@bitkyc08/opencodex 2.75.0 → 2.76.0

package/src/server/management/decision-discovery.ts

@@ -0,0 +1,74 @@
+// Carried from PR #6185 by yxr1995-maker and PR #6275 by codingbooo.
+/**
+ * Discovery of decision-capable models in the Codex catalog.
+ *
+ * A decision destination does not have to be configured by hand: gateways resell the System One
+ * contract under their own model ids (the OpenCode zen gateway serves `jev-1.13`, an aggregator may
+ * expose `typesafe-ai/jev`). This module answers the two pure questions such a search needs — which
+ * catalog rows look like decision models, and where that provider's System One endpoint lives — so
+ * the route only has to do the IO and the answer checks stay in one place.
+ */
+
+export interface DiscoveryModelRow {
+  provider?: string;
+  id: string;
+  namespaced?: string;
+  owned_by?: string;
+  pricingStatus?: string;
+  displayName?: string;
+  disabled?: boolean;
+}
+
+/**
+ * Spellings that name a decision service rather than a generating model.
+ *
+ * Deliberately conservative: a bare `decision` or `jev` token, `systemone`, and the hyphenated
+ * spelling. Substring hits like `jeveux` do not qualify, because a false candidate costs a probe.
+ */
+export const DECISION_MODEL_HINT = /(?:^|[^a-z0-9])(?:jev|systemone|system-one|decision)(?:[^a-z0-9]|$)/i;
+
+const normalize = (value: string) => value.trim().toLowerCase();
+
+/**
+ * True when a catalog row is worth probing as a decision model.
+ *
+ * An explicit query replaces the heuristic: an operator searching for a term knows what they mean,
+ * and a search that silently keeps the built-in filter would hide the model they asked for.
+ */
+export function isDecisionModelCandidate(row: DiscoveryModelRow, query = ""): boolean {
+  const term = normalize(query);
+  const haystack = `${row.id} ${row.owned_by ?? ""} ${row.displayName ?? ""}`.toLowerCase();
+  if (term.length > 0) return haystack.includes(term);
+  return DECISION_MODEL_HINT.test(row.id) || DECISION_MODEL_HINT.test(row.owned_by ?? "");
+}
+
+/**
+ * The System One endpoint for a provider, derived from its API prefix.
+ *
+ * TypeSafe serves it at `<base>/v1/systemone` and the OpenCode zen gateway at `<base>/zen/v1/systemone`
+ * — in both cases the segment sits directly after the provider's own prefix, so appending is the
+ * rule, and a baseUrl that already names it is returned unchanged. Anything that is not an absolute
+ * http(s) URL yields `null` rather than a guess.
+ */
+export function systemOneEndpoint(baseUrl: string | undefined): string | null {
+  const trimmed = (baseUrl ?? "").trim().replace(/\/+$/, "");
+  if (!/^https?:\/\//i.test(trimmed)) return null;
+  return trimmed.endsWith("/systemone") ? trimmed : `${trimmed}/systemone`;
+}
+
+/** Deduplicate by provider+model so a row that appears twice is probed once. */
+export function uniqueDiscoveryCandidates(
+  rows: readonly DiscoveryModelRow[],
+  query = "",
+): DiscoveryModelRow[] {
+  const seen = new Set<string>();
+  const candidates: DiscoveryModelRow[] = [];
+  for (const row of rows) {
+    if (!row?.provider || typeof row.id !== "string" || !isDecisionModelCandidate(row, query)) continue;
+    const key = `${row.provider}/${row.id}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    candidates.push(row);
+  }
+  return candidates;
+}

package/src/server/management/decision-model-validation.ts

@@ -0,0 +1,80 @@
+import { resolveComboId } from "../../combos/identifiers";
+import { comboDependsOnProvider } from "../../combos/types";
+import { previewRouteModel } from "../../router";
+import type { OcxComboConfig, OcxConfig, OcxProviderConfig } from "../../types";
+import { parseSyntheticRowId } from "../fast-row";
+
+/** Resolve synthetic selectors using the same prospective config as route preview. */
+export function normalizeDecisionModelSelector(config: OcxConfig, model: string): string {
+  const parsed = parseSyntheticRowId(model, config);
+  return parsed.fastRow?.baseId ?? parsed.effortRow?.baseId ?? model;
+}
+
+/**
+ * Whether deleting provider `name` would leave `combo` invalid. Beyond the lexical check in
+ * `comboDependsOnProvider`, a decision model is resolved the way routing resolves it, so a
+ * provider alias (`judge/model`) or an unqualified model served by the default provider still
+ * counts as a dependency instead of silently falling through to whatever routes it next.
+ */
+export function comboDependsOnProviderRoute(config: OcxConfig, combo: OcxComboConfig, name: string): boolean {
+  if (comboDependsOnProvider(combo, name)) return true;
+  if (typeof combo.decisionModel !== "string" || !combo.decisionModel.trim()) return false;
+  const selector = normalizeDecisionModelSelector(config, combo.decisionModel.trim());
+  const slash = selector.indexOf("/");
+  const prefix = slash > 0 ? selector.slice(0, slash).toLowerCase() : "";
+  if (prefix && (prefix === name.toLowerCase() || prefix === config.providers[name]?.alias?.toLowerCase())) return true;
+  try {
+    return previewRouteModel(config, selector).providerName === name;
+  } catch {
+    return false;
+  }
+}
+
+/** Save-time validation uses preview routing, so it never advances combo selection state. */
+export function decisionModelRouteError(config: OcxConfig, comboId: string | undefined, model: string): string | null {
+  // Standalone decision-test probes have no saved combo identity yet.
+  const subject = comboId ? `combo "${comboId}" decisionModel` : "decisionModel";
+  const selector = normalizeDecisionModelSelector(config, model.trim());
+  const referenced = resolveComboId(config, selector);
+  if (referenced === comboId || (referenced && config.combos?.[referenced]?.strategy === "jev")) {
+    return `${subject} must not reference ${referenced === comboId ? "itself" : "a JEV combo"} (combo "${referenced}")`;
+  }
+  try {
+    const route = previewRouteModel(config, selector);
+    // Match shadow-call validation: a qualified typo must not silently use the default row.
+    if (route.routeKind === "default-provider" && selector.includes("/")) {
+      return `${subject} must resolve to a configured provider`;
+    }
+    if (route.provider.adapter === "jev-decision") {
+      return `${subject} must not route to a jev-decision provider`;
+    }
+    if (route.combo && (route.combo.comboId === comboId || config.combos?.[route.combo.comboId]?.strategy === "jev")) {
+      return `${subject} must not route to JEV combo "${route.combo.comboId}"`;
+    }
+    return null;
+  } catch {
+    return `${subject} must resolve to a configured provider`;
+  }
+}
+
+/** Adapter edits cannot turn a referenced inference row into a decision-only service. */
+export function decisionModelProviderPatchError(config: OcxConfig, name: string, candidate: OcxProviderConfig): string | null {
+  if (candidate.adapter !== "jev-decision") return null;
+  const prospective = { ...config, providers: { ...config.providers, [name]: candidate } };
+  for (const [id, combo] of Object.entries(config.combos ?? {})) {
+    if (typeof combo.decisionModel !== "string") continue;
+    const selector = normalizeDecisionModelSelector(config, combo.decisionModel.trim());
+    const slash = selector.indexOf("/");
+    const prefix = slash > 0 ? selector.slice(0, slash).toLowerCase() : "";
+    const explicit = !!prefix && (prefix === name.toLowerCase() || prefix === config.providers[name]?.alias?.toLowerCase());
+    // Unrelated unusable routes remain runtime fail-open cases. A qualified dependency
+    // still counts when the old row is disabled and preview cannot resolve it.
+    if (!explicit) {
+      try { if (previewRouteModel(config, selector).providerName !== name) continue; }
+      catch { continue; }
+    }
+    const error = decisionModelRouteError(prospective, id, combo.decisionModel);
+    if (error) return error;
+  }
+  return null;
+}

package/src/server/management/decision-routes.ts

@@ -0,0 +1,160 @@
+import { jsonResponse } from "../auth-cors";
+import type { ManagementContext } from "./context";
+import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
+import { isPlainRecord } from "./shared";
+import { systemOneEndpoint, uniqueDiscoveryCandidates, type DiscoveryModelRow } from "./decision-discovery";
+
+const PROBE_TASK = "Verify the configured decision method with a two-option probe.";
+const PROBE_CANDIDATE = {
+  key: "probe/decision",
+  provider: "probe",
+  model: "decision",
+  reasoningEfforts: ["low", "high"],
+} as const;
+const MAX_DECISION_MODEL_CHARS = 512;
+
+function optionalString(body: Record<string, unknown>, key: string): string | null | undefined | false {
+  const value = body[key];
+  if (value === undefined || value === null) return undefined;
+  if (typeof value !== "string") return false;
+  const trimmed = value.trim();
+  return trimmed ? trimmed : null;
+}
+
+type DecisionRow = import("../../types").OcxProviderConfig;
+
+/** Why a decision-service row cannot answer, shared by discovery and the probe. */
+function decisionServiceIssue(
+  id: string,
+  provider: DecisionRow,
+  isSystemOneEndpoint: (url: string) => boolean,
+): { url: string; model: string; issue?: "disabled" | "endpoint" | "model" } {
+  const url = typeof provider.baseUrl === "string" ? provider.baseUrl.trim().replace(/\/+$/, "") : "";
+  const model = provider.defaultModel?.trim() || provider.models?.[0]?.trim() || "";
+  const issue = provider.disabled === true
+    ? "disabled"
+    : id === "jev"
+      ? undefined
+      : !isSystemOneEndpoint(url)
+        ? "endpoint"
+        : !model ? "model" : undefined;
+  return { url, model, ...(issue ? { issue } : {}) };
+}
+
+/**
+ * Decision-method management surfaces for JEV combos.
+ *
+ * - POST /api/combos/decision-test runs one bounded decision with a synthetic two-option probe
+ *   through the same backend a combo would use, saved or not. It may spend a decision call.
+ * - GET /api/combos/decision-discovery lists configured System One rows and catalog models whose
+ *   names look like decision services, with the System One endpoint their provider would serve.
+ *   Nothing is probed and nothing is written.
+ *
+ * The probe selects its method only from the body's `decisionProvider` / `decisionModel`; none
+ * means TypeSafe. `comboId` names the combo for the recursion rules and never loads its saved
+ * method, because the dashboard probes an unsaved TypeSafe draft by sending `comboId` alone.
+ * `ocx combo test --combo` resolves the saved method on the client before calling this.
+ */
+export async function handleDecisionRoutes(ctx: ManagementContext): Promise<Response | null> {
+  const { req, url, config } = ctx;
+
+  if (url.pathname === "/api/combos/decision-test" && req.method === "POST") {
+    let rawBody: unknown;
+    try { rawBody = await readManagementJsonBody(req); } catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid JSON body" }, 400); }
+    if (!isPlainRecord(rawBody)) return jsonResponse({ error: "request body must be an object" }, 400);
+    const decisionProvider = optionalString(rawBody, "decisionProvider");
+    const decisionModel = optionalString(rawBody, "decisionModel");
+    const comboId = optionalString(rawBody, "comboId");
+    if (decisionProvider === false || decisionModel === false || comboId === false) {
+      return jsonResponse({ error: "decisionProvider, decisionModel and comboId must be strings" }, 400);
+    }
+    if (decisionProvider && decisionModel) {
+      return jsonResponse({ error: "choose either decisionProvider or decisionModel, not both" }, 400);
+    }
+    const timeout = rawBody.decisionTimeoutMs;
+    const { JEV_DECISION_TIMEOUT_MAX_MS, JEV_DECISION_TIMEOUT_MIN_MS } = await import("../../combos/types");
+    if (timeout !== undefined && timeout !== null && (typeof timeout !== "number" || !Number.isInteger(timeout)
+      || timeout < JEV_DECISION_TIMEOUT_MIN_MS || timeout > JEV_DECISION_TIMEOUT_MAX_MS)) {
+      return jsonResponse({
+        error: `decisionTimeoutMs must be an integer from ${JEV_DECISION_TIMEOUT_MIN_MS} to ${JEV_DECISION_TIMEOUT_MAX_MS}`,
+      }, 400);
+    }
+    if (decisionProvider && decisionProvider !== "jev") {
+      const row = Object.hasOwn(config.providers, decisionProvider) ? config.providers[decisionProvider] : undefined;
+      if (row?.adapter !== "jev-decision") {
+        return jsonResponse({ error: `decisionProvider "${decisionProvider}" is not a configured decision service` }, 400);
+      }
+      // Match the combo PUT: a disabled or model-less row is refused by name, not probed into a
+      // generic fail-open gate.
+      const { isSystemOneEndpoint } = await import("../../combos/types");
+      const { issue } = decisionServiceIssue(decisionProvider, row, isSystemOneEndpoint);
+      if (issue) {
+        return jsonResponse({ error: `decisionProvider "${decisionProvider}" is not usable (${issue})`, issue }, 400);
+      }
+    }
+    if (decisionModel) {
+      if (decisionModel.length > MAX_DECISION_MODEL_CHARS) {
+        return jsonResponse({ error: "decisionModel is too long" }, 400);
+      }
+      const { decisionModelRouteError } = await import("./decision-model-validation");
+      const routeError = decisionModelRouteError(config, comboId || undefined, decisionModel);
+      if (routeError) return jsonResponse({ error: routeError }, 400);
+    }
+    const { resolveJevComboDecision } = await import("../../combos/jev-dispatch");
+    let invokeModel: import("../../combos/jev-model-backend").JevModelInvoke | undefined;
+    if (decisionModel) {
+      const [{ createJevModelInvoker }, { handleResponses }] = await Promise.all([
+        import("../responses/jev-model-invoke"),
+        import("../responses/core"),
+      ]);
+      invokeModel = createJevModelInvoker({
+        req: new Request("http://localhost/api/combos/decision-test"),
+        config,
+        options: {},
+        handleResponses,
+      });
+    }
+    const fallback = { targetKey: PROBE_CANDIDATE.key, effort: null };
+    const decision = await resolveJevComboDecision({
+      body: { input: PROBE_TASK },
+      candidates: [{ ...PROBE_CANDIDATE, reasoningEfforts: [...PROBE_CANDIDATE.reasoningEfforts] }],
+      fallback,
+      config,
+      ...(decisionProvider ? { decisionProvider } : {}),
+      ...(decisionModel && invokeModel ? { decisionModel, invokeModel } : {}),
+      ...(typeof timeout === "number" ? { timeoutMs: timeout } : {}),
+      signal: req.signal,
+    });
+    return jsonResponse({
+      ok: decision.gate === "apply",
+      backend: decision.backend,
+      gate: decision.gate,
+      latencyMs: decision.latencyMs,
+      ...(decision.gate === "apply" && decision.effort ? { effort: decision.effort } : {}),
+    });
+  }
+
+  if (url.pathname === "/api/combos/decision-discovery" && req.method === "GET") {
+    const query = (url.searchParams.get("q") ?? "").slice(0, 128);
+    const { isSystemOneEndpoint } = await import("../../combos/types");
+    const configured = Object.entries(config.providers)
+      .filter(([, provider]) => provider.adapter === "jev-decision")
+      .map(([id, provider]) => {
+        const { url, model, issue } = decisionServiceIssue(id, provider, isSystemOneEndpoint);
+        return { id, url, ...(model ? { model } : {}), usable: issue === undefined, ...(issue ? { issue } : {}) };
+      });
+    const { listManagementModelRows } = await import("./model-rows");
+    const rows = (await listManagementModelRows(config)) as unknown as DiscoveryModelRow[];
+    const discovered = uniqueDiscoveryCandidates(rows, query)
+      .flatMap(row => {
+        const provider = config.providers[row.provider!];
+        if (!provider || provider.disabled === true || provider.adapter === "jev-decision") return [];
+        const endpoint = systemOneEndpoint(provider.baseUrl);
+        return endpoint ? [{ provider: row.provider!, model: row.id, endpoint }] : [];
+      })
+      .slice(0, 50);
+    return jsonResponse({ configured, discovered });
+  }
+
+  return null;
+}

package/src/server/management/native-integration-routes.ts

@@ -1,3 +1,4 @@
+import { ensureManagementClaudeIntercept, interceptStartRefusal } from "./claude-intercept-routes";
 import { persistCommittedDesktopGateway } from "../../claude/desktop-gateway-state";
 import { commitClaudeCodeBlock } from "../../claude/claude-code-block";
 /**
@@ -94,6 +95,7 @@ export interface NativeToggleEnvelope {
   desiredEnabled: boolean;
   /** Present when the outcome needs more than success/failure to be honest. */
   reason?: string;
+  interceptReason?: string | null;
   artifacts?: CodexNativeRestoreResult["artifacts"];
 }
 
@@ -748,6 +750,13 @@ async function handleClaudeDesktopToggle(ctx: ManagementContext): Promise<Respon
     }
 
     if (resolveClaudeDesktopApplyMode(current, observeClaudeDesktopMode(current)) === "first-party") {
+      const startRefusal = interceptStartRefusal(ctx);
+      if (startRefusal) return startRefusal;
+      const started = await ensureManagementClaudeIntercept(ctx);
+      if (!started.ok) return jsonResponse({ ...started, code: started.reason }, 409);
+      const { claudeInterceptProxyPort } = await import("../../claude/intercept/runtime");
+      const configured = claudeInterceptProxyPort(current, current.port ?? 10100);
+      if (started.state.proxyPort !== configured) return jsonResponse({ ok: false, code: "port_mismatch", bound: started.state.proxyPort, configured }, 409);
       // The whole switch runs under the picker lock, in today's order: env first, then gateway cleanup.
       return await runPickerTransition(current, async ops => {
         const rollback = captureDesktopFirstPartyRollback(current);
@@ -924,11 +933,18 @@ export async function handleNativeIntegrationRoutes(ctx: ManagementContext): Pro
       throw error;
     }
 
+    let interceptReason = enabled && interceptStartRefusal(ctx) ? "intercept_start_forbidden" : null;
+    if (enabled && !interceptReason) {
+      const outcome = await ensureManagementClaudeIntercept(ctx);
+      if (!outcome.ok) interceptReason = outcome.reason;
+    }
+
     return jsonResponse({
       ok: true, clientId: "claude", changed: true,
       state: enabled ? "current" : "absent",
       desiredEnabled: enabled,
       message: enabled ? "Claude inbound enabled" : "Claude inbound disabled",
+      interceptReason,
     } satisfies NativeToggleEnvelope);
   }
 

package/src/server/management/provider-routes.ts

@@ -74,7 +74,8 @@ import { clearAccountQuotaCache, clearProviderQuotaCache, fetchProviderQuotaRepo
 import { getCachedProviderRoutingQuota } from "../../providers/quota-routing-cache";
 import { PROVIDER_QUOTA_MAX_AGE_MS, type ProviderRoutingQuota } from "../../providers/quota-types";
 import { cachedProviderQuotaIsExhausted } from "../../combos/resolve";
-import { resolveJevDecision } from "../../combos/jev";
+import { probeJevDecisionProvider } from "../../combos/jev";
+import { comboDependsOnProviderRoute } from "./decision-model-validation";
 import { clearKeyCooldowns, forgetApiKeyRotationCursor } from "../../providers/key-failover";
 import { providerRequestPacingStatus } from "../../providers/request-pacing";
 import { CODEX_FORWARD_BASE_URL, isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
@@ -137,6 +138,7 @@ import { isPlainRecord, parseDebugLogQuery, tokPerSecondResult, unavailableCostR
 import type { MetricUnavailableReason, TokPerSecondResult, CostEstimateReason, CostResult, MetricSource } from "./shared";
 import type { ManagementContext } from "./context";
 import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
+import { providerTlsProfileDiagnostic } from "../../lib/provider-tls-profile";
 
 type ProviderPatchApplication =
   | { error: string }
@@ -245,7 +247,7 @@ function providerEditorCandidate(
 
   for (const name of removedProviders) {
     const dependentCombos = Object.entries(persisted.combos ?? {})
-      .filter(([, combo]) => combo.targets.some(target => target.provider === name))
+      .filter(([, combo]) => comboDependsOnProviderRoute(persisted, combo, name))
       .map(([id]) => id)
       .sort((a, b) => a.localeCompare(b));
     if (dependentCombos.length > 0) {
@@ -930,8 +932,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
 
   if (url.pathname === "/api/providers" && req.method === "GET") {
     return jsonResponse(Object.entries(config.providers).map(([name, p]) => ({
-      name, adapter: p.adapter, baseUrl: publicProviderBaseUrl(p.baseUrl), defaultModel: p.defaultModel,
-      hasApiKey: !!p.apiKey,
+      name, adapter: p.adapter, baseUrl: publicProviderBaseUrl(p.baseUrl), defaultModel: p.defaultModel, hasApiKey: !!p.apiKey,
       // Presence only (#959 review): header names and values never leave the process.
       hasHeaders: !!p.headers && Object.keys(p.headers).length > 0,
       allowPrivateNetwork: p.allowPrivateNetwork === true,
@@ -962,7 +963,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       ...(name === "xai" ? { xaiResponsesOptInState: xaiResponsesOptInState(p) } : {}),
       // Only opt-in Fast lanes (Anthropic fast mode bills usage credits) get a dashboard switch.
       ...(getProviderRegistryEntry(name)?.fastOptIn === true ? { fastOptIn: { enabled: p.fastEnabled === true } } : {}),
-      discovery: p.liveModels === false ? undefined : getProviderDiscoveryStatus(name),
+      discovery: p.liveModels === false ? undefined : getProviderDiscoveryStatus(name), ...providerTlsProfileDiagnostic(name, p),
       ...(name === "openai" && isCanonicalOpenAiForwardProvider(p)
         ? { entitlement: getCodexModelEntitlementStatus(config) }
         : {}),
@@ -1489,6 +1490,15 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     const next = applied.next;
 
     const pacingOnly = keys.every(key => key === "requestPacing");
+    // A combo naming this row as its decisionProvider is only as valid as the row: an adapter
+    // or baseUrl edit could fail the combo's load-time checks and get it salvaged away on the
+    // next reload. Disabling the row stays allowed (not editorTouched; runtime fails open).
+    const decisionDependent = () => Object.values(config.combos ?? {})
+      .some(combo => (typeof combo.decisionProvider === "string" && combo.decisionProvider.trim() === name)
+        || (typeof combo.decisionModel === "string" && combo.decisionModel.trim().startsWith(`${name}/`)));
+    const { decisionModelProviderPatchError } = await import("./decision-model-validation");
+    const decisionModelError = applied.editorTouched ? decisionModelProviderPatchError(config, name, next) : null;
+    if (decisionModelError) return jsonResponse({ error: decisionModelError }, 400);
     if (applied.editorTouched && !pacingOnly) {
       const providerError = canonicalBudgetOnly
         ? canonicalOpenAiBudgetPatchError(next, rawBody, keys, config)
@@ -1514,6 +1524,10 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
         const resolvedError = await providerDestinationResolvedError(name, next, { allowBenchmarkAddresses });
         if (resolvedError) return jsonResponse({ error: resolvedError }, 400);
       }
+      if (decisionDependent()) {
+        const validation = validateConfigCandidate({ ...config, providers: { ...config.providers, [name]: next } });
+        if (!validation.ok) return jsonResponse({ error: validation.error }, 400);
+      }
     } else if (applied.enablingOpenAi) {
       // Same DNS gate as POST: Clash fake-IP only. Never honor a persisted
       // allowPrivateNetwork on this path — it must not bypass the built-in guard.
@@ -1567,8 +1581,10 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       // A PATCH that managed headers owns the resulting block: the clear path restores
       // registry static headers, so exact-match stripping must not erase them again.
       const candidate = replay.headersTouched ? replay.next : stripRegistryOnlyStaticHeaders(name, replay.next);
+      const decisionModelError = replay.editorTouched ? decisionModelProviderPatchError(config, name, candidate) : null;
+      if (decisionModelError) { replayError = decisionModelError; return; }
       const pinsTouched = Object.hasOwn(rawBody, "pinnedReasoningEffort") || Object.hasOwn(rawBody, "modelPinnedReasoningEfforts");
-      if (pinsTouched) {
+      if (pinsTouched || (replay.editorTouched && !pacingOnly && decisionDependent())) {
         const validation = validateConfigCandidate({ ...config, providers: { ...config.providers, [name]: candidate } });
         if (!validation.ok) { replayError = validation.error; return; }
       }
@@ -1616,34 +1632,13 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
         message: "Passthrough provider is configured (forwards your Codex login; no upstream /models).",
       });
     }
-    if (name === "jev" && providerMatchesRegistryTransport(name, prov)) {
-      const probe = { targetKey: "jev/probe", effort: null } as const;
-      const decision = await resolveJevDecision({
-        body: { input: "Verify the configured TypeSafe JEV decision service." },
-        candidates: [{
-          key: probe.targetKey,
-          provider: "jev",
-          model: "jev-latest",
-          reasoningEfforts: [],
-        }],
-        fallback: probe,
-        config,
-        signal: req.signal,
-      });
-      if (decision.gate === "apply") {
-        return jsonResponse({
-          ok: true,
-          latencyMs: decision.latencyMs,
-          message: "Connected. TypeSafe JEV answered a decision probe.",
-        });
+    // Decision services answer through the bounded JEV client. A retargeted `jev` row is neither
+    // TypeSafe nor a self-hosted service, so it is not probed at all: its key stays unsent.
+    if (prov.adapter === "jev-decision") {
+      if (name === "jev" && !providerMatchesRegistryTransport(name, prov)) {
+        return jsonResponse({ applicable: false, reason: "retargeted_decision_service", latencyMs: 0 });
       }
-      return jsonResponse({
-        ok: false,
-        latencyMs: decision.latencyMs,
-        error: decision.gate === "missing_key"
-          ? "TypeSafe JEV API key is not configured"
-          : `TypeSafe JEV decision probe failed (${decision.gate})`,
-      });
+      return jsonResponse(await probeJevDecisionProvider(config, name, { signal: req.signal }));
     }
     if (prov.liveModels === false) {
       // A static catalog has no live discovery endpoint to test. This is neither
@@ -1660,6 +1655,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     if (prov.authMode === "oauth" && !apiKey) {
       return jsonResponse({ ok: false, latencyMs: 0, error: "static catalog only — upstream not verified (not logged in)" });
     }
+    if (prov.adapter === "zed") return (await import("./zed-provider-probe")).probeZedProvider(prov, apiKey, snapshot?.providerUserId);
     if (prov.adapter === "cursor") {
       const started = Date.now();
       const live = await fetchCursorUsableModels({
@@ -1845,7 +1841,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       }, 409);
     }
     const dependentCombos = Object.entries(config.combos ?? {})
-      .filter(([, combo]) => combo.targets.some(target => target.provider === name))
+      .filter(([, combo]) => comboDependsOnProviderRoute(config, combo, name))
       .map(([id]) => id)
       .sort((a, b) => a.localeCompare(b));
     if (dependentCombos.length > 0) {

package/src/server/management/route-registry.ts

@@ -121,6 +121,7 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "PUT", path: "/api/codex-auth/accounts/alias", module: "codex/auth-api/routes", mutates: true },
   { method: "PUT", path: "/api/codex-auth/accounts/pause", module: "codex/auth-api/routes", mutates: true },
   { method: "PUT", path: "/api/codex-auth/accounts/pause-exhausted", module: "codex/auth-api/routes", mutates: true },
+  { method: "PUT", path: "/api/codex-auth/accounts/credits", module: "codex/auth-api/routes", mutates: true, exempt: { reason: "deferred-verb", why: "The credits switches ship on the dashboard Codex Auth header first; `ocx config set creditCodexAccountIds` covers scripted use until an account verb exists.", owner: "#6334 follow-up", ownerDoc: "structure/codex-account-controls.md" } },
   { method: "PUT", path: "/api/codex-auth/accounts/priority", module: "codex/auth-api/routes", mutates: true },
   { method: "PUT", path: "/api/codex-auth/active", module: "codex/auth-api/routes", mutates: true },
   { method: "PUT", path: "/api/codex-auth/auto-switch", module: "codex/auth-api/routes", mutates: true },
@@ -144,6 +145,7 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "GET", path: "/api/effort-caps", module: "server/management/agent-settings-routes", mutates: false },
   { method: "GET", path: "/api/grok", module: "server/management/agent-settings-routes", mutates: false },
   { method: "GET", path: "/api/injection-model", module: "server/management/agent-settings-routes", mutates: false },
+  { method: "POST", path: "/api/injection-model/suggest", module: "server/management/agent-settings-routes", mutates: false },
   { method: "GET", path: "/api/subagent-model-fallback", module: "server/management/agent-settings-routes", mutates: false },
   { method: "GET", path: "/api/subagent-models", module: "server/management/agent-settings-routes", mutates: false },
   { method: "GET", path: "/api/v2", module: "server/management/agent-settings-routes", mutates: false },
@@ -156,6 +158,9 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "PUT", path: "/api/claude-code", module: "server/management/agent-settings-routes", mutates: true },
   { method: "PUT", path: "/api/claude-desktop", module: "server/management/agent-settings-routes", mutates: true },
   { method: "PUT", path: "/api/claude-desktop/first-party-bindings", module: "server/management/agent-settings-routes", mutates: true },
+  // server/management/claude-intercept-routes
+  { method: "POST", path: "/api/claude-intercept/start", module: "server/management/claude-intercept-routes", mutates: true },
+
   // server/management/claude-desktop-picker-routes
   { method: "GET", path: "/api/claude-desktop/picker", module: "server/management/claude-desktop-picker-routes", mutates: false },
   { method: "PUT", path: "/api/claude-desktop/picker", module: "server/management/claude-desktop-picker-routes", mutates: true },
@@ -166,6 +171,10 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "PUT", path: "/api/subagent-model-fallback", module: "server/management/agent-settings-routes", mutates: true },
   { method: "PUT", path: "/api/subagent-models", module: "server/management/agent-settings-routes", mutates: true },
   { method: "PUT", path: "/api/v2", module: "server/management/agent-settings-routes", mutates: true },
+  // server/management/codex-agent-role-routes
+  { method: "GET", path: "/api/codex-agent-roles", module: "server/management/codex-agent-role-routes", mutates: false },
+  { method: "POST", path: "/api/codex-agent-roles/auto-assign", module: "server/management/codex-agent-role-routes", mutates: false, mechanism: "path-constant" },
+  { method: "PUT", path: "/api/codex-agent-roles/{role}", module: "server/management/codex-agent-role-routes", mutates: true, mechanism: "prefix-decode" },
   // server/management/aside-profile-routes
   { method: "GET", path: "/api/client-integrations/aside", module: "server/management/aside-profile-routes", mutates: false, mechanism: "path-constant", exempt: { reason: "compatibility-alias", why: "Legacy Aside status alias; the current CLI reads the same aggregate through GET /api/client-integrations/aside/profiles." } },
   { method: "PUT", path: "/api/client-integrations/aside", module: "server/management/aside-profile-routes", mutates: true, mechanism: "path-constant", exempt: { reason: "compatibility-alias", why: "Legacy Aside toggle alias; the current CLI uses PUT /api/client-integrations/aside/profiles so older servers cannot mistake a bulk request for a current-account toggle." } },
@@ -193,6 +202,9 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "DELETE", path: "/api/combos", module: "server/management/combo-routes", mutates: true },
   { method: "GET", path: "/api/combos", module: "server/management/combo-routes", mutates: false },
   { method: "PUT", path: "/api/combos", module: "server/management/combo-routes", mutates: true },
+  // server/management/decision-routes
+  { method: "GET", path: "/api/combos/decision-discovery", module: "server/management/decision-routes", mutates: false },
+  { method: "POST", path: "/api/combos/decision-test", module: "server/management/decision-routes", mutates: true },
   // server/management/config-routes
   { method: "GET", path: "/api/config", module: "server/management/config-routes", mutates: false },
   { method: "GET", path: "/api/diagnostics/project-config", module: "server/management/config-routes", mutates: false },

package/src/server/management/sibling-guard.ts

@@ -34,6 +34,7 @@ export const SIBLING_REFUSED_MANAGEMENT_PATHS: readonly { readonly path: string;
   { path: "/api/grok/apply", children: false },
   { path: "/api/grok/selection", children: false },
   { path: "/api/codex-prompt", children: true },
+  { path: "/api/codex-agent-roles", children: true },
   { path: CODEX_RESTART_PATH, children: false },
   { path: "/api/link/join", children: false },
   { path: "/api/native-main-profiles", children: true },

package/src/server/management/zed-provider-probe.ts

@@ -0,0 +1,38 @@
+import { resolveZedModels } from "../../providers/zed";
+import type { OcxProviderConfig } from "../../types";
+import { jsonResponse } from "../auth-cors";
+
+/**
+ * Connection test for the experimental Zed Hosted AI provider.
+ *
+ * Lives outside `provider-routes.ts`, which sits at the file-size threshold, and is reached by a
+ * dynamic import so Zed code stays off the module graph until someone tests a Zed row. The probe
+ * forces a live roster fetch, which exercises the account lookup, the short-lived LLM token
+ * exchange and the model list in one call. Failures return a fixed message: an upstream error can
+ * echo account material, and the caller only needs to know that discovery failed.
+ */
+export async function probeZedProvider(
+  prov: OcxProviderConfig,
+  apiKey: string | undefined,
+  zedUserId: string | undefined,
+): Promise<Response> {
+  const started = Date.now();
+  if (!zedUserId) {
+    return jsonResponse({ ok: false, latencyMs: 0, error: "Zed account identity is unavailable — re-run `ocx login zed`" });
+  }
+  try {
+    const zedFetch = (prov as OcxProviderConfig & { fetch?: typeof globalThis.fetch }).fetch;
+    const live = await resolveZedModels(
+      { userId: zedUserId, accessToken: apiKey ?? "" },
+      { forceRefresh: true, signal: AbortSignal.timeout(8_000), ...(zedFetch ? { fetchFn: zedFetch } : {}) },
+    );
+    return jsonResponse({
+      ok: true,
+      latencyMs: Date.now() - started,
+      models: live.models.length,
+      message: `Connected. ${live.models.length} models.`,
+    });
+  } catch {
+    return jsonResponse({ ok: false, latencyMs: Date.now() - started, error: "zed model discovery failed" });
+  }
+}