@iislee/opencodex 2.11.0 → 2.35.0

package/src/server/management/routing-profile-routes.ts

@@ -0,0 +1,380 @@
+/**
+ * Routing-profile management API (RI-04).
+ *
+ * - `GET    /api/routing-profiles` - normalized profiles with revisions
+ * - `PUT    /api/routing-profiles` - create or replace one validated profile
+ * - `DELETE /api/routing-profiles?id=<id>` - remove one profile
+ * - `POST   /api/routing-profiles/dry-run` - deterministic dry-run evaluation
+ *   (never dispatches an upstream request)
+ */
+
+import {
+  getRoutingProfile,
+  listRoutingProfileIds,
+  normalizeRoutingProfile,
+  policyPublicModelId,
+  routingProfileIssues,
+} from "../../routing/profile";
+import { evaluatePolicyProfile, type PolicyCandidateEvidence, type PolicyRequestEvidence } from "../../routing/evaluator";
+import { assemblePolicyCandidateEvidence } from "../../routing/compatibility/assemble";
+import { activateLab, labActivationRequired } from "../../lib/lab-activation";
+import { quotaEvidenceForCandidate } from "../../routing/quota";
+import { routedProviderConfig } from "../../router";
+import { deleteConfigTopLevelKey, saveConfigPreservingClaudeCode, getConfigDir } from "../../config";
+import { reconcileLiveStateStores } from "../../lib/state-store-registrations";
+import { isPlainRecord } from "./shared";
+import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
+import { jsonResponse } from "../auth-cors";
+import type { ManagementContext } from "./context";
+import type { OcxConfig, OcxRoutingProfileConfig } from "../../types";
+
+function profileDto(config: Parameters<typeof getRoutingProfile>[0], id: string): Record<string, unknown> | null {
+  const profile = getRoutingProfile(config, id);
+  if (!profile) return null;
+  return {
+    id,
+    alias: profile.alias,
+    model: policyPublicModelId(id, profile),
+    revision: profile.revision,
+    candidates: profile.candidates,
+    require: profile.require,
+    optimize: profile.optimize,
+    limits: profile.limits,
+    unknownEvidence: profile.unknownEvidence,
+    ...(profile.compatibility ? { compatibility: profile.compatibility } : {}),
+  };
+}
+
+function parseEvidence(raw: unknown): { evidence: PolicyRequestEvidence; ok: boolean } {
+  // Absent evidence is empty evidence, mirroring the absent-candidates case.
+  if (raw === undefined) return { evidence: {}, ok: true };
+  if (!isPlainRecord(raw)) return { evidence: {}, ok: false };
+  const record = raw as Record<string, unknown>;
+  const evidence: PolicyRequestEvidence = {};
+  if (typeof record.contextWindow === "number" && Number.isFinite(record.contextWindow) && record.contextWindow >= 0) {
+    evidence.contextWindow = record.contextWindow;
+  }
+  for (const key of ["toolsRequired", "imageInputRequired", "structuredOutputRequired", "encryptedCodexTask"] as const) {
+    if (typeof record[key] === "boolean") evidence[key] = record[key];
+  }
+  if (typeof record.reasoningEffort === "string") evidence.reasoningEffort = record.reasoningEffort;
+  if (typeof record.serviceTier === "string") evidence.serviceTier = record.serviceTier;
+  return { evidence, ok: true };
+}
+
+function parseCandidateEvidence(raw: unknown): PolicyCandidateEvidence[] | null {
+  if (!Array.isArray(raw)) return null;
+  const out: PolicyCandidateEvidence[] = [];
+  for (const item of raw) {
+    if (!isPlainRecord(item)) return null;
+    const provider = item.provider;
+    const model = item.model;
+    if (typeof provider !== "string" || typeof model !== "string") return null;
+    out.push({
+      provider,
+      model,
+      ...(typeof item.accountRef === "string" ? { accountRef: item.accountRef } : {}),
+      ...(typeof item.codexAccountId === "string" ? { codexAccountId: item.codexAccountId } : {}),
+      // Dry-run evidence is caller-supplied and echoed back in the result as
+      // given; the trace's candidate rows carry only score/exclusions, which
+      // the trace builder bounds. Structural casts keep the API permissive.
+      ...(isPlainRecord(item.capability) ? { capability: item.capability as unknown as PolicyCandidateEvidence["capability"] } : {}),
+      ...(isPlainRecord(item.health) ? { health: item.health as unknown as PolicyCandidateEvidence["health"] } : {}),
+      ...(isPlainRecord(item.quota) ? { quota: item.quota as unknown as PolicyCandidateEvidence["quota"] } : {}),
+      ...(isPlainRecord(item.cost) ? { cost: item.cost as unknown as PolicyCandidateEvidence["cost"] } : {}),
+      // Derive account-scoped quota evidence from the documented refs when the
+      // caller does not supply an explicit quota object, so a dry-run following
+      // the documented shape reports the same cached account quota as routing.
+      ...(item.quota === undefined && typeof item.codexAccountId === "string"
+        ? { quota: quotaEvidenceForCandidate({ provider, model, codexAccountId: item.codexAccountId }) }
+        : {}),
+      ...(item.quota === undefined && typeof item.accountRef === "string" && typeof item.codexAccountId !== "string"
+        ? { quota: quotaEvidenceForCandidate({ provider, model, accountRef: item.accountRef }) }
+        : {}),
+    });
+  }
+  return out;
+}
+
+function assembleCandidateEvidence(
+  config: OcxConfig,
+  profile: NonNullable<ReturnType<typeof getRoutingProfile>>,
+  now: number,
+): PolicyCandidateEvidence[] {
+  return assemblePolicyCandidateEvidence(config, profile, now, {
+    routedProviderConfig,
+  });
+}
+
+function storedProfile(
+  id: string,
+  raw: OcxRoutingProfileConfig,
+): OcxRoutingProfileConfig {
+  const normalized = normalizeRoutingProfile(id, raw);
+  const {
+    id: _id,
+    revision: _revision,
+    alias,
+    ...profile
+  } = normalized;
+  return alias === null ? profile : { ...profile, alias };
+}
+
+/**
+ * Rewrite config references from one public model id to another (alias change
+ * on update). Mirrors the /api/combos migration: model-valued config that
+ * still names the old alias must follow it, or requests fall through to
+ * ordinary routing and send the obsolete alias upstream.
+ */
+/**
+ * Detect a modelMap key collision that the alias migration would silently
+ * resolve by dropping one mapping: the map already contains the new public
+ * model as a key with a different target than the old-alias key's target.
+ */
+function modelMapMigrationCollision(
+  config: OcxConfig,
+  oldPublicModel: string,
+  newPublicModel: string,
+): string | null {
+  const map = config.claudeCode?.modelMap;
+  if (!map) return null;
+  if (oldPublicModel === newPublicModel) return null;
+  const oldTarget = map[oldPublicModel];
+  if (oldTarget === undefined) return null;
+  const newTarget = map[newPublicModel];
+  if (newTarget === undefined) return null;
+  if (oldTarget === newTarget) return null;
+  return `modelMap already maps \"${newPublicModel}\" to \"${newTarget}\"; renaming \"${oldPublicModel}\" (→ \"${newTarget}\") would drop one mapping. Resolve the conflict and retry.`;
+}
+
+/**
+ * Rewrite config references from one public model id to another (alias change
+ * on update). Mirrors the /api/combos migration: model-valued config that
+ * still names the old alias must follow it, or requests fall through to
+ * ordinary routing and send the obsolete alias upstream.
+ */
+function migrateProfileModelReferences(
+  config: OcxConfig,
+  oldPublicModel: string,
+  newPublicModel: string,
+): boolean {
+  if (oldPublicModel === newPublicModel) return false;
+  const migrateReference = (model: string): string => (
+    model === oldPublicModel ? newPublicModel : model
+  );
+  let shouldSyncClaudeAgentDefs = false;
+  const migrateAgentReference = (model: string): string => {
+    const migrated = migrateReference(model);
+    if (migrated !== model) shouldSyncClaudeAgentDefs = true;
+    return migrated;
+  };
+  const migrateReferences = (models: string[]): string[] => [
+    ...new Set(models.map(migrateReference)),
+  ];
+  if (config.disabledModels) {
+    config.disabledModels = migrateReferences(config.disabledModels);
+  }
+  if (config.subagentModels) {
+    config.subagentModels = [...new Set(config.subagentModels.map(migrateAgentReference))];
+  }
+  if (config.subagentModelFallback) {
+    config.subagentModelFallback = [...new Set(config.subagentModelFallback.map(migrateAgentReference))];
+  }
+  if (config.injectionModel && config.injectionModel === oldPublicModel) {
+    config.injectionModel = newPublicModel;
+  }
+  if (config.shadowCallIntercept?.model && config.shadowCallIntercept.model === oldPublicModel) {
+    config.shadowCallIntercept = { ...config.shadowCallIntercept, model: newPublicModel };
+  }
+  if (config.claudeCode) {
+    const claudeCode = { ...config.claudeCode };
+    for (const field of ["model", "smallFastModel"] as const) {
+      if (claudeCode[field]) claudeCode[field] = migrateAgentReference(claudeCode[field]);
+    }
+    if (claudeCode.tierModels) {
+      claudeCode.tierModels = Object.fromEntries(
+        Object.entries(claudeCode.tierModels).map(([tier, model]) => [tier, migrateAgentReference(model)]),
+      );
+    }
+    if (claudeCode.modelMap) {
+      // Keys are the inbound ids matched for reroute (src/claude/inbound.ts);
+      // an old-alias key must follow the rename or that request stops intercepting.
+      claudeCode.modelMap = Object.fromEntries(
+        Object.entries(claudeCode.modelMap).map(([source, model]) => [
+          migrateAgentReference(source),
+          migrateAgentReference(model),
+        ]),
+      );
+    }
+    config.claudeCode = claudeCode;
+  }
+  return shouldSyncClaudeAgentDefs;
+}
+export async function handleRoutingProfileRoutes(ctx: ManagementContext): Promise<Response | null> {
+  const { req, url, config, deps, convergeCodexCatalog, syncClaudeAgentDefsBestEffort } = ctx;
+
+  if (url.pathname === "/api/routing-profiles" && req.method === "GET") {
+    const profiles = listRoutingProfileIds(config).map(id => profileDto(config, id)).filter(
+      (profile): profile is Record<string, unknown> => profile !== null,
+    );
+    return jsonResponse({ profiles }, 200, req, config);
+  }
+
+  if (url.pathname === "/api/routing-profiles" && req.method === "PUT") {
+    let rawBody: unknown;
+    try {
+      rawBody = await readManagementJsonBody(req);
+    } catch (error) {
+      rethrowManagementBodyTooLarge(error);
+      return jsonResponse({ error: "invalid JSON body" }, 400, req, config);
+    }
+    if (!isPlainRecord(rawBody)) {
+      return jsonResponse({ error: "request body must be an object" }, 400, req, config);
+    }
+    const body = rawBody as Record<string, unknown>;
+    const id = typeof body.id === "string" ? body.id.trim() : "";
+    if (!id) {
+      return jsonResponse({ error: { code: "missing_profile_id", message: "id is required" } }, 400, req, config);
+    }
+    const mode = body.mode === "create" || body.mode === "update" ? body.mode : null;
+    if (!mode) {
+      return jsonResponse({ error: { code: "invalid_profile_mode", message: "mode must be create or update" } }, 400, req, config);
+    }
+    const exists = Object.hasOwn(config.routingProfiles ?? {}, id);
+    if (mode === "create" && exists) {
+      return jsonResponse({ error: { code: "profile_exists", message: `routing profile already exists: ${id}` } }, 409, req, config);
+    }
+    if (mode === "update" && !exists) {
+      return jsonResponse({ error: { code: "unknown_profile", message: `unknown routing profile: ${id}` } }, 404, req, config);
+    }
+    if (mode === "update") {
+      const expectedRevision = typeof body.expectedRevision === "string" && body.expectedRevision.trim()
+        ? body.expectedRevision.trim()
+        : undefined;
+      if (expectedRevision) {
+        const current = getRoutingProfile(config, id);
+        if (current && current.revision !== expectedRevision) {
+          return jsonResponse({
+            error: {
+              code: "profile_revision_conflict",
+              message: `routing profile ${id} changed since it was loaded; reload and retry`,
+              currentRevision: current.revision,
+            },
+          }, 409, req, config);
+        }
+      }
+    }
+    const issues = routingProfileIssues(id, body.profile, config, { excludeProfileId: id });
+    if (issues.length > 0) {
+      return jsonResponse({
+        error: {
+          code: "invalid_profile",
+          message: issues[0]!.message,
+          issues,
+        },
+      }, 400, req, config);
+    }
+
+    const previousProfile = mode === "update" ? getRoutingProfile(config, id) : undefined;
+    if (mode === "update" && previousProfile) {
+      const oldPublicModel = policyPublicModelId(id, previousProfile);
+      const newProfile = normalizeRoutingProfile(id, body.profile as OcxRoutingProfileConfig);
+      const newPublicModel = policyPublicModelId(id, newProfile);
+      const collision = modelMapMigrationCollision(config, oldPublicModel, newPublicModel);
+      if (collision) {
+        return jsonResponse({
+          error: { code: "alias_reference_conflict", message: collision },
+        }, 409, req, config);
+      }
+    }
+    const nextProfiles = { ...(config.routingProfiles ?? {}) };
+    nextProfiles[id] = storedProfile(id, body.profile as OcxRoutingProfileConfig);
+    config.routingProfiles = nextProfiles;
+    // Creating the first profile on a process started profile-less must install the
+    // compatibility provider now; activation is synchronous and idempotent per configDir.
+    if (labActivationRequired(config, getConfigDir())) activateLab(config, getConfigDir());
+    // An alias change on update renames the public model id; rewrite config
+    // references (disabledModels, subagentModels, injectionModel,
+    // shadowCallIntercept, claudeCode) so they follow the new alias.
+    let shouldSyncClaudeAgentDefs = false;
+    if (previousProfile) {
+      const oldPublicModel = policyPublicModelId(id, previousProfile);
+      const newPublicModel = policyPublicModelId(id, getRoutingProfile(config, id)!);
+      shouldSyncClaudeAgentDefs = migrateProfileModelReferences(config, oldPublicModel, newPublicModel);
+    }
+    const save = deps.saveConfigPreservingClaudeCode ?? saveConfigPreservingClaudeCode;
+    save(config);
+    reconcileLiveStateStores();
+    const catalogRefresh = await convergeCodexCatalog();
+    if (shouldSyncClaudeAgentDefs) await syncClaudeAgentDefsBestEffort();
+    const profile = profileDto(config, id)!;
+    return jsonResponse({
+      success: true,
+      id,
+      model: profile.model,
+      profile,
+      catalogRefresh,
+    }, 200, req, config);
+  }
+
+  if (url.pathname === "/api/routing-profiles" && req.method === "DELETE") {
+    const id = url.searchParams.get("id")?.trim();
+    if (!id) {
+      return jsonResponse({ error: "id query param is required" }, 400, req, config);
+    }
+    if (!Object.hasOwn(config.routingProfiles ?? {}, id)) {
+      return jsonResponse({ error: "unknown routing profile" }, 404, req, config);
+    }
+
+    const nextProfiles = { ...(config.routingProfiles ?? {}) };
+    delete nextProfiles[id];
+    if (Object.keys(nextProfiles).length > 0) config.routingProfiles = nextProfiles;
+    else deleteConfigTopLevelKey(config, "routingProfiles");
+    const saveConfigPreservingClaudeCodeSafe = deps.saveConfigPreservingClaudeCode ?? saveConfigPreservingClaudeCode;
+    saveConfigPreservingClaudeCodeSafe(config);
+    reconcileLiveStateStores();
+    const catalogRefresh = await convergeCodexCatalog();
+    return jsonResponse({ success: true, id, catalogRefresh }, 200, req, config);
+  }
+
+  if (url.pathname === "/api/routing-profiles/dry-run" && req.method === "POST") {
+    let rawBody: unknown;
+    try { rawBody = await readManagementJsonBody(req); } catch (error) {
+      rethrowManagementBodyTooLarge(error);
+      return jsonResponse({ error: "invalid JSON body" }, 400, req, config);
+    }
+    if (!isPlainRecord(rawBody)) {
+      return jsonResponse({ error: "request body must be an object" }, 400, req, config);
+    }
+    const body = rawBody as Record<string, unknown>;
+    const profile = typeof body.profile === "string" ? body.profile.trim() : "";
+    if (!profile) {
+      return jsonResponse({ error: { code: "missing_profile", message: "profile is required" } }, 400, req, config);
+    }
+    const resolvedProfile = getRoutingProfile(config, profile);
+    if (!resolvedProfile) {
+      return jsonResponse({ error: { code: "unknown_profile", message: `unknown routing profile: ${profile}` } }, 404, req, config);
+    }
+    const { evidence, ok } = parseEvidence(body.evidence);
+    if (!ok) {
+      return jsonResponse({ error: { code: "invalid_evidence", message: "evidence must be an object" } }, 400, req, config);
+    }
+    // One clock read for both assembly and evaluation keeps freshness, health,
+    // and trace timestamps mutually consistent with the production router.
+    const now = Date.now();
+    // R3-1: dry-run assembles candidate evidence independently of the startup gate, so an
+    // operator preview on a process started without profiles would silently omit
+    // compatibility evidence and disagree with production. Activate first.
+    if (labActivationRequired(config, getConfigDir())) activateLab(config, getConfigDir());
+    const candidateEvidence = body.candidates === undefined
+      ? assembleCandidateEvidence(config, resolvedProfile, now)
+      : parseCandidateEvidence(body.candidates);
+    if (candidateEvidence === null) {
+      return jsonResponse({ error: { code: "invalid_candidates", message: "candidates must be an array of evidence objects" } }, 400, req, config);
+    }
+    const result = evaluatePolicyProfile(config, profile, evidence, candidateEvidence, now);
+    return jsonResponse(result, 200, req, config);
+  }
+
+  return null;
+}

package/src/server/management/shared.ts

@@ -28,7 +28,7 @@ import { deriveProviderPresets } from "../../providers/derive";
 import { providerCodexAccountMode } from "../../providers/registry";
 import { routedSlug, slugEquals } from "../../providers/slug-codec";
 import { clearProviderQuotaCache, fetchProviderQuotaReports } from "../../providers/quota";
-import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
+import { isCanonicalOpenAiForwardProvider, OPENAI_CODEX_PROVIDER_ID } from "../../providers/openai-tiers";
 import { clearThreadAccountMap } from "../../codex/routing";
 import { primeCodexPoolQuotas } from "../../codex/auth-api";
 import { DEFAULT_PROVIDER_CONTEXT_CAP, globalContextCapValue, providerContextCap, providerContextCaps, setAllProviderContextCaps, setGlobalContextCapValue, setProviderContextCap } from "../../providers/context-cap";
@@ -51,7 +51,7 @@ import type { OcxClaudeCodeConfig, OcxClaudeDesktopProfile, OcxConfig, OcxCustom
 import type { DesktopProfileModel } from "../../claude/desktop-profile";
 import { drainAndShutdown } from "../lifecycle";
 import { filterRequestLogs, getRequestLogEntries, type RequestLogEntry } from "../request-log";
-import { estimateComboCost, estimateRequestCost, effectiveServiceTier, normalizeCostTokens, tokensPerSecond } from "../../usage/cost";
+import { estimateComboCost, estimateRequestCost, serviceTierContext, normalizeCostTokens, tokensPerSecond } from "../../usage/cost";
 import type { PersistedUsageAttempt } from "../../usage/log";
 import { isAllowedRequestOrigin, jsonResponse, providerManagementConfigError, publicProviderBaseUrl, safeConfigDTO } from "../auth-cors";
 import { applySystemEnvToggle } from "../system-env";
@@ -82,13 +82,18 @@ export type TokPerSecondResult =
   | { kind: "value"; value: number; estimated: boolean }
   | { kind: "unavailable"; reason: MetricUnavailableReason };
 
-export type CostEstimateReason = "usage_estimated" | "cache_detail_missing" | "expected_price_overlay";
+export type CostEstimateReason =
+  | "usage_estimated"
+  | "cache_detail_missing"
+  | "expected_price_overlay"
+  | "provider_cost_overlay"
+  | "priority_lower_bound";
 
 export type CostResult =
   | { kind: "value"; estimate: NonNullable<ReturnType<typeof estimateRequestCost>>; estimateReasons: CostEstimateReason[] }
   | { kind: "unavailable"; reason: MetricUnavailableReason };
 
-export type MetricSource = Pick<RequestLogEntry, "provider" | "model" | "durationMs" | "usageStatus" | "usage" | "requestedServiceTier" | "configuredServiceTier" | "responseServiceTier"> & {
+export type MetricSource = Pick<RequestLogEntry, "provider" | "model" | "durationMs" | "usageStatus" | "usage" | "requestedServiceTier" | "configuredServiceTier" | "responseServiceTier" | "tierOutcome"> & {
   attempts?: readonly PersistedUsageAttempt[];
 };
 
@@ -123,8 +128,9 @@ export function unavailableCostReason(entry: MetricSource): MetricUnavailableRea
   return "price_unmatched";
 }
 
+/** Display-time cost estimate for one log entry (or its attempt list), including the reasons that qualify the estimate. */
 export function costResult(entry: MetricSource): CostResult {
-  const tier = effectiveServiceTier(entry);
+  const tier = serviceTierContext(entry);
   const estimate = entry.attempts?.length
     ? estimateComboCost(entry.attempts, undefined, tier)
     : estimateRequestCost({ provider: entry.provider, model: entry.model, usage: entry.usage, usageStatus: entry.usageStatus, serviceTier: tier });
@@ -136,6 +142,9 @@ export function costResult(entry: MetricSource): CostResult {
       && entry.usage.cacheCreationInputTokens === undefined ? "cache_detail_missing" as const : undefined,
     estimate.price?.source === "expected" || estimate.attempts?.some(a => a.price.source === "expected")
       ? "expected_price_overlay" as const : undefined,
+    estimate.price?.source === "user" || estimate.attempts?.some(a => a.price.source === "user")
+      ? "provider_cost_overlay" as const : undefined,
+    estimate.priorityLowerBound ? "priority_lower_bound" as const : undefined,
   ].filter((reason): reason is CostEstimateReason => reason !== undefined);
   return { kind: "value", estimate, estimateReasons };
 }
@@ -166,10 +175,17 @@ export function requestLogDto(entry: RequestLogEntry): Record<string, unknown> {
  * canonical, TTL-cached `gatherRoutedModels` (single source of truth) — so the GUI/codex endpoints
  * share the same fetch, the same per-provider cache (dedups Codex's frequent /v1/models polling),
  * and the same stale fallback when a provider blips, instead of a parallel uncached copy.
+ *
+ * Pass `preferCached: true` for management UI lists that must paint immediately from
+ * cache/configured seeds (background live refresh still runs). Codex catalog sync and
+ * `/v1/models` must keep the default so they wait for the authoritative live set.
  */
-export async function fetchAllModels(config: OcxConfig): Promise<CatalogModel[]> {
+export async function fetchAllModels(
+  config: OcxConfig,
+  options?: { preferCached?: boolean },
+): Promise<CatalogModel[]> {
   const { gatherRoutedModels } = await import("../../codex/catalog");
-  return gatherRoutedModels(config);
+  return gatherRoutedModels(config, options?.preferCached ? { preferCached: true } : undefined);
 }
 
 export interface GrokCandidateModel {
@@ -185,11 +201,11 @@ export interface GrokCandidateModel {
  * from the same two sources as the sync so the two can never disagree.
  */
 export async function fetchGrokCandidateModels(config: OcxConfig): Promise<GrokCandidateModel[]> {
-  const { filterCatalogVisibleModels, nativeOpenAiContextWindow, visibleNativeSlugs } = await import("../../codex/catalog");
+  const { filterCatalogVisibleModels, nativeContextLimits, nativeOpenAiContextWindow, visibleNativeSlugs } = await import("../../codex/catalog");
   const routed = filterCatalogVisibleModels(await fetchAllModels(config), config);
   return [
     ...visibleNativeSlugs(config).map(id => {
-      const contextWindow = nativeOpenAiContextWindow(id);
+      const contextWindow = nativeOpenAiContextWindow(id, nativeContextLimits(config));
       return { id, native: true, ...(contextWindow !== undefined ? { contextWindow } : {}) };
     }),
     ...routed.map(m => ({
@@ -214,7 +230,7 @@ export function stripRegistryOnlyStaticHeaders(name: string, provider: OcxProvid
 
 /** Shared Desktop profile DTO builder for the management API and CLI. */
 export async function buildClaudeDesktopState(config: OcxConfig, stored?: OcxClaudeDesktopProfile) {
-  const { filterCatalogVisibleModels, nativeOpenAiContextWindow, desktopVisibleNativeSlugs } = await import("../../codex/catalog");
+  const { filterCatalogVisibleModels, nativeContextLimits, nativeOpenAiContextWindow, desktopVisibleNativeSlugs } = await import("../../codex/catalog");
   const { DESKTOP_SUPPORTS_1M_THRESHOLD } = await import("../../claude/desktop-3p");
   const { reconcileDesktopProfile, renderDesktopProfile } = await import("../../claude/desktop-profile");
   const routed = filterCatalogVisibleModels(await fetchAllModels(config), config);
@@ -222,7 +238,7 @@ export async function buildClaudeDesktopState(config: OcxConfig, stored?: OcxCla
     // Native rows carry their real context window from the same accessor the Grok sync
     // uses — otherwise Sol's 372k and gpt-5.5's 272k render as blank on Desktop.
     ...desktopVisibleNativeSlugs(config).map(id => {
-      const contextWindow = nativeOpenAiContextWindow(id);
+      const contextWindow = nativeOpenAiContextWindow(id, nativeContextLimits(config));
       return { route: `native/${id}`, label: `${id} (native)`,
         ...(contextWindow !== undefined ? { contextWindow } : {}) };
     }),

package/src/server/management/sidebar-routes.ts

@@ -9,40 +9,54 @@
  * this surface only learns the yes/no answer. `gh` writes the authenticated account
  * name to stderr, so that output is discarded at the source rather than forwarded.
  *
- * The star POST additionally refuses agent-driven programmatic callers. Management
- * auth proves the caller reached the admin token, not that a person chose to star:
- * a coding agent runs on the user's machine and can read that token from disk, so
- * the CLI's "ask the user" deferral would be bypassable with one `curl` here.
+ * The star POST additionally requires a dashboard session. Management auth proves
+ * the caller reached the admin token, not that a person chose to star: a coding
+ * agent runs on the user's machine and can read that token from disk, so the CLI's
+ * "ask the user" deferral would be bypassable with one `curl` here.
  *
- * The dashboard button must keep working even when the proxy itself was started by
- * an agent, which is the common case — the person is at the browser, not at the
- * spawning shell. A GUI click is therefore distinguished by its browser session
- * evidence (a same-origin `Origin` plus the minted CSRF header, both already
- * verified by the management auth gate) rather than by the proxy's own env.
+ * The requirement is unconditional, and that is the point. It used to apply only
+ * when `isAgentDriven()` was true — but that function reads the SERVER's
+ * environment, not the caller's, so a proxy already running as a service (no agent
+ * markers, the normal remote setup) accepted a raw-token star from anyone who could
+ * read the token, which includes every agent on the machine. The provenance of the
+ * HTTP caller is not knowable from the server's env; only the credential is. So the
+ * mutation asks for a GUI session this process minted for a browser, which the auth
+ * gate accepts only after matching origin and the per-session CSRF token.
  */
 import { jsonResponse } from "../auth-cors";
-import { agentDrivenMarkers, isAgentDriven } from "../../cli/agent-driven";
+import { agentDrivenMarkers } from "../../cli/agent-driven";
 import type { ManagementContext } from "./context";
 
 /**
- * True when this request carries the browser-session evidence a dashboard click
- * always has: an `Origin` (only a browser sends one) plus the per-session CSRF
- * token, which `requireManagementAuth` has already matched against the minted
- * session before dispatch. A shell/HTTP caller holding only the admin token has
- * neither, which is exactly the case the agent guard is aimed at.
+ * True only when a minted GUI session authorized this request.
+ *
+ * The previous version of this check looked for an `Origin` plus the CSRF headers
+ * and reasoned that the auth gate had already validated them. It had not: the gate
+ * accepts a raw admin token BEFORE it ever consults the session table, so a caller
+ * holding that token (any process running as the user, a coding agent included)
+ * could add three nonempty headers of its choosing and satisfy this check without
+ * a browser ever being involved. The credential itself is the only part of the
+ * request an agent cannot fabricate, so that is what this now reads.
  */
-function hasBrowserSessionEvidence(req: Request): boolean {
-  return !!req.headers.get("Origin")?.trim()
-    && !!req.headers.get("x-opencodex-csrf-token")?.trim()
-    && !!req.headers.get("x-opencodex-gui-origin")?.trim();
+function hasBrowserSessionEvidence(ctx: ManagementContext): boolean {
+  return ctx.principal === "gui-session";
 }
 
-// Known edge, deliberately fail-closed: a non-loopback operator dashboard signs in
-// with the raw admin token instead of a minted GUI session, so its clicks carry no
-// CSRF header. If that proxy was *also* started from an agent shell, the button is
-// refused and the response names the one-line `gh` command to run by hand. A
-// service-run proxy (`OCX_SERVICE`, the usual remote setup) is not agent-driven and
-// is unaffected.
+// Known edge, deliberately fail-closed: a non-loopback operator dashboard that signs
+// in with the raw admin token instead of a minted GUI session gets its click refused,
+// and the response names the one-line `gh` command to run by hand. That is the
+// correct trade — an endpoint reachable with a readable token cannot establish that
+// a human chose to spend their own GitHub identity.
+//
+// The honest limit of this guard: a local process running AS THE USER can mint its
+// own GUI session (the dashboard bootstrap is served to any loopback GET) and can
+// equally just run `gh api -X PUT /user/starred/...` itself, which needs no proxy at
+// all. No check inside this process can distinguish that caller from the browser,
+// because both hold every local credential. So this endpoint is not a technical
+// barrier against a determined local agent — it removes the CASUAL path (an agent
+// that would have POSTed here because the endpoint existed) and makes the refusal
+// legible. The actual boundary is normative and lives in AGENTS.md: an agent must
+// not spend the user's identity, whichever mechanism is at hand.
 
 export async function handleSidebarRoutes(ctx: ManagementContext): Promise<Response | null> {
   const { req, url } = ctx;
@@ -55,10 +69,11 @@ export async function handleSidebarRoutes(ctx: ManagementContext): Promise<Respo
   if (url.pathname === "/api/github/star" && req.method === "POST") {
     const { STAR_REPO, STAR_REPO_URL, starRepository } = await import("../../github/star-state");
     // Starring uses the user's GitHub identity, so consent must come from the
-    // account owner. An agent-driven caller without browser-session evidence
-    // cannot have obtained it, and must relay the question instead of answering
-    // it with an HTTP call.
-    if (isAgentDriven() && !hasBrowserSessionEvidence(req)) {
+    // account owner. Only a minted dashboard session evidences that; a caller
+    // holding the admin token must relay the question instead of answering it
+    // with an HTTP call.
+    if (!hasBrowserSessionEvidence(ctx)) {
+      const markers = agentDrivenMarkers().slice(0, 3);
       return jsonResponse({
         ok: false,
         state: "not-starred",
@@ -66,8 +81,9 @@ export async function handleSidebarRoutes(ctx: ManagementContext): Promise<Respo
         url: STAR_REPO_URL,
         code: "agent_consent_required",
         message:
-          `Refused: agent session detected (${agentDrivenMarkers().slice(0, 3).join(", ")}) and this request `
-          + `carries no dashboard session. Starring writes to the user's own GitHub account, so ask the user `
+          `Refused: this request carries no dashboard session`
+          + `${markers.length ? ` (agent session detected: ${markers.join(", ")})` : ""}. `
+          + `Starring writes to the user's own GitHub account, so ask the user `
           + `directly as a required Yes/No choice — not a soft aside, and no answer is not a No, so re-ask `
           + `it unchanged while it is open — and only if they say yes run: `
           + `gh api -X PUT /user/starred/${STAR_REPO}`,