@bitkyc08/opencodex 2.84.0 → 2.87.0

package/src/server/management/config-routes.ts

@@ -2,8 +2,9 @@ import { MAIN_ACCOUNT_HARD_LOCK_MIN_PERCENT } from "../../codex/quota-types";
 import { resolveMainAccountHardLockThresholds } from "../../codex/main-account-hard-lock";
 import { getMainAccountExternalUsageWarning } from "../../codex/main-account-external-usage";
 import { getObservedMainQuotaIdentityKey } from "../../codex/main-account-cache";
-import { compactionRoutingSchema, memoryModelsSchema } from "../../config/schema/leaf-validators";
+import { compactionRoutingSchema, memoryModelsSchema, reasoningRetentionSchema } from "../../config/schema/leaf-validators";
 import { compactionRecoverySchema } from "../../config/schema/compaction-recovery";
+import { mainAccountHardLockFallbackSchema } from "../../config/schema/main-account-hard-lock-fallback";
 import { anthropicSidecarPatchError } from "../../config/schema/anthropic-account-pool";
 import { isAnthropicInstanceId } from "../../providers/anthropic-instance-id";
 import { captureConfigTopLevelRollback } from "../../config/rebase-provenance";
@@ -121,6 +122,8 @@ import {
 } from "../../lib/debug-settings";
 import type { OcxClaudeCodeConfig, OcxConfig, OcxCustomModel, OcxProviderConfig } from "../../types";
 import { shadowCallTargetError } from "./shadow-call-validation";
+import { autoReviewOverrideConfigError } from "../../config/provider-validation";
+import { ConfigWritePublishedError } from "../../config/persist-unlocked";
 import { drainAndShutdown } from "../lifecycle";
 import { filterRequestLogs, getRequestLogEntries, type RequestLogEntry } from "../request-log";
 import { estimateComboCost, estimateRequestCost, normalizeCostTokens, tokensPerSecond } from "../../usage/cost";
@@ -268,7 +271,6 @@ export async function syncEnabledClientIntegrations(
     try {
       const { writeDesktop3pConfig } = await import("../../claude/desktop-3p");
       const { desktopVisibleNativeSlugs, filterCatalogVisibleModels } = await import("../../codex/catalog");
-      const { fetchAllModels } = await import("../management-api");
       const models = await (deps.fetchAllModels ?? fetchAllModels)(config);
       // Serialized with Desktop mode transitions (picker lock): a first-party switch cannot interleave.
       const { runPickerTransition } = await import("./claude-desktop-picker-routes");
@@ -329,8 +331,8 @@ export async function syncEnabledClientIntegrations(
     config,
     port,
   }, unattended
-    ? ["mcode", "pi", "aside", "raycast", "omo", "commandcode", "droid", "opencode", "kilo"]
-    : ["mcode", "pi", "aside", "raycast", "omo", "cline", "commandcode", "droid", "opencode", "kilo"],
+    ? ["mcode", "pi", "aside", "raycast", "omo", "commandcode", "droid", "opencode", "kilo", "qoder"]
+    : ["mcode", "pi", "aside", "raycast", "omo", "cline", "commandcode", "droid", "opencode", "kilo", "qoder"],
   ...unattended ? [{ refreshOnly: true, admit }] as const : []));
 
   return out;
@@ -353,6 +355,7 @@ function publicVisionSidecarSettings(
   };
 }
 
+/** Serve validated settings and publish catalog-affecting changes after persistence. */
 export async function handleConfigRoutes(ctx: ManagementContext): Promise<Response | null> {
   const { req, url, config, deps, convergeCodexCatalog, syncClaudeAgentDefsBestEffort } = ctx;
   const readStartupHealth = deps.getCachedStartupHealth ?? getCachedStartupHealth;
@@ -424,6 +427,9 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       // Absent means on by default: the GUI renders a switch enabled unless explicit false.
       fastRows: config.fastRows !== false,
       codexMainAccountHardLock: isMainAccountHardLockEnabled(config),
+      // Absent means off: the fallback is an extension of the lock, so the GUI renders
+      // the extended fields empty unless an explicit section exists.
+      codexMainAccountHardLockFallback: config.codexMainAccountHardLockFallback ?? null,
       mainAccountHardLock: { ...getMainAccountHardLockStatus(config),
         externalUsage: getMainAccountExternalUsageWarning(getObservedMainQuotaIdentityKey()) },
       // Absent means the historical auto-open, so the GUI can render the toggle
@@ -437,6 +443,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       codexDesktopSwitches: describeCodexDesktopSwitches(config, await observedCodexDesktopSwitchApply()),
       compactionRouting: config.compactionRouting ?? null,
       compactionRecovery: config.compactionRecovery ?? null,
+      reasoningRetention: config.reasoningRetention ?? null,
       // Absent means both phases keep their existing routes; the GUI renders that as "Off".
       memoryModels: config.memoryModels ?? null,
       startupHealth: await readStartupHealthSnapshot(config),
@@ -530,11 +537,13 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       fastRows?: unknown;
       codexMainAccountHardLock?: unknown;
       codexMainAccountHardLockThresholds?: unknown;
+      codexMainAccountHardLockFallback?: unknown;
       codexDesktopAuthless?: unknown;
       codexClientCompaction?: unknown;
       compactionRouting?: unknown;
       compactionRecovery?: unknown;
       memoryModels?: unknown;
+      reasoningRetention?: unknown;
     };
     if (body.codexAutoStart === undefined
       && body.streamMode === undefined
@@ -547,12 +556,14 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       && body.fastRows === undefined
       && body.codexMainAccountHardLock === undefined
       && body.codexMainAccountHardLockThresholds === undefined
+      && body.codexMainAccountHardLockFallback === undefined
       && body.codexDesktopAuthless === undefined
       && body.codexClientCompaction === undefined
       && body.compactionRouting === undefined
       && body.compactionRecovery === undefined
+      && body.reasoningRetention === undefined
       && body.memoryModels === undefined) {
-      return jsonResponse({ error: "provide codexAutoStart, streamMode, appOwnedMemoryBudgetMb, codexAccountPickerEnabled, codexQuotaAutoRefresh, oauthOpenBrowser, showCodexCredits, ultraFastTier, fastRows, codexMainAccountHardLock, codexMainAccountHardLockThresholds, codexDesktopAuthless, codexClientCompaction, compactionRouting, compactionRecovery, or memoryModels" }, 400);
+      return jsonResponse({ error: "provide codexAutoStart, streamMode, appOwnedMemoryBudgetMb, codexAccountPickerEnabled, codexQuotaAutoRefresh, oauthOpenBrowser, showCodexCredits, ultraFastTier, fastRows, codexMainAccountHardLock, codexMainAccountHardLockThresholds, codexMainAccountHardLockFallback, codexDesktopAuthless, codexClientCompaction, compactionRouting, compactionRecovery, reasoningRetention, or memoryModels" }, 400);
     }
     if (body.codexAutoStart !== undefined && typeof body.codexAutoStart !== "boolean") {
       return jsonResponse({ error: "codexAutoStart boolean is required" }, 400);
@@ -597,6 +608,13 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
         return jsonResponse({ error: "codexMainAccountHardLockThresholds short must not exceed long" }, 400);
       }
     }
+    // null clears the section, like compactionRouting; a present section must fully parse.
+    const hardLockFallback = body.codexMainAccountHardLockFallback == null
+      ? body.codexMainAccountHardLockFallback
+      : mainAccountHardLockFallbackSchema.safeParse(body.codexMainAccountHardLockFallback);
+    if (hardLockFallback != null && !hardLockFallback.success) {
+      return jsonResponse({ error: "codexMainAccountHardLockFallback requires a nonblank model selector and an optional declared reasoningEffort" }, 400);
+    }
     if (body.codexDesktopAuthless !== undefined && typeof body.codexDesktopAuthless !== "boolean") {
       return jsonResponse({ error: "codexDesktopAuthless boolean is required" }, 400);
     }
@@ -614,6 +632,8 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
     const memoryModels = body.memoryModels == null
       ? body.memoryModels
       : memoryModelsSchema.safeParse(body.memoryModels);
+    const reasoningRetention = body.reasoningRetention == null ? body.reasoningRetention : reasoningRetentionSchema.safeParse(body.reasoningRetention);
+    if (reasoningRetention != null && !reasoningRetention.success) return jsonResponse({ error: "reasoningRetention requires optional boolean enabled, maxContextPercent greater than 0 and at most 100 and/or positive integer maxTokens; no other fields are allowed" }, 400);
     if (memoryModels != null && !memoryModels.success) {
       return jsonResponse({ error: "memoryModels requires a nonblank model and an optional declared reasoningEffort per configured phase, and no other fields" }, 400);
     }
@@ -646,7 +666,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
     )) {
       return jsonResponse({ error: `appOwnedMemoryBudgetMb must be an integer from ${MIN_APP_OWNED_MEMORY_BUDGET_MB} to ${MAX_APP_OWNED_MEMORY_BUDGET_MB}` }, 400);
     }
-    const restoreCompactionRouting = captureConfigTopLevelRollback(config, ["compactionRouting", "compactionRecovery", "memoryModels"]);
+    const restoreCompactionRouting = captureConfigTopLevelRollback(config, ["compactionRouting", "compactionRecovery", "memoryModels", "reasoningRetention"]);
     const previousSettings = {
       codexAutoStart: config.codexAutoStart,
       hasCodexAutoStart: Object.hasOwn(config, "codexAutoStart"),
@@ -672,6 +692,8 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       hasCodexMainAccountHardLockThresholds: Object.hasOwn(config, "codexMainAccountHardLockThresholds"),
       codexMainAccountHardLock: config.codexMainAccountHardLock,
       hasCodexMainAccountHardLock: Object.hasOwn(config, "codexMainAccountHardLock"),
+      codexMainAccountHardLockFallback: config.codexMainAccountHardLockFallback,
+      hasCodexMainAccountHardLockFallback: Object.hasOwn(config, "codexMainAccountHardLockFallback"),
       codexDesktopAuthless: config.codexDesktopAuthless,
       hasCodexDesktopAuthless: Object.hasOwn(config, "codexDesktopAuthless"),
       codexClientCompaction: config.codexClientCompaction,
@@ -717,6 +739,8 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       if (hardLockThresholds !== undefined) config.codexMainAccountHardLockThresholds = { ...hardLockThresholds };
       if (body.codexMainAccountHardLock === false) config.codexMainAccountHardLock = false;
       else if (body.codexMainAccountHardLock === true) deleteConfigTopLevelKey(config, "codexMainAccountHardLock");
+      if (hardLockFallback === null) deleteConfigTopLevelKey(config, "codexMainAccountHardLockFallback");
+      else if (hardLockFallback?.success) config.codexMainAccountHardLockFallback = hardLockFallback.data;
       if (body.codexDesktopAuthless === true) config.codexDesktopAuthless = true;
       else if (body.codexDesktopAuthless === false) deleteConfigTopLevelKey(config, "codexDesktopAuthless");
       if (body.codexClientCompaction === true) config.codexClientCompaction = true;
@@ -725,6 +749,8 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       else if (compactionRouting?.success) config.compactionRouting = compactionRouting.data;
       if (compactionRecovery === null) deleteConfigTopLevelKey(config, "compactionRecovery");
       else if (compactionRecovery?.success) config.compactionRecovery = compactionRecovery.data;
+      if (reasoningRetention === null) deleteConfigTopLevelKey(config, "reasoningRetention");
+      else if (reasoningRetention?.success) config.reasoningRetention = reasoningRetention.data;
       // Null clears both phases; the GUI sends that when neither row names a model.
       if (memoryModels === null) deleteConfigTopLevelKey(config, "memoryModels");
       else if (memoryModels?.success) config.memoryModels = memoryModels.data;
@@ -775,6 +801,9 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       if (previousSettings.hasCodexMainAccountHardLock) {
         config.codexMainAccountHardLock = previousSettings.codexMainAccountHardLock;
       } else deleteConfigTopLevelKey(config, "codexMainAccountHardLock");
+      if (previousSettings.hasCodexMainAccountHardLockFallback) {
+        config.codexMainAccountHardLockFallback = previousSettings.codexMainAccountHardLockFallback;
+      } else deleteConfigTopLevelKey(config, "codexMainAccountHardLockFallback");
       if (previousSettings.hasCodexDesktopAuthless) {
         config.codexDesktopAuthless = previousSettings.codexDesktopAuthless;
       } else deleteConfigTopLevelKey(config, "codexDesktopAuthless");
@@ -836,10 +865,12 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       codexDesktopSwitches,
       compactionRouting: config.compactionRouting ?? null,
       compactionRecovery: config.compactionRecovery ?? null,
+      reasoningRetention: config.reasoningRetention ?? null,
       // The panel re-reads its own save response, so a missing block would render both
       // phases as "Off" while the server kept them.
       memoryModels: config.memoryModels ?? null,
       codexMainAccountHardLock: isMainAccountHardLockEnabled(config),
+      codexMainAccountHardLockFallback: config.codexMainAccountHardLockFallback ?? null,
       mainAccountHardLock: { ...getMainAccountHardLockStatus(config),
         externalUsage: getMainAccountExternalUsageWarning(getObservedMainQuotaIdentityKey()) },
       startupHealth: await readStartupHealthSnapshot(config),
@@ -1058,6 +1089,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
     // Read BEFORE the mutation below: the Codex-side key follows the switch, and a flip is the
     // only case that owes a config.toml rewrite.
     const webSearchEnabledBefore = config.webSearchSidecar?.enabled !== false;
+    const visionEnabledBefore = config.visionSidecar?.enabled !== false;
     if (body.webSearch) {
       const pairTouched = body.webSearch.model !== undefined || body.webSearch.backend !== undefined || body.webSearch.anthropicInstance !== undefined;
       // Validate against the backend the caller SUBMITTED, across the whole
@@ -1193,6 +1225,11 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       }
     }
     saveConfigPreservingClaudeCode(config);
+    // Publish the changed attachment affordance to both the managed catalog and Codex cache.
+    // Use the existing bounded catalog-only path after persistence, outside the config lock.
+    const catalogRefresh = visionEnabledBefore !== (config.visionSidecar?.enabled !== false)
+      ? await convergeCodexCatalog()
+      : undefined;
     // The sidecar's own switch is only half of what "off" means: Codex keeps declaring its native
     // hosted `web_search` tool until its own mode says otherwise, and the tool a client advertises
     // is the one the model reaches for — which is why an MCP search server needs the client-side
@@ -1218,6 +1255,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
         ...(ws.xSearch ? { xSearch: ws.xSearch } : {}),
       },
       codexWebSearch,
+      catalogRefreshPending: catalogRefresh ? catalogRefreshIsPending(catalogRefresh) : false,
       vision: publicVisionSidecarSettings(config, vision),
       visionModels: vision.models,
       // Echoed for the same reason GET always carries it: the dashboard rebuilds
@@ -1269,5 +1307,38 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       sourceModels: shadowSourceModels(sci.sourceModels),
     });
   }
+
+  if (url.pathname === "/api/auto-review-settings" && req.method === "GET") {
+    const override = config.autoReviewOverride ?? {};
+    return jsonResponse({ enabled: override.enabled === true, model: override.model?.trim() ?? "" });
+  }
+
+  if (url.pathname === "/api/auto-review-settings" && req.method === "PUT") {
+    let raw: unknown;
+    try { raw = await readManagementJsonBody(req); } catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid JSON body" }, 400); }
+    if (!isPlainRecord(raw)) return jsonResponse({ error: "body must be a JSON object" }, 400);
+    const body = raw as { enabled?: unknown; model?: unknown };
+    const shapeError = autoReviewOverrideConfigError(body, "body");
+    if (shapeError) return jsonResponse({ error: shapeError }, 400);
+    const rollback = captureConfigTopLevelRollback(config, ["autoReviewOverride"]);
+    try {
+      config.autoReviewOverride = { ...config.autoReviewOverride };
+      if (typeof body.enabled === "boolean") config.autoReviewOverride.enabled = body.enabled;
+      if (typeof body.model === "string") {
+        const trimmed = body.model.trim();
+        if (trimmed === "") delete config.autoReviewOverride.model;
+        else config.autoReviewOverride.model = trimmed;
+      }
+      (deps.saveConfigPreservingClaudeCode ?? saveConfigPreservingClaudeCode)(config);
+    } catch (error) {
+      if (!(error instanceof ConfigWritePublishedError)) rollback();
+      throw error;
+    }
+    // The catalog carries the reviewer stamps, so the new selector has to reach it now; the
+    // disposition travels in the body like every other catalog-affecting route.
+    const catalogRefresh = await convergeCodexCatalog();
+    const override = config.autoReviewOverride;
+    return jsonResponse({ ok: true, enabled: override.enabled === true, model: override.model ?? "", catalogRefresh });
+  }
   return null;
 }

package/src/server/management/context.ts

@@ -45,6 +45,10 @@ export interface ManagementRequestIngress {
 }
 
 export interface ManagementApiDeps {
+  desktopStartupSettings?: import("../../codex/desktop-compatibility/startup-settings").DesktopStartupSettingsService;
+  desktopCertificateService?: import("../../codex/desktop-compatibility/certificate-service").DesktopCertificateService;
+  desktopCompatibilityRuntime?: import("../../codex/desktop-compatibility/runtime").DesktopCompatibilityRuntime;
+  onDesktopCompatibilityShutdown?: (shutdown: () => Promise<void>) => void;
   /** Bound to this server's lifecycle owner; absent in direct route tests. */
   listLowQuotaEvents?: (limit?: number) => LowQuotaEvent[];
   /** Bound Claude intercept state, injectable for isolated management-route tests. */

package/src/server/management/cursor-integration-routes.ts

@@ -16,7 +16,7 @@ import { buildCursorLocalInstallerHint, type CursorLocalInstallerHint } from "..
 import { loadCursorEffortTable } from "../../integrations/cursor-effort-table";
 import { configuredApiAuthToken, isApiAuthRequired, jsonResponse } from "../auth-cors";
 import { localInferenceDestination } from "../../lib/local-destinations";
-import { fetchAllModels } from "../management-api";
+import { fetchAllModels } from "./shared";
 import { predictCursorEffort } from "../models-capabilities";
 import { expandCursorEffortRow, knownEffortRowIds } from "../effort-row";
 import type { ManagementContext } from "./context";

package/src/server/management/desktop-compatibility-routes.ts

@@ -0,0 +1,46 @@
+import { jsonResponse } from "../auth-cors";
+import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
+import type { ManagementContext } from "./context";
+import type { DesktopCertificateService } from "../../codex/desktop-compatibility/certificate-service";
+
+const PATH = "/api/codex/desktop-compatibility/certificate";
+let service: DesktopCertificateService | undefined;
+
+export async function handleDesktopCompatibilityRoutes(ctx: ManagementContext): Promise<Response | null> {
+  if (ctx.url.pathname !== PATH) return null;
+  if (ctx.req.method !== "GET" && ctx.req.method !== "POST") return jsonResponse({ error: "method_not_allowed" }, 405);
+  // A local dashboard confirmation precedes any persisted key or CurrentUser Root mutation.
+  // This is caller provenance, not protection against an arbitrary same-user process.
+  if (ctx.req.method === "POST" && (ctx.principal !== "gui-session" || !ctx.trustedLoopbackIngress)) {
+    return jsonResponse({ error: "local_dashboard_confirmation_required" }, 403);
+  }
+  let action: "prepare" | "trust" | "remove-trust" | "renew" | undefined, fingerprint: string | undefined;
+  if (ctx.req.method === "POST") {
+    let body: unknown;
+    try { body = await readManagementJsonBody(ctx.req); }
+    catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid_json" }, 400); }
+    if (!body || typeof body !== "object" || Array.isArray(body)) return jsonResponse({ error: "invalid_request" }, 400);
+    const value = body as Record<string, unknown>;
+    if (Object.keys(value).some(key => !["action", "fingerprint", "confirmed"].includes(key)) || value.confirmed !== true
+      || typeof value.action !== "string" || !["prepare", "trust", "remove-trust", "renew"].includes(value.action)) return jsonResponse({ error: "invalid_request" }, 400);
+    action = value.action as typeof action;
+    if (action !== "prepare" && (typeof value.fingerprint !== "string" || !/^[A-F0-9]{64}$/.test(value.fingerprint))) {
+      return jsonResponse({ error: "certificate_fingerprint_required" }, 400);
+    }
+    if (action === "prepare" && value.fingerprint !== undefined) return jsonResponse({ error: "unexpected_fingerprint" }, 400);
+    fingerprint = value.fingerprint as string | undefined;
+  }
+  const controller = ctx.deps.desktopCertificateService ?? (service ??= (await import("../../codex/desktop-compatibility/certificate-service")).createDesktopCertificateService());
+  try {
+    const status = action === "prepare" ? await controller.prepare()
+      : action === "trust" ? await controller.trust(fingerprint!)
+      : action === "renew" ? await controller.renew(fingerprint!)
+      : action === "remove-trust" ? await controller.removeTrust(fingerprint!) : await controller.status();
+    return jsonResponse({ ok: true, certificate: status });
+  } catch (error) {
+    const code = error && typeof error === "object" && "code" in error ? String(error.code) : "operation_failed";
+    const allowed = new Set(["unsupported", "busy", "not_prepared", "fingerprint_changed", "app_running", "runtime_running", "app_state_unknown", "trust_unknown", "trust_not_applied",
+      "unsafe_path", "unreadable", "expired", "renewal_required", "protection_failed"]);
+    return jsonResponse({ ok: false, error: allowed.has(code) ? code : "operation_failed" }, 409);
+  }
+}

package/src/server/management/desktop-compatibility-runtime-routes.ts

@@ -0,0 +1,46 @@
+import { jsonResponse } from "../auth-cors";
+import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
+import type { ManagementContext } from "./context";
+import type { DesktopCompatibilityRuntime } from "../../codex/desktop-compatibility/runtime";
+
+const PATH = "/api/codex/desktop-compatibility/runtime";
+const ERROR_CODES = new Set(["busy", "unsupported", "test_environment", "stopping", "build_unverified", "egress_proxy_invalid",
+  "trust_required", "certificate_expiring", "certificate_not_prepared", "certificate_invalid", "certificate_expired",
+  "native_identity_unverified", "native_routing_unverified", "cleanup_incomplete", "not_running", "connection_invalid", "connection_changed", "connection_cleanup_required", "connection_unavailable"]);
+
+export async function handleDesktopCompatibilityRuntimeRoutes(ctx: ManagementContext): Promise<Response | null> {
+  if (ctx.url.pathname !== PATH) return null;
+  if (ctx.req.method !== "GET" && ctx.req.method !== "POST") return jsonResponse({ error: "method_not_allowed" }, 405);
+  if (ctx.req.method === "POST" && (ctx.principal !== "gui-session" || !ctx.trustedLoopbackIngress)) return jsonResponse({ error: "local_dashboard_confirmation_required" }, 403);
+  let action: "start" | "stop" | "observe" | "apply" | "launch" | undefined;
+  if (ctx.req.method === "POST") {
+    let body: unknown;
+    try { body = await readManagementJsonBody(ctx.req); }
+    catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid_json" }, 400); }
+    if (!body || typeof body !== "object" || Array.isArray(body)) return jsonResponse({ error: "invalid_request" }, 400);
+    const value = body as Record<string, unknown>;
+    if (Object.keys(value).some(key => !["action", "confirmed", "accountWideConsent"].includes(key)) || value.confirmed !== true
+      || typeof value.action !== "string" || !["start", "stop", "observe", "apply", "launch"].includes(value.action)) return jsonResponse({ error: "invalid_request" }, 400);
+    if (value.action === "apply" ? value.accountWideConsent !== true : value.accountWideConsent !== undefined) return jsonResponse({ error: "invalid_consent_scope" }, 400);
+    action = value.action as typeof action;
+  }
+  const module = ctx.deps.desktopCompatibilityRuntime ? null : await import("../../codex/desktop-compatibility/service");
+  const service: DesktopCompatibilityRuntime = ctx.deps.desktopCompatibilityRuntime ?? module!.getDesktopCompatibilityRuntime();
+  if (module) ctx.deps.onDesktopCompatibilityShutdown?.(module.shutdownDesktopCompatibility);
+  try {
+    if (action === "apply") {
+      const result = await service.apply(true);
+      return jsonResponse({ ok: result.accepted, activation: result, runtime: service.status() }, result.accepted ? 202 : 409);
+    }
+    if (action === "launch") {
+      const result = await service.launch();
+      return jsonResponse({ ok: result.status === "started", launch: result, runtime: service.status() }, result.status === "started" ? 200 : 409);
+    }
+    const result = action === "start" ? await service.start() : action === "stop" ? await service.stop()
+      : action === "observe" ? await service.observe() : service.status();
+    return jsonResponse({ ok: true, runtime: result });
+  } catch (error) {
+    const code = error instanceof Error ? error.message.replace(/^desktop_compatibility_/, "") : "operation_failed";
+    return jsonResponse({ ok: false, error: ERROR_CODES.has(code) ? code : "operation_failed", runtime: service.status() }, 409);
+  }
+}

package/src/server/management/desktop-compatibility-settings-routes.ts

@@ -0,0 +1,27 @@
+import { jsonResponse } from "../auth-cors";
+import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
+import type { ManagementContext } from "./context";
+
+const PATH = "/api/codex/desktop-compatibility/settings";
+export async function handleDesktopCompatibilitySettingsRoutes(ctx: ManagementContext): Promise<Response | null> {
+  if (ctx.url.pathname !== PATH) return null;
+  if (ctx.req.method !== "GET" && ctx.req.method !== "POST") return jsonResponse({ error: "method_not_allowed" }, 405);
+  if (ctx.req.method === "POST" && (ctx.principal !== "gui-session" || !ctx.trustedLoopbackIngress)) return jsonResponse({ error: "local_dashboard_confirmation_required" }, 403);
+  let update: { startOnProxyStart: boolean; revision: string } | undefined;
+  if (ctx.req.method === "POST") {
+    let body: unknown;
+    try { body = await readManagementJsonBody(ctx.req); }
+    catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid_json" }, 400); }
+    if (!body || typeof body !== "object" || Array.isArray(body)) return jsonResponse({ error: "invalid_request" }, 400);
+    const value = body as Record<string, unknown>;
+    if (Object.keys(value).some(key => !["startOnProxyStart", "revision", "confirmed"].includes(key)) || value.confirmed !== true
+      || typeof value.startOnProxyStart !== "boolean" || typeof value.revision !== "string" || !/^[a-f0-9]{64}$/.test(value.revision)) return jsonResponse({ error: "invalid_request" }, 400);
+    update = { startOnProxyStart: value.startOnProxyStart, revision: value.revision };
+  }
+  const service = ctx.deps.desktopStartupSettings ?? (await import("../../codex/desktop-compatibility/startup-settings")).createDesktopStartupSettings({ liveConfig: ctx.config });
+  try { return jsonResponse({ ok: true, settings: update ? service.set(update.startOnProxyStart, update.revision) : service.status() }); }
+  catch (error) {
+    const code = error instanceof Error ? error.message.replace(/^desktop_compatibility_settings_/, "") : "operation_unconfirmed";
+    return jsonResponse({ ok: false, error: ["unavailable", "invalid", "changed", "invalid_request"].includes(code) ? `settings_${code}` : "settings_operation_unconfirmed" }, 409);
+  }
+}

package/src/server/management/model-routes.ts

@@ -109,6 +109,7 @@ import {
 import { removeCredential } from "../../oauth/store";
 import { providerDestinationResolvedError } from "../../lib/destination-policy";
 import { redactSecretString } from "../../lib/redact";
+import { withModelCostRowReplacement } from "../../config/live-reconcile";
 import { enrichProviderFromCatalog, listKeyLoginProviders } from "../../oauth/key-providers";
 import { deriveProviderPresets } from "../../providers/derive";
 import { providerCodexAccountMode } from "../../providers/registry";
@@ -408,7 +409,7 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
     const submitted = { [modelId]: body.cost };
     const validationError = body.cost === null ? null : providerModelCostsConfigError(submitted);
     if (validationError) return jsonResponse({ error: validationError }, 400, req, config);
-    // Copy only validated rate fields; never echo a secret-shaped model key that the
+    // Copy validated rates and policy; never echo a secret-shaped model key that the
     // shared display boundary suppresses. Model IDs remain exact, including slashes.
     const cost = body.cost === null ? null : sanitizeModelCostsForDisplay(submitted)?.[modelId];
     if (cost === undefined) return jsonResponse({ error: "modelId cannot be displayed safely" }, 400, req, config);
@@ -423,10 +424,10 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
     const previousModelCosts = provider.modelCosts;
     const nextModelCosts = Object.assign(
       Object.create(null) as Record<string, ProviderCostOverlay>,
-      previousModelCosts ?? {},
+      structuredClone(previousModelCosts ?? {}),
     );
     if (cost === null) delete nextModelCosts[modelId];
-    else nextModelCosts[modelId] = cost;
+    else nextModelCosts[modelId] = structuredClone(cost);
     const mergedError = providerModelCostsConfigError(nextModelCosts);
     if (mergedError) return jsonResponse({ error: mergedError }, 400, req, config);
     // Keep even an empty map until persistence reconciles individual model keys.
@@ -435,10 +436,14 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
     try {
       // The persistence owner refreshes usage overlays after its atomic write.
       // Price-only edits do not change routing or require catalog convergence.
-      persistConfig(config);
+      withModelCostRowReplacement(config, name, modelId, cost, () => persistConfig(config));
     } catch (error) {
-      if (hadModelCosts) provider.modelCosts = previousModelCosts;
-      else delete provider.modelCosts;
+      // A published write is durable even if bookkeeping failed: recovery GET
+      // must not serve old prices or let a later save undo the committed policy.
+      if (!(error instanceof ConfigWritePublishedError)) {
+        if (hadModelCosts) provider.modelCosts = previousModelCosts;
+        else delete provider.modelCosts;
+      }
       throw error;
     }
     return jsonResponse({ ok: true, provider: name, modelId, cost }, 200, req, config);
@@ -556,9 +561,9 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
       if (!(error instanceof ClientPathError)) throw error;
       return jsonResponse({ error: error.message }, 400, req, config);
     }
-    if ((requested === "raycast" || requested === "droid") && shouldInjectApiAuthHeader(config)) {
+    if ((requested === "raycast" || requested === "droid" || requested === "qoder") && shouldInjectApiAuthHeader(config)) {
       return jsonResponse({
-        error: `${requested === "droid" ? "Factory Droid" : "Raycast"} export requires an unauthenticated loopback destination; this listener requires an admission header the client cannot supply.`,
+        error: `${requested === "droid" ? "Factory Droid" : requested === "qoder" ? "Qoder" : "Raycast"} export requires an unauthenticated loopback destination; this listener requires an admission header the client cannot supply.`,
         reason: "non_loopback",
       }, 400, req, config);
     }

package/src/server/management/model-rows.ts

@@ -52,6 +52,7 @@ import { reconcileSuccessfulModelDiscoveries } from "../../providers/new-model-p
 import { initialModelSelectionPending, pendingModelSelectionProviders } from "../../providers/initial-model-selection";
 import { catalogFastRowEligible, fastRowId } from "../fast-row";
 import { knownEffortRowIds } from "../effort-row";
+import { visionSidecarConsumerClassifier } from "../../vision/eligibility";
 
 /**
  * One row of the `/api/models` list. Routed rows spread a `CatalogModel`, so the shape is
@@ -78,6 +79,15 @@ export type ManagementModelRow = Partial<CatalogModel> & {
    * one thing and saves another, so its own writes never appear to take.
    */
   inputModalitiesDeclared?: string[];
+  /**
+   * The runtime's verdict on whether the Vision Sidecar describes this model's images, from
+   * the same predicate the request path consults (legacy `noVisionModels`, registry
+   * enrichment, explicit declarations, custom rows). `inputModalitiesDeclared` cannot answer
+   * this: a model covered ONLY by legacy `noVisionModels` has no declaration while its
+   * advertised modalities are widened to image, so a client inferring consumer status from
+   * declared-vs-advertised modalities misclassifies the row after reload.
+   */
+  visionSidecarConsumer?: boolean;
   /** Exact stored context override, distinct from the effective catalog window. */
   contextWindowDeclared?: number;
   /**
@@ -496,6 +506,7 @@ export async function listManagementModelRows(
   // a hidden real `x--fast` must never become a synthetic selector for another model.
   const knownIds = config.fastRows === false ? new Set<string>() : knownEffortRowIds(config);
   for (const row of rows) knownIds.add(row.namespaced);
+  const isVisionSidecarConsumer = visionSidecarConsumerClassifier(config);
   return rows.map(row => {
     const pending = initialModelSelectionPending(config.providers[row.provider]);
     const modelCosts = Object.hasOwn(config.providers, row.provider)
@@ -519,6 +530,9 @@ export async function listManagementModelRows(
       });
     return {
       ...row,
+      // One shared definition with the request path: the GUI must not re-derive consumer
+      // status from declared-vs-advertised modalities (see the field doc above).
+      visionSidecarConsumer: isVisionSidecarConsumer(row.provider, row.id),
       ...(!row.native && modelCosts !== undefined && Object.hasOwn(modelCosts, row.id)
         ? { manualPricing: true } : {}),
       ...(pending ? { disabled: true, initialSelectionPending: true } : {}),

package/src/server/management/native-integration-routes.ts

@@ -289,13 +289,8 @@ function isConfigLockError(error: unknown): boolean {
  */
 let grokToggleFlight: Promise<Response> | null = null;
 
-/**
- * Dynamic import, never static: management-api.ts statically imports THIS
- * module, so a static import of fetchAllModels back from it would close a
- * cycle. sync.ts:18-21 dodges the same cycle the same way.
- */
 async function defaultFetchAllModels(config: OcxConfig) {
-  const { fetchAllModels } = await import("../management-api");
+  const { fetchAllModels } = await import("./shared");
   return fetchAllModels(config);
 }
 
@@ -665,7 +660,7 @@ function pickerStateNote(picker: DesktopPickerStatus): string {
     return "Picker mode is on: fully quit and reopen Claude Desktop to see OpenCodex models in the Code tab.";
   }
   if (picker.reason === "trust_pending" || picker.reason === "trust_declined") {
-    return `Picker mode is waiting for the keychain step: run ${picker.hint ?? "ocx claude desktop picker trust"}.`;
+    return `Picker mode is waiting for certificate trust: run ${picker.hint ?? "ocx claude desktop picker trust"}.`;
   }
   return `Picker mode is off (${picker.reason}).`;
 }

package/src/server/management/native-reasoning-retention-routes.ts

@@ -0,0 +1,41 @@
+import {
+  nativeReasoningRetentionSchema,
+  resolveNativeReasoningRetention,
+} from "../../config/schema/native-reasoning-retention";
+import { captureConfigTopLevelRollback, deleteConfigTopLevelKey } from "../../config/rebase-provenance";
+import { ConfigWritePublishedError } from "../../config/persist-unlocked";
+import { jsonResponse } from "../auth-cors";
+import { readManagementJsonBodyOr } from "./body";
+import type { ManagementContext } from "./context";
+
+const INVALID_BODY = Symbol("invalid-body");
+
+/** Partial PUTs preserve omitted allowances; null resets the entire block to defaults. */
+export async function handleNativeReasoningRetentionRoutes(ctx: ManagementContext): Promise<Response | null> {
+  const { req, url, config } = ctx;
+  if (url.pathname === "/api/native-reasoning-retention" && req.method === "GET") {
+    return jsonResponse(resolveNativeReasoningRetention(config), 200, req, config);
+  }
+  if (url.pathname === "/api/native-reasoning-retention" && req.method === "PUT") {
+    const body = await readManagementJsonBodyOr(req, INVALID_BODY);
+    const parsed = body === null ? null : nativeReasoningRetentionSchema.safeParse(body);
+    if (parsed !== null && !parsed.success) {
+      return jsonResponse({ error: "body must be null or an object containing only boolean modelSwitch and accountSwitch fields" }, 400, req, config);
+    }
+    // Resolve the saver before changing the live object: no await may interleave mutation/save.
+    const persist = ctx.deps.saveConfigPreservingClaudeCode
+      ?? (await import("../../config")).saveConfigPreservingClaudeCode;
+    const restore = captureConfigTopLevelRollback(config, ["nativeReasoningRetention"]);
+    try {
+      if (parsed === null) deleteConfigTopLevelKey(config, "nativeReasoningRetention");
+      else config.nativeReasoningRetention = { ...config.nativeReasoningRetention, ...parsed.data };
+      persist(config);
+    } catch (error) {
+      // Published bytes remain authoritative even if later bookkeeping failed.
+      if (!(error instanceof ConfigWritePublishedError)) restore();
+      throw error;
+    }
+    return jsonResponse(resolveNativeReasoningRetention(config), 200, req, config);
+  }
+  return null;
+}