@bitkyc08/opencodex 2.77.0 → 2.78.0

package/src/server/management/oauth-account-routes.ts

@@ -1,3 +1,5 @@
+import { readConfigFileSnapshot, validateConfigCandidate } from "../../config/diagnostics";
+import { ConfigWritePublishedError } from "../../config/persist-unlocked";
 import { parseAnthropicModelRoutes, readAnthropicModelRoutes } from "../../oauth/anthropic-model-routes";
 import { effectiveAnthropicAccountThreshold } from "../../oauth/anthropic-account-threshold";
 import { handleAnthropicAccountThreshold } from "./anthropic-account-threshold";
@@ -16,6 +18,7 @@ import {
   readConfigDiagnostics,
   reconcileLiveConfigFromDisk,
   saveConfigPreservingClaudeCode,
+  mutatePersistedConfig,
 } from "../../config";
 import {
   clearLoginState,
@@ -210,6 +213,44 @@ function genericOAuthProviderConfig(provider: string, config: ManagementContext[
   return definition?.resolveProviderConfig?.(config) ?? definition?.providerConfig;
 }
 
+/** Both Anthropic writers share publication-aware recovery from the atomic mutation owner. */
+function persistAnthropicPoolPatch(
+  config: OcxConfig,
+  patch: (target: OcxConfig) => { changed: boolean; value: NonNullable<OcxConfig["anthropicAccountPool"]> },
+): { status: "saved"; warning?: "config_bookkeeping_failed" } | { status: "failed"; response: Response } {
+  const before = readConfigFileSnapshot();
+  const unknown = () => ({ status: "failed" as const, response: jsonResponse({
+    error: "Pool settings save state is unknown; reload settings before editing again",
+    code: "config_save_state_unknown",
+  }, 409) });
+  try {
+    const saved = mutatePersistedConfig(patch);
+    if (saved.status === "unavailable") return unknown();
+    config.anthropicAccountPool = saved.value;
+    reconcileLiveStateStores();
+    return { status: "saved" };
+  } catch (error) {
+    const persisted = readConfigFileSnapshot();
+    if (persisted.diagnostics.source !== "file" || persisted.raw === undefined) return unknown();
+    // File reads may salvage hand edits; recovery success requires a strict, authoritative document.
+    let validated: ReturnType<typeof validateConfigCandidate>;
+    try { validated = validateConfigCandidate(JSON.parse(persisted.raw.replace(/^\uFEFF/, ""))); }
+    catch { return unknown(); }
+    if (!validated.ok) return unknown();
+    const current = validated.config;
+    const expected = patch(structuredClone(current)).value;
+    const matches = JSON.stringify(current.anthropicAccountPool) === JSON.stringify(expected);
+    if (matches) {
+      config.anthropicAccountPool = current.anthropicAccountPool;
+      // A failed reconcile must not turn confirmed publication back into a rollback.
+      try { reconcileLiveStateStores(); } catch { /* Fixed warning covers bookkeeping failure. */ }
+      return { status: "saved", warning: "config_bookkeeping_failed" };
+    }
+    if (error instanceof ConfigWritePublishedError || persisted.raw !== before.raw) return unknown();
+    return { status: "failed", response: jsonResponse({ error: "Pool settings could not be saved" }, 500) };
+  }
+}
+
 export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<Response | null> {
   const { req, url, config, deps, principal, syncClaudeAgentDefsBestEffort } = ctx;
 
@@ -565,7 +606,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     if (req.method !== "GET" && !isPlainRecord(rawBody)) {
       return jsonResponse({ error: "body must be an object" }, 400);
     }
-    const fields = rawBody as { provider?: unknown; enabled?: unknown; strategy?: unknown; stickyLimit?: unknown; autoSwitchThreshold?: unknown; quotaWindow?: unknown; maxConcurrentPerAccount?: unknown; routes?: unknown };
+    const fields = rawBody as { provider?: unknown; enabled?: unknown; strategy?: unknown; stickyLimit?: unknown; autoSwitchThreshold?: unknown; quotaWindow?: unknown; maxConcurrentPerAccount?: unknown; routes?: unknown; nativeMessages?: unknown };
     const provider = req.method === "GET"
       ? (url.searchParams.get("provider") ?? "").trim().toLowerCase()
       : (typeof fields.provider === "string" ? fields.provider.trim().toLowerCase() : "");
@@ -573,6 +614,10 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     if (!provider || !kind) {
       return jsonResponse({ error: "pool settings are only available for the codex, anthropic and generic OAuth pools" }, 400);
     }
+    if (Object.hasOwn(fields, "nativeMessages")) {
+      if (kind !== "anthropic") return jsonResponse({ error: "nativeMessages is only part of the anthropic pool contract" }, 400);
+      if (typeof fields.nativeMessages !== "boolean") return jsonResponse({ error: "nativeMessages must be a boolean" }, 400);
+    }
     // Validated by the SHARED parsers before any kind-specific write, so a bad strategy or
     // sticky limit is refused identically whichever pool is addressed.
     let strategy: string | undefined;
@@ -625,17 +670,24 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
         if (stickyLimit !== undefined) config.accountPoolStickyLimit = stickyLimit;
         if (autoSwitchThreshold !== undefined) config.autoSwitchThreshold = autoSwitchThreshold;
       } else if (kind === "anthropic") {
-        const pool = { ...(config.anthropicAccountPool ?? {}) };
-        if (fields.enabled !== undefined) pool.enabled = fields.enabled as boolean;
-        if (strategy !== undefined) pool.strategy = strategy as never;
-        if (stickyLimit !== undefined) pool.stickyLimit = stickyLimit;
-        if (autoSwitchThreshold !== undefined) pool.autoSwitchThreshold = autoSwitchThreshold;
-        if (quotaWindow !== undefined) pool.quotaWindow = quotaWindow as never;
-        if (Object.hasOwn(fields, "routes")) {
-          if (fields.routes === null) delete pool.routes;
-          else if (parsedRoutes?.ok) pool.routes = parsedRoutes.routes;
-        }
-        config.anthropicAccountPool = pool;
+        const patchPool = (target: OcxConfig) => {
+          const pool = { ...(target.anthropicAccountPool ?? {}) };
+          if (fields.nativeMessages !== undefined) pool.nativeMessages = fields.nativeMessages as boolean;
+          if (fields.enabled !== undefined) pool.enabled = fields.enabled as boolean;
+          if (strategy !== undefined) pool.strategy = strategy as never;
+          if (stickyLimit !== undefined) pool.stickyLimit = stickyLimit;
+          if (autoSwitchThreshold !== undefined) pool.autoSwitchThreshold = autoSwitchThreshold;
+          if (quotaWindow !== undefined) pool.quotaWindow = quotaWindow as never;
+          if (Object.hasOwn(fields, "routes")) {
+            if (fields.routes === null) delete pool.routes;
+            else if (parsedRoutes?.ok) pool.routes = parsedRoutes.routes;
+          }
+          target.anthropicAccountPool = pool;
+          return { changed: true, value: pool };
+        };
+        const saved = persistAnthropicPoolPatch(config, patchPool);
+        if (saved.status === "failed") return saved.response;
+        return jsonResponse({ ...unifiedPoolSettingsDto(config, provider, kind), ...(saved.warning ? { warning: saved.warning } : {}) });
       } else {
         const prov = config.providers[provider]!;
         const next = { ...(prov.oauthAccountFailover ?? {}) };
@@ -679,6 +731,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
       stickyLimit: normalizeAccountPoolStickyLimit(pool.stickyLimit),
       quotaWindow: normalizeAccountPoolQuotaWindow(pool.quotaWindow),
       ...readAnthropicModelRoutes(pool.routes),
+      nativeMessages: !Object.hasOwn(pool, "nativeMessages") || pool.nativeMessages === true,
       experimental: true,
     });
   }
@@ -696,8 +749,13 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
       quotaWindow?: unknown;
       maxConcurrentPerAccount?: unknown;
       routes?: unknown;
+      nativeMessages?: unknown;
     };
     const provider = typeof body.provider === "string" ? body.provider.trim().toLowerCase() : "";
+    if (Object.hasOwn(body, "nativeMessages")) {
+      if (provider !== "anthropic") return jsonResponse({ error: "nativeMessages is only part of the anthropic pool contract" }, 400);
+      if (typeof body.nativeMessages !== "boolean") return jsonResponse({ error: "nativeMessages must be a boolean" }, 400);
+    }
     if (provider !== "anthropic") {
       const {
         poolSettingsCapability, genericPoolSettingsDto, parseGenericPoolStrategy, parseGenericAutoSwitchThreshold,
@@ -796,28 +854,36 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     const parsedLegacyRoutes = Object.hasOwn(body, "routes") && body.routes !== null
       ? parseAnthropicModelRoutes(body.routes) : null;
     if (parsedLegacyRoutes && !parsedLegacyRoutes.ok) return jsonResponse({ error: parsedLegacyRoutes.error }, 400);
-    const routes = Object.hasOwn(body, "routes")
-      ? (parsedLegacyRoutes?.ok ? parsedLegacyRoutes.routes : undefined)
-      : config.anthropicAccountPool?.routes;
-    config.anthropicAccountPool = {
-      enabled,
-      autoSwitchThreshold: threshold,
-      ...(strategy !== undefined ? { strategy } : {}),
-      ...(stickyLimit !== undefined ? { stickyLimit } : {}),
-      ...(quotaWindow !== undefined ? { quotaWindow } : {}),
-      ...(routes !== undefined ? { routes } : {}),
+    const legacyPatch = (target: OcxConfig) => {
+      const pool = { ...(target.anthropicAccountPool ?? {}) };
+      if (body.enabled !== undefined) pool.enabled = enabled;
+      else if (pool.enabled === undefined) pool.enabled = false;
+      if (body.nativeMessages !== undefined) pool.nativeMessages = body.nativeMessages as boolean;
+      if (body.autoSwitchThreshold !== undefined) pool.autoSwitchThreshold = threshold;
+      else if (pool.autoSwitchThreshold === undefined) pool.autoSwitchThreshold = 80;
+      if (body.strategy !== undefined) pool.strategy = strategy;
+      if (body.stickyLimit !== undefined) pool.stickyLimit = stickyLimit;
+      if (body.quotaWindow !== undefined) pool.quotaWindow = quotaWindow;
+      if (Object.hasOwn(body, "routes")) {
+        if (body.routes === null) delete pool.routes;
+        else if (parsedLegacyRoutes?.ok) pool.routes = parsedLegacyRoutes.routes;
+      }
+      target.anthropicAccountPool = pool;
+      return { changed: true, value: pool };
     };
-    saveConfigPreservingClaudeCode(config);
-    reconcileLiveStateStores();
+    const saved = persistAnthropicPoolPatch(config, legacyPatch);
+    if (saved.status === "failed") return saved.response;
     return jsonResponse({
       ok: true,
       provider,
-      enabled,
-      autoSwitchThreshold: threshold,
-      strategy: normalizeAccountPoolStrategy(strategy),
-      stickyLimit: normalizeAccountPoolStickyLimit(stickyLimit),
-      quotaWindow: normalizeAccountPoolQuotaWindow(quotaWindow),
-      routes: routes ?? null,
+      enabled: config.anthropicAccountPool?.enabled === true,
+      autoSwitchThreshold: config.anthropicAccountPool?.autoSwitchThreshold ?? 80,
+      strategy: normalizeAccountPoolStrategy(config.anthropicAccountPool?.strategy),
+      stickyLimit: normalizeAccountPoolStickyLimit(config.anthropicAccountPool?.stickyLimit),
+      quotaWindow: normalizeAccountPoolQuotaWindow(config.anthropicAccountPool?.quotaWindow),
+      routes: config.anthropicAccountPool?.routes ?? null,
+      nativeMessages: !Object.hasOwn(config.anthropicAccountPool ?? {}, "nativeMessages") || config.anthropicAccountPool?.nativeMessages === true,
+      ...(saved.warning ? { warning: saved.warning } : {}),
       experimental: true,
     });
   }

package/src/server/management/route-registry.ts

@@ -30,6 +30,8 @@ export type ExemptionReason =
   | "gui-invalidation"
   /** Requires a dashboard browser session. Includes the user-consent star boundary. */
   | "session-only"
+  /** Opens a browser view; data operations remain independently CLI-addressable. */
+  | "browser-navigation"
   /** Deliberately returns 405; there is nothing to drive. */
   | "disabled"
   /** Gated on a process-scoped capability principal, not an operator action. */
@@ -43,10 +45,8 @@ export type ExemptionReason =
   /** Older clients use this alias; the current CLI drives its declared replacement. */
   | "compatibility-alias"
   /**
-   * A read-only POST whose purpose is to bind an interactive confirmation to the mutation that
-   * immediately follows it. There is no standalone thing for a CLI to do with one: the plan is
-   * only meaningful to the caller that is about to commit it, and a scripted caller drives the
-   * mutation directly.
+   * An interactive-only preview that lacks a supported terminal confirmation workflow.
+   * Named CLI preview/commit workflows are operational capabilities, not this exemption.
    */
   | "interactive-preview"
   /** Unreachable in the live dispatch order; delete rather than expose. */
@@ -121,7 +121,7 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "PUT", path: "/api/codex-auth/accounts/alias", module: "codex/auth-api/routes", mutates: true },
   { method: "PUT", path: "/api/codex-auth/accounts/pause", module: "codex/auth-api/routes", mutates: true },
   { method: "PUT", path: "/api/codex-auth/accounts/pause-exhausted", module: "codex/auth-api/routes", mutates: true },
-  { method: "PUT", path: "/api/codex-auth/accounts/credits", module: "codex/auth-api/routes", mutates: true, exempt: { reason: "deferred-verb", why: "The credits switches ship on the dashboard Codex Auth header first; `ocx config set creditCodexAccountIds` covers scripted use until an account verb exists.", owner: "#6334 follow-up", ownerDoc: "structure/codex-account-controls.md" } },
+  { method: "PUT", path: "/api/codex-auth/accounts/credits", module: "codex/auth-api/routes", mutates: true },
   { method: "PUT", path: "/api/codex-auth/accounts/priority", module: "codex/auth-api/routes", mutates: true },
   { method: "PUT", path: "/api/codex-auth/active", module: "codex/auth-api/routes", mutates: true },
   { method: "PUT", path: "/api/codex-auth/auto-switch", module: "codex/auth-api/routes", mutates: true },
@@ -152,7 +152,7 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "POST", path: "/api/grok/apply", module: "server/management/agent-settings-routes", mutates: true },
   { method: "GET", path: "/api/grok/reset-coupons", module: "server/management/grok-coupon-routes", mutates: false },
   { method: "POST", path: "/api/grok/reset-coupons/consume", module: "server/management/grok-coupon-routes", mutates: true },
-  { method: "GET", path: "/api/anthropic/reset-grants", module: "server/management/anthropic-reset-grant-routes", mutates: false, exempt: { reason: "deferred-verb", why: "Reading Claude reset grants has no CLI verb yet; the dashboard ticket badge is the only reader in this unit.", owner: "260923_claude_reset_grants wp1", ownerDoc: "devlog/_plan/260923_claude_reset_grants/010_plan.md" } },
+  { method: "GET", path: "/api/anthropic/reset-grants", module: "server/management/anthropic-reset-grant-routes", mutates: false },
   { method: "POST", path: "/api/anthropic/reset-grants/consume", module: "server/management/anthropic-reset-grant-routes", mutates: true, exempt: { reason: "session-only", why: "Spending a Claude reset grant requires the gui-session principal (anthropic-reset-grant-routes.ts handleConsume); the admin token is refused." } },
   { method: "PUT", path: "/api/claude-code", module: "server/management/agent-settings-routes", mutates: true },
   { method: "PUT", path: "/api/claude-desktop", module: "server/management/agent-settings-routes", mutates: true },
@@ -185,10 +185,10 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "GET", path: "/api/client-integrations/aside/profiles/{profileId}", module: "server/management/aside-profile-routes", mutates: false, mechanism: "prefix-decode" },
   { method: "PUT", path: "/api/client-integrations/aside/profiles/{profileId}", module: "server/management/aside-profile-routes", mutates: true, mechanism: "prefix-decode" },
   { method: "GET", path: "/api/client-integrations/aside/profiles/journal", module: "server/management/aside-profile-routes", mutates: false, mechanism: "prefix-decode" },
-  { method: "DELETE", path: "/api/client-integrations/aside/profiles/journal", module: "server/management/aside-profile-routes", mutates: true, mechanism: "prefix-decode", exempt: { reason: "deferred-verb", why: "Aside history deletion uses the dashboard journal cleanup; the CLI has history and restore but no deletion verb yet.", owner: "260904_priority65_closeout WP7", ownerDoc: "devlog/_fin/260904_priority65_closeout/060_wp7_rollback_journal_crud.md" } },
+  { method: "DELETE", path: "/api/client-integrations/aside/profiles/journal", module: "server/management/aside-profile-routes", mutates: true, mechanism: "prefix-decode" },
   { method: "GET", path: "/api/client-integrations/aside/profiles/{profileId}/journal", module: "server/management/aside-profile-routes", mutates: false, mechanism: "prefix-decode" },
-  { method: "POST", path: "/api/client-integrations/aside/profiles/{profileId}/preview", module: "server/management/aside-profile-routes", mutates: false, mechanism: "prefix-decode", exempt: { reason: "interactive-preview", why: "Plans one Aside profile's change so a dashboard confirmation can show what would change and bind to it. Read-only, and useful only to the caller about to commit; a scripted caller drives the profile toggle or restore directly." } },
-  { method: "DELETE", path: "/api/client-integrations/aside/profiles/{profileId}/journal", module: "server/management/aside-profile-routes", mutates: true, mechanism: "prefix-decode", exempt: { reason: "deferred-verb", why: "Aside profile history deletion uses the dashboard journal cleanup; the CLI has scoped history and restore but no deletion verb yet.", owner: "260904_priority65_closeout WP7", ownerDoc: "devlog/_fin/260904_priority65_closeout/060_wp7_rollback_journal_crud.md" } },
+  { method: "POST", path: "/api/client-integrations/aside/profiles/{profileId}/preview", module: "server/management/aside-profile-routes", mutates: false, mechanism: "prefix-decode" },
+  { method: "DELETE", path: "/api/client-integrations/aside/profiles/{profileId}/journal", module: "server/management/aside-profile-routes", mutates: true, mechanism: "prefix-decode" },
   { method: "POST", path: "/api/client-integrations/aside/profiles/{profileId}/restore", module: "server/management/aside-profile-routes", mutates: true, mechanism: "prefix-decode" },
   // server/management/codex-prompt-routes
   { method: "GET", path: "/api/codex-prompt", module: "server/management/codex-prompt-routes", mutates: false },
@@ -227,15 +227,15 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   // server/management/integration-routes
   { method: "GET", path: "/api/client-integrations", module: "server/management/integration-routes", mutates: false },
   { method: "GET", path: "/api/client-integrations/journal", module: "server/management/integration-routes", mutates: false },
-  { method: "DELETE", path: "/api/client-integrations/journal", module: "server/management/integration-routes", mutates: true, exempt: { reason: "deferred-verb", why: "Retiring one rollback row is a dashboard-local cleanup; the CLI verb that would drive it is owed by a later work-phase and is not implemented here.", owner: "260904_priority65_closeout WP7", ownerDoc: "devlog/_fin/260904_priority65_closeout/060_wp7_rollback_journal_crud.md" } },
+  { method: "DELETE", path: "/api/client-integrations/journal", module: "server/management/integration-routes", mutates: true },
   { method: "POST", path: "/api/client-integrations/restore", module: "server/management/integration-routes", mutates: true },
-  { method: "POST", path: "/api/client-integrations/preview", module: "server/management/integration-routes", mutates: false, exempt: { reason: "interactive-preview", why: "Plans an apply, overwrite or disable so a dashboard confirmation can show what would change and bind to it. Read-only, and useful only to the caller about to commit; a scripted caller drives PUT /api/client-integrations/{clientId} directly." } },
-  { method: "POST", path: "/api/client-integrations/restore/preview", module: "server/management/integration-routes", mutates: false, exempt: { reason: "interactive-preview", why: "Plans an undo so drift is shown before a restore rather than discovered by a rejected mutation. Read-only, and useful only to the caller about to commit; a scripted caller drives POST /api/client-integrations/restore directly." } },
+  { method: "POST", path: "/api/client-integrations/preview", module: "server/management/integration-routes", mutates: false },
+  { method: "POST", path: "/api/client-integrations/restore/preview", module: "server/management/integration-routes", mutates: false },
   // server/management/lab-automation-routes
   { method: "GET", path: "/api/lab/automation", module: "server/management/lab-automation-routes", mutates: false, exempt: { reason: "local-transport", why: "ocx lab reads the same rows from the local SQLite projection; src/cli/lab.ts imports ../lab/query directly and never fetches /api/lab." } },
   { method: "GET", path: "/api/lab/automation/runs", module: "server/management/lab-automation-routes", mutates: false, exempt: { reason: "local-transport", why: "ocx lab reads the same rows from the local SQLite projection; src/cli/lab.ts imports ../lab/query directly and never fetches /api/lab." } },
-  { method: "POST", path: "/api/lab/automation/run", module: "server/management/lab-automation-routes", mutates: true, exempt: { reason: "deferred-verb", why: "Lab automation run has no CLI verb yet. A local SQLite read cannot drive it, so local-transport does not apply.", owner: "wp7", ownerDoc: "devlog/_plan/260828_ocx_agentic_control/060_phase_gui_parity.md" } },
-  { method: "PUT", path: "/api/lab/automation", module: "server/management/lab-automation-routes", mutates: true, exempt: { reason: "deferred-verb", why: "Lab automation config update has no CLI verb yet. A local SQLite read cannot drive it, so local-transport does not apply.", owner: "wp7", ownerDoc: "devlog/_plan/260828_ocx_agentic_control/060_phase_gui_parity.md" } },
+  { method: "POST", path: "/api/lab/automation/run", module: "server/management/lab-automation-routes", mutates: true, exempt: { reason: "deferred-verb", why: "ocx lab run explicitly executes a local scenario. The local invocation does not control the selected running proxy; this HTTP operation remains deferred.", owner: "wp7", ownerDoc: "devlog/_plan/260828_ocx_agentic_control/060_phase_gui_parity.md" } },
+  { method: "PUT", path: "/api/lab/automation", module: "server/management/lab-automation-routes", mutates: true, exempt: { reason: "deferred-verb", why: "ocx lab automation enable/disable updates local policy. The local invocation does not control the selected running proxy; this HTTP operation remains deferred.", owner: "wp7", ownerDoc: "devlog/_plan/260828_ocx_agentic_control/060_phase_gui_parity.md" } },
   // server/management/lab-routes
   { method: "GET", path: "/api/lab/artifacts", module: "server/management/lab-routes", mutates: false, exempt: { reason: "local-transport", why: "ocx lab reads the same rows from the local SQLite projection; src/cli/lab.ts imports ../lab/query directly and never fetches /api/lab." } },
   { method: "GET", path: "/api/lab/catalog", module: "server/management/lab-routes", mutates: false, exempt: { reason: "local-transport", why: "ocx lab reads the same rows from the local SQLite projection; src/cli/lab.ts imports ../lab/query directly and never fetches /api/lab." } },
@@ -246,10 +246,10 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "GET", path: "/api/lab/status", module: "server/management/lab-routes", mutates: false, exempt: { reason: "local-transport", why: "ocx lab reads the same rows from the local SQLite projection; src/cli/lab.ts imports ../lab/query directly and never fetches /api/lab." } },
   { method: "GET", path: "/api/lab/subjects", module: "server/management/lab-routes", mutates: false, exempt: { reason: "local-transport", why: "ocx lab reads the same rows from the local SQLite projection; src/cli/lab.ts imports ../lab/query directly and never fetches /api/lab." } },
   { method: "GET", path: "/api/lab/verdicts", module: "server/management/lab-routes", mutates: false, exempt: { reason: "local-transport", why: "ocx lab reads the same rows from the local SQLite projection; src/cli/lab.ts imports ../lab/query directly and never fetches /api/lab." } },
-  { method: "POST", path: "/api/lab/public/community/import", module: "server/management/lab-routes", mutates: true, exempt: { reason: "deferred-verb", why: "Community evidence import has no CLI verb yet. A local SQLite read cannot drive it, so local-transport does not apply.", owner: "wp7", ownerDoc: "devlog/_plan/260828_ocx_agentic_control/060_phase_gui_parity.md" } },
-  { method: "POST", path: "/api/lab/public/export", module: "server/management/lab-routes", mutates: true, exempt: { reason: "deferred-verb", why: "Public evidence export has no CLI verb yet. A local SQLite read cannot drive it, so local-transport does not apply.", owner: "wp7", ownerDoc: "devlog/_plan/260828_ocx_agentic_control/060_phase_gui_parity.md" } },
-  { method: "POST", path: "/api/lab/public/preview", module: "server/management/lab-routes", mutates: true, exempt: { reason: "deferred-verb", why: "Public evidence preview has no CLI verb yet. A local SQLite read cannot drive it, so local-transport does not apply.", owner: "wp7", ownerDoc: "devlog/_plan/260828_ocx_agentic_control/060_phase_gui_parity.md" } },
-  { method: "POST", path: "/api/lab/public/verify", module: "server/management/lab-routes", mutates: true, exempt: { reason: "deferred-verb", why: "Public evidence verification has no CLI verb yet. A local SQLite read cannot drive it, so local-transport does not apply.", owner: "wp7", ownerDoc: "devlog/_plan/260828_ocx_agentic_control/060_phase_gui_parity.md" } },
+  { method: "POST", path: "/api/lab/public/community/import", module: "server/management/lab-routes", mutates: true, exempt: { reason: "deferred-verb", why: "ocx lab public import reads a local bundle file. The local invocation does not control the selected running proxy; this HTTP operation remains deferred.", owner: "wp7", ownerDoc: "devlog/_plan/260828_ocx_agentic_control/060_phase_gui_parity.md" } },
+  { method: "POST", path: "/api/lab/public/export", module: "server/management/lab-routes", mutates: true, exempt: { reason: "deferred-verb", why: "ocx lab public export uses local evidence. The local invocation does not control the selected running proxy; this HTTP operation remains deferred.", owner: "wp7", ownerDoc: "devlog/_plan/260828_ocx_agentic_control/060_phase_gui_parity.md" } },
+  { method: "POST", path: "/api/lab/public/preview", module: "server/management/lab-routes", mutates: true, exempt: { reason: "deferred-verb", why: "ocx lab public preview uses local evidence. The local invocation does not control the selected running proxy; this HTTP operation remains deferred.", owner: "wp7", ownerDoc: "devlog/_plan/260828_ocx_agentic_control/060_phase_gui_parity.md" } },
+  { method: "POST", path: "/api/lab/public/verify", module: "server/management/lab-routes", mutates: true, exempt: { reason: "deferred-verb", why: "ocx lab public verify reads a local bundle file. The local invocation does not control the selected running proxy; this HTTP operation remains deferred.", owner: "wp7", ownerDoc: "devlog/_plan/260828_ocx_agentic_control/060_phase_gui_parity.md" } },
   // server/management/logs-usage-routes
   { method: "GET", path: "/api/claude/inbound-debug", module: "server/management/logs-usage-routes", mutates: false },
   { method: "GET", path: "/api/debug", module: "server/management/logs-usage-routes", mutates: false },
@@ -265,7 +265,7 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   // server/management/usage-timeline-routes
   { method: "GET", path: "/api/usage/timeline", module: "server/management/usage-timeline-routes", mutates: false },
   // server/management/companion-routes
-  { method: "POST", path: "/api/companion/open-in-browser", module: "server/management/companion-routes", mutates: true, exempt: { reason: "session-only", why: "Dashboard-only navigation helper; the GUI session opens its current view in the system browser, and there is no standalone CLI operation to drive." } },
+  { method: "POST", path: "/api/companion/open-in-browser", module: "server/management/companion-routes", mutates: true, exempt: { reason: "browser-navigation", why: "Opens the companion's current view in the system browser under normal management admission; the CLI reads the underlying settings and usage directly." } },
   { method: "GET", path: "/api/companion/settings", module: "server/management/companion-routes", mutates: false },
   { method: "PUT", path: "/api/companion/settings", module: "server/management/companion-routes", mutates: true },
   { method: "POST", path: "/api/storage/cleanup", module: "server/management/logs-usage-routes", mutates: true },
@@ -315,7 +315,7 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "GET", path: "/api/oauth/accounts/pool", module: "server/management/oauth-account-routes", mutates: false },
   { method: "GET", path: "/api/pool/settings", module: "server/management/oauth-account-routes", mutates: false },
   { method: "PUT", path: "/api/pool/settings", module: "server/management/oauth-account-routes", mutates: true },
-  { method: "PATCH", path: "/api/pool/settings", module: "server/management/oauth-account-routes", mutates: true },
+  { method: "PATCH", path: "/api/pool/settings", module: "server/management/oauth-account-routes", mutates: true, exempt: { reason: "compatibility-alias", why: "Handled by the same partial settings branch as PUT /api/pool/settings; current CLI strategy, sticky and routes commands use PUT, not PATCH." } },
   { method: "GET", path: "/api/oauth/providers", module: "server/management/oauth-account-routes", mutates: false },
   { method: "GET", path: "/api/oauth/status", module: "server/management/oauth-account-routes", mutates: false },
   { method: "GET", path: "/api/providers/keys", module: "server/management/oauth-account-routes", mutates: false },
@@ -350,7 +350,7 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "PATCH", path: "/api/providers", module: "server/management/provider-routes", mutates: true },
   { method: "POST", path: "/api/providers", module: "server/management/provider-routes", mutates: true },
   { method: "POST", path: "/api/providers/test", module: "server/management/provider-routes", mutates: true },
-  { method: "PUT", path: "/api/providers", module: "server/management/provider-routes", mutates: true, exempt: { reason: "deferred-verb", why: "Issue #3280 scopes this atomic batch endpoint to the GUI JSON editor; a matching CLI verb is outside wp5 and remains owed.", owner: "wp5-followup", ownerDoc: "devlog/_fin/260903_bug_drawdown_bcda/050_phase5.md" } },
+  { method: "PUT", path: "/api/providers", module: "server/management/provider-routes", mutates: true },
   { method: "PUT", path: "/api/provider-context-caps", module: "server/management/provider-routes", mutates: true },
   // server/management/quota-reset-routes
   { method: "GET", path: "/api/quota-resets", module: "server/management/quota-reset-routes", mutates: false, mechanism: "negated-guard" },
@@ -394,9 +394,9 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "DELETE", path: "/api/link/{id}", module: "server/management/link-routes", mutates: true, mechanism: "regex" },
   { method: "POST", path: "/api/link/issue", module: "server/management/link-routes", mutates: true },
   // server/management/remote-workspace-routes
-  { method: "GET", path: "/api/remote-workspace", module: "server/management/remote-workspace-routes", mutates: false, exempt: { reason: "deferred-verb", why: "The first Remote Workspace slice exposes Hub status through the authenticated dashboard; a distinct CLI Hub-status verb is still owed and must not be confused with the Executor-local status command.", owner: "remote-workspace-cli-followup", ownerDoc: "docs-site/src/content/docs/reference/management-api.md" } },
-  { method: "GET", path: "/api/remote-workspace/runtimes", module: "server/management/remote-workspace-routes", mutates: false, exempt: { reason: "deferred-verb", why: "The first Remote Workspace slice exposes Hub runtime availability through the authenticated dashboard; a distinct CLI Hub-status verb is still owed.", owner: "remote-workspace-cli-followup", ownerDoc: "docs-site/src/content/docs/reference/management-api.md" } },
-  { method: "GET", path: "/api/remote-workspace/sessions", module: "server/management/remote-workspace-routes", mutates: false, exempt: { reason: "deferred-verb", why: "The first Remote Workspace slice exposes Hub session snapshots through the authenticated dashboard; a distinct CLI Hub-status verb is still owed.", owner: "remote-workspace-cli-followup", ownerDoc: "docs-site/src/content/docs/reference/management-api.md" } },
+  { method: "GET", path: "/api/remote-workspace", module: "server/management/remote-workspace-routes", mutates: false },
+  { method: "GET", path: "/api/remote-workspace/runtimes", module: "server/management/remote-workspace-routes", mutates: false },
+  { method: "GET", path: "/api/remote-workspace/sessions", module: "server/management/remote-workspace-routes", mutates: false },
   { method: "POST", path: "/api/remote-workspace/pairing", module: "server/management/remote-workspace-routes", mutates: true, exempt: { reason: "session-only", why: "Creating a device enrollment grant authorizes another computer, so only a dashboard consent session may request one." } },
   { method: "POST", path: "/api/remote-workspace/sessions", module: "server/management/remote-workspace-routes", mutates: true, exempt: { reason: "session-only", why: "Starting a Hub-authenticated model session against a remote computer requires an interactive dashboard consent session." } },
   { method: "POST", path: "/api/remote-workspace/sessions/{id}/prompt", module: "server/management/remote-workspace-routes", mutates: true, mechanism: "regex", exempt: { reason: "session-only", why: "A prompt can execute tools on the selected remote computer and therefore requires an interactive dashboard consent session." } },
@@ -422,6 +422,7 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "PUT", path: "/api/providers/{provider}/model-aliases", module: "server/management/model-routes", mutates: true, mechanism: "regex" },
   { method: "GET", path: "/api/providers/{provider}/model-costs", module: "server/management/model-routes", mutates: false, mechanism: "regex" },
   { method: "PUT", path: "/api/providers/{provider}/model-costs", module: "server/management/model-routes", mutates: true, mechanism: "regex" },
+  { method: "PUT", path: "/api/providers/{provider}/model-display-names", module: "server/management/model-routes", mutates: true, mechanism: "regex" },
   { method: "PUT", path: "/api/custom-models/{id}", module: "server/management/model-routes", mutates: true, mechanism: "regex" },
   { method: "DELETE", path: "/api/custom-models/{id}", module: "server/management/model-routes", mutates: true, mechanism: "regex" },
   { method: "GET", path: "/api/lab/subjects/{id}", module: "server/management/lab-routes", mutates: false, mechanism: "regex", exempt: { reason: "local-transport", why: "ocx lab reads the same rows from the local SQLite projection; src/cli/lab.ts imports ../lab/query directly and never fetches /api/lab." } },

package/src/server/messages-native-eligibility.ts

@@ -7,7 +7,6 @@
  */
 import { anthropicBodyElidesBlockedSkill } from "../claude/inbound";
 import { isClaudeWebSearchToolName } from "../claude/outbound";
-import { isAnthropicAccountPoolEnabled } from "../oauth/anthropic-routing";
 import type { ProtocolReasonCode } from "../protocols/contract";
 import { featuresFromMessagesBody } from "../protocols/features";
 import { credentialDomainFor } from "../protocols/opaque-state";
@@ -96,8 +95,7 @@ function bridgeOnlyPolicyApplies(
  * The credential rule. A proxy-managed key is native since PF-08. An Anthropic OAuth account
  * is native only with `managedMessagesNativeOAuth` on (itself effective only with
  * `managedMessagesNative`), only for the `anthropic` provider the OAuth store serves, and only
- * to `api.anthropic.com`. A pooled account set declines: rotation, session affinity and quota
- * ranking live in the Responses pipeline's transport and are not replicated here. `forward`
+ * to `api.anthropic.com`. Pool selection and recovery are resolved at native dispatch. `forward`
  * belongs to the caller.
  */
 function credentialDeclineReason(
@@ -108,10 +106,9 @@ function credentialDeclineReason(
   const provider = route.provider;
   if (provider.authMode === undefined || provider.authMode === "key") return undefined;
   if (provider.authMode !== "oauth") return "auth-mode-not-native";
-  if (!resolveProtocolSettings(config).rollout.managedMessagesNativeOAuth) return "auth-mode-not-native";
+  if (!resolveProtocolSettings(config, route.providerName).rollout.managedMessagesNativeOAuth) return "auth-mode-not-native";
   if (route.providerName !== "anthropic") return "auth-mode-not-native";
   if (!credentialDomainFor(provider)?.firstPartyAnthropic) return "auth-mode-not-native";
-  if (isAnthropicAccountPoolEnabled(config) || selector.oauthFailoverQuorum === true) return "oauth-account-pool";
   return undefined;
 }
 
@@ -135,7 +132,7 @@ export function nativeMessagesDeclineReason(
   config: OcxConfig,
   selector: NativeMessagesSelector = {},
 ): NativeMessagesDeclineReason | undefined {
-  if (!resolveProtocolSettings(config).rollout.managedMessagesNative) return "rollout-disabled";
+  if (!resolveProtocolSettings(config, route.providerName).rollout.managedMessagesNative) return "rollout-disabled";
   const provider = route.provider;
   if (provider.adapter !== "anthropic") return "cross-wire-ir";
   const credentialDecline = credentialDeclineReason(route, config, selector);

package/src/server/messages-native-oauth.ts

@@ -2,19 +2,15 @@
  * Anthropic OAuth on the managed native Messages lane (PF-10, behind
  * `protocols.rollout.managedMessagesNativeOAuth`).
  *
- * Credential. The account is the one the existing OAuth selection chooses for this request, by
- * the same steps the Responses pipeline's transport takes for an unpooled Anthropic OAuth route
- * (`prepareResponsesTransport`): capture the committed selection, resolve an eligible account's
- * access snapshot (including pause/cooldown recovery), and commit that
- * proposal against the captured selection so a concurrent manual switch wins. Nothing here picks
- * an account of its own, and nothing runs at planning time: the planner and eligibility read
- * config only, and this module is reached from the lane's dispatch alone.
+ * Credential. Shared Anthropic routing chooses the account for the session and model;
+ * the same generation-fenced selection commit as the Responses transport admits it. A lost
+ * commit re-evaluates routing so a concurrent manual switch or policy edit wins. Selection,
+ * token resolution and affinity binding run at dispatch only, never during planning.
  *
- * Pools. A pooled account set (the opt-in Anthropic account pool, or two or more usable accounts,
- * which turns on reactive 429 rotation) is declined before this lane is chosen
- * (`oauth-account-pool`). Should one appear between that decision and dispatch, resolution fails
- * closed rather than serve a pooled account without the pool's rotation and affinity. This
- * lane-change 409 is distinct from the shared local authentication/pause/cooldown refusals.
+ * Pools. Native Messages uses the OAuth owner's strategy, model allowlist, session affinity,
+ * pause and cooldown admission. Pre-output refusal recovery proposes a replacement account;
+ * this module admits and binds its exact generation before a rebuilt request may send.
+ * A lane-change 409 remains distinct from typed local authentication/pause/cooldown refusals.
  *
  * Tool names. An OAuth request carries client tool names under the Claude OAuth prefix, as the
  * adapter sends them; the answer's `tool_use` names are mapped back here, for exactly the names
@@ -25,12 +21,15 @@
 import type { OAuthAccessSnapshot } from "../oauth";
 import {
   commitAnthropicSelectionRouting,
+  captureAnthropicManualSelectionGeneration,
   getAnthropicPoolAccessSnapshot,
   getAnthropicAccountHealthSnapshot,
   resolveAnthropicDispatchAccountId,
-  hasAnthropicFailoverQuorum,
+  resolveAnthropicAccountForSession,
+  getEligibleAnthropicAccounts,
   isAnthropicAccountPoolEnabled,
 } from "../oauth/anthropic-routing";
+import { resolveAnthropicModelRoute, routeCandidates, type AnthropicRouteDecision } from "../oauth/anthropic-model-routes";
 import {
   captureOAuthAccountSelection,
   commitOAuthAccountSelection,
@@ -57,9 +56,14 @@ export interface NativeOAuthBinding {
   readonly snapshot: OAuthAccessSnapshot;
   /** Anthropic account UUID from the same stored generation, distinct from snapshot.accountId. */
   readonly providerAccountUuid?: string;
+  readonly routeDecision: AnthropicRouteDecision | null;
+  readonly sessionKey: string | null;
+  readonly model?: string;
+  readonly config: OcxConfig;
+  readonly manualSelectionGeneration: number;
 }
 
-/** The selection moved or became pooled while it was being resolved. Maps to a 409 retry. */
+/** The selection moved or became ineligible while resolving. Maps to a 409 retry. */
 export class NativeOAuthSelectionChangedError extends Error {
   constructor() {
     super("OAuth account selection changed; retry the request");
@@ -67,57 +71,100 @@ export class NativeOAuthSelectionChangedError extends Error {
   }
 }
 
-function pooled(config: OcxConfig): boolean {
-  return isAnthropicAccountPoolEnabled(config) || hasAnthropicFailoverQuorum();
+/** Invalid operator route configuration remains a request refusal, not an auth failure. */
+export class NativeOAuthModelRouteError extends Error {}
+
+function currentRoute(config: OcxConfig, model?: string): AnthropicRouteDecision | null {
+  const resolved = model ? resolveAnthropicModelRoute(config, model) : { decision: null };
+  if (resolved.error) throw new NativeOAuthModelRouteError(`Invalid Anthropic model routes: ${resolved.error}`);
+  return resolved.decision ? { ...resolved.decision, accounts: [...resolved.decision.accounts] } : null;
 }
 
-/**
- * Resolve and commit the account for one native request. Throws the OAuth owner's own errors
- * (login required, refresh failure) unchanged, and `NativeOAuthSelectionChangedError` when the
- * selection could not be committed.
- */
-export async function resolveNativeOAuthBinding(config: OcxConfig): Promise<NativeOAuthBinding> {
+function routeIsCurrent(config: OcxConfig, model: string | undefined, decision: AnthropicRouteDecision | null): boolean {
+  return JSON.stringify(currentRoute(config, model)) === JSON.stringify(decision);
+}
+
+export interface NativeOAuthBindingOptions {
+  sessionKey?: string | null;
+  model?: string;
+  /** An account proposed by the shared pre-output refusal recovery policy. */
+  candidateAccountId?: string;
+  /** Selection captured before asynchronous refusal classification or throttle wait. */
+  expectedRecoverySelection?: Selection | null;
+  expectedRecoveryRouteDecision?: AnthropicRouteDecision | null;
+}
+
+/** Resolve the shared pool selector and commit its exact credential generation for dispatch. */
+export async function resolveNativeOAuthBinding(
+  config: OcxConfig,
+  options: NativeOAuthBindingOptions = {},
+): Promise<NativeOAuthBinding> {
+  const sessionKey = options.sessionKey ?? null;
+  const model = options.model;
   for (let attempt = 0; attempt < MAX_SELECTION_ATTEMPTS; attempt++) {
+    const routeDecision = currentRoute(config, model);
+    const manualSelectionGeneration = captureAnthropicManualSelectionGeneration();
     const selection = captureOAuthAccountSelection(PROVIDER);
-    // Resolve eligibility before the lane guard: a local 401/403/429 must not turn
-    // into a generic lane-change 409 merely because it appeared during pacing.
-    const accountId = await resolveAnthropicDispatchAccountId(config);
-    if (pooled(config)) throw new NativeOAuthSelectionChangedError();
+    // Always ask admission first so pause/login/cooldown retains its typed local refusal.
+    const admittedId = await resolveAnthropicDispatchAccountId(config, sessionKey, routeDecision, model);
+    if (!routeIsCurrent(config, model, routeDecision)) continue;
+    const proposed = resolveAnthropicAccountForSession(sessionKey, config, Date.now(), routeDecision, model);
+    // A lost selection commit discards a recovery proposal: a newer manual/policy choice wins.
+    const recoverySelectionMatches = !!options.expectedRecoverySelection
+      && selection?.accountId === options.expectedRecoverySelection.accountId
+      && selection?.revision === options.expectedRecoverySelection.revision;
+    const recoveryRouteMatches = options.expectedRecoveryRouteDecision === undefined
+      || JSON.stringify(options.expectedRecoveryRouteDecision) === JSON.stringify(routeDecision);
+    const accountId = attempt === 0 && options.candidateAccountId && recoverySelectionMatches && recoveryRouteMatches
+      ? options.candidateAccountId : admittedId;
     if (!selection) continue;
+    if (!routeCandidates(getEligibleAnthropicAccounts(Date.now(), model), routeDecision).includes(accountId)) {
+      throw new NativeOAuthSelectionChangedError();
+    }
     const candidate = await getAnthropicPoolAccessSnapshot(accountId);
+    if (!routeIsCurrent(config, model, routeDecision)) continue;
     const committed = await commitOAuthAccountSelection(PROVIDER, candidate.accountId, {
       expectedSelection: selection,
       expectedCredentialGeneration: candidate.generation,
       requireUsableAccount: true,
     });
     if (committed) {
+      if (!routeIsCurrent(config, model, routeDecision)
+        || manualSelectionGeneration !== captureAnthropicManualSelectionGeneration()) continue;
       if (!commitAnthropicSelectionRouting(candidate.accountId, selection, committed, {
-        config,
-        sessionKey: null,
+        config, sessionKey, model, routeDecision,
+        reason: accountId === proposed.accountId ? proposed.reason : undefined,
         expectedCredentialGeneration: candidate.generation,
       })) continue;
-      if (pooled(config)) break;
       const row = getAccountCredentialWithStatus(PROVIDER, candidate.accountId);
       if (!row || credentialGeneration(row.credential) !== candidate.generation) continue;
-      const binding = { selection: committed, snapshot: candidate, providerAccountUuid: row.credential.accountId };
+      const binding = { selection: committed, snapshot: candidate, providerAccountUuid: row.credential.accountId, routeDecision, sessionKey, model, config, manualSelectionGeneration };
       if (nativeOAuthBindingIsCurrent(binding)) return binding;
     }
-    // Re-read after a lost commit or a health change during credential resolution.
   }
   throw new NativeOAuthSelectionChangedError();
 }
 
 /**
- * Whether a binding may still be sent: the same committed selection, and the same usable,
- * unexpired credential generation. Checked immediately before every physical send.
+ * Whether a binding may still be sent: a live pooled session affinity or the same committed
+ * selection, plus the same usable credential generation. Checked before every physical send.
  */
 export function nativeOAuthBindingIsCurrent(binding: NativeOAuthBinding): boolean {
+  if (binding.manualSelectionGeneration !== captureAnthropicManualSelectionGeneration()
+    || !routeIsCurrent(binding.config, binding.model, binding.routeDecision)) return false;
   const selected = captureOAuthAccountSelection(PROVIDER);
   const row = getAccountCredentialWithStatus(PROVIDER, binding.snapshot.accountId);
-  return selected?.accountId === binding.selection.accountId
-    && selected?.revision === binding.selection.revision
+  const sessionRoute = isAnthropicAccountPoolEnabled(binding.config) && binding.sessionKey
+    ? resolveAnthropicAccountForSession(binding.sessionKey, binding.config, Date.now(), binding.routeDecision, binding.model) : null;
+  // Another conversation may move the automatic active pointer without revoking this
+  // session's affinity. Manual selection clears affinity and precedes it in the selector.
+  const selectionCurrent = sessionRoute?.reason === "affinity"
+    && sessionRoute.accountId === binding.snapshot.accountId
+    || (selected?.accountId === binding.selection.accountId && selected?.revision === binding.selection.revision);
+  return selectionCurrent
     && !!row && !row.paused && !row.needsReauth && row.credential.expires > Date.now()
     && !getAnthropicAccountHealthSnapshot(binding.snapshot.accountId)
+    && routeCandidates(getEligibleAnthropicAccounts(Date.now(), binding.model), binding.routeDecision).includes(binding.snapshot.accountId)
     && credentialGeneration(row.credential) === binding.snapshot.generation
     && row.credential.accountId === binding.providerAccountUuid;
 }