@bitkyc08/opencodex 2.64.0-preview.20260923 → 2.65.0-preview.20260925

package/src/server/management/combo-routes.ts

@@ -52,7 +52,7 @@ import {
   setDebugSettings,
   type DebugFlag,
 } from "../../lib/debug-settings";
-import type { OcxClaudeCodeConfig, OcxComboConfig, OcxConfig, OcxCustomModel, OcxProviderConfig } from "../../types";
+import type { OcxClaudeCodeConfig, OcxComboConfig, OcxConfig, OcxCustomModel, OcxProviderConfig, OcxComboCooldownWaitPolicy } from "../../types";
 import { drainAndShutdown } from "../lifecycle";
 import { reconcileLiveStateStores } from "../../lib/state-store-registrations";
 import { filterRequestLogs, getRequestLogEntries, type RequestLogEntry } from "../request-log";
@@ -78,12 +78,14 @@ import { COMBO_DEFAULT_WAIT_FOR_COOLDOWN_MS } from "../../combos";
 function sparseComboConfig<T extends {
   cooldownMs?: number;
   waitForCooldownMs?: number;
+  cooldownWaitPolicy?: OcxComboCooldownWaitPolicy | null;
   imageInput?: "auto" | "disabled";
   reasoningEffortMode?: "strict" | "adaptive";
   defaultEffortMode?: "fallback" | "force";
-}>(combo: T): Omit<T, "cooldownMs" | "waitForCooldownMs" | "imageInput" | "reasoningEffortMode" | "defaultEffortMode"> & {
+}>(combo: T): Omit<T, "cooldownMs" | "waitForCooldownMs" | "cooldownWaitPolicy" | "imageInput" | "reasoningEffortMode" | "defaultEffortMode"> & {
   cooldownMs?: number;
   waitForCooldownMs?: number;
+  cooldownWaitPolicy?: OcxComboCooldownWaitPolicy;
   imageInput?: "disabled";
   reasoningEffortMode?: "adaptive";
   defaultEffortMode?: "force";
@@ -91,6 +93,7 @@ function sparseComboConfig<T extends {
   const {
     cooldownMs,
     waitForCooldownMs,
+    cooldownWaitPolicy,
     imageInput,
     reasoningEffortMode,
     defaultEffortMode,
@@ -99,6 +102,9 @@ function sparseComboConfig<T extends {
   return {
     ...rest,
     ...(cooldownMs !== undefined ? { cooldownMs } : {}),
+    // #5691: the normalizer yields null for "unset"; persisting that would put a
+    // meaningless key in every stored combo. Only the opt-in value is written.
+    ...(cooldownWaitPolicy ? { cooldownWaitPolicy } : {}),
     ...(waitForCooldownMs !== undefined && waitForCooldownMs !== COMBO_DEFAULT_WAIT_FOR_COOLDOWN_MS
       ? { waitForCooldownMs }
       : {}),
@@ -174,6 +180,42 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
       ...(!Object.hasOwn(requestedCombo, "waitForCooldownMs") && previous?.waitForCooldownMs !== undefined
         ? { waitForCooldownMs: previous.waitForCooldownMs }
         : {}),
+      // Same reason as defaultEffortMode below: the dashboard does not expose the
+      // last-resort policy, so a GUI round-trip that omits it must not delete it (#5736).
+      ...(!Object.hasOwn(requestedCombo, "cooldownWaitPolicy") && previous?.cooldownWaitPolicy !== undefined
+        ? { cooldownWaitPolicy: previous.cooldownWaitPolicy }
+        : {}),
+      // #5687: an API or CLI client that omits these must not reset them. The dashboard
+      // sends both explicitly, so switching back to auto/strict there still replaces them.
+      ...(!Object.hasOwn(requestedCombo, "reasoningEffortMode") && previous?.reasoningEffortMode !== undefined
+        ? { reasoningEffortMode: previous.reasoningEffortMode }
+        : {}),
+      ...(!Object.hasOwn(requestedCombo, "imageInput") && previous?.imageInput !== undefined
+        ? { imageInput: previous.imageInput }
+        : {}),
+      // `lastResort` rides on each target, so a GUI that re-sends the target list without the
+      // flag would strip it. Carry it over per target, matched on provider+model.
+      ...(Array.isArray(requestedCombo.targets) && Array.isArray(previous?.targets)
+        ? {
+            targets: requestedCombo.targets.map(target => {
+              // A non-record entry stays as the client sent it so comboConfigError reports it.
+              // Reading `lastResort` off it here would throw in place of that structured 400.
+              if (!isPlainRecord(target)) return target;
+              if (Object.hasOwn(target, "lastResort")) return target;
+              const rawProvider = target.provider;
+              const rawModel = target.model;
+              if (typeof rawProvider !== "string" || typeof rawModel !== "string") return target;
+              // Identity is trimmed on both sides: the normalizer trims too, so a re-sent
+              // " b " must still match the stored "b" instead of losing the flag.
+              const provider = rawProvider.trim();
+              const model = rawModel.trim();
+              const before = previous.targets.find(
+                candidate => candidate.provider === provider && candidate.model === model,
+              );
+              return before?.lastResort ? { ...target, lastResort: true } : target;
+            }),
+          }
+        : {}),
       // The dashboard does not expose this advanced CLI/API policy. Preserve it when
       // a GUI round-trip omits the field instead of silently downgrading to fallback.
       ...(!Object.hasOwn(requestedCombo, "defaultEffortMode") && previous?.defaultEffortMode !== undefined
@@ -198,6 +240,13 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
     } = sparseComboConfig(normalized);
     const stored: OcxComboConfig = {
       ...normalizedBase,
+      // The normalizer gives every target an explicit `lastResort: false`; persisting that
+      // would add a noise key to every target of every combo, including ones that never use
+      // the policy (#5736). Only the opt-in value is stored, matching how the combo-level
+      // policy is handled in sparseComboConfig.
+      targets: normalizedBase.targets.map(({ lastResort, ...target }) =>
+        lastResort ? { ...target, lastResort: true } : target,
+      ),
       ...(normalizedAlias ? { alias: normalizedAlias } : {}),
       ...(normalizedNativeAlias ? { nativeAlias: true } : {}),
       ...(normalizedDisplayName ? { displayName: normalizedDisplayName } : {}),
@@ -275,6 +324,14 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
             Object.entries(claudeCode.modelMap).map(([source, model]) => [source, migrateAgentReference(model)]),
           );
         }
+        if (claudeCode.intercept?.modelMap) {
+          claudeCode.intercept = {
+            ...claudeCode.intercept,
+            modelMap: Object.fromEntries(
+              Object.entries(claudeCode.intercept.modelMap).map(([pickerId, route]) => [pickerId, migrateAgentReference(route)]),
+            ),
+          };
+        }
         config.claudeCode = claudeCode;
       }
     }

package/src/server/management/config-routes.ts

@@ -6,7 +6,7 @@ import { readFileSync } from "node:fs";
 import type { CatalogModel } from "../../codex/catalog";
 import { catalogModelSlug, invalidateCodexModelsCache, nativeContextLimits, nativeModelRows, uniqueCatalogModelsForPublicList } from "../../codex/catalog";
 import {
-  applyCodexDesktopSwitches,
+  applyCodexConfigInjection,
   describeCodexDesktopSwitches,
   type CodexDesktopSwitchApply,
 } from "../../codex/desktop-switches";
@@ -59,7 +59,10 @@ import {
   codexQuotaAutoRefreshStatus,
   runCodexQuotaAutoRefresh,
 } from "../../codex/quota-auto-refresh";
-import { getMainAccountHardLockStatus } from "../../codex/main-account-hard-lock";
+import {
+  getMainAccountHardLockStatus,
+  isMainAccountHardLockEnabled,
+} from "../../codex/main-account-hard-lock";
 import {
   codexAccountPickerEnabled,
   initializeDefaultCodexAccountNamespaces,
@@ -208,40 +211,48 @@ export async function syncEnabledClientIntegrations(
     }
   }
 
-  if (claudeDesktopIntegrationEnabled(config)) {
+  const { observeClaudeDesktopMode, resolveClaudeDesktopMode } = await import("../../claude/desktop-first-party");
+  // A first-party Desktop must never get a gateway profile written and selected by a sync.
+  if (claudeDesktopIntegrationEnabled(config) && resolveClaudeDesktopMode(config, observeClaudeDesktopMode(config)) !== "first-party") {
     try {
       const { writeDesktop3pConfig } = await import("../../claude/desktop-3p");
       const { desktopVisibleNativeSlugs, filterCatalogVisibleModels } = await import("../../codex/catalog");
       const { fetchAllModels } = await import("../management-api");
       const models = await (deps.fetchAllModels ?? fetchAllModels)(config);
-      // Discovery admits a concurrent OFF or settings edit. Re-read outside C:
-      // the writer facade owns L and its final desired-state check under L→C.
-      const latest = loadConfig();
-      if (claudeDesktopIntegrationEnabled(latest)) {
-        const routed = filterCatalogVisibleModels(models, latest)
-          .map(model => ({ provider: model.provider, id: model.id, contextWindow: model.contextWindow }));
-        const writtenProfile = latest.claudeCode?.desktopProfile;
-        const markerBaseline = captureDesktopAppliedMarker(writtenProfile);
-        const r = (deps.writeDesktop3pConfig ?? writeDesktop3pConfig)(
-          port,
-          [...desktopVisibleNativeSlugs(latest)],
-          routed,
-          latest.apiKeys?.[0]?.key,
-          "static",
-          writtenProfile,
-          nativeContextLimits(latest),
-        );
-        if (!r.written || !r.fingerprint) {
-          out.push({ client: "claude-desktop", ok: false, reason: r.reason ?? "Claude Desktop write failed" });
-        } else {
-          const marked = commitDesktopAppliedMarker(markerBaseline, r.fingerprint);
-          out.push(marked.status === "unavailable"
-            ? { client: "claude-desktop", ok: false, reason: "Claude Desktop applied marker was not saved (" + marked.reason + ")" }
-            : marked.value === false
-            ? { client: "claude-desktop", ok: false, reason: "Claude Desktop desired profile changed during sync; applied marker skipped" }
-            : { client: "claude-desktop", ok: true, changed: true });
+      // Serialized with Desktop mode transitions (picker lock): a first-party switch cannot interleave.
+      const { runPickerTransition } = await import("./claude-desktop-picker-routes");
+      await runPickerTransition(config, async () => {
+        // Discovery admits a concurrent OFF or settings edit. Re-read outside C:
+        // the writer facade owns L and its final desired-state check under L→C.
+        const latest = loadConfig();
+        // Discovery awaited: the mode may have changed meanwhile. Re-resolve on the fresh read,
+        // immediately before the writer, so a first-party switch during fetchAllModels still wins.
+        if (claudeDesktopIntegrationEnabled(latest) && resolveClaudeDesktopMode(latest, observeClaudeDesktopMode(latest)) !== "first-party") {
+          const routed = filterCatalogVisibleModels(models, latest)
+            .map(model => ({ provider: model.provider, id: model.id, contextWindow: model.contextWindow }));
+          const writtenProfile = latest.claudeCode?.desktopProfile;
+          const markerBaseline = captureDesktopAppliedMarker(writtenProfile);
+          const r = (deps.writeDesktop3pConfig ?? writeDesktop3pConfig)(
+            port,
+            [...desktopVisibleNativeSlugs(latest)],
+            routed,
+            latest.apiKeys?.[0]?.key,
+            "static",
+            writtenProfile,
+            nativeContextLimits(latest),
+          );
+          if (!r.written || !r.fingerprint) {
+            out.push({ client: "claude-desktop", ok: false, reason: r.reason ?? "Claude Desktop write failed" });
+          } else {
+            const marked = commitDesktopAppliedMarker(markerBaseline, r.fingerprint);
+            out.push(marked.status === "unavailable"
+              ? { client: "claude-desktop", ok: false, reason: "Claude Desktop applied marker was not saved (" + marked.reason + ")" }
+              : marked.value === false
+              ? { client: "claude-desktop", ok: false, reason: "Claude Desktop desired profile changed during sync; applied marker skipped" }
+              : { client: "claude-desktop", ok: true, changed: true });
+          }
         }
-      }
+      });
     } catch (error) {
       out.push({ client: "claude-desktop", ok: false, reason: error instanceof Error ? error.message : String(error) });
     }
@@ -340,7 +351,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       ultraFastTier: config.ultraFastTier === true,
       // Absent means on by default: the GUI renders a switch enabled unless explicit false.
       fastRows: config.fastRows !== false,
-      codexMainAccountHardLock: config.codexMainAccountHardLock === true,
+      codexMainAccountHardLock: isMainAccountHardLockEnabled(config),
       mainAccountHardLock: getMainAccountHardLockStatus(config),
       // Absent means the historical auto-open, so the GUI can render the toggle
       // without having to know that `undefined` and `true` mean the same thing.
@@ -586,8 +597,10 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       else if (body.ultraFastTier === false) deleteConfigTopLevelKey(config, "ultraFastTier");
       if (body.fastRows === false) config.fastRows = false;
       else if (body.fastRows === true) deleteConfigTopLevelKey(config, "fastRows");
-      if (body.codexMainAccountHardLock === true) config.codexMainAccountHardLock = true;
-      else if (body.codexMainAccountHardLock === false) deleteConfigTopLevelKey(config, "codexMainAccountHardLock");
+      // Inverted from the pair above because the default is on (#5694): off is the persisted
+      // decision, so it writes `false`, while on deletes the key and returns to the default.
+      if (body.codexMainAccountHardLock === false) config.codexMainAccountHardLock = false;
+      else if (body.codexMainAccountHardLock === true) deleteConfigTopLevelKey(config, "codexMainAccountHardLock");
       if (body.codexDesktopAuthless === true) config.codexDesktopAuthless = true;
       else if (body.codexDesktopAuthless === false) deleteConfigTopLevelKey(config, "codexDesktopAuthless");
       if (body.codexClientCompaction === true) config.codexClientCompaction = true;
@@ -673,7 +686,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
     // because coordinated Codex writes acquire the Codex write lock N before the config mutation
     // lock C — awaiting N while still holding C would invert that order.
     const desktopSwitchApply: CodexDesktopSwitchApply = desktopSwitchesChanged
-      ? await applyCodexDesktopSwitches(config)
+      ? await applyCodexConfigInjection(config)
       : { applied: false, reason: "not_requested", retryable: false };
     const codexDesktopSwitches = describeCodexDesktopSwitches(config, desktopSwitchApply);
     const catalogRefreshPending = catalogRefresh
@@ -695,7 +708,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       codexClientCompaction: clientCompactionIsEnabled,
       codexDesktopSwitches,
       compactionRouting: config.compactionRouting ?? null,
-      codexMainAccountHardLock: config.codexMainAccountHardLock === true,
+      codexMainAccountHardLock: isMainAccountHardLockEnabled(config),
       mainAccountHardLock: getMainAccountHardLockStatus(config),
       startupHealth: await readStartupHealth(config),
     });
@@ -735,12 +748,13 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
   }
 
   if (url.pathname === "/api/update/check" && req.method === "GET") {
-    const { checkForUpdate, normalizeUpdateChannel } = await import("../../update/job");
+    const { normalizeUpdateChannel } = await import("../../update/job");
+    const { packageRefresh } = await import("../../update/refresh-scheduler");
     const rawTag = url.searchParams.get("tag");
     if (rawTag && rawTag !== "latest" && rawTag !== "preview") {
       return jsonResponse({ error: "tag must be latest or preview" }, 400);
     }
-    return jsonResponse(checkForUpdate(normalizeUpdateChannel(rawTag)));
+    return jsonResponse(await (deps.checkPackageUpdate ?? packageRefresh.check)(normalizeUpdateChannel(rawTag)));
   }
 
   if (url.pathname === "/api/update/run" && req.method === "POST") {
@@ -754,7 +768,12 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       return jsonResponse({ error: "restart boolean is required" }, 400);
     }
     try {
-      return jsonResponse({ ok: true, job: startUpdateJob(normalizeUpdateChannel(body.tag as string | undefined), body.restart !== false) });
+      const channel = normalizeUpdateChannel(body.tag as string | undefined);
+      const { packageRefresh } = await import("../../update/refresh-scheduler");
+      const checked = await (deps.checkPackageUpdate ?? packageRefresh.check)(channel);
+      return jsonResponse({ ok: true, job: startUpdateJob(channel, body.restart !== false, {
+        checkForUpdateFn: () => checked,
+      }) });
     } catch (err) {
       if (err instanceof UpdateJobError) {
         return jsonResponse({ error: err.message, code: err.code }, err.status);
@@ -799,7 +818,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
     if (raw.webSearch !== undefined && !isPlainRecord(raw.webSearch)) return jsonResponse({ error: "webSearch must be an object" }, 400);
     if (raw.vision !== undefined && !isPlainRecord(raw.vision)) return jsonResponse({ error: "vision must be an object" }, 400);
     const body = raw as {
-      webSearch?: { model?: unknown; backend?: unknown; reasoning?: unknown; streamRoutedModelOutput?: unknown; exaApiKey?: unknown; xSearch?: unknown };
+      webSearch?: { enabled?: unknown; model?: unknown; backend?: unknown; reasoning?: unknown; streamRoutedModelOutput?: unknown; exaApiKey?: unknown; xSearch?: unknown };
       vision?: {
         model?: unknown;
         backend?: unknown;
@@ -821,6 +840,9 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       && typeof body.webSearch.streamRoutedModelOutput !== "boolean") {
       return jsonResponse({ error: "webSearch.streamRoutedModelOutput must be a boolean" }, 400);
     }
+    if (body.webSearch && body.webSearch.enabled !== undefined && typeof body.webSearch.enabled !== "boolean") {
+      return jsonResponse({ error: "webSearch.enabled must be a boolean" }, 400);
+    }
     if (body.vision && body.vision.backend !== undefined
       && body.vision.backend !== null && body.vision.backend !== "openai" && body.vision.backend !== "anthropic"
       && body.vision.backend !== "routed") {
@@ -884,6 +906,9 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
         : normalizeVisionReasoningForModel(model, sourceReasoning);
     }
 
+    // Read BEFORE the mutation below: the Codex-side key follows the switch, and a flip is the
+    // only case that owes a config.toml rewrite.
+    const webSearchEnabledBefore = config.webSearchSidecar?.enabled !== false;
     if (body.webSearch) {
       const pairTouched = body.webSearch.model !== undefined || body.webSearch.backend !== undefined;
       // Validate against the backend the caller SUBMITTED, across the whole
@@ -979,6 +1004,12 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
         if (body.webSearch.streamRoutedModelOutput) webSearchCandidate.streamRoutedModelOutput = true;
         else delete webSearchCandidate.streamRoutedModelOutput;
       }
+      if (typeof body.webSearch.enabled === "boolean") {
+        // `true` is the default — drop the key so a disable/re-enable cycle does not rewrite the
+        // file, exactly like the Vision master switch.
+        if (body.webSearch.enabled) delete webSearchCandidate.enabled;
+        else webSearchCandidate.enabled = false;
+      }
       config.webSearchSidecar = webSearchCandidate;
     }
     if (body.vision) {
@@ -1009,6 +1040,16 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       }
     }
     saveConfigPreservingClaudeCode(config);
+    // The sidecar's own switch is only half of what "off" means: Codex keeps declaring its native
+    // hosted `web_search` tool until its own mode says otherwise, and the tool a client advertises
+    // is the one the model reaches for — which is why an MCP search server needs the client-side
+    // key off too. The injection owns that root key, and a write that cannot happen is reported
+    // (the Desktop switches' contract) instead of being stored as if it had.
+    const webSearchEnabledChanged = typeof body.webSearch?.enabled === "boolean"
+      && webSearchEnabledBefore !== (config.webSearchSidecar?.enabled !== false);
+    const codexWebSearch: CodexDesktopSwitchApply = webSearchEnabledChanged
+      ? await applyCodexConfigInjection(config)
+      : { applied: false, reason: "not_requested", retryable: false };
     const ws = config.webSearchSidecar ?? {};
     const vision = await sidecarVisionResponseSettings(config);
     const savedWebSearchCandidates = await webSearchCandidateRows(config);
@@ -1021,6 +1062,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
         streamRoutedModelOutput: ws.streamRoutedModelOutput === true,
         ...(ws.xSearch ? { xSearch: ws.xSearch } : {}),
       },
+      codexWebSearch,
       vision: publicVisionSidecarSettings(config, vision),
       visionModels: vision.models,
       // Echoed for the same reason GET always carries it: the dashboard rebuilds

package/src/server/management/context.ts

@@ -1,4 +1,6 @@
 import type { OcxConfig } from "../../types";
+import type { Channel } from "../../update/index";
+import type { UpdateCheckResult } from "../../update/job";
 import type { NativeProfileApiDeps } from "../../codex/native-profile-api";
 import type { CodexLogGuardProtectionDeps } from "../../codex/log-guard/protection";
 import type { CodexLogGuardMaintenanceDeps } from "../../codex/log-guard/maintenance";
@@ -34,6 +36,7 @@ export type RemoteWorkspaceSessionsApi = Pick<RemoteWorkspaceSessionService,
 export interface ManagementApiDeps {
   /** Read-only process-local aggregate metrics; absent keeps the scrape route unavailable. */
   requestMetrics?: RequestMetricsSnapshotter;
+  checkPackageUpdate?: (channel: Channel) => Promise<UpdateCheckResult>;
   remoteWorkspaceHub?: RemoteWorkspaceHubApi;
   remoteWorkspaceSessions?: RemoteWorkspaceSessionsApi;
   /** The listener retains and awaits teardown only after this optional subsystem activates. */