@bitkyc08/opencodex 2.76.0 → 2.77.0

package/src/server/claude-messages.ts

@@ -61,6 +61,7 @@ import { resolveWireProtocolOverride } from "./adapter-resolve";
 import type { OcxConfig } from "../types";
 import { readJsonRequestBody, resolveInboundBodyLimitBytes } from "./request-decompress";
 import { addFinalRequestLog, httpStatusForRequestLogTerminal, recordFirstOutput, type RequestLogContext } from "./request-log";
+import { recordGenerationEvent } from "./request-log-generation-window";
 import { createFinalRequestLog } from "./inference/final-log";
 import {
   conversationIdFromClaudeMetadata,
@@ -143,10 +144,10 @@ function decodeClaudeFastSelector(raw: string, cc?: OcxConfig["claudeCode"]): st
   return decodedBase === bare ? exact : `${decodedBase}--fast`;
 }
 
-/** Restore the reversible Fable picker alias before Anthropic passthrough checks. */
-function decodeFablePickerAlias(raw: string, cc?: OcxConfig["claudeCode"]): string {
+/** Restore reversible native Claude picker aliases before Anthropic passthrough checks. */
+function decodeNativeClaudePickerAlias(raw: string, cc?: OcxConfig["claudeCode"]): string {
   const decoded = resolveInboundModel(raw, cc);
-  if (!decoded.startsWith("claude-fable-")) return raw;
+  if (!decoded.startsWith("claude-")) return raw;
   // A picker value saved before the ocx-claude spelling keeps the native passthrough too.
   return claudeCodeNativeAlias(decoded) === raw || legacyAliasForNative(decoded) === raw ? decoded : raw;
 }
@@ -334,6 +335,7 @@ export function tapAnthropicSseForLog(
     let data: unknown;
     try { data = JSON.parse(dataLine); } catch { return; }
     if (!isRec(data)) return;
+    recordGenerationEvent(logCtx, data.type);
     if (data.type === "message_start" && isRec(data.message) && isRec(data.message.usage)) {
       usageAcc = { ...usageAcc, ...data.message.usage };
     } else if (data.type === "message_delta" && isRec(data.usage)) {
@@ -894,7 +896,7 @@ async function handleClaudeMessagesWithBudget(
       }
     }
     if (isRec(anthropicBody) && typeof anthropicBody.model === "string") {
-      anthropicBody.model = decodeFablePickerAlias(anthropicBody.model, cc);
+      anthropicBody.model = decodeNativeClaudePickerAlias(anthropicBody.model, cc);
     }
     if (isRec(anthropicBody) && typeof anthropicBody.model === "string") {
       requestedModel = anthropicBody.model;
@@ -1313,10 +1315,12 @@ async function handleClaudeMessagesWithBudget(
     const replayRefusal = isReplayRefusalResponse(response);
     // Re-shape the OpenAI-style error envelope into the Anthropic one, preserving status.
     let message = `upstream error (${response.status})`;
+    let contextError = false;
     try {
       const text = await response.text();
       try {
-        const parsed = JSON.parse(text) as { error?: { message?: string; type?: string } | string; message?: string };
+        const parsed = JSON.parse(text) as { error?: { message?: string; type?: string; code?: unknown } | string; message?: string };
+        contextError = typeof parsed?.error === "object" && parsed.error?.code === "context_length_exceeded";
         const nested = typeof parsed?.error === "object" && parsed.error ? parsed.error.message : undefined;
         const flat = typeof parsed?.error === "string" ? parsed.error : parsed?.message;
         message = nested || flat || (text ? `upstream error (${response.status}): ${text.slice(0, 400)}` : message);
@@ -1325,7 +1329,7 @@ async function handleClaudeMessagesWithBudget(
       }
     } catch { /* keep fallback message */ }
     const upstreamRetryAfter = response.headers.get("retry-after");
-    const retryAfter = replayRefusal
+    const retryAfter = replayRefusal || contextError
       ? undefined
       : resolveClientRetryAfter({
           status: response.status,
@@ -1345,10 +1349,10 @@ async function handleClaudeMessagesWithBudget(
     const nativeMainFence = response.status === 503
       && upstreamRetryAfter?.trim() === "1"
       && message === CODEX_MAIN_PROFILE_MAINTENANCE_MESSAGE;
-    const transient = !replayRefusal && !nativeMainFence && isTransientUpstreamStatus(response.status);
+    const transient = !replayRefusal && !nativeMainFence && !contextError && isTransientUpstreamStatus(response.status);
     const outStatus = replayRefusal
       ? REPLAY_REFUSED_STATUS
-      : nativeMainFence ? 503 : transient ? 529 : response.status;
+      : nativeMainFence ? 503 : contextError ? 400 : transient ? 529 : response.status;
     const outHeaders = new Headers({ "Content-Type": "application/json" });
     if (retryAfter) outHeaders.set("Retry-After", retryAfter);
     else if (transient) outHeaders.set("Retry-After", "2");
@@ -1357,7 +1361,7 @@ async function handleClaudeMessagesWithBudget(
       outStatus,
       message,
       undefined,
-      replayRefusal ? UPSTREAM_RESET_REPLAY_REFUSED_CODE : undefined,
+      replayRefusal ? UPSTREAM_RESET_REPLAY_REFUSED_CODE : contextError ? "context_length_exceeded" : undefined,
     )), {
       status: outStatus,
       headers: outHeaders,
@@ -1408,7 +1412,7 @@ async function handleClaudeMessagesWithBudget(
       );
     }
     return new Response(JSON.stringify(message), {
-      status: isError ? 502 : 200,
+      status: isError ? (translatedError?.code === "context_length_exceeded" ? 400 : 502) : 200,
       headers: { "Content-Type": "application/json" },
     });
   }
@@ -1431,6 +1435,9 @@ async function handleClaudeMessagesWithBudget(
         "translation_buffer_limit",
       );
     }
+    if (error?.code === "context_length_exceeded") {
+      return anthropicErrorResponse(400, error.message ?? "upstream context limit exceeded", "invalid_request_error", error.code);
+    }
     return anthropicErrorResponse(502, error?.message ?? "upstream request failed", "api_error");
   }
   let message: Rec;
@@ -1659,7 +1666,7 @@ export async function handleClaudeCountTokens(
       model = stripOneMillionMarker(countRoute);
       raw.model = model;
     }
-    model = decodeFablePickerAlias(model, cc);
+    model = decodeNativeClaudePickerAlias(model, cc);
     raw.model = model;
     // Fast-only: count_tokens never parsed an effort row, so it must not start. It returns a
     // token estimate and sends no tier, so only the IDENTITY is corrected - without this the

package/src/server/droid-reasoning-default.ts

@@ -0,0 +1,50 @@
+import { CODEX_REASONING_LEVELS, configuredReasoningEfforts, isDeclaredReasoningEffort } from "../reasoning-effort";
+import { isPlainObject } from "../lib/plain-data";
+import type { OcxProviderConfig } from "../types";
+
+export { DROID_DEFAULT_EFFORT_HEADER } from "../clients/config-export/contracts";
+
+type ChatRequestBody = Record<string, unknown>;
+type DroidReasoningTarget = { provider: OcxProviderConfig; modelId: string };
+
+function hasExplicitEffort(body: ChatRequestBody): boolean {
+  return Object.hasOwn(body, "reasoning_effort")
+    || (isPlainObject(body.reasoning) && Object.hasOwn(body.reasoning, "effort"));
+}
+
+/** Read before the Chat body is bridged: the bridge drops null and unknown efforts, which still count as explicit. */
+export function droidReasoningDefault(header: string | null, chatBody: ChatRequestBody): string | undefined {
+  return header && isDeclaredReasoningEffort(header) && !hasExplicitEffort(chatBody) ? header : undefined;
+}
+
+function pendingDefault(
+  body: ChatRequestBody,
+  defaultEffort: string | undefined,
+  target: DroidReasoningTarget,
+): string | undefined {
+  if (!defaultEffort || hasExplicitEffort(body)) return undefined;
+  const supportedEfforts = configuredReasoningEfforts(target.provider, target.modelId)
+    ?? CODEX_REASONING_LEVELS.map(level => level.effort);
+  return supportedEfforts.includes(defaultEffort) ? defaultEffort : undefined;
+}
+
+export function applyDroidReasoningDefault(
+  body: ChatRequestBody,
+  defaultEffort: string | undefined,
+  target: DroidReasoningTarget,
+): void {
+  const effort = pendingDefault(body, defaultEffort, target);
+  if (effort) body.reasoning_effort = effort;
+}
+
+export function applyDroidResponsesReasoningDefault(
+  body: unknown,
+  defaultEffort: string | undefined,
+  target: DroidReasoningTarget,
+): boolean {
+  if (!isPlainObject(body)) return false;
+  const effort = pendingDefault(body, defaultEffort, target);
+  if (!effort) return false;
+  body.reasoning = { ...(isPlainObject(body.reasoning) ? body.reasoning : {}), effort };
+  return true;
+}

package/src/server/github-copilot-responses-repair.ts

@@ -14,6 +14,8 @@ import {
 } from "../lib/translator-budget";
 import {
   replaceSseDataPayload,
+  splitSseBlock,
+  sseLineEnding as blockNewline,
   sseDataPayload,
   type SseBlockRewrite,
 } from "./sse-payload-rewrite";
@@ -46,14 +48,9 @@ function byteLength(value: unknown): number {
   return Buffer.byteLength(JSON.stringify(value), "utf8");
 }
 
-function blockNewline(block: string): "\r\n" | "\n" {
-  return block.includes("\r\n") ? "\r\n" : "\n";
-}
-
 /** Keep a named SSE block's `event:` field aligned with its JSON `type`. */
 function withEventName(block: string, eventName: string): string {
-  const newline = blockNewline(block);
-  const lines = block.split(/\r?\n/);
+  const { newline, lines } = splitSseBlock(block);
   let replaced = false;
   const rewritten = lines.flatMap((line) => {
     if (!line.startsWith("event:")) return [line];

package/src/server/grok-responses-control-frame.ts

@@ -1,4 +1,4 @@
-import { replaceSseDataPayload, sseDataPayload, type SseBlockRewrite } from "./sse-payload-rewrite";
+import { replaceSseDataPayload, splitSseBlock, sseDataPayload, type SseBlockRewrite } from "./sse-payload-rewrite";
 
 const GROK_CONTROL_FRAME_TYPES: Record<string, true> = {
   "codex.rate_limits": true,
@@ -144,7 +144,7 @@ export function createGrokResponsesControlFrameBlockRewrite(): SseBlockRewrite {
     let eventName = "";
     // SSE overwrites the event type on every event field, including empty resets.
     // Like sseDataPayload, remove only one optional ASCII space after the colon.
-    for (const line of block.split(/\r?\n/)) {
+    for (const line of splitSseBlock(block).lines) {
       if (line === "event") eventName = "";
       else if (line.startsWith("event:")) {
         const value = line.slice("event:".length);

package/src/server/grok-responses-snapshot-repair.ts

@@ -1,7 +1,7 @@
 /** Strict terminal reconstruction selected by the Grok compatibility marker. */
 import type { TranslatorBudget } from "../lib/translator-budget";
 import { MAX_COMPLETED_OUTPUT_ITEMS, MAX_COMPLETED_OUTPUT_ITEM_SOURCE_BYTES } from "./relay";
-import { replaceSseDataPayload, sseDataPayload, type SseBlockRewrite } from "./sse-payload-rewrite";
+import { replaceSseDataPayload, splitSseBlock, sseDataPayload, type SseBlockRewrite } from "./sse-payload-rewrite";
 import { isPlainObject, jsonBlock, type RetainedOutputItem } from "./responses-snapshot-codec";
 import {
   requestToolScope,
@@ -215,14 +215,13 @@ function refusedTerminalBlock(
     },
   });
   const rewritten = replaceSseDataPayload(block, payload);
-  const newline = block.includes("\r\n") ? "\r\n" : "\n";
+  const { newline, lines } = splitSseBlock(rewritten);
   let eventRewritten = false;
-  const lines = rewritten.split(/\r?\n/).map(line => {
+  return lines.map(line => {
     if (eventRewritten || !line.startsWith("event:")) return line;
     eventRewritten = true;
     return `event: ${GROK_REFUSED_TERMINAL_EVENT_TYPE}`;
-  });
-  return lines.join(newline);
+  }).join(newline);
 }
 
 /**

package/src/server/gui-session.ts

@@ -1,6 +1,6 @@
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import type { OcxConfig } from "../types";
-import { canonicalGuiBrowserOrigin } from "../lib/gui-pair-capability";
+import { canonicalGuiBrowserOrigin, standaloneGuiPairingOrigin } from "../lib/gui-pair-capability";
 import {
   isAllowedManagementOrigin,
   isApiAuthRequired,
@@ -20,6 +20,8 @@ export interface GuiSessionRecord {
   csrfToken: string;
   expiresAt: number;
   issuance: GuiSessionIssuance;
+  /** Process-local marker; never accepted from a browser. */
+  localPairing?: true;
 }
 
 export interface GuiSessionBootstrap extends GuiSessionRecord {
@@ -31,6 +33,7 @@ export interface GuiPairingGrantRecord {
   browserOrigin: string;
   expiresAt: number;
   failedAttempts?: number;
+  localPairing?: true;
 }
 
 export interface PairingAttemptContext {
@@ -131,6 +134,7 @@ function mintSession(
   issuance: GuiSessionIssuance,
   state: GuiSessionState,
   now: number,
+  localPairing = false,
 ): GuiSessionBootstrap {
   pruneExpired(state, now);
   evictOldestSession(state);
@@ -142,8 +146,9 @@ function mintSession(
     serverOrigin,
     browserOrigin,
     csrfToken: randomBytes(32).toString("base64url"),
-    expiresAt: now + (issuance === "loopback" ? LOOPBACK_GUI_SESSION_TTL_MS : REMOTE_GUI_SESSION_TTL_MS),
+    expiresAt: now + (issuance === "loopback" || localPairing ? LOOPBACK_GUI_SESSION_TTL_MS : REMOTE_GUI_SESSION_TTL_MS),
     issuance,
+    ...(localPairing ? { localPairing: true as const } : {}),
   };
   state.sessions.set(token, session);
   return {
@@ -258,13 +263,16 @@ export function createGuiPairingGrant(
   now = Date.now(),
 ): { grant: string; browserOrigin: string; serverOrigin: string; expiresAt: number } {
   const canonicalBrowserOrigin = canonicalGuiBrowserOrigin(browserOrigin);
-  const serverOrigin = canonicalHttpOrigin(config.hub?.managementPublicOrigin);
+  const localOrigin = standaloneGuiPairingOrigin(config);
+  const localPairing = localOrigin !== null && canonicalBrowserOrigin === localOrigin;
+  const serverOrigin = config.runtimeRole === "hub"
+    ? canonicalHttpOrigin(config.hub?.managementPublicOrigin) : localOrigin;
   if (
-    config.runtimeRole !== "hub"
-    || !canonicalBrowserOrigin
+    !canonicalBrowserOrigin
     || canonicalBrowserOrigin !== browserOrigin
     || !serverOrigin
-    || !isRemoteGuiBrowserOriginAllowed(canonicalBrowserOrigin, config)
+    || (config.runtimeRole === "hub"
+      ? !isRemoteGuiBrowserOriginAllowed(canonicalBrowserOrigin, config) : !localPairing)
   ) throw new TypeError("remote GUI origin is not allowed");
   pruneExpired(state, now);
   consumeGrantRateSlot(state, now);
@@ -276,7 +284,8 @@ export function createGuiPairingGrant(
     digest = pairingGrantDigest(grant);
   } while (state.pairingGrants.has(digest));
   const expiresAt = now + GUI_PAIRING_GRANT_TTL_MS;
-  state.pairingGrants.set(digest, { browserOrigin: canonicalBrowserOrigin, serverOrigin, expiresAt });
+  state.pairingGrants.set(digest, { browserOrigin: canonicalBrowserOrigin, serverOrigin, expiresAt,
+    ...(localPairing ? { localPairing: true as const } : {}) });
   return { grant, browserOrigin: canonicalBrowserOrigin, serverOrigin, expiresAt };
 }
 
@@ -316,7 +325,8 @@ export function consumeGuiPairingGrant(
   now = Date.now(),
   attemptContext?: PairingAttemptContext,
 ): GuiSessionBootstrap | PairingAttemptRefusal | null {
-  if (req.method !== "POST" || hasAlternateCredential(req) || config.runtimeRole !== "hub") return null;
+  const localOrigin = standaloneGuiPairingOrigin(config);
+  if (req.method !== "POST" || hasAlternateCredential(req) || (config.runtimeRole !== "hub" && !localOrigin)) return null;
   // Scheme check FIRST, before the grant is parsed or looked up.
   //
   // A grant is single-use, so consuming one and then refusing to mint would burn the
@@ -333,6 +343,11 @@ export function consumeGuiPairingGrant(
   const grant = strictPairingGrantBody(body);
   const browserOrigin = canonicalGuiBrowserOrigin(req.headers.get("Origin"));
   if (!grant || !browserOrigin) return null;
+  // Unlike the hub path, standalone redemption never accepts a proxy-origin claim:
+  // both origins must be the configured loopback origin and the kernel peer must be local.
+  if (localOrigin && (destination !== localOrigin || browserOrigin !== localOrigin
+    || attemptContext?.ingress !== "public"
+    || !["127.0.0.1", "::1", "::ffff:127.0.0.1"].includes(attemptContext.peerAddress ?? ""))) return null;
   const context = attemptContext ?? {
     ingress: "public",
     peerAddress: null,
@@ -344,11 +359,14 @@ export function consumeGuiPairingGrant(
   const found = findPairingGrant(grant, state);
   if (!found) {
     // Cross-origin browser requests must not create limiter state as a side effect.
-    if (!isRemoteGuiBrowserOriginAllowed(browserOrigin, config)) return null;
+    if (localOrigin ? browserOrigin !== localOrigin : !isRemoteGuiBrowserOriginAllowed(browserOrigin, config)) return null;
     const source = recordSourceFailure(state, context, now);
     return attemptContext && !source.allowed ? source : null;
   }
   const [digest, record] = found;
+  // A live role/config change must not turn a hub grant into local operator consent, or vice versa.
+  if (record.localPairing ? !localOrigin || record.serverOrigin !== localOrigin
+    : config.runtimeRole !== "hub") return null;
   if (record.expiresAt <= now) {
     state.pairingGrants.delete(digest);
     return null;
@@ -369,7 +387,7 @@ export function consumeGuiPairingGrant(
   // the session is actually minted from.
   if (!isPairingTransportPermitted(record.serverOrigin)) return null;
   state.pairingGrants.delete(digest);
-  return mintSession(record.serverOrigin, record.browserOrigin, "pairing", state, now);
+  return mintSession(record.serverOrigin, record.browserOrigin, "pairing", state, now, record.localPairing === true);
 }
 
 /**
@@ -420,6 +438,10 @@ export function authorizeGuiSessionRequest(
     state.sessions.delete(token);
     return { ok: false, reason: "expired" };
   }
+  if (session.localPairing && standaloneGuiPairingOrigin(config) !== session.serverOrigin) {
+    state.sessions.delete(token);
+    return { ok: false, reason: "server-origin" };
+  }
   if (managementRequestOrigin(req, config) !== session.serverOrigin) {
     return { ok: false, reason: "server-origin" };
   }
@@ -435,6 +457,6 @@ export function authorizeGuiSessionRequest(
     const csrf = req.headers.get("x-opencodex-csrf-token")?.trim();
     if (!csrf || !equalSecret(csrf, session.csrfToken)) return { ok: false, reason: "csrf" };
   }
-  if (session.issuance !== "loopback") session.expiresAt = now + REMOTE_GUI_SESSION_TTL_MS;
+  if (session.issuance !== "loopback" && !session.localPairing) session.expiresAt = now + REMOTE_GUI_SESSION_TTL_MS;
   return { ok: true, principal: "gui-session", session };
 }

package/src/server/index/claude-intercept-lifecycle.ts

@@ -1,5 +1,7 @@
 import type { Server } from "bun";
 import type { OcxConfig } from "../../types";
+import { getConfigDir } from "../../config/paths";
+import { discardPickerCaKey } from "../../claude/intercept/picker-ca";
 import type { PickerRouteInput } from "../../claude/intercept/picker-models";
 import { observeClaudeDesktopMode, type ClaudeDesktopModeObservation } from "../../claude/desktop-first-party";
 import { firstPartyDesired, type ClaudeFirstPartyDesired } from "../../claude/first-party-settings";
@@ -79,6 +81,8 @@ export function createClaudeInterceptLifecycle<T>(): ClaudeInterceptLifecycle<T>
     if (!options) return Promise.resolve(outcome = { ok: false, reason: "failed" });
     const opts = options;
     const run = async (): Promise<ClaudeInterceptOutcome> => {
+      // Legacy key cleanup is independent of listener eligibility, including on-demand retries.
+      try { discardPickerCaKey(opts.configDir ?? getConfigDir()); } catch { /* best-effort; retried on the next attempt */ }
       if (opts.config.runtimeRole === "client") return { ok: false, reason: "client_role" };
       if (!claudeInterceptEnabled(opts.config)) return { ok: false, reason: "disabled" };
       if (opts.requestedPort === 0 && typeof opts.config.claudeCode?.intercept?.port !== "number")

package/src/server/index/serve-options.ts

@@ -202,6 +202,7 @@ import type { WorkflowRefusalLog } from "../workflow-refusal";
 import { readyProtocolMetadata } from "../../remote/protocol";
 import { modelCapabilityFields } from "../models-capabilities";
 import { createWebsocketHandler } from "./websocket-handler";
+import { withGrokSessionIdentity } from "../../grok/session-identity";
 
 export type ServerIngress = "public" | "unauthenticated-loopback" | "hub-management" | "claude-intercept" | "hub-link";
 
@@ -1476,7 +1477,7 @@ export function createServeOptions(ctx: ServeOptionsContext) {
         return runAdmittedHttpTurn(req, policy, async turnAdmissionLease => {
           let response: Response;
           try {
-            response = await handleResponses(req, config, logCtx, {
+            response = await handleResponses(withGrokSessionIdentity(req), config, logCtx, {
               turnAdmissionLease,
               admission,
               onRequestBodyRead: () => disableResponsesRequestTimeout(req, requestServer),

package/src/server/management/agent-settings-routes.ts

@@ -761,135 +761,9 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
     });
   }
 
-  // Featured roster and saved picker order are separate settings. Native Codex advertises
-  // the first five eligible visible rows by display priority; OCX guidance uses natural ranks.
-  if (url.pathname === "/api/subagent-models" && req.method === "GET") {
-    const models = await (deps.fetchAllModels ?? fetchAllModels)(config);
-    // Native gpt (passthrough) are also valid subagent picks — they're picker-visible models in the
-    // catalog, just buried by priority. List them first so the user can feature them over routed.
-    const [{ listCatalogNativeSlugs }, { subagentSelectableModels }] = await Promise.all([
-      import("../../codex/catalog"),
-      import("../../codex/subagent-selectable-models"),
-    ]);
-    const chosen = config.subagentModels ?? [];
-    // A saved roster slot must stay representable even after its model is disabled
-    // elsewhere (Models page, provider allowlist, a provider row going away). The
-    // dashboard treats `available` as the set of rows it can render, so a chosen id
-    // missing from it disappears from the roster UI and the next Save — which PUTs
-    // exactly what the UI holds — silently truncates the persisted list. Losing a
-    // deliberate 5-model roster to an unrelated visibility toggle is data loss, not a
-    // filter. Same reasoning as `fetchGrokCandidateModels`, which deliberately lists a
-    // model the user already excluded so its switch remains reachable.
-    const available = subagentSelectableModels(config, models, listCatalogNativeSlugs());
-    // #857: let CLI/GUI show when a running Codex app-server keeps an older
-    // in-memory catalog than the one on disk. Bounded request-path read: the synchronous
-    // collector blocked the event loop for the whole Windows CIM walk (4-7s measured).
-    const {
-      collectCodexAppServerCatalogStateWithin,
-      DASHBOARD_CATALOG_STATE_DEADLINE_MS,
-    } = await import("../../codex/app-server-processes");
-    const catalogState = await collectCodexAppServerCatalogStateWithin(DASHBOARD_CATALOG_STATE_DEADLINE_MS);
-    return jsonResponse({
-      chosen, available, catalogState,
-      pickerAvailable: [...new Set(filterCatalogVisibleModels(models, config).map(catalogModelSlug).filter(slug => slug.includes("/")))],
-      pickerOrder: config.modelPickerOrder ?? [],
-      pickerOrderMode: config.modelPickerOrderMode ?? null,
-    });
-  }
-  if (url.pathname === "/api/subagent-models" && req.method === "PUT") {
-    let rawBody: unknown;
-    try { rawBody = await readManagementJsonBody(req); } catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid JSON body" }, 400); }
-    if (!isPlainRecord(rawBody)) return jsonResponse({ error: "JSON body must be an object" }, 400);
-    const body = rawBody as { models?: unknown; pickerOrder?: unknown; pickerOrderMode?: unknown };
-    const updatesRoster = body.models !== undefined;
-    const updatesPicker = body.pickerOrder !== undefined;
-    if (!updatesRoster && !updatesPicker) return jsonResponse({ error: "models or pickerOrder is required" }, 400);
-    let chosen: string[] | undefined;
-    if (updatesRoster) {
-      if (!Array.isArray(body.models) || body.models.some(model => typeof model !== "string")) {
-        return jsonResponse({ error: "models must be an array of strings" }, 400);
-      }
-      // Keep the original valid roster contract: no discovery validation, trimming or deduping.
-      chosen = body.models.slice(0, 5);
-    }
-    const mode = body.pickerOrderMode;
-    if (mode !== undefined && (!updatesPicker || (mode !== null
-      && mode !== "alphabetical" && mode !== "provider" && mode !== "most-used"))) {
-      return jsonResponse({ error: "pickerOrderMode requires pickerOrder and must be alphabetical, provider, most-used, or null" }, 400);
-    }
-    let pickerOrder: string[] | undefined;
-    if (updatesPicker) {
-      if (body.pickerOrder !== null && (!Array.isArray(body.pickerOrder)
-        || body.pickerOrder.some(model => typeof model !== "string" || model.trim() === ""))) {
-        return jsonResponse({ error: "pickerOrder must be an array of non-empty routed model ids, or null" }, 400);
-      }
-      pickerOrder = body.pickerOrder === null ? [] : (body.pickerOrder as string[]).map(model => model.trim());
-      if (new Set(pickerOrder).size !== pickerOrder.length) {
-        return jsonResponse({ error: "pickerOrder must not contain duplicate ids" }, 400);
-      }
-      if (pickerOrder.length > 0) {
-        const models = await (deps.fetchAllModels ?? fetchAllModels)(config);
-        // Evaluate visibility AFTER discovery: a concurrent visibility write may have completed.
-        const visible = new Set(filterCatalogVisibleModels(models, config).map(catalogModelSlug).filter(slug => slug.includes("/")));
-        // A bare native id orders the complete picker (docs: guides/model-ordering.md).
-        for (const row of nativeModelRows(config)) if (!row.disabled) visible.add(row.slug);
-        if (pickerOrder.some(model => !visible.has(model))) {
-          return jsonResponse({ error: "pickerOrder must contain visible routed or native model ids, each at most once" }, 400);
-        }
-      }
-    }
-
-    // Everything above can await. From this snapshot through persistence there is no yield.
-    // Stage deletion intent before adopting the touched fields through the canonical
-    // live deletion owner. A failed save restores both fields and pending intent.
-    if (updatesPicker && config.configRebaseProvenance !== undefined
-      && parsedConfigRebaseDeletionKeys(config) === null) {
-      // A newer provenance format must not silently discard this clear's intent on rebase.
-      return jsonResponse({ error: "unsupported config deletion provenance" }, 409);
-    }
-    const draft = { ...projectConfigRebaseProvenance(config) };
-    if (chosen !== undefined) draft.subagentModels = chosen;
-    if (pickerOrder !== undefined) {
-      if (pickerOrder.length === 0) {
-        deleteConfigTopLevelKey(draft, "modelPickerOrder");
-        deleteConfigTopLevelKey(draft, "modelPickerOrderMode");
-      } else {
-        draft.modelPickerOrder = pickerOrder;
-        if (mode === "alphabetical" || mode === "provider" || mode === "most-used") draft.modelPickerOrderMode = mode;
-        else deleteConfigTopLevelKey(draft, "modelPickerOrderMode");
-      }
-    }
-    const projected = projectConfigRebaseProvenance(draft);
-    const touched = [
-      ...(updatesRoster ? ["subagentModels" as const] : []),
-      ...(updatesPicker ? ["modelPickerOrder" as const, "modelPickerOrderMode" as const] : []),
-      "configRebaseProvenance" as const,
-    ];
-    const rollback = captureConfigTopLevelRollback(config, touched);
-    try {
-      for (const key of touched) {
-        if (Object.hasOwn(projected, key)) Object.defineProperty(config, key, {
-          value: projected[key], writable: true, enumerable: true, configurable: true,
-        });
-        else deleteConfigTopLevelKey(config, key);
-      }
-      (deps.saveConfigPreservingClaudeCode ?? saveConfigPreservingClaudeCode)(config);
-    } catch (error) {
-      rollback();
-      throw error;
-    }
-    // Capture the result before convergence yields to another settings mutation.
-    const saved = {
-      applied: [...(config.subagentModels ?? [])],
-      pickerOrder: [...(config.modelPickerOrder ?? [])],
-      pickerOrderMode: config.modelPickerOrderMode ?? null,
-    };
-    const catalogRefresh = await convergeCodexCatalog();
-    if (updatesRoster) {
-      await syncClaudeAgentDefsBestEffort();
-      await autoApplyDesktopBestEffort();
-    }
-    return jsonResponse({ ok: true, ...saved, catalogRefresh });
+  if (url.pathname === "/api/subagent-models") {
+    const { handleSubagentModelRoutes } = await import("./subagent-model-routes");
+    return handleSubagentModelRoutes(ctx, autoApplyDesktopBestEffort);
   }
 
   // Priority-ordered subagent model fallback chain for quota-aware spawn routing.
@@ -1194,6 +1068,7 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
           const picker = modeSaved.ok && pickerPreferenceOn(loadConfig())
             ? await ops.enableLocked({ persist: false, context: "server" })
             : await pickerStatusFor(loadConfig());
+          if (modeSaved.ok) await syncClaudeAgentDefsBestEffort();
           return jsonResponse({
             ok: true,
             mode: "first-party",
@@ -1542,6 +1417,7 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
         ? { visionSidecar: { backend: visionOverride.backend, model: visionOverride.model } }
         : {}),
       fastMode: config.fastMode,
+      forceAvailable: [...visibleNativeSlugs(config), ...filterCatalogVisibleModels(models, config).map(catalogModelSlug)],
       contextWindows,
       effectiveModelEnv: effectiveModelEnv(config.claudeCode, contextWindows),
       available,
@@ -1678,6 +1554,7 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
       const finalDesired = firstPartyDesired(config, observeClaudeDesktopMode(config));
       const residual = !finalDesired.desktop && !finalDesired.cli
         && readFirstPartyProxyStatus(config, bound?.proxyPort ?? null) !== "none";
+      await syncClaudeAgentDefsBestEffort();
       return jsonResponse({ ok: true, enabled: config.claudeCode?.enabled !== false,
         cliFirstParty: body.cliFirstParty,
         warnings: [

package/src/server/management/config-routes.ts

@@ -276,7 +276,7 @@ export async function syncEnabledClientIntegrations(
     },
     config,
     port,
-  }, ["mcode", "pi", "aside", "raycast", "omo", "cline", "droid"]));
+  }, ["mcode", "pi", "aside", "raycast", "omo", "cline", "droid", "opencode", "kilo"]));
 
   return out;
 }