@bitkyc08/opencodex 2.78.0 → 2.79.0

package/src/lib/windows-owner-acl.ts

@@ -0,0 +1,143 @@
+import { resolveTrustedWindowsPowerShellExe } from "./windows-elevation";
+
+export interface WindowsPrivateEntry {
+  path: string;
+  directory: boolean;
+}
+export interface WindowsOwnerAclResult {
+  success: boolean;
+  timedOut: boolean;
+  stdout: string | Uint8Array;
+}
+export type WindowsOwnerAclRunner = (entries: readonly WindowsPrivateEntry[], timeoutMs: number) => WindowsOwnerAclResult;
+
+export const WINDOWS_OWNER_ACL_TIMEOUT_MS = 5_000;
+const SID = /^S-1-\d+(?:-\d+)+$/i;
+const ADMINISTRATORS = "S-1-5-32-544";
+const PRIVILEGED_GRANTEES = new Set(["S-1-5-18", ADMINISTRATORS]); // LocalSystem, BUILTIN\Administrators
+const PRIVATE_DACL_FLAGS = 0x1004; // DiscretionaryAclPresent | DiscretionaryAclProtected
+const FULL_CONTROL = 2032127;
+
+// This script is constant. Literal paths are environment data, never PowerShell source.
+// Read the descriptor through .NET (Owner, Group and Access, as Get-Acl does). Get-Acl is a module-autoloaded
+// cmdlet: PowerShell 5.1 resolves it through the per-profile module analysis cache, and with a fresh or
+// redirected LOCALAPPDATA that rebuild scans every PSModulePath module and can outlast the inspection budget
+// (hosted Windows runners: the pairing CLI timed out at 30 s). Every call below is a .NET member, so nothing
+// autoloads and no module on PSModulePath can shadow the read. GetAccessRules projects away unsupported ACE details, so the
+// ACEs are read from the serialized descriptor instead. .NET canonicalizes it first: compatible entries for the
+// same principal merge and entries that grant nothing drop, but another principal's entry is never folded into
+// the user's, and the owner is untouched. The policy is therefore the effective DACL, not the on-disk bytes.
+const ACL_SCRIPT = String.raw`
+$ErrorActionPreference='Stop'
+try {
+  # ASCII has no preamble, so a UTF-8 console code page cannot prefix the protocol with a BOM.
+  try { [Console]::OutputEncoding=[System.Text.Encoding]::ASCII } catch { $encodingUnchanged=$true }
+  $countText=[Environment]::GetEnvironmentVariable('OCX_ACL_COUNT')
+  if ($countText -notmatch '^[1-9][0-9]*$') { throw 'count' }
+  $count=[int]$countText
+  $identity=[System.Security.Principal.WindowsIdentity]::GetCurrent()
+  $principal=[System.Security.Principal.WindowsPrincipal]::new($identity)
+  $administrators=[System.Security.Principal.SecurityIdentifier]::new('S-1-5-32-544')
+  $enabled=$principal.IsInRole($administrators)
+  [Console]::WriteLine(('U|{0}|{1}|{2}' -f $identity.User.Value,$identity.Owner.Value,$enabled))
+  $sections=[System.Security.AccessControl.AccessControlSections]'Owner,Group,Access'
+  for ($i=0; $i -lt $count; $i++) {
+    $path=[Environment]::GetEnvironmentVariable(('OCX_ACL_PATH_{0}' -f $i))
+    if ([string]::IsNullOrEmpty($path)) { throw 'path' }
+    if ([System.IO.Directory]::Exists($path)) { $acl=[System.Security.AccessControl.DirectorySecurity]::new($path, $sections) }
+    else { $acl=[System.Security.AccessControl.FileSecurity]::new($path, $sections) }
+    $acls=@($acl)
+    if ($acls.Count -ne 1) { throw 'acl' }
+    $bytes=$acls[0].GetSecurityDescriptorBinaryForm()
+    $raw=[System.Security.AccessControl.RawSecurityDescriptor]::new([byte[]]$bytes, 0)
+    $aceCount=-1
+    if ($null -ne $raw.DiscretionaryAcl) { $aceCount=$raw.DiscretionaryAcl.Count }
+    [Console]::WriteLine(('E|{0}|{1}|{2}|{3}' -f $i,$raw.Owner.Value,[int]$raw.ControlFlags,$aceCount))
+    if ($null -ne $raw.DiscretionaryAcl) {
+      foreach ($ace in $raw.DiscretionaryAcl) {
+        if ($ace -is [System.Security.AccessControl.CommonAce]) {
+          [Console]::WriteLine(('A|{0}|{1}|{2}|{3}|{4}|{5}' -f $i,[int]$ace.AceType,[int]$ace.AceFlags,[int]$ace.AccessMask,$ace.SecurityIdentifier.Value,$ace.IsCallback))
+        } else {
+          [Console]::WriteLine(('A|{0}|{1}|X' -f $i,[int]$ace.AceType))
+        }
+      }
+    }
+  }
+  [Console]::WriteLine('END')
+  exit 0
+} catch { exit 3 }
+`;
+const ENCODED_ACL_SCRIPT = Buffer.from(ACL_SCRIPT, "utf16le").toString("base64");
+
+function defaultWindowsOwnerAclRunner(entries: readonly WindowsPrivateEntry[], timeoutMs: number): WindowsOwnerAclResult {
+  const env: Record<string, string | undefined> = { ...process.env, OCX_ACL_COUNT: String(entries.length) };
+  for (let i = 0; i < entries.length; i++) env[`OCX_ACL_PATH_${i}`] = entries[i]!.path;
+  const result = Bun.spawnSync([
+    resolveTrustedWindowsPowerShellExe(), "-NoLogo", "-NoProfile", "-NonInteractive",
+    "-ExecutionPolicy", "Bypass", "-EncodedCommand", ENCODED_ACL_SCRIPT,
+  ], {
+    env, stdin: "ignore", stdout: "pipe", stderr: "ignore",
+    timeout: timeoutMs, windowsHide: true,
+  });
+  return { success: result.success, timedOut: result.exitedDueToTimeout ?? false, stdout: result.stdout ?? new Uint8Array() };
+}
+let ownerAclRunner: WindowsOwnerAclRunner = defaultWindowsOwnerAclRunner;
+/** Test-only access to the real subprocess runner, for native diagnostics. */
+export const windowsOwnerAclDefaultRunnerForTests: WindowsOwnerAclRunner = defaultWindowsOwnerAclRunner;
+
+export function setWindowsOwnerAclRunnerForTests(runner: WindowsOwnerAclRunner | null): void {
+  ownerAclRunner = runner ?? defaultWindowsOwnerAclRunner;
+}
+
+/** Pure, strict line-protocol parser and owner/effective-DACL policy. No account names or SDDL. */
+export function windowsPrivateEntriesAclMatches(stdout: string | Uint8Array, entries: readonly WindowsPrivateEntry[]): boolean {
+  if (entries.length === 0) return false;
+  // The script emits ASCII only. Reject BOMs, NULs, non-ASCII bytes and replacement decoding.
+  if (typeof stdout !== "string" && stdout.some(byte => byte > 127)) return false;
+  const text = typeof stdout === "string" ? stdout : Buffer.from(stdout).toString("ascii");
+  if (/[^\x20-\x7e\r\n]/.test(text)) return false;
+  const normalized = text.replace(/\r\n/g, "\n");
+  if (normalized.includes("\r")) return false;
+  const lines = (normalized.endsWith("\n") ? normalized.slice(0, -1) : normalized).split("\n");
+  if (lines.at(-1) !== "END") return false;
+  const token = lines[0]!.split("|");
+  if (token.length !== 4 || token[0] !== "U" || !SID.test(token[1]!) || !SID.test(token[2]!)
+    || (token[3] !== "True" && token[3] !== "False")) return false;
+  const user = token[1]!.toUpperCase();
+  const acceptsAdministrators = token[2]!.toUpperCase() === ADMINISTRATORS && token[3] === "True";
+  let at = 1;
+  for (let i = 0; i < entries.length; i++) {
+    const entry = (lines[at++] ?? "").split("|");
+    if (entry.length !== 5 || entry[0] !== "E" || entry[1] !== String(i) || !SID.test(entry[2]!)
+      || !/^(0|[1-9]\d{0,4})$/.test(entry[3]!) || !/^[1-3]$/.test(entry[4]!)) return false;
+    const flags = Number(entry[3]);
+    if (flags > 0xffff || (flags & PRIVATE_DACL_FLAGS) !== PRIVATE_DACL_FLAGS) return false;
+    const owner = entry[2]!.toUpperCase();
+    if (owner !== user && !(owner === ADMINISTRATORS && acceptsAdministrators)) return false;
+    // The serving account needs its own Full Control entry. SYSTEM and Administrators may also hold plain
+    // allow entries: LocalSystem and an elevated administrator can already take ownership of any object, and a
+    // filtered administrator token holds Administrators only as deny-only, so the allow entry grants it nothing.
+    const grantees = new Set<string>();
+    for (let k = Number(entry[4]); k > 0; k--) {
+      const ace = (lines[at++] ?? "").split("|");
+      if (ace.length !== 7 || ace[0] !== "A" || ace[1] !== String(i) || ace[2] !== "0"
+        || ace[3] !== (entries[i]!.directory ? "3" : "0") || !/^[1-9]\d{0,9}$/.test(ace[4]!)
+        || !SID.test(ace[5]!) || ace[6] !== "False") return false;
+      const grantee = ace[5]!.toUpperCase();
+      if (grantees.has(grantee)) return false;
+      grantees.add(grantee);
+      if (grantee === user ? ace[4] !== String(FULL_CONTROL) : !PRIVILEGED_GRANTEES.has(grantee)) return false;
+    }
+    if (!grantees.has(user)) return false;
+  }
+  return at === lines.length - 1;
+}
+
+/** Fresh, read-only verification; runner failures never disclose paths, SIDs or ACL output. */
+export function verifyWindowsPrivateEntries(entries: readonly WindowsPrivateEntry[], timeoutMs: number): boolean {
+  if (entries.length === 0 || !Number.isFinite(timeoutMs) || timeoutMs <= 0) return false;
+  try {
+    const result = ownerAclRunner(entries, Math.max(1, Math.min(WINDOWS_OWNER_ACL_TIMEOUT_MS, Math.floor(timeoutMs))));
+    return result.success && !result.timedOut && windowsPrivateEntriesAclMatches(result.stdout, entries);
+  } catch { return false; }
+}

package/src/providers/openai-sidecar-credit.ts

@@ -0,0 +1,26 @@
+import {
+  CodexPoolAccountCreditsOffError,
+  releaseCodexAuthContextProbeLease,
+  unwrapUpstreamRetryEvidenceError,
+  type CodexAuthContext,
+  type CodexAuthPolicyConfig,
+} from "../codex/auth-context";
+import { poolContextCreditHoldResetAt } from "../codex/pool-credit-policy";
+
+export function createOpenAiSidecarCreditGuard(
+  context: CodexAuthContext,
+  policy: CodexAuthPolicyConfig,
+): (() => void) | undefined {
+  if (context.kind !== "pool") return undefined;
+  return () => {
+    const resetAt = poolContextCreditHoldResetAt(context, policy);
+    if (resetAt === undefined) return;
+    releaseCodexAuthContextProbeLease(context);
+    throw new CodexPoolAccountCreditsOffError(context.accountId, resetAt);
+  };
+}
+
+export function openAiSidecarCreditRefusal(error: unknown): CodexPoolAccountCreditsOffError | undefined {
+  const cause = unwrapUpstreamRetryEvidenceError(error);
+  return cause instanceof CodexPoolAccountCreditsOffError ? cause : undefined;
+}

package/src/providers/openai-sidecar.ts

@@ -1,4 +1,5 @@
 import { resolveProviderApiKey } from "./key-store";
+import { createOpenAiSidecarCreditGuard } from "./openai-sidecar-credit";
 import {
   CodexPoolAuthenticationError,
   headersForCodexAuthContext,
@@ -31,6 +32,7 @@ export interface OpenAiForwardSidecarCandidate {
 export interface ResolvedOpenAiForwardSidecar extends OpenAiForwardSidecarCandidate {
   authContext: CodexAuthContext;
   headers: Headers;
+  beforeDispatch?: () => void;
   recordOutcome?: (outcome: CodexUpstreamOutcome) => void;
   /** Hand back an acquired recovery probe when no sidecar request reached upstream. */
   releaseProbeLease?: () => void;
@@ -123,6 +125,37 @@ function directSidecarHeaders(
   return selected;
 }
 
+/**
+ * The caller's own ChatGPT credential for a call the caller created itself.
+ *
+ * A V3 `existingCall` sideband join attaches to a WebRTC call that ChatGPT voice or Codex Desktop
+ * created with the caller's login, so only that login can join it; a Pool-selected account is a
+ * different ChatGPT account and the upstream refuses the handshake. This hands the join the same
+ * caller-owned headers Codex Direct mode forwards: an explicit bearer whose token claim matches
+ * its `chatgpt-account-id`, never the proxy admission secret, materialized through the same main
+ * policy (hard lock, credits), whose refusals surface as `CodexAccountCooldownError`.
+ * Returns undefined when the caller presents no such credential.
+ */
+export function resolveCallerOwnedOpenAiSidecar(
+  candidates: readonly OpenAiForwardSidecarCandidate[],
+  incomingHeaders: Headers,
+  config: OcxConfig,
+  options: { admission?: Pick<DataPlaneAdmission, "source">; codexAuthPolicy?: CodexAuthPolicyConfig } = {},
+): ResolvedOpenAiForwardSidecar | undefined {
+  const candidate = candidates[0];
+  if (!candidate) return undefined;
+  try {
+    validateForwardAdmissionCredential(incomingHeaders, config);
+  } catch (error) {
+    if (error instanceof ForwardAdmissionCredentialError) return undefined;
+    throw error;
+  }
+  if (!hasCallerCodexBearer(incomingHeaders)) return undefined;
+  const headers = directSidecarHeaders(incomingHeaders, options.codexAuthPolicy ?? config, options.admission);
+  if (!headers) return undefined;
+  return { ...candidate, authContext: { kind: "main", accountId: null }, headers };
+}
+
 export async function resolveFirstUsableOpenAiSidecar(
   candidates: readonly OpenAiForwardSidecarCandidate[],
   incomingHeaders: Headers,
@@ -176,6 +209,7 @@ export async function resolveFirstUsableOpenAiSidecar(
         ...candidate,
         authContext,
         headers: selectedHeaders,
+        beforeDispatch: createOpenAiSidecarCreditGuard(authContext, policy),
         recordOutcome: (outcome: CodexUpstreamOutcome) => recordCodexUpstreamOutcome(
           config,
           authContext.accountId,
@@ -226,6 +260,7 @@ export async function resolveFirstUsableOpenAiSidecar(
       ...candidate,
       authContext,
       headers: selectedHeaders,
+      beforeDispatch: createOpenAiSidecarCreditGuard(authContext, policy),
       ...(authContext.kind === "pool" || authContext.kind === "main-pool"
         ? {
           recordOutcome: (outcome: CodexUpstreamOutcome) => recordCodexUpstreamOutcome(

package/src/server/claude-messages.ts

@@ -1205,6 +1205,7 @@ async function handleClaudeMessagesWithBudget(
     return await handleNativeMessages({
       req, config, logCtx, ...(logIds ? { logIds } : {}),
       route: nativeMessagesRoute, body: nativeBody, requestedModel, translatorBudget, selector: nativeSelector,
+      modelScope: resolveAdmissionModelScope(config, logIds?.admission),
       // Compatibility identity is an opaque request-local handle, separate from credentials.
       clientIdentity: captureAnthropicClientIdentity(req.headers),
       callerAnthropicBeta: req.headers.get("anthropic-beta"),

package/src/server/gui-pair-delivery.ts

@@ -0,0 +1,23 @@
+import type { OcxConfig } from "../types";
+import { GUI_PAIR_BROWSER_ORIGIN_HEADER, GUI_PAIR_CAPABILITY_HEADER, standaloneGuiPairingOrigin } from "../lib/gui-pair-capability";
+import { consumeGuiPairIntent, GUI_PAIR_INTENT_HEADER } from "../lib/gui-pair-intent";
+import { createGuiPairingGrant, type GuiSessionState } from "./gui-session";
+
+export class GuiPairingIntentRequiredError extends Error {
+  constructor() {
+    super("Standalone GUI pairing requires a fresh local CLI intent");
+    this.name = "GuiPairingIntentRequiredError";
+  }
+}
+
+/** The serving route must authenticate the existing process-bound capability first. */
+export function deliverGuiPairingGrant(req: Request, config: OcxConfig, state: GuiSessionState) {
+  const origin = req.headers.get(GUI_PAIR_BROWSER_ORIGIN_HEADER) ?? "";
+  if (config.runtimeRole !== "hub") {
+    if (standaloneGuiPairingOrigin(config) !== origin
+      || !consumeGuiPairIntent(req.headers.get(GUI_PAIR_CAPABILITY_HEADER), req.headers.get(GUI_PAIR_INTENT_HEADER))) {
+      throw new GuiPairingIntentRequiredError();
+    }
+  }
+  return createGuiPairingGrant(origin, config, state);
+}

package/src/server/index/serve-options.ts

@@ -174,15 +174,14 @@ import { LOCAL_MANAGEMENT_NONCE_HEADER } from "../../lib/local-management-capabi
 import { LOCAL_PROVIDER_RELOAD_CAPABILITY_VERSION } from "../../lib/local-provider-reload-contract";
 import { LOCAL_ASIDE_SYNC_CAPABILITY_VERSION } from "../../lib/local-aside-sync-contract";
 import {
-  GUI_PAIR_BROWSER_ORIGIN_HEADER,
   GUI_PAIR_CAPABILITY_VERSION,
   GUI_PAIR_PATH,
 } from "../../lib/gui-pair-capability";
 import {
   GuiPairingGrantRateLimitError,
   consumeGuiPairingGrant,
-  createGuiPairingGrant,
 } from "../gui-session";
+import { deliverGuiPairingGrant, GuiPairingIntentRequiredError } from "../gui-pair-delivery";
 import { recordCursorSeen } from "../../integrations/cursor-seen";
 import { detectCursorInstalls } from "../../integrations/cursor-detect";
 import { loadCursorEffortTable } from "../../integrations/cursor-effort-table";
@@ -681,18 +680,16 @@ export function createServeOptions(ctx: ServeOptionsContext) {
             return withManagementCors(Response.json({ error: "GUI pairing capability required" }, { status: 403 }), req, config);
           }
           try {
-            const grant = createGuiPairingGrant(
-              req.headers.get(GUI_PAIR_BROWSER_ORIGIN_HEADER) ?? "",
-              config,
-              managementAuth,
-            );
+            const grant = deliverGuiPairingGrant(req, config, managementAuth);
             return withManagementCors(Response.json(grant, {
               status: 201,
               headers: { "Cache-Control": "no-store" },
             }), req, config);
           } catch (error) {
             const status = error instanceof GuiPairingGrantRateLimitError ? 429 : 403;
-            return withManagementCors(Response.json({ error: "GUI pairing grant refused" }, {
+            return withManagementCors(Response.json({ error: "GUI pairing grant refused",
+              ...(error instanceof GuiPairingIntentRequiredError ? { code: "local_pairing_intent_required" } : {}),
+            }, {
               status,
               ...(status === 429 ? { headers: { "Retry-After": "60" } } : {}),
             }), req, config);

package/src/server/live-native-calls.ts

@@ -0,0 +1,94 @@
+/**
+ * Upstream call ids created through the native voice call-create path (`handleLive`).
+ *
+ * A sideband join names only a call id, and two kinds of call reach the same join routes. A call
+ * this process created was negotiated under the account the Pool selected, and its join must stay
+ * on that account (openai/codex #35830; thread affinity carries it). A call the client created
+ * itself — ChatGPT voice handing a call to a Codex thread, or Codex Desktop when its renderer owns
+ * the call — belongs to the caller's own ChatGPT login and arrives as a V3 `existingCall` join with
+ * no create on this proxy. Membership here is what tells the two apart.
+ *
+ * Ids only: no account, credential, model, or caller is stored. Process-local and bounded, so a
+ * restart, the TTL, or eviction past capacity turns a created call into an unknown one; a later
+ * rejoin is then authenticated as the caller (see `resolveLiveRelay`).
+ */
+export const NATIVE_LIVE_CALL_TTL_MS = 6 * 60 * 60_000;
+export const MAX_NATIVE_LIVE_CALLS = 1024;
+const MAX_LOCATION_LENGTH = 4096;
+const MAX_CALL_ID_LENGTH = 128;
+const RTC_CALL_ID_RE = /^rtc_[A-Za-z0-9_-]+$/;
+const UUID_CALL_ID_RE = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+
+function isRealtimeCallIdSegment(segment: string): boolean {
+  if (segment.length > MAX_CALL_ID_LENGTH) return false;
+  return RTC_CALL_ID_RE.test(segment) || UUID_CALL_ID_RE.test(segment);
+}
+
+/**
+ * The call id a client reads from a call-create Location, extracted the way openai/codex does
+ * (`decode_call_id_from_location`, codex-api realtime_call.rs): drop the query, scan the path
+ * segments from the end, and take the first `rtc_…` or hyphenated-UUID segment. The backend
+ * answers `/v1/realtime/calls/calls/rtc_…`, the API `/v1/live/rtc_…`; both yield the id the client
+ * then joins with.
+ */
+export function liveCallIdFromLocation(location: string | null | undefined): string | null {
+  if (!location || location.length > MAX_LOCATION_LENGTH) return null;
+  const path = location.split("?")[0] ?? "";
+  for (const segment of path.split("/").reverse()) {
+    if (isRealtimeCallIdSegment(segment)) return segment;
+  }
+  return null;
+}
+
+export class NativeLiveCalls {
+  /** Insertion order is creation order, so the first key is always the oldest entry. */
+  private readonly entries = new Map<string, number>();
+
+  constructor(
+    private readonly now: () => number = Date.now,
+    private readonly ttlMs: number = NATIVE_LIVE_CALL_TTL_MS,
+    private readonly capacity: number = MAX_NATIVE_LIVE_CALLS,
+  ) {}
+
+  /** Record the call a successful create's Location names; returns the id, or null when none. */
+  record(location: string | null | undefined): string | null {
+    const id = liveCallIdFromLocation(location);
+    if (!id) return null;
+    this.prune();
+    this.entries.delete(id);
+    while (this.entries.size >= this.capacity) {
+      const oldest = this.entries.keys().next().value;
+      if (oldest === undefined) break;
+      this.entries.delete(oldest);
+    }
+    this.entries.set(id, this.now() + this.ttlMs);
+    return id;
+  }
+
+  has(id: string): boolean {
+    const expiresAt = this.entries.get(id);
+    if (expiresAt === undefined) return false;
+    if (expiresAt <= this.now()) {
+      this.entries.delete(id);
+      return false;
+    }
+    return true;
+  }
+
+  get size(): number {
+    this.prune();
+    return this.entries.size;
+  }
+
+  clear(): void {
+    this.entries.clear();
+  }
+
+  private prune(): void {
+    const now = this.now();
+    for (const [id, expiresAt] of this.entries) if (expiresAt <= now) this.entries.delete(id);
+  }
+}
+
+/** The process-wide registry `handleLive` writes and native sideband joins read. */
+export const nativeLiveCalls = new NativeLiveCalls();

package/src/server/live.ts

@@ -44,9 +44,14 @@ import { cancelBodyOnAbort, signalWithTimeout } from "../lib/abort";
 import { sidecarEnter } from "../lib/sidecar-tracker";
 import { hardenSecretPath } from "../lib/windows-secret-acl";
 import type { OcxConfig } from "../types";
-import { resolveFirstUsableOpenAiSidecar, selectOpenAiImagesProvider } from "../providers/openai-sidecar";
+import {
+  resolveCallerOwnedOpenAiSidecar,
+  resolveFirstUsableOpenAiSidecar,
+  selectOpenAiImagesProvider,
+} from "../providers/openai-sidecar";
 import { ForwardAdmissionCredentialError, validateForwardAdmissionCredential, type DataPlaneAdmission } from "./auth-cors";
 import { admissionScopeDenial } from "./admission-model-scope";
+import { nativeLiveCalls } from "./live-native-calls";
 import type { RequestLogContext } from "./request-log";
 import { codexLogAccountId } from "./responses";
 import type { AdmissionLease } from "../lib/admission";
@@ -613,6 +618,12 @@ async function readRequestBodyCapped(req: Request, maxBytes: number): Promise<Ar
 export interface LiveScopeDestination {
   admission?: DataPlaneAdmission;
   model: string | undefined;
+  /**
+   * The call a sideband join attaches to. When this process did not create it (no entry in
+   * `nativeLiveCalls`), the client created it with its own ChatGPT login — a V3 `existingCall` —
+   * and the join is authenticated as that caller instead of a Pool-selected account.
+   */
+  callerOwnedCallId?: string;
 }
 
 /**
@@ -691,9 +702,14 @@ export async function resolveLiveRelay(
   let forwardAuthError: Response | undefined;
   if (candidates.forwardCandidates.length > 0) {
     try {
-      forward = await resolveFirstUsableOpenAiSidecar(candidates.forwardCandidates, req.headers, config, {
-        beginCodexAccountSelection: codexAccountSelectionForTurn(turnAdmissionLease),
-      });
+      const joinsForeignCall = destination?.callerOwnedCallId !== undefined
+        && !nativeLiveCalls.has(destination.callerOwnedCallId);
+      forward = (joinsForeignCall
+        ? resolveCallerOwnedOpenAiSidecar(candidates.forwardCandidates, req.headers, config)
+        : undefined)
+        ?? await resolveFirstUsableOpenAiSidecar(candidates.forwardCandidates, req.headers, config, {
+          beginCodexAccountSelection: codexAccountSelectionForTurn(turnAdmissionLease),
+        });
       if (forward) {
         logCtx.provider = formatCodexProviderForLog(
           forward.providerName,
@@ -756,7 +772,8 @@ export async function resolveLiveRelay(
       providerBaseUrl: provider.baseUrl,
       usesBackendShape: isChatGptBackendBaseUrl(provider.baseUrl),
       keyed: false,
-      recordOutcome: status => forward.recordOutcome?.(status),
+      // A caller-owned or Direct credential selected no Pool account, so there is nothing to record.
+      ...(forward.recordOutcome ? { recordOutcome: (status: number | "timeout" | "connect_error") => forward.recordOutcome?.(status) } : {}),
     };
   }
   if (forwardAuthError) return forwardAuthError;
@@ -864,6 +881,11 @@ export async function handleLive(
       detachBodyGuard();
     }
     if (payload instanceof Response) return payload;
+    // Remember the calls this proxy created, so their joins keep the Pool account that created
+    // them while a join for any other call is authenticated as its caller (`resolveLiveRelay`).
+    if (upstreamResponse.status >= 200 && upstreamResponse.status < 300) {
+      nativeLiveCalls.record(upstreamResponse.headers.get("location"));
+    }
     const relayHeaders: Record<string, string> = {};
     for (const name of LIVE_RELAY_HEADERS) {
       const value = upstreamResponse.headers.get(name);
@@ -902,6 +924,7 @@ export async function resolveLiveSidebandUpgrade(
   const relay = await resolveLiveRelay(req, config, logCtx, turnAdmissionLease, {
     admission,
     model: liveSidebandModel(target),
+    ...("callId" in target ? { callerOwnedCallId: target.callId } : {}),
   });
   if (relay instanceof Response) return relay;
   return {

package/src/server/local-management-read-client.ts

@@ -25,6 +25,8 @@ export type LocalManagementReadResult =
 
 export interface LocalManagementReadDeps {
   fetchImpl?: typeof fetch;
+  /** Default transport seam; receives the caller deadline. */
+  directFetch?: typeof directLocalHttpFetch;
   readRuntime?: (pid: number) => RuntimePortState | null;
   createNonce?: () => string;
   now?: () => number;
@@ -84,18 +86,20 @@ export async function fetchBoundLocalManagementRead(
   if (!capability) return { kind: "unavailable", reason: "capability-unavailable" };
 
   try {
-    const response = await (deps.fetchImpl ?? directLocalHttpFetch)(
-      `http://${probeHostname(target.hostname)}:${target.port}${path}`,
-      {
-        headers: {
-          [LOCAL_MANAGEMENT_EXPECTED_PID_HEADER]: String(target.pid),
-          [LOCAL_MANAGEMENT_NONCE_HEADER]: nonce,
-          [LOCAL_MANAGEMENT_CAPABILITY_EXPIRES_AT_HEADER]: String(expiresAt),
-          [LOCAL_MANAGEMENT_CAPABILITY_HEADER]: capability,
-        },
-        signal: AbortSignal.timeout(deps.timeoutMs ?? 4_000),
+    const timeoutMs = deps.timeoutMs ?? 4_000;
+    const url = `http://${probeHostname(target.hostname)}:${target.port}${path}`;
+    const init: RequestInit = {
+      headers: {
+        [LOCAL_MANAGEMENT_EXPECTED_PID_HEADER]: String(target.pid),
+        [LOCAL_MANAGEMENT_NONCE_HEADER]: nonce,
+        [LOCAL_MANAGEMENT_CAPABILITY_EXPIRES_AT_HEADER]: String(expiresAt),
+        [LOCAL_MANAGEMENT_CAPABILITY_HEADER]: capability,
       },
-    );
+      signal: AbortSignal.timeout(timeoutMs),
+    };
+    const response = deps.fetchImpl
+      ? await deps.fetchImpl(url, init)
+      : await (deps.directFetch ?? directLocalHttpFetch)(url, init, { timeoutMs });
     if (deps.requireResponseProof && !verifyLocalAttestationProof(
       runtime.attestationSecret, nonce, target.pid, target.port, response.headers.get(LOCAL_ATTESTATION_PROOF_HEADER),
     )) {

package/src/server/management/oauth-account-routes.ts

@@ -1164,6 +1164,21 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     }, 200, req, config);
   }
 
+  if (url.pathname === "/api/keys/reveal" && req.method === "POST") {
+    if (principal !== "gui-session") {
+      return jsonResponse({ error: "dashboard session required" }, 403, req, config);
+    }
+    const body = await readJsonBody(req);
+    if (!body || Object.keys(body).length !== 1 || typeof body.id !== "string" || !body.id) {
+      return jsonResponse({ error: "invalid body" }, 400, req, config);
+    }
+    const entry = config.apiKeys?.find(key => key.id === body.id);
+    if (!entry) return jsonResponse({ error: "key not found" }, 404, req, config);
+    const response = jsonResponse({ key: entry.key }, 200, req, config);
+    response.headers.set("Cache-Control", "no-store");
+    return response;
+  }
+
   if (url.pathname === "/api/keys/rotate" && req.method === "POST") {
     const body = await readJsonBody(req);
     if (!body || Object.keys(body).length !== 1 || typeof body.id !== "string" || !body.id) {

package/src/server/management/route-registry.ts

@@ -324,6 +324,7 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "PATCH", path: "/api/keys", module: "server/management/oauth-account-routes", mutates: true },
   { method: "PATCH", path: "/api/oauth/accounts/pool", module: "server/management/oauth-account-routes", mutates: true },
   { method: "POST", path: "/api/keys", module: "server/management/oauth-account-routes", mutates: true },
+  { method: "POST", path: "/api/keys/reveal", module: "server/management/oauth-account-routes", mutates: false, exempt: { reason: "session-only", why: "Revealing a data key requires the gui-session principal; the admin token is refused." } },
   { method: "POST", path: "/api/keys/rotate", module: "server/management/oauth-account-routes", mutates: true },
   { method: "POST", path: "/api/keys/rotate/commit", module: "server/management/oauth-account-routes", mutates: true },
   { method: "POST", path: "/api/oauth/accounts/clear-cooldown", module: "server/management/oauth-account-routes", mutates: true },

package/src/server/management/shared.ts

@@ -89,6 +89,11 @@ export type TokPerSecondResult =
   | { kind: "value"; value: number; estimated: boolean }
   | { kind: "unavailable"; reason: MetricUnavailableReason };
 
+export type DecodeTimingBasis = "generation-window" | "legacy-post-visible-output";
+export type DecodeTokPerSecondResult =
+  | (Extract<TokPerSecondResult, { kind: "value" }> & { timingBasis: DecodeTimingBasis })
+  | Extract<TokPerSecondResult, { kind: "unavailable" }>;
+
 export type CostEstimateReason =
   | "usage_estimated"
   | "cache_detail_missing"
@@ -149,7 +154,7 @@ export const MIN_DECODE_WINDOW_MS = 1_000;
  */
 export function decodeTokPerSecondResult(
   entry: Pick<MetricSource, "durationMs" | "firstOutputMs" | "genStartMs" | "lastOutputMs" | "usageStatus" | "usage">,
-): TokPerSecondResult {
+): DecodeTokPerSecondResult {
   if (!entry.usage) return { kind: "unavailable", reason: "usage_missing" };
   if (entry.usageStatus === "unsupported") return { kind: "unavailable", reason: "usage_unsupported" };
   if (entry.usage.outputTokens <= 0) return { kind: "unavailable", reason: "output_missing" };
@@ -159,7 +164,8 @@ export function decodeTokPerSecondResult(
     if (generationMs <= 0) return { kind: "unavailable", reason: "invalid_duration" };
     if (generationMs < MIN_DECODE_WINDOW_MS) return { kind: "unavailable", reason: "decode_window_too_short" };
     const value = tokensPerSecond(entry.usage.outputTokens, generationMs);
-    return value === null ? { kind: "unavailable", reason: "invalid_duration" } : { kind: "value", value, estimated: true };
+    return value === null ? { kind: "unavailable", reason: "invalid_duration" }
+      : { kind: "value", value, estimated: true, timingBasis: "generation-window" };
   }
   // A row that predates TTFT capture, or a non-streaming turn that never recorded one, has no
   // window to measure. That is a different fact from a bad duration, so it gets its own reason.
@@ -173,7 +179,7 @@ export function decodeTokPerSecondResult(
   if (windowMs < MIN_DECODE_WINDOW_MS) return { kind: "unavailable", reason: "decode_window_too_short" };
   const value = tokensPerSecond(entry.usage.outputTokens, windowMs);
   if (value === null) return { kind: "unavailable", reason: "invalid_duration" };
-  return { kind: "value", value, estimated: true };
+  return { kind: "value", value, estimated: true, timingBasis: "legacy-post-visible-output" };
 }
 
 export function unavailableCostReason(entry: MetricSource): MetricUnavailableReason {

package/src/server/messages-native-scope.ts

@@ -0,0 +1,57 @@
+import {
+  AdmissionModelDeniedError, routeAllowedByScope, UNNAMED_DESTINATION_MODEL, type AdmissionModelScope,
+} from "./admission-model-scope";
+
+type Rec = Record<string, unknown>;
+const isRec = (value: unknown): value is Rec => value !== null && typeof value === "object" && !Array.isArray(value);
+const isAdvisor = (tool: Rec): boolean => typeof tool.type === "string" && /^advisor_\d{8}$/.test(tool.type);
+
+/** Only executable declarations are policy inputs; schemas, arguments and results stay opaque. */
+export function nativeMessagesToolScopeDenial(
+  scope: AdmissionModelScope | undefined,
+  providerName: string,
+  requestedModel: string,
+  body: Readonly<Rec>,
+): AdmissionModelDeniedError | undefined {
+  if (!scope || scope.models.length === 0) return undefined;
+  const definitions = new Map<string, Rec[]>();
+  const withdrawn = new Set<string>();
+  const anonymous: Rec[] = [];
+  if (Array.isArray(body.tools)) for (const tool of body.tools) {
+    if (!isRec(tool)) continue;
+    if (typeof tool.name !== "string") { anonymous.push(tool); continue; }
+    const declarations = definitions.get(tool.name) ?? [];
+    declarations.push(tool);
+    definitions.set(tool.name, declarations);
+  }
+  if (Array.isArray(body.messages)) for (const message of body.messages) {
+    if (!isRec(message) || message.role !== "system" || !Array.isArray(message.content)) continue;
+    // Upstream rejects tool changes in turn-scoped messages; do not depend on that. An addition
+    // always counts, and only a permanent removal withdraws a declaration (fail closed).
+    const permanent = message.clear_at === undefined || message.clear_at === "never";
+    for (const block of message.content) {
+      if (!isRec(block) || !isRec(block.tool)) continue;
+      const tool = block.tool;
+      if (block.type === "tool_addition" && tool.type === "tool_definition" && isRec(tool.definition)) {
+        const definition = tool.definition;
+        if (typeof definition.name !== "string") { anonymous.push(definition); continue; }
+        // A temporary replacement keeps the declaration it shadows in scope as well.
+        definitions.set(definition.name, permanent ? [definition] : [...definitions.get(definition.name) ?? [], definition]);
+        withdrawn.delete(definition.name);
+      } else if (tool.type === "tool_reference" && typeof tool.name === "string") {
+        if (block.type === "tool_removal" && permanent) withdrawn.add(tool.name);
+        if (block.type === "tool_addition") withdrawn.delete(tool.name);
+      }
+    }
+  }
+  // Deferred definitions can still be loaded by tool search in the current turn.
+  const active = [...anonymous, ...[...definitions].flatMap(([name, tools]) => withdrawn.has(name) ? [] : tools)];
+  for (const tool of active) {
+    if (!isAdvisor(tool)) continue;
+    const modelId = typeof tool.model === "string" && tool.model.trim() ? tool.model : undefined;
+    if (modelId === undefined || !routeAllowedByScope(scope, { providerName, modelId })) {
+      return new AdmissionModelDeniedError(requestedModel, { providerName, modelId: modelId ?? UNNAMED_DESTINATION_MODEL });
+    }
+  }
+  return undefined;
+}