@bitkyc08/opencodex 2.7.40 → 2.7.41

package/src/claude/desktop-profile.ts

@@ -0,0 +1,263 @@
+import { createHash } from "node:crypto";
+import type {
+  OcxClaudeDesktopAssignment,
+  OcxClaudeDesktopFamily,
+  OcxClaudeDesktopProfile,
+} from "../types";
+
+export const DESKTOP_FAMILIES = ["opus", "fable", "sonnet", "haiku"] as const;
+export type DesktopFamily = OcxClaudeDesktopFamily;
+export type DesktopProfile = OcxClaudeDesktopProfile;
+
+export interface DesktopProfileModel {
+  route: string;
+  label: string;
+  contextWindow?: number;
+}
+
+export interface RenderedDesktopModel extends DesktopProfileModel {
+  name: string;
+  family: DesktopFamily;
+  isFamilyDefault: boolean;
+  supports1m: boolean;
+}
+
+const DATE_ALIAS = /^claude-opus-4-8-(2026\d{4})$/;
+const DAY_COUNT_2026 = 365;
+
+export class DesktopProfileError extends Error {
+  constructor(message: string, readonly path = "profile") {
+    super(`${path}: ${message}`);
+    this.name = "DesktopProfileError";
+  }
+}
+
+export function emptyDesktopProfile(): DesktopProfile {
+  return {
+    version: 1,
+    assignments: {},
+    defaults: { opus: null, fable: null, sonnet: null, haiku: null },
+  };
+}
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+
+function assertExactKeys(value: Record<string, unknown>, keys: readonly string[], path: string): void {
+  const allowed = new Set(keys);
+  for (const key of Object.keys(value)) {
+    if (!allowed.has(key)) throw new DesktopProfileError(`unknown field "${key}"`, path);
+  }
+}
+
+/**
+ * Applied-state markers survive every profile rebuild.
+ *
+ * `parseDesktopProfile`, `reconcileDesktopProfile` and `moveDesktopRoute` each construct a
+ * fresh `{ version, assignments, defaults }`, and the management routes persist whatever they
+ * return. Without this carry-through, saving an assignment — or merely dragging a model to
+ * another family — would erase the fingerprint the apply route wrote, and the GUI would report
+ * "not applied" for a config that is applied on disk.
+ */
+function appliedMarkers(source: { appliedFingerprint?: unknown; appliedAt?: unknown }): {
+  appliedFingerprint?: string;
+  appliedAt?: string;
+} {
+  return {
+    ...(typeof source.appliedFingerprint === "string" ? { appliedFingerprint: source.appliedFingerprint } : {}),
+    ...(typeof source.appliedAt === "string" ? { appliedAt: source.appliedAt } : {}),
+  };
+}
+
+function isFamily(value: unknown): value is DesktopFamily {
+  return typeof value === "string" && (DESKTOP_FAMILIES as readonly string[]).includes(value);
+}
+
+function routeModelId(route: string): string {
+  const slash = route.indexOf("/");
+  return slash >= 0 ? route.slice(slash + 1) : route;
+}
+
+function isRealAnthropicRoute(route: string): boolean {
+  return route.startsWith("anthropic/claude-");
+}
+
+function validDateAlias(alias: string): boolean {
+  const match = DATE_ALIAS.exec(alias);
+  if (!match) return false;
+  const year = Number(match[1]!.slice(0, 4));
+  const month = Number(match[1]!.slice(4, 6));
+  const day = Number(match[1]!.slice(6, 8));
+  const date = new Date(Date.UTC(year, month - 1, day));
+  return date.getUTCFullYear() === year && date.getUTCMonth() === month - 1 && date.getUTCDate() === day;
+}
+
+export function parseDesktopProfile(value: unknown): DesktopProfile {
+  if (!isPlainObject(value)) throw new DesktopProfileError("must be an object");
+  // `appliedFingerprint`/`appliedAt` are written back by the apply route once a profile
+  // reaches Claude Desktop (see server/management/agent-settings-routes.ts). Rejecting them
+  // here made every reload after the first apply fail with `unknown field`.
+  assertExactKeys(value, ["version", "assignments", "defaults", "appliedFingerprint", "appliedAt"], "profile");
+  if (value.version !== 1) throw new DesktopProfileError("version must be 1", "profile.version");
+  if (!isPlainObject(value.assignments)) throw new DesktopProfileError("must be an object", "profile.assignments");
+  if (!isPlainObject(value.defaults)) throw new DesktopProfileError("must be an object", "profile.defaults");
+  assertExactKeys(value.defaults, DESKTOP_FAMILIES, "profile.defaults");
+  if (value.appliedFingerprint !== undefined && typeof value.appliedFingerprint !== "string") {
+    throw new DesktopProfileError("must be a string", "profile.appliedFingerprint");
+  }
+  if (value.appliedAt !== undefined && typeof value.appliedAt !== "string") {
+    throw new DesktopProfileError("must be a string", "profile.appliedAt");
+  }
+
+  const assignments: Record<string, OcxClaudeDesktopAssignment> = {};
+  const aliases = new Set<string>();
+  for (const [route, raw] of Object.entries(value.assignments)) {
+    if (!route.trim() || !route.includes("/")) throw new DesktopProfileError("route must be provider/model", `profile.assignments.${route || "<empty>"}`);
+    if (!isPlainObject(raw)) throw new DesktopProfileError("must be an object", `profile.assignments.${route}`);
+    assertExactKeys(raw, ["family", "alias"], `profile.assignments.${route}`);
+    if (!isFamily(raw.family)) throw new DesktopProfileError("unknown family", `profile.assignments.${route}.family`);
+    if (typeof raw.alias !== "string" || !raw.alias) throw new DesktopProfileError("must be a non-empty string", `profile.assignments.${route}.alias`);
+    if (isRealAnthropicRoute(route)) {
+      if (raw.alias !== routeModelId(route)) throw new DesktopProfileError("real Anthropic routes must keep their exact model id", `profile.assignments.${route}.alias`);
+    } else if (!validDateAlias(raw.alias)) {
+      throw new DesktopProfileError("must be a valid claude-opus-4-8-2026MMDD alias", `profile.assignments.${route}.alias`);
+    }
+    if (aliases.has(raw.alias)) throw new DesktopProfileError(`duplicate alias "${raw.alias}"`, `profile.assignments.${route}.alias`);
+    aliases.add(raw.alias);
+    assignments[route] = { family: raw.family, alias: raw.alias };
+  }
+
+  const defaults = {} as DesktopProfile["defaults"];
+  for (const family of DESKTOP_FAMILIES) {
+    const route = value.defaults[family];
+    if (route !== null && typeof route !== "string") throw new DesktopProfileError("must be a route or null", `profile.defaults.${family}`);
+    const members = Object.keys(assignments).filter(key => assignments[key]!.family === family).sort();
+    if (members.length === 0) {
+      if (route !== null) throw new DesktopProfileError("must be null for an empty family", `profile.defaults.${family}`);
+      defaults[family] = null;
+      continue;
+    }
+    if (typeof route !== "string" || !assignments[route] || assignments[route]!.family !== family) {
+      throw new DesktopProfileError("must reference a member of this family", `profile.defaults.${family}`);
+    }
+    defaults[family] = route;
+  }
+  return { version: 1, assignments, defaults, ...appliedMarkers(value) };
+}
+
+function dayOfYearAlias(dayIndex: number): string {
+  const date = new Date(Date.UTC(2026, 0, dayIndex + 1));
+  const y = date.getUTCFullYear();
+  const m = String(date.getUTCMonth() + 1).padStart(2, "0");
+  const d = String(date.getUTCDate()).padStart(2, "0");
+  return `claude-opus-4-8-${y}${m}${d}`;
+}
+
+function routeStartDay(route: string): number {
+  return createHash("sha256").update(route).digest().readUInt32BE(0) % DAY_COUNT_2026;
+}
+
+function allocateAlias(route: string, used: Set<string>): string {
+  if (isRealAnthropicRoute(route)) return routeModelId(route);
+  const start = routeStartDay(route);
+  for (let offset = 0; offset < DAY_COUNT_2026; offset += 1) {
+    const alias = dayOfYearAlias((start + offset) % DAY_COUNT_2026);
+    if (!used.has(alias)) return alias;
+  }
+  throw new DesktopProfileError("all 365 encoded date slots are occupied", `profile.assignments.${route}.alias`);
+}
+
+export function reconcileDesktopProfile(
+  stored: unknown,
+  models: readonly DesktopProfileModel[],
+): DesktopProfile {
+  const profile = stored === undefined || stored === null ? emptyDesktopProfile() : parseDesktopProfile(stored);
+  const assignments: DesktopProfile["assignments"] = Object.fromEntries(
+    Object.entries(profile.assignments).map(([route, assignment]) => [route, { ...assignment }]),
+  );
+  const used = new Set(Object.values(assignments).map(value => value.alias));
+  for (const model of [...models].sort((a, b) => a.route.localeCompare(b.route))) {
+    if (assignments[model.route]) continue;
+    const alias = allocateAlias(model.route, used);
+    used.add(alias);
+    assignments[model.route] = { family: "opus", alias };
+  }
+  const defaults = { ...profile.defaults };
+  for (const family of DESKTOP_FAMILIES) {
+    const members = Object.keys(assignments).filter(route => assignments[route]!.family === family).sort();
+    const current = defaults[family];
+    defaults[family] = current && assignments[current]?.family === family ? current : (members[0] ?? null);
+  }
+  return parseDesktopProfile({ version: 1, assignments, defaults, ...appliedMarkers(profile) });
+}
+
+export function moveDesktopRoute(
+  profile: DesktopProfile,
+  route: string,
+  family: DesktopFamily,
+  makeDefault = false,
+): DesktopProfile {
+  const parsed = parseDesktopProfile(profile);
+  const current = parsed.assignments[route];
+  if (!current) throw new DesktopProfileError("route is not assigned", `profile.assignments.${route}`);
+  const oldFamily = current.family;
+  if (oldFamily === family) {
+    return makeDefault ? setDesktopFamilyDefault(parsed, family, route) : parsed;
+  }
+  const assignments = { ...parsed.assignments, [route]: { ...current, family } };
+  const defaults = { ...parsed.defaults };
+  if (defaults[oldFamily] === route) {
+    defaults[oldFamily] = Object.keys(assignments).filter(key => key !== route && assignments[key]!.family === oldFamily).sort()[0] ?? null;
+  }
+  const destinationMembers = Object.keys(assignments).filter(key => assignments[key]!.family === family).sort();
+  if (makeDefault || !defaults[family] || assignments[defaults[family]!]?.family !== family) defaults[family] = route;
+  if (!defaults[family] && destinationMembers.length > 0) defaults[family] = destinationMembers[0]!;
+  return parseDesktopProfile({ version: 1, assignments, defaults, ...appliedMarkers(parsed) });
+}
+
+export function setDesktopFamilyDefault(
+  profile: DesktopProfile,
+  family: DesktopFamily,
+  route: string | null,
+): DesktopProfile {
+  const parsed = parseDesktopProfile(profile);
+  const members = Object.keys(parsed.assignments).filter(key => parsed.assignments[key]!.family === family);
+  if (route === null && members.length > 0) throw new DesktopProfileError("cannot clear a non-empty family default", `profile.defaults.${family}`);
+  if (route !== null && parsed.assignments[route]?.family !== family) throw new DesktopProfileError("route is not a member of this family", `profile.defaults.${family}`);
+  return parseDesktopProfile({ ...parsed, defaults: { ...parsed.defaults, [family]: route } });
+}
+
+export function renderDesktopProfile(
+  profile: DesktopProfile,
+  models: readonly DesktopProfileModel[],
+): RenderedDesktopModel[] {
+  const parsed = parseDesktopProfile(profile);
+  const modelByRoute = new Map(models.map(model => [model.route, model]));
+  const activeByFamily = new Map<DesktopFamily, string[]>();
+  for (const family of DESKTOP_FAMILIES) activeByFamily.set(family, []);
+  for (const [route, assignment] of Object.entries(parsed.assignments)) {
+    if (modelByRoute.has(route)) activeByFamily.get(assignment.family)!.push(route);
+  }
+  for (const routes of activeByFamily.values()) routes.sort();
+  const effectiveDefaults = {} as Record<DesktopFamily, string | null>;
+  for (const family of DESKTOP_FAMILIES) {
+    const active = activeByFamily.get(family)!;
+    const stored = parsed.defaults[family];
+    effectiveDefaults[family] = stored && active.includes(stored) ? stored : (active[0] ?? null);
+  }
+  const defaultOrder = DESKTOP_FAMILIES.map(family => effectiveDefaults[family]).filter((route): route is string => !!route);
+  const defaultSet = new Set(defaultOrder);
+  const rest = Object.keys(parsed.assignments).filter(route => modelByRoute.has(route) && !defaultSet.has(route)).sort();
+  return [...defaultOrder, ...rest].map(route => {
+    const model = modelByRoute.get(route)!;
+    const assignment = parsed.assignments[route]!;
+    return {
+      ...model,
+      name: assignment.alias,
+      family: assignment.family,
+      isFamilyDefault: effectiveDefaults[assignment.family] === route,
+      supports1m: typeof model.contextWindow === "number" && model.contextWindow >= 1_000_000,
+    };
+  });
+}

package/src/claude/inbound-debug.ts

@@ -16,6 +16,8 @@ import { createHmac, randomBytes } from "node:crypto";
 import { isClaudeDebugEnabled } from "../lib/debug-settings";
 
 export interface ClaudeInboundDebugEntry {
+  /** Monotonic capture id — unique even when several entries share Date.now(). */
+  id: number;
   at: number;
   endpoint: "messages" | "count_tokens";
   model: string;
@@ -39,6 +41,7 @@ const RING_LIMIT = 20;
 const ring: ClaudeInboundDebugEntry[] = [];
 const salt = randomBytes(16).toString("hex");
 let lastEnabled = false;
+let nextCaptureId = 0;
 
 function tag(value: string): string {
   return createHmac("sha256", salt).update(value).digest("hex").slice(0, 8);
@@ -82,6 +85,7 @@ export function captureClaudeInbound(
   const userId = metadata && typeof metadata.user_id === "string" ? metadata.user_id : undefined;
   const system = systemText(body.system);
   const entry: ClaudeInboundDebugEntry = {
+    id: ++nextCaptureId,
     at: Date.now(),
     endpoint,
     model: typeof body.model === "string" ? body.model : "unknown",

package/src/claude/model-info.ts

@@ -102,7 +102,13 @@ function modelInfo(id: string, displayName: string, ladder: readonly string[], i
 export type AnthropicIdStyle = "desktop3p" | "readable";
 
 /** Build the full anthropic-flavor discovery list (ids are Desktop 3P aliases). */
-export function buildAnthropicModelInfos(nativeSlugs: readonly string[], routedModels: readonly CatalogModel[], auto: AutoContextMode = AUTO_CONTEXT_OFF, idStyle: AnthropicIdStyle = "desktop3p"): AnthropicModelInfo[] {
+export function buildAnthropicModelInfos(
+  nativeSlugs: readonly string[],
+  routedModels: readonly CatalogModel[],
+  auto: AutoContextMode = AUTO_CONTEXT_OFF,
+  idStyle: AnthropicIdStyle = "desktop3p",
+  aliasForRoute: (provider: string, modelId: string) => string = desktop3pAlias,
+): AnthropicModelInfo[] {
   const out: AnthropicModelInfo[] = [];
   const seen = new Set<string>();
   // [1m] picker variant (devlog 260712 B1): Claude Code accounts exactly 1M for ids
@@ -122,7 +128,7 @@ export function buildAnthropicModelInfos(nativeSlugs: readonly string[], routedM
     out.push({ ...base, id, display_name: `${base.display_name} · ${label}`, max_input_tokens: Math.min(window, ONE_MILLION) });
   };
   for (const slug of nativeSlugs) {
-    const id = idStyle === "readable" ? claudeCodeNativeAlias(slug) : desktop3pAlias("native", slug);
+    const id = idStyle === "readable" ? claudeCodeNativeAlias(slug) : aliasForRoute("native", slug);
     if (seen.has(id)) continue;
     seen.add(id);
     const info = modelInfo(id, `${slug} (native)`, nativeEffectiveLadder(slug), true);
@@ -130,7 +136,7 @@ export function buildAnthropicModelInfos(nativeSlugs: readonly string[], routedM
     push1mVariant(info, nativeOpenAiContextWindow(slug));
   }
   for (const m of routedModels) {
-    const id = idStyle === "readable" ? claudeCodeAlias(m.provider, m.id) : desktop3pAlias(m.provider, m.id);
+    const id = idStyle === "readable" ? claudeCodeAlias(m.provider, m.id) : aliasForRoute(m.provider, m.id);
     if (seen.has(id)) continue;
     seen.add(id);
     const ladder = Array.isArray(m.reasoningEfforts) ? m.reasoningEfforts : [];

package/src/cli/account-extended.ts

@@ -19,6 +19,7 @@ const EXTENDED_USAGE = `Usage:
   ocx account auto-switch <provider> <on|off|status|threshold <0-100>> [--json]
   ocx account alias <provider> <id|main> <display-name|-> [--json]
   ocx account remove <provider> <id|main> --yes [--json]
+  ocx account clear-cooldown <provider> <id|main> [--json]
   ocx account add-key <provider> [--label <label>] [--json]`;
 const PIPE_GUIDANCE = `Pipe the API key on stdin, for example:
   ocx account add-key <provider> <<< "$MY_KEY"
@@ -282,6 +283,39 @@ export async function cmdAddKey(args: string[], deps: AccountDeps): Promise<numb
   return 0;
 }
 
+/**
+ * Lift a quota cooldown on a Codex account.
+ *
+ * This is the user-facing escape from the lockout described in
+ * `devlog/_plan/260726_cooldown_lockout_hardening`: injected routing makes the proxy the
+ * only model path for Codex Desktop, so a stuck cooldown reads as "the whole app is dead".
+ *
+ * Codex accounts only. API-key pools already reset their own 429 cooldowns through key
+ * management (`clearKeyCooldowns`), and OAuth providers have no equivalent state here.
+ */
+export async function cmdClearCooldown(args: string[], deps: AccountDeps): Promise<number> {
+  const wantsJson = flag(args, "--json");
+  const name = args.shift();
+  const requestedId = args.shift();
+  if (!name || !requestedId || args.length) return usage();
+  const classified = configAndType(deps, name);
+  if ("error" in classified) return usage(`Error: ${classified.error}`);
+  if (classified.type !== "codex") {
+    return usage(`Error: ${name} is not a Codex account pool; cooldown clearing applies to Codex accounts only`);
+  }
+  const id = requestedId === "main" ? MAIN_ID : requestedId;
+  const baseUrl = await resolveBaseUrl(deps);
+  if (!baseUrl) return proxyUnreachable();
+  const response = await apiJson(deps, baseUrl, "POST", "/api/codex-auth/accounts/clear-cooldown", { id });
+  if (response.status === 0) return proxyUnreachable();
+  if (response.status !== 200) return apiError(response.json, `failed to clear cooldown for ${requestedId}`);
+  const cleared = response.json?.cleared === true;
+  if (wantsJson) console.log(JSON.stringify({ ok: true, provider: name, id, cleared }, null, 2));
+  else if (cleared) console.log(`${name}: cooldown lifted for ${requestedId}`);
+  else console.log(`${name}: no active cooldown for ${requestedId}`);
+  return 0;
+}
+
 export async function cmdAlias(args: string[], deps: AccountDeps): Promise<number> {
   const wantsJson = flag(args, "--json");
   const name = args.shift();

package/src/cli/account.ts

@@ -2,7 +2,7 @@
 import { loadConfig } from "../config";
 import { providerCodexAccountMode } from "../providers/registry";
 import type { OcxConfig } from "../types";
-import { cmdAddKey, cmdAlias, cmdAutoSwitch, cmdRefresh, cmdRemove } from "./account-extended";
+import { cmdAddKey, cmdAlias, cmdAutoSwitch, cmdClearCooldown, cmdRefresh, cmdRemove } from "./account-extended";
 import { apiError, apiJson, classifyAccount, fetchRows, proxyUnreachable, resolveBaseUrl, type AccountDeps, type AccountRow, type AccountType, type ApiResult }
   from "./account-api";
 
@@ -23,6 +23,7 @@ const ACCOUNT_USAGE = `Usage:
   ocx account auto-switch <provider> <on|off|status|threshold <0-100>> [--json]
   ocx account alias <provider> <account-or-key-id> <display-name|-> [--json]
   ocx account remove <provider> <account-or-key-id|main> --yes [--json]
+  ocx account clear-cooldown <provider> <account-id|main> [--json]
   ocx account add-key <provider> [--label <label>] [--json]
 
 List and switch provider accounts and API-key pools (masked output only).
@@ -257,6 +258,7 @@ export async function cmdAccount(args: string[], deps: AccountDeps = {}): Promis
     if (sub === "auto-switch") return await cmdAutoSwitch(rest, deps);
     if (sub === "alias" || sub === "rename") return await cmdAlias(rest, deps);
     if (sub === "remove") return await cmdRemove(rest, deps);
+    if (sub === "clear-cooldown") return await cmdClearCooldown(rest, deps);
     if (sub === "add-key") return await cmdAddKey(rest, deps);
     console.error(ACCOUNT_USAGE);
     return 1;

package/src/cli/claude-desktop.ts

@@ -0,0 +1,152 @@
+import { readFileSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { loadConfig, saveConfigPreservingClaudeCode } from "../config";
+import {
+  DESKTOP_FAMILIES,
+  moveDesktopRoute,
+  parseDesktopProfile,
+  setDesktopFamilyDefault,
+  type DesktopFamily,
+  type DesktopProfile,
+} from "../claude/desktop-profile";
+import { writeDesktop3pConfig, type Desktop3pConfigMode, parseDesktop3pModeArgs } from "../claude/desktop-3p";
+import { filterCatalogVisibleModels, visibleNativeSlugs } from "../codex/catalog";
+import { buildClaudeDesktopState, fetchAllModels } from "../server/management-api";
+import { findLiveProxy } from "../server/proxy-liveness";
+
+function isFamily(value: string | undefined): value is DesktopFamily {
+  return !!value && (DESKTOP_FAMILIES as readonly string[]).includes(value);
+}
+
+function printDesktopHelp(): void {
+  console.log(`Usage:
+  ocx claude desktop [apply] [--static|--hybrid|--discovery-only]
+  ocx claude desktop show [--json]
+  ocx claude desktop move <provider/model> <opus|fable|sonnet|haiku> [--default]
+  ocx claude desktop default <family> <provider/model|none>
+  ocx claude desktop export <path|->
+  ocx claude desktop import <path> [--apply]`);
+}
+
+async function applyProfile(profile: DesktopProfile, mode: Desktop3pConfigMode): Promise<{ ok: boolean; path: string; reason?: string }> {
+  const config = loadConfig();
+  const state = await buildClaudeDesktopState(config, profile);
+  config.claudeCode = { ...(config.claudeCode ?? {}), desktopProfile: state.profile };
+  saveConfigPreservingClaudeCode(config);
+  const live = await findLiveProxy();
+  const allModels = await fetchAllModels(config);
+  const routed = filterCatalogVisibleModels(allModels, config).map(model => ({
+    provider: model.provider,
+    id: model.id,
+    contextWindow: model.contextWindow,
+  }));
+  const result = writeDesktop3pConfig(
+    live?.port ?? config.port ?? 10100,
+    [...visibleNativeSlugs(config)],
+    routed,
+    config.apiKeys?.[0]?.key,
+    mode,
+    state.profile,
+  );
+  return { ok: result.written, path: result.path, reason: result.reason };
+}
+
+export async function handleClaudeDesktopCommand(argv: string[]): Promise<number> {
+  const command = argv[0];
+  if (command === "help" || command === "--help" || command === "-h") {
+    printDesktopHelp();
+    return 0;
+  }
+
+  // Legacy mode flags remain apply aliases and are parsed before subcommands.
+  const legacyFlags = argv.filter(arg => ["--static", "--hybrid", "--discovery-only"].includes(arg));
+  const applyInvocation = argv.length === 0 || command === "apply" || legacyFlags.length > 0;
+  if (applyInvocation) {
+    const nonMode = argv.filter(arg => !["apply", "--static", "--hybrid", "--discovery-only"].includes(arg));
+    if (nonMode.length > 0) {
+      console.error(`알 수 없는 인자: ${nonMode.join(" ")}`);
+      return 1;
+    }
+    const parsedMode = parseDesktop3pModeArgs(legacyFlags);
+    if ("error" in parsedMode) { console.error(parsedMode.error); return 1; }
+    try {
+      const config = loadConfig();
+      const state = await buildClaudeDesktopState(config);
+      const result = await applyProfile(state.profile, parsedMode.mode);
+      if (!result.ok) { console.error(`설정 적용 실패: ${result.reason ?? "unknown error"}`); return 1; }
+      console.log(`Claude Desktop 설정을 적용했습니다: ${result.path}`);
+      console.log("Claude Desktop을 완전히 종료한 뒤 다시 열어 주세요.");
+      return 0;
+    } catch (error) {
+      console.error(error instanceof Error ? error.message : String(error));
+      return 1;
+    }
+  }
+
+  try {
+    const config = loadConfig();
+    const state = await buildClaudeDesktopState(config);
+    if (command === "show") {
+      if (argv.length > 2 || (argv[1] && argv[1] !== "--json")) throw new Error("Usage: ocx claude desktop show [--json]");
+      if (argv[1] === "--json") console.log(JSON.stringify(state));
+      else {
+        for (const family of DESKTOP_FAMILIES) {
+          console.log(`${family.toUpperCase()}${state.profile.defaults[family] ? ` (default: ${state.profile.defaults[family]})` : ""}`);
+          for (const model of state.models.filter(item => item.assignment.family === family)) {
+            console.log(`  ${model.available ? "•" : "○"} ${model.route} -> ${model.assignment.alias}${model.available ? "" : " (unavailable)"}`);
+          }
+        }
+      }
+      return 0;
+    }
+    if (command === "move") {
+      const [, route, familyRaw, ...flags] = argv;
+      if (!route || !isFamily(familyRaw) || flags.some(flag => flag !== "--default")) throw new Error("Usage: ocx claude desktop move <route> <family> [--default]");
+      if (!state.models.some(model => model.route === route && model.available)) throw new Error(`현재 사용할 수 없는 모델입니다: ${route}`);
+      const profile = moveDesktopRoute(state.profile, route, familyRaw, flags.includes("--default"));
+      config.claudeCode = { ...(config.claudeCode ?? {}), desktopProfile: profile };
+      saveConfigPreservingClaudeCode(config);
+      console.log(`${route} 모델을 ${familyRaw} 그룹으로 옮겼습니다.`);
+      return 0;
+    }
+    if (command === "default") {
+      const [, familyRaw, routeRaw] = argv;
+      if (!isFamily(familyRaw) || !routeRaw || argv.length !== 3) throw new Error("Usage: ocx claude desktop default <family> <route|none>");
+      const route = routeRaw === "none" ? null : routeRaw;
+      if (route && !state.models.some(model => model.route === route && model.available)) throw new Error(`현재 사용할 수 없는 모델입니다: ${route}`);
+      const profile = setDesktopFamilyDefault(state.profile, familyRaw, route);
+      config.claudeCode = { ...(config.claudeCode ?? {}), desktopProfile: profile };
+      saveConfigPreservingClaudeCode(config);
+      console.log(`${familyRaw} 기본 모델을 ${route ?? "없음"}으로 지정했습니다.`);
+      return 0;
+    }
+    if (command === "export") {
+      const target = argv[1];
+      if (!target || argv.length !== 2) throw new Error("Usage: ocx claude desktop export <path|->");
+      const json = JSON.stringify(state.profile, null, 2) + "\n";
+      if (target === "-") process.stdout.write(json);
+      else writeFileSync(resolve(target), json, { encoding: "utf8", mode: 0o600 });
+      return 0;
+    }
+    if (command === "import") {
+      const source = argv[1];
+      const flags = argv.slice(2);
+      if (!source || flags.some(flag => flag !== "--apply")) throw new Error("Usage: ocx claude desktop import <path> [--apply]");
+      const profile = parseDesktopProfile(JSON.parse(readFileSync(resolve(source), "utf8")));
+      const reconciled = (await buildClaudeDesktopState(config, profile)).profile;
+      config.claudeCode = { ...(config.claudeCode ?? {}), desktopProfile: reconciled };
+      saveConfigPreservingClaudeCode(config);
+      if (flags.includes("--apply")) {
+        const result = await applyProfile(reconciled, "static");
+        if (!result.ok) { console.error(`프로필은 저장했지만 Desktop 적용에 실패했습니다: ${result.reason ?? "unknown error"}`); return 1; }
+      }
+      console.log("Claude Desktop 프로필을 가져왔습니다.");
+      return 0;
+    }
+    printDesktopHelp();
+    return 1;
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    return 1;
+  }
+}

package/src/cli/claude.ts

@@ -14,19 +14,39 @@ import { refreshGatewayModelCacheFromProxy } from "../claude/gateway-cache";
 import { commandInvocation } from "../lib/win-exec";
 import { findLiveProxy } from "../server/proxy-liveness";
 import type { OcxConfig } from "../types";
+import { PROXY_MARKER, ownAdmissionTokens, defaultAuthDetectDeps, detectClaudeAuth, type AuthDetectDeps } from "../claude/auth-detect";
+import { resolveClaudeAuthMode } from "../claude/auth-mode";
 
 export interface ClaudeLaunchEnv {
   [key: string]: string | undefined;
 }
 
+/**
+ * Injectable IO for tests. `env` is deliberately NOT injectable: it is bound to the
+ * launch base so detection and the spawned process can never disagree (audit R3-3).
+ */
+export type ClaudeEnvDeps = { authDetect?: Omit<Partial<AuthDetectDeps>, "env" | "ownTokens"> };
+
 /**
  * Pure env assembly (unit-tested): never sets ANTHROPIC_API_KEY (setting both
  * token vars triggers Claude Code's auth-conflict warning, 003 E1), and never
  * overrides variables the user already exported, apart from stale loopback
  * ANTHROPIC_BASE_URL values owned by a previous opencodex launch.
  */
-export function buildClaudeEnv(config: OcxConfig, port: number, base: ClaudeLaunchEnv, contextWindows: Record<string, number> = {}): ClaudeLaunchEnv {
+export function buildClaudeEnv(
+  config: OcxConfig,
+  port: number,
+  base: ClaudeLaunchEnv,
+  contextWindows: Record<string, number> = {},
+  deps: ClaudeEnvDeps = {},
+): ClaudeLaunchEnv {
   const env: ClaudeLaunchEnv = { ...base };
+  // Step 1 — strip OUR OWN dummy from the inherited environment before anything reads
+  // or writes the token slot. setDefault below preserves any non-empty value, so a
+  // stale marker left in place would suppress the admission key and then be removed,
+  // leaving the child with no token at all (audit R2-1). It is opencodex state, never
+  // user auth, so dropping it unconditionally is safe.
+  if (env.ANTHROPIC_AUTH_TOKEN === PROXY_MARKER) delete env.ANTHROPIC_AUTH_TOKEN;
   const setDefault = (name: string, value: string | undefined) => {
     if (value === undefined || value.length === 0) return;
     if (env[name] !== undefined && env[name] !== "") return; // user wins
@@ -55,8 +75,22 @@ export function buildClaudeEnv(config: OcxConfig, port: number, base: ClaudeLaun
   if ((config.apiKeys?.length ?? 0) > 0) {
     setDefault("ANTHROPIC_AUTH_TOKEN", config.apiKeys![0].key);
   }
-  if (!env.ANTHROPIC_AUTH_TOKEN && config.claudeCode?.authMode === "proxy") {
-    env.ANTHROPIC_AUTH_TOKEN = "opencodex-proxy";
+  // Detection reads the SAME base env this launch will use, so the resolver and the
+  // spawned process cannot disagree. Injected deps are spread FIRST and `env` bound
+  // LAST, and the injection type excludes `env`, so a test fake cannot break that.
+  // `ownTokens` is bound last for the same reason: it is config-derived, and a fake
+  // that replaced it could make our own admission key look like user auth.
+  const resolved = resolveClaudeAuthMode(config, detectClaudeAuth({
+    ...defaultAuthDetectDeps(base as NodeJS.ProcessEnv),
+    ...(deps.authDetect ?? {}),
+    env: () => base as NodeJS.ProcessEnv,
+    ownTokens: ownAdmissionTokens(config),
+  }));
+  if (!env.ANTHROPIC_AUTH_TOKEN && resolved.markerMode === "proxy") {
+    env.ANTHROPIC_AUTH_TOKEN = PROXY_MARKER;
+  }
+  if (resolved.origin === "auto-unknown") {
+    console.error("⚠ Claude 인증을 확인하지 못했습니다 — 구독 방식으로 진행합니다. GUI에서 인증 모드를 직접 지정하면 이 판단을 덮어쓸 수 있습니다.");
   }
   // NOTE: do NOT set _CLAUDE_CODE_ASSUME_FIRST_PARTY_BASE_URL here. While it enables
   // Design/Remote Control, it DISABLES gateway model discovery (Claude Code's eligibility