@bitkyc08/opencodex 2.8.2-preview.20260731 → 2.9.0

package/src/server/management/config-routes.ts

@@ -25,6 +25,13 @@ import { removeCredential } from "../../oauth/store";
 import { providerDestinationResolvedError } from "../../lib/destination-policy";
 import { isStreamMode } from "../../lib/bun-stream-caps";
 import { shadowSourceModels } from "../../lib/shadow-call";
+import {
+  configureAppOwnedMemoryBudget,
+  enforceAppOwnedMemoryBudget,
+  MAX_APP_OWNED_MEMORY_BUDGET_MB,
+  MIN_APP_OWNED_MEMORY_BUDGET_MB,
+  resolveAppOwnedMemoryBudgetBytes,
+} from "../../lib/app-owned-memory";
 import { enrichProviderFromCatalog, listKeyLoginProviders } from "../../oauth/key-providers";
 import { deriveProviderPresets } from "../../providers/derive";
 import { providerCodexAccountMode } from "../../providers/registry";
@@ -64,6 +71,7 @@ import { displayCodexRuntimePath, effortClampAppliesToRuntime, loadLastEffortCla
 import { isPlainRecord, parseDebugLogQuery, tokPerSecondResult, unavailableCostReason, costResult, requestLogDto, stripRegistryOnlyStaticHeaders, fetchAllModels } from "./shared";
 import type { MetricUnavailableReason, TokPerSecondResult, CostEstimateReason, CostResult, MetricSource } from "./shared";
 import type { ManagementContext } from "./context";
+import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
 
 export async function handleConfigRoutes(ctx: ManagementContext): Promise<Response | null> {
   const { req, url, config, deps, refreshCodexCatalogBestEffort, syncClaudeAgentDefsBestEffort } = ctx;
@@ -120,6 +128,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       port: config.port,
       hostname: config.hostname ?? "127.0.0.1",
       streamMode: config.streamMode ?? "auto",
+      appOwnedMemoryBudgetMb: config.appOwnedMemoryBudgetMb ?? 256,
       startupHealth: await getCachedStartupHealth(config),
       codexRuntime: {
         path: displayCodexRuntimePath(resolved.runtime.command),
@@ -147,7 +156,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
 
   if (url.pathname === "/api/startup-action" && req.method === "POST") {
     let body: { action?: unknown; repair?: unknown };
-    try { body = await req.json(); } catch { return jsonResponse({ error: "invalid JSON body" }, 400); }
+    try { body = await readManagementJsonBody(req); } catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid JSON body" }, 400); }
     if (!body || !["install-service", "install-shim"].includes(String(body.action))) {
       return jsonResponse({ error: "action must be install-service or install-shim" }, 400);
     }
@@ -176,7 +185,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
 
   if (url.pathname === "/api/windows-tray" && req.method === "POST") {
     let body: { action?: unknown };
-    try { body = await req.json(); } catch { return jsonResponse({ error: "invalid JSON body" }, 400); }
+    try { body = await readManagementJsonBody(req); } catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid JSON body" }, 400); }
     if (!body || !["install", "start", "stop", "uninstall"].includes(String(body.action))) {
       return jsonResponse({ error: "action must be install, start, stop, or uninstall" }, 400);
     }
@@ -191,15 +200,15 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
 
   if (url.pathname === "/api/settings" && req.method === "PUT") {
     // Each field is optional but at least one must be present; fields are
-    // validated when present. streamMode-only PUTs must work: Windows-memory
-    // troubleshooting docs tell service users to set it here (a service does
-    // not inherit shell env, so config.json is its only input). A stream-shape
+    // validated when present. streamMode-only PUTs must work: Windows/macOS
+    // memory troubleshooting can use this persisted stream-shape escape hatch
+    // (a Windows service does not inherit shell env). A stream-shape
     // change applies to NEW turns only — the config object is shared by
     // reference with the request handlers, no restart needed.
-    let body: { codexAutoStart?: unknown; streamMode?: unknown };
-    try { body = await req.json(); } catch { return jsonResponse({ error: "invalid JSON body" }, 400); }
-    if (body.codexAutoStart === undefined && body.streamMode === undefined) {
-      return jsonResponse({ error: "codexAutoStart boolean is required" }, 400);
+    let body: { codexAutoStart?: unknown; streamMode?: unknown; appOwnedMemoryBudgetMb?: unknown };
+    try { body = await readManagementJsonBody(req); } catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid JSON body" }, 400); }
+    if (body.codexAutoStart === undefined && body.streamMode === undefined && body.appOwnedMemoryBudgetMb === undefined) {
+      return jsonResponse({ error: "provide codexAutoStart, streamMode, or appOwnedMemoryBudgetMb" }, 400);
     }
     if (body.codexAutoStart !== undefined && typeof body.codexAutoStart !== "boolean") {
       return jsonResponse({ error: "codexAutoStart boolean is required" }, 400);
@@ -207,6 +216,14 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
     if (body.streamMode !== undefined && !isStreamMode(body.streamMode)) {
       return jsonResponse({ error: "streamMode must be auto, legacy-tee, or eager-relay" }, 400);
     }
+    if (body.appOwnedMemoryBudgetMb !== undefined && (
+      typeof body.appOwnedMemoryBudgetMb !== "number"
+      || !Number.isInteger(body.appOwnedMemoryBudgetMb)
+      || body.appOwnedMemoryBudgetMb < MIN_APP_OWNED_MEMORY_BUDGET_MB
+      || body.appOwnedMemoryBudgetMb > MAX_APP_OWNED_MEMORY_BUDGET_MB
+    )) {
+      return jsonResponse({ error: `appOwnedMemoryBudgetMb must be an integer from ${MIN_APP_OWNED_MEMORY_BUDGET_MB} to ${MAX_APP_OWNED_MEMORY_BUDGET_MB}` }, 400);
+    }
     if (typeof body.codexAutoStart === "boolean") {
       config.codexAutoStart = body.codexAutoStart;
     }
@@ -217,12 +234,20 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
         config.streamMode = body.streamMode as "legacy-tee" | "eager-relay";
       }
     }
+    if (typeof body.appOwnedMemoryBudgetMb === "number") {
+      config.appOwnedMemoryBudgetMb = body.appOwnedMemoryBudgetMb;
+    }
     saveConfigPreservingClaudeCode(config);
+    if (typeof body.appOwnedMemoryBudgetMb === "number") {
+      configureAppOwnedMemoryBudget(resolveAppOwnedMemoryBudgetBytes(body.appOwnedMemoryBudgetMb));
+      enforceAppOwnedMemoryBudget();
+    }
     invalidateStartupHealthCache();
     return jsonResponse({
       ok: true,
       codexAutoStart: codexAutoStartEnabled(config),
       streamMode: config.streamMode ?? "auto",
+      appOwnedMemoryBudgetMb: config.appOwnedMemoryBudgetMb ?? 256,
       startupHealth: await getCachedStartupHealth(config),
     });
   }
@@ -255,7 +280,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
   if (url.pathname === "/api/update/run" && req.method === "POST") {
     const { normalizeUpdateChannel, startUpdateJob, UpdateJobError } = await import("../../update/job");
     let body: { tag?: unknown; restart?: unknown };
-    try { body = await req.json(); } catch { return jsonResponse({ error: "invalid JSON body" }, 400); }
+    try { body = await readManagementJsonBody(req); } catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid JSON body" }, 400); }
     if (body.tag !== undefined && body.tag !== "latest" && body.tag !== "preview") {
       return jsonResponse({ error: "tag must be latest or preview" }, 400);
     }
@@ -294,7 +319,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
 
   if (url.pathname === "/api/sidecar-settings" && req.method === "PUT") {
     let raw: unknown;
-    try { raw = await req.json(); } catch { return jsonResponse({ error: "invalid JSON body" }, 400); }
+    try { raw = await readManagementJsonBody(req); } catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid JSON body" }, 400); }
     // Strict shape (review F2): reject non-object bodies and non-object sections instead of throwing
     // on `null` or silently accepting arrays/strings as no-op updates.
     if (!isPlainRecord(raw)) return jsonResponse({ error: "body must be a JSON object" }, 400);
@@ -369,7 +394,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
 
   if (url.pathname === "/api/shadow-call-settings" && req.method === "PUT") {
     let raw: unknown;
-    try { raw = await req.json(); } catch { return jsonResponse({ error: "invalid JSON body" }, 400); }
+    try { raw = await readManagementJsonBody(req); } catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid JSON body" }, 400); }
     if (!isPlainRecord(raw)) return jsonResponse({ error: "body must be a JSON object" }, 400);
     const body = raw as { enabled?: unknown; model?: unknown };
     if (body.enabled !== undefined && typeof body.enabled !== "boolean") {

package/src/server/management/logs-usage-routes.ts

@@ -68,7 +68,7 @@ import {
 } from "../../lib/debug-settings";
 import type { OcxClaudeCodeConfig, OcxConfig, OcxCustomModel, OcxProviderConfig } from "../../types";
 import { drainAndShutdown } from "../lifecycle";
-import { filterRequestLogs, getRequestLogEntries, type RequestLogEntry } from "../request-log";
+import { filterRequestLogs, filteredRequestLogCount, getRequestLogEntries, type RequestLogEntry } from "../request-log";
 import { estimateComboCost, estimateRequestCost, normalizeCostTokens, tokensPerSecond } from "../../usage/cost";
 import type { PersistedUsageAttempt } from "../../usage/log";
 import { isAllowedRequestOrigin, jsonResponse, providerManagementConfigError, publicProviderBaseUrl, safeConfigDTO } from "../auth-cors";
@@ -77,14 +77,14 @@ import { applySystemEnvToggle } from "../system-env";
 import { isPlainRecord, parseDebugLogQuery, tokPerSecondResult, unavailableCostReason, costResult, requestLogDto, stripRegistryOnlyStaticHeaders, fetchAllModels } from "./shared";
 import type { MetricUnavailableReason, TokPerSecondResult, CostEstimateReason, CostResult, MetricSource } from "./shared";
 import type { ManagementContext } from "./context";
+import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
+import {
+  discardUsageSummaryCacheEntry,
+  getUsageSummaryCacheEntry,
+  setUsageSummaryCacheEntry,
+} from "./usage-summary-cache";
 
 const USAGE_DAY_MS = 86_400_000;
-const usageSummaryCache = new Map<string, {
-  revisionKey: string;
-  expiresAt: number;
-  summary: UsageSummary;
-}>();
-
 function usageEntryMatchesSurface(entry: PersistedUsageEntry, surface: UsageSurface): boolean {
   if (surface === "claude") return entry.surface === "claude" || entry.surface === "claude-desktop";
   if (surface === "grok") return entry.surface === "grok";
@@ -115,7 +115,7 @@ function usageSummaryExpiresAt(
   return expiresAt;
 }
 
-function refreshedUsageSummary(summary: UsageSummary, range: UsageRange, now: number): UsageSummary {
+function refreshedUsageSummary<T extends UsageSummary & { historyTruncated: boolean }>(summary: T, range: UsageRange, now: number): T {
   const since = range === "7d" ? now - 7 * USAGE_DAY_MS : range === "30d" ? now - 30 * USAGE_DAY_MS : null;
   return { ...summary, since, generatedAt: now };
 }
@@ -124,8 +124,14 @@ export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Res
   const { req, url, config, deps, refreshCodexCatalogBestEffort, syncClaudeAgentDefsBestEffort } = ctx;
 
   if (url.pathname === "/api/logs" && req.method === "GET") {
-    const logs = filterRequestLogs(getRequestLogEntries(), url.searchParams);
-    return jsonResponse(logs.map(requestLogDto));
+    const all = getRequestLogEntries();
+    const total = filteredRequestLogCount(all, url.searchParams);
+    const logs = filterRequestLogs(all, url.searchParams);
+    return jsonResponse({
+      timeZone: Intl.DateTimeFormat().resolvedOptions().timeZone,
+      total,
+      logs: logs.map(requestLogDto),
+    });
   }
 
   if (url.pathname === "/api/debug" && req.method === "GET") {
@@ -155,7 +161,7 @@ export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Res
 
   if (url.pathname === "/api/debug" && req.method === "PUT") {
     let body: { debug?: unknown; usage?: unknown; injection?: unknown; claude?: unknown; reset?: unknown };
-    try { body = await req.json(); } catch { return jsonResponse({ error: "invalid JSON body" }, 400); }
+    try { body = await readManagementJsonBody(req); } catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid JSON body" }, 400); }
     if (body.reset === true) return jsonResponse(clearDebugSettings());
     if (body.reset === "debug" || body.reset === "provider") return jsonResponse(clearDebugSetting("debug"));
     if (body.reset === "usage") return jsonResponse(clearDebugSetting("usage"));
@@ -184,16 +190,26 @@ export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Res
     const now = Date.now();
     try {
       const cacheKey = `${range}:${surface}`;
-      const observedRevisionKey = usageLogRevisionKey(currentUsageLogRevision());
-      const cached = usageSummaryCache.get(cacheKey);
+      const effectiveReadLimit = config.managementUsageMaxReadBytes ?? 64 * 1024 * 1024;
+      const observedRevisionKey = `${usageLogRevisionKey(currentUsageLogRevision())}\0${effectiveReadLimit}`;
+      const cached = getUsageSummaryCacheEntry(cacheKey);
       if (cached && cached.revisionKey === observedRevisionKey && now < cached.expiresAt) {
         return jsonResponse(refreshedUsageSummary(cached.summary, range, now));
       }
-      const snapshot = await readUsageSnapshotForManagement();
-      const summary = summarizeUsage(snapshot.entries, range, now, surface);
-      usageSummaryCache.set(cacheKey, {
-        revisionKey: usageLogRevisionKey(snapshot.revision),
+      if (cached) discardUsageSummaryCacheEntry(cacheKey);
+      const snapshot = await readUsageSnapshotForManagement(effectiveReadLimit);
+      const revisionReadAt = Date.now();
+      const summary = {
+        ...summarizeUsage(snapshot.entries, range, now, surface),
+        historyTruncated: snapshot.truncatedPrefixBytes > 0 || snapshot.entriesTruncated,
+        truncatedPrefixBytes: snapshot.truncatedPrefixBytes,
+        entriesTruncated: snapshot.entriesTruncated,
+        entriesDropped: snapshot.entriesDropped,
+      };
+      setUsageSummaryCacheEntry(cacheKey, {
+        revisionKey: `${usageLogRevisionKey(snapshot.revision)}\0${effectiveReadLimit}`,
         expiresAt: usageSummaryExpiresAt(snapshot.entries, range, surface, now),
+        revisionReadAt,
         summary,
       });
       return jsonResponse(summary);
@@ -227,6 +243,10 @@ export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Res
         days: [],
         models: [],
         providers: [],
+        historyTruncated: false,
+        truncatedPrefixBytes: 0,
+        entriesTruncated: false,
+        entriesDropped: 0,
         error: "read_failed",
       });
     }
@@ -248,7 +268,7 @@ export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Res
 
   if (url.pathname === "/api/storage/cleanup/preview" && req.method === "POST") {
     let body: { percent?: unknown };
-    try { body = await req.json(); } catch { return jsonResponse({ error: "invalid_json" }, 400); }
+    try { body = await readManagementJsonBody(req); } catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid_json" }, 400); }
     const percent = typeof body?.percent === "number" ? body.percent : Number.NaN;
     if (!Number.isFinite(percent) || percent < 0 || percent > 100) {
       return jsonResponse({ error: "invalid_percent" }, 400);
@@ -272,7 +292,7 @@ export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Res
 
   if (url.pathname === "/api/storage/cleanup" && req.method === "POST") {
     let body: { percent?: unknown; mode?: unknown; digest?: unknown; _test?: unknown };
-    try { body = await req.json(); } catch { return jsonResponse({ error: "invalid_json" }, 400); }
+    try { body = await readManagementJsonBody(req); } catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid_json" }, 400); }
     const percent = typeof body?.percent === "number" ? body.percent : Number.NaN;
     if (!Number.isFinite(percent) || percent < 0 || percent > 100) {
       return jsonResponse({ error: "invalid_percent" }, 400);
@@ -373,7 +393,7 @@ export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Res
 
   if (url.pathname === "/api/storage/trash/restore" && req.method === "POST") {
     let body: { id?: unknown };
-    try { body = await req.json(); } catch { return jsonResponse({ error: "invalid_json" }, 400); }
+    try { body = await readManagementJsonBody(req); } catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid_json" }, 400); }
     const id = typeof body?.id === "string" ? body.id : "";
     if (!id.trim()) {
       return jsonResponse({ error: "invalid_trash", message: "Trash entry id is required." }, 400);
@@ -453,7 +473,7 @@ export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Res
 
   if (url.pathname === "/api/storage/cleanup-policy" && req.method === "PUT") {
     let raw: unknown;
-    try { raw = await req.json(); } catch { return jsonResponse({ error: "invalid_json" }, 400); }
+    try { raw = await readManagementJsonBody(req); } catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid_json" }, 400); }
     const previous = normalizeStorageCleanupPolicy(config.storageCleanupPolicy);
     const parsed = parseStorageCleanupPolicyInput(raw, previous);
     if (!parsed.ok) return jsonResponse({ error: parsed.error }, 400);

package/src/server/management/model-routes.ts

@@ -31,6 +31,7 @@ function readInputModalities(raw: unknown): { values?: string[]; error?: string
 }
 import type { CatalogModel } from "../../codex/catalog";
 import { catalogModelSlug, disabledNativeSlugs, invalidateCodexModelsCache, nativeModelRows, uniqueCatalogModelsForPublicList } from "../../codex/catalog";
+import { CatalogGatherBusyError } from "../../codex/catalog/provider-fetch";
 import { getProviderLiveModelCount } from "../../codex/model-cache";
 import {
   DEFAULT_SUBAGENT_MODELS,
@@ -85,10 +86,126 @@ import { estimateComboCost, estimateRequestCost, normalizeCostTokens, tokensPerS
 import type { PersistedUsageAttempt } from "../../usage/log";
 import { isAllowedRequestOrigin, jsonResponse, providerManagementConfigError, publicProviderBaseUrl, safeConfigDTO, corsHeaders } from "../auth-cors";
 import { applySystemEnvToggle } from "../system-env";
+import {
+  EXPORT_CLIENTS,
+  EXPORT_CLIENT_IDS,
+  OPENCODE_PROVIDER_ID,
+  buildClientConfig,
+  isExportClientId,
+  opencodeProxyBaseUrl,
+} from "../../clients/config-export";
+import type {
+  ExportClientId,
+  ExportModel,
+  OpencodeGeneratedConfig,
+  PiGeneratedConfig,
+} from "../../clients/config-export";
 
 import { isPlainRecord, parseDebugLogQuery, tokPerSecondResult, unavailableCostReason, costResult, requestLogDto, stripRegistryOnlyStaticHeaders, fetchAllModels } from "./shared";
 import type { MetricUnavailableReason, TokPerSecondResult, CostEstimateReason, CostResult, MetricSource } from "./shared";
 import type { ManagementContext } from "./context";
+import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
+
+/**
+ * One row of the `/api/models` list. Routed rows spread a `CatalogModel`, so the shape is
+ * that model plus the identity/visibility fields this boundary computes for every row
+ * regardless of source. `disabled` is always present; the rest vary by row origin.
+ */
+type ManagementModelRow = Partial<CatalogModel> & {
+  provider: string;
+  id: string;
+  namespaced: string;
+  disabled: boolean;
+  native?: boolean;
+  custom?: boolean;
+  customId?: string;
+};
+
+/**
+ * The exact row list `/api/models` returns. Extracted so `/api/client-config` exports the
+ * models the GUI's Models tab shows — including this function's `disabled` computation,
+ * which the export core (src/clients/config-export.ts) deliberately does not perform.
+ */
+async function listManagementModelRows(config: OcxConfig): Promise<ManagementModelRow[]> {
+  const models = await fetchAllModels(config);
+  const disabled = new Set(config.disabledModels ?? []);
+  // Native GPT passthrough rows lead (provider "openai", bare-slug namespaced ids): sourced
+  // from the static supported set so a disabled model stays listed and re-enableable.
+  const native: ManagementModelRow[] = nativeModelRows(config).map(row => ({
+    provider: "openai",
+    id: row.slug,
+    namespaced: row.slug,
+    disabled: row.disabled,
+    native: true,
+    ...(row.contextWindow !== undefined ? { contextWindow: row.contextWindow } : {}),
+  }));
+  const customModels: ManagementModelRow[] = (config.customModels ?? []).map(cm => {
+    const namespaced = routedSlug(cm.provider, cm.modelId);
+    return {
+      provider: cm.provider,
+      id: cm.modelId,
+      namespaced,
+      disabled: [...disabled].some(stored => slugEquals(stored, cm.provider, cm.modelId)),
+      custom: true,
+      customId: cm.id,
+      displayName: cm.displayName,
+      ...(cm.contextWindow ? { contextWindow: cm.contextWindow } : {}),
+      ...(cm.inputModalities ? { inputModalities: cm.inputModalities } : {}),
+    };
+  });
+  const publicModels = uniqueCatalogModelsForPublicList(models);
+  const comboNamespaced = new Set(
+    publicModels.filter(model => model.provider === "combo").map(catalogModelSlug),
+  );
+  const visibleCustomModels = customModels.filter(model => !comboNamespaced.has(model.namespaced));
+  // Custom metadata wins when a physical live/static row resolves to the same Codex-facing
+  // slug, while a combo keeps the same precedence it has in routing and /v1/models.
+  const customNamespaced = new Set(visibleCustomModels.map(c => c.namespaced));
+  const dedupedRouted = publicModels.map((m): ManagementModelRow | null => {
+    // Codex-facing slug (one "/", slug-codec); disabledModels compares tolerate both forms.
+    const namespaced = catalogModelSlug(m);
+    if (m.provider !== "combo" && customNamespaced.has(namespaced)) return null;
+    const contextCap = providerContextCap(config, m.provider);
+    return {
+      ...m,
+      namespaced,
+      disabled: [...disabled].some(stored => (
+        stored === namespaced || slugEquals(stored, m.provider, m.id)
+      )),
+      ...(contextCap !== undefined ? { contextCap, contextCapped: m.contextCapped === true } : {}),
+    };
+  }).filter((row): row is ManagementModelRow => row !== null);
+  return [...native, ...dedupedRouted, ...visibleCustomModels];
+}
+
+/** `/api/models` row → the narrower input the client-config serializers accept. */
+function toExportModel(row: ManagementModelRow): ExportModel {
+  return {
+    namespaced: row.namespaced,
+    provider: row.provider,
+    id: row.id,
+    ...(row.native ? { native: true } : {}),
+    ...(row.displayName ? { displayName: row.displayName } : {}),
+    ...(row.contextWindow !== undefined ? { contextWindow: row.contextWindow } : {}),
+    ...(row.inputModalities ? { inputModalities: row.inputModalities } : {}),
+  };
+}
+
+/**
+ * Counts read back off the SERIALIZED document rather than recomputed from the input rows.
+ * `modelsWithoutLimits` drives a GUI line claiming "these models ship without limits", so it
+ * has to describe the bytes the user actually receives — a parallel reimplementation of the
+ * core's "authoritative context window" rule would be free to drift from it silently.
+ */
+function summarizeExportedModels(client: ExportClientId, document: unknown): { modelCount: number; modelsWithoutLimits: number } {
+  if (client === "opencode") {
+    const models = (document as OpencodeGeneratedConfig).provider[OPENCODE_PROVIDER_ID].models;
+    const entries = Object.values(models);
+    return { modelCount: entries.length, modelsWithoutLimits: entries.filter(entry => entry.limit === undefined).length };
+  }
+  const models = (document as PiGeneratedConfig).providers[OPENCODE_PROVIDER_ID].models;
+  return { modelCount: models.length, modelsWithoutLimits: models.filter(entry => entry.contextWindow === undefined).length };
+}
 
 export async function handleModelRoutes(ctx: ManagementContext): Promise<Response | null> {
   const { req, url, config, deps, refreshCodexCatalogBestEffort, syncClaudeAgentDefsBestEffort } = ctx;
@@ -113,62 +230,65 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
   }
 
   if (url.pathname === "/api/models" && req.method === "GET") {
-    const models = await fetchAllModels(config);
-    const disabled = new Set(config.disabledModels ?? []);
-    // Native GPT passthrough rows lead (provider "openai", bare-slug namespaced ids): sourced
-    // from the static supported set so a disabled model stays listed and re-enableable.
-    const native = nativeModelRows(config).map(row => ({
-      provider: "openai",
-      id: row.slug,
-      namespaced: row.slug,
-      disabled: row.disabled,
-      native: true,
-      ...(row.contextWindow !== undefined ? { contextWindow: row.contextWindow } : {}),
-    }));
-    const customModels = (config.customModels ?? []).map(cm => {
-      const namespaced = routedSlug(cm.provider, cm.modelId);
-      return {
-        provider: cm.provider,
-        id: cm.modelId,
-        namespaced,
-        disabled: [...disabled].some(stored => slugEquals(stored, cm.provider, cm.modelId)),
-        custom: true,
-        customId: cm.id,
-        displayName: cm.displayName,
-        ...(cm.contextWindow ? { contextWindow: cm.contextWindow } : {}),
-        ...(cm.inputModalities ? { inputModalities: cm.inputModalities } : {}),
-      };
+    return jsonResponse(await listManagementModelRows(config));
+  }
+
+  /**
+   * Client config document for OpenCode / Pi, built from the SAME function `ocx export`
+   * calls, so the bytes a user downloads here and the bytes they pipe from the CLI cannot
+   * disagree. Read-only: this route never writes the user's client config.
+   */
+  if (url.pathname === "/api/client-config" && req.method === "GET") {
+    const requested = url.searchParams.get("client")?.trim() ?? "";
+    if (!isExportClientId(requested)) {
+      return jsonResponse(
+        { error: `client must be one of: ${EXPORT_CLIENT_IDS.join(", ")}` },
+        400,
+        req,
+        config,
+      );
+    }
+    const spec = EXPORT_CLIENTS[requested];
+    let rows: ManagementModelRow[];
+    try {
+      rows = await listManagementModelRows(config);
+    } catch (error) {
+      // A partial or empty `models` block reads as a valid config while offering nothing,
+      // so a catalog failure is surfaced as unavailable rather than serialized. The
+      // catalog-busy error keeps its own 503 from handleManagementAPI.
+      if (error instanceof CatalogGatherBusyError) throw error;
+      return jsonResponse(
+        { error: `model catalog unavailable: ${error instanceof Error ? error.message : String(error)}` },
+        503,
+        req,
+        config,
+      );
+    }
+    // The export core does not filter visibility — it serializes what it is given. A model the
+    // user disabled in the Models tab is absent from /v1/models, so exporting it would hand the
+    // client a selector the proxy refuses to route.
+    const models = rows.filter(row => !row.disabled).map(toExportModel);
+    const document = buildClientConfig(requested, {
+      baseUrl: opencodeProxyBaseUrl(Number(url.port) || config.port, config.hostname),
+      models,
+      config,
     });
-    const publicModels = uniqueCatalogModelsForPublicList(models);
-    const comboNamespaced = new Set(
-      publicModels.filter(model => model.provider === "combo").map(catalogModelSlug),
-    );
-    const visibleCustomModels = customModels.filter(model => !comboNamespaced.has(model.namespaced));
-    // Custom metadata wins when a physical live/static row resolves to the same Codex-facing
-    // slug, while a combo keeps the same precedence it has in routing and /v1/models.
-    const customNamespaced = new Set(visibleCustomModels.map(c => c.namespaced));
-    const dedupedRouted = publicModels.map(m => {
-      // Codex-facing slug (one "/", slug-codec); disabledModels compares tolerate both forms.
-      const namespaced = catalogModelSlug(m);
-      if (m.provider !== "combo" && customNamespaced.has(namespaced)) return null;
-      const contextCap = providerContextCap(config, m.provider);
-      return {
-        ...m,
-        namespaced,
-        disabled: [...disabled].some(stored => (
-          stored === namespaced || slugEquals(stored, m.provider, m.id)
-        )),
-        ...(contextCap !== undefined ? { contextCap, contextCapped: m.contextCapped === true } : {}),
-      };
-    }).filter(Boolean);
-    return jsonResponse([...native, ...dedupedRouted, ...visibleCustomModels]);
+    return jsonResponse({
+      client: spec.id,
+      filename: spec.filename,
+      destination: spec.destination(process.env),
+      apiKeyEnv: spec.apiKeyEnv,
+      exportHint: spec.exportHint,
+      ...summarizeExportedModels(requested, document),
+      config: document,
+    }, 200, req, config);
   }
 
   // Enable/disable models: which routed models Codex sees. PUT hides them from the catalog +
   // /v1/models and invalidates Codex's 5-min models cache so it applies on the next turn.
   if (url.pathname === "/api/disabled-models" && req.method === "PUT") {
     let body: { models?: unknown };
-    try { body = await req.json(); } catch { return jsonResponse({ error: "invalid JSON body" }, 400); }
+    try { body = await readManagementJsonBody(req); } catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid JSON body" }, 400); }
     const disabled = Array.isArray(body.models) ? body.models.filter((m): m is string => typeof m === "string") : [];
     config.disabledModels = disabled;
     persistConfig(config);
@@ -181,7 +301,7 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
   // state. Native rows only use the blocklist; routed/custom rows also join a non-empty allowlist.
   if (url.pathname === "/api/model-visibility" && req.method === "PUT") {
     let parsedBody: unknown;
-    try { parsedBody = await req.json(); } catch { return jsonResponse({ error: "invalid JSON body" }, 400); }
+    try { parsedBody = await readManagementJsonBody(req); } catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid JSON body" }, 400); }
     if (!isPlainRecord(parsedBody)) return jsonResponse({ error: "invalid model visibility request" }, 400);
     const body = parsedBody;
     const scope = body.scope === "models" || body.scope === "provider" ? body.scope : null;
@@ -281,7 +401,7 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
 
   if (url.pathname === "/api/custom-models" && req.method === "POST") {
     let body: { provider?: unknown; modelId?: unknown; displayName?: unknown; contextWindow?: unknown; inputModalities?: unknown };
-    try { body = await req.json(); } catch { return jsonResponse({ error: "invalid JSON body" }, 400); }
+    try { body = await readManagementJsonBody(req); } catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid JSON body" }, 400); }
     const provider = typeof body.provider === "string" ? body.provider.trim() : "";
     const modelId = typeof body.modelId === "string" ? body.modelId.trim() : "";
     if (!provider || !modelId) return jsonResponse({ error: "provider and modelId are required" }, 400);
@@ -319,7 +439,7 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
     let id: string;
     try { id = decodeURIComponent(customPutMatch[1]); } catch { return jsonResponse({ error: "invalid id encoding" }, 400); }
     let body: { displayName?: unknown; contextWindow?: unknown; inputModalities?: unknown; modelId?: unknown };
-    try { body = await req.json(); } catch { return jsonResponse({ error: "invalid JSON body" }, 400); }
+    try { body = await readManagementJsonBody(req); } catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid JSON body" }, 400); }
     const list = config.customModels ?? [];
     const idx = list.findIndex(cm => cm.id === id);
     if (idx === -1) return jsonResponse({ error: "not found" }, 404);
@@ -386,7 +506,7 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
   }
   if (url.pathname === "/api/selected-models" && req.method === "PUT") {
     let body: { provider?: unknown; models?: unknown };
-    try { body = await req.json(); } catch { return jsonResponse({ error: "invalid JSON body" }, 400); }
+    try { body = await readManagementJsonBody(req); } catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid JSON body" }, 400); }
     const provider = typeof body.provider === "string" ? body.provider : "";
     if (!provider || !hasOwnProvider(config.providers, provider)) {
       return jsonResponse({ error: "unknown provider" }, provider ? 404 : 400);