@bitkyc08/opencodex 2.80.0 → 2.82.0

package/src/server/management/anthropic-reset-grant-routes.ts

@@ -14,7 +14,11 @@
 import { jsonResponse } from "../auth-cors";
 import type { ManagementContext } from "./context";
 import { getValidAccessSnapshotForAccount } from "../../oauth";
-import { captureOAuthAccountSelection, listAccounts } from "../../oauth/store";
+import { configuredAnthropicInstance, isAnthropicInstanceId, type AnthropicInstanceId } from "../../providers/anthropic-instance";
+import { captureAnthropicPhysicalSendOwnership, anthropicPhysicalSendOwnershipIsCurrent } from "../../oauth/anthropic-send-ownership";
+import { anthropicCooldownRecoveryFor } from "../../providers/quota/anthropic-cooldown-recovery";
+import { captureProviderAccountQuotaEpoch } from "../../providers/quota/account-cache";
+import { captureOAuthAccountSelection, getAccountSet, getAccountCredentialWithStatus, listAccounts } from "../../oauth/store";
 import {
   ANTHROPIC_RESET_GRANT_ID_RE,
   AnthropicResetGrantError,
@@ -28,19 +32,20 @@ import {
   AnthropicResetLedgerError,
   anthropicOrgDigest,
   anthropicResetOperationExists,
+  anthropicResetJournalPathForInstance,
   beginAnthropicResetOperation,
   pendingAnthropicResetOperation,
   releaseAnthropicResetLease,
   settleAnthropicResetOperation,
 } from "../../providers/anthropic-reset-grant-ledger";
 
-const PROVIDER = "anthropic";
 const UUID_V4_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 
 const MESSAGES = {
   method_not_allowed: "Method not allowed",
   session_required: "Spending a reset requires a dashboard session.",
   invalid_json: "Request body must be JSON.",
+  invalid_provider: "No matching builtin Anthropic OAuth provider.",
   invalid_grant_id: "grantId is missing or malformed.",
   invalid_operation_id: "operationId must be a UUIDv4.",
   no_account: "No matching Anthropic OAuth account.",
@@ -60,6 +65,9 @@ const MESSAGES = {
 type ErrorCode = keyof typeof MESSAGES;
 
 export interface AnthropicResetGrantRouteDeps {
+  provider?: AnthropicInstanceId;
+  isCurrent?: () => boolean;
+  forProvider?: (provider: AnthropicInstanceId) => AnthropicResetGrantRouteDeps;
   fetchFn?: typeof globalThis.fetch;
   journalPath?: string;
   now?: () => number;
@@ -68,25 +76,64 @@ export interface AnthropicResetGrantRouteDeps {
   accessTokenFor: (accountId: string) => Promise<string>;
 }
 
-const defaultDeps: AnthropicResetGrantRouteDeps = {
-  listAccountIds: () => listAccounts(PROVIDER).map(account => account.id),
-  activeAccountId: () => captureOAuthAccountSelection(PROVIDER)?.accountId ?? null,
-  accessTokenFor: async accountId =>
-    (await getValidAccessSnapshotForAccount(PROVIDER, accountId, { requireUsableAccount: true })).accessToken,
-};
+function defaultDepsFor(ctx: ManagementContext, provider: AnthropicInstanceId): AnthropicResetGrantRouteDeps | null {
+  // One source: the live management config. A keeps its legacy reach without a providers row;
+  // B requires its configured builtin row. A fresh file load here would refuse on any drift.
+  const live = ctx.config;
+  const target = live.providers?.[provider];
+  if (target?.disabled || target && target.authMode !== "oauth" || configuredAnthropicInstance(live, provider) !== provider) return null;
+  const identity = JSON.stringify(target ?? null);
+  let owner: ReturnType<typeof captureAnthropicPhysicalSendOwnership> = null;
+  const targetCurrent = () => configuredAnthropicInstance(live, provider) === provider
+    && JSON.stringify(live.providers?.[provider] ?? null) === identity;
+  return {
+    // Only the journal path: the ledger's numeric `now` option is not the deps clock function.
+    provider, journalPath: anthropicResetJournalPathForInstance(provider),
+    listAccountIds: () => listAccounts(provider).map(account => account.id),
+    activeAccountId: () => captureOAuthAccountSelection(provider)?.accountId ?? null,
+    isCurrent: () => {
+      if (!targetCurrent() || !owner || !anthropicPhysicalSendOwnershipIsCurrent(owner)) return false;
+      const row = getAccountCredentialWithStatus(provider, owner.accountId);
+      return !!row && !row.paused && !row.needsReauth;
+    },
+    accessTokenFor: async accountId => {
+      const initial = getAccountSet(provider)?.accounts.find(row => row.id === accountId);
+      const recovery = anthropicCooldownRecoveryFor(provider);
+      const incarnation = recovery.reserveAnthropicAccountIncarnation(accountId);
+      const epoch = captureProviderAccountQuotaEpoch(provider);
+      const snapshot = await getValidAccessSnapshotForAccount(provider, accountId, { requireUsableAccount: true });
+      const current = getAccountSet(provider)?.accounts.find(row => row.id === accountId);
+      if (!initial || !current || initial.loginId !== current.loginId || initial.addedAt !== current.addedAt
+        || recovery.anthropicAccountIncarnation(accountId) !== incarnation || captureProviderAccountQuotaEpoch(provider) !== epoch) throw new Error("reset account replaced");
+      owner = captureAnthropicPhysicalSendOwnership(snapshot);
+      if (!targetCurrent() || !owner) throw new Error("reset owner changed");
+      return snapshot.accessToken;
+    },
+  };
+}
+
+function selectDeps(ctx: ManagementContext, requested: unknown, deps?: AnthropicResetGrantRouteDeps): AnthropicResetGrantRouteDeps | null {
+  const provider = requested === undefined || requested === null ? "anthropic" : requested;
+  if (!isAnthropicInstanceId(provider)) return null;
+  const selected = deps?.forProvider?.(provider) ?? deps;
+  // Legacy injected dependencies are A-only; B must explicitly bind its own journal.
+  if (selected) return (selected.provider ?? "anthropic") === provider
+    ? { journalPath: anthropicResetJournalPathForInstance(provider), ...selected, provider } : null;
+  return defaultDepsFor(ctx, provider);
+}
 
 function fail(ctx: ManagementContext, status: number, code: ErrorCode, extra: Record<string, unknown> = {}): Response {
   return jsonResponse({ error: { code, message: MESSAGES[code], ...extra } }, status, ctx.req, ctx.config);
 }
 
-function ledgerFailure(ctx: ManagementContext, error: unknown): Response {
-  if (error instanceof AnthropicResetLedgerError && error.code === "busy") return fail(ctx, 503, "ledger_busy");
-  return fail(ctx, 503, "ledger_unavailable");
+function ledgerFailure(ctx: ManagementContext, error: unknown, extra: Record<string, unknown> = {}): Response {
+  if (error instanceof AnthropicResetLedgerError && error.code === "busy") return fail(ctx, 503, "ledger_busy", extra);
+  return fail(ctx, 503, "ledger_unavailable", extra);
 }
 
-function readFailure(ctx: ManagementContext, error: unknown): Response {
-  if (error instanceof AnthropicResetGrantError && error.code === "auth") return fail(ctx, 401, "auth_failed");
-  return fail(ctx, 502, "upstream_unavailable");
+function readFailure(ctx: ManagementContext, error: unknown, extra: Record<string, unknown> = {}): Response {
+  if (error instanceof AnthropicResetGrantError && error.code === "auth") return fail(ctx, 401, "auth_failed", extra);
+  return fail(ctx, 502, "upstream_unavailable", extra);
 }
 
 function resolveAccountId(deps: AnthropicResetGrantRouteDeps, requested: unknown): string | null {
@@ -107,16 +154,19 @@ async function tokenFor(deps: AnthropicResetGrantRouteDeps, accountId: string):
 }
 
 async function handleRead(ctx: ManagementContext, deps: AnthropicResetGrantRouteDeps): Promise<Response> {
+  const receipt = { provider: deps.provider };
   const accountId = resolveAccountId(deps, ctx.url.searchParams.get("accountId") ?? undefined);
-  if (!accountId) return fail(ctx, 400, "no_account");
+  if (!accountId) return fail(ctx, 400, "no_account", receipt);
   const accessToken = await tokenFor(deps, accountId);
-  if (!accessToken) return fail(ctx, 401, "auth_failed");
+  if (!accessToken) return fail(ctx, 401, "auth_failed", receipt);
+  if (deps.isCurrent?.() === false) return fail(ctx, 401, "auth_failed", receipt);
   let status;
   try {
     status = await fetchAnthropicResetGrantStatus({ accessToken, fetchFn: deps.fetchFn });
   } catch (error) {
-    return readFailure(ctx, error);
+    return readFailure(ctx, error, receipt);
   }
+  if (deps.isCurrent?.() === false) return fail(ctx, 401, "auth_failed", receipt);
   let pendingOperation = null;
   let journalAvailable = true;
   try {
@@ -124,10 +174,10 @@ async function handleRead(ctx: ManagementContext, deps: AnthropicResetGrantRoute
   } catch {
     journalAvailable = false;
   }
-  return jsonResponse({ accountId, ...status, pendingOperation, journalAvailable }, 200, ctx.req, ctx.config);
+  return jsonResponse({ provider: deps.provider, accountId, ...status, pendingOperation, journalAvailable }, 200, ctx.req, ctx.config);
 }
 
-async function handleConsume(ctx: ManagementContext, deps: AnthropicResetGrantRouteDeps): Promise<Response> {
+async function handleConsume(ctx: ManagementContext, injected?: AnthropicResetGrantRouteDeps): Promise<Response> {
   if (ctx.principal !== "gui-session") return fail(ctx, 403, "session_required");
   let body: Record<string, unknown>;
   try {
@@ -137,21 +187,27 @@ async function handleConsume(ctx: ManagementContext, deps: AnthropicResetGrantRo
   } catch {
     return fail(ctx, 400, "invalid_json");
   }
+  const deps = selectDeps(ctx, body.provider, injected);
+  if (!deps) return fail(ctx, 400, "invalid_provider");
+  const provider = deps.provider;
+  const operationReceipt = { provider };
+  const scopedFail = (status: number, code: ErrorCode, extra: Record<string, unknown> = {}) => fail(ctx, status, code, { ...operationReceipt, ...extra });
   const { grantId, operationId } = body;
-  if (typeof grantId !== "string" || !ANTHROPIC_RESET_GRANT_ID_RE.test(grantId)) return fail(ctx, 400, "invalid_grant_id");
-  if (typeof operationId !== "string" || !UUID_V4_RE.test(operationId)) return fail(ctx, 400, "invalid_operation_id");
-  if (typeof body.accountId !== "string") return fail(ctx, 400, "no_account");
+  if (typeof grantId !== "string" || !ANTHROPIC_RESET_GRANT_ID_RE.test(grantId)) return scopedFail(400, "invalid_grant_id");
+  if (typeof operationId !== "string" || !UUID_V4_RE.test(operationId)) return scopedFail(400, "invalid_operation_id");
+  if (typeof body.accountId !== "string") return scopedFail(400, "no_account");
   const accountId = resolveAccountId(deps, body.accountId);
-  if (!accountId) return fail(ctx, 400, "no_account");
+  if (!accountId) return scopedFail(400, "no_account");
 
   const accessToken = await tokenFor(deps, accountId);
-  if (!accessToken) return fail(ctx, 401, "auth_failed");
+  if (!accessToken || deps.isCurrent?.() === false) return scopedFail(401, "auth_failed");
   let organizationUuid: string;
   try {
     organizationUuid = await fetchAnthropicOrganizationUuid({ accessToken, fetchFn: deps.fetchFn });
   } catch (error) {
-    return readFailure(ctx, error);
+    return readFailure(ctx, error, operationReceipt);
   }
+  if (deps.isCurrent?.() === false) return scopedFail(401, "auth_failed");
   const ledger = { journalPath: deps.journalPath, now: deps.now?.() };
 
   // A new operation must pass the spend gate on a fresh read. A same-id retry of
@@ -161,39 +217,40 @@ async function handleConsume(ctx: ManagementContext, deps: AnthropicResetGrantRo
   try {
     known = anthropicResetOperationExists(operationId, ledger);
   } catch (error) {
-    return ledgerFailure(ctx, error);
+    return ledgerFailure(ctx, error, operationReceipt);
   }
   if (!known) {
     let status;
     try {
       status = await fetchAnthropicResetGrantStatus({ accessToken, fetchFn: deps.fetchFn });
     } catch (error) {
-      return readFailure(ctx, error);
+      return readFailure(ctx, error, operationReceipt);
     }
     const blocker = anthropicResetGrantBlocker(status, grantId);
-    if (blocker) return fail(ctx, 409, "grant_not_usable", { reason: blocker });
+    if (blocker) return scopedFail(409, "grant_not_usable", { reason: blocker });
   }
 
   let begin;
+  if (deps.isCurrent?.() === false) return scopedFail(401, "auth_failed");
   try {
     begin = beginAnthropicResetOperation(
       { operationId, accountId, grantId, orgDigest: anthropicOrgDigest(organizationUuid) },
       { journalPath: deps.journalPath, now: deps.now?.() },
     );
   } catch (error) {
-    return ledgerFailure(ctx, error);
+    return ledgerFailure(ctx, error, operationReceipt);
   }
   switch (begin.kind) {
     case "replay":
       return jsonResponse(
-        { code: begin.code, replayed: true, resetsLeft: begin.resetsLeft, accountId, grantId, operationId },
+        { provider, code: begin.code, replayed: true, resetsLeft: begin.resetsLeft, accountId, grantId, operationId },
         200, ctx.req, ctx.config,
       );
-    case "identity-mismatch": return fail(ctx, 409, "operation_identity_mismatch");
-    case "in-flight": return fail(ctx, 409, "in_flight");
-    case "expired": return fail(ctx, 409, "unknown_outcome_expired");
-    case "unresolved-prior": return fail(ctx, 409, "unresolved_prior_operation", { pendingOperationId: begin.operationId });
-    case "capacity": return fail(ctx, 503, "ledger_capacity");
+    case "identity-mismatch": return scopedFail(409, "operation_identity_mismatch");
+    case "in-flight": return scopedFail(409, "in_flight");
+    case "expired": return scopedFail(409, "unknown_outcome_expired");
+    case "unresolved-prior": return scopedFail(409, "unresolved_prior_operation", { pendingOperationId: begin.operationId });
+    case "capacity": return scopedFail(503, "ledger_capacity");
     case "execute": break;
   }
 
@@ -206,7 +263,7 @@ async function handleConsume(ctx: ManagementContext, deps: AnthropicResetGrantRo
     try {
       releaseAnthropicResetLease(operationId, { journalPath: deps.journalPath, now: deps.now?.() });
     } catch { /* the lease expires on its own */ }
-    return fail(ctx, 502, "unknown_outcome", { operationId, grantId });
+    return scopedFail(502, "unknown_outcome", { operationId, grantId, accountId });
   }
   let settled;
   try {
@@ -216,13 +273,14 @@ async function handleConsume(ctx: ManagementContext, deps: AnthropicResetGrantRo
     );
   } catch {
     // Fail closed: the caller must not read this as a durable result.
-    return fail(ctx, 500, "journal_write_failed", { operationId, grantId });
+    return scopedFail(500, "journal_write_failed", { operationId, grantId, accountId });
   }
   // Report what the journal holds. An overlapping same-id attempt may have
   // settled first; its answer is the canonical one.
   const replayed = settled.code !== answer.code || settled.resetsLeft !== answer.resetsLeft;
   return jsonResponse(
     {
+      provider,
       code: settled.code,
       replayed,
       resetsLeft: settled.resetsLeft,
@@ -237,12 +295,13 @@ async function handleConsume(ctx: ManagementContext, deps: AnthropicResetGrantRo
 
 export async function handleAnthropicResetGrantRoutes(
   ctx: ManagementContext,
-  deps: AnthropicResetGrantRouteDeps = defaultDeps,
+  deps?: AnthropicResetGrantRouteDeps,
 ): Promise<Response | null> {
   const { pathname } = ctx.url;
   if (pathname === "/api/anthropic/reset-grants") {
     if (ctx.req.method !== "GET") return fail(ctx, 405, "method_not_allowed");
-    return handleRead(ctx, deps);
+    const selected = selectDeps(ctx, ctx.url.searchParams.get("provider"), deps);
+    return selected ? handleRead(ctx, selected) : fail(ctx, 400, "invalid_provider");
   }
   if (pathname === "/api/anthropic/reset-grants/consume") {
     if (ctx.req.method !== "POST") return fail(ctx, 405, "method_not_allowed");

package/src/server/management/codex-agent-role-routes.ts

@@ -1,6 +1,6 @@
 /**
  * Per-role model for omo (Codex / LazyCodex): `$CODEX_HOME/agents/<role>.toml` plus LazyCodex's
- * `codex.agents.<role>.model` mirror in omo.jsonc. Both halves exist only when LazyCodex is
+ * `"[codex]".agents.<role>` model and reasoning mirror in omo.jsonc. Both halves exist only when LazyCodex is
  * detected; Pi-based and OpenCode-based omo are never read here.
  *
  * Loaded on demand from `src/server/management-api.ts`, like the quota-reset handler, so a
@@ -40,6 +40,7 @@ export async function handleCodexAgentRoleRoutes(ctx: ManagementContext): Promis
       omoJsonc: { state: omoState.state },
       roles: roles.listCodexAgentRoleModels(codexHome).map(entry => ({
         ...entry,
+        effort: roles.readCodexAgentRoleEffort(entry.role, codexHome),
         omoJsoncModel: omoModels[entry.role] ?? null,
       })),
     }, 200, req, config);
@@ -114,7 +115,8 @@ export async function handleCodexAgentRoleRoutes(ctx: ManagementContext): Promis
   // The role TOML is what Codex obeys, so its write stands even when the omo mirror cannot follow.
   let omoStatus: ReturnType<typeof omo.writeOmoRoleModel> | "write_failed";
   try {
-    omoStatus = omo.writeOmoRoleModel(role, model, omo.omoJsoncPath());
+    const reasoning = effort === undefined ? undefined : omo.omoReasoningFor(effort);
+    omoStatus = omo.writeOmoRoleModel(role, model, omo.omoJsoncPath(), reasoning);
   } catch {
     omoStatus = "write_failed";
   }

package/src/server/management/codex-prompt-routes.ts

@@ -83,6 +83,7 @@ const WRITE_ERROR_STATUS: Record<WriteError, number> = {
   write_failed: 500,
   recovery_required: 409,
   locked: 409,
+  unsafe: 422,
 };
 
 /** Read-only view for the route test that asserts every mapping is a client error. */

package/src/server/management/codex-role-auto-assign.ts

@@ -58,6 +58,10 @@ async function modelCandidates(slugs: readonly string[], models: readonly Catalo
   ]);
   const nativeSlugs = catalog.listCatalogNativeSlugs();
   const routed = new Map(models.map(model => [catalog.catalogModelSlug(model), model]));
+  // A routed model that declares no levels still gets the ladder Codex shows for it, the same one
+  // the Models page lists, so its proposal carries an effort instead of none. An explicit empty
+  // ladder means the model takes no effort control, and the written catalog lists none for it.
+  const written = catalog.catalogModelLadders(slugs);
   const unitPrice = (provider: string, modelId: string): number | null => {
     const cost = resolveMatchedPrice(provider, modelId)?.cost4;
     return cost ? cost.input + cost.output : null;
@@ -65,11 +69,18 @@ async function modelCandidates(slugs: readonly string[], models: readonly Catalo
   return slugs.map(slug => {
     const row = routed.get(slug);
     if (row) {
+      const ladder = written.get(slug);
+      const efforts = Array.isArray(row.reasoningEfforts) ? row.reasoningEfforts : ladder?.efforts ?? [];
+      // A row without its own default keeps the one Codex shows, when that rung is on the ladder.
+      const shownDefault = ladder?.defaultEffort !== undefined && efforts.includes(ladder.defaultEffort)
+        ? ladder.defaultEffort
+        : undefined;
+      const defaultEffort = row.defaultReasoningEffort ?? shownDefault;
       return {
         model: slug,
         unitPrice: unitPrice(row.provider, row.id),
-        efforts: row.reasoningEfforts ?? [],
-        ...(row.defaultReasoningEffort ? { defaultEffort: row.defaultReasoningEffort } : {}),
+        efforts,
+        ...(defaultEffort ? { defaultEffort } : {}),
       };
     }
     if (nativeSlugs.includes(slug)) {

package/src/server/management/config-routes.ts

@@ -4,9 +4,12 @@ import { getMainAccountExternalUsageWarning } from "../../codex/main-account-ext
 import { getObservedMainQuotaIdentityKey } from "../../codex/main-account-cache";
 import { compactionRoutingSchema, memoryModelsSchema } from "../../config/schema/leaf-validators";
 import { compactionRecoverySchema } from "../../config/schema/compaction-recovery";
+import { anthropicSidecarPatchError } from "../../config/schema/anthropic-account-pool";
+import { isAnthropicInstanceId } from "../../providers/anthropic-instance-id";
 import { captureConfigTopLevelRollback } from "../../config/rebase-provenance";
 import type { IntegrationClientId } from "../../integrations/registry";
 import { randomUUID } from "node:crypto";
+import { isDeepStrictEqual } from "node:util";
 import { readFileSync } from "node:fs";
 import type { CatalogModel } from "../../codex/catalog";
 import { catalogModelSlug, invalidateCodexModelsCache, nativeContextLimits, nativeModelRows, uniqueCatalogModelsForPublicList } from "../../codex/catalog";
@@ -85,7 +88,6 @@ import { getProviderRegistryEntry } from "../../providers/registry";
 import { VISION_REASONING_EFFORTS, isVisionReasoningEffort } from "../../reasoning-effort";
 import { normalizeVisionReasoningForModel } from "../../vision/reasoning";
 import {
-  findAnthropicVisionProvider,
   isValidVisionTimeoutMs,
   MAX_VISION_TIMEOUT_MS,
   MIN_VISION_TIMEOUT_MS,
@@ -105,6 +107,7 @@ import {
   webSearchModelIsRejected,
   webSearchModelOptionsFrom,
   webSearchModelRejection,
+  sidecarAnthropicPoolOptions, sidecarOptionsAuth, sidecarSettingsAfterPatch,
 } from "./web-search-sidecar-options";
 import { validateXaiSearchOptions } from "../../web-search/xai-executor";
 import { getDebugLogEntries } from "../../lib/debug-log-buffer";
@@ -150,7 +153,9 @@ async function sidecarVisionResponseSettings(config: OcxConfig): Promise<{
   const vs = config.visionSidecar ?? {};
   // Match the runtime's one selected Anthropic executor for both backend fallback
   // and catalog reachability; resolving it once prevents the two projections drifting.
-  const anthropicSidecar = findAnthropicVisionProvider(config);
+  const auth = sidecarOptionsAuth(config, vs.anthropicInstance);
+  const anthropicSidecar = auth.isAnthropicAuth && auth.anthropicProviderName && auth.anthropicProvider
+    ? { providerName: auth.anthropicProviderName, provider: auth.anthropicProvider, config } : undefined;
   // The routed backend reports its own namespaced model verbatim: it is the
   // dispatched value, and collapsing it through the legacy resolver would
   // display a describer the runtime is not using (roadmap 190).
@@ -178,6 +183,17 @@ interface ClientIntegrationSyncOutcome {
   readonly profileId?: number;
 }
 
+/** Only the Desktop write's own applied markers may change during a background projection. */
+function clientProjectionConfig(config: OcxConfig): OcxConfig {
+  const snapshot = structuredClone(config);
+  const profile = snapshot.claudeCode?.desktopProfile;
+  if (profile) {
+    delete profile.appliedFingerprint;
+    delete profile.appliedAt;
+  }
+  return snapshot;
+}
+
 /**
  * Re-inject native clients that are switched ON and every file integration whose
  * OpenCodex ownership record is the operator's durable opt-in.
@@ -201,17 +217,41 @@ export async function syncEnabledClientIntegrations(
   config: OcxConfig,
   deps: Pick<ManagementContext["deps"],
     "fetchAllModels" | "refreshOwnedCatalogIntegrations" | "writeDesktop3pConfig"> = {},
+  options: { unattended?: { isCurrent: () => boolean } } = {},
 ): Promise<ClientIntegrationSyncOutcome[]> {
   // A sibling instance passes its OWN port here; the Grok fence and the Desktop gateway profile
   // stay on the live owner's (`src/codex/sibling-start.ts`).
   if (port === undefined || siblingOfLivePort() !== null) return [];
-  const { claudeDesktopIntegrationEnabled, grokIntegrationEnabled } = await import("../../codex/desired-state");
+  const projectionConfig = options.unattended ? clientProjectionConfig(config) : undefined;
+  const { claudeDesktopIntegrationEnabled, grokIntegrationEnabled, localClientSyncAllowed } = await import("../../codex/desired-state");
   const out: ClientIntegrationSyncOutcome[] = [];
+  const unattended = options.unattended;
+  const admit = () => {
+    if (!unattended!.isCurrent()) return false;
+    const fresh = loadConfig();
+    return localClientSyncAllowed(fresh) && isDeepStrictEqual(clientProjectionConfig(fresh), projectionConfig);
+  };
+  const stale = () => unattended !== undefined && !admit();
+  if (stale()) return out;
+  const grok = unattended ? await import("../../grok/inject") : undefined;
 
-  if (grokIntegrationEnabled(config)) {
+  if (grokIntegrationEnabled(config) && (!grok || grok.grokManagedBlockPresent())) {
     try {
       const { syncGrokConfig } = await import("../../grok/sync");
-      const r = await syncGrokConfig(port, config, config.hostname ? { hostname: config.hostname } : {});
+      if (stale()) return out;
+      const grokDeps = grok ? {
+        fetchAllModels: deps.fetchAllModels ?? (await import("../management-api")).fetchAllModels,
+        injectGrokConfig: ((...args: Parameters<typeof grok.injectGrokConfig>) =>
+          admit() && grokIntegrationEnabled(loadConfig()) && grok.grokManagedBlockPresent()
+            ? grok.injectGrokConfig(...args)
+            : { ok: true, changed: false, message: "Grok refresh skipped" }),
+      } : undefined;
+      const r = unattended
+        ? await syncGrokConfig(port, config, {
+          ...config.hostname ? { hostname: config.hostname } : {},
+          refreshOnly: { admit },
+        }, grokDeps)
+        : await syncGrokConfig(port, config, config.hostname ? { hostname: config.hostname } : {}, grokDeps);
       out.push(r.ok
         ? { client: "grok", ok: true, changed: r.changed === true }
         : { client: "grok", ok: false, reason: r.message });
@@ -220,9 +260,11 @@ export async function syncEnabledClientIntegrations(
     }
   }
 
+  if (stale()) return out;
   const { observeClaudeDesktopMode, resolveClaudeDesktopMode } = await import("../../claude/desktop-first-party");
   // A first-party Desktop must never get a gateway profile written and selected by a sync.
-  if (claudeDesktopIntegrationEnabled(config) && resolveClaudeDesktopMode(config, observeClaudeDesktopMode(config)) !== "first-party") {
+  if (claudeDesktopIntegrationEnabled(config) && resolveClaudeDesktopMode(config, observeClaudeDesktopMode(config)) !== "first-party"
+    && (!unattended || !!config.claudeCode?.desktopProfile?.appliedFingerprint)) {
     try {
       const { writeDesktop3pConfig } = await import("../../claude/desktop-3p");
       const { desktopVisibleNativeSlugs, filterCatalogVisibleModels } = await import("../../codex/catalog");
@@ -236,12 +278,15 @@ export async function syncEnabledClientIntegrations(
         const latest = loadConfig();
         // Discovery awaited: the mode may have changed meanwhile. Re-resolve on the fresh read,
         // immediately before the writer, so a first-party switch during fetchAllModels still wins.
-        if (claudeDesktopIntegrationEnabled(latest) && resolveClaudeDesktopMode(latest, observeClaudeDesktopMode(latest)) !== "first-party") {
+        if (stale()) return;
+        if (claudeDesktopIntegrationEnabled(latest) && resolveClaudeDesktopMode(latest, observeClaudeDesktopMode(latest)) !== "first-party"
+          && (!unattended || !!latest.claudeCode?.desktopProfile?.appliedFingerprint)) {
           const routed = filterCatalogVisibleModels(models, latest)
             .map(model => ({ provider: model.provider, id: model.id, contextWindow: model.contextWindow }));
           const writtenProfile = latest.claudeCode?.desktopProfile;
           const markerBaseline = captureDesktopAppliedMarker(writtenProfile);
-          const r = (deps.writeDesktop3pConfig ?? writeDesktop3pConfig)(
+          // Keep the attended writer's argument count unchanged, including its lock test seam.
+          const writeArgs: Parameters<typeof writeDesktop3pConfig> = [
             port,
             [...desktopVisibleNativeSlugs(latest)],
             routed,
@@ -249,7 +294,13 @@ export async function syncEnabledClientIntegrations(
             "static",
             writtenProfile,
             nativeContextLimits(latest),
-          );
+          ];
+          if (unattended) {
+            writeArgs[7] = undefined;
+            writeArgs[8] = { appliedFingerprint: writtenProfile!.appliedFingerprint!, admit };
+          }
+          const r = (deps.writeDesktop3pConfig ?? writeDesktop3pConfig)(...writeArgs);
+          if (unattended && r.reason === "desktop_refresh_only_skipped") return;
           if (!r.written || !r.fingerprint) {
             out.push({ client: "claude-desktop", ok: false, reason: r.reason ?? "Claude Desktop write failed" });
           } else {
@@ -267,6 +318,7 @@ export async function syncEnabledClientIntegrations(
     }
   }
 
+  if (stale()) return out;
   const { refreshOwnedCatalogIntegrations } = await import("../../integrations/catalog-refresh");
   const refreshOwned = deps.refreshOwnedCatalogIntegrations ?? refreshOwnedCatalogIntegrations;
   out.push(...await refreshOwned({
@@ -276,7 +328,10 @@ export async function syncEnabledClientIntegrations(
     },
     config,
     port,
-  }, ["mcode", "pi", "aside", "raycast", "omo", "cline", "droid", "opencode", "kilo"]));
+  }, unattended
+    ? ["mcode", "pi", "aside", "raycast", "omo", "commandcode", "droid", "opencode", "kilo"]
+    : ["mcode", "pi", "aside", "raycast", "omo", "cline", "commandcode", "droid", "opencode", "kilo"],
+  ...unattended ? [{ refreshOnly: true, admit }] as const : []));
 
   return out;
 }
@@ -290,6 +345,8 @@ function publicVisionSidecarSettings(
     enabled: vs.enabled !== false,
     model: vision.model,
     backend: vs.backend,
+    ...(vs.anthropicInstance ? { anthropicInstance: vs.anthropicInstance } : {}),
+    anthropicPool: sidecarAnthropicPoolOptions(config, { ...vs, backend: vs.backend ?? (vision.models.find(row => row.value === vision.model)?.backend) }),
     reasoning: vision.reasoning,
     maxDescriptionsPerTurn: resolveMaxDescriptionsPerTurn(vs.maxDescriptionsPerTurn),
     timeoutMs: resolveVisionTimeoutMs(vs.timeoutMs),
@@ -882,6 +939,8 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
         enabled: ws.enabled !== false,
         model: ws.model ?? "gpt-5.6-luna",
         backend: ws.backend,
+        ...(ws.anthropicInstance ? { anthropicInstance: ws.anthropicInstance } : {}),
+        anthropicPool: sidecarAnthropicPoolOptions(config, ws),
         streamRoutedModelOutput: ws.streamRoutedModelOutput === true,
         ...(ws.xSearch ? { xSearch: ws.xSearch } : {}),
       },
@@ -902,10 +961,11 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
     if (raw.webSearch !== undefined && !isPlainRecord(raw.webSearch)) return jsonResponse({ error: "webSearch must be an object" }, 400);
     if (raw.vision !== undefined && !isPlainRecord(raw.vision)) return jsonResponse({ error: "vision must be an object" }, 400);
     const body = raw as {
-      webSearch?: { enabled?: unknown; model?: unknown; backend?: unknown; reasoning?: unknown; streamRoutedModelOutput?: unknown; exaApiKey?: unknown; xSearch?: unknown };
+      webSearch?: { enabled?: unknown; model?: unknown; backend?: unknown; anthropicInstance?: unknown; reasoning?: unknown; streamRoutedModelOutput?: unknown; exaApiKey?: unknown; xSearch?: unknown };
       vision?: {
         model?: unknown;
         backend?: unknown;
+        anthropicInstance?: unknown;
         reasoning?: unknown;
         maxDescriptionsPerTurn?: unknown;
         enabled?: unknown;
@@ -913,6 +973,11 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       };
     };
     const WEB_SEARCH_BACKENDS_UNION = ["openai", "anthropic", "xai", "gemini", "exa"] as const;
+    const instanceError = anthropicSidecarPatchError(config, {
+      ...(body.webSearch ? { webSearchSidecar: body.webSearch } : {}),
+      ...(body.vision ? { visionSidecar: body.vision } : {}),
+    });
+    if (instanceError) return jsonResponse({ error: instanceError }, 400);
     if (body.webSearch && body.webSearch.backend !== undefined && body.webSearch.backend !== null
       && !WEB_SEARCH_BACKENDS_UNION.includes(body.webSearch.backend as never)) {
       return jsonResponse({ error: "webSearch.backend must be openai, anthropic, xai, gemini, exa, or null" }, 400);
@@ -956,7 +1021,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
     // rejection body, so a 400 cannot cost two provider fetches.
     if (body.vision && typeof body.vision.model === "string" && body.vision.model !== "") {
       const requested = body.vision.model;
-      const candidates = await visionCandidateRows(config);
+      const candidates = await visionCandidateRows({ ...config, visionSidecar: sidecarSettingsAfterPatch(config.visionSidecar, body.vision) });
       const hint = body.vision.backend === "anthropic" || body.vision.backend === "openai"
         || body.vision.backend === "routed"
         ? body.vision.backend
@@ -994,7 +1059,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
     // only case that owes a config.toml rewrite.
     const webSearchEnabledBefore = config.webSearchSidecar?.enabled !== false;
     if (body.webSearch) {
-      const pairTouched = body.webSearch.model !== undefined || body.webSearch.backend !== undefined;
+      const pairTouched = body.webSearch.model !== undefined || body.webSearch.backend !== undefined || body.webSearch.anthropicInstance !== undefined;
       // Validate against the backend the caller SUBMITTED, across the whole
       // union — not just openai/anthropic (#2457). The union check above has
       // already refused unknown literals, so a surviving string is a member;
@@ -1013,12 +1078,14 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
         ? body.webSearch.model || undefined
         : config.webSearchSidecar?.model;
       if (pairTouched && effectiveModel) {
-        const candidates = await webSearchCandidateRows(config);
+        const candidates = await webSearchCandidateRows({ ...config, webSearchSidecar: sidecarSettingsAfterPatch(config.webSearchSidecar, body.webSearch) });
         if (webSearchModelIsRejected(effectiveBackend, effectiveModel, candidates)) {
           return jsonResponse(webSearchModelRejection("webSearch.model", effectiveBackend, effectiveModel, candidates), 400);
         }
       }
       const webSearchCandidate = { ...config.webSearchSidecar };
+      if (body.webSearch.anthropicInstance === null) delete webSearchCandidate.anthropicInstance;
+      else if (isAnthropicInstanceId(body.webSearch.anthropicInstance)) webSearchCandidate.anthropicInstance = body.webSearch.anthropicInstance;
       if (typeof body.webSearch.model === "string") {
         if (body.webSearch.model === "") delete webSearchCandidate.model;
         else webSearchCandidate.model = body.webSearch.model;
@@ -1098,6 +1165,8 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
     }
     if (body.vision) {
       config.visionSidecar = { ...config.visionSidecar };
+      if (body.vision.anthropicInstance === null) delete config.visionSidecar.anthropicInstance;
+      else if (isAnthropicInstanceId(body.vision.anthropicInstance)) config.visionSidecar.anthropicInstance = body.vision.anthropicInstance;
       if (typeof body.vision.model === "string") {
         if (body.vision.model === "") delete config.visionSidecar.model;
         else config.visionSidecar.model = body.vision.model;
@@ -1143,6 +1212,8 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
         enabled: ws.enabled !== false,
         model: ws.model ?? "gpt-5.6-luna",
         backend: ws.backend,
+        ...(ws.anthropicInstance ? { anthropicInstance: ws.anthropicInstance } : {}),
+        anthropicPool: sidecarAnthropicPoolOptions(config, ws),
         streamRoutedModelOutput: ws.streamRoutedModelOutput === true,
         ...(ws.xSearch ? { xSearch: ws.xSearch } : {}),
       },

package/src/server/management/context.ts

@@ -64,8 +64,8 @@ export interface ManagementApiDeps {
   refreshOwnedCatalogIntegrations?: typeof refreshOwnedCatalogIntegrations;
   /** Platform seam for capability projections; does not alter host-level startup behavior. */
   platform?: NodeJS.Platform;
-  toggleCodexMultiAgentV2?: (enabled: boolean) => void;
-  toggleDefaultModeRequestUserInput?: (enabled: boolean) => void;
+  toggleCodexMultiAgentV2?: (enabled: boolean, env: NodeJS.ProcessEnv, validateBeforeSpawn: () => void) => void;
+  toggleDefaultModeRequestUserInput?: (enabled: boolean, env: NodeJS.ProcessEnv, validateBeforeSpawn: () => void) => void;
   createManagementConvergeCodex?: (config: Readonly<OcxConfig>) => ConvergeCodex;
   /** Test-only destination for best-effort Claude agent-definition sync. */
   claudeAgentConfigDir?: string;

package/src/server/management/decision-routes.ts

@@ -1,4 +1,5 @@
 import { jsonResponse } from "../auth-cors";
+import { jevDecisionEndpointUrl } from "../../combos/jev-decision-contract";
 import type { ManagementContext } from "./context";
 import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
 import { isPlainRecord } from "./shared";
@@ -29,7 +30,7 @@ function decisionServiceIssue(
   provider: DecisionRow,
   isSystemOneEndpoint: (url: string) => boolean,
 ): { url: string; model: string; issue?: "disabled" | "endpoint" | "model" } {
-  const url = typeof provider.baseUrl === "string" ? provider.baseUrl.trim().replace(/\/+$/, "") : "";
+  const url = typeof provider.baseUrl === "string" ? jevDecisionEndpointUrl(provider.baseUrl) : "";
   const model = provider.defaultModel?.trim() || provider.models?.[0]?.trim() || "";
   const issue = provider.disabled === true
     ? "disabled"