@bitkyc08/opencodex 2.8.0 → 2.9.0

package/src/server/management/oauth-account-routes.ts

@@ -1,4 +1,4 @@
-import { randomUUID } from "node:crypto";
+import { randomBytes, randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
 import type { CatalogModel } from "../../codex/catalog";
 import { catalogModelSlug, invalidateCodexModelsCache, nativeModelRows, uniqueCatalogModelsForPublicList } from "../../codex/catalog";
@@ -22,8 +22,9 @@ import {
   startLoginFlow,
   submitManualLoginCode,
 } from "../../oauth";
-import { removeCredential } from "../../oauth/store";
+import { OAuthMutationBusyError, removeCredential } from "../../oauth/store";
 import { providerDestinationResolvedError } from "../../lib/destination-policy";
+import { reconcileLiveStateStores } from "../../lib/state-store-registrations";
 import { enrichProviderFromCatalog, listKeyLoginProviders } from "../../oauth/key-providers";
 import { deriveProviderPresets } from "../../providers/derive";
 import { providerCodexAccountMode } from "../../providers/registry";
@@ -59,15 +60,57 @@ import { drainAndShutdown } from "../lifecycle";
 import { filterRequestLogs, getRequestLogEntries, type RequestLogEntry } from "../request-log";
 import { estimateComboCost, estimateRequestCost, normalizeCostTokens, tokensPerSecond } from "../../usage/cost";
 import type { PersistedUsageAttempt } from "../../usage/log";
-import { isAllowedRequestOrigin, jsonResponse, providerManagementConfigError, publicProviderBaseUrl, safeConfigDTO } from "../auth-cors";
+import { AUTH_MATRIX, isAllowedRequestOrigin, jsonResponse, providerManagementConfigError, publicProviderBaseUrl, safeConfigDTO } from "../auth-cors";
 import { applySystemEnvToggle } from "../system-env";
 import { buildApiAccessEndpoints } from "./api-access";
 
 import { isPlainRecord, parseDebugLogQuery, tokPerSecondResult, unavailableCostReason, costResult, requestLogDto, stripRegistryOnlyStaticHeaders, fetchAllModels } from "./shared";
 import type { MetricUnavailableReason, TokPerSecondResult, CostEstimateReason, CostResult, MetricSource } from "./shared";
 import type { ManagementContext } from "./context";
+import { readManagementJsonBody, readManagementJsonBodyOr, rethrowManagementBodyTooLarge } from "./body";
 import { codexAccountNamespaceProviderCollisionError } from "../../codex/account-namespace-match";
 
+/**
+ * Parses a bounded JSON object body, or null. Malformed JSON is swallowed; an
+ * oversized body still throws so the management dispatcher can return 413.
+ * a malformed body, which used to surface as a 500 from the key routes.
+ */
+async function readJsonBody(req: Request): Promise<Record<string, unknown> | null> {
+  try {
+    const parsed: unknown = await readManagementJsonBody(req);
+    return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)
+      ? parsed as Record<string, unknown>
+      : null;
+  } catch (error) {
+    rethrowManagementBodyTooLarge(error);
+    return null;
+  }
+}
+
+/**
+ * The single place key-name rules live. The config read schema is deliberately
+ * permissive so an existing config can never become unloadable; this is the write
+ * boundary that keeps new junk out. A non-string name used to reach `.trim()` and
+ * throw.
+ */
+function validateKeyName(
+  raw: unknown,
+  opts: { required: boolean },
+): { value: string } | { error: string } {
+  if (raw === undefined || raw === null) {
+    return opts.required ? { error: "name required" } : { value: "" };
+  }
+  if (typeof raw !== "string") return { error: "name must be a string" };
+  // Check the RAW string: trimming first would silently accept "deploy\n" by
+  // deleting the very character being rejected.
+  // eslint-disable-next-line no-control-regex
+  if (/[\u0000-\u001f\u007f]/.test(raw)) return { error: "invalid name" };
+  const value = raw.trim();
+  if (opts.required && !value) return { error: "name required" };
+  if (value.length > 64) return { error: "name too long" };
+  return { value };
+}
+
 export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<Response | null> {
   const { req, url, config, deps, refreshCodexCatalogBestEffort, syncClaudeAgentDefsBestEffort } = ctx;
 
@@ -85,7 +128,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
   // the provider's loopback callback server (inside this process) captures the redirect in the
   // background, then the credential is persisted. The GUI opens the URL and polls /api/oauth/status.
   if (url.pathname === "/api/oauth/login" && req.method === "POST") {
-    const body = await req.json().catch(() => ({})) as { provider?: string; addAccount?: boolean; accountId?: string; reauth?: boolean };
+    const body = await readManagementJsonBodyOr(req, {}) as { provider?: string; addAccount?: boolean; accountId?: string; reauth?: boolean };
     const provider = (body.provider ?? "").trim().toLowerCase();
     if (!isPublicOAuthProvider(provider)) return jsonResponse({ error: "unknown oauth provider" }, 400);
     const namespaceCollision = codexAccountNamespaceProviderCollisionError(config.codexAccountNamespaces, provider);
@@ -111,7 +154,10 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
         // startLoginFlow returns the authorization URL before background persistence completes.
         // Three-way reconcile settled disk changes so a failed login cannot leave a provider
         // live-only and an in-flight management mutation cannot be erased before it saves.
-        onSettled: () => reconcileLiveConfigFromDisk(config, persistedBaseline),
+        onSettled: () => {
+          reconcileLiveConfigFromDisk(config, persistedBaseline);
+          reconcileLiveStateStores();
+        },
       });
       if (authUrl && !deviceCode) {
         // Open the browser server-side (the proxy runs on the user's machine) — the GUI's
@@ -121,6 +167,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
       }
       return jsonResponse({ url: authUrl, instructions, deviceCode });
     } catch (err) {
+      if (err instanceof OAuthMutationBusyError) throw err;
       return jsonResponse({ error: err instanceof Error ? err.message : String(err) }, 409);
     }
   }
@@ -128,7 +175,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
   // Cancel an in-progress browser/device OAuth login (GUI "Cancel" / modal close). Guarded by
   // the same public predicate as /api/oauth/login — only publicly startable flows are cancellable.
   if (url.pathname === "/api/oauth/login/cancel" && req.method === "POST") {
-    const body = await req.json().catch(() => ({})) as { provider?: string };
+    const body = await readManagementJsonBodyOr(req, {}) as { provider?: string };
     const provider = (body.provider ?? "").trim().toLowerCase();
     if (!isPublicOAuthProvider(provider)) return jsonResponse({ error: "unknown oauth provider" }, 400);
     const { cancelLoginFlow } = await import("../../oauth");
@@ -139,7 +186,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
   // Manual fallback for browser OAuth: paste the final redirect URL (or authorization code)
   // when the browser cannot reach the loopback callback (remote/SSH/blocked localhost).
   if (url.pathname === "/api/oauth/login/code" && req.method === "POST") {
-    const body = await req.json().catch(() => ({})) as { provider?: string; input?: string; code?: string };
+    const body = await readManagementJsonBodyOr(req, {}) as { provider?: string; input?: string; code?: string };
     const provider = (body.provider ?? "").trim().toLowerCase();
     if (!isPublicOAuthProvider(provider)) return jsonResponse({ error: "unknown oauth provider" }, 400);
     const input = typeof body.input === "string" ? body.input : typeof body.code === "string" ? body.code : "";
@@ -161,6 +208,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     const provider = (url.searchParams.get("provider") ?? "").trim().toLowerCase();
     if (!isPublicOAuthProvider(provider)) return jsonResponse({ error: "unknown oauth provider" }, 400);
     await removeCredential(provider);
+    reconcileLiveStateStores();
     clearLoginState(provider);
     // Drop cached/last-good quota rows tied to the removed credential.
     const { clearProviderQuotaCache, clearAccountQuotaCache } = await import("../../providers/quota");
@@ -223,7 +271,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     });
   }
   if (url.pathname === "/api/oauth/accounts/active" && req.method === "PUT") {
-    const body = await req.json().catch(() => ({})) as { provider?: string; accountId?: string };
+    const body = await readManagementJsonBodyOr(req, {}) as { provider?: string; accountId?: string };
     const provider = (body.provider ?? "").trim().toLowerCase();
     if (!isPublicOAuthProvider(provider)) return jsonResponse({ error: "unknown oauth provider" }, 400);
     if (!body.accountId) return jsonResponse({ error: "missing accountId" }, 400);
@@ -253,7 +301,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     });
   }
   if (url.pathname === "/api/oauth/accounts/pool" && (req.method === "PUT" || req.method === "PATCH")) {
-    const parsedBody = await req.json().catch(() => ({}));
+    const parsedBody = await readManagementJsonBodyOr(req, {});
     if (!isPlainRecord(parsedBody)) {
       return jsonResponse({ error: "body must be an object" }, 400);
     }
@@ -306,6 +354,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
       ...(stickyLimit !== undefined ? { stickyLimit } : {}),
     };
     saveConfigPreservingClaudeCode(config);
+    reconcileLiveStateStores();
     return jsonResponse({
       ok: true,
       provider,
@@ -317,7 +366,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     });
   }
   if (url.pathname === "/api/oauth/accounts/clear-cooldown" && req.method === "POST") {
-    const body = await req.json().catch(() => ({})) as { provider?: unknown; accountId?: unknown };
+    const body = await readManagementJsonBodyOr(req, {}) as { provider?: unknown; accountId?: unknown };
     const provider = typeof body.provider === "string" ? body.provider.trim().toLowerCase() : "";
     const accountId = typeof body.accountId === "string" ? body.accountId.trim() : "";
     if (provider !== "anthropic") return jsonResponse({ error: "clear-cooldown is only supported for anthropic" }, 400);
@@ -328,7 +377,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
   }
 
   if (url.pathname === "/api/oauth/accounts/alias" && req.method === "PUT") {
-    const body = await req.json().catch(() => ({})) as { provider?: unknown; accountId?: unknown; alias?: unknown };
+    const body = await readManagementJsonBodyOr(req, {}) as { provider?: unknown; accountId?: unknown; alias?: unknown };
     const provider = typeof body.provider === "string" ? body.provider.trim().toLowerCase() : "";
     const accountId = typeof body.accountId === "string" ? body.accountId.trim() : "";
     const alias = typeof body.alias === "string" ? body.alias.trim() : "";
@@ -348,6 +397,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     if (!id) return jsonResponse({ error: "missing id" }, 400);
     const { removeAccount, getAccountSet } = await import("../../oauth/store");
     if (!(await removeAccount(provider, id))) return jsonResponse({ error: "account not found" }, 404);
+    reconcileLiveStateStores();
     if (provider === "anthropic") {
       const { clearAnthropicAccountCooldown, clearAnthropicSessionAffinityForAccount } = await import("../../oauth/anthropic-routing");
       clearAnthropicAccountCooldown(id);
@@ -370,7 +420,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     return jsonResponse(listProviderApiKeys(config, name));
   }
   if (url.pathname === "/api/providers/keys" && req.method === "POST") {
-    const body = await req.json().catch(() => ({})) as { name?: string; key?: string; label?: string };
+    const body = await readManagementJsonBodyOr(req, {}) as { name?: string; key?: string; label?: string };
     const name = (body.name ?? "").trim();
     if (!name || !isValidProviderName(name) || !hasOwnProvider(config.providers, name)) return jsonResponse({ error: "unknown provider" }, 404);
     if (typeof body.key !== "string" || !body.key.trim()) return jsonResponse({ error: "key is required" }, 400);
@@ -386,7 +436,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     return jsonResponse({ ok: true, id: result.id }, 201);
   }
   if (url.pathname === "/api/providers/keys/active" && req.method === "PUT") {
-    const body = await req.json().catch(() => ({})) as { name?: string; id?: string };
+    const body = await readManagementJsonBodyOr(req, {}) as { name?: string; id?: string };
     const name = (body.name ?? "").trim();
     if (!name || !isValidProviderName(name) || !hasOwnProvider(config.providers, name)) return jsonResponse({ error: "unknown provider" }, 404);
     if (!body.id) return jsonResponse({ error: "missing id" }, 400);
@@ -401,7 +451,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     return jsonResponse({ ok: true, name, activeId: body.id });
   }
   if (url.pathname === "/api/providers/keys/alias" && req.method === "PUT") {
-    const body = await req.json().catch(() => ({})) as { name?: unknown; id?: unknown; alias?: unknown };
+    const body = await readManagementJsonBodyOr(req, {}) as { name?: unknown; id?: unknown; alias?: unknown };
     const name = typeof body.name === "string" ? body.name.trim() : "";
     const id = typeof body.id === "string" ? body.id.trim() : "";
     const alias = typeof body.alias === "string" ? body.alias.trim() : "";
@@ -440,32 +490,71 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
       requestHost: req.headers.get("host"),
       requestOrigin: req.headers.get("origin"),
     });
+    const { readApiKeyUsageRollup } = await import("./api-key-usage");
+    const { rollup, attributionSince, historyTruncated } = await readApiKeyUsageRollup(keys.map(k => k.id), config.managementUsageMaxReadBytes);
     return jsonResponse({
-      keys: keys.map(k => ({ id: k.id, name: k.name, prefix: k.key.slice(0, 8) + "...", createdAt: k.createdAt })),
+      // 8 random hex past the fixed `ocx_data_` literal: enough to tell two keys
+      // apart in a list, with 128 bits of the tail still unrevealed. Masking only
+      // 8 characters showed `ocx_data...` for every key ever generated.
+      keys: keys.map(k => ({
+        id: k.id,
+        name: k.name,
+        prefix: k.key.slice(0, 17) + "...",
+        createdAt: k.createdAt,
+        usage: rollup.get(k.id) ?? { requests7d: 0, totalRequests: 0 },
+      })),
+      // Dataset-level and singular: it describes the usage log, not any one key.
+      ...(attributionSince ? { attributionSince } : {}),
+      ...(historyTruncated ? { historyTruncated: true } : {}),
+      authMatrix: AUTH_MATRIX,
       ...endpoints,
     }, 200, req, config);
   }
 
   if (url.pathname === "/api/keys" && req.method === "POST") {
-    const body = await req.json() as { name?: string };
-    const name = (body.name ?? "").trim() || "default";
-    // Generate key from provider keys hash + random salt
-    const providerKeys = Object.values(config.providers).map(p => p.apiKey ?? "").filter(Boolean).join("|");
-    const salt = crypto.randomUUID();
-    const hashInput = `${providerKeys}|${salt}|${Date.now()}`;
-    const hashBuf = new Bun.CryptoHasher("sha256").update(hashInput).digest();
-    const key = "ocx_data_" + Buffer.from(hashBuf).toString("hex").slice(0, 40);
-    const entry = { id: crypto.randomUUID(), name, key, createdAt: new Date().toISOString() };
+    const body = await readJsonBody(req);
+    if (!body) return jsonResponse({ error: "invalid body" }, 400, req, config);
+    const nameField = validateKeyName(body.name, { required: false });
+    if ("error" in nameField) return jsonResponse({ error: nameField.error }, 400, req, config);
+    const name = nameField.value || "default";
+    // A direct random draw. The previous derivation hashed every configured
+    // provider API key into the input, which was never needed for uniqueness and
+    // made this secret's safety argument depend on string concatenation rather
+    // than the RNG. 20 bytes is the same 40 hex characters as before, so nothing
+    // that pattern-matches the key shape changes.
+    const key = "ocx_data_" + randomBytes(20).toString("hex");
+    const entry = { id: randomUUID(), name, key, createdAt: new Date().toISOString() };
     config.apiKeys = [...(config.apiKeys ?? []), entry];
     saveConfigPreservingClaudeCode(config);
+    reconcileLiveStateStores();
     return jsonResponse({ id: entry.id, name: entry.name, key: entry.key, createdAt: entry.createdAt }, 201, req, config);
   }
 
+  if (url.pathname === "/api/keys" && req.method === "PATCH") {
+    const body = await readJsonBody(req);
+    if (!body) return jsonResponse({ error: "invalid body" }, 400, req, config);
+    if (typeof body.id !== "string" || !body.id) return jsonResponse({ error: "id required" }, 400, req, config);
+    const nameField = validateKeyName(body.name, { required: true });
+    if ("error" in nameField) return jsonResponse({ error: nameField.error }, 400, req, config);
+    const entry = (config.apiKeys ?? []).find(k => k.id === body.id);
+    if (!entry) return jsonResponse({ error: "key not found" }, 404, req, config);
+    entry.name = nameField.value;
+    saveConfigPreservingClaudeCode(config);
+    reconcileLiveStateStores();
+    // Never echo key material from a rename.
+    return jsonResponse({ id: entry.id, name: entry.name, createdAt: entry.createdAt }, 200, req, config);
+  }
+
   if (url.pathname === "/api/keys" && req.method === "DELETE") {
-    const body = await req.json() as { id?: string };
-    if (!body.id) return jsonResponse({ error: "id required" }, 400, req, config);
+    const body = await readJsonBody(req);
+    if (!body) return jsonResponse({ error: "invalid body" }, 400, req, config);
+    if (typeof body.id !== "string" || !body.id) return jsonResponse({ error: "id required" }, 400, req, config);
+    const before = (config.apiKeys ?? []).length;
     config.apiKeys = (config.apiKeys ?? []).filter(k => k.id !== body.id);
+    // A stale id must not read as a successful revocation.
+    if (config.apiKeys.length === before) return jsonResponse({ error: "key not found" }, 404, req, config);
     saveConfigPreservingClaudeCode(config);
+    reconcileLiveStateStores();
     return jsonResponse({ success: true }, 200, req, config);
   }
   return null;

package/src/server/management/provider-routes.ts

@@ -23,6 +23,7 @@ import {
 } from "../../oauth";
 import { removeCredential } from "../../oauth/store";
 import { providerDestinationResolvedError } from "../../lib/destination-policy";
+import { reconcileLiveStateStores } from "../../lib/state-store-registrations";
 import { ProviderOutboundPolicyError, providerOutboundGet, providerRedirectError } from "../../lib/provider-outbound";
 import { enrichProviderFromCatalog, listKeyLoginProviders } from "../../oauth/key-providers";
 import { deriveProviderPresets } from "../../providers/derive";
@@ -67,6 +68,7 @@ import { applySystemEnvToggle } from "../system-env";
 import { isPlainRecord, parseDebugLogQuery, tokPerSecondResult, unavailableCostReason, costResult, requestLogDto, stripRegistryOnlyStaticHeaders, fetchAllModels } from "./shared";
 import type { MetricUnavailableReason, TokPerSecondResult, CostEstimateReason, CostResult, MetricSource } from "./shared";
 import type { ManagementContext } from "./context";
+import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
 
 export async function handleProviderRoutes(ctx: ManagementContext): Promise<Response | null> {
   const { req, url, config, deps, refreshCodexCatalogBestEffort, syncClaudeAgentDefsBestEffort } = ctx;
@@ -96,7 +98,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
   // which would re-save the masked keys from GET). Live routing picks it up immediately.
   if (url.pathname === "/api/providers" && req.method === "POST") {
     let body: { name?: unknown; provider?: unknown; setDefault?: boolean };
-    try { body = await req.json(); } catch { return jsonResponse({ error: "invalid JSON body" }, 400); }
+    try { body = await readManagementJsonBody(req); } catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid JSON body" }, 400); }
     const name = typeof body.name === "string" ? body.name.trim() : "";
     const providerError = providerManagementConfigError(name, body.provider);
     if (providerError) return jsonResponse({ error: providerError }, 400);
@@ -118,6 +120,12 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     const allowBenchmarkAddresses = name === "openai" && isCanonicalOpenAiForwardProvider(prov);
     const resolvedError = await providerDestinationResolvedError(name, prov, { allowBenchmarkAddresses });
     if (resolvedError) return jsonResponse({ error: resolvedError }, 400);
+    if (body.setDefault !== undefined && typeof body.setDefault !== "boolean") {
+      return jsonResponse({ error: "setDefault must be a boolean" }, 400);
+    }
+    if (body.setDefault === true && prov.disabled) {
+      return jsonResponse({ error: "cannot set a disabled provider as default", code: "default_provider_disabled" }, 400);
+    }
     // Catalog providers (e.g. ollama-cloud) carry a models + vision/reasoning classification the GUI
     // doesn't send — merge it in so the sidecars are gated correctly.
     enrichProviderFromCatalog(name, prov);
@@ -127,8 +135,9 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     const existingPool = config.providers[name]?.apiKeyPool;
     if (existingPool && !prov.apiKeyPool) prov.apiKeyPool = existingPool;
     config.providers[name] = stripRegistryOnlyStaticHeaders(name, prov);
-    if (body.setDefault) config.defaultProvider = name;
+    if (body.setDefault === true) config.defaultProvider = name;
     save(config);
+    reconcileLiveStateStores();
     if (prov.apiKey && prov.apiKeyPool) {
       const { addProviderApiKey } = await import("../../providers/api-keys");
       addProviderApiKey(config, name, prov.apiKey);
@@ -143,10 +152,11 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     const name = url.searchParams.get("name")?.trim();
     if (!name || !isValidProviderName(name) || !hasOwnProvider(config.providers, name)) return jsonResponse({ error: "unknown provider" }, 404);
     let rawBody: unknown;
-    try { rawBody = await req.json(); } catch { return jsonResponse({ error: "invalid JSON body" }, 400); }
+    try { rawBody = await readManagementJsonBody(req); } catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid JSON body" }, 400); }
     if (!isPlainRecord(rawBody)) return jsonResponse({ error: "provider patch body must be a plain object" }, 400);
     const keys = Object.keys(rawBody);
     const hasMode = Object.hasOwn(rawBody, "codexAccountMode");
+    const hasSetDefault = Object.hasOwn(rawBody, "setDefault");
 
     // codexAccountMode keeps its dedicated side-effect path (quota cache clear, thread map
     // clear, pool prime) and is mutually exclusive with every other patch field.
@@ -166,6 +176,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       const { saveConfigPreservingClaudeCode: save } = await import("../../config");
       config.providers.openai = { ...provider, codexAccountMode: mode };
       save(config);
+      reconcileLiveStateStores();
       (deps.clearProviderQuotaCache ?? clearProviderQuotaCache)();
       (deps.clearThreadAccountMap ?? clearThreadAccountMap)();
       if (mode === "pool") {
@@ -179,6 +190,23 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       return jsonResponse({ success: true, name: "openai", codexAccountMode: mode });
     }
 
+    // Default-provider changes must be a deliberate, standalone action. This keeps
+    // routing changes out of ordinary provider edits and lets the dashboard expose a
+    // simple "Set as default" control without round-tripping the full config.
+    if (hasSetDefault) {
+      if (keys.length !== 1 || rawBody.setDefault !== true) {
+        return jsonResponse({ error: "setDefault must be true and cannot be combined with other patch fields" }, 400);
+      }
+      if (config.providers[name]!.disabled) {
+        return jsonResponse({ error: "cannot set a disabled provider as default", code: "default_provider_disabled" }, 400);
+      }
+      const { saveConfigPreservingClaudeCode: save } = await import("../../config");
+      config.defaultProvider = name;
+      save(config);
+      reconcileLiveStateStores();
+      return jsonResponse({ success: true, name, defaultProvider: name });
+    }
+
     // Field-mask editor: apply recognized fields onto a copy, then validate the MERGED
     // provider (canonical-seed guard covers openai; local-guard covers registry key providers).
     // API keys are never writable here — the api-keys endpoints own pool-integrated key writes.
@@ -302,6 +330,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     const { saveConfigPreservingClaudeCode: save } = await import("../../config");
     config.providers[name] = stripRegistryOnlyStaticHeaders(name, next);
     save(config);
+    reconcileLiveStateStores();
     if (editorTouched) {
       const { clearModelCache } = await import("../../codex/model-cache");
       clearModelCache(name);
@@ -417,7 +446,22 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
   if (url.pathname === "/api/providers" && req.method === "DELETE") {
     const name = url.searchParams.get("name")?.trim();
     if (!name || !isValidProviderName(name) || !hasOwnProvider(config.providers, name)) return jsonResponse({ error: "unknown provider" }, 404);
-    if (name === config.defaultProvider) return jsonResponse({ error: "cannot delete the default provider; set another default first" }, 400);
+    // Config validation requires a default provider. Reassigning before deletion keeps
+    // the persisted config valid and makes removal of the current default a one-step UI
+    // operation. Prefer the first remaining *enabled* provider so DELETE cannot leave a
+    // disabled default that setDefault / disable already refuse. Object-key order is the
+    // documented configuration order and is stable through JSON persistence.
+    const fallbackDefault = name === config.defaultProvider
+      ? Object.entries(config.providers)
+        .find(([provider, providerConfig]) => provider !== name && providerConfig.disabled !== true)
+        ?.[0]
+      : undefined;
+    if (name === config.defaultProvider && !fallbackDefault) {
+      return jsonResponse({
+        error: "cannot delete the default provider when no enabled replacement remains",
+        code: "last_provider",
+      }, 409);
+    }
     const dependentCombos = Object.entries(config.combos ?? {})
       .filter(([, combo]) => combo.targets.some(target => target.provider === name))
       .map(([id]) => id)
@@ -425,17 +469,20 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     if (dependentCombos.length > 0) {
       return jsonResponse({
         error: `cannot delete provider "${name}" while combos depend on it`,
+        code: "provider_has_dependent_combos",
         combos: dependentCombos,
       }, 409);
     }
     const { saveConfigPreservingClaudeCode: save } = await import("../../config");
+    if (fallbackDefault) config.defaultProvider = fallbackDefault;
     delete config.providers[name];
     setProviderContextCap(config, name, false);
     save(config);
+    reconcileLiveStateStores();
     const { clearModelCache: clearCache } = await import("../../codex/model-cache");
     clearCache(name);
     await refreshCodexCatalogBestEffort();
-    return jsonResponse({ success: true });
+    return jsonResponse({ success: true, ...(fallbackDefault ? { defaultProvider: fallbackDefault } : {}) });
   }
 
   if (url.pathname === "/api/provider-context-caps" && req.method === "GET") {
@@ -444,7 +491,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
 
   if (url.pathname === "/api/provider-context-caps" && req.method === "PUT") {
     let body: { provider?: unknown; enabled?: unknown; value?: unknown; setAll?: unknown };
-    try { body = await req.json(); } catch { return jsonResponse({ error: "invalid JSON body" }, 400); }
+    try { body = await readManagementJsonBody(req); } catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid JSON body" }, 400); }
     const { saveConfigPreservingClaudeCode: save } = await import("../../config");
     const { clearModelCache } = await import("../../codex/model-cache");
     const respond = () => jsonResponse({ ok: true, cap: DEFAULT_PROVIDER_CONTEXT_CAP, value: globalContextCapValue(config), caps: providerContextCaps(config) });
@@ -457,6 +504,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       const affected = Object.keys(providerContextCaps(config));
       setGlobalContextCapValue(config, body.value);
       save(config);
+      reconcileLiveStateStores();
       for (const provider of affected) clearModelCache(provider);
       await refreshCodexCatalogBestEffort();
       return respond();
@@ -471,6 +519,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       const names = Object.keys(config.providers);
       setAllProviderContextCaps(config, names, body.setAll);
       save(config);
+      reconcileLiveStateStores();
       for (const provider of new Set([...before, ...names])) clearModelCache(provider);
       await refreshCodexCatalogBestEffort();
       return respond();
@@ -489,6 +538,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     }
     setProviderContextCap(config, provider, body.enabled);
     save(config);
+    reconcileLiveStateStores();
     clearModelCache(provider);
     await refreshCodexCatalogBestEffort();
     return respond();

package/src/server/management/shared.ts

@@ -214,14 +214,14 @@ export function stripRegistryOnlyStaticHeaders(name: string, provider: OcxProvid
 
 /** Shared Desktop profile DTO builder for the management API and CLI. */
 export async function buildClaudeDesktopState(config: OcxConfig, stored?: OcxClaudeDesktopProfile) {
-  const { filterCatalogVisibleModels, nativeOpenAiContextWindow, visibleNativeSlugs } = await import("../../codex/catalog");
+  const { filterCatalogVisibleModels, nativeOpenAiContextWindow, desktopVisibleNativeSlugs } = await import("../../codex/catalog");
   const { DESKTOP_SUPPORTS_1M_THRESHOLD } = await import("../../claude/desktop-3p");
   const { reconcileDesktopProfile, renderDesktopProfile } = await import("../../claude/desktop-profile");
   const routed = filterCatalogVisibleModels(await fetchAllModels(config), config);
   const profileModels: DesktopProfileModel[] = [
     // Native rows carry their real context window from the same accessor the Grok sync
     // uses — otherwise Sol's 372k and gpt-5.5's 272k render as blank on Desktop.
-    ...visibleNativeSlugs(config).map(id => {
+    ...desktopVisibleNativeSlugs(config).map(id => {
       const contextWindow = nativeOpenAiContextWindow(id);
       return { route: `native/${id}`, label: `${id} (native)`,
         ...(contextWindow !== undefined ? { contextWindow } : {}) };
@@ -233,6 +233,19 @@ export async function buildClaudeDesktopState(config: OcxConfig, stored?: OcxCla
     })),
   ];
   const profile = reconcileDesktopProfile(stored ?? config.claudeCode?.desktopProfile, profileModels);
+  if (config.claudeCode?.desktopNativeModels === false) {
+    for (const route of Object.keys(profile.assignments)) {
+      if (route.startsWith("native/")) delete profile.assignments[route];
+    }
+    for (const family of ["opus", "fable", "sonnet", "haiku"] as const) {
+      const current = profile.defaults[family];
+      if (current?.startsWith("native/")) {
+        profile.defaults[family] = Object.keys(profile.assignments)
+          .filter(route => profile.assignments[route]?.family === family)
+          .sort()[0] ?? null;
+      }
+    }
+  }
   const available = new Set(profileModels.map(model => model.route));
   const modelByRoute = new Map(profileModels.map(model => [model.route, model]));
   // Effort support: routed models with a non-empty reasoningEfforts ladder support effort;
@@ -241,7 +254,7 @@ export async function buildClaudeDesktopState(config: OcxConfig, stored?: OcxCla
   for (const m of routed) {
     effortByRoute.set(`${m.provider}/${m.id}`, Array.isArray(m.reasoningEfforts) && m.reasoningEfforts.length > 0);
   }
-  for (const id of visibleNativeSlugs(config)) {
+  for (const id of desktopVisibleNativeSlugs(config)) {
     effortByRoute.set(`native/${id}`, true);
   }
   const models = Object.keys(profile.assignments).sort().map(route => ({

package/src/server/management/sidebar-routes.ts

@@ -8,10 +8,42 @@
  * output is ever serialized here — starring runs through the user's own `gh` CLI and
  * this surface only learns the yes/no answer. `gh` writes the authenticated account
  * name to stderr, so that output is discarded at the source rather than forwarded.
+ *
+ * The star POST additionally refuses agent-driven programmatic callers. Management
+ * auth proves the caller reached the admin token, not that a person chose to star:
+ * a coding agent runs on the user's machine and can read that token from disk, so
+ * the CLI's "ask the user" deferral would be bypassable with one `curl` here.
+ *
+ * The dashboard button must keep working even when the proxy itself was started by
+ * an agent, which is the common case — the person is at the browser, not at the
+ * spawning shell. A GUI click is therefore distinguished by its browser session
+ * evidence (a same-origin `Origin` plus the minted CSRF header, both already
+ * verified by the management auth gate) rather than by the proxy's own env.
  */
 import { jsonResponse } from "../auth-cors";
+import { agentDrivenMarkers, isAgentDriven } from "../../cli/agent-driven";
 import type { ManagementContext } from "./context";
 
+/**
+ * True when this request carries the browser-session evidence a dashboard click
+ * always has: an `Origin` (only a browser sends one) plus the per-session CSRF
+ * token, which `requireManagementAuth` has already matched against the minted
+ * session before dispatch. A shell/HTTP caller holding only the admin token has
+ * neither, which is exactly the case the agent guard is aimed at.
+ */
+function hasBrowserSessionEvidence(req: Request): boolean {
+  return !!req.headers.get("Origin")?.trim()
+    && !!req.headers.get("x-opencodex-csrf-token")?.trim()
+    && !!req.headers.get("x-opencodex-gui-origin")?.trim();
+}
+
+// Known edge, deliberately fail-closed: a non-loopback operator dashboard signs in
+// with the raw admin token instead of a minted GUI session, so its clicks carry no
+// CSRF header. If that proxy was *also* started from an agent shell, the button is
+// refused and the response names the one-line `gh` command to run by hand. A
+// service-run proxy (`OCX_SERVICE`, the usual remote setup) is not agent-driven and
+// is unaffected.
+
 export async function handleSidebarRoutes(ctx: ManagementContext): Promise<Response | null> {
   const { req, url } = ctx;
 
@@ -21,7 +53,24 @@ export async function handleSidebarRoutes(ctx: ManagementContext): Promise<Respo
   }
 
   if (url.pathname === "/api/github/star" && req.method === "POST") {
-    const { starRepository } = await import("../../github/star-state");
+    const { STAR_REPO, STAR_REPO_URL, starRepository } = await import("../../github/star-state");
+    // Starring uses the user's GitHub identity, so consent must come from the
+    // account owner. An agent-driven caller without browser-session evidence
+    // cannot have obtained it, and must relay the question instead of answering
+    // it with an HTTP call.
+    if (isAgentDriven() && !hasBrowserSessionEvidence(req)) {
+      return jsonResponse({
+        ok: false,
+        state: "not-starred",
+        repo: STAR_REPO,
+        url: STAR_REPO_URL,
+        code: "agent_consent_required",
+        message:
+          `Refused: agent session detected (${agentDrivenMarkers().slice(0, 3).join(", ")}) and this request `
+          + `carries no dashboard session. Starring writes to the user's own GitHub account, so ask the user `
+          + `directly and only if they say yes run: gh api -X PUT /user/starred/${STAR_REPO}`,
+      }, 403);
+    }
     const result = await starRepository();
     return jsonResponse({
       ...result.status,

package/src/server/management/system-restart.ts

@@ -6,11 +6,14 @@
  * recycle to reclaim RSS, not a teardown.
  *
  * Respawn policy (matches real supervisor configs in src/service.ts):
- * - Supervised child (`OCX_SERVICE=1` + service installed): exit(1) so
+ * - Supervised child (`OCX_SERVICE=1` + viable service): exit(1) so
  *   failure-only supervisors (systemd Restart=on-failure, WinSW onfailure,
  *   Task Scheduler ERRORLEVEL loop) bring the proxy back.
  * - Otherwise: detached `ocx start --port <live>` (bypasses ensure's
  *   codexAutoStart gate), mark recycle so exit cleanup keeps injection, exit(0).
+ *   Installed-but-stale/missing service assets are NOT treated as supervised —
+ *   exit(1) would leave the proxy dead with `Service: installed, stale or missing
+ *   service assets` and a /healthz timeout.
  * - If detached spawn fails (sync throw or pre-start `error`): exit(1) without
  *   markRecycling — after drain the listen socket is already closed, so a latch
  *   reset cannot recover serving. Clear inherited `OCX_SERVICE` so exit cleanup
@@ -27,7 +30,7 @@ import {
   markRecyclingForExit,
   setDraining,
 } from "../lifecycle";
-import { isServiceInstalled } from "../../service";
+import { isServiceViable } from "../../service";
 import { readRuntimePort } from "../../config";
 
 /** Fixed v1 drain window for the memory-card action (not config-driven). */
@@ -35,7 +38,8 @@ export const MEMORY_DRAIN_RESTART_MS = 60_000;
 
 export interface SystemRestartIo {
   drainAndShutdown?: typeof drainAndShutdown;
-  isServiceInstalled?: () => boolean;
+  /** True when a background service can actually respawn this process after exit(1). */
+  isServiceViable?: () => boolean;
   isSupervisedServiceChild?: () => boolean;
   /** Must resolve only after the replacement process has actually started. */
   spawnStart?: (port?: number) => void | Promise<void>;
@@ -66,8 +70,11 @@ function resolveListenPort(): number | undefined {
   return undefined;
 }
 
-function isSupervisedServiceChild(): boolean {
-  return process.env.OCX_SERVICE === "1" && isServiceInstalled();
+function isSupervisedServiceChild(io: SystemRestartIo = {}): boolean {
+  if (process.env.OCX_SERVICE !== "1") return false;
+  // Presence is not enough: stale/missing service assets report installed but will not
+  // respawn after exit(1). Dashboard status/recovery must fall through to detached start.
+  return (io.isServiceViable ?? isServiceViable)();
 }
 
 /** Stable, path-free spawn failure label for logs (never interpolate err.message). */
@@ -137,7 +144,7 @@ export function acceptSystemRestart(io: SystemRestartIo = restartIo): {
     schedule(async () => {
       const drain = io.drainAndShutdown ?? drainAndShutdown;
       await drain(undefined, MEMORY_DRAIN_RESTART_MS);
-      const supervised = (io.isSupervisedServiceChild ?? isSupervisedServiceChild)();
+      const supervised = (io.isSupervisedServiceChild ?? (() => isSupervisedServiceChild(io)))();
       if (supervised) {
         // Failure-only supervisors ignore exit(0); intentional non-zero triggers respawn.
         (io.exitProcess ?? ((code: number) => { process.exit(code); }))(1);