feat(shadow-call): add per-source interception toggles

docs-site/src/content/docs/reference/configuration/server.md

@@ -47,7 +47,7 @@ runs helper features around provider requests.
 | `resetCreditAutoRedeem?` | `{ enabled?: boolean; leadTimeMinutes?: number }` | off | Opt-in: redeem the main Codex account's soonest-expiring reset credit `leadTimeMinutes` (1–60, default 10) before it expires. Every attempt re-reads the upstream credit list first and skips when the credit is gone (for example, redeemed by hand); the `redeem_request_id` is journaled in `$OPENCODEX_HOME/reset-credit-auto-redeem.json` before the call so a crash replays the same idempotent request instead of spending a second credit. Servers sharing this configuration directory coordinate reservations and settlements so one process does not replace another's request record. Logs carry a hashed account key only. |
 | `syncResumeHistory?` | `boolean` | `true` | Reversible Codex App history compatibility. Original metadata is backed up and restored by `ocx stop` / `ocx restore`. |
 | `spendPoolAliases?` | `Record<string, string>` | unset | Explicit historical salted pool-alias to canonical provider mappings. Keep this key at the top level, outside `spend`. See [Historical pool continuity](#historical-pool-continuity). |
-| `shadowCallIntercept?` | `{ enabled?: boolean; model?: string; sourceModels?: string[] }` | off | Redirect recognized Codex helper/shadow calls to a chosen model while preserving the request's configured reasoning effort. The default source prefixes are `gpt-6-luna` and `gpt-5.6-luna`; older clients through 0.144.x used `gpt-5.4-mini`, which `sourceModels` can restore. |
+| `shadowCallIntercept?` | `{ enabled?: boolean; model?: string; sourceModels?: string[] }` | off | Redirect recognized Codex helper/shadow calls to a chosen model while preserving the request's configured reasoning effort. The default source prefixes are `gpt-6-luna` and `gpt-5.6-luna`. The dashboard exposes one toggle per source and keeps both Terra generations (`gpt-6.1-terra` and `gpt-5.6-terra`) and the retired `gpt-5.4-mini` helper off until selected. At least one source must stay enabled; disable the main switch to stop all shadow calls. |
 | `memoryModels?` | `{ extract?: { model: string; reasoningEffort?: string }; consolidation?: { model: string; reasoningEffort?: string } }` | off | Route Codex's two memory phases to a chosen model, with an optional reasoning effort per phase. See [Memory routing](#memory-routing). |
 | `webSearchSidecar?` | `OcxWebSearchSidecarConfig` | on when usable | Web-search sidecar options. |
 | `visionSidecar?` | `OcxVisionSidecarConfig` | on when usable | Image-description sidecar options. |
@@ -932,10 +932,25 @@ proxy after editing `config.json` by hand. Dashboard saves apply immediately.
 
 Codex uses small helper models for tasks such as titles and commit messages. Enable
 `shadowCallIntercept` to redirect recognized source-model prefixes to another configured model. The
-replacement keeps the request's configured reasoning effort. Set `sourceModels` only when a client
-uses different helper ids. A non-empty `sourceModels` replaces the default prefixes instead of
-extending them, so include `gpt-6-luna` (and `gpt-5.6-luna` for 0.145.0-0.153.x clients) in the
-list when current clients should still be intercepted.
+replacement keeps the request's configured reasoning effort. The dashboard lists the sources the
+runtime supports and persists one switch per source through
+`PUT /api/shadow-call-settings`; `GET` returns both the active `sourceModels` and that
+`sourceModelOptions` inventory. A non-empty `sourceModels` replaces the default prefixes instead of
+extending them, so include `gpt-6-luna` (and `gpt-5.6-luna` for 0.145.0-0.153.x clients) when
+current clients should still be intercepted. The API rejects an empty, duplicate, whitespace-bearing,
+or provider-qualified source prefix, caps the list at 32 prefixes of 128 characters each, and it
+refuses a target that would intersect a selected source.
+A rejected source list returns `code: "shadow_call_source_invalid"` and a conflicting target
+returns `code: "shadow_call_target_invalid"`, so the dashboard can show the matching message
+instead of treating every `400` or HTTP error as a network failure.
+At least one source stays active; use the main switch to stop every shadow call.
+Memory consolidation is separate: Codex asks for Terra there, and
+`memoryModels.consolidation` controls that phase. Terra is also a normal foreground and subagent
+model, so its source toggles stay off by default. Selecting the active Terra generation routes
+consolidation through the shadow target only while no consolidation model is configured; a
+configured Memory-Routing phase still wins. The dashboard keeps both `gpt-6.1-terra` and
+`gpt-5.6-terra` in the source inventory and labels them as `Memory` rather than silently omitting
+them.
 Matching bare model ids are eligible for interception, but explicit user turns keep their selected
 model: `x-codex-turn-metadata` must contain both `request_kind: "turn"` and `thread_source: "user"`.
 Spawned children also keep their model, identified by the `x-openai-subagent: collab_spawn` connection header (HTTP request or WebSocket

docs-site/src/content/docs/reference/management-api.md

@@ -280,7 +280,7 @@ See [Codex prompt layers](/guides/codex-prompt/) for the layer model and the key
 | `POST /api/update/run` | Asynchronously check a fresh package version, then start an update job, optionally followed by restart | 400 invalid body; job-specific conflict/error status |
 | `GET /api/update/status` | Poll an update job by id | 404 unknown job |
 | `GET, PUT /api/sidecar-settings` | Read or update web-search and vision sidecar model/backend settings | 400 invalid shape, backend, or limit |
-| `GET, PUT /api/shadow-call-settings` | Read or update shadow-call interception settings | 400 invalid shape or value |
+| `GET, PUT /api/shadow-call-settings` | Read or update shadow-call interception settings, including `sourceModels`; GET also returns the runtime-owned `sourceModelOptions` inventory | 400 invalid shape or value, including an empty, duplicate, whitespace-bearing, or provider-qualified source prefix, or more than 32 prefixes / 128 characters per prefix; source-list failures carry `code: shadow_call_source_invalid`, target conflicts `code: shadow_call_target_invalid` |
 
 ### Logs, usage, and storage
 

gui/src/i18n/de.ts

@@ -580,13 +580,27 @@ export const de: Record<TKey, string> = {
   "memoryModels.saved": "Memory-Einstellungen gespeichert.",
   "memoryModels.saveFailed": "Speichern fehlgeschlagen. Deine Änderungen stehen noch da; versuch es erneut.",
   "dash.shadowCallIntercept": "Shadow-Call-Abfangen",
-  "dash.shadowCallInterceptHint": "Fängt die Hintergrund-Hilfsaufrufe der Codex-App ({models}) ab und leitet sie an das gewählte Modell um.",
-  "dash.shadowCallWarning": "⚠ Bei Aktivierung werden ALLE Anfragen an {models} durch das gewählte Modell ersetzt.",
+  "shadowCall.memoryLabel": "Memory: Terra",
+  "shadowCall.sourceCoveredShort": "Abgedeckt durch {prefix}",
+  "shadowCall.sourceRequired": "Muss aktiv bleiben",
+  "shadowCall.sources": "Abgefangene Quellen",
+  "shadowCall.sourceHelper": "Hilfsmodell",
+  "shadowCall.sourceMemory": "Memory",
+  "shadowCall.sourceLegacy": "Legacy",
+  "shadowCall.sourceCustom": "Benutzerdefiniert",
+  "shadowCall.sourceHint": "Nur aktivierte Quellen werden abgefangen. Mindestens eine muss aktiv bleiben; der Hauptschalter schaltet das Abfangen aller Shadow-Calls aus. Memory-Routing hat bei konfigurierter Konsolidierung weiterhin Vorrang.",
+  "shadowCall.sourceCovered": "Wird vom benutzerdefinierten Präfix {prefix} abgedeckt. Entferne oder verenge ihn in config.json, um diese Quelle separat zu schalten.",
+  "shadowCall.sourceLastRequired": "Mindestens eine Quelle muss aktiv bleiben. Der Hauptschalter schaltet das Abfangen aller Shadow-Calls aus.",
+  "dash.shadowCallInterceptHint": "Fängt die Hintergrund-Hilfsaufrufe der Codex-App für Titel, Commit-Nachrichten und Skill-Orchestrierung ab. Wähle unten die Quellmodelle. Die Memory-Konsolidierung läuft normalerweise mit Terra und folgt bei Konfiguration dem Memory-Routing.",
+  "dash.shadowCallWarning": "⚠ Bei Aktivierung werden Anfragen an jede ausgewählte Quelle ({models}) durch das gewählte Modell ersetzt. Terra ist Opt-in; bei der Konsolidierung hat Memory-Routing weiterhin Vorrang.",
   "dash.shadowCallOriginal": "Original",
   "dash.shadowCallModel": "Ersatzmodell",
-  "dash.shadowCallTooltip": "Die Codex-App ruft im Hintergrund ein Hilfsmodell für Titelgenerierung, Commit-Nachrichten und Skill-Orchestrierung auf. Das Modell wechselt zwischen Client-Versionen, daher fängt opencodex diesen Satz ab: {models}.",
+  "dash.shadowCallTooltip": "Die Codex-App ruft im Hintergrund Hilfsmodelle für Titelgenerierung, Commit-Nachrichten und Skill-Orchestrierung auf. Das Modell wechselt zwischen Client-Versionen, daher kann opencodex mehrere Quellen abfangen. Wähle unten jede Quelle aus, die umgeleitet werden soll. Terra ist das Modell für die Memory-Konsolidierung und standardmäßig aus, weil Codex es auch für normale Arbeit wählt; ist ein Konsolidierungsmodell im Memory-Routing gesetzt, gewinnt diese Route. Mindestens eine Quelle muss aktiv bleiben; der Hauptschalter schaltet das Abfangen aller Shadow-Calls aus.",
   "models.shadowCallIntercept": "Shadow-Call-Abfangen",
-  "models.shadowCallInterceptHint": "Fängt die Hintergrund-Hilfsaufrufe der Codex-App ({models}) ab und leitet sie an das gewählte Modell um.",
+  "models.shadowCallInterceptHint": "Fängt die Hintergrund-Hilfsaufrufe der Codex-App für Titel, Commit-Nachrichten und Skill-Orchestrierung ab. Wähle unten die Quellmodelle. Die Memory-Konsolidierung läuft normalerweise mit Terra und folgt bei Konfiguration dem Memory-Routing.",
+  "models.shadowCallSaveFailed": "Shadow-Call-Einstellungen konnten nicht gespeichert werden.",
+  "models.shadowCallTargetInvalid": "Das Ersatzmodell überschneidet sich mit einer aktiven Quelle. Wähle ein anderes Ersatzmodell.",
+  "models.shadowCallSourceInvalid": "Diese Quellenauswahl ist ungültig. Wähle mindestens eine Quelle ohne Leerzeichen oder Provider-Präfix.",
   "models.autoReviewOverride": "Auto-Review-Überschreibung",
   "models.autoReviewOverrideHint": "Legt fest, welches Modell Codex für die automatische Prüfung (Approval-Reviewer) verwendet. Wird beim Katalog-Abgleich auf alle Zeilen angewendet; ein autoReviewModel auf Anbieterebene hat weiterhin Vorrang.",
   "models.autoReviewPending": "Ausstehend",

gui/src/i18n/en.ts

@@ -598,13 +598,27 @@ export const en = {
   "memoryModels.saved": "Memory settings saved.",
   "memoryModels.saveFailed": "Could not save. Your changes are still here; try again.",
   "dash.shadowCallIntercept": "Shadow Call Intercept",
-  "dash.shadowCallInterceptHint": "Intercepts Codex App's background helper calls ({models}) for title generation and commit messages and redirects them to your chosen model.",
-  "dash.shadowCallWarning": "⚠ When enabled, ALL requests for {models} will be replaced with the selected model.",
+  "shadowCall.memoryLabel": "Memory: Terra",
+  "shadowCall.sourceCoveredShort": "Covered by {prefix}",
+  "shadowCall.sourceRequired": "Must stay on",
+  "dash.shadowCallInterceptHint": "Intercepts Codex App's background helper calls for titles, commit messages, and skill orchestration. Choose the source models below. Memory consolidation normally runs on Terra and follows Memory-Routing when configured.",
+  "dash.shadowCallWarning": "⚠ When enabled, requests for every selected source ({models}) are replaced with the chosen model. Terra is opt-in; Memory-Routing still wins for consolidation.",
   "dash.shadowCallOriginal": "Original",
   "dash.shadowCallModel": "Replacement model",
-  "dash.shadowCallTooltip": "Codex App makes background helper calls for thread title generation, commit message generation, and skill orchestration. The helper model changed across client versions, so opencodex intercepts every model in this set: {models}. Enable this to redirect those calls to your chosen model.",
+  "dash.shadowCallTooltip": "Codex App makes background helper calls for thread title generation, commit message generation, and skill orchestration. The helper model changed across client versions, so opencodex can intercept several sources. Select each source you want to redirect below. Terra is the memory-consolidation model and stays off by default because Codex also selects it for ordinary work; when a Memory-Routing consolidation model is configured, that route wins. At least one source must stay enabled; use the main switch to turn off shadow-call interception.",
+  "shadowCall.sources": "Intercepted sources",
+  "shadowCall.sourceHelper": "Helper",
+  "shadowCall.sourceMemory": "Memory",
+  "shadowCall.sourceLegacy": "Legacy",
+  "shadowCall.sourceCustom": "Custom",
+  "shadowCall.sourceHint": "Only enabled sources are intercepted. At least one must stay on; use the main switch to turn off shadow-call interception. Memory-Routing still wins for consolidation when configured.",
+  "shadowCall.sourceCovered": "Covered by the custom prefix {prefix}. Remove or narrow it in config.json to toggle this source separately.",
+  "shadowCall.sourceLastRequired": "At least one source must stay enabled. Use the main switch to turn off shadow-call interception.",
   "models.shadowCallIntercept": "Shadow Call Intercept",
-  "models.shadowCallInterceptHint": "Intercepts Codex App's background helper calls ({models}) for titles and commit messages and redirects them to your chosen model.",
+  "models.shadowCallInterceptHint": "Intercepts Codex App's background helper calls for titles, commit messages, and skill orchestration. Choose the source models below. Memory consolidation normally runs on Terra and follows Memory-Routing when configured.",
+  "models.shadowCallSaveFailed": "Could not save the shadow-call settings.",
+  "models.shadowCallTargetInvalid": "The replacement target overlaps an active source. Choose another replacement model.",
+  "models.shadowCallSourceInvalid": "This source selection is invalid. Choose at least one source without whitespace or a provider prefix.",
   "models.autoReviewOverride": "Auto-review override",
   "models.autoReviewOverrideHint": "Chooses the model Codex uses for auto-review (the approval reviewer). Applied to every catalog row at sync; a provider-scoped autoReviewModel still takes precedence on its own rows.",
   "models.autoReviewPending": "Pending",

gui/src/i18n/fr.ts

@@ -588,13 +588,27 @@ export const fr: Record<TKey, string> = {
   "memoryModels.saved": "Réglages de mémoire enregistrés.",
   "memoryModels.saveFailed": "Échec de l'enregistrement. Vos modifications sont conservées ; réessayez.",
   "dash.shadowCallIntercept": "Interception des appels fantômes",
-  "dash.shadowCallInterceptHint": "Intercepte les appels auxiliaires en arrière-plan de l’application Codex ({models}) pour générer les titres et les messages de commit, puis les redirige vers le modèle choisi.",
-  "dash.shadowCallWarning": "⚠ Lorsque cette option est activée, TOUTES les requêtes destinées à {models} sont remplacées par le modèle sélectionné.",
+  "shadowCall.memoryLabel": "Mémoire : Terra",
+  "shadowCall.sourceCoveredShort": "Couvert par {prefix}",
+  "shadowCall.sourceRequired": "Doit rester actif",
+  "shadowCall.sources": "Sources interceptées",
+  "shadowCall.sourceHelper": "Auxiliaire",
+  "shadowCall.sourceMemory": "Mémoire",
+  "shadowCall.sourceLegacy": "Hérité",
+  "shadowCall.sourceCustom": "Personnalisé",
+  "shadowCall.sourceHint": "Seules les sources activées sont interceptées. Au moins une doit rester active ; utilisez l’interrupteur principal pour désactiver l’interception des appels fantômes. Le routage de la mémoire reste prioritaire pour la consolidation lorsqu’il est configuré.",
+  "shadowCall.sourceCovered": "Couvert par le préfixe personnalisé {prefix}. Supprimez-le ou réduisez-le dans config.json pour activer cette source séparément.",
+  "shadowCall.sourceLastRequired": "Au moins une source doit rester active. Utilisez l’interrupteur principal pour désactiver l’interception des appels fantômes.",
+  "dash.shadowCallInterceptHint": "Intercepte les appels auxiliaires en arrière-plan de l’application Codex pour les titres, les messages de commit et l’orchestration des compétences. Choisissez les modèles sources ci-dessous. La consolidation de la mémoire utilise normalement Terra et suit le routage de la mémoire lorsqu’il est configuré.",
+  "dash.shadowCallWarning": "⚠ Lorsque cette option est activée, les requêtes de chaque source sélectionnée ({models}) sont remplacées par le modèle choisi. Terra est optionnel ; le routage de la mémoire reste prioritaire pour la consolidation.",
   "dash.shadowCallOriginal": "Original",
   "dash.shadowCallModel": "Modèle de remplacement",
-  "dash.shadowCallTooltip": "L’application Codex effectue des appels auxiliaires en arrière-plan pour générer les titres de fils, les messages de commit et orchestrer les compétences. Le modèle auxiliaire ayant changé selon les versions du client, opencodex intercepte tous les modèles de cet ensemble : {models}. Activez cette option pour rediriger ces appels vers le modèle choisi.",
+  "dash.shadowCallTooltip": "L’application Codex effectue des appels auxiliaires en arrière-plan pour générer les titres de fils, les messages de commit et orchestrer les compétences. Le modèle auxiliaire ayant changé selon les versions du client, opencodex peut intercepter plusieurs sources. Sélectionnez ci-dessous chaque source à rediriger. Terra est le modèle de consolidation de la mémoire et reste désactivé par défaut, car Codex le choisit aussi pour le travail ordinaire ; lorsqu’un modèle de consolidation est configuré dans le routage de la mémoire, cette route l’emporte. Au moins une source doit rester active ; utilisez l’interrupteur principal pour désactiver l’interception des appels fantômes.",
   "models.shadowCallIntercept": "Interception des appels fantômes",
-  "models.shadowCallInterceptHint": "Intercepte les appels auxiliaires en arrière-plan de l’application Codex ({models}) pour les titres et les messages de commit, puis les redirige vers le modèle choisi.",
+  "models.shadowCallInterceptHint": "Intercepte les appels auxiliaires en arrière-plan de l’application Codex pour les titres, les messages de commit et l’orchestration des compétences. Choisissez les modèles sources ci-dessous. La consolidation de la mémoire utilise normalement Terra et suit le routage de la mémoire lorsqu’il est configuré.",
+  "models.shadowCallSaveFailed": "Impossible d’enregistrer les paramètres des appels fantômes.",
+  "models.shadowCallTargetInvalid": "Le modèle de remplacement recouvre une source active. Choisissez un autre modèle de remplacement.",
+  "models.shadowCallSourceInvalid": "Cette sélection de sources n’est pas valide. Choisissez au moins une source sans espace ni préfixe de fournisseur.",
   "models.autoReviewOverride": "Remplacement de la revue automatique",
   "models.autoReviewOverrideHint": "Choisit le modèle que Codex utilise pour la revue automatique (le modèle de revue des demandes d'approbation). Appliqué à chaque ligne du catalogue à la synchronisation ; un autoReviewModel défini au niveau du fournisseur reste prioritaire sur ses lignes.",
   "models.autoReviewPending": "En attente",