@bitkyc08/opencodex 2.64.0 → 2.65.0

package/src/server/management/native-integration-routes.ts

@@ -19,7 +19,8 @@ import { persistCommittedDesktopGateway } from "../../claude/desktop-gateway-sta
  * 011 (Claude Code), 012 (Grok).
  */
 import { join } from "node:path";
-import { loadConfig, mutatePersistedConfig, saveConfigPreservingClaudeCode } from "../../config";
+import { existsSync } from "node:fs";
+import { getConfigPath, loadConfig, mutatePersistedConfig, saveConfigPreservingClaudeCode } from "../../config";
 import { readRuntimePort } from "../../config/process-state";
 import { desktopVisibleNativeSlugs, filterCatalogVisibleModels, nativeContextLimits } from "../../codex/catalog";
 import { getCodexHome } from "../../codex/paths";
@@ -30,11 +31,15 @@ import {
   applyDesktopFirstParty,
   captureDesktopFirstPartyRollback,
   inspectDesktopFirstParty,
+  observeClaudeDesktopMode,
   recordClaudeDesktopMode,
   removeDesktopFirstParty,
   resolveClaudeDesktopApplyMode,
   type ClaudeDesktopMode,
 } from "../../claude/desktop-first-party";
+import { FIRST_PARTY_ACCOUNT_RISK } from "../../claude/desktop-risk";
+import type { DesktopPickerStatus } from "../../claude/desktop-picker";
+import { pickerPreferenceOn, runPickerTransition } from "./claude-desktop-picker-routes";
 import { projectGrokCatalog } from "../../grok/catalog";
 import { injectGrokConfig, stripGrokConfig } from "../../grok/inject";
 import { inspectGrokConfig } from "../../grok/inspect";
@@ -149,7 +154,7 @@ function desktopStatus(config: ManagementContext["config"]): NativeStatus {
     : null;
   // First-party mode lives in Claude Code's settings.json, not in Desktop's library. A leftover
   // gateway profile still counts as current (it is what Desktop is actually running).
-  const firstParty = resolveClaudeDesktopApplyMode(config) === "first-party" && gatewayState === "absent"
+  const firstParty = resolveClaudeDesktopApplyMode(config, observeClaudeDesktopMode(config)) === "first-party" && gatewayState === "absent"
     ? inspectDesktopFirstParty(config)
     : null;
   const state: NativeStatus["state"] = firstParty
@@ -183,11 +188,26 @@ function claudeStatus(config: ManagementContext["config"], configPath: string):
   };
 }
 
+/**
+ * The state the latest Codex toggle in this process reported, keyed by the intent it
+ * applied. Intent alone cannot describe an apply or restore that did not complete: the
+ * PUT reports `absent` for a skipped or failed enable and `unsafe` for an incomplete
+ * restore, and the next GET must not turn those into `current` or `absent`. It applies
+ * only while the persisted intent still matches; a restart re-runs startup convergence.
+ */
+let codexLastToggle: { desiredEnabled: boolean; state: NativeStatus["state"] } | null = null;
+
+function rememberCodexToggle(desiredEnabled: boolean, state: NativeStatus["state"]): NativeStatus["state"] {
+  codexLastToggle = { desiredEnabled, state };
+  return state;
+}
+
 function codexStatus(config: ManagementContext["config"], configPath: string): NativeStatus {
   const desiredEnabled = config.clientIntegrations?.codex !== false;
+  const reported = codexLastToggle?.desiredEnabled === desiredEnabled ? codexLastToggle.state : null;
   return {
     clientId: "codex",
-    state: desiredEnabled ? "current" : "absent",
+    state: reported ?? (desiredEnabled ? "current" : "absent"),
     installed: true,
     configPath,
     desiredEnabled,
@@ -356,7 +376,7 @@ async function handleCodexToggle(ctx: ManagementContext): Promise<Response> {
       if (applied.status === "skipped") {
         return jsonResponse({
           ok: true, clientId: "codex", changed: durable && persisted.status === "committed",
-          state: "absent",
+          state: rememberCodexToggle(true, "absent"),
           desiredEnabled: enabled,
           message: "Codex integration is OFF; enable did not change Codex.",
           reason: "apply_incomplete",
@@ -364,7 +384,7 @@ async function handleCodexToggle(ctx: ManagementContext): Promise<Response> {
       }
       return jsonResponse({
         ok: true, clientId: "codex", changed: durable && persisted.status === "committed",
-        state: applied.ok ? "current" : "absent",
+        state: rememberCodexToggle(true, applied.ok ? "current" : "absent"),
         desiredEnabled: enabled,
         message: applied.ok
           ? "Codex now routes through opencodex"
@@ -379,6 +399,7 @@ async function handleCodexToggle(ctx: ManagementContext): Promise<Response> {
     if (durable && persisted.status === "unchanged") {
       const { classifyNativeRoutedResidue } = await import("../../codex/native-residue");
       if (classifyNativeRoutedResidue().kind === "clean") {
+        rememberCodexToggle(false, "absent");
         return jsonResponse({
           ok: true, clientId: "codex", changed: false, state: "absent", desiredEnabled: false,
           message: "Codex integration is already OFF and native; no Codex files changed.",
@@ -390,7 +411,7 @@ async function handleCodexToggle(ctx: ManagementContext): Promise<Response> {
     const restored = await restoreNativeCodexAsync({ revalidateDesiredState: true });
     return jsonResponse({
       ok: true, clientId: "codex", changed: durable && persisted.status === "committed",
-      state: restored.success ? "absent" : "unsafe",
+      state: rememberCodexToggle(false, restored.success ? "absent" : "unsafe"),
       desiredEnabled: enabled,
       message: restored.success
         ? `Codex restored to its native path; the proxy is still serving other clients. ${OCX_NATIVE_REPLAY_RECOVERY_NOTE}`
@@ -635,6 +656,24 @@ export function firstPartyRefusalMessage(
   }
 }
 
+/** One line for a toggle message about picker mode after a first-party enable. */
+function pickerStateNote(picker: DesktopPickerStatus): string {
+  if (picker.reason === "active" || picker.reason === "restart_required") {
+    return "Picker mode is on: fully quit and reopen Claude Desktop to see OpenCodex models in the Code tab.";
+  }
+  if (picker.reason === "trust_pending" || picker.reason === "trust_declined") {
+    return `Picker mode is waiting for the keychain step: run ${picker.hint ?? "ocx claude desktop picker trust"}.`;
+  }
+  return `Picker mode is off (${picker.reason}).`;
+}
+
+/** Empty unless turning picker mode off left something behind. */
+function pickerCleanupNote(picker: DesktopPickerStatus): string {
+  return picker.residual?.length
+    ? `Picker mode cleanup is incomplete (${picker.residual.join(", ")}); run ocx claude desktop picker off.`
+    : "";
+}
+
 /** Record which Desktop mode is applied; `false` when the config file could not be updated. */
 function persistDesktopModeMarker(desktopMode: ClaudeDesktopMode): boolean {
   const outcome = mutatePersistedConfig(persisted => recordClaudeDesktopMode(persisted, desktopMode));
@@ -668,104 +707,125 @@ async function handleClaudeDesktopToggle(ctx: ManagementContext): Promise<Respon
     const fingerprint = current.claudeCode?.desktopProfile?.appliedFingerprint ?? null;
 
     if (!body.enabled) {
-      const firstPartyRemoved = removeDesktopFirstParty();
-      if (!firstPartyRemoved.ok) {
-        return postCommitRefusal(409, "claude-desktop", "write_failed",
-          `Claude Code settings could not be read (${firstPartyRemoved.path}); the first-party proxy env was left in place.`, { desiredEnabled });
-      }
-      const removed = (ctx.deps.removeDesktop3pStandardPivot ?? removeDesktop3pStandardPivot)({ appliedFingerprint: fingerprint });
-      if (removed.kind === "cleanup_incomplete") {
-        return postCommitRefusal(500, "claude-desktop", "cleanup_incomplete",
-          "Claude Desktop now points at standard mode, but credential cleanup is incomplete.",
-          { desiredEnabled, residualPaths: removed.residualPaths ?? [] });
-      }
-      if (!removed.ok) {
-        return postCommitRefusal(409, "claude-desktop", removed.reason === "metadata_unreadable" ? "metadata_unreadable" : "write_failed",
-          "Claude Desktop configuration could not be changed safely.", { desiredEnabled });
-      }
-      const changed = removed.changed || firstPartyRemoved.changed;
-      return jsonResponse({
-        ok: true, clientId: "claude-desktop", changed, state: "absent", desiredEnabled,
-        message: changed ? "Claude Desktop integration disabled." : "Claude Desktop integration is already off.",
-      } satisfies NativeToggleEnvelope);
-    }
-
-    if (resolveClaudeDesktopApplyMode(current) === "first-party") {
-      const rollback = captureDesktopFirstPartyRollback(current);
-      const applied = applyDesktopFirstParty(current);
-      if (!applied.ok) {
-        const reason = applied.reason === "foreign_env" || applied.reason === "intercept_disabled" ? applied.reason : "write_failed";
-        return postCommitRefusal(applied.reason === "unreadable" || applied.reason === "ca_unavailable" ? 500 : 409, "claude-desktop", reason,
-          firstPartyRefusalMessage(applied.reason, applied.path), { desiredEnabled });
-      }
-      const library = inspectDesktop3pConfigLibrary({ appliedFingerprint: fingerprint });
-      let gatewayRemoved = false;
-      if (library.kind === "gateway_ours" || library.kind === "gateway_drifted") {
-        const removed = (ctx.deps.removeDesktop3pStandardPivot ?? removeDesktop3pStandardPivot)({ appliedFingerprint: fingerprint, replaceWhileEnabled: true });
-        if (!removed.ok && !removed.changed && applied.changed && !rollback()) {
-          return postCommitRefusal(500, "claude-desktop", "write_failed",
-            "Gateway cleanup and first-party settings rollback did not complete.", { desiredEnabled });
+      // Picker mode goes first: stop terminating claude.ai, drop its profile and trust.
+      return await runPickerTransition(current, async ops => {
+        const pickerOff = await ops.disableLocked({ persist: false });
+        const firstPartyRemoved = removeDesktopFirstParty();
+        if (!firstPartyRemoved.ok) {
+          return postCommitRefusal(409, "claude-desktop", "write_failed",
+            `Claude Code settings could not be read (${firstPartyRemoved.path}); the first-party proxy env was left in place.`, { desiredEnabled });
         }
-        const partialModeWarning = !removed.ok && removed.changed && !persistDesktopModeMarker("first-party")
-          ? " First-party is active but its mode marker was not saved." : "";
+        const removed = (ctx.deps.removeDesktop3pStandardPivot ?? removeDesktop3pStandardPivot)({ appliedFingerprint: fingerprint });
         if (removed.kind === "cleanup_incomplete") {
           return postCommitRefusal(500, "claude-desktop", "cleanup_incomplete",
-            "Claude Desktop now points at standard mode, but gateway credential cleanup is incomplete; the first-party connection remains active." + partialModeWarning,
+            "Claude Desktop now points at standard mode, but credential cleanup is incomplete.",
             { desiredEnabled, residualPaths: removed.residualPaths ?? [] });
         }
         if (!removed.ok) {
           return postCommitRefusal(409, "claude-desktop", removed.reason === "metadata_unreadable" ? "metadata_unreadable" : "write_failed",
-            "The gateway profile could not be removed safely; the mode switch is incomplete." + partialModeWarning, { desiredEnabled });
+            "Claude Desktop configuration could not be changed safely.", { desiredEnabled });
         }
-        gatewayRemoved = removed.changed;
-      }
-      const modeSaved = persistDesktopModeMarker("first-party");
-      const changed = applied.changed || gatewayRemoved;
-      return jsonResponse({
-        ok: true, clientId: "claude-desktop", changed, state: "current", desiredEnabled,
-        message: [
-          changed
-            ? "Claude Desktop integration enabled (first-party). Fully quit and reopen Claude Desktop."
-            : "Claude Desktop integration is already on.",
-          modeSaved ? "" : "The first-party mode marker could not be saved to config; status may report the mode as unsaved.",
-        ].filter(Boolean).join(" "),
-      } satisfies NativeToggleEnvelope);
+        const changed = removed.changed || firstPartyRemoved.changed;
+        return jsonResponse({
+          ok: true, clientId: "claude-desktop", changed, state: "absent", desiredEnabled,
+          message: [
+            changed ? "Claude Desktop integration disabled." : "Claude Desktop integration is already off.",
+            pickerCleanupNote(pickerOff),
+          ].filter(Boolean).join(" "),
+        } satisfies NativeToggleEnvelope);
+      });
+    }
+
+    if (resolveClaudeDesktopApplyMode(current, observeClaudeDesktopMode(current)) === "first-party") {
+      // The whole switch runs under the picker lock, in today's order: env first, then gateway cleanup.
+      return await runPickerTransition(current, async ops => {
+        const rollback = captureDesktopFirstPartyRollback(current);
+        const applied = applyDesktopFirstParty(current);
+        if (!applied.ok) {
+          const reason = applied.reason === "foreign_env" || applied.reason === "intercept_disabled" ? applied.reason : "write_failed";
+          return postCommitRefusal(applied.reason === "unreadable" || applied.reason === "ca_unavailable" ? 500 : 409, "claude-desktop", reason,
+            firstPartyRefusalMessage(applied.reason, applied.path), { desiredEnabled });
+        }
+        const library = inspectDesktop3pConfigLibrary({ appliedFingerprint: fingerprint });
+        let gatewayRemoved = false;
+        if (library.kind === "gateway_ours" || library.kind === "gateway_drifted") {
+          const removed = (ctx.deps.removeDesktop3pStandardPivot ?? removeDesktop3pStandardPivot)({ appliedFingerprint: fingerprint, replaceWhileEnabled: true });
+          if (!removed.ok && !removed.changed && applied.changed && !rollback()) {
+            return postCommitRefusal(500, "claude-desktop", "write_failed",
+              "Gateway cleanup and first-party settings rollback did not complete.", { desiredEnabled });
+          }
+          const partialModeWarning = !removed.ok && removed.changed && !persistDesktopModeMarker("first-party")
+            ? " First-party is active but its mode marker was not saved." : "";
+          if (removed.kind === "cleanup_incomplete") {
+            return postCommitRefusal(500, "claude-desktop", "cleanup_incomplete",
+              "Claude Desktop now points at standard mode, but gateway credential cleanup is incomplete; the first-party connection remains active." + partialModeWarning,
+              { desiredEnabled, residualPaths: removed.residualPaths ?? [] });
+          }
+          if (!removed.ok) {
+            return postCommitRefusal(409, "claude-desktop", removed.reason === "metadata_unreadable" ? "metadata_unreadable" : "write_failed",
+              "The gateway profile could not be removed safely; the mode switch is incomplete." + partialModeWarning, { desiredEnabled });
+          }
+          gatewayRemoved = removed.changed;
+        }
+        const modeSaved = persistDesktopModeMarker("first-party");
+        const changed = applied.changed || gatewayRemoved;
+        // Picker mode is on by default in first-party; only a committed mode turns it on.
+        const picker = modeSaved && pickerPreferenceOn(loadConfig())
+          ? await ops.enableLocked({ persist: false, context: "server" })
+          : null;
+        return jsonResponse({
+          ok: true, clientId: "claude-desktop", changed, state: "current", desiredEnabled,
+          message: [
+            changed
+              ? "Claude Desktop integration enabled (first-party). Fully quit and reopen Claude Desktop."
+              : "Claude Desktop integration is already on.",
+            FIRST_PARTY_ACCOUNT_RISK.message,
+            picker ? pickerStateNote(picker) : "",
+            modeSaved ? "" : "The first-party mode marker could not be saved to config; status may report the mode as unsaved.",
+          ].filter(Boolean).join(" "),
+        } satisfies NativeToggleEnvelope);
+      });
     }
 
     const fetchModels = ctx.deps.fetchAllModels ?? defaultFetchAllModels;
     try {
       const fetched = await fetchModels(current);
-      const latest = loadConfig();
-      const latestDesiredEnabled = latest.clientIntegrations?.["claude-desktop"] !== false;
-      if (!latestDesiredEnabled) {
-        return postCommitRefusal(409, "claude-desktop", "desired_state_changed",
-          "Claude Desktop enable was cancelled because the desired state changed to off.", { desiredEnabled: latestDesiredEnabled });
-      }
-      const routed = filterCatalogVisibleModels(fetched, latest).map(model => ({
-        provider: model.provider, id: model.id, contextWindow: model.contextWindow,
-      }));
-      const runtime = (ctx.deps.readRuntimePort ?? readRuntimePort)(process.pid);
-      const result = (ctx.deps.writeDesktop3pConfig ?? writeDesktop3pConfig)(
-        runtime?.port ?? latest.port,
-        [...desktopVisibleNativeSlugs(latest)],
-        routed,
-        latest.apiKeys?.[0]?.key,
-        "static",
-        latest.claudeCode?.desktopProfile,
-        nativeContextLimits(latest),
-      );
-      if (!result.written) return postCommitRefusal(500, "claude-desktop", "write_failed", "Claude Desktop apply failed.", { desiredEnabled: latestDesiredEnabled });
-      const committed = persistCommittedDesktopGateway(ctx.config, latest.claudeCode?.desktopProfile, result.fingerprint);
-      const stateWarning = committed.ok ? "" : " The committed gateway mode/profile state was not saved.";
-      const removed = removeDesktopFirstParty();
-      if (!removed.ok) return postCommitRefusal(500, "claude-desktop", "write_failed", "Gateway applied, but first-party settings cleanup did not complete." + stateWarning, { desiredEnabled: latestDesiredEnabled });
-      return jsonResponse({
-        ok: true, clientId: "claude-desktop", changed: true, state: "current", desiredEnabled: latestDesiredEnabled,
-        message: [
-          "Claude Desktop integration enabled.",
-          stateWarning,
-        ].filter(Boolean).join(" "),
-      } satisfies NativeToggleEnvelope);
+      return await runPickerTransition(current, async ops => {
+        const latest = loadConfig();
+        const latestDesiredEnabled = latest.clientIntegrations?.["claude-desktop"] !== false;
+        if (!latestDesiredEnabled) {
+          return postCommitRefusal(409, "claude-desktop", "desired_state_changed",
+            "Claude Desktop enable was cancelled because the desired state changed to off.", { desiredEnabled: latestDesiredEnabled });
+        }
+        // Picker mode belongs to first-party: stop terminating claude.ai before the gateway lands.
+        const pickerOff = await ops.disableLocked({ persist: false });
+        const routed = filterCatalogVisibleModels(fetched, latest).map(model => ({
+          provider: model.provider, id: model.id, contextWindow: model.contextWindow,
+        }));
+        const runtime = (ctx.deps.readRuntimePort ?? readRuntimePort)(process.pid);
+        const result = (ctx.deps.writeDesktop3pConfig ?? writeDesktop3pConfig)(
+          runtime?.port ?? latest.port,
+          [...desktopVisibleNativeSlugs(latest)],
+          routed,
+          latest.apiKeys?.[0]?.key,
+          "static",
+          latest.claudeCode?.desktopProfile,
+          nativeContextLimits(latest),
+        );
+        if (!result.written) return postCommitRefusal(500, "claude-desktop", "write_failed", "Claude Desktop apply failed.", { desiredEnabled: latestDesiredEnabled });
+        const committed = persistCommittedDesktopGateway(ctx.config, latest.claudeCode?.desktopProfile, result.fingerprint);
+        const stateWarning = committed.ok ? "" : " The committed gateway mode/profile state was not saved.";
+        const removed = removeDesktopFirstParty();
+        if (!removed.ok) return postCommitRefusal(500, "claude-desktop", "write_failed", "Gateway applied, but first-party settings cleanup did not complete." + stateWarning, { desiredEnabled: latestDesiredEnabled });
+        return jsonResponse({
+          ok: true, clientId: "claude-desktop", changed: true, state: "current", desiredEnabled: latestDesiredEnabled,
+          message: [
+            "Claude Desktop integration enabled.",
+            stateWarning,
+            pickerCleanupNote(pickerOff),
+          ].filter(Boolean).join(" "),
+        } satisfies NativeToggleEnvelope);
+      });
     } catch {
       return postCommitRefusal(500, "claude-desktop", "write_failed", "Claude Desktop apply failed.", { desiredEnabled });
     }
@@ -777,14 +837,30 @@ async function handleClaudeDesktopToggle(ctx: ManagementContext): Promise<Respon
   }
 }
 
+function persistedIntentConfig(snapshot: ManagementContext["config"]): ManagementContext["config"] {
+  // Only the per-client intent is refreshed; every other field keeps the snapshot the
+  // rest of this request already reasons about.
+  try {
+    // No config file means no persisted intent: loadConfig would return defaults, which
+    // must not override the in-memory intent this request carries.
+    if (!existsSync(getConfigPath())) return snapshot;
+    return { ...snapshot, clientIntegrations: loadConfig().clientIntegrations };
+  } catch {
+    return snapshot;
+  }
+}
+
 export async function handleNativeIntegrationRoutes(ctx: ManagementContext): Promise<Response | null> {
   const { req, url, config, deps } = ctx;
 
   if (url.pathname === "/api/native-integrations" && req.method === "GET") {
-    const { getConfigPath } = await import("../../config");
     const codexConfigPath = join(getCodexHome(), "config.toml");
+    // The Codex, Grok and Claude Desktop toggles persist intent independently of the
+    // server's startup config snapshot. Read that intent once so the next dashboard
+    // refresh reflects a completed PUT; fall back to the snapshot if the file is unreadable.
+    const persisted = persistedIntentConfig(config);
     return jsonResponse({
-      clients: [claudeStatus(config, getConfigPath()), grokStatus(config), codexStatus(config, codexConfigPath), desktopStatus(config)],
+      clients: [claudeStatus(config, getConfigPath()), grokStatus(persisted), codexStatus(persisted, codexConfigPath), desktopStatus(persisted)],
     } satisfies NativeStatusListEnvelope);
   }
 

package/src/server/management/provider-routes.ts

@@ -43,6 +43,8 @@ import { providerDestinationResolvedError } from "../../lib/destination-policy";
 import { reconcileLiveStateStores } from "../../lib/state-store-registrations";
 import { ProviderOutboundPolicyError, providerOutboundGet, providerOutboundPost, providerRedirectError } from "../../lib/provider-outbound";
 import { fetchCursorUsableModels } from "../../adapters/cursor/live-models";
+import { fetchDevinUsableModels } from "../../adapters/devin/live-models";
+import { resolveDevinApiBaseUrl } from "../../oauth/devin/api-base";
 import { fetchQoderModels } from "../../adapters/qoder/live-models";
 import { resolveQoderProfile } from "../../adapters/qoder/profiles";
 import { parseAntigravityAvailableModels } from "../../providers/antigravity-models";
@@ -448,6 +450,13 @@ function applyProviderPatchFields(
     }
     touched = true;
   }
+  if (Object.hasOwn(rawBody, "fastEnabled")) {
+    const value = rawBody.fastEnabled;
+    if (value === null) delete next.fastEnabled;
+    else if (typeof value === "boolean") next.fastEnabled = value;
+    else return { error: "fastEnabled must be a boolean or null" };
+    touched = true;
+  }
   if (Object.hasOwn(rawBody, "xaiResponsesOptIn")) {
     if (name !== "xai") return { error: "xaiResponsesOptIn is valid only for provider xai" };
     if (typeof rawBody.xaiResponsesOptIn !== "boolean") {
@@ -934,12 +943,15 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       retainModels: p.retainModels,
       omitReasoningEffortWithToolsModels: p.omitReasoningEffortWithToolsModels,
       upstreamHttpVersion: p.upstreamHttpVersion,
-      upstreamWebsocket: p.upstreamWebsocket === true,
+      // As configured: unset on canonical `openai` means upstream WebSocket, so never coerce to false.
+      upstreamWebsocket: p.upstreamWebsocket,
       authMode: p.authMode,
       apiKeyTransport: p.apiKeyTransport,
       disabled: p.disabled === true,
       codexAccountMode: providerCodexAccountMode(name, p),
       ...(name === "xai" ? { xaiResponsesOptInState: xaiResponsesOptInState(p) } : {}),
+      // Only opt-in Fast lanes (Anthropic fast mode bills usage credits) get a dashboard switch.
+      ...(getProviderRegistryEntry(name)?.fastOptIn === true ? { fastOptIn: { enabled: p.fastEnabled === true } } : {}),
       discovery: p.liveModels === false ? undefined : getProviderDiscoveryStatus(name),
       ...(name === "openai" && isCanonicalOpenAiForwardProvider(p)
         ? { entitlement: getCodexModelEntitlementStatus(config) }
@@ -1203,6 +1215,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     const submittedModelDisplayNames = Object.hasOwn(prov, "modelDisplayNames");
     const submittedRequestPacing = Object.hasOwn(prov, "requestPacing");
     const submittedUpstreamWebsocket = Object.hasOwn(prov, "upstreamWebsocket");
+    const submittedFastEnabled = Object.hasOwn(prov, "fastEnabled");
     // Same trap, one more field: DeepSeek carries a registry default of `true` for
     // annotateEmptyToolOutputs, so enrichment cannot distinguish "the client omitted it"
     // from "the registry supplied it" either. Without this sample, an unrelated edit that
@@ -1277,6 +1290,10 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     if (!submittedUpstreamWebsocket && existing?.upstreamWebsocket !== undefined) {
       prov.upstreamWebsocket = existing.upstreamWebsocket;
     }
+    // The Models-page Fast switch is PATCH-owned and the provider form never sends it, so an
+    // unrelated full save must not silently turn an opted-in Anthropic Fast lane back off.
+    const liveFastEnabled = config.providers[name]?.fastEnabled;
+    if (!submittedFastEnabled && liveFastEnabled !== undefined) prov.fastEnabled = liveFastEnabled;
     // The form sends none of the compatibility settings either (#5563). Read the live row rather
     // than `existing`, like the alias overlays below: a PATCH that saved one of them while DNS
     // validation awaited must not be undone. Nothing is carried to a new destination.
@@ -1602,10 +1619,10 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     }
     const { buildModelsRequest, getValidAccessTokenSnapshot, resolveModelsAuthToken } = await import("../../oauth");
     const antigravity = effectiveGoogleMode(name, prov) === "cloud-code-assist";
-    const snapshot = antigravity
+    const snapshot = prov.authMode === "oauth"
       ? await getValidAccessTokenSnapshot(name).catch(() => undefined)
       : undefined;
-    const apiKey = snapshot?.accessToken ?? await resolveModelsAuthToken(name, prov);
+    const apiKey = prov.authMode === "oauth" ? snapshot?.accessToken : await resolveModelsAuthToken(name, prov);
     if (prov.authMode === "oauth" && !apiKey) {
       return jsonResponse({ ok: false, latencyMs: 0, error: "static catalog only — upstream not verified (not logged in)" });
     }
@@ -1630,6 +1647,29 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
         message: `Connected. ${live.models.length} models.`,
       });
     }
+    if (prov.adapter === "devin") {
+      const started = Date.now();
+      const configuredBase = name === "devin" ? getProviderRegistryEntry(name)?.baseUrl ?? prov.baseUrl : prov.baseUrl;
+      const destination = resolveDevinApiBaseUrl(snapshot?.apiBaseUrl ?? configuredBase);
+      const liveResult = await fetchDevinUsableModels({
+        apiKey: apiKey ?? "",
+        baseUrl: destination,
+      });
+      const latencyMs = Date.now() - started;
+      if (!liveResult.ok) {
+        return jsonResponse({
+          ok: false,
+          latencyMs,
+          error: `devin discovery ${liveResult.error}${liveResult.detail ? `: ${liveResult.detail}` : ""}`,
+        });
+      }
+      return jsonResponse({
+        ok: true,
+        latencyMs,
+        models: liveResult.models.length,
+        message: `Connected. ${liveResult.models.length} models.`,
+      });
+    }
     if (prov.adapter === "qoder") {
       const started = Date.now();
       const profile = resolveQoderProfile(prov.baseUrl);
@@ -1656,7 +1696,9 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     if (antigravity && !project) {
       return jsonResponse({ ok: false, latencyMs: 0, error: "Antigravity project unavailable — re-run `ocx login google-antigravity`" });
     }
-    const { method, url: modelsUrl, headers } = buildModelsRequest(prov, apiKey, name);
+    const { method, url: modelsUrl, headers } = buildModelsRequest(prov, apiKey, name, {
+      oauthApiBaseUrl: snapshot?.apiBaseUrl,
+    });
     const discovery = resolveProviderModelDiscovery(name, prov);
     const started = Date.now();
     try {

package/src/server/management/route-registry.ts

@@ -51,6 +51,8 @@ export type ExemptionReason =
   | "interactive-preview"
   /** Unreachable in the live dispatch order; delete rather than expose. */
   | "dead"
+  /** Desktop shell internal display-state POST; the CLI has no app updater state to publish. */
+  | "desktop-internal"
   /**
    * A verb is owed but belongs to a later work-phase. BOUNDED: requires `owner` and
    * `ownerDoc`, and the parity test asserts that tracked doc exists and names the route.
@@ -152,6 +154,10 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "POST", path: "/api/anthropic/reset-grants/consume", module: "server/management/anthropic-reset-grant-routes", mutates: true, exempt: { reason: "session-only", why: "Spending a Claude reset grant requires the gui-session principal (anthropic-reset-grant-routes.ts handleConsume); the admin token is refused." } },
   { method: "PUT", path: "/api/claude-code", module: "server/management/agent-settings-routes", mutates: true },
   { method: "PUT", path: "/api/claude-desktop", module: "server/management/agent-settings-routes", mutates: true },
+  { method: "PUT", path: "/api/claude-desktop/first-party-bindings", module: "server/management/agent-settings-routes", mutates: true },
+  // server/management/claude-desktop-picker-routes
+  { method: "GET", path: "/api/claude-desktop/picker", module: "server/management/claude-desktop-picker-routes", mutates: false },
+  { method: "PUT", path: "/api/claude-desktop/picker", module: "server/management/claude-desktop-picker-routes", mutates: true },
   { method: "PUT", path: "/api/codex-auth/features/default-mode-request-user-input", module: "server/management/agent-settings-routes", mutates: true },
   { method: "PUT", path: "/api/effort-caps", module: "server/management/agent-settings-routes", mutates: true },
   { method: "PUT", path: "/api/grok/selection", module: "server/management/agent-settings-routes", mutates: true },
@@ -346,6 +352,10 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   // server/management/sidebar-routes
   { method: "GET", path: "/api/github/star", module: "server/management/sidebar-routes", mutates: false },
   { method: "GET", path: "/api/update/badge", module: "server/management/sidebar-routes", mutates: false },
+  { method: "POST", path: "/api/update/desktop-snapshot",
+    module: "server/management/sidebar-routes", mutates: true,
+    exempt: { reason: "desktop-internal",
+      why: "Only the Tauri shell has signed-updater state to publish; a CLI verb could only forge that state and would not create an operator action." } },
   { method: "POST", path: "/api/github/star", module: "server/management/sidebar-routes", mutates: true, exempt: { reason: "session-only", why: "User-consent boundary in AGENTS_INSTALL.md: starring spends the user's identity. Must never gain a CLI verb." } },
   // server/management/storage-log-guard-routes
   { method: "GET", path: "/api/storage/codex-logs", module: "server/management/storage-log-guard-routes", mutates: false },

package/src/server/management/routing-profile-routes.ts

@@ -207,6 +207,15 @@ function migrateProfileModelReferences(
         ]),
       );
     }
+    if (claudeCode.intercept?.modelMap) {
+      // First-party picker bindings: keys are Anthropic picker ids, only the route follows the rename.
+      claudeCode.intercept = {
+        ...claudeCode.intercept,
+        modelMap: Object.fromEntries(
+          Object.entries(claudeCode.intercept.modelMap).map(([pickerId, route]) => [pickerId, migrateAgentReference(route)]),
+        ),
+      };
+    }
     config.claudeCode = claudeCode;
   }
   return shouldSyncClaudeAgentDefs;

package/src/server/management/sidebar-routes.ts

@@ -97,6 +97,58 @@ export async function handleSidebarRoutes(ctx: ManagementContext): Promise<Respo
     });
   }
 
+  if (url.pathname === "/api/update/desktop-snapshot" && req.method === "POST") {
+    // Only the native ProxyClient publishes this state; browsers always send Origin.
+    if (req.headers.has("origin")) {
+      return Response.json({ error: "desktop snapshot does not accept browser-origin requests" }, { status: 403 });
+    }
+    if (ctx.principal !== "admin-token") {
+      return jsonResponse({ error: "desktop snapshot requires admin token" }, 403, req, ctx.config);
+    }
+    if (req.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase() !== "application/json") {
+      return jsonResponse({ error: "invalid desktop snapshot" }, 400, req, ctx.config);
+    }
+    const declared = Number(req.headers.get("content-length") ?? "0");
+    if (Number.isFinite(declared) && declared > 1024) {
+      return jsonResponse({ error: "desktop snapshot too large" }, 413, req, ctx.config);
+    }
+    const reader = req.body?.getReader();
+    if (!reader) return jsonResponse({ error: "invalid desktop snapshot" }, 400, req, ctx.config);
+    const bytes = new Uint8Array(1024);
+    let used = 0;
+    try {
+      while (true) {
+        const part = await reader.read();
+        if (part.done) break;
+        if (used + part.value.length > bytes.length) {
+          await reader.cancel();
+          return jsonResponse({ error: "desktop snapshot too large" }, 413, req, ctx.config);
+        }
+        bytes.set(part.value, used);
+        used += part.value.length;
+      }
+      const decoded = new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, used));
+      const { desktopBadgeStore } = await import("../../update/desktop-badge");
+      if (!desktopBadgeStore.put(JSON.parse(decoded))) {
+        return jsonResponse({ error: "invalid desktop snapshot" }, 400, req, ctx.config);
+      }
+    } catch {
+      return jsonResponse({ error: "invalid desktop snapshot" }, 400, req, ctx.config);
+    }
+    return jsonResponse({ ok: true }, 200, req, ctx.config);
+  }
+
+  if (url.pathname === "/api/update/badge" && req.method === "GET"
+    && url.searchParams.get("surface") === "desktop") {
+    const { desktopBadgeStore } = await import("../../update/desktop-badge");
+    return jsonResponse(desktopBadgeStore.read(url.searchParams.get("session")), 200, req, ctx.config);
+  }
+
+  if (url.pathname === "/api/update/badge" && req.method === "GET"
+    && url.searchParams.has("surface") && url.searchParams.get("surface") !== "desktop") {
+    return jsonResponse({ error: "invalid badge surface" }, 400, req, ctx.config);
+  }
+
   if (url.pathname === "/api/update/badge" && req.method === "GET") {
     const { readUpdateBadge } = await import("../../update/badge");
     return jsonResponse(readUpdateBadge());

package/src/server/management-api.ts

@@ -76,6 +76,7 @@ import { handleCompanionRoutes } from "./management/companion-routes";
 import { handleCodexPromptRoutes } from "./management/codex-prompt-routes";
 import { handleIntegrationRoutes } from "./management/integration-routes";
 import { handleNativeIntegrationRoutes } from "./management/native-integration-routes";
+import { handleClaudeDesktopPickerRoutes } from "./management/claude-desktop-picker-routes";
 import { handleCursorIntegrationRoutes } from "./management/cursor-integration-routes";
 import type { ManagementContext } from "./management/context";
 import type { ManagementPrincipal, ManagementSessionControl } from "./management-auth";
@@ -293,6 +294,7 @@ export async function handleManagementAPI(
     ??     (await handleIntegrationRoutes(ctx))
     ??     (await handleNativeIntegrationRoutes(ctx))
     ??     (await handleCursorIntegrationRoutes(ctx))
+    ??     (await handleClaudeDesktopPickerRoutes(ctx))
     ??     (await handleAgentSettingsRoutes(ctx))
     ??     (await handleCodexPromptRoutes(ctx))
     ??     (await handleOauthAccountRoutes(ctx))