@bitkyc08/opencodex 2.86.0 → 2.87.0

package/src/server/index/optional-listeners.ts

@@ -21,6 +21,7 @@ export { LINK_INGRESS_HOSTNAME } from "./link-listener";
 import type { ServerIngress } from "./serve-options";
 
 export interface OptionalListenerStartContext<T> {
+  startProxy?: typeof import("../../claude/intercept/connect-proxy").startConnectProxy;
   config: OcxConfig;
   publicPort: number;
   requestedPort?: number;
@@ -106,6 +107,7 @@ export function createOptionalListenerSet<T>(linkDeps: LinkListenerDeps = {}): O
       }
       supervisorStop = () => supervisor.stop();
       claudeIntercept.start({
+        startProxy: ctx.startProxy,
         config: ctx.config,
         publicPort: ctx.publicPort,
         requestedPort: ctx.requestedPort,

package/src/server/index/serve-options.ts

@@ -1,4 +1,5 @@
 import type { Server, ServerWebSocket } from "bun";
+import { modelAliasIdPromoter } from "./model-alias-id";
 import type { StartServerDeps } from "./startup-warnings";
 import { isLinkManagementPath } from "../../link/management-routes";
 import {
@@ -1252,6 +1253,7 @@ export function createServeOptions(ctx: ServeOptionsContext) {
             effortRowKnownIds,
           ));
         };
+        const promoteAliasId = modelAliasIdPromoter(config);
         const routedRows = await Promise.all(uniqueCatalogModelsForRawPublicList(goOrdered)
           .filter(m => listAllows(m.provider, m.id))
           .map(async m => {
@@ -1269,8 +1271,11 @@ export function createServeOptions(ctx: ServeOptionsContext) {
                 knownModelIdsForProvider(m.provider, provider, config),
               ).get(m.id)
             : undefined;
+          const effectiveId = !isCombo && !fastModelId && effective
+            ? promoteAliasId(m.provider, m.id, effective.alias, catalogRowFastEligible(m)) ?? publicId
+            : publicId;
           const row = {
-            id: publicId,
+            id: effectiveId,
             object: "model",
             created: 0,
             // This endpoint is an OpenAI-compatible inbound contract. Some clients use
@@ -1279,6 +1284,9 @@ export function createServeOptions(ctx: ServeOptionsContext) {
             owned_by: isCombo ? "openai" : (m.owned_by ?? m.provider),
             ...(isCombo ? { is_combo: true } : {}),
             ...(effective ? { alias_of: `${provider?.alias || m.provider}/${effective.alias}` } : {}),
+            // When preferModelAliasIds promotes the alias to `id`, retain the original
+            // provider/nativeId so clients that need the upstream identity can read it.
+            ...(effectiveId !== publicId ? { native_id: publicId } : {}),
             ...grokEffortFields(m.reasoningEfforts ?? [], m.defaultReasoningEffort),
             ...modelCapabilityFields({
               reasoningEfforts: m.reasoningEfforts,

package/src/server/index/startup-warnings.ts

@@ -149,6 +149,8 @@ export function withRequestLogId(response: Response, requestId: string): Respons
 }
 
 export interface StartServerDeps {
+  /** Test-only CONNECT binder; permits kernel-assigned ports without probe-and-release races. */
+  startClaudeInterceptProxy?: typeof import("../../claude/intercept/connect-proxy").startConnectProxy;
   /** Test-only seam; production always initializes its own management credential state. */
   managementAuthState?: ManagementAuthState;
   /** Test-only route dependencies, forwarded only after management admission succeeds. */

package/src/server/index.ts

@@ -738,7 +738,7 @@ function startServerWithSpendLedgerOwner(port: number | undefined, deps: StartSe
         throw new AuxiliaryListenerBindError("hub.managementIngress", managementIngressPort, "127.0.0.1", error);
       }
     }
-    optionalListeners.start({ config, publicPort: server.port ?? listenPort, requestedPort: listenPort,
+    optionalListeners.start({ config, publicPort: server.port ?? listenPort, requestedPort: listenPort, startProxy: deps.startClaudeInterceptProxy,
       maxRequestBodySize: inboundBodyLimitBytes, dispatch: (req, requestServer) => serveOptions.fetch(req, requestServer) });
   } catch (error) {
     unregisterQuotaAutoRefresh?.();

package/src/server/inference/advisor-diagnostics.ts

@@ -0,0 +1,31 @@
+import type { RequestLogContext } from "../request-log";
+import { ADVISOR_INTERNAL_CAPABILITY_HEADER, isInternalCallCapability } from "../../lib/local-internal-call-capability";
+
+export const ADVISOR_REASONING_HEADER = "x-opencodex-advisor-reasoning";
+const EFFORTS = new Set(["none", "minimal", "low", "medium", "high", "xhigh", "max", "ultra"]);
+
+/** Native Chat sends the finalized body directly instead of the translating adapter builder. */
+export function observeAdvisorNativeReasoning(headers: Headers, log: RequestLogContext, body: string): void {
+  if (!isInternalCallCapability(headers.get(ADVISOR_INTERNAL_CAPABILITY_HEADER))) return;
+  delete log.effectiveEffort;
+  try {
+    const effort = JSON.parse(body)?.reasoning_effort;
+    if (typeof effort === "string" && EFFORTS.has(effort)) log.effectiveEffort = effort;
+  } catch { /* absence of evidence stays unreported */ }
+}
+
+/** Only the authenticated internal caller receives adapter-owned serialization evidence. */
+export function attachAdvisorReasoning(response: Response, log: RequestLogContext): Response {
+  const headers = new Headers(response.headers);
+  headers.set(ADVISOR_REASONING_HEADER, JSON.stringify({
+    effectiveEffort: log.effectiveEffort && EFFORTS.has(log.effectiveEffort) ? log.effectiveEffort : null,
+  }));
+  return new Response(response.body, { status: response.status, statusText: response.statusText, headers });
+}
+
+export function readAdvisorReasoning(headers: Headers): string | null {
+  try {
+    const value = JSON.parse(headers.get(ADVISOR_REASONING_HEADER) ?? "null")?.effectiveEffort;
+    return typeof value === "string" && EFFORTS.has(value) ? value : null;
+  } catch { return null; }
+}

package/src/server/management/advisor-routes.ts

@@ -20,10 +20,12 @@ import {
   isCurrentAdvisorContextSharingConsent,
   isValidAdvisorEffort,
   isValidAdvisorPolicy,
+  isValidAdvisorTaskLimit,
   resolveAdvisorSettings,
   type AdvisorEffort,
   type AdvisorPolicy,
 } from "../../advisor/settings";
+import { advisorActivityStore } from "../../advisor/activity";
 
 const INVALID_BODY = Symbol("invalid-body");
 
@@ -33,6 +35,7 @@ interface AdvisorPatch {
   effort?: AdvisorEffort;
   policy?: AdvisorPolicy;
   timeoutMs?: number;
+  maxConsultationsPerTask?: number;
   /** "v1" records current consent. null removes it. Enabling does not imply this field. */
   contextSharingConsent?: typeof ADVISOR_CONTEXT_SHARING_CONSENT_VERSION | null;
   reset?: boolean;
@@ -40,7 +43,7 @@ interface AdvisorPatch {
 
 type ParsedPatch = { ok: true; patch: AdvisorPatch } | { ok: false; code: string; message: string };
 
-const PATCH_KEYS = new Set(["enabled", "model", "effort", "policy", "timeoutMs", "contextSharingConsent", "reset"]);
+const PATCH_KEYS = new Set(["enabled", "model", "effort", "policy", "timeoutMs", "maxConsultationsPerTask", "contextSharingConsent", "reset"]);
 
 type Rec = Record<string, unknown>;
 function isRec(value: unknown): value is Rec {
@@ -50,9 +53,9 @@ function isRec(value: unknown): value is Rec {
 /** Strict: unknown keys and wrong types are refused; messages name the field, never the value. */
 export function parseAdvisorSettingsPatch(body: unknown): ParsedPatch {
   if (!isRec(body)) return { ok: false, code: "invalid_body", message: "body must be a JSON object" };
-  if (Object.keys(body).length === 0) return { ok: false, code: "empty_body", message: "body must set at least one of enabled, model, effort, policy, timeoutMs, contextSharingConsent or reset" };
+  if (Object.keys(body).length === 0) return { ok: false, code: "empty_body", message: "body must set at least one supported advisor setting or reset" };
   for (const key of Object.keys(body)) {
-    if (!PATCH_KEYS.has(key)) return { ok: false, code: "unknown_field", message: "body accepts only enabled, model, effort, policy, timeoutMs, contextSharingConsent and reset" };
+    if (!PATCH_KEYS.has(key)) return { ok: false, code: "unknown_field", message: "body accepts only enabled, model, effort, policy, timeoutMs, maxConsultationsPerTask, contextSharingConsent and reset" };
   }
   const patch: AdvisorPatch = {};
   if (body.reset !== undefined) {
@@ -86,7 +89,7 @@ export function parseAdvisorSettingsPatch(body: unknown): ParsedPatch {
   }
   if (body.policy !== undefined) {
     if (!isValidAdvisorPolicy(body.policy)) {
-      return { ok: false, code: "invalid_policy", message: 'policy must be "manual" or "preflight"' };
+      return { ok: false, code: "invalid_policy", message: 'policy must be "manual", "preflight" or "adaptive"' };
     }
     patch.policy = body.policy;
   }
@@ -96,6 +99,10 @@ export function parseAdvisorSettingsPatch(body: unknown): ParsedPatch {
     }
     patch.timeoutMs = Math.floor(body.timeoutMs);
   }
+  if (body.maxConsultationsPerTask !== undefined) {
+    if (!isValidAdvisorTaskLimit(body.maxConsultationsPerTask)) return { ok: false, code: "invalid_task_limit", message: "maxConsultationsPerTask must be an integer between 1 and 3" };
+    patch.maxConsultationsPerTask = body.maxConsultationsPerTask;
+  }
   if (body.contextSharingConsent !== undefined) {
     if (body.contextSharingConsent === null) {
       patch.contextSharingConsent = null;
@@ -139,6 +146,7 @@ function applyPatchInMemory(config: ManagementContext["config"], patch: AdvisorP
   if (patch.effort !== undefined) current.effort = patch.effort;
   if (patch.policy !== undefined) current.policy = patch.policy;
   if (patch.timeoutMs !== undefined) current.timeoutMs = patch.timeoutMs;
+  if (patch.maxConsultationsPerTask !== undefined) current.maxConsultationsPerTask = patch.maxConsultationsPerTask;
   if (patch.contextSharingConsent === null) delete current.contextSharingConsent;
   else if (patch.contextSharingConsent !== undefined) current.contextSharingConsent = patch.contextSharingConsent;
   config.advisor = current as ManagementContext["config"]["advisor"];
@@ -152,6 +160,9 @@ function isConfigLockContention(error: unknown): boolean {
 
 export async function handleAdvisorRoutes(ctx: ManagementContext): Promise<Response | null> {
   const { url, req, config } = ctx;
+  if (url.pathname === "/api/advisor/activity" && req.method === "GET") {
+    return jsonResponse({ entries: advisorActivityStore(config).snapshot(), retention: "process", limit: 100 }, 200, req, config);
+  }
   if (url.pathname !== "/api/advisor/settings") return null;
 
   if (req.method === "GET") return jsonResponse(advisorInfo(config), 200, req, config);

package/src/server/management/claude-desktop-picker-routes.ts

@@ -44,7 +44,7 @@ export function pickerPreferenceOn(config: Pick<OcxConfig, "claudeCode">): boole
 }
 
 const PICKER_BODY_KEYS = new Set(["enabled", "persist", "trustedLocally", "callerAddedTrust"]);
-/** Enable outcomes that are progress, not refusal: on, waiting for a Desktop restart, or for the keychain step. */
+/** Enable outcomes that are progress, not refusal: on, waiting for a Desktop restart, or for certificate trust. */
 const ENABLE_ACCEPTED = new Set(["active", "restart_required", "trust_pending"]);
 
 interface PickerRequestBody { enabled: boolean; persist: boolean; trustedLocally?: boolean; callerAddedTrust?: boolean }

package/src/server/management/combo-routes.ts

@@ -52,6 +52,15 @@ import {
   setDebugSettings,
   type DebugFlag,
 } from "../../lib/debug-settings";
+import { mergeModelCapabilities, modelCapabilitiesConfigError } from "../../config/provider-validation";
+import { modelRecordValue } from "../../reasoning-effort";
+import { commitProviderPatch } from "./provider-patch-transaction";
+import { ConfigWritePublishedError } from "../../config/persist-unlocked";
+import {
+  customRowInputModalities,
+  isVisionSidecarConsumer,
+  modelAcceptsImageInput,
+} from "../../vision/eligibility";
 import type { OcxClaudeCodeConfig, OcxComboConfig, OcxConfig, OcxCustomModel, OcxProviderConfig, OcxComboCooldownWaitPolicy } from "../../types";
 import { drainAndShutdown } from "../lifecycle";
 import { reconcileLiveStateStores } from "../../lib/state-store-registrations";
@@ -116,6 +125,43 @@ function sparseComboConfig<T extends {
   };
 }
 
+interface VisionSidecarTarget {
+  provider: string;
+  model: string;
+}
+
+/**
+ * Request-only PUT field: combo members to declare text-only so the Vision Sidecar
+ * covers them when the combo accepts images. Every entry must be an exact target of
+ * the submitted combo, and the whole field is validated before any config mutation.
+ * Nothing from here is persisted under config.combos.
+ */
+function parseVisionSidecarTargets(
+  raw: unknown,
+  comboTargetKeys: ReadonlySet<string>,
+): { targets?: VisionSidecarTarget[]; error?: string } {
+  if (raw === undefined) return {};
+  if (!Array.isArray(raw)) return { error: "visionSidecarTargets must be an array" };
+  const seen = new Set<string>();
+  const targets: VisionSidecarTarget[] = [];
+  for (const entry of raw) {
+    if (!isPlainRecord(entry)) return { error: "visionSidecarTargets entries must be objects" };
+    const provider = typeof entry.provider === "string" ? entry.provider.trim() : "";
+    const model = typeof entry.model === "string" ? entry.model.trim() : "";
+    if (!provider || !model) {
+      return { error: "visionSidecarTargets entries must have nonblank provider and model" };
+    }
+    const key = `${provider}/${model}`;
+    if (!comboTargetKeys.has(key)) {
+      return { error: `visionSidecarTargets entry "${key}" is not a target of this combo` };
+    }
+    if (seen.has(key)) continue;
+    seen.add(key);
+    targets.push({ provider, model });
+  }
+  return { targets };
+}
+
 export async function handleComboRoutes(ctx: ManagementContext): Promise<Response | null> {
   const { req, url, config, deps, convergeCodexCatalog, syncClaudeAgentDefsBestEffort } = ctx;
 
@@ -176,6 +222,9 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
     const requestedCombo: Record<string, unknown> = body.combo;
     const effectiveCombo = {
       ...requestedCombo,
+      ...(!Object.hasOwn(requestedCombo, "allowMeteredTargets") && previous?.allowMeteredTargets === true
+        ? { allowMeteredTargets: true }
+        : {}),
       ...(!Object.hasOwn(requestedCombo, "cooldownMs") && previous?.cooldownMs !== undefined
         ? { cooldownMs: previous.cooldownMs }
         : {}),
@@ -203,7 +252,7 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
               // A non-record entry stays as the client sent it so comboConfigError reports it.
               // Reading `lastResort` off it here would throw in place of that structured 400.
               if (!isPlainRecord(target)) return target;
-              if (Object.hasOwn(target, "lastResort")) return target;
+              if (["lastResort", "metered"].every(key => Object.hasOwn(target, key))) return target;
               const rawProvider = target.provider;
               const rawModel = target.model;
               if (typeof rawProvider !== "string" || typeof rawModel !== "string") return target;
@@ -214,7 +263,13 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
               const before = previous.targets.find(
                 candidate => candidate.provider === provider && candidate.model === model,
               );
-              return before?.lastResort ? { ...target, lastResort: true } : target;
+              // `metered` is carried the same way: dropping it on a GUI round-trip would open a
+              // pay-per-use target to every issued key.
+              return {
+                ...target,
+                ...(!Object.hasOwn(target, "lastResort") && before?.lastResort ? { lastResort: true } : {}),
+                ...(!Object.hasOwn(target, "metered") && before?.metered ? { metered: true } : {}),
+              };
             }),
           }
         : {}),
@@ -280,6 +335,54 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
       if (routeError) return jsonResponse({ error: issue ? `combo "${otherId}": ${routeError}` : routeError }, 400);
     }
     const normalized = normalizeComboConfig(effectiveCombo as unknown as OcxComboConfig);
+    const sidecarParsed = parseVisionSidecarTargets(
+      body.visionSidecarTargets,
+      new Set(normalized.targets.map((target) => `${target.provider}/${target.model}`)),
+    );
+    if (sidecarParsed.error) return jsonResponse({ error: sidecarParsed.error }, 400);
+    const sidecarPatches = new Map<string, Record<string, { inputModalities: string[] }>>();
+    if (sidecarParsed.targets?.length) {
+      if (normalized.imageInput === "disabled") {
+        return jsonResponse({ error: "visionSidecarTargets requires imageInput not disabled" }, 400);
+      }
+      for (const { provider, model } of sidecarParsed.targets) {
+        const providerRow = config.providers?.[provider];
+        if (!providerRow) {
+          return jsonResponse({ error: `visionSidecarTargets entry "${provider}/${model}" has no configured provider` }, 400);
+        }
+        // A text-only declaration would HIDE a real capability; never overwrite one.
+        if (modelAcceptsImageInput(config, { provider, id: model }) === true) {
+          return jsonResponse({ error: `visionSidecarTargets entry "${provider}/${model}" already accepts image input` }, 400);
+        }
+        // Already a consumer through any runtime source (exact declaration, custom row,
+        // noVisionModels, legacy record, registry enrichment): the catalog already
+        // advertises image for it. Writing the declaration again would be a no-op write.
+        if (isVisionSidecarConsumer(config, provider, model)) continue;
+        // Read the declaration the way the runtime does: exact capability axis, then the
+        // operator's custom row, then the provider's per-model modality hint. A row without
+        // text (audio-only) cannot be widened by the sidecar, and writing ["text"] on the
+        // capability axis would silently override that declaration.
+        const capabilityRow = Object.hasOwn(providerRow.modelCapabilities ?? {}, model)
+          ? providerRow.modelCapabilities?.[model] : undefined;
+        const declared = capabilityRow?.inputModalities
+          ?? customRowInputModalities(config, provider, model)
+          ?? modelRecordValue(providerRow.modelInputModalities, model);
+        if (declared !== undefined && !declared.includes("text")) {
+          return jsonResponse({ error: `visionSidecarTargets entry "${provider}/${model}" is declared without text input; the Vision Sidecar cannot cover it` }, 400);
+        }
+        const patch = sidecarPatches.get(provider) ?? {};
+        patch[model] = { inputModalities: ["text"] };
+        sidecarPatches.set(provider, patch);
+      }
+      for (const [providerName, patch] of sidecarPatches) {
+        // Validate the map that will be persisted, not just the patch: a provider already at
+        // the modelCapabilities cap would otherwise save an oversized map that load-time
+        // sanitization truncates, silently dropping the new text-only declaration.
+        const merged = mergeModelCapabilities(config.providers?.[providerName]?.modelCapabilities, patch);
+        const error = modelCapabilitiesConfigError(patch) ?? (merged ? modelCapabilitiesConfigError(merged) : null);
+        if (error) return jsonResponse({ error: `visionSidecarTargets for provider "${providerName}": ${error}` }, 400);
+      }
+    }
     // Persist only non-default identity/capability fields so config stays sparse.
     // Capability defaults (`imageInput`, `reasoningEffortMode`) go through the same
     // helper the GET/PUT responses use, so the wire shape and the stored shape cannot drift.
@@ -295,9 +398,10 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
       // would add a noise key to every target of every combo, including ones that never use
       // the policy (#5736). Only the opt-in value is stored, matching how the combo-level
       // policy is handled in sparseComboConfig.
-      targets: normalizedBase.targets.map(({ lastResort, modelProfile, ...target }) => ({
+      targets: normalizedBase.targets.map(({ lastResort, metered, modelProfile, ...target }) => ({
         ...target,
         ...(lastResort ? { lastResort: true } : {}),
+        ...(metered ? { metered: true } : {}),
         ...(modelProfile ? { modelProfile } : {}),
       })),
       ...(normalizedAlias ? { alias: normalizedAlias } : {}),
@@ -340,58 +444,80 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
       const targetError = shadowCallTargetError({ ...config, combos: nextCombos }, migratedShadowTarget);
       if (targetError) return jsonResponse({ error: targetError }, 400);
     }
-    config.combos = nextCombos;
-    if (migratedModels.size > 0) {
-      const migrateReference = (model: string): string => migratedModels.get(model) ?? model;
-      const migrateAgentReference = (model: string): string => {
-        const migrated = migrateReference(model);
-        if (migrated !== model) shouldSyncClaudeAgentDefs = true;
-        return migrated;
-      };
-      if (config.subagentModels) {
-        config.subagentModels = [...new Set(config.subagentModels.map(migrateAgentReference))];
-      }
-      if (config.injectionModel && migratedModels.has(config.injectionModel)) {
-        config.injectionModel = migrateReference(config.injectionModel);
-      }
-      if (config.shadowCallIntercept?.model && migratedModels.has(config.shadowCallIntercept.model)) {
-        config.shadowCallIntercept = {
-          ...config.shadowCallIntercept,
-          model: migrateReference(config.shadowCallIntercept.model),
-        };
-      }
-      if (config.claudeCode) {
-        const claudeCode = { ...config.claudeCode };
-        for (const field of ["model", "smallFastModel"] as const) {
-          if (claudeCode[field]) claudeCode[field] = migrateAgentReference(claudeCode[field]);
-        }
-        if (claudeCode.tierModels) {
-          claudeCode.tierModels = Object.fromEntries(
-            Object.entries(claudeCode.tierModels).map(([tier, model]) => [tier, migrateAgentReference(model)]),
-          );
+    // One atomic transaction: a failed save must restore the combo, the capability
+    // declarations, and every migrated reference together, never partially.
+    try {
+      commitProviderPatch(config, () => {
+        config.combos = nextCombos;
+        if (migratedModels.size > 0) {
+          const migrateReference = (model: string): string => migratedModels.get(model) ?? model;
+          const migrateAgentReference = (model: string): string => {
+            const migrated = migrateReference(model);
+            if (migrated !== model) shouldSyncClaudeAgentDefs = true;
+            return migrated;
+          };
+          if (config.subagentModels) {
+            config.subagentModels = [...new Set(config.subagentModels.map(migrateAgentReference))];
+          }
+          if (config.injectionModel && migratedModels.has(config.injectionModel)) {
+            config.injectionModel = migrateReference(config.injectionModel);
+          }
+          if (config.shadowCallIntercept?.model && migratedModels.has(config.shadowCallIntercept.model)) {
+            config.shadowCallIntercept = {
+              ...config.shadowCallIntercept,
+              model: migrateReference(config.shadowCallIntercept.model),
+            };
+          }
+          if (config.claudeCode) {
+            const claudeCode = { ...config.claudeCode };
+            for (const field of ["model", "smallFastModel"] as const) {
+              if (claudeCode[field]) claudeCode[field] = migrateAgentReference(claudeCode[field]);
+            }
+            if (claudeCode.tierModels) {
+              claudeCode.tierModels = Object.fromEntries(
+                Object.entries(claudeCode.tierModels).map(([tier, model]) => [tier, migrateAgentReference(model)]),
+              );
+            }
+            if (claudeCode.modelMap) {
+              claudeCode.modelMap = Object.fromEntries(
+                Object.entries(claudeCode.modelMap).map(([source, model]) => [source, migrateAgentReference(model)]),
+              );
+            }
+            if (claudeCode.intercept?.modelMap) {
+              claudeCode.intercept = {
+                ...claudeCode.intercept,
+                modelMap: Object.fromEntries(
+                  Object.entries(claudeCode.intercept.modelMap).map(([pickerId, route]) => [pickerId, migrateAgentReference(route)]),
+                ),
+              };
+            }
+            config.claudeCode = claudeCode;
+          }
         }
-        if (claudeCode.modelMap) {
-          claudeCode.modelMap = Object.fromEntries(
-            Object.entries(claudeCode.modelMap).map(([source, model]) => [source, migrateAgentReference(model)]),
-          );
+        if (oldDisabledSelectors.size > 0 && config.disabledModels) {
+          config.disabledModels = [...new Set(config.disabledModels.map(model => (
+            oldDisabledSelectors.has(model) ? newDisabledModel : model
+          )))];
         }
-        if (claudeCode.intercept?.modelMap) {
-          claudeCode.intercept = {
-            ...claudeCode.intercept,
-            modelMap: Object.fromEntries(
-              Object.entries(claudeCode.intercept.modelMap).map(([pickerId, route]) => [pickerId, migrateAgentReference(route)]),
-            ),
-          };
+        for (const [providerName, patch] of sidecarPatches) {
+          const provider = config.providers?.[providerName];
+          if (!provider) continue;
+          const capabilities = mergeModelCapabilities(provider.modelCapabilities, patch);
+          // Re-check under the config lock: a concurrent edit may have grown the map since
+          // the pre-check, and an oversized map must never be published.
+          if (capabilities && modelCapabilitiesConfigError(capabilities)) {
+            throw new Error("modelCapabilities would exceed its limit");
+          }
+          if (capabilities === undefined) delete provider.modelCapabilities;
+          else provider.modelCapabilities = capabilities;
         }
-        config.claudeCode = claudeCode;
+      }, deps.saveConfigPreservingClaudeCode ?? saveConfigPreservingClaudeCode);
+    } catch (error) {
+      if (!(error instanceof ConfigWritePublishedError)) {
+        return jsonResponse({ error: "combo could not be saved" }, 500);
       }
+      throw error;
     }
-    if (oldDisabledSelectors.size > 0 && config.disabledModels) {
-      config.disabledModels = [...new Set(config.disabledModels.map(model => (
-        oldDisabledSelectors.has(model) ? newDisabledModel : model
-      )))];
-    }
-    saveConfigPreservingClaudeCode(config);
     reconcileLiveStateStores();
     clearComboSelectionState(id);
     clearComboTargetCooldowns(id);

package/src/server/management/companion-routes.ts

@@ -27,7 +27,7 @@ function response(): Response {
 }
 
 export async function handleCompanionRoutes(ctx: ManagementContext): Promise<Response | null> {
-  if (ctx.url.pathname === "/api/advisor/settings") {
+  if (ctx.url.pathname === "/api/advisor/settings" || ctx.url.pathname === "/api/advisor/activity") {
     const { handleAdvisorRoutes } = await import("./advisor-routes");
     return handleAdvisorRoutes(ctx);
   }