@bitkyc08/opencodex 2.83.0 → 2.84.0

package/src/responses/parser.ts

@@ -15,7 +15,7 @@ import { createToolChoiceResolver, namespacedToolName } from "../types";
 import { responsesRequestSchema } from "./schema";
 import { providerMetadataFromResponsesFunctionCall } from "./provider-opaque-metadata";
 import { lookupReplayThoughtSignature } from "./thought-signature-replay";
-import { compactionItemToText, isCompactionItemType } from "./compaction";
+import { CHECKPOINT_CONTINUATION_NOTE, compactionItemToText, decodeCompactionSummary, isCompactionItemType } from "./compaction";
 import { previousResponseReplayPrefixLength } from "./state";
 import { decodeReasoningEnvelope } from "./reasoning-envelope";
 import { hasRoutedIdentity, nameRoutedIdentity } from "../adapters/identity";
@@ -193,6 +193,7 @@ export function parseRequest(
   // Remote compaction v2: the input tail carries `{type:"compaction_trigger"}` and Codex expects a
   // synthetic `{type:"compaction"}` output item (src/responses/compaction.ts). Flagged for the server.
   let compactionRequest = false;
+  let decodedCheckpoint = false;
   let contextCompactionBoundary = false;
   let continuationConversationMessageIndex: number | undefined;
 
@@ -261,6 +262,7 @@ export function parseRequest(
         if (inputIndex >= replayedInputPrefixLength) contextCompactionBoundary = true;
         const encrypted = (item as { encrypted_content?: unknown }).encrypted_content;
         if (effectiveType === "context_compaction" && typeof encrypted !== "string") continue;
+        if (typeof encrypted === "string" && decodeCompactionSummary(encrypted) !== null) decodedCheckpoint = true;
         pendingReasoning.length = 0;
         messages.push({
           role: "user",
@@ -586,6 +588,10 @@ export function parseRequest(
     .map(t => loadedToolNames.has(namespacedToolName(t.namespace, t.name))
       ? { ...t, loadedFromToolSearch: true }
       : t);
+  // #6764: the decoded checkpoint is ordinary user text on this route. Say in the system prompt
+  // what it is, so a retained earlier request that it reports as completed is not repeated.
+  // A compaction request is a summarizer turn and must not be told to continue.
+  if (decodedCheckpoint && !compactionRequest) systemPrompt.push(CHECKPOINT_CONTINUATION_NOTE);
   const context: OcxContext = {
     ...(systemPrompt.length > 0 ? { systemPrompt } : {}),
     messages,

package/src/server/auth-cors.ts

@@ -47,6 +47,18 @@ import { googleVertexLocationConfigError } from "../providers/google-vertex-loca
 import { xaiResponsesOptInState } from "../providers/xai-responses-opt-in";
 
 let _corsOrigin = "http://localhost:10100";
+// Listener identity is process-local. Never infer this trust from forwarded headers: the
+// request handler marks a Request only after resolving the actual Bun Server instance.
+const trustedHubManagementRequests = new WeakSet<Request>();
+
+export function markTrustedHubManagementRequest(req: Request): void {
+  trustedHubManagementRequests.add(req);
+}
+
+export function inheritTrustedHubManagementRequest(source: Request, target: Request): void {
+  if (trustedHubManagementRequests.has(source)) trustedHubManagementRequests.add(target);
+}
+
 export function setCorsOrigin(port: number): void { _corsOrigin = `http://localhost:${port}`; }
 /** The proxy's own listening port. No admission check uses it: both loopback predicates key on hostname alone. */
 export function configuredPort(): string {
@@ -144,6 +156,24 @@ export function managementRequestOrigin(req: Request, config: OcxConfig): string
       return null;
     }
   }
+  if (trustedHubManagementRequests.has(req)) {
+    if (config.runtimeRole !== "hub") return null;
+    const canonical = canonicalHubManagementOrigin(config.hub?.managementPublicOrigin);
+    if (!canonical) return null;
+    try {
+      // The dedicated listener may receive HTTP from a local TLS terminator, so its URL
+      // scheme is not authoritative. Host must still name exactly the configured public
+      // authority; forwarded host/proto headers are deliberately ignored.
+      const requestAuthority = new URL(`https://${host}`);
+      if (requestAuthority.username || requestAuthority.password || requestAuthority.pathname !== "/"
+        || requestAuthority.search || requestAuthority.hash || requestAuthority.host !== new URL(canonical).host) {
+        return null;
+      }
+      return canonical;
+    } catch {
+      return null;
+    }
+  }
   if (!isApiAuthRequired(config)) return null;
   if (config.runtimeRole === "hub" && config.hub?.managementPublicOrigin) {
     try {
@@ -437,6 +467,18 @@ export function resolveDataPlaneAdmissionSecret(
   return null;
 }
 
+function canonicalHubManagementOrigin(value: unknown): string | null {
+  if (typeof value !== "string") return null;
+  try {
+    const parsed = new URL(value);
+    if (parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.pathname !== "/"
+      || parsed.search || parsed.hash) return null;
+    return parsed.origin;
+  } catch {
+    return null;
+  }
+}
+
 /** The principal an authenticated admission belongs to, or undefined for loopback. */
 export function contextPrincipalIdOf(admission: DataPlaneAdmission | undefined): string | undefined {
   return admission && "contextPrincipalId" in admission ? admission.contextPrincipalId : undefined;

package/src/server/configured-credentials.ts

@@ -0,0 +1,194 @@
+/**
+ * Credentials this installation is configured with, read when an upstream diagnostic is checked.
+ *
+ * A gateway can echo a credential it learned before this process ever sent it: an inactive pool
+ * key, another provider's key, an OAuth token from an earlier session. Learning only from sends
+ * would let such an echo be warned and finalized before the value is first dispatched, and a warning
+ * cannot be retracted. So the request log also refuses any diagnostic that repeats a configured
+ * value: every provider's apiKey and apiKeyPool keys (keychain and env references resolved), every
+ * configured header value, every credential-named provider field, and every token in the OAuth
+ * store. The set is rebuilt when the bytes of config.json or auth.json change, a stored keychain
+ * secret is replaced in this process, or a referenced environment variable changes.
+ *
+ * Freshness is decided by content, never by file metadata. Every check reads both stores and
+ * compares a digest of the bytes it read; the rebuild parses those same bytes. An inode/size/mtime
+ * key missed a same-length rewrite inside one timestamp tick (coarse on Windows) and any writer that
+ * preserves or backdates mtime, and then kept serving the previous, complete-looking view (#6923).
+ * The cost is two small reads per check; checks run only for retained upstream diagnostics.
+ *
+ * Reads are observe-only: no hardening, backup, repair or warning. A file that exists but cannot be
+ * read, parsed or recognized as the expected shape, or a keychain reference that cannot be resolved,
+ * makes coverage incomplete and callers fail closed; an incomplete set is retried after a short delay
+ * so a keychain that becomes available restores diagnostics. Values are held in memory only and
+ * never serialized or exposed.
+ *
+ * Not covered: keychain secrets are cached per process (`readKeychain` in
+ * src/providers/api-key-resolve.ts), so a secret replaced by another process is seen only after
+ * this process re-resolves it.
+ */
+import { createHash } from "node:crypto";
+import { readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { getConfigDir } from "../config/paths";
+import { resolveEnvValue } from "../config/proxy-env";
+import { isKeychainReference, providerKeyResolutionGeneration, resolveProviderApiKeyQuietly } from "../providers/api-key-resolve";
+import { credentialComponents, credentialSetMatches } from "../lib/outbound-credential-registry";
+import { SENSITIVE_KEY_PATTERN } from "../lib/redact";
+
+const CREDENTIAL_FIELD = /(?:key|token|secret|password|passwd|credential|cookie|authorization)$/i;
+/** How long an incomplete set is trusted before its sources are read again. */
+export const INCOMPLETE_RETRY_MS = 30_000;
+
+export interface ConfiguredCredentials {
+  readonly complete: boolean;
+  matches(value: string): boolean;
+}
+
+interface Snapshot {
+  /** The only object handed out: cache metadata (including env values) stays private here. */
+  readonly view: ConfiguredCredentials;
+  readonly signature: string;
+  readonly envNames: readonly string[];
+  readonly envFingerprint: string;
+  readonly builtAt: number;
+}
+
+let cached: Snapshot | undefined;
+
+/** One read of a store: its state for the signature and, for a readable file, the bytes read. */
+interface StoreRead {
+  /** "absent", "not-a-file", "unreadable", or "sha256:<hex>" of exactly the bytes in `text`. */
+  readonly state: string;
+  readonly text?: string;
+}
+
+function readStore(path: string): StoreRead {
+  try {
+    if (!statSync(path).isFile()) return { state: "not-a-file" };
+  } catch (error) {
+    // Only a store that is not there at all counts as intentionally absent.
+    return { state: (error as NodeJS.ErrnoException)?.code === "ENOENT" ? "absent" : "unreadable" };
+  }
+  let bytes: Buffer;
+  try {
+    bytes = readFileSync(path);
+  } catch {
+    // Present a moment ago, gone or unreadable now (a replacement in progress): fail closed.
+    return { state: "unreadable" };
+  }
+  return { state: `sha256:${createHash("sha256").update(bytes).digest("hex")}`, text: bytes.toString("utf8") };
+}
+
+function parseStore(read: StoreRead): { ok: boolean; value?: unknown } {
+  if (read.state === "absent") return { ok: true };
+  if (read.text === undefined) return { ok: false };
+  try {
+    return { ok: true, value: JSON.parse(read.text.replace(/^\uFEFF/, "")) };
+  } catch {
+    return { ok: false };
+  }
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function envFingerprint(names: readonly string[]): string {
+  return names.map(name => process.env[name] ?? "\u0000unset").join("\u0000");
+}
+
+/** Mirrors resolveEnvValue: a braced or bare dollar reference reads the environment. */
+function envReference(raw: string): string | undefined {
+  if (!raw.startsWith("$")) return undefined;
+  return /^\$\{(\w+)\}$/.exec(raw)?.[1] ?? raw.slice(1);
+}
+
+function build(configRead: StoreRead, authRead: StoreRead, signature: string, now: number): Snapshot {
+  const values = new Set<string>();
+  const envNames = new Set<string>();
+  let complete = true;
+  const add = (raw: string | undefined) => {
+    if (raw) for (const part of credentialComponents(raw)) values.add(part);
+  };
+  const noteEnv = (raw: string) => {
+    const name = envReference(raw);
+    if (name) envNames.add(name);
+  };
+  const addReference = (raw: unknown) => {
+    if (typeof raw !== "string" || !raw) return;
+    noteEnv(raw);
+    const resolved = resolveProviderApiKeyQuietly(raw);
+    if (resolved === undefined && isKeychainReference(raw)) complete = false;
+    add(resolved);
+  };
+  const isCredentialField = (field: string) => CREDENTIAL_FIELD.test(field) || SENSITIVE_KEY_PATTERN.test(field);
+  const walkProvider = (node: unknown, depth: number) => {
+    if (depth > 8) return;
+    if (Array.isArray(node)) { for (const item of node) walkProvider(item, depth + 1); return; }
+    if (!isRecord(node)) return;
+    for (const [field, value] of Object.entries(node)) {
+      if (field === "headers" && isRecord(value)) {
+        for (const header of Object.values(value)) {
+          if (typeof header !== "string") continue;
+          noteEnv(header);
+          add(resolveEnvValue(header) ?? header);
+        }
+      } else if (typeof value === "string") {
+        if (isCredentialField(field)) addReference(value);
+      } else {
+        walkProvider(value, depth + 1);
+      }
+    }
+  };
+  const walkAuth = (node: unknown, depth: number) => {
+    if (depth > 8) return;
+    if (Array.isArray(node)) { for (const item of node) walkAuth(item, depth + 1); return; }
+    if (!isRecord(node)) return;
+    for (const [field, value] of Object.entries(node)) {
+      if (typeof value === "string") {
+        if (field === "access" || field === "refresh" || isCredentialField(field)) add(value);
+      } else {
+        walkAuth(value, depth + 1);
+      }
+    }
+  };
+
+  const configSig = configRead.state;
+  const authSig = authRead.state;
+  const config = parseStore(configRead);
+  const auth = parseStore(authRead);
+  if (!config.ok || !auth.ok) complete = false;
+  // An existing file must have the shape its loader expects; anything else hides credentials.
+  if (configSig !== "absent" && config.ok && (!isRecord(config.value)
+    || (config.value.providers !== undefined && !isRecord(config.value.providers)))) complete = false;
+  if (authSig !== "absent" && auth.ok && !isRecord(auth.value)) complete = false;
+  if (isRecord(config.value) && isRecord(config.value.providers)) walkProvider(config.value.providers, 0);
+  if (isRecord(auth.value)) walkAuth(auth.value, 0);
+
+  const names = [...envNames].sort();
+  const view: ConfiguredCredentials = Object.freeze({
+    complete,
+    matches: (value: string) => credentialSetMatches(values, candidate => values.has(candidate), value),
+  });
+  return {
+    view,
+    signature,
+    envNames: names,
+    envFingerprint: envFingerprint(names),
+    builtAt: now,
+  };
+}
+
+/** The configured credential set for the active config home, rebuilt when any input changes. */
+export function configuredCredentials(now = Date.now()): ConfiguredCredentials {
+  const dir = getConfigDir();
+  const configRead = readStore(join(dir, "config.json"));
+  const authRead = readStore(join(dir, "auth.json"));
+  const signature = `${configRead.state}|${authRead.state}|${providerKeyResolutionGeneration()}|${dir}`;
+  const stale = !cached
+    || cached.signature !== signature
+    || cached.envFingerprint !== envFingerprint(cached.envNames)
+    || (!cached.view.complete && now - cached.builtAt >= INCOMPLETE_RETRY_MS);
+  if (stale) cached = build(configRead, authRead, signature, now);
+  return cached!.view;
+}

package/src/server/index/link-management.ts

@@ -0,0 +1,58 @@
+/**
+ * The Home end of the Remote Link management relay (#6957).
+ *
+ * Reached only on the hub-link listener, after the request has passed its link-key admission
+ * (`resolveApiAuth` restricted to recorded link keys) and the shared route table in
+ * `src/link/management-routes.ts`. The management handler sees a fresh request built here: no
+ * caller header, cookie, Origin or credential crosses from the link, and the principal is
+ * absent, so no consent- or capability-gated branch can be reached. Only allowlisted reads run.
+ * They run as passive reads (`src/lib/passive-read.ts`): no discovery, config write or diagnostic (#6959).
+ */
+import type { OcxConfig } from "../../types";
+import { handleManagementAPI, type ManagementApiDeps } from "../management-api";
+import type { ManagementSessionControl } from "../management-auth";
+import { runPassiveRead } from "../../lib/passive-read";
+import { LINK_CODEX_SETTINGS_PATH, linkManagementRouteAllowed, linkManagementTarget } from "../../link/management-routes";
+import { projectHomeCodexSettings } from "../../link/codex-settings";
+import { packageVersion } from "../../lib/package-version";
+
+const VERSION = packageVersion("0.0.0");
+const KEPT_RESPONSE_HEADERS = ["content-type", "content-language", "etag", "last-modified"];
+
+function notFound(): Response {
+  return Response.json({ error: "not_found" }, { status: 404, headers: { "cache-control": "no-store" } });
+}
+
+export async function handleLinkManagementRequest(
+  req: Request,
+  url: URL,
+  config: OcxConfig,
+  deps: ManagementApiDeps,
+  sessionControl?: ManagementSessionControl,
+): Promise<Response> {
+  if (!linkManagementRouteAllowed(url, req)) return notFound();
+  if (url.pathname === LINK_CODEX_SETTINGS_PATH) {
+    return Response.json(projectHomeCodexSettings(config, VERSION), { headers: { "cache-control": "no-store" } });
+  }
+  const target = linkManagementTarget(url);
+  if (!target) return notFound();
+  const local = new URL(`${target.pathname}${target.search}`, "http://127.0.0.1");
+  // The handlers branch on GET; an admitted HEAD runs as GET and its body is dropped below.
+  const inner = new Request(local.href, {
+    method: "GET",
+    headers: { accept: "application/json", host: "127.0.0.1" },
+  });
+  const response = await runPassiveRead(() =>
+    handleManagementAPI(inner, local, config, deps, undefined, sessionControl, { trustedLoopback: false }));
+  if (!response) return notFound();
+  const headers = new Headers({ "cache-control": "no-store" });
+  for (const name of KEPT_RESPONSE_HEADERS) {
+    const value = response.headers.get(name);
+    if (value) headers.set(name, value);
+  }
+  if (req.method === "HEAD") {
+    try { await response.body?.cancel(); } catch { /* best effort */ }
+    return new Response(null, { status: response.status, headers });
+  }
+  return new Response(response.body, { status: response.status, headers });
+}

package/src/server/index/optional-listeners.ts

@@ -14,6 +14,7 @@ import {
   type LinkListenerStatus,
 } from "./link-listener";
 import { createLinkSupervisor, type LinkSupervisor } from "../../link/supervisor";
+import { linkManagementRouteAllowed } from "../../link/management-routes";
 import { saveConfigPreservingClaudeCode } from "../../config/live-reconcile";
 import { reconcileLiveStateStores } from "../../lib/state-store-registrations";
 export { LINK_INGRESS_HOSTNAME } from "./link-listener";
@@ -77,7 +78,10 @@ export function createOptionalListenerSet<T>(linkDeps: LinkListenerDeps = {}): O
       if (claudeIntercept.ownsListener(server)) return "claude-intercept";
       return undefined;
     },
-    linkRouteAllowed,
+    // The Home's link listener admits the data plane plus the read-only management relay
+    // (#6957). The Child's own ingress keeps the data-only table, so a local caller on the Child
+    // cannot reach the Home's management reads without the Child's dashboard session.
+    linkRouteAllowed: (url, req) => linkRouteAllowed(url, req) || linkManagementRouteAllowed(url, req),
     linkAdmissionKeyIds: () => linkListener.linkAdmissionKeyIds(),
     onAuthenticatedCatalog: listener => linkListener.onAuthenticatedCatalog(listener),
     notifyAuthenticatedCatalog: apiKeyId => linkListener.notifyAuthenticatedCatalog(apiKeyId),

package/src/server/index/serve-options.ts

@@ -1,5 +1,6 @@
 import type { Server, ServerWebSocket } from "bun";
 import type { StartServerDeps } from "./startup-warnings";
+import { isLinkManagementPath } from "../../link/management-routes";
 import {
   GUI_PAIRING_EXCHANGE_BODY_LIMIT,
   REMOTE_WORKSPACE_PAIRING_BODY_LIMIT,
@@ -96,6 +97,7 @@ import {
   isAllowedManagementOrigin,
   isApiAuthRequired,
   isLoopbackHostname,
+  markTrustedHubManagementRequest,
   jsonResponse,
   admissionFields,
   resolveApiAuth,
@@ -313,6 +315,11 @@ export function createServeOptions(ctx: ServeOptionsContext) {
       maxRequestBodySize: inboundBodyLimitBytes,
       async fetch(req: Request, requestServer: Server<WsData>): Promise<Response> {
       const ingress = ingressForServer(requestServer);
+      // Bind management-origin trust to the actual Bun listener object resolved above.
+      // Neither Host nor any X-Forwarded-* header can manufacture this process-local mark.
+      if (ingress === "hub-management" && config.runtimeRole === "hub") {
+        markTrustedHubManagementRequest(req);
+      }
       const requestUrl = codexCompatibleUrl(req.url);
       const linkPolicyView = ingress === "hub-link" ? linkPolicy() : undefined;
       // The unauthenticated loopback listener (#1102) serves a fixed allowlist and nothing
@@ -367,6 +374,12 @@ export function createServeOptions(ctx: ServeOptionsContext) {
         if (requestUrl.pathname === "/v1/catalog" && requestUrl.search === ""
           && (req.method === "GET" || req.method === "HEAD")
           && admission.kind === "configured") onAuthenticatedCatalog(admission.keyId);
+        // #6957: the Child's read-only view of this Home. Admitted by the link key above and by
+        // the shared table in src/link/management-routes.ts; never reachable on another ingress.
+        if (isLinkManagementPath(requestUrl.pathname)) {
+          const { handleLinkManagementRequest } = await import("./link-management");
+          return withCors(await handleLinkManagementRequest(req, requestUrl, config, requestManagementApiDeps, managementSessionControl), req, policy);
+        }
       }
       const url = requestUrl;
       const admissionOptions = { linkIngress: policy.linkIngress?.allowedKeyIds };

package/src/server/lifecycle.ts

@@ -8,7 +8,7 @@ import {
 } from "../storage/policy-job";
 import { abortRestoreTrashJobAsync } from "../storage/restore-job";
 import { stopStorageCleanupScheduler } from "../storage/policy-scheduler";
-import { runOptionalShutdownHooks } from "../lib/optional-shutdown-hooks";
+import { runDrainStartHooks, runOptionalShutdownHooks } from "../lib/optional-shutdown-hooks";
 import { stopStateStoreSweeper } from "../lib/state-store-sweeper";
 import {
   cancelQueuedStorageWorkerSpawns,
@@ -499,6 +499,7 @@ export async function drainAndShutdown(
   // ordinary in-flight turns. A stuck scoped owner must not pin shutdown forever.
   const deadline = Date.now() + Math.max(0, timeoutMs);
   beginShutdownDrain();
+  runDrainStartHooks();
   const temporaryDrainsSettled = await waitForTemporaryDrainsUntil(deadline);
   if (!temporaryDrainsSettled) {
     console.warn("Temporary drain lease did not settle before the shutdown deadline; forcing shutdown");

package/src/server/management/agent-settings-routes.ts

@@ -1,6 +1,7 @@
 import { ensureManagementClaudeIntercept, interceptStartRefusal, interceptStatus } from "./claude-intercept-routes";
 import { persistCommittedDesktopGateway } from "../../claude/desktop-gateway-state";
 import { captureDesktopAppliedMarker, commitDesktopAppliedMarker } from "../../claude/desktop-applied-marker";
+import { isPassiveRead } from "../../lib/passive-read";
 import { randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { dirname } from "node:path";
@@ -230,6 +231,32 @@ async function injectionModelOptions(config: OcxConfig, models: readonly Catalog
   return [...nativeModels, ...routedModels];
 }
 
+/**
+ * The GET /api/injection-model body. `routed` is the discovered routed catalog, or `null` in a
+ * passive read (a Remote Link Child's, #6959). That body lists the native
+ * options and the current pick, which is all a read-only Child shows.
+ */
+export async function injectionModelView(config: OcxConfig, routed: readonly CatalogModel[] | null) {
+  const { CODEX_REASONING_LEVELS } = await import("../../reasoning-effort");
+  const available = await injectionModelOptions(config, routed ?? []);
+  const picked = config.injectionModel;
+  if (routed === null && picked && !available.some(option => option.namespaced === picked)) {
+    const slash = picked.indexOf("/");
+    available.push(slash > 0
+      ? { provider: picked.slice(0, slash), model: picked.slice(slash + 1), namespaced: picked }
+      : { provider: "openai", model: picked, namespaced: picked });
+  }
+  return {
+    multiAgentGuidanceEnabled: multiAgentGuidanceEnabled(config),
+    syncCodexSubagentDefaults: subagentDefaultSyncEffective(config),
+    model: config.injectionModel ?? null,
+    effort: config.injectionEffort ?? null,
+    prompt: config.injectionPrompt ?? null,
+    efforts: CODEX_REASONING_LEVELS.map(l => l.effort),
+    available,
+  };
+}
+
 export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise<Response | null> {
   const { req, url, config, deps, convergeCodexCatalog, syncClaudeAgentDefsBestEffort } = ctx;
 
@@ -620,16 +647,7 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
   // effort the prompt tells the agent to pass to spawn_agent. GET returns the current
   // picks + available models/efforts; PUT sets or clears them.
   if (url.pathname === "/api/injection-model" && req.method === "GET") {
-    const { CODEX_REASONING_LEVELS } = await import("../../reasoning-effort");
-    return jsonResponse({
-      multiAgentGuidanceEnabled: multiAgentGuidanceEnabled(config),
-      syncCodexSubagentDefaults: subagentDefaultSyncEffective(config),
-      model: config.injectionModel ?? null,
-      effort: config.injectionEffort ?? null,
-      prompt: config.injectionPrompt ?? null,
-      efforts: CODEX_REASONING_LEVELS.map(l => l.effort),
-      available: await injectionModelOptions(config, await fetchAllModels(config)),
-    });
+    return jsonResponse(await injectionModelView(config, isPassiveRead() ? null : await fetchAllModels(config)));
   }
   // Read-only: sizes the described delegated work and proposes a model and effort from the
   // same options GET offers. The page applies an accepted proposal through the PUT below.

package/src/server/management/anthropic-reset-grant-routes.ts

@@ -19,6 +19,7 @@ import { captureAnthropicPhysicalSendOwnership, anthropicPhysicalSendOwnershipIs
 import { anthropicCooldownRecoveryFor } from "../../providers/quota/anthropic-cooldown-recovery";
 import { captureProviderAccountQuotaEpoch } from "../../providers/quota/account-cache";
 import { captureOAuthAccountSelection, getAccountSet, getAccountCredentialWithStatus, listAccounts } from "../../oauth/store";
+import { admitAnthropicAccountAfterReset, type AnthropicResetAdmissionEvidence } from "../../providers/anthropic-reset-admission";
 import {
   ANTHROPIC_RESET_GRANT_ID_RE,
   AnthropicResetGrantError,
@@ -74,6 +75,8 @@ export interface AnthropicResetGrantRouteDeps {
   listAccountIds: () => string[];
   activeAccountId: () => string | null;
   accessTokenFor: (accountId: string) => Promise<string>;
+  /** Lift local admission after a journaled reset, bounded by its journal evidence. Tests omit it. */
+  admitReset?: (accountId: string, evidence: AnthropicResetAdmissionEvidence) => Promise<void>;
 }
 
 function defaultDepsFor(ctx: ManagementContext, provider: AnthropicInstanceId): AnthropicResetGrantRouteDeps | null {
@@ -109,6 +112,7 @@ function defaultDepsFor(ctx: ManagementContext, provider: AnthropicInstanceId):
       if (!targetCurrent() || !owner) throw new Error("reset owner changed");
       return snapshot.accessToken;
     },
+    admitReset: (accountId, evidence) => admitAnthropicAccountAfterReset(provider, accountId, evidence),
   };
 }
 
@@ -209,6 +213,16 @@ async function handleConsume(ctx: ManagementContext, injected?: AnthropicResetGr
   }
   if (deps.isCurrent?.() === false) return scopedFail(401, "auth_failed");
   const ledger = { journalPath: deps.journalPath, now: deps.now?.() };
+  // Retry-after cooldowns survive a usage probe. A journaled reset, including a
+  // replay after the process died before admission, has to lift this account,
+  // but only refusals recorded before the claim was journaled and only for the
+  // windows the journal says were cleared. A failed reread must not turn a
+  // spent grant into an error.
+  const admitJournaledReset = async (code: string, evidence: AnthropicResetAdmissionEvidence): Promise<void> => {
+    if (code !== "reset" || deps.isCurrent?.() === false) return;
+    try { await deps.admitReset?.(accountId, evidence); }
+    catch { /* The grant is already spent. */ }
+  };
 
   // A new operation must pass the spend gate on a fresh read. A same-id retry of
   // an open record skips it: that attempt was already gated, and upstream
@@ -242,6 +256,7 @@ async function handleConsume(ctx: ManagementContext, injected?: AnthropicResetGr
   }
   switch (begin.kind) {
     case "replay":
+      await admitJournaledReset(begin.code, { claimedAt: begin.claimedAt, cleared: begin.cleared });
       return jsonResponse(
         { provider, code: begin.code, replayed: true, resetsLeft: begin.resetsLeft, accountId, grantId, operationId },
         200, ctx.req, ctx.config,
@@ -268,7 +283,7 @@ async function handleConsume(ctx: ManagementContext, injected?: AnthropicResetGr
   let settled;
   try {
     settled = settleAnthropicResetOperation(
-      { operationId, code: answer.code, resetsLeft: answer.resetsLeft },
+      { operationId, code: answer.code, resetsLeft: answer.resetsLeft, cleared: answer.cleared },
       { journalPath: deps.journalPath, now: deps.now?.() },
     );
   } catch {
@@ -278,6 +293,7 @@ async function handleConsume(ctx: ManagementContext, injected?: AnthropicResetGr
   // Report what the journal holds. An overlapping same-id attempt may have
   // settled first; its answer is the canonical one.
   const replayed = settled.code !== answer.code || settled.resetsLeft !== answer.resetsLeft;
+  await admitJournaledReset(settled.code, { claimedAt: settled.claimedAt, cleared: settled.cleared });
   return jsonResponse(
     {
       provider,

package/src/server/management/codex-agent-role-routes.ts

@@ -96,12 +96,18 @@ export async function handleCodexAgentRoleRoutes(ctx: ManagementContext): Promis
     return jsonResponse({ error: "invalid JSON body" }, 400, req, config);
   }
 
-  let model: string;
-  let effort: string | undefined;
+  // An omitted model leaves the role's model pin (or its inheritance) alone, an omitted effort
+  // keeps the effort, and an effort of null clears it. A body with neither changes nothing, which
+  // is a client mistake rather than a save, so it is refused before any role file is read.
+  if (body?.model === undefined && body?.effort === undefined) {
+    return jsonResponse({ error: "send a model, an effort, or both", code: "empty_update" }, 400, req, config);
+  }
+  let model: string | undefined;
+  let effort: string | null | undefined;
   let toml: { status: "written" | "unchanged" };
   try {
-    model = roles.validateAgentRoleModel(body?.model);
-    effort = body?.effort === undefined || body.effort === null ? undefined : roles.validateAgentRoleEffort(body.effort);
+    model = body?.model === undefined ? undefined : roles.validateAgentRoleModel(body.model);
+    effort = body?.effort === undefined ? undefined : body.effort === null ? null : roles.validateAgentRoleEffort(body.effort);
     toml = roles.writeCodexAgentRoleModel(role, model, codexHome, effort);
   } catch (error) {
     if (error instanceof roles.AgentRoleModelError) {
@@ -115,10 +121,17 @@ export async function handleCodexAgentRoleRoutes(ctx: ManagementContext): Promis
   // The role TOML is what Codex obeys, so its write stands even when the omo mirror cannot follow.
   let omoStatus: ReturnType<typeof omo.writeOmoRoleModel> | "write_failed";
   try {
-    const reasoning = effort === undefined ? undefined : omo.omoReasoningFor(effort);
+    const reasoning = effort === undefined ? undefined : effort === null ? null : omo.omoReasoningFor(effort);
     omoStatus = omo.writeOmoRoleModel(role, model, omo.omoJsoncPath(), reasoning);
   } catch {
     omoStatus = "write_failed";
   }
-  return jsonResponse({ ok: true, role, model, ...(effort ? { effort } : {}), toml, omoJsonc: { status: omoStatus } }, 200, req, config);
+  return jsonResponse({
+    ok: true,
+    role,
+    ...(model !== undefined ? { model } : {}),
+    ...(effort !== undefined ? { effort } : {}),
+    toml,
+    omoJsonc: { status: omoStatus },
+  }, 200, req, config);
 }