@bitkyc08/opencodex 2.86.0 → 2.88.0

package/src/server/management/native-integration-routes.ts

@@ -289,13 +289,8 @@ function isConfigLockError(error: unknown): boolean {
  */
 let grokToggleFlight: Promise<Response> | null = null;
 
-/**
- * Dynamic import, never static: management-api.ts statically imports THIS
- * module, so a static import of fetchAllModels back from it would close a
- * cycle. sync.ts:18-21 dodges the same cycle the same way.
- */
 async function defaultFetchAllModels(config: OcxConfig) {
-  const { fetchAllModels } = await import("../management-api");
+  const { fetchAllModels } = await import("./shared");
   return fetchAllModels(config);
 }
 
@@ -665,7 +660,7 @@ function pickerStateNote(picker: DesktopPickerStatus): string {
     return "Picker mode is on: fully quit and reopen Claude Desktop to see OpenCodex models in the Code tab.";
   }
   if (picker.reason === "trust_pending" || picker.reason === "trust_declined") {
-    return `Picker mode is waiting for the keychain step: run ${picker.hint ?? "ocx claude desktop picker trust"}.`;
+    return `Picker mode is waiting for certificate trust: run ${picker.hint ?? "ocx claude desktop picker trust"}.`;
   }
   return `Picker mode is off (${picker.reason}).`;
 }

package/src/server/management/native-reasoning-retention-routes.ts

@@ -0,0 +1,41 @@
+import {
+  nativeReasoningRetentionSchema,
+  resolveNativeReasoningRetention,
+} from "../../config/schema/native-reasoning-retention";
+import { captureConfigTopLevelRollback, deleteConfigTopLevelKey } from "../../config/rebase-provenance";
+import { ConfigWritePublishedError } from "../../config/persist-unlocked";
+import { jsonResponse } from "../auth-cors";
+import { readManagementJsonBodyOr } from "./body";
+import type { ManagementContext } from "./context";
+
+const INVALID_BODY = Symbol("invalid-body");
+
+/** Partial PUTs preserve omitted allowances; null resets the entire block to defaults. */
+export async function handleNativeReasoningRetentionRoutes(ctx: ManagementContext): Promise<Response | null> {
+  const { req, url, config } = ctx;
+  if (url.pathname === "/api/native-reasoning-retention" && req.method === "GET") {
+    return jsonResponse(resolveNativeReasoningRetention(config), 200, req, config);
+  }
+  if (url.pathname === "/api/native-reasoning-retention" && req.method === "PUT") {
+    const body = await readManagementJsonBodyOr(req, INVALID_BODY);
+    const parsed = body === null ? null : nativeReasoningRetentionSchema.safeParse(body);
+    if (parsed !== null && !parsed.success) {
+      return jsonResponse({ error: "body must be null or an object containing only boolean modelSwitch and accountSwitch fields" }, 400, req, config);
+    }
+    // Resolve the saver before changing the live object: no await may interleave mutation/save.
+    const persist = ctx.deps.saveConfigPreservingClaudeCode
+      ?? (await import("../../config")).saveConfigPreservingClaudeCode;
+    const restore = captureConfigTopLevelRollback(config, ["nativeReasoningRetention"]);
+    try {
+      if (parsed === null) deleteConfigTopLevelKey(config, "nativeReasoningRetention");
+      else config.nativeReasoningRetention = { ...config.nativeReasoningRetention, ...parsed.data };
+      persist(config);
+    } catch (error) {
+      // Published bytes remain authoritative even if later bookkeeping failed.
+      if (!(error instanceof ConfigWritePublishedError)) restore();
+      throw error;
+    }
+    return jsonResponse(resolveNativeReasoningRetention(config), 200, req, config);
+  }
+  return null;
+}

package/src/server/management/oauth-account-routes.ts

@@ -23,12 +23,17 @@ import {
 import {
   clearLoginState,
   getLoginStatus,
+  isCodeLoginFlow,
   isPublicOAuthProvider,
   listOAuthProviders,
+  loginFlowAccountId,
   OAUTH_PROVIDERS,
   publicOAuthAuthenticationErrorMessage,
   startLoginFlow,
+  submitLoginCode,
   submitManualLoginCode,
+  supportsCodeLoginMode,
+  waitForLoginSettled,
 } from "../../oauth";
 import { OAuthMutationBusyError, removeCredential } from "../../oauth/store";
 import { cancelKiroDeviceLogin, kiroDeviceConfigBaseline, startKiroDeviceLogin, statusKiroDeviceLogin, type KiroDeviceMethod } from "../../oauth/kiro-device-login";
@@ -253,9 +258,17 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
   // the provider's loopback callback server (inside this process) captures the redirect in the
   // background, then the credential is persisted. The GUI opens the URL and polls /api/oauth/status.
   if (url.pathname === "/api/oauth/login" && req.method === "POST") {
-    const body = await readManagementJsonBodyOr(req, {}) as { provider?: string; addAccount?: boolean; accountId?: string; reauth?: boolean; openBrowser?: unknown; method?: unknown };
+    const body = await readManagementJsonBodyOr(req, {}) as { provider?: string; addAccount?: boolean; accountId?: string; reauth?: boolean; openBrowser?: unknown; method?: unknown; mode?: unknown };
     const provider = (body.provider ?? "").trim().toLowerCase();
     if (!isPublicOAuthProvider(provider)) return jsonResponse({ error: "unknown oauth provider" }, 400);
+    // Omitted mode is the localhost-callback flow this route has always run.
+    if (body.mode !== undefined && body.mode !== "callback" && body.mode !== "code") {
+      return jsonResponse({ error: "mode must be \"callback\" or \"code\"" }, 400);
+    }
+    const codeMode = body.mode === "code";
+    if (codeMode && !supportsCodeLoginMode(provider)) {
+      return jsonResponse({ error: "code_mode_unsupported" }, 400);
+    }
     // Muse may import a local Keychain credential or start a device grant; add-account
     // and reauth skip the import. All management login paths require the dashboard
     // principal before credential acquisition. A raw token proves administration,
@@ -292,10 +305,15 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
       // request may already have mutated live config and yielded before its save.
       const persistedBaseline = readConfigDiagnostics().config;
       // addAccount / reauth forces a fresh browser identity (skips local-CLI token import).
-      const { url: authUrl, instructions, deviceCode } = await startLoginFlow(provider, {
+      // Only code mode gets a flow id: it is what a later paste is pinned to. The callback
+      // flow's lifecycle argument stays exactly as it was.
+      const flowId = codeMode ? randomUUID() : undefined;
+      const { url: authUrl, instructions, deviceCode, expiresAt } = await startLoginFlow(provider, {
         forceLogin: body.addAccount === true || reauth,
         ...(accountId ? { reauthAccountId: accountId } : {}),
+        ...(codeMode ? { codeMode: true } : {}),
       }, {
+        ...(flowId ? { flowId } : {}),
         // startLoginFlow returns the authorization URL before background persistence completes.
         // Three-way reconcile settled disk changes so a failed login cannot leave a provider
         // live-only and an in-flight management mutation cannot be erased before it saves.
@@ -322,7 +340,13 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
         const { openUrl } = await import("../../lib/open-url");
         browserLaunch = (await openUrl(authUrl)).status === "started" ? "started" : "failed";
       }
-      return jsonResponse({ url: authUrl, instructions, deviceCode, browserLaunch });
+      return jsonResponse({
+        url: authUrl,
+        instructions,
+        deviceCode,
+        browserLaunch,
+        ...(codeMode ? { mode: "code", flowId, expiresAt } : {}),
+      });
     } catch (err) {
       if (err instanceof OAuthMutationBusyError) throw err;
       const message = err instanceof Error ? err.message : String(err);
@@ -347,25 +371,69 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
       return result ? jsonResponse(result) : jsonResponse({ error: "unknown login flow" }, 404);
     }
     const { cancelLoginFlow } = await import("../../oauth");
-    const cancelled = cancelLoginFlow(provider);
+    // Without a flow id this cancels the provider's newest in-flight login, which is what the
+    // single-user GUI has always meant by "Cancel". A host running concurrent code logins for
+    // several users passes the flowId it was given at /api/oauth/login.
+    const cancelled = cancelLoginFlow(provider, typeof body.flowId === "string" ? body.flowId : undefined);
     return jsonResponse({ ok: true, cancelled });
   }
 
   // Manual fallback for browser OAuth: paste the final redirect URL (or authorization code)
   // when the browser cannot reach the loopback callback (remote/SSH/blocked localhost).
+  //
+  // A code-display flow (started with mode:"code", or identified by its flowId) gets the
+  // richer contract instead: the paste is answered with the OUTCOME of the token exchange,
+  // not merely with "accepted". A hosted caller has one paste box and no second channel, so
+  // "accepted" is indistinguishable from "worked" to the person typing.
   if (url.pathname === "/api/oauth/login/code" && req.method === "POST") {
-    const body = await readManagementJsonBodyOr(req, {}) as { provider?: string; input?: string; code?: string };
+    const body = await readManagementJsonBodyOr(req, {}) as { provider?: string; input?: string; code?: string; flowId?: unknown };
     const provider = (body.provider ?? "").trim().toLowerCase();
     if (!isPublicOAuthProvider(provider)) return jsonResponse({ error: "unknown oauth provider" }, 400);
     const consentRequired = metaMuseConsentRequired(provider, principal);
     if (consentRequired) return consentRequired;
+    const flowId = typeof body.flowId === "string" ? body.flowId : undefined;
+    const maskEmails = emailMaskingEnabled(config);
+    // Only a code flow of THIS provider gets the outcome-waiting contract; that flow is single-use,
+    // so at most one request ever waits on it. A flow id naming anything else (a callback flow,
+    // another provider's flow, nothing) has no code login to complete.
+    const codeFlow = isCodeLoginFlow(provider, flowId);
+    if (flowId !== undefined && !codeFlow) return jsonResponse({ ok: false, error: "no_pending_login" }, 409);
     const input = typeof body.input === "string" ? body.input : typeof body.code === "string" ? body.code : "";
     // Authorization responses are measured in hundreds of bytes; never accept the
     // generic management-body allowance here.
-    if (input.length > 4096) return jsonResponse({ error: "input too long" }, 400);
-    const result = submitManualLoginCode(provider, input);
-    if (!result.ok) return jsonResponse({ error: result.error }, 409);
-    return jsonResponse({ ok: true });
+    if (input.length > 4096) {
+      return codeFlow
+        ? jsonResponse({ ok: false, error: "malformed_input" }, 400)
+        : jsonResponse({ error: "input too long" }, 400);
+    }
+    if (!codeFlow) {
+      const result = submitManualLoginCode(provider, input);
+      if (!result.ok) return jsonResponse({ error: result.error }, 409);
+      return jsonResponse({ ok: true });
+    }
+    const submitted = submitLoginCode(provider, input, flowId);
+    // Rejected before any token request: the flow stays alive so the user can paste again.
+    if (!submitted.ok) {
+      return jsonResponse({ ok: false, error: submitted.code }, submitted.code === "no_pending_login" ? 409 : 400);
+    }
+    // The exchange itself times out at 30s inside the provider client; this only has to
+    // outlast it so a hung socket surfaces as an answer rather than as a hung request.
+    // Pinned to the flow this paste actually landed in: with several code logins in flight for
+    // one provider, "the newest flow" by the time this resolves may be somebody else's.
+    const settled = await waitForLoginSettled(provider, 60_000, submitted.flowId);
+    const status = getLoginStatus(provider, maskEmails, submitted.flowId);
+    if (!settled) return jsonResponse({ ok: false, error: "provider_unreachable" }, 400);
+    if (status.error) {
+      const failure = status.errorCode ?? "invalid_or_expired_code";
+      return jsonResponse({ ok: false, error: failure }, failure === "no_pending_login" ? 409 : 400);
+    }
+    // A flow dropped while waiting (logout, clear) never completed, whatever the store now holds.
+    if (status.status !== "complete") return jsonResponse({ ok: false, error: "no_pending_login" }, 409);
+    // The account THIS flow wrote, which need not be the active one (reauth of an inactive account,
+    // or a concurrent login that finished later).
+    const savedId = loginFlowAccountId(provider, submitted.flowId);
+    const account = savedId === undefined ? undefined : status.accounts?.find(entry => entry.id === savedId);
+    return jsonResponse({ ok: true, ...(account ? { account: { id: account.id, email: account.email } } : {}) });
   }
 
   if (url.pathname === "/api/oauth/status" && req.method === "GET") {
@@ -597,10 +665,15 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     // sticky limit is refused identically whichever pool is addressed.
     let strategy: string | undefined;
     if (fields.strategy !== undefined) {
-      const parsed = kind === "codex" ? parseCodexAccountPoolStrategy(fields.strategy) : parseGenericPoolStrategy(fields.strategy, provider);
-      if (parsed === null) return jsonResponse({ error: kind === "codex"
-        ? "strategy must be one of: quota, round-robin, fill-first, reset-first"
-        : `strategy must be one of: quota, round-robin, fill-first${provider === "kiro" ? ", least-loaded" : ""}` }, 400);
+      // reset-first is a Codex and generic strategy. The Anthropic runtime implements only
+      // quota, round-robin and fill-first, so that kind keeps refusing it rather than storing
+      // a strategy it would silently ignore.
+      const parsed = kind === "codex" ? parseCodexAccountPoolStrategy(fields.strategy)
+        : kind === "generic" ? parseGenericPoolStrategy(fields.strategy, provider)
+        : parseAccountPoolStrategy(fields.strategy);
+      if (parsed === null) return jsonResponse({ error: kind === "anthropic"
+        ? "strategy must be one of: quota, round-robin, fill-first"
+        : `strategy must be one of: quota, round-robin, fill-first, reset-first${kind === "generic" && provider === "kiro" ? ", least-loaded" : ""}` }, 400);
       strategy = parsed;
     }
     let stickyLimit: number | undefined;
@@ -754,7 +827,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
         if (body.strategy === null) delete next.strategy;
         else {
           const parsed = parseGenericPoolStrategy(body.strategy, provider);
-          if (parsed === null) return jsonResponse({ error: `strategy must be one of: quota, round-robin, fill-first${provider === "kiro" ? ", least-loaded" : ""}` }, 400);
+          if (parsed === null) return jsonResponse({ error: `strategy must be one of: quota, round-robin, fill-first, reset-first${provider === "kiro" ? ", least-loaded" : ""}` }, 400);
           next.strategy = parsed;
         }
       }

package/src/server/management/provider-gcp-credential-routes.ts

@@ -0,0 +1,29 @@
+import { providerCredentialInputError } from "../../providers/api-keys";
+import { commitProviderGcpCredentialRemoval } from "../../providers/gcp-credential-cleanup";
+import { dropProviderCustomModels } from "../../providers/provider-id-rewrite";
+import { forgetProviderContextCap } from "../../providers/context-cap";
+import type { OcxConfig } from "../../types";
+import { jsonResponse } from "../auth-cors";
+
+/** Generic provider writes refuse credential JSON before any config mutation. */
+export function providerGcpCredentialInputResponse(provider: { apiKey?: unknown; apiKeyPool?: unknown }): Response | null {
+  const error = providerCredentialInputError(provider);
+  return error ? jsonResponse({ error }, 400) : null;
+}
+
+/** Keep marker capture, provider removal and persistence in one synchronous locked operation. */
+export function removeProviderWithGcpCredentials(
+  config: OcxConfig,
+  name: string,
+  fallbackDefault: string | undefined,
+  save: (config: OcxConfig) => void,
+): number {
+  return commitProviderGcpCredentialRemoval(config, name, () => {
+    if (fallbackDefault) config.defaultProvider = fallbackDefault;
+    delete config.providers[name];
+    const dropped = dropProviderCustomModels(config, name);
+    forgetProviderContextCap(config, name);
+    save(config);
+    return dropped;
+  });
+}

package/src/server/management/provider-key-pacing-routes.ts

@@ -0,0 +1,31 @@
+import { hasOwnProvider, isValidProviderName } from "../../config";
+import { getKeyCooldownUntil } from "../../providers/key-failover";
+import { providerRequestPacingStatus } from "../../providers/request-pacing";
+import type { OcxProviderConfig } from "../../types";
+import { jsonResponse } from "../auth-cors";
+import type { ManagementContext } from "./context";
+
+/** Read-only provider/key pacing diagnostics; configuration writes stay in the provider PATCH owner. */
+export function handleProviderKeyPacingRoutes(
+  { req, url, config }: Pick<ManagementContext, "req" | "url" | "config">,
+): Response | null {
+  if (url.pathname !== "/api/provider-request-pacing" || req.method !== "GET") return null;
+  const statusFor = (name: string, provider: OcxProviderConfig) => {
+    const status = providerRequestPacingStatus(name, provider);
+    if (status.keys) status.keys = status.keys.map(row => ({ ...row, cooldownUntil: getKeyCooldownUntil(name, row.id) }));
+    return status;
+  };
+  const name = url.searchParams.get("name")?.trim();
+  if (name) {
+    if (!isValidProviderName(name) || !hasOwnProvider(config.providers, name)) {
+      return jsonResponse({ error: "unknown provider" }, 404);
+    }
+    return jsonResponse(statusFor(name, config.providers[name]!));
+  }
+  return jsonResponse(Object.fromEntries(
+    Object.entries(config.providers).map(([providerName, provider]) => [
+      providerName,
+      statusFor(providerName, provider),
+    ]),
+  ));
+}

package/src/server/management/provider-overwrite-carry.ts

@@ -214,6 +214,13 @@ export function applyProviderCompatPatchFields(
     else return { error: "preserveResponsesReasoningContent must be a boolean" };
     touched = true;
   }
+  if (Object.hasOwn(rawBody, "inferContextWindow")) {
+    const value = rawBody.inferContextWindow;
+    if (value === null) delete next.inferContextWindow;
+    else if (typeof value === "boolean") next.inferContextWindow = value;
+    else return { error: "inferContextWindow must be a boolean or null" };
+    touched = true;
+  }
   if (Object.hasOwn(rawBody, "reasoningWireFormat")) {
     const value = rawBody.reasoningWireFormat;
     if (value === null) {

package/src/server/management/provider-routes.ts

@@ -1,6 +1,8 @@
 import { contextTierRecordConfigError, modelCapabilitiesConfigError, mergeModelCapabilities } from "../../config/provider-validation";
 import { DECLARABLE_HOSTED_TOOL_TYPES } from "../../responses/hosted-tool-policy";
 import { randomUUID } from "node:crypto";
+import { cleanupRemovedGcpCredentials, providerGcpCredentialMarkers, snapshotProviderGcpCredentialMarkers } from "../../providers/gcp-credential-cleanup";
+import { providerGcpCredentialInputResponse, removeProviderWithGcpCredentials } from "./provider-gcp-credential-routes";
 import { readFileSync } from "node:fs";
 import { isDeepStrictEqual } from "node:util";
 import type { CatalogModel } from "../../codex/catalog";
@@ -78,7 +80,7 @@ import { cachedProviderQuotaIsExhausted } from "../../combos/resolve";
 import { probeJevDecisionProvider } from "../../combos/jev";
 import { comboDependsOnProviderRoute } from "./decision-model-validation";
 import { clearKeyCooldowns, forgetApiKeyRotationCursor } from "../../providers/key-failover";
-import { providerRequestPacingStatus } from "../../providers/request-pacing";
+import { handleProviderKeyPacingRoutes } from "./provider-key-pacing-routes";
 import { CODEX_FORWARD_BASE_URL, isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
 import { codexAccountNamespaceProviderCollisionError } from "../../codex/account-namespace-match";
 import { clearThreadAccountMap } from "../../codex/routing";
@@ -853,7 +855,7 @@ function providerRoutingQuota(config: OcxConfig, name: string, now: number): Pro
 
   // Removing search/MCP windows may leave only a timestamp. That is not inference evidence.
   const percentages = [quota.fiveHourPercent, quota.weeklyPercent, quota.monthlyPercent,
-    ...(quota.customWindows ?? []).map(window => window.percent)];
+    ...(quota.customWindows ?? []).filter(window => window.modelId === undefined).map(window => window.percent)];
   const hasPercentage = percentages.some(value => typeof value === "number" && Number.isFinite(value) && value >= 0);
   const credits = quota.creditsUsd;
   const hasCredits = credits !== undefined && Number.isFinite(credits.percent)
@@ -864,7 +866,7 @@ function providerRoutingQuota(config: OcxConfig, name: string, now: number): Pro
   let validUntil = quota.updatedAt + PROVIDER_QUOTA_MAX_AGE_MS;
   if (state === "exhausted") {
     const resets = [quota.fiveHourResetAt, quota.weeklyResetAt, quota.monthlyResetAt,
-      ...(quota.customWindows ?? []).map(window => window.resetAt)]
+      ...(quota.customWindows ?? []).filter(window => window.modelId === undefined).map(window => window.resetAt)]
       .filter((reset): reset is number => typeof reset === "number" && Number.isFinite(reset)
         && reset > now && reset < validUntil)
       .sort((left, right) => left - right);
@@ -895,21 +897,8 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     });
   }
 
-  if (url.pathname === "/api/provider-request-pacing" && req.method === "GET") {
-    const name = url.searchParams.get("name")?.trim();
-    if (name) {
-      if (!isValidProviderName(name) || !hasOwnProvider(config.providers, name)) {
-        return jsonResponse({ error: "unknown provider" }, 404);
-      }
-      return jsonResponse(providerRequestPacingStatus(name, config.providers[name]!));
-    }
-    return jsonResponse(Object.fromEntries(
-      Object.entries(config.providers).map(([providerName, provider]) => [
-        providerName,
-        providerRequestPacingStatus(providerName, provider),
-      ]),
-    ));
-  }
+  const keyPacingResponse = handleProviderKeyPacingRoutes(ctx);
+  if (keyPacingResponse) return keyPacingResponse;
 
   if (url.pathname === "/api/providers" && req.method === "GET") {
     return jsonResponse(Object.entries(config.providers).map(([name, p]) => ({
@@ -922,6 +911,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       requestPacing: p.requestPacing,
       models: p.models ?? [],
       contextWindow: p.contextWindow,
+      inferContextWindow: p.inferContextWindow,
       modelContextWindows: p.modelContextWindows,
       modelContextTiers: p.modelContextTiers,
       modelCapabilities: p.modelCapabilities,
@@ -1073,6 +1063,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       if (resolvedError) return jsonResponse({ error: resolvedError, code: "invalid_provider_destination" }, 400);
     }
 
+    let removedCredentials: string[] = [];
     const outcome = mutatePersistedConfig<ProviderEditorMutationValue>(persisted => {
       if (!isDeepStrictEqual(providerEditorConfigDTO(persisted), baselineResult.value)) {
         return {
@@ -1095,6 +1086,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
           initializeProviderModelSelection(name, provider, undefined, candidate.config);
         }
       }
+      removedCredentials = Object.values(persisted.providers).flatMap(providerGcpCredentialMarkers);
       persisted.defaultProvider = candidate.config.defaultProvider;
       persisted.providers = structuredClone(candidate.config.providers);
       persisted.disabledModels = candidate.config.disabledModels;
@@ -1120,6 +1112,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       return jsonResponse({ error: outcome.value.error, code: outcome.value.code }, outcome.value.status);
     }
 
+    cleanupRemovedGcpCredentials(removedCredentials);
     adoptProviderEditorCandidate(config, outcome.value.config);
     reconcileLiveStateStores();
     refreshConfigDerivedRegistries(outcome.value.config);
@@ -1137,16 +1130,15 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     return jsonResponse({ success: true, catalogRefresh });
   }
 
-  // Add (or overwrite) a single provider. Merges into the live in-memory config and
-  // persists — existing providers' real keys are never round-tripped (unlike PUT /api/config,
-  // which would re-save the masked keys from GET). Live routing picks it up immediately.
+  // Provider POST merges directly; existing secrets never round-trip through masked DTOs.
   if (url.pathname === "/api/providers" && req.method === "POST") {
     let body: { name?: unknown; provider?: unknown; setDefault?: boolean };
     try { body = await readManagementJsonBody(req); } catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid JSON body" }, 400); }
     const name = typeof body.name === "string" ? body.name.trim() : "";
     if (!isPlainRecord(body.provider)) return jsonResponse({ error: "provider must be a plain object" }, 400);
-    // Same prohibition as PATCH: the canonical OpenAI row never carries these fields, and a clear
-    // form would otherwise be normalized away before the merged-row guard could see it.
+    const credentialResponse = providerGcpCredentialInputResponse(body.provider);
+    if (credentialResponse) return credentialResponse;
+    // Reject canonical-row clears before normalization hides their ownership.
     if (name === "openai" && (Object.hasOwn(body.provider, "autoReviewModel") || Object.hasOwn(body.provider, "autoReviewModelOverrides"))) {
       return jsonResponse({ error: "provider openai must not include autoReviewModel or autoReviewModelOverrides" }, 400);
     }
@@ -1357,7 +1349,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     const candidate = stripRegistryOnlyStaticHeaders(name, prov);
     const previous = Object.getOwnPropertyDescriptor(config.providers, name);
     const rollback = pinsOwned ? captureConfigTopLevelRollback(config, ["defaultProvider", "modelDiscovery", "disabledModels"]) : undefined;
-    let validationError: string | undefined;
+    let validationError: string | undefined, removedCredentials: string[] = [];
     withConfigMutationLockSync(() => {
       validationError = anthropicInstancePublicationError(name, candidate, config.providers[name]);
       if (validationError) return;
@@ -1365,6 +1357,12 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       if (submittedModelContextTiers && liveTiers) candidate.modelContextTiers = Object.assign(Object.create(null), liveTiers, candidate.modelContextTiers ?? {});
       else if (!submittedModelContextTiers && liveTiers) candidate.modelContextTiers = { ...liveTiers };
       else if (!submittedModelContextTiers) delete candidate.modelContextTiers;
+      // Full forms omit the opt-in; preserve the latest value, including a concurrent clear.
+      if (!Object.hasOwn(rawProvider, "inferContextWindow")) {
+        const liveInference = config.providers[name]?.inferContextWindow;
+        if (liveInference === undefined) delete candidate.inferContextWindow;
+        else candidate.inferContextWindow = liveInference;
+      }
       const draft = { ...(registrationDraft ?? config), providers: { ...config.providers, [name]: candidate }, ...(body.setDefault === true ? { defaultProvider: name } : {}) };
       const validation = validateConfigCandidate(draft); if (!validation.ok) { validationError = validation.error; return; }
       try {
@@ -1375,6 +1373,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
             });
           }
         }
+        removedCredentials = snapshotProviderGcpCredentialMarkers(name, config.providers[name]);
         config.providers[name] = candidate;
         if (body.setDefault === true) config.defaultProvider = name;
         (deps.saveConfigPreservingClaudeCode ?? save)(config);
@@ -1388,6 +1387,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       }
     });
     if (validationError !== undefined) return jsonResponse({ error: validationError }, 400);
+    cleanupRemovedGcpCredentials(removedCredentials);
     reconcileLiveStateStores();
     if (prov.apiKey && prov.apiKeyPool) {
       const { addProviderApiKey } = await import("../../providers/api-keys");
@@ -1848,12 +1848,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     const { saveConfigPreservingClaudeCode: save } = await import("../../config");
     // Deleting still succeeds; the response names the shadow-call target left without a provider.
     const shadowDependency = shadowInterceptProviderDependency(config, name);
-    if (fallbackDefault) config.defaultProvider = fallbackDefault;
-    delete config.providers[name];
-    const { dropProviderCustomModels } = await import("../../providers/provider-id-rewrite");
-    const droppedCustomModels = dropProviderCustomModels(config, name);
-    forgetProviderContextCap(config, name);
-    save(config);
+    const droppedCustomModels = removeProviderWithGcpCredentials(config, name, fallbackDefault, save);
     await replaceProviderAccountSet(name, null);
     reconcileLiveStateStores();
     const { clearModelCache: clearCache } = await import("../../codex/model-cache");

package/src/server/management/route-registry.ts

@@ -97,8 +97,12 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   // server/management-api
   { method: "POST", path: "/api/stop", module: "server/management-api", mutates: true },
   // codex/auth-api
+  { method: "GET", path: "/api/codex-auth/preserve-signed-in", module: "codex/auth-api/routes", mutates: false },
+  { method: "PUT", path: "/api/codex-auth/preserve-signed-in", module: "codex/auth-api/routes", mutates: true },
   { method: "DELETE", path: "/api/codex-auth/accounts", module: "codex/auth-api/routes", mutates: true },
   { method: "GET", path: "/api/codex-auth/accounts", module: "codex/auth-api/routes", mutates: false },
+  { method: "GET", path: "/api/codex-auth/accounts/use-remaining", module: "codex/auth-api/routes", mutates: false },
+  { method: "PUT", path: "/api/codex-auth/accounts/use-remaining", module: "codex/auth-api/routes", mutates: true },
   { method: "GET", path: "/api/codex-auth/active", module: "codex/auth-api/routes", mutates: false },
   { method: "GET", path: "/api/codex-auth/login-status", module: "codex/auth-api/routes", mutates: false },
   { method: "GET", path: "/api/codex-auth/quota", module: "codex/auth-api/routes", mutates: false },
@@ -217,8 +221,11 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "POST", path: "/api/combos/decision-test", module: "server/management/decision-routes", mutates: true },
   // server/management/config-routes
   { method: "GET", path: "/api/config", module: "server/management/config-routes", mutates: false },
+  { method: "GET", path: "/api/auto-review-settings", module: "server/management/config-routes", mutates: false },
   { method: "GET", path: "/api/diagnostics/project-config", module: "server/management/config-routes", mutates: false },
   { method: "GET", path: "/api/settings", module: "server/management/config-routes", mutates: false },
+  { method: "GET", path: "/api/native-reasoning-retention", module: "server/management/native-reasoning-retention-routes", mutates: false, exempt: { reason: "local-transport", why: "The CLI reads the same nativeReasoningRetention policy through ocx config get; no separate HTTP-specific settings verb is required." } },
+  { method: "PUT", path: "/api/native-reasoning-retention", module: "server/management/native-reasoning-retention-routes", mutates: true, exempt: { reason: "deferred-verb", why: "A dedicated live CLI verb for this policy is deferred to native-reasoning-retention-live-cli; ocx config set/unset currently edits the same block on disk without live convergence.", owner: "native-reasoning-retention-live-cli", ownerDoc: "structure/transports/native-reasoning-retention.md" } },
   { method: "GET", path: "/api/shadow-call-settings", module: "server/management/config-routes", mutates: false },
   { method: "GET", path: "/api/sidecar-settings", module: "server/management/config-routes", mutates: false },
   { method: "GET", path: "/api/startup-health", module: "server/management/config-routes", mutates: false },
@@ -231,6 +238,7 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "POST", path: "/api/windows-tray", module: "server/management/config-routes", mutates: true },
   { method: "PUT", path: "/api/config", module: "server/management/config-routes", mutates: true, exempt: { reason: "disabled", why: "Returns 405 by design; provider changes go through POST /api/providers." } },
   { method: "PUT", path: "/api/settings", module: "server/management/config-routes", mutates: true },
+  { method: "PUT", path: "/api/auto-review-settings", module: "server/management/config-routes", mutates: true },
   { method: "PUT", path: "/api/shadow-call-settings", module: "server/management/config-routes", mutates: true },
   { method: "PUT", path: "/api/sidecar-settings", module: "server/management/config-routes", mutates: true },
   // server/management/integration-routes
@@ -277,6 +285,7 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "GET", path: "/api/usage/timeline", module: "server/management/usage-timeline-routes", mutates: false },
   // server/management/advisor-routes
   { method: "GET", path: "/api/advisor/settings", module: "server/management/advisor-routes", mutates: false },
+  { method: "GET", path: "/api/advisor/activity", module: "server/management/advisor-routes", mutates: false },
   { method: "PUT", path: "/api/advisor/settings", module: "server/management/advisor-routes", mutates: true },
   // server/management/companion-routes
   { method: "POST", path: "/api/companion/open-in-browser", module: "server/management/companion-routes", mutates: true, exempt: { reason: "browser-navigation", why: "Opens the companion's current view in the system browser under normal management admission; the CLI reads the underlying settings and usage directly." } },
@@ -360,7 +369,7 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "GET", path: "/api/provider-context-caps", module: "server/management/provider-routes", mutates: false },
   { method: "GET", path: "/api/provider-presets", module: "server/management/provider-routes", mutates: false },
   { method: "GET", path: "/api/provider-quotas", module: "server/management/provider-routes", mutates: false },
-  { method: "GET", path: "/api/provider-request-pacing", module: "server/management/provider-routes", mutates: false },
+  { method: "GET", path: "/api/provider-request-pacing", module: "server/management/provider-key-pacing-routes", mutates: false },
   { method: "GET", path: "/api/providers", module: "server/management/provider-routes", mutates: false },
   { method: "PATCH", path: "/api/providers", module: "server/management/provider-routes", mutates: true },
   { method: "POST", path: "/api/providers", module: "server/management/provider-routes", mutates: true },

package/src/server/management-api.ts

@@ -59,6 +59,7 @@ import { applySystemEnvToggle } from "./system-env";
 
 import type { ManagementApiDeps } from "./management/context";
 import { handleConfigRoutes } from "./management/config-routes";
+import { handleNativeReasoningRetentionRoutes } from "./management/native-reasoning-retention-routes";
 import { handleLogsUsageRoutes } from "./management/logs-usage-routes";
 import { handleStorageLogGuardRoutes } from "./management/storage-log-guard-routes";
 import { handleRequestHistoryRoutes } from "./management/request-history-routes";
@@ -344,6 +345,7 @@ export async function handleManagementAPI(
     ??     (await handleLinkRoutesOnDemand(ctx))
     ??     (await handleRemoteWorkspaceRoutesOnDemand(ctx))
     ??     (await handleConfigRoutes(ctx))
+    ??     (await handleNativeReasoningRetentionRoutes(ctx))
     ??     (await handleStorageLogGuardRoutes(ctx))
     ??     (await handleLogsUsageRoutes(ctx))
     ??     (await handleRequestHistoryRoutes(ctx))
@@ -519,7 +521,7 @@ export async function handleManagementAPI(
       const { handleMainDeviceReauthAPI } = await import("../codex/main-device-reauth-api");
       return handleMainDeviceReauthAPI(req, url, config);
     }
-    const { handleCodexAuthAPI } = await import("../codex/auth-api");
+    const { handleCodexAuthAPI } = await import("../codex/auth-api/routes");
     const { ConfigMutationLockError } = await import("../config");
     const { CodexCredentialRefreshLockTimeoutError } = await import("../codex/account-store");
     try {