@bitkyc08/opencodex 2.10.0 → 2.10.1

package/src/codex/account-lifecycle.ts

@@ -5,7 +5,7 @@ import { MAIN_CODEX_ACCOUNT_ID, setMainAccountPlan } from "./main-account";
 import { clearAccountQuota } from "./quota";
 import { clearCodexUpstreamHealthForAccount, clearThreadAccountMapForAccount } from "./routing";
 import { invalidateCodexWebSocketsForAccount } from "./websocket-registry";
-import { clearMainAccountInfoCache } from "./main-account-cache";
+import { clearMainAccountCredentialPresence, clearMainAccountInfoCache } from "./main-account-cache";
 import { forgetCodexAccountPause } from "./account-pause";
 import type { OcxConfig } from "../types";
 
@@ -16,7 +16,16 @@ export function purgeCodexAccountRuntimeState(accountId: string): void {
   clearAccountQuota(accountId);
   clearThreadAccountMapForAccount(accountId);
   clearCodexUpstreamHealthForAccount(accountId);
-  if (accountId === MAIN_CODEX_ACCOUNT_ID) clearMainAccountInfoCache();
+  if (accountId === MAIN_CODEX_ACCOUNT_ID) {
+    clearMainAccountInfoCache();
+    clearMainAccountCredentialPresence();
+  }
+}
+
+function purgeMainCodexAccountRuntimeState(): void {
+  purgeCodexAccountRuntimeState(MAIN_CODEX_ACCOUNT_ID);
+  setMainAccountPlan(null);
+  invalidateCodexWebSocketsForAccount(MAIN_CODEX_ACCOUNT_ID);
 }
 
 /**
@@ -34,14 +43,30 @@ export function reconcileMainCodexAccountRuntimeState(): boolean {
   observedMainChatgptAccountId = currentAccountId;
   if (previousAccountId === undefined || previousAccountId === currentAccountId) return false;
 
-  purgeCodexAccountRuntimeState(MAIN_CODEX_ACCOUNT_ID);
-  setMainAccountPlan(null);
-  invalidateCodexWebSocketsForAccount(MAIN_CODEX_ACCOUNT_ID);
+  purgeMainCodexAccountRuntimeState();
+  return true;
+}
+
+/**
+ * Apply a transaction-confirmed physical native-login change without waiting for
+ * a later auth.json observation. The caller owns credential commit/rollback.
+ */
+export function applyConfirmedMainCodexAccountTransition(
+  fromAccountId: string,
+  toAccountId: string,
+): boolean {
+  if (!fromAccountId || !toAccountId || fromAccountId === toAccountId) {
+    if (toAccountId) observedMainChatgptAccountId = toAccountId;
+    return false;
+  }
+  observedMainChatgptAccountId = toAccountId;
+  purgeMainCodexAccountRuntimeState();
   return true;
 }
 
 export function resetMainCodexAccountIdentityTrackingForTests(): void {
   observedMainChatgptAccountId = undefined;
+  clearMainAccountCredentialPresence();
 }
 
 export function deleteCodexAccount(runtimeConfig: OcxConfig, accountId: string): void {

package/src/codex/account-usability.ts

@@ -3,14 +3,34 @@ import { isAccountNeedsReauth } from "./account-runtime-state";
 import { MAIN_CODEX_ACCOUNT_ID, isMainAccountTokenLive } from "./main-account";
 import { hasLegacyMainCodexPoolAccount, isSelectableCodexPoolAccount } from "./account-id";
 import type { OcxConfig } from "../types";
+import { isNativeMainTrafficBlocked } from "./native-profile-startup";
 
-export function isCodexAccountUsable(config: OcxConfig, accountId: string): boolean {
+export interface CodexAccountUsabilityOptions {
+  /** Route using cached runtime state only; the caller must reject selected main before auth. */
+  nativeMainSelectionOnly?: boolean;
+  /** Test seam for proving whether routing attempted a physical native-token read. */
+  isMainAccountTokenLive?: typeof isMainAccountTokenLive;
+}
+
+export function isCodexAccountUsable(
+  config: OcxConfig,
+  accountId: string,
+  options: CodexAccountUsabilityOptions = {},
+): boolean {
   if (accountId === MAIN_CODEX_ACCOUNT_ID) {
+    // Startup recovery owns the physical auth/vault boundary. Never parse or select
+    // native __main__ while an encrypted switch journal is pending or inconclusive.
+    if (!options.nativeMainSelectionOnly && isNativeMainTrafficBlocked()) return false;
     // A legacy pool row with the sentinel makes an active `__main__` ambiguous.
     // Fail closed until the authenticated compatibility-delete path removes it.
     if (hasLegacyMainCodexPoolAccount(config.codexAccounts)) return false;
+    if (isAccountNeedsReauth(accountId)) return false;
+    // A selection-only caller owns the recovery/drain fence and will reject main
+    // before reservation or token materialization. Treat cached main as a routing
+    // candidate without touching the credential file so affinity is not rebound.
+    if (options.nativeMainSelectionOnly) return true;
     // Main account: credential is the read-only ~/.codex/auth.json token (Option A).
-    return isMainAccountTokenLive() && !isAccountNeedsReauth(accountId);
+    return (options.isMainAccountTokenLive ?? isMainAccountTokenLive)();
   }
   const exists = (config.codexAccounts ?? [])
     .some(account => isSelectableCodexPoolAccount(account) && account.id === accountId);

package/src/codex/admission.ts

@@ -0,0 +1,255 @@
+/**
+ * The `AdmissionSnapshot` producer.
+ *
+ * `AdmissionSnapshot` existed as a TYPE for the whole unit while nothing built
+ * one, which meant the write lock's API could only ever be exercised by a
+ * fabricated object — the reason WP11 was merged into WP12 rather than shipped
+ * as a mechanism with no consumer.
+ *
+ * What this is FOR: one decision uses one set of bytes. Everything the lock
+ * compares is captured here, once, before any artifact is created; the lock then
+ * re-reads it while holding N and refuses if the authority moved underneath.
+ * Passing the config around instead would let two reads of a changing file
+ * disagree inside one operation, which is the interruption hazard this unit
+ * exists to close.
+ *
+ * READS ONLY. Nothing here creates a directory, a database, or a marker: an
+ * admission that manufactures the state it is admitting cannot refuse.
+ *
+ * Design record: devlog/_plan/260804_codex_write_substrate/040_ownership_convergence.md.
+ */
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { getConfigDir, observeConfigGeneration, readConfigAdmissionSnapshot } from "../config";
+import { inspectNativeCodexOwnership } from "../integrations/native/ownership-preflight";
+import type { AdmissionSnapshot } from "./convergence-types";
+import { codexIntegrationEnabled } from "./desired-state";
+import { externalCodexModelProvider } from "./inject";
+import { JOURNAL_PATH } from "./journal";
+import {
+  CODEX_MODELS_CACHE_PATH,
+  CODEX_PROFILE_PATH,
+  DEFAULT_CATALOG_PATH,
+  getCodexHome,
+} from "./paths";
+
+export type CodexAdmission =
+  | { readonly kind: "admitted"; readonly snapshot: AdmissionSnapshot }
+  | {
+      readonly kind: "refused";
+      readonly authority: "config" | "generation" | "service-home" | "external-provider";
+      readonly message: string;
+    };
+
+/**
+ * Seams, not conveniences.
+ *
+ * The ownership probe shells out to the platform service manager, and a test
+ * that reached the real one would be asserting against whatever the developer's
+ * machine happens to have installed. Injecting it is also what lets a test
+ * observe the EXACT argv the production probe emits, which is the only way to
+ * hold down "this never starts or stops anything".
+ */
+export interface AdmissionDeps {
+  readonly inspectOwnership?: typeof inspectNativeCodexOwnership;
+}
+
+/** Hash of a file's exact bytes, or a stable marker for absence. */
+function contentIdentity(path: string): string {
+  try {
+    return createHash("sha256").update(readFileSync(path)).digest("hex").slice(0, 32);
+  } catch {
+    // Absence is EVIDENCE, not a hole. An absent journal and an unreadable one
+    // are different states and must not collapse to the same identity.
+    return existsSync(path) ? "unreadable" : "absent";
+  }
+}
+
+/**
+ * Capture everything one Codex write decision depends on.
+ *
+ * Refuses rather than guessing: a missing or malformed config, a coordinator
+ * that cannot report a generation, a service installed from another home, and an
+ * external `model_provider` each end the operation before it starts. The last
+ * two are separate authorities on purpose — "someone else's service owns this
+ * home" and "the user pointed Codex somewhere else" need different messages
+ * because they need different actions.
+ */
+export function admitCodexWrite(deps: AdmissionDeps = {}): CodexAdmission {
+  const persisted = readConfigAdmissionSnapshot();
+  const diagnostics = persisted.diagnostics;
+  if (diagnostics.source !== "file") {
+    return {
+      kind: "refused",
+      authority: "config",
+      message: diagnostics.source === "default"
+        ? "No config file exists to admit a Codex write from."
+        : "The config file is malformed; refusing to write from it.",
+    };
+  }
+  if (persisted.kind !== "read") {
+    // Unreachable through the union today — `source: "file"` only comes from a
+    // successful read — but stated rather than assumed, because the day that
+    // stops being true this should refuse, not proceed with no digest.
+    return {
+      kind: "refused",
+      authority: "config",
+      message: "The config file could not be read as bytes; refusing to write from it.",
+    };
+  }
+
+  /*
+   * OBSERVE, not read.
+   *
+   * `readConfigGeneration` opens the coordinator with `create: true`, so merely
+   * admitting would produce a `config-mutation.sqlite` in a home that had none —
+   * caught by the "creates nothing" test, which is what that test is for. Only a
+   * cooperating config WRITE may create and initialize the singleton.
+   */
+  const observed = observeConfigGeneration();
+  if (observed.kind === "unavailable") {
+    return {
+      kind: "refused",
+      authority: "generation",
+      message: observed.reason === "busy"
+        ? "The config coordinator is busy; the generation could not be read."
+        : "The config generation exists but could not be read; refusing to guess it.",
+    };
+  }
+  const generation = observed.kind === "absent"
+    ? { present: false, value: 0 }
+    : { present: true, value: observed.generation.value };
+
+  /*
+   * Tri-state, and NOT `assertNativeTeardownOwned` — that one fails open, so a
+   * corrupt state file would arrive here as `owned`. Unattended writes refuse on
+   * both `foreign` and `unknown`: the first is someone else's home, the second
+   * is a question that could not be answered, and neither is permission.
+   */
+  const ownership = (deps.inspectOwnership ?? inspectNativeCodexOwnership)();
+  if (ownership.ownership !== "owned") {
+    return {
+      kind: "refused",
+      authority: "service-home",
+      message: ownership.ownership === "foreign"
+        ? `Refusing to write: ${ownership.reason}.`
+        : `Refusing to write because ownership could not be proven: ${ownership.reason}.`,
+    };
+  }
+
+  const codexHome = getCodexHome();
+  const codexConfigPath = join(codexHome, "config.toml");
+  let external: string | null = null;
+  try {
+    // Resolved at call time, not at module load: CODEX_CONFIG_PATH is a const
+    // fixed when the module was first imported, so it does not follow a
+    // CODEX_HOME that changed afterwards.
+    external = externalCodexModelProvider(readFileSync(codexConfigPath, "utf-8"));
+  } catch {
+    // No Codex config yet is not an external owner; it is simply nothing to read.
+    external = null;
+  }
+  if (external) {
+    return {
+      kind: "refused",
+      authority: "external-provider",
+      message: `Codex config.toml is owned by an external model_provider (${external}).`,
+    };
+  }
+
+  const config = diagnostics.config;
+  const opencodexHome = getConfigDir();
+  const integrationRecord = join(opencodexHome, "integrations", "codex.json");
+  const historyDb = join(codexHome, "state_5.sqlite");
+
+  const canonicalTargets = {
+    codexHome,
+    opencodexHome,
+    config: codexConfigPath,
+    profile: CODEX_PROFILE_PATH,
+    catalog: DEFAULT_CATALOG_PATH,
+    cache: CODEX_MODELS_CACHE_PATH,
+    // The journal's own constant. Re-deriving it here is what made this field
+    // watch a path nothing writes.
+    journal: JOURNAL_PATH,
+    integrationRecord,
+    // Backups and rollouts are enumerated by their owners, not guessed here.
+    catalogBackups: [] as readonly string[],
+    historyDb,
+    historyManifest: `${historyDb}.ocx-backup.json`,
+    historyRollouts: [] as readonly string[],
+  } as const;
+
+  const snapshot: AdmissionSnapshot = {
+    config,
+    // The EXACT persisted bytes. Hashing the parsed object instead let a
+    // whitespace-only rewrite pass unnoticed, which is precisely the
+    // non-cooperating writer this comparison exists to catch.
+    configDigest: persisted.contentSha256,
+    intent: codexIntegrationEnabled(config) ? "on" : "off",
+    generation,
+    // Reached only when the projection above said `owned`; the other two states
+    // have already refused. This is the observed value, not a placeholder.
+    ownership: ownership.ownership,
+    externalProvider: null,
+    canonicalTargets,
+    journalIdentity: contentIdentity(JOURNAL_PATH),
+    provenanceIdentity: contentIdentity(integrationRecord),
+    authoritySnapshotId: "",
+  };
+
+  return { kind: "admitted", snapshot: { ...snapshot, authoritySnapshotId: hashAuthority(snapshot) } };
+}
+
+/**
+ * Collapse the generation to one authority token.
+ *
+ * An absent database and a present zero are the SAME authority — both mean no
+ * cooperating write has committed — and they must hash alike, because the lock
+ * compares this ID byte-for-byte. They cannot be observed alike: before the lock
+ * only absence is visible, and inside it only the present zero is, since the
+ * transaction that creates the row has not committed while a separate connection
+ * looks. Without this they would never match and every first write would refuse.
+ *
+ * Canonicalizing inside the hash rather than beside it, in a comparator: a
+ * comparator that treats one field specially has to be rewritten at every future
+ * comparison site, and the site that gets forgotten is the one that matters.
+ */
+function generationAuthority(generation: AdmissionSnapshot["generation"]): string {
+  const { present, value } = generation;
+  if (!Number.isSafeInteger(value) || value < 0) {
+    // NaN, Infinity, fractions, negatives and unsafe integers would otherwise
+    // all quietly become "gen:0" — the one value that means "safe to proceed".
+    throw new TypeError(`A config generation must be a non-negative safe integer, got ${String(value)}.`);
+  }
+  return present && value > 0 ? `gen:${value}` : "gen:0";
+}
+
+/**
+ * Digest every authority field, in a fixed order.
+ *
+ * The lock compares THIS and nothing else, so a field left out of the hash is a
+ * field that can change under the lock without anyone noticing. Adding one to
+ * the snapshot means adding it here.
+ */
+export function hashAuthority(snapshot: AdmissionSnapshot): string {
+  return createHash("sha256")
+    .update(JSON.stringify([
+      snapshot.configDigest,
+      snapshot.intent,
+      generationAuthority(snapshot.generation),
+      snapshot.ownership,
+      snapshot.externalProvider,
+      snapshot.canonicalTargets,
+      snapshot.journalIdentity,
+      snapshot.provenanceIdentity,
+    ]))
+    .digest("hex");
+}
+
+/** Test seam: prove the identity of a path the way admission does. */
+export function admissionContentIdentityForTests(path: string): string {
+  return contentIdentity(path);
+}