@bitkyc08/opencodex 2.7.40 → 2.7.41

package/src/server/management/logs-usage-routes.ts

@@ -10,7 +10,7 @@ import {
   multiAgentGuidanceEnabled,
   providerBaseUrlConfigError,
   providerHeadersConfigError,
-  saveConfig,
+  saveConfigPreservingClaudeCode,
 } from "../../config";
 import {
   clearLoginState,
@@ -34,9 +34,14 @@ import { primeCodexPoolQuotas } from "../../codex/auth-api";
 import { DEFAULT_PROVIDER_CONTEXT_CAP, globalContextCapValue, providerContextCap, providerContextCaps, setAllProviderContextCaps, setGlobalContextCapValue, setProviderContextCap } from "../../providers/context-cap";
 import { resolveCodexHomeDir } from "../../codex/home";
 import { scanStorage } from "../../storage/scanner";
-import { readUsageEntries } from "../../usage/log";
+import {
+  currentUsageLogRevision,
+  readUsageSnapshotForManagement,
+  usageLogRevisionKey,
+  type PersistedUsageEntry,
+} from "../../usage/log";
 import { getUsageDebugLogEntries } from "../../usage/debug";
-import { parseRange, parseUsageSurface, summarizeUsage } from "../../usage/summary";
+import { parseRange, parseUsageSurface, summarizeUsage, type UsageRange, type UsageSummary, type UsageSurface } from "../../usage/summary";
 import { stripCodexRuntimeProviderFields } from "../../codex/auth-context";
 import { getProviderRegistryEntry } from "../../providers/registry";
 import { getDebugLogEntries } from "../../lib/debug-log-buffer";
@@ -60,6 +65,48 @@ import { isPlainRecord, parseDebugLogQuery, tokPerSecondResult, unavailableCostR
 import type { MetricUnavailableReason, TokPerSecondResult, CostEstimateReason, CostResult, MetricSource } from "./shared";
 import type { ManagementContext } from "./context";
 
+const USAGE_DAY_MS = 86_400_000;
+const usageSummaryCache = new Map<string, {
+  revisionKey: string;
+  expiresAt: number;
+  summary: UsageSummary;
+}>();
+
+function usageEntryMatchesSurface(entry: PersistedUsageEntry, surface: UsageSurface): boolean {
+  if (surface === "claude") return entry.surface === "claude" || entry.surface === "claude-desktop";
+  if (surface === "grok") return entry.surface === "grok";
+  if (surface === "codex") return entry.surface === undefined;
+  return true;
+}
+
+function nextLocalMidnight(now: number): number {
+  const next = new Date(now);
+  next.setHours(24, 0, 0, 0);
+  return next.getTime();
+}
+
+function usageSummaryExpiresAt(
+  entries: PersistedUsageEntry[],
+  range: UsageRange,
+  surface: UsageSurface,
+  now: number,
+): number {
+  let expiresAt = nextLocalMidnight(now);
+  const windowMs = range === "7d" ? 7 * USAGE_DAY_MS : range === "30d" ? 30 * USAGE_DAY_MS : null;
+  if (windowMs === null) return expiresAt;
+  for (const entry of entries) {
+    if (!usageEntryMatchesSurface(entry, surface)) continue;
+    const expiry = entry.timestamp + windowMs;
+    if (expiry > now && expiry < expiresAt) expiresAt = expiry;
+  }
+  return expiresAt;
+}
+
+function refreshedUsageSummary(summary: UsageSummary, range: UsageRange, now: number): UsageSummary {
+  const since = range === "7d" ? now - 7 * USAGE_DAY_MS : range === "30d" ? now - 30 * USAGE_DAY_MS : null;
+  return { ...summary, since, generatedAt: now };
+}
+
 export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Response | null> {
   const { req, url, config, deps, refreshCodexCatalogBestEffort, syncClaudeAgentDefsBestEffort } = ctx;
 
@@ -123,7 +170,20 @@ export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Res
     const surface = parseUsageSurface(url.searchParams.get("surface"));
     const now = Date.now();
     try {
-      return jsonResponse(summarizeUsage(readUsageEntries(), range, now, surface));
+      const cacheKey = `${range}:${surface}`;
+      const observedRevisionKey = usageLogRevisionKey(currentUsageLogRevision());
+      const cached = usageSummaryCache.get(cacheKey);
+      if (cached && cached.revisionKey === observedRevisionKey && now < cached.expiresAt) {
+        return jsonResponse(refreshedUsageSummary(cached.summary, range, now));
+      }
+      const snapshot = await readUsageSnapshotForManagement();
+      const summary = summarizeUsage(snapshot.entries, range, now, surface);
+      usageSummaryCache.set(cacheKey, {
+        revisionKey: usageLogRevisionKey(snapshot.revision),
+        expiresAt: usageSummaryExpiresAt(snapshot.entries, range, surface, now),
+        summary,
+      });
+      return jsonResponse(summary);
     } catch {
       return jsonResponse({
         range,

package/src/server/management/model-routes.ts

@@ -1,7 +1,8 @@
 import { randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
 import type { CatalogModel } from "../../codex/catalog";
-import { catalogModelSlug, invalidateCodexModelsCache, nativeModelRows, uniqueCatalogModelsForPublicList } from "../../codex/catalog";
+import { catalogModelSlug, disabledNativeSlugs, invalidateCodexModelsCache, nativeModelRows, uniqueCatalogModelsForPublicList } from "../../codex/catalog";
+import { getProviderLiveModelCount } from "../../codex/model-cache";
 import {
   DEFAULT_SUBAGENT_MODELS,
   codexAutoStartEnabled,
@@ -10,7 +11,7 @@ import {
   multiAgentGuidanceEnabled,
   providerBaseUrlConfigError,
   providerHeadersConfigError,
-  saveConfig,
+  saveConfigPreservingClaudeCode,
 } from "../../config";
 import {
   clearLoginState,
@@ -27,6 +28,7 @@ import { enrichProviderFromCatalog, listKeyLoginProviders } from "../../oauth/ke
 import { deriveProviderPresets } from "../../providers/derive";
 import { providerCodexAccountMode } from "../../providers/registry";
 import { routedSlug, slugEquals } from "../../providers/slug-codec";
+import { COMBO_NAMESPACE, comboModelId, comboPublicModelId, preservesPhysicalComboProvider } from "../../combos";
 import { clearProviderQuotaCache, fetchProviderQuotaReports } from "../../providers/quota";
 import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
 import { clearThreadAccountMap } from "../../codex/routing";
@@ -122,12 +124,111 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
     try { body = await req.json(); } catch { return jsonResponse({ error: "invalid JSON body" }, 400); }
     const disabled = Array.isArray(body.models) ? body.models.filter((m): m is string => typeof m === "string") : [];
     config.disabledModels = disabled;
-    const { saveConfig: save } = await import("../../config");
+    const { saveConfigPreservingClaudeCode: save } = await import("../../config");
     save(config);
     await refreshCodexCatalogBestEffort();
     return jsonResponse({ ok: true, disabled });
   }
 
+  // One user-facing visibility switch spans two persisted filters: a provider allowlist and the
+  // shared blocklist. Keep the update atomic so an interrupted request cannot expose a half-applied
+  // state. Native rows only use the blocklist; routed/custom rows also join a non-empty allowlist.
+  if (url.pathname === "/api/model-visibility" && req.method === "PUT") {
+    let parsedBody: unknown;
+    try { parsedBody = await req.json(); } catch { return jsonResponse({ error: "invalid JSON body" }, 400); }
+    if (!isPlainRecord(parsedBody)) return jsonResponse({ error: "invalid model visibility request" }, 400);
+    const body = parsedBody;
+    const scope = body.scope === "models" || body.scope === "provider" ? body.scope : null;
+    const provider = typeof body.provider === "string" ? body.provider.trim() : "";
+    if (!scope || !provider || !isValidProviderName(provider) || typeof body.enabled !== "boolean" || !Array.isArray(body.targets)) {
+      return jsonResponse({ error: "invalid model visibility request" }, 400);
+    }
+
+    const providerConfig = hasOwnProvider(config.providers, provider) ? config.providers[provider] : undefined;
+    const isVirtualComboNamespace = provider === COMBO_NAMESPACE && !preservesPhysicalComboProvider(config);
+    if (!providerConfig && provider !== "openai" && !isVirtualComboNamespace) {
+      return jsonResponse({ error: "unknown model visibility provider" }, 400);
+    }
+    const supportedNative = new Set(nativeModelRows(config).map(row => row.slug));
+    const targets: Array<{ id: string; native: boolean }> = [];
+    const seen = new Set<string>();
+    for (const value of body.targets) {
+      if (!isPlainRecord(value) || typeof value.id !== "string" || (value.native !== undefined && typeof value.native !== "boolean")) {
+        return jsonResponse({ error: "invalid model visibility target" }, 400);
+      }
+      const id = value.id.trim();
+      const native = value.native === true;
+      if (!id || (provider === "openai") !== native || (native && !supportedNative.has(id))) {
+        return jsonResponse({ error: "invalid model visibility target" }, 400);
+      }
+      const key = `${native ? "native" : "routed"}:${id}`;
+      if (!seen.has(key)) {
+        seen.add(key);
+        targets.push({ id, native });
+      }
+    }
+    if (targets.length === 0) return jsonResponse({ error: "model visibility targets required" }, 400);
+
+    const knownComboSelectors = new Set(
+      Object.entries(config.combos ?? {}).flatMap(([id, combo]) => [
+        comboModelId(id),
+        comboPublicModelId(id, combo),
+      ]),
+    );
+    const targetComboSelectors = new Map<string, Set<string>>();
+    if (isVirtualComboNamespace) {
+      for (const target of targets) {
+        const combo = config.combos && Object.hasOwn(config.combos, target.id) ? config.combos[target.id] : undefined;
+        if (!combo) return jsonResponse({ error: "invalid model visibility target" }, 400);
+        targetComboSelectors.set(target.id, new Set([comboModelId(target.id), comboPublicModelId(target.id, combo)]));
+      }
+    }
+    const matchesTarget = (stored: string, target: { id: string; native: boolean }) => target.native
+      ? stored === target.id
+      : isVirtualComboNamespace
+        ? targetComboSelectors.get(target.id)!.has(stored)
+        : slugEquals(stored, provider, target.id);
+
+    let disabled = [...new Set(config.disabledModels ?? [])];
+    if (body.enabled) {
+      if (scope === "provider") {
+        if (providerConfig && !isVirtualComboNamespace) delete providerConfig.selectedModels;
+        if (isVirtualComboNamespace) {
+          disabled = disabled.filter(stored => !knownComboSelectors.has(stored));
+        } else {
+          const nativeIds = provider === "openai"
+            ? disabledNativeSlugs({ disabledModels: disabled })
+            : new Set<string>();
+          disabled = disabled.filter(stored => (
+            knownComboSelectors.has(stored)
+            || (!stored.startsWith(`${provider}/`) && !nativeIds.has(stored))
+          ));
+        }
+      } else {
+        if (!isVirtualComboNamespace && providerConfig?.selectedModels && providerConfig.selectedModels.length > 0) {
+          const additions = targets.filter(target => !target.native).map(target => target.id);
+          providerConfig.selectedModels = [...new Set([...providerConfig.selectedModels, ...additions])];
+        }
+        disabled = disabled.filter(stored => !targets.some(target => matchesTarget(stored, target)));
+      }
+    } else {
+      for (const target of targets) {
+        const canonical = target.native
+          ? target.id
+          : isVirtualComboNamespace
+            ? comboModelId(target.id)
+            : routedSlug(provider, target.id);
+        const alreadyDisabled = disabled.some(stored => matchesTarget(stored, target));
+        if (!alreadyDisabled) disabled.push(canonical);
+      }
+    }
+
+    config.disabledModels = disabled;
+    saveConfigPreservingClaudeCode(config);
+    await refreshCodexCatalogBestEffort();
+    return jsonResponse({ ok: true, scope, provider, enabled: body.enabled, disabled });
+  }
+
   if (url.pathname === "/api/custom-models" && req.method === "GET") {
     return jsonResponse(config.customModels ?? []);
   }
@@ -160,7 +261,7 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
       addedAt: new Date().toISOString(),
     };
     config.customModels = [...existing, entry];
-    const { saveConfig: save } = await import("../../config");
+    const { saveConfigPreservingClaudeCode: save } = await import("../../config");
     save(config);
     await refreshCodexCatalogBestEffort();
     return jsonResponse(entry, 201);
@@ -197,7 +298,7 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
     }
     list[idx] = cm;
     config.customModels = list;
-    const { saveConfig: save } = await import("../../config");
+    const { saveConfigPreservingClaudeCode: save } = await import("../../config");
     save(config);
     await refreshCodexCatalogBestEffort();
     return jsonResponse(cm);
@@ -212,7 +313,7 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
     if (idx === -1) return jsonResponse({ error: "not found" }, 404);
     list.splice(idx, 1);
     config.customModels = list.length > 0 ? list : undefined;
-    const { saveConfig: save } = await import("../../config");
+    const { saveConfigPreservingClaudeCode: save } = await import("../../config");
     save(config);
     await refreshCodexCatalogBestEffort();
     return jsonResponse({ ok: true });
@@ -226,10 +327,15 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
     const available: Record<string, string[]> = {};
     for (const m of models) (available[m.provider] ??= []).push(m.id);
     const selected: Record<string, string[]> = {};
+    // Live-catalog provenance. The GUI cannot infer this by subtracting known custom ids: an id
+    // that is both custom and discovered would make a real live catalog look custom-only.
+    const liveModelCounts: Record<string, number> = {};
     for (const [name, prov] of Object.entries(config.providers)) {
       if (Array.isArray(prov.selectedModels) && prov.selectedModels.length > 0) selected[name] = [...prov.selectedModels];
+      const liveCount = getProviderLiveModelCount(name);
+      if (liveCount !== undefined) liveModelCounts[name] = liveCount;
     }
-    return jsonResponse({ selected, available });
+    return jsonResponse({ selected, available, liveModelCounts });
   }
   if (url.pathname === "/api/selected-models" && req.method === "PUT") {
     let body: { provider?: unknown; models?: unknown };
@@ -244,7 +350,7 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
     // Empty list clears the allowlist (provider reverts to exposing all models).
     if (models.length > 0) config.providers[provider].selectedModels = models;
     else delete config.providers[provider].selectedModels;
-    const { saveConfig: save } = await import("../../config");
+    const { saveConfigPreservingClaudeCode: save } = await import("../../config");
     save(config);
     await refreshCodexCatalogBestEffort();
     return jsonResponse({ ok: true, provider, selected: models });

package/src/server/management/oauth-account-routes.ts

@@ -10,7 +10,7 @@ import {
   multiAgentGuidanceEnabled,
   providerBaseUrlConfigError,
   providerHeadersConfigError,
-  saveConfig,
+  saveConfigPreservingClaudeCode,
 } from "../../config";
 import {
   clearLoginState,
@@ -55,6 +55,7 @@ import { estimateComboCost, estimateRequestCost, normalizeCostTokens, tokensPerS
 import type { PersistedUsageAttempt } from "../../usage/log";
 import { isAllowedRequestOrigin, jsonResponse, providerManagementConfigError, publicProviderBaseUrl, safeConfigDTO } from "../auth-cors";
 import { applySystemEnvToggle } from "../system-env";
+import { buildApiAccessEndpoints } from "./api-access";
 
 import { isPlainRecord, parseDebugLogQuery, tokPerSecondResult, unavailableCostReason, costResult, requestLogDto, stripRegistryOnlyStaticHeaders, fetchAllModels } from "./shared";
 import type { MetricUnavailableReason, TokPerSecondResult, CostEstimateReason, CostResult, MetricSource } from "./shared";
@@ -157,7 +158,24 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     const provider = (url.searchParams.get("provider") ?? "").trim().toLowerCase();
     if (!isPublicOAuthProvider(provider)) return jsonResponse({ error: "unknown oauth provider" }, 400);
     const status = getLoginStatus(provider);
-    return jsonResponse({ activeAccountId: status.activeAccountId ?? null, accounts: status.accounts ?? [] });
+    const { getAccountSet } = await import("../../oauth/store");
+    const {
+      oauthAccountHealthFields,
+      projectOAuthAccountHealth,
+      projectStoredOAuthAccountHealth,
+    } = await import("../../oauth/health");
+    const set = getAccountSet(provider);
+    const accounts = (status.accounts ?? []).map(summary => {
+      const full = set?.accounts.find(account => account.id === summary.id);
+      const health = full
+        ? projectStoredOAuthAccountHealth(provider, full)
+        : projectOAuthAccountHealth({
+          needsReauth: summary.needsReauth === true,
+          reauthReason: summary.needsReauth === true ? "refresh_failed" : undefined,
+        });
+      return { ...summary, ...oauthAccountHealthFields(provider, summary.id, health) };
+    });
+    return jsonResponse({ activeAccountId: status.activeAccountId ?? null, accounts });
   }
   if (url.pathname === "/api/oauth/accounts/active" && req.method === "PUT") {
     const body = await req.json().catch(() => ({})) as { provider?: string; accountId?: string };
@@ -272,7 +290,15 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
   // ---------------------------------------------------------------------------
   if (url.pathname === "/api/keys" && req.method === "GET") {
     const keys = config.apiKeys ?? [];
-    return jsonResponse({ keys: keys.map(k => ({ id: k.id, name: k.name, prefix: k.key.slice(0, 8) + "...", createdAt: k.createdAt })), endpoint: `http://${config.hostname ?? "127.0.0.1"}:${config.port ?? 10100}/v1/responses` }, 200, req, config);
+    const endpoints = buildApiAccessEndpoints(config, {
+      requestUrl: req.url,
+      requestHost: req.headers.get("host"),
+      requestOrigin: req.headers.get("origin"),
+    });
+    return jsonResponse({
+      keys: keys.map(k => ({ id: k.id, name: k.name, prefix: k.key.slice(0, 8) + "...", createdAt: k.createdAt })),
+      ...endpoints,
+    }, 200, req, config);
   }
 
   if (url.pathname === "/api/keys" && req.method === "POST") {
@@ -286,7 +312,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     const key = "ocx_" + Buffer.from(hashBuf).toString("hex").slice(0, 40);
     const entry = { id: crypto.randomUUID(), name, key, createdAt: new Date().toISOString() };
     config.apiKeys = [...(config.apiKeys ?? []), entry];
-    saveConfig(config);
+    saveConfigPreservingClaudeCode(config);
     return jsonResponse({ id: entry.id, name: entry.name, key: entry.key, createdAt: entry.createdAt }, 201, req, config);
   }
 
@@ -294,7 +320,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     const body = await req.json() as { id?: string };
     if (!body.id) return jsonResponse({ error: "id required" }, 400, req, config);
     config.apiKeys = (config.apiKeys ?? []).filter(k => k.id !== body.id);
-    saveConfig(config);
+    saveConfigPreservingClaudeCode(config);
     return jsonResponse({ success: true }, 200, req, config);
   }
   return null;

package/src/server/management/provider-routes.ts

@@ -10,7 +10,7 @@ import {
   multiAgentGuidanceEnabled,
   providerBaseUrlConfigError,
   providerHeadersConfigError,
-  saveConfig,
+  saveConfigPreservingClaudeCode,
 } from "../../config";
 import {
   clearLoginState,
@@ -28,7 +28,7 @@ import { deriveProviderPresets } from "../../providers/derive";
 import { providerCodexAccountMode } from "../../providers/registry";
 import { routedSlug, slugEquals } from "../../providers/slug-codec";
 import { clearProviderQuotaCache, fetchProviderQuotaReports } from "../../providers/quota";
-import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
+import { CODEX_FORWARD_BASE_URL, isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
 import { clearThreadAccountMap } from "../../codex/routing";
 import { primeCodexPoolQuotas } from "../../codex/auth-api";
 import { getProviderDiscoveryStatus } from "../../codex/model-cache";
@@ -101,12 +101,15 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     }
     // Hostname destinations additionally get a DNS-resolved SSRF check at write time —
     // the sync check above only classifies literal IPs (review finding, PR #96).
-    const resolvedError = await providerDestinationResolvedError(name, prov);
+    // Canonical openai still runs the resolver: only Clash fake-IP (198.18.0.0/15)
+    // answers are ignored; loopback/RFC1918/metadata/mixed sets still fail.
+    const allowBenchmarkAddresses = name === "openai" && isCanonicalOpenAiForwardProvider(prov);
+    const resolvedError = await providerDestinationResolvedError(name, prov, { allowBenchmarkAddresses });
     if (resolvedError) return jsonResponse({ error: resolvedError }, 400);
     // Catalog providers (e.g. ollama-cloud) carry a models + vision/reasoning classification the GUI
     // doesn't send — merge it in so the sidecars are gated correctly.
     enrichProviderFromCatalog(name, prov);
-    const { saveConfig: save } = await import("../../config");
+    const { saveConfigPreservingClaudeCode: save } = await import("../../config");
     // Overwriting an existing provider must not drop its multi-key pool: carry it over, then
     // let the (possibly new) apiKey join the pool as the active entry.
     const existingPool = config.providers[name]?.apiKeyPool;
@@ -148,7 +151,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       if (!provider || !isCanonicalOpenAiForwardProvider(provider)) {
         return jsonResponse({ error: "provider openai must be the canonical built-in provider" }, 400);
       }
-      const { saveConfig: save } = await import("../../config");
+      const { saveConfigPreservingClaudeCode: save } = await import("../../config");
       config.providers.openai = { ...provider, codexAccountMode: mode };
       save(config);
       (deps.clearProviderQuotaCache ?? clearProviderQuotaCache)();
@@ -233,18 +236,46 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
 
     if (!touched) return jsonResponse({ error: "no recognized fields to update" }, 400);
 
-    // A disabled-only toggle preserves the v2 fast lane: it changes routing eligibility,
-    // not the provider shape, so the merged-shape validators (canonical-seed guard for
-    // openai, destination/local checks) do not apply.
+    // A disabled-only toggle preserves the v2 fast lane for non-openai providers: it changes
+    // routing eligibility, not the provider shape. Re-enabling `openai` is different — a
+    // malformed disabled row must not come back online unchanged, so canonicalize/reject
+    // against the same built-in gate used by mode PATCH and POST.
     const editorTouched = keys.some(key => key !== "disabled");
+    const enablingOpenAi = name === "openai"
+      && Object.hasOwn(rawBody, "disabled")
+      && rawBody.disabled === false
+      && config.providers[name]?.disabled === true;
     if (editorTouched) {
       const providerError = providerManagementConfigError(name, next);
       if (providerError) return jsonResponse({ error: providerError }, 400);
       const resolvedError = await providerDestinationResolvedError(name, next);
       if (resolvedError) return jsonResponse({ error: resolvedError }, 400);
+    } else if (enablingOpenAi) {
+      if (!isCanonicalOpenAiForwardProvider(next)) {
+        return jsonResponse({ error: "provider openai must be the canonical built-in provider" }, 400);
+      }
+      // Persist the byte-identical canonical URL so config.ts startup checks (case-sensitive)
+      // accept the row after we fill mode. Equivalent hosts like CHATGPT.com/:443 normalize here.
+      next.baseUrl = CODEX_FORWARD_BASE_URL;
+      // Fill missing mode so a disabled canonical row becomes a complete live openai entry.
+      if (next.codexAccountMode !== "pool" && next.codexAccountMode !== "direct") {
+        next.codexAccountMode = "pool";
+      }
+      // Same DNS gate as POST: Clash fake-IP only. Never honor a persisted
+      // allowPrivateNetwork on this path — it must not bypass the built-in guard.
+      const resolvedError = await providerDestinationResolvedError(
+        "openai",
+        { baseUrl: CODEX_FORWARD_BASE_URL },
+        { allowBenchmarkAddresses: true },
+      );
+      if (resolvedError) return jsonResponse({ error: resolvedError }, 400);
+      if (next.disabled === false) delete next.disabled;
+      // Canonical openai never uses private-network opt-in; drop a stale flag that
+      // was ignored for the DNS probe so it cannot linger on the live row.
+      delete next.allowPrivateNetwork;
     }
 
-    const { saveConfig: save } = await import("../../config");
+    const { saveConfigPreservingClaudeCode: save } = await import("../../config");
     config.providers[name] = stripRegistryOnlyStaticHeaders(name, next);
     save(config);
     if (editorTouched) {
@@ -335,7 +366,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
         combos: dependentCombos,
       }, 409);
     }
-    const { saveConfig: save } = await import("../../config");
+    const { saveConfigPreservingClaudeCode: save } = await import("../../config");
     delete config.providers[name];
     setProviderContextCap(config, name, false);
     save(config);
@@ -352,7 +383,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
   if (url.pathname === "/api/provider-context-caps" && req.method === "PUT") {
     let body: { provider?: unknown; enabled?: unknown; value?: unknown; setAll?: unknown };
     try { body = await req.json(); } catch { return jsonResponse({ error: "invalid JSON body" }, 400); }
-    const { saveConfig: save } = await import("../../config");
+    const { saveConfigPreservingClaudeCode: save } = await import("../../config");
     const { clearModelCache } = await import("../../codex/model-cache");
     const respond = () => jsonResponse({ ok: true, cap: DEFAULT_PROVIDER_CONTEXT_CAP, value: globalContextCapValue(config), caps: providerContextCaps(config) });
 

package/src/server/management/shared.ts

@@ -10,7 +10,7 @@ import {
   multiAgentGuidanceEnabled,
   providerBaseUrlConfigError,
   providerHeadersConfigError,
-  saveConfig,
+  saveConfigPreservingClaudeCode,
 } from "../../config";
 import {
   clearLoginState,
@@ -48,7 +48,8 @@ import {
   setDebugSettings,
   type DebugFlag,
 } from "../../lib/debug-settings";
-import type { OcxClaudeCodeConfig, OcxConfig, OcxCustomModel, OcxProviderConfig } from "../../types";
+import type { OcxClaudeCodeConfig, OcxClaudeDesktopProfile, OcxConfig, OcxCustomModel, OcxProviderConfig } from "../../types";
+import type { DesktopProfileModel } from "../../claude/desktop-profile";
 import { drainAndShutdown } from "../lifecycle";
 import { filterRequestLogs, getRequestLogEntries, type RequestLogEntry } from "../request-log";
 import { estimateComboCost, estimateRequestCost, effectiveServiceTier, normalizeCostTokens, tokensPerSecond } from "../../usage/cost";
@@ -172,6 +173,34 @@ export async function fetchAllModels(config: OcxConfig): Promise<CatalogModel[]>
   return gatherRoutedModels(config);
 }
 
+export interface GrokCandidateModel {
+  id: string;
+  contextWindow?: number;
+  native: boolean;
+}
+
+/**
+ * The model list `syncGrokConfig` would inject, BEFORE the user's exclusions. The Grok
+ * page needs this to show a switch for a model the user has already excluded — such a
+ * model is absent from the fence, so readGrokStatus alone could never list it. Built
+ * from the same two sources as the sync so the two can never disagree.
+ */
+export async function fetchGrokCandidateModels(config: OcxConfig): Promise<GrokCandidateModel[]> {
+  const { filterCatalogVisibleModels, nativeOpenAiContextWindow, visibleNativeSlugs } = await import("../../codex/catalog");
+  const routed = filterCatalogVisibleModels(await fetchAllModels(config), config);
+  return [
+    ...visibleNativeSlugs(config).map(id => {
+      const contextWindow = nativeOpenAiContextWindow(id);
+      return { id, native: true, ...(contextWindow !== undefined ? { contextWindow } : {}) };
+    }),
+    ...routed.map(m => ({
+      id: m.alias ?? `${m.provider}/${m.id}`,
+      native: false,
+      ...(m.contextWindow !== undefined ? { contextWindow: m.contextWindow } : {}),
+    })),
+  ];
+}
+
 export function stripRegistryOnlyStaticHeaders(name: string, provider: OcxProviderConfig): OcxProviderConfig {
   const entry = getProviderRegistryEntry(name);
   if (!entry?.staticHeaders || !provider.headers) return provider;
@@ -184,3 +213,53 @@ export function stripRegistryOnlyStaticHeaders(name: string, provider: OcxProvid
   return rest;
 }
 
+/** Shared Desktop profile DTO builder for the management API and CLI. */
+export async function buildClaudeDesktopState(config: OcxConfig, stored?: OcxClaudeDesktopProfile) {
+  const { filterCatalogVisibleModels, nativeOpenAiContextWindow, visibleNativeSlugs } = await import("../../codex/catalog");
+  const { DESKTOP_SUPPORTS_1M_THRESHOLD } = await import("../../claude/desktop-3p");
+  const { reconcileDesktopProfile, renderDesktopProfile } = await import("../../claude/desktop-profile");
+  const routed = filterCatalogVisibleModels(await fetchAllModels(config), config);
+  const profileModels: DesktopProfileModel[] = [
+    // Native rows carry their real context window from the same accessor the Grok sync
+    // uses — otherwise Sol's 372k and gpt-5.5's 272k render as blank on Desktop.
+    ...visibleNativeSlugs(config).map(id => {
+      const contextWindow = nativeOpenAiContextWindow(id);
+      return { route: `native/${id}`, label: `${id} (native)`,
+        ...(contextWindow !== undefined ? { contextWindow } : {}) };
+    }),
+    ...routed.map(model => ({
+      route: `${model.provider}/${model.id}`,
+      label: `${model.id} (${model.provider})`,
+      ...(typeof model.contextWindow === "number" ? { contextWindow: model.contextWindow } : {}),
+    })),
+  ];
+  const profile = reconcileDesktopProfile(stored ?? config.claudeCode?.desktopProfile, profileModels);
+  const available = new Set(profileModels.map(model => model.route));
+  const modelByRoute = new Map(profileModels.map(model => [model.route, model]));
+  // Effort support: routed models with a non-empty reasoningEfforts ladder support effort;
+  // native models always support it (Anthropic native effort).
+  const effortByRoute = new Map<string, boolean>();
+  for (const m of routed) {
+    effortByRoute.set(`${m.provider}/${m.id}`, Array.isArray(m.reasoningEfforts) && m.reasoningEfforts.length > 0);
+  }
+  for (const id of visibleNativeSlugs(config)) {
+    effortByRoute.set(`native/${id}`, true);
+  }
+  const models = Object.keys(profile.assignments).sort().map(route => ({
+    route,
+    label: modelByRoute.get(route)?.label ?? route,
+    available: available.has(route),
+    ...(modelByRoute.get(route)?.contextWindow ? { contextWindow: modelByRoute.get(route)!.contextWindow } : {}),
+    effortSupported: effortByRoute.get(route) ?? false,
+    // Read-only view of the 1M capability the written Desktop config already emits,
+    // derived from the SAME threshold so the dashboard chip can never disagree.
+    supports1m: (modelByRoute.get(route)?.contextWindow ?? 0) >= DESKTOP_SUPPORTS_1M_THRESHOLD,
+    assignment: profile.assignments[route]!,
+  }));
+  return {
+    profile,
+    models,
+    rendered: renderDesktopProfile(profile, profileModels),
+    port: config.port,
+  };
+}

package/src/server/management/system-routes.ts

@@ -9,10 +9,14 @@
  * The payload is scalar-only (numbers, enum strings): no paths, no tokens, no
  * account identifiers. `jscHeap` (bun:jsc heapStats) is the js-vs-native
  * discriminator: a flat JS heap under a growing RSS points at native runtime
- * memory (the #314 shape), not an app-level JS leak.
+ * memory (the #314 shape), not an app-level JS leak. `responseState` attributes
+ * JS-heap growth further: it is the proxy's previous_response_id continuation
+ * store, so a growing responseState.totalBytes under a growing heap points the
+ * finger at conversation retention rather than the runtime allocator.
  */
 import { decideEagerRelay } from "../../lib/bun-stream-caps";
 import { getActiveMemoryWatchdog } from "../memory-watchdog";
+import { responseStateMetrics } from "../../responses/state";
 import { jsonResponse } from "../auth-cors";
 import type { ManagementContext } from "./context";
 
@@ -56,6 +60,7 @@ export async function handleSystemRoutes(ctx: ManagementContext): Promise<Respon
       heapUsed: usage.heapUsed,
       heapTotal: usage.heapTotal,
       jscHeap,
+      responseState: responseStateMetrics(),
       streamMode,
       eagerRelay: process.platform === "win32" ? decideEagerRelay(streamMode) : null,
       watchdog,