ldrouter 1.14.0 → 1.16.2

package/dist/server/routes/admin/codex.js

@@ -0,0 +1,331 @@
+import { z } from 'zod';
+import { GatewayError } from '../../errors.js';
+import { requireAdminAuth, requireAdminCsrf } from '../../auth/middleware.js';
+import { recordAudit } from '../../db/repositories/audit.js';
+import { listCodexAccountSummaries, setCodexAccountHealth, toCodexAccountSummaryRow, upsertCodexAccount, findCodexAccountForImport, } from '../../db/repositories/codex-accounts.js';
+import { getRawDb } from '../../db/index.js';
+import { parseCodexImportText, toCodexPreview } from '../../providers/codex-import.js';
+import { probeCodex } from '../../providers/codex.js';
+import { fetchCodexResetCredits, consumeCodexResetCredit } from '../../providers/codex-usage.js';
+import { codexCredentialError, withCodexCredentials } from '../../providers/codex-refresh.js';
+import { buildCodexAuthorizeUrl, exchangeCodexCode, extractCodeFromCallback, newCodexPkce } from '../../providers/codex-oauth.js';
+import { refreshStoredCodexUsage } from '../../providers/codex-autostart.js';
+import { redactString } from '../../security/redact.js';
+const MAX_BYTES = 2_000_000;
+const MAX_RECORDS = 500;
+const ImportBody = z.object({ providerId: z.string().min(1), selectedIndexes: z.array(z.number().int().min(0)).max(MAX_RECORDS).optional() });
+const MutationOptions = { preHandler: requireAdminCsrf };
+export const CodexAccountUpdate = z.object({
+    enabled: z.boolean().optional(),
+    email: z.string().email().nullable().optional(),
+    workspaceId: z.string().max(256).nullable().optional(),
+    planType: z.string().max(128).nullable().optional(),
+    priority: z.number().int().min(0).max(100000).optional(),
+    autostart: z.boolean().optional(),
+}).refine((v) => Object.keys(v).length > 0, 'At least one update is required');
+/** Credential failures must surface as typed admin errors, not an opaque 500. */
+async function withCredentials(accountId, fn) {
+    try {
+        return await withCodexCredentials(accountId, fn);
+    }
+    catch (error) {
+        throw codexCredentialError(error);
+    }
+}
+function parseAll(text) {
+    const result = parseCodexImportText(text);
+    const records = [];
+    const failures = [];
+    for (const item of result)
+        ('accessToken' in item ? records : failures).push(item);
+    return { records, failures };
+}
+function providerOrThrow(providerId) {
+    const provider = getRawDb().prepare('SELECT id,type,base_url,total_timeout_ms FROM providers WHERE id=?').get(providerId);
+    if (!provider)
+        throw new GatewayError('invalid_request_error', 'Provider not found', { status: 404 });
+    if (provider.type !== 'codex')
+        throw new GatewayError('invalid_request_error', 'Provider must be Codex', { status: 400 });
+    return provider;
+}
+/**
+ * Desktop/e2e flows cannot always hand a real File to a multipart file part, so a file part whose
+ * name lacks a text extension is accepted as base64 of the JSON payload.
+ */
+const TEXT_EXT = /\.(json|jsonl|txt)$/i;
+async function readInput(req, body) {
+    const contentType = String(req.headers['content-type'] ?? '');
+    if (contentType.includes('multipart/form-data')) {
+        const parts = req.parts();
+        let providerId = '';
+        let selectedIndexes;
+        const texts = [];
+        let bytes = 0;
+        for await (const part of parts) {
+            if (part.type === 'file') {
+                const chunks = [];
+                for await (const chunk of part.file) {
+                    bytes += chunk.length;
+                    if (bytes > MAX_BYTES)
+                        throw new GatewayError('invalid_request_error', 'Import exceeds maximum size', { status: 413 });
+                    chunks.push(chunk);
+                }
+                const raw = Buffer.concat(chunks).toString('utf8');
+                texts.push(TEXT_EXT.test(part.filename ?? '') ? raw : Buffer.from(raw, 'base64').toString('utf8'));
+            }
+            else if (part.fieldname === 'providerId')
+                providerId = String(part.value);
+            else if (part.fieldname === 'selectedIndexes') {
+                let parsedIndexes;
+                try {
+                    parsedIndexes = JSON.parse(String(part.value));
+                }
+                catch {
+                    throw new GatewayError('invalid_request_error', 'selectedIndexes must be JSON', { status: 400 });
+                }
+                selectedIndexes = z.array(z.number().int().min(0)).max(MAX_RECORDS).parse(parsedIndexes);
+            }
+            else if (part.fieldname === 'text')
+                texts.push(String(part.value));
+        }
+        return { providerId, text: texts.join('\n'), selectedIndexes };
+    }
+    const parsed = ImportBody.extend({ text: z.union([z.string(), z.record(z.string(), z.unknown()), z.array(z.unknown())]) }).parse(body);
+    const text = typeof parsed.text === 'string' ? parsed.text : JSON.stringify(parsed.text);
+    if (Buffer.byteLength(text, 'utf8') > MAX_BYTES)
+        throw new GatewayError('invalid_request_error', 'Import exceeds maximum size', { status: 413 });
+    return { providerId: parsed.providerId, text, selectedIndexes: parsed.selectedIndexes };
+}
+const selectAccount = "SELECT id,email,workspace_id AS workspaceId,chatgpt_account_id AS chatgptAccountId,plan_type AS planType,token_expires_at AS tokenExpiresAt,enabled,health_state AS healthState,last_refresh_at AS lastRefreshAt,priority,codex_autostart_enabled AS autostart,codex_usage_json AS usageJson,codex_usage_error AS usageError,codex_usage_updated_at AS usageUpdatedAt,last_pinged_reset_at AS lastPingedResetAt,last_ping_at AS lastPingAt,created_at AS createdAt,updated_at AS updatedAt FROM codex_accounts WHERE id=?";
+function accountById(id) {
+    const row = getRawDb().prepare(selectAccount).get(id);
+    if (!row)
+        throw new GatewayError('invalid_request_error', 'Codex account not found', { status: 404 });
+    return row;
+}
+/** Narrow seam onto the Codex account row so quota routes can read provider + identity. */
+function accountTarget(id) {
+    const row = getRawDb().prepare('SELECT provider_id AS providerId, chatgpt_account_id AS accountId FROM codex_accounts WHERE id=?').get(id);
+    if (!row)
+        throw new GatewayError('invalid_request_error', 'Codex account not found', { status: 404 });
+    return { ...row, provider: providerOrThrow(row.providerId) };
+}
+/**
+ * Server-held PKCE sessions. The challenge must derive from the verifier used at exchange time,
+ * so the verifier never leaves the process; the dialog polls this state instead.
+ */
+const oauthSessions = new Map();
+const OAUTH_TTL_MS = 15 * 60_000;
+const reapOauthSessions = () => {
+    const cutoff = Date.now() - OAUTH_TTL_MS;
+    for (const [state, session] of oauthSessions)
+        if (session.createdAt < cutoff)
+            oauthSessions.delete(state);
+};
+/**
+ * Loopback capture endpoint for the Codex CLI redirect (http://localhost:1455/auth/callback).
+ * Registered outside the admin scope because the browser's redirect carries no session; the code
+ * is held in memory against its state and exchanged only by /oauth/complete.
+ */
+export async function registerCodexOAuthCallbackRoute(app) {
+    app.get('/oauth/codex/callback', async (req, reply) => {
+        const { code, state, error } = req.query;
+        reapOauthSessions();
+        const session = state ? oauthSessions.get(state) : undefined;
+        if (session && code)
+            session.code = code;
+        const failed = Boolean(error) || !session || !code;
+        reply.type('text/html').send(`<!doctype html><meta charset="utf-8"><title>LateDev Router</title><body style="font:14px system-ui;padding:2rem">` +
+            (failed
+                ? `<h1>Authorization failed</h1><p>${session ? 'No authorization code was returned. Close this tab and try again.' : 'This authorization session is unknown or has expired.'}</p>`
+                : `<h1>Account connected</h1><p>You can close this tab and return to LateDev Router.</p>`));
+    });
+}
+export async function registerCodexRoutes(app) {
+    app.addHook('preHandler', requireAdminAuth);
+    app.post('/api/admin/codex/accounts/preview', { preHandler: requireAdminCsrf }, async (req) => {
+        const input = await readInput(req, req.body);
+        providerOrThrow(input.providerId);
+        const parsed = parseAll(input.text);
+        const seen = new Map();
+        const records = parsed.records.map((record) => {
+            const duplicateOf = seen.get(record.identity);
+            seen.set(record.identity, record.index);
+            const existing = findCodexAccountForImport(input.providerId, { chatgptAccountId: record.chatgptAccountId, workspaceId: record.workspaceId, email: record.email, tokenDigest: '' });
+            return { ...toCodexPreview(record, duplicateOf === undefined ? (existing?.id ?? null) : String(duplicateOf)), duplicateOf: duplicateOf === undefined ? (existing?.id ?? null) : String(duplicateOf) };
+        });
+        return { records: [...records, ...parsed.failures.map((f) => ({ index: f.index, source: f.source, valid: false, error: 'Invalid record' }))], validCount: records.length, invalidCount: parsed.failures.length };
+    });
+    app.post('/api/admin/codex/accounts/import', MutationOptions, async (req) => {
+        const input = await readInput(req, req.body);
+        providerOrThrow(input.providerId);
+        const parsed = parseAll(input.text);
+        const selected = input.selectedIndexes ? new Set(input.selectedIndexes) : null;
+        const results = [];
+        let added = 0;
+        let updated = 0;
+        let skipped = 0;
+        let failed = 0;
+        for (const failure of parsed.failures) {
+            if (!selected || selected.has(failure.index)) {
+                failed++;
+                results.push({ index: failure.index, status: 'failed', error: 'Invalid record' });
+            }
+            else
+                skipped++;
+        }
+        for (const record of parsed.records) {
+            if (selected && !selected.has(record.index)) {
+                skipped++;
+                continue;
+            }
+            try {
+                const result = upsertCodexAccount(input.providerId, record);
+                if (result.status === 'added')
+                    added++;
+                else
+                    updated++;
+                results.push({ index: record.index, status: result.status, email: record.email, accountIdMasked: toCodexPreview(record).accountIdMasked });
+            }
+            catch (error) {
+                failed++;
+                results.push({ index: record.index, status: 'failed', error: 'Import failed' });
+                void error;
+            }
+        }
+        recordAudit({ action: 'codex.accounts.import', success: failed === 0, targetType: 'provider', targetId: input.providerId, ip: req.ip, metadata: { added, updated, skipped, failed } });
+        return { added, updated, skipped, failed, results };
+    });
+    app.get('/api/admin/codex/accounts', async (req) => {
+        const providerId = z.object({ providerId: z.string().min(1) }).parse(req.query).providerId;
+        providerOrThrow(providerId);
+        return { accounts: listCodexAccountSummaries(providerId) };
+    });
+    /** Drag-and-drop routing order. The posted array order becomes priority 0..n-1. */
+    const ReorderBody = z.object({ providerId: z.string().min(1), ids: z.array(z.string().min(1)).min(1).max(MAX_RECORDS) });
+    app.post('/api/admin/codex/accounts/reorder', MutationOptions, async (req) => {
+        const { providerId, ids } = ReorderBody.parse(req.body);
+        providerOrThrow(providerId);
+        const owned = new Set(listCodexAccountSummaries(providerId).map((account) => account.id));
+        if (ids.some((id) => !owned.has(id)))
+            throw new GatewayError('invalid_request_error', 'Account list does not match the provider', { status: 400 });
+        const raw = getRawDb();
+        const now = new Date().toISOString();
+        const update = raw.prepare('UPDATE codex_accounts SET priority=?, updated_at=? WHERE id=?');
+        raw.transaction(() => ids.forEach((id, index) => update.run(index, now, id)))();
+        recordAudit({ action: 'codex.accounts.reorder', success: true, targetType: 'provider', targetId: providerId, ip: req.ip, metadata: { count: ids.length } });
+        return { accounts: listCodexAccountSummaries(providerId) };
+    });
+    app.post('/api/admin/codex/oauth/start', MutationOptions, async (req) => {
+        const { providerId } = z.object({ providerId: z.string().min(1) }).parse(req.body);
+        providerOrThrow(providerId);
+        reapOauthSessions();
+        const { verifier, state } = newCodexPkce();
+        oauthSessions.set(state, { verifier, providerId, createdAt: Date.now() });
+        return { state, authorizeUrl: buildCodexAuthorizeUrl(verifier, state) };
+    });
+    app.get('/api/admin/codex/oauth/:state', async (req) => {
+        const { state } = req.params;
+        reapOauthSessions();
+        const session = oauthSessions.get(state);
+        // Poll target for the dialog: reports whether the loopback callback already delivered a code.
+        if (!session)
+            throw new GatewayError('invalid_request_error', 'Authorization session not found or expired', { status: 404 });
+        return { pending: true, callbackReceived: Boolean(session.code), providerId: session.providerId, expiresInMs: session.createdAt + OAUTH_TTL_MS - Date.now() };
+    });
+    /**
+     * Completes the flow from either the browser's loopback redirect or a pasted callback URL/code.
+     * The matching session is consumed, so a code can only be exchanged once.
+     */
+    app.post('/api/admin/codex/oauth/complete', MutationOptions, async (req) => {
+        const body = z.object({ providerId: z.string().min(1), state: z.string().min(1).optional(), callbackUrl: z.string().min(1).max(8192) }).parse(req.body);
+        providerOrThrow(body.providerId);
+        const fallbackState = [...oauthSessions.entries()].filter(([, session]) => session.providerId === body.providerId).sort((a, b) => b[1].createdAt - a[1].createdAt)[0]?.[0];
+        const state = body.state ?? fallbackState;
+        const session = state ? oauthSessions.get(state) : undefined;
+        if (!state || !session || session.providerId !== body.providerId)
+            throw new GatewayError('invalid_request_error', 'Authorization session not found or expired', { status: 409 });
+        const code = extractCodeFromCallback(body.callbackUrl) ?? session.code;
+        if (!code)
+            throw new GatewayError('invalid_request_error', 'Could not find an authorization code in the pasted value', { status: 400 });
+        try {
+            const record = await exchangeCodexCode({ code, verifier: session.verifier });
+            oauthSessions.delete(state);
+            const result = upsertCodexAccount(body.providerId, record);
+            recordAudit({ action: 'codex.oauth.connect', success: true, targetType: 'codex_account', targetId: result.id, targetName: record.email ?? undefined, ip: req.ip, metadata: { status: result.status } });
+            return { account: toCodexAccountSummaryRow(accountById(result.id)), status: result.status };
+        }
+        catch (error) {
+            const status = error.status ?? 502;
+            throw new GatewayError('authentication_error', redactString(error instanceof Error ? error.message : 'Codex authorization failed'), { status });
+        }
+    });
+    app.patch('/api/admin/codex/accounts/:id', MutationOptions, async (req) => {
+        const { id } = req.params;
+        const body = CodexAccountUpdate.parse(req.body);
+        accountById(id);
+        const raw = getRawDb();
+        const fields = [];
+        const values = [];
+        for (const [key, value] of Object.entries(body)) {
+            const column = { enabled: 'enabled', email: 'email', workspaceId: 'workspace_id', planType: 'plan_type', priority: 'priority', autostart: 'codex_autostart_enabled' }[key];
+            if (column) {
+                fields.push(`${column}=?`);
+                values.push(typeof value === 'boolean' ? (value ? 1 : 0) : value);
+            }
+        }
+        fields.push('updated_at=?');
+        values.push(new Date().toISOString(), id);
+        raw.prepare(`UPDATE codex_accounts SET ${fields.join(',')} WHERE id=?`).run(...values);
+        recordAudit({ action: 'codex.accounts.update', success: true, targetType: 'codex_account', targetId: id, ip: req.ip, metadata: { fields: Object.keys(body) } });
+        return { account: toCodexAccountSummaryRow(accountById(id)) };
+    });
+    app.delete('/api/admin/codex/accounts/:id', MutationOptions, async (req) => {
+        const { id } = req.params;
+        const account = accountById(id);
+        // Hard delete: the encrypted credentials must not linger on disk. Historical request attempts
+        // survive because request_attempts.codex_account_id is ON DELETE SET NULL.
+        getRawDb().prepare('DELETE FROM codex_accounts WHERE id=?').run(id);
+        recordAudit({ action: 'codex.accounts.delete', success: true, targetType: 'codex_account', targetId: id, targetName: account.email ?? undefined, ip: req.ip });
+        return { ok: true, deleted: true };
+    });
+    app.post('/api/admin/codex/accounts/:id/test', MutationOptions, async (req) => {
+        const { id } = req.params;
+        const { provider, accountId } = accountTarget(id);
+        const result = await withCredentials(id, (credentials) => probeCodex({
+            baseUrl: provider.base_url, accountId: accountId ?? '', accessToken: credentials.accessToken,
+            accountRecordId: id, customHeaders: {}, totalTimeoutMs: Math.min(provider.total_timeout_ms, 20_000),
+        }));
+        setCodexAccountHealth(id, result.ok ? 'healthy' : 'down', result.ok ? null : redactString(result.detail));
+        recordAudit({ action: 'codex.accounts.test', success: result.ok, targetType: 'codex_account', targetId: id, ip: req.ip, metadata: { detail: redactString(result.detail) } });
+        return { ok: result.ok, detail: redactString(result.detail), latencyMs: result.latencyMs, modelCount: result.modelCount ?? null };
+    });
+    /** Refresh the 5h/weekly quota snapshot for one account. */
+    app.post('/api/admin/codex/accounts/:id/usage', MutationOptions, async (req) => {
+        const { id } = req.params;
+        const { provider, accountId } = accountTarget(id);
+        await refreshStoredCodexUsage(id, provider, { id, chatgpt_account_id: accountId });
+        return { account: toCodexAccountSummaryRow(accountById(id)) };
+    });
+    /** Weekly reset credits available on the ChatGPT account. */
+    app.get('/api/admin/codex/accounts/:id/reset-credits', async (req) => {
+        const { id } = req.params;
+        const { accountId } = accountTarget(id);
+        const result = await withCredentials(id, (credentials) => fetchCodexResetCredits(credentials.accessToken, accountId ?? undefined));
+        return result;
+    });
+    /** Spend one weekly reset credit to restart the 5h window immediately. */
+    app.post('/api/admin/codex/accounts/:id/reset-quota', MutationOptions, async (req) => {
+        const { id } = req.params;
+        const { provider, accountId } = accountTarget(id);
+        const result = await withCredentials(id, (credentials) => consumeCodexResetCredit(credentials.accessToken, accountId ?? undefined));
+        if (result.ok)
+            await refreshStoredCodexUsage(id, provider, { id, chatgpt_account_id: accountId });
+        recordAudit({ action: 'codex.accounts.reset_quota', success: result.ok, targetType: 'codex_account', targetId: id, ip: req.ip, metadata: { code: result.code, windowsReset: result.windowsReset } });
+        if (!result.ok) {
+            const status = result.noCredit ? 409 : 502;
+            throw new GatewayError('invalid_request_error', result.noCredit ? 'No Codex reset credits available' : redactString(result.message ?? 'Codex reset credit request failed'), { status });
+        }
+        return { ok: true, windowsReset: result.windowsReset, account: toCodexAccountSummaryRow(accountById(id)) };
+    });
+}

package/dist/server/routes/admin/models.js

@@ -71,11 +71,28 @@ export async function registerModelRoutes(app) {
         // For simplicity: re-discover and match by upstream id.
         const { discoverProviderModels } = await import('../../providers/index.js');
         const { decryptSecret, decryptCustomHeaders } = await import('../../auth/crypto.js');
-        const apiKey = decryptSecret({ ciphertext: provider.encryptedApiKey, nonce: provider.apiKeyNonce, version: provider.apiKeyVersion });
-        const headers = decryptCustomHeaders(provider.customHeadersEncrypted && provider.customHeadersNonce ? { ciphertext: provider.customHeadersEncrypted, nonce: provider.customHeadersNonce, version: 1 } : null);
+        const { codexModels } = await import('../../providers/codex.js');
+        const { getCodexAccountById, listCodexAccountSummaries } = await import('../../db/repositories/codex-accounts.js');
+        const { withCodexCredentials } = await import('../../providers/codex-refresh.js');
         let discovered;
         try {
-            discovered = await discoverProviderModels({ type: provider.type, baseUrl: provider.baseUrl, apiKey, customHeaders: headers, connectTimeoutMs: 5000, totalTimeoutMs: 30000 });
+            if (provider.type === 'codex') {
+                const summary = listCodexAccountSummaries(provider.id).find((candidate) => candidate.enabled && candidate.healthState !== 'down');
+                const account = summary ? getCodexAccountById(summary.id) : null;
+                if (!account)
+                    throw new GatewayError('authentication_error', 'No eligible Codex account is configured', { status: 503 });
+                discovered = await withCodexCredentials(account.id, (credentials) => codexModels({
+                    baseUrl: provider.baseUrl, accountId: account.chatgptAccountId, accessToken: credentials.accessToken,
+                    accountRecordId: account.id, customHeaders: {}, totalTimeoutMs: Math.min(provider.totalTimeoutMs, 30000),
+                }));
+            }
+            else {
+                if (!provider.encryptedApiKey || !provider.apiKeyNonce)
+                    throw new GatewayError('invalid_request_error', 'Provider credentials are missing', { status: 501 });
+                const apiKey = decryptSecret({ ciphertext: provider.encryptedApiKey, nonce: provider.apiKeyNonce, version: provider.apiKeyVersion });
+                const headers = decryptCustomHeaders(provider.customHeadersEncrypted && provider.customHeadersNonce ? { ciphertext: provider.customHeadersEncrypted, nonce: provider.customHeadersNonce, version: 1 } : null);
+                discovered = await discoverProviderModels({ type: provider.type, baseUrl: provider.baseUrl, apiKey, customHeaders: headers, connectTimeoutMs: 5000, totalTimeoutMs: 30000 });
+            }
         }
         catch {
             discovered = [];

package/dist/server/routes/admin/providers.js

@@ -1,18 +1,22 @@
 import { z } from 'zod';
 import { sql, eq } from 'drizzle-orm';
-import { getDb, schema } from '../../db/index.js';
+import { getDb, getRawDb, schema } from '../../db/index.js';
 import { requireAdminAuth } from '../../auth/middleware.js';
 import { recordAudit } from '../../db/repositories/audit.js';
 import { encryptSecret, decryptSecret, encryptCustomHeaders, decryptCustomHeaders, isMasterKeyConfigured } from '../../auth/crypto.js';
 import { uuid, slugify } from '../../auth/ids.js';
 import { GatewayError } from '../../errors.js';
 import { probeProvider, discoverProviderModels } from '../../providers/index.js';
+import { probeCodex, codexModels } from '../../providers/codex.js';
+import { listCodexAccountSummaries } from '../../db/repositories/codex-accounts.js';
+import { codexCredentialError, withCodexCredentials } from '../../providers/codex-refresh.js';
+import { redactString } from '../../security/redact.js';
 const ProviderCreate = z.object({
     name: z.string().min(1).max(128),
     slug: z.string().min(1).max(64).optional(),
-    type: z.enum(['openai', 'anthropic']),
+    type: z.enum(['openai', 'anthropic', 'codex']),
     baseUrl: z.string().url().max(512),
-    apiKey: z.string().min(1).max(512),
+    apiKey: z.string().min(1).max(20000).optional(),
     customHeaders: z.record(z.string(), z.string()).optional(),
     enabled: z.boolean().optional(),
     connectTimeoutMs: z.number().int().min(100).max(60000).optional(),
@@ -60,13 +64,16 @@ export async function registerProviderRoutes(app) {
     });
     app.post('/api/admin/providers', async (req) => {
         const body = ProviderCreate.parse(req.body);
+        if (body.type !== 'codex' && !body.apiKey) {
+            throw new GatewayError('invalid_request_error', 'API key is required for this provider type', { status: 400 });
+        }
         requireMasterKey(); // Need master key to encrypt new credentials
         const db = getDb();
         const slug = body.slug ? slugify(body.slug) : slugify(body.name);
         const dup = db.select().from(schema.providers).where(eq(schema.providers.slug, slug)).get();
         if (dup)
             throw new GatewayError('invalid_request_error', `Provider slug '${slug}' is already in use`, { status: 400 });
-        const enc = encryptSecret(body.apiKey);
+        const enc = body.apiKey ? encryptSecret(body.apiKey) : null;
         const headersEnc = body.customHeaders ? encryptCustomHeaders(body.customHeaders) : null;
         const id = uuid();
         db.insert(schema.providers).values({
@@ -75,9 +82,9 @@ export async function registerProviderRoutes(app) {
             slug,
             type: body.type,
             baseUrl: body.baseUrl,
-            encryptedApiKey: enc.ciphertext,
-            apiKeyNonce: enc.nonce,
-            apiKeyVersion: enc.version,
+            encryptedApiKey: enc?.ciphertext ?? null,
+            apiKeyNonce: enc?.nonce ?? null,
+            apiKeyVersion: enc?.version ?? 1,
             customHeadersEncrypted: headersEnc?.ciphertext ?? null,
             customHeadersNonce: headersEnc?.nonce ?? null,
             enabled: body.enabled ?? true,
@@ -150,9 +157,21 @@ export async function registerProviderRoutes(app) {
             recordAudit({ action: 'provider.soft_disable', success: true, targetType: 'provider', targetId: id, targetName: p.name, ip: req.ip });
             return { ok: true, softDisabled: true };
         }
-        db.delete(schema.providers).where(eq(schema.providers.id, id)).run();
-        recordAudit({ action: 'provider.delete', success: true, targetType: 'provider', targetId: id, targetName: p.name, ip: req.ip });
-        return { ok: true };
+        // A Codex provider owns its account pool. codex_accounts.provider_id is ON DELETE RESTRICT,
+        // so the accounts must go in the same transaction or the delete fails with a raw SQLite
+        // constraint error (which surfaces as an opaque 500 "Gateway error").
+        let codexAccountsDeleted = 0;
+        try {
+            getRawDb().transaction(() => {
+                codexAccountsDeleted = getRawDb().prepare('DELETE FROM codex_accounts WHERE provider_id=?').run(id).changes;
+                db.delete(schema.providers).where(eq(schema.providers.id, id)).run();
+            })();
+        }
+        catch (error) {
+            throw new GatewayError('invalid_request_error', 'Provider is still referenced and cannot be deleted', { status: 409, cause: error });
+        }
+        recordAudit({ action: 'provider.delete', success: true, targetType: 'provider', targetId: id, targetName: p.name, ip: req.ip, metadata: { codexAccountsDeleted } });
+        return { ok: true, codexAccountsDeleted };
     });
     app.post('/api/admin/providers/:id/test', async (req) => {
         const { id } = req.params;
@@ -160,6 +179,18 @@ export async function registerProviderRoutes(app) {
         const p = db.select().from(schema.providers).where(eq(schema.providers.id, id)).get();
         if (!p)
             throw new GatewayError('invalid_request_error', 'Provider not found', { status: 404 });
+        if (p.type === 'codex') {
+            const account = listCodexAccountSummaries(p.id).find((candidate) => candidate.enabled && candidate.healthState !== 'down');
+            if (!account)
+                throw new GatewayError('authentication_error', 'No eligible Codex account is configured', { status: 503 });
+            const row = getRawDb().prepare('SELECT chatgpt_account_id AS accountId FROM codex_accounts WHERE id=?').get(account.id);
+            const result = await withCodexCredentials(account.id, async (credentials) => probeCodex({ baseUrl: p.baseUrl, accountId: row?.accountId ?? '', accessToken: credentials.accessToken, customHeaders: {}, totalTimeoutMs: Math.min(p.totalTimeoutMs, 20000) })).catch((error) => { throw codexCredentialError(error); });
+            db.update(schema.providers).set({ healthState: result.ok ? 'healthy' : 'down', updatedAt: new Date().toISOString() }).where(eq(schema.providers.id, id)).run();
+            recordAudit({ action: 'provider.test', success: result.ok, targetType: 'provider', targetId: id, targetName: p.name, ip: req.ip, metadata: { detail: redactString(result.detail) } });
+            return { ...result, detail: redactString(result.detail) };
+        }
+        if (!p.encryptedApiKey || !p.apiKeyNonce)
+            throw new GatewayError('invalid_request_error', 'Provider credentials are missing', { status: 501 });
         const apiKey = decryptSecret({ ciphertext: p.encryptedApiKey, nonce: p.apiKeyNonce, version: p.apiKeyVersion });
         const headers = decryptCustomHeaders(p.customHeadersEncrypted && p.customHeadersNonce ? { ciphertext: p.customHeadersEncrypted, nonce: p.customHeadersNonce, version: 1 } : null);
         const result = await probeProvider({
@@ -185,16 +216,28 @@ export async function registerProviderRoutes(app) {
         const p = db.select().from(schema.providers).where(eq(schema.providers.id, id)).get();
         if (!p)
             throw new GatewayError('invalid_request_error', 'Provider not found', { status: 404 });
-        const apiKey = decryptSecret({ ciphertext: p.encryptedApiKey, nonce: p.apiKeyNonce, version: p.apiKeyVersion });
-        const headers = decryptCustomHeaders(p.customHeadersEncrypted && p.customHeadersNonce ? { ciphertext: p.customHeadersEncrypted, nonce: p.customHeadersNonce, version: 1 } : null);
-        const discovered = await discoverProviderModels({
-            type: p.type,
-            baseUrl: p.baseUrl,
-            apiKey,
-            customHeaders: headers,
-            connectTimeoutMs: 5000,
-            totalTimeoutMs: 30000,
-        });
+        let discovered;
+        if (p.type === 'codex') {
+            const account = listCodexAccountSummaries(p.id).find((candidate) => candidate.enabled && candidate.healthState !== 'down');
+            if (!account)
+                throw new GatewayError('authentication_error', 'No eligible Codex account is configured', { status: 503 });
+            const row = getRawDb().prepare('SELECT chatgpt_account_id AS accountId FROM codex_accounts WHERE id=?').get(account.id);
+            discovered = await withCodexCredentials(account.id, async (credentials) => codexModels({ baseUrl: p.baseUrl, accountId: row?.accountId ?? '', accessToken: credentials.accessToken, customHeaders: {}, totalTimeoutMs: 30000 })).catch((error) => { throw codexCredentialError(error); });
+        }
+        else {
+            if (!p.encryptedApiKey || !p.apiKeyNonce)
+                throw new GatewayError('invalid_request_error', 'Provider credentials are missing', { status: 501 });
+            const apiKey = decryptSecret({ ciphertext: p.encryptedApiKey, nonce: p.apiKeyNonce, version: p.apiKeyVersion });
+            const headers = decryptCustomHeaders(p.customHeadersEncrypted && p.customHeadersNonce ? { ciphertext: p.customHeadersEncrypted, nonce: p.customHeadersNonce, version: 1 } : null);
+            discovered = await discoverProviderModels({
+                type: p.type,
+                baseUrl: p.baseUrl,
+                apiKey,
+                customHeaders: headers,
+                connectTimeoutMs: 5000,
+                totalTimeoutMs: 30000,
+            });
+        }
         const existing = db
             .select()
             .from(schema.models)

package/dist/server/routes/admin/requests.js

@@ -230,6 +230,7 @@ export async function registerRequestRoutes(app) {
                 providerName: providerMap.get(a.providerId)?.name ?? '',
                 modelId: a.modelId,
                 modelPublicId: modelMap.get(a.modelId)?.publicModelId ?? '',
+                codexAccountId: a.codexAccountId,
                 startedAt: a.startedAt,
                 completedAt: a.completedAt,
                 statusCode: a.statusCode,

package/dist/server/routes/admin.js

@@ -1,4 +1,5 @@
 // Admin API routes (mounted at /api/admin/*). All require admin session auth.
+import { requireAdminAuth, requireAdminCsrf } from '../auth/middleware.js';
 import { registerSetupRoutes } from './admin/setup.js';
 import { registerAuthRoutes } from './admin/auth.js';
 import { registerProviderRoutes } from './admin/providers.js';
@@ -12,6 +13,7 @@ import { registerAuditRoutes } from './admin/audit.js';
 import { registerSettingsRoutes } from './admin/settings.js';
 import { registerBackupRoutes } from './admin/backup.js';
 import { registerDashboardRoutes } from './admin/dashboard.js';
+import { registerCodexRoutes, registerCodexOAuthCallbackRoute } from './admin/codex.js';
 export async function registerAdminRoutes(app) {
     // Setup routes are always reachable (used on first run).
     await app.register(async (instance) => {
@@ -22,8 +24,17 @@ export async function registerAdminRoutes(app) {
     await app.register(async (instance) => {
         await registerAuthRoutes(instance);
     });
+    // The Codex OAuth loopback callback is hit by the browser's redirect, so it is public too.
+    await app.register(async (instance) => {
+        await registerCodexOAuthCallbackRoute(instance);
+    });
     // Authenticated admin routes
     await app.register(async (instance) => {
+        instance.addHook('preHandler', requireAdminAuth);
+        instance.addHook('preHandler', async (req) => {
+            if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(req.method))
+                await requireAdminCsrf(req);
+        });
         await registerProviderRoutes(instance);
         await registerModelRoutes(instance);
         await registerComboRoutes(instance);
@@ -35,5 +46,6 @@ export async function registerAdminRoutes(app) {
         await registerSettingsRoutes(instance);
         await registerBackupRoutes(instance);
         await registerDashboardRoutes(instance);
+        await registerCodexRoutes(instance);
     });
 }

package/dist/server/routing/capabilities.js

@@ -38,7 +38,9 @@ export function deriveRequiredCapabilities(req) {
  * IMPORTANT: Treat undefined as "unknown" rather than "unsupported".
  * For generic OpenAI-compatible providers where capabilities weren't explicitly imported,
  * undefined means we don't know, so we should assume it's potentially supported.
- * Explicit false means "known unsupported".
+ * Explicit false means "known unsupported" for protocol capabilities such as
+ * tools, images, and streaming. Reasoning is advisory metadata because the
+ * upstream may support it even when discovery cannot identify it.
  */
 export function modelMeets(caps, req) {
     // Only reject if capability is explicitly false, not if unknown (undefined)
@@ -52,8 +54,6 @@ export function modelMeets(caps, req) {
         return false;
     if (req.audioInput && caps.audio_input === false)
         return false;
-    if (req.reasoning && caps.reasoning === false)
-        return false;
     if (req.responses && caps.responses === false)
         return false;
     return true;

package/dist/server/routing/combo.js

@@ -23,6 +23,13 @@ export function loadCombo(comboId) {
         },
     };
 }
+export function expandCodexAccountCandidates(candidate, accounts, now = new Date()) {
+    if (!candidate.publicModelId.startsWith('codex/'))
+        return [candidate];
+    const usable = accounts.filter((a) => a.enabled && (a.healthState === 'healthy' || a.healthState === 'unknown') && Date.parse(a.tokenExpiresAt) > now.getTime())
+        .sort((a, b) => a.priority - b.priority || a.id.localeCompare(b.id));
+    return usable.map((a) => ({ ...candidate, codexAccountId: a.id, codexChatgptAccountId: a.chatgptAccountId, selectionReason: 'codex_account' }));
+}
 export function selectCandidates(combo, allModels, req, onReject) {
     // Resolve each combo member to a candidate and apply filters
     const map = new Map(allModels.map((m) => [m.modelId, m]));
@@ -69,8 +76,6 @@ function capabilityRejection(caps, req) {
         return 'image_input';
     if (req.audioInput && caps.audio_input === false)
         return 'audio_input';
-    if (req.reasoning && caps.reasoning === false)
-        return 'reasoning';
     if (req.responses && caps.responses === false)
         return 'responses';
     return 'capability_mismatch';
@@ -86,24 +91,25 @@ export function orderCandidates(combo, candidates) {
     }
     // Weighted round-robin: stable order with weighted lead bias.
     // We rotate via a process-local cursor keyed by combo id.
-    const cursor = nextCursor(combo.comboId, candidates);
+    const cursor = nextCursor(combo.comboId, combo.members, candidates);
     return cursor;
 }
 const comboCursors = new Map();
-function nextCursor(comboId, candidates) {
+function nextCursor(comboId, members, candidates) {
     if (candidates.length === 0)
         return [];
-    // Compute total weight of available candidates
-    const totalWeight = candidates.reduce((s, c) => {
-        const m = (candidates.find((x) => x.modelId === c.modelId));
-        void m;
-        return s + 1; // weight normalization happens upstream
-    }, 0);
-    void totalWeight;
-    // Simple modulo rotation for determinism in tests
-    const cur = (comboCursors.get(comboId) ?? 0) % candidates.length;
+    // Repeat each available member according to its configured positive weight,
+    // then advance one slot per request. This is deterministic weighted RR.
+    const slots = members.flatMap((member) => {
+        const candidate = candidates.find((c) => c.modelId === member.modelId);
+        if (!candidate)
+            return [];
+        return Array.from({ length: Math.max(1, member.weight) }, () => candidate);
+    });
+    const cur = (comboCursors.get(comboId) ?? 0) % Math.max(1, slots.length);
     comboCursors.set(comboId, cur + 1);
-    return [...candidates.slice(cur), ...candidates.slice(0, cur)];
+    const selected = slots[cur] ?? candidates[0];
+    return [selected, ...candidates.filter((candidate) => candidate !== selected)];
 }
 export function shouldFallback(combo, reason) {
     switch (reason.type) {