@iislee/opencodex 2.11.0 → 2.35.0

package/src/server/management/system-routes.ts

@@ -22,12 +22,26 @@
  * dashboard drain-and-restart confirm UX — never request bodies or IDs.
  */
 import { selectEagerPath } from "../../lib/bun-stream-caps";
+import { reportedBunRuntimeSource } from "../../lib/bun-runtime";
 import { getActiveTurnCount, isDraining } from "../lifecycle";
 import { getActiveMemoryWatchdog, observedMemoryCounter } from "../memory-watchdog";
 import { responseStateMetrics } from "../../responses/state";
 import { appOwnedBytesSnapshot } from "../../lib/app-owned-memory";
+import { readWindowsReplaceRetryCounters } from "../../lib/windows-atomic-replace";
+import {
+  SYSTEM_RESTART_EXPECTED_PID_HEADER,
+  parseExpectedSystemRestartPid,
+} from "../../lib/system-restart-contract";
+import {
+  CODEX_APP_SERVER_STATE_PATH,
+  CODEX_RESTART_PATH,
+} from "../../lib/codex-restart-contract";
 import { jsonResponse } from "../auth-cors";
 import { getInspectionCounters } from "../relay";
+import type {
+  performCodexRestart,
+  readCodexAppServerState,
+} from "../../codex/app-server-restart-service";
 import type { ManagementContext } from "./context";
 import { acceptSystemRestart } from "./system-restart";
 
@@ -78,6 +92,9 @@ export async function handleSystemRoutes(ctx: ManagementContext): Promise<Respon
       pid: process.pid,
       bunVersion: Bun.version,
       bunRevision: Bun.revision,
+      // Recorded at launch, not resolved now: absent means "this service predates the
+      // marker", which callers must report as unknown rather than guess.
+      bunRuntimeSource: reportedBunRuntimeSource(),
       platform: process.platform,
       uptimeSeconds: process.uptime(),
       rss: usage.rss,
@@ -99,7 +116,37 @@ export async function handleSystemRoutes(ctx: ManagementContext): Promise<Respon
     });
   }
 
+  /**
+   * Windows atomic-replace retry counters.
+   *
+   * A sibling route rather than a field on /api/system/memory: that payload is
+   * memory-shaped, and appending unrelated filesystem counters to it makes both
+   * harder to consume.
+   *
+   * Keys are `publisher:CODE` where publisher is a closed union
+   * (ReplacePublisher) and never a path — a path could carry a username. The
+   * type is what enforces that; a text scan cannot see a runtime value.
+   */
+  if (url.pathname === "/api/system/windows-replace-retries" && req.method === "GET") {
+    return jsonResponse({ counters: readWindowsReplaceRetryCounters() });
+  }
   if (url.pathname === "/api/system/restart" && req.method === "POST") {
+    const expectedPid = parseExpectedSystemRestartPid(
+      req.headers.get(SYSTEM_RESTART_EXPECTED_PID_HEADER),
+    );
+    if (expectedPid.kind === "invalid") {
+      return jsonResponse({
+        success: false,
+        error: "Invalid restart target identity.",
+      }, 400, req, config);
+    }
+    if (expectedPid.kind === "present" && expectedPid.pid !== process.pid) {
+      return jsonResponse({
+        success: false,
+        error: "Restart target identity changed.",
+      }, 409, req, config);
+    }
+
     // Longer informed drain than /api/stop; does not tear down Codex/Grok injection.
     const result = acceptSystemRestart();
     return jsonResponse({
@@ -113,5 +160,35 @@ export async function handleSystemRoutes(ctx: ManagementContext): Promise<Respon
     }, 202, req, config);
   }
 
+  if (
+    (url.pathname === CODEX_APP_SERVER_STATE_PATH && req.method === "GET")
+    || (url.pathname === CODEX_RESTART_PATH && req.method === "POST")
+  ) {
+    // Resolved inside the path check, not at the top of this function: every
+    // /api/system/* request runs through here, and an unconditional import would
+    // pull the platform process-enumeration helpers into requests that never
+    // touch them.
+    // An explicit branch rather than `??`: the seam is an optional property, and
+    // narrowing through a nullish default keeps its `undefined` in the union.
+    let service: {
+      readState: typeof readCodexAppServerState;
+      performRestart: typeof performCodexRestart;
+    };
+    const injected = ctx.deps.codexRestartService;
+    if (injected) {
+      service = injected;
+    } else {
+      const module = await import("../../codex/app-server-restart-service");
+      service = {
+        readState: module.readCodexAppServerState,
+        performRestart: module.performCodexRestart,
+      };
+    }
+    if (req.method === "GET") {
+      return jsonResponse(service.readState(), 200, req, config);
+    }
+    return jsonResponse(await service.performRestart(), 200, req, config);
+  }
+
   return null;
 }

package/src/server/management/usage-summary-cache.ts

@@ -8,9 +8,17 @@ export type CachedUsageSummary = UsageSummary & {
   entriesDropped: number;
 };
 
-interface UsageSummaryCacheEntry {
+export interface UsageSummaryCacheEntry {
   revisionKey: string;
+  /** path/dev/ino/birthtime only; appends keep this stable. */
+  identityKey: string;
+  maxReadBytes: number;
+  /** userCostOverlayVersion() when the summary was computed; overlay edits invalidate the entry. */
+  overlayVersion: number;
   expiresAt: number;
+  /** Generation freshness: ignore size/mtime until this instant. */
+  freshUntil: number;
+  lastSeenSize: number;
   summary: CachedUsageSummary;
   revisionReadAt: number;
   sizeBytes: number;

package/src/server/management/vision-sidecar-options.ts

@@ -0,0 +1,167 @@
+/**
+ * The one place that decides which models the management API offers as vision
+ * describers, and which it refuses to persist.
+ *
+ * Two routes write a vision sidecar model — `PUT /api/sidecar-settings` and the
+ * `visionSidecar` override in `PUT /api/claude-code`. They share this module so
+ * the policy cannot drift: a gate on one route and a stale copy on the other is
+ * the same as no gate at all.
+ */
+import type { OcxConfig } from "../../types";
+import { findAnthropicVisionProvider, type AnthropicVisionProvider } from "../../vision";
+import { VISION_BACKENDS } from "../../vision/backends";
+import {
+  modelAcceptsImageInput,
+  visionEligibleModelOptions,
+  type VisionCandidateModel,
+  type VisionModelOption,
+  type VisionSidecarBackend,
+} from "../../vision/eligibility";
+import { pickerVisibleSidecarCandidates } from "../../sidecar/candidates";
+import { resolveSidecarAuth } from "../../sidecar/auth";
+
+/**
+ * Backends whose executor could actually run (#2188 roadmap 170): openai
+ * forward, anthropic OAuth, xai OAuth, Antigravity OAuth — resolved by the
+ * VISION_BACKENDS descriptor table so this module and the options path cannot
+ * drift on what "active" means.
+ *
+ * `anthropicSidecar` is REQUIRED rather than defaulted. `findAnthropicVisionProvider`
+ * reads the OAuth account store from disk, and a default argument made every helper
+ * in this chain re-resolve it whenever a caller passed an explicit `undefined` —
+ * which is exactly the no-executor case. Passing it in keeps one read per request.
+ * The descriptor table re-derives the anthropic flag from the shared auth
+ * module; asserting the caller's resolution stays consistent with it is the
+ * job of the shared module, not this file.
+ */
+export function enabledVisionBackends(
+  config: OcxConfig,
+  anthropicSidecar: AnthropicVisionProvider | undefined,
+): VisionSidecarBackend[] {
+  const auth = resolveSidecarAuth(config);
+  // Preserve the caller's resolution for the anthropic side: the descriptor
+  // reads the shared auth module, but a caller that already resolved "no
+  // executor" must not see anthropic options it cannot dispatch. The filter
+  // applies to the ACTIVE set only — the fresh-install fallback below stays
+  // both universal sides, exactly the pre-widening behavior (test 6 pins it).
+  const active = VISION_BACKENDS
+    .filter(descriptor => descriptor.isActive(auth, config))
+    .map(descriptor => descriptor.backend)
+    .filter(backend => backend !== "anthropic" || anthropicSidecar !== undefined);
+  // "routed" is active by construction, so the fresh-install fallback keys on
+  // the UNIVERSAL sides: when neither resolves, both are offered so the picker
+  // stays populated (permissive-unknown rule; test 6 pins it).
+  if (!active.includes("openai") && !active.includes("anthropic")) {
+    return ["openai", "anthropic", ...active];
+  }
+  return active;
+}
+
+/**
+ * Visible catalog rows in the shape the eligibility predicate consumes.
+ * Sourced from the unified picker set (#2188): picker-visible rows ∪ auth
+ * slots, UNFILTERED. Rule 2 (− provably text-only) belongs to the OPTIONS
+ * path only (visionEligibleModelOptions already applies it). The PUT gate
+ * consumes this list as EVIDENCE: a picker row proving an id text-only is
+ * exactly what visionDescriberIsProvablyBlind needs to reject that id, so
+ * pre-filtering here would deaden the gate (review F1: reject → allow flip).
+ */
+export async function visionCandidateRows(config: OcxConfig): Promise<VisionCandidateModel[]> {
+  const auth = resolveSidecarAuth(config);
+  const all = await pickerVisibleSidecarCandidates(config, auth);
+  return all.map(candidate => ({
+    provider: candidate.provider,
+    id: candidate.id,
+    ...(candidate.inputModalities ? { inputModalities: candidate.inputModalities } : {}),
+    ...(candidate.native ? { native: true } : {}),
+  }));
+}
+
+export function visionModelOptionsFrom(
+  config: OcxConfig,
+  candidates: readonly VisionCandidateModel[],
+  anthropicSidecar: AnthropicVisionProvider | undefined,
+): VisionModelOption[] {
+  return visionEligibleModelOptions(
+    config,
+    candidates,
+    enabledVisionBackends(config, anthropicSidecar),
+    anthropicSidecar?.providerName,
+  );
+}
+
+/** Convenience for read paths that have no candidate list in hand yet. */
+export async function visionModelOptionsFor(
+  config: OcxConfig,
+  anthropicSidecar: AnthropicVisionProvider | undefined,
+): Promise<VisionModelOption[]> {
+  return visionModelOptionsFrom(config, await visionCandidateRows(config), anthropicSidecar);
+}
+
+/**
+ * Can we PROVE the requested describer is blind?
+ *
+ * Only a positive `false` rejects. An id no source knows stays allowed, because
+ * the runtime never required catalog membership and an operator may be ahead of
+ * our tables.
+ *
+ * When no catalog row matches, the caller's `backend` is only a HINT, never the
+ * authority. Trusting it let a client launder a known-blind OpenAI model past the
+ * gate by claiming `backend: "anthropic"`, since the id is absent from the
+ * Anthropic table and absence reads as "unknown".
+ *
+ * A NAMESPACED id ("provider/model", the routed-backend option shape) names
+ * its provider outright, so that provider's config row and metadata family
+ * are probed directly. A BARE id probes ALL configured provider families and
+ * any positive text-only verdict wins (roadmap 170: a bare `grok-4` is
+ * provably text-only in the xai vendor table and must not slip through a
+ * two-family probe). That is safe precisely because the vendor tables share
+ * no bare model id (collision scan in roadmap 160: openai 48, anthropic 26,
+ * xai 32, google 43, zero overlaps), so they can never disagree about one.
+ */
+export function visionDescriberIsProvablyBlind(
+  config: OcxConfig,
+  requested: string,
+  candidates: readonly VisionCandidateModel[],
+  backendHint: VisionSidecarBackend | undefined,
+): boolean {
+  // Catalog rows can carry operator-authored modalities. A positive claim from one
+  // must not hide another row or canonical metadata that proves this id is blind.
+  if (candidates.some(candidate => candidate.id === requested
+    && modelAcceptsImageInput(config, candidate) === false)) return true;
+
+  // Namespaced routed id: the provider is named, probe it directly (config
+  // row enrichment + its metadata family both flow through the predicate).
+  const sep = requested.indexOf("/");
+  if (sep > 0) {
+    const provider = requested.slice(0, sep);
+    const id = requested.slice(sep + 1);
+    if (modelAcceptsImageInput(config, { provider, id }) === false) return true;
+    // A namespaced candidate row (value shape) may also carry the proof.
+    return candidates.some(candidate => candidate.provider === provider && candidate.id === id
+      && modelAcceptsImageInput(config, candidate) === false);
+  }
+
+  // Bare id: probe the base vendor families plus every configured provider —
+  // a positive text-only verdict from any source wins.
+  const families = new Set(["openai", "anthropic", "xai", "google-antigravity", ...Object.keys(config.providers ?? {})]);
+  const ordered = backendHint === "anthropic"
+    ? ["anthropic", ...[...families].filter(family => family !== "anthropic")]
+    : ["openai", ...[...families].filter(family => family !== "openai")];
+  return ordered.some(provider => modelAcceptsImageInput(config, { provider, id: requested }) === false);
+}
+
+/** The 400 body both routes return, so the two errors cannot diverge either. */
+export function visionDescriberRejection(
+  field: "vision.model" | "visionSidecar.model",
+  requested: string,
+  config: OcxConfig,
+  candidates: readonly VisionCandidateModel[],
+): { error: string; allowed: string[] } {
+  return {
+    error: `${field} "${requested}" cannot describe images: it has no image input support, or it is a model the vision sidecar describes FOR.`,
+    // The rejection path is not hot, so it resolves the executor itself rather than
+    // making every 400 caller thread one through.
+    allowed: visionModelOptionsFrom(config, candidates, findAnthropicVisionProvider(config)).map(option => option.value),
+  };
+}

package/src/server/management/web-search-sidecar-options.ts

@@ -0,0 +1,120 @@
+/**
+ * The one place that decides which models the management API offers as the
+ * web-search sidecar, and which it refuses to persist (#2188).
+ *
+ * Two routes write `webSearchSidecar.model` — `PUT /api/sidecar-settings`
+ * and the `webSearchSidecar` override in `PUT /api/claude-code`. They share
+ * this module for the same reason the vision routes share
+ * vision-sidecar-options.ts: a gate on one route and a stale copy on the
+ * other is the same as no gate at all. `ocx config set` raw JSON writes
+ * bypass management gates by design (operator escape hatch, same as vision).
+ *
+ * Unlike vision's provably-blind gate (reject only on positive proof), the
+ * web-search gate is MEMBERSHIP: the executor set is closed and known, so an
+ * id outside (candidates ∪ auth slots) can never run and is refused.
+ */
+import type { OcxConfig } from "../../types";
+import { AUTH_SLOT_MODELS, resolveSidecarAuth } from "../../sidecar/auth";
+import { pickerVisibleSidecarCandidates, type SidecarCandidate } from "../../sidecar/candidates";
+import { WEB_SEARCH_BACKENDS, webSearchSidecarCandidates } from "../../web-search/backends";
+import type { WebSearchBackendId } from "../../web-search/index";
+
+// The full configured union. Rows only ever materialize for backends whose
+// executor admits the candidate, so inert arms (gemini/exa without config)
+// simply never produce rows.
+export type WebSearchBackend = WebSearchBackendId;
+
+export interface WebSearchCandidateRow extends SidecarCandidate {
+  /** Executor backend that admitted this exact candidate row. */
+  backend: WebSearchBackend;
+}
+
+export interface WebSearchModelOption {
+  value: string;
+  label: string;
+  /** Exact runnable pair represented by this picker row. */
+  backend: WebSearchBackend;
+  model: string;
+  /** True when the row is an auth-slot entitlement rather than a picker row. */
+  authSlot?: boolean;
+}
+
+/** The candidate rows the web-search executors can actually run right now. */
+export async function webSearchCandidateRows(config: OcxConfig): Promise<WebSearchCandidateRow[]> {
+  const auth = resolveSidecarAuth(config);
+  const all = await pickerVisibleSidecarCandidates(config, auth);
+  return webSearchSidecarCandidates(config, auth, all).flatMap(candidate => {
+   const descriptor = WEB_SEARCH_BACKENDS.find(entry =>
+      entry.isActive(auth, config) && entry.eligibleModel(candidate, auth));
+    return descriptor ? [{ ...candidate, backend: descriptor.backend }] : [];
+  });
+}
+
+/**
+ * The GUI/CLI option list. The persisted model is display-grandfathered so an
+ * operator can SEE a now-illegal setting in the picker (parity with the vision
+ * GET); new writes of such an id are still rejected by the gate below.
+ */
+export function webSearchModelOptionsFrom(
+  config: Pick<OcxConfig, "webSearchSidecar">,
+  candidates: readonly WebSearchCandidateRow[],
+): WebSearchModelOption[] {
+  const byValue = new Map<string, WebSearchModelOption>();
+  for (const candidate of candidates) {
+    if (byValue.has(candidate.id)) continue;
+    byValue.set(candidate.id, {
+      value: candidate.id,
+      label: candidate.id,
+      backend: candidate.backend,
+      model: candidate.id,
+      ...(candidate.authSlot ? { authSlot: true } : {}),
+    });
+  }
+  const persisted = config.webSearchSidecar?.model;
+  if (persisted && !byValue.has(persisted)) {
+    byValue.set(persisted, {
+      value: persisted,
+      label: persisted,
+      backend: config.webSearchSidecar?.backend ?? "openai",
+      model: persisted,
+    });
+  }
+  return [...byValue.values()].sort((a, b) => a.value.localeCompare(b.value));
+}
+
+/**
+ * Membership gate: reject when the id is neither a runnable candidate nor an
+ * auth-slot model. Auth slots pass even when the matching login is currently
+ * absent — the slot is a legal setting whose executor simply is not live yet,
+ * and refusing it would make settings order-dependent on login state.
+ */
+export function webSearchModelIsRejected(
+  backend: WebSearchBackend,
+  requested: string,
+  candidates: readonly WebSearchCandidateRow[],
+): boolean {
+  if (requested === AUTH_SLOT_MODELS.codex) return backend !== "openai";
+  if (requested === AUTH_SLOT_MODELS.anthropic) return backend !== "anthropic";
+  return !candidates.some(candidate => candidate.backend === backend && candidate.id === requested);
+}
+
+/** Uniform 400 payload naming the filter, mirroring visionDescriberRejection's shape. */
+export function webSearchModelRejection(
+  field: string,
+  backend: WebSearchBackend,
+  requested: string,
+  candidates: readonly WebSearchCandidateRow[],
+): { error: string; allowedModels: string[] } {
+  const allowed = new Set(candidates
+    .filter(candidate => candidate.backend === backend)
+    .map(candidate => candidate.id));
+  // Preserve the response contract: allowedModels lists both always-configurable
+  // auth-slot ids even though the pair gate below binds each to its own backend.
+  allowed.add(AUTH_SLOT_MODELS.codex);
+  allowed.add(AUTH_SLOT_MODELS.anthropic);
+  return {
+    error: `${field}: backend/model pair "${backend}/${requested}" is not a web-search sidecar candidate — ` +
+      "the model must be picker-visible and runnable by that executor-backed backend (or its auth-slot model)",
+    allowedModels: [...allowed].sort(),
+  };
+}

package/src/server/management-api.ts

@@ -1,7 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
 import type { CatalogModel } from "../codex/catalog";
-import { catalogModelSlug, invalidateCodexModelsCache, nativeModelRows, uniqueCatalogModelsForPublicList } from "../codex/catalog";
+import { catalogModelSlug, invalidateCodexModelsCache, nativeContextLimits, nativeModelRows, uniqueCatalogModelsForPublicList } from "../codex/catalog";
 import {
   DEFAULT_SUBAGENT_MODELS,
   codexAutoStartEnabled,
@@ -28,7 +28,7 @@ import { deriveProviderPresets } from "../providers/derive";
 import { providerCodexAccountMode } from "../providers/registry";
 import { routedSlug, slugEquals } from "../providers/slug-codec";
 import { clearProviderQuotaCache, fetchProviderQuotaReports } from "../providers/quota";
-import { isCanonicalOpenAiForwardProvider } from "../providers/openai-tiers";
+import { isCanonicalOpenAiForwardProvider, OPENAI_CODEX_PROVIDER_ID } from "../providers/openai-tiers";
 import { clearThreadAccountMap } from "../codex/routing";
 import { primeCodexPoolQuotas } from "../codex/auth-api";
 import { DEFAULT_PROVIDER_CONTEXT_CAP, globalContextCapValue, providerContextCap, providerContextCaps, setAllProviderContextCaps, setGlobalContextCapValue, setProviderContextCap } from "../providers/context-cap";
@@ -59,6 +59,9 @@ import { applySystemEnvToggle } from "./system-env";
 import type { ManagementApiDeps } from "./management/context";
 import { handleConfigRoutes } from "./management/config-routes";
 import { handleLogsUsageRoutes } from "./management/logs-usage-routes";
+import { handleStorageLogGuardRoutes } from "./management/storage-log-guard-routes";
+import { handleRequestHistoryRoutes } from "./management/request-history-routes";
+import { handleRoutingAnalyticsRoutes } from "./management/routing-analytics-routes";
 import { handleProviderRoutes } from "./management/provider-routes";
 import { handleModelRoutes } from "./management/model-routes";
 import { handleAgentSettingsRoutes } from "./management/agent-settings-routes";
@@ -68,10 +71,16 @@ import { handleComboRoutes } from "./management/combo-routes";
 import { handleSystemRoutes } from "./management/system-routes";
 import { handleCloudSyncRoutes } from "./management/cloud-sync-routes";
 import { handleSidebarRoutes } from "./management/sidebar-routes";
+import { handleCodexPromptRoutes } from "./management/codex-prompt-routes";
+import { handleIntegrationRoutes } from "./management/integration-routes";
+import { handleNativeIntegrationRoutes } from "./management/native-integration-routes";
 import type { ManagementContext } from "./management/context";
+import type { ManagementPrincipal } from "./management-auth";
 export type { ManagementApiDeps } from "./management/context";
 import { fetchAllModels } from "./management/shared";
 import { CatalogGatherBusyError } from "../codex/catalog/provider-fetch";
+import type { CatalogDisposition, ConvergeCodex } from "../codex/convergence-types";
+import { normalizeCatalogDisposition } from "../codex/catalog-refresh-status";
 import { managementBodyTooLargeResponse } from "./management/body";
 
 // installed npm version instead of a stale hardcode.
@@ -83,7 +92,53 @@ export const VERSION = (() => {
   }
 })();
 
-export async function handleManagementAPI(req: Request, url: URL, config: OcxConfig, deps: ManagementApiDeps = {}): Promise<Response | null> {
+const managementConvergenceBindings = new WeakMap<object, Readonly<{
+  factory: (config: Readonly<OcxConfig>) => ConvergeCodex;
+  converge: ConvergeCodex;
+}>>();
+
+/**
+ * Namespace match for management route prefixes: exact hit or a child path, never a
+ * prefix collision (`/api/labfoo` must not match `/api/lab`).
+ */
+function pathInManagementNamespace(pathname: string, prefix: string): boolean {
+  return pathname === prefix || pathname.startsWith(`${prefix}/`);
+}
+
+/**
+ * Routing-profile and Compatibility Lab handlers statically import the Lab module graph,
+ * so mounting them eagerly would pull ~70 `src/lab/` modules into every management
+ * request -- including installs that never opted into Lab. Loading them per namespace
+ * keeps `management-api.ts` on the same footing as the three protected core files.
+ *
+ * Cherry-picked from @Wibias's PR #1676, which solved this before the boundary work
+ * reached it. See devlog/_fin/260814_lab_core_decoupling/.
+ */
+async function handleRoutingProfileRoutesOnDemand(ctx: ManagementContext): Promise<Response | null> {
+  if (!pathInManagementNamespace(ctx.url.pathname, "/api/routing-profiles")) return null;
+  const { handleRoutingProfileRoutes } = await import("./management/routing-profile-routes");
+  return handleRoutingProfileRoutes(ctx);
+}
+
+async function handleLabRoutesOnDemand(ctx: ManagementContext): Promise<Response | null> {
+  if (!pathInManagementNamespace(ctx.url.pathname, "/api/lab")) return null;
+  // Automation is checked first so its narrower namespace keeps its own handler, matching
+  // the eager chain's ordering.
+  if (pathInManagementNamespace(ctx.url.pathname, "/api/lab/automation")) {
+    const { handleLabAutomationRoutes } = await import("./management/lab-automation-routes");
+    return handleLabAutomationRoutes(ctx);
+  }
+  const { handleLabRoutes } = await import("./management/lab-routes");
+  return handleLabRoutes(ctx);
+}
+
+export async function handleManagementAPI(
+  req: Request,
+  url: URL,
+  config: OcxConfig,
+  deps: ManagementApiDeps = {},
+  principal?: ManagementPrincipal,
+): Promise<Response | null> {
   if (!isAllowedManagementOrigin(req, config)) {
     return jsonResponse({ error: "cross-origin request blocked" }, 403, req, config);
   }
@@ -95,13 +150,48 @@ export async function handleManagementAPI(req: Request, url: URL, config: OcxCon
       return jsonResponse({ error: "request body too large" }, 413, req, config);
     }
   }
-  async function refreshCodexCatalogBestEffort(): Promise<void> {
-    if (deps.refreshCodexCatalog) return deps.refreshCodexCatalog();
+  async function convergeCodexCatalog(): Promise<CatalogDisposition> {
+    let convergenceInvoked = false;
+    let managementConvergeCodex: ConvergeCodex | undefined;
     try {
-      const { refreshCodexModelCatalog } = await import("../codex/refresh");
-      await refreshCodexModelCatalog(config);
-    } catch {
-      /* catalog absent */
+      if (!managementConvergeCodex) {
+        const factory = deps.createManagementConvergeCodex
+          ?? (await import("../codex/management-convergence")).createManagementConvergeCodex;
+        if (typeof factory !== "function") throw new TypeError("Catalog convergence factory is unavailable.");
+        let binding = managementConvergenceBindings.get(config);
+        if (!binding || binding.factory !== factory) {
+          const created = factory(config);
+          if (typeof created !== "function") throw new TypeError("Catalog convergence factory returned no function.");
+          binding = { factory, converge: created };
+          managementConvergenceBindings.set(config, binding);
+        }
+        managementConvergeCodex = binding.converge;
+      }
+      const { createCatalogConvergeRequest } = await import("../codex/catalog-admission");
+      convergenceInvoked = true;
+      const outcome = await managementConvergeCodex(createCatalogConvergeRequest({ deadlineMs: 1_000 }));
+      const catalogRefresh = outcome?.kind === "catalog-only"
+        ? normalizeCatalogDisposition(outcome.catalogRefresh)
+        : null;
+      if (!catalogRefresh) {
+        throw new TypeError("Catalog convergence returned an invalid outcome.");
+      }
+      return catalogRefresh;
+    } catch (error) {
+      // #1784: this used to manufacture `reason: "disk"` for every escaping error, so a
+      // programming fault and a full filesystem were indistinguishable and both reported
+      // non-retryable. Classify honestly and keep the cause allowlisted.
+      const invalidRequest = error instanceof TypeError
+        || error instanceof RangeError
+        || error instanceof SyntaxError;
+      return {
+        status: "failed",
+        reason: invalidRequest ? "request-invalid" : "internal",
+        phase: convergenceInvoked ? "commit" : "gather",
+        retryable: false,
+        partialWrite: convergenceInvoked,
+        cause: { kind: invalidRequest ? "invalid-request" : "unknown" },
+      };
     }
   }
 
@@ -118,7 +208,7 @@ export async function handleManagementAPI(req: Request, url: URL, config: OcxCon
           import("../claude/context-windows"),
           import("../codex/catalog"),
         ]);
-        injectClaudeAgentDefs(config, buildClaudeContextWindows([...visibleNativeSlugs(config)], models));
+        injectClaudeAgentDefs(config, buildClaudeContextWindows([...visibleNativeSlugs(config)], models, nativeContextLimits(config)));
       } catch {
         // Keep routes available through a provider-discovery blip. A later
         // launch-time sync restores any context markers missing from this pass.
@@ -126,19 +216,27 @@ export async function handleManagementAPI(req: Request, url: URL, config: OcxCon
       }
     } catch { /* best-effort */ }
   }
-  const ctx: ManagementContext = { req, url, config, deps, refreshCodexCatalogBestEffort, syncClaudeAgentDefsBestEffort };
+  const ctx: ManagementContext = { req, url, config, deps, principal, convergeCodexCatalog, syncClaudeAgentDefsBestEffort };
   let routed: Response | null;
   try {
     routed = (await handleConfigRoutes(ctx))
-      ?? (await handleLogsUsageRoutes(ctx))
-      ?? (await handleProviderRoutes(ctx))
-      ?? (await handleModelRoutes(ctx))
-      ?? (await handleAgentSettingsRoutes(ctx))
-      ?? (await handleClientsRoutes(ctx))
-      ?? (await handleOauthAccountRoutes(ctx))
-      ?? (await handleComboRoutes(ctx))
-      ?? (await handleSystemRoutes(ctx))
-      ?? (await handleCloudSyncRoutes(ctx))
+    ??     (await handleStorageLogGuardRoutes(ctx))
+    ??     (await handleLogsUsageRoutes(ctx))
+    ??     (await handleRequestHistoryRoutes(ctx))
+    ??     (await handleRoutingAnalyticsRoutes(ctx))
+    ??     (await handleRoutingProfileRoutesOnDemand(ctx))
+    ??     (await handleProviderRoutes(ctx))
+    ??     (await handleModelRoutes(ctx))
+    ??     (await handleIntegrationRoutes(ctx))
+    ??     (await handleNativeIntegrationRoutes(ctx))
+    ??     (await handleAgentSettingsRoutes(ctx))
+    ??     (await handleCodexPromptRoutes(ctx))
+    ??     (await handleClientsRoutes(ctx))
+    ??     (await handleOauthAccountRoutes(ctx))
+    ??     (await handleComboRoutes(ctx))
+    ??     (await handleSystemRoutes(ctx))
+    ??     (await handleCloudSyncRoutes(ctx))
+    ??     (await handleLabRoutesOnDemand(ctx))
       ?? (await handleSidebarRoutes(ctx));
   } catch (error) {
     const tooLarge = managementBodyTooLargeResponse(error, req, config);
@@ -158,7 +256,7 @@ export async function handleManagementAPI(req: Request, url: URL, config: OcxCon
   if (routed) return routed;
 
   if (url.pathname === "/api/stop" && req.method === "POST") {
-    const { restoreNativeCodex } = await import("../codex/inject");
+    const { restoreNativeCodexAsync } = await import("../codex/inject");
     const { stopServiceIfInstalled, isServiceOwnershipError } = await import("../service");
     try {
       stopServiceIfInstalled();
@@ -171,7 +269,7 @@ export async function handleManagementAPI(req: Request, url: URL, config: OcxCon
       }
       throw err;
     }
-    const restore = restoreNativeCodex();
+    const restore = await restoreNativeCodexAsync();
     // Both managed configs come down together on an explicit teardown. The daemon's own
     // syncCleanup skips this when OCX_SERVICE is set (so a crash/respawn keeps the fence),
     // which is exactly why an intentional stop has to do it here.
@@ -187,12 +285,17 @@ export async function handleManagementAPI(req: Request, url: URL, config: OcxCon
       : { success: false, message: `Proxy stopping, but native Codex restore failed: ${restore.message}. Run \`ocx restore\`.${grokNote}` });
   }
 
+  if (url.pathname.startsWith("/api/native-main-profiles")) {
+    const { handleNativeProfileAPI } = await import("../codex/native-profile-api");
+    return handleNativeProfileAPI(req, url, config, deps.nativeProfileApi);
+  }
+
   if (url.pathname.startsWith("/api/codex-auth/")) {
     const { handleCodexAuthAPI } = await import("../codex/auth-api");
     const { ConfigMutationLockError } = await import("../config");
     const { CodexCredentialRefreshLockTimeoutError } = await import("../codex/account-store");
     try {
-      return await handleCodexAuthAPI(req, url, config);
+      return await handleCodexAuthAPI(req, url, config, convergeCodexCatalog);
     } catch (error) {
       // Credential writers remap ConfigMutationLockError to CodexCredentialRefreshLockTimeoutError;
       // treat both as the same retryable busy response.