@bitkyc08/opencodex 2.7.43-preview.20260728 → 2.8.0

package/src/server/management/oauth-account-routes.ts

@@ -10,6 +10,8 @@ import {
   multiAgentGuidanceEnabled,
   providerBaseUrlConfigError,
   providerHeadersConfigError,
+  readConfigDiagnostics,
+  reconcileLiveConfigFromDisk,
   saveConfigPreservingClaudeCode,
 } from "../../config";
 import {
@@ -19,7 +21,6 @@ import {
   listOAuthProviders,
   startLoginFlow,
   submitManualLoginCode,
-  upsertOAuthProvider,
 } from "../../oauth";
 import { removeCredential } from "../../oauth/store";
 import { providerDestinationResolvedError } from "../../lib/destination-policy";
@@ -27,9 +28,15 @@ import { enrichProviderFromCatalog, listKeyLoginProviders } from "../../oauth/ke
 import { deriveProviderPresets } from "../../providers/derive";
 import { providerCodexAccountMode } from "../../providers/registry";
 import { routedSlug, slugEquals } from "../../providers/slug-codec";
-import { clearProviderQuotaCache, fetchProviderQuotaReports } from "../../providers/quota";
+import { clearProviderQuotaCache, fetchProviderAccountQuotas, fetchProviderQuotaReports, supportsPerAccountQuota } from "../../providers/quota";
 import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
 import { clearThreadAccountMap } from "../../codex/routing";
+import {
+  normalizeAccountPoolStickyLimit,
+  normalizeAccountPoolStrategy,
+  parseAccountPoolStickyLimit,
+  parseAccountPoolStrategy,
+} from "../../codex/pool-rotation";
 import { primeCodexPoolQuotas } from "../../codex/auth-api";
 import { DEFAULT_PROVIDER_CONTEXT_CAP, globalContextCapValue, providerContextCap, providerContextCaps, setAllProviderContextCaps, setGlobalContextCapValue, setProviderContextCap } from "../../providers/context-cap";
 import { resolveCodexHomeDir } from "../../codex/home";
@@ -59,6 +66,7 @@ import { buildApiAccessEndpoints } from "./api-access";
 import { isPlainRecord, parseDebugLogQuery, tokPerSecondResult, unavailableCostReason, costResult, requestLogDto, stripRegistryOnlyStaticHeaders, fetchAllModels } from "./shared";
 import type { MetricUnavailableReason, TokPerSecondResult, CostEstimateReason, CostResult, MetricSource } from "./shared";
 import type { ManagementContext } from "./context";
+import { codexAccountNamespaceProviderCollisionError } from "../../codex/account-namespace-match";
 
 export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<Response | null> {
   const { req, url, config, deps, refreshCodexCatalogBestEffort, syncClaudeAgentDefsBestEffort } = ctx;
@@ -80,6 +88,8 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     const body = await req.json().catch(() => ({})) as { provider?: string; addAccount?: boolean; accountId?: string; reauth?: boolean };
     const provider = (body.provider ?? "").trim().toLowerCase();
     if (!isPublicOAuthProvider(provider)) return jsonResponse({ error: "unknown oauth provider" }, 400);
+    const namespaceCollision = codexAccountNamespaceProviderCollisionError(config.codexAccountNamespaces, provider);
+    if (namespaceCollision) return jsonResponse({ error: namespaceCollision }, 409);
     const accountId = body.accountId?.trim();
     const reauth = body.reauth === true || Boolean(accountId);
     try {
@@ -90,12 +100,19 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
           return jsonResponse({ error: "Unknown account for reauth" }, 404);
         }
       }
+      // Use persisted state, not the live object, as the merge base: another management
+      // request may already have mutated live config and yielded before its save.
+      const persistedBaseline = readConfigDiagnostics().config;
       // addAccount / reauth forces a fresh browser identity (skips local-CLI token import).
       const { url: authUrl, instructions, deviceCode } = await startLoginFlow(provider, {
         forceLogin: body.addAccount === true || reauth,
         ...(accountId ? { reauthAccountId: accountId } : {}),
+      }, {
+        // startLoginFlow returns the authorization URL before background persistence completes.
+        // Three-way reconcile settled disk changes so a failed login cannot leave a provider
+        // live-only and an in-flight management mutation cannot be erased before it saves.
+        onSettled: () => reconcileLiveConfigFromDisk(config, persistedBaseline),
       });
-      upsertOAuthProvider(config, provider); // mutate LIVE config — routing sees it without restart
       if (authUrl && !deviceCode) {
         // Open the browser server-side (the proxy runs on the user's machine) — the GUI's
         // window.open is popup-blocked because it runs after an await, not a direct click.
@@ -146,8 +163,9 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     await removeCredential(provider);
     clearLoginState(provider);
     // Drop cached/last-good quota rows tied to the removed credential.
-    const { clearProviderQuotaCache } = await import("../../providers/quota");
+    const { clearProviderQuotaCache, clearAccountQuotaCache } = await import("../../providers/quota");
     clearProviderQuotaCache();
+    clearAccountQuotaCache(provider);
     return jsonResponse({ success: true });
   }
 
@@ -163,18 +181,46 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
       projectOAuthAccountHealth,
       projectStoredOAuthAccountHealth,
     } = await import("../../oauth/health");
-    const set = getAccountSet(provider);
-    const accounts = (status.accounts ?? []).map(summary => {
-      const full = set?.accounts.find(account => account.id === summary.id);
-      const health = full
-        ? projectStoredOAuthAccountHealth(provider, full)
-        : projectOAuthAccountHealth({
-          needsReauth: summary.needsReauth === true,
-          reauthReason: summary.needsReauth === true ? "refresh_failed" : undefined,
-        });
-      return { ...summary, ...oauthAccountHealthFields(provider, summary.id, health) };
+    const projectAccounts = () => {
+      const set = getAccountSet(provider);
+      const current = getLoginStatus(provider);
+      return {
+        activeAccountId: current.activeAccountId ?? null,
+        accounts: (current.accounts ?? []).map(summary => {
+          const full = set?.accounts.find(account => account.id === summary.id);
+          const health = full
+            ? projectStoredOAuthAccountHealth(provider, full)
+            : projectOAuthAccountHealth({
+              needsReauth: summary.needsReauth === true,
+              reauthReason: summary.needsReauth === true ? "refresh_failed" : undefined,
+            });
+          return { ...summary, ...oauthAccountHealthFields(provider, summary.id, health) };
+        }),
+      };
+    };
+    // Per-account rate limits: Anthropic reports usage per credential, so every logged-in
+    // account can show its own 5h/weekly bars (not just the active one). Opt-in via ?quota=1
+    // so the plain account list stays a cheap local read; ?refresh=1 bypasses the TTL.
+    const wantQuota = url.searchParams.get("quota") === "1" && supportsPerAccountQuota(provider);
+    if (!wantQuota) return jsonResponse(projectAccounts());
+    const forceRefresh = url.searchParams.get("refresh") === "1";
+    // Probing may refresh the active credential and mark needsReauth — project health
+    // from the post-probe store so the response is not stale.
+    const rows = await fetchProviderAccountQuotas(provider, forceRefresh);
+    const byId = new Map(rows.map(row => [row.accountId, row]));
+    const projected = projectAccounts();
+    return jsonResponse({
+      activeAccountId: projected.activeAccountId,
+      accounts: projected.accounts.map(account => {
+        const row = byId.get(account.id);
+        if (!row) return account;
+        return {
+          ...account,
+          quota: row.quota,
+          ...(row.unavailable ? { quotaUnavailable: true } : {}),
+        };
+      }),
     });
-    return jsonResponse({ activeAccountId: status.activeAccountId ?? null, accounts });
   }
   if (url.pathname === "/api/oauth/accounts/active" && req.method === "PUT") {
     const body = await req.json().catch(() => ({})) as { provider?: string; accountId?: string };
@@ -183,10 +229,104 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     if (!body.accountId) return jsonResponse({ error: "missing accountId" }, 400);
     const { setActiveAccount } = await import("../../oauth/store");
     if (!(await setActiveAccount(provider, body.accountId))) return jsonResponse({ error: "account not found" }, 404);
+    if (provider === "anthropic") {
+      const { resetAnthropicRoutingForManualSelection } = await import("../../oauth/anthropic-routing");
+      resetAnthropicRoutingForManualSelection(body.accountId);
+    }
     const { clearProviderQuotaCache } = await import("../../providers/quota");
     clearProviderQuotaCache();
     return jsonResponse({ ok: true, provider, activeAccountId: body.accountId });
   }
+
+  // Opt-in Anthropic OAuth account pool (#294): enable/threshold/strategy + clear cooldown.
+  if (url.pathname === "/api/oauth/accounts/pool" && req.method === "GET") {
+    const provider = (url.searchParams.get("provider") ?? "").trim().toLowerCase();
+    if (provider !== "anthropic") return jsonResponse({ error: "pool config is only supported for anthropic" }, 400);
+    const pool = config.anthropicAccountPool ?? {};
+    return jsonResponse({
+      provider,
+      enabled: pool.enabled === true,
+      autoSwitchThreshold: typeof pool.autoSwitchThreshold === "number" ? pool.autoSwitchThreshold : 80,
+      strategy: normalizeAccountPoolStrategy(pool.strategy),
+      stickyLimit: normalizeAccountPoolStickyLimit(pool.stickyLimit),
+      experimental: true,
+    });
+  }
+  if (url.pathname === "/api/oauth/accounts/pool" && (req.method === "PUT" || req.method === "PATCH")) {
+    const parsedBody = await req.json().catch(() => ({}));
+    if (!isPlainRecord(parsedBody)) {
+      return jsonResponse({ error: "body must be an object" }, 400);
+    }
+    const body = parsedBody as {
+      provider?: unknown;
+      enabled?: unknown;
+      autoSwitchThreshold?: unknown;
+      strategy?: unknown;
+      stickyLimit?: unknown;
+    };
+    const provider = typeof body.provider === "string" ? body.provider.trim().toLowerCase() : "";
+    if (provider !== "anthropic") return jsonResponse({ error: "pool config is only supported for anthropic" }, 400);
+    let enabled = config.anthropicAccountPool?.enabled === true;
+    if (body.enabled !== undefined) {
+      if (typeof body.enabled !== "boolean") return jsonResponse({ error: "enabled must be a boolean" }, 400);
+      enabled = body.enabled;
+    }
+    let threshold = config.anthropicAccountPool?.autoSwitchThreshold ?? 80;
+    if (body.autoSwitchThreshold !== undefined) {
+      if (
+        typeof body.autoSwitchThreshold !== "number"
+        || !Number.isInteger(body.autoSwitchThreshold)
+        || body.autoSwitchThreshold < 0
+        || body.autoSwitchThreshold > 100
+      ) {
+        return jsonResponse({ error: "autoSwitchThreshold must be an integer 0-100" }, 400);
+      }
+      threshold = body.autoSwitchThreshold;
+    }
+    let strategy = config.anthropicAccountPool?.strategy;
+    if (body.strategy !== undefined) {
+      const parsed = parseAccountPoolStrategy(body.strategy);
+      if (parsed === null) {
+        return jsonResponse({ error: "strategy must be one of: quota, round-robin, fill-first" }, 400);
+      }
+      strategy = parsed;
+    }
+    let stickyLimit = config.anthropicAccountPool?.stickyLimit;
+    if (body.stickyLimit !== undefined) {
+      const parsed = parseAccountPoolStickyLimit(body.stickyLimit);
+      if (parsed === null) {
+        return jsonResponse({ error: "stickyLimit must be an integer 1-100" }, 400);
+      }
+      stickyLimit = parsed;
+    }
+    config.anthropicAccountPool = {
+      enabled,
+      autoSwitchThreshold: threshold,
+      ...(strategy !== undefined ? { strategy } : {}),
+      ...(stickyLimit !== undefined ? { stickyLimit } : {}),
+    };
+    saveConfigPreservingClaudeCode(config);
+    return jsonResponse({
+      ok: true,
+      provider,
+      enabled,
+      autoSwitchThreshold: threshold,
+      strategy: normalizeAccountPoolStrategy(strategy),
+      stickyLimit: normalizeAccountPoolStickyLimit(stickyLimit),
+      experimental: true,
+    });
+  }
+  if (url.pathname === "/api/oauth/accounts/clear-cooldown" && req.method === "POST") {
+    const body = await req.json().catch(() => ({})) as { provider?: unknown; accountId?: unknown };
+    const provider = typeof body.provider === "string" ? body.provider.trim().toLowerCase() : "";
+    const accountId = typeof body.accountId === "string" ? body.accountId.trim() : "";
+    if (provider !== "anthropic") return jsonResponse({ error: "clear-cooldown is only supported for anthropic" }, 400);
+    if (!accountId) return jsonResponse({ error: "missing accountId" }, 400);
+    const { clearAnthropicAccountCooldown } = await import("../../oauth/anthropic-routing");
+    const cleared = clearAnthropicAccountCooldown(accountId);
+    return jsonResponse({ ok: true, cleared });
+  }
+
   if (url.pathname === "/api/oauth/accounts/alias" && req.method === "PUT") {
     const body = await req.json().catch(() => ({})) as { provider?: unknown; accountId?: unknown; alias?: unknown };
     const provider = typeof body.provider === "string" ? body.provider.trim().toLowerCase() : "";
@@ -208,9 +348,15 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     if (!id) return jsonResponse({ error: "missing id" }, 400);
     const { removeAccount, getAccountSet } = await import("../../oauth/store");
     if (!(await removeAccount(provider, id))) return jsonResponse({ error: "account not found" }, 404);
+    if (provider === "anthropic") {
+      const { clearAnthropicAccountCooldown, clearAnthropicSessionAffinityForAccount } = await import("../../oauth/anthropic-routing");
+      clearAnthropicAccountCooldown(id);
+      clearAnthropicSessionAffinityForAccount(id);
+    }
     if (!getAccountSet(provider)) clearLoginState(provider);
-    const { clearProviderQuotaCache } = await import("../../providers/quota");
+    const { clearProviderQuotaCache, clearAccountQuotaCache } = await import("../../providers/quota");
     clearProviderQuotaCache();
+    clearAccountQuotaCache(provider);
     return jsonResponse({ ok: true });
   }
 
@@ -308,7 +454,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     const salt = crypto.randomUUID();
     const hashInput = `${providerKeys}|${salt}|${Date.now()}`;
     const hashBuf = new Bun.CryptoHasher("sha256").update(hashInput).digest();
-    const key = "ocx_" + Buffer.from(hashBuf).toString("hex").slice(0, 40);
+    const key = "ocx_data_" + Buffer.from(hashBuf).toString("hex").slice(0, 40);
     const entry = { id: crypto.randomUUID(), name, key, createdAt: new Date().toISOString() };
     config.apiKeys = [...(config.apiKeys ?? []), entry];
     saveConfigPreservingClaudeCode(config);

package/src/server/management/provider-routes.ts

@@ -23,12 +23,20 @@ import {
 } from "../../oauth";
 import { removeCredential } from "../../oauth/store";
 import { providerDestinationResolvedError } from "../../lib/destination-policy";
+import { ProviderOutboundPolicyError, providerOutboundGet, providerRedirectError } from "../../lib/provider-outbound";
 import { enrichProviderFromCatalog, listKeyLoginProviders } from "../../oauth/key-providers";
 import { deriveProviderPresets } from "../../providers/derive";
 import { providerCodexAccountMode } from "../../providers/registry";
+import {
+  extractModelEnvelopeRows,
+  extractProviderModelItems,
+  readBoundedDiscoveryJson,
+  resolveProviderModelDiscovery,
+} from "../../providers/model-discovery";
 import { routedSlug, slugEquals } from "../../providers/slug-codec";
 import { clearProviderQuotaCache, fetchProviderQuotaReports } from "../../providers/quota";
 import { CODEX_FORWARD_BASE_URL, isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
+import { codexAccountNamespaceProviderCollisionError } from "../../codex/account-namespace-match";
 import { clearThreadAccountMap } from "../../codex/routing";
 import { primeCodexPoolQuotas } from "../../codex/auth-api";
 import { getProviderDiscoveryStatus } from "../../codex/model-cache";
@@ -76,6 +84,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       liveModels: p.liveModels !== false,
       models: p.models ?? [],
       authMode: p.authMode,
+      apiKeyTransport: p.apiKeyTransport,
       disabled: p.disabled === true,
       codexAccountMode: providerCodexAccountMode(name, p),
       discovery: p.liveModels === false ? undefined : getProviderDiscoveryStatus(name),
@@ -98,6 +107,10 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     if (!isValidProviderName(name)) {
       return jsonResponse({ error: "provider name must use letters, numbers, dot, underscore, or hyphen and cannot be a reserved object key" }, 400);
     }
+    const namespaceCollision = codexAccountNamespaceProviderCollisionError(config.codexAccountNamespaces, name);
+    if (namespaceCollision) {
+      return jsonResponse({ error: namespaceCollision }, 409);
+    }
     // Hostname destinations additionally get a DNS-resolved SSRF check at write time —
     // the sync check above only classifies literal IPs (review finding, PR #96).
     // Canonical openai still runs the resolver: only Clash fake-IP (198.18.0.0/15)
@@ -213,6 +226,18 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
         return jsonResponse({ error: "authMode must be key, forward, oauth, or local" }, 400);
       }
     }
+    if (Object.hasOwn(rawBody, "apiKeyTransport")) {
+      const transport = rawBody.apiKeyTransport;
+      if (transport === "x-api-key" || transport === "bearer") {
+        next.apiKeyTransport = transport;
+        touched = true;
+      } else if (transport === "") {
+        delete next.apiKeyTransport;
+        touched = true;
+      } else {
+        return jsonResponse({ error: "apiKeyTransport must be x-api-key, bearer, or empty to clear" }, 400);
+      }
+    }
    if (Object.hasOwn(rawBody, "note")) {
      if (typeof rawBody.note !== "string") return jsonResponse({ error: "note must be a string" }, 400);
      const note = rawBody.note.trim();
@@ -319,23 +344,59 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       return jsonResponse({ ok: false, latencyMs: 0, error: "static catalog only — upstream not verified (not logged in)" });
     }
     const { url: modelsUrl, headers } = buildModelsRequest(prov, apiKey, name);
+    const discovery = resolveProviderModelDiscovery(name, prov);
     const started = Date.now();
     try {
-      const res = await fetch(modelsUrl, { headers, signal: AbortSignal.timeout(8000) });
+      const res = await providerOutboundGet(name, prov, modelsUrl, {
+        headers,
+        signal: AbortSignal.timeout(8000),
+      });
       const latencyMs = Date.now() - started;
+      const redirectError = await providerRedirectError(res, modelsUrl);
+      if (redirectError) {
+        return jsonResponse({
+          ok: false,
+          latencyMs,
+          error: redirectError,
+        });
+      }
       if (!res.ok) {
+        try {
+          void res.body?.cancel().catch(() => undefined);
+        } catch {
+          // Best-effort release for non-conforming response streams.
+        }
         return jsonResponse({ ok: false, latencyMs, error: `upstream /models returned ${res.status}` });
       }
-      const json = await res.json().catch(() => null) as { data?: unknown; models?: unknown } | null;
-      // OpenAI-style lists use { data: [...] }; Google's /v1beta/models (the other shape
-      // buildModelsRequest can produce) returns { models: [...] }.
-      const list = json && typeof json === "object" && !Array.isArray(json)
-        ? (Array.isArray(json.data) ? json.data : Array.isArray(json.models) ? json.models : undefined)
+      const bounded = await readBoundedDiscoveryJson(res, discovery.maxResponseBytes);
+      if (!bounded.ok) {
+        return jsonResponse({
+          ok: false,
+          latencyMs,
+          error: bounded.reason === "response_too_large"
+            ? `upstream /models exceeded the ${discovery.maxResponseBytes}-byte response limit`
+            : "upstream /models returned invalid JSON",
+        });
+      }
+      // OpenAI-style lists (and Together top-level arrays) use the same validation/dedupe/filter
+      // as catalog discovery. Google's /v1beta/models uses `models[].name` and remains a
+      // connectivity-only count because it is not an authoritative catalog source.
+      const record = bounded.value !== null && typeof bounded.value === "object" && !Array.isArray(bounded.value)
+        ? bounded.value as Record<string, unknown>
         : undefined;
-      if (!Array.isArray(list)) {
-        return jsonResponse({ ok: false, latencyMs, error: "upstream /models returned an unexpected shape" });
+      const extracted = Array.isArray(bounded.value) || Array.isArray(record?.data)
+        ? extractProviderModelItems(bounded.value, discovery)
+        : extractModelEnvelopeRows(bounded.value, discovery.maxModels, ["models"]);
+      if (!extracted.ok) {
+        return jsonResponse({
+          ok: false,
+          latencyMs,
+          error: extracted.reason === "too_many_models"
+            ? `upstream /models exceeded the ${discovery.maxModels}-row model limit`
+            : "upstream /models returned an unexpected shape",
+        });
       }
-      const models = list.length;
+      const models = "items" in extracted ? extracted.items.length : extracted.rows.length;
       return jsonResponse({
         ok: true,
         latencyMs,
@@ -346,7 +407,9 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       return jsonResponse({
         ok: false,
         latencyMs: Date.now() - started,
-        error: err instanceof Error ? err.message : "Connection test failed",
+        error: err instanceof ProviderOutboundPolicyError
+          ? `upstream /models blocked by destination policy: ${err.message}`
+          : err instanceof Error ? err.message : "Connection test failed",
       });
     }
   }

package/src/server/management/shared.ts

@@ -37,7 +37,7 @@ import { readUsageEntries } from "../../usage/log";
 import { getUsageDebugLogEntries } from "../../usage/debug";
 import { parseRange, parseUsageSurface, summarizeUsage } from "../../usage/summary";
 import { stripCodexRuntimeProviderFields } from "../../codex/auth-context";
-import { getProviderRegistryEntry } from "../../providers/registry";
+import { getProviderRegistryEntry, providerMatchesRegistryTransport } from "../../providers/registry";
 import { getDebugLogEntries } from "../../lib/debug-log-buffer";
 import { getInjectionDebugLogEntries } from "../../lib/injection-debug-log";
 import {
@@ -201,7 +201,7 @@ export async function fetchGrokCandidateModels(config: OcxConfig): Promise<GrokC
 }
 
 export function stripRegistryOnlyStaticHeaders(name: string, provider: OcxProviderConfig): OcxProviderConfig {
-  const entry = getProviderRegistryEntry(name);
+  const entry = providerMatchesRegistryTransport(name, provider) ? getProviderRegistryEntry(name) : undefined;
   if (!entry?.staticHeaders || !provider.headers) return provider;
   const headerEntries = Object.entries(provider.headers);
   const staticEntries = Object.entries(entry.staticHeaders);

package/src/server/management/sidebar-routes.ts

@@ -0,0 +1,39 @@
+/**
+ * /api/github/star and /api/update/badge — the two cheap polls behind the
+ * sidebar's GitHub star and update controls.
+ *
+ * Both ride the standard management gate (auth + origin check happen before
+ * dispatch), and both are scalar-only: a star state enum, a repo slug, version
+ * strings, and a fixed error code. No GitHub token, account login, or raw `gh`/npm
+ * output is ever serialized here — starring runs through the user's own `gh` CLI and
+ * this surface only learns the yes/no answer. `gh` writes the authenticated account
+ * name to stderr, so that output is discarded at the source rather than forwarded.
+ */
+import { jsonResponse } from "../auth-cors";
+import type { ManagementContext } from "./context";
+
+export async function handleSidebarRoutes(ctx: ManagementContext): Promise<Response | null> {
+  const { req, url } = ctx;
+
+  if (url.pathname === "/api/github/star" && req.method === "GET") {
+    const { getStarStatus } = await import("../../github/star-state");
+    return jsonResponse(await getStarStatus());
+  }
+
+  if (url.pathname === "/api/github/star" && req.method === "POST") {
+    const { starRepository } = await import("../../github/star-state");
+    const result = await starRepository();
+    return jsonResponse({
+      ...result.status,
+      ok: result.ok,
+      ...(result.code ? { code: result.code } : {}),
+    });
+  }
+
+  if (url.pathname === "/api/update/badge" && req.method === "GET") {
+    const { readUpdateBadge } = await import("../../update/badge");
+    return jsonResponse(readUpdateBadge());
+  }
+
+  return null;
+}

package/src/server/management/system-restart.ts

@@ -0,0 +1,172 @@
+/**
+ * Dashboard memory-card drain-and-restart (#563).
+ *
+ * Longer than POST /api/stop's short drain: waits up to 60s for active turns,
+ * then respawns. Never runs restoreNativeCodex / stripGrokConfig — this is a
+ * recycle to reclaim RSS, not a teardown.
+ *
+ * Respawn policy (matches real supervisor configs in src/service.ts):
+ * - Supervised child (`OCX_SERVICE=1` + service installed): exit(1) so
+ *   failure-only supervisors (systemd Restart=on-failure, WinSW onfailure,
+ *   Task Scheduler ERRORLEVEL loop) bring the proxy back.
+ * - Otherwise: detached `ocx start --port <live>` (bypasses ensure's
+ *   codexAutoStart gate), mark recycle so exit cleanup keeps injection, exit(0).
+ * - If detached spawn fails (sync throw or pre-start `error`): exit(1) without
+ *   markRecycling — after drain the listen socket is already closed, so a latch
+ *   reset cannot recover serving. Clear inherited `OCX_SERVICE` so exit cleanup
+ *   can restore Codex/Grok fences (ensure/tray daemons set the marker without a
+ *   real supervisor). Log only a stable errno code — never the raw message
+ *   (paths in ENOENT often include the OS username).
+ */
+import { spawn } from "node:child_process";
+import {
+  drainAndShutdown,
+  getActiveTurnCount,
+  getServerListenPort,
+  isDraining,
+  markRecyclingForExit,
+  setDraining,
+} from "../lifecycle";
+import { isServiceInstalled } from "../../service";
+import { readRuntimePort } from "../../config";
+
+/** Fixed v1 drain window for the memory-card action (not config-driven). */
+export const MEMORY_DRAIN_RESTART_MS = 60_000;
+
+export interface SystemRestartIo {
+  drainAndShutdown?: typeof drainAndShutdown;
+  isServiceInstalled?: () => boolean;
+  isSupervisedServiceChild?: () => boolean;
+  /** Must resolve only after the replacement process has actually started. */
+  spawnStart?: (port?: number) => void | Promise<void>;
+  markRecycling?: () => void;
+  exitProcess?: (code: number) => void;
+  schedule?: (fn: () => void | Promise<void>, ms: number) => void;
+  isDraining?: () => boolean;
+  setDraining?: (value: boolean) => void;
+  getActiveTurnCount?: () => number;
+  listenPort?: () => number | undefined;
+}
+
+let restartIo: SystemRestartIo = {};
+/** Prevents double-scheduling in the 200ms window before drainAndShutdown sets draining. */
+let restartAccepted = false;
+
+/** Test seam — reset between tests. */
+export function setSystemRestartIoForTests(io: SystemRestartIo = {}): void {
+  restartIo = io;
+  restartAccepted = false;
+}
+
+function resolveListenPort(): number | undefined {
+  const live = getServerListenPort();
+  if (live) return live;
+  const runtime = readRuntimePort(process.pid);
+  if (runtime && runtime.port > 0) return runtime.port;
+  return undefined;
+}
+
+function isSupervisedServiceChild(): boolean {
+  return process.env.OCX_SERVICE === "1" && isServiceInstalled();
+}
+
+/** Stable, path-free spawn failure label for logs (never interpolate err.message). */
+function spawnFailureCode(err: unknown): string {
+  if (err && typeof err === "object" && "code" in err) {
+    const code = (err as NodeJS.ErrnoException).code;
+    if (typeof code === "string" && code.length > 0 && code.length <= 64) return code;
+  }
+  return "spawn_failed";
+}
+
+function spawnDetachedStart(port?: number): Promise<void> {
+  const args = [process.argv[1], "start"];
+  if (typeof port === "number" && Number.isFinite(port) && port > 0 && port <= 65535) {
+    args.push("--port", String(Math.trunc(port)));
+  }
+  return new Promise<void>((resolve, reject) => {
+    let child: ReturnType<typeof spawn>;
+    try {
+      child = spawn(process.execPath, args, {
+        detached: true,
+        stdio: "ignore",
+        windowsHide: true,
+        env: { ...process.env, OCX_SERVICE: "1" },
+      });
+    } catch (err) {
+      reject(err);
+      return;
+    }
+    let settled = false;
+    const finish = (fn: () => void) => {
+      if (settled) return;
+      settled = true;
+      fn();
+    };
+    child.once("error", (err) => {
+      finish(() => reject(err));
+    });
+    child.once("spawn", () => {
+      finish(() => {
+        child.unref();
+        resolve();
+      });
+    });
+  });
+}
+
+/**
+ * Accept a drain-and-restart request. Returns immediately; the drain +
+ * respawn runs on a short timer so the HTTP response can flush first.
+ * Idempotent while already draining: returns the accepted shape again.
+ */
+export function acceptSystemRestart(io: SystemRestartIo = restartIo): {
+  accepted: true;
+  alreadyDraining: boolean;
+  activeTurnCount: number;
+  drainTimeoutMs: number;
+} {
+  const alreadyDraining = restartAccepted || (io.isDraining ?? isDraining)();
+  const activeTurnCount = (io.getActiveTurnCount ?? getActiveTurnCount)();
+  const schedule = io.schedule ?? ((fn, ms) => { setTimeout(() => { void fn(); }, ms); });
+
+  if (!alreadyDraining) {
+    restartAccepted = true;
+    // Reject new data-plane traffic immediately (503), before the 200ms response-flush delay.
+    (io.setDraining ?? setDraining)(true);
+    schedule(async () => {
+      const drain = io.drainAndShutdown ?? drainAndShutdown;
+      await drain(undefined, MEMORY_DRAIN_RESTART_MS);
+      const supervised = (io.isSupervisedServiceChild ?? isSupervisedServiceChild)();
+      if (supervised) {
+        // Failure-only supervisors ignore exit(0); intentional non-zero triggers respawn.
+        (io.exitProcess ?? ((code: number) => { process.exit(code); }))(1);
+        return;
+      }
+      const port = (io.listenPort ?? resolveListenPort)();
+      const exitProcess = io.exitProcess ?? ((code: number) => { process.exit(code); });
+      try {
+        await (io.spawnStart ?? spawnDetachedStart)(port);
+      } catch (err) {
+        console.warn(
+          `⚠️  Drain-and-restart spawn failed (${spawnFailureCode(err)}); exiting without replacement`,
+        );
+        // Listen socket is already stopped; do not markRecycling — no child to inherit fences.
+        // ensure/tray children inherit OCX_SERVICE=1 without an installed service; clear it so
+        // syncCleanup can restore Codex/Grok fences instead of leaving clients pointed at a dead port.
+        delete process.env.OCX_SERVICE;
+        exitProcess(1);
+        return;
+      }
+      (io.markRecycling ?? markRecyclingForExit)();
+      exitProcess(0);
+    }, 200);
+  }
+
+  return {
+    accepted: true,
+    alreadyDraining,
+    activeTurnCount,
+    drainTimeoutMs: MEMORY_DRAIN_RESTART_MS,
+  };
+}