@bitkyc08/opencodex 2.10.0 → 2.10.1

package/src/codex/features.ts

@@ -1,11 +1,14 @@
 /**
  * features.ts — codex feature-flag view for $CODEX_HOME/config.toml.
  *
- * Scope boundary: this module mirrors ONLY `multi_agent_v2`, because opencodex has
- * to migrate its concurrency value across the v1/v2 boundary and expose the
- * multi-agent config surface. Every other upstream feature flag is delegated to
- * the native `codex features` command (see src/cli/v2.ts) and must not be
- * hardcoded here.
+ * Scope boundary: this module mirrors only the flags opencodex has to READ
+ * directly from config.toml:
+ *   - `multi_agent_v2`, because opencodex migrates its concurrency value across
+ *     the v1/v2 boundary and exposes the multi-agent config surface;
+ *   - `default_mode_request_user_input` (Codex Auth page toggle), because the
+ *     management API needs a live reader for the flag it manages.
+ * Every other upstream feature flag is delegated to the native `codex features`
+ * command (see src/cli/v2.ts) and must not be hardcoded here.
  *
  * Upstream reshapes flags freely: in the 1f0566d3f..5a1097ed2 range alone,
  * `code_mode_host` changed from a boolean to a table (it is Stage::Stable and
@@ -30,9 +33,13 @@
 import { existsSync, readFileSync, unlinkSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { realpathSync } from "node:fs";
-import { atomicWriteFile, expandUserPath } from "../config";
+import { AtomicWriteResidualTempError, AtomicWriteSecretResidualError, atomicWriteFile, expandUserPath } from "../config";
+import { forgetEphemeralSecretPath } from "../lib/windows-secret-acl";
 import { CODEX_CONFIG_PATH } from "./paths";
 
+/** Upstream codex-rs feature key: allow `request_user_input` in Default mode. */
+export const DEFAULT_MODE_REQUEST_USER_INPUT_FEATURE_KEY = "default_mode_request_user_input";
+
 // EOL preservation, local copies of inject.ts dominantEol/applyEol: importing
 // inject here would close a module cycle (features -> inject -> catalog -> features).
 function dominantEol(content: string): "\r\n" | "\n" {
@@ -55,7 +62,7 @@ function mergeTrailingComments(existing?: string, migrated?: string): string {
   return `${existing}; ${migratedText}`;
 }
 
-function activeCodexConfigPath(): string {
+export function activeCodexConfigPath(): string {
   const raw = process.env.CODEX_HOME?.trim();
   if (!raw) return CODEX_CONFIG_PATH;
   const path = resolve(expandUserPath(raw));
@@ -127,6 +134,22 @@ export function isMultiAgentV2Enabled(configPath?: string): boolean {
   return false;
 }
 
+/**
+ * TRUE when the codex `default_mode_request_user_input` feature is enabled in
+ * config.toml — lets a Default-mode session pause and ask the user questions
+ * through `request_user_input` (upstream FeatureSpec: under development,
+ * default_enabled = false). Recognizes the shipped boolean form
+ * `[features] default_mode_request_user_input = true`.
+ * Missing file/key -> false.
+ */
+export function isDefaultModeRequestUserInputEnabled(configPath?: string): boolean {
+  const content = readConfigText(configPath);
+  if (content === null) return false;
+  const features = tomlTableBody(content, "features");
+  if (features === null) return false;
+  return tomlBoolInBody(features, DEFAULT_MODE_REQUEST_USER_INPUT_FEATURE_KEY) === true;
+}
+
 /**
  * TRUE when config.toml still carries `[agents] max_threads` — codex-rs REFUSES to
  * boot with that key while multi_agent_v2 is enabled ("agents.max_threads cannot be
@@ -833,10 +856,20 @@ function activeThreadComment(content: string, v2Enabled: boolean): string | unde
 }
 
 let migrationEditSeq = 0;
+/** Both residual classes gate the memo release: a plain residual and a
+ * secret-bearing one alike keep their destination memo while the file
+ * remains on disk. Exported for the regression seam. */
+export function isAtomicResidualError(error: unknown): boolean {
+  return error instanceof AtomicWriteResidualTempError || error instanceof AtomicWriteSecretResidualError;
+}
+
 function applyConfigEditsAtomically(path: string, edit: (tempPath: string) => ConfigEditResult): ConfigEditResult {
   const content = readConfigText(path);
   if (content === null) return { ok: false, error: `config.toml not readable at ${path}` };
   const tempPath = `${path}.ocx-migration.${process.pid}.${++migrationEditSeq}`;
+  // An inner residual temp (AtomicWriteResidualTempError) keeps its
+  // destination-keyed memo: fail-closed while the residual exists.
+  let innerResidual = false;
   try {
     atomicWriteFile(tempPath, content);
     const result = edit(tempPath);
@@ -846,8 +879,19 @@ function applyConfigEditsAtomically(path: string, edit: (tempPath: string) => Co
     if (edited === content) return { ok: true, changed: false };
     atomicWriteFile(path, edited);
     return { ok: true, changed: true };
+  } catch (error) {
+    if (isAtomicResidualError(error)) innerResidual = true;
+    throw error;
   } finally {
-    try { unlinkSync(tempPath); } catch { /* already absent */ }
+    try {
+      unlinkSync(tempPath);
+      if (!innerResidual) forgetEphemeralSecretPath(tempPath);
+    } catch (error) {
+      // Already absent is also proven-absent; other failures keep the memo.
+      if ((error as NodeJS.ErrnoException | undefined)?.code === "ENOENT") {
+        if (!innerResidual) forgetEphemeralSecretPath(tempPath);
+      }
+    }
   }
 }
 

package/src/codex/generation.ts

@@ -0,0 +1,202 @@
+/**
+ * Durable generation ownership for OpenCodex config bytes.
+ *
+ * The WP8b C-phase review found that config ABA and moved configuration could
+ * not be detected because cooperating saves had no durable counter. This module
+ * owns the singleton schema and conditional increment in the existing config
+ * mutation database; callers that already hold its transaction reuse that
+ * Database handle so bytes and generation remain one cooperating commit.
+ *
+ * A hand edit from a non-cooperating writer deliberately does not increment this
+ * counter. The convergence contract detects that case with its post-commit file
+ * observation instead of pretending SQLite can coordinate an external editor.
+ */
+import { chmodSync, statSync } from "node:fs";
+
+import { Database } from "bun:sqlite";
+
+import type {
+  ConfigGeneration,
+  ConfigGenerationBump,
+  ConfigGenerationRead,
+} from "./convergence-types";
+
+const CREATE_CONFIG_GENERATION = `
+  CREATE TABLE IF NOT EXISTS config_generation (
+    singleton INTEGER PRIMARY KEY CHECK (singleton = 1),
+    value INTEGER NOT NULL CHECK (value >= 0)
+  )`;
+const INITIALIZE_CONFIG_GENERATION = `
+  INSERT OR IGNORE INTO config_generation (singleton, value) VALUES (1, 0)`;
+const SELECT_CONFIG_GENERATION = `
+  SELECT value FROM config_generation WHERE singleton = 1`;
+const BUMP_CONFIG_GENERATION = `
+  UPDATE config_generation
+     SET value = value + 1
+   WHERE singleton = 1 AND value = ?`;
+
+interface ConfigGenerationRow {
+  value: unknown;
+}
+
+interface SchemaVersionRow {
+  schema_version: unknown;
+}
+
+/**
+ * Observation adds exactly one variant to `ConfigGenerationRead`: `absent`.
+ *
+ * This used to be deliberately absent itself, on the reasoning that a caller
+ * who may only LOOK must not be handed something it could mistake for a
+ * known-good baseline of zero. That reasoning still holds, and `absent` does
+ * not violate it — because `absent` is not a baseline. It authorizes nothing on
+ * its own. A caller may only promote it after taking the config transaction and
+ * reading a real zero THERE (`readConfigGenerationInCurrentMutationTransaction`),
+ * at which point the zero is observed rather than assumed. A caller with no
+ * transaction to open, such as catalog gather, must keep refusing it.
+ *
+ * What forced the distinction: refusing on absence meant refusing every Codex
+ * write on any home whose config predates this database — a permanent refusal
+ * for existing users, not a fixture problem.
+ *
+ * `absent` is returned ONLY for ENOENT on the initial `statSync`. A file that
+ * exists but cannot be read, a directory in its place, a bad schema version, or
+ * corrupt SQLite all stay `unavailable`, because those are reasons to stop, and
+ * collapsing them into absence is how a corrupt coordinator would become a
+ * licence to write.
+ */
+export type ConfigGenerationObservation =
+  | ConfigGenerationRead
+  | { kind: "absent" };
+
+function errorCode(error: unknown): string {
+  return error && typeof error === "object" && "code" in error
+    ? String((error as { code?: unknown }).code)
+    : "";
+}
+
+function isBusy(error: unknown): boolean {
+  const code = errorCode(error);
+  const message = error instanceof Error ? error.message : "";
+  return code === "SQLITE_BUSY"
+    || code === "SQLITE_LOCKED"
+    || /database (?:is|table is) locked/i.test(message);
+}
+
+function unavailable(error: unknown): Extract<ConfigGenerationRead, { kind: "unavailable" }> {
+  return { kind: "unavailable", reason: isBusy(error) ? "busy" : "database" };
+}
+
+export function initializeConfigGeneration(database: Database): void {
+  database.exec(CREATE_CONFIG_GENERATION);
+  database.exec(INITIALIZE_CONFIG_GENERATION);
+}
+
+export function readConfigGenerationInTransaction(database: Database): ConfigGeneration {
+  const row = database.query<ConfigGenerationRow, []>(SELECT_CONFIG_GENERATION).get();
+  if (!row || !Number.isSafeInteger(row.value) || Number(row.value) < 0) {
+    throw new Error("The config generation singleton is missing or invalid.");
+  }
+  return { value: Number(row.value) };
+}
+
+export function bumpConfigGenerationInTransaction(
+  database: Database,
+  expected: ConfigGeneration,
+): ConfigGenerationBump {
+  const result = database.query(BUMP_CONFIG_GENERATION).run(expected.value);
+  if (result.changes === 1) {
+    return { kind: "updated", generation: { value: expected.value + 1 } };
+  }
+  return { kind: "conflict", current: readConfigGenerationInTransaction(database) };
+}
+
+export function bumpCurrentConfigGeneration(database: Database): ConfigGeneration {
+  const current = readConfigGenerationInTransaction(database);
+  const result = bumpConfigGenerationInTransaction(database, current);
+  if (result.kind !== "updated") {
+    throw new Error("The config generation changed inside its owning transaction.");
+  }
+  return result.generation;
+}
+
+function runGenerationTransaction<T>(databasePath: string, operation: (database: Database) => T): T {
+  let database: Database | undefined;
+  let transactionOpen = false;
+  try {
+    database = new Database(databasePath, { create: true });
+    try { chmodSync(databasePath, 0o600); } catch { /* platform may ignore chmod */ }
+    database.exec("PRAGMA busy_timeout = 0; BEGIN IMMEDIATE");
+    transactionOpen = true;
+    initializeConfigGeneration(database);
+    const result = operation(database);
+    database.exec("COMMIT");
+    transactionOpen = false;
+    return result;
+  } catch (error) {
+    if (transactionOpen) {
+      try { database?.exec("ROLLBACK"); } catch { /* close releases the transaction */ }
+    }
+    throw error;
+  } finally {
+    try { database?.close(); } catch { /* operation already completed */ }
+  }
+}
+
+export function readConfigGenerationAtPath(databasePath: string): ConfigGenerationRead {
+  try {
+    return {
+      kind: "ready",
+      generation: runGenerationTransaction(databasePath, readConfigGenerationInTransaction),
+    };
+  } catch (error) {
+    return unavailable(error);
+  }
+}
+
+/**
+ * Observe generation state without preparing the mutation database in any way.
+ * Missing storage is a first-class state: only cooperating config writes have
+ * authority to create and initialize the generation singleton.
+ */
+export function observeConfigGenerationAtPath(
+  databasePath: string,
+): ConfigGenerationObservation {
+  try {
+    statSync(databasePath);
+  } catch (error) {
+    // ENOENT alone means absent. Everything else — EACCES, ENOTDIR, EIO — is a
+    // reason the question could not be answered, which is not the same answer.
+    return errorCode(error) === "ENOENT" ? { kind: "absent" } : unavailable(error);
+  }
+
+  let database: Database | undefined;
+  try {
+    database = new Database(databasePath, { readonly: true });
+    const schema = database.query<SchemaVersionRow, []>("PRAGMA schema_version").get();
+    if (!schema || !Number.isSafeInteger(schema.schema_version)) {
+      throw new Error("The config generation schema version is invalid.");
+    }
+    return {
+      kind: "ready",
+      generation: readConfigGenerationInTransaction(database),
+    };
+  } catch (error) {
+    return unavailable(error);
+  } finally {
+    try { database?.close(); } catch { /* observation already completed */ }
+  }
+}
+
+export function bumpConfigGenerationAtPath(
+  databasePath: string,
+  expected: ConfigGeneration,
+): ConfigGenerationBump {
+  try {
+    return runGenerationTransaction(databasePath, database => (
+      bumpConfigGenerationInTransaction(database, expected)
+    ));
+  } catch (error) {
+    return unavailable(error);
+  }
+}

package/src/codex/history-job.ts

@@ -0,0 +1,257 @@
+/**
+ * The parent half of the history unit: derive the operation, dispatch the
+ * Worker, and never let its failure become the caller's stall.
+ *
+ * The operation is DERIVED here from what the caller already decided — its
+ * config and the direction its native mutation just took — and then handed down
+ * as a fixed value. It is not a request field the Worker trusts, because the
+ * distinctions are real: `syncResumeHistory: false` means leave history alone,
+ * apply targets opencodex only in legacy mode, and legacy recovery must not
+ * touch the manifest that generic restore consumes.
+ *
+ * Every exit is typed. A Worker that errors, dies, or overruns its watchdog
+ * produces an outcome the caller can record, because the alternative — an
+ * exception crossing back into a route that already persisted its mutation — is
+ * how a successful change gets reported as a 500.
+ *
+ * Design record: devlog/_plan/260804_codex_write_substrate/020_history_isolation.md.
+ */
+import { randomUUID } from "node:crypto";
+import { join } from "node:path";
+
+import type {
+  CodexHistoryWorkerOperation,
+  HistoryWorkerResult,
+} from "./history-worker";
+import { historyBackupPathFor } from "./history-provider";
+import { getCodexHome } from "./paths";
+
+/** Where Codex keeps its resume history, and the manifest that shadows it. */
+const STATE_DB_FILE = "state_5.sqlite";
+
+/**
+ * Resolve the paths a history job needs, at CALL time.
+ *
+ * `history-provider.ts` resolves its equivalents at module load (`:16`, `:22`),
+ * which is fine in one process and wrong for a Worker: the Worker does not
+ * inherit them, so anything derived from those constants would address a
+ * different home than the caller intended. Resolving here also means a test that
+ * moves `CODEX_HOME` is honoured rather than ignored.
+ */
+export function resolveCodexHistoryJobTarget(): {
+  readonly canonicalCodexHome: string;
+  readonly canonicalStateDbPath: string;
+  readonly canonicalBackupPath: string;
+} {
+  const home = getCodexHome();
+  const stateDb = join(home, STATE_DB_FILE);
+  return {
+    canonicalCodexHome: home,
+    canonicalStateDbPath: stateDb,
+    // Derived by the provider's own rule rather than guessed: the manifest lives
+    // in the config directory under a hash of the state database, so a
+    // hand-built path would address a different file entirely.
+    canonicalBackupPath: historyBackupPathFor(stateDb),
+  };
+}
+
+/** How long a history unit may run before the parent stops waiting on it. */
+const WORKER_TIMEOUT_MS = 30_000;
+
+export interface CodexHistoryJobRequest {
+  readonly canonicalCodexHome: string;
+  readonly canonicalStateDbPath: string;
+  readonly canonicalBackupPath: string;
+  readonly operation: CodexHistoryWorkerOperation;
+}
+
+export type CodexHistoryJobOutcome =
+  | { readonly kind: "converged"; readonly rows: number; readonly files: number }
+  | { readonly kind: "skipped" }
+  | { readonly kind: "blocked"; readonly reason: "busy" | "database" | "unsafe-path" }
+  | { readonly kind: "failed"; readonly reason: "worker-error" | "worker-died" | "timeout";
+      readonly message: string };
+
+/**
+ * Derive the durable history operation from admitted intent.
+ *
+ * `resumeHistory === false` is the user's explicit opt-out and outranks the
+ * direction entirely — an apply that quietly migrated history anyway would be
+ * the setting failing silently. `legacyMode` is the only case that routes
+ * history TO opencodex; the ordinary apply migrates to native so a later restore
+ * has nothing to undo.
+ */
+/**
+ * Test seam: the boundary suite exercises the validator without standing up a
+ * Worker whose malformed message it cannot easily emit from inside a test.
+ */
+export function isPlausibleWorkerResultForTests(
+  message: Record<string, unknown>,
+  requestId: string,
+  jobId: string,
+): boolean {
+  return isPlausibleWorkerResult(message, requestId, jobId);
+}
+
+/**
+ * Reject a message that names a recognized type but lacks its payload.
+ *
+ * Without this, `{requestId, type:"done"}` reached an unchecked cast and read
+ * as `converged` with undefined fields — a success report for work that may not
+ * have happened. Each type is checked for the fields it actually carries, and
+ * the ids are matched against the request in flight, not merely present.
+ */
+function isPlausibleWorkerResult(
+  message: Record<string, unknown>,
+  requestId: string,
+  jobId: string,
+): boolean {
+  if (message.requestId !== requestId || message.jobId !== jobId) return false;
+  switch (message.type) {
+    case "done":
+      return (message.outcome === "converged" || message.outcome === "skipped")
+        && typeof message.rows === "number"
+        && typeof message.files === "number";
+    case "blocked":
+      return message.reason === "busy" || message.reason === "database" || message.reason === "unsafe-path";
+    case "error":
+      return typeof message.message === "string";
+    default:
+      return false;
+  }
+}
+
+export function deriveCodexHistoryOperation(intent: {
+  readonly direction: "apply" | "restore";
+  readonly resumeHistory: boolean;
+  readonly legacyMode: boolean;
+}): CodexHistoryWorkerOperation {
+  if (!intent.resumeHistory) return "skip";
+  if (intent.direction === "restore") return "restore-openai";
+  return intent.legacyMode ? "apply-opencodex" : "migrate-openai";
+}
+
+function classifyWorkerResult(result: HistoryWorkerResult): CodexHistoryJobOutcome {
+  if (result.type === "blocked") return { kind: "blocked", reason: result.reason };
+  if (result.type === "error") {
+    return { kind: "failed", reason: "worker-error", message: result.message };
+  }
+  return result.outcome === "skipped"
+    ? { kind: "skipped" }
+    : { kind: "converged", rows: result.rows, files: result.files };
+}
+
+/**
+ * Run one history unit in a Worker and join it before returning.
+ *
+ * The join is not optional politeness: returning while the thread may still be
+ * mutating CODEX_HOME would let a caller's next step observe a half-applied
+ * transition, and would let a test suite reach its next file with a worker still
+ * exiting behind it.
+ */
+export async function runCodexHistoryJob(
+  request: CodexHistoryJobRequest,
+  options: { readonly timeoutMs?: number } = {},
+): Promise<CodexHistoryJobOutcome> {
+  const requestId = randomUUID();
+  const jobId = randomUUID();
+  const timeoutMs = options.timeoutMs ?? WORKER_TIMEOUT_MS;
+
+  // `skip` writes nothing, so spawning a thread to decide that would be pure
+  // cost. It still returns a recorded outcome rather than silence.
+  if (request.operation === "skip") return { kind: "skipped" };
+
+  let worker: Worker;
+  try {
+    worker = new Worker(new URL("./history-worker.ts", import.meta.url).href);
+  } catch (error) {
+    return {
+      kind: "failed",
+      reason: "worker-died",
+      message: error instanceof Error ? error.message : "history_worker_spawn_failed",
+    };
+  }
+
+  return new Promise<CodexHistoryJobOutcome>(resolve => {
+    let settled = false;
+    const finish = (outcome: CodexHistoryJobOutcome) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      // Terminate and join before settling: see the note above.
+      const done = () => resolve(outcome);
+      try {
+        const terminated = worker.terminate() as unknown;
+        if (terminated && typeof (terminated as Promise<unknown>).then === "function") {
+          void (terminated as Promise<unknown>).then(done, done);
+          return;
+        }
+      } catch { /* already gone */ }
+      done();
+    };
+
+    const timer = setTimeout(() => {
+      finish({ kind: "failed", reason: "timeout", message: "history_worker_timeout" });
+    }, timeoutMs);
+
+    const died = (detail: string): void => {
+      finish({ kind: "failed", reason: "worker-died", message: detail });
+    };
+
+    worker.onmessage = (event: MessageEvent<unknown>) => {
+      const data = event.data;
+      if (!data || typeof data !== "object") {
+        // Not the shape at all: this is a death signal, not silence. Ignoring it
+        // would let the watchdog call a dead Worker a timeout.
+        died("history_worker_malformed_message");
+        return;
+      }
+      const message = data as Record<string, unknown>;
+      // A reply for a different request is somebody else's; ignoring it is not
+      // the same as accepting it.
+      if (message.requestId !== requestId) return;
+      if (message.type !== "done" && message.type !== "blocked" && message.type !== "error") {
+        died("history_worker_unknown_message_type");
+        return;
+      }
+      if (!isPlausibleWorkerResult(message, requestId, jobId)) {
+        // A recognized type with a missing payload read as `converged` with
+        // undefined fields once — success for work that may not have happened.
+        died("history_worker_malformed_payload");
+        return;
+      }
+      finish(classifyWorkerResult(message as unknown as HistoryWorkerResult));
+    };
+
+    /*
+     * A Worker that exits early — without erroring — is not an error event, so
+     * without these it surfaced as `timeout` after the full wait. Both are death
+     * signals. Neither can overturn a settled success: `finish` is idempotent,
+     * and the Worker always closes after posting its result.
+     */
+    worker.addEventListener("messageerror", () => died("history_worker_unserializable_message"));
+    worker.addEventListener("close", () => died("history_worker_closed_early"));
+
+    worker.onerror = (event: ErrorEvent) => {
+      finish({
+        kind: "failed",
+        reason: "worker-died",
+        message: event.message || "history_worker_failed",
+      });
+    };
+
+    worker.postMessage({
+      type: "run",
+      requestId,
+      jobId,
+      operation: request.operation,
+      canonicalCodexHome: request.canonicalCodexHome,
+      canonicalStateDbPath: request.canonicalStateDbPath,
+      canonicalBackupPath: request.canonicalBackupPath,
+      env: {
+        ...(process.env.CODEX_HOME ? { CODEX_HOME: process.env.CODEX_HOME } : {}),
+        ...(process.env.OPENCODEX_HOME ? { OPENCODEX_HOME: process.env.OPENCODEX_HOME } : {}),
+      },
+    });
+  });
+}