@bitkyc08/opencodex 2.10.0 → 2.10.1

package/src/responses/reasoning-envelope.ts

@@ -24,6 +24,12 @@ export interface ReasoningEnvelope {
    * so replay needs it even though the visible summary was suppressed.
    */
   txt?: string;
+  /**
+   * Kiro `reasoningContentEvent.redactedContent`: a KMS-encrypted reasoning blob that is opaque to
+   * the proxy. Kiro's own CLI replays it on the matching `assistantResponseMessage` to preserve
+   * model reasoning across turns, so it round-trips here the same way a signature does.
+   */
+  krc?: string;
 }
 
 export function encodeReasoningEnvelope(envelope: ReasoningEnvelope): string {
@@ -45,7 +51,9 @@ export function decodeReasoningEnvelope(encryptedContent: string): ReasoningEnve
     }
     const txt = (parsed as { txt?: unknown }).txt;
     if (typeof txt === "string" && txt.length > 0) envelope.txt = txt;
-    return envelope.sig || envelope.red || envelope.txt ? envelope : null;
+    const krc = (parsed as { krc?: unknown }).krc;
+    if (typeof krc === "string" && krc.length > 0) envelope.krc = krc;
+    return envelope.sig || envelope.red || envelope.txt || envelope.krc ? envelope : null;
   } catch {
     return null;
   }

package/src/responses/reasoning-replay-cache.ts

@@ -0,0 +1,105 @@
+/**
+ * In-process fallback store pairing raw reasoning text with the tool call it
+ * preceded (issue #950).
+ *
+ * DeepSeek thinking mode requires the assistant's original `reasoning_content`
+ * to be replayed on every continuation of a tool-call turn. The bridge records
+ * the raw reasoning here when it closes a reasoning block and a tool call
+ * follows; the openai-chat adapter re-attaches it when a `tool_calls`
+ * assistant message is about to serialize without thinking parts (compacted
+ * history, lost assistant turn, orphan-repaired tool results).
+ *
+ * Entries are scoped by an optional conversation identity in addition to the
+ * call id: provider-generated ids like `call_1` are not globally unique, so a
+ * process-wide key would let one conversation's reasoning bleed into another
+ * when ids collide (CodeRabbit P1 on #971).
+ *
+ * Privacy: entries hold reasoning text in memory only — never logged,
+ * serialized, or exported. Bounded by entry count, total bytes, and TTL, so a
+ * long-lived proxy cannot grow without limit.
+ */
+
+const MAX_ENTRIES = 64;
+const MAX_TOTAL_BYTES = 256 * 1024;
+const TTL_MS = 60 * 60 * 1000;
+
+interface CacheEntry {
+  text: string;
+  bytes: number;
+  at: number;
+}
+
+const entries = new Map<string, CacheEntry>();
+let totalBytes = 0;
+let clockForTests: (() => number) | null = null;
+
+const now = (): number => clockForTests?.() ?? Date.now();
+const keyFor = (callId: string, scope: string | undefined): string =>
+  `${scope ?? "global"}\u0000${callId}`;
+
+/**
+ * Record the raw reasoning text that preceded the given tool call.
+ *
+ * Expired entries are swept on insert so the TTL bound holds even when a call
+ * id is never read again.
+ */
+export function rememberReasoningForCall(callId: string, text: string, scope?: string): void {
+  if (!callId || typeof text !== "string" || text.length === 0) return;
+  const bytes = Buffer.byteLength(text, "utf8");
+  // A single entry larger than the whole budget would immediately evict itself.
+  if (bytes > MAX_TOTAL_BYTES) return;
+  const at = now();
+  // Delete every due entry first so expired reasoning cannot linger until a
+  // later peek or capacity eviction.
+  for (const [key, entry] of entries) {
+    if (at - entry.at >= TTL_MS) {
+      entries.delete(key);
+      totalBytes -= entry.bytes;
+    }
+  }
+  const key = keyFor(callId, scope);
+  const previous = entries.get(key);
+  if (previous) totalBytes -= previous.bytes;
+  entries.set(key, { text, bytes, at });
+  totalBytes += bytes;
+  // Evict oldest-first until both caps hold (never evict the entry just written
+  // while it is the only one — the loop guards on size > 1).
+  while ((totalBytes > MAX_TOTAL_BYTES || entries.size > MAX_ENTRIES) && entries.size > 1) {
+    let oldestKey: string | undefined;
+    let oldestAt = Infinity;
+    for (const [candidateKey, entry] of entries) {
+      if (entry.at < oldestAt) {
+        oldestAt = entry.at;
+        oldestKey = candidateKey;
+      }
+    }
+    if (oldestKey === undefined) break;
+    const evicted = entries.get(oldestKey)!;
+    totalBytes -= evicted.bytes;
+    entries.delete(oldestKey);
+  }
+}
+
+/**
+ * Read the recorded reasoning for a call id without removing it: retries after
+ * a failed continuation reuse the same fallback.
+ */
+export function peekReasoningForCall(callId: string, scope?: string): string | undefined {
+  if (!callId) return undefined;
+  const key = keyFor(callId, scope);
+  const entry = entries.get(key);
+  if (!entry) return undefined;
+  if (now() - entry.at >= TTL_MS) {
+    entries.delete(key);
+    totalBytes -= entry.bytes;
+    return undefined;
+  }
+  return entry.text;
+}
+
+/** Test-only: reset the cache and optionally pin the clock. */
+export function clearReasoningReplayCacheForTests(clock?: (() => number) | null): void {
+  entries.clear();
+  totalBytes = 0;
+  clockForTests = clock ?? null;
+}

package/src/responses/spill-store.ts

@@ -17,7 +17,7 @@ import {
 import { createHash, randomBytes } from "node:crypto";
 import { join } from "node:path";
 import { getConfigDir } from "../config";
-import { forgetHardenedSecretPath, hardenSecretDir, hardenSecretPath } from "../lib/windows-secret-acl";
+import { forgetEphemeralSecretPath, forgetHardenedSecretPath, hardenSecretDir, hardenSecretPath } from "../lib/windows-secret-acl";
 import type { OcxProviderContinuationState } from "../types";
 
 export const RESPONSE_SPILL_VERSION = 1;
@@ -45,9 +45,29 @@ export interface ResponseSpillRef {
   payloadBytes: number;
 }
 
+/**
+ * Hard ceiling for one spill payload, enforced BOTH at direct-spill admission
+ * (state.ts refuses to durably retain a larger candidate) and at replay read
+ * (below). 256 MiB keeps the replay transient under the process-wide
+ * APP_OWNED_WORST_CASE_PINNED_BYTES ceiling (512 MiB); without an admission
+ * ceiling the read ceiling would strand write-only spills on disk.
+ */
+export const MAX_RESPONSE_SPILL_PAYLOAD_BYTES = 256 * 1024 * 1024;
+
+let spillPayloadCapOverride: number | null = null;
+
+/** Test-only: lower/restore the single-spill payload ceiling (null restores). */
+export function setResponseSpillPayloadCapForTests(bytes: number | null): void {
+  spillPayloadCapOverride = bytes;
+}
+
+export function responseSpillPayloadCap(): number {
+  return spillPayloadCapOverride ?? MAX_RESPONSE_SPILL_PAYLOAD_BYTES;
+}
+
 export type ResponseSpillReadResult =
   | { ok: true; payload: ResponseSpillPayload }
-  | { ok: false; reason: "missing" | "corrupt" };
+  | { ok: false; reason: "missing" | "corrupt" | "too_large" };
 
 export interface ResponseSpillCleanupResult {
   scanned: number;
@@ -176,17 +196,28 @@ function closeFile(fd: number): void {
   record("close");
 }
 
-function unlink(path: string): void {
+function unlink(path: string, ephemeral = false): void {
   try {
     if (spillIoForTest?.unlink) spillIoForTest.unlink(path);
     else unlinkSync(path);
-    forgetHardenedSecretPath(path);
+    // Ephemeral release only for publish temps; stable spill files keep their
+    // destination-keyed timeout memos (anti-restall) and drop just the
+    // success memo for the now-deleted file.
+    if (ephemeral) forgetEphemeralSecretPath(path);
+    else forgetHardenedSecretPath(path);
   } catch (error) {
-    if (isErrno(error, "ENOENT")) forgetHardenedSecretPath(path);
+    if (isErrno(error, "ENOENT")) {
+      if (ephemeral) forgetEphemeralSecretPath(path);
+      else forgetHardenedSecretPath(path);
+    }
     throw error;
   }
 }
 
+function unlinkEphemeral(path: string): void {
+  unlink(path, true);
+}
+
 function publishNoReplace(tempPath: string, destinationPath: string): void {
   try {
     if (spillIoForTest?.link) spillIoForTest.link(tempPath, destinationPath);
@@ -284,7 +315,7 @@ export function writeResponseSpillDurably(
       try {
         publishNoReplace(publishTempPath, destinationPath);
         fsyncDirectoryBestEffort(dir);
-        unlink(publishTempPath);
+        unlinkEphemeral(publishTempPath);
         tempPath = null;
         return { version: 1, fileName, digest, payloadBytes: bytes.byteLength };
       } catch (error) {
@@ -298,7 +329,7 @@ export function writeResponseSpillDurably(
       try { closeSync(fd); } catch { /* best effort */ }
     }
     if (tempPath) {
-      try { unlink(tempPath); } catch { /* best effort */ }
+      try { unlinkEphemeral(tempPath); } catch { /* best effort */ }
     }
     throw new Error("Response spill write failed");
   }
@@ -306,6 +337,9 @@ export function writeResponseSpillDurably(
 
 export function readResponseSpill(responseId: string, ref: ResponseSpillRef): ResponseSpillReadResult {
   if (!validSpillRef(ref)) return { ok: false, reason: "corrupt" };
+  // Refuse before any read/parse: an oversized declared payload would otherwise
+  // materialize an unbounded transient (readFileSync + utf8 + JSON.parse).
+  if (ref.payloadBytes > responseSpillPayloadCap()) return { ok: false, reason: "too_large" };
   const match = OWNED_SPILL_NAME.exec(ref.fileName);
   if (!match
     || match[2] !== sha256(responseId).slice(0, 12)
@@ -376,7 +410,10 @@ export function recoverOrphanedResponseSpills(
       try { stat = lstatSync(path); } catch { continue; }
       if (!stat.isFile() || stat.isSymbolicLink() || Date.now() - stat.mtimeMs < graceMs) continue;
       try {
-        unlink(path);
+        // Orphaned publish temps get the full ephemeral release; stable
+        // orphaned spills keep destination-keyed timeout memos.
+        if (isOwnedTemp) unlinkEphemeral(path);
+        else unlink(path);
         result.removed += 1;
         result.bytesRemoved += stat.size;
       } catch {

package/src/responses/state.ts

@@ -1,6 +1,6 @@
-import { chmodSync, existsSync, lstatSync, mkdirSync, opendirSync, readFileSync, rmSync, unlinkSync } from "node:fs";
+import { chmodSync, existsSync, lstatSync, mkdirSync, opendirSync, readFileSync, rmSync, statSync, unlinkSync } from "node:fs";
 import { dirname, join } from "node:path";
-import { atomicWriteFileAsync, getConfigDir } from "../config";
+import { atomicWriteFileAsync, getConfigDir, resolveWriteTarget } from "../config";
 import { enforceAppOwnedMemoryBudget, type RetainedStoreSnapshot } from "../lib/app-owned-memory";
 import type { OcxProviderContinuationState } from "../types";
 import {
@@ -9,6 +9,7 @@ import {
   readResponseSpill,
   recoverOrphanedResponseSpills,
   responseSpillDirectory,
+  responseSpillPayloadCap,
   type ResponseSpillRef,
   writeResponseSpillDurably,
 } from "./spill-store";
@@ -23,6 +24,10 @@ export const MAX_STORED_RESPONSE_BYTES = 64 * 1024 * 1024;
 /** Legacy snapshot selection only. Spill demotion is governed solely by the RAM cap above. */
 const SNAPSHOT_ENTRY_MAX_BYTES = 2 * 1024 * 1024;
 const SNAPSHOT_TOTAL_MAX_BYTES = 24 * 1024 * 1024;
+/** Refuse-to-parse ceiling for an existing snapshot file (above the 24 MiB write
+ * bound, so anything we wrote ourselves always loads; guards against externally
+ * planted or pre-cap unbounded files being parsed whole). */
+const SNAPSHOT_FILE_MAX_BYTES = 32 * 1024 * 1024;
 const STALE_TEMP_GRACE_MS = 15 * 60 * 1_000;
 const STALE_TEMP_MAX_ENTRIES = 4_096;
 const STALE_TEMP_MAX_CLEANUPS = 512;
@@ -56,7 +61,7 @@ type ResidentInput = Omit<ResidentResponseState, "kind" | "sizeBytes">;
 
 export type PreviousResponseReplayFailure = {
   code: "previous_response_not_found";
-  reason: "spill_missing" | "spill_corrupt" | "spill_failed";
+  reason: "spill_missing" | "spill_corrupt" | "spill_failed" | "spill_too_large";
 };
 
 const states = new Map<string, StoredResponseState>();
@@ -67,6 +72,19 @@ let oldestResidentAt: number | null = null;
 let byteCapOverride: number | null = null;
 let stateRevision = 0;
 const spillCounters = { writes: 0, writeFailures: 0, readFailures: 0 };
+/**
+ * Admission-boundary observability (test-visible). directSpills: oversized
+ * candidates routed straight to durable spill without a resident stay or
+ * unrelated demotion. oversizedDrops: candidates above the single-spill
+ * payload ceiling, tombstoned instead of retained. snapshotOversizedRefusals:
+ * snapshot files refused before parse.
+ */
+const admissionCounters = { directSpills: 0, oversizedDrops: 0, snapshotOversizedRefusals: 0 };
+
+/** Test-only: admission-boundary counters (proves the new paths fire). */
+export function responseAdmissionCountersForTests(): Readonly<typeof admissionCounters> {
+  return admissionCounters;
+}
 // Superseded spill generations awaiting a durable snapshot before unlink
 // (review C1-1: unlinking at swap time races a crash against the debounced
 // snapshot — the reloaded OLD stub would point at a deleted file).
@@ -177,12 +195,28 @@ function deleteEntry(id: string, options: { deleteSpill?: boolean } = {}): void
   if (options.deleteSpill !== false) deleteOwnedSpills(existing);
 }
 
-function replaceWithSpillFailure(id: string, expected?: StoredResponseState): void {
+function replaceWithSpillFailure(
+  id: string,
+  expected?: StoredResponseState,
+  options: { deferSpillUnlink?: boolean } = {},
+): void {
   const existing = states.get(id);
   if (expected && existing !== expected) return;
   const failed = tombstone(id, expected?.createdAt ?? existing?.createdAt ?? now());
   if (replaceMapEntry(id, failed, expected)) {
-    if (existing) deleteOwnedSpills(existing);
+    if (existing) {
+      if (options.deferSpillUnlink && existing.kind === "spill") {
+        // Crash consistency (same rule as replaceSpillEntryAtomically): the old
+        // durable snapshot still references this generation until the tombstone
+        // itself is durable — queue the unlink for the next stable persist.
+        pendingSpillUnlinks.push(existing.spill);
+        while (pendingSpillUnlinks.length > PENDING_SPILL_UNLINKS_MAX) {
+          deleteResponseSpill(pendingSpillUnlinks.shift()!);
+        }
+      } else {
+        deleteOwnedSpills(existing);
+      }
+    }
   }
 }
 
@@ -236,7 +270,9 @@ function replaceSpillEntryAtomically(
     }
   } catch {
     spillCounters.writeFailures += 1;
-    replaceWithSpillFailure(id, expected);
+    // deferSpillUnlink: the durable snapshot may still reference the old
+    // generation; deleting it now would strand the old stub after a crash.
+    replaceWithSpillFailure(id, expected, { deferSpillUnlink: true });
   }
 }
 
@@ -251,6 +287,11 @@ function setResidentEntry(id: string, entry: ResidentInput): void {
     pruneResponses();
     return;
   }
+  if (candidate.sizeBytes > byteCap()) {
+    admitOversizedCandidate(id, candidate, expected);
+    pruneResponses();
+    return;
+  }
   if (expected?.kind === "spill") {
     replaceSpillEntryAtomically(id, expected, candidate);
     pruneResponses();
@@ -260,6 +301,68 @@ function setResidentEntry(id: string, entry: ResidentInput): void {
   pruneResponses();
 }
 
+/**
+ * Admission boundary for candidates that can never fit as resident (larger
+ * than the whole resident-map cap). Writes them DIRECTLY to durable spill and
+ * installs only the stub — the oversized candidate never becomes resident and
+ * no unrelated resident is demoted to make room for it. Candidates above the
+ * single-spill payload ceiling are tombstoned instead: retaining a spill the
+ * replay ceiling would refuse to read is write-only waste.
+ */
+function admitOversizedCandidate(
+  id: string,
+  candidate: ResidentResponseState,
+  expected?: StoredResponseState,
+): void {
+  if (candidate.sizeBytes > responseSpillPayloadCap()) {
+    admissionCounters.oversizedDrops += 1;
+    replaceWithSpillFailure(id, expected, { deferSpillUnlink: true });
+    return;
+  }
+  try {
+    const ref = writeResponseSpillDurably(id, {
+      createdAt: candidate.createdAt,
+      items: candidate.items,
+      ...(candidate.providers ? { providers: candidate.providers } : {}),
+    });
+    // Enforce the ceiling against the REAL envelope: the spill payload adds
+    // the {version, responseId, ...} wrapper, so a candidate within the
+    // wrapper's size of the cap would otherwise be retained unreadably.
+    if (ref.payloadBytes > responseSpillPayloadCap()) {
+      deleteResponseSpill(ref);
+      admissionCounters.oversizedDrops += 1;
+      replaceWithSpillFailure(id, expected, { deferSpillUnlink: true });
+      return;
+    }
+    const base: Omit<SpilledResponseState, "sizeBytes"> = {
+      kind: "spill",
+      createdAt: candidate.createdAt,
+      ...(candidate.providers ? { providers: candidate.providers } : {}),
+      spill: ref,
+    };
+    const next: SpilledResponseState = { ...base, sizeBytes: stubSize(id, base) };
+    if (!replaceMapEntry(id, next, expected)) {
+      deleteResponseSpill(ref);
+      return;
+    }
+    spillCounters.writes += 1;
+    admissionCounters.directSpills += 1;
+    noteStubSwapForTest();
+    if (expected?.kind === "spill") {
+      // Same deferred-unlink rule as replaceSpillEntryAtomically: the new stub
+      // is durable only after the debounced snapshot, so the old generation
+      // stays until a stable persist drains the queue.
+      pendingSpillUnlinks.push(expected.spill);
+      while (pendingSpillUnlinks.length > PENDING_SPILL_UNLINKS_MAX) {
+        deleteResponseSpill(pendingSpillUnlinks.shift()!);
+      }
+    }
+  } catch {
+    spillCounters.writeFailures += 1;
+    replaceWithSpillFailure(id, expected, { deferSpillUnlink: true });
+  }
+}
+
 // Expansion provenance must stay proxy-private: a WeakMap distinguishes replayed history from the
 // newly appended input suffix without adding an unknown field that native passthrough could send
 // upstream. The parser uses this boundary to acknowledge historical compaction markers exactly once.
@@ -334,8 +437,18 @@ function loadSnapshotEntry(id: string, value: unknown): void {
     items: rec.items,
     ...(providers ? { providers } : {}),
   });
-  if (resident) replaceMapEntry(id, resident);
-  else replaceMapEntry(id, tombstone(id, rec.createdAt));
+  if (!resident) {
+    replaceMapEntry(id, tombstone(id, rec.createdAt));
+    return;
+  }
+  // Same admission boundary as live writes: an oversized snapshot row goes
+  // straight to spill (or tombstone above the payload ceiling) instead of
+  // entering the resident map and demoting unrelated rows on the first prune.
+  if (resident.sizeBytes > byteCap()) {
+    admitOversizedCandidate(id, resident, undefined);
+    return;
+  }
+  replaceMapEntry(id, resident);
 }
 
 export interface ResponseStateTempRecoveryResult {
@@ -454,18 +567,43 @@ function ensureLoaded(): void {
   if (loaded) return;
   loaded = true;
   const path = snapshotPath();
+  // Atomic writes place their temp beside the RESOLVED target, so a symlinked
+  // snapshot (dotfiles-managed config dir) strands temps in the link's real
+  // directory where a scan of the literal config dir would never see them.
+  // Both locations are swept; they collapse to one when nothing is symlinked.
+  // resolveWriteTarget refuses a dangling link; snapshot loading stays independent.
+  let resolvedDir = dirname(path);
   try {
-    recoverStaleResponseStateTemps(dirname(path));
+    resolvedDir = dirname(resolveWriteTarget(path));
   } catch {
-    /* best-effort cleanup only; snapshot loading must remain independent */
+    /* unresolvable link: sweep the literal dir only */
+  }
+  for (const dir of new Set([dirname(path), resolvedDir])) {
+    try {
+      recoverStaleResponseStateTemps(dir);
+    } catch {
+      /* best-effort cleanup only; snapshot loading must remain independent */
+    }
   }
   try {
     if (existsSync(path)) {
-      const raw = JSON.parse(readFileSync(path, "utf-8")) as { version?: unknown; states?: unknown };
-      if ((raw.version === 1 || raw.version === 2) && Array.isArray(raw.states)) {
-        for (const entry of raw.states) {
-          if (!Array.isArray(entry) || entry.length !== 2 || typeof entry[0] !== "string") continue;
-          loadSnapshotEntry(entry[0], entry[1]);
+      // Bound the read BEFORE parse: the 24 MiB write cap constrains snapshots
+      // this process wrote, not a pre-existing oversized file. statSync follows
+      // symlinks deliberately — readFileSync below follows them too, so the
+      // size gate must measure the same target the read would.
+      const stat = statSync(path);
+      if (!stat.isFile()) {
+        // Symlink to a FIFO/device (e.g. /dev/zero): reading would block or
+        // return unbounded input. Only regular files are ever parsed.
+      } else if (stat.size > SNAPSHOT_FILE_MAX_BYTES) {
+        admissionCounters.snapshotOversizedRefusals += 1;
+      } else {
+        const raw = JSON.parse(readFileSync(path, "utf-8")) as { version?: unknown; states?: unknown };
+        if ((raw.version === 1 || raw.version === 2) && Array.isArray(raw.states)) {
+          for (const entry of raw.states) {
+            if (!Array.isArray(entry) || entry.length !== 2 || typeof entry[0] !== "string") continue;
+            loadSnapshotEntry(entry[0], entry[1]);
+          }
         }
       }
     }
@@ -504,7 +642,9 @@ async function writeBoundedSnapshot(path: string): Promise<SnapshotWriteOutcome>
           persistable = smallState;
         }
         const persistEntry: [string, unknown] = [id, persistable];
-        const size = JSON.stringify(persistEntry).length;
+        // UTF-8 bytes, not UTF-16 code units: multibyte items otherwise slip
+        // past both snapshot caps at up to 2x the intended size.
+        const size = Buffer.byteLength(JSON.stringify(persistEntry), "utf8");
         if (state.kind === "resident" && size > SNAPSHOT_ENTRY_MAX_BYTES) continue;
         if (total + size > SNAPSHOT_TOTAL_MAX_BYTES) break;
         total += size;
@@ -676,7 +816,11 @@ function materializeEntry(
     spillCounters.readFailures += 1;
     const failure: PreviousResponseReplayFailure = {
       code: "previous_response_not_found",
-      reason: result.reason === "missing" ? "spill_missing" : "spill_corrupt",
+      reason: result.reason === "missing"
+        ? "spill_missing"
+        : result.reason === "too_large"
+          ? "spill_too_large"
+          : "spill_corrupt",
     };
     replaceWithSpillFailure(id, entry);
     schedulePersist();