@bitkyc08/opencodex 2.77.0 → 2.78.0

package/src/oauth/index.ts

@@ -1032,18 +1032,16 @@ export async function refreshAnthropicAccountWithLock(
         // OAuthLoginRequiredError. One 503 locked the account out of refresh until manual
         // re-auth even after upstream recovered.
         //
-        // Only clear the intent when the server DEFINITIVELY answered and rejected the
-        // request. The adapter attaches an HTTP status only to that explicit non-success
-        // response. A timeout, a dropped connection, or an unreadable/unparseable body
-        // carries no status: the server may already have
-        // rotated the token, and replaying it could trip refresh-token-reuse revocation.
-        // Those outcomes keep the intent so the guard still refuses a blind replay.
-        if ((!refreshMayHaveReachedProvider || definitivelyAnswered(error)) && attemptIntent) {
+        // Clear only for proven pre-dispatch failure or an explicit HTTP rejection.
+        // Other transport/body failures may follow rotation and keep the replay guard.
+        const requestNotSent = !refreshMayHaveReachedProvider
+          || (error instanceof AnthropicTokenError && error.requestNotSent);
+        if ((requestNotSent || definitivelyAnswered(error)) && attemptIntent) {
           await clearAnthropicRefreshIntentForKnownFailure(
             provider,
             accountId,
             attemptIntent,
-            refreshMayHaveReachedProvider ? "definitive-rejection" : "pre-dispatch",
+            requestNotSent ? "pre-dispatch" : "definitive-rejection",
             error,
           );
         }

package/src/oauth/pool-settings-capability.ts

@@ -50,7 +50,7 @@ export function parseGenericStickyLimit(value: unknown): number | null {
 
 /** Fields the unified pool-settings contract can carry, per kind. */
 export const POOL_SETTINGS_FIELDS = [
-  "enabled", "strategy", "stickyLimit", "autoSwitchThreshold", "quotaWindow", "maxConcurrentPerAccount", "routes",
+  "enabled", "strategy", "stickyLimit", "autoSwitchThreshold", "quotaWindow", "maxConcurrentPerAccount", "routes", "nativeMessages",
 ] as const;
 export type PoolSettingsField = typeof POOL_SETTINGS_FIELDS[number];
 
@@ -84,8 +84,12 @@ export interface PoolSettingsDto {
   quotaWindow: string | null;
   maxConcurrentPerAccount: number | null;
   routes: AnthropicModelRoute[] | null;
+  /** Anthropic preference, default true; null for unsupported pool kinds. */
+  nativeMessages: boolean | null;
   /** Present only when stored Anthropic routes fail validation on read. */
   routesError?: string;
+  /** Saved state confirmed despite a post-publication failure. */
+  warning?: "config_bookkeeping_failed";
 }
 
 
@@ -134,7 +138,7 @@ export function genericPoolSettingsDto(
 /** Which fields each kind actually honours. Declared, never silently omitted. */
 const SUPPORTED_BY_KIND: Record<PoolSettingsKind, PoolSettingsField[]> = {
   codex: ["strategy", "stickyLimit", "autoSwitchThreshold"],
-  anthropic: ["enabled", "strategy", "stickyLimit", "autoSwitchThreshold", "quotaWindow", "routes"],
+  anthropic: ["enabled", "strategy", "stickyLimit", "autoSwitchThreshold", "quotaWindow", "routes", "nativeMessages"],
   generic: ["enabled", "strategy", "stickyLimit", "autoSwitchThreshold"],
 };
 
@@ -165,6 +169,7 @@ export function unifiedPoolSettingsDto(
       quotaWindow: null,
       maxConcurrentPerAccount: null,
       routes: null,
+      nativeMessages: null,
     };
   }
   if (kind === "anthropic") {
@@ -174,6 +179,7 @@ export function unifiedPoolSettingsDto(
       ...base,
       enabled,
       enabledEffective: enabled === true,
+      nativeMessages: !Object.hasOwn(pool, "nativeMessages") || pool.nativeMessages === true,
       strategy: parseGenericPoolStrategy(pool.strategy) ?? "quota",
       stickyLimit: parseGenericStickyLimit(pool.stickyLimit) ?? 1,
       autoSwitchThreshold: parseGenericAutoSwitchThreshold(pool.autoSwitchThreshold) ?? 80,
@@ -198,5 +204,6 @@ export function unifiedPoolSettingsDto(
     quotaWindow: null,
     maxConcurrentPerAccount: provider === "kiro" ? parseKiroAccountCap(failover.maxConcurrentPerAccount) : null,
     routes: null,
+    nativeMessages: null,
   };
 }

package/src/protocols/plan-snapshot.ts

@@ -138,7 +138,7 @@ function candidateFor(
     const reason = rows.effortRow ? "effort-row" : nativeChatDeclineReason(settled, chatBodyForFeatures(features), config);
     nativeEligible = reason === undefined;
     if (reason) declineReasons = [reason];
-  } else if (inbound === "messages" && resolveProtocolSettings(config).rollout.managedMessagesNative) {
+  } else if (inbound === "messages" && resolveProtocolSettings(config, settled.providerName).rollout.managedMessagesNative) {
     // The runtime rule itself. With the switch off nothing is judged, so the default preview
     // is exactly what it was before the managed native lane existed.
     // Pinned effort is judged from config and the route; blocked-skill elision and the web-search

package/src/protocols/settings.ts

@@ -71,19 +71,29 @@ export interface ProtocolSettings {
 }
 
 /** Resolve protocol policy with conservative defaults for every absent or malformed field. */
-export function resolveProtocolSettings(config: Pick<OcxConfig, "protocols">): Readonly<ProtocolSettings> {
+export function resolveProtocolSettings(config: Pick<OcxConfig, "protocols" | "anthropicAccountPool">, providerName?: string): Readonly<ProtocolSettings> {
   const raw: unknown = config.protocols;
   const protocols = isRec(raw) ? raw : {};
   const rollout = isRec(protocols.rollout) ? protocols.rollout : {};
   const on = (key: keyof ProtocolRolloutSettings): boolean => rollout[key] === true;
-  const managedMessagesNative = on("managedMessagesNative");
+  // A present malformed container cannot become an absent/default-on policy.
+  const validContainers = (raw === undefined || isRec(raw))
+    && (!Object.hasOwn(protocols, "rollout") || isRec(protocols.rollout));
+  const rawPool: unknown = config.anthropicAccountPool;
+  const pool = isRec(rawPool) ? rawPool : {};
+  const pooled = providerName === "anthropic" && pool.enabled === true;
+  const poolPreference = !Object.hasOwn(pool, "nativeMessages") || pool.nativeMessages === true;
+  const nativeOn = (key: "managedMessagesNative" | "managedMessagesNativeOAuth") => validContainers
+    && (!pooled || poolPreference)
+    && (Object.hasOwn(rollout, key) ? rollout[key] === true : pooled);
+  const managedMessagesNative = nativeOn("managedMessagesNative");
   return Object.freeze({
     unrepresentable: protocols.unrepresentable === "reject" ? "reject" : "legacy",
     rollout: Object.freeze({
       nativeChatCombos: on("nativeChatCombos"),
       managedMessagesNative,
       // OAuth extension is meaningless without the key-auth path it extends.
-      managedMessagesNativeOAuth: managedMessagesNative && on("managedMessagesNativeOAuth"),
+      managedMessagesNativeOAuth: managedMessagesNative && nativeOn("managedMessagesNativeOAuth"),
       directEncoders: on("directEncoders"),
       shadowPlan: on("shadowPlan"),
     }),
@@ -95,16 +105,30 @@ export function resolveProtocolSettings(config: Pick<OcxConfig, "protocols">): R
  * dashboard can tell a preview computed under an older policy from a current one. Not a
  * security boundary; FNV-1a over a canonical JSON projection.
  */
-export function protocolPolicyRevision(config: Pick<OcxConfig, "apiSurfaces" | "claudeCode" | "protocols">): string {
+export function protocolPolicyRevision(config: Pick<OcxConfig, "apiSurfaces" | "claudeCode" | "protocols" | "anthropicAccountPool">): string {
   const surfaces = resolveApiSurfaceSettings(config);
   const settings = resolveProtocolSettings(config);
+  const anthropicSettings = resolveProtocolSettings(config, "anthropic");
+  const state = (record: unknown, key: string) => !isRec(record) || !Object.hasOwn(record, key)
+    ? "absent" : record[key] === true ? "true" : record[key] === false ? "false" : "invalid";
+  const container = (value: unknown) => value === undefined ? "absent" : isRec(value) ? "object" : "invalid";
+  const rawProtocols: unknown = config.protocols;
+  const rawRollout = isRec(rawProtocols) ? rawProtocols.rollout : undefined;
   const canonical = JSON.stringify({
     messages: [surfaces.messages.enabled, surfaces.messages.source],
     unrepresentable: settings.unrepresentable,
+    nativeInputs: [
+      container(rawProtocols), container(rawRollout),
+      state(rawRollout, "managedMessagesNative"), state(rawRollout, "managedMessagesNativeOAuth"),
+      container(config.anthropicAccountPool), state(config.anthropicAccountPool, "enabled"),
+      state(config.anthropicAccountPool, "nativeMessages"),
+    ],
     rollout: [
       settings.rollout.nativeChatCombos,
       settings.rollout.managedMessagesNative,
       settings.rollout.managedMessagesNativeOAuth,
+      anthropicSettings.rollout.managedMessagesNative,
+      anthropicSettings.rollout.managedMessagesNativeOAuth,
       settings.rollout.directEncoders,
       settings.rollout.shadowPlan,
     ],

package/src/server/caller-session-identity.ts

@@ -0,0 +1,32 @@
+/** Promote third-party conversation markers after ingress authentication and origin checks. */
+import { contextPrincipalIdOf, type DataPlaneAdmission } from "./auth-cors";
+
+const SESSION_HEADERS = ["session_id", "session-id", "thread-id"] as const;
+const SAFE_CALLER_SESSION_ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
+
+export function safeCallerSessionId(raw: string | null): string | undefined {
+  const value = raw?.trim();
+  return value && SAFE_CALLER_SESSION_ID.test(value) ? value : undefined;
+}
+
+export function callerSessionId(headers: Headers): string | undefined {
+  if (SESSION_HEADERS.some(name => headers.has(name))) return undefined;
+  return safeCallerSessionId(headers.get("x-session-id"));
+}
+
+/** Authenticated callers share continuity only within their trusted credential principal. */
+export function withCallerSessionIdentity(req: Request, admission: DataPlaneAdmission): Request {
+  const conversation = callerSessionId(req.headers);
+  if (!conversation) return req;
+  let sessionId = conversation;
+  if (admission.kind !== "loopback") {
+    const principal = contextPrincipalIdOf(admission);
+    if (!principal) return req;
+    sessionId = new Bun.CryptoHasher("sha256")
+      .update(JSON.stringify(["opencodex-caller-session-v1", principal, conversation])).digest("hex");
+  }
+  const headers = new Headers(req.headers);
+  headers.set("session_id", sessionId);
+  // Preserve the unread body stream and propagate the original request's abort signal.
+  return new Request(req, { headers });
+}

package/src/server/claude-messages.ts

@@ -80,7 +80,7 @@ import { upstreamWireForAdapter } from "../protocols/contract";
 import { createProtocolEnvelope, type ProtocolEnvelope } from "../protocols/envelope";
 import { featuresFromMessagesBody, type ProtocolFeature } from "../protocols/features";
 import { credentialDomainFor, messagesBodyHasOpaqueState } from "../protocols/opaque-state";
-import { hasAnthropicFailoverQuorum } from "../oauth/anthropic-routing";
+import { hasAnthropicFailoverQuorum, anthropicSessionKeyFromParts } from "../oauth/anthropic-routing";
 import { checkRepresentable, unrepresentableMessage } from "../protocols/guard";
 import { requestPathForLane } from "../protocols/path";
 import { resolveApiSurfaceSettings, resolveProtocolSettings } from "../protocols/settings";
@@ -1208,6 +1208,13 @@ async function handleClaudeMessagesWithBudget(
       // Compatibility identity is an opaque request-local handle, separate from credentials.
       clientIdentity: captureAnthropicClientIdentity(req.headers),
       callerAnthropicBeta: req.headers.get("anthropic-beta"),
+      sessionKey: anthropicSessionKeyFromParts({
+        sessionIdHeader: req.headers.get("session_id")?.trim() || req.headers.get("x-claude-code-session-id"),
+        threadIdHeader: req.headers.get("thread_id"),
+        clientThreadId: conversationIdFromClaudeMetadata(isRec(nativeBody.metadata) ? nativeBody.metadata : undefined),
+        promptCacheKey: typeof internalBody.prompt_cache_key === "string" ? internalBody.prompt_cache_key : null,
+        promptCacheKeyIsSharedCohort: cacheKeySource === "system",
+      }),
     });
   }
 
@@ -1685,9 +1692,9 @@ export async function handleClaudeCountTokens(
     // A thread delta would undercount; refuse it exactly as the translated Messages path does.
     if (carriesMessageThread(raw)) return messageThreadUnsupportedResponse();
     // PF-08: an eligible managed-key route counts the body the native lane would send.
-    const nativeCountBody = resolveProtocolSettings(config).rollout.managedMessagesNative
-      ? (await import("./messages-native")).nativeMessagesCountBody(config, cc, raw, { fastRow: countFastRow !== null })
-      : undefined;
+    const nativeCountBody = (await import("./messages-native")).nativeMessagesCountBody(
+      config, cc, raw, { fastRow: countFastRow !== null }, captureAnthropicClientIdentity(req.headers),
+    );
     // A count answers for the prompt a real turn from this model would forward, so it projects
     // the same unserialized content that turn's `message_start` floor does. Counting the raw
     // caller body instead reported replayed thinking this route never sends (#4857 family).

package/src/server/index/serve-options.ts

@@ -203,6 +203,7 @@ import { readyProtocolMetadata } from "../../remote/protocol";
 import { modelCapabilityFields } from "../models-capabilities";
 import { createWebsocketHandler } from "./websocket-handler";
 import { withGrokSessionIdentity } from "../../grok/session-identity";
+import { withCallerSessionIdentity } from "../caller-session-identity";
 
 export type ServerIngress = "public" | "unauthenticated-loopback" | "hub-management" | "claude-intercept" | "hub-link";
 
@@ -298,9 +299,11 @@ export function createServeOptions(ctx: ServeOptionsContext) {
   const requestMetrics = metricsExportEnabled(config)
     ? createRequestMetricsOwner(Date.now() / 1000, cachedKiroQuotaMetricRows) : undefined;
   const requestMetricsLogContext = requestMetrics ? { requestMetricsRecorder: requestMetrics } : {};
-  const requestManagementApiDeps: ManagementApiDeps = requestMetrics
-    ? { ...managementApiDeps, requestMetrics: { snapshot: () => requestMetrics.snapshot() } }
-    : managementApiDeps;
+  const requestManagementApiDeps: ManagementApiDeps = {
+    ...managementApiDeps,
+    liveListenPort: () => ctx.boundPort ?? listenPort,
+    ...(requestMetrics ? { requestMetrics: { snapshot: () => requestMetrics.snapshot() } } : {}),
+  };
   const serveOptions = {
       idleTimeout: 255,
       // Bun rejects an oversized body before `fetch` runs, so the listener has to be raised
@@ -1474,10 +1477,11 @@ export function createServeOptions(ctx: ServeOptionsContext) {
           logged = true;
           addFinalRequestLog(requestId, start, logCtx, status, meta);
         };
-        return runAdmittedHttpTurn(req, policy, async turnAdmissionLease => {
+        const sessionReq = withCallerSessionIdentity(withGrokSessionIdentity(req), admission);
+        return runAdmittedHttpTurn(sessionReq, policy, async turnAdmissionLease => {
           let response: Response;
           try {
-            response = await handleResponses(withGrokSessionIdentity(req), config, logCtx, {
+            response = await handleResponses(sessionReq, config, logCtx, {
               turnAdmissionLease,
               admission,
               onRequestBodyRead: () => disableResponsesRequestTimeout(req, requestServer),
@@ -1554,8 +1558,9 @@ export function createServeOptions(ctx: ServeOptionsContext) {
         // Logging is finalized inside handleClaudeMessages (Responses-vocab tap on the
         // pre-translation stream + native passthrough callbacks) — do not re-wrap the
         // translated Anthropic stream here.
-        return runAdmittedHttpTurn(req, policy, async turnAdmissionLease => withCors(
-          await handleClaudeMessages(req, config, logCtx, { requestId, start, turnAdmissionLease, admission }, policy, { claudeIntercept: ingress === "claude-intercept" }),
+        const sessionReq = withCallerSessionIdentity(req, admission);
+        return runAdmittedHttpTurn(sessionReq, policy, async turnAdmissionLease => withCors(
+          await handleClaudeMessages(sessionReq, config, logCtx, { requestId, start, turnAdmissionLease, admission }, policy, { claudeIntercept: ingress === "claude-intercept" }),
           req,
           policy,
         ), { requestId, start, logCtx });

package/src/server/index.ts

@@ -281,7 +281,7 @@ function startServerWithSpendLedgerOwner(port: number | undefined, deps: StartSe
       // with the later startup sync and warns ONCE about stale app-servers; warning
       // here instead would read a catalog mtime the sync is about to move.
       const outcome = withCatalogWriteSerialization(startupCodexHome, permit =>
-        invalidateCodexModelsCacheWithPermit(permit, startupCodexHome));
+        invalidateCodexModelsCacheWithPermit(permit, startupCodexHome), { intent: "cache", writer: "startup-cache" });
       // A refused permit is not a write; only a completed run that returned true is.
       setStartupCacheInvalidationWrite(outcome.kind === "completed" && outcome.value === true);
     } catch { /* no readable Codex home: nothing to invalidate */ }

package/src/server/management/agent-settings-routes.ts

@@ -205,7 +205,7 @@ export function setGrokApplyFlightTestHooks(
   grokApplyFlight = null;
   grokApplyHighWaterBytes = 0;
 }
-import type { ManagementContext } from "./context";
+import { managementInferencePort, type ManagementContext } from "./context";
 
 async function injectionModelOptions(config: OcxConfig, models: readonly CatalogModel[]) {
   const disabled = new Set(config.disabledModels ?? []);
@@ -262,7 +262,8 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
         const writtenProfile = current.claudeCode.desktopProfile;
         const markerBaseline = captureDesktopAppliedMarker(writtenProfile);
         const result = (deps.writeDesktop3pConfig ?? writeDesktop3pConfig)(
-          current.port ?? 10100,
+          // Live bound port, not config: a CLI override or ephemeral bind must not strand Desktop (#6598).
+          managementInferencePort({ config: current, deps }) ?? 10100,
           [...desktopVisibleNativeSlugs(current)],
           routed,
           current.apiKeys?.[0]?.key,
@@ -898,7 +899,7 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
   if (url.pathname === "/api/claude-desktop" && req.method === "GET") {
     try {
       const state = await buildClaudeDesktopState(config);
-      const runtimePort = Number(url.port) || config.port;
+      const runtimePort = managementInferencePort(ctx);
       return jsonResponse({ ...state, port: runtimePort });
     } catch (error) {
       return jsonResponse({ error: error instanceof Error ? error.message : String(error) }, 400);
@@ -966,7 +967,7 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
         };
       }
       const saved = await buildClaudeDesktopState(config);
-      const runtimePort = Number(url.port) || config.port;
+      const runtimePort = managementInferencePort(ctx);
       return jsonResponse({ ok: true, ...saved, port: runtimePort });
     } catch (error) {
       return jsonResponse({ error: error instanceof Error ? error.message : String(error) }, 400);
@@ -1131,7 +1132,7 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
         // Picker mode belongs to first-party: stop terminating claude.ai before the gateway lands.
         const pickerOff = await ops.disableLocked({ persist: false });
         const result = (deps.writeDesktop3pConfig ?? writeDesktop3pConfig)(
-          Number(url.port) || latest.port,
+          managementInferencePort({ config: latest, deps }),
           [...desktopVisibleNativeSlugs(latest)],
           routed,
           latest.apiKeys?.[0]?.key,

package/src/server/management/context.ts

@@ -160,7 +160,7 @@ export interface ManagementApiDeps {
   issueApiKey?: (config: OcxConfig, name: string) => IssuedApiKey;
   revokeApiKey?: (config: OcxConfig, id: string) => boolean;
   loadLinkCandidates?: () => Array<{ alias: string; source: "ssh_config" | "tailscale" }>;
-  /** The port this runtime listens on; a join is refused unless it is the configured port. */
+  /** Bound public inference port, not the ingress receiving this management request. */
   liveListenPort?: () => number | undefined;
   now?: () => number;
 }
@@ -191,3 +191,10 @@ export interface ManagementContext {
   convergeCodexCatalog: () => Promise<CatalogDisposition>;
   syncClaudeAgentDefsBestEffort: () => Promise<void>;
 }
+
+/** A management-only ingress cannot supply the port used by generated inference clients. */
+export function managementInferencePort(ctx: Pick<ManagementContext, "config" | "deps">): number {
+  // Lifecycle owns the actual port (including CLI overrides/ephemeral binds); direct route
+  // fixtures fall back to config without consulting another runtime's state file.
+  return ctx.deps.liveListenPort?.() ?? ctx.config.port;
+}

package/src/server/management/cursor-integration-routes.ts

@@ -53,9 +53,9 @@ export async function buildCursorIntegrationStatus(
   const privateInference = pick(installs, "private-inference");
   const regular = pick(installs, "regular");
   const runtime = (deps.readRuntimePort ?? readRuntimePort)(process.pid);
-  // The port the browser reached is the one Cursor on the same machine will reach too; the
-  // runtime record and config.port are fallbacks for a request that carries no port.
-  const port = runtime?.port ?? (Number(ctx.url?.port) || config.port);
+  // The lifecycle-bound public port wins, then the PID-matched runtime record, then config.
+  // A management-only ingress port must never become the Cursor gateway (#6598).
+  const port = deps.liveListenPort?.() ?? runtime?.port ?? config.port;
   // Cursor runs on this machine, so the gateway URL it is told to paste is the LOCAL one: the
   // unauthenticated loopback listener when one is enabled, and otherwise the bind address on the
   // public port — 127.0.0.1 for a loopback or wildcard bind exactly as before, and the tailnet

package/src/server/management/integration-routes.ts

@@ -46,7 +46,7 @@ import {
 } from "../../integrations/mutation-flight";
 import { jsonResponse } from "../auth-cors";
 import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
-import type { ManagementContext } from "./context";
+import { managementInferencePort, type ManagementContext } from "./context";
 import { exportSnapshotIdentity, loadExportModels, previewExportSnapshot } from "./model-rows";
 import {
   previewIntegration,
@@ -230,7 +230,7 @@ function asideOptions(ctx: ManagementContext): AsideProfileRouteOptions {
   return {
     input: () => input ??= {
       config: ctx.config,
-      port: Number(ctx.url.port) || ctx.config.port,
+      port: managementInferencePort(ctx),
       models: () => loadExportModels(ctx.config),
       store: integrationStore(),
       ...pathOverrides(),
@@ -252,7 +252,7 @@ async function buildIntegrationWriteInput(
     clientId,
     models: await loadExportModels(ctx.config),
     config: ctx.config,
-    port: Number(ctx.url.port) || ctx.config.port,
+    port: managementInferencePort(ctx),
     ...(droidReasoningDefaults === undefined ? {} : { droidReasoningDefaults: { ...droidReasoningDefaults } }),
     store,
     io: integrationMutationTestHooks?.io,
@@ -284,7 +284,7 @@ async function buildIntegrationPreviewInput(
       clientId,
       models: snapshot.models,
       config: ctx.config,
-      port: Number(ctx.url.port) || ctx.config.port,
+      port: managementInferencePort(ctx),
       ...(droidReasoningDefaults === undefined ? {} : { droidReasoningDefaults: { ...droidReasoningDefaults } }),
       store,
       io: integrationMutationTestHooks?.io,
@@ -619,7 +619,7 @@ export async function handleIntegrationRoutes(ctx: ManagementContext): Promise<R
   if (url.pathname === "/api/client-integrations" && req.method === "GET") {
     try {
       const models = await loadExportModels(ctx.config);
-      const port = Number(url.port) || ctx.config.port;
+      const port = managementInferencePort(ctx);
       // One store for the whole collection read: without it this route retried
       // maintenance and counted snapshots in the default store even when the
       // caller had bound everything else to a temp root (A-gate round 13).

package/src/server/management/model-routes.ts

@@ -167,7 +167,7 @@ import type {
 
 import { isPlainRecord, parseDebugLogQuery, tokPerSecondResult, unavailableCostReason, costResult, requestLogDto, stripRegistryOnlyStaticHeaders, fetchAllModels } from "./shared";
 import type { MetricUnavailableReason, TokPerSecondResult, CostEstimateReason, CostResult, MetricSource } from "./shared";
-import type { ManagementContext } from "./context";
+import { managementInferencePort, type ManagementContext } from "./context";
 import { effectiveModelReasoningEfforts, inheritedModelReasoningEfforts, listManagementModelRows, loadExportModels } from "./model-rows";
 import { initialModelSelectionPending } from "../../providers/initial-model-selection";
 import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
@@ -204,7 +204,7 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
       ?? (await import("../../integrations/catalog-refresh")).refreshOwnedCatalogIntegrations;
     const clientIntegrations = await refresh({
       config,
-      port: Number(url.port) || config.port,
+      port: managementInferencePort(ctx),
       models: () => loadExportModels(config),
     });
     return { catalogRefresh, clientIntegrations };
@@ -562,7 +562,7 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
         reason: "non_loopback",
       }, 400, req, config);
     }
-    const baseUrl = opencodeProxyBaseUrl(Number(url.port) || config.port, config.hostname, config);
+    const baseUrl = opencodeProxyBaseUrl(managementInferencePort(ctx), config.hostname, config);
     let models: ExportModel[];
     try {
       // The ONE loader every export surface uses. It carries the visibility

package/src/server/management/native-integration-routes.ts

@@ -51,7 +51,7 @@ import type { CodexNativeRestoreResult } from "../../codex/inject";
 import type { OcxConfig } from "../../types";
 import { jsonResponse } from "../auth-cors";
 import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
-import type { ManagementContext } from "./context";
+import { managementInferencePort, type ManagementContext } from "./context";
 
 export type NativeIntegrationClientId = "claude" | "grok" | "codex" | "claude-desktop";
 
@@ -540,7 +540,7 @@ async function handleGrokToggle(ctx: ManagementContext): Promise<Response> {
      * a stale config.hostname picks the wrong loopback policy branch entirely.
      */
     const runtime = (deps.readRuntimePort ?? readRuntimePort)(process.pid);
-    const port = runtime?.port ?? (Number(ctx.url.port) || config.port);
+    const port = deps.liveListenPort?.() ?? runtime?.port ?? managementInferencePort(ctx);
     const hostname = runtime?.hostname ?? config.hostname;
 
     /*