@bitkyc08/opencodex 2.7.40 → 2.7.41

package/src/config.ts

@@ -15,6 +15,7 @@ import {
   type OcxProviderConfig,
 } from "./types";
 import { isCanonicalOpenAiForwardProvider } from "./providers/openai-tiers";
+import { parseDesktopProfile } from "./claude/desktop-profile";
 
 let _atomicSeq = 0;
 
@@ -485,11 +486,27 @@ const configSchema = z.object({
   contextCapValue: z.number().int().positive().optional(),
   multiAgentGuidanceEnabled: z.boolean().optional(),
   codexShimAutoRestore: z.boolean().optional(),
+  // Model ids excluded from the Grok Build managed block (dashboard switches).
+  grokExcludedModels: z.array(z.string()).optional(),
   // Invalid values degrade to undefined ("auto") instead of failing the whole
   // parse: a hand-edited typo must never trip the backup-and-defaults repair
   // path below and wipe providers/pool accounts. Warning emitted in loadConfig.
   streamMode: z.enum(["auto", "legacy-tee", "eager-relay"]).optional().catch(undefined),
 }).passthrough().superRefine((config, ctx) => {
+  const claudeCode = (config as { claudeCode?: unknown }).claudeCode;
+  if (claudeCode !== undefined && (!claudeCode || typeof claudeCode !== "object" || Array.isArray(claudeCode))) {
+    ctx.addIssue({ code: "custom", path: ["claudeCode"], message: "claudeCode must be an object" });
+  } else if (claudeCode && "desktopProfile" in claudeCode && (claudeCode as { desktopProfile?: unknown }).desktopProfile !== undefined) {
+    try {
+      parseDesktopProfile((claudeCode as { desktopProfile?: unknown }).desktopProfile);
+    } catch (error) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["claudeCode", "desktopProfile"],
+        message: error instanceof Error ? error.message : String(error),
+      });
+    }
+  }
   for (const name of Object.keys(config.providers)) {
     if (!isValidProviderName(name)) {
       ctx.addIssue({
@@ -845,6 +862,106 @@ export function websocketsEnabled(config: Pick<OcxConfig, "websockets">): boolea
   return config.websockets === true;
 }
 
+// ---------------------------------------------------------------------------
+// Hand-edit protection for the `claudeCode` subtree (devlog 260726_claude_auth_auto/040 H1).
+//
+// `saveConfig` serializes the WHOLE config object, so ANY service-time save — a model
+// visibility toggle, a 429 key rotation on the request path — rewrites `claudeCode`
+// from whatever the long-lived server config happens to hold. A user who hand-edits
+// `config.json` while the proxy runs then watches their edit vanish for no visible
+// reason (issue #488). Enumerating `claudeCode` mutators cannot fix that; the guard has
+// to live in ONE save wrapper that every live-config writer goes through.
+// ---------------------------------------------------------------------------
+
+/**
+ * Baseline keyed on the CONFIG INSTANCE, never a module global: a second `loadConfig()`
+ * elsewhere must not refresh the baseline the long-lived server config is judged
+ * against, or a later stale save would masquerade as "our own change".
+ */
+const claudeCodeBaseline = new WeakMap<OcxConfig, unknown>();
+
+/**
+ * Arm the baseline for a long-lived config. MANDATORY at `startServer`, not lazy on
+ * first save — arming lazily would lose exactly the hand edit made before that first
+ * save, which is the case the guard exists for.
+ */
+export function armClaudeCodeBaseline(config: OcxConfig): void {
+  claudeCodeBaseline.set(config, structuredClone(config.claudeCode));
+}
+
+/** Test seam only: is this instance armed? */
+export function claudeCodeBaselineArmed(config: OcxConfig): boolean {
+  return claudeCodeBaseline.has(config);
+}
+
+/**
+ * Structural compare of parsed subtrees. NOT `JSON.stringify`: key order must not
+ * decide whether a user's hand edit survives.
+ */
+function deepEqual(a: unknown, b: unknown): boolean {
+  if (a === b) return true;
+  if (a === null || b === null || typeof a !== "object" || typeof b !== "object") return false;
+  if (Array.isArray(a) !== Array.isArray(b)) return false;
+  if (Array.isArray(a) && Array.isArray(b)) {
+    return a.length === b.length && a.every((item, index) => deepEqual(item, b[index]));
+  }
+  const left = a as Record<string, unknown>;
+  const right = b as Record<string, unknown>;
+  // `undefined` values and absent keys are the same thing after a JSON round-trip.
+  const keys = new Set([...Object.keys(left), ...Object.keys(right)]);
+  for (const key of keys) {
+    if (left[key] === undefined && right[key] === undefined) continue;
+    if (!deepEqual(left[key], right[key])) return false;
+  }
+  return true;
+}
+
+/** The literal file, with no schema merge or default injection. */
+function readRawConfigJson(): Record<string, unknown> | undefined {
+  try {
+    const configPath = getConfigPath();
+    if (!existsSync(configPath)) return undefined;
+    const raw = readFileSync(configPath, "utf-8").replace(/^\uFEFF/, "");
+    const parsed = JSON.parse(raw) as unknown;
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return undefined;
+    return parsed as Record<string, unknown>;
+  } catch {
+    // Unreadable or corrupt: behave exactly as before. Never fail a save over protection.
+    return undefined;
+  }
+}
+
+/**
+ * The save entry point for every writer holding a LIVE server config.
+ *
+ * Conflict policy, chosen deliberately:
+ * - disk changed, we did not → their hand edit wins;
+ * - disk changed AND we changed → our change wins and the baseline rebases, so the
+ *   user's next edit starts from the new value (a three-way merge is out of scope);
+ * - file missing/unreadable → save what we have, no throw.
+ *
+ * Scope residual: only `claudeCode` is reconciled. A hand edit to `providers` is still
+ * clobbered — recorded and asserted in tests so it cannot drift into an assumed
+ * guarantee.
+ */
+export function saveConfigPreservingClaudeCode(config: OcxConfig): void {
+  if (claudeCodeBaseline.has(config)) {
+    const onDisk = readRawConfigJson();
+    if (onDisk !== undefined) {
+      const baseline = claudeCodeBaseline.get(config);
+      const diskChanged = !deepEqual(onDisk.claudeCode, baseline);
+      const weChanged = !deepEqual(config.claudeCode, baseline);
+      if (diskChanged && !weChanged) {
+        config.claudeCode = onDisk.claudeCode as OcxConfig["claudeCode"];
+      }
+    }
+  }
+  saveConfig(config);
+  if (claudeCodeBaseline.has(config)) {
+    claudeCodeBaseline.set(config, structuredClone(config.claudeCode));
+  }
+}
+
 export function codexAutoStartEnabled(config: Pick<OcxConfig, "codexAutoStart">): boolean {
   return config.codexAutoStart !== false;
 }

package/src/grok/inject.ts

@@ -0,0 +1,339 @@
+import { constants, copyFileSync, existsSync, readFileSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { atomicWriteFile } from "../config";
+import { applyEol, dominantEol, isLoopbackHostname, providerBaseHost } from "../codex/inject";
+
+export interface GrokInjectModel {
+  id: string;
+  name?: string;
+  contextWindow?: number;
+}
+
+export interface GrokInjectResult {
+  ok: boolean;
+  changed: boolean;
+  message: string;
+  skippedReason?: "no-grok-home" | "orphaned-marker" | "non-loopback";
+}
+
+const BEGIN_MARKER = "# >>> opencodex managed block — do not edit (removed by `ocx stop`) >>>";
+const END_MARKER = "# <<< opencodex managed block <<<";
+// grok 0.2.101 verified live (2026-07-23): [model_providers.<id>] inheritance parses but the
+// inherited base_url is NOT applied to inference routing — the turn falls through to the default
+// cli-chat-proxy and 401s. Per-model direct fields DO route. So every [model.*] block carries its
+// own base_url/api_backend/api_key and no [model_providers] table is emitted at all.
+
+interface ManagedRegion {
+  start: number;
+  end: number;
+  orphaned: boolean;
+}
+
+function tomlString(value: string): string {
+  return JSON.stringify(value);
+}
+
+function resolveGrokHome(grokHome?: string): string {
+  return grokHome ?? (process.env.GROK_HOME || join(homedir(), ".grok"));
+}
+
+function isDirectory(path: string): boolean {
+  try {
+    return statSync(path).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
+function findManagedRegion(content: string): ManagedRegion | null {
+  const start = content.indexOf(BEGIN_MARKER);
+  if (start === -1) return null;
+  const endMarkerStart = content.indexOf(END_MARKER, start + BEGIN_MARKER.length);
+  if (endMarkerStart === -1) return { start, end: content.length, orphaned: true };
+  return { start, end: endMarkerStart + END_MARKER.length, orphaned: false };
+}
+
+/**
+ * A TOML key segment as it may be spelled in a table header: bare, basic string, or literal
+ * string. All three spellings of the same key address the SAME table, so both segments of a
+ * `[model.<alias>]` header must be canonicalized before comparison.
+ */
+const KEY_SEGMENT = String.raw`(?:[A-Za-z0-9_-]+|"(?:[^"\\]|\\.)*"|'[^']*')`;
+/**
+ * User-owned model table headers. Also matches array-of-table (`[[model.x]]`) and sub-table
+ * (`[model.x.sub]`) spellings. `[[model.x]]` genuinely collides with a generated `[model.x]`,
+ * and one collision makes grok reject the ENTIRE config layer ("duplicate key"), taking every
+ * unrelated user setting with it; `[model.x.sub]` does not strictly collide, but reserving it
+ * costs only a suffixed alias and keeps us clear of the user's namespace.
+ *
+ * Every character class here is newline-free ON PURPOSE. With `[^\]]*` the optional sub-table
+ * tail runs past the end of its own line, so an unclosed `[model.…` inside a multiline string
+ * swallows the following lines — including a real `[model.<alias>]` header, which then goes
+ * unreserved and produces the very duplicate-key config this scan exists to prevent.
+ */
+const MODEL_TABLE_HEADER = new RegExp(
+  String.raw`^[ \t]*\[\[?[ \t]*(${KEY_SEGMENT})[ \t]*\.[ \t]*(${KEY_SEGMENT})[ \t]*(?:\.[^\]\r\n]*)?\]\]?[ \t]*(?:#.*)?$`,
+  "gm",
+);
+
+/** Resolve a header key segment (bare / basic / literal) to the key it actually addresses. */
+function canonicalKeySegment(raw: string): string {
+  if (raw.startsWith('"')) return decodeTomlBasicString(raw.slice(1, -1));
+  if (raw.startsWith("'")) return raw.slice(1, -1); // literal strings have no escapes
+  return raw;
+}
+
+/**
+ * `[model.<alias>]` table headers the USER owns (outside our fence) — reserved for collisions.
+ * TOML admits equivalent header spellings for BOTH segments (`["model"."ocx-mine"]`,
+ * `['model'.ocx-mine]`, `[ model . ocx-mine ]`); all of them redefine the same table, so each
+ * form is canonicalized before it is reserved.
+ */
+function userModelAliases(content: string, region: ManagedRegion | null): Set<string> {
+  const outsideManagedRegion = region
+    ? content.slice(0, region.start) + content.slice(region.end)
+    : content;
+  const aliases = new Set<string>();
+  for (const match of outsideManagedRegion.matchAll(MODEL_TABLE_HEADER)) {
+    if (canonicalKeySegment(match[1]!) !== "model") continue;
+    aliases.add(canonicalKeySegment(match[2]!));
+  }
+  return aliases;
+}
+
+function orphanedMarkerResult(action: string): GrokInjectResult {
+  return {
+    ok: false,
+    changed: false,
+    message: `Grok config ${action} refused: found the opencodex begin marker without its end marker. `
+      + "The managed region boundary is ambiguous, so nothing was modified. "
+      + "Repair ~/.grok/config.toml manually (see config.toml.bak-opencodex) and re-run.",
+    skippedReason: "orphaned-marker",
+  };
+}
+
+function copyBackupOnce(configPath: string, backupPath: string): void {
+  if (existsSync(backupPath)) return;
+  try {
+    copyFileSync(configPath, backupPath, constants.COPYFILE_EXCL);
+  } catch (error) {
+    if (!(error instanceof Error && "code" in error && error.code === "EEXIST")) throw error;
+  }
+}
+
+function errorResult(action: string, error: unknown): GrokInjectResult {
+  const detail = error instanceof Error ? error.message : String(error);
+  return { ok: false, changed: false, message: `Could not ${action} Grok config: ${detail}` };
+}
+
+export function buildGrokManagedBlock(
+  port: number,
+  models: GrokInjectModel[],
+  hostname?: string,
+  reservedAliases?: ReadonlySet<string>,
+  /**
+   * Ids to allocate an alias for but NOT emit. Alias numbering must not depend on which
+   * models the user switched off, or excluding one colliding model would rename another
+   * model's alias out from under a grok config that already uses it.
+   */
+  excluded?: ReadonlySet<string>,
+): string {
+  const host = providerBaseHost(hostname);
+  const baseUrl = `http://${host}:${port}/v1`;
+  const lines = [
+    BEGIN_MARKER,
+  ];
+  const aliasCounts = new Map<string, number>();
+  const taken = new Set(reservedAliases ?? []);
+
+  for (const model of models) {
+    const baseAlias = `ocx-${model.id.replace(/[^A-Za-z0-9_-]/g, "-")}`;
+    let count = (aliasCounts.get(baseAlias) ?? 0) + 1;
+    let alias = count === 1 ? baseAlias : `${baseAlias}-${count}`;
+    // User-owned [model.<alias>] tables outside the fence are reserved: emitting a
+    // duplicate table header would make the whole TOML invalid for grok.
+    while (taken.has(alias)) {
+      count += 1;
+      alias = `${baseAlias}-${count}`;
+    }
+    aliasCounts.set(baseAlias, count);
+    taken.add(alias);
+    // Slot consumed, table not written: this is what keeps every other alias stable
+    // across selection changes.
+    if (excluded?.has(model.id)) continue;
+    const isFirst = lines.length === 1;
+    lines.push(
+      ...(isFirst ? [] : [""]),
+      `[model.${alias}]`,
+      `model = ${tomlString(model.id)}`,
+      `base_url = ${tomlString(baseUrl)}`,
+      'api_backend = "chat_completions"',
+      'api_key = "opencodex-loopback"',
+      `name = ${tomlString(model.name ?? `OCX ${model.id}`)}`,
+      // Best-effort attribution tag for the usage dashboard. Upstream Grok sends
+      // extra_headers verbatim on inference calls (11-custom-models.md). This is NOT a
+      // security boundary — any loopback client could send the same header.
+      'extra_headers = { "x-opencodex-grok" = "1" }',
+    );
+    if (Number.isFinite(model.contextWindow) && (model.contextWindow ?? 0) > 0) {
+      lines.push(`context_window = ${model.contextWindow}`);
+    }
+  }
+
+  lines.push(END_MARKER);
+  return lines.join("\n");
+}
+
+export function injectGrokConfig(
+  port: number,
+  models: GrokInjectModel[],
+  opts: { grokHome?: string; hostname?: string; excluded?: ReadonlySet<string> } = {},
+): GrokInjectResult {
+  const grokHome = resolveGrokHome(opts.grokHome);
+  if (!isDirectory(grokHome)) {
+    return {
+      ok: true,
+      changed: false,
+      message: `Grok home not found at ${grokHome}; config injection skipped.`,
+      skippedReason: "no-grok-home",
+    };
+  }
+
+  // Non-loopback binds require the real admission token (src/server/auth-cors.ts), and there is
+  // no safe way for a REGENERATED block to carry it: a literal token would write the user's
+  // secret into their own file and overwrite it on every start/ensure/restart, while omitting
+  // api_key in favour of env_key opens grok's credential fallthrough — with no `model_provider`
+  // to fail closed, an unresolved env_key makes grok send its xAI session bearer to our
+  // plaintext LAN endpoint (upstream config.rs resolve_credentials). So we do not auto-register
+  // at all here; the user configures models manually, outside our fence, where nothing we do
+  // can clobber their credential.
+  if (!isLoopbackHostname(opts.hostname)) {
+    const removed = stripGrokConfig({ ...(opts.grokHome !== undefined ? { grokHome: opts.grokHome } : {}) });
+    const cleanup = removed.changed
+      ? " Removed the previously generated block, which pointed at a loopback address."
+      : "";
+    return {
+      ok: true, // a deliberate policy skip, not a failure — it must never block startup
+      changed: removed.changed,
+      skippedReason: "non-loopback",
+      message: `Grok auto-registration skipped: opencodex is bound to the non-loopback host `
+        + `"${opts.hostname}", where requests need your admission token. A managed block would `
+        + `either store that secret in ~/.grok/config.toml or overwrite it on the next start, so `
+        + `add the models yourself OUTSIDE the opencodex markers (see the Grok Build guide).${cleanup}`,
+    };
+  }
+
+  const configPath = join(grokHome, "config.toml");
+  const backupPath = join(grokHome, "config.toml.bak-opencodex");
+  try {
+    const configExisted = existsSync(configPath);
+    const rawContent = configExisted ? readFileSync(configPath, "utf8") : "";
+    const eol = dominantEol(rawContent);
+    const content = applyEol(rawContent, "\n");
+    const region = findManagedRegion(content);
+    if (region?.orphaned) return orphanedMarkerResult("injection");
+
+    const block = buildGrokManagedBlock(port, models, opts.hostname, userModelAliases(content, region), opts.excluded);
+    let nextContent: string;
+    if (region) {
+      nextContent = content.slice(0, region.start) + block + content.slice(region.end);
+    } else if (content.length === 0) {
+      nextContent = `${block}\n`;
+    } else {
+      // Exactly ONE separator newline, always. The old rule ("\n\n" when the file lacked a
+      // trailing newline) made two different originals — "X" and "X\n" — produce byte-identical
+      // files, so strip could not restore both. One newline keeps injection injective: the
+      // user's own terminator is preserved verbatim and strip can undo exactly what we added.
+      nextContent = `${content}\n${block}\n`;
+    }
+
+    const output = applyEol(nextContent, eol);
+    if (output === rawContent) {
+      return { ok: true, changed: false, message: "Grok config already contains the current opencodex managed block." };
+    }
+    if (configExisted && !region) copyBackupOnce(configPath, backupPath);
+    atomicWriteFile(configPath, output);
+    return {
+      ok: true,
+      changed: true,
+      message: region
+        ? "Updated the opencodex managed block in Grok config."
+        : "Added the opencodex managed block to Grok config.",
+    };
+  } catch (error) {
+    return errorResult("inject", error);
+  }
+}
+
+export function stripGrokConfig(opts: { grokHome?: string } = {}): GrokInjectResult {
+  const grokHome = resolveGrokHome(opts.grokHome);
+  if (!isDirectory(grokHome)) {
+    return {
+      ok: true,
+      changed: false,
+      message: `Grok home not found at ${grokHome}; no managed config to remove.`,
+      skippedReason: "no-grok-home",
+    };
+  }
+
+  const configPath = join(grokHome, "config.toml");
+  if (!existsSync(configPath)) {
+    return { ok: true, changed: false, message: "Grok config not found; no managed block to remove." };
+  }
+
+  try {
+    const rawContent = readFileSync(configPath, "utf8");
+    const eol = dominantEol(rawContent);
+    const content = applyEol(rawContent, "\n");
+    const region = findManagedRegion(content);
+    if (!region) {
+      return { ok: true, changed: false, message: "No opencodex managed block found in Grok config." };
+    }
+    if (region.orphaned) return orphanedMarkerResult("cleanup");
+
+    let removalEnd = region.end;
+    if (content.startsWith("\n", removalEnd)) removalEnd += 1;
+    let prefix = content.slice(0, region.start);
+    const restOfFile = content.slice(removalEnd);
+    // Undo the single separator newline injection added. Two cases, mirroring inject:
+    //   "X\n"  -> "X\n" + "\n" + block  => prefix ends "\n\n", drop one.
+    //   "X"    -> "X"   + "\n" + block  => prefix ends "\n" at EOF, drop it.
+    // A block the user has appended content after is left alone: we never shrink their bytes.
+    if (prefix.endsWith("\n\n")) prefix = prefix.slice(0, -1);
+    else if (restOfFile.length === 0 && prefix.endsWith("\n")) prefix = prefix.slice(0, -1);
+    const stripped = prefix + restOfFile;
+    atomicWriteFile(configPath, applyEol(stripped, eol));
+
+    return {
+      ok: true,
+      changed: true,
+      message: "Removed the opencodex managed block from Grok config.",
+    };
+  } catch (error) {
+    return errorResult("strip", error);
+  }
+}
+/** Decode a TOML basic-string body: JSON-compatible escapes plus TOML's \uXXXX / \UXXXXXXXX. */
+function decodeTomlBasicString(body: string): string {
+  return body.replace(
+    /\\(u[0-9A-Fa-f]{4}|U[0-9A-Fa-f]{8}|.)/g,
+    (whole, esc: string) => {
+      if (esc[0] === "u") return String.fromCharCode(parseInt(esc.slice(1), 16));
+      if (esc[0] === "U") {
+        const code = parseInt(esc.slice(1), 16);
+        return code <= 0x10ffff ? String.fromCodePoint(code) : whole;
+      }
+      switch (esc) {
+        case "b": return "\b";
+        case "t": return "\t";
+        case "n": return "\n";
+        case "f": return "\f";
+        case "r": return "\r";
+        case '"': return '"';
+        case "\\": return "\\";
+        default: return whole; // invalid escape — keep raw, reservation stays conservative
+      }
+    },
+  );
+}

package/src/grok/status.ts

@@ -0,0 +1,88 @@
+/**
+ * Read-only view of the Grok Build managed block.
+ *
+ * This never writes. `injectGrokConfig` owns every mutation of `~/.grok/config.toml`, behind
+ * guards (non-loopback refusal, byte-for-byte preservation of user content, alias reservation)
+ * that a web-reachable writer would widen the blast radius of. The dashboard only needs to
+ * answer "is Grok wired up, and with what?", which a reader does at a fraction of the risk.
+ *
+ * It parses only the fenced region we ourselves emit, and only the specific fields
+ * `buildGrokManagedBlock` writes — user content outside the fence is never read or echoed,
+ * since it can legitimately contain real credentials.
+ */
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+const BEGIN_MARKER = "# >>> opencodex managed block — do not edit (removed by `ocx stop`) >>>";
+const END_MARKER = "# <<< opencodex managed block <<<";
+
+export interface GrokStatusModel {
+  /** Alias of the emitted `[model.<alias>]` table. */
+  alias: string;
+  /** The model id opencodex routes for. */
+  id: string;
+  contextWindow?: number;
+}
+
+export interface GrokStatus {
+  configPath: string;
+  /** Whether the managed fence is present in that file. */
+  present: boolean;
+  /** Endpoint the fence points at, parsed from the first entry. */
+  baseUrl: string | null;
+  models: GrokStatusModel[];
+}
+
+/** Mirrors `resolveGrokHome` in ./inject so both agree on the authoritative file. */
+export function grokConfigPath(grokHome?: string): string {
+  const home = grokHome ?? (process.env.GROK_HOME || join(homedir(), ".grok"));
+  return join(home, "config.toml");
+}
+
+function tomlStringValue(line: string): string | undefined {
+  const match = /^[A-Za-z_]+\s*=\s*"((?:[^"\\]|\\.)*)"\s*$/.exec(line.trim());
+  if (!match) return undefined;
+  return match[1]!.replace(/\\(["\\])/g, "$1");
+}
+
+export function readGrokStatus(opts: { grokHome?: string } = {}): GrokStatus {
+  const configPath = grokConfigPath(opts.grokHome);
+  let content: string;
+  try {
+    content = readFileSync(configPath, "utf8");
+  } catch {
+    // No Grok install, or no config yet. Absent is a state, not an error.
+    return { configPath, present: false, baseUrl: null, models: [] };
+  }
+
+  const begin = content.indexOf(BEGIN_MARKER);
+  const end = content.indexOf(END_MARKER, begin + 1);
+  if (begin < 0 || end < 0) return { configPath, present: false, baseUrl: null, models: [] };
+
+  const region = content.slice(begin + BEGIN_MARKER.length, end);
+  const models: GrokStatusModel[] = [];
+  let baseUrl: string | null = null;
+  let current: GrokStatusModel | null = null;
+
+  for (const rawLine of region.split("\n")) {
+    const line = rawLine.trim();
+    const header = /^\[model\.([^\]]+)\]$/.exec(line);
+    if (header) {
+      current = { alias: header[1]!, id: "" };
+      models.push(current);
+      continue;
+    }
+    if (!current) continue;
+    if (line.startsWith("model =")) {
+      current.id = tomlStringValue(line) ?? "";
+    } else if (line.startsWith("base_url =")) {
+      baseUrl ??= tomlStringValue(line) ?? null;
+    } else if (line.startsWith("context_window =")) {
+      const value = Number(line.slice(line.indexOf("=") + 1).trim());
+      if (Number.isFinite(value) && value > 0) current.contextWindow = value;
+    }
+  }
+
+  return { configPath, present: true, baseUrl, models: models.filter(model => model.id) };
+}

package/src/grok/sync.ts

@@ -0,0 +1,66 @@
+/**
+ * Shared Grok Build config sync: gather the visible model catalog and (re)inject the
+ * managed block into ~/.grok/config.toml. Used by `ocx start` (server process) and by
+ * `ocx ensure` / `ocx restart` (parent process, after live discovery or child readiness)
+ * so the fence exists deterministically once the proxy reports healthy.
+ *
+ * Deps are injectable (mirrors src/codex/sync.ts) so tests can run without a live proxy.
+ */
+import { visibleNativeSlugs, filterCatalogVisibleModels, nativeOpenAiContextWindow, type CatalogModel } from "../codex/catalog";
+import type { OcxConfig } from "../types";
+import { injectGrokConfig, type GrokInjectModel, type GrokInjectResult } from "./inject";
+
+export interface GrokSyncDeps {
+  fetchAllModels: (config: OcxConfig) => Promise<CatalogModel[]>;
+  injectGrokConfig: typeof injectGrokConfig;
+}
+
+async function defaultFetchAllModels(config: OcxConfig): Promise<CatalogModel[]> {
+  const { fetchAllModels } = await import("../server/management-api");
+  return fetchAllModels(config);
+}
+
+/**
+ * Build the model list and inject the fenced block. `hostname` should be the hostname the
+ * RUNNING proxy actually bound (live.hostname from proxy-liveness for ensure's live branch;
+ * config.hostname for a freshly spawned start) — a stale config.hostname could otherwise
+ * name a host the process never bound.
+ */
+export async function syncGrokConfig(
+  port: number,
+  config: OcxConfig,
+  opts: { hostname?: string; grokHome?: string } = {},
+  deps: GrokSyncDeps = { fetchAllModels: defaultFetchAllModels, injectGrokConfig },
+): Promise<GrokInjectResult> {
+  let models: GrokInjectModel[];
+  try {
+    const routed = filterCatalogVisibleModels(await deps.fetchAllModels(config), config);
+    models = [
+      // Native slugs carry their context window too. Without it Grok falls back to its own
+      // default (200k) and understates models like gpt-5.6-sol, which is 372k. This is the same
+      // accessor the dashboard's native rows use, so the two cannot disagree.
+      ...visibleNativeSlugs(config).map(id => {
+        const contextWindow = nativeOpenAiContextWindow(id);
+        return { id, ...(contextWindow !== undefined ? { contextWindow } : {}) };
+      }),
+      ...routed.map(m => ({
+        id: m.alias ?? `${m.provider}/${m.id}`,
+        ...(m.contextWindow !== undefined ? { contextWindow: m.contextWindow } : {}),
+      })),
+    ];
+  } catch (err) {
+    return {
+      ok: false,
+      changed: false,
+      message: `Grok config sync skipped: model catalog unavailable (${err instanceof Error ? err.message : String(err)})`,
+    };
+  }
+  // Pass the FULL list plus the exclusion set: the writer allocates aliases over
+  // everything and emits only what is switched on, so a model's alias never depends on
+  // its neighbours' switches. Absent/empty selection keeps today's behaviour exactly.
+  return deps.injectGrokConfig(port, models, {
+    ...(opts.hostname !== undefined ? { hostname: opts.hostname } : {}),
+    ...(opts.grokHome !== undefined ? { grokHome: opts.grokHome } : {}),
+    excluded: new Set(config.grokExcludedModels ?? []),
+  });
+}

package/src/lib/destination-policy.ts

@@ -133,10 +133,15 @@ export function assertProviderDestinationAllowed(name: string, provider: Pick<Oc
  * config load are synchronous). DNS failures return null: config-time validation is
  * advisory and must not hard-fail offline startups. DNS rebinding after validation is
  * a recorded residual for this loopback proxy (devlog 260712_pr_batch_landing 000).
+ *
+ * `allowBenchmarkAddresses` is only for the exact canonical ChatGPT Codex seed under
+ * Clash fake-IP DNS (198.18.0.0/15). Every other non-public answer — including mixed
+ * benchmark + private/metadata sets — still fails.
  */
 export async function providerDestinationResolvedError(
   name: string,
   provider: Pick<OcxProviderConfig, "baseUrl" | "allowPrivateNetwork">,
+  options?: { allowBenchmarkAddresses?: boolean },
 ): Promise<string | null> {
   const syncError = providerDestinationConfigError(name, provider);
   if (syncError) return syncError;
@@ -160,6 +165,14 @@ export async function providerDestinationResolvedError(
     const ipKind = isIP(address);
     const assessment = ipKind === 4 ? classifyIpv4(address) : ipKind === 6 ? classifyIpv6(normalizeHostname(address)) : null;
     if (!assessment || assessment.kind === "public") continue;
+    // Clash fake-IP only: 198.18/19 benchmark detail. Mixed dangerous sets still reject.
+    if (
+      options?.allowBenchmarkAddresses
+      && assessment.kind === "private"
+      && assessment.detail === "benchmark address"
+    ) {
+      continue;
+    }
     if (assessment.kind === "metadata") return `baseUrl hostname ${hostname} resolves to a blocked metadata endpoint (${address})`;
     return `baseUrl hostname ${hostname} resolves to a ${assessment.detail} (${address}); set allowPrivateNetwork:true only for intentionally local/self-hosted providers`;
   }