@bitkyc08/opencodex 2.7.9-preview.20260712 → 2.7.9-preview.20260712.2

package/src/server/claude-messages.ts

@@ -178,15 +178,21 @@ async function anthropicNativePassthrough(
   });
   headers.set("content-type", "application/json");
 
+  const timeoutSignal = AbortSignal.timeout(config.connectTimeoutMs ?? 120_000);
+  const upstreamSignal = AbortSignal.any([req.signal, timeoutSignal]);
   let upstream: Response;
   try {
     upstream = await fetch(`${base}${pathname}${search}`, {
       method: "POST",
       headers,
       body: JSON.stringify(body),
-      signal: req.signal,
+      signal: upstreamSignal,
     });
   } catch (err) {
+    if (timeoutSignal.aborted && upstreamSignal.reason === timeoutSignal.reason) {
+      finalize(504, { closeReason: "non_stream" });
+      return anthropicErrorResponse(504, "anthropic passthrough timed out waiting for response headers", "timeout_error");
+    }
     finalize(502, { closeReason: "non_stream" });
     return anthropicErrorResponse(502, `anthropic passthrough failed: ${err instanceof Error ? err.message : String(err)}`, "api_error");
   }

package/src/server/management-api.ts

@@ -19,6 +19,7 @@ import {
   upsertOAuthProvider,
 } from "../oauth";
 import { removeCredential } from "../oauth/store";
+import { providerDestinationResolvedError } from "../lib/destination-policy";
 import { enrichProviderFromCatalog, listKeyLoginProviders } from "../oauth/key-providers";
 import { deriveProviderPresets } from "../providers/derive";
 import { fetchProviderQuotaReports } from "../providers/quota";
@@ -28,6 +29,7 @@ import { getUsageDebugLogEntries } from "../usage/debug";
 import { parseRange, summarizeUsage } from "../usage/summary";
 import { stripCodexRuntimeProviderFields } from "../codex/auth-context";
 import { getDebugLogEntries } from "../lib/debug-log-buffer";
+import { getInjectionDebugLogEntries } from "../lib/injection-debug-log";
 import {
   clearDebugSettings,
   clearDebugSetting,
@@ -39,6 +41,7 @@ import type { OcxConfig, OcxProviderConfig } from "../types";
 import { drainAndShutdown } from "./lifecycle";
 import { filterRequestLogs, getRequestLogEntries } from "./request-log";
 import { isAllowedRequestOrigin, jsonResponse, providerManagementConfigError, publicProviderBaseUrl, safeConfigDTO } from "./auth-cors";
+import { applySystemEnvToggle } from "./system-env";
 
 // Single source of truth = package.json (../ from src/), so /healthz + the GUI badge match the
 // installed npm version instead of a stale hardcode.
@@ -86,6 +89,28 @@ export async function handleManagementAPI(req: Request, url: URL, config: OcxCon
     }
   }
 
+  async function syncClaudeAgentDefsBestEffort(): Promise<void> {
+    try {
+      const { injectClaudeAgentDefs } = await import("../claude/agents-inject");
+      if (config.claudeCode?.enabled === false || config.claudeCode?.injectAgents === false) {
+        injectClaudeAgentDefs(config, {});
+        return;
+      }
+      try {
+        const [models, { buildClaudeContextWindows }, { visibleNativeSlugs }] = await Promise.all([
+          fetchAllModels(config),
+          import("../claude/context-windows"),
+          import("../codex/catalog"),
+        ]);
+        injectClaudeAgentDefs(config, buildClaudeContextWindows([...visibleNativeSlugs(config)], models));
+      } catch {
+        // Keep routes available through a provider-discovery blip. A later
+        // launch-time sync restores any context markers missing from this pass.
+        injectClaudeAgentDefs(config, {});
+      }
+    } catch { /* best-effort */ }
+  }
+
   if (url.pathname === "/api/config" && req.method === "GET") {
     return jsonResponse(safeConfigDTO(config));
   }
@@ -219,6 +244,11 @@ export async function handleManagementAPI(req: Request, url: URL, config: OcxCon
     return jsonResponse({ enabled: isClaudeDebugEnabled(), entries: getClaudeInboundDebugEntries() });
   }
 
+  if (url.pathname === "/api/debug/injection-logs" && req.method === "GET") {
+    const { after, limit } = parseDebugLogQuery(url);
+    return jsonResponse(getInjectionDebugLogEntries({ after, limit }));
+  }
+
   if (url.pathname === "/api/debug" && req.method === "PUT") {
     let body: { debug?: unknown; usage?: unknown; injection?: unknown; claude?: unknown; reset?: unknown };
     try { body = await req.json(); } catch { return jsonResponse({ error: "invalid JSON body" }, 400); }
@@ -287,6 +317,7 @@ export async function handleManagementAPI(req: Request, url: URL, config: OcxCon
     return jsonResponse(Object.entries(config.providers).map(([name, p]) => ({
       name, adapter: p.adapter, baseUrl: publicProviderBaseUrl(p.baseUrl), defaultModel: p.defaultModel,
       hasApiKey: !!p.apiKey,
+      allowPrivateNetwork: p.allowPrivateNetwork === true,
       disabled: p.disabled === true,
     })));
   }
@@ -307,6 +338,10 @@ export async function handleManagementAPI(req: Request, url: URL, config: OcxCon
     }
     const providerError = providerManagementConfigError(name, prov);
     if (providerError) return jsonResponse({ error: providerError }, 400);
+    // Hostname destinations additionally get a DNS-resolved SSRF check at write time —
+    // the sync check above only classifies literal IPs (review finding, PR #96).
+    const resolvedError = await providerDestinationResolvedError(name, prov);
+    if (resolvedError) return jsonResponse({ error: resolvedError }, 400);
     // Catalog providers (e.g. ollama-cloud) carry a models + vision/reasoning classification the GUI
     // doesn't send — merge it in so the sidecars are gated correctly.
     enrichProviderFromCatalog(name, prov);
@@ -645,6 +680,7 @@ export async function handleManagementAPI(req: Request, url: URL, config: OcxCon
     const { saveConfig: save } = await import("../config");
     save(config);
     await refreshCodexCatalogBestEffort();
+    await syncClaudeAgentDefsBestEffort();
     return jsonResponse({ ok: true, applied: chosen });
   }
 
@@ -699,8 +735,15 @@ export async function handleManagementAPI(req: Request, url: URL, config: OcxCon
     // supersede tiers; auto-context supersedes the max-context pair; effort rides
     // regardless on 2.1.207). PUT keeps validating them so hand-written configs
     // and older GUIs stay safe; GUI saves omit them and the spread preserves them.
-    let body: { enabled?: unknown; model?: unknown; smallFastModel?: unknown; modelMap?: unknown; systemEnv?: unknown; fastMode?: unknown; maxContextTokens?: unknown; alwaysEnableEffort?: unknown; tierModels?: unknown; autoContext?: unknown; autoCompactWindow?: unknown; blockedSkills?: unknown; injectAgents?: unknown };
-    try { body = await req.json(); } catch { return jsonResponse({ error: "invalid JSON body" }, 400); }
+    let parsedBody: unknown;
+    try { parsedBody = await req.json(); } catch { return jsonResponse({ error: "invalid JSON body" }, 400); }
+    const isPlainObject = (value: unknown): value is Record<string, unknown> => {
+      if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+      const prototype = Object.getPrototypeOf(value);
+      return prototype === Object.prototype || prototype === null;
+    };
+    if (!isPlainObject(parsedBody)) return jsonResponse({ error: "body must be an object" }, 400);
+    const body = parsedBody as { enabled?: unknown; model?: unknown; smallFastModel?: unknown; modelMap?: unknown; systemEnv?: unknown; fastMode?: unknown; maxContextTokens?: unknown; alwaysEnableEffort?: unknown; tierModels?: unknown; autoContext?: unknown; autoCompactWindow?: unknown; blockedSkills?: unknown; injectAgents?: unknown };
     const next = { ...(config.claudeCode ?? {}) };
     if (body.enabled !== undefined) {
       if (typeof body.enabled !== "boolean") return jsonResponse({ error: "enabled must be a boolean" }, 400);
@@ -762,18 +805,23 @@ export async function handleManagementAPI(req: Request, url: URL, config: OcxCon
     }
     if (body.tierModels !== undefined) {
       // CONFIG-ONLY back-compat (GUI pickers removed — roster agents supersede tiers).
-      if (!body.tierModels || typeof body.tierModels !== "object" || Array.isArray(body.tierModels)) {
-        return jsonResponse({ error: "tierModels must be an object" }, 400);
-      }
-      const tiers: Record<string, string> = {};
-      for (const tier of ["opus", "sonnet", "haiku", "fable"] as const) {
-        const value = (body.tierModels as Record<string, unknown>)[tier];
-        if (value === undefined || value === null) continue;
-        if (typeof value !== "string") return jsonResponse({ error: `tierModels.${tier} must be a string` }, 400);
-        if (value.trim() !== "") tiers[tier] = value.trim();
+      if (body.tierModels === null) {
+        delete next.tierModels;
+      } else if (!isPlainObject(body.tierModels)) {
+        return jsonResponse({ error: "tierModels must be an object with string values, or null" }, 400);
+      } else {
+        for (const [tier, value] of Object.entries(body.tierModels)) {
+          if (typeof value !== "string") return jsonResponse({ error: `tierModels.${tier} must be a string` }, 400);
+        }
+        const tierModels = body.tierModels as Record<string, string>;
+        const tiers: Record<string, string> = {};
+        for (const tier of ["opus", "sonnet", "haiku", "fable"] as const) {
+          const value = tierModels[tier];
+          if (value !== undefined && value.trim() !== "") tiers[tier] = value.trim();
+        }
+        if (Object.keys(tiers).length > 0) next.tierModels = tiers;
+        else delete next.tierModels;
       }
-      if (Object.keys(tiers).length > 0) next.tierModels = tiers;
-      else delete next.tierModels;
     }
     if (body.fastMode !== undefined) {
       if (body.fastMode !== true && body.fastMode !== false && body.fastMode !== null) {
@@ -789,32 +837,38 @@ export async function handleManagementAPI(req: Request, url: URL, config: OcxCon
       else next[field] = value.trim();
     }
     if (body.modelMap !== undefined) {
-      if (!body.modelMap || typeof body.modelMap !== "object" || Array.isArray(body.modelMap)) {
-        return jsonResponse({ error: "modelMap must be an object of string->string" }, 400);
-      }
-      const map: Record<string, string> = {};
-      for (const [k, v] of Object.entries(body.modelMap as Record<string, unknown>)) {
-        if (typeof v !== "string" || k.trim() === "" || v.trim() === "") {
-          return jsonResponse({ error: "modelMap entries must be non-empty strings" }, 400);
+      if (body.modelMap === null) {
+        delete next.modelMap;
+      } else {
+        if (!isPlainObject(body.modelMap)) {
+          return jsonResponse({ error: "modelMap must be an object of string->string, or null" }, 400);
         }
-        map[k.trim()] = v.trim();
+        const map: Record<string, string> = {};
+        for (const [k, v] of Object.entries(body.modelMap)) {
+          if (typeof v !== "string" || k.trim() === "" || v.trim() === "") {
+            return jsonResponse({ error: "modelMap entries must be non-empty strings" }, 400);
+          }
+          map[k.trim()] = v.trim();
+        }
+        if (Object.keys(map).length > 0) next.modelMap = map;
+        else delete next.modelMap;
       }
-      if (Object.keys(map).length > 0) next.modelMap = map;
-      else delete next.modelMap;
     }
     config.claudeCode = next;
     const { saveConfig: save } = await import("../config");
     save(config);
-    // Immediate prune when injection turns off (audit 071 #3): stale ocx-* agent
-    // definitions must stop loading in future sessions without waiting for the
-    // next launch hook. Best-effort; the disabled gate inside prunes owned files.
-    if (next.injectAgents === false || next.enabled === false) {
+    const warnings: string[] = [];
+    if (body.systemEnv !== undefined) {
       try {
-        const { injectClaudeAgentDefs } = await import("../claude/agents-inject");
-        injectClaudeAgentDefs(config, {});
-      } catch { /* best-effort */ }
+        await applySystemEnvToggle(config, config.port);
+      } catch (err) {
+        warnings.push(`Failed to apply system environment setting: ${err instanceof Error ? err.message : String(err)}`);
+      }
     }
-    return jsonResponse({ ok: true, enabled: next.enabled !== false });
+    // Keep the file-backed live registry symmetric: OFF prunes immediately, while
+    // ON and config changes restore definitions without requiring a restart.
+    await syncClaudeAgentDefsBestEffort();
+    return jsonResponse({ ok: true, enabled: next.enabled !== false, warnings });
   }
 
   // Per-provider catalog allowlist (issue #52): when a provider has a non-empty selectedModels list,

package/src/server/request-decompress.ts

@@ -1,3 +1,5 @@
+import { gunzipSync, inflateRawSync, inflateSync, zstdDecompressSync } from "node:zlib";
+
 /**
  * Request-body decompression for the /v1/responses data plane.
  *
@@ -25,28 +27,59 @@ export class UnsupportedContentEncodingError extends Error {
 }
 
 export class DecompressedBodyTooLargeError extends Error {
-  constructor(readonly bytes: number) {
-    super(`Decompressed request body exceeds ${MAX_DECOMPRESSED_BODY_BYTES} bytes`);
+  constructor(readonly bytes: number, limit: number = MAX_DECOMPRESSED_BODY_BYTES) {
+    super(`Decompressed request body exceeds ${limit} bytes`);
   }
 }
 
-export function decodeRequestBody(raw: Uint8Array<ArrayBuffer>, contentEncoding: string | null): Uint8Array {
+function assertBodySizeWithinLimit(body: Uint8Array, maxBytes: number): Uint8Array {
+  if (body.byteLength > maxBytes) throw new DecompressedBodyTooLargeError(body.byteLength, maxBytes);
+  return body;
+}
+
+function inflateDeflateBody(compressed: Uint8Array<ArrayBuffer>, opts: { maxOutputLength: number }): Uint8Array {
+  // HTTP "deflate" appears both zlib-wrapped and raw in the wild (Bun.deflateSync emits raw,
+  // which the previous Bun.inflateSync accepted). Try zlib-wrapped first, fall back to raw —
+  // but never swallow the size-cap abort.
+  try {
+    return inflateSync(compressed, opts);
+  } catch (err) {
+    if ((err as NodeJS.ErrnoException | null)?.code === "ERR_BUFFER_TOO_LARGE") throw err;
+    return inflateRawSync(compressed, opts);
+  }
+}
+
+export function decodeRequestBody(
+  raw: Uint8Array,
+  contentEncoding: string | null,
+  maxBytes: number = MAX_DECOMPRESSED_BODY_BYTES,
+): Uint8Array {
   const encoding = (contentEncoding ?? "").trim().toLowerCase();
-  if (encoding === "" || encoding === "identity") return raw;
+  if (encoding === "" || encoding === "identity") return assertBodySizeWithinLimit(raw, maxBytes);
+  const compressed = raw as Uint8Array<ArrayBuffer>;
+  // `maxOutputLength` makes zlib abort DURING inflation (ERR_BUFFER_TOO_LARGE), so a
+  // decompression bomb never allocates beyond the cap — checking after the fact would
+  // already have paid the full allocation (review finding, PR #96).
+  const opts = { maxOutputLength: maxBytes };
   let decoded: Uint8Array;
-  if (encoding === "zstd") decoded = Bun.zstdDecompressSync(raw);
-  else if (encoding === "gzip" || encoding === "x-gzip") decoded = Bun.gunzipSync(raw);
-  else if (encoding === "deflate") decoded = Bun.inflateSync(raw);
-  // Multi-codings ("zstd, gzip") and unknown tokens are rejected rather than guessed.
-  else throw new UnsupportedContentEncodingError(encoding);
-  if (decoded.byteLength > MAX_DECOMPRESSED_BODY_BYTES) throw new DecompressedBodyTooLargeError(decoded.byteLength);
-  return decoded;
+  try {
+    if (encoding === "zstd") decoded = zstdDecompressSync(compressed, opts);
+    else if (encoding === "gzip" || encoding === "x-gzip") decoded = gunzipSync(compressed, opts);
+    else if (encoding === "deflate") decoded = inflateDeflateBody(compressed, opts);
+    // Multi-codings ("zstd, gzip") and unknown tokens are rejected rather than guessed.
+    else throw new UnsupportedContentEncodingError(encoding);
+  } catch (err) {
+    if ((err as NodeJS.ErrnoException | null)?.code === "ERR_BUFFER_TOO_LARGE") {
+      throw new DecompressedBodyTooLargeError(maxBytes + 1, maxBytes);
+    }
+    throw err;
+  }
+  return assertBodySizeWithinLimit(decoded, maxBytes);
 }
 
 /** Parse a JSON request body, transparently decoding compressed payloads. */
 export async function readJsonRequestBody(req: Request): Promise<unknown> {
   const encoding = req.headers.get("content-encoding");
-  if (!encoding || encoding.trim().toLowerCase() === "identity") return await req.json();
   const decoded = decodeRequestBody(new Uint8Array(await req.arrayBuffer()), encoding);
   return JSON.parse(new TextDecoder().decode(decoded));
 }

package/src/server/responses.ts

@@ -10,6 +10,7 @@ import { FORWARD_HEADERS } from "../adapters/openai-responses";
 import { expandPreviousResponseInput, previousResponseConversationId, rememberResponseState } from "../responses/state";
 import { routeModel } from "../router";
 import { isInjectionDebugEnabled } from "../lib/debug-settings";
+import { injectionDebugLog } from "../lib/injection-debug-log";
 import { modelInList, namespacedToolName } from "../types";
 import type { AdapterEvent, OcxConfig, OcxParsedRequest, OcxProviderConfig } from "../types";
 import {
@@ -505,9 +506,9 @@ export async function handleResponses(
     const guidance = await multiAgentGuidanceText(parsed, config.injectionModel, config.injectionEffort, config.subagentModels, config.injectionPrompt);
     if (guidance) {
       injectDeveloperMessage(parsed, guidance);
-      if (isInjectionDebugEnabled()) console.log(`[opencodex] ${route.modelId}: multi-agent guidance injected (surface=${collabSurface(parsed)}, ${guidance.length} chars)`);
+      if (isInjectionDebugEnabled()) injectionDebugLog(`[opencodex] ${route.modelId}: multi-agent guidance injected (surface=${collabSurface(parsed)}, ${guidance.length} chars)`);
     } else if (isInjectionDebugEnabled() && collabSurface(parsed) !== null) {
-      console.log(`[opencodex] ${route.modelId}: collab surface=${collabSurface(parsed)}, guidance silent (effort=${parsed.options.reasoning ?? "unset"}, injectionModel=${config.injectionModel ?? "unset"})`);
+      injectionDebugLog(`[opencodex] ${route.modelId}: collab surface=${collabSurface(parsed)}, guidance silent (effort=${parsed.options.reasoning ?? "unset"}, injectionModel=${config.injectionModel ?? "unset"})`);
     }
   }
 
@@ -530,11 +531,11 @@ export async function handleResponses(
       if (capped) {
         logCtx.requestedEffort = `${capped.from}->${capped.to}`;
         if (isInjectionDebugEnabled()) {
-          console.log(`[opencodex] ${route.modelId}: effort cap applied (${capped.from} -> ${capped.to}, ${capped.subagent ? "sub-agent" : "main"} turn)`);
+          injectionDebugLog(`[opencodex] ${route.modelId}: effort cap applied (${capped.from} -> ${capped.to}, ${capped.subagent ? "sub-agent" : "main"} turn)`);
         }
       }
     } else if (isInjectionDebugEnabled() && (config.effortCap || config.subagentEffortCap)) {
-      console.log(`[opencodex] ${route.modelId}: effort cap skipped (surface=${surface ?? "none"}, v2 feature only)`);
+      injectionDebugLog(`[opencodex] ${route.modelId}: effort cap skipped (surface=${surface ?? "none"}, v2 feature only)`);
     }
   }
 

package/src/server/system-env.ts

@@ -15,24 +15,28 @@ export function getShellEnvFilePath(): string {
   return join(getConfigDir(), "claude-env.sh");
 }
 
+function shellValue(value: string): string {
+  return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+
 function writeShellEnvFile(port: number, config: OcxConfig, modelEnv: Record<string, string> = {}, auto?: AutoContextMode): void {
   const lines = [
     `# Generated by opencodex — do not edit manually`,
-    `export ANTHROPIC_BASE_URL="http://127.0.0.1:${port}"`,
-    `export CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=1`,
+    `export ANTHROPIC_BASE_URL=${shellValue(`http://127.0.0.1:${port}`)}`,
+    `export CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=${shellValue("1")}`,
   ];
   if (config.apiKeys?.length) {
-    lines.push(`export ANTHROPIC_AUTH_TOKEN="${config.apiKeys[0].key.replace(/"/g, '\\"')}"`);
+    lines.push(`export ANTHROPIC_AUTH_TOKEN=${shellValue(config.apiKeys[0].key)}`);
   }
   // New lever keys are CONDITIONAL exports (audit 139 R2#1): a value the user already
   // exported in their shell wins even though launchctl knows nothing about it.
   const conditional = (name: string, value: string) =>
-    `[ -z "\${${name}+x}" ] && export ${name}="${value.replace(/"/g, '\\"')}"`;
+    `[ -z "\${${name}+x}" ] && export ${name}=${shellValue(value)}`;
   // Model slots (default + tiers + legacy small-fast) with [1m] applied (devlog 260712 B2).
   if (modelEnv.ANTHROPIC_MODEL) {
-    lines.push(`export ANTHROPIC_MODEL="${modelEnv.ANTHROPIC_MODEL.replace(/"/g, '\\"')}"`);
+    lines.push(`export ANTHROPIC_MODEL=${shellValue(modelEnv.ANTHROPIC_MODEL)}`);
   } else if (config.claudeCode?.model) {
-    lines.push(`export ANTHROPIC_MODEL="${config.claudeCode.model}"`);
+    lines.push(`export ANTHROPIC_MODEL=${shellValue(config.claudeCode.model)}`);
   }
   for (const [name, value] of Object.entries(modelEnv)) {
     if (name === "ANTHROPIC_MODEL") continue;
@@ -159,6 +163,34 @@ function ownedBaseUrl(port: number): string {
   return `http://127.0.0.1:${port}`;
 }
 
+function writeTracking(port: number, injectedKeys: string[]): void {
+  mkdirSync(getConfigDir(), { recursive: true, mode: 0o700 });
+  writeFileSync(getSystemEnvTrackingPath(), JSON.stringify({
+    pid: process.pid,
+    port,
+    injectedAt: new Date().toISOString(),
+    injectedKeys,
+  }), { encoding: "utf8", mode: 0o600 });
+}
+
+function rollbackInjectedKeys(port: number, injectedKeys: string[]): void {
+  const rollbackFailed: string[] = [];
+  for (const name of [...injectedKeys].reverse()) {
+    try {
+      unsetLaunchctlEnv(name);
+    } catch {
+      rollbackFailed.unshift(name);
+    }
+  }
+
+  if (rollbackFailed.length > 0) {
+    writeTracking(port, rollbackFailed);
+    return;
+  }
+
+  try { unlinkSync(getSystemEnvTrackingPath()); } catch { /* already gone */ }
+}
+
 /**
  * In-process effective model-env (default + tier slots, [1m] applied) under the shared
  * 3s bound (audit R4#3). Returns {} on timeout/failure so injection degrades safely.
@@ -192,77 +224,86 @@ export async function injectSystemEnv(port: number, config: OcxConfig): Promise<
     return { injected: false, reason: `another instance owns env (port ${existingTracking.port})` };
   }
 
-  setLaunchctlEnv("ANTHROPIC_BASE_URL", ownedBaseUrl(port));
-  setLaunchctlEnv("CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY", "1");
-  const injectedKeys = [
-    "ANTHROPIC_BASE_URL",
-    "CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY",
-  ];
-  if (config.apiKeys?.length) {
-    setLaunchctlEnv("ANTHROPIC_AUTH_TOKEN", config.apiKeys[0].key);
-    injectedKeys.push("ANTHROPIC_AUTH_TOKEN");
-  }
-  // Lever keys (devlog 136 B6): user-wins — skip any key the user already set in the
-  // launchd domain, and track ONLY the keys we actually injected so revert cannot
-  // delete a pre-existing user value (audit 139 #3).
-  const injectLever = (name: string, value: string) => {
-    if (launchctlGetenv(name) !== undefined) return;
+  const injectedKeys: string[] = existingTracking
+    ? [...(existingTracking.injectedKeys ?? SYSTEM_ENV_NAMES)]
+    : [];
+  const inject = (name: string, value: string) => {
     setLaunchctlEnv(name, value);
-    injectedKeys.push(name);
+    if (!injectedKeys.includes(name)) injectedKeys.push(name);
+    writeTracking(port, injectedKeys);
   };
-  // Model slots (default + tier defaults + legacy small-fast) with [1m] auto-marking
-  // (devlog 260712 B2, audit R2#3/R4#3): in-process context-window computation under
-  // the same 3s bound; on timeout the tier keys are simply not injected this run.
-  // Auto-context: a user-owned launchd value drives the marking predicate so the
-  // marker and threshold never separate (audit 021 #2); injectLever's user-wins
-  // check below keeps that value untouched.
-  const userAutoCompact = launchctlGetenv("CLAUDE_CODE_AUTO_COMPACT_WINDOW");
-  const auto = resolveAutoContext(config.claudeCode, userAutoCompact);
-  const { modelEnv, windows } = await computeEffectiveModelEnv(config, auto);
-  for (const [name, value] of Object.entries(modelEnv)) {
-    if (name === "ANTHROPIC_MODEL") continue; // legacy slot handled by shell file only (back-compat)
-    injectLever(name, value);
-  }
-  const maxCtx = config.claudeCode?.maxContextTokens;
-  if (typeof maxCtx === "number" && Number.isFinite(maxCtx) && maxCtx > 0) {
-    injectLever("CLAUDE_CODE_MAX_CONTEXT_TOKENS", String(Math.floor(maxCtx)));
-    injectLever("DISABLE_COMPACT", "1");
-  }
-  // Auto-context (devlog 260712 020): user-wins lever, inert when maxContextTokens set.
-  if (auto.enabled) injectLever("CLAUDE_CODE_AUTO_COMPACT_WINDOW", String(auto.compactWindow));
-  if (config.claudeCode?.alwaysEnableEffort === true) {
-    injectLever("CLAUDE_CODE_ALWAYS_ENABLE_EFFORT", "1");
-  }
 
-  // Shell-hook env file: works for new shells in already-running Terminal.app.
-  writeShellEnvFile(port, config, modelEnv, auto);
-
-  // Gateway-model cache pre-write (devlog 030): plain `claude` sessions read the
-  // picker list from ~/.claude/cache/gateway-models.json and cannot refresh it
-  // without a token — keep it in sync with this proxy's /v1/models. Best-effort.
   try {
-    const { refreshGatewayModelCacheFromProxy } = await import("../claude/gateway-cache");
-    await refreshGatewayModelCacheFromProxy(port);
-  } catch { /* best-effort */ }
+    inject("ANTHROPIC_BASE_URL", ownedBaseUrl(port));
+    inject("CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY", "1");
+    if (config.apiKeys?.length) {
+      inject("ANTHROPIC_AUTH_TOKEN", config.apiKeys[0].key);
+    }
+    // Lever keys (devlog 136 B6): user-wins — skip any key the user already set in the
+    // launchd domain, and track ONLY the keys we actually injected so revert cannot
+    // delete a pre-existing user value (audit 139 #3).
+    const injectLever = (name: string, value: string) => {
+      if (launchctlGetenv(name) !== undefined) return;
+      inject(name, value);
+    };
+    // Model slots (default + tier defaults + legacy small-fast) with [1m] auto-marking
+    // (devlog 260712 B2, audit R2#3/R4#3): in-process context-window computation under
+    // the same 3s bound; on timeout the tier keys are simply not injected this run.
+    // Auto-context: a user-owned launchd value drives the marking predicate so the
+    // marker and threshold never separate (audit 021 #2); injectLever's user-wins
+    // check below keeps that value untouched.
+    const userAutoCompact = launchctlGetenv("CLAUDE_CODE_AUTO_COMPACT_WINDOW");
+    const auto = resolveAutoContext(config.claudeCode, userAutoCompact);
+    const { modelEnv, windows } = await computeEffectiveModelEnv(config, auto);
+    for (const [name, value] of Object.entries(modelEnv)) {
+      if (name === "ANTHROPIC_MODEL") continue; // legacy slot handled by shell file only (back-compat)
+      injectLever(name, value);
+    }
+    const maxCtx = config.claudeCode?.maxContextTokens;
+    if (typeof maxCtx === "number" && Number.isFinite(maxCtx) && maxCtx > 0) {
+      injectLever("CLAUDE_CODE_MAX_CONTEXT_TOKENS", String(Math.floor(maxCtx)));
+      injectLever("DISABLE_COMPACT", "1");
+    }
+    // Auto-context (devlog 260712 020): user-wins lever, inert when maxContextTokens set.
+    if (auto.enabled) injectLever("CLAUDE_CODE_AUTO_COMPACT_WINDOW", String(auto.compactWindow));
+    if (config.claudeCode?.alwaysEnableEffort === true) {
+      injectLever("CLAUDE_CODE_ALWAYS_ENABLE_EFFORT", "1");
+    }
 
-  // Roster agent definitions (devlog 070): same launch-time sync for plain `claude`.
-  // Reuses the window map computed above (audit 071 #5 — no second acquisition).
-  try {
-    const { injectClaudeAgentDefs } = await import("../claude/agents-inject");
-    injectClaudeAgentDefs(config, windows);
-  } catch { /* best-effort */ }
+    // Shell-hook env file: works for new shells in already-running Terminal.app.
+    writeShellEnvFile(port, config, modelEnv, auto);
 
-  mkdirSync(getConfigDir(), { recursive: true, mode: 0o700 });
-  writeFileSync(getSystemEnvTrackingPath(), JSON.stringify({
-    pid: process.pid,
-    port,
-    injectedAt: new Date().toISOString(),
-    injectedKeys,
-  }), { encoding: "utf8", mode: 0o600 });
+    // Gateway-model cache pre-write (devlog 030): plain `claude` sessions read the
+    // picker list from ~/.claude/cache/gateway-models.json and cannot refresh it
+    // without a token — keep it in sync with this proxy's /v1/models. Best-effort.
+    try {
+      const { refreshGatewayModelCacheFromProxy } = await import("../claude/gateway-cache");
+      await refreshGatewayModelCacheFromProxy(port);
+    } catch { /* best-effort */ }
+
+    // Roster agent definitions (devlog 070): same launch-time sync for plain `claude`.
+    // Reuses the window map computed above (audit 071 #5 — no second acquisition).
+    try {
+      const { injectClaudeAgentDefs } = await import("../claude/agents-inject");
+      injectClaudeAgentDefs(config, windows);
+    } catch { /* best-effort */ }
+
+    writeTracking(port, injectedKeys);
+  } catch (error) {
+    rollbackInjectedKeys(port, injectedKeys);
+    removeShellEnvFile();
+    console.error("Failed to inject system environment; rolled back launchctl changes:", error);
+    throw error;
+  }
 
   return { injected: true };
 }
 
+export async function applySystemEnvToggle(config: OcxConfig, port: number): Promise<SystemEnvResult | RevertResult> {
+  if (config.claudeCode?.systemEnv === true) return injectSystemEnv(port, config);
+  return revertSystemEnv();
+}
+
 export function revertSystemEnv(): RevertResult {
   if (process.platform !== "darwin") return { reverted: false, reason: "not macOS" };
 
@@ -270,7 +311,8 @@ export function revertSystemEnv(): RevertResult {
   if (!tracking) return { reverted: false, reason: "no tracking file" };
 
   try {
-    if (launchctlGetenv("ANTHROPIC_BASE_URL") !== ownedBaseUrl(tracking.port)) {
+    const tracksBaseUrl = tracking.injectedKeys?.includes("ANTHROPIC_BASE_URL") ?? true;
+    if (tracksBaseUrl && launchctlGetenv("ANTHROPIC_BASE_URL") !== ownedBaseUrl(tracking.port)) {
       return { reverted: false, reason: "ownership mismatch" };
     }
 

package/src/service.ts

@@ -16,6 +16,7 @@ import { isWslRuntime } from "./codex/home";
 import { durableBunPath, durableBunRuntime } from "./lib/bun-runtime";
 import { isProcessAlive, stopProxy } from "./lib/process-control";
 import { serviceApiTokenFilePath } from "./lib/service-secrets";
+import { hardenSecretDir, hardenSecretPath } from "./lib/windows-secret-acl";
 import { windowsEnvIndirectBatchPathList, windowsEnvIndirectBatchValue } from "./lib/win-paths";
 
 const LABEL = "com.opencodex.proxy";
@@ -103,6 +104,7 @@ function writeServiceInstallState(): void {
     if (!existsSync(dir)) mkdirSync(dir, { recursive: true, mode: 0o700 });
     writeFileSync(path, JSON.stringify(state, null, 2) + "\n", { encoding: "utf8", mode: 0o600 });
     try { chmodSync(path, 0o600); } catch { /* best-effort */ }
+    if (process.platform === "win32") hardenSecretPath(path, { required: true });
   }
 }
 
@@ -169,8 +171,10 @@ function writeServiceApiTokenFile(): string | null {
   const path = serviceApiTokenFilePath();
   const dir = getConfigDir();
   if (!existsSync(dir)) mkdirSync(dir, { recursive: true, mode: 0o700 });
+  if (process.platform === "win32") hardenSecretDir(dir, { required: true });
   writeFileSync(path, `${token}\n`, { encoding: "utf8", mode: 0o600 });
   try { chmodSync(path, 0o600); } catch { /* best-effort */ }
+  if (process.platform === "win32") hardenSecretPath(path, { required: true });
   return path;
 }
 

package/src/types.ts

@@ -265,9 +265,9 @@ export interface OcxClaudeCodeConfig {
   /** Inbound model id remaps: exact id first, then date-stripped (`-\d{8}$`). */
   modelMap?: Record<string, string>;
   /**
-   * Inject ANTHROPIC_BASE_URL etc. into the macOS user domain via `launchctl setenv`
-   * so plain `claude` commands route through the proxy without `ocx claude`. Reverted
-   * on stop/shutdown. Default: true when `enabled` is not false. macOS only.
+  * Inject ANTHROPIC_BASE_URL etc. into the macOS user domain via `launchctl setenv`
+  * so plain `claude` commands route through the proxy without `ocx claude`. Reverted
+   * on stop/shutdown. Default: false (opt-in). macOS only.
    */
   systemEnv?: boolean;
   /**
@@ -514,6 +514,11 @@ export interface OcxWebSearchSidecarConfig {
 export interface OcxProviderConfig {
   adapter: string;
   baseUrl: string;
+  /**
+   * Explicit opt-in for non-registry private-network destinations such as localhost, RFC1918,
+   * link-local, or unique-local upstreams. Metadata endpoints remain blocked.
+   */
+  allowPrivateNetwork?: boolean;
   /** Keep provider settings on disk but exclude it from routing and model/catalog listings. */
   disabled?: boolean;
   apiKey?: string;