@bitkyc08/opencodex 2.68.0 → 2.69.0

package/src/claude/intercept/runtime.ts

@@ -7,6 +7,8 @@ import { classifyInterceptClient, interceptRouteFor } from "./client-class";
 import { CLAUDE_INTERCEPT_HOSTS, isBrowserConnect, startConnectProxy, type ConnectProxyHandle } from "./connect-proxy";
 import { startClaudeInterceptListener } from "./listener";
 import { claudeInterceptCaCertPath, ensureLocalInterceptCaForStartup, issueLocalInterceptLeaf } from "./local-ca";
+import { discardPickerCaKey, ensurePickerCa } from "./picker-ca";
+import { drainPendingPickerCaUntrust } from "./picker-ca-cleanup";
 import type { PickerRouteInput } from "./picker-models";
 import { createPickerRuntime, type CreatePickerRuntimeOptions, type PickerRuntime } from "./picker-runtime";
 import type { SecurityRunner } from "./picker-trust";
@@ -117,6 +119,8 @@ export interface StartClaudeInterceptOptions<T> {
   loadPickerRoutes?: () => Promise<PickerRouteInput>;
   /** Test seam: builds the picker runtime. */
   createPicker?: (options: CreatePickerRuntimeOptions) => PickerRuntime;
+  /** Test seam: bind real CONNECT handlers on kernel-assigned ports without probe-and-release races. */
+  startProxy?: typeof startConnectProxy;
   /** Test seams: the macOS `security` runner and platform for the picker runtime and controller. */
   pickerSecurity?: SecurityRunner;
   pickerPlatform?: NodeJS.Platform;
@@ -127,11 +131,16 @@ export interface StartClaudeInterceptOptions<T> {
  * rejecting; callers treat it as a degraded optional integration, never as a startup failure.
  */
 export async function startClaudeIntercept<T>(options: StartClaudeInterceptOptions<T>): Promise<ClaudeInterceptHandle<T> | null> {
+  // An older release may have left the picker's exportable signing key on disk. Remove it on every
+  // start, even when the intercept or the picker is off, so an upgrade with the picker disabled
+  // does not keep the key of a CA that may still be trusted. Failure here must not block startup.
+  try { discardPickerCaKey(options.configDir ?? getConfigDir()); } catch { /* retried on the next start */ }
   if (!claudeInterceptEnabled(options.config)) return null;
   const explicitPort = typeof options.config.claudeCode?.intercept?.port === "number";
   if (options.requestedPort === 0 && !explicitPort) return null;
   const configDir = options.configDir ?? getConfigDir();
   const ca = await ensureLocalInterceptCaForStartup(configDir);
+  const startProxy = options.startProxy ?? startConnectProxy;
   const authToken = ensureClaudeInterceptProxyToken(configDir);
   const leaf = issueLocalInterceptLeaf(ca, CLAUDE_INTERCEPT_HOSTS);
   // Refresh an env we already own (e.g. a pre-auth proxy URL left by an upgrade) before the
@@ -156,7 +165,7 @@ export async function startClaudeIntercept<T>(options: StartClaudeInterceptOptio
   });
   let proxy: ConnectProxyHandle;
   try {
-    proxy = await startConnectProxy(claudeInterceptProxyPort(options.config, options.publicPort), {
+    proxy = await startProxy(claudeInterceptProxyPort(options.config, options.publicPort), {
       interceptPort: listener.port!,
       // A real apply may recreate a missing token while this listener remains live.
       // Read current validated authority per CONNECT; absent/invalid means deny, not mint.
@@ -173,7 +182,52 @@ export async function startClaudeIntercept<T>(options: StartClaudeInterceptOptio
   let pickerProxyLive = false;
   try {
     if (options.loadPickerRoutes) {
-      picker = (options.createPicker ?? createPickerRuntime)({
+      // A picker authority is process-scoped, and older releases persisted an exportable ca.key
+      // next to the published certificate. Drop that key before anything else: a cleanup failure
+      // below must never leave a signing key on disk that outlives this process.
+      discardPickerCaKey(configDir);
+      const { inspectDesktopPickerProfile } = await import("../desktop-picker-profile");
+      // The applied profile row is durable evidence of the user's picker selection. Rotation keeps
+      // it in place — row id and its recorded previous selection included — so the picker proxy
+      // can fail to bind without losing it, and the restore enable below only updates the proxy
+      // URL inside the same row rather than recreating a selection around a placeholder pivot.
+      const pickerProfile = inspectDesktopPickerProfile({
+        configDir,
+        ...(options.pickerPlatform ? { platform: options.pickerPlatform } : {}),
+      });
+      const pickerProfileApplied = pickerProfile.kind === "applied";
+      let pickerBlocked = false;
+      try {
+        // A prior process may have died after publishing the journal but before cleanup. Finish
+        // that entry before rotation can replace it, then drain the newly queued predecessor.
+        const drain = () => drainPendingPickerCaUntrust(configDir, options.pickerSecurity, options.pickerPlatform);
+        if (!await drain()) pickerBlocked = true;
+        if (!pickerBlocked) {
+          ensurePickerCa(configDir, { rotation: "startup" });
+          if (!await drain()) pickerBlocked = true;
+        }
+      } catch (error) {
+        pickerBlocked = true;
+        console.warn(`⚠ Claude Desktop picker CA cleanup deferred: ${error instanceof Error ? error.message : String(error)}`);
+      }
+      if (pickerBlocked) {
+        console.warn("⚠ Claude Desktop picker disabled: the previous certificate could not be untrusted");
+        if (pickerProfile.kind === "applied") {
+          // Keep Desktop's actual pinned egress alive without ever constructing a TLS terminator.
+          const port = Number(new URL(pickerProfile.proxyUrl).port);
+          try {
+            pickerProxy = await startProxy(port, {
+              interceptPort: listener.port!,
+              interceptHosts: [],
+              selectTunnel: () => ({ kind: "blind" }),
+            });
+            pickerProxyLive = true;
+          } catch (error) {
+            console.warn(`⚠ Claude Desktop blind egress relay could not start: ${error instanceof Error ? error.message : String(error)}`);
+          }
+        }
+      }
+      picker = pickerBlocked ? null : (options.createPicker ?? createPickerRuntime)({
         config: options.config,
         configDir,
         loadRoutes: options.loadPickerRoutes,
@@ -184,35 +238,39 @@ export async function startClaudeIntercept<T>(options: StartClaudeInterceptOptio
         ...(options.pickerSecurity ? { security: options.pickerSecurity } : {}),
         ...(options.pickerPlatform ? { platform: options.pickerPlatform } : {}),
       });
-      const runtime = picker;
-      const interceptPort = listener.port!;
-      try {
-        pickerProxy = await startConnectProxy(claudePickerProxyPort(options.config, options.publicPort), {
-          interceptPort,
-          // No authToken: Desktop's egressProxyUrl cannot present proxy credentials, so this
-          // listener stays an unauthenticated loopback relay until the profile format can carry
-          // one. The intercept proxy above is the credential-bearing hop.
-          // No host list here: the choice below depends on which client opened the tunnel.
-          interceptHosts: [],
-          selectTunnel: (host, port, request) => {
-            // Desktop hands its pinned egress proxy to the Claude Code processes it spawns, so their
-            // api.anthropic.com traffic arrives here too and gets the same intercept as on the Claude
-            // Code proxy. Those processes trust only the intercept CA, so the picker never terminates
-            // their claude.ai tunnels; only the app's own (browser) CONNECTs reach the picker.
-            if (!isBrowserConnect(request)) {
-              return port === 443 && (CLAUDE_INTERCEPT_HOSTS as readonly string[]).includes(host.toLowerCase())
-                ? { kind: "intercept", port: interceptPort }
-                : { kind: "blind" };
-            }
-            return runtime.selectTunnel(host, port);
-          },
-        });
-        pickerProxyLive = true;
-      } catch (error) {
-        // Picker mode is optional: a busy port leaves the intercept pair running without it.
-        console.warn(`⚠ Claude Desktop picker proxy could not start: ${error instanceof Error ? error.message : String(error)}`);
-        await runtime.stop();
-        picker = null;
+      if (picker) {
+        const runtime = picker;
+        const interceptPort = listener.port!;
+        try {
+          pickerProxy = await startProxy(claudePickerProxyPort(options.config, options.publicPort), {
+            interceptPort,
+            // No authToken: Desktop's egressProxyUrl cannot present proxy credentials, so this
+            // listener stays an unauthenticated loopback relay until the profile format can carry
+            // one. The intercept proxy above is the credential-bearing hop.
+            // No host list here: the choice below depends on which client opened the tunnel.
+            interceptHosts: [],
+            selectTunnel: (host, port, request) => {
+              // Desktop hands its pinned egress proxy to the Claude Code processes it spawns, so their
+              // api.anthropic.com traffic arrives here too and gets the same intercept as on the Claude
+              // Code proxy. Those processes trust only the intercept CA, so the picker never terminates
+              // their claude.ai tunnels; only the app's own (browser) CONNECTs reach the picker.
+              if (!isBrowserConnect(request)) {
+                return port === 443 && (CLAUDE_INTERCEPT_HOSTS as readonly string[]).includes(host.toLowerCase())
+                  ? { kind: "intercept", port: interceptPort }
+                  : { kind: "blind" };
+              }
+              return runtime.selectTunnel(host, port);
+            },
+          });
+          pickerProxyLive = true;
+        } catch (error) {
+          // Picker mode is optional: a busy port leaves the intercept pair running without it.
+          // The selected profile row survives, so the next startup retries the restore once the
+          // port is free again.
+          console.warn(`⚠ Claude Desktop picker proxy could not start: ${error instanceof Error ? error.message : String(error)}`);
+          await runtime.stop();
+          picker = null;
+        }
       }
       if (picker) {
         // Dynamic: the controller reaches desktop-first-party, which imports this module.
@@ -232,6 +290,15 @@ export async function startClaudeIntercept<T>(options: StartClaudeInterceptOptio
           ...(options.pickerPlatform ? { platform: options.pickerPlatform } : {}),
         });
         await picker.start();
+        // The rotated authority still needs the user's consent in the login keychain — a decline
+        // reports trust_pending, and the picker stays a blind tunnel until trust is granted. When
+        // Desktop was pinned to the picker before the restart, the regular enable flow re-trusts
+        // the new authority and rewrites the profile row in place, so a restart does not silently
+        // turn the picker off.
+        if (pickerProfileApplied && controller) {
+          void controller.enable({ persist: false, context: "server" })
+            .catch(error => console.warn(`⚠ Claude Desktop picker restore failed: ${error instanceof Error ? error.message : String(error)}`));
+        }
       }
     }
   } catch (error) {
@@ -248,7 +315,7 @@ export async function startClaudeIntercept<T>(options: StartClaudeInterceptOptio
   const state: ClaudeInterceptState = {
     proxyPort: proxy.port,
     caCertPath: claudeInterceptCaCertPath(configDir),
-    pickerProxyPort: picker && pickerProxy ? pickerProxy.port : null,
+    pickerProxyPort: pickerProxy?.port ?? null,
   };
   activeState = state;
   activePicker = picker;

package/src/cli/account-api.ts

@@ -28,7 +28,7 @@ export interface AccountRow {
   active: boolean;
   needsReauth?: boolean;
   autoSelectable?: boolean;
-  skipReason?: "needs_reauth" | "suspended" | "cooldown" | "quota_exhausted";
+  skipReason?: "paused" | "needs_reauth" | "suspended" | "cooldown" | "quota_exhausted";
   selectionExcludedReason?: "plan_excluded";
   selectionExcludedPlan?: string;
   /** Registered credential that is still excluded from routing until validation completes. */
@@ -345,6 +345,8 @@ interface OAuthAccountDto {
   email?: string;
   active?: boolean;
   needsReauth?: boolean;
+  /** Present only for providers that support operator pause (generic OAuth pools). */
+  paused?: boolean;
   autoSelectable?: boolean;
   skipReason?: unknown;
   /** Always sent by the management route; explicitly `null` when the tier is unknown. */
@@ -355,7 +357,7 @@ interface OAuthAccountDto {
 }
 
 function isKiroSkipReason(value: unknown): value is NonNullable<AccountRow["skipReason"]> {
-  return value === "needs_reauth" || value === "suspended"
+  return value === "paused" || value === "needs_reauth" || value === "suspended"
     || value === "cooldown" || value === "quota_exhausted";
 }
 
@@ -385,6 +387,7 @@ async function fetchOAuthRows(
     email: a.email,
     active: a.active ?? a.id === activeId,
     needsReauth: a.needsReauth,
+    ...(a.paused === true ? { paused: true } : {}),
     ...(name === "kiro" && typeof a.autoSelectable === "boolean"
       ? { autoSelectable: a.autoSelectable } : {}),
     ...(name === "kiro" && a.autoSelectable === false && isKiroSkipReason(a.skipReason)

package/src/cli/account-extended.ts

@@ -772,14 +772,21 @@ export async function cmdPriority(args: string[], deps: AccountDeps): Promise<nu
   return 0;
 }
 
-/**
- * `ocx account pause|resume <provider> <id>` (#2702).
- *
- * The server routes have always existed; only the CLI caller was missing, so pausing an
- * account was dashboard-only. The issue reports these as POST; the code is PUT
- * (`auth-api.ts:1494`), and the route is shared by both directions with a `paused` boolean
- * rather than being two endpoints.
- */
+function resolveGenericOAuthPauseTarget(accounts: unknown[], requested: string): { id: string } | { error: string } {
+  const rows = accounts.filter((value): value is { id: string; alias?: unknown } =>
+    typeof value === "object" && value !== null && typeof (value as { id?: unknown }).id === "string",
+  );
+  if (rows.some(account => account.id === requested)) return { id: requested };
+  const exact = rows.filter(account => account.alias === requested);
+  const matches = exact.length > 0
+    ? exact
+    : rows.filter(account => typeof account.alias === "string" && account.alias.toLowerCase() === requested.toLowerCase());
+  if (matches.length === 1) return { id: matches[0]!.id };
+  if (matches.length > 1) return { error: `alias "${requested}" names ${matches.length} accounts; use the account id` };
+  return { error: `Account not found: no OAuth account has the id or alias "${requested}"` };
+}
+
+/** Pause or resume a Codex account or a generic OAuth provider account. */
 export async function cmdPause(args: string[], deps: AccountDeps, paused: boolean): Promise<number> {
   const wantsJson = flag(args, "--json");
   const name = args.shift();
@@ -788,11 +795,40 @@ export async function cmdPause(args: string[], deps: AccountDeps, paused: boolea
   if (!name || !requestedId || args.length) return usage();
   const classified = configAndType(deps, name);
   if ("error" in classified) return usage(`Error: ${classified.error}`);
-  if (classified.type !== "codex") {
-    return usage(`Error: ${verb} applies to the openai Codex account pool`);
-  }
   const baseUrl = await resolveBaseUrl(deps);
   if (!baseUrl) return proxyUnreachable();
+
+  if (classified.type === "oauth") {
+    if (name === "anthropic") return usage(`Error: ${verb} is not supported for the Anthropic OAuth pool`);
+    const list = await apiJson(deps, baseUrl, "GET", `/api/oauth/accounts?provider=${encodeURIComponent(name)}`);
+    if (list.status === 0) return proxyUnreachable(list.transportError);
+    if (list.status !== 200) return apiError(list.json, `failed to list ${name} OAuth accounts`, list.status);
+    const target = resolveGenericOAuthPauseTarget(Array.isArray(list.json.accounts) ? list.json.accounts : [], requestedId);
+    if ("error" in target) return usage(`Error: ${target.error}`);
+
+    const response = await apiJson(deps, baseUrl, "PUT", "/api/oauth/accounts/pause", {
+      provider: name,
+      accountId: target.id,
+      paused,
+    });
+    if (response.status === 0) return proxyUnreachable(response.transportError);
+    if (response.status !== 200) return apiError(response.json, `failed to ${verb} ${requestedId}`, response.status);
+
+    if (wantsJson) {
+      console.log(JSON.stringify({ ok: true, provider: name, id: target.id, paused,
+        activeAccountId: response.json.activeAccountId }, null, 2));
+    } else {
+      console.log(`${name}: ${requestedId} ${paused ? "paused" : "resumed"}`);
+      if (response.json.activeAccountChanged === true) {
+        console.error(`Active account changed to ${String(response.json.activeAccountId)}.`);
+      }
+    }
+    return 0;
+  }
+
+  if (classified.type !== "codex") {
+    return usage(`Error: ${verb} applies to the openai Codex account pool or a generic OAuth provider`);
+  }
   const target = await resolveCodexAccountTarget(deps, baseUrl, requestedId);
   if ("networkDown" in target) return proxyUnreachable(target.transportError);
   if ("error" in target) return reportCodexAccountTargetError(target);

package/src/cli/account-target.ts

@@ -15,7 +15,7 @@ const MAIN_ALIAS = "main";
 
 export type CodexAccountTarget =
   | { id: string }
-  | { error: string; kind: "not_found" | "ambiguous" | "reserved" }
+  | { error: string; kind: "not_found" | "ambiguous" | "reserved" | "unavailable" }
   | { networkDown: true; transportError?: string };
 
 /** Built-in selectors cannot be reused as Codex account aliases. */
@@ -35,18 +35,21 @@ export async function resolveCodexAccountTarget(
   requested: string,
 ): Promise<CodexAccountTarget> {
   if (requested === MAIN_ALIAS || requested === MAIN_CODEX_ACCOUNT_ID) return { id: MAIN_CODEX_ACCOUNT_ID };
-  if (isReservedCodexAccountWord(requested)) {
-    return { error: `"${requested}" is reserved; it clears the selection with \`ocx account use\` and names no account`, kind: "reserved" };
-  }
   const res = await apiJson(deps, baseUrl, "GET", "/api/codex-auth/accounts");
   if (res.status === 0) return { networkDown: true, transportError: res.transportError };
   // The list is only needed to turn an alias into an id. If the proxy cannot produce it, send
   // the argument as the id it may already be and let the route answer, as the CLI always did.
-  if (res.status !== 200) return { id: requested };
+  if (res.status !== 200) {
+    if (!isReservedCodexAccountWord(requested)) return { id: requested };
+    return { error: `Cannot safely resolve reserved account selector "${requested}" while the account list is unavailable`, kind: "unavailable" };
+  }
   const accounts = (Array.isArray(res.json.accounts) ? res.json.accounts : [])
     .filter((entry): entry is { id: string; alias?: unknown } =>
       typeof entry === "object" && entry !== null && typeof (entry as { id?: unknown }).id === "string");
   if (accounts.some(account => account.id === requested)) return { id: requested };
+  if (isReservedCodexAccountWord(requested)) {
+    return { error: `"${requested}" is reserved; it clears the selection with \`ocx account use\` and names no account`, kind: "reserved" };
+  }
   const exact = accounts.filter(account => account.alias === requested);
   const matches = exact.length > 0
     ? exact
@@ -69,10 +72,12 @@ export async function resolveCodexUseTarget(
   baseUrl: string,
   requested: string,
 ): Promise<CodexUseTarget> {
-  if (requested === AUTO_ACCOUNT_ARGUMENT) return { accountId: null };
   const target = await resolveCodexAccountTarget(deps, baseUrl, requested);
   if ("networkDown" in target) return target;
-  if ("error" in target) return target;
+  if ("error" in target) {
+    if (requested === AUTO_ACCOUNT_ARGUMENT && target.kind === "reserved") return { accountId: null };
+    return target;
+  }
   return { accountId: target.id };
 }
 

package/src/cli/account.ts

@@ -45,6 +45,7 @@ const ACCOUNT_USAGE = `Usage:
   ocx account history openai <pool-account-id> [--limit <1-200>] [--json]
   ocx account current <provider> [--json]
   ocx account use <provider> <account-or-key-id|alias|main|auto> [--json]
+  ocx account clear <provider> [--json]
   ocx account refresh <provider> [--json]
   ocx account auto-switch <provider> <on|off|status|threshold <0-100>> [--json]
   ocx account alias <provider> <account-or-key-id|alias> <display-name|-> [--json]
@@ -68,8 +69,10 @@ const ACCOUNT_USAGE = `Usage:
 
 List and switch provider accounts and API-key pools (masked output only).
 'main' selects the Codex App login for the openai account pool; 'auto' clears the
-selection so the pool places work by its own strategy. A Codex account can be named
-by the alias set with 'ocx account alias' wherever an id is accepted.`;
+selection so the pool places work by its own strategy — unless an account actually
+carries that id, which wins, so 'ocx account clear' is the spelling that always
+clears. A Codex account can be named by the alias set with 'ocx account alias'
+wherever an id is accepted.`;
 
 function consumeFlag(args: string[], flag: string): boolean {
   const idx = args.indexOf(flag);
@@ -105,7 +108,8 @@ function statusText(row: AccountRow): string {
   if (row.paused) parts.push("paused");
   if (row.active) parts.push(row.type === "codex" ? "selected" : "active");
   if (row.needsReauth && !(row.provider === "kiro" && row.skipReason === "needs_reauth")) parts.push("needs-reauth");
-  if (row.provider === "kiro" && row.autoSelectable === false)
+  // A paused Kiro row already says "paused"; repeating it as a skip reason adds nothing.
+  if (row.provider === "kiro" && row.autoSelectable === false && !(row.paused && row.skipReason === "paused"))
     parts.push(row.skipReason ? `not-auto-selected(${row.skipReason})` : "not-auto-selected");
   if (row.validationPending) parts.push("validation-pending");
   if (row.selectionExcludedReason === "plan_excluded") {
@@ -352,6 +356,45 @@ async function cmdUse(rest: string[], deps: AccountDeps): Promise<number> {
   return 0;
 }
 
+/** `ocx account clear` never resolves its argument as an account id, so an account literally
+ * named `auto` cannot shadow the verb that returns the pool to automatic selection. */
+async function cmdClear(rest: string[], deps: AccountDeps): Promise<number> {
+  const wantsJson = consumeFlag(rest, "--json");
+  const name = rest.shift();
+  const leftover = leftoverArgsError(rest);
+  if (!name || leftover) {
+    if (leftover) console.error(leftover);
+    console.error(ACCOUNT_USAGE);
+    return 1;
+  }
+  const config = deps.loadConfigImpl?.() ?? loadConfig();
+  const c = classifyAccount(config, name);
+  if ("error" in c) {
+    console.error(`Error: ${c.error}. Known candidates: ${candidateNames(config)}`);
+    return 1;
+  }
+  if (c.type !== "codex") {
+    console.error(`Error: ${name} has no automatic-selection pin to clear; clear applies to Codex account pools`);
+    return 1;
+  }
+  const baseUrl = await resolveBaseUrl(deps);
+  if (!baseUrl) return proxyUnreachable();
+  const res = await apiJson(deps, baseUrl, "PUT", "/api/codex-auth/active", { accountId: null });
+  if (res.status === 0) return proxyUnreachable(res.transportError);
+  if (res.status !== 200) return apiError(res.json, `failed to clear ${name}`, res.status);
+  const pinDrainReason = typeof res.json.pinDrainReason === "string" ? res.json.pinDrainReason : undefined;
+  if (wantsJson) {
+    console.log(JSON.stringify({
+      ok: true, provider: name, type: c.type, activeId: null,
+      ...(pinDrainReason !== undefined ? { pinDrained: true, pinDrainReason } : {}),
+    }, null, 2));
+  } else {
+    console.log(`${name}: automatic account selection (pin cleared)`);
+  }
+  await explainCodexUseOutcome(deps, baseUrl, name, null, pinDrainReason);
+  return 0;
+}
+
 export async function cmdAccount(args: string[], deps: AccountDeps = {}): Promise<number> {
   const [sub, ...rest] = args;
   try {
@@ -362,6 +405,7 @@ export async function cmdAccount(args: string[], deps: AccountDeps = {}): Promis
     }
     if (sub === "current") return await cmdCurrent(rest, deps);
     if (sub === "use") return await cmdUse(rest, deps);
+    if (sub === "clear") return await cmdClear(rest, deps);
     if (sub === "refresh") return await cmdRefresh(rest, deps);
     if (sub === "auto-switch") return await cmdAutoSwitch(rest, deps);
     if (sub === "alias" || sub === "rename") return await cmdAlias(rest, deps);

package/src/cli/capabilities.ts

@@ -240,6 +240,25 @@ export const CAPABILITIES: readonly Capability[] = [
     json: "payload",
     details: ["Uses the exact upstream model ID after the first slash. Omitted cache rates default to zero; sibling model prices are preserved."],
   },
+  {
+    command: ["models", "set"],
+    summary: "Save per-model overrides for a routed model, or clear them back to the computed values.",
+    routes: [{ method: "PUT", path: "/api/model-settings" }],
+    flags: [
+      { name: "--context-window", value: "string", summary: "Context window in tokens; 0 or - clears the override." },
+      { name: "--modalities", value: "string", summary: "Comma-separated text,image,audio; - clears the override." },
+      { name: "--reasoning-efforts", value: "string", summary: "Comma-separated ladder; \"\" for no reasoning, - to inherit." },
+      { name: "--default-reasoning-effort", value: "string", summary: "Ladder member a request inherits when it omits one; - to inherit." },
+      { name: "--reset", value: "boolean", summary: "Clear every override on this model; cannot be combined with the options above." },
+      { name: "--json", value: "boolean", summary: "Emit the saved state as JSON." },
+    ],
+    mutates: true,
+    json: "envelope",
+    details: [
+      "Addresses a routed model as provider/model. The native openai lane and combos have no per-model overrides.",
+      "Unlike ocx models edit, which changes a custom model's own definition, this edits a row that already exists.",
+    ],
+  },
   {
     command: ["status"],
     summary: "Proxy status, injection state, and version skew between this CLI and the running proxy.",
@@ -522,21 +541,28 @@ export const CAPABILITIES: readonly Capability[] = [
   },
   {
     command: ["account", "pause"],
-    summary: "Stop routing new requests to one account in the Codex pool.",
-    // One route, both directions: `resume` is the same PUT with `paused: false`.
-    routes: [{ method: "PUT", path: "/api/codex-auth/accounts/pause" }],
+    summary: "Exclude one account in a Codex or supported generic OAuth pool from automatic selection.",
+    // Resume uses the same endpoints with `paused: false`.
+    routes: [
+      { method: "PUT", path: "/api/codex-auth/accounts/pause" },
+      { method: "GET", path: "/api/oauth/accounts" },
+      { method: "PUT", path: "/api/oauth/accounts/pause" },
+    ],
     flags: [{ name: "--json", value: "boolean", summary: "Emit the pause result as JSON." }],
     mutates: true,
     json: "envelope",
     details: [
-      "Pausing also unbinds threads pinned to the account and selects a fallback if it was active -- side effects of the route, not of the word `pause`.",
-      "The issue that requested this reported the route as POST; it is PUT.",
+      "Codex pause unbinds pinned threads and selects a fallback when possible; with no fallback, a paused-but-selected Codex account still receives requests. Generic OAuth pause never dispatches to that account: it is excluded from new requests, failover and refresh, and an all-paused pool answers 403. Anthropic is unsupported.",
     ],
   },
   {
     command: ["account", "resume"],
-    summary: "Return a paused account to the Codex pool.",
-    routes: [{ method: "PUT", path: "/api/codex-auth/accounts/pause" }],
+    summary: "Return a paused account to a Codex or supported generic OAuth pool.",
+    routes: [
+      { method: "PUT", path: "/api/codex-auth/accounts/pause" },
+      { method: "GET", path: "/api/oauth/accounts" },
+      { method: "PUT", path: "/api/oauth/accounts/pause" },
+    ],
     flags: [{ name: "--json", value: "boolean", summary: "Emit the resume result as JSON." }],
     mutates: true,
     json: "envelope",

package/src/cli/claude-agent-startup-sync.ts

@@ -1,4 +1,5 @@
 import type { OcxConfig } from "../types";
+import { siblingOfLivePort } from "../codex/sibling-start";
 import { injectClaudeAgentDefs } from "../claude/agents-inject";
 import { readCachedHubState } from "../client/hub-state";
 import { fetchClaudeContextWindows } from "./claude";
@@ -77,6 +78,7 @@ export async function syncClaudeAgentDefsAtProxyStartup(
   port: number,
   deps: ClaudeAgentStartupSyncDeps = {},
 ): Promise<string[] | null> {
+  if (siblingOfLivePort() !== null) return null;
   const inject = deps.injectAgentDefs ?? injectClaudeAgentDefs;
   const warn = deps.warn ?? (message => console.warn(message));
 

package/src/cli/claude-desktop.ts

@@ -136,23 +136,36 @@ function persistPickerPreference(value: boolean): boolean {
   return outcome.status !== "unavailable";
 }
 
-function pickerTrustPaths(deps: ApplyProfileDeps, configDir = getConfigDir()): { caPath: string; leafPath: string; sha1: string } {
-  const ca = (deps.ensurePickerCaImpl ?? ensurePickerCa)(configDir);
+function pickerTrustPaths(deps: ApplyProfileDeps, configDir = getConfigDir()): { caPath: string; leafPath: string; sha1: string; certPem: string } {
+  const caPath = pickerCaCertPath(configDir);
+  const certPem = deps.ensurePickerCaImpl
+    ? deps.ensurePickerCaImpl(configDir).certPem
+    : readFileSync(caPath, "utf8");
   return {
-    caPath: pickerCaCertPath(configDir),
+    caPath,
     leafPath: pickerLeafCertPath(configDir),
-    sha1: pickerCaFingerprints(ca.certPem).sha1,
+    sha1: pickerCaFingerprints(certPem).sha1,
+    certPem,
   };
 }
 
-async function trustPickerLocally(deps: ApplyProfileDeps): Promise<{ ok: true; callerAddedTrust: boolean; caPath: string; sha1: string } | { ok: false; reason: string }> {
+async function trustPickerLocally(
+  deps: ApplyProfileDeps,
+  expectedCaSha256?: string | null,
+): Promise<{ ok: true; callerAddedTrust: boolean; caPath: string; sha1: string } | { ok: false; reason: string }> {
   try {
     const configDir = getConfigDir();
     const paths = pickerTrustPaths(deps, configDir);
+    if (!deps.ensurePickerCaImpl) {
+      // The bytes in ca.pem are only safe to trust when they match the authority the running
+      // server actually owns — a replaced file must never land in the login keychain.
+      const live = pickerCaFingerprints(paths.certPem).sha256;
+      if (expectedCaSha256 == null || expectedCaSha256 !== live) return { ok: false, reason: "ca_unverified" };
+    }
     const inspect = deps.inspectPickerTrustImpl ?? inspectPickerTrust;
     const before = await inspect(paths.leafPath, paths.sha1, deps.security, deps.platform);
     if (before === "trusted") return { ok: true, callerAddedTrust: false, caPath: paths.caPath, sha1: paths.sha1 };
-    const trust = await (deps.trustPickerCaImpl ?? trustPickerCa)(paths.caPath, deps.security, deps.platform);
+    const trust = await (deps.trustPickerCaImpl ?? trustPickerCa)(paths.caPath, deps.security, deps.platform, { pem: paths.certPem });
     if (!trust.ok) return { ok: false, reason: trust.reason ?? "trust_declined" };
     return { ok: true, callerAddedTrust: true, caPath: paths.caPath, sha1: paths.sha1 };
   } catch (error) {
@@ -597,17 +610,28 @@ async function handleClaudeDesktopPickerCommand(
   });
 
   if (action === "trust") {
-    const trusted = await trustPickerLocally(deps);
+    if (!(await liveDesktopProxy(deps))) {
+      console.error("proxy_unavailable");
+      return 1;
+    }
+    // Verify the published CA file against the authority the live server reports — the status
+    // response carries caSha256, and a first enable materializes one when none exists yet.
+    let caSha256: string | null;
+    try {
+      caSha256 = (await pickerRuntimeRequest<{ ok?: boolean; picker?: DesktopPickerStatus }>(
+        "/api/claude-desktop/picker", {}, deps,
+      )).picker?.caSha256 ?? null;
+      if (caSha256 === null) caSha256 = (await sendEnable(false)).picker?.caSha256 ?? null;
+    } catch (error) {
+      console.error(error instanceof Error ? error.message : String(error));
+      return 1;
+    }
+    const trusted = await trustPickerLocally(deps, caSha256);
     if (!trusted.ok) {
       console.error(trusted.reason);
       return 1;
     }
     localTrust = trusted;
-    if (!(await liveDesktopProxy(deps))) {
-      await compensateLocalPickerTrust(localTrust, deps);
-      console.error("proxy_unavailable");
-      return 1;
-    }
   }
 
   let response: PickerRouteResponse;
@@ -619,7 +643,7 @@ async function handleClaudeDesktopPickerCommand(
       return 1;
     }
     if (action === "on" && response.picker?.reason === "trust_pending") {
-      const trusted = await trustPickerLocally(deps);
+      const trusted = await trustPickerLocally(deps, response.picker.caSha256);
       if (!trusted.ok) {
         console.error(trusted.reason);
         return 1;