@bitkyc08/opencodex 2.80.0 → 2.81.0

package/src/server/management/provider-instance-ownership.ts

@@ -0,0 +1,44 @@
+import { isDeepStrictEqual } from "node:util";
+import type { OcxProviderConfig } from "../../types";
+import type { ProviderEditorProviderDTO } from "../auth-cors";
+import { anthropicInstanceRowShapeMatches } from "../../providers/anthropic-instance-id";
+import { assertAnthropicInstanceLoginConfig } from "../../oauth/store-anthropic-instance";
+
+/** Preset publication may create B, but may never take over an existing custom row. */
+export function anthropicInstancePublicationError(name: string, next: OcxProviderConfig, existing: OcxProviderConfig | undefined): string | undefined {
+  if (name === "anthropic2" && anthropicInstanceRowShapeMatches(name, next)) {
+    try { assertAnthropicInstanceLoginConfig({ providers: existing ? { [name]: existing } : {} }, name); }
+    catch { return "cannot add Pool 2 over an existing custom provider or unreadable configuration; resolve it first"; }
+  }
+  return undefined;
+}
+
+/** Full form edits omit provenance; preserve only an already owned compatible row. */
+export function preserveAnthropicInstanceMarker(name: string, next: OcxProviderConfig, existing: OcxProviderConfig | undefined): void {
+  if (name !== "anthropic2" || Object.hasOwn(next, "anthropicOAuthInstance")) return;
+  if (anthropicInstanceRowShapeMatches(name, existing) && next.adapter === "anthropic" && next.authMode === "oauth") {
+    next.anthropicOAuthInstance = "anthropic2";
+  }
+}
+
+export function mergeProviderEditorRow(
+  persisted: OcxProviderConfig | undefined,
+  baseline: ProviderEditorProviderDTO | undefined,
+  next: ProviderEditorProviderDTO,
+): OcxProviderConfig {
+  const merged = structuredClone(persisted ?? {}) as Record<string, unknown>;
+  const fields = new Set([...Object.keys(baseline ?? {}), ...Object.keys(next)]);
+  for (const field of fields) {
+    const baselineHasField = baseline !== undefined && Object.hasOwn(baseline, field);
+    const nextHasField = Object.hasOwn(next, field);
+    if (
+      baselineHasField === nextHasField
+      && (!baselineHasField || isDeepStrictEqual(baseline[field], next[field]))
+    ) {
+      continue;
+    }
+    if (nextHasField) merged[field] = structuredClone(next[field]);
+    else delete merged[field];
+  }
+  return merged as unknown as OcxProviderConfig;
+}

package/src/server/management/provider-routes.ts

@@ -40,6 +40,7 @@ import { commitProviderPatch } from "./provider-patch-transaction";
 import { captureConfigTopLevelRollback } from "../../config/rebase-provenance";
 import { canonicalAutoReviewModelKey, mergeModelPinnedEfforts, modelPinnedEffortsConfigError, pinnedReasoningEffortConfigError } from "../../config/provider-validation";
 import { replaceProviderAccountSet } from "../../oauth/store";
+import { captureModelsOAuthTarget, mayResolveModelsOAuth, modelsOAuthTargetMatches } from "../../oauth/model-discovery-auth";
 import { providerDestinationResolvedError } from "../../lib/destination-policy";
 import { reconcileLiveStateStores } from "../../lib/state-store-registrations";
 import { ProviderOutboundPolicyError, providerOutboundGet, providerOutboundPost, providerRedirectError } from "../../lib/provider-outbound";
@@ -115,7 +116,6 @@ import {
   publicProviderBaseUrl,
   safeConfigDTO,
   type ProviderEditorConfigDTO,
-  type ProviderEditorProviderDTO,
 } from "../auth-cors";
 import { providerCatalogCapabilityConfigError } from "./provider-capability-config";
 import { providerEmptyToolOutputConfigError } from "../../config/provider-validation";
@@ -138,6 +138,7 @@ import { isPlainRecord, parseDebugLogQuery, tokPerSecondResult, unavailableCostR
 import type { MetricUnavailableReason, TokPerSecondResult, CostEstimateReason, CostResult, MetricSource } from "./shared";
 import type { ManagementContext } from "./context";
 import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
+import { anthropicInstancePublicationError, mergeProviderEditorRow, preserveAnthropicInstanceMarker } from "./provider-instance-ownership";
 import { providerTlsProfileDiagnostic } from "../../lib/provider-tls-profile";
 
 type ProviderPatchApplication =
@@ -213,28 +214,6 @@ type ProviderEditorCandidateResult =
 
 type ProviderEditorMutationValue = ProviderEditorCandidateResult;
 
-function mergeProviderEditorRow(
-  persisted: OcxProviderConfig | undefined,
-  baseline: ProviderEditorProviderDTO | undefined,
-  next: ProviderEditorProviderDTO,
-): OcxProviderConfig {
-  const merged = structuredClone(persisted ?? {}) as Record<string, unknown>;
-  const fields = new Set([...Object.keys(baseline ?? {}), ...Object.keys(next)]);
-  for (const field of fields) {
-    const baselineHasField = baseline !== undefined && Object.hasOwn(baseline, field);
-    const nextHasField = Object.hasOwn(next, field);
-    if (
-      baselineHasField === nextHasField
-      && (!baselineHasField || isDeepStrictEqual(baseline[field], next[field]))
-    ) {
-      continue;
-    }
-    if (nextHasField) merged[field] = structuredClone(next[field]);
-    else delete merged[field];
-  }
-  return merged as unknown as OcxProviderConfig;
-}
-
 /** Build and validate a complete candidate without mutating the caller's snapshot. */
 function providerEditorCandidate(
   persisted: OcxConfig,
@@ -273,6 +252,8 @@ function providerEditorCandidate(
     const namespaceCollision = codexAccountNamespaceProviderCollisionError(candidate.codexAccountNamespaces, name);
     if (namespaceCollision) return { ok: false, status: 409, error: namespaceCollision, code: "provider_namespace_conflict" };
     const merged = mergeProviderEditorRow(persisted.providers[name], baseline.providers[name], publicProvider);
+    const markerCollision = anthropicInstancePublicationError(name, merged, persisted.providers[name]);
+    if (markerCollision) return { ok: false, status: 409, error: markerCollision, code: "anthropic_instance_collision" };
     const transportCandidate = providerTransportValidationCandidate(merged as unknown as Record<string, unknown>);
     // The editor merges onto the persisted row, so stored operator overlays (selectedModels,
     // disabled, …) ride along in the candidate. They are owned by their own write boundaries;
@@ -1172,6 +1153,9 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     const aliasOwnershipError = providerAliasOverlayOwnershipError(body.provider, existing);
     if (aliasOwnershipError) return jsonResponse({ error: aliasOwnershipError }, 400);
     const transportCandidate = providerTransportValidationCandidate(body.provider);
+    preserveAnthropicInstanceMarker(name, transportCandidate as unknown as OcxProviderConfig, existing);
+    const markerCollision = anthropicInstancePublicationError(name, transportCandidate as unknown as OcxProviderConfig, existing);
+    if (markerCollision) return jsonResponse({ error: markerCollision }, 409);
     const pinError = applyProviderPinFields(transportCandidate as unknown as OcxProviderConfig, body.provider, existing);
     if (pinError) return jsonResponse({ error: pinError }, 400);
     const providerError = providerManagementConfigError(name, transportCandidate)
@@ -1328,6 +1312,9 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     // DNS validation above awaits. Re-read the live row so a dedicated alias write that
     // completed during that wait remains authoritative instead of being overwritten by the
     // older ownership snapshot used to admit this POST.
+    const lateMarkerCollision = anthropicInstancePublicationError(name, prov, config.providers[name]);
+    if (lateMarkerCollision) return jsonResponse({ error: lateMarkerCollision }, 409);
+    preserveAnthropicInstanceMarker(name, prov, config.providers[name]);
     restorePersistedAliasOverlays(prov, config.providers[name]);
     const capabilities = Object.hasOwn(body.provider, "modelCapabilities")
       ? mergeModelCapabilities(undefined, prov.modelCapabilities)
@@ -1371,6 +1358,8 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     const rollback = pinsOwned ? captureConfigTopLevelRollback(config, ["defaultProvider", "modelDiscovery", "disabledModels"]) : undefined;
     let validationError: string | undefined;
     withConfigMutationLockSync(() => {
+      validationError = anthropicInstancePublicationError(name, candidate, config.providers[name]);
+      if (validationError) return;
       const liveTiers = config.providers[name]?.modelContextTiers;
       if (submittedModelContextTiers && liveTiers) candidate.modelContextTiers = Object.assign(Object.create(null), liveTiers, candidate.modelContextTiers ?? {});
       else if (!submittedModelContextTiers && liveTiers) candidate.modelContextTiers = { ...liveTiers };
@@ -1621,7 +1610,8 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     if (!name || !isValidProviderName(name) || !hasOwnProvider(config.providers, name)) {
       return jsonResponse({ error: "unknown provider" }, 404);
     }
-    const prov = config.providers[name]!;
+    const prov = { ...config.providers[name]! };
+    const authorizedTarget = captureModelsOAuthTarget(name, prov);
     if (prov.disabled) {
       return jsonResponse({ ok: false, error: "Provider is disabled", latencyMs: 0 });
     }
@@ -1646,10 +1636,10 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       // credential resolution/network access for providers such as Antigravity.
       return jsonResponse({ applicable: false, reason: "static_catalog", latencyMs: 0 });
     }
-    const { buildModelsRequest, getValidAccessTokenSnapshot, resolveModelsAuthToken } = await import("../../oauth");
+    const { buildModelsRequest, getModelsOAuthAccessSnapshot, resolveModelsAuthToken } = await import("../../oauth");
     const antigravity = effectiveGoogleMode(name, prov) === "cloud-code-assist";
-    const snapshot = prov.authMode === "oauth"
-      ? await getValidAccessTokenSnapshot(name).catch(() => undefined)
+    const snapshot = prov.authMode === "oauth" && mayResolveModelsOAuth(name, config.providers[name])
+      ? await getModelsOAuthAccessSnapshot(name, prov).catch(() => undefined)
       : undefined;
     const apiKey = prov.authMode === "oauth" ? snapshot?.accessToken : await resolveModelsAuthToken(name, prov);
     if (prov.authMode === "oauth" && !apiKey) {
@@ -1735,7 +1725,10 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       // Same canonical-URL TUN transparency as catalog discovery: the registry's
       // own fixed discovery URL survives purely-benchmark (Clash/Surge/Mihomo
       // fake-IP) DNS without proxy env.
-      const outboundDependencies = { isCanonicalUrl: isRegistryModelDiscoveryUrl };
+      const outboundDependencies = { isCanonicalUrl: isRegistryModelDiscoveryUrl,
+        beforeSend: () => prov.authMode !== "oauth" || (mayResolveModelsOAuth(name, config.providers[name])
+          && modelsOAuthTargetMatches(name, config.providers[name], authorizedTarget)
+          && (name !== "anthropic2" || new URL(modelsUrl).href === authorizedTarget)) };
       const res = method === "POST"
         ? await providerOutboundPost(name, prov, modelsUrl, {
           headers,

package/src/server/management/route-registry.ts

@@ -231,6 +231,8 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "POST", path: "/api/client-integrations/restore", module: "server/management/integration-routes", mutates: true },
   { method: "POST", path: "/api/client-integrations/preview", module: "server/management/integration-routes", mutates: false },
   { method: "POST", path: "/api/client-integrations/restore/preview", module: "server/management/integration-routes", mutates: false },
+  { method: "POST", path: "/api/client-integrations/commandcode/restore", module: "server/management/integration-routes", mutates: true },
+  { method: "POST", path: "/api/client-integrations/commandcode/restore/preview", module: "server/management/integration-routes", mutates: false },
   // server/management/lab-automation-routes
   { method: "GET", path: "/api/lab/automation", module: "server/management/lab-automation-routes", mutates: false, exempt: { reason: "local-transport", why: "ocx lab reads the same rows from the local SQLite projection; src/cli/lab.ts imports ../lab/query directly and never fetches /api/lab." } },
   { method: "GET", path: "/api/lab/automation/runs", module: "server/management/lab-automation-routes", mutates: false, exempt: { reason: "local-transport", why: "ocx lab reads the same rows from the local SQLite projection; src/cli/lab.ts imports ../lab/query directly and never fetches /api/lab." } },
@@ -324,7 +326,7 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "PATCH", path: "/api/keys", module: "server/management/oauth-account-routes", mutates: true },
   { method: "PATCH", path: "/api/oauth/accounts/pool", module: "server/management/oauth-account-routes", mutates: true },
   { method: "POST", path: "/api/keys", module: "server/management/oauth-account-routes", mutates: true },
-  { method: "POST", path: "/api/keys/reveal", module: "server/management/oauth-account-routes", mutates: false, exempt: { reason: "session-only", why: "Revealing a data key requires the gui-session principal; the admin token is refused." } },
+  { method: "POST", path: "/api/keys/reveal", module: "server/management/oauth-account-routes", mutates: false, exempt: { reason: "session-only", why: "Stored-key reads require a current pairing or trusted Tailscale-identity session; automatic loopback sessions and admin tokens are refused." } },
   { method: "POST", path: "/api/keys/rotate", module: "server/management/oauth-account-routes", mutates: true },
   { method: "POST", path: "/api/keys/rotate/commit", module: "server/management/oauth-account-routes", mutates: true },
   { method: "POST", path: "/api/oauth/accounts/clear-cooldown", module: "server/management/oauth-account-routes", mutates: true },

package/src/server/management/routing-profile-routes.ts

@@ -63,7 +63,7 @@ function parseEvidence(raw: unknown): { evidence: PolicyRequestEvidence; ok: boo
   return { evidence, ok: true };
 }
 
-function parseCandidateEvidence(raw: unknown): PolicyCandidateEvidence[] | null {
+function parseCandidateEvidence(raw: unknown, config: OcxConfig): PolicyCandidateEvidence[] | null {
   if (!Array.isArray(raw)) return null;
   const out: PolicyCandidateEvidence[] = [];
   for (const item of raw) {
@@ -87,10 +87,10 @@ function parseCandidateEvidence(raw: unknown): PolicyCandidateEvidence[] | null
       // caller does not supply an explicit quota object, so a dry-run following
       // the documented shape reports the same cached account quota as routing.
       ...(item.quota === undefined && typeof item.codexAccountId === "string"
-        ? { quota: quotaEvidenceForCandidate({ provider, model, codexAccountId: item.codexAccountId }) }
+        ? { quota: quotaEvidenceForCandidate({ provider, model, codexAccountId: item.codexAccountId }, config) }
         : {}),
       ...(item.quota === undefined && typeof item.accountRef === "string" && typeof item.codexAccountId !== "string"
-        ? { quota: quotaEvidenceForCandidate({ provider, model, accountRef: item.accountRef }) }
+        ? { quota: quotaEvidenceForCandidate({ provider, model, accountRef: item.accountRef }, config) }
         : {}),
     });
   }
@@ -392,7 +392,7 @@ export async function handleRoutingProfileRoutes(ctx: ManagementContext): Promis
     if (labActivationRequired(config, getConfigDir())) activateLab(config, getConfigDir());
     const candidateEvidence = body.candidates === undefined
       ? assembleCandidateEvidence(config, resolvedProfile, now)
-      : parseCandidateEvidence(body.candidates);
+      : parseCandidateEvidence(body.candidates, config);
     if (candidateEvidence === null) {
       return jsonResponse({ error: { code: "invalid_candidates", message: "candidates must be an array of evidence objects" } }, 400, req, config);
     }

package/src/server/management/system-restart.ts

@@ -1,8 +1,8 @@
 /**
  * Dashboard memory-card drain-and-restart (#563).
  *
- * Longer than POST /api/stop's short drain: waits up to 60s for active turns,
- * then respawns. Never runs restoreNativeCodex / stripGrokConfig — this is a
+ * Waits up to 60s for active turns unless a manual API caller explicitly opts
+ * into a shorter grace, with the existing 60s cleanup watchdog, then respawns. Never runs restoreNativeCodex / stripGrokConfig — this is a
  * recycle to reclaim RSS, not a teardown.
  *
  * Respawn policy (matches real supervisor configs in src/service.ts):
@@ -37,6 +37,7 @@
  *   Checked before the service rule: that app, not a service manager, is the parent.
  */
 import {
+  abortAndReleaseAllTurns,
   acquireTemporaryDrain,
   beginShutdownDrain,
   drainAndShutdown,
@@ -64,8 +65,11 @@ import { spawnReplacementStart } from "../restart-replacement";
 export { MEMORY_DRAIN_RESTART_MS, REPLACEMENT_READY_TIMEOUT_MS } from "../../lib/system-restart-contract";
 export { waitForReplacementReady, type ReplacementReadinessIo } from "../restart-replacement";
 export const DEADLINE_LISTENER_STOP_TIMEOUT_MS = 5_000;
+const RESTART_RESPONSE_FLUSH_DELAY_MS = 200;
 
 export interface SystemRestartIo {
+  /** Cancel and release admitted turns without stopping the listener or process. */
+  abortActiveTurns?: () => void;
   acquireTemporaryDrain?: () => { release(): void } | null;
   drainAndShutdown?: typeof drainAndShutdown;
   /** True when a background service can actually respawn this process after exit(1). */
@@ -92,6 +96,11 @@ export interface SystemRestartIo {
   now?: () => number;
 }
 
+export interface SystemRestartOptions {
+  /** Explicit API opt-in; omission preserves the existing 60s drain. */
+  drainGraceMs?: number;
+}
+
 export interface SystemRestartAdmission {
   /** Only the caller that created this pending restart receives its veto. */
   onAccepted?: (veto: () => void) => void;
@@ -100,8 +109,9 @@ export interface SystemRestartAdmission {
 }
 
 let restartIo: SystemRestartIo = {};
-/** Prevents double-scheduling in the 200ms window before drainAndShutdown sets draining. */
+/** Prevents double-scheduling during the 200ms response-flush window. */
 let restartAccepted = false;
+let acceptedDrainGraceMs = MEMORY_DRAIN_RESTART_MS;
 
 type RestartDrainOutcome = "completed" | "failed" | "rejected" | "deadline";
 type BoundedSettlementOutcome = "completed" | "rejected" | "deadline";
@@ -173,6 +183,7 @@ export function noteExplicitShutdownRequested(): void {
 export function setSystemRestartIoForTests(io: SystemRestartIo = {}): void {
   restartIo = io;
   restartAccepted = false;
+  acceptedDrainGraceMs = MEMORY_DRAIN_RESTART_MS;
   explicitShutdownRequested = false;
 }
 
@@ -324,10 +335,10 @@ async function completeDeadlineRestartHandoff(
 
 /**
  * Accept a drain-and-restart request. Returns immediately; the drain +
- * respawn runs on a short timer so the HTTP response can flush first.
+ * respawn waits 200ms for the HTTP response to flush; shorter grace cuts turns separately.
  * Idempotent while already draining: returns the accepted shape again.
  */
-export function acceptSystemRestart(io: SystemRestartIo = restartIo, admission: SystemRestartAdmission = {}): {
+export function acceptSystemRestart(io: SystemRestartIo = restartIo, admission: SystemRestartAdmission = {}, options: SystemRestartOptions = {}): {
   accepted: true;
   alreadyDraining: boolean;
   activeTurnCount: number;
@@ -337,16 +348,22 @@ export function acceptSystemRestart(io: SystemRestartIo = restartIo, admission:
     ?? io.isDraining
     ?? isShutdownDraining;
   const alreadyDraining = restartAccepted || shutdownActive();
+  const drainGraceMs = alreadyDraining
+    ? (restartAccepted ? acceptedDrainGraceMs : MEMORY_DRAIN_RESTART_MS)
+    : (options.drainGraceMs ?? MEMORY_DRAIN_RESTART_MS);
   const activeTurnCount = (io.getActiveTurnCount ?? getActiveTurnCount)();
   const schedule = io.schedule ?? ((fn, ms) => { setTimeout(() => { void fn(); }, ms); });
 
   if (!alreadyDraining) {
     restartAccepted = true;
+    acceptedDrainGraceMs = drainGraceMs;
     const automatic = Boolean(admission.onAccepted);
     const temporaryDrain = automatic
       ? (io.acquireTemporaryDrain ?? (() => acquireTemporaryDrain("automatic-restart")))()
       : null;
+    let cancelEarlyCut: (() => void) | undefined;
     const releasePending = () => {
+      cancelEarlyCut?.();
       temporaryDrain?.release();
       restartAccepted = false;
     };
@@ -363,13 +380,27 @@ export function acceptSystemRestart(io: SystemRestartIo = restartIo, admission:
       releasePending();
     });
     const now = io.now ?? Date.now;
-    const restartDeadlineMs = now() + MEMORY_DRAIN_RESTART_MS;
+    const acceptedAtMs = now();
+    const restartDeadlineMs = acceptedAtMs + MEMORY_DRAIN_RESTART_MS;
+    const drainDeadlineMs = acceptedAtMs + drainGraceMs;
+    const scheduleDeadline = io.scheduleDeadline ?? ((fn, ms) => {
+      const timer = setTimeout(fn, ms);
+      return () => clearTimeout(timer);
+    });
     // Reject new data-plane traffic immediately (503), before the 200ms response-flush delay.
     if (!automatic) {
       if (io.beginShutdownDrain) io.beginShutdownDrain();
       else if (io.setDraining) io.setDraining(true);
       else beginShutdownDrain();
     }
+    // A shorter grace cuts admitted turns at acceptance + grace, but listener stop
+    // and process exit must still wait for the full response-flush window.
+    if (!vetoed && drainGraceMs < RESTART_RESPONSE_FLUSH_DELAY_MS) {
+      cancelEarlyCut = scheduleDeadline(() => {
+        if (vetoed) return;
+        (io.abortActiveTurns ?? (() => abortAndReleaseAllTurns(new Error("server shutdown"))))();
+      }, drainGraceMs);
+    }
     schedule(async () => {
       if (vetoed) return;
       pending = false;
@@ -390,12 +421,11 @@ export function acceptSystemRestart(io: SystemRestartIo = restartIo, admission:
       // closes the listener and makes both the server ref and runtime metadata stale.
       const restartPort = (io.listenPort ?? resolveListenPort)();
       const drain = io.drainAndShutdown ?? drainAndShutdown;
-      const remainingMs = Math.max(0, restartDeadlineMs - now());
-      const drainPromise = Promise.resolve().then(() => drain(undefined, remainingMs));
-      const scheduleDeadline = io.scheduleDeadline ?? ((fn, ms) => {
-        const timer = setTimeout(fn, ms);
-        return () => clearTimeout(timer);
-      });
+      // Bound active/scoped-drain waiting independently of cleanup and readiness.
+      // A cut turn may already have executed upstream; never replay it automatically.
+      const drainPromise = Promise.resolve().then(
+        () => drain(undefined, Math.max(0, drainDeadlineMs - now())),
+      );
       const drainOutcome = await waitForRestartDrain(drainPromise, restartDeadlineMs, now, scheduleDeadline);
       if (!canHandoff()) return;
       const exitProcess = io.exitProcess ?? ((code: number) => { process.exit(code); });
@@ -451,13 +481,13 @@ export function acceptSystemRestart(io: SystemRestartIo = restartIo, admission:
       }
       (io.markRecycling ?? markRecyclingForExit)();
       exitProcess(drainOutcome === "failed" || drainOutcome === "rejected" ? 1 : 0);
-    }, 200);
+    }, RESTART_RESPONSE_FLUSH_DELAY_MS);
   }
 
   return {
     accepted: true,
     alreadyDraining,
     activeTurnCount,
-    drainTimeoutMs: MEMORY_DRAIN_RESTART_MS,
+    drainTimeoutMs: drainGraceMs,
   };
 }

package/src/server/management/system-routes.ts

@@ -30,6 +30,7 @@ import { inspectResponseSpillStorage, responseStateMetrics, type ResponseSpillDi
 import { appOwnedBytesSnapshot } from "../../lib/app-owned-memory";
 import { readWindowsReplaceRetryCounters } from "../../lib/windows-atomic-replace";
 import {
+  MEMORY_DRAIN_RESTART_MS,
   SYSTEM_RESTART_EXPECTED_PID_HEADER,
   parseExpectedSystemRestartPid,
 } from "../../lib/system-restart-contract";
@@ -46,6 +47,7 @@ import type {
 } from "../../codex/app-server-restart-service";
 import type { ManagementContext } from "./context";
 import { acceptSystemRestart } from "./system-restart";
+import { readOptionalManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
 
 const ENDPOINT_SAMPLE_LIMIT = 60;
 // The spill report reads the snapshot and walks the spill directory synchronously,
@@ -179,8 +181,28 @@ export async function handleSystemRoutes(ctx: ManagementContext): Promise<Respon
       }, 409, req, config);
     }
 
-    // Longer informed drain than /api/stop; does not tear down Codex/Grok injection.
-    const result = acceptSystemRestart();
+    let body: unknown;
+    try { body = await readOptionalManagementJsonBody(req); }
+    catch (error) {
+      rethrowManagementBodyTooLarge(error);
+      return jsonResponse({ success: false, error: "Invalid restart JSON body." }, 400, req, config);
+    }
+    if (!body || typeof body !== "object" || Array.isArray(body)) {
+      return jsonResponse({ success: false, error: "Invalid restart JSON body." }, 400, req, config);
+    }
+    const drainGraceMs = (body as Record<string, unknown>).drainGraceMs;
+    if (drainGraceMs !== undefined && (
+      typeof drainGraceMs !== "number" || !Number.isSafeInteger(drainGraceMs)
+      || drainGraceMs < 1 || drainGraceMs > MEMORY_DRAIN_RESTART_MS
+    )) {
+      return jsonResponse({ success: false, error: "drainGraceMs must be an integer from 1 to 60000." }, 400, req, config);
+    }
+    // The process capability signs the restart target, not this new body option.
+    if (drainGraceMs !== undefined && ctx.principal === "system-restart-capability") {
+      return jsonResponse({ success: false, error: "Short grace requires management authentication." }, 403, req, config);
+    }
+    // Omission retains the informed 60s drain; only an explicit API request shortens it.
+    const result = acceptSystemRestart(undefined, {}, { drainGraceMs });
     return jsonResponse({
       success: true,
       message: result.alreadyDraining

package/src/server/management/vision-sidecar-options.ts

@@ -8,7 +8,7 @@
  * the same as no gate at all.
  */
 import type { OcxConfig } from "../../types";
-import { findAnthropicVisionProvider, type AnthropicVisionProvider } from "../../vision";
+import { type AnthropicVisionProvider } from "../../vision";
 import { VISION_BACKENDS } from "../../vision/backends";
 import {
   modelAcceptsImageInput,
@@ -18,7 +18,7 @@ import {
   type VisionSidecarBackend,
 } from "../../vision/eligibility";
 import { pickerVisibleSidecarCandidates } from "../../sidecar/candidates";
-import { resolveSidecarAuth } from "../../sidecar/auth";
+import { sidecarOptionsAuth } from "./web-search-sidecar-options";
 
 /**
  * Backends whose executor could actually run (#2188 roadmap 170): openai
@@ -38,7 +38,7 @@ export function enabledVisionBackends(
   config: OcxConfig,
   anthropicSidecar: AnthropicVisionProvider | undefined,
 ): VisionSidecarBackend[] {
-  const auth = resolveSidecarAuth(config);
+  const auth = sidecarOptionsAuth(config, config.visionSidecar?.anthropicInstance);
   // Preserve the caller's resolution for the anthropic side: the descriptor
   // reads the shared auth module, but a caller that already resolved "no
   // executor" must not see anthropic options it cannot dispatch. The filter
@@ -52,7 +52,7 @@ export function enabledVisionBackends(
   // the UNIVERSAL sides: when neither resolves, both are offered so the picker
   // stays populated (permissive-unknown rule; test 6 pins it).
   if (!active.includes("openai") && !active.includes("anthropic")) {
-    return ["openai", "anthropic", ...active];
+    return ["openai", ...(config.visionSidecar?.anthropicInstance ? [] : ["anthropic" as const]), ...active];
   }
   return active;
 }
@@ -67,7 +67,7 @@ export function enabledVisionBackends(
  * pre-filtering here would deaden the gate (review F1: reject → allow flip).
  */
 export async function visionCandidateRows(config: OcxConfig): Promise<VisionCandidateModel[]> {
-  const auth = resolveSidecarAuth(config);
+  const auth = sidecarOptionsAuth(config, config.visionSidecar?.anthropicInstance);
   const all = await pickerVisibleSidecarCandidates(config, auth);
   return all.map(candidate => ({
     provider: candidate.provider,
@@ -158,10 +158,13 @@ export function visionDescriberRejection(
   config: OcxConfig,
   candidates: readonly VisionCandidateModel[],
 ): { error: string; allowed: string[] } {
+  const auth = sidecarOptionsAuth(config, config.visionSidecar?.anthropicInstance);
+  const anthropic = auth.anthropicProviderName && auth.anthropicProvider
+    ? { providerName: auth.anthropicProviderName, provider: auth.anthropicProvider, config } : undefined;
   return {
     error: `${field} "${requested}" cannot describe images: it has no image input support, or it is a model the vision sidecar describes FOR.`,
     // The rejection path is not hot, so it resolves the executor itself rather than
     // making every 400 caller thread one through.
-    allowed: visionModelOptionsFrom(config, candidates, findAnthropicVisionProvider(config)).map(option => option.value),
+    allowed: visionModelOptionsFrom(config, candidates, anthropic).map(option => option.value),
   };
 }

package/src/server/management/web-search-sidecar-options.ts

@@ -14,7 +14,9 @@
  * id outside (candidates ∪ auth slots) can never run and is refused.
  */
 import type { OcxConfig } from "../../types";
-import { AUTH_SLOT_MODELS, resolveSidecarAuth } from "../../sidecar/auth";
+import { AUTH_SLOT_MODELS, resolveSidecarAuth, resolveAnthropicSidecarAuth, resolveAnthropicHelperInstance, AnthropicHelperUnavailableError, type SidecarAuthState } from "../../sidecar/auth";
+import { ANTHROPIC_INSTANCE_IDS, isAnthropicInstanceId, type AnthropicInstanceId } from "../../providers/anthropic-instance-id";
+import { configuredAnthropicInstance } from "../../providers/anthropic-instance";
 import { pickerVisibleSidecarCandidates, type SidecarCandidate } from "../../sidecar/candidates";
 import { WEB_SEARCH_BACKENDS, webSearchSidecarCandidates } from "../../web-search/backends";
 import type { WebSearchBackendId } from "../../web-search/index";
@@ -24,6 +26,53 @@ import type { WebSearchBackendId } from "../../web-search/index";
 // simply never produce rows.
 export type WebSearchBackend = WebSearchBackendId;
 
+export function sidecarAnthropicPoolOptions(config: OcxConfig,
+  settings: { backend?: string; anthropicInstance?: AnthropicInstanceId }, parentProviderName?: string): {
+    backend?: string; parent?: AnthropicInstanceId; selected?: AnthropicInstanceId;
+    resolved?: AnthropicInstanceId; mixed: boolean; available: AnthropicInstanceId[];
+    code?: "anthropic_helper_unavailable";
+  } {
+  const parent = configuredAnthropicInstance(config, parentProviderName);
+  const available = ANTHROPIC_INSTANCE_IDS.filter(instance => resolveAnthropicSidecarAuth(config, instance) !== undefined);
+  const base = { ...(settings.backend ? { backend: settings.backend } : {}), ...(parent ? { parent } : {}), ...(settings.anthropicInstance ? { selected: settings.anthropicInstance } : {}),
+    mixed: !!parent && !!settings.anthropicInstance && parent !== settings.anthropicInstance, available };
+  if (settings.backend !== "anthropic") return base;
+  try {
+    const resolved = resolveAnthropicHelperInstance(config, { backendFamily: "anthropic",
+      anthropicInstance: settings.anthropicInstance, parentProviderName });
+    const legacy = resolved === undefined ? resolveSidecarAuth(config).anthropicProviderName : resolved;
+    return { ...base, ...(isAnthropicInstanceId(legacy) ? { resolved: legacy } : {}) };
+  } catch (error) {
+    if (!(error instanceof AnthropicHelperUnavailableError)) throw error;
+    return { ...base, code: error.code };
+  }
+}
+
+/** An unavailable explicit pool removes its executor; it never resumes legacy discovery. */
+export function sidecarOptionsAuth(config: OcxConfig, instance?: AnthropicInstanceId): SidecarAuthState {
+  try { return resolveSidecarAuth(config, instance); }
+  catch (error) {
+    if (!(error instanceof AnthropicHelperUnavailableError)) throw error;
+    // Preserve other backend defaults while removing all Anthropic executor authority.
+    const otherBackends = { ...config, providers: Object.fromEntries(Object.entries(config.providers)
+      .filter(([, provider]) => provider.adapter !== "anthropic")) };
+    return { isCodexAuth: resolveSidecarAuth(otherBackends).isCodexAuth, isAnthropicAuth: false };
+  }
+}
+
+/** Apply only the helper identity fields to a typed, isolated validation snapshot. */
+export function sidecarSettingsAfterPatch<T extends { backend?: string; model?: string; anthropicInstance?: AnthropicInstanceId }>(
+  stored: T | undefined, patch: Record<string, unknown>,
+): T {
+  const next = { ...stored } as T;
+  for (const key of ["backend", "model", "anthropicInstance"] as const) {
+    const value = patch[key];
+    if (value === null || (key === "model" && value === "")) delete next[key];
+    else if (value !== undefined) Object.assign(next, { [key]: value });
+  }
+  return next;
+}
+
 export interface WebSearchCandidateRow extends SidecarCandidate {
   /** Executor backend that admitted this exact candidate row. */
   backend: WebSearchBackend;
@@ -41,7 +90,7 @@ export interface WebSearchModelOption {
 
 /** The candidate rows the web-search executors can actually run right now. */
 export async function webSearchCandidateRows(config: OcxConfig): Promise<WebSearchCandidateRow[]> {
-  const auth = resolveSidecarAuth(config);
+  const auth = sidecarOptionsAuth(config, config.webSearchSidecar?.anthropicInstance);
   const all = await pickerVisibleSidecarCandidates(config, auth);
   return webSearchSidecarCandidates(config, auth, all).flatMap(candidate => {
    const descriptor = WEB_SEARCH_BACKENDS.find(entry =>

package/src/server/management-auth.ts

@@ -279,6 +279,8 @@ export interface ManagementSessionControl {
   isCurrent(req: Request, config: OcxConfig): boolean;
   /** Prove that the current browser session came from the operator-mediated pairing flow. */
   isPaired(req: Request, config: OcxConfig): boolean;
+  /** Revalidate independent session authority before disclosing stored data keys. */
+  canRevealDataKeys?(req: Request, config: OcxConfig): boolean;
 }
 
 export function createManagementSessionControl(state: ManagementAuthState): ManagementSessionControl {
@@ -307,6 +309,10 @@ export function createManagementSessionControl(state: ManagementAuthState): Mana
     isPaired(req: Request, config: OcxConfig): boolean {
       return currentSession(req, config)?.issuance === "pairing";
     },
+    canRevealDataKeys(req: Request, config: OcxConfig): boolean {
+      const issuance = currentSession(req, config)?.issuance;
+      return issuance === "pairing" || issuance === "tailscale-identity";
+    },
     revokeCurrent(req: Request): boolean {
       if (!state.available) return false;
       const credential = requestManagementCredential(req);

package/src/server/messages-native-eligibility.ts

@@ -13,6 +13,7 @@ import { credentialDomainFor } from "../protocols/opaque-state";
 import { resolveProtocolSettings } from "../protocols/settings";
 import type { RouteResult } from "../router";
 import type { OcxConfig } from "../types";
+import { configuredAnthropicInstance } from "../providers/anthropic-instance";
 import { requiresVisionPreprocessing } from "../vision";
 import { resolvePinnedEffort } from "./effort-policy";
 
@@ -94,7 +95,7 @@ function bridgeOnlyPolicyApplies(
 /**
  * The credential rule. A proxy-managed key is native since PF-08. An Anthropic OAuth account
  * is native only with `managedMessagesNativeOAuth` on (itself effective only with
- * `managedMessagesNative`), only for the `anthropic` provider the OAuth store serves, and only
+ * `managedMessagesNative`), only for a configured Anthropic OAuth instance, and only
  * to `api.anthropic.com`. Pool selection and recovery are resolved at native dispatch. `forward`
  * belongs to the caller.
  */
@@ -107,7 +108,7 @@ function credentialDeclineReason(
   if (provider.authMode === undefined || provider.authMode === "key") return undefined;
   if (provider.authMode !== "oauth") return "auth-mode-not-native";
   if (!resolveProtocolSettings(config, route.providerName).rollout.managedMessagesNativeOAuth) return "auth-mode-not-native";
-  if (route.providerName !== "anthropic") return "auth-mode-not-native";
+  if (!configuredAnthropicInstance(config, route.providerName)) return "auth-mode-not-native";
   if (!credentialDomainFor(provider)?.firstPartyAnthropic) return "auth-mode-not-native";
   return undefined;
 }