@bitkyc08/opencodex 2.75.0 → 2.76.0

package/src/server/management/claude-desktop-picker-routes.ts

@@ -1,3 +1,4 @@
+import { ensureManagementClaudeIntercept, interceptStartRefusal } from "./claude-intercept-routes";
 /**
  * Claude Desktop picker mode over the management API, and the transition helpers every Desktop
  * mode change uses.
@@ -76,6 +77,12 @@ export async function handleClaudeDesktopPickerRoutes(ctx: ManagementContext): P
     }
     const body = parsePickerBody(raw);
     if (typeof body === "string") return jsonResponse({ error: body }, 400);
+    if (body.enabled) {
+      const refusal = interceptStartRefusal(ctx);
+      if (refusal) return refusal;
+      const started = await ensureManagementClaudeIntercept(ctx);
+      if (!started.ok) return jsonResponse({ ...started, code: started.reason }, 409);
+    }
     const controller = await currentPickerController();
     if (body.enabled) {
       if (!controller) {

package/src/server/management/claude-intercept-routes.ts

@@ -0,0 +1,35 @@
+import type { ManagementContext } from "./context";
+import { jsonResponse } from "../auth-cors";
+import { claudeInterceptEnabled, getClaudeInterceptState, type ClaudeInterceptOutcome } from "../../claude/intercept/runtime";
+
+/** Local management authority only; data-plane credentials never grant this capability. */
+export function interceptStartRefusal(ctx: ManagementContext): Response | null {
+  return ctx.trustedLoopbackIngress && (ctx.principal === "gui-session" || ctx.principal === "admin-token")
+    ? null : jsonResponse({ ok: false, code: "intercept_start_forbidden", error: "Local management authority is required." }, 403);
+}
+
+export async function ensureManagementClaudeIntercept(ctx: ManagementContext): Promise<ClaudeInterceptOutcome> {
+  if (ctx.config.runtimeRole === "client") return { ok: false, reason: "client_role" };
+  if (!claudeInterceptEnabled(ctx.config)) return { ok: false, reason: "disabled" };
+  if (ctx.deps.ensureClaudeIntercept) return ctx.deps.ensureClaudeIntercept();
+  const injected = ctx.deps.getClaudeInterceptState?.();
+  if (injected) return { ok: true, state: injected };
+  const listener = ctx.deps.linkListener?.();
+  if (listener?.ensureClaudeIntercept) return listener.ensureClaudeIntercept();
+  const state = (ctx.deps.getClaudeInterceptState ?? getClaudeInterceptState)();
+  return state ? { ok: true, state } : { ok: false, reason: "failed" };
+}
+
+export function interceptStatus(ctx: ManagementContext): { interceptReason: string | null; pickerReason: string | null; pickerFailurePort?: number; interceptFailurePort?: number } {
+  const outcome = ctx.deps.linkListener?.()?.claudeInterceptOutcome?.();
+  const state = (ctx.deps.getClaudeInterceptState ?? getClaudeInterceptState)();
+  return { ...(outcome && !outcome.ok ? { interceptFailurePort: outcome.port } : {}), interceptReason: outcome && !outcome.ok ? outcome.reason : null, pickerReason: state?.pickerReason ?? null, pickerFailurePort: state?.pickerFailurePort };
+}
+
+export async function handleClaudeInterceptRoutes(ctx: ManagementContext): Promise<Response | null> {
+  if (ctx.url.pathname !== "/api/claude-intercept/start" || ctx.req.method !== "POST") return null;
+  const refusal = interceptStartRefusal(ctx);
+  if (refusal) return refusal;
+  const outcome = await ensureManagementClaudeIntercept(ctx);
+  return jsonResponse(outcome, outcome.ok ? 200 : 409);
+}

package/src/server/management/codex-agent-role-routes.ts

@@ -0,0 +1,122 @@
+/**
+ * Per-role model for omo (Codex / LazyCodex): `$CODEX_HOME/agents/<role>.toml` plus LazyCodex's
+ * `codex.agents.<role>.model` mirror in omo.jsonc. Both halves exist only when LazyCodex is
+ * detected; Pi-based and OpenCode-based omo are never read here.
+ *
+ * Loaded on demand from `src/server/management-api.ts`, like the quota-reset handler, so a
+ * dashboard request that never opens the omo tab loads neither writer.
+ */
+import { jsonResponse } from "../auth-cors";
+import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
+import type { ManagementContext } from "./context";
+
+const ROLE_PATH_PREFIX = "/api/codex-agent-roles/";
+const AUTO_ASSIGN_PATH = "/api/codex-agent-roles/auto-assign";
+
+function lazycodexNotDetected(ctx: ManagementContext): Response {
+  return jsonResponse({
+    error: "omo (Codex / LazyCodex) is not installed in this CODEX_HOME",
+    code: "lazycodex_not_detected",
+  }, 409, ctx.req, ctx.config);
+}
+
+export async function handleCodexAgentRoleRoutes(ctx: ManagementContext): Promise<Response | null> {
+  const { req, url, config, deps } = ctx;
+  const [{ getCodexHome }, roles, omo, { detectLazyCodex }] = await Promise.all([
+    import("../../codex/paths"),
+    import("../../codex/agent-role-models"),
+    import("../../clients/omo-role-models"),
+    import("../../clients/lazycodex"),
+  ]);
+
+  if (url.pathname === "/api/codex-agent-roles" && req.method === "GET") {
+    const codexHome = getCodexHome();
+    const lazycodex = detectLazyCodex(codexHome);
+    if (!lazycodex.detected) return jsonResponse({ lazycodex, omoJsonc: null, roles: [] }, 200, req, config);
+    const omoState = omo.readOmoRoleModels(omo.omoJsoncPath());
+    const omoModels = omoState.state === "present" ? omoState.models : {};
+    return jsonResponse({
+      lazycodex,
+      omoJsonc: { state: omoState.state },
+      roles: roles.listCodexAgentRoleModels(codexHome).map(entry => ({
+        ...entry,
+        omoJsoncModel: omoModels[entry.role] ?? null,
+      })),
+    }, 200, req, config);
+  }
+
+  if (url.pathname === AUTO_ASSIGN_PATH && req.method === "POST") {
+    const codexHome = getCodexHome();
+    if (!detectLazyCodex(codexHome).detected) return lazycodexNotDetected(ctx);
+    let body: { model?: unknown };
+    try {
+      body = await readManagementJsonBody(req);
+    } catch (error) {
+      rethrowManagementBodyTooLarge(error);
+      return jsonResponse({ error: "invalid JSON body" }, 400, req, config);
+    }
+    if (body?.model !== undefined && typeof body.model !== "string") {
+      return jsonResponse({ error: "model must be a string", code: "invalid_model" }, 400, req, config);
+    }
+    const [{ proposeCodexRoleModels, NoSizingModelError }, { fetchAllModels }] = await Promise.all([
+      import("./codex-role-auto-assign"),
+      import("./shared"),
+    ]);
+    try {
+      return jsonResponse(await proposeCodexRoleModels({
+        config,
+        codexHome,
+        ...(typeof body?.model === "string" ? { sizingModel: body.model } : {}),
+        fetchAllModels: deps.fetchAllModels ?? fetchAllModels,
+        ...(deps.completeCodexRoleSizing ? { completeRoleSizing: deps.completeCodexRoleSizing } : {}),
+      }), 200, req, config);
+    } catch (error) {
+      if (error instanceof NoSizingModelError) {
+        return jsonResponse({ error: error.message, code: "no_sizing_model" }, 409, req, config);
+      }
+      throw error;
+    }
+  }
+
+  if (!url.pathname.startsWith(ROLE_PATH_PREFIX) || req.method !== "PUT") return null;
+  const codexHome = getCodexHome();
+  if (!detectLazyCodex(codexHome).detected) return lazycodexNotDetected(ctx);
+  let role: string;
+  try {
+    role = decodeURIComponent(url.pathname.slice(ROLE_PATH_PREFIX.length));
+  } catch {
+    return jsonResponse({ error: "role must be URL-encoded", code: "invalid_role" }, 400, req, config);
+  }
+  let body: { model?: unknown; effort?: unknown };
+  try {
+    body = await readManagementJsonBody(req);
+  } catch (error) {
+    rethrowManagementBodyTooLarge(error);
+    return jsonResponse({ error: "invalid JSON body" }, 400, req, config);
+  }
+
+  let model: string;
+  let effort: string | undefined;
+  let toml: { status: "written" | "unchanged" };
+  try {
+    model = roles.validateAgentRoleModel(body?.model);
+    effort = body?.effort === undefined || body.effort === null ? undefined : roles.validateAgentRoleEffort(body.effort);
+    toml = roles.writeCodexAgentRoleModel(role, model, codexHome, effort);
+  } catch (error) {
+    if (error instanceof roles.AgentRoleModelError) {
+      const status = error.code === "unknown_role" ? 404 : error.code === "invalid_model" || error.code === "invalid_effort" ? 400 : 409;
+      return jsonResponse({ error: error.message, code: error.code }, status, req, config);
+    }
+    // Filesystem and ownership errors carry absolute paths and UIDs; keep them out of the response.
+    return jsonResponse({ error: "could not write the role file", code: "write_failed" }, 500, req, config);
+  }
+
+  // The role TOML is what Codex obeys, so its write stands even when the omo mirror cannot follow.
+  let omoStatus: ReturnType<typeof omo.writeOmoRoleModel> | "write_failed";
+  try {
+    omoStatus = omo.writeOmoRoleModel(role, model, omo.omoJsoncPath());
+  } catch {
+    omoStatus = "write_failed";
+  }
+  return jsonResponse({ ok: true, role, model, ...(effort ? { effort } : {}), toml, omoJsonc: { status: omoStatus } }, 200, req, config);
+}

package/src/server/management/codex-role-auto-assign.ts

@@ -0,0 +1,208 @@
+/**
+ * The read-only half of role auto-assign: size every Codex agent role with one model call, map
+ * each size to a concrete model and effort, and return the proposals. Nothing is written here;
+ * the dashboard and "ocx agent roles suggest --apply" apply a proposal through the ordinary
+ * PUT /api/codex-agent-roles/{role}.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import type { OcxConfig } from "../../types";
+import type { CatalogModel } from "../../codex/catalog";
+import type { RoleModelCandidate } from "../../codex/role-auto-assign";
+
+export interface RoleSizingCall {
+  readonly model: string;
+  readonly system: string;
+  readonly user: string;
+}
+
+export type CompleteRoleSizing = (call: RoleSizingCall, config: OcxConfig) => Promise<{ text: string; error?: string }>;
+
+const SIZING_TIMEOUT_MS = 180_000;
+const MAX_SIZING_RESPONSE_BYTES = 1024 * 1024;
+
+/**
+ * The completion error can carry upstream response text and exception messages, which may
+ * include paths, account identifiers or secrets the redactor does not recognise. Only a fixed
+ * category, plus a bare HTTP status, leaves the management response and the CLI.
+ */
+export function publicSizingError(error: string): string {
+  const http = /^[\w .-]* HTTP (\d{3}):/.exec(error);
+  if (http) return `HTTP ${http[1]}`;
+  if (error.endsWith("response exceeded byte bound")) return "the response was too large";
+  if (error.endsWith("returned non-JSON")) return "the response was not JSON";
+  if (error.endsWith("returned no text")) return "the response had no text";
+  return "the request could not be completed";
+}
+
+async function completeThroughProxy(call: RoleSizingCall, config: OcxConfig) {
+  const { postLocalChatCompletion } = await import("../../lib/local-chat-completion");
+  return postLocalChatCompletion({
+    config,
+    label: "role sizing",
+    logTag: "role-sizing",
+    timeoutMs: SIZING_TIMEOUT_MS,
+    maxResponseBytes: MAX_SIZING_RESPONSE_BYTES,
+    boundWhileStreaming: true,
+    body: {
+      model: call.model,
+      messages: [{ role: "system", content: call.system }, { role: "user", content: call.user }],
+    },
+  });
+}
+
+async function modelCandidates(slugs: readonly string[], models: readonly CatalogModel[]): Promise<RoleModelCandidate[]> {
+  const [catalog, { resolveMatchedPrice }] = await Promise.all([
+    import("../../codex/catalog"),
+    import("../../usage/cost"),
+  ]);
+  const nativeSlugs = catalog.listCatalogNativeSlugs();
+  const routed = new Map(models.map(model => [catalog.catalogModelSlug(model), model]));
+  const unitPrice = (provider: string, modelId: string): number | null => {
+    const cost = resolveMatchedPrice(provider, modelId)?.cost4;
+    return cost ? cost.input + cost.output : null;
+  };
+  return slugs.map(slug => {
+    const row = routed.get(slug);
+    if (row) {
+      return {
+        model: slug,
+        unitPrice: unitPrice(row.provider, row.id),
+        efforts: row.reasoningEfforts ?? [],
+        ...(row.defaultReasoningEffort ? { defaultEffort: row.defaultReasoningEffort } : {}),
+      };
+    }
+    if (nativeSlugs.includes(slug)) {
+      const defaultEffort = catalog.nativeDefaultReasoningEffort(slug);
+      return {
+        model: slug,
+        unitPrice: unitPrice("openai", slug),
+        efforts: catalog.nativeReasoningEfforts(slug),
+        ...(defaultEffort ? { defaultEffort } : {}),
+      };
+    }
+    return { model: slug, unitPrice: null, efforts: [] };
+  });
+}
+
+async function roleModelCandidates(config: OcxConfig, models: readonly CatalogModel[]): Promise<RoleModelCandidate[]> {
+  const [{ listCatalogNativeSlugs }, { subagentSelectableModels }] = await Promise.all([
+    import("../../codex/catalog"),
+    import("../../codex/subagent-selectable-models"),
+  ]);
+  return modelCandidates(subagentSelectableModels(config, models, listCatalogNativeSlugs()), models);
+}
+
+export class NoSizingModelError extends Error {}
+
+function resolveSizingModel(sizingModel: string | undefined, readConfiguredDefaultModel: () => string | null): string {
+  const model = sizingModel?.trim() || readConfiguredDefaultModel();
+  if (!model) throw new NoSizingModelError("no default model is set in Codex config.toml; pass a sizing model");
+  return model;
+}
+
+export async function proposeCodexRoleModels(options: {
+  config: OcxConfig;
+  codexHome: string;
+  sizingModel?: string;
+  fetchAllModels: (config: OcxConfig) => Promise<CatalogModel[]>;
+  completeRoleSizing?: CompleteRoleSizing;
+}) {
+  const [roles, sizing, assign, { readConfiguredDefaultModel }] = await Promise.all([
+    import("../../codex/agent-role-models"),
+    import("../../codex/role-sizing"),
+    import("../../codex/role-auto-assign"),
+    import("../../codex/catalog/parsing"),
+  ]);
+  const sizingModel = resolveSizingModel(options.sizingModel, readConfiguredDefaultModel);
+
+  const roleRows = roles.listCodexAgentRoleModels(options.codexHome).map(row => ({
+    role: row.role,
+    model: row.model,
+    effort: roles.readCodexAgentRoleEffort(row.role, options.codexHome),
+  }));
+  const inputs: { role: string; instructions: string }[] = [];
+  const outcomes = new Map<string, import("../../codex/role-sizing").RoleSizingOutcome>();
+  for (const row of roleRows) {
+    let excerpt: string | null = null;
+    try {
+      excerpt = sizing.roleInstructionsExcerpt(readFileSync(join(options.codexHome, "agents", `${row.role}.toml`), "utf8"));
+    } catch { /* an unreadable role is reported unsized below */ }
+    if (excerpt === null) outcomes.set(row.role, { unsized: "the role file has no description or developer_instructions to size from" });
+    else inputs.push({ role: row.role, instructions: excerpt });
+  }
+
+  let sizingError: string | null = null;
+  if (inputs.length > 0) {
+    const answer = await (options.completeRoleSizing ?? completeThroughProxy)({
+      model: sizingModel,
+      system: sizing.ROLE_SIZING_SYSTEM_PROMPT,
+      user: sizing.buildRoleSizingUserMessage(inputs),
+    }, options.config);
+    const names = inputs.map(input => input.role);
+    if (answer.error) {
+      sizingError = publicSizingError(answer.error);
+      for (const role of names) outcomes.set(role, { unsized: `the sizing call failed: ${sizingError}` });
+    } else {
+      for (const [role, outcome] of sizing.parseRoleSizingResponse(answer.text, names)) outcomes.set(role, outcome);
+    }
+  }
+
+  const classified = assign.classifyRoleModelCandidates(
+    await roleModelCandidates(options.config, await options.fetchAllModels(options.config)),
+    options.config.codexRoleTiers,
+  );
+  return {
+    sizingModel,
+    sizingError,
+    proposals: assign.buildRoleProposals(roleRows, outcomes, classified),
+    candidates: classified.map(({ model, tier, tierSource, unitPrice }) => ({ model, tier, tierSource, unitPrice })),
+  };
+}
+
+export const DELEGATED_WORK_ROLE = "delegated-work";
+
+/**
+ * The same sizing for the Subagents page's delegation default: the work a parent hands its
+ * preferred subagent is sized as one standing role, and the pick comes from the models that page
+ * offers. Effort is always proposed, restricted to the Codex levels the page can save.
+ */
+export async function proposeDelegationModel(options: {
+  config: OcxConfig;
+  work: string;
+  offered: readonly string[];
+  sizingModel?: string;
+  models: readonly CatalogModel[];
+  completeRoleSizing?: CompleteRoleSizing;
+}) {
+  const [sizing, assign, { readConfiguredDefaultModel }, { isCodexReasoningEffort }] = await Promise.all([
+    import("../../codex/role-sizing"),
+    import("../../codex/role-auto-assign"),
+    import("../../codex/catalog/parsing"),
+    import("../../reasoning-effort"),
+  ]);
+  const sizingModel = resolveSizingModel(options.sizingModel, readConfiguredDefaultModel);
+  const answer = await (options.completeRoleSizing ?? completeThroughProxy)({
+    model: sizingModel,
+    system: sizing.DELEGATED_WORK_SIZING_SYSTEM_PROMPT,
+    user: sizing.buildRoleSizingUserMessage([{ role: DELEGATED_WORK_ROLE, instructions: options.work }]),
+  }, options.config);
+  const sizingError = answer.error ? publicSizingError(answer.error) : null;
+  const outcomes = sizingError
+    ? new Map([[DELEGATED_WORK_ROLE, { unsized: `the sizing call failed: ${sizingError}` }]])
+    : sizing.parseRoleSizingResponse(answer.text, [DELEGATED_WORK_ROLE]);
+  const candidates = (await modelCandidates(options.offered, options.models))
+    .map(candidate => ({ ...candidate, efforts: candidate.efforts.filter(isCodexReasoningEffort) }));
+  const classified = assign.classifyRoleModelCandidates(candidates, options.config.codexRoleTiers);
+  const [proposal] = assign.buildRoleProposals([{
+    role: DELEGATED_WORK_ROLE,
+    model: options.config.injectionModel ?? null,
+    effort: options.config.injectionEffort ?? null,
+  }], outcomes, classified, { alwaysProposeEffort: true });
+  return {
+    sizingModel,
+    sizingError,
+    proposal: proposal!,
+    candidates: classified.map(({ model, tier, tierSource, unitPrice }) => ({ model, tier, tierSource, unitPrice })),
+  };
+}

package/src/server/management/combo-routes.ts

@@ -66,6 +66,8 @@ import type { MetricUnavailableReason, TokPerSecondResult, CostEstimateReason, C
 import type { ManagementContext } from "./context";
 import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
 import { shadowCallTargetError } from "./shadow-call-validation";
+import { decisionModelRouteError, normalizeDecisionModelSelector } from "./decision-model-validation";
+import { comboConfigIssues, resolveComboId } from "../../combos/types";
 import { COMBO_DEFAULT_WAIT_FOR_COOLDOWN_MS } from "../../combos";
 
 
@@ -221,13 +223,62 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
       ...(!Object.hasOwn(requestedCombo, "defaultEffortMode") && previous?.defaultEffortMode !== undefined
         ? { defaultEffortMode: previous.defaultEffortMode }
         : {}),
+      // An API or CLI round-trip of a JEV combo that omits these keeps them; the dashboard sends
+      // both explicitly (null = default). Switching to another strategy drops them rather than
+      // failing validation.
+      ...(!Object.hasOwn(requestedCombo, "decisionProvider")
+        && !Object.hasOwn(requestedCombo, "decisionModel")
+        && previous?.decisionProvider !== undefined
+        && requestedCombo.strategy === "jev"
+        ? { decisionProvider: previous.decisionProvider }
+        : {}),
+      ...(!Object.hasOwn(requestedCombo, "decisionModel")
+        && !Object.hasOwn(requestedCombo, "decisionProvider")
+        && previous?.decisionModel !== undefined
+        && requestedCombo.strategy === "jev"
+        ? { decisionModel: previous.decisionModel }
+        : {}),
+      ...(!Object.hasOwn(requestedCombo, "decisionTimeoutMs")
+        && previous?.decisionTimeoutMs !== undefined
+        && requestedCombo.strategy === "jev"
+        ? { decisionTimeoutMs: previous.decisionTimeoutMs }
+        : {}),
     };
-    const error = comboConfigError(id, effectiveCombo, config.providers, {
+    const nextCombos = { ...(config.combos ?? {}) };
+    if (renameFrom) delete nextCombos[renameFrom];
+    nextCombos[id] = effectiveCombo as unknown as OcxComboConfig;
+    const prospectiveConfig = { ...config, combos: nextCombos };
+    // Decision routes follow the same combo identity migration as agent/shadow references,
+    // retaining any synthetic suffix while resolving the old identity against the old map.
+    if (previous) {
+      const nextPublicModel = comboPublicModelId(id, nextCombos[id]!);
+      for (const [otherId, combo] of Object.entries(nextCombos)) {
+        if (otherId === id || typeof combo.decisionModel !== "string") continue;
+        const model = combo.decisionModel.trim();
+        const selector = normalizeDecisionModelSelector(config, model);
+        if (resolveComboId(config, selector) !== sourceId) continue;
+        const nextSelector = selector === comboModelId(sourceId) ? comboModelId(id) : nextPublicModel;
+        nextCombos[otherId] = { ...combo, decisionModel: nextSelector + model.slice(selector.length) };
+      }
+    }
+    const validationOptions = {
       requireEnabledTarget: true,
-      combos: config.combos,
+      requireUsableDecisionService: true,
+      combos: nextCombos,
       excludeComboId: sourceId,
-    });
+      normalizeDecisionModel: (model: string) => normalizeDecisionModelSelector(prospectiveConfig, model),
+    };
+    const error = comboConfigError(id, effectiveCombo, config.providers, validationOptions);
     if (error) return jsonResponse({ error }, 400);
+    for (const [otherId, combo] of Object.entries(nextCombos)) {
+      if (typeof combo.decisionModel !== "string") continue;
+      const issue = otherId === id ? undefined : comboConfigIssues(otherId, combo, config.providers, {
+        combos: nextCombos,
+        normalizeDecisionModel: validationOptions.normalizeDecisionModel,
+      }).find(issue => issue.path[0] === "decisionModel");
+      const routeError = issue?.message ?? decisionModelRouteError(prospectiveConfig, otherId, combo.decisionModel);
+      if (routeError) return jsonResponse({ error: issue ? `combo "${otherId}": ${routeError}` : routeError }, 400);
+    }
     const normalized = normalizeComboConfig(effectiveCombo as unknown as OcxComboConfig);
     // Persist only non-default identity/capability fields so config stays sparse.
     // Capability defaults (`imageInput`, `reasoningEffortMode`) go through the same
@@ -267,8 +318,6 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
     if (codexAccountNamespaceForModel(config.codexAccountNamespaces, newPublicModel)) {
       return jsonResponse({ error: CODEX_ACCOUNT_NAMESPACE_COMBO_ALIAS_COLLISION_ERROR }, 409);
     }
-    const nextCombos = { ...(config.combos ?? {}) };
-    if (renameFrom) delete nextCombos[renameFrom];
     nextCombos[id] = stored;
     let shouldSyncClaudeAgentDefs = false;
     const migratedModels = new Map<string, string>();
@@ -362,6 +411,14 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
     if (!Object.hasOwn(config.combos ?? {}, id)) {
       return jsonResponse({ error: "unknown combo" }, 404);
     }
+    const dependents = Object.entries(config.combos ?? {}).filter(([otherId, combo]) =>
+      otherId !== id && typeof combo.decisionModel === "string"
+      && resolveComboId(config, normalizeDecisionModelSelector(config, combo.decisionModel.trim())) === id,
+    ).map(([otherId]) => otherId);
+    if (dependents.length) {
+      return jsonResponse({ error: `combo "${id}" is referenced by decisionModel in combos: ${dependents.join(", ")}`,
+        code: "combo_has_dependent_combos", combos: dependents }, 409);
+    }
     const { clearComboSelectionState, clearComboTargetCooldowns } = await import("../../combos");
     delete config.combos![id];
     if (Object.keys(config.combos!).length === 0) deleteConfigTopLevelKey(config, "combos");

package/src/server/management/config-routes.ts

@@ -1,3 +1,7 @@
+import { MAIN_ACCOUNT_HARD_LOCK_MIN_PERCENT } from "../../codex/quota-types";
+import { resolveMainAccountHardLockThresholds } from "../../codex/main-account-hard-lock";
+import { getMainAccountExternalUsageWarning } from "../../codex/main-account-external-usage";
+import { getObservedMainQuotaIdentityKey } from "../../codex/main-account-cache";
 import { compactionRoutingSchema, memoryModelsSchema } from "../../config/schema/leaf-validators";
 import { compactionRecoverySchema } from "../../config/schema/compaction-recovery";
 import { captureConfigTopLevelRollback } from "../../config/rebase-provenance";
@@ -363,7 +367,8 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       // Absent means on by default: the GUI renders a switch enabled unless explicit false.
       fastRows: config.fastRows !== false,
       codexMainAccountHardLock: isMainAccountHardLockEnabled(config),
-      mainAccountHardLock: getMainAccountHardLockStatus(config),
+      mainAccountHardLock: { ...getMainAccountHardLockStatus(config),
+        externalUsage: getMainAccountExternalUsageWarning(getObservedMainQuotaIdentityKey()) },
       // Absent means the historical auto-open, so the GUI can render the toggle
       // without having to know that `undefined` and `true` mean the same thing.
       oauthOpenBrowser: config.oauthOpenBrowser !== false,
@@ -467,6 +472,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       ultraFastTier?: unknown;
       fastRows?: unknown;
       codexMainAccountHardLock?: unknown;
+      codexMainAccountHardLockThresholds?: unknown;
       codexDesktopAuthless?: unknown;
       codexClientCompaction?: unknown;
       compactionRouting?: unknown;
@@ -483,12 +489,13 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       && body.ultraFastTier === undefined
       && body.fastRows === undefined
       && body.codexMainAccountHardLock === undefined
+      && body.codexMainAccountHardLockThresholds === undefined
       && body.codexDesktopAuthless === undefined
       && body.codexClientCompaction === undefined
       && body.compactionRouting === undefined
       && body.compactionRecovery === undefined
       && body.memoryModels === undefined) {
-      return jsonResponse({ error: "provide codexAutoStart, streamMode, appOwnedMemoryBudgetMb, codexAccountPickerEnabled, codexQuotaAutoRefresh, oauthOpenBrowser, showCodexCredits, ultraFastTier, fastRows, codexMainAccountHardLock, codexDesktopAuthless, codexClientCompaction, compactionRouting, compactionRecovery, or memoryModels" }, 400);
+      return jsonResponse({ error: "provide codexAutoStart, streamMode, appOwnedMemoryBudgetMb, codexAccountPickerEnabled, codexQuotaAutoRefresh, oauthOpenBrowser, showCodexCredits, ultraFastTier, fastRows, codexMainAccountHardLock, codexMainAccountHardLockThresholds, codexDesktopAuthless, codexClientCompaction, compactionRouting, compactionRecovery, or memoryModels" }, 400);
     }
     if (body.codexAutoStart !== undefined && typeof body.codexAutoStart !== "boolean") {
       return jsonResponse({ error: "codexAutoStart boolean is required" }, 400);
@@ -515,6 +522,24 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
     if (body.codexMainAccountHardLock !== undefined && typeof body.codexMainAccountHardLock !== "boolean") {
       return jsonResponse({ error: "codexMainAccountHardLock boolean is required" }, 400);
     }
+    let hardLockThresholds: OcxConfig["codexMainAccountHardLockThresholds"];
+    if (body.codexMainAccountHardLockThresholds !== undefined) {
+      const value = body.codexMainAccountHardLockThresholds;
+      if (!value || typeof value !== "object" || Array.isArray(value)
+        || Object.keys(value).length === 0
+        || Object.keys(value).some(key => key !== "short" && key !== "long")
+        || Object.values(value).some(percent => typeof percent !== "number" || !Number.isInteger(percent)
+          || percent < MAIN_ACCOUNT_HARD_LOCK_MIN_PERCENT || percent > 100)) {
+        return jsonResponse({ error: "codexMainAccountHardLockThresholds requires integer short/long percentages from 80 to 100" }, 400);
+      }
+      // A partial body updates one window and keeps the other stored value.
+      hardLockThresholds = { ...config.codexMainAccountHardLockThresholds,
+        ...(value as NonNullable<OcxConfig["codexMainAccountHardLockThresholds"]>) };
+      const defaults = resolveMainAccountHardLockThresholds(undefined);
+      if ((hardLockThresholds.short ?? defaults.short) > (hardLockThresholds.long ?? defaults.long)) {
+        return jsonResponse({ error: "codexMainAccountHardLockThresholds short must not exceed long" }, 400);
+      }
+    }
     if (body.codexDesktopAuthless !== undefined && typeof body.codexDesktopAuthless !== "boolean") {
       return jsonResponse({ error: "codexDesktopAuthless boolean is required" }, 400);
     }
@@ -586,6 +611,8 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       hasUltraFastTier: Object.hasOwn(config, "ultraFastTier"),
       fastRows: config.fastRows,
       hasFastRows: Object.hasOwn(config, "fastRows"),
+      codexMainAccountHardLockThresholds: config.codexMainAccountHardLockThresholds,
+      hasCodexMainAccountHardLockThresholds: Object.hasOwn(config, "codexMainAccountHardLockThresholds"),
       codexMainAccountHardLock: config.codexMainAccountHardLock,
       hasCodexMainAccountHardLock: Object.hasOwn(config, "codexMainAccountHardLock"),
       codexDesktopAuthless: config.codexDesktopAuthless,
@@ -630,6 +657,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       else if (body.fastRows === true) deleteConfigTopLevelKey(config, "fastRows");
       // Inverted from the pair above because the default is on (#5694): off is the persisted
       // decision, so it writes `false`, while on deletes the key and returns to the default.
+      if (hardLockThresholds !== undefined) config.codexMainAccountHardLockThresholds = { ...hardLockThresholds };
       if (body.codexMainAccountHardLock === false) config.codexMainAccountHardLock = false;
       else if (body.codexMainAccountHardLock === true) deleteConfigTopLevelKey(config, "codexMainAccountHardLock");
       if (body.codexDesktopAuthless === true) config.codexDesktopAuthless = true;
@@ -684,6 +712,9 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       if (previousSettings.hasFastRows) {
         config.fastRows = previousSettings.fastRows;
       } else deleteConfigTopLevelKey(config, "fastRows");
+      if (previousSettings.hasCodexMainAccountHardLockThresholds) {
+        config.codexMainAccountHardLockThresholds = previousSettings.codexMainAccountHardLockThresholds;
+      } else deleteConfigTopLevelKey(config, "codexMainAccountHardLockThresholds");
       if (previousSettings.hasCodexMainAccountHardLock) {
         config.codexMainAccountHardLock = previousSettings.codexMainAccountHardLock;
       } else deleteConfigTopLevelKey(config, "codexMainAccountHardLock");
@@ -752,7 +783,8 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       // phases as "Off" while the server kept them.
       memoryModels: config.memoryModels ?? null,
       codexMainAccountHardLock: isMainAccountHardLockEnabled(config),
-      mainAccountHardLock: getMainAccountHardLockStatus(config),
+      mainAccountHardLock: { ...getMainAccountHardLockStatus(config),
+        externalUsage: getMainAccountExternalUsageWarning(getObservedMainQuotaIdentityKey()) },
       startupHealth: await readStartupHealthSnapshot(config),
     });
   }

package/src/server/management/context.ts

@@ -48,6 +48,7 @@ export interface ManagementApiDeps {
   /** Bound to this server's lifecycle owner; absent in direct route tests. */
   listLowQuotaEvents?: (limit?: number) => LowQuotaEvent[];
   /** Bound Claude intercept state, injectable for isolated management-route tests. */
+  ensureClaudeIntercept?: () => Promise<import("../../claude/intercept/runtime").ClaudeInterceptOutcome>;
   getClaudeInterceptState?: typeof import("../../claude/intercept/runtime").getClaudeInterceptState;
   /** Reconciliation seam for field-scoped rollback tests. */
   reconcileClaudeFirstPartySettings?: typeof import("../../claude/first-party-settings").reconcileClaudeFirstPartySettings;
@@ -84,6 +85,8 @@ export interface ManagementApiDeps {
    * Tests stub it to orphan the fixture file mid-fetch (the r7 recheck test).
    */
   fetchAllModels?: (config: OcxConfig) => Promise<CatalogModel[]>;
+  /** Codex role auto-assign's one sizing model call; route tests answer it without a provider. */
+  completeCodexRoleSizing?: import("./codex-role-auto-assign").CompleteRoleSizing;
   /**
    * Writer seam for the Grok toggle: lets a test place the file in any state
    * between the pre-write recheck and the write itself (the r8 post-inspection
@@ -149,7 +152,7 @@ export interface ManagementApiDeps {
   codexPromptPaths?: CodexPromptPaths;
   /** Link seams are getters so the optional listener and supervisor are singletons. */
   linkSupervisor?: () => LinkSupervisor;
-  linkListener?: () => Pick<LinkListenerLifecycle<unknown>, "ensureStarted" | "status" | "close" | "onAuthenticatedCatalog">;
+  linkListener?: () => Pick<LinkListenerLifecycle<unknown>, "ensureStarted" | "status" | "close" | "onAuthenticatedCatalog"> & Partial<Pick<import("../index/optional-listeners").OptionalListenerSet<unknown>, "ensureClaudeIntercept" | "claudeInterceptOutcome">>;
   readLinkStore?: () => LinkStore;
   writeLinkStore?: (store: LinkStore) => void;
   linkKnownHostsPath?: () => string;