@yansigit/opencodex 2.36.1-dev.20260829.47 → 2.36.1-dev.20260829.48

package/src/server/management/oauth-account-routes.ts

@@ -64,10 +64,11 @@ import { AUTH_MATRIX, isAllowedRequestOrigin, jsonResponse, providerManagementCo
 import { applySystemEnvToggle } from "../system-env";
 import { buildApiAccessEndpoints } from "./api-access";
 import { isAzureIdentityProvider } from "../../config/provider-validation";
+import { apiKeyPoolEntryId } from "../../providers/api-keys";
 
 import { isPlainRecord, parseDebugLogQuery, tokPerSecondResult, unavailableCostReason, costResult, requestLogDto, stripRegistryOnlyStaticHeaders, fetchAllModels } from "./shared";
 import type { MetricUnavailableReason, TokPerSecondResult, CostEstimateReason, CostResult, MetricSource } from "./shared";
-import { saveManagementConfig, type ManagementContext } from "./context";
+import { mutateManagementConfig, saveManagementConfig, type ManagementContext } from "./context";
 import { readManagementJsonBody, readManagementJsonBodyOr, rethrowManagementBodyTooLarge } from "./body";
 import { codexAccountNamespaceProviderCollisionError } from "../../codex/account-namespace-match";
 import { ACCOUNT_IMPORT_DEADLINE_MS, ACCOUNT_IMPORT_MAX_REQUEST_BYTES } from "../../oauth/account-import";
@@ -95,6 +96,44 @@ async function readJsonBody(req: Request): Promise<Record<string, unknown> | nul
   }
 }
 
+function providerKeyPool(provider: OcxProviderConfig): NonNullable<OcxProviderConfig["apiKeyPool"]> {
+  const pool = provider.apiKeyPool ??= [];
+  if (pool.length === 0 && provider.apiKey) {
+    pool.push({ id: apiKeyPoolEntryId(provider.apiKey), key: provider.apiKey });
+  }
+  return pool;
+}
+
+function providerUsesKeyAuth(provider: OcxProviderConfig): boolean {
+  return !isAzureIdentityProvider(provider) && provider.authMode !== "oauth" && provider.authMode !== "forward";
+}
+
+function mutateProviderKey<T>(
+  deps: ManagementContext["deps"],
+  config: OcxConfig,
+  name: string,
+  mutate: (provider: OcxProviderConfig) => T | null,
+): { ok: true; value: T } | { ok: false; error: string; status: number } {
+  const outcome = mutateManagementConfig(deps, fresh => {
+    const provider = fresh.providers[name];
+    if (!provider || !providerUsesKeyAuth(provider)) {
+      return { changed: false, value: null };
+    }
+    const before = JSON.stringify(provider);
+    const value = mutate(provider);
+    return {
+      changed: value !== null && JSON.stringify(provider) !== before,
+      value: value === null ? null : { provider: structuredClone(provider), value },
+    };
+  });
+  if (outcome.status === "unavailable") {
+    return { ok: false, error: outcome.reason === "conflict" ? "config changed; retry" : `config is ${outcome.reason}`, status: outcome.reason === "conflict" ? 409 : 500 };
+  }
+  if (outcome.value === null) return { ok: false, error: "key not found", status: 404 };
+  config.providers[name] = outcome.value.provider;
+  return { ok: true, value: outcome.value.value };
+}
+
 /**
  * The single place key-name rules live. The config read schema is deliberately
  * permissive so an existing config can never become unloadable; this is the write
@@ -560,27 +599,48 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     const body = await readManagementJsonBodyOr(req, {}) as { name?: string; key?: string; label?: string };
     const name = (body.name ?? "").trim();
     if (!name || !isValidProviderName(name) || !hasOwnProvider(config.providers, name)) return jsonResponse({ error: "unknown provider" }, 404);
-    if (isAzureIdentityProvider(config.providers[name]!)) return jsonResponse({ error: "provider does not use API-key auth" }, 400);
+    if (!providerUsesKeyAuth(config.providers[name]!)) return jsonResponse({ error: "provider does not use API-key auth" }, 400);
     if (typeof body.key !== "string" || !body.key.trim()) return jsonResponse({ error: "key is required" }, 400);
-    const { addProviderApiKey } = await import("../../providers/api-keys");
-    const result = addProviderApiKey(config, name, body.key, body.label);
-    if ("error" in result) return jsonResponse({ error: result.error }, 400);
+    const key = body.key.trim();
+    if (/[\r\n]/.test(key)) return jsonResponse({ error: "key must not include line breaks" }, 400);
+    const result = mutateProviderKey(deps, config, name, provider => {
+      const pool = providerKeyPool(provider);
+      const label = body.label?.trim();
+      const existing = pool.find(entry => entry.key === key);
+      if (existing) {
+        if (label) existing.label = label;
+        provider.apiKey = existing.key;
+        return { id: existing.id };
+      }
+      const id = apiKeyPoolEntryId(key);
+      if (pool.some(entry => entry.id === id)) return { error: "API-key pool ID collision" };
+      pool.push({ id, key, ...(label ? { label } : {}), addedAt: Date.now() });
+      provider.apiKey = key;
+      return { id };
+    });
+    if (!result.ok) return jsonResponse({ error: result.error }, result.status);
+    if ("error" in result.value) return jsonResponse({ error: result.value.error }, 409);
     const { clearModelCache } = await import("../../codex/model-cache");
     clearModelCache(name);
     const { clearProviderQuotaCache } = await import("../../providers/quota");
     clearProviderQuotaCache();
     const { clearKeyCooldowns } = await import("../../providers/key-failover");
     clearKeyCooldowns(name); // manual key management resets 429 cooldown state
-    return jsonResponse({ ok: true, id: result.id }, 201);
+    return jsonResponse({ ok: true, id: result.value.id }, 201);
   }
   if (url.pathname === "/api/providers/keys/active" && req.method === "PUT") {
     const body = await readManagementJsonBodyOr(req, {}) as { name?: string; id?: string };
     const name = (body.name ?? "").trim();
     if (!name || !isValidProviderName(name) || !hasOwnProvider(config.providers, name)) return jsonResponse({ error: "unknown provider" }, 404);
-    if (isAzureIdentityProvider(config.providers[name]!)) return jsonResponse({ error: "provider does not use API-key auth" }, 400);
+    if (!providerUsesKeyAuth(config.providers[name]!)) return jsonResponse({ error: "provider does not use API-key auth" }, 400);
     if (!body.id) return jsonResponse({ error: "missing id" }, 400);
-    const { setActiveProviderApiKey } = await import("../../providers/api-keys");
-    if (!setActiveProviderApiKey(config, name, body.id)) return jsonResponse({ error: "key not found" }, 404);
+    const result = mutateProviderKey(deps, config, name, provider => {
+      const entry = providerKeyPool(provider).find(candidate => candidate.id === body.id);
+      if (!entry) return null;
+      provider.apiKey = entry.key;
+      return true;
+    });
+    if (!result.ok) return jsonResponse({ error: result.error }, result.status);
     const { clearModelCache } = await import("../../codex/model-cache");
     clearModelCache(name);
     const { clearProviderQuotaCache } = await import("../../providers/quota");
@@ -595,23 +655,41 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     const id = typeof body.id === "string" ? body.id.trim() : "";
     const alias = typeof body.alias === "string" ? body.alias.trim() : "";
     if (!name || !isValidProviderName(name) || !hasOwnProvider(config.providers, name)) return jsonResponse({ error: "unknown provider" }, 404);
-    if (isAzureIdentityProvider(config.providers[name]!)) return jsonResponse({ error: "provider does not use API-key auth" }, 400);
+    if (!providerUsesKeyAuth(config.providers[name]!)) return jsonResponse({ error: "provider does not use API-key auth" }, 400);
     if (!id) return jsonResponse({ error: "missing id" }, 400);
     if (typeof body.alias !== "string" || alias.length > 80 || /[\x00-\x1f\x7f]/.test(alias)) {
       return jsonResponse({ error: "alias must be at most 80 printable characters" }, 400);
     }
-    const { setProviderApiKeyLabel } = await import("../../providers/api-keys");
-    if (!setProviderApiKeyLabel(config, name, id, alias || undefined)) return jsonResponse({ error: "key not found" }, 404);
+    const result = mutateProviderKey(deps, config, name, provider => {
+      const entry = providerKeyPool(provider).find(candidate => candidate.id === id);
+      if (!entry) return null;
+      if (alias) entry.label = alias;
+      else delete entry.label;
+      return true;
+    });
+    if (!result.ok) return jsonResponse({ error: result.error }, result.status);
     return jsonResponse({ ok: true, name, id, alias: alias || null });
   }
   if (url.pathname === "/api/providers/keys" && req.method === "DELETE") {
     const name = (url.searchParams.get("name") ?? "").trim();
     const id = url.searchParams.get("id") ?? "";
     if (!name || !isValidProviderName(name) || !hasOwnProvider(config.providers, name)) return jsonResponse({ error: "unknown provider" }, 404);
-    if (isAzureIdentityProvider(config.providers[name]!)) return jsonResponse({ error: "provider does not use API-key auth" }, 400);
+    if (!providerUsesKeyAuth(config.providers[name]!)) return jsonResponse({ error: "provider does not use API-key auth" }, 400);
     if (!id) return jsonResponse({ error: "missing id" }, 400);
-    const { removeProviderApiKey } = await import("../../providers/api-keys");
-    if (!removeProviderApiKey(config, name, id)) return jsonResponse({ error: "key not found" }, 404);
+    const result = mutateProviderKey(deps, config, name, provider => {
+      const pool = providerKeyPool(provider);
+      const entry = pool.find(candidate => candidate.id === id);
+      if (!entry) return null;
+      provider.apiKeyPool = pool.filter(candidate => candidate.id !== id);
+      if (provider.apiKey === entry.key) {
+        const next = provider.apiKeyPool[0];
+        if (next) provider.apiKey = next.key;
+        else delete provider.apiKey;
+      }
+      if (provider.apiKeyPool.length === 0) delete provider.apiKeyPool;
+      return true;
+    });
+    if (!result.ok) return jsonResponse({ error: result.error }, result.status);
     const { clearModelCache } = await import("../../codex/model-cache");
     clearModelCache(name);
     const { clearProviderQuotaCache } = await import("../../providers/quota");

package/src/server/management/provider-routes.ts

@@ -29,6 +29,7 @@ import {
   upsertOAuthProvider,
 } from "../../oauth";
 import { replaceProviderAccountSet } from "../../oauth/store";
+import { comboPublicModelId } from "../../combos/types";
 import { providerDestinationResolvedError } from "../../lib/destination-policy";
 import {
   antigravityOAuthDestinationConfigError,
@@ -51,6 +52,7 @@ import {
 import { routedSlug, slugEquals } from "../../providers/slug-codec";
 import { clearAccountQuotaCache, clearProviderQuotaCache, fetchProviderQuotaReports } from "../../providers/quota";
 import { clearKeyCooldowns } from "../../providers/key-failover";
+import { apiKeyPoolEntryId } from "../../providers/api-keys";
 import { providerRequestPacingStatus } from "../../providers/request-pacing";
 import { CODEX_FORWARD_BASE_URL, isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
 import { codexAccountNamespaceProviderCollisionError } from "../../codex/account-namespace-match";
@@ -65,6 +67,7 @@ import { getUsageDebugLogEntries } from "../../usage/debug";
 import { parseRange, parseUsageSurface, summarizeUsage } from "../../usage/summary";
 import { stripCodexRuntimeProviderFields } from "../../codex/auth-context";
 import { getProviderRegistryEntry } from "../../providers/registry";
+import { dropProviderCustomModels } from "../../providers/provider-id-rewrite";
 import { getDebugLogEntries } from "../../lib/debug-log-buffer";
 import { getInjectionDebugLogEntries } from "../../lib/injection-debug-log";
 import {
@@ -94,7 +97,7 @@ import {
 
 import { isPlainRecord, parseDebugLogQuery, tokPerSecondResult, unavailableCostReason, costResult, requestLogDto, stripRegistryOnlyStaticHeaders, fetchAllModels } from "./shared";
 import type { MetricUnavailableReason, TokPerSecondResult, CostEstimateReason, CostResult, MetricSource } from "./shared";
-import { saveManagementConfig, type ManagementContext } from "./context";
+import { mutateManagementConfig, saveManagementConfig, type ManagementContext } from "./context";
 import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
 import { resolveAiStudioCredentials } from "../../oauth/aistudio-credentials";
 import { buildAiStudioHeaders, parseGoogleCookieJar } from "../../oauth/google-aistudio-auth";
@@ -110,6 +113,93 @@ type ProviderPatchApplication =
       headersTouched: boolean;
     };
 
+type ProviderMutationValue =
+  | { config: OcxConfig; fallbackDefault?: string; droppedCustomModels?: number }
+  | {
+      error: string;
+      code?: string;
+      status?: number;
+      combos?: string[];
+      routingProfiles?: string[];
+    };
+
+function reconcileSubmittedApiKey(provider: OcxProviderConfig): string | undefined {
+  if (!provider.apiKey || !provider.apiKeyPool) return;
+  const key = provider.apiKey.trim();
+  if (!key || /[\r\n]/.test(key)) return;
+  if (provider.apiKeyPool.some(entry => entry.key === key)) {
+    provider.apiKey = key;
+    return;
+  }
+  const id = apiKeyPoolEntryId(key);
+  if (provider.apiKeyPool.some(entry => entry.id === id)) return "API-key pool ID collision";
+  provider.apiKeyPool.push({ id, key, addedAt: Date.now() });
+  provider.apiKey = key;
+}
+
+function providerDependencies(config: OcxConfig, name: string): {
+  combos: string[];
+  routingProfiles: string[];
+} {
+  return {
+    combos: Object.entries(config.combos ?? {})
+      .filter(([, combo]) => combo.targets.some(target => target.provider === name))
+      .map(([id]) => id)
+      .sort((a, b) => a.localeCompare(b)),
+    routingProfiles: Object.entries(config.routingProfiles ?? {})
+      .filter(([, profile]) => profile.candidates.some(candidate => candidate.provider === name))
+      .map(([id]) => id)
+      .sort((a, b) => a.localeCompare(b)),
+  };
+}
+
+function providerDependencyError(config: OcxConfig, name: string): Extract<ProviderMutationValue, { error: string }> | null {
+  const dependencies = providerDependencies(config, name);
+  if (dependencies.routingProfiles.length > 0) return {
+    error: `cannot delete provider "${name}" while routing profiles depend on it`,
+    code: "provider_has_dependent_routing_profiles",
+    routingProfiles: dependencies.routingProfiles,
+  };
+  if (dependencies.combos.length > 0) return {
+    error: `cannot delete provider "${name}" while combos depend on it`,
+    code: "provider_has_dependent_combos",
+    combos: dependencies.combos,
+  };
+  return null;
+}
+
+function providerNamespaceCollisionError(config: OcxConfig, name: string): string | undefined {
+  const accountCollision = codexAccountNamespaceProviderCollisionError(config.codexAccountNamespaces, name);
+  if (accountCollision) return accountCollision;
+  const comboCollision = (name === "combo" && Object.keys(config.combos ?? {}).length > 0)
+    || Object.entries(config.combos ?? {}).some(([id, combo]) => {
+      const publicId = comboPublicModelId(id, combo);
+      return id === name || publicId === name || publicId.startsWith(`${name}/`);
+    });
+  if (comboCollision) {
+    return "provider name must not collide with a configured combo namespace";
+  }
+  const profileCollision = Object.values(config.routingProfiles ?? {}).some(profile => {
+    const alias = profile.alias?.trim();
+    return alias === name || alias?.startsWith(`${name}/`);
+  });
+  return profileCollision
+    ? "provider name must not collide with a configured routing profile namespace"
+    : undefined;
+}
+
+function adoptCommittedConfig(target: OcxConfig, source: OcxConfig): void {
+  for (const key of Object.keys(target)) delete (target as unknown as Record<string, unknown>)[key];
+  Object.assign(target, structuredClone(source));
+}
+
+function unavailableMutationResponse(reason: "missing" | "invalid" | "conflict", req: Request, config: OcxConfig): Response {
+  const message = reason === "conflict"
+    ? "config changed while applying this update; retry"
+    : `config is ${reason}`;
+  return jsonResponse({ error: message }, reason === "conflict" ? 409 : 500, req, config);
+}
+
 const AI_STUDIO_REAUTH_ERROR = "Session expired or missing — re-authentication required";
 const AI_STUDIO_PROBE_TIMEOUT_MS = 8_000;
 const AI_STUDIO_PROBE_MODEL = "gemini-2.5-flash";
@@ -714,7 +804,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     if (!isValidProviderName(name)) {
       return jsonResponse({ error: "provider name must use letters, numbers, dot, underscore, or hyphen and cannot be a reserved object key" }, 400);
     }
-    const namespaceCollision = codexAccountNamespaceProviderCollisionError(config.codexAccountNamespaces, name);
+    const namespaceCollision = providerNamespaceCollisionError(config, name);
     if (namespaceCollision) {
       return jsonResponse({ error: namespaceCollision }, 409);
     }
@@ -731,65 +821,56 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     if (body.setDefault === true && prov.disabled) {
       return jsonResponse({ error: "cannot set a disabled provider as default", code: "default_provider_disabled" }, 400);
     }
-    // Catalog providers (e.g. ollama-cloud) carry a models + vision/reasoning classification the GUI
-    // doesn't send — merge it in so the sidecars are gated correctly.
-    // Sample request ownership BEFORE enrichment. Enrichment fills absent fields from the
-    // registry seed, after which "the client omitted this" and "the registry supplied it" are
-    // indistinguishable — so a carry-over guard written as `prov.x === undefined` after this
-    // call can never fire.
     const submittedContextWindow = Object.hasOwn(prov, "contextWindow");
     const submittedModelContextWindows = Object.hasOwn(prov, "modelContextWindows");
     const submittedModelAutoCompactTokenLimits = Object.hasOwn(prov, "modelAutoCompactTokenLimits");
     const submittedRequestPacing = Object.hasOwn(prov, "requestPacing");
-    enrichProviderFromCatalog(name, prov);
-    // Overwriting an existing provider must not drop its multi-key pool: carry it over, then
-    // let the (possibly new) apiKey join the pool as the active entry.
-    const existingPool = config.providers[name]?.apiKeyPool;
-    if (existingPool && !prov.apiKeyPool && !prov.azureCredential) prov.apiKeyPool = existingPool;
-    // The same rule applies to user-configured price overlays: the dashboard's
-    // add/edit form does not send modelCosts, so an overwrite must not silently
-    // erase hand-edited per-model prices from Logs/Usage estimates.
-    const existingCosts = config.providers[name]?.modelCosts;
-    if (existingCosts && !prov.modelCosts) prov.modelCosts = existingCosts;
-    // And to the per-provider account-failover opt-out (#2568d). `ProviderPayload` has no
-    // member for it either, so an add/edit save structurally cannot carry it — and dropping it
-    // silently ENABLES rotation, because activation is presence-driven once the knob is gone.
-    // An overwrite must not spend a second subscription account's quota as a side effect.
-    const existingFailover = config.providers[name]?.oauthAccountFailover;
-    if (existingFailover && !prov.oauthAccountFailover) prov.oauthAccountFailover = existingFailover;
-    // ...and to hand-edited context windows. `ProviderPayload` (gui/src/provider-payload.ts)
-    // has no member for either field, so the add/edit form structurally cannot send them:
-    // absence in the request means "not carried", never "the user deleted it". Deletion goes
-    // through PATCH with an explicit null (#1409).
-    const existing = config.providers[name];
-    if (!submittedRequestPacing && existing?.requestPacing) {
-      prov.requestPacing = structuredClone(existing.requestPacing);
-    }
-    if (!submittedContextWindow && existing?.contextWindow !== undefined) {
-      prov.contextWindow = existing.contextWindow;
-    }
-    if (existing?.modelContextWindows) {
-      // When the client did send a map, its keys win and the user's other keys survive. When
-      // it did not, the stored value is the user's map alone: merging the registry seed in
-      // would persist seed keys into user config as a side effect of an unrelated save, and
-      // router.ts already fills registry values beneath user entries at resolve time.
-      prov.modelContextWindows = submittedModelContextWindows
-        ? { ...existing.modelContextWindows, ...(prov.modelContextWindows ?? {}) }
-        : { ...existing.modelContextWindows };
-    }
-    if (existing?.modelAutoCompactTokenLimits) {
-      prov.modelAutoCompactTokenLimits = submittedModelAutoCompactTokenLimits
-        ? { ...existing.modelAutoCompactTokenLimits, ...(prov.modelAutoCompactTokenLimits ?? {}) }
-        : { ...existing.modelAutoCompactTokenLimits };
-    }
-    config.providers[name] = stripRegistryOnlyStaticHeaders(name, prov);
-    if (body.setDefault === true) config.defaultProvider = name;
-    saveManagementConfig(deps, config);
+    const buildProvider = (existing: OcxProviderConfig | undefined): OcxProviderConfig => {
+      const next = structuredClone(prov);
+      // Native OpenAI capabilities are registry-owned runtime defaults. Enriching this exact
+      // canonical row adds supportsServiceTier to the document, which no longer equals the
+      // immutable forward seed and is correctly rejected by the write validator.
+      if (name !== "openai") enrichProviderFromCatalog(name, next);
+      const existingPool = existing?.apiKeyPool;
+      if (existingPool && !next.apiKeyPool && !next.azureCredential) next.apiKeyPool = existingPool;
+      if (typeof next.apiKey === "string" && !next.apiKey.trim()) delete next.apiKey;
+      if (!next.apiKey && existing?.apiKey && !next.azureCredential
+        && next.authMode !== "oauth" && next.authMode !== "forward") next.apiKey = existing.apiKey;
+      const existingCosts = existing?.modelCosts;
+      if (existingCosts && !next.modelCosts) next.modelCosts = existingCosts;
+      const existingFailover = existing?.oauthAccountFailover;
+      if (existingFailover && !next.oauthAccountFailover) next.oauthAccountFailover = existingFailover;
+      if (!submittedRequestPacing && existing?.requestPacing) next.requestPacing = structuredClone(existing.requestPacing);
+      if (!submittedContextWindow && existing?.contextWindow !== undefined) next.contextWindow = existing.contextWindow;
+      if (existing?.modelContextWindows) {
+        next.modelContextWindows = submittedModelContextWindows
+          ? { ...existing.modelContextWindows, ...(next.modelContextWindows ?? {}) }
+          : { ...existing.modelContextWindows };
+      }
+      if (existing?.modelAutoCompactTokenLimits) {
+        next.modelAutoCompactTokenLimits = submittedModelAutoCompactTokenLimits
+          ? { ...existing.modelAutoCompactTokenLimits, ...(next.modelAutoCompactTokenLimits ?? {}) }
+          : { ...existing.modelAutoCompactTokenLimits };
+      }
+      return stripRegistryOnlyStaticHeaders(name, next);
+    };
+    const outcome = mutateManagementConfig<ProviderMutationValue>(deps, fresh => {
+      const namespaceCollision = providerNamespaceCollisionError(fresh, name);
+      if (namespaceCollision) return { changed: false, value: { error: namespaceCollision, status: 409 } };
+      const next = buildProvider(fresh.providers[name]);
+      const keyCollision = reconcileSubmittedApiKey(next);
+      if (keyCollision) return { changed: false, value: { error: keyCollision, status: 409 } };
+      const providerError = providerManagementConfigError(name, next)
+        ?? providerServiceTierConfigError(name, next);
+      if (providerError) return { changed: false, value: { error: providerError, status: 400 } };
+      fresh.providers[name] = next;
+      if (body.setDefault === true) fresh.defaultProvider = name;
+      return { changed: true, value: { config: structuredClone(fresh) } };
+    });
+    if (outcome.status === "unavailable") return unavailableMutationResponse(outcome.reason, req, config);
+    if ("error" in outcome.value) return jsonResponse({ error: outcome.value.error }, outcome.value.status, req, config);
+    adoptCommittedConfig(config, outcome.value.config);
     reconcileLiveStateStores();
-    if (prov.apiKey && prov.apiKeyPool) {
-      const { addProviderApiKey } = await import("../../providers/api-keys");
-      addProviderApiKey(config, name, prov.apiKey);
-    }
     const { clearModelCache } = await import("../../codex/model-cache");
     clearModelCache(name);
     const catalogRefresh = await convergeCodexCatalog();
@@ -824,8 +905,17 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       if (!provider || !isCanonicalOpenAiForwardProvider(provider)) {
         return jsonResponse({ error: "provider openai must be the canonical built-in provider" }, 400);
       }
-      config.providers.openai = { ...provider, codexAccountMode: mode };
-      saveManagementConfig(deps, config);
+      const outcome = mutateManagementConfig<ProviderMutationValue>(deps, fresh => {
+        const provider = fresh.providers.openai;
+        if (!provider || !isCanonicalOpenAiForwardProvider(provider)) {
+          return { changed: false, value: { error: "provider openai must be the canonical built-in provider" } };
+        }
+        fresh.providers.openai = { ...provider, codexAccountMode: mode };
+        return { changed: true, value: { config: structuredClone(fresh) } };
+      });
+      if (outcome.status === "unavailable") return unavailableMutationResponse(outcome.reason, req, config);
+      if ("error" in outcome.value) return jsonResponse({ error: outcome.value.error }, 409);
+      adoptCommittedConfig(config, outcome.value.config);
       reconcileLiveStateStores();
       (deps.clearProviderQuotaCache ?? clearProviderQuotaCache)();
       (deps.clearThreadAccountMap ?? clearThreadAccountMap)();
@@ -850,8 +940,17 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       if (config.providers[name]!.disabled) {
         return jsonResponse({ error: "cannot set a disabled provider as default", code: "default_provider_disabled" }, 400);
       }
-      config.defaultProvider = name;
-      saveManagementConfig(deps, config);
+      const outcome = mutateManagementConfig<ProviderMutationValue>(deps, fresh => {
+        if (!hasOwnProvider(fresh.providers, name)) return { changed: false, value: { error: "unknown provider" } };
+        if (fresh.providers[name]!.disabled) {
+          return { changed: false, value: { error: "cannot set a disabled provider as default", code: "default_provider_disabled" } };
+        }
+        fresh.defaultProvider = name;
+        return { changed: true, value: { config: structuredClone(fresh) } };
+      });
+      if (outcome.status === "unavailable") return unavailableMutationResponse(outcome.reason, req, config);
+      if ("error" in outcome.value) return jsonResponse(outcome.value, outcome.value.error === "unknown provider" ? 404 : 400);
+      adoptCommittedConfig(config, outcome.value.config);
       reconcileLiveStateStores();
       return jsonResponse({ success: true, name, defaultProvider: name });
     }
@@ -894,36 +993,41 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     // concurrent PATCHes updating different fields/headers both survive instead of the
     // later save clobbering the earlier snapshot.
     let replayError: string | undefined;
-    withConfigMutationLockSync(() => {
-      const replay = applyProviderPatchFields(name, config.providers[name]!, rawBody, keys, config);
+    const outcome = mutateManagementConfig<ProviderMutationValue>(deps, fresh => {
+      const provider = fresh.providers[name];
+      if (!provider) return { changed: false, value: { error: "unknown provider" } };
+      const replay = applyProviderPatchFields(name, provider, rawBody, keys, fresh);
       if ("error" in replay) {
         replayError = replay.error;
-        return;
+        return { changed: false, value: { error: replay.error } };
       }
       if (replay.editorTouched && !pacingOnly) {
         const syncError = canonicalBudgetOnly
-          ? canonicalOpenAiBudgetPatchError(replay.next, rawBody, keys, config)
+          ? canonicalOpenAiBudgetPatchError(replay.next, rawBody, keys, fresh)
           : providerManagementConfigError(name, replay.next);
         if (syncError) {
           replayError = syncError;
-          return;
+          return { changed: false, value: { error: syncError } };
         }
         if (!canonicalBudgetOnly) {
           const serviceTierError = providerServiceTierConfigError(name, replay.next);
           if (serviceTierError) {
             replayError = serviceTierError;
-            return;
+            return { changed: false, value: { error: serviceTierError } };
           }
         }
       } else if (replay.enablingOpenAi && !isCanonicalOpenAiForwardProvider(replay.next)) {
         replayError = "provider openai must be the canonical built-in provider";
-        return;
+        return { changed: false, value: { error: replayError } };
       }
       // A PATCH that managed headers owns the resulting block: the clear path restores
       // registry static headers, so exact-match stripping must not erase them again.
-      config.providers[name] = replay.headersTouched ? replay.next : stripRegistryOnlyStaticHeaders(name, replay.next);
-      saveManagementConfig(deps, config);
+      fresh.providers[name] = replay.headersTouched ? replay.next : stripRegistryOnlyStaticHeaders(name, replay.next);
+      return { changed: true, value: { config: structuredClone(fresh) } };
     });
+    if (outcome.status === "unavailable") return unavailableMutationResponse(outcome.reason, req, config);
+    if ("error" in outcome.value) return jsonResponse({ error: outcome.value.error }, outcome.value.error === "unknown provider" ? 404 : 409);
+    adoptCommittedConfig(config, outcome.value.config);
     if (replayError !== undefined) return jsonResponse({ error: replayError }, 409);
     reconcileLiveStateStores();
     if (applied.editorTouched && !pacingOnly) {
@@ -1110,23 +1214,32 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
         code: "last_provider",
       }, 409);
     }
-    const dependentCombos = Object.entries(config.combos ?? {})
-      .filter(([, combo]) => combo.targets.some(target => target.provider === name))
-      .map(([id]) => id)
-      .sort((a, b) => a.localeCompare(b));
-    if (dependentCombos.length > 0) {
-      return jsonResponse({
-        error: `cannot delete provider "${name}" while combos depend on it`,
-        code: "provider_has_dependent_combos",
-        combos: dependentCombos,
-      }, 409);
+    const dependencyError = providerDependencyError(config, name);
+    if (dependencyError) return jsonResponse(dependencyError, 409);
+    const outcome = mutateManagementConfig<ProviderMutationValue>(deps, fresh => {
+      if (!hasOwnProvider(fresh.providers, name)) return { changed: false, value: { error: "unknown provider" } };
+      const fallbackDefault = name === fresh.defaultProvider
+        ? Object.entries(fresh.providers)
+          .find(([provider, providerConfig]) => provider !== name && providerConfig.disabled !== true)
+          ?.[0]
+        : undefined;
+      if (name === fresh.defaultProvider && !fallbackDefault) {
+        return { changed: false, value: { error: "cannot delete the default provider when no enabled replacement remains", code: "last_provider" } };
+      }
+      const dependencyError = providerDependencyError(fresh, name);
+      if (dependencyError) return { changed: false, value: dependencyError };
+      if (fallbackDefault) fresh.defaultProvider = fallbackDefault;
+      delete fresh.providers[name];
+      const droppedCustomModels = dropProviderCustomModels(fresh, name);
+      setProviderContextCap(fresh, name, false);
+      return { changed: true, value: { config: structuredClone(fresh), fallbackDefault, droppedCustomModels } };
+    });
+    if (outcome.status === "unavailable") return unavailableMutationResponse(outcome.reason, req, config);
+    if ("error" in outcome.value) {
+      const status = outcome.value.code?.startsWith("provider_has_dependent_") || outcome.value.code === "last_provider" ? 409 : 404;
+      return jsonResponse(outcome.value, status);
     }
-    if (fallbackDefault) config.defaultProvider = fallbackDefault;
-    delete config.providers[name];
-    const { dropProviderCustomModels } = await import("../../providers/provider-id-rewrite");
-    const droppedCustomModels = dropProviderCustomModels(config, name);
-    setProviderContextCap(config, name, false);
-    saveManagementConfig(deps, config);
+    adoptCommittedConfig(config, outcome.value.config);
     await replaceProviderAccountSet(name, null);
     reconcileLiveStateStores();
     const { clearModelCache: clearCache } = await import("../../codex/model-cache");
@@ -1134,8 +1247,8 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     const catalogRefresh = await convergeCodexCatalog();
     return jsonResponse({
       success: true,
-      ...(fallbackDefault ? { defaultProvider: fallbackDefault } : {}),
-      ...(droppedCustomModels > 0 ? { droppedCustomModels } : {}),
+      ...(outcome.value.fallbackDefault ? { defaultProvider: outcome.value.fallbackDefault } : {}),
+      droppedCustomModels: outcome.value.droppedCustomModels,
       catalogRefresh,
     });
   }