@iislee/opencodex 2.31.0 → 2.35.0

package/src/server/management/model-rows.ts

@@ -63,6 +63,7 @@ export async function listManagementModelRows(config: OcxConfig): Promise<Manage
           disabled: disabled.has(`${selector}/${slug}`) || disabled.has(slug),
           contextWindow: undefined,
           maxInputTokens: undefined,
+          autoCompactTokenLimit: undefined,
         })))
     : [];
   const native: ManagementModelRow[] = [...nativeRows, ...accountNativeRows].map(row => {
@@ -82,6 +83,9 @@ export async function listManagementModelRows(config: OcxConfig): Promise<Manage
       // 1.05M). Dropping it here made /api/models describe a native row as if the whole
       // window were usable as input, which is the claim the measurement disproved.
       ...(row.maxInputTokens !== undefined ? { maxInputTokens: row.maxInputTokens } : {}),
+      ...(row.autoCompactTokenLimit !== undefined
+        ? { autoCompactTokenLimit: row.autoCompactTokenLimit }
+        : {}),
     };
   });
   const customModels: ManagementModelRow[] = (config.customModels ?? []).map(cm => {

package/src/server/management/native-integration-routes.ts

@@ -17,7 +17,8 @@
  * Design of record: devlog/_fin/260803_integrations_toggle_all/030 (routes),
  * 011 (Claude Code), 012 (Grok).
  */
-import { loadConfig, readRuntimePort, saveConfigPreservingClaudeCode } from "../../config";
+import { loadConfig, saveConfigPreservingClaudeCode } from "../../config";
+import { readRuntimePort } from "../../config/process-state";
 import { desktopVisibleNativeSlugs, filterCatalogVisibleModels, nativeContextLimits, nativeOpenAiContextWindow, visibleNativeSlugs } from "../../codex/catalog";
 import { providerContextCap } from "../../providers/context-cap";
 import { OPENAI_CODEX_PROVIDER_ID } from "../../providers/openai-tiers";

package/src/server/management/oauth-account-routes.ts

@@ -136,7 +136,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
   // the provider's loopback callback server (inside this process) captures the redirect in the
   // background, then the credential is persisted. The GUI opens the URL and polls /api/oauth/status.
   if (url.pathname === "/api/oauth/login" && req.method === "POST") {
-    const body = await readManagementJsonBodyOr(req, {}) as { provider?: string; addAccount?: boolean; accountId?: string; reauth?: boolean };
+    const body = await readManagementJsonBodyOr(req, {}) as { provider?: string; addAccount?: boolean; accountId?: string; reauth?: boolean; openBrowser?: unknown };
     const provider = (body.provider ?? "").trim().toLowerCase();
     if (!isPublicOAuthProvider(provider)) return jsonResponse({ error: "unknown oauth provider" }, 400);
     const namespaceCollision = codexAccountNamespaceProviderCollisionError(config.codexAccountNamespaces, provider);
@@ -167,9 +167,15 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
           reconcileLiveStateStores();
         },
       });
-      if (authUrl && !deviceCode) {
-        // Open the browser server-side (the proxy runs on the user's machine) — the GUI's
-        // window.open is popup-blocked because it runs after an await, not a direct click.
+      // Open the browser server-side (the proxy runs on the user's machine) — the GUI's
+      // window.open is popup-blocked because it runs after an await, not a direct click.
+      //
+      // The operator can decline, which is the only way to finish a login in a
+      // browser profile other than the OS default, or on a different machine
+      // than the proxy. Declining changes nothing else: the URL is still
+      // returned below and every login surface renders it with a copy button.
+      const { shouldOpenBrowserForLogin } = await import("../../oauth/open-browser-choice");
+      if (authUrl && !deviceCode && shouldOpenBrowserForLogin(body.openBrowser, config)) {
         const { openUrl } = await import("../../lib/open-url");
         openUrl(authUrl);
       }

package/src/server/management/provider-capability-config.ts

@@ -1,4 +1,4 @@
-import { booleanRecordConfigError } from "../../config";
+import { booleanRecordConfigError } from "../../config/provider-validation";
 import type { OcxConfig } from "../../types";
 
 /**

package/src/server/management/provider-routes.ts

@@ -36,7 +36,7 @@ import { ProviderOutboundPolicyError, providerOutboundGet, providerOutboundPost,
 import { fetchCursorUsableModels } from "../../adapters/cursor/live-models";
 import { parseAntigravityAvailableModels } from "../../providers/antigravity-models";
 import { enrichProviderFromCatalog, listKeyLoginProviders } from "../../oauth/key-providers";
-import { deriveProviderPresets, enrichProviderFromRegistry } from "../../providers/derive";
+import { deriveProviderPresets, enrichProviderFromRegistry, providerConfigSeed } from "../../providers/derive";
 import { effectiveGoogleMode, providerCodexAccountMode, providerMatchesRegistryTransport } from "../../providers/registry";
 import {
   extractModelEnvelopeRows,
@@ -59,6 +59,7 @@ import {
   getProviderLiveModelCount,
 } from "../../codex/model-cache";
 import { DEFAULT_PROVIDER_CONTEXT_CAP, globalContextCapValue, providerContextCap, providerContextCaps, setAllProviderContextCaps, setGlobalContextCapValue, setProviderContextCap } from "../../providers/context-cap";
+import { modelAutoCompactTokenLimitsConfigError } from "../../providers/auto-compact-budget";
 import { resolveCodexHomeDir } from "../../codex/home";
 import { readUsageEntries } from "../../usage/log";
 import { getUsageDebugLogEntries } from "../../usage/debug";
@@ -271,6 +272,29 @@ function applyProviderPatchFields(
     }
     touched = true;
   }
+  if (Object.hasOwn(rawBody, "modelAutoCompactTokenLimits")) {
+    const value = rawBody.modelAutoCompactTokenLimits;
+    const error = modelAutoCompactTokenLimitsConfigError(value, {
+      allowTombstones: true,
+      requireNativeIds: name === "openai",
+    });
+    if (error) return { error };
+    if (value === null) {
+      delete next.modelAutoCompactTokenLimits;
+    } else {
+      const budgets: Record<string, number> = Object.assign(
+        Object.create(null) as Record<string, number>,
+        next.modelAutoCompactTokenLimits ?? {},
+      );
+      for (const [model, budget] of Object.entries(value as Record<string, number | null>)) {
+        if (budget === null) delete budgets[model];
+        else budgets[model] = budget;
+      }
+      if (Object.keys(budgets).length > 0) next.modelAutoCompactTokenLimits = budgets;
+      else delete next.modelAutoCompactTokenLimits;
+    }
+    touched = true;
+  }
   if (Object.hasOwn(rawBody, "modelSupportsServiceTier")) {
     const value = rawBody.modelSupportsServiceTier;
     if (value === null) {
@@ -374,6 +398,28 @@ function applyProviderPatchFields(
   return { next, touched, editorTouched, enablingOpenAi, headersTouched };
 }
 
+/** Validate the canonical OpenAI soft-budget overlay against a fresh registry seed. */
+function canonicalOpenAiBudgetPatchError(
+  provider: OcxProviderConfig,
+  rawBody: Record<string, unknown>,
+  keys: string[],
+  config: OcxConfig,
+): string | null {
+  if (!isCanonicalOpenAiForwardProvider(provider)) {
+    return "provider openai must be the canonical built-in provider";
+  }
+  const entry = getProviderRegistryEntry("openai");
+  if (!entry) return "provider openai registry seed is unavailable";
+  const seed = providerConfigSeed(entry);
+  if (provider.codexAccountMode !== undefined) seed.codexAccountMode = provider.codexAccountMode;
+  if (provider.modelAutoCompactTokenLimits !== undefined) {
+    seed.modelAutoCompactTokenLimits = { ...provider.modelAutoCompactTokenLimits };
+  }
+  const applied = applyProviderPatchFields("openai", seed, rawBody, keys, config);
+  if ("error" in applied) return applied.error;
+  return providerManagementConfigError("openai", applied.next);
+}
+
 export async function handleProviderRoutes(ctx: ManagementContext): Promise<Response | null> {
   const { req, url, config, deps, principal, convergeCodexCatalog, syncClaudeAgentDefsBestEffort } = ctx;
 
@@ -410,6 +456,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       models: p.models ?? [],
       contextWindow: p.contextWindow,
       modelContextWindows: p.modelContextWindows,
+      modelAutoCompactTokenLimits: p.modelAutoCompactTokenLimits,
       modelSupportsServiceTier: p.modelSupportsServiceTier,
       noStructuredOutputModels: p.noStructuredOutputModels,
       upstreamHttpVersion: p.upstreamHttpVersion,
@@ -541,6 +588,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     // call can never fire.
     const submittedContextWindow = Object.hasOwn(prov, "contextWindow");
     const submittedModelContextWindows = Object.hasOwn(prov, "modelContextWindows");
+    const submittedModelAutoCompactTokenLimits = Object.hasOwn(prov, "modelAutoCompactTokenLimits");
     const submittedRequestPacing = Object.hasOwn(prov, "requestPacing");
     enrichProviderFromCatalog(name, prov);
     const { saveConfigPreservingClaudeCode: save } = await import("../../config");
@@ -553,6 +601,12 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     // erase hand-edited per-model prices from Logs/Usage estimates.
     const existingCosts = config.providers[name]?.modelCosts;
     if (existingCosts && !prov.modelCosts) prov.modelCosts = existingCosts;
+    // And to the per-provider account-failover opt-out (#2568d). `ProviderPayload` has no
+    // member for it either, so an add/edit save structurally cannot carry it — and dropping it
+    // silently ENABLES rotation, because activation is presence-driven once the knob is gone.
+    // An overwrite must not spend a second subscription account's quota as a side effect.
+    const existingFailover = config.providers[name]?.oauthAccountFailover;
+    if (existingFailover && !prov.oauthAccountFailover) prov.oauthAccountFailover = existingFailover;
     // ...and to hand-edited context windows. `ProviderPayload` (gui/src/provider-payload.ts)
     // has no member for either field, so the add/edit form structurally cannot send them:
     // absence in the request means "not carried", never "the user deleted it". Deletion goes
@@ -573,6 +627,11 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
         ? { ...existing.modelContextWindows, ...(prov.modelContextWindows ?? {}) }
         : { ...existing.modelContextWindows };
     }
+    if (existing?.modelAutoCompactTokenLimits) {
+      prov.modelAutoCompactTokenLimits = submittedModelAutoCompactTokenLimits
+        ? { ...existing.modelAutoCompactTokenLimits, ...(prov.modelAutoCompactTokenLimits ?? {}) }
+        : { ...existing.modelAutoCompactTokenLimits };
+    }
     config.providers[name] = stripRegistryOnlyStaticHeaders(name, prov);
     if (body.setDefault === true) config.defaultProvider = name;
     save(config);
@@ -596,6 +655,9 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     const keys = Object.keys(rawBody);
     const hasMode = Object.hasOwn(rawBody, "codexAccountMode");
     const hasSetDefault = Object.hasOwn(rawBody, "setDefault");
+    const canonicalBudgetOnly = name === "openai"
+      && keys.length === 1
+      && keys[0] === "modelAutoCompactTokenLimits";
 
     // codexAccountMode keeps its dedicated side-effect path (quota cache clear, thread map
     // clear, pool prime) and is mutually exclusive with every other patch field.
@@ -658,12 +720,16 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
 
     const pacingOnly = keys.every(key => key === "requestPacing");
     if (applied.editorTouched && !pacingOnly) {
-      const providerError = providerManagementConfigError(name, next);
+      const providerError = canonicalBudgetOnly
+        ? canonicalOpenAiBudgetPatchError(next, rawBody, keys, config)
+        : providerManagementConfigError(name, next);
       if (providerError) return jsonResponse({ error: providerError }, 400);
-      const serviceTierError = providerServiceTierConfigError(name, next);
-      if (serviceTierError) return jsonResponse({ error: serviceTierError }, 400);
-      const resolvedError = await providerDestinationResolvedError(name, next);
-      if (resolvedError) return jsonResponse({ error: resolvedError }, 400);
+      if (!canonicalBudgetOnly) {
+        const serviceTierError = providerServiceTierConfigError(name, next);
+        if (serviceTierError) return jsonResponse({ error: serviceTierError }, 400);
+        const resolvedError = await providerDestinationResolvedError(name, next);
+        if (resolvedError) return jsonResponse({ error: resolvedError }, 400);
+      }
     } else if (applied.enablingOpenAi) {
       // Same DNS gate as POST: Clash fake-IP only. Never honor a persisted
       // allowPrivateNetwork on this path — it must not bypass the built-in guard.
@@ -687,15 +753,19 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
         return;
       }
       if (replay.editorTouched && !pacingOnly) {
-        const syncError = providerManagementConfigError(name, replay.next);
+        const syncError = canonicalBudgetOnly
+          ? canonicalOpenAiBudgetPatchError(replay.next, rawBody, keys, config)
+          : providerManagementConfigError(name, replay.next);
         if (syncError) {
           replayError = syncError;
           return;
         }
-        const serviceTierError = providerServiceTierConfigError(name, replay.next);
-        if (serviceTierError) {
-          replayError = serviceTierError;
-          return;
+        if (!canonicalBudgetOnly) {
+          const serviceTierError = providerServiceTierConfigError(name, replay.next);
+          if (serviceTierError) {
+            replayError = serviceTierError;
+            return;
+          }
         }
       } else if (replay.enablingOpenAi && !isCanonicalOpenAiForwardProvider(replay.next)) {
         replayError = "provider openai must be the canonical built-in provider";

package/src/server/management/route-registry.ts

@@ -0,0 +1,332 @@
+/**
+ * Declared inventory of every reachable management route.
+ *
+ * DECLARED, not harvested. A grep cannot see this surface: 18 routes are registered
+ * through a regex, an `endsWith`, a `pathname.slice`, a prefix decode, a path constant, or a
+ * negated `pathname !== "…"` guard, and two of those are live routes whose only textual
+ * trace is the negated form. For `GET /api/storage` an equality scan finds solely the dead
+ * shadowed copy in `logs-usage-routes.ts` and never the live one.
+ *
+ * This module is pure DATA and must stay that way. It is imported by
+ * `src/server/management-api.ts`, which `tests/core-lab-boundary.test.ts` protects: a user
+ * with one provider and no Lab must execute no Lab code. Route paths are strings, so
+ * declaring `/api/lab/status` here creates no module edge. Never import a handler, and
+ * never import anything from `src/lab/`. The `module` field names the owning file as text
+ * for exactly this reason.
+ *
+ * Reconciliation lives in `tests/management-route-registry.test.ts`, which resolves
+ * `(method, path)` pairs from source and fails loudly on a route whose method it cannot
+ * determine. Adding a route without declaring it here fails that test.
+ */
+
+export type HttpMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD";
+
+/**
+ * Why a route has no CLI verb. Every value is a claim about the route that a reviewer
+ * can check, not a way to quiet the parity test.
+ */
+export type ExemptionReason =
+  /** Requires a dashboard browser session. Includes the user-consent star boundary. */
+  | "session-only"
+  /** Deliberately returns 405; there is nothing to drive. */
+  | "disabled"
+  /** Gated on a process-scoped capability principal, not an operator action. */
+  | "capability-principal"
+  /** A test seam, not an operator capability. */
+  | "test-seam"
+  /** The CLI reaches the same data through a local transport instead of HTTP. */
+  | "local-transport"
+  /** Unreachable in the live dispatch order; delete rather than expose. */
+  | "dead"
+  /**
+   * A verb is owed but belongs to a later work-phase. BOUNDED: requires `owner` and
+   * `ownerDoc`, and the parity test asserts that tracked doc exists and names the route.
+   * The doc is deliberately a repository file rather than the goalplan, which is
+   * gitignored -- a test reading machine-local state passes here and finds nothing in CI.
+   */
+  | "deferred-verb";
+
+export interface RouteExemption {
+  readonly reason: ExemptionReason;
+  /** Free text; required, because an exemption nobody justified is how a gate erodes. */
+  readonly why: string;
+  /** Work-phase that owes the verb. Required for `deferred-verb`. */
+  readonly owner?: string;
+  /** Tracked doc naming the route. Required for `deferred-verb`. */
+  readonly ownerDoc?: string;
+}
+
+/** How a route is registered, for routes an equality scan cannot see. */
+export type NonLiteralMechanism =
+  | "negated-guard"
+  | "path-constant"
+  | "prefix-decode"
+  | "slice"
+  | "ends-with"
+  | "regex";
+
+export interface ManagementRoute {
+  readonly method: HttpMethod;
+  readonly path: string;
+  /** Owning source file, repo-relative without the `src/` prefix or `.ts` suffix. */
+  readonly module: string;
+  readonly mutates: boolean;
+  /** Set when the route is not recoverable from an equality scan of its own file. */
+  readonly mechanism?: NonLiteralMechanism;
+  readonly exempt?: RouteExemption;
+}
+
+
+/** Every reachable management route. */
+export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
+  // server/management-api
+  { method: "POST", path: "/api/stop", module: "server/management-api", mutates: true },
+  // codex/auth-api
+  { method: "DELETE", path: "/api/codex-auth/accounts", module: "codex/auth-api", mutates: true },
+  { method: "GET", path: "/api/codex-auth/accounts", module: "codex/auth-api", mutates: false },
+  { method: "GET", path: "/api/codex-auth/active", module: "codex/auth-api", mutates: false },
+  { method: "GET", path: "/api/codex-auth/login-status", module: "codex/auth-api", mutates: false },
+  { method: "GET", path: "/api/codex-auth/quota", module: "codex/auth-api", mutates: false },
+  { method: "GET", path: "/api/codex-auth/reset-credits", module: "codex/auth-api", mutates: false },
+  { method: "PATCH", path: "/api/codex-auth/pool-strategy", module: "codex/auth-api", mutates: true },
+  { method: "POST", path: "/api/codex-auth/accounts", module: "codex/auth-api", mutates: true },
+  { method: "POST", path: "/api/codex-auth/accounts/clear-cooldown", module: "codex/auth-api", mutates: true },
+  { method: "POST", path: "/api/codex-auth/login", module: "codex/auth-api", mutates: true },
+  { method: "POST", path: "/api/codex-auth/login/cancel", module: "codex/auth-api", mutates: true },
+  { method: "POST", path: "/api/codex-auth/login/code", module: "codex/auth-api", mutates: true },
+  { method: "POST", path: "/api/codex-auth/reset-credits/consume", module: "codex/auth-api", mutates: true },
+  { method: "PUT", path: "/api/codex-auth/accounts/alias", module: "codex/auth-api", mutates: true },
+  { method: "PUT", path: "/api/codex-auth/accounts/pause", module: "codex/auth-api", mutates: true },
+  { method: "PUT", path: "/api/codex-auth/accounts/pause-exhausted", module: "codex/auth-api", mutates: true },
+  { method: "PUT", path: "/api/codex-auth/accounts/priority", module: "codex/auth-api", mutates: true },
+  { method: "PUT", path: "/api/codex-auth/active", module: "codex/auth-api", mutates: true },
+  { method: "PUT", path: "/api/codex-auth/auto-switch", module: "codex/auth-api", mutates: true },
+  { method: "PUT", path: "/api/codex-auth/failover", module: "codex/auth-api", mutates: true },
+  { method: "PUT", path: "/api/codex-auth/pool-strategy", module: "codex/auth-api", mutates: true },
+  // codex/native-profile-api
+  { method: "GET", path: "/api/native-main-profiles", module: "codex/native-profile-api", mutates: false },
+  { method: "GET", path: "/api/native-main-profiles/doctor", module: "codex/native-profile-api", mutates: false },
+  { method: "POST", path: "/api/native-main-profiles/recover", module: "codex/native-profile-api", mutates: true },
+  { method: "POST", path: "/api/native-main-profiles/register", module: "codex/native-profile-api", mutates: true },
+  { method: "POST", path: "/api/native-main-profiles/stage", module: "codex/native-profile-api", mutates: true },
+  { method: "POST", path: "/api/native-main-profiles/stage/cancel", module: "codex/native-profile-api", mutates: true },
+  { method: "POST", path: "/api/native-main-profiles/stage/finish", module: "codex/native-profile-api", mutates: true },
+  { method: "POST", path: "/api/native-main-profiles/stage/heartbeat", module: "codex/native-profile-api", mutates: true },
+  { method: "POST", path: "/api/native-main-profiles/switch", module: "codex/native-profile-api", mutates: true },
+  // server/management/agent-settings-routes
+  { method: "GET", path: "/api/claude-code", module: "server/management/agent-settings-routes", mutates: false },
+  { method: "GET", path: "/api/claude-desktop", module: "server/management/agent-settings-routes", mutates: false },
+  { method: "GET", path: "/api/claude-desktop/status", module: "server/management/agent-settings-routes", mutates: false },
+  { method: "GET", path: "/api/codex-auth/features/default-mode-request-user-input", module: "server/management/agent-settings-routes", mutates: false },
+  { method: "GET", path: "/api/effort-caps", module: "server/management/agent-settings-routes", mutates: false },
+  { method: "GET", path: "/api/grok", module: "server/management/agent-settings-routes", mutates: false },
+  { method: "GET", path: "/api/injection-model", module: "server/management/agent-settings-routes", mutates: false },
+  { method: "GET", path: "/api/pi", module: "server/management/agent-settings-routes", mutates: false },
+  { method: "GET", path: "/api/pi/extensions", module: "server/management/agent-settings-routes", mutates: false },
+  { method: "GET", path: "/api/pi/packages", module: "server/management/agent-settings-routes", mutates: false },
+  { method: "GET", path: "/api/pi/settings", module: "server/management/agent-settings-routes", mutates: false },
+  { method: "GET", path: "/api/subagent-model-fallback", module: "server/management/agent-settings-routes", mutates: false },
+  { method: "GET", path: "/api/subagent-models", module: "server/management/agent-settings-routes", mutates: false },
+  { method: "GET", path: "/api/v2", module: "server/management/agent-settings-routes", mutates: false },
+  { method: "POST", path: "/api/claude-desktop/apply", module: "server/management/agent-settings-routes", mutates: true },
+  { method: "POST", path: "/api/grok/apply", module: "server/management/agent-settings-routes", mutates: true },
+  { method: "POST", path: "/api/pi/apply", module: "server/management/agent-settings-routes", mutates: true },
+  { method: "POST", path: "/api/pi/packages/install", module: "server/management/agent-settings-routes", mutates: true },
+  { method: "POST", path: "/api/pi/packages/remove", module: "server/management/agent-settings-routes", mutates: true },
+  { method: "POST", path: "/api/pi/remove", module: "server/management/agent-settings-routes", mutates: true },
+  { method: "PUT", path: "/api/claude-code", module: "server/management/agent-settings-routes", mutates: true },
+  { method: "PUT", path: "/api/claude-desktop", module: "server/management/agent-settings-routes", mutates: true },
+  { method: "PUT", path: "/api/codex-auth/features/default-mode-request-user-input", module: "server/management/agent-settings-routes", mutates: true },
+  { method: "PUT", path: "/api/effort-caps", module: "server/management/agent-settings-routes", mutates: true },
+  { method: "PUT", path: "/api/grok/selection", module: "server/management/agent-settings-routes", mutates: true },
+  { method: "PUT", path: "/api/injection-model", module: "server/management/agent-settings-routes", mutates: true },
+  { method: "PUT", path: "/api/pi/settings", module: "server/management/agent-settings-routes", mutates: true },
+  { method: "PUT", path: "/api/subagent-model-fallback", module: "server/management/agent-settings-routes", mutates: true },
+  { method: "PUT", path: "/api/subagent-models", module: "server/management/agent-settings-routes", mutates: true },
+  { method: "PUT", path: "/api/v2", module: "server/management/agent-settings-routes", mutates: true },
+  // server/management/clients-routes
+  { method: "GET", path: "/api/clients/status", module: "server/management/clients-routes", mutates: false },
+  // server/management/cloud-sync-routes
+  { method: "GET", path: "/api/cloud-sync/status", module: "server/management/cloud-sync-routes", mutates: false },
+  { method: "POST", path: "/api/cloud-sync/client-id", module: "server/management/cloud-sync-routes", mutates: true },
+  { method: "POST", path: "/api/cloud-sync/login/poll", module: "server/management/cloud-sync-routes", mutates: true },
+  { method: "POST", path: "/api/cloud-sync/login/start", module: "server/management/cloud-sync-routes", mutates: true },
+  { method: "POST", path: "/api/cloud-sync/logout", module: "server/management/cloud-sync-routes", mutates: true },
+  { method: "POST", path: "/api/cloud-sync/pull", module: "server/management/cloud-sync-routes", mutates: true },
+  { method: "POST", path: "/api/cloud-sync/push", module: "server/management/cloud-sync-routes", mutates: true },
+  // server/management/codex-prompt-routes
+  { method: "GET", path: "/api/codex-prompt", module: "server/management/codex-prompt-routes", mutates: false },
+  { method: "GET", path: "/api/codex-prompt/text", module: "server/management/codex-prompt-routes", mutates: false },
+  { method: "POST", path: "/api/codex-prompt/adopt", module: "server/management/codex-prompt-routes", mutates: true, exempt: { reason: "session-only", why: "Prompt adoption requires the gui-session principal (codex-prompt-routes.ts:298)." } },
+  { method: "POST", path: "/api/codex-prompt/repair", module: "server/management/codex-prompt-routes", mutates: true, exempt: { reason: "session-only", why: "Prompt repair requires the gui-session principal (codex-prompt-routes.ts:298)." } },
+  { method: "PUT", path: "/api/codex-prompt/base", module: "server/management/codex-prompt-routes", mutates: true, exempt: { reason: "session-only", why: "Base prompt write requires the gui-session principal (codex-prompt-routes.ts:298)." } },
+  { method: "PUT", path: "/api/codex-prompt/base/select", module: "server/management/codex-prompt-routes", mutates: true, exempt: { reason: "session-only", why: "Base prompt selection requires the gui-session principal (codex-prompt-routes.ts:298)." } },
+  { method: "PUT", path: "/api/codex-prompt/custom", module: "server/management/codex-prompt-routes", mutates: true, exempt: { reason: "session-only", why: "Custom prompt write requires the gui-session principal (codex-prompt-routes.ts:298)." } },
+  { method: "PUT", path: "/api/codex-prompt/toggle", module: "server/management/codex-prompt-routes", mutates: true, exempt: { reason: "session-only", why: "Prompt toggle requires the gui-session principal (codex-prompt-routes.ts:298)." } },
+  // server/management/combo-routes
+  { method: "DELETE", path: "/api/combos", module: "server/management/combo-routes", mutates: true },
+  { method: "GET", path: "/api/combos", module: "server/management/combo-routes", mutates: false },
+  { method: "PUT", path: "/api/combos", module: "server/management/combo-routes", mutates: true },
+  // server/management/config-routes
+  { method: "GET", path: "/api/config", module: "server/management/config-routes", mutates: false },
+  { method: "GET", path: "/api/diagnostics/project-config", module: "server/management/config-routes", mutates: false },
+  { method: "GET", path: "/api/settings", module: "server/management/config-routes", mutates: false },
+  { method: "GET", path: "/api/shadow-call-settings", module: "server/management/config-routes", mutates: false },
+  { method: "GET", path: "/api/sidecar-settings", module: "server/management/config-routes", mutates: false },
+  { method: "GET", path: "/api/startup-health", module: "server/management/config-routes", mutates: false },
+  { method: "GET", path: "/api/update/check", module: "server/management/config-routes", mutates: false },
+  { method: "GET", path: "/api/update/status", module: "server/management/config-routes", mutates: false },
+  { method: "GET", path: "/api/windows-tray", module: "server/management/config-routes", mutates: false },
+  { method: "POST", path: "/api/startup-action", module: "server/management/config-routes", mutates: true },
+  { method: "POST", path: "/api/sync", module: "server/management/config-routes", mutates: true },
+  { method: "POST", path: "/api/update/run", module: "server/management/config-routes", mutates: true },
+  { method: "POST", path: "/api/windows-tray", module: "server/management/config-routes", mutates: true },
+  { method: "PUT", path: "/api/config", module: "server/management/config-routes", mutates: true, exempt: { reason: "disabled", why: "Returns 405 by design; provider changes go through POST /api/providers." } },
+  { method: "PUT", path: "/api/settings", module: "server/management/config-routes", mutates: true },
+  { method: "PUT", path: "/api/shadow-call-settings", module: "server/management/config-routes", mutates: true },
+  { method: "PUT", path: "/api/sidecar-settings", module: "server/management/config-routes", mutates: true },
+  // server/management/integration-routes
+  { method: "GET", path: "/api/client-integrations", module: "server/management/integration-routes", mutates: false },
+  { method: "GET", path: "/api/client-integrations/journal", module: "server/management/integration-routes", mutates: false },
+  { method: "POST", path: "/api/client-integrations/restore", module: "server/management/integration-routes", mutates: true },
+  // server/management/lab-automation-routes
+  { method: "GET", path: "/api/lab/automation", module: "server/management/lab-automation-routes", mutates: false, exempt: { reason: "local-transport", why: "ocx lab reads the same rows from the local SQLite projection; src/cli/lab.ts imports ../lab/query directly and never fetches /api/lab." } },
+  { method: "GET", path: "/api/lab/automation/runs", module: "server/management/lab-automation-routes", mutates: false, exempt: { reason: "local-transport", why: "ocx lab reads the same rows from the local SQLite projection; src/cli/lab.ts imports ../lab/query directly and never fetches /api/lab." } },
+  { method: "POST", path: "/api/lab/automation/run", module: "server/management/lab-automation-routes", mutates: true, exempt: { reason: "deferred-verb", why: "Lab automation run has no CLI verb yet. A local SQLite read cannot drive it, so local-transport does not apply.", owner: "wp7", ownerDoc: "devlog/_plan/260828_ocx_agentic_control/060_phase_gui_parity.md" } },
+  { method: "PUT", path: "/api/lab/automation", module: "server/management/lab-automation-routes", mutates: true, exempt: { reason: "deferred-verb", why: "Lab automation config update has no CLI verb yet. A local SQLite read cannot drive it, so local-transport does not apply.", owner: "wp7", ownerDoc: "devlog/_plan/260828_ocx_agentic_control/060_phase_gui_parity.md" } },
+  // server/management/lab-routes
+  { method: "GET", path: "/api/lab/artifacts", module: "server/management/lab-routes", mutates: false, exempt: { reason: "local-transport", why: "ocx lab reads the same rows from the local SQLite projection; src/cli/lab.ts imports ../lab/query directly and never fetches /api/lab." } },
+  { method: "GET", path: "/api/lab/catalog", module: "server/management/lab-routes", mutates: false, exempt: { reason: "local-transport", why: "ocx lab reads the same rows from the local SQLite projection; src/cli/lab.ts imports ../lab/query directly and never fetches /api/lab." } },
+  { method: "GET", path: "/api/lab/events", module: "server/management/lab-routes", mutates: false, exempt: { reason: "local-transport", why: "ocx lab reads the same rows from the local SQLite projection; src/cli/lab.ts imports ../lab/query directly and never fetches /api/lab." } },
+  { method: "GET", path: "/api/lab/observations", module: "server/management/lab-routes", mutates: false, exempt: { reason: "local-transport", why: "ocx lab reads the same rows from the local SQLite projection; src/cli/lab.ts imports ../lab/query directly and never fetches /api/lab." } },
+  { method: "GET", path: "/api/lab/production-signals", module: "server/management/lab-routes", mutates: false, exempt: { reason: "local-transport", why: "ocx lab reads the same rows from the local SQLite projection; src/cli/lab.ts imports ../lab/query directly and never fetches /api/lab." } },
+  { method: "GET", path: "/api/lab/public/community", module: "server/management/lab-routes", mutates: false, exempt: { reason: "local-transport", why: "ocx lab reads the same rows from the local SQLite projection; src/cli/lab.ts imports ../lab/query directly and never fetches /api/lab." } },
+  { method: "GET", path: "/api/lab/status", module: "server/management/lab-routes", mutates: false, exempt: { reason: "local-transport", why: "ocx lab reads the same rows from the local SQLite projection; src/cli/lab.ts imports ../lab/query directly and never fetches /api/lab." } },
+  { method: "GET", path: "/api/lab/subjects", module: "server/management/lab-routes", mutates: false, exempt: { reason: "local-transport", why: "ocx lab reads the same rows from the local SQLite projection; src/cli/lab.ts imports ../lab/query directly and never fetches /api/lab." } },
+  { method: "GET", path: "/api/lab/verdicts", module: "server/management/lab-routes", mutates: false, exempt: { reason: "local-transport", why: "ocx lab reads the same rows from the local SQLite projection; src/cli/lab.ts imports ../lab/query directly and never fetches /api/lab." } },
+  { method: "POST", path: "/api/lab/public/community/import", module: "server/management/lab-routes", mutates: true, exempt: { reason: "deferred-verb", why: "Community evidence import has no CLI verb yet. A local SQLite read cannot drive it, so local-transport does not apply.", owner: "wp7", ownerDoc: "devlog/_plan/260828_ocx_agentic_control/060_phase_gui_parity.md" } },
+  { method: "POST", path: "/api/lab/public/export", module: "server/management/lab-routes", mutates: true, exempt: { reason: "deferred-verb", why: "Public evidence export has no CLI verb yet. A local SQLite read cannot drive it, so local-transport does not apply.", owner: "wp7", ownerDoc: "devlog/_plan/260828_ocx_agentic_control/060_phase_gui_parity.md" } },
+  { method: "POST", path: "/api/lab/public/preview", module: "server/management/lab-routes", mutates: true, exempt: { reason: "deferred-verb", why: "Public evidence preview has no CLI verb yet. A local SQLite read cannot drive it, so local-transport does not apply.", owner: "wp7", ownerDoc: "devlog/_plan/260828_ocx_agentic_control/060_phase_gui_parity.md" } },
+  { method: "POST", path: "/api/lab/public/verify", module: "server/management/lab-routes", mutates: true, exempt: { reason: "deferred-verb", why: "Public evidence verification has no CLI verb yet. A local SQLite read cannot drive it, so local-transport does not apply.", owner: "wp7", ownerDoc: "devlog/_plan/260828_ocx_agentic_control/060_phase_gui_parity.md" } },
+  // server/management/logs-usage-routes
+  { method: "GET", path: "/api/claude/inbound-debug", module: "server/management/logs-usage-routes", mutates: false },
+  { method: "GET", path: "/api/debug", module: "server/management/logs-usage-routes", mutates: false },
+  { method: "GET", path: "/api/debug/injection-logs", module: "server/management/logs-usage-routes", mutates: false },
+  { method: "GET", path: "/api/debug/logs", module: "server/management/logs-usage-routes", mutates: false },
+  { method: "GET", path: "/api/debug/usage-logs", module: "server/management/logs-usage-routes", mutates: false },
+  { method: "GET", path: "/api/logs", module: "server/management/logs-usage-routes", mutates: false },
+  { method: "GET", path: "/api/storage/cleanup-policy", module: "server/management/logs-usage-routes", mutates: false },
+  { method: "GET", path: "/api/storage/cleanup-policy/test-stream", module: "server/management/logs-usage-routes", mutates: false, exempt: { reason: "test-seam", why: "Opt-in streaming seam declared at src/storage/policy-job.ts:71." } },
+  { method: "GET", path: "/api/storage/trash", module: "server/management/logs-usage-routes", mutates: false },
+  { method: "GET", path: "/api/storage/trash/restore/test-stream", module: "server/management/logs-usage-routes", mutates: false, exempt: { reason: "test-seam", why: "Opt-in streaming seam declared at src/storage/restore-job.ts:34." } },
+  { method: "GET", path: "/api/usage", module: "server/management/logs-usage-routes", mutates: false },
+  { method: "POST", path: "/api/storage/cleanup", module: "server/management/logs-usage-routes", mutates: true },
+  { method: "POST", path: "/api/storage/cleanup-policy/run", module: "server/management/logs-usage-routes", mutates: true },
+  { method: "POST", path: "/api/storage/cleanup/preview", module: "server/management/logs-usage-routes", mutates: true },
+  { method: "POST", path: "/api/storage/trash/restore", module: "server/management/logs-usage-routes", mutates: true },
+  { method: "POST", path: "/api/usage/ingest", module: "server/management/logs-usage-routes", mutates: true },
+  { method: "PUT", path: "/api/debug", module: "server/management/logs-usage-routes", mutates: true },
+  { method: "PUT", path: "/api/storage/cleanup-policy", module: "server/management/logs-usage-routes", mutates: true },
+  // server/management/model-routes
+  { method: "GET", path: "/api/aliases", module: "server/management/model-routes", mutates: false },
+  { method: "GET", path: "/api/catalog", module: "server/management/model-routes", mutates: false },
+  { method: "GET", path: "/api/client-config", module: "server/management/model-routes", mutates: false },
+  { method: "GET", path: "/api/custom-models", module: "server/management/model-routes", mutates: false },
+  { method: "GET", path: "/api/model-discovery", module: "server/management/model-routes", mutates: false },
+  { method: "GET", path: "/api/model-presets", module: "server/management/model-routes", mutates: false },
+  { method: "GET", path: "/api/models", module: "server/management/model-routes", mutates: false },
+  { method: "GET", path: "/api/selected-models", module: "server/management/model-routes", mutates: false },
+  { method: "POST", path: "/api/custom-models", module: "server/management/model-routes", mutates: true },
+  { method: "POST", path: "/api/model-discovery/acknowledge", module: "server/management/model-routes", mutates: true },
+  { method: "PUT", path: "/api/default-aliases", module: "server/management/model-routes", mutates: true },
+  { method: "PUT", path: "/api/disabled-models", module: "server/management/model-routes", mutates: true },
+  { method: "PUT", path: "/api/model-discovery", module: "server/management/model-routes", mutates: true },
+  { method: "PUT", path: "/api/model-presets", module: "server/management/model-routes", mutates: true },
+  { method: "PUT", path: "/api/model-visibility", module: "server/management/model-routes", mutates: true },
+  { method: "PUT", path: "/api/selected-models", module: "server/management/model-routes", mutates: true },
+  // server/management/native-integration-routes
+  { method: "GET", path: "/api/native-integrations", module: "server/management/native-integration-routes", mutates: false },
+  { method: "PUT", path: "/api/native-integrations/claude", module: "server/management/native-integration-routes", mutates: true },
+  { method: "PUT", path: "/api/native-integrations/claude-desktop", module: "server/management/native-integration-routes", mutates: true },
+  { method: "PUT", path: "/api/native-integrations/codex", module: "server/management/native-integration-routes", mutates: true },
+  { method: "PUT", path: "/api/native-integrations/grok", module: "server/management/native-integration-routes", mutates: true },
+  // server/management/oauth-account-routes
+  { method: "DELETE", path: "/api/keys", module: "server/management/oauth-account-routes", mutates: true },
+  { method: "DELETE", path: "/api/oauth/accounts", module: "server/management/oauth-account-routes", mutates: true },
+  { method: "DELETE", path: "/api/providers/keys", module: "server/management/oauth-account-routes", mutates: true },
+  { method: "GET", path: "/api/key-providers", module: "server/management/oauth-account-routes", mutates: false },
+  { method: "GET", path: "/api/keys", module: "server/management/oauth-account-routes", mutates: false },
+  { method: "GET", path: "/api/oauth/accounts", module: "server/management/oauth-account-routes", mutates: false },
+  { method: "GET", path: "/api/oauth/accounts/pool", module: "server/management/oauth-account-routes", mutates: false },
+  { method: "GET", path: "/api/oauth/providers", module: "server/management/oauth-account-routes", mutates: false },
+  { method: "GET", path: "/api/oauth/status", module: "server/management/oauth-account-routes", mutates: false },
+  { method: "GET", path: "/api/providers/keys", module: "server/management/oauth-account-routes", mutates: false },
+  { method: "PATCH", path: "/api/keys", module: "server/management/oauth-account-routes", mutates: true },
+  { method: "PATCH", path: "/api/oauth/accounts/pool", module: "server/management/oauth-account-routes", mutates: true },
+  { method: "POST", path: "/api/keys", module: "server/management/oauth-account-routes", mutates: true },
+  { method: "POST", path: "/api/oauth/accounts/clear-cooldown", module: "server/management/oauth-account-routes", mutates: true },
+  { method: "POST", path: "/api/oauth/accounts/import", module: "server/management/oauth-account-routes", mutates: true },
+  { method: "POST", path: "/api/oauth/login", module: "server/management/oauth-account-routes", mutates: true },
+  { method: "POST", path: "/api/oauth/login/cancel", module: "server/management/oauth-account-routes", mutates: true },
+  { method: "POST", path: "/api/oauth/login/code", module: "server/management/oauth-account-routes", mutates: true },
+  { method: "POST", path: "/api/oauth/logout", module: "server/management/oauth-account-routes", mutates: true },
+  { method: "POST", path: "/api/providers/keys", module: "server/management/oauth-account-routes", mutates: true },
+  { method: "PUT", path: "/api/oauth/accounts/active", module: "server/management/oauth-account-routes", mutates: true },
+  { method: "PUT", path: "/api/oauth/accounts/alias", module: "server/management/oauth-account-routes", mutates: true },
+  { method: "PUT", path: "/api/oauth/accounts/pool", module: "server/management/oauth-account-routes", mutates: true },
+  { method: "PUT", path: "/api/providers/keys/active", module: "server/management/oauth-account-routes", mutates: true },
+  { method: "PUT", path: "/api/providers/keys/alias", module: "server/management/oauth-account-routes", mutates: true },
+  // server/management/provider-routes
+  { method: "DELETE", path: "/api/providers", module: "server/management/provider-routes", mutates: true },
+  { method: "GET", path: "/api/provider-context-caps", module: "server/management/provider-routes", mutates: false },
+  { method: "GET", path: "/api/provider-presets", module: "server/management/provider-routes", mutates: false },
+  { method: "GET", path: "/api/provider-quotas", module: "server/management/provider-routes", mutates: false },
+  { method: "GET", path: "/api/provider-request-pacing", module: "server/management/provider-routes", mutates: false },
+  { method: "GET", path: "/api/providers", module: "server/management/provider-routes", mutates: false },
+  { method: "PATCH", path: "/api/providers", module: "server/management/provider-routes", mutates: true },
+  { method: "POST", path: "/api/providers", module: "server/management/provider-routes", mutates: true },
+  { method: "POST", path: "/api/providers/refresh-models", module: "server/management/provider-routes", mutates: true },
+  { method: "POST", path: "/api/providers/test", module: "server/management/provider-routes", mutates: true },
+  { method: "PUT", path: "/api/provider-context-caps", module: "server/management/provider-routes", mutates: true },
+  // server/management/request-history-routes
+  { method: "GET", path: "/api/request-history", module: "server/management/request-history-routes", mutates: false },
+  // server/management/routing-analytics-routes
+  // server/management/routing-profile-routes
+  { method: "DELETE", path: "/api/routing-profiles", module: "server/management/routing-profile-routes", mutates: true },
+  { method: "GET", path: "/api/routing-profiles", module: "server/management/routing-profile-routes", mutates: false },
+  { method: "POST", path: "/api/routing-profiles/dry-run", module: "server/management/routing-profile-routes", mutates: true },
+  { method: "PUT", path: "/api/routing-profiles", module: "server/management/routing-profile-routes", mutates: true },
+  // server/management/sidebar-routes
+  { method: "GET", path: "/api/github/star", module: "server/management/sidebar-routes", mutates: false },
+  { method: "GET", path: "/api/update/badge", module: "server/management/sidebar-routes", mutates: false },
+  { method: "POST", path: "/api/github/star", module: "server/management/sidebar-routes", mutates: true, exempt: { reason: "session-only", why: "User-consent boundary in AGENTS_INSTALL.md: starring spends the user's identity. Must never gain a CLI verb." } },
+  // server/management/storage-log-guard-routes
+  { method: "GET", path: "/api/storage/codex-logs", module: "server/management/storage-log-guard-routes", mutates: false },
+  { method: "POST", path: "/api/storage/codex-logs/compact", module: "server/management/storage-log-guard-routes", mutates: true },
+  { method: "POST", path: "/api/storage/codex-logs/protect", module: "server/management/storage-log-guard-routes", mutates: true },
+  { method: "POST", path: "/api/storage/codex-logs/repair", module: "server/management/storage-log-guard-routes", mutates: true },
+  { method: "POST", path: "/api/storage/codex-logs/unprotect", module: "server/management/storage-log-guard-routes", mutates: true },
+  // server/management/system-routes
+  { method: "GET", path: "/api/system/memory", module: "server/management/system-routes", mutates: false },
+  { method: "GET", path: "/api/system/windows-replace-retries", module: "server/management/system-routes", mutates: false },
+  { method: "POST", path: "/api/system/restart", module: "server/management/system-routes", mutates: true },
+  // --- Routes an equality scan of their own file cannot see (18). ---
+  // Each carries `mechanism`; the reconciliation test counts these separately.
+  { method: "GET", path: "/api/storage", module: "server/management/storage-log-guard-routes", mutates: false, mechanism: "negated-guard" },
+  { method: "GET", path: "/api/routing-analytics", module: "server/management/routing-analytics-routes", mutates: false, mechanism: "negated-guard" },
+  { method: "GET", path: "/api/system/codex-app-server", module: "server/management/system-routes", mutates: false, mechanism: "path-constant" },
+  { method: "POST", path: "/api/system/codex-restart", module: "server/management/system-routes", mutates: true, mechanism: "path-constant" },
+  { method: "POST", path: "/api/providers/reload", module: "server/management/provider-routes", mutates: true, mechanism: "path-constant", exempt: { reason: "capability-principal", why: "Gated on the local-provider-reload-capability principal (provider-routes.ts:467), not an operator action." } },
+  { method: "GET", path: "/api/client-integrations/{clientId}", module: "server/management/integration-routes", mutates: false, mechanism: "prefix-decode" },
+  { method: "PUT", path: "/api/client-integrations/{clientId}", module: "server/management/integration-routes", mutates: true, mechanism: "prefix-decode" },
+  { method: "GET", path: "/api/request-history/{id}", module: "server/management/request-history-routes", mutates: false, mechanism: "slice" },
+  { method: "GET", path: "/api/request-history/{id}/route-decision", module: "server/management/request-history-routes", mutates: false, mechanism: "ends-with" },
+  { method: "PUT", path: "/api/providers/{provider}/alias", module: "server/management/model-routes", mutates: true, mechanism: "regex" },
+  { method: "PUT", path: "/api/providers/{provider}/model-aliases", module: "server/management/model-routes", mutates: true, mechanism: "regex" },
+  { method: "PUT", path: "/api/custom-models/{id}", module: "server/management/model-routes", mutates: true, mechanism: "regex" },
+  { method: "DELETE", path: "/api/custom-models/{id}", module: "server/management/model-routes", mutates: true, mechanism: "regex" },
+  { method: "GET", path: "/api/lab/subjects/{id}", module: "server/management/lab-routes", mutates: false, mechanism: "regex", exempt: { reason: "local-transport", why: "ocx lab reads the same rows from the local SQLite projection; src/cli/lab.ts imports ../lab/query directly and never fetches /api/lab." } },
+  { method: "GET", path: "/api/lab/events/{id}", module: "server/management/lab-routes", mutates: false, mechanism: "regex", exempt: { reason: "local-transport", why: "ocx lab reads the same rows from the local SQLite projection; src/cli/lab.ts imports ../lab/query directly and never fetches /api/lab." } },
+  { method: "GET", path: "/api/lab/artifacts/{digest}", module: "server/management/lab-routes", mutates: false, mechanism: "regex", exempt: { reason: "local-transport", why: "ocx lab reads the same rows from the local SQLite projection; src/cli/lab.ts imports ../lab/query directly and never fetches /api/lab." } },
+  { method: "POST", path: "/api/lab/automation/runs/{id}/cancel", module: "server/management/lab-automation-routes", mutates: true, mechanism: "regex", exempt: { reason: "deferred-verb", why: "Lab automation run cancellation has no CLI verb yet. A local SQLite read cannot drive it, so local-transport does not apply.", owner: "wp7", ownerDoc: "devlog/_plan/260828_ocx_agentic_control/060_phase_gui_parity.md" } },
+];