Notch shows no providers or logs when data-plane auth token is set

[coseung2]

Summary

OCX Notch can render no providers and no request logs on Windows when OPENCODEX_API_AUTH_TOKEN is present but the management API uses the file-backed admin token.

The OCX server remains healthy and authenticated management requests made with the admin token succeed, but Notch receives HTTP 401 from both /api/providers and /api/logs.

Reproduction

1. Run OCX with its normal file-backed management token.
2. Set OPENCODEX_API_AUTH_TOKEN to a different data-plane token.
3. Start OCX Notch.
4. Open the Notch UI.

Actual behavior

• Provider list is empty.
• Request logs are empty.
• Restarting Notch does not help.
• The Notch WinHTTP client receives:
  • /api/providers: HTTP 401, opencodex admin token required
  • /api/logs?tail=10: HTTP 401, opencodex admin token required

Expected behavior

Notch should authenticate management endpoints only with:

• OPENCODEX_ADMIN_AUTH_TOKEN, when explicitly configured; or
• the file-backed admin-api-token.

OPENCODEX_API_AUTH_TOKEN is a data-plane credential and must not override the management token.

Root cause

packages/ocx-notch/src/api.rs treats both OPENCODEX_ADMIN_AUTH_TOKEN and OPENCODEX_API_AUTH_TOKEN as management credentials, returning the first non-empty value. On machines where only the legacy data-plane variable is set, Notch sends the wrong credential to management endpoints.

This explains why the issue is machine-dependent: systems without that environment variable correctly fall back to the admin token file.

Proposed fix

• Read only OPENCODEX_ADMIN_AUTH_TOKEN as an environment-provided management credential.
• Otherwise load the file-backed admin token.
• Send it through X-OpenCodex-API-Key.
• Retry provider fetches quickly after authentication failures instead of leaving the Notch blank for the full slow polling interval.

Verified locally

Using the exact Notch WinHTTP request path after the fix:

• providers: 5 returned
• logs: 10 returned
• Notch Rust tests: 55 passed

Observed with OCX 2.8.0-cs.12 on Windows.

[github-actions]

_{Automated translation bookkeeping — detected language: unknown.}