@iislee/opencodex 2.11.0

package/src/server/management/api-access.ts

@@ -0,0 +1,141 @@
+import type { OcxConfig } from "../../types";
+import { probeHostname } from "../proxy-liveness";
+
+export interface ApiAccessEndpoints {
+  baseUrl: string;
+  responsesEndpoint: string;
+  chatCompletionsEndpoint: string;
+  messagesEndpoint: string;
+  modelsEndpoint: string;
+  claudeCodeEnabled: boolean;
+  /** Back-compat alias for older GUI clients. */
+  endpoint: string;
+}
+
+export type BuildApiAccessEndpointsOptions = {
+  /** Full request URL (preferred when the bind host is a wildcard). */
+  requestUrl?: string | URL | null;
+  /** Raw `Host` header from the inbound request. */
+  requestHost?: string | null;
+  /** Raw `Origin` header from the inbound request. */
+  requestOrigin?: string | null;
+};
+
+function isWildcardBindHost(hostname: string | undefined): boolean {
+  const trimmed = (hostname ?? "").trim();
+  return !trimmed || trimmed === "0.0.0.0" || trimmed === "::" || trimmed === "[::]";
+}
+
+/** Bracket bare IPv6 literals for URL authority composition. */
+export function formatAuthorityHost(hostname: string): string {
+  const trimmed = hostname.trim();
+  if (!trimmed) return "127.0.0.1";
+  if (trimmed.startsWith("[") && trimmed.endsWith("]")) return trimmed;
+  return trimmed.includes(":") ? `[${trimmed}]` : trimmed;
+}
+
+function hostnameFromAuthority(authority: string): string | null {
+  const raw = authority.trim();
+  if (!raw) return null;
+  if (raw.startsWith("[")) {
+    const end = raw.indexOf("]");
+    if (end > 0) return raw.slice(1, end) || null;
+    return null;
+  }
+  // Host headers for IPv6 are bracketed; treat multi-colon values as unusable.
+  if (raw.includes(":") && raw.split(":").length > 2) return null;
+  const colon = raw.lastIndexOf(":");
+  if (colon > 0 && /^\d+$/.test(raw.slice(colon + 1))) {
+    return raw.slice(0, colon) || null;
+  }
+  return raw;
+}
+
+function originBaseUrl(raw: string): string | null {
+  try {
+    const url = new URL(raw);
+    if (!url.hostname || isWildcardBindHost(url.hostname)) return null;
+    return `${url.protocol}//${url.host}/v1`;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Prefer the client's request host/origin when the proxy is bound to a wildcard.
+ * Falls back to loopback only when no usable request context is available.
+ */
+export function resolveApiAccessBaseUrl(
+  config: Pick<OcxConfig, "hostname" | "port">,
+  opts: BuildApiAccessEndpointsOptions = {},
+): string {
+  const port = config.port ?? 10100;
+
+  if (!isWildcardBindHost(config.hostname)) {
+    return `http://${probeHostname(config.hostname)}:${port}/v1`;
+  }
+
+  const fromOrigin = opts.requestOrigin ? originBaseUrl(opts.requestOrigin) : null;
+  if (fromOrigin) return fromOrigin;
+
+  if (opts.requestUrl) {
+    try {
+      const url = typeof opts.requestUrl === "string" ? new URL(opts.requestUrl) : opts.requestUrl;
+      if (url.hostname && !isWildcardBindHost(url.hostname)) {
+        return `${url.protocol}//${url.host}/v1`;
+      }
+    } catch {
+      /* ignore malformed request URL */
+    }
+  }
+
+  const hostHeader = opts.requestHost?.trim();
+  if (hostHeader) {
+    const hostname = hostnameFromAuthority(hostHeader);
+    if (hostname && !isWildcardBindHost(hostname)) {
+      // Preserve an explicit port from the Host header; otherwise use the bind port.
+      const hasPort = hostHeader.startsWith("[")
+        ? /\]:\d+$/.test(hostHeader)
+        : /:\d+$/.test(hostHeader) && hostHeader.split(":").length === 2;
+      const authority = hasPort
+        ? (hostHeader.startsWith("[") ? hostHeader : hostHeader)
+        : `${formatAuthorityHost(hostname)}:${port}`;
+      return `http://${authority}/v1`;
+    }
+  }
+
+  return `http://127.0.0.1:${port}/v1`;
+}
+
+/** @deprecated Prefer resolveApiAccessBaseUrl; retained for focused host-format tests. */
+export function resolveApiAccessDisplayHost(
+  configHostname: string | undefined,
+  opts: BuildApiAccessEndpointsOptions = {},
+): string {
+  if (!isWildcardBindHost(configHostname)) {
+    return probeHostname(configHostname);
+  }
+  try {
+    return new URL(resolveApiAccessBaseUrl({ hostname: configHostname, port: 10100 }, opts)).hostname
+      || "127.0.0.1";
+  } catch {
+    return "127.0.0.1";
+  }
+}
+
+export function buildApiAccessEndpoints(
+  config: OcxConfig,
+  opts: BuildApiAccessEndpointsOptions = {},
+): ApiAccessEndpoints {
+  const baseUrl = resolveApiAccessBaseUrl(config, opts);
+  const responsesEndpoint = `${baseUrl}/responses`;
+  return {
+    baseUrl,
+    responsesEndpoint,
+    chatCompletionsEndpoint: `${baseUrl}/chat/completions`,
+    messagesEndpoint: `${baseUrl}/messages`,
+    modelsEndpoint: `${baseUrl}/models`,
+    claudeCodeEnabled: config.claudeCode?.enabled !== false,
+    endpoint: responsesEndpoint,
+  };
+}

package/src/server/management/api-key-usage.ts

@@ -0,0 +1,167 @@
+import {
+  currentUsageLogRevision,
+  readUsageSnapshotForManagement,
+  usageLogRevisionKey,
+  type PersistedUsageEntry,
+} from "../../usage/log";
+
+/**
+ * Per-key usage as the API tab renders it.
+ *
+ * A discriminated union rather than numbers with a flag beside them: when two
+ * config entries share an id there IS no per-key total, and an optional marker
+ * next to `requests7d: 7` invites a consumer to render the 7 anyway.
+ */
+export type ApiKeyUsage =
+  | { ambiguous: true }
+  | { ambiguous?: false; requests7d: number; totalRequests: number; lastUsedAt?: string };
+
+export interface ApiKeyUsageSnapshot {
+  rollup: Map<string, ApiKeyUsage>;
+  historyTruncated?: true;
+  /**
+   * Earliest row carrying a recognized `admissionKind`. A property of the DATA
+   * SET, not of a key, so it is singular and lives beside the map: it is what
+   * lets the GUI tell "this key was used zero times" from "nothing is
+   * attributable yet". Keyed on the kind rather than on `apiKeyId`, because an
+   * environment or loopback row is attributed traffic with no configured key.
+   */
+  attributionSince?: string;
+}
+
+const SEVEN_DAYS_MS = 7 * 24 * 60 * 60 * 1000;
+
+/**
+ * A timestamp we can actually do date arithmetic with.
+ *
+ * `usage.jsonl` is hand-editable and JSON permits numbers outside the Date
+ * range: `1e309` survives normalization and then throws `RangeError` from
+ * `toISOString()`. Since the caller catches to protect key management, one bad
+ * row would have zeroed the rollup for EVERY key — active keys reported as
+ * unused is exactly the wrong answer to hand someone deciding what to delete.
+ */
+function usableTimestamp(value: unknown): number | null {
+  if (typeof value !== "number" || !Number.isFinite(value)) return null;
+  return Number.isNaN(new Date(value).getTime()) ? null : value;
+}
+
+/**
+ * Pure: one pass over an already-read snapshot, so it is unit-testable without
+ * touching the filesystem.
+ *
+ * Rows are bucketed only when `admissionKind === "configured"`. Keying on
+ * `apiKeyId` alone would let a hand-edited entry whose id is `loopback` absorb
+ * traffic it never admitted.
+ */
+export function rollupApiKeyUsage(
+  entries: PersistedUsageEntry[],
+  configuredIds: string[],
+  now: number = Date.now(),
+): ApiKeyUsageSnapshot {
+  const duplicated = new Set<string>();
+  const seen = new Set<string>();
+  for (const id of configuredIds) {
+    if (seen.has(id)) duplicated.add(id);
+    seen.add(id);
+  }
+
+  const totals = new Map<string, { requests7d: number; totalRequests: number; lastUsedAt?: string }>();
+  let attributionSince: number | undefined;
+  const cutoff = now - SEVEN_DAYS_MS;
+
+  for (const entry of entries) {
+    if (!entry.admissionKind) continue;
+    const timestamp = usableTimestamp(entry.timestamp);
+    if (timestamp !== null && (attributionSince === undefined || timestamp < attributionSince)) {
+      attributionSince = timestamp;
+    }
+    if (entry.admissionKind !== "configured" || !entry.apiKeyId) continue;
+
+    const bucket = totals.get(entry.apiKeyId) ?? { requests7d: 0, totalRequests: 0 };
+    // The request happened even if its clock reading is unusable, so it still
+    // counts toward the total; only the time-based fields are skipped.
+    bucket.totalRequests += 1;
+    if (timestamp !== null) {
+      if (timestamp >= cutoff) bucket.requests7d += 1;
+      const iso = new Date(timestamp).toISOString();
+      if (!bucket.lastUsedAt || iso > bucket.lastUsedAt) bucket.lastUsedAt = iso;
+    }
+    totals.set(entry.apiKeyId, bucket);
+  }
+
+  const rollup = new Map<string, ApiKeyUsage>();
+  for (const id of configuredIds) {
+    if (duplicated.has(id)) {
+      rollup.set(id, { ambiguous: true });
+      continue;
+    }
+    rollup.set(id, totals.get(id) ?? { requests7d: 0, totalRequests: 0 });
+  }
+  return {
+    rollup,
+    ...(attributionSince !== undefined ? { attributionSince: new Date(attributionSince).toISOString() } : {}),
+  };
+}
+
+/**
+ * Rollup cache keyed by the exact usage-log revision, mirroring the /api/usage
+ * summary cache. Without it, every key-list read reparses an append-only log
+ * that only ever grows — and the GUI fetches this route on mount and after every
+ * create/rename/delete. The compact rollup is a handful of counters per key, so
+ * caching it costs nothing; a new row changes the revision and invalidates it.
+ */
+let rollupCache: { revisionKey: string; expiresAt: number; snapshot: ApiKeyUsageSnapshot } | null = null;
+
+/**
+ * The rollup is a function of the log AND of the clock: a request ages out of
+ * the seven-day window with no write to bump the file revision, so a purely
+ * revision-keyed entry would report a stale `requests7d` indefinitely.
+ *
+ * A minute is the whole rule. Deriving the exact next-transition instant would
+ * mean tracking the OLDEST counted request per key, which the compact rollup
+ * deliberately does not keep — and a count that can be at most 60s stale is
+ * already far tighter than the window it describes.
+ */
+const ROLLUP_CACHE_TTL_MS = 60_000;
+
+/** Test seam: the cache is module state and would otherwise leak between cases. */
+export function clearApiKeyUsageCacheForTests(): void {
+  rollupCache = null;
+}
+
+/**
+ * Reads the durable usage snapshot the way /api/usage does, then rolls it up.
+ *
+ * Never throws: an unreadable snapshot yields empty rollups and no
+ * `attributionSince`. Key management working matters more than usage numbers
+ * being present, and the GUI already treats an absent field as "no data".
+ */
+export async function readApiKeyUsageRollup(configuredIds: string[], maxReadBytes?: number): Promise<ApiKeyUsageSnapshot> {
+  // JSON rather than a joined string: ids are only validated as non-empty
+  // strings, so `["a\0b","c"]` and `["a","b\0c"]` join to the same value and one
+  // config could be served the other's cached rollup.
+  const idsKey = JSON.stringify([configuredIds, maxReadBytes]);
+  const now = Date.now();
+  try {
+    const observedKey = `${usageLogRevisionKey(currentUsageLogRevision())}|${idsKey}`;
+    if (rollupCache?.revisionKey === observedKey && now < rollupCache.expiresAt) {
+      return rollupCache.snapshot;
+    }
+
+    const snapshot = await readUsageSnapshotForManagement(maxReadBytes);
+    const rolled = {
+      ...rollupApiKeyUsage(snapshot.entries, configuredIds, now),
+      ...(snapshot.truncatedPrefixBytes > 0 || snapshot.entriesTruncated ? { historyTruncated: true as const } : {}),
+    };
+    rollupCache = {
+      revisionKey: `${usageLogRevisionKey(snapshot.revision)}|${idsKey}`,
+      expiresAt: now + ROLLUP_CACHE_TTL_MS,
+      snapshot: rolled,
+    };
+    return rolled;
+  } catch {
+    const rollup = new Map<string, ApiKeyUsage>();
+    for (const id of configuredIds) rollup.set(id, { requests7d: 0, totalRequests: 0 });
+    return { rollup };
+  }
+}

package/src/server/management/body.ts

@@ -0,0 +1,35 @@
+import type { OcxConfig } from "../../types";
+import { jsonResponse } from "../auth-cors";
+import {
+  DecompressedBodyTooLargeError,
+  readBoundedJsonRequestBody,
+} from "../request-decompress";
+
+export const MANAGEMENT_JSON_BODY_MAX_BYTES = 4 * 1024 * 1024;
+
+export function readManagementJsonBody<T = unknown>(req: Request): Promise<T> {
+  return readBoundedJsonRequestBody(req, MANAGEMENT_JSON_BODY_MAX_BYTES) as Promise<T>;
+}
+
+export function managementBodyTooLargeResponse(
+  error: unknown,
+  req: Request,
+  config: OcxConfig,
+): Response | null {
+  return error instanceof DecompressedBodyTooLargeError
+    ? jsonResponse({ error: "request body too large" }, 413, req, config)
+    : null;
+}
+
+export function rethrowManagementBodyTooLarge(error: unknown): void {
+  if (error instanceof DecompressedBodyTooLargeError) throw error;
+}
+
+export async function readManagementJsonBodyOr<T>(req: Request, fallback: T): Promise<unknown | T> {
+  try {
+    return await readManagementJsonBody(req);
+  } catch (error) {
+    rethrowManagementBodyTooLarge(error);
+    return fallback;
+  }
+}

package/src/server/management/clients-routes.ts

@@ -0,0 +1,63 @@
+/**
+ * Clients effective-status management route.
+ *
+ * GET /api/clients/status — read-only snapshot of each coding agent's on-disk
+ * routing (base URL / model / verdict). Never serializes secrets.
+ */
+import { readRuntimePort } from "../../config";
+import { jsonResponse } from "../auth-cors";
+import type { ManagementContext } from "./context";
+
+export async function handleClientsRoutes(ctx: ManagementContext): Promise<Response | null> {
+  const { req, url, config } = ctx;
+
+  if (url.pathname === "/api/clients/status" && req.method === "GET") {
+    try {
+      const { readClientsEffectiveStatus } = await import("../../clients/effective-status");
+      const { findLiveProxy } = await import("../proxy-liveness");
+
+      // Prefer live bind metadata so the page compares client base URLs against the
+      // port the proxy actually answered on, not just config.port.
+      let livePort: number | undefined;
+      let liveHostname: string | undefined;
+      let running = false;
+      try {
+        const live = await findLiveProxy();
+        if (live) {
+          running = true;
+          livePort = live.port;
+          liveHostname = live.hostname;
+        }
+      } catch {
+        // Fall back to runtime-port file / config.
+      }
+      if (!running) {
+        try {
+          const runtime = readRuntimePort(process.pid);
+          if (runtime?.port) {
+            // Runtime file exists for this process → we are the proxy answering this request.
+            running = true;
+            livePort = runtime.port;
+            liveHostname = runtime.hostname;
+          }
+        } catch { /* ignore */ }
+      }
+      // Management API is served by the proxy itself, so if we got here the process is up.
+      // Still report running=true even when findLiveProxy races during startup.
+      if (!running) running = true;
+      if (livePort === undefined) livePort = config.port;
+      if (liveHostname === undefined) liveHostname = config.hostname;
+
+      const snapshot = await readClientsEffectiveStatus(config, {
+        running,
+        livePort,
+        liveHostname,
+      });
+      return jsonResponse(snapshot);
+    } catch (error) {
+      return jsonResponse({ error: error instanceof Error ? error.message : String(error) }, 400);
+    }
+  }
+
+  return null;
+}

package/src/server/management/cloud-sync-routes.ts

@@ -0,0 +1,266 @@
+/**
+ * /api/cloud-sync/* — OneDrive backup/restore for ~/.opencodex (management auth).
+ */
+import {
+  azureRedirectUri,
+  cancelBrowserLogin,
+  clearOneDriveToken,
+  fetchOneDriveAccountEmail,
+  getBrowserLoginStatus,
+  pollDeviceCodeTokenOnce,
+  readOneDriveToken,
+  resolveLoopbackPort,
+  resolveMsAuthority,
+  startBrowserLoopbackLogin,
+  startDeviceCodeLogin,
+  writeOneDriveToken,
+} from "../../cloud/onedrive-auth";
+import type { MsAuthority } from "../../cloud/types";
+import { remoteSyncRootDescription } from "../../cloud/onedrive-graph";
+import { pullFromOneDrive, pushToOneDrive, readRemoteManifest } from "../../cloud/sync";
+import {
+  getDeviceName,
+  getOrCreateDeviceId,
+  readCloudSyncSettings,
+  resolveClientId,
+  writeCloudSyncSettings,
+} from "../../cloud/settings";
+import { jsonResponse } from "../auth-cors";
+import type { ManagementContext } from "./context";
+
+interface PendingDeviceLogin {
+  clientId: string;
+  deviceCode: string;
+  userCode: string;
+  verificationUri: string;
+  verificationUriComplete?: string;
+  interval: number;
+  expiresAt: number;
+  authority: MsAuthority;
+}
+
+let pendingLogin: PendingDeviceLogin | null = null;
+
+function statusPayload() {
+  const settings = readCloudSyncSettings();
+  const token = readOneDriveToken();
+  return {
+    clientId: settings.clientId ?? process.env.OPENCODEX_MS_CLIENT_ID ?? process.env.OPENCODEX_ONEDRIVE_CLIENT_ID ?? null,
+    hasClientSecret: Boolean(settings.clientSecret?.trim() || process.env.OPENCODEX_MS_CLIENT_SECRET?.trim()),
+    loggedIn: Boolean(token),
+    account: token?.account ?? null,
+    msAuthority: resolveMsAuthority(),
+    deviceId: getOrCreateDeviceId(),
+    deviceName: getDeviceName(),
+    lastSyncAt: settings.lastSyncAt ?? null,
+    lastSyncDirection: settings.lastSyncDirection ?? null,
+    remoteRoot: remoteSyncRootDescription(),
+    includeUsage: settings.includeUsage === true,
+    includeVault: settings.includeVault !== false,
+    loopbackPort: resolveLoopbackPort(),
+    /** Exact value to paste into Azure → Mobile and desktop → Redirect URIs */
+    azureRedirectUri: azureRedirectUri(),
+  };
+}
+
+export async function handleCloudSyncRoutes(ctx: ManagementContext): Promise<Response | null> {
+  const { req, url, config } = ctx;
+
+  if (url.pathname === "/api/cloud-sync/status" && req.method === "GET") {
+    const base = statusPayload();
+    let remoteManifest: unknown = null;
+    let remoteError: string | null = null;
+    if (base.loggedIn) {
+      try {
+        remoteManifest = await readRemoteManifest();
+      } catch (e) {
+        remoteError = e instanceof Error ? e.message : String(e);
+      }
+    }
+    return jsonResponse({ ...base, remoteManifest, remoteError });
+  }
+
+  if (url.pathname === "/api/cloud-sync/client-id" && req.method === "POST") {
+    let body: { clientId?: unknown; clientSecret?: unknown };
+    try { body = await req.json(); } catch { return jsonResponse({ error: "invalid JSON" }, 400); }
+    const clientId = typeof body.clientId === "string" ? body.clientId.trim() : "";
+    if (!clientId || clientId.length < 8) return jsonResponse({ error: "clientId is required" }, 400);
+    const settings = readCloudSyncSettings();
+    const next = { ...settings, clientId };
+    // Only update secret when the field is present (empty string clears it).
+    if ("clientSecret" in body) {
+      const secret = typeof body.clientSecret === "string" ? body.clientSecret.trim() : "";
+      if (secret) next.clientSecret = secret;
+      else delete next.clientSecret;
+    }
+    writeCloudSyncSettings(next);
+    return jsonResponse({
+      ok: true,
+      clientId,
+      hasClientSecret: Boolean(next.clientSecret),
+    });
+  }
+
+  if (url.pathname === "/api/cloud-sync/login/start" && req.method === "POST") {
+    let body: { clientId?: unknown; msAuthority?: unknown; mode?: unknown } = {};
+    try { body = await req.json(); } catch { /* empty ok */ }
+    let clientId: string;
+    try {
+      clientId = resolveClientId(typeof body.clientId === "string" ? body.clientId : undefined);
+    } catch (e) {
+      return jsonResponse({ error: e instanceof Error ? e.message : String(e) }, 400);
+    }
+    const authorityHint = typeof body.msAuthority === "string" ? body.msAuthority : undefined;
+    const authority =
+      authorityHint === "common" || authorityHint === "consumers" || authorityHint === "organizations"
+        ? authorityHint
+        : undefined;
+    const settings = readCloudSyncSettings();
+    writeCloudSyncSettings({
+      ...settings,
+      clientId,
+      ...(authority ? { msAuthority: authority } : {}),
+    });
+    // Default: browser loopback PKCE (works with Mobile+desktop + http://localhost).
+    // mode=device forces classic device-code (needs Allow public client flows / "mobile").
+    const mode = body.mode === "device" ? "device" : "browser";
+    try {
+      if (mode === "browser") {
+        cancelBrowserLogin();
+        pendingLogin = null;
+        const start = await startBrowserLoopbackLogin(clientId, authority);
+        return jsonResponse({
+          ok: true,
+          mode: "browser",
+          authUrl: start.authUrl,
+          redirectUri: start.redirectUri,
+          azureRedirectUri: start.azureRedirectUri,
+          verificationUri: start.authUrl,
+          verificationUriComplete: start.authUrl,
+          message:
+            `Complete sign-in in the browser. Azure must list redirect URI exactly: ${start.azureRedirectUri}`,
+          expiresIn: start.expiresIn,
+          interval: 2,
+          msAuthority: start.authority,
+        });
+      }
+      cancelBrowserLogin();
+      const start = await startDeviceCodeLogin(clientId, authority);
+      pendingLogin = {
+        clientId,
+        deviceCode: start.deviceCode,
+        userCode: start.userCode,
+        verificationUri: start.verificationUri,
+        verificationUriComplete: start.verificationUriComplete,
+        interval: start.interval,
+        expiresAt: Date.now() + start.expiresIn * 1000,
+        authority: start.authority,
+      };
+      return jsonResponse({
+        ok: true,
+        mode: "device",
+        userCode: start.userCode,
+        verificationUri: start.verificationUri,
+        verificationUriComplete: start.verificationUriComplete ?? null,
+        message: start.message,
+        expiresIn: start.expiresIn,
+        interval: start.interval,
+        msAuthority: start.authority,
+      });
+    } catch (e) {
+      return jsonResponse({ error: e instanceof Error ? e.message : String(e) }, 500);
+    }
+  }
+
+  if (url.pathname === "/api/cloud-sync/login/poll" && req.method === "POST") {
+    // Browser loopback session takes precedence when active.
+    const browser = getBrowserLoginStatus();
+    if (browser.status === "pending") {
+      return jsonResponse({ ok: true, pending: true, mode: "browser" });
+    }
+    if (browser.status === "ok") {
+      const account = browser.account ?? browser.store.account ?? null;
+      cancelBrowserLogin();
+      return jsonResponse({ ok: true, pending: false, mode: "browser", account, msAuthority: browser.store.authority });
+    }
+    if (browser.status === "error") {
+      const err = browser.error;
+      cancelBrowserLogin();
+      return jsonResponse({ pending: false, mode: "browser", error: err }, 400);
+    }
+
+    if (!pendingLogin) return jsonResponse({ pending: false, error: "no login in progress" }, 400);
+    if (Date.now() > pendingLogin.expiresAt) {
+      pendingLogin = null;
+      return jsonResponse({ pending: false, error: "device code expired" }, 400);
+    }
+    try {
+      const result = await pollDeviceCodeTokenOnce(
+        pendingLogin.clientId,
+        pendingLogin.deviceCode,
+        pendingLogin.authority,
+      );
+      if (result.status === "pending") {
+        return jsonResponse({ ok: true, pending: true, mode: "device", error: result.error });
+      }
+      if (result.status === "error") {
+        pendingLogin = null;
+        return jsonResponse({ pending: false, mode: "device", error: result.error }, 400);
+      }
+      const store = result.store;
+      const email = await fetchOneDriveAccountEmail(store.accessToken);
+      if (email) {
+        store.account = email;
+        writeOneDriveToken(store);
+      }
+      pendingLogin = null;
+      return jsonResponse({ ok: true, pending: false, mode: "device", account: email ?? null, msAuthority: store.authority });
+    } catch (e) {
+      return jsonResponse({ pending: false, error: e instanceof Error ? e.message : String(e) }, 500);
+    }
+  }
+
+  if (url.pathname === "/api/cloud-sync/logout" && req.method === "POST") {
+    pendingLogin = null;
+    cancelBrowserLogin();
+    clearOneDriveToken();
+    return jsonResponse({ ok: true });
+  }
+
+  if (url.pathname === "/api/cloud-sync/push" && req.method === "POST") {
+    let body: { passphrase?: unknown; includeUsage?: unknown; noVault?: unknown } = {};
+    try { body = await req.json(); } catch { /* empty ok */ }
+    const passphrase = typeof body.passphrase === "string" ? body.passphrase : undefined;
+    const includeUsage = body.includeUsage === true;
+    const noVault = body.noVault === true;
+    try {
+      resolveClientId();
+      const result = await pushToOneDrive({
+        passphrase: noVault ? undefined : passphrase,
+        includeUsage,
+        includeVault: !noVault && Boolean(passphrase),
+      });
+      return jsonResponse({ ok: true, ...result });
+    } catch (e) {
+      return jsonResponse({ error: e instanceof Error ? e.message : String(e) }, 400);
+    }
+  }
+
+  if (url.pathname === "/api/cloud-sync/pull" && req.method === "POST") {
+    let body: { passphrase?: unknown; includeUsage?: unknown; yes?: unknown } = {};
+    try { body = await req.json(); } catch { /* empty ok */ }
+    if (body.yes !== true) return jsonResponse({ error: "pull requires yes: true (overwrites local state)" }, 400);
+    const passphrase = typeof body.passphrase === "string" ? body.passphrase : undefined;
+    const includeUsage = body.includeUsage === true;
+    try {
+      resolveClientId();
+      const result = await pullFromOneDrive({ yes: true, passphrase, includeUsage });
+      return jsonResponse({ ok: true, ...result });
+    } catch (e) {
+      return jsonResponse({ error: e instanceof Error ? e.message : String(e) }, 400);
+    }
+  }
+
+  void config;
+  return null;
+}