ldrouter 1.16.2 → 1.16.3

package/dist/server/routes/admin/combos.js

@@ -35,6 +35,55 @@ function comboSlug(input) {
         .replace(/[^a-z0-9._-]+/g, '')
         .slice(0, 64) || 'item');
 }
+/**
+ * A combo's slug and public id both have to be unique, and `slug` is NOT
+ * derivable from `public_model_id` (a slugless combo has slug "beta" and id
+ * "beta"; a slugged one has slug "beta" and id "combo/beta"). Checking only the
+ * public id lets a new name collide with an existing *slug*: the insert then
+ * dies as a raw SQLITE_CONSTRAINT and reaches the admin as an opaque
+ * 500 "Gateway error".
+ */
+function assertComboIdFree(db, slug, publicModelId, excludeId) {
+    const clash = db
+        .select()
+        .from(schema.combos)
+        .where(sql `public_model_id = ${publicModelId} OR slug = ${slug}`)
+        .all()
+        .find((c) => c.id !== excludeId);
+    if (clash)
+        throw new GatewayError('invalid_request_error', 'Combo ID already in use', { status: 400 });
+    if (db.select().from(schema.models).where(eq(schema.models.publicModelId, publicModelId)).get()) {
+        throw new GatewayError('invalid_request_error', `A model with ID "${publicModelId}" already exists`, { status: 400 });
+    }
+}
+/** Slug triple the route / slug triple the runtime resolver expects. */
+function comboIds(name, slug) {
+    const s = comboSlug(slug || name);
+    return { slug: s, publicModelId: slug ? `combo/${s}` : s };
+}
+/**
+ * `combo_members` is UNIQUE(combo_id, model_id) and the admin UI's member rows
+ * are the payload of record, so two rows for one model collapse silently. Reject
+ * that here: a member list is a set, and telling the operator beats a lost row.
+ */
+function assertMembersUsable(db, members) {
+    const ids = members.map((m) => m.modelId);
+    const dupes = ids.filter((id, i) => ids.indexOf(id) !== i);
+    if (dupes.length > 0) {
+        throw new GatewayError('invalid_request_error', `Duplicate members: ${[...new Set(dupes)].join(', ')}`, { status: 400 });
+    }
+    assertModelsExist(db, members);
+}
+function assertModelsExist(db, members) {
+    const models = db
+        .select()
+        .from(schema.models)
+        .where(sql `id IN (${sql.join(members.map((m) => sql `${m.modelId}`), sql `, `)})`)
+        .all();
+    if (models.length !== members.length) {
+        throw new GatewayError('invalid_request_error', 'One or more members are not valid physical models', { status: 400 });
+    }
+}
 export async function registerComboRoutes(app) {
     app.addHook('preHandler', requireAdminAuth);
     app.get('/api/admin/combos', async () => {
@@ -92,41 +141,35 @@ export async function registerComboRoutes(app) {
         const body = ComboCreate.parse(req.body);
         const db = getDb();
         // No slug given → the public id IS the normalized name (no "combo/" prefix).
-        const slug = comboSlug(body.slug ?? body.name);
-        const publicModelId = body.slug ? `combo/${slug}` : slug;
+        const { slug, publicModelId } = comboIds(body.name, body.slug);
         // The id must be globally unique across combos AND physical models — the
         // resolver treats every name as one routing surface.
-        if (db.select().from(schema.combos).where(eq(schema.combos.publicModelId, publicModelId)).get()) {
-            throw new GatewayError('invalid_request_error', 'Combo ID already in use', { status: 400 });
-        }
-        if (db.select().from(schema.models).where(eq(schema.models.publicModelId, publicModelId)).get()) {
-            throw new GatewayError('invalid_request_error', `A model with ID "${publicModelId}" already exists`, { status: 400 });
-        }
-        // Verify all referenced models exist and are physical
-        const modelIds = body.members.map((m) => m.modelId);
-        const models = db.select().from(schema.models).where(sql `id IN (${sql.join(modelIds.map((id) => sql `${id}`), sql `, `)})`).all();
-        if (models.length !== new Set(modelIds).size)
-            throw new GatewayError('invalid_request_error', 'One or more members are not valid physical models', { status: 400 });
+        assertComboIdFree(db, slug, publicModelId);
+        assertMembersUsable(db, body.members);
         const id = uuid();
-        db.insert(schema.combos).values({
-            id,
-            name: body.name,
-            slug,
-            publicModelId,
-            mode: body.mode,
-            enabled: body.enabled ?? true,
-            maxTotalAttempts: body.maxTotalAttempts ?? 3,
-            fallbackOnConnection: body.fallbackOnConnection ?? true,
-            fallbackOnConnectTimeout: body.fallbackOnConnectTimeout ?? true,
-            fallbackOnFirstTokenTimeout: body.fallbackOnFirstTokenTimeout ?? true,
-            fallbackOn408: body.fallbackOn408 ?? true,
-            fallbackOn429: body.fallbackOn429 ?? true,
-            fallbackOn5xx: body.fallbackOn5xx ?? true,
-            configVersion: 1,
-        }).run();
-        for (const m of body.members) {
-            db.insert(schema.comboMembers).values({ id: uuid(), comboId: id, modelId: m.modelId, position: m.position, weight: m.weight ?? 1, enabled: m.enabled ?? true }).run();
-        }
+        // ponytail: one transaction — a combo row without its members is unroutable,
+        // and a half-applied create used to burn the name and report only "Gateway error".
+        db.transaction((tx) => {
+            tx.insert(schema.combos).values({
+                id,
+                name: body.name,
+                slug,
+                publicModelId,
+                mode: body.mode,
+                enabled: body.enabled ?? true,
+                maxTotalAttempts: body.maxTotalAttempts ?? 3,
+                fallbackOnConnection: body.fallbackOnConnection ?? true,
+                fallbackOnConnectTimeout: body.fallbackOnConnectTimeout ?? true,
+                fallbackOnFirstTokenTimeout: body.fallbackOnFirstTokenTimeout ?? true,
+                fallbackOn408: body.fallbackOn408 ?? true,
+                fallbackOn429: body.fallbackOn429 ?? true,
+                fallbackOn5xx: body.fallbackOn5xx ?? true,
+                configVersion: 1,
+            }).run();
+            for (const m of body.members) {
+                tx.insert(schema.comboMembers).values({ id: uuid(), comboId: id, modelId: m.modelId, position: m.position, weight: m.weight ?? 1, enabled: m.enabled ?? true }).run();
+            }
+        });
         recordAudit({ action: 'combo.create', success: true, targetType: 'combo', targetId: id, targetName: body.name, ip: req.ip, metadata: { members: body.members.length, mode: body.mode } });
         return { id, slug, publicModelId };
     });
@@ -139,18 +182,17 @@ export async function registerComboRoutes(app) {
         const update = { updatedAt: new Date().toISOString(), configVersion: c.configVersion + 1 };
         if (body.name)
             update.name = body.name;
-        if (body.slug !== undefined) {
-            // Same rule as creation: empty slug → plain id, provided slug → combo/<slug>.
-            const slug = comboSlug(body.slug || body.name || c.name);
-            const publicModelId = body.slug ? `combo/${slug}` : slug;
-            const clashCombo = db.select().from(schema.combos).where(eq(schema.combos.publicModelId, publicModelId)).get();
-            if (clashCombo && clashCombo.id !== body.id)
-                throw new GatewayError('invalid_request_error', 'Combo ID already in use', { status: 400 });
-            if (db.select().from(schema.models).where(eq(schema.models.publicModelId, publicModelId)).get()) {
-                throw new GatewayError('invalid_request_error', `A model with ID "${publicModelId}" already exists`, { status: 400 });
+        // Same rule as creation: no slug → the id IS the (normalized) name, slug →
+        // combo/<slug>. Deliberately no `|| body.name || c.name` fallback: a request
+        // carrying neither field would otherwise re-derive the id from the current
+        // name and silently rename the combo (or degrade it to "item").
+        if (body.name !== undefined || body.slug !== undefined) {
+            const { slug, publicModelId } = comboIds(body.name ?? c.name, body.slug);
+            if (slug !== c.slug || publicModelId !== c.publicModelId) {
+                assertComboIdFree(db, slug, publicModelId, body.id);
+                update.slug = slug;
+                update.publicModelId = publicModelId;
             }
-            update.slug = slug;
-            update.publicModelId = publicModelId;
         }
         if (body.mode)
             update.mode = body.mode;
@@ -170,12 +212,20 @@ export async function registerComboRoutes(app) {
             update.fallbackOn429 = body.fallbackOn429;
         if (body.fallbackOn5xx !== undefined)
             update.fallbackOn5xx = body.fallbackOn5xx;
-        db.update(schema.combos).set(update).where(eq(schema.combos.id, body.id)).run();
         if (body.members) {
-            db.delete(schema.comboMembers).where(eq(schema.comboMembers.comboId, body.id)).run();
-            for (const m of body.members) {
-                db.insert(schema.comboMembers).values({ id: uuid(), comboId: body.id, modelId: m.modelId, position: m.position, weight: m.weight ?? 1, enabled: m.enabled ?? true }).run();
-            }
+            assertMembersUsable(db, body.members);
+            // Replace members inside one transaction: the delete-then-insert used to
+            // leave the combo memberless (and so unroutable) if any insert failed.
+            db.transaction((tx) => {
+                tx.update(schema.combos).set(update).where(eq(schema.combos.id, body.id)).run();
+                tx.delete(schema.comboMembers).where(eq(schema.comboMembers.comboId, body.id)).run();
+                for (const m of body.members) {
+                    tx.insert(schema.comboMembers).values({ id: uuid(), comboId: body.id, modelId: m.modelId, position: m.position, weight: m.weight ?? 1, enabled: m.enabled ?? true }).run();
+                }
+            });
+        }
+        else {
+            db.update(schema.combos).set(update).where(eq(schema.combos.id, body.id)).run();
         }
         // Invalidate cache for this combo
         const { invalidateCacheFor } = await import('../../caching/store.js');

package/dist/server/routes/admin/models.js

@@ -14,11 +14,24 @@ const ModelUpdate = z.object({
     displayName: z.string().min(1).max(128).optional(),
     enabled: z.boolean().optional(),
     upstreamAvailable: z.boolean().optional(),
-    capabilities: z.record(z.any()).optional(),
+    // Values may be true / false / null. null clears the key back to "unknown",
+    // which the router treats as "not verified" rather than "unsupported".
+    capabilities: z.record(z.union([z.boolean(), z.null()])).optional(),
     cacheOverrideEnabled: z.boolean().nullable().optional(),
     maxContextTokens: z.number().int().min(1).nullable().optional(),
     maxOutputTokens: z.number().int().min(1).nullable().optional(),
 });
+/** Apply an admin capability override. `null` removes the key (= unknown). */
+function applyCapabilityOverrides(stored, patch) {
+    const out = { ...stored };
+    for (const [k, v] of Object.entries(patch)) {
+        if (v === null)
+            delete out[k];
+        else
+            out[k] = v;
+    }
+    return out;
+}
 export async function registerModelRoutes(app) {
     app.addHook('preHandler', requireAdminAuth);
     app.get('/api/admin/models', async (req) => {
@@ -54,6 +67,7 @@ export async function registerModelRoutes(app) {
             enabled: m.enabled,
             upstreamAvailable: m.upstreamAvailable,
             capabilities: safeJson(m.capabilitiesJson),
+            discoveredCapabilities: m.discoveredMetadataJson ? safeJson(m.discoveredMetadataJson) : null,
             maxContextTokens: m.maxContextTokens,
             maxOutputTokens: m.maxOutputTokens,
             lastSeenUpstreamAt: m.lastSeenUpstreamAt,
@@ -69,30 +83,13 @@ export async function registerModelRoutes(app) {
             throw new GatewayError('invalid_request_error', 'Provider not found', { status: 404 });
         // Fetch discovered model metadata fresh (so import uses current discovery data)
         // For simplicity: re-discover and match by upstream id.
-        const { discoverProviderModels } = await import('../../providers/index.js');
+        const { discoverProviderModels, mergeDiscoveredCapabilities } = await import('../../providers/index.js');
         const { decryptSecret, decryptCustomHeaders } = await import('../../auth/crypto.js');
-        const { codexModels } = await import('../../providers/codex.js');
-        const { getCodexAccountById, listCodexAccountSummaries } = await import('../../db/repositories/codex-accounts.js');
-        const { withCodexCredentials } = await import('../../providers/codex-refresh.js');
+        const apiKey = decryptSecret({ ciphertext: provider.encryptedApiKey, nonce: provider.apiKeyNonce, version: provider.apiKeyVersion });
+        const headers = decryptCustomHeaders(provider.customHeadersEncrypted && provider.customHeadersNonce ? { ciphertext: provider.customHeadersEncrypted, nonce: provider.customHeadersNonce, version: 1 } : null);
         let discovered;
         try {
-            if (provider.type === 'codex') {
-                const summary = listCodexAccountSummaries(provider.id).find((candidate) => candidate.enabled && candidate.healthState !== 'down');
-                const account = summary ? getCodexAccountById(summary.id) : null;
-                if (!account)
-                    throw new GatewayError('authentication_error', 'No eligible Codex account is configured', { status: 503 });
-                discovered = await withCodexCredentials(account.id, (credentials) => codexModels({
-                    baseUrl: provider.baseUrl, accountId: account.chatgptAccountId, accessToken: credentials.accessToken,
-                    accountRecordId: account.id, customHeaders: {}, totalTimeoutMs: Math.min(provider.totalTimeoutMs, 30000),
-                }));
-            }
-            else {
-                if (!provider.encryptedApiKey || !provider.apiKeyNonce)
-                    throw new GatewayError('invalid_request_error', 'Provider credentials are missing', { status: 501 });
-                const apiKey = decryptSecret({ ciphertext: provider.encryptedApiKey, nonce: provider.apiKeyNonce, version: provider.apiKeyVersion });
-                const headers = decryptCustomHeaders(provider.customHeadersEncrypted && provider.customHeadersNonce ? { ciphertext: provider.customHeadersEncrypted, nonce: provider.customHeadersNonce, version: 1 } : null);
-                discovered = await discoverProviderModels({ type: provider.type, baseUrl: provider.baseUrl, apiKey, customHeaders: headers, connectTimeoutMs: 5000, totalTimeoutMs: 30000 });
-            }
+            discovered = await discoverProviderModels({ type: provider.type, baseUrl: provider.baseUrl, apiKey, customHeaders: headers, connectTimeoutMs: 5000, totalTimeoutMs: 30000 });
         }
         catch {
             discovered = [];
@@ -105,7 +102,19 @@ export async function registerModelRoutes(app) {
             const disc = discMap.get(upstreamId);
             const caps = disc?.capabilities ?? { chat: true, streaming: true, tools: true };
             if (existing) {
-                db.update(schema.models).set({ upstreamAvailable: true, lastSeenUpstreamAt: now, updatedAt: now }).where(eq(schema.models.id, existing.id)).run();
+                // Refresh capabilities so stale discoveries (e.g. a wrong
+                // `image_input: false`) heal on re-import, while admin edits survive.
+                const merged = mergeDiscoveredCapabilities(safeJson(existing.capabilitiesJson), existing.discoveredMetadataJson ? safeJson(existing.discoveredMetadataJson) : null, caps);
+                db.update(schema.models)
+                    .set({
+                    upstreamAvailable: true,
+                    lastSeenUpstreamAt: now,
+                    updatedAt: now,
+                    capabilitiesJson: JSON.stringify(merged.capabilities),
+                    discoveredMetadataJson: JSON.stringify(merged.baseline),
+                })
+                    .where(eq(schema.models.id, existing.id))
+                    .run();
                 continue;
             }
             const publicModelId = `${provider.slug}/${upstreamId}`;
@@ -118,6 +127,7 @@ export async function registerModelRoutes(app) {
                 enabled: true,
                 upstreamAvailable: true,
                 capabilitiesJson: JSON.stringify(caps),
+                discoveredMetadataJson: JSON.stringify(caps),
                 maxContextTokens: typeof caps.max_context_tokens === 'number' ? caps.max_context_tokens : null,
                 maxOutputTokens: typeof caps.max_output_tokens === 'number' ? caps.max_output_tokens : null,
                 lastSeenUpstreamAt: now,
@@ -141,7 +151,7 @@ export async function registerModelRoutes(app) {
         if (body.upstreamAvailable !== undefined)
             update.upstreamAvailable = body.upstreamAvailable;
         if (body.capabilities) {
-            const merged = { ...safeJson(m.capabilitiesJson), ...body.capabilities };
+            const merged = applyCapabilityOverrides(safeJson(m.capabilitiesJson), body.capabilities);
             update.capabilitiesJson = JSON.stringify(merged);
             if (typeof merged.max_context_tokens === 'number')
                 update.maxContextTokens = merged.max_context_tokens;

package/dist/server/routes/admin/providers.js

@@ -1,22 +1,18 @@
 import { z } from 'zod';
 import { sql, eq } from 'drizzle-orm';
-import { getDb, getRawDb, schema } from '../../db/index.js';
+import { getDb, schema } from '../../db/index.js';
 import { requireAdminAuth } from '../../auth/middleware.js';
 import { recordAudit } from '../../db/repositories/audit.js';
 import { encryptSecret, decryptSecret, encryptCustomHeaders, decryptCustomHeaders, isMasterKeyConfigured } from '../../auth/crypto.js';
 import { uuid, slugify } from '../../auth/ids.js';
 import { GatewayError } from '../../errors.js';
 import { probeProvider, discoverProviderModels } from '../../providers/index.js';
-import { probeCodex, codexModels } from '../../providers/codex.js';
-import { listCodexAccountSummaries } from '../../db/repositories/codex-accounts.js';
-import { codexCredentialError, withCodexCredentials } from '../../providers/codex-refresh.js';
-import { redactString } from '../../security/redact.js';
 const ProviderCreate = z.object({
     name: z.string().min(1).max(128),
     slug: z.string().min(1).max(64).optional(),
-    type: z.enum(['openai', 'anthropic', 'codex']),
+    type: z.enum(['openai', 'anthropic']),
     baseUrl: z.string().url().max(512),
-    apiKey: z.string().min(1).max(20000).optional(),
+    apiKey: z.string().min(1).max(512),
     customHeaders: z.record(z.string(), z.string()).optional(),
     enabled: z.boolean().optional(),
     connectTimeoutMs: z.number().int().min(100).max(60000).optional(),
@@ -64,16 +60,13 @@ export async function registerProviderRoutes(app) {
     });
     app.post('/api/admin/providers', async (req) => {
         const body = ProviderCreate.parse(req.body);
-        if (body.type !== 'codex' && !body.apiKey) {
-            throw new GatewayError('invalid_request_error', 'API key is required for this provider type', { status: 400 });
-        }
         requireMasterKey(); // Need master key to encrypt new credentials
         const db = getDb();
         const slug = body.slug ? slugify(body.slug) : slugify(body.name);
         const dup = db.select().from(schema.providers).where(eq(schema.providers.slug, slug)).get();
         if (dup)
             throw new GatewayError('invalid_request_error', `Provider slug '${slug}' is already in use`, { status: 400 });
-        const enc = body.apiKey ? encryptSecret(body.apiKey) : null;
+        const enc = encryptSecret(body.apiKey);
         const headersEnc = body.customHeaders ? encryptCustomHeaders(body.customHeaders) : null;
         const id = uuid();
         db.insert(schema.providers).values({
@@ -82,9 +75,9 @@ export async function registerProviderRoutes(app) {
             slug,
             type: body.type,
             baseUrl: body.baseUrl,
-            encryptedApiKey: enc?.ciphertext ?? null,
-            apiKeyNonce: enc?.nonce ?? null,
-            apiKeyVersion: enc?.version ?? 1,
+            encryptedApiKey: enc.ciphertext,
+            apiKeyNonce: enc.nonce,
+            apiKeyVersion: enc.version,
             customHeadersEncrypted: headersEnc?.ciphertext ?? null,
             customHeadersNonce: headersEnc?.nonce ?? null,
             enabled: body.enabled ?? true,
@@ -157,21 +150,9 @@ export async function registerProviderRoutes(app) {
             recordAudit({ action: 'provider.soft_disable', success: true, targetType: 'provider', targetId: id, targetName: p.name, ip: req.ip });
             return { ok: true, softDisabled: true };
         }
-        // A Codex provider owns its account pool. codex_accounts.provider_id is ON DELETE RESTRICT,
-        // so the accounts must go in the same transaction or the delete fails with a raw SQLite
-        // constraint error (which surfaces as an opaque 500 "Gateway error").
-        let codexAccountsDeleted = 0;
-        try {
-            getRawDb().transaction(() => {
-                codexAccountsDeleted = getRawDb().prepare('DELETE FROM codex_accounts WHERE provider_id=?').run(id).changes;
-                db.delete(schema.providers).where(eq(schema.providers.id, id)).run();
-            })();
-        }
-        catch (error) {
-            throw new GatewayError('invalid_request_error', 'Provider is still referenced and cannot be deleted', { status: 409, cause: error });
-        }
-        recordAudit({ action: 'provider.delete', success: true, targetType: 'provider', targetId: id, targetName: p.name, ip: req.ip, metadata: { codexAccountsDeleted } });
-        return { ok: true, codexAccountsDeleted };
+        db.delete(schema.providers).where(eq(schema.providers.id, id)).run();
+        recordAudit({ action: 'provider.delete', success: true, targetType: 'provider', targetId: id, targetName: p.name, ip: req.ip });
+        return { ok: true };
     });
     app.post('/api/admin/providers/:id/test', async (req) => {
         const { id } = req.params;
@@ -179,18 +160,6 @@ export async function registerProviderRoutes(app) {
         const p = db.select().from(schema.providers).where(eq(schema.providers.id, id)).get();
         if (!p)
             throw new GatewayError('invalid_request_error', 'Provider not found', { status: 404 });
-        if (p.type === 'codex') {
-            const account = listCodexAccountSummaries(p.id).find((candidate) => candidate.enabled && candidate.healthState !== 'down');
-            if (!account)
-                throw new GatewayError('authentication_error', 'No eligible Codex account is configured', { status: 503 });
-            const row = getRawDb().prepare('SELECT chatgpt_account_id AS accountId FROM codex_accounts WHERE id=?').get(account.id);
-            const result = await withCodexCredentials(account.id, async (credentials) => probeCodex({ baseUrl: p.baseUrl, accountId: row?.accountId ?? '', accessToken: credentials.accessToken, customHeaders: {}, totalTimeoutMs: Math.min(p.totalTimeoutMs, 20000) })).catch((error) => { throw codexCredentialError(error); });
-            db.update(schema.providers).set({ healthState: result.ok ? 'healthy' : 'down', updatedAt: new Date().toISOString() }).where(eq(schema.providers.id, id)).run();
-            recordAudit({ action: 'provider.test', success: result.ok, targetType: 'provider', targetId: id, targetName: p.name, ip: req.ip, metadata: { detail: redactString(result.detail) } });
-            return { ...result, detail: redactString(result.detail) };
-        }
-        if (!p.encryptedApiKey || !p.apiKeyNonce)
-            throw new GatewayError('invalid_request_error', 'Provider credentials are missing', { status: 501 });
         const apiKey = decryptSecret({ ciphertext: p.encryptedApiKey, nonce: p.apiKeyNonce, version: p.apiKeyVersion });
         const headers = decryptCustomHeaders(p.customHeadersEncrypted && p.customHeadersNonce ? { ciphertext: p.customHeadersEncrypted, nonce: p.customHeadersNonce, version: 1 } : null);
         const result = await probeProvider({
@@ -216,28 +185,16 @@ export async function registerProviderRoutes(app) {
         const p = db.select().from(schema.providers).where(eq(schema.providers.id, id)).get();
         if (!p)
             throw new GatewayError('invalid_request_error', 'Provider not found', { status: 404 });
-        let discovered;
-        if (p.type === 'codex') {
-            const account = listCodexAccountSummaries(p.id).find((candidate) => candidate.enabled && candidate.healthState !== 'down');
-            if (!account)
-                throw new GatewayError('authentication_error', 'No eligible Codex account is configured', { status: 503 });
-            const row = getRawDb().prepare('SELECT chatgpt_account_id AS accountId FROM codex_accounts WHERE id=?').get(account.id);
-            discovered = await withCodexCredentials(account.id, async (credentials) => codexModels({ baseUrl: p.baseUrl, accountId: row?.accountId ?? '', accessToken: credentials.accessToken, customHeaders: {}, totalTimeoutMs: 30000 })).catch((error) => { throw codexCredentialError(error); });
-        }
-        else {
-            if (!p.encryptedApiKey || !p.apiKeyNonce)
-                throw new GatewayError('invalid_request_error', 'Provider credentials are missing', { status: 501 });
-            const apiKey = decryptSecret({ ciphertext: p.encryptedApiKey, nonce: p.apiKeyNonce, version: p.apiKeyVersion });
-            const headers = decryptCustomHeaders(p.customHeadersEncrypted && p.customHeadersNonce ? { ciphertext: p.customHeadersEncrypted, nonce: p.customHeadersNonce, version: 1 } : null);
-            discovered = await discoverProviderModels({
-                type: p.type,
-                baseUrl: p.baseUrl,
-                apiKey,
-                customHeaders: headers,
-                connectTimeoutMs: 5000,
-                totalTimeoutMs: 30000,
-            });
-        }
+        const apiKey = decryptSecret({ ciphertext: p.encryptedApiKey, nonce: p.apiKeyNonce, version: p.apiKeyVersion });
+        const headers = decryptCustomHeaders(p.customHeadersEncrypted && p.customHeadersNonce ? { ciphertext: p.customHeadersEncrypted, nonce: p.customHeadersNonce, version: 1 } : null);
+        const discovered = await discoverProviderModels({
+            type: p.type,
+            baseUrl: p.baseUrl,
+            apiKey,
+            customHeaders: headers,
+            connectTimeoutMs: 5000,
+            totalTimeoutMs: 30000,
+        });
         const existing = db
             .select()
             .from(schema.models)

package/dist/server/routes/admin/requests.js

@@ -230,7 +230,6 @@ export async function registerRequestRoutes(app) {
                 providerName: providerMap.get(a.providerId)?.name ?? '',
                 modelId: a.modelId,
                 modelPublicId: modelMap.get(a.modelId)?.publicModelId ?? '',
-                codexAccountId: a.codexAccountId,
                 startedAt: a.startedAt,
                 completedAt: a.completedAt,
                 statusCode: a.statusCode,

package/dist/server/routes/admin.js

@@ -1,5 +1,4 @@
 // Admin API routes (mounted at /api/admin/*). All require admin session auth.
-import { requireAdminAuth, requireAdminCsrf } from '../auth/middleware.js';
 import { registerSetupRoutes } from './admin/setup.js';
 import { registerAuthRoutes } from './admin/auth.js';
 import { registerProviderRoutes } from './admin/providers.js';
@@ -13,7 +12,6 @@ import { registerAuditRoutes } from './admin/audit.js';
 import { registerSettingsRoutes } from './admin/settings.js';
 import { registerBackupRoutes } from './admin/backup.js';
 import { registerDashboardRoutes } from './admin/dashboard.js';
-import { registerCodexRoutes, registerCodexOAuthCallbackRoute } from './admin/codex.js';
 export async function registerAdminRoutes(app) {
     // Setup routes are always reachable (used on first run).
     await app.register(async (instance) => {
@@ -24,17 +22,8 @@ export async function registerAdminRoutes(app) {
     await app.register(async (instance) => {
         await registerAuthRoutes(instance);
     });
-    // The Codex OAuth loopback callback is hit by the browser's redirect, so it is public too.
-    await app.register(async (instance) => {
-        await registerCodexOAuthCallbackRoute(instance);
-    });
     // Authenticated admin routes
     await app.register(async (instance) => {
-        instance.addHook('preHandler', requireAdminAuth);
-        instance.addHook('preHandler', async (req) => {
-            if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(req.method))
-                await requireAdminCsrf(req);
-        });
         await registerProviderRoutes(instance);
         await registerModelRoutes(instance);
         await registerComboRoutes(instance);
@@ -46,6 +35,5 @@ export async function registerAdminRoutes(app) {
         await registerSettingsRoutes(instance);
         await registerBackupRoutes(instance);
         await registerDashboardRoutes(instance);
-        await registerCodexRoutes(instance);
     });
 }

package/dist/server/routes/gateway/anthropic.js

@@ -3,7 +3,7 @@ import { z } from 'zod';
 import { authenticateGatewayKey } from '../../auth/api-key.js';
 import { resolveClientIp } from '../../util/client-ip.js';
 import { anthropicToCanonical } from '../../protocols/anthropic.js';
-import { GatewayError, toAnthropicError } from '../../errors.js';
+import { GatewayError, toAnthropicError, outcomeError } from '../../errors.js';
 import { GatewayRunner } from '../../gateway/runner.js';
 import { uuid } from '../../auth/ids.js';
 import { lifecycle, debugHttp, debugBody, getDebugFlags, summarizeMessages, summarizeTools, summarizeHeaders, sanitizeJson, truncate } from '../../logging/debug.js';
@@ -58,7 +58,7 @@ export async function registerAnthropicRoutes(app) {
                     return reply;
                 }
                 if (!outcome.success) {
-                    const g = new GatewayError(outcome.errorType ?? 'gateway_error', outcome.errorMessage ?? 'Gateway error', { status: outcome.httpStatus });
+                    const g = outcomeError(outcome);
                     reply.code(outcome.httpStatus).send(toAnthropicError(g, ctx.requestId));
                     return;
                 }
@@ -66,7 +66,7 @@ export async function registerAnthropicRoutes(app) {
                 return;
             }
             if (!outcome.success) {
-                const g = new GatewayError(outcome.errorType ?? 'gateway_error', outcome.errorMessage ?? 'Gateway error', { status: outcome.httpStatus });
+                const g = outcomeError(outcome);
                 lifecycle(requestId, 'DONE', [`status=${outcome.httpStatus} durationMs=${outcome.latencyMs} error=true type=${g.type}`]);
                 reply.code(outcome.httpStatus).send(toAnthropicError(g, ctx.requestId));
                 return;

package/dist/server/routes/gateway/openai.js

@@ -5,7 +5,7 @@ import { getDb, schema } from '../../db/index.js';
 import { authenticateGatewayKey } from '../../auth/api-key.js';
 import { resolveClientIp } from '../../util/client-ip.js';
 import { openAIToCanonical, openAIModelList } from '../../protocols/canonical.js';
-import { GatewayError, toOpenAIError } from '../../errors.js';
+import { GatewayError, toOpenAIError, outcomeError } from '../../errors.js';
 import { GatewayRunner } from '../../gateway/runner.js';
 import { uuid } from '../../auth/ids.js';
 import { lifecycle, debugHttp, debugBody, getDebugFlags, summarizeBody, summarizeMessages, summarizeTools, summarizeHeaders, sanitizeJson, truncate } from '../../logging/debug.js';
@@ -86,7 +86,7 @@ export async function registerOpenAIRoutes(app) {
                 // the client should get a regular protocol error instead of a dangling
                 // stream.
                 if (!outcome.success) {
-                    const g = new GatewayError(outcome.errorType ?? 'gateway_error', outcome.errorMessage ?? 'Gateway error', { status: outcome.httpStatus });
+                    const g = outcomeError(outcome);
                     reply.code(outcome.httpStatus).send(toOpenAIError(g, ctx.requestId));
                     return;
                 }
@@ -95,7 +95,7 @@ export async function registerOpenAIRoutes(app) {
                 return;
             }
             if (!outcome.success) {
-                const g = new GatewayError(outcome.errorType ?? 'gateway_error', outcome.errorMessage ?? 'Gateway error', { status: outcome.httpStatus });
+                const g = outcomeError(outcome);
                 lifecycle(requestId, 'DONE', [`status=${outcome.httpStatus} durationMs=${outcome.latencyMs} error=true type=${g.type}`]);
                 reply.code(outcome.httpStatus).send(toOpenAIError(g, ctx.requestId));
                 return;
@@ -176,7 +176,7 @@ export async function registerOpenAIRoutes(app) {
                     return reply;
                 }
                 if (!outcome.success) {
-                    const g = new GatewayError(outcome.errorType ?? 'gateway_error', outcome.errorMessage ?? 'Gateway error', { status: outcome.httpStatus });
+                    const g = outcomeError(outcome);
                     reply.code(outcome.httpStatus).send(toOpenAIError(g, ctx.requestId));
                     return;
                 }
@@ -184,7 +184,7 @@ export async function registerOpenAIRoutes(app) {
                 return;
             }
             if (!outcome.success) {
-                const g = new GatewayError(outcome.errorType ?? 'gateway_error', outcome.errorMessage ?? 'Gateway error', { status: outcome.httpStatus });
+                const g = outcomeError(outcome);
                 reply.code(outcome.httpStatus).send(toOpenAIError(g, ctx.requestId));
                 return;
             }