@bitkyc08/opencodex 2.83.0 → 2.86.0

package/src/server/login-shell-path.ts

@@ -0,0 +1,146 @@
+/**
+ * The user's login-shell PATH, for installers the dashboard runs under OpenCodex Desktop (#6971).
+ *
+ * A Finder or login launch gives the Desktop app, and so its proxy sidecar, only the system PATH
+ * (`/usr/bin:/bin:/usr/sbin:/sbin`). `ocx codex-shim install` scans PATH for the native Codex
+ * launcher, so from the dashboard it reported "Native Codex launcher not found" for Homebrew, npm,
+ * bun, nvm, fnm, volta and mise installs, and an npm launcher had no `node` for its probe.
+ *
+ * This asks the user's shell once, as an interactive login shell would start, and keeps only PATH:
+ * the value is framed by markers so startup-file output cannot leak into it. The read has a
+ * deadline, runs in its own process group so a hung startup file is killed with all of its
+ * children, and its result, including failure, is cached so repeated dashboard actions do not
+ * spawn shells. It is scoped to the shim installer's child environment; the service definition's
+ * PATH has its own policy.
+ */
+import { spawn as nodeSpawn, type ChildProcess } from "node:child_process";
+import { userInfo } from "node:os";
+import { basename, isAbsolute } from "node:path";
+
+const BEGIN = "__OCX_LOGIN_PATH_BEGIN__";
+const END = "__OCX_LOGIN_PATH_END__";
+export const LOGIN_SHELL_PATH_TIMEOUT_MS = 5_000;
+export const LOGIN_SHELL_PATH_CACHE_MS = 5 * 60_000;
+const MAX_OUTPUT_BYTES = 64 * 1024;
+/** After the shell exits, how long its stdout may stay open before a background job is assumed to hold it. */
+const STDOUT_DRAIN_MS = 500;
+
+export function loginShellPathArgs(shell: string): string[] {
+  const print = basename(shell) === "fish"
+    ? `printf '%s%s%s\\n' ${BEGIN} (string join : $PATH) ${END}`
+    : `printf '%s%s%s\\n' ${BEGIN} "$PATH" ${END}`;
+  return ["-l", "-i", "-c", print];
+}
+
+/** The framed PATH, only when every entry is absolute. */
+export function parseLoginShellPath(output: string): string | null {
+  const start = output.lastIndexOf(BEGIN);
+  if (start < 0) return null;
+  const end = output.indexOf(END, start + BEGIN.length);
+  if (end < 0) return null;
+  const value = output.slice(start + BEGIN.length, end);
+  if (!value || /[\r\n\0]/.test(value)) return null;
+  const entries = value.split(":").filter(Boolean);
+  return entries.length > 0 && entries.every(entry => isAbsolute(entry)) ? entries.join(":") : null;
+}
+
+/** Ordered union: the shell's entries first, then any the process had that the shell did not. */
+export function mergePathLists(preferred: string, fallback: string | undefined): string {
+  // POSIX only: the login shell runs on macOS and Linux, where PATH is colon-separated.
+  return [...new Set([...preferred.split(":"), ...(fallback ?? "").split(":")].filter(Boolean))].join(":");
+}
+
+export interface LoginShellPathDeps {
+  platform?: NodeJS.Platform;
+  shell?: string | null;
+  env?: NodeJS.ProcessEnv;
+  spawn?: (command: string, args: string[], options: Parameters<typeof nodeSpawn>[2]) => ChildProcess;
+  killGroup?: (pid: number) => void;
+  timeoutMs?: number;
+  now?: () => number;
+}
+
+let cached: { at: number; value: string | null } | null = null;
+
+export function resetLoginShellPathCacheForTests(): void {
+  cached = null;
+}
+
+function defaultShell(env: NodeJS.ProcessEnv): string | null {
+  const fromEnv = env.SHELL?.trim();
+  if (fromEnv && isAbsolute(fromEnv)) return fromEnv;
+  try {
+    const shell = userInfo().shell;
+    return shell && isAbsolute(shell) ? shell : null;
+  } catch { return null; }
+}
+
+function killProcessGroup(pid: number): void {
+  try { process.kill(-pid, "SIGKILL"); } catch { /* already gone */ }
+}
+
+export async function readLoginShellPath(deps: LoginShellPathDeps = {}): Promise<string | null> {
+  const platform = deps.platform ?? process.platform;
+  if (platform === "win32") return null;
+  const now = deps.now ?? Date.now;
+  if (cached && now() - cached.at < LOGIN_SHELL_PATH_CACHE_MS) return cached.value;
+  const env = deps.env ?? process.env;
+  const shell = deps.shell === undefined ? defaultShell(env) : deps.shell;
+  const value = shell ? await probe(shell, env, deps) : null;
+  cached = { at: now(), value };
+  return value;
+}
+
+function probe(shell: string, env: NodeJS.ProcessEnv, deps: LoginShellPathDeps): Promise<string | null> {
+  const spawn = deps.spawn ?? nodeSpawn;
+  const killGroup = deps.killGroup ?? killProcessGroup;
+  return new Promise(resolve => {
+    let child: ChildProcess;
+    try {
+      child = spawn(shell, loginShellPathArgs(shell), {
+        detached: true,
+        stdio: ["ignore", "pipe", "ignore"],
+        // Only what a login shell needs to find its startup files; no proxy or credential state.
+        env: Object.fromEntries(Object.entries({
+          HOME: env.HOME, USER: env.USER, LOGNAME: env.LOGNAME, SHELL: shell, LANG: env.LANG,
+          PATH: env.PATH, TERM: "dumb",
+        }).filter(([, value]) => value !== undefined)) as NodeJS.ProcessEnv,
+      });
+    } catch { resolve(null); return; }
+    let output = "";
+    let settled = false;
+    let exitCode: number | null = null;
+    let drain: ReturnType<typeof setTimeout> | undefined;
+    const finish = (value: string | null, killGroupMembers: boolean) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      clearTimeout(drain);
+      // A hung startup file, or a background job still holding the pipe, is killed with its group.
+      // A shell that exited and closed its output is left alone: its group id may already be free.
+      if (killGroupMembers && child.pid) killGroup(child.pid);
+      resolve(value);
+    };
+    const timer = setTimeout(() => finish(null, true), deps.timeoutMs ?? LOGIN_SHELL_PATH_TIMEOUT_MS);
+    child.stdout?.setEncoding("utf8");
+    child.stdout?.on("data", (chunk: string) => {
+      output += chunk;
+      if (output.length > MAX_OUTPUT_BYTES) finish(null, true);
+    });
+    const parsed = () => exitCode === 0 ? parseLoginShellPath(output) : null;
+    child.once("error", () => finish(null, true));
+    // Parse only after stdout closes: `exit` can arrive before the last chunk.
+    child.once("close", code => { exitCode ??= code; finish(parsed(), false); });
+    child.once("exit", code => {
+      exitCode = code;
+      drain = setTimeout(() => finish(parsed(), true), STDOUT_DRAIN_MS);
+    });
+  });
+}
+
+/** `env` with the login-shell PATH in front, or unchanged when it cannot be read. */
+export async function withLoginShellPath(env: NodeJS.ProcessEnv, deps: LoginShellPathDeps = {}): Promise<NodeJS.ProcessEnv> {
+  const loginPath = await readLoginShellPath({ ...deps, env });
+  return loginPath ? { ...env, PATH: mergePathLists(loginPath, env.PATH) } : env;
+}
+

package/src/server/management/advisor-routes.ts

@@ -0,0 +1,191 @@
+/**
+ * GET / PUT /api/advisor/settings — the advisor sidecar's management surface.
+ *
+ * GET answers the RESOLVED settings (defaults applied, sources marked) plus availability, so the
+ * GUI/CLI show real runtime state rather than stored fields. PUT is a strict partial patch:
+ * unknown keys and wrong types are refused, values are validated against the same resolver the
+ * runtime reads, and the patch persists through the locked config writer with the snapshot-
+ * restore discipline used by PATCH /api/protocols/settings — a refused or failed write never
+ * leaves the live config serving a state the file does not hold.
+ */
+import { activateAdvisor } from "../../lib/advisor-activation";
+import { jsonResponse } from "../auth-cors";
+import { readManagementJsonBodyOr } from "./body";
+import type { ManagementContext } from "./context";
+import {
+  ADVISOR_CONTEXT_SHARING_CONSENT_VERSION,
+  ADVISOR_EFFORTS,
+  advisorContextSharingBlocked,
+  advisorRunnable,
+  isCurrentAdvisorContextSharingConsent,
+  isValidAdvisorEffort,
+  isValidAdvisorPolicy,
+  resolveAdvisorSettings,
+  type AdvisorEffort,
+  type AdvisorPolicy,
+} from "../../advisor/settings";
+
+const INVALID_BODY = Symbol("invalid-body");
+
+interface AdvisorPatch {
+  enabled?: boolean;
+  model?: string;
+  effort?: AdvisorEffort;
+  policy?: AdvisorPolicy;
+  timeoutMs?: number;
+  /** "v1" records current consent. null removes it. Enabling does not imply this field. */
+  contextSharingConsent?: typeof ADVISOR_CONTEXT_SHARING_CONSENT_VERSION | null;
+  reset?: boolean;
+}
+
+type ParsedPatch = { ok: true; patch: AdvisorPatch } | { ok: false; code: string; message: string };
+
+const PATCH_KEYS = new Set(["enabled", "model", "effort", "policy", "timeoutMs", "contextSharingConsent", "reset"]);
+
+type Rec = Record<string, unknown>;
+function isRec(value: unknown): value is Rec {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+
+/** Strict: unknown keys and wrong types are refused; messages name the field, never the value. */
+export function parseAdvisorSettingsPatch(body: unknown): ParsedPatch {
+  if (!isRec(body)) return { ok: false, code: "invalid_body", message: "body must be a JSON object" };
+  if (Object.keys(body).length === 0) return { ok: false, code: "empty_body", message: "body must set at least one of enabled, model, effort, policy, timeoutMs, contextSharingConsent or reset" };
+  for (const key of Object.keys(body)) {
+    if (!PATCH_KEYS.has(key)) return { ok: false, code: "unknown_field", message: "body accepts only enabled, model, effort, policy, timeoutMs, contextSharingConsent and reset" };
+  }
+  const patch: AdvisorPatch = {};
+  if (body.reset !== undefined) {
+    if (body.reset !== true) return { ok: false, code: "invalid_reset", message: "reset must be true when present" };
+    if (Object.keys(body).length > 1) return { ok: false, code: "reset_with_fields", message: "reset must be the only field when present" };
+    patch.reset = true;
+    return { ok: true, patch };
+  }
+  if (body.enabled !== undefined) {
+    if (typeof body.enabled !== "boolean") return { ok: false, code: "invalid_enabled", message: "enabled must be a boolean" };
+    patch.enabled = body.enabled;
+  }
+  if (body.model !== undefined) {
+    // An empty or whitespace-only value is the supported "clear the model" state, not an error:
+    // the resolver defaults to an empty model and `advisorRunnable` requires a non-blank one. The
+    // only structural rules are the string type and the trimmed length bound.
+    if (typeof body.model !== "string" || body.model.trim().length > 200) {
+      return {
+        ok: false,
+        code: "invalid_model",
+        message: "model must be a string whose trimmed value is at most 200 characters; an empty value clears the advisor model",
+      };
+    }
+    patch.model = body.model.trim();
+  }
+  if (body.effort !== undefined) {
+    if (!isValidAdvisorEffort(body.effort)) {
+      return { ok: false, code: "invalid_effort", message: `effort must be one of ${ADVISOR_EFFORTS.join(", ")}` };
+    }
+    patch.effort = body.effort;
+  }
+  if (body.policy !== undefined) {
+    if (!isValidAdvisorPolicy(body.policy)) {
+      return { ok: false, code: "invalid_policy", message: 'policy must be "manual" or "preflight"' };
+    }
+    patch.policy = body.policy;
+  }
+  if (body.timeoutMs !== undefined) {
+    if (typeof body.timeoutMs !== "number" || !Number.isFinite(body.timeoutMs) || body.timeoutMs < 1_000 || body.timeoutMs > 600_000) {
+      return { ok: false, code: "invalid_timeout", message: "timeoutMs must be a number between 1000 and 600000" };
+    }
+    patch.timeoutMs = Math.floor(body.timeoutMs);
+  }
+  if (body.contextSharingConsent !== undefined) {
+    if (body.contextSharingConsent === null) {
+      patch.contextSharingConsent = null;
+    } else if (isCurrentAdvisorContextSharingConsent(body.contextSharingConsent)) {
+      patch.contextSharingConsent = body.contextSharingConsent;
+    } else {
+      return {
+        ok: false,
+        code: "invalid_context_sharing_consent",
+        message: `contextSharingConsent must be "${ADVISOR_CONTEXT_SHARING_CONSENT_VERSION}" or null`,
+      };
+    }
+  }
+  return { ok: true, patch };
+}
+
+function advisorInfo(config: ManagementContext["config"]): Record<string, unknown> {
+  const settings = resolveAdvisorSettings(config);
+  const warning = settings.enabled && settings.model.trim() === ""
+    ? "advisor_enabled_without_model"
+    : advisorContextSharingBlocked(settings)
+      ? "advisor_context_sharing_consent_required"
+      : undefined;
+  return {
+    settings,
+    runnable: advisorRunnable(settings),
+    // Enabled without a model cannot consult. Enabled with a model but without current
+    // consent must not send task context; the warning names that block.
+    ...(warning ? { warning } : {}),
+  };
+}
+
+function applyPatchInMemory(config: ManagementContext["config"], patch: AdvisorPatch): void {
+  if (patch.reset) {
+    delete config.advisor;
+    return;
+  }
+  const current: Rec = isRec(config.advisor) ? { ...config.advisor } : {};
+  if (patch.enabled !== undefined) current.enabled = patch.enabled;
+  if (patch.model !== undefined) current.model = patch.model;
+  if (patch.effort !== undefined) current.effort = patch.effort;
+  if (patch.policy !== undefined) current.policy = patch.policy;
+  if (patch.timeoutMs !== undefined) current.timeoutMs = patch.timeoutMs;
+  if (patch.contextSharingConsent === null) delete current.contextSharingConsent;
+  else if (patch.contextSharingConsent !== undefined) current.contextSharingConsent = patch.contextSharingConsent;
+  config.advisor = current as ManagementContext["config"]["advisor"];
+}
+
+function isConfigLockContention(error: unknown): boolean {
+  if (!error || typeof error !== "object") return false;
+  if ((error as { code?: unknown }).code !== "CONFIG_MUTATION_LOCK_UNAVAILABLE") return false;
+  return (error as { cause?: { code?: unknown } }).cause?.code === "SQLITE_BUSY";
+}
+
+export async function handleAdvisorRoutes(ctx: ManagementContext): Promise<Response | null> {
+  const { url, req, config } = ctx;
+  if (url.pathname !== "/api/advisor/settings") return null;
+
+  if (req.method === "GET") return jsonResponse(advisorInfo(config), 200, req, config);
+  if (req.method === "PUT") return putAdvisorSettings(ctx);
+  return null;
+}
+
+async function putAdvisorSettings(ctx: ManagementContext): Promise<Response> {
+  const { req, config } = ctx;
+
+  const body = await readManagementJsonBodyOr(req, INVALID_BODY);
+  const parsed = body === INVALID_BODY
+    ? { ok: false as const, code: "invalid_json", message: "body must be valid JSON" }
+    : parseAdvisorSettingsPatch(body);
+  if (!parsed.ok) return jsonResponse({ error: { code: parsed.code, message: parsed.message } }, 400, req, config);
+
+  // Resolve the writer BEFORE touching the live config: a resolution failure must leave the
+  // in-memory config exactly as it was, not rely on the snapshot restore below.
+  // `deps.` first: route tests with an in-memory fixture must never write the real config.
+  const persist = ctx.deps.saveConfigPreservingClaudeCode
+    ?? (await import("../../config")).saveConfigPreservingClaudeCode;
+  const snapshot = isRec(config.advisor) ? { ...config.advisor } : undefined;
+  applyPatchInMemory(config, parsed.patch);
+  try {
+    persist(config);
+  } catch (error) {
+    // Undo in memory too: a live config that serves a state the file does not hold would
+    // mislead every GET until the next restart.
+    if (snapshot === undefined) delete config.advisor;
+    else config.advisor = snapshot as ManagementContext["config"]["advisor"];
+    return isConfigLockContention(error)
+      ? jsonResponse({ error: { code: "config_busy", message: "Another process is saving the configuration. Try again in a moment." } }, 409, req, config)
+      : jsonResponse({ error: { code: "write_failed", message: "The configuration could not be saved." } }, 500, req, config);
+  }
+  activateAdvisor(config);
+  return jsonResponse(advisorInfo(config), 200, req, config);
+}

package/src/server/management/agent-settings-routes.ts

@@ -1,6 +1,7 @@
 import { ensureManagementClaudeIntercept, interceptStartRefusal, interceptStatus } from "./claude-intercept-routes";
 import { persistCommittedDesktopGateway } from "../../claude/desktop-gateway-state";
 import { captureDesktopAppliedMarker, commitDesktopAppliedMarker } from "../../claude/desktop-applied-marker";
+import { isPassiveRead } from "../../lib/passive-read";
 import { randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { dirname } from "node:path";
@@ -230,6 +231,32 @@ async function injectionModelOptions(config: OcxConfig, models: readonly Catalog
   return [...nativeModels, ...routedModels];
 }
 
+/**
+ * The GET /api/injection-model body. `routed` is the discovered routed catalog, or `null` in a
+ * passive read (a Remote Link Child's, #6959). That body lists the native
+ * options and the current pick, which is all a read-only Child shows.
+ */
+export async function injectionModelView(config: OcxConfig, routed: readonly CatalogModel[] | null) {
+  const { CODEX_REASONING_LEVELS } = await import("../../reasoning-effort");
+  const available = await injectionModelOptions(config, routed ?? []);
+  const picked = config.injectionModel;
+  if (routed === null && picked && !available.some(option => option.namespaced === picked)) {
+    const slash = picked.indexOf("/");
+    available.push(slash > 0
+      ? { provider: picked.slice(0, slash), model: picked.slice(slash + 1), namespaced: picked }
+      : { provider: "openai", model: picked, namespaced: picked });
+  }
+  return {
+    multiAgentGuidanceEnabled: multiAgentGuidanceEnabled(config),
+    syncCodexSubagentDefaults: subagentDefaultSyncEffective(config),
+    model: config.injectionModel ?? null,
+    effort: config.injectionEffort ?? null,
+    prompt: config.injectionPrompt ?? null,
+    efforts: CODEX_REASONING_LEVELS.map(l => l.effort),
+    available,
+  };
+}
+
 export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise<Response | null> {
   const { req, url, config, deps, convergeCodexCatalog, syncClaudeAgentDefsBestEffort } = ctx;
 
@@ -620,16 +647,7 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
   // effort the prompt tells the agent to pass to spawn_agent. GET returns the current
   // picks + available models/efforts; PUT sets or clears them.
   if (url.pathname === "/api/injection-model" && req.method === "GET") {
-    const { CODEX_REASONING_LEVELS } = await import("../../reasoning-effort");
-    return jsonResponse({
-      multiAgentGuidanceEnabled: multiAgentGuidanceEnabled(config),
-      syncCodexSubagentDefaults: subagentDefaultSyncEffective(config),
-      model: config.injectionModel ?? null,
-      effort: config.injectionEffort ?? null,
-      prompt: config.injectionPrompt ?? null,
-      efforts: CODEX_REASONING_LEVELS.map(l => l.effort),
-      available: await injectionModelOptions(config, await fetchAllModels(config)),
-    });
+    return jsonResponse(await injectionModelView(config, isPassiveRead() ? null : await fetchAllModels(config)));
   }
   // Read-only: sizes the described delegated work and proposes a model and effort from the
   // same options GET offers. The page applies an accepted proposal through the PUT below.
@@ -1379,6 +1397,24 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
   }
 
   // Claude Code inbound settings (GUI "Claude ON" toggle + Claude page).
+  if (url.pathname === "/api/claude-code/model-defaults" && (req.method === "GET" || req.method === "POST")) {
+    const { previewClaudeModelDefaults, applyClaudeModelDefaults, ModelDefaultsRecoveryError } = await import("../../claude/model-default-settings");
+    try {
+      if (req.method === "GET") return jsonResponse(previewClaudeModelDefaults(config.claudeCode?.tierModels));
+      let body: unknown;
+      try { body = await readManagementJsonBody(req); } catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid JSON body" }, 400); }
+      if (!body || typeof body !== "object" || Array.isArray(body) || Object.keys(body).length !== 1 ||
+          !("fingerprint" in body) || typeof body.fingerprint !== "string" || !/^[a-f0-9]{64}$/.test(body.fingerprint)) {
+        return jsonResponse({ error: "fingerprint is required" }, 400);
+      }
+      return jsonResponse(applyClaudeModelDefaults(config.claudeCode?.tierModels, body.fingerprint));
+    } catch (error) {
+      rethrowManagementBodyTooLarge(error);
+      if (error instanceof ModelDefaultsRecoveryError) return jsonResponse({ error: error.message, code: error.message, backupPath: error.backupPath }, 500);
+      const code = error instanceof Error && error.message === "settings_changed" ? "settings_changed" : "settings_unavailable";
+      return jsonResponse({ error: code, code }, code === "settings_changed" ? 409 : 500);
+    }
+  }
   if (url.pathname === "/api/claude-code" && req.method === "GET") {
     const models = await fetchAllModels(config);
     const { listCatalogNativeSlugs } = await import("../../codex/catalog");
@@ -1495,10 +1531,10 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
     });
   }
   if (url.pathname === "/api/claude-code" && req.method === "PUT") {
-    // NOTE: model / tierModels / maxContextTokens / alwaysEnableEffort are
+    // NOTE: model / maxContextTokens / alwaysEnableEffort are
     // CONFIG-ONLY back-compat fields — the GUI no longer offers controls for them
-    // (default model is owned by Claude Code's /model picker; roster agents
-    // supersede tiers; auto-context supersedes the max-context pair; effort rides
+    // (default model is owned by Claude Code's /model picker;
+    // auto-context supersedes the max-context pair; effort rides
     // regardless on 2.1.207). PUT keeps validating them so hand-written configs
     // and older GUIs stay safe; GUI saves omit them and the spread preserves them.
     let parsedBody: unknown;
@@ -1817,7 +1853,7 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
       }
     }
     if (body.tierModels !== undefined) {
-      // CONFIG-ONLY back-compat (GUI pickers removed — roster agents supersede tiers).
+      // Family defaults also serve third-party callers that request native tier aliases.
       if (body.tierModels === null) {
         delete next.tierModels;
       } else if (!isPlainObject(body.tierModels)) {

package/src/server/management/anthropic-reset-grant-routes.ts

@@ -19,6 +19,7 @@ import { captureAnthropicPhysicalSendOwnership, anthropicPhysicalSendOwnershipIs
 import { anthropicCooldownRecoveryFor } from "../../providers/quota/anthropic-cooldown-recovery";
 import { captureProviderAccountQuotaEpoch } from "../../providers/quota/account-cache";
 import { captureOAuthAccountSelection, getAccountSet, getAccountCredentialWithStatus, listAccounts } from "../../oauth/store";
+import { admitAnthropicAccountAfterReset, type AnthropicResetAdmissionEvidence } from "../../providers/anthropic-reset-admission";
 import {
   ANTHROPIC_RESET_GRANT_ID_RE,
   AnthropicResetGrantError,
@@ -74,6 +75,8 @@ export interface AnthropicResetGrantRouteDeps {
   listAccountIds: () => string[];
   activeAccountId: () => string | null;
   accessTokenFor: (accountId: string) => Promise<string>;
+  /** Lift local admission after a journaled reset, bounded by its journal evidence. Tests omit it. */
+  admitReset?: (accountId: string, evidence: AnthropicResetAdmissionEvidence) => Promise<void>;
 }
 
 function defaultDepsFor(ctx: ManagementContext, provider: AnthropicInstanceId): AnthropicResetGrantRouteDeps | null {
@@ -109,6 +112,7 @@ function defaultDepsFor(ctx: ManagementContext, provider: AnthropicInstanceId):
       if (!targetCurrent() || !owner) throw new Error("reset owner changed");
       return snapshot.accessToken;
     },
+    admitReset: (accountId, evidence) => admitAnthropicAccountAfterReset(provider, accountId, evidence),
   };
 }
 
@@ -209,6 +213,16 @@ async function handleConsume(ctx: ManagementContext, injected?: AnthropicResetGr
   }
   if (deps.isCurrent?.() === false) return scopedFail(401, "auth_failed");
   const ledger = { journalPath: deps.journalPath, now: deps.now?.() };
+  // Retry-after cooldowns survive a usage probe. A journaled reset, including a
+  // replay after the process died before admission, has to lift this account,
+  // but only refusals recorded before the claim was journaled and only for the
+  // windows the journal says were cleared. A failed reread must not turn a
+  // spent grant into an error.
+  const admitJournaledReset = async (code: string, evidence: AnthropicResetAdmissionEvidence): Promise<void> => {
+    if (code !== "reset" || deps.isCurrent?.() === false) return;
+    try { await deps.admitReset?.(accountId, evidence); }
+    catch { /* The grant is already spent. */ }
+  };
 
   // A new operation must pass the spend gate on a fresh read. A same-id retry of
   // an open record skips it: that attempt was already gated, and upstream
@@ -242,6 +256,7 @@ async function handleConsume(ctx: ManagementContext, injected?: AnthropicResetGr
   }
   switch (begin.kind) {
     case "replay":
+      await admitJournaledReset(begin.code, { claimedAt: begin.claimedAt, cleared: begin.cleared });
       return jsonResponse(
         { provider, code: begin.code, replayed: true, resetsLeft: begin.resetsLeft, accountId, grantId, operationId },
         200, ctx.req, ctx.config,
@@ -268,7 +283,7 @@ async function handleConsume(ctx: ManagementContext, injected?: AnthropicResetGr
   let settled;
   try {
     settled = settleAnthropicResetOperation(
-      { operationId, code: answer.code, resetsLeft: answer.resetsLeft },
+      { operationId, code: answer.code, resetsLeft: answer.resetsLeft, cleared: answer.cleared },
       { journalPath: deps.journalPath, now: deps.now?.() },
     );
   } catch {
@@ -278,6 +293,7 @@ async function handleConsume(ctx: ManagementContext, injected?: AnthropicResetGr
   // Report what the journal holds. An overlapping same-id attempt may have
   // settled first; its answer is the canonical one.
   const replayed = settled.code !== answer.code || settled.resetsLeft !== answer.resetsLeft;
+  await admitJournaledReset(settled.code, { claimedAt: settled.claimedAt, cleared: settled.cleared });
   return jsonResponse(
     {
       provider,

package/src/server/management/codex-agent-role-routes.ts

@@ -96,12 +96,18 @@ export async function handleCodexAgentRoleRoutes(ctx: ManagementContext): Promis
     return jsonResponse({ error: "invalid JSON body" }, 400, req, config);
   }
 
-  let model: string;
-  let effort: string | undefined;
+  // An omitted model leaves the role's model pin (or its inheritance) alone, an omitted effort
+  // keeps the effort, and an effort of null clears it. A body with neither changes nothing, which
+  // is a client mistake rather than a save, so it is refused before any role file is read.
+  if (body?.model === undefined && body?.effort === undefined) {
+    return jsonResponse({ error: "send a model, an effort, or both", code: "empty_update" }, 400, req, config);
+  }
+  let model: string | undefined;
+  let effort: string | null | undefined;
   let toml: { status: "written" | "unchanged" };
   try {
-    model = roles.validateAgentRoleModel(body?.model);
-    effort = body?.effort === undefined || body.effort === null ? undefined : roles.validateAgentRoleEffort(body.effort);
+    model = body?.model === undefined ? undefined : roles.validateAgentRoleModel(body.model);
+    effort = body?.effort === undefined ? undefined : body.effort === null ? null : roles.validateAgentRoleEffort(body.effort);
     toml = roles.writeCodexAgentRoleModel(role, model, codexHome, effort);
   } catch (error) {
     if (error instanceof roles.AgentRoleModelError) {
@@ -115,10 +121,17 @@ export async function handleCodexAgentRoleRoutes(ctx: ManagementContext): Promis
   // The role TOML is what Codex obeys, so its write stands even when the omo mirror cannot follow.
   let omoStatus: ReturnType<typeof omo.writeOmoRoleModel> | "write_failed";
   try {
-    const reasoning = effort === undefined ? undefined : omo.omoReasoningFor(effort);
+    const reasoning = effort === undefined ? undefined : effort === null ? null : omo.omoReasoningFor(effort);
     omoStatus = omo.writeOmoRoleModel(role, model, omo.omoJsoncPath(), reasoning);
   } catch {
     omoStatus = "write_failed";
   }
-  return jsonResponse({ ok: true, role, model, ...(effort ? { effort } : {}), toml, omoJsonc: { status: omoStatus } }, 200, req, config);
+  return jsonResponse({
+    ok: true,
+    role,
+    ...(model !== undefined ? { model } : {}),
+    ...(effort !== undefined ? { effort } : {}),
+    toml,
+    omoJsonc: { status: omoStatus },
+  }, 200, req, config);
 }