@bitkyc08/opencodex 2.75.0 → 2.76.0

package/src/vision/routed-describe.ts

@@ -19,18 +19,13 @@
  * admission secret in a forwardable header is a forwarding hazard). Loopback
  * binds require no token at all (resolveApiAuth admits loopback).
  *
- * Destination (#4236): the unauthenticated loopback listener when one is
- * enabled, otherwise the BIND address — the former roadmap-170 limitation
- * ("a bindHost where 127.0.0.1 does not answer cannot reach its own
- * loopback") is closed by resolving through `localInferenceDestination`
- * rather than composing 127.0.0.1 by hand.
+ * Destination (#4236) and transport: postLocalChatCompletion in
+ * src/lib/local-chat-completion.ts, which resolves the unauthenticated
+ * loopback listener when one is enabled and otherwise the BIND address.
  */
 import type { OcxConfig } from "../types";
-import { localAdmissionToken, localInferenceDestination } from "../lib/local-destinations";
-import { signalWithTimeout, cancelBodyOnAbort } from "../lib/abort";
-import { redactSecretString } from "../lib/redact";
-import { sidecarEnter } from "../lib/sidecar-tracker";
-import { configuredPort } from "../server/auth-cors";
+import { localAdmissionToken } from "../lib/local-destinations";
+import { localChatCompletionBaseUrl, postLocalChatCompletion } from "../lib/local-chat-completion";
 import type { DescribeOutcome, VisionSettings } from "./describe";
 
 export const VISION_DESCRIBE_TERMINAL_HEADER = "x-opencodex-vision-describe";
@@ -77,28 +72,7 @@ export function routedDescribeAdmissionToken(config: Pick<OcxConfig, "apiKeys">)
 export function routedDescribeBaseUrl(
   config: Pick<OcxConfig, "port" | "hostname" | "unauthenticatedLoopbackListener">,
 ): string {
-  return routedDescribeDestination(config).origin;
-}
-
-/**
- * The local destination this self-fetch dials, and whether it needs a credential.
- *
- * This is a local client like any other: the unauthenticated loopback listener when one is
- * enabled, otherwise the bind address — on a tailnet-bound hub there is no loopback socket at
- * all (#4236). The helper sends the OpenAI chat wire, which that listener now admits.
- */
-function routedDescribeDestination(
-  config: Pick<OcxConfig, "port" | "hostname" | "unauthenticatedLoopbackListener">,
-) {
-  // config.port can be 0 (ephemeral bind, tests) or stale after a live port override; the
-  // server records its ACTUAL bound port via setCorsOrigin at startup, so prefer that when
-  // config carries no positive port. `configuredPort()` is itself `0` when `_corsOrigin` has no
-  // explicit port (a default-port origin), so the literal default has to backstop it or the
-  // composed URL names port 0 and the self-fetch cannot connect.
-  const port = config.port && config.port > 0
-    ? config.port
-    : Number(configuredPort()) || 10_100;
-  return localInferenceDestination(config, port);
+  return localChatCompletionBaseUrl(config);
 }
 
 export async function describeImageRouted(
@@ -114,93 +88,27 @@ export async function describeImageRouted(
   const invalid = validateImageUrl(imageUrl);
   if (invalid) return { text: "", error: invalid };
 
-  const headers: Record<string, string> = {
-    "Content-Type": "application/json",
-    [VISION_DESCRIBE_TERMINAL_HEADER]: "1",
-  };
-  const admission = routedDescribeAdmissionToken(config);
-  if (admission) headers["x-opencodex-api-key"] = admission;
-  // A bind that demands admission with no resolvable credential would return 401 with a body
-  // the caller reports as a describe failure; naming the cause once is the difference between
-  // "vision is broken" and a fixable configuration note.
-  if (!admission && !baseUrlOverride && routedDescribeDestination(config).requiresAdmissionToken) {
-    console.warn(
-      "[vision] routed describe has no opencodex data-plane credential for "
-      + `${routedDescribeBaseUrl(config)} — the self-fetch will be refused.`,
-    );
-  }
-
-  const requestBody = {
-    model: routedModel,
-    stream: false,
-    messages: [
-      { role: "system", content: DESCRIBE_INSTRUCTION },
-      {
-        role: "user",
-        content: [
-          ...(contextText ? [{ type: "text", text: `User's request context: ${contextText}` }] : []),
-          { type: "image_url", image_url: { url: imageUrl } },
-        ],
-      },
-    ],
-  };
-
-  const linkedSignal = signalWithTimeout(settings.timeoutMs, abortSignal);
-  const sidecarExit = sidecarEnter("vision");
-  const t0 = Date.now();
-  try {
-    const res = await fetch(`${baseUrlOverride ?? routedDescribeBaseUrl(config)}/v1/chat/completions`, {
-      method: "POST",
-      headers,
-      body: JSON.stringify(requestBody),
-      signal: linkedSignal.signal,
-      redirect: "manual",
-    });
-    const detachBodyGuard = cancelBodyOnAbort(res.body, linkedSignal.signal);
-    try {
-      const raw = await res.text();
-      if (raw.length > MAX_ROUTED_RESPONSE_BYTES) {
-        return { text: "", error: "routed describe response exceeded byte bound" };
-      }
-      if (!res.ok) {
-        return { text: "", error: `routed describe HTTP ${res.status}: ${redactSecretString(raw.slice(0, 200))}` };
-      }
-      let payload: unknown;
-      try { payload = JSON.parse(raw); } catch {
-        return { text: "", error: "routed describe returned non-JSON" };
-      }
-      const content = extractChatContent(payload);
-      if (!content) return { text: "", error: "routed describe returned no text" };
-      return { text: content };
-    } finally {
-      detachBodyGuard();
-    }
-  } catch (e) {
-    const kind = e instanceof Error && e.name === "TimeoutError" ? "timeout" : "connect_error";
-    console.warn(`[vision] routed describe ${kind} (${Date.now() - t0}ms)`);
-    return { text: "", error: redactSecretString(e instanceof Error ? e.message : String(e)) };
-  } finally {
-    sidecarExit();
-    linkedSignal.cleanup();
-  }
-}
-
-function extractChatContent(payload: unknown): string | undefined {
-  if (!payload || typeof payload !== "object") return undefined;
-  const choices = (payload as { choices?: unknown }).choices;
-  if (!Array.isArray(choices) || choices.length === 0) return undefined;
-  const message = (choices[0] as { message?: unknown })?.message;
-  if (!message || typeof message !== "object") return undefined;
-  const content = (message as { content?: unknown }).content;
-  if (typeof content === "string" && content.trim().length > 0) return content;
-  // Some adapters emit content parts; join text parts.
-  if (Array.isArray(content)) {
-    const joined = content
-      .map(part => (part && typeof part === "object" && typeof (part as { text?: unknown }).text === "string"
-        ? (part as { text: string }).text
-        : ""))
-      .join("");
-    if (joined.trim().length > 0) return joined;
-  }
-  return undefined;
+  return postLocalChatCompletion({
+    config,
+    label: "routed describe",
+    logTag: "vision",
+    timeoutMs: settings.timeoutMs,
+    maxResponseBytes: MAX_ROUTED_RESPONSE_BYTES,
+    headers: { [VISION_DESCRIBE_TERMINAL_HEADER]: "1" },
+    abortSignal,
+    baseUrlOverride,
+    body: {
+      model: routedModel,
+      messages: [
+        { role: "system", content: DESCRIBE_INSTRUCTION },
+        {
+          role: "user",
+          content: [
+            ...(contextText ? [{ type: "text", text: `User's request context: ${contextText}` }] : []),
+            { type: "image_url", image_url: { url: imageUrl } },
+          ],
+        },
+      ],
+    },
+  });
 }

package/src/web-search/alpha-search.ts

@@ -62,7 +62,7 @@ const DEFAULT_BACKEND_MODELS = {
 export type AlphaSearchSidecarBackend = keyof typeof DEFAULT_BACKEND_MODELS;
 
 type ResolvedAlphaSearchSidecar =
-  | { backend: "anthropic"; providerName: string; provider: OcxProviderConfig }
+  | { backend: "anthropic"; providerName: string; provider: OcxProviderConfig; config: OcxConfig }
   | { backend: "xai"; providerName: string; provider: OcxProviderConfig }
   | { backend: "gemini"; providerName: string; provider: OcxProviderConfig }
   | { backend: "exa"; apiKey: string };
@@ -103,7 +103,7 @@ export function resolveAlphaSearchSidecar(config: OcxConfig): AlphaSearchSidecar
     case "anthropic": {
       const found = findAnthropicSidecarProvider(config);
       return found
-        ? { status: "ready", sidecar: { backend, providerName: found.providerName, provider: found.provider } }
+        ? { status: "ready", sidecar: { backend, providerName: found.providerName, provider: found.provider, config } }
         : { status: "missing-credential", backend };
     }
     case "xai": {
@@ -188,7 +188,7 @@ async function runAlphaSearchQuery(
 ): Promise<SidecarOutcome> {
   switch (resolved.backend) {
     case "anthropic":
-      return runAnthropicWebSearch(query, resolved.providerName, resolved.provider, settings, signal);
+      return runAnthropicWebSearch(query, resolved.providerName, resolved.provider, settings, signal, config);
     case "xai":
       return runXaiWebSearch(
         query,

package/src/web-search/anthropic-executor.ts

@@ -1,5 +1,6 @@
-import type { OcxProviderConfig } from "../types";
-import { getValidAccessToken, publicOAuthAuthenticationErrorMessage } from "../oauth";
+import type { OcxConfig, OcxProviderConfig } from "../types";
+import { publicOAuthAuthenticationErrorMessage } from "../oauth";
+import { getAnthropicSidecarAccessToken } from "../oauth/anthropic-routing";
 import { ANTHROPIC_OAUTH_BETA, CLAUDE_CODE_SYSTEM_INSTRUCTION } from "../oauth/anthropic";
 import { sidecarThinkingOff } from "../adapters/anthropic-model-contract";
 import { CLAUDE_CODE_HEADERS, claudeCodeSessionId } from "../adapters/client-fingerprint";
@@ -153,7 +154,7 @@ export async function parseAnthropicSidecarSSE(res: Response): Promise<SidecarOu
 
 /**
  * Execute ONE web search via a Claude sidecar through the STORED anthropic OAuth credential — the
- * Anthropic-backed analog of runWebSearch. Authenticates with getValidAccessToken (refresh handled)
+ * Anthropic-backed analog of runWebSearch. Resolves the helper model's permitted account (refresh handled)
  * and reproduces the Claude Code OAuth fingerprint (identity system block first, oauth beta, client
  * headers, stable session id) so the request is first-party-shaped. Never throws — returns `{error}`
  * so the caller injects a graceful tool result.
@@ -164,12 +165,13 @@ export async function runAnthropicWebSearch(
   provider: OcxProviderConfig,
   settings: SidecarSettings,
   abortSignal?: AbortSignal,
+  config?: OcxConfig,
 ): Promise<SidecarOutcome> {
   const base = provider.baseUrl.replace(/\/v1\/?$/, "");
   const url = `${base}/v1/messages`;
   let token: string;
   try {
-    token = await getValidAccessToken(providerName);
+    token = await getAnthropicSidecarAccessToken(providerName, settings.model, config);
   } catch (e) {
     return { text: "", sources: [], error: `anthropic sidecar auth failed: ${publicOAuthAuthenticationErrorMessage(e)}` };
   }

package/src/web-search/index.ts

@@ -170,7 +170,7 @@ export function planWebSearch(
   // resolveSidecarBackend's explicit-or-openai contract.
   const auth = resolveSidecarAuth(config);
   const anthropicSidecar = auth.isAnthropicAuth && auth.anthropicProviderName && auth.anthropicProvider
-    ? { providerName: auth.anthropicProviderName, provider: auth.anthropicProvider }
+    ? { providerName: auth.anthropicProviderName, provider: auth.anthropicProvider, config }
     : undefined;
   const backend = resolveSidecarBackend(cfg.backend);
   const maxSearches = cfg.maxSearchesPerTurn ?? DEFAULT_MAX_SEARCHES;

package/src/web-search/loop.ts

@@ -1,5 +1,5 @@
 import type { AdapterRequest, IncomingMeta, ProviderAdapter } from "../adapters/base";
-import type { AdapterEvent, OcxMessage, OcxParsedRequest, OcxProviderConfig, OcxProviderOpaqueToolCallMetadata, OcxThinkingContent, OcxUsage, RateLimitRetryPolicy } from "../types";
+import type { AdapterEvent, OcxConfig, OcxMessage, OcxParsedRequest, OcxProviderConfig, OcxProviderOpaqueToolCallMetadata, OcxThinkingContent, OcxUsage, RateLimitRetryPolicy } from "../types";
 import { namespacedToolName, toolChoiceToolPredicate } from "../types";
 import { cloneProviderOpaqueToolCallMetadata } from "../responses/provider-opaque-metadata";
 import type { AttemptRecoveryKind } from "../usage/log";
@@ -282,7 +282,7 @@ export interface WebSearchLoopDeps {
   /** Required for the openai backend; unused (and typically undefined) for the anthropic backend. */
   forwardProvider?: OcxProviderConfig;
   /** Required for the anthropic backend: the stored-OAuth provider that runs web_search_20250305. */
-  anthropicSidecar?: { providerName: string; provider: OcxProviderConfig };
+  anthropicSidecar?: { providerName: string; provider: OcxProviderConfig; config: OcxConfig };
   /** Required for the xai backend: the stored Grok OAuth provider (L7). */
   xaiSidecar?: { providerName: string; provider: OcxProviderConfig };
   /** Required for the gemini backend: the stored Antigravity CCA provider (L8). */
@@ -743,7 +743,7 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
         // signal would otherwise look like an ordinary degradable failure).
         try {
           if (backend === "anthropic" && anthropicSidecar) {
-            outcome = await runAnthropicWebSearch(query, anthropicSidecar.providerName, anthropicSidecar.provider, settings, signal);
+            outcome = await runAnthropicWebSearch(query, anthropicSidecar.providerName, anthropicSidecar.provider, settings, signal, anthropicSidecar.config);
           } else if (backend === "xai") {
             // L7: stored Grok OAuth to the pinned api.x.ai Responses endpoint; same
             // never-throws contract and no Codex/OpenAI pool outcome recording (F5 parity).

package/src/web-search/passthrough-bridge.ts

@@ -232,7 +232,7 @@ export function resolveOllamaWebSearchEndpoint(
 /** Credentials that may run a non-Ollama passthrough-bridge search. The key never rides the plan. */
 export interface PassthroughWebSearchBridgeAuth {
   openAiSidecar?: ResolvedOpenAiForwardSidecar;
-  anthropic?: { providerName: string; provider: OcxProviderConfig };
+  anthropic?: { providerName: string; provider: OcxProviderConfig; config: OcxConfig };
   xai?: { providerName: string; provider: OcxProviderConfig };
   gemini?: { providerName: string; provider: OcxProviderConfig };
   exaApiKey?: string;
@@ -967,6 +967,7 @@ export function createPassthroughWebSearchBridgeExecutor(
           anthropic.provider,
           settings,
           querySignal,
+          anthropic.config,
         );
       }
       case "xai": {

package/src/web-search/run-turn-loop.ts

@@ -262,7 +262,7 @@ export async function* runTurnWebSearchLoop(
       switch (plan.backend) {
         case "anthropic":
           return plan.anthropicSidecar
-            ? await runAnthropicWebSearch(query, plan.anthropicSidecar.providerName, plan.anthropicSidecar.provider, plan.settings, signal)
+            ? await runAnthropicWebSearch(query, plan.anthropicSidecar.providerName, plan.anthropicSidecar.provider, plan.settings, signal, plan.anthropicSidecar.config)
             : { text: "", sources: [], error: "anthropic backend selected without a resolved sidecar provider" };
         case "xai":
           return plan.xaiSidecar

package/src/web-search/sidecar-providers.ts

@@ -35,6 +35,7 @@ export function resolveSidecarBackend(
 export interface AnthropicSidecarProvider {
   providerName: string;
   provider: OcxProviderConfig;
+  config: OcxConfig;
 }
 
 /**
@@ -48,7 +49,7 @@ export interface AnthropicSidecarProvider {
 export function findAnthropicSidecarProvider(config: OcxConfig): AnthropicSidecarProvider | undefined {
   const auth = resolveSidecarAuth(config);
   if (!auth.isAnthropicAuth || !auth.anthropicProviderName || !auth.anthropicProvider) return undefined;
-  return { providerName: auth.anthropicProviderName, provider: auth.anthropicProvider };
+  return { providerName: auth.anthropicProviderName, provider: auth.anthropicProvider, config };
 }
 
 /**

package/gui/dist/assets/App-ia4U0ufY.css

@@ -1 +0,0 @@
-.codex-account-controls{flex-wrap:wrap;justify-content:flex-end;align-items:center;gap:12px;min-width:0;display:flex}.codex-account-auto-switch{flex:none;align-items:center;gap:7px;min-width:0;display:flex}.codex-account-auto-switch-label{font-size:var(--text-label);color:var(--muted);font-weight:var(--weight-medium);white-space:nowrap}.codex-account-auto-switch-input-wrap{align-items:stretch;display:inline-flex;position:relative}.codex-account-auto-switch-input{width:76px;height:30px;font-size:var(--text-label);text-align:right;padding:4px 38px 4px 8px}.codex-account-auto-switch-unit{color:var(--muted);font-size:var(--text-label);pointer-events:none;position:absolute;top:50%;right:25px;transform:translateY(-50%)}.codex-account-auto-switch-input-wrap .ocx-stepper{width:22px}.codex-account-auto-switch-toggle{transform-origin:50%;margin-inline:-3px;transform:scale(.8)}.quota-row--codex-credits .quota-val{white-space:nowrap}.quota-compact:has(>.quota-row--codex-credits){grid-template-columns:minmax(34px,max-content) max-content minmax(34px,max-content) minmax(38px,max-content) minmax(58px,1fr) minmax(30px,max-content);column-gap:8px}.quota-compact:has(>.quota-row--codex-credits)>*{grid-column:1/-1}.quota-compact:has(>.quota-row--codex-credits)>.quota-row:not(.quota-row--credits){grid-template-columns:subgrid}.codex-auth-credits-toggle{align-items:center;gap:var(--space-2);white-space:nowrap;display:inline-flex}.codex-auth-credits-toggle__label{font-size:var(--text-label);color:var(--muted)}.kiro-device-dialog{max-width:var(--prose-measure);border:1px solid var(--border);border-radius:var(--radius-lg);background:var(--surface);width:100%;color:var(--text);padding:var(--space-6)}.kiro-device-dialog::backdrop{background:var(--glass-rail)}.kiro-login-choices{gap:var(--space-2);margin-block:var(--space-4);display:grid}.kiro-login-choices .btn{min-height:var(--control-touch);justify-content:flex-start}.kiro-device-code{align-items:center;gap:var(--space-3);margin-block:var(--space-4);flex-wrap:wrap;display:flex}.kiro-device-code-value{font-family:var(--font-code);font-size:var(--text-title);font-weight:var(--weight-semibold);letter-spacing:var(--tracking-wide)}.kiro-device-destination{overflow-wrap:anywhere;-webkit-user-select:all;user-select:all}.kiro-device-actions{justify-content:flex-end;gap:var(--space-2);margin-top:var(--space-4);display:flex}.remote-link-page{gap:var(--space-4);display:grid}.remote-link-page .page-head{align-items:flex-start}.remote-link-page .page-sub{max-width:var(--prose-measure);margin:0}.remote-link-panel{gap:var(--space-4);display:grid}.remote-link-off-preview{min-height:260px;position:relative;overflow:hidden}.remote-link-off-preview:after{content:"";pointer-events:none;-webkit-backdrop-filter:blur(7px);backdrop-filter:blur(7px);background:color-mix(in srgb, var(--bg) 24%, transparent);position:absolute;inset:0}.remote-link-preview-content{gap:var(--space-3);filter:grayscale();opacity:.64;-webkit-user-select:none;user-select:none;display:grid}.remote-link-preview-row{justify-content:space-between;align-items:center;gap:var(--space-3);padding:var(--space-3);border:1px solid var(--border-soft);border-radius:var(--radius-sm);background:var(--raised);display:flex}.remote-link-preview-lines{gap:var(--space-2);width:min(55%,300px);display:grid}.remote-link-preview-lines span{border-radius:var(--radius-pill);background:var(--border);height:8px;display:block}.remote-link-switch-row{z-index:1;justify-content:space-between;align-items:center;gap:var(--space-4);display:flex;position:relative}.remote-link-switch{width:var(--control-touch);height:var(--control-md);border:1px solid var(--border);border-radius:var(--radius-pill);background:var(--toggle-off-bg);cursor:pointer;padding:3px}.remote-link-switch:after{content:"";background:var(--toggle-dot-color);width:24px;height:24px;transition:transform var(--motion-fast) ease;border-radius:50%;display:block}.remote-link-switch[aria-checked=true]{background:var(--toggle-on-bg)}.remote-link-switch[aria-checked=true]:after{transform:translate(16px)}.remote-link-switch:focus-visible,.remote-link-role-card:focus-visible,.remote-link-sheet button:focus-visible,.remote-link-row button:focus-visible{outline:2px solid var(--accent-ring);outline-offset:2px}.remote-link-role-grid{gap:var(--space-3);grid-template-columns:repeat(2,minmax(0,1fr));display:grid}.remote-link-role-card{min-height:132px;padding:var(--space-4);border:1px solid var(--border);border-radius:var(--radius-sm);background:var(--raised);color:var(--text);text-align:left;cursor:pointer}.remote-link-role-card:hover{background:var(--raised-hover)}.remote-link-role-card[aria-disabled=true]{color:var(--muted);cursor:not-allowed;opacity:.72}.remote-link-role-card[aria-disabled=true]:hover{background:var(--raised)}.remote-link-role-card[aria-checked=true]{border-color:var(--text);box-shadow:0 0 0 1px var(--text)}.remote-link-role-card strong,.remote-link-role-card span{display:block}.remote-link-role-card span{margin-top:var(--space-2);color:var(--muted);font-size:var(--text-label)}.remote-link-toolbar{justify-content:space-between;align-items:center;gap:var(--space-3);display:flex}.remote-link-status{align-items:center;gap:var(--space-2);color:var(--muted);font-size:var(--text-label);display:inline-flex}.remote-link-status:before{content:"";background:var(--faint);border-radius:50%;flex:none;width:8px;height:8px}.remote-link-status[data-state=connected]:before{background:var(--green)}.remote-link-status[data-state=reconnecting]:before{background:var(--amber)}.remote-link-status[data-state=failed]:before{background:var(--red)}.remote-link-status[data-state=connecting]:before{background:var(--amber)}.remote-link-children{gap:var(--space-2);display:grid}.remote-link-row{gap:var(--space-3);padding:var(--space-3);border:1px solid var(--border-soft);border-radius:var(--radius-sm);background:var(--raised);grid-template-columns:minmax(0,1fr) auto;align-items:center;display:grid}.remote-link-row-main{gap:var(--space-2);min-width:0;display:grid}.remote-link-row-meta{gap:var(--space-3);color:var(--muted);font-size:var(--text-caption);flex-wrap:wrap;display:flex}.remote-link-row .btn{min-height:var(--control-touch)}.remote-link-error{color:var(--red)}.remote-link-hint{margin-top:var(--space-1);color:var(--muted);font-size:var(--text-label);overflow-wrap:anywhere;display:block}.remote-link-info{color:var(--muted);font-size:var(--text-label)}.remote-link-restart{gap:var(--space-2);padding:var(--space-4);border:1px solid var(--border-soft);border-radius:var(--radius-sm);background:var(--raised);display:grid}.remote-link-restart p{color:var(--muted);margin:0}.remote-link-fingerprint{padding:var(--space-3);overflow-wrap:anywhere;border:1px solid var(--border);border-radius:var(--radius-sm);background:var(--raised);font-family:var(--font-code);font-size:var(--text-label);margin:0}.remote-link-workspace-card{justify-content:space-between;align-items:center;gap:var(--space-4);display:flex}.remote-link-workspace-card p{margin:var(--space-1) 0 0;color:var(--muted);font-size:var(--text-label)}.remote-link-sheet{width:min(620px, calc(100vw - var(--space-4)));max-height:min(760px, calc(100dvh - var(--space-4)));padding:var(--space-6);border:1px solid var(--border);border-radius:var(--radius-lg);background:var(--bg);color:var(--text);box-shadow:var(--shadow);margin:auto;overflow:auto}.remote-link-sheet::backdrop{background:color-mix(in srgb, var(--text) 24%, transparent)}.remote-link-sheet-head{justify-content:space-between;align-items:flex-start;gap:var(--space-3);display:flex}.remote-link-sheet-head h3{font-size:var(--text-title);margin:0}.remote-link-sheet-body{gap:var(--space-4);margin-top:var(--space-5);display:grid}.remote-link-candidates{gap:var(--space-2);display:grid}.remote-link-candidate{justify-content:space-between;align-items:center;gap:var(--space-3);min-height:var(--control-touch);padding:var(--space-2) var(--space-3);border:1px solid var(--border);border-radius:var(--radius-sm);background:var(--raised);color:var(--text);cursor:pointer;text-align:left;display:flex}.remote-link-candidate:hover{background:var(--raised-hover)}.remote-link-form{gap:var(--space-2);display:grid}.remote-link-form .field-label{margin-bottom:0}.remote-link-sheet-actions{justify-content:flex-end;gap:var(--space-2);flex-wrap:wrap;display:flex}.remote-link-confirm-dialog{width:min(460px, calc(100vw - var(--space-4)));padding:var(--space-5);border:1px solid var(--border);border-radius:var(--radius);background:var(--bg);color:var(--text);box-shadow:var(--shadow);margin:auto}.remote-link-confirm-dialog::backdrop{background:color-mix(in srgb, var(--text) 24%, transparent)}.remote-link-confirm-dialog h3{font-size:var(--text-subtitle);margin:0}.remote-link-confirm-dialog p{color:var(--muted)}@media (width<=620px){.remote-link-role-grid{grid-template-columns:1fr}.remote-link-workspace-card,.remote-link-switch-row{flex-direction:column;align-items:stretch}.remote-link-switch{align-self:flex-start}.remote-link-sheet{width:calc(100vw - var(--space-2));border-radius:var(--radius-lg) var(--radius-lg) 0 0;max-height:88dvh;margin:auto auto 0}}@media (prefers-reduced-motion:reduce){.remote-link-page *,.remote-link-page :before,.remote-link-page :after{scroll-behavior:auto!important;transition:none!important;animation:none!important}}.quota-summary-bar{z-index:var(--z-sticky);border-bottom:1px solid var(--border);background:var(--bg);min-height:34px;font-size:var(--text-label);align-items:center;gap:12px;padding:4px 16px;display:flex;position:sticky;top:0}.quota-summary-scroller{flex:1;align-items:center;gap:2px;min-width:0;display:flex}.quota-summary-list{overscroll-behavior-x:contain;scrollbar-width:none;flex-wrap:nowrap;flex:auto;align-items:center;gap:4px;min-width:0;margin:0;padding:3px;list-style:none;display:flex;overflow:auto hidden}.quota-summary-list::-webkit-scrollbar{display:none}.quota-summary-item{flex:none}.quota-summary-scroll{border:1px solid var(--border);background:var(--surface);width:22px;height:22px;color:var(--text);font:inherit;cursor:pointer;border-radius:999px;flex:none;place-items:center;padding:0;font-weight:600;line-height:1;display:inline-grid}.quota-summary-scroll:hover:not([aria-disabled=true]){background:var(--bg)}.quota-summary-scroll[aria-disabled=true]{color:var(--muted);opacity:.45;cursor:default}.quota-summary-scroll:focus-visible{outline:2px solid var(--text);outline-offset:1px}.quota-summary-chip{color:var(--text);font:inherit;white-space:nowrap;cursor:pointer;background:0 0;border:1px solid #0000;border-radius:999px;align-items:center;gap:6px;padding:3px 8px;text-decoration:none;display:inline-flex}.quota-summary-chip:hover,.quota-summary-chip--open{border-color:var(--border)}.quota-summary-chip:focus-visible{outline:2px solid var(--text);outline-offset:1px}.quota-summary-name{color:var(--muted)}.quota-summary-pct{font-variant-numeric:tabular-nums;font-weight:600}.quota-summary-flag{width:14px;height:14px;color:var(--bg);font-size:var(--text-micro);border-radius:50%;place-items:center;font-weight:700;display:inline-grid}.quota-summary-item--warn .quota-summary-chip{background:var(--amber-soft)}.quota-summary-item--warn .quota-summary-pct{color:var(--amber)}.quota-summary-item--warn .quota-summary-flag{background:var(--amber)}.quota-summary-item--critical .quota-summary-chip{border-color:var(--red);background:var(--red-soft)}.quota-summary-item--critical .quota-summary-pct{color:var(--red)}.quota-summary-item--critical .quota-summary-flag{background:var(--red)}.quota-summary-popover{top:calc(var(--qs-pop-top,0) * 1px);left:calc(var(--qs-pop-left,0) * 1px);z-index:var(--z-popover);border:1px solid var(--border);background:var(--surface);border-radius:8px;min-width:260px;max-width:calc(100% - 16px);padding:10px 12px;position:fixed;box-shadow:0 8px 24px #00000024}.quota-summary-popover:before{content:"";left:calc(var(--qs-bridge-left,0) * 1px - 1px);right:calc(var(--qs-bridge-right,0) * 1px - 1px);height:calc((var(--qs-pop-gap,4) + 1) * 1px);position:absolute;bottom:100%}.quota-summary-popover-head{justify-content:space-between;align-items:center;gap:12px;margin-bottom:6px;display:flex}.quota-summary-badge{font-size:var(--text-caption);border-radius:999px;padding:1px 6px}.quota-summary-badge--warn{color:var(--amber);background:var(--amber-soft)}.quota-summary-badge--critical{color:var(--red);background:var(--red-soft)}.quota-summary-table{border-collapse:collapse;width:100%}.quota-summary-table th,.quota-summary-table td{text-align:left;white-space:nowrap;padding:3px 0;font-weight:400}.quota-summary-table td.quota-summary-row-pct{font-variant-numeric:tabular-nums;text-align:right;white-space:nowrap;padding:3px 12px;font-weight:600}.quota-summary-row-reset{color:var(--muted);white-space:nowrap}.quota-summary-table th[scope=row]{white-space:normal;overflow-wrap:anywhere}.quota-summary-row--warn .quota-summary-row-pct{color:var(--amber)}.quota-summary-row--critical .quota-summary-row-pct{color:var(--red)}.quota-summary-popover-foot{color:var(--muted);font-size:var(--text-caption);flex-wrap:wrap;justify-content:space-between;gap:4px 12px;margin-top:6px;display:flex}.quota-summary-updated{color:var(--muted);font-size:var(--text-caption);white-space:nowrap;flex-shrink:0}.quota-summary-popover-link{color:var(--text);text-underline-offset:2px;text-decoration:underline}.quota-summary-popover-link:focus-visible{outline:2px solid var(--text);outline-offset:1px}.quota-summary-updated--stale{color:var(--amber)}.main:has(>.quota-summary-bar):has(>.main-inner--combos .combos-workspace-shell){flex-direction:column;height:100dvh;display:flex}.main:has(>.quota-summary-bar)>.main-inner.main-inner--combos:has(.combos-workspace-shell){flex:auto;height:auto;min-height:0}@media (width<=760px){.quota-summary-bar{padding:4px 10px;position:static}.quota-summary-popover{top:calc(var(--qs-pop-top,0) * 1px);min-width:0;left:8px;right:8px}.main:has(>.quota-summary-bar):has(>.main-inner--combos .combos-workspace-shell){height:100%;min-height:0}}.app{--titlebar-h:40px;--tl-inset:80px;--chrome-clear:52px}.app--macos{--chrome-clear:124px;--sidebar-column:max(232px, calc(var(--tl-inset) + 52px))}.sidebar-top{z-index:calc(var(--z-overlay,30) + 1);width:232px;height:var(--titlebar-h,40px);border-bottom:1px solid var(--border);background:var(--glass-rail);-webkit-backdrop-filter:var(--glass-blur);-webkit-user-select:none;user-select:none;align-items:center;padding:0 10px 0 14px;display:flex;position:fixed;top:0;left:0}.app--macos .sidebar-top{width:var(--sidebar-column);padding-left:var(--tl-inset,80px)}.sidebar{padding-top:calc(var(--titlebar-h,40px) + 18px)}.sidebar-collapse{border-radius:var(--radius-sm);width:28px;height:28px;color:var(--muted);cursor:pointer;transition:background var(--motion-fast), color var(--motion-fast);background:0 0;border:none;flex:none;justify-content:center;align-items:center;padding:0;display:inline-flex}.sidebar-collapse:hover{background:var(--accent-soft);color:var(--text)}.sidebar-collapse:focus-visible{outline:2px solid var(--accent-ring);outline-offset:2px}.sidebar-collapse svg{width:18px;height:18px}.main-top{z-index:var(--z-sticky);height:var(--titlebar-h,40px);background:var(--bg);border-bottom:1px solid var(--border);-webkit-user-select:none;user-select:none;align-items:stretch;display:flex;position:sticky;top:0}.main-top>.quota-summary-bar{border-bottom:none;flex:auto;min-width:0;min-height:0;padding:0 16px;position:static}.main:has(>.main-top):has(>.main-inner--combos .combos-workspace-shell){flex-direction:column;height:100dvh;display:flex}.main:has(>.main-top)>.main-inner.main-inner--combos:has(.combos-workspace-shell){flex:auto;height:auto;min-height:0}@media (width>=761px){.app{transition:grid-template-columns .16s}.app--macos.app--reduced-zoom{transition:none}.app--macos:not(.app--nav-collapsed){grid-template-columns:var(--sidebar-column) minmax(0, 1fr)}.app.app--nav-collapsed{grid-template-columns:0 1fr}.app--nav-collapsed .sidebar{display:none}.app--nav-collapsed .main{grid-column:2}.app--nav-collapsed .sidebar-top{-webkit-backdrop-filter:none;background:0 0;border-bottom:none;width:auto;margin:0;padding:0 12px}.app--macos.app--nav-collapsed .sidebar-top{padding-left:var(--tl-inset,80px)}.app--nav-collapsed .main-top,.app--nav-collapsed .main>.quota-summary-bar{padding-left:var(--chrome-clear,52px)}}@media (width<=760px){.sidebar-top{display:none}.main-top{z-index:auto;position:static}.main:has(>.main-top):has(>.main-inner--combos .combos-workspace-shell){height:100%;min-height:0}.app--macos .mobile-topbar{padding-left:var(--tl-inset,80px)}.app--macos .sidebar.open{padding-top:calc(var(--titlebar-h,40px) + 18px)}}@media (width<=320px){.app--macos .mobile-topbar{flex-wrap:wrap}.app--macos .mobile-topbar-actions{width:calc(100% + var(--tl-inset,80px));margin-left:calc(-1 * var(--tl-inset,80px));justify-content:flex-end}}