@bitkyc08/opencodex 2.79.0 → 2.81.0

package/src/server/management/anthropic-reset-grant-routes.ts

@@ -14,7 +14,11 @@
 import { jsonResponse } from "../auth-cors";
 import type { ManagementContext } from "./context";
 import { getValidAccessSnapshotForAccount } from "../../oauth";
-import { captureOAuthAccountSelection, listAccounts } from "../../oauth/store";
+import { configuredAnthropicInstance, isAnthropicInstanceId, type AnthropicInstanceId } from "../../providers/anthropic-instance";
+import { captureAnthropicPhysicalSendOwnership, anthropicPhysicalSendOwnershipIsCurrent } from "../../oauth/anthropic-send-ownership";
+import { anthropicCooldownRecoveryFor } from "../../providers/quota/anthropic-cooldown-recovery";
+import { captureProviderAccountQuotaEpoch } from "../../providers/quota/account-cache";
+import { captureOAuthAccountSelection, getAccountSet, getAccountCredentialWithStatus, listAccounts } from "../../oauth/store";
 import {
   ANTHROPIC_RESET_GRANT_ID_RE,
   AnthropicResetGrantError,
@@ -28,19 +32,20 @@ import {
   AnthropicResetLedgerError,
   anthropicOrgDigest,
   anthropicResetOperationExists,
+  anthropicResetJournalPathForInstance,
   beginAnthropicResetOperation,
   pendingAnthropicResetOperation,
   releaseAnthropicResetLease,
   settleAnthropicResetOperation,
 } from "../../providers/anthropic-reset-grant-ledger";
 
-const PROVIDER = "anthropic";
 const UUID_V4_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 
 const MESSAGES = {
   method_not_allowed: "Method not allowed",
   session_required: "Spending a reset requires a dashboard session.",
   invalid_json: "Request body must be JSON.",
+  invalid_provider: "No matching builtin Anthropic OAuth provider.",
   invalid_grant_id: "grantId is missing or malformed.",
   invalid_operation_id: "operationId must be a UUIDv4.",
   no_account: "No matching Anthropic OAuth account.",
@@ -60,6 +65,9 @@ const MESSAGES = {
 type ErrorCode = keyof typeof MESSAGES;
 
 export interface AnthropicResetGrantRouteDeps {
+  provider?: AnthropicInstanceId;
+  isCurrent?: () => boolean;
+  forProvider?: (provider: AnthropicInstanceId) => AnthropicResetGrantRouteDeps;
   fetchFn?: typeof globalThis.fetch;
   journalPath?: string;
   now?: () => number;
@@ -68,25 +76,64 @@ export interface AnthropicResetGrantRouteDeps {
   accessTokenFor: (accountId: string) => Promise<string>;
 }
 
-const defaultDeps: AnthropicResetGrantRouteDeps = {
-  listAccountIds: () => listAccounts(PROVIDER).map(account => account.id),
-  activeAccountId: () => captureOAuthAccountSelection(PROVIDER)?.accountId ?? null,
-  accessTokenFor: async accountId =>
-    (await getValidAccessSnapshotForAccount(PROVIDER, accountId, { requireUsableAccount: true })).accessToken,
-};
+function defaultDepsFor(ctx: ManagementContext, provider: AnthropicInstanceId): AnthropicResetGrantRouteDeps | null {
+  // One source: the live management config. A keeps its legacy reach without a providers row;
+  // B requires its configured builtin row. A fresh file load here would refuse on any drift.
+  const live = ctx.config;
+  const target = live.providers?.[provider];
+  if (target?.disabled || target && target.authMode !== "oauth" || configuredAnthropicInstance(live, provider) !== provider) return null;
+  const identity = JSON.stringify(target ?? null);
+  let owner: ReturnType<typeof captureAnthropicPhysicalSendOwnership> = null;
+  const targetCurrent = () => configuredAnthropicInstance(live, provider) === provider
+    && JSON.stringify(live.providers?.[provider] ?? null) === identity;
+  return {
+    // Only the journal path: the ledger's numeric `now` option is not the deps clock function.
+    provider, journalPath: anthropicResetJournalPathForInstance(provider),
+    listAccountIds: () => listAccounts(provider).map(account => account.id),
+    activeAccountId: () => captureOAuthAccountSelection(provider)?.accountId ?? null,
+    isCurrent: () => {
+      if (!targetCurrent() || !owner || !anthropicPhysicalSendOwnershipIsCurrent(owner)) return false;
+      const row = getAccountCredentialWithStatus(provider, owner.accountId);
+      return !!row && !row.paused && !row.needsReauth;
+    },
+    accessTokenFor: async accountId => {
+      const initial = getAccountSet(provider)?.accounts.find(row => row.id === accountId);
+      const recovery = anthropicCooldownRecoveryFor(provider);
+      const incarnation = recovery.reserveAnthropicAccountIncarnation(accountId);
+      const epoch = captureProviderAccountQuotaEpoch(provider);
+      const snapshot = await getValidAccessSnapshotForAccount(provider, accountId, { requireUsableAccount: true });
+      const current = getAccountSet(provider)?.accounts.find(row => row.id === accountId);
+      if (!initial || !current || initial.loginId !== current.loginId || initial.addedAt !== current.addedAt
+        || recovery.anthropicAccountIncarnation(accountId) !== incarnation || captureProviderAccountQuotaEpoch(provider) !== epoch) throw new Error("reset account replaced");
+      owner = captureAnthropicPhysicalSendOwnership(snapshot);
+      if (!targetCurrent() || !owner) throw new Error("reset owner changed");
+      return snapshot.accessToken;
+    },
+  };
+}
+
+function selectDeps(ctx: ManagementContext, requested: unknown, deps?: AnthropicResetGrantRouteDeps): AnthropicResetGrantRouteDeps | null {
+  const provider = requested === undefined || requested === null ? "anthropic" : requested;
+  if (!isAnthropicInstanceId(provider)) return null;
+  const selected = deps?.forProvider?.(provider) ?? deps;
+  // Legacy injected dependencies are A-only; B must explicitly bind its own journal.
+  if (selected) return (selected.provider ?? "anthropic") === provider
+    ? { journalPath: anthropicResetJournalPathForInstance(provider), ...selected, provider } : null;
+  return defaultDepsFor(ctx, provider);
+}
 
 function fail(ctx: ManagementContext, status: number, code: ErrorCode, extra: Record<string, unknown> = {}): Response {
   return jsonResponse({ error: { code, message: MESSAGES[code], ...extra } }, status, ctx.req, ctx.config);
 }
 
-function ledgerFailure(ctx: ManagementContext, error: unknown): Response {
-  if (error instanceof AnthropicResetLedgerError && error.code === "busy") return fail(ctx, 503, "ledger_busy");
-  return fail(ctx, 503, "ledger_unavailable");
+function ledgerFailure(ctx: ManagementContext, error: unknown, extra: Record<string, unknown> = {}): Response {
+  if (error instanceof AnthropicResetLedgerError && error.code === "busy") return fail(ctx, 503, "ledger_busy", extra);
+  return fail(ctx, 503, "ledger_unavailable", extra);
 }
 
-function readFailure(ctx: ManagementContext, error: unknown): Response {
-  if (error instanceof AnthropicResetGrantError && error.code === "auth") return fail(ctx, 401, "auth_failed");
-  return fail(ctx, 502, "upstream_unavailable");
+function readFailure(ctx: ManagementContext, error: unknown, extra: Record<string, unknown> = {}): Response {
+  if (error instanceof AnthropicResetGrantError && error.code === "auth") return fail(ctx, 401, "auth_failed", extra);
+  return fail(ctx, 502, "upstream_unavailable", extra);
 }
 
 function resolveAccountId(deps: AnthropicResetGrantRouteDeps, requested: unknown): string | null {
@@ -107,16 +154,19 @@ async function tokenFor(deps: AnthropicResetGrantRouteDeps, accountId: string):
 }
 
 async function handleRead(ctx: ManagementContext, deps: AnthropicResetGrantRouteDeps): Promise<Response> {
+  const receipt = { provider: deps.provider };
   const accountId = resolveAccountId(deps, ctx.url.searchParams.get("accountId") ?? undefined);
-  if (!accountId) return fail(ctx, 400, "no_account");
+  if (!accountId) return fail(ctx, 400, "no_account", receipt);
   const accessToken = await tokenFor(deps, accountId);
-  if (!accessToken) return fail(ctx, 401, "auth_failed");
+  if (!accessToken) return fail(ctx, 401, "auth_failed", receipt);
+  if (deps.isCurrent?.() === false) return fail(ctx, 401, "auth_failed", receipt);
   let status;
   try {
     status = await fetchAnthropicResetGrantStatus({ accessToken, fetchFn: deps.fetchFn });
   } catch (error) {
-    return readFailure(ctx, error);
+    return readFailure(ctx, error, receipt);
   }
+  if (deps.isCurrent?.() === false) return fail(ctx, 401, "auth_failed", receipt);
   let pendingOperation = null;
   let journalAvailable = true;
   try {
@@ -124,10 +174,10 @@ async function handleRead(ctx: ManagementContext, deps: AnthropicResetGrantRoute
   } catch {
     journalAvailable = false;
   }
-  return jsonResponse({ accountId, ...status, pendingOperation, journalAvailable }, 200, ctx.req, ctx.config);
+  return jsonResponse({ provider: deps.provider, accountId, ...status, pendingOperation, journalAvailable }, 200, ctx.req, ctx.config);
 }
 
-async function handleConsume(ctx: ManagementContext, deps: AnthropicResetGrantRouteDeps): Promise<Response> {
+async function handleConsume(ctx: ManagementContext, injected?: AnthropicResetGrantRouteDeps): Promise<Response> {
   if (ctx.principal !== "gui-session") return fail(ctx, 403, "session_required");
   let body: Record<string, unknown>;
   try {
@@ -137,21 +187,27 @@ async function handleConsume(ctx: ManagementContext, deps: AnthropicResetGrantRo
   } catch {
     return fail(ctx, 400, "invalid_json");
   }
+  const deps = selectDeps(ctx, body.provider, injected);
+  if (!deps) return fail(ctx, 400, "invalid_provider");
+  const provider = deps.provider;
+  const operationReceipt = { provider };
+  const scopedFail = (status: number, code: ErrorCode, extra: Record<string, unknown> = {}) => fail(ctx, status, code, { ...operationReceipt, ...extra });
   const { grantId, operationId } = body;
-  if (typeof grantId !== "string" || !ANTHROPIC_RESET_GRANT_ID_RE.test(grantId)) return fail(ctx, 400, "invalid_grant_id");
-  if (typeof operationId !== "string" || !UUID_V4_RE.test(operationId)) return fail(ctx, 400, "invalid_operation_id");
-  if (typeof body.accountId !== "string") return fail(ctx, 400, "no_account");
+  if (typeof grantId !== "string" || !ANTHROPIC_RESET_GRANT_ID_RE.test(grantId)) return scopedFail(400, "invalid_grant_id");
+  if (typeof operationId !== "string" || !UUID_V4_RE.test(operationId)) return scopedFail(400, "invalid_operation_id");
+  if (typeof body.accountId !== "string") return scopedFail(400, "no_account");
   const accountId = resolveAccountId(deps, body.accountId);
-  if (!accountId) return fail(ctx, 400, "no_account");
+  if (!accountId) return scopedFail(400, "no_account");
 
   const accessToken = await tokenFor(deps, accountId);
-  if (!accessToken) return fail(ctx, 401, "auth_failed");
+  if (!accessToken || deps.isCurrent?.() === false) return scopedFail(401, "auth_failed");
   let organizationUuid: string;
   try {
     organizationUuid = await fetchAnthropicOrganizationUuid({ accessToken, fetchFn: deps.fetchFn });
   } catch (error) {
-    return readFailure(ctx, error);
+    return readFailure(ctx, error, operationReceipt);
   }
+  if (deps.isCurrent?.() === false) return scopedFail(401, "auth_failed");
   const ledger = { journalPath: deps.journalPath, now: deps.now?.() };
 
   // A new operation must pass the spend gate on a fresh read. A same-id retry of
@@ -161,39 +217,40 @@ async function handleConsume(ctx: ManagementContext, deps: AnthropicResetGrantRo
   try {
     known = anthropicResetOperationExists(operationId, ledger);
   } catch (error) {
-    return ledgerFailure(ctx, error);
+    return ledgerFailure(ctx, error, operationReceipt);
   }
   if (!known) {
     let status;
     try {
       status = await fetchAnthropicResetGrantStatus({ accessToken, fetchFn: deps.fetchFn });
     } catch (error) {
-      return readFailure(ctx, error);
+      return readFailure(ctx, error, operationReceipt);
     }
     const blocker = anthropicResetGrantBlocker(status, grantId);
-    if (blocker) return fail(ctx, 409, "grant_not_usable", { reason: blocker });
+    if (blocker) return scopedFail(409, "grant_not_usable", { reason: blocker });
   }
 
   let begin;
+  if (deps.isCurrent?.() === false) return scopedFail(401, "auth_failed");
   try {
     begin = beginAnthropicResetOperation(
       { operationId, accountId, grantId, orgDigest: anthropicOrgDigest(organizationUuid) },
       { journalPath: deps.journalPath, now: deps.now?.() },
     );
   } catch (error) {
-    return ledgerFailure(ctx, error);
+    return ledgerFailure(ctx, error, operationReceipt);
   }
   switch (begin.kind) {
     case "replay":
       return jsonResponse(
-        { code: begin.code, replayed: true, resetsLeft: begin.resetsLeft, accountId, grantId, operationId },
+        { provider, code: begin.code, replayed: true, resetsLeft: begin.resetsLeft, accountId, grantId, operationId },
         200, ctx.req, ctx.config,
       );
-    case "identity-mismatch": return fail(ctx, 409, "operation_identity_mismatch");
-    case "in-flight": return fail(ctx, 409, "in_flight");
-    case "expired": return fail(ctx, 409, "unknown_outcome_expired");
-    case "unresolved-prior": return fail(ctx, 409, "unresolved_prior_operation", { pendingOperationId: begin.operationId });
-    case "capacity": return fail(ctx, 503, "ledger_capacity");
+    case "identity-mismatch": return scopedFail(409, "operation_identity_mismatch");
+    case "in-flight": return scopedFail(409, "in_flight");
+    case "expired": return scopedFail(409, "unknown_outcome_expired");
+    case "unresolved-prior": return scopedFail(409, "unresolved_prior_operation", { pendingOperationId: begin.operationId });
+    case "capacity": return scopedFail(503, "ledger_capacity");
     case "execute": break;
   }
 
@@ -206,7 +263,7 @@ async function handleConsume(ctx: ManagementContext, deps: AnthropicResetGrantRo
     try {
       releaseAnthropicResetLease(operationId, { journalPath: deps.journalPath, now: deps.now?.() });
     } catch { /* the lease expires on its own */ }
-    return fail(ctx, 502, "unknown_outcome", { operationId, grantId });
+    return scopedFail(502, "unknown_outcome", { operationId, grantId, accountId });
   }
   let settled;
   try {
@@ -216,13 +273,14 @@ async function handleConsume(ctx: ManagementContext, deps: AnthropicResetGrantRo
     );
   } catch {
     // Fail closed: the caller must not read this as a durable result.
-    return fail(ctx, 500, "journal_write_failed", { operationId, grantId });
+    return scopedFail(500, "journal_write_failed", { operationId, grantId, accountId });
   }
   // Report what the journal holds. An overlapping same-id attempt may have
   // settled first; its answer is the canonical one.
   const replayed = settled.code !== answer.code || settled.resetsLeft !== answer.resetsLeft;
   return jsonResponse(
     {
+      provider,
       code: settled.code,
       replayed,
       resetsLeft: settled.resetsLeft,
@@ -237,12 +295,13 @@ async function handleConsume(ctx: ManagementContext, deps: AnthropicResetGrantRo
 
 export async function handleAnthropicResetGrantRoutes(
   ctx: ManagementContext,
-  deps: AnthropicResetGrantRouteDeps = defaultDeps,
+  deps?: AnthropicResetGrantRouteDeps,
 ): Promise<Response | null> {
   const { pathname } = ctx.url;
   if (pathname === "/api/anthropic/reset-grants") {
     if (ctx.req.method !== "GET") return fail(ctx, 405, "method_not_allowed");
-    return handleRead(ctx, deps);
+    const selected = selectDeps(ctx, ctx.url.searchParams.get("provider"), deps);
+    return selected ? handleRead(ctx, selected) : fail(ctx, 400, "invalid_provider");
   }
   if (pathname === "/api/anthropic/reset-grants/consume") {
     if (ctx.req.method !== "POST") return fail(ctx, 405, "method_not_allowed");

package/src/server/management/config-routes.ts

@@ -4,6 +4,8 @@ import { getMainAccountExternalUsageWarning } from "../../codex/main-account-ext
 import { getObservedMainQuotaIdentityKey } from "../../codex/main-account-cache";
 import { compactionRoutingSchema, memoryModelsSchema } from "../../config/schema/leaf-validators";
 import { compactionRecoverySchema } from "../../config/schema/compaction-recovery";
+import { anthropicSidecarPatchError } from "../../config/schema/anthropic-account-pool";
+import { isAnthropicInstanceId } from "../../providers/anthropic-instance-id";
 import { captureConfigTopLevelRollback } from "../../config/rebase-provenance";
 import type { IntegrationClientId } from "../../integrations/registry";
 import { randomUUID } from "node:crypto";
@@ -85,7 +87,6 @@ import { getProviderRegistryEntry } from "../../providers/registry";
 import { VISION_REASONING_EFFORTS, isVisionReasoningEffort } from "../../reasoning-effort";
 import { normalizeVisionReasoningForModel } from "../../vision/reasoning";
 import {
-  findAnthropicVisionProvider,
   isValidVisionTimeoutMs,
   MAX_VISION_TIMEOUT_MS,
   MIN_VISION_TIMEOUT_MS,
@@ -105,6 +106,7 @@ import {
   webSearchModelIsRejected,
   webSearchModelOptionsFrom,
   webSearchModelRejection,
+  sidecarAnthropicPoolOptions, sidecarOptionsAuth, sidecarSettingsAfterPatch,
 } from "./web-search-sidecar-options";
 import { validateXaiSearchOptions } from "../../web-search/xai-executor";
 import { getDebugLogEntries } from "../../lib/debug-log-buffer";
@@ -150,7 +152,9 @@ async function sidecarVisionResponseSettings(config: OcxConfig): Promise<{
   const vs = config.visionSidecar ?? {};
   // Match the runtime's one selected Anthropic executor for both backend fallback
   // and catalog reachability; resolving it once prevents the two projections drifting.
-  const anthropicSidecar = findAnthropicVisionProvider(config);
+  const auth = sidecarOptionsAuth(config, vs.anthropicInstance);
+  const anthropicSidecar = auth.isAnthropicAuth && auth.anthropicProviderName && auth.anthropicProvider
+    ? { providerName: auth.anthropicProviderName, provider: auth.anthropicProvider, config } : undefined;
   // The routed backend reports its own namespaced model verbatim: it is the
   // dispatched value, and collapsing it through the legacy resolver would
   // display a describer the runtime is not using (roadmap 190).
@@ -276,7 +280,7 @@ export async function syncEnabledClientIntegrations(
     },
     config,
     port,
-  }, ["mcode", "pi", "aside", "raycast", "omo", "cline", "droid", "opencode", "kilo"]));
+  }, ["mcode", "pi", "aside", "raycast", "omo", "cline", "commandcode", "droid", "opencode", "kilo"]));
 
   return out;
 }
@@ -290,6 +294,8 @@ function publicVisionSidecarSettings(
     enabled: vs.enabled !== false,
     model: vision.model,
     backend: vs.backend,
+    ...(vs.anthropicInstance ? { anthropicInstance: vs.anthropicInstance } : {}),
+    anthropicPool: sidecarAnthropicPoolOptions(config, { ...vs, backend: vs.backend ?? (vision.models.find(row => row.value === vision.model)?.backend) }),
     reasoning: vision.reasoning,
     maxDescriptionsPerTurn: resolveMaxDescriptionsPerTurn(vs.maxDescriptionsPerTurn),
     timeoutMs: resolveVisionTimeoutMs(vs.timeoutMs),
@@ -882,6 +888,8 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
         enabled: ws.enabled !== false,
         model: ws.model ?? "gpt-5.6-luna",
         backend: ws.backend,
+        ...(ws.anthropicInstance ? { anthropicInstance: ws.anthropicInstance } : {}),
+        anthropicPool: sidecarAnthropicPoolOptions(config, ws),
         streamRoutedModelOutput: ws.streamRoutedModelOutput === true,
         ...(ws.xSearch ? { xSearch: ws.xSearch } : {}),
       },
@@ -902,10 +910,11 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
     if (raw.webSearch !== undefined && !isPlainRecord(raw.webSearch)) return jsonResponse({ error: "webSearch must be an object" }, 400);
     if (raw.vision !== undefined && !isPlainRecord(raw.vision)) return jsonResponse({ error: "vision must be an object" }, 400);
     const body = raw as {
-      webSearch?: { enabled?: unknown; model?: unknown; backend?: unknown; reasoning?: unknown; streamRoutedModelOutput?: unknown; exaApiKey?: unknown; xSearch?: unknown };
+      webSearch?: { enabled?: unknown; model?: unknown; backend?: unknown; anthropicInstance?: unknown; reasoning?: unknown; streamRoutedModelOutput?: unknown; exaApiKey?: unknown; xSearch?: unknown };
       vision?: {
         model?: unknown;
         backend?: unknown;
+        anthropicInstance?: unknown;
         reasoning?: unknown;
         maxDescriptionsPerTurn?: unknown;
         enabled?: unknown;
@@ -913,6 +922,11 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       };
     };
     const WEB_SEARCH_BACKENDS_UNION = ["openai", "anthropic", "xai", "gemini", "exa"] as const;
+    const instanceError = anthropicSidecarPatchError(config, {
+      ...(body.webSearch ? { webSearchSidecar: body.webSearch } : {}),
+      ...(body.vision ? { visionSidecar: body.vision } : {}),
+    });
+    if (instanceError) return jsonResponse({ error: instanceError }, 400);
     if (body.webSearch && body.webSearch.backend !== undefined && body.webSearch.backend !== null
       && !WEB_SEARCH_BACKENDS_UNION.includes(body.webSearch.backend as never)) {
       return jsonResponse({ error: "webSearch.backend must be openai, anthropic, xai, gemini, exa, or null" }, 400);
@@ -956,7 +970,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
     // rejection body, so a 400 cannot cost two provider fetches.
     if (body.vision && typeof body.vision.model === "string" && body.vision.model !== "") {
       const requested = body.vision.model;
-      const candidates = await visionCandidateRows(config);
+      const candidates = await visionCandidateRows({ ...config, visionSidecar: sidecarSettingsAfterPatch(config.visionSidecar, body.vision) });
       const hint = body.vision.backend === "anthropic" || body.vision.backend === "openai"
         || body.vision.backend === "routed"
         ? body.vision.backend
@@ -994,7 +1008,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
     // only case that owes a config.toml rewrite.
     const webSearchEnabledBefore = config.webSearchSidecar?.enabled !== false;
     if (body.webSearch) {
-      const pairTouched = body.webSearch.model !== undefined || body.webSearch.backend !== undefined;
+      const pairTouched = body.webSearch.model !== undefined || body.webSearch.backend !== undefined || body.webSearch.anthropicInstance !== undefined;
       // Validate against the backend the caller SUBMITTED, across the whole
       // union — not just openai/anthropic (#2457). The union check above has
       // already refused unknown literals, so a surviving string is a member;
@@ -1013,12 +1027,14 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
         ? body.webSearch.model || undefined
         : config.webSearchSidecar?.model;
       if (pairTouched && effectiveModel) {
-        const candidates = await webSearchCandidateRows(config);
+        const candidates = await webSearchCandidateRows({ ...config, webSearchSidecar: sidecarSettingsAfterPatch(config.webSearchSidecar, body.webSearch) });
         if (webSearchModelIsRejected(effectiveBackend, effectiveModel, candidates)) {
           return jsonResponse(webSearchModelRejection("webSearch.model", effectiveBackend, effectiveModel, candidates), 400);
         }
       }
       const webSearchCandidate = { ...config.webSearchSidecar };
+      if (body.webSearch.anthropicInstance === null) delete webSearchCandidate.anthropicInstance;
+      else if (isAnthropicInstanceId(body.webSearch.anthropicInstance)) webSearchCandidate.anthropicInstance = body.webSearch.anthropicInstance;
       if (typeof body.webSearch.model === "string") {
         if (body.webSearch.model === "") delete webSearchCandidate.model;
         else webSearchCandidate.model = body.webSearch.model;
@@ -1098,6 +1114,8 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
     }
     if (body.vision) {
       config.visionSidecar = { ...config.visionSidecar };
+      if (body.vision.anthropicInstance === null) delete config.visionSidecar.anthropicInstance;
+      else if (isAnthropicInstanceId(body.vision.anthropicInstance)) config.visionSidecar.anthropicInstance = body.vision.anthropicInstance;
       if (typeof body.vision.model === "string") {
         if (body.vision.model === "") delete config.visionSidecar.model;
         else config.visionSidecar.model = body.vision.model;
@@ -1143,6 +1161,8 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
         enabled: ws.enabled !== false,
         model: ws.model ?? "gpt-5.6-luna",
         backend: ws.backend,
+        ...(ws.anthropicInstance ? { anthropicInstance: ws.anthropicInstance } : {}),
+        anthropicPool: sidecarAnthropicPoolOptions(config, ws),
         streamRoutedModelOutput: ws.streamRoutedModelOutput === true,
         ...(ws.xSearch ? { xSearch: ws.xSearch } : {}),
       },

package/src/server/management/decision-routes.ts

@@ -1,4 +1,5 @@
 import { jsonResponse } from "../auth-cors";
+import { jevDecisionEndpointUrl } from "../../combos/jev-decision-contract";
 import type { ManagementContext } from "./context";
 import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
 import { isPlainRecord } from "./shared";
@@ -29,7 +30,7 @@ function decisionServiceIssue(
   provider: DecisionRow,
   isSystemOneEndpoint: (url: string) => boolean,
 ): { url: string; model: string; issue?: "disabled" | "endpoint" | "model" } {
-  const url = typeof provider.baseUrl === "string" ? provider.baseUrl.trim().replace(/\/+$/, "") : "";
+  const url = typeof provider.baseUrl === "string" ? jevDecisionEndpointUrl(provider.baseUrl) : "";
   const model = provider.defaultModel?.trim() || provider.models?.[0]?.trim() || "";
   const issue = provider.disabled === true
     ? "disabled"

package/src/server/management/integration-routes.ts

@@ -318,6 +318,25 @@ function invalidClientResponse(ctx: ManagementContext): Response {
   }, 400, ctx.req, ctx.config);
 }
 
+/** Bind an explicitly scoped restore before profile delegation or mutation. */
+function restoreClientScopeResponse(ctx: ManagementContext, opId: string, expectedClientId: unknown, pathClientId?: IntegrationClientId): Response | null {
+  if (pathClientId !== undefined) {
+    if (expectedClientId !== undefined && (typeof expectedClientId !== "string" || !isIntegrationClientId(expectedClientId))) return invalidClientResponse(ctx);
+    if (expectedClientId !== undefined && expectedClientId !== pathClientId) return jsonResponse({ error: "restore identity does not match the client path", code: "integration_client_mismatch" }, 409, ctx.req, ctx.config);
+    expectedClientId = pathClientId;
+  }
+  if (expectedClientId === undefined) return null;
+  if (typeof expectedClientId !== "string" || !isIntegrationClientId(expectedClientId)) return invalidClientResponse(ctx);
+  try {
+    const operation = integrationStore().findOperation(opId);
+    if (!operation) return jsonResponse({ error: "integration operation not found", code: "integration_operation_not_found", opId }, 404, ctx.req, ctx.config);
+    if (operation.clientId !== expectedClientId) return jsonResponse({ error: "integration operation belongs to a different client", code: "integration_client_mismatch" }, 409, ctx.req, ctx.config);
+    return null;
+  } catch (error) {
+    return internalErrorResponse(error, ctx);
+  }
+}
+
 function isStringRecord(value: unknown): value is Record<string, string> {
   return value !== null && typeof value === "object" && !Array.isArray(value)
     && Object.values(value).every(item => typeof item === "string");
@@ -775,7 +794,7 @@ export async function handleIntegrationRoutes(ctx: ManagementContext): Promise<R
     }
   }
 
-  if (url.pathname === "/api/client-integrations/restore/preview") {
+  if (url.pathname === "/api/client-integrations/restore/preview" || url.pathname === "/api/client-integrations/commandcode/restore/preview") {
     if (req.method !== "POST") return null;
     const parsed = await readJsonBody(ctx);
     if (parsed instanceof Response) return parsed;
@@ -786,6 +805,8 @@ export async function handleIntegrationRoutes(ctx: ManagementContext): Promise<R
       return jsonResponse({ error: "confirmDrift must be a boolean", code: "invalid_confirm_drift" }, 400, req, ctx.config);
     }
     const opId = parsed.opId.trim();
+    const scopeResponse = restoreClientScopeResponse(ctx, opId, parsed.expectedClientId, url.pathname === "/api/client-integrations/commandcode/restore/preview" ? "commandcode" : undefined);
+    if (scopeResponse) return scopeResponse;
     try {
       const store = integrationStore();
       const operation = store.findOperation(opId);
@@ -819,7 +840,7 @@ export async function handleIntegrationRoutes(ctx: ManagementContext): Promise<R
     }
   }
 
-  if (url.pathname === "/api/client-integrations/restore") {
+  if (url.pathname === "/api/client-integrations/restore" || url.pathname === "/api/client-integrations/commandcode/restore") {
     if (req.method !== "POST") return null;
     const parsed = await readJsonBody(ctx);
     if (parsed instanceof Response) return parsed;
@@ -837,6 +858,8 @@ export async function handleIntegrationRoutes(ctx: ManagementContext): Promise<R
     }
 
     const opId = parsed.opId.trim();
+    const scopeResponse = restoreClientScopeResponse(ctx, opId, parsed.expectedClientId, url.pathname === "/api/client-integrations/commandcode/restore" ? "commandcode" : undefined);
+    if (scopeResponse) return scopeResponse;
     const confirmDrift = parsed.confirmDrift ?? false;
     const restoreBinding = planBindingOf(parsed);
     if (restoreBinding === "half") return halfBoundResponse(ctx);