@bitkyc08/opencodex 2.86.0 → 2.87.0

package/src/server/management/config-routes.ts

@@ -2,8 +2,9 @@ import { MAIN_ACCOUNT_HARD_LOCK_MIN_PERCENT } from "../../codex/quota-types";
 import { resolveMainAccountHardLockThresholds } from "../../codex/main-account-hard-lock";
 import { getMainAccountExternalUsageWarning } from "../../codex/main-account-external-usage";
 import { getObservedMainQuotaIdentityKey } from "../../codex/main-account-cache";
-import { compactionRoutingSchema, memoryModelsSchema } from "../../config/schema/leaf-validators";
+import { compactionRoutingSchema, memoryModelsSchema, reasoningRetentionSchema } from "../../config/schema/leaf-validators";
 import { compactionRecoverySchema } from "../../config/schema/compaction-recovery";
+import { mainAccountHardLockFallbackSchema } from "../../config/schema/main-account-hard-lock-fallback";
 import { anthropicSidecarPatchError } from "../../config/schema/anthropic-account-pool";
 import { isAnthropicInstanceId } from "../../providers/anthropic-instance-id";
 import { captureConfigTopLevelRollback } from "../../config/rebase-provenance";
@@ -121,6 +122,8 @@ import {
 } from "../../lib/debug-settings";
 import type { OcxClaudeCodeConfig, OcxConfig, OcxCustomModel, OcxProviderConfig } from "../../types";
 import { shadowCallTargetError } from "./shadow-call-validation";
+import { autoReviewOverrideConfigError } from "../../config/provider-validation";
+import { ConfigWritePublishedError } from "../../config/persist-unlocked";
 import { drainAndShutdown } from "../lifecycle";
 import { filterRequestLogs, getRequestLogEntries, type RequestLogEntry } from "../request-log";
 import { estimateComboCost, estimateRequestCost, normalizeCostTokens, tokensPerSecond } from "../../usage/cost";
@@ -268,7 +271,6 @@ export async function syncEnabledClientIntegrations(
     try {
       const { writeDesktop3pConfig } = await import("../../claude/desktop-3p");
       const { desktopVisibleNativeSlugs, filterCatalogVisibleModels } = await import("../../codex/catalog");
-      const { fetchAllModels } = await import("../management-api");
       const models = await (deps.fetchAllModels ?? fetchAllModels)(config);
       // Serialized with Desktop mode transitions (picker lock): a first-party switch cannot interleave.
       const { runPickerTransition } = await import("./claude-desktop-picker-routes");
@@ -353,6 +355,7 @@ function publicVisionSidecarSettings(
   };
 }
 
+/** Serve validated settings and publish catalog-affecting changes after persistence. */
 export async function handleConfigRoutes(ctx: ManagementContext): Promise<Response | null> {
   const { req, url, config, deps, convergeCodexCatalog, syncClaudeAgentDefsBestEffort } = ctx;
   const readStartupHealth = deps.getCachedStartupHealth ?? getCachedStartupHealth;
@@ -424,6 +427,9 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       // Absent means on by default: the GUI renders a switch enabled unless explicit false.
       fastRows: config.fastRows !== false,
       codexMainAccountHardLock: isMainAccountHardLockEnabled(config),
+      // Absent means off: the fallback is an extension of the lock, so the GUI renders
+      // the extended fields empty unless an explicit section exists.
+      codexMainAccountHardLockFallback: config.codexMainAccountHardLockFallback ?? null,
       mainAccountHardLock: { ...getMainAccountHardLockStatus(config),
         externalUsage: getMainAccountExternalUsageWarning(getObservedMainQuotaIdentityKey()) },
       // Absent means the historical auto-open, so the GUI can render the toggle
@@ -437,6 +443,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       codexDesktopSwitches: describeCodexDesktopSwitches(config, await observedCodexDesktopSwitchApply()),
       compactionRouting: config.compactionRouting ?? null,
       compactionRecovery: config.compactionRecovery ?? null,
+      reasoningRetention: config.reasoningRetention ?? null,
       // Absent means both phases keep their existing routes; the GUI renders that as "Off".
       memoryModels: config.memoryModels ?? null,
       startupHealth: await readStartupHealthSnapshot(config),
@@ -530,11 +537,13 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       fastRows?: unknown;
       codexMainAccountHardLock?: unknown;
       codexMainAccountHardLockThresholds?: unknown;
+      codexMainAccountHardLockFallback?: unknown;
       codexDesktopAuthless?: unknown;
       codexClientCompaction?: unknown;
       compactionRouting?: unknown;
       compactionRecovery?: unknown;
       memoryModels?: unknown;
+      reasoningRetention?: unknown;
     };
     if (body.codexAutoStart === undefined
       && body.streamMode === undefined
@@ -547,12 +556,14 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       && body.fastRows === undefined
       && body.codexMainAccountHardLock === undefined
       && body.codexMainAccountHardLockThresholds === undefined
+      && body.codexMainAccountHardLockFallback === undefined
       && body.codexDesktopAuthless === undefined
       && body.codexClientCompaction === undefined
       && body.compactionRouting === undefined
       && body.compactionRecovery === undefined
+      && body.reasoningRetention === undefined
       && body.memoryModels === undefined) {
-      return jsonResponse({ error: "provide codexAutoStart, streamMode, appOwnedMemoryBudgetMb, codexAccountPickerEnabled, codexQuotaAutoRefresh, oauthOpenBrowser, showCodexCredits, ultraFastTier, fastRows, codexMainAccountHardLock, codexMainAccountHardLockThresholds, codexDesktopAuthless, codexClientCompaction, compactionRouting, compactionRecovery, or memoryModels" }, 400);
+      return jsonResponse({ error: "provide codexAutoStart, streamMode, appOwnedMemoryBudgetMb, codexAccountPickerEnabled, codexQuotaAutoRefresh, oauthOpenBrowser, showCodexCredits, ultraFastTier, fastRows, codexMainAccountHardLock, codexMainAccountHardLockThresholds, codexMainAccountHardLockFallback, codexDesktopAuthless, codexClientCompaction, compactionRouting, compactionRecovery, reasoningRetention, or memoryModels" }, 400);
     }
     if (body.codexAutoStart !== undefined && typeof body.codexAutoStart !== "boolean") {
       return jsonResponse({ error: "codexAutoStart boolean is required" }, 400);
@@ -597,6 +608,13 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
         return jsonResponse({ error: "codexMainAccountHardLockThresholds short must not exceed long" }, 400);
       }
     }
+    // null clears the section, like compactionRouting; a present section must fully parse.
+    const hardLockFallback = body.codexMainAccountHardLockFallback == null
+      ? body.codexMainAccountHardLockFallback
+      : mainAccountHardLockFallbackSchema.safeParse(body.codexMainAccountHardLockFallback);
+    if (hardLockFallback != null && !hardLockFallback.success) {
+      return jsonResponse({ error: "codexMainAccountHardLockFallback requires a nonblank model selector and an optional declared reasoningEffort" }, 400);
+    }
     if (body.codexDesktopAuthless !== undefined && typeof body.codexDesktopAuthless !== "boolean") {
       return jsonResponse({ error: "codexDesktopAuthless boolean is required" }, 400);
     }
@@ -614,6 +632,8 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
     const memoryModels = body.memoryModels == null
       ? body.memoryModels
       : memoryModelsSchema.safeParse(body.memoryModels);
+    const reasoningRetention = body.reasoningRetention == null ? body.reasoningRetention : reasoningRetentionSchema.safeParse(body.reasoningRetention);
+    if (reasoningRetention != null && !reasoningRetention.success) return jsonResponse({ error: "reasoningRetention requires optional boolean enabled, maxContextPercent greater than 0 and at most 100 and/or positive integer maxTokens; no other fields are allowed" }, 400);
     if (memoryModels != null && !memoryModels.success) {
       return jsonResponse({ error: "memoryModels requires a nonblank model and an optional declared reasoningEffort per configured phase, and no other fields" }, 400);
     }
@@ -646,7 +666,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
     )) {
       return jsonResponse({ error: `appOwnedMemoryBudgetMb must be an integer from ${MIN_APP_OWNED_MEMORY_BUDGET_MB} to ${MAX_APP_OWNED_MEMORY_BUDGET_MB}` }, 400);
     }
-    const restoreCompactionRouting = captureConfigTopLevelRollback(config, ["compactionRouting", "compactionRecovery", "memoryModels"]);
+    const restoreCompactionRouting = captureConfigTopLevelRollback(config, ["compactionRouting", "compactionRecovery", "memoryModels", "reasoningRetention"]);
     const previousSettings = {
       codexAutoStart: config.codexAutoStart,
       hasCodexAutoStart: Object.hasOwn(config, "codexAutoStart"),
@@ -672,6 +692,8 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       hasCodexMainAccountHardLockThresholds: Object.hasOwn(config, "codexMainAccountHardLockThresholds"),
       codexMainAccountHardLock: config.codexMainAccountHardLock,
       hasCodexMainAccountHardLock: Object.hasOwn(config, "codexMainAccountHardLock"),
+      codexMainAccountHardLockFallback: config.codexMainAccountHardLockFallback,
+      hasCodexMainAccountHardLockFallback: Object.hasOwn(config, "codexMainAccountHardLockFallback"),
       codexDesktopAuthless: config.codexDesktopAuthless,
       hasCodexDesktopAuthless: Object.hasOwn(config, "codexDesktopAuthless"),
       codexClientCompaction: config.codexClientCompaction,
@@ -717,6 +739,8 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       if (hardLockThresholds !== undefined) config.codexMainAccountHardLockThresholds = { ...hardLockThresholds };
       if (body.codexMainAccountHardLock === false) config.codexMainAccountHardLock = false;
       else if (body.codexMainAccountHardLock === true) deleteConfigTopLevelKey(config, "codexMainAccountHardLock");
+      if (hardLockFallback === null) deleteConfigTopLevelKey(config, "codexMainAccountHardLockFallback");
+      else if (hardLockFallback?.success) config.codexMainAccountHardLockFallback = hardLockFallback.data;
       if (body.codexDesktopAuthless === true) config.codexDesktopAuthless = true;
       else if (body.codexDesktopAuthless === false) deleteConfigTopLevelKey(config, "codexDesktopAuthless");
       if (body.codexClientCompaction === true) config.codexClientCompaction = true;
@@ -725,6 +749,8 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       else if (compactionRouting?.success) config.compactionRouting = compactionRouting.data;
       if (compactionRecovery === null) deleteConfigTopLevelKey(config, "compactionRecovery");
       else if (compactionRecovery?.success) config.compactionRecovery = compactionRecovery.data;
+      if (reasoningRetention === null) deleteConfigTopLevelKey(config, "reasoningRetention");
+      else if (reasoningRetention?.success) config.reasoningRetention = reasoningRetention.data;
       // Null clears both phases; the GUI sends that when neither row names a model.
       if (memoryModels === null) deleteConfigTopLevelKey(config, "memoryModels");
       else if (memoryModels?.success) config.memoryModels = memoryModels.data;
@@ -775,6 +801,9 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       if (previousSettings.hasCodexMainAccountHardLock) {
         config.codexMainAccountHardLock = previousSettings.codexMainAccountHardLock;
       } else deleteConfigTopLevelKey(config, "codexMainAccountHardLock");
+      if (previousSettings.hasCodexMainAccountHardLockFallback) {
+        config.codexMainAccountHardLockFallback = previousSettings.codexMainAccountHardLockFallback;
+      } else deleteConfigTopLevelKey(config, "codexMainAccountHardLockFallback");
       if (previousSettings.hasCodexDesktopAuthless) {
         config.codexDesktopAuthless = previousSettings.codexDesktopAuthless;
       } else deleteConfigTopLevelKey(config, "codexDesktopAuthless");
@@ -836,10 +865,12 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       codexDesktopSwitches,
       compactionRouting: config.compactionRouting ?? null,
       compactionRecovery: config.compactionRecovery ?? null,
+      reasoningRetention: config.reasoningRetention ?? null,
       // The panel re-reads its own save response, so a missing block would render both
       // phases as "Off" while the server kept them.
       memoryModels: config.memoryModels ?? null,
       codexMainAccountHardLock: isMainAccountHardLockEnabled(config),
+      codexMainAccountHardLockFallback: config.codexMainAccountHardLockFallback ?? null,
       mainAccountHardLock: { ...getMainAccountHardLockStatus(config),
         externalUsage: getMainAccountExternalUsageWarning(getObservedMainQuotaIdentityKey()) },
       startupHealth: await readStartupHealthSnapshot(config),
@@ -1058,6 +1089,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
     // Read BEFORE the mutation below: the Codex-side key follows the switch, and a flip is the
     // only case that owes a config.toml rewrite.
     const webSearchEnabledBefore = config.webSearchSidecar?.enabled !== false;
+    const visionEnabledBefore = config.visionSidecar?.enabled !== false;
     if (body.webSearch) {
       const pairTouched = body.webSearch.model !== undefined || body.webSearch.backend !== undefined || body.webSearch.anthropicInstance !== undefined;
       // Validate against the backend the caller SUBMITTED, across the whole
@@ -1193,6 +1225,11 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       }
     }
     saveConfigPreservingClaudeCode(config);
+    // Publish the changed attachment affordance to both the managed catalog and Codex cache.
+    // Use the existing bounded catalog-only path after persistence, outside the config lock.
+    const catalogRefresh = visionEnabledBefore !== (config.visionSidecar?.enabled !== false)
+      ? await convergeCodexCatalog()
+      : undefined;
     // The sidecar's own switch is only half of what "off" means: Codex keeps declaring its native
     // hosted `web_search` tool until its own mode says otherwise, and the tool a client advertises
     // is the one the model reaches for — which is why an MCP search server needs the client-side
@@ -1218,6 +1255,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
         ...(ws.xSearch ? { xSearch: ws.xSearch } : {}),
       },
       codexWebSearch,
+      catalogRefreshPending: catalogRefresh ? catalogRefreshIsPending(catalogRefresh) : false,
       vision: publicVisionSidecarSettings(config, vision),
       visionModels: vision.models,
       // Echoed for the same reason GET always carries it: the dashboard rebuilds
@@ -1269,5 +1307,38 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       sourceModels: shadowSourceModels(sci.sourceModels),
     });
   }
+
+  if (url.pathname === "/api/auto-review-settings" && req.method === "GET") {
+    const override = config.autoReviewOverride ?? {};
+    return jsonResponse({ enabled: override.enabled === true, model: override.model?.trim() ?? "" });
+  }
+
+  if (url.pathname === "/api/auto-review-settings" && req.method === "PUT") {
+    let raw: unknown;
+    try { raw = await readManagementJsonBody(req); } catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid JSON body" }, 400); }
+    if (!isPlainRecord(raw)) return jsonResponse({ error: "body must be a JSON object" }, 400);
+    const body = raw as { enabled?: unknown; model?: unknown };
+    const shapeError = autoReviewOverrideConfigError(body, "body");
+    if (shapeError) return jsonResponse({ error: shapeError }, 400);
+    const rollback = captureConfigTopLevelRollback(config, ["autoReviewOverride"]);
+    try {
+      config.autoReviewOverride = { ...config.autoReviewOverride };
+      if (typeof body.enabled === "boolean") config.autoReviewOverride.enabled = body.enabled;
+      if (typeof body.model === "string") {
+        const trimmed = body.model.trim();
+        if (trimmed === "") delete config.autoReviewOverride.model;
+        else config.autoReviewOverride.model = trimmed;
+      }
+      (deps.saveConfigPreservingClaudeCode ?? saveConfigPreservingClaudeCode)(config);
+    } catch (error) {
+      if (!(error instanceof ConfigWritePublishedError)) rollback();
+      throw error;
+    }
+    // The catalog carries the reviewer stamps, so the new selector has to reach it now; the
+    // disposition travels in the body like every other catalog-affecting route.
+    const catalogRefresh = await convergeCodexCatalog();
+    const override = config.autoReviewOverride;
+    return jsonResponse({ ok: true, enabled: override.enabled === true, model: override.model ?? "", catalogRefresh });
+  }
   return null;
 }

package/src/server/management/cursor-integration-routes.ts

@@ -16,7 +16,7 @@ import { buildCursorLocalInstallerHint, type CursorLocalInstallerHint } from "..
 import { loadCursorEffortTable } from "../../integrations/cursor-effort-table";
 import { configuredApiAuthToken, isApiAuthRequired, jsonResponse } from "../auth-cors";
 import { localInferenceDestination } from "../../lib/local-destinations";
-import { fetchAllModels } from "../management-api";
+import { fetchAllModels } from "./shared";
 import { predictCursorEffort } from "../models-capabilities";
 import { expandCursorEffortRow, knownEffortRowIds } from "../effort-row";
 import type { ManagementContext } from "./context";

package/src/server/management/model-routes.ts

@@ -109,6 +109,7 @@ import {
 import { removeCredential } from "../../oauth/store";
 import { providerDestinationResolvedError } from "../../lib/destination-policy";
 import { redactSecretString } from "../../lib/redact";
+import { withModelCostRowReplacement } from "../../config/live-reconcile";
 import { enrichProviderFromCatalog, listKeyLoginProviders } from "../../oauth/key-providers";
 import { deriveProviderPresets } from "../../providers/derive";
 import { providerCodexAccountMode } from "../../providers/registry";
@@ -408,7 +409,7 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
     const submitted = { [modelId]: body.cost };
     const validationError = body.cost === null ? null : providerModelCostsConfigError(submitted);
     if (validationError) return jsonResponse({ error: validationError }, 400, req, config);
-    // Copy only validated rate fields; never echo a secret-shaped model key that the
+    // Copy validated rates and policy; never echo a secret-shaped model key that the
     // shared display boundary suppresses. Model IDs remain exact, including slashes.
     const cost = body.cost === null ? null : sanitizeModelCostsForDisplay(submitted)?.[modelId];
     if (cost === undefined) return jsonResponse({ error: "modelId cannot be displayed safely" }, 400, req, config);
@@ -423,10 +424,10 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
     const previousModelCosts = provider.modelCosts;
     const nextModelCosts = Object.assign(
       Object.create(null) as Record<string, ProviderCostOverlay>,
-      previousModelCosts ?? {},
+      structuredClone(previousModelCosts ?? {}),
     );
     if (cost === null) delete nextModelCosts[modelId];
-    else nextModelCosts[modelId] = cost;
+    else nextModelCosts[modelId] = structuredClone(cost);
     const mergedError = providerModelCostsConfigError(nextModelCosts);
     if (mergedError) return jsonResponse({ error: mergedError }, 400, req, config);
     // Keep even an empty map until persistence reconciles individual model keys.
@@ -435,10 +436,14 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
     try {
       // The persistence owner refreshes usage overlays after its atomic write.
       // Price-only edits do not change routing or require catalog convergence.
-      persistConfig(config);
+      withModelCostRowReplacement(config, name, modelId, cost, () => persistConfig(config));
     } catch (error) {
-      if (hadModelCosts) provider.modelCosts = previousModelCosts;
-      else delete provider.modelCosts;
+      // A published write is durable even if bookkeeping failed: recovery GET
+      // must not serve old prices or let a later save undo the committed policy.
+      if (!(error instanceof ConfigWritePublishedError)) {
+        if (hadModelCosts) provider.modelCosts = previousModelCosts;
+        else delete provider.modelCosts;
+      }
       throw error;
     }
     return jsonResponse({ ok: true, provider: name, modelId, cost }, 200, req, config);

package/src/server/management/model-rows.ts

@@ -52,6 +52,7 @@ import { reconcileSuccessfulModelDiscoveries } from "../../providers/new-model-p
 import { initialModelSelectionPending, pendingModelSelectionProviders } from "../../providers/initial-model-selection";
 import { catalogFastRowEligible, fastRowId } from "../fast-row";
 import { knownEffortRowIds } from "../effort-row";
+import { visionSidecarConsumerClassifier } from "../../vision/eligibility";
 
 /**
  * One row of the `/api/models` list. Routed rows spread a `CatalogModel`, so the shape is
@@ -78,6 +79,15 @@ export type ManagementModelRow = Partial<CatalogModel> & {
    * one thing and saves another, so its own writes never appear to take.
    */
   inputModalitiesDeclared?: string[];
+  /**
+   * The runtime's verdict on whether the Vision Sidecar describes this model's images, from
+   * the same predicate the request path consults (legacy `noVisionModels`, registry
+   * enrichment, explicit declarations, custom rows). `inputModalitiesDeclared` cannot answer
+   * this: a model covered ONLY by legacy `noVisionModels` has no declaration while its
+   * advertised modalities are widened to image, so a client inferring consumer status from
+   * declared-vs-advertised modalities misclassifies the row after reload.
+   */
+  visionSidecarConsumer?: boolean;
   /** Exact stored context override, distinct from the effective catalog window. */
   contextWindowDeclared?: number;
   /**
@@ -496,6 +506,7 @@ export async function listManagementModelRows(
   // a hidden real `x--fast` must never become a synthetic selector for another model.
   const knownIds = config.fastRows === false ? new Set<string>() : knownEffortRowIds(config);
   for (const row of rows) knownIds.add(row.namespaced);
+  const isVisionSidecarConsumer = visionSidecarConsumerClassifier(config);
   return rows.map(row => {
     const pending = initialModelSelectionPending(config.providers[row.provider]);
     const modelCosts = Object.hasOwn(config.providers, row.provider)
@@ -519,6 +530,9 @@ export async function listManagementModelRows(
       });
     return {
       ...row,
+      // One shared definition with the request path: the GUI must not re-derive consumer
+      // status from declared-vs-advertised modalities (see the field doc above).
+      visionSidecarConsumer: isVisionSidecarConsumer(row.provider, row.id),
       ...(!row.native && modelCosts !== undefined && Object.hasOwn(modelCosts, row.id)
         ? { manualPricing: true } : {}),
       ...(pending ? { disabled: true, initialSelectionPending: true } : {}),

package/src/server/management/native-integration-routes.ts

@@ -289,13 +289,8 @@ function isConfigLockError(error: unknown): boolean {
  */
 let grokToggleFlight: Promise<Response> | null = null;
 
-/**
- * Dynamic import, never static: management-api.ts statically imports THIS
- * module, so a static import of fetchAllModels back from it would close a
- * cycle. sync.ts:18-21 dodges the same cycle the same way.
- */
 async function defaultFetchAllModels(config: OcxConfig) {
-  const { fetchAllModels } = await import("../management-api");
+  const { fetchAllModels } = await import("./shared");
   return fetchAllModels(config);
 }
 
@@ -665,7 +660,7 @@ function pickerStateNote(picker: DesktopPickerStatus): string {
     return "Picker mode is on: fully quit and reopen Claude Desktop to see OpenCodex models in the Code tab.";
   }
   if (picker.reason === "trust_pending" || picker.reason === "trust_declined") {
-    return `Picker mode is waiting for the keychain step: run ${picker.hint ?? "ocx claude desktop picker trust"}.`;
+    return `Picker mode is waiting for certificate trust: run ${picker.hint ?? "ocx claude desktop picker trust"}.`;
   }
   return `Picker mode is off (${picker.reason}).`;
 }

package/src/server/management/native-reasoning-retention-routes.ts

@@ -0,0 +1,41 @@
+import {
+  nativeReasoningRetentionSchema,
+  resolveNativeReasoningRetention,
+} from "../../config/schema/native-reasoning-retention";
+import { captureConfigTopLevelRollback, deleteConfigTopLevelKey } from "../../config/rebase-provenance";
+import { ConfigWritePublishedError } from "../../config/persist-unlocked";
+import { jsonResponse } from "../auth-cors";
+import { readManagementJsonBodyOr } from "./body";
+import type { ManagementContext } from "./context";
+
+const INVALID_BODY = Symbol("invalid-body");
+
+/** Partial PUTs preserve omitted allowances; null resets the entire block to defaults. */
+export async function handleNativeReasoningRetentionRoutes(ctx: ManagementContext): Promise<Response | null> {
+  const { req, url, config } = ctx;
+  if (url.pathname === "/api/native-reasoning-retention" && req.method === "GET") {
+    return jsonResponse(resolveNativeReasoningRetention(config), 200, req, config);
+  }
+  if (url.pathname === "/api/native-reasoning-retention" && req.method === "PUT") {
+    const body = await readManagementJsonBodyOr(req, INVALID_BODY);
+    const parsed = body === null ? null : nativeReasoningRetentionSchema.safeParse(body);
+    if (parsed !== null && !parsed.success) {
+      return jsonResponse({ error: "body must be null or an object containing only boolean modelSwitch and accountSwitch fields" }, 400, req, config);
+    }
+    // Resolve the saver before changing the live object: no await may interleave mutation/save.
+    const persist = ctx.deps.saveConfigPreservingClaudeCode
+      ?? (await import("../../config")).saveConfigPreservingClaudeCode;
+    const restore = captureConfigTopLevelRollback(config, ["nativeReasoningRetention"]);
+    try {
+      if (parsed === null) deleteConfigTopLevelKey(config, "nativeReasoningRetention");
+      else config.nativeReasoningRetention = { ...config.nativeReasoningRetention, ...parsed.data };
+      persist(config);
+    } catch (error) {
+      // Published bytes remain authoritative even if later bookkeeping failed.
+      if (!(error instanceof ConfigWritePublishedError)) restore();
+      throw error;
+    }
+    return jsonResponse(resolveNativeReasoningRetention(config), 200, req, config);
+  }
+  return null;
+}

package/src/server/management/oauth-account-routes.ts

@@ -23,12 +23,17 @@ import {
 import {
   clearLoginState,
   getLoginStatus,
+  isCodeLoginFlow,
   isPublicOAuthProvider,
   listOAuthProviders,
+  loginFlowAccountId,
   OAUTH_PROVIDERS,
   publicOAuthAuthenticationErrorMessage,
   startLoginFlow,
+  submitLoginCode,
   submitManualLoginCode,
+  supportsCodeLoginMode,
+  waitForLoginSettled,
 } from "../../oauth";
 import { OAuthMutationBusyError, removeCredential } from "../../oauth/store";
 import { cancelKiroDeviceLogin, kiroDeviceConfigBaseline, startKiroDeviceLogin, statusKiroDeviceLogin, type KiroDeviceMethod } from "../../oauth/kiro-device-login";
@@ -253,9 +258,17 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
   // the provider's loopback callback server (inside this process) captures the redirect in the
   // background, then the credential is persisted. The GUI opens the URL and polls /api/oauth/status.
   if (url.pathname === "/api/oauth/login" && req.method === "POST") {
-    const body = await readManagementJsonBodyOr(req, {}) as { provider?: string; addAccount?: boolean; accountId?: string; reauth?: boolean; openBrowser?: unknown; method?: unknown };
+    const body = await readManagementJsonBodyOr(req, {}) as { provider?: string; addAccount?: boolean; accountId?: string; reauth?: boolean; openBrowser?: unknown; method?: unknown; mode?: unknown };
     const provider = (body.provider ?? "").trim().toLowerCase();
     if (!isPublicOAuthProvider(provider)) return jsonResponse({ error: "unknown oauth provider" }, 400);
+    // Omitted mode is the localhost-callback flow this route has always run.
+    if (body.mode !== undefined && body.mode !== "callback" && body.mode !== "code") {
+      return jsonResponse({ error: "mode must be \"callback\" or \"code\"" }, 400);
+    }
+    const codeMode = body.mode === "code";
+    if (codeMode && !supportsCodeLoginMode(provider)) {
+      return jsonResponse({ error: "code_mode_unsupported" }, 400);
+    }
     // Muse may import a local Keychain credential or start a device grant; add-account
     // and reauth skip the import. All management login paths require the dashboard
     // principal before credential acquisition. A raw token proves administration,
@@ -292,10 +305,15 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
       // request may already have mutated live config and yielded before its save.
       const persistedBaseline = readConfigDiagnostics().config;
       // addAccount / reauth forces a fresh browser identity (skips local-CLI token import).
-      const { url: authUrl, instructions, deviceCode } = await startLoginFlow(provider, {
+      // Only code mode gets a flow id: it is what a later paste is pinned to. The callback
+      // flow's lifecycle argument stays exactly as it was.
+      const flowId = codeMode ? randomUUID() : undefined;
+      const { url: authUrl, instructions, deviceCode, expiresAt } = await startLoginFlow(provider, {
         forceLogin: body.addAccount === true || reauth,
         ...(accountId ? { reauthAccountId: accountId } : {}),
+        ...(codeMode ? { codeMode: true } : {}),
       }, {
+        ...(flowId ? { flowId } : {}),
         // startLoginFlow returns the authorization URL before background persistence completes.
         // Three-way reconcile settled disk changes so a failed login cannot leave a provider
         // live-only and an in-flight management mutation cannot be erased before it saves.
@@ -322,7 +340,13 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
         const { openUrl } = await import("../../lib/open-url");
         browserLaunch = (await openUrl(authUrl)).status === "started" ? "started" : "failed";
       }
-      return jsonResponse({ url: authUrl, instructions, deviceCode, browserLaunch });
+      return jsonResponse({
+        url: authUrl,
+        instructions,
+        deviceCode,
+        browserLaunch,
+        ...(codeMode ? { mode: "code", flowId, expiresAt } : {}),
+      });
     } catch (err) {
       if (err instanceof OAuthMutationBusyError) throw err;
       const message = err instanceof Error ? err.message : String(err);
@@ -347,25 +371,69 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
       return result ? jsonResponse(result) : jsonResponse({ error: "unknown login flow" }, 404);
     }
     const { cancelLoginFlow } = await import("../../oauth");
-    const cancelled = cancelLoginFlow(provider);
+    // Without a flow id this cancels the provider's newest in-flight login, which is what the
+    // single-user GUI has always meant by "Cancel". A host running concurrent code logins for
+    // several users passes the flowId it was given at /api/oauth/login.
+    const cancelled = cancelLoginFlow(provider, typeof body.flowId === "string" ? body.flowId : undefined);
     return jsonResponse({ ok: true, cancelled });
   }
 
   // Manual fallback for browser OAuth: paste the final redirect URL (or authorization code)
   // when the browser cannot reach the loopback callback (remote/SSH/blocked localhost).
+  //
+  // A code-display flow (started with mode:"code", or identified by its flowId) gets the
+  // richer contract instead: the paste is answered with the OUTCOME of the token exchange,
+  // not merely with "accepted". A hosted caller has one paste box and no second channel, so
+  // "accepted" is indistinguishable from "worked" to the person typing.
   if (url.pathname === "/api/oauth/login/code" && req.method === "POST") {
-    const body = await readManagementJsonBodyOr(req, {}) as { provider?: string; input?: string; code?: string };
+    const body = await readManagementJsonBodyOr(req, {}) as { provider?: string; input?: string; code?: string; flowId?: unknown };
     const provider = (body.provider ?? "").trim().toLowerCase();
     if (!isPublicOAuthProvider(provider)) return jsonResponse({ error: "unknown oauth provider" }, 400);
     const consentRequired = metaMuseConsentRequired(provider, principal);
     if (consentRequired) return consentRequired;
+    const flowId = typeof body.flowId === "string" ? body.flowId : undefined;
+    const maskEmails = emailMaskingEnabled(config);
+    // Only a code flow of THIS provider gets the outcome-waiting contract; that flow is single-use,
+    // so at most one request ever waits on it. A flow id naming anything else (a callback flow,
+    // another provider's flow, nothing) has no code login to complete.
+    const codeFlow = isCodeLoginFlow(provider, flowId);
+    if (flowId !== undefined && !codeFlow) return jsonResponse({ ok: false, error: "no_pending_login" }, 409);
     const input = typeof body.input === "string" ? body.input : typeof body.code === "string" ? body.code : "";
     // Authorization responses are measured in hundreds of bytes; never accept the
     // generic management-body allowance here.
-    if (input.length > 4096) return jsonResponse({ error: "input too long" }, 400);
-    const result = submitManualLoginCode(provider, input);
-    if (!result.ok) return jsonResponse({ error: result.error }, 409);
-    return jsonResponse({ ok: true });
+    if (input.length > 4096) {
+      return codeFlow
+        ? jsonResponse({ ok: false, error: "malformed_input" }, 400)
+        : jsonResponse({ error: "input too long" }, 400);
+    }
+    if (!codeFlow) {
+      const result = submitManualLoginCode(provider, input);
+      if (!result.ok) return jsonResponse({ error: result.error }, 409);
+      return jsonResponse({ ok: true });
+    }
+    const submitted = submitLoginCode(provider, input, flowId);
+    // Rejected before any token request: the flow stays alive so the user can paste again.
+    if (!submitted.ok) {
+      return jsonResponse({ ok: false, error: submitted.code }, submitted.code === "no_pending_login" ? 409 : 400);
+    }
+    // The exchange itself times out at 30s inside the provider client; this only has to
+    // outlast it so a hung socket surfaces as an answer rather than as a hung request.
+    // Pinned to the flow this paste actually landed in: with several code logins in flight for
+    // one provider, "the newest flow" by the time this resolves may be somebody else's.
+    const settled = await waitForLoginSettled(provider, 60_000, submitted.flowId);
+    const status = getLoginStatus(provider, maskEmails, submitted.flowId);
+    if (!settled) return jsonResponse({ ok: false, error: "provider_unreachable" }, 400);
+    if (status.error) {
+      const failure = status.errorCode ?? "invalid_or_expired_code";
+      return jsonResponse({ ok: false, error: failure }, failure === "no_pending_login" ? 409 : 400);
+    }
+    // A flow dropped while waiting (logout, clear) never completed, whatever the store now holds.
+    if (status.status !== "complete") return jsonResponse({ ok: false, error: "no_pending_login" }, 409);
+    // The account THIS flow wrote, which need not be the active one (reauth of an inactive account,
+    // or a concurrent login that finished later).
+    const savedId = loginFlowAccountId(provider, submitted.flowId);
+    const account = savedId === undefined ? undefined : status.accounts?.find(entry => entry.id === savedId);
+    return jsonResponse({ ok: true, ...(account ? { account: { id: account.id, email: account.email } } : {}) });
   }
 
   if (url.pathname === "/api/oauth/status" && req.method === "GET") {
@@ -597,10 +665,15 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     // sticky limit is refused identically whichever pool is addressed.
     let strategy: string | undefined;
     if (fields.strategy !== undefined) {
-      const parsed = kind === "codex" ? parseCodexAccountPoolStrategy(fields.strategy) : parseGenericPoolStrategy(fields.strategy, provider);
-      if (parsed === null) return jsonResponse({ error: kind === "codex"
-        ? "strategy must be one of: quota, round-robin, fill-first, reset-first"
-        : `strategy must be one of: quota, round-robin, fill-first${provider === "kiro" ? ", least-loaded" : ""}` }, 400);
+      // reset-first is a Codex and generic strategy. The Anthropic runtime implements only
+      // quota, round-robin and fill-first, so that kind keeps refusing it rather than storing
+      // a strategy it would silently ignore.
+      const parsed = kind === "codex" ? parseCodexAccountPoolStrategy(fields.strategy)
+        : kind === "generic" ? parseGenericPoolStrategy(fields.strategy, provider)
+        : parseAccountPoolStrategy(fields.strategy);
+      if (parsed === null) return jsonResponse({ error: kind === "anthropic"
+        ? "strategy must be one of: quota, round-robin, fill-first"
+        : `strategy must be one of: quota, round-robin, fill-first, reset-first${kind === "generic" && provider === "kiro" ? ", least-loaded" : ""}` }, 400);
       strategy = parsed;
     }
     let stickyLimit: number | undefined;
@@ -754,7 +827,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
         if (body.strategy === null) delete next.strategy;
         else {
           const parsed = parseGenericPoolStrategy(body.strategy, provider);
-          if (parsed === null) return jsonResponse({ error: `strategy must be one of: quota, round-robin, fill-first${provider === "kiro" ? ", least-loaded" : ""}` }, 400);
+          if (parsed === null) return jsonResponse({ error: `strategy must be one of: quota, round-robin, fill-first, reset-first${provider === "kiro" ? ", least-loaded" : ""}` }, 400);
           next.strategy = parsed;
         }
       }

package/src/server/management/provider-gcp-credential-routes.ts

@@ -0,0 +1,29 @@
+import { providerCredentialInputError } from "../../providers/api-keys";
+import { commitProviderGcpCredentialRemoval } from "../../providers/gcp-credential-cleanup";
+import { dropProviderCustomModels } from "../../providers/provider-id-rewrite";
+import { forgetProviderContextCap } from "../../providers/context-cap";
+import type { OcxConfig } from "../../types";
+import { jsonResponse } from "../auth-cors";
+
+/** Generic provider writes refuse credential JSON before any config mutation. */
+export function providerGcpCredentialInputResponse(provider: { apiKey?: unknown; apiKeyPool?: unknown }): Response | null {
+  const error = providerCredentialInputError(provider);
+  return error ? jsonResponse({ error }, 400) : null;
+}
+
+/** Keep marker capture, provider removal and persistence in one synchronous locked operation. */
+export function removeProviderWithGcpCredentials(
+  config: OcxConfig,
+  name: string,
+  fallbackDefault: string | undefined,
+  save: (config: OcxConfig) => void,
+): number {
+  return commitProviderGcpCredentialRemoval(config, name, () => {
+    if (fallbackDefault) config.defaultProvider = fallbackDefault;
+    delete config.providers[name];
+    const dropped = dropProviderCustomModels(config, name);
+    forgetProviderContextCap(config, name);
+    save(config);
+    return dropped;
+  });
+}

package/src/server/management/provider-key-pacing-routes.ts

@@ -0,0 +1,31 @@
+import { hasOwnProvider, isValidProviderName } from "../../config";
+import { getKeyCooldownUntil } from "../../providers/key-failover";
+import { providerRequestPacingStatus } from "../../providers/request-pacing";
+import type { OcxProviderConfig } from "../../types";
+import { jsonResponse } from "../auth-cors";
+import type { ManagementContext } from "./context";
+
+/** Read-only provider/key pacing diagnostics; configuration writes stay in the provider PATCH owner. */
+export function handleProviderKeyPacingRoutes(
+  { req, url, config }: Pick<ManagementContext, "req" | "url" | "config">,
+): Response | null {
+  if (url.pathname !== "/api/provider-request-pacing" || req.method !== "GET") return null;
+  const statusFor = (name: string, provider: OcxProviderConfig) => {
+    const status = providerRequestPacingStatus(name, provider);
+    if (status.keys) status.keys = status.keys.map(row => ({ ...row, cooldownUntil: getKeyCooldownUntil(name, row.id) }));
+    return status;
+  };
+  const name = url.searchParams.get("name")?.trim();
+  if (name) {
+    if (!isValidProviderName(name) || !hasOwnProvider(config.providers, name)) {
+      return jsonResponse({ error: "unknown provider" }, 404);
+    }
+    return jsonResponse(statusFor(name, config.providers[name]!));
+  }
+  return jsonResponse(Object.fromEntries(
+    Object.entries(config.providers).map(([providerName, provider]) => [
+      providerName,
+      statusFor(providerName, provider),
+    ]),
+  ));
+}