToolScope(
+    outboundRequestBody,
+    toolIdentityCorrespondence,
+  );
   const openItems = new Map<number, SparseTerminalOpenItem>();
   const completedItems = new Map<number, SparseTerminalCompletedItem>();
+  const withheldIndices = new Set<number>();
+  let withheldToolName: string | undefined;
   let aggregateItemBytes = 0;
   let aggregateOpenItemBytes = 0;
   let tainted = false;
@@ -194,6 +266,8 @@ export function createGrokResponsesSparseTerminalBlockRewrite(
     }
     openItems.clear();
     completedItems.clear();
+    withheldIndices.clear();
+    withheldToolName = undefined;
     aggregateItemBytes = 0;
     aggregateOpenItemBytes = 0;
     hasVisibleOutput = false;
@@ -217,7 +291,7 @@ export function createGrokResponsesSparseTerminalBlockRewrite(
     if (tainted) return;
     const sourceBytes = Buffer.byteLength(JSON.stringify(item), "utf8");
     if (sourceBytes > MAX_COMPLETED_OUTPUT_ITEM_SOURCE_BYTES
-      || completedItems.size >= MAX_COMPLETED_OUTPUT_ITEMS
+      || completedItems.size + withheldIndices.size >= MAX_COMPLETED_OUTPUT_ITEMS
       || aggregateItemBytes + sourceBytes > MAX_COMPLETED_OUTPUT_ITEM_SOURCE_BYTES) {
       taintAndRelease();
       return;
@@ -228,6 +302,24 @@ export function createGrokResponsesSparseTerminalBlockRewrite(
     hasVisibleOutput = hasVisibleOutput || visibleToGrok;
   };
 
+  /**
+   * Record the position of a call this request forbade without retaining the item.
+   *
+   * Only the offending item is dropped. Tainting here instead would discard the assistant text
+   * that arrived in the same turn and leave the client the empty terminal this repair exists to
+   * fix, which punishes the caller for the provider's overreach. The index is kept so the
+   * contiguity proof below still covers the whole output.
+   */
+  const withholdForbiddenCall = (index: number, name: string): void => {
+    if (tainted) return;
+    if (completedItems.size + withheldIndices.size >= MAX_COMPLETED_OUTPUT_ITEMS) {
+      taintAndRelease();
+      return;
+    }
+    withheldIndices.add(index);
+    withheldToolName ??= name.slice(0, MAX_REPORTED_TOOL_NAME_CHARS);
+  };
+
   const closeOpenItem = (index: number): void => {
     const open = openItems.get(index);
     if (!open) return;
@@ -265,6 +357,7 @@ export function createGrokResponsesSparseTerminalBlockRewrite(
       const open = isPlainObject(parsed.item) ? plausibleGrokOpenItem(parsed.item) : null;
       if (outputIndex === undefined || !open
         || openItems.has(outputIndex) || completedItems.has(outputIndex)
+        || withheldIndices.has(outputIndex)
         || openItems.size >= MAX_COMPLETED_OUTPUT_ITEMS) {
         taintAndRelease();
       } else if (!tainted) {
@@ -284,7 +377,8 @@ export function createGrokResponsesSparseTerminalBlockRewrite(
     if (type === "response.output_item.done") {
       const item = isPlainObject(parsed.item) ? parsed.item : null;
       const proof = item ? trustedGrokCompletedItem(item) : null;
-      if (outputIndex === undefined || !proof || completedItems.has(outputIndex)) {
+      if (outputIndex === undefined || !proof
+        || completedItems.has(outputIndex) || withheldIndices.has(outputIndex)) {
         taintAndRelease();
         return [block];
       }
@@ -295,7 +389,12 @@ export function createGrokResponsesSparseTerminalBlockRewrite(
         return [block];
       }
       closeOpenItem(outputIndex);
-      retainCompletedItem(outputIndex, item!, proof.visibleToGrok);
+      const forbidden = toolScope?.forbiddenClientToolCallName(item!);
+      if (forbidden === undefined) {
+        retainCompletedItem(outputIndex, item!, proof.visibleToGrok);
+      } else {
+        withholdForbiddenCall(outputIndex, forbidden);
+      }
       return [block];
     }
 
@@ -312,14 +411,18 @@ export function createGrokResponsesSparseTerminalBlockRewrite(
       const outputIsAuthoritative = Array.isArray(output) && output.length > 0;
       const outputIsSparse = !("output" in response)
         || (Array.isArray(output) && output.length === 0);
+      // A withheld call is a reason to publish on its own: the refusal has to reach the client
+      // even when nothing visible survived it, or the turn ends as an ordinary empty finish.
+      const refused = withheldIndices.size > 0;
       if (!outputIsAuthoritative && outputIsSparse && terminalStatusConsistent
-        && completedItems.size > 0 && openItems.size === 0 && hasVisibleOutput) {
+        && openItems.size === 0 && (hasVisibleOutput || refused)) {
         const ordered = [...completedItems.entries()].sort(([left], [right]) => left - right);
-        if (ordered.every(([index], position) => index === position)) {
-          out = jsonBlock({
-            ...parsed,
-            response: { ...response, output: ordered.map(([, retained]) => retained.item) },
-          });
+        const positions = [...completedItems.keys(), ...withheldIndices].sort((left, right) => left - right);
+        if (positions.length > 0 && positions.every((index, position) => index === position)) {
+          const rebuilt = ordered.map(([, retained]) => retained.item);
+          out = refused
+            ? refusedTerminalBlock(block, parsed, response, rebuilt, withheldToolName)
+            : jsonBlock({ ...parsed, response: { ...response, output: rebuilt } });
         }
       }
     }
@@ -330,4 +433,3 @@ export function createGrokResponsesSparseTerminalBlockRewrite(
   rewrite.dispose = reset;
   return rewrite;
 }
-

package/src/server/gui-freshness.ts

@@ -0,0 +1,103 @@
+import { existsSync, readdirSync, statSync } from "node:fs";
+import { join } from "node:path";
+
+/**
+ * Whether the served dashboard bundle predates the sources it was built from.
+ *
+ * The dashboard is a build artifact: `AGENTS.md` records that `gui/` is served from `gui/dist`,
+ * so a checkout that moves forward without `bun run build:gui` keeps serving the previous bundle.
+ * Nothing fails when that happens. The proxy answers, the page loads, and every feature added since
+ * the last build is simply absent — which reads as the feature being broken rather than unbuilt.
+ * A five-day-old bundle hid the entire menu-bar and widget section of the Usage page this way.
+ *
+ * This reports; it never rebuilds. A proxy that compiled a frontend while starting would trade a
+ * silent staleness for a slow, surprising start, and the rebuild belongs to whoever moved the
+ * checkout.
+ */
+export interface GuiBundleFreshness {
+  /** Absolute path of the served bundle, or null when no bundle was found. */
+  bundlePath: string | null;
+  /** Newest mtime under the bundle, in epoch milliseconds. */
+  bundleModifiedMs: number | null;
+  /** Newest mtime under the GUI sources, in epoch milliseconds. */
+  sourceModifiedMs: number | null;
+  /** True only when both sides are known and the sources are strictly newer. */
+  stale: boolean;
+}
+
+/** Directory entries that never carry meaningful build input or output timestamps. */
+const IGNORED_DIRECTORIES = new Set(["node_modules", ".git", ".vite", ".cache"]);
+
+/**
+ * Newest mtime beneath `root`, or null when the tree is missing or empty.
+ *
+ * Walking is bounded by `maxEntries` because this runs on a status path: a pathological tree must
+ * cost a predictable amount rather than stalling the command that reports on it. Hitting the bound
+ * yields the newest value seen so far, which can only make the comparison more conservative.
+ */
+export function newestModifiedMs(root: string, maxEntries = 20_000): number | null {
+  if (!existsSync(root)) return null;
+  let newest: number | null = null;
+  let seen = 0;
+  const queue: string[] = [root];
+  while (queue.length > 0) {
+    const current = queue.pop()!;
+    let entries;
+    try {
+      entries = readdirSync(current, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (seen >= maxEntries) return newest;
+      if (entry.isSymbolicLink()) continue;
+      const full = join(current, entry.name);
+      if (entry.isDirectory()) {
+        if (IGNORED_DIRECTORIES.has(entry.name)) continue;
+        queue.push(full);
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      seen += 1;
+      try {
+        const mtime = statSync(full).mtimeMs;
+        if (newest === null || mtime > newest) newest = mtime;
+      } catch {
+        // A file that vanished mid-walk cannot make the bundle look fresher than it is.
+      }
+    }
+  }
+  return newest;
+}
+
+/**
+ * Compare the built bundle against its sources.
+ *
+ * Unknown is not stale. A packaged install has no `gui/src` beside it, and a missing bundle is a
+ * different condition with its own message elsewhere; neither should produce a rebuild warning.
+ */
+export function inspectGuiBundleFreshness(input: {
+  bundlePath: string | null;
+  sourcePath: string;
+}): GuiBundleFreshness {
+  const bundleModifiedMs = input.bundlePath === null ? null : newestModifiedMs(input.bundlePath);
+  const sourceModifiedMs = newestModifiedMs(input.sourcePath);
+  const stale = bundleModifiedMs !== null
+    && sourceModifiedMs !== null
+    && sourceModifiedMs > bundleModifiedMs;
+  return {
+    bundlePath: input.bundlePath,
+    bundleModifiedMs,
+    sourceModifiedMs,
+    stale,
+  };
+}
+
+/** Operator-facing lines for a stale bundle; empty when the bundle is current or unknown. */
+export function staleGuiBundleLines(freshness: GuiBundleFreshness): string[] {
+  if (!freshness.stale) return [];
+  return [
+    "Dashboard bundle is older than the GUI sources, so the page is missing everything built since.",
+    "Rebuild it with: bun run build:gui",
+  ];
+}

package/src/server/gui-static.ts

@@ -2,15 +2,11 @@ import { existsSync, readFileSync, statSync } from "node:fs";
 import { basename, extname, isAbsolute, join, relative, resolve } from "node:path";
 import { browserSecurityHeaders } from "./auth-cors";
 import type { GuiSessionBootstrap } from "./gui-session";
+import { packageVersion } from "../lib/package-version";
+import { isStandaloneBinary, standaloneRoot } from "../lib/standalone";
 
 /** opencodex version, read from the packaged package.json (same source as the server bootstrap). */
-const VERSION = (() => {
-  try {
-    return JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf8")).version as string;
-  } catch {
-    return "0.0.0";
-  }
-})();
+const VERSION = packageVersion("0.0.0");
 
 const MIME_TYPES: Record<string, string> = {
   ".html": "text/html", ".js": "application/javascript", ".css": "text/css",
@@ -24,11 +20,13 @@ const MIME_TYPES: Record<string, string> = {
  */
 const HASHED_ASSET_PATTERN = /-[a-zA-Z0-9_-]{8,}\.[a-zA-Z0-9]+$/;
 
-function findGuiDist(): string | null {
+export function findGuiDist(): string | null {
   const candidates = [
+    process.env.OPENCODEX_GUI_DIST,
+    ...(isStandaloneBinary() ? [join(standaloneRoot(), "gui", "dist")] : []),
     join(import.meta.dir, "..", "..", "gui", "dist"),
     join(import.meta.dir, "..", "..", "..", "gui", "dist"),
-  ];
+  ].filter((candidate): candidate is string => Boolean(candidate));
   for (const c of candidates) {
     if (existsSync(join(c, "index.html"))) return c;
   }

package/src/server/images.ts

@@ -33,6 +33,8 @@ import { selectProactiveApiKeyTransport } from "../providers/key-failover";
 import { getProviderRegistryEntry } from "../providers/registry";
 import { readJsonRequestBody, resolveInboundBodyLimitBytes } from "./request-decompress";
 import { ForwardAdmissionCredentialError, validateForwardAdmissionCredential } from "./auth-cors";
+import type { DataPlaneAdmission } from "./auth-cors";
+import { admissionScopeDenial } from "./admission-model-scope";
 import type { RequestLogContext } from "./request-log";
 import { codexLogAccountId, decodeRequestErrorResponse } from "./responses";
 import { getValidAccessToken, getOAuthCredentialProjectId } from "../oauth/index";
@@ -115,6 +117,18 @@ export async function readImageResponseBytes(
 }
 
 const CCA_IMAGE_MODEL = "gemini-3.1-flash-image";
+const XAI_IMAGE_BRIDGE_MODEL = "grok-imagine-image-quality";
+
+/**
+ * The model this request names, or undefined when it names none.
+ *
+ * An absent `model` is relayed as an absent `model`: the upstream picks, so
+ * there is no destination to echo and none a model list can allow.
+ */
+function requestedImageSelector(body: unknown): string | undefined {
+  const model = (body as { model?: unknown } | null)?.model;
+  return typeof model === "string" && model.trim() ? model : undefined;
+}
 
 /**
  * Google Gemini finishReasons that indicate a permanent content/safety block.
@@ -207,11 +221,21 @@ async function tryCcaImageGeneration(
   logCtx: RequestLogContext,
   signal: AbortSignal,
   endpoint: ImagesEndpoint,
+  admission: DataPlaneAdmission | undefined,
 ): Promise<Response | undefined> {
   if (endpoint !== "generations") return undefined;
   const provider = config.providers?.["google-antigravity"];
   if (!provider || provider.disabled) return undefined;
 
+  // The destination is decided here, not by the caller: this branch always
+  // bills Antigravity for CCA_IMAGE_MODEL whatever the body named. That is the
+  // pair a scoped key is held to.
+  const denial = admissionScopeDenial(config, admission, requestedImageSelector(body), {
+    providerName: "google-antigravity",
+    modelId: CCA_IMAGE_MODEL,
+  });
+  if (denial) return denial;
+
   const prompt = (body as { prompt?: unknown })?.prompt;
   if (typeof prompt !== "string" || !prompt.trim()) {
     return formatErrorResponse(400, "invalid_request_error", "prompt is required and must not be empty");
@@ -446,10 +470,20 @@ async function tryXaiImageRelay(
   logCtx: RequestLogContext,
   signal: AbortSignal | undefined,
   endpoint: ImagesEndpoint,
+  admission: DataPlaneAdmission | undefined,
 ): Promise<Response | undefined> {
   if (config.images?.bridgeEnabled !== true) return undefined;
   const found = findXaiProvider(config);
   if (!found) return undefined;
+  const bridgeModel = config.images?.bridgeModel ?? XAI_IMAGE_BRIDGE_MODEL;
+  // The bridge sends this request to the configured xAI provider and the bridge
+  // model regardless of the selector in the body, so that is what the key is
+  // checked against.
+  const denial = admissionScopeDenial(config, admission, requestedImageSelector(body), {
+    providerName: found.name,
+    modelId: bridgeModel,
+  });
+  if (denial) return denial;
   const obj = body && typeof body === "object" && !Array.isArray(body)
     ? body as Record<string, unknown>
     : {};
@@ -496,11 +530,11 @@ async function tryXaiImageRelay(
     }
     if (!token) return xaiImageAuthMissing();
     logCtx.provider = "xai";
-    logCtx.model = config.images?.bridgeModel ?? "grok-imagine-image-quality";
+    logCtx.model = bridgeModel;
     const result = await callXaiImages(
       {
         prompt,
-        model: logCtx.model,
+        model: bridgeModel,
         n,
         size,
         quality,
@@ -602,6 +636,7 @@ export async function handleImages(
   endpoint: ImagesEndpoint,
   logCtx: RequestLogContext,
   turnAdmissionLease?: AdmissionLease,
+  admission?: DataPlaneAdmission,
 ): Promise<Response> {
   let body: unknown;
   try {
@@ -616,7 +651,7 @@ export async function handleImages(
   // Explicit images.provider owns the route, including its validation errors.
   // Do not divert that selection to the xAI Imagine relay.
   if (config.images?.provider === undefined) {
-    const xaiRelay = await tryXaiImageRelay(body, config, logCtx, req.signal, endpoint);
+    const xaiRelay = await tryXaiImageRelay(body, config, logCtx, req.signal, endpoint, admission);
     if (xaiRelay) return xaiRelay;
   }
   if (candidates.error) {
@@ -641,7 +676,7 @@ export async function handleImages(
   const canUseOpenAiForward = !skipOpenAiForwardForAdmissionBearer && candidates.forwardCandidates.length > 0;
 
   if (!canUseOpenAiForward && !candidates.keyed) {
-    const ccaResponse = await tryCcaImageGeneration(body, config, logCtx, req.signal, endpoint);
+    const ccaResponse = await tryCcaImageGeneration(body, config, logCtx, req.signal, endpoint, admission);
     if (ccaResponse) return ccaResponse;
     // 400, not 5xx: codex retries every 5xx up to 5 total attempts, and this is a permanent
     // configuration state that must surface on the first attempt.
@@ -688,7 +723,20 @@ export async function handleImages(
 
   const headers: Record<string, string> = { "content-type": "application/json" };
   let url: string;
+  // Both relay branches copy the body upstream, so the destination is the
+  // provider chosen in that branch and the model the caller named. Each branch
+  // is checked as it is entered, before it resolves a credential or commits a
+  // key rotation, so a refused request spends nothing.
+  const relaySelector = requestedImageSelector(body);
   if (forward) {
+    const denial = admissionScopeDenial(config, admission, relaySelector, {
+      providerName: forward.providerName,
+      modelId: relaySelector,
+    });
+    if (denial) {
+      forward.releaseProbeLease?.();
+      return denial;
+    }
     const { provider } = forward;
     if (provider.headers) Object.assign(headers, provider.headers);
     for (const [name, value] of forward.headers) headers[name] = value;
@@ -697,13 +745,18 @@ export async function handleImages(
   } else if (forwardAuthError) {
     // Before surfacing the OpenAI auth failure, try CCA — the user may have a
     // valid Google Antigravity login even though their OpenAI pool is broken.
-    const ccaResponse = await tryCcaImageGeneration(body, config, logCtx, req.signal, endpoint);
+    const ccaResponse = await tryCcaImageGeneration(body, config, logCtx, req.signal, endpoint, admission);
     if (ccaResponse) return ccaResponse;
     // No CCA either: a configured OpenAI pool mode owns its authentication failure.
     // Do not hide a broken/expired pool behind separately billed API-key image generation.
     return forwardAuthError;
   } else if (candidates.keyed) {
     const { providerName } = candidates.keyed;
+    const denial = admissionScopeDenial(config, admission, relaySelector, {
+      providerName,
+      modelId: relaySelector,
+    });
+    if (denial) return denial;
     // The keyed image path builds its own URL and Authorization header and never enters
     // handleResponses, so the pre-dispatch key pick happens here.
     //
@@ -737,7 +790,7 @@ export async function handleImages(
     url = `${provider.baseUrl.replace(/\/v1\/?$/, "")}/v1/images/${endpoint}`;
   } else {
     // No usable OpenAI credential — try CCA before giving up.
-    const ccaResponse = await tryCcaImageGeneration(body, config, logCtx, req.signal, endpoint);
+    const ccaResponse = await tryCcaImageGeneration(body, config, logCtx, req.signal, endpoint, admission);
     if (ccaResponse) return ccaResponse;
     return formatErrorResponse(
       401,