@bitkyc08/opencodex 2.76.0 → 2.78.0-preview.20261005

package/src/server/management/model-row-export-metadata.ts

@@ -0,0 +1,150 @@
+/**
+ * Effective export metadata for custom `/api/models` rows.
+ *
+ * A custom row's own fields are the operator's stored OVERRIDE. `/api/models` returns them
+ * verbatim because the edit dialog must show what the user set — including an explicit empty
+ * "no reasoning" ladder — not what the provider happens to advertise today. But a client
+ * export has to serialize what the proxy will actually route: the canonical resolved catalog
+ * metadata for the same `provider/modelId`. `listManagementModelRows` resolves that
+ * projection here and attaches it additively, so the editor's raw fields and the exporter's
+ * effective fields can never overwrite each other.
+ *
+ * Sources are the ones the routed-row projection already uses — the gathered catalog row for
+ * the same slug (the gather materializes custom rows with provider/native inheritance), the
+ * registry-enriched provider config, and the ladder resolution in `model-rows.ts`. No
+ * independent provider fact tables, and no per-model fetch: everything comes from the roster
+ * and config already in hand.
+ */
+import { enrichProviderFromRegistry } from "../../providers/derive";
+import { modelRecordValue } from "../../reasoning-effort";
+import { configuredReasoningSummarySupport } from "../../codex/catalog/model-hints";
+import type { CatalogModel } from "../../codex/catalog";
+import type { OcxConfig } from "../../types";
+import {
+  knownReasoningSupport,
+  knownToolsSupport,
+  type EffectiveModelExportMetadata,
+} from "../../clients/config-export/contracts";
+
+/** The stored-override fields a custom row carries, exactly as `config.customModels` writes them. */
+export interface CustomRowOverrideSource {
+  provider: string;
+  id: string;
+  contextWindow?: number;
+  inputModalities?: string[];
+  /** Explicit ladder; `[]` is a declaration ("no rungs"), not an absence. */
+  reasoningEfforts?: string[];
+  defaultReasoningEffort?: string;
+}
+
+/**
+ * Resolve the effective export metadata for one custom row.
+ *
+ * Explicit custom overrides win; resolved gathered facts precede provider-config fallbacks.
+ * `effectiveReasoningEfforts` is
+ * supplied by the caller because its resolution (declared ladder first, then the enriched
+ * provider maps, then the pinned native table, then the catalog hints) lives with the other
+ * ladder readers in `model-rows.ts`; here it is an input, resolved once per row.
+ */
+export function customRowExportMetadata(
+  config: OcxConfig,
+  source: CustomRowOverrideSource,
+  catalogRow: CatalogModel | undefined,
+  effectiveReasoningEfforts: string[] | undefined,
+): EffectiveModelExportMetadata {
+  const provider = config.providers[source.provider];
+  // The same registry hydration the other per-model readers at this boundary perform, so a
+  // custom row whose provider declares facts only in the registry still inherits them. The
+  // per-model records are cloned first because the enrichment fills and folds them in place.
+  const enriched = provider === undefined ? undefined : {
+    ...provider,
+    ...(provider.modelContextWindows ? { modelContextWindows: { ...provider.modelContextWindows } } : {}),
+    ...(provider.modelInputModalities ? { modelInputModalities: { ...provider.modelInputModalities } } : {}),
+    ...(provider.modelCapabilities ? { modelCapabilities: { ...provider.modelCapabilities } } : {}),
+    ...(provider.modelReasoningEfforts ? { modelReasoningEfforts: { ...provider.modelReasoningEfforts } } : {}),
+    ...(provider.modelDefaultReasoningEfforts
+      ? { modelDefaultReasoningEfforts: { ...provider.modelDefaultReasoningEfforts } }
+      : {}),
+  };
+  if (enriched) enrichProviderFromRegistry(source.provider, enriched);
+
+  // Gathered resolved context first after the explicit override: the gather already ran the
+  // canonical precedence (operator maps, registry, native clamps) and may have applied a
+  // tighter cap than a config map read here would suggest. Re-reading the config maps ahead
+  // of it would duplicate that policy and could widen past an observed tighter window.
+  const contextWindow = source.contextWindow
+    ?? catalogRow?.contextWindow
+    ?? modelRecordValue(enriched?.modelContextWindows, source.id)
+    ?? enriched?.contextWindow;
+  // Same declaration chain `declaredModelInputModalities` reads, as the fallback when neither
+  // the override nor the gathered row says anything.
+  const declaredModalities = enriched === undefined ? undefined : (
+    enriched.modelCapabilities?.[source.id]?.inputModalities
+      ?? modelRecordValue(enriched.modelInputModalities, source.id)
+  );
+  const inputModalities = source.inputModalities ?? catalogRow?.inputModalities ?? declaredModalities;
+  // The gathered row carries what the materializer already resolved; for a rosterless row the
+  // same reader the materializer uses answers from the provider config, so both paths agree.
+  const supportsReasoningSummaries = catalogRow?.supportsReasoningSummaries
+    ?? configuredReasoningSummarySupport(provider, source.id);
+  const defaultReasoningEffort = declaredDefaultWithin(
+    effectiveReasoningEfforts,
+    defaultEffort(source, catalogRow, provider),
+  );
+  return {
+    ...(contextWindow !== undefined ? { contextWindow } : {}),
+    ...(catalogRow?.maxInputTokens !== undefined ? { maxInputTokens: catalogRow.maxInputTokens } : {}),
+    ...(catalogRow?.maxOutputTokens !== undefined ? { maxTokens: catalogRow.maxOutputTokens } : {}),
+    ...(inputModalities !== undefined ? { inputModalities: [...inputModalities] } : {}),
+    ...(effectiveReasoningEfforts !== undefined ? { reasoningEfforts: [...effectiveReasoningEfforts] } : {}),
+    ...(defaultReasoningEffort !== undefined ? { defaultReasoningEffort } : {}),
+    ...(knownToolsSupport({
+      capabilities: catalogRow?.capabilities,
+      parallelToolCalls: catalogRow?.parallelToolCalls,
+    }) === true ? { supportsTools: true } : {}),
+    ...(knownReasoningSupport({ reasoningEfforts: effectiveReasoningEfforts, supportsReasoningSummaries }) === true
+      ? { supportsReasoning: true }
+      : {}),
+    ...(supportsReasoningSummaries !== undefined ? { supportsReasoningSummaries } : {}),
+  };
+}
+
+/**
+ * The declared default, suppressed unless it is a member of the effective ladder. An empty
+ * ladder has no rung to default to, and a default the ladder does not contain describes an
+ * effort the proxy would never send — the same rule the settings route applies when it
+ * rejects a default "not in the declared reasoningEfforts ladder", applied here so an export
+ * never ships a default the row cannot act on.
+ */
+function declaredDefaultWithin(
+  effectiveReasoningEfforts: string[] | undefined,
+  declared: string | undefined,
+): string | undefined {
+  if (declared === undefined) return undefined;
+  if (effectiveReasoningEfforts === undefined) return declared;
+  return effectiveReasoningEfforts.includes(declared) ? declared : undefined;
+}
+
+/**
+ * The declared default, and nothing else. The ladder-preference fallback
+ * (`effectiveModelDefaultReasoningEffort`'s medium → low → first) fabricates a default no
+ * source declared; it is right for the picker's own preference order but wrong for an export
+ * that claims to carry provider truth, so this projection stops at:
+ *
+ * 1. the explicit custom default (an override always wins),
+ * 2. the gathered catalog row's declared default (the gather only lets it ride when it is a
+ *    member of the effective ladder),
+ * 3. the operator's per-model record — the same raw map the routed-row reader consults.
+ *
+ * `declaredDefaultWithin` then drops the answer when it is not a member of the effective
+ * ladder, empty ladder included.
+ */
+function defaultEffort(
+  source: CustomRowOverrideSource,
+  catalogRow: CatalogModel | undefined,
+  provider: { modelDefaultReasoningEfforts?: Record<string, string> } | undefined,
+): string | undefined {
+  if (source.defaultReasoningEffort) return source.defaultReasoningEffort;
+  if (catalogRow?.defaultReasoningEffort) return catalogRow.defaultReasoningEffort;
+  return modelRecordValue(provider?.modelDefaultReasoningEfforts, source.id) ?? undefined;
+}

package/src/server/management/model-rows.ts

@@ -9,6 +9,7 @@
  * Bodies are unchanged from their previous home; only `export` was added.
  */
 import type { CatalogModel } from "../../codex/catalog";
+import { antigravityFamilyDisabled } from "../../providers/antigravity-effort-families";
 import { observeModelCacheRevision } from "../../codex/model-cache";
 import {
   captureExportConfigAdmission,
@@ -30,7 +31,13 @@ import {
   catalogModelEfforts,
 } from "../../codex/catalog";
 import { SUPPORTED_NATIVE_OPENAI_SLUGS } from "../../codex/catalog/native-models";
-import type { ExportModel } from "../../clients/config-export";
+import {
+  knownReasoningSupport,
+  knownToolsSupport,
+  type EffectiveModelExportMetadata,
+  type ExportModel,
+} from "../../clients/config-export/contracts";
+import { customRowExportMetadata } from "./model-row-export-metadata";
 import { providerContextCap } from "../../providers/context-cap";
 import { isVisionReasoningEffort, modelRecordValue, sanitizeCodexReasoningEfforts } from "../../reasoning-effort";
 import { routedSlug, slugEquals } from "../../providers/slug-codec";
@@ -78,6 +85,28 @@ export type ManagementModelRow = Partial<CatalogModel> & {
    * config — so this compares values against what the model would inherit anyway.
    */
   reasoningOverridden?: boolean;
+  /**
+   * Tool support a canonical source positively asserts (native identity, a catalog row's
+   * `"tools"` capability, or the parallel-call opt-in — the same evidence
+   * `src/routing/capability.ts` counts). A row without positive evidence stays absent:
+   * unknown is not false.
+   */
+  supportsTools?: boolean;
+  /**
+   * True when a canonical source positively asserts reasoning (a non-empty effective ladder
+   * or delivered reasoning summaries). Absent means unknown, never "cannot reason": an empty
+   * ladder only says the effort is not adjustable.
+   */
+  supportsReasoning?: boolean;
+  /**
+   * Effective export projection for a row, resolved from canonical sources only — for a
+   * custom row the full effective view (the raw override fields above stay exactly what the
+   * editor wrote), for routed and native rows the authoritative declared default where the
+   * row's own `defaultReasoningEffort` is the picker's preference order instead. Additive on
+   * `/api/models`, and its PRESENCE is the authority signal: an absent field inside it means
+   * "no declared value", never "fall back to the row".
+   */
+  exportMetadata?: EffectiveModelExportMetadata;
 };
 
 /** Resolve the exact text and source shown for one routed discovered model. */
@@ -322,6 +351,13 @@ export async function listManagementModelRows(
       ...(row.autoCompactTokenLimit !== undefined
         ? { autoCompactTokenLimit: row.autoCompactTokenLimit }
         : {}),
+      // The pinned default above IS the declared default for a native row — no heuristic
+      // touches it — so the authoritative projection carries it verbatim and exists even
+      // when empty, which is what tells an export consumer "absence means no default"
+      // rather than "fall back to the row".
+      exportMetadata: {
+        ...(defaultReasoningEffort !== undefined ? { defaultReasoningEffort } : {}),
+      },
     };
   });
   const customModels: ManagementModelRow[] = (config.customModels ?? []).map(cm => {
@@ -374,6 +410,34 @@ export async function listManagementModelRows(
   // the guard and the value) re-read the same file thousands of times on a large roster.
   const routedSlugs = publicModels.filter(m => m.provider !== "combo").map(m => routedSlug(m.provider, m.id));
   const catalogLadders = catalogModelEfforts([...new Set(routedSlugs)]);
+  // The gathered roster, keyed once by Codex-facing slug. A custom row looks itself up here —
+  // the gather materializes custom rows with the provider/native inheritance the catalog
+  // publishes, so this is the canonical resolved metadata the export must preserve, and no
+  // per-model fetch ever happens to obtain it.
+  const rosterByNamespaced = new Map(publicModels.map(model => [catalogModelSlug(model), model] as const));
+  const customRowsWithExportMetadata = visibleCustomModels.map(model => {
+    const catalogRow = rosterByNamespaced.get(model.namespaced);
+    // The gathered materialization's ladder is authoritative when it has one: it already
+    // folded the explicit override in and then applied the canonical bounds (the native
+    // clamp for a capability-backed id, learned refusals), so re-declaring the raw override
+    // here would undo a bound. Two raw values still win: the explicit empty ladder — "no
+    // rungs" is an operator statement no normalization may fill in, even against a stale
+    // gathered row — and any override with no gathered ladder behind it.
+    const declaredEfforts = Array.isArray(model.reasoningEfforts) && model.reasoningEfforts.length === 0
+      ? model.reasoningEfforts
+      : catalogRow?.reasoningEfforts !== undefined
+        ? catalogRow.reasoningEfforts
+        : model.reasoningEfforts;
+    return {
+      ...model,
+      exportMetadata: customRowExportMetadata(
+        config,
+        model,
+        catalogRow,
+        effectiveModelReasoningEfforts(config, model.provider, model.id, declaredEfforts, catalogLadders),
+      ),
+    };
+  });
   const dedupedRouted = publicModels.map((m): ManagementModelRow | null => {
     // Codex-facing slug (one "/", slug-codec); disabledModels compares tolerate both forms.
     const namespaced = catalogModelSlug(m);
@@ -395,7 +459,7 @@ export async function listManagementModelRows(
       ...m,
       ...displayName,
       namespaced,
-      disabled: [...disabled].some(stored => (
+      disabled: antigravityFamilyDisabled(config, m, models) || [...disabled].some(stored => (
         (!nativeAlias && stored === namespaced) || slugEquals(stored, m.provider, m.id)
       )),
       ...(contextCap !== undefined ? { contextCap, contextCapped: m.contextCapped === true } : {}),
@@ -407,13 +471,25 @@ export async function listManagementModelRows(
       ...(routed ? { reasoningOverridden: reasoningOverrideFor(config, m.provider, m.id, catalogLadders) } : {}),
       ...(inputModalitiesDeclared !== undefined ? { inputModalitiesDeclared } : {}),
       ...(contextWindowDeclared !== undefined ? { contextWindowDeclared } : {}),
+      // The authoritative export default is the GATHERED row's own declared default — never
+      // the picker value above, whose medium → low → first fallback invents a default no
+      // source declared. The object exists even when empty: its presence is what tells
+      // `toExportModel` and the CLI that an absent default means "no default", not "fall
+      // back to the row". A default outside the effective ladder is dropped for the same
+      // reason the settings route rejects one: the proxy would never send it.
+      exportMetadata: {
+        ...(m.defaultReasoningEffort !== undefined
+          && (reasoningEfforts === undefined || reasoningEfforts.includes(m.defaultReasoningEffort))
+          ? { defaultReasoningEffort: m.defaultReasoningEffort }
+          : {}),
+      },
     };
   }).filter((row): row is ManagementModelRow => row !== null);
   // Manual OpenAI rows retain their routed selector but replace the bare dashboard row.
   // Account-qualified rows remain distinct, explicitly selected routes.
   const visibleNative = native.filter(model => model.id.includes("/")
     || !customNamespaced.has(routedSlug(model.provider, model.id)));
-  const rows = [...visibleNative, ...dedupedRouted, ...visibleCustomModels];
+  const rows = [...visibleNative, ...dedupedRouted, ...customRowsWithExportMetadata];
   // Include disabled rows and configured aliases before the export visibility filter:
   // a hidden real `x--fast` must never become a synthetic selector for another model.
   const knownIds = config.fastRows === false ? new Set<string>() : knownEffortRowIds(config);
@@ -422,6 +498,23 @@ export async function listManagementModelRows(
     const pending = initialModelSelectionPending(config.providers[row.provider]);
     const modelCosts = Object.hasOwn(config.providers, row.provider)
       ? config.providers[row.provider]?.modelCosts : undefined;
+    // Derived once here so the wire row carries the same booleans the export projection
+    // serializes; the CLI reads /api/models and cannot re-derive them without duplicating
+    // this policy. Custom rows read their effective view from `exportMetadata`; routed and
+    // native rows read their own evidence.
+    const supportsTools = row.exportMetadata?.supportsTools
+      ?? row.supportsTools
+      ?? knownToolsSupport({
+        capabilities: row.capabilities,
+        parallelToolCalls: row.parallelToolCalls,
+        native: row.native,
+      });
+    const supportsReasoning = row.exportMetadata?.supportsReasoning
+      ?? row.supportsReasoning
+      ?? knownReasoningSupport({
+        reasoningEfforts: row.reasoningEfforts,
+        supportsReasoningSummaries: row.supportsReasoningSummaries,
+      });
     return {
       ...row,
       ...(!row.native && modelCosts !== undefined && Object.hasOwn(modelCosts, row.id)
@@ -429,12 +522,52 @@ export async function listManagementModelRows(
       ...(pending ? { disabled: true, initialSelectionPending: true } : {}),
       fastRowAvailable: !row.disabled && !pending
         && !knownIds.has(fastRowId(row.namespaced)) && catalogFastRowEligible(config, row),
+      // An explicit false survives; derivation itself is true-or-nothing.
+      ...(typeof supportsTools === "boolean" ? { supportsTools } : {}),
+      ...(typeof supportsReasoning === "boolean" ? { supportsReasoning } : {}),
     };
   });
 }
 
-/** `/api/models` row → the narrower input the client-config serializers accept. */
+/**
+ * `/api/models` row → the narrower input the client-config serializers accept.
+ *
+ * A row's `exportMetadata`, when present, is the authority: custom rows project through it
+ * because their own fields are stored overrides (an absent field means "not overridden"),
+ * and routed/native rows carry the declared default in it because the row-level
+ * `defaultReasoningEffort` is the picker's preference order, whose medium → low → first
+ * fallback fabricates a default no source declared.
+ */
 export function toExportModel(row: ManagementModelRow): ExportModel {
+  const effective = row.exportMetadata;
+  const contextWindow = effective?.contextWindow ?? row.contextWindow;
+  const maxTokens = effective?.maxTokens ?? row.maxOutputTokens;
+  const maxInputTokens = effective?.maxInputTokens ?? row.maxInputTokens;
+  const inputModalities = effective?.inputModalities ?? row.inputModalities;
+  const reasoningEfforts = effective?.reasoningEfforts ?? row.reasoningEfforts;
+  // The projection is the authority on the default. When it exists, an absent default means
+  // NO declared default — falling back to the row would reintroduce the picker's synthetic
+  // medium/low value, which is exactly what this projection exists to keep out of exports.
+  // Rows without a projection (native-era shapes, hand-built rows) keep the row's own value.
+  const defaultReasoningEffort = effective !== undefined
+    ? effective.defaultReasoningEffort
+    : row.defaultReasoningEffort;
+  const supportsReasoningSummaries = effective?.supportsReasoningSummaries ?? row.supportsReasoningSummaries;
+  // Projection first, then the row's own explicit boolean (an external producer may state
+  // false, which is evidence), and only then derivation from positive evidence.
+  const supportsTools = effective?.supportsTools
+    ?? row.supportsTools
+    ?? knownToolsSupport({
+      capabilities: row.capabilities,
+      parallelToolCalls: row.parallelToolCalls,
+      native: row.native,
+    });
+  const supportsReasoning = effective?.supportsReasoning
+    ?? row.supportsReasoning
+    ?? knownReasoningSupport({
+      reasoningEfforts: row.reasoningEfforts,
+      supportsReasoningSummaries: row.supportsReasoningSummaries,
+    });
   return {
     namespaced: row.namespaced,
     provider: row.provider,
@@ -442,11 +575,17 @@ export function toExportModel(row: ManagementModelRow): ExportModel {
     fastRowAvailable: row.fastRowAvailable === true,
     ...(row.native ? { native: true } : {}),
     ...(row.displayName && row.displayNameSource !== "fallback" ? { displayName: row.displayName } : {}),
-    ...(row.contextWindow !== undefined ? { contextWindow: row.contextWindow } : {}),
-    ...(row.maxOutputTokens !== undefined ? { maxTokens: row.maxOutputTokens } : {}),
-    ...(row.inputModalities ? { inputModalities: row.inputModalities } : {}),
-    ...(row.reasoningEfforts ? { reasoningEfforts: row.reasoningEfforts } : {}),
-    ...(row.defaultReasoningEffort ? { defaultReasoningEffort: row.defaultReasoningEffort } : {}),
+    ...(contextWindow !== undefined ? { contextWindow } : {}),
+    ...(maxTokens !== undefined ? { maxTokens } : {}),
+    ...(maxInputTokens !== undefined ? { maxInputTokens } : {}),
+    ...(inputModalities ? { inputModalities } : {}),
+    // An empty array is a declaration ("no rungs"), and `[]` is truthy: it survives here.
+    ...(reasoningEfforts ? { reasoningEfforts } : {}),
+    ...(defaultReasoningEffort ? { defaultReasoningEffort } : {}),
+    // An explicit false is evidence and survives; only derivation is true-or-nothing.
+    ...(typeof supportsTools === "boolean" ? { supportsTools } : {}),
+    ...(typeof supportsReasoning === "boolean" ? { supportsReasoning } : {}),
+    ...(supportsReasoningSummaries !== undefined ? { supportsReasoningSummaries } : {}),
   };
 }
 

package/src/server/management/native-integration-routes.ts

@@ -51,7 +51,7 @@ import type { CodexNativeRestoreResult } from "../../codex/inject";
 import type { OcxConfig } from "../../types";
 import { jsonResponse } from "../auth-cors";
 import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
-import type { ManagementContext } from "./context";
+import { managementInferencePort, type ManagementContext } from "./context";
 
 export type NativeIntegrationClientId = "claude" | "grok" | "codex" | "claude-desktop";
 
@@ -540,7 +540,7 @@ async function handleGrokToggle(ctx: ManagementContext): Promise<Response> {
      * a stale config.hostname picks the wrong loopback policy branch entirely.
      */
     const runtime = (deps.readRuntimePort ?? readRuntimePort)(process.pid);
-    const port = runtime?.port ?? (Number(ctx.url.port) || config.port);
+    const port = deps.liveListenPort?.() ?? runtime?.port ?? managementInferencePort(ctx);
     const hostname = runtime?.hostname ?? config.hostname;
 
     /*

package/src/server/management/oauth-account-routes.ts

@@ -1,3 +1,5 @@
+import { readConfigFileSnapshot, validateConfigCandidate } from "../../config/diagnostics";
+import { ConfigWritePublishedError } from "../../config/persist-unlocked";
 import { parseAnthropicModelRoutes, readAnthropicModelRoutes } from "../../oauth/anthropic-model-routes";
 import { effectiveAnthropicAccountThreshold } from "../../oauth/anthropic-account-threshold";
 import { handleAnthropicAccountThreshold } from "./anthropic-account-threshold";
@@ -16,6 +18,7 @@ import {
   readConfigDiagnostics,
   reconcileLiveConfigFromDisk,
   saveConfigPreservingClaudeCode,
+  mutatePersistedConfig,
 } from "../../config";
 import {
   clearLoginState,
@@ -210,6 +213,44 @@ function genericOAuthProviderConfig(provider: string, config: ManagementContext[
   return definition?.resolveProviderConfig?.(config) ?? definition?.providerConfig;
 }
 
+/** Both Anthropic writers share publication-aware recovery from the atomic mutation owner. */
+function persistAnthropicPoolPatch(
+  config: OcxConfig,
+  patch: (target: OcxConfig) => { changed: boolean; value: NonNullable<OcxConfig["anthropicAccountPool"]> },
+): { status: "saved"; warning?: "config_bookkeeping_failed" } | { status: "failed"; response: Response } {
+  const before = readConfigFileSnapshot();
+  const unknown = () => ({ status: "failed" as const, response: jsonResponse({
+    error: "Pool settings save state is unknown; reload settings before editing again",
+    code: "config_save_state_unknown",
+  }, 409) });
+  try {
+    const saved = mutatePersistedConfig(patch);
+    if (saved.status === "unavailable") return unknown();
+    config.anthropicAccountPool = saved.value;
+    reconcileLiveStateStores();
+    return { status: "saved" };
+  } catch (error) {
+    const persisted = readConfigFileSnapshot();
+    if (persisted.diagnostics.source !== "file" || persisted.raw === undefined) return unknown();
+    // File reads may salvage hand edits; recovery success requires a strict, authoritative document.
+    let validated: ReturnType<typeof validateConfigCandidate>;
+    try { validated = validateConfigCandidate(JSON.parse(persisted.raw.replace(/^\uFEFF/, ""))); }
+    catch { return unknown(); }
+    if (!validated.ok) return unknown();
+    const current = validated.config;
+    const expected = patch(structuredClone(current)).value;
+    const matches = JSON.stringify(current.anthropicAccountPool) === JSON.stringify(expected);
+    if (matches) {
+      config.anthropicAccountPool = current.anthropicAccountPool;
+      // A failed reconcile must not turn confirmed publication back into a rollback.
+      try { reconcileLiveStateStores(); } catch { /* Fixed warning covers bookkeeping failure. */ }
+      return { status: "saved", warning: "config_bookkeeping_failed" };
+    }
+    if (error instanceof ConfigWritePublishedError || persisted.raw !== before.raw) return unknown();
+    return { status: "failed", response: jsonResponse({ error: "Pool settings could not be saved" }, 500) };
+  }
+}
+
 export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<Response | null> {
   const { req, url, config, deps, principal, syncClaudeAgentDefsBestEffort } = ctx;
 
@@ -565,7 +606,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     if (req.method !== "GET" && !isPlainRecord(rawBody)) {
       return jsonResponse({ error: "body must be an object" }, 400);
     }
-    const fields = rawBody as { provider?: unknown; enabled?: unknown; strategy?: unknown; stickyLimit?: unknown; autoSwitchThreshold?: unknown; quotaWindow?: unknown; maxConcurrentPerAccount?: unknown; routes?: unknown };
+    const fields = rawBody as { provider?: unknown; enabled?: unknown; strategy?: unknown; stickyLimit?: unknown; autoSwitchThreshold?: unknown; quotaWindow?: unknown; maxConcurrentPerAccount?: unknown; routes?: unknown; nativeMessages?: unknown };
     const provider = req.method === "GET"
       ? (url.searchParams.get("provider") ?? "").trim().toLowerCase()
       : (typeof fields.provider === "string" ? fields.provider.trim().toLowerCase() : "");
@@ -573,6 +614,10 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     if (!provider || !kind) {
       return jsonResponse({ error: "pool settings are only available for the codex, anthropic and generic OAuth pools" }, 400);
     }
+    if (Object.hasOwn(fields, "nativeMessages")) {
+      if (kind !== "anthropic") return jsonResponse({ error: "nativeMessages is only part of the anthropic pool contract" }, 400);
+      if (typeof fields.nativeMessages !== "boolean") return jsonResponse({ error: "nativeMessages must be a boolean" }, 400);
+    }
     // Validated by the SHARED parsers before any kind-specific write, so a bad strategy or
     // sticky limit is refused identically whichever pool is addressed.
     let strategy: string | undefined;
@@ -625,17 +670,24 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
         if (stickyLimit !== undefined) config.accountPoolStickyLimit = stickyLimit;
         if (autoSwitchThreshold !== undefined) config.autoSwitchThreshold = autoSwitchThreshold;
       } else if (kind === "anthropic") {
-        const pool = { ...(config.anthropicAccountPool ?? {}) };
-        if (fields.enabled !== undefined) pool.enabled = fields.enabled as boolean;
-        if (strategy !== undefined) pool.strategy = strategy as never;
-        if (stickyLimit !== undefined) pool.stickyLimit = stickyLimit;
-        if (autoSwitchThreshold !== undefined) pool.autoSwitchThreshold = autoSwitchThreshold;
-        if (quotaWindow !== undefined) pool.quotaWindow = quotaWindow as never;
-        if (Object.hasOwn(fields, "routes")) {
-          if (fields.routes === null) delete pool.routes;
-          else if (parsedRoutes?.ok) pool.routes = parsedRoutes.routes;
-        }
-        config.anthropicAccountPool = pool;
+        const patchPool = (target: OcxConfig) => {
+          const pool = { ...(target.anthropicAccountPool ?? {}) };
+          if (fields.nativeMessages !== undefined) pool.nativeMessages = fields.nativeMessages as boolean;
+          if (fields.enabled !== undefined) pool.enabled = fields.enabled as boolean;
+          if (strategy !== undefined) pool.strategy = strategy as never;
+          if (stickyLimit !== undefined) pool.stickyLimit = stickyLimit;
+          if (autoSwitchThreshold !== undefined) pool.autoSwitchThreshold = autoSwitchThreshold;
+          if (quotaWindow !== undefined) pool.quotaWindow = quotaWindow as never;
+          if (Object.hasOwn(fields, "routes")) {
+            if (fields.routes === null) delete pool.routes;
+            else if (parsedRoutes?.ok) pool.routes = parsedRoutes.routes;
+          }
+          target.anthropicAccountPool = pool;
+          return { changed: true, value: pool };
+        };
+        const saved = persistAnthropicPoolPatch(config, patchPool);
+        if (saved.status === "failed") return saved.response;
+        return jsonResponse({ ...unifiedPoolSettingsDto(config, provider, kind), ...(saved.warning ? { warning: saved.warning } : {}) });
       } else {
         const prov = config.providers[provider]!;
         const next = { ...(prov.oauthAccountFailover ?? {}) };
@@ -679,6 +731,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
       stickyLimit: normalizeAccountPoolStickyLimit(pool.stickyLimit),
       quotaWindow: normalizeAccountPoolQuotaWindow(pool.quotaWindow),
       ...readAnthropicModelRoutes(pool.routes),
+      nativeMessages: !Object.hasOwn(pool, "nativeMessages") || pool.nativeMessages === true,
       experimental: true,
     });
   }
@@ -696,8 +749,13 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
       quotaWindow?: unknown;
       maxConcurrentPerAccount?: unknown;
       routes?: unknown;
+      nativeMessages?: unknown;
     };
     const provider = typeof body.provider === "string" ? body.provider.trim().toLowerCase() : "";
+    if (Object.hasOwn(body, "nativeMessages")) {
+      if (provider !== "anthropic") return jsonResponse({ error: "nativeMessages is only part of the anthropic pool contract" }, 400);
+      if (typeof body.nativeMessages !== "boolean") return jsonResponse({ error: "nativeMessages must be a boolean" }, 400);
+    }
     if (provider !== "anthropic") {
       const {
         poolSettingsCapability, genericPoolSettingsDto, parseGenericPoolStrategy, parseGenericAutoSwitchThreshold,
@@ -796,28 +854,36 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     const parsedLegacyRoutes = Object.hasOwn(body, "routes") && body.routes !== null
       ? parseAnthropicModelRoutes(body.routes) : null;
     if (parsedLegacyRoutes && !parsedLegacyRoutes.ok) return jsonResponse({ error: parsedLegacyRoutes.error }, 400);
-    const routes = Object.hasOwn(body, "routes")
-      ? (parsedLegacyRoutes?.ok ? parsedLegacyRoutes.routes : undefined)
-      : config.anthropicAccountPool?.routes;
-    config.anthropicAccountPool = {
-      enabled,
-      autoSwitchThreshold: threshold,
-      ...(strategy !== undefined ? { strategy } : {}),
-      ...(stickyLimit !== undefined ? { stickyLimit } : {}),
-      ...(quotaWindow !== undefined ? { quotaWindow } : {}),
-      ...(routes !== undefined ? { routes } : {}),
+    const legacyPatch = (target: OcxConfig) => {
+      const pool = { ...(target.anthropicAccountPool ?? {}) };
+      if (body.enabled !== undefined) pool.enabled = enabled;
+      else if (pool.enabled === undefined) pool.enabled = false;
+      if (body.nativeMessages !== undefined) pool.nativeMessages = body.nativeMessages as boolean;
+      if (body.autoSwitchThreshold !== undefined) pool.autoSwitchThreshold = threshold;
+      else if (pool.autoSwitchThreshold === undefined) pool.autoSwitchThreshold = 80;
+      if (body.strategy !== undefined) pool.strategy = strategy;
+      if (body.stickyLimit !== undefined) pool.stickyLimit = stickyLimit;
+      if (body.quotaWindow !== undefined) pool.quotaWindow = quotaWindow;
+      if (Object.hasOwn(body, "routes")) {
+        if (body.routes === null) delete pool.routes;
+        else if (parsedLegacyRoutes?.ok) pool.routes = parsedLegacyRoutes.routes;
+      }
+      target.anthropicAccountPool = pool;
+      return { changed: true, value: pool };
     };
-    saveConfigPreservingClaudeCode(config);
-    reconcileLiveStateStores();
+    const saved = persistAnthropicPoolPatch(config, legacyPatch);
+    if (saved.status === "failed") return saved.response;
     return jsonResponse({
       ok: true,
       provider,
-      enabled,
-      autoSwitchThreshold: threshold,
-      strategy: normalizeAccountPoolStrategy(strategy),
-      stickyLimit: normalizeAccountPoolStickyLimit(stickyLimit),
-      quotaWindow: normalizeAccountPoolQuotaWindow(quotaWindow),
-      routes: routes ?? null,
+      enabled: config.anthropicAccountPool?.enabled === true,
+      autoSwitchThreshold: config.anthropicAccountPool?.autoSwitchThreshold ?? 80,
+      strategy: normalizeAccountPoolStrategy(config.anthropicAccountPool?.strategy),
+      stickyLimit: normalizeAccountPoolStickyLimit(config.anthropicAccountPool?.stickyLimit),
+      quotaWindow: normalizeAccountPoolQuotaWindow(config.anthropicAccountPool?.quotaWindow),
+      routes: config.anthropicAccountPool?.routes ?? null,
+      nativeMessages: !Object.hasOwn(config.anthropicAccountPool ?? {}, "nativeMessages") || config.anthropicAccountPool?.nativeMessages === true,
+      ...(saved.warning ? { warning: saved.warning } : {}),
       experimental: true,
     });
   }