@bitkyc08/opencodex 2.10.0 → 2.10.1

package/src/server/auth-cors.ts

@@ -4,14 +4,17 @@ import {
   apiKeyTransportConfigError,
   booleanRecordConfigError,
   modelAdapterRecordConfigError,
+  modelPreferHostedToolsConfigError,
   codexAutoStartEnabled,
   positiveIntegerConfigError,
   positiveIntegerRecordConfigError,
   providerBaseUrlConfigError,
   providerHeadersConfigError,
   reasoningSummaryDeliveryRecordConfigError,
+  retryOn429PolicyConfigError,
 } from "../config";
 import { providerDestinationConfigError } from "../lib/destination-policy";
+import { redactSecretString } from "../lib/redact";
 import { getProviderRegistryEntry, providerCodexAccountMode, providerMatchesRegistryTransport, registryEntryForProviderDestination } from "../providers/registry";
 import { providerConfigSeed } from "../providers/derive";
 import type { OcxConfig, OcxProviderConfig } from "../types";
@@ -80,15 +83,28 @@ export function isAllowedRequestOrigin(req: Request, config: OcxConfig): boolean
 
 function isExtraAllowedOrigin(origin: string, cfg: OcxConfig): boolean {
   if (!cfg.corsAllowOrigins?.length) return false;
+  const parsedOrigin = comparableOrigin(origin);
   return cfg.corsAllowOrigins.some(allowed => {
-    try {
-      return new URL(allowed).origin === new URL(origin).origin;
-    } catch {
-      return allowed === origin;
-    }
+    const parsedAllowed = comparableOrigin(allowed);
+    return parsedOrigin !== null && parsedAllowed !== null
+      ? parsedAllowed === parsedOrigin
+      : allowed === origin;
   });
 }
 
+function comparableOrigin(value: string): string | null {
+  try {
+    const parsed = new URL(value);
+    if (parsed.origin !== "null") return parsed.origin;
+    // WHATWG URL exposes authority-based custom schemes (for example browser
+    // extensions) as opaque `null` origins. Compare their scheme + authority so
+    // one allowlisted extension cannot admit every other opaque origin.
+    return parsed.host ? `${parsed.protocol}//${parsed.host}` : null;
+  } catch {
+    return null;
+  }
+}
+
 export function managementRequestOrigin(req: Request, config: OcxConfig): string | null {
   const host = req.headers.get("Host");
   const parsedHost = parseHttpHost(host);
@@ -375,6 +391,11 @@ function sameCanonicalProviderSeed(actual: Record<string, unknown>, expected: Oc
   return actualKeys.every(key => JSON.stringify(actual[key]) === JSON.stringify((expected as unknown as Record<string, unknown>)[key]));
 }
 
+/**
+ * Validate a provider object arriving at the management write boundary. Returns an error
+ * string, or null when the provider may be persisted. Caller-controlled names/fields are
+ * redacted and JSON-escaped so secrets never reach the response.
+ */
 export function providerManagementConfigError(name: unknown, provider: unknown): string | null {
   if (typeof name !== "string" || !provider || typeof provider !== "object" || Array.isArray(provider)) {
     return "provider must be a plain object";
@@ -392,7 +413,9 @@ export function providerManagementConfigError(name: unknown, provider: unknown):
       return "provider openai codexAccountMode must be pool or direct";
     }
     if (seed) seed.codexAccountMode = raw.codexAccountMode;
-    const canonical = seed && sameCanonicalProviderSeed(raw, seed);
+    const canonicalCandidate = { ...raw };
+    delete canonicalCandidate.responsesSnapshotRepair;
+    const canonical = seed && sameCanonicalProviderSeed(canonicalCandidate, seed);
     if (!canonical) {
       return `provider ${name} must equal the canonical built-in provider seed`;
     }
@@ -406,6 +429,12 @@ export function providerManagementConfigError(name: unknown, provider: unknown):
   if (destinationError) return `provider ${name} ${destinationError}`;
   const headersError = providerHeadersConfigError(typed.headers);
   if (headersError) return `provider ${name} ${headersError}`;
+  const retryOn429Error = retryOn429PolicyConfigError(raw.retryOn429);
+  if (retryOn429Error) {
+    // The provider name is caller-controlled and can be token-shaped; redact and JSON-escape
+    // it before it reaches the management API response.
+    return `provider ${JSON.stringify(redactSecretString(name))} ${retryOn429Error}`;
+  }
   const apiKeyTransportError = apiKeyTransportConfigError(typed);
   if (apiKeyTransportError) return `provider ${name} ${apiKeyTransportError}`;
   const maxInputError = positiveIntegerRecordConfigError(raw.modelMaxInputTokens, "modelMaxInputTokens");
@@ -419,6 +448,16 @@ export function providerManagementConfigError(name: unknown, provider: unknown):
   if (reasoningSummaryDeliveryError) return `provider ${name} ${reasoningSummaryDeliveryError}`;
   const modelAdaptersError = modelAdapterRecordConfigError(raw.modelAdapters, "modelAdapters", name, typed);
   if (modelAdaptersError) return `provider ${name} ${modelAdaptersError}`;
+  const preferHostedToolsError = modelPreferHostedToolsConfigError(
+    raw.modelPreferHostedTools,
+    "modelPreferHostedTools",
+    name,
+    typed,
+  );
+  if (preferHostedToolsError) return `provider ${name} ${preferHostedToolsError}`;
+  if (raw.responsesSnapshotRepair !== undefined && typeof raw.responsesSnapshotRepair !== "boolean") {
+    return `provider ${name} responsesSnapshotRepair must be a boolean`;
+  }
   const defaultMaxOutputError = positiveIntegerConfigError(raw.defaultMaxOutputTokens, "defaultMaxOutputTokens");
   if (defaultMaxOutputError) return `provider ${name} ${defaultMaxOutputError}`;
   const maxOutputError = positiveIntegerRecordConfigError(raw.modelMaxOutputTokens, "modelMaxOutputTokens");
@@ -496,6 +535,7 @@ export function safeConfigDTO(config: OcxConfig): unknown {
       "modelOpenRouterRouting",
       "reasoningEfforts",
       "modelReasoningEfforts",
+      "reasoningWireFormat",
       "noVisionModels",
       "noReasoningModels",
       "noTemperatureModels",

package/src/server/chat-completions.ts

@@ -18,7 +18,8 @@ import { classifyError, CYBER_POLICY_ERROR_CODE, isCyberPolicyCode } from "../li
 import { redactSecretString } from "../lib/redact";
 import { resolveClientRetryAfter } from "../lib/retry-after";
 import { estimateTokens } from "../lib/token-estimate";
-import { routeModel } from "../router";
+import { NoEligiblePolicyCandidateError, routeModel } from "../router";
+import { evidenceFromBody } from "../routing/request-evidence";
 import { resolveWireProtocolOverride } from "./adapter-resolve";
 import type { OcxConfig } from "../types";
 import { readJsonRequestBody } from "./request-decompress";
@@ -32,6 +33,7 @@ import {
 import { responseWithDeferredRequestLog } from "./relay";
 import { handleResponses } from "./responses";
 import type { AdmissionLease } from "../lib/admission";
+import { tryClaimNativeMainProfileForTurn } from "../codex/native-main-admission";
 import {
   createTranslatorBudget,
   finalizeTranslatorBudgetResponse,
@@ -109,7 +111,7 @@ async function handleChatCompletionsWithBudget(
   let nativeRoute = false;
   let directRoute = false;
   try {
-    const route = routeModel(config, internalBody.model as string);
+    const route = routeModel(config, internalBody.model as string, evidenceFromBody(internalBody));
     // Settle the wire once so every branch below reads the adapter this model will
     // actually use, not the provider-wide default (#404).
     route.provider = resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, "chat");
@@ -117,6 +119,7 @@ async function handleChatCompletionsWithBudget(
     logCtx.providerAdapter = route.provider.adapter;
     logCtx.requestedModel = requestedModel;
     logCtx.provider = route.providerName;
+    logCtx.routeDecision = route.routeDecision;
     if (route.provider.adapter === "openai-responses") {
       nativeRoute = true;
       directRoute = route.codexAccountMode === "direct";
@@ -146,7 +149,12 @@ async function handleChatCompletionsWithBudget(
       const ladder = supportedLadderFor({ provider: route.provider, modelId: route.modelId });
       if (ladder !== undefined && ladder.length === 0) delete internalBody.reasoning;
     }
-  } catch {
+  } catch (err) {
+    if (err instanceof NoEligiblePolicyCandidateError) {
+      logCtx.routeDecision = err.trace;
+      if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, 404, { closeReason: "non_stream" });
+      return chatCompletionsErrorResponse(404, err.message, "invalid_request_error");
+    }
     /* unknown model: let handleResponses shape the 404 */
   }
   void nativeRoute;
@@ -158,15 +166,22 @@ async function handleChatCompletionsWithBudget(
     if (value) headers.set(name, value);
   }
   // Prefer main ChatGPT auth so OpenAI-backed sidecars remain reachable on routed turns.
-  if (!directRoute) try {
-    const { getMainAccountToken } = await import("../codex/main-account");
-    const token = getMainAccountToken();
-    if (token) {
-      headers.set("authorization", `Bearer ${token.accessToken}`);
-      headers.set("chatgpt-account-id", token.chatgptAccountId);
+  if (!directRoute) {
+    // This enrichment is optional for routed/non-main providers. If native main
+    // is fenced, omit it and let auth-context reject only a final physical-main
+    // selection while healthy pool/provider routes continue.
+    if (tryClaimNativeMainProfileForTurn(logIds?.turnAdmissionLease)) {
+      try {
+        const { getMainAccountToken } = await import("../codex/main-account");
+        const token = getMainAccountToken();
+        if (token) {
+          headers.set("authorization", `Bearer ${token.accessToken}`);
+          headers.set("chatgpt-account-id", token.chatgptAccountId);
+        }
+      } catch {
+        /* optional */
+      }
     }
-  } catch {
-    /* optional */
   }
 
   const internalBodyJson = JSON.stringify(internalBody);
@@ -316,7 +331,7 @@ async function handleChatCompletionsWithBudget(
     const classified = classifyError(502, error?.type ?? "server_error", message);
     if (error?.code === "translation_buffer_limit") {
       classified.code = "translation_buffer_limit";
-      classified.type = "invalid_request_error";
+      classified.type = "upstream_error";
     } else if (isCyberPolicyCode(error?.code)) {
       classified.code = CYBER_POLICY_ERROR_CODE;
       classified.type = "invalid_request_error";
@@ -327,7 +342,7 @@ async function handleChatCompletionsWithBudget(
     }
     return chatCompletionsErrorResponse(
       classified.code === "translation_buffer_limit"
-        ? 413
+        ? 502
         : isCyberPolicyCode(classified.code) ? 400 : 502,
       message,
       classified.type,

package/src/server/claude-messages.ts

@@ -25,7 +25,8 @@ import {
 } from "../claude/outbound";
 import { clearableDeadline, idleDeadline } from "../lib/abort";
 import { estimateTokens } from "../lib/token-estimate";
-import { routeModel } from "../router";
+import { NoEligiblePolicyCandidateError, routeModel } from "../router";
+import { evidenceFromBody } from "../routing/request-evidence";
 import { resolveWireProtocolOverride } from "./adapter-resolve";
 import type { OcxConfig } from "../types";
 import { readJsonRequestBody } from "./request-decompress";
@@ -34,6 +35,7 @@ import { conversationIdFromClaudeMetadata } from "./request-log-conversation";
 import { responseWithDeferredRequestLog } from "./relay";
 import { handleResponses } from "./responses";
 import type { AdmissionLease } from "../lib/admission";
+import { tryClaimNativeMainProfileForTurn } from "../codex/native-main-admission";
 import {
   createTranslatorBudget,
   finalizeTranslatorBudgetResponse,
@@ -627,10 +629,11 @@ async function handleClaudeMessagesWithBudget(
   // verified live 2026-07-11). Strip them for that route; routed providers keep them.
   let nativeRoute = false;
   try {
-    const route = routeModel(config, internalBody.model as string);
+    const route = routeModel(config, internalBody.model as string, evidenceFromBody(internalBody));
     // Settle the wire once so the sampling decision below reads the effective
     // adapter rather than the provider-wide default (#404).
     route.provider = resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, "anthropic");
+    logCtx.routeDecision = route.routeDecision;
     if (route.provider.adapter === "openai-responses") {
       nativeRoute = true;
       delete internalBody.max_output_tokens;
@@ -661,7 +664,14 @@ async function handleClaudeMessagesWithBudget(
       const ladder = supportedLadderFor({ provider: route.provider, modelId: route.modelId });
       if (ladder !== undefined && ladder.length === 0) delete internalBody.reasoning;
     }
-  } catch { /* unknown model: let handleResponses shape the 404 */ }
+  } catch (err) {
+    if (err instanceof NoEligiblePolicyCandidateError) {
+      logCtx.routeDecision = err.trace;
+      if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, 404, { closeReason: "non_stream" });
+      return anthropicErrorResponse(404, err.message, "invalid_request_error");
+    }
+    /* unknown model: let handleResponses shape the 404 */
+  }
 
   const headers = new Headers({ "content-type": "application/json" });
   for (const name of FORWARD_HEADERS) {
@@ -671,8 +681,11 @@ async function handleClaudeMessagesWithBudget(
     const value = req.headers.get(name);
     if (value) headers.set(name, value);
   }
-  if (!nativeRoute) {
-    // Routed replays need main ChatGPT auth so OpenAI-backed sidecars remain reachable.
+  // Routed replays need main ChatGPT auth so OpenAI-backed sidecars remain reachable;
+  // native replays have no caller ChatGPT credential. This enrichment is optional:
+  // auth-context later rejects a real physical-main selection, while routed/pool
+  // traffic continues without reading native credentials during a fence/recovery.
+  if (tryClaimNativeMainProfileForTurn(logIds?.turnAdmissionLease)) {
     const { getMainAccountToken } = await import("../codex/main-account");
     const token = getMainAccountToken();
     if (token) {
@@ -681,14 +694,6 @@ async function handleClaudeMessagesWithBudget(
     }
   }
   if (nativeRoute) {
-    // No forwarded ChatGPT auth exists on this surface. Attach the main codex login
-    // (read-only auth.json token); account-pool rotation still overrides downstream.
-    const { getMainAccountToken } = await import("../codex/main-account");
-    const token = getMainAccountToken();
-    if (token) {
-      headers.set("authorization", `Bearer ${token.accessToken}`);
-      headers.set("chatgpt-account-id", token.chatgptAccountId);
-    }
     // ChatGPT-backend prompt-cache affinity rides the session_id HEADER (codex
     // clients always send their session uuid; devlog 090 follow-up: body-level
     // prompt_cache_key alone still yielded cached_tokens:0). Claude Code never sends
@@ -763,8 +768,11 @@ async function handleClaudeMessagesWithBudget(
     // rewrite): log = upstream truth, client = retry signal.
     // Retryable 429s also get Retry-After (#507) so Codex-shaped clients and Claude Code
     // share a backoff hint when the upstream omitted the header.
-    const transient = isTransientUpstreamStatus(response.status);
-    const outStatus = transient ? 529 : response.status;
+    const nativeMainFence = response.status === 503
+      && upstreamRetryAfter?.trim() === "1"
+      && message === "Native Codex main profile is switching; retry this request";
+    const transient = !nativeMainFence && isTransientUpstreamStatus(response.status);
+    const outStatus = nativeMainFence ? 503 : transient ? 529 : response.status;
     const out = new Response(JSON.stringify(anthropicErrorBody(outStatus, message)), {
       status: outStatus,
       headers: {

package/src/server/gui-static.ts

@@ -56,16 +56,25 @@ function isFile(path: string): boolean {
   }
 }
 
-function htmlResponse(path: string, session?: GuiSessionBootstrap): Response {
-  let html = readFileSync(path, "utf8");
-  if (session) {
-    const bootstrap = [
-      `<meta name="opencodex-session-token" content="${session.token}">`,
-      `<meta name="opencodex-session-csrf" content="${session.csrfToken}">`,
-      `<meta name="opencodex-session-origin" content="${session.origin}">`,
-    ].join("");
-    html = html.includes("</head>") ? html.replace("</head>", `${bootstrap}</head>`) : `${bootstrap}${html}`;
-  }
+/** HTML-attribute escape for values interpolated into meta tags. */
+function escapeHtmlAttribute(value: string): string {
+  return value
+    .replaceAll("&", "&amp;")
+    .replaceAll('"', "&quot;")
+    .replaceAll("<", "&lt;")
+    .replaceAll(">", "&gt;");
+}
+
+/** Shared session meta-tag block, escaped for quoted attribute interpolation. */
+function sessionBootstrapMeta(session: GuiSessionBootstrap): string {
+  return [
+    `<meta name="opencodex-session-token" content="${escapeHtmlAttribute(session.token)}">`,
+    `<meta name="opencodex-session-csrf" content="${escapeHtmlAttribute(session.csrfToken)}">`,
+    `<meta name="opencodex-session-origin" content="${escapeHtmlAttribute(session.origin)}">`,
+  ].join("");
+}
+
+function htmlDocumentResponse(html: string): Response {
   return new Response(html, {
     headers: {
       "Content-Type": "text/html",
@@ -76,6 +85,26 @@ function htmlResponse(path: string, session?: GuiSessionBootstrap): Response {
   });
 }
 
+function htmlResponse(path: string, session?: GuiSessionBootstrap): Response {
+  let html = readFileSync(path, "utf8");
+  if (session) {
+    const bootstrap = sessionBootstrapMeta(session);
+    html = html.includes("</head>") ? html.replace("</head>", `${bootstrap}</head>`) : `${bootstrap}${html}`;
+  }
+  return htmlDocumentResponse(html);
+}
+
+/**
+ * Minimal session-bootstrap document, independent of any packaged GUI build. The dev
+ * GUI (Vite) proxies /opencodex-session to the backend with the original host so the
+ * backend can mint an origin-bound loopback session even when gui/dist does not exist.
+ */
+export function serveSessionBootstrap(session: GuiSessionBootstrap): Response {
+  const bootstrap = sessionBootstrapMeta(session);
+  const html = `<!doctype html><html><head><meta charset="utf-8">${bootstrap}</head><body></body></html>`;
+  return htmlDocumentResponse(html);
+}
+
 export function serveGuiFile(
   pathname: string,
   guiDist = findGuiDist(),

package/src/server/images.ts

@@ -15,8 +15,10 @@
 import { formatErrorResponse } from "../bridge";
 import {
   CodexAccountCooldownError,
+  codexMainProfileDrainingResponse,
   cooldownErrorResponse,
   CodexAuthContextError,
+  CodexMainProfileDrainingError,
   CodexPoolAuthenticationError,
   CodexThreadAffinityExpiredError,
 } from "../codex/auth-context";
@@ -35,6 +37,8 @@ import { safeAntigravityHttpErrorMessage } from "../adapters/google-errors";
 import { sanitizeUpstreamErrorText } from "../adapters/upstream-http-error";
 import { ANTIGRAVITY_REQUEST_UA } from "../adapters/google-antigravity-wire";
 import { decodeValidatedImageBase64, MAX_ENCODED_BYTES_PER_IMAGE } from "../images/artifacts";
+import type { AdmissionLease } from "../lib/admission";
+import { codexAccountSelectionForTurn } from "./lifecycle";
 
 export type ImagesEndpoint = "generations" | "edits";
 
@@ -323,6 +327,7 @@ export async function handleImages(
   config: OcxConfig,
   endpoint: ImagesEndpoint,
   logCtx: RequestLogContext,
+  turnAdmissionLease?: AdmissionLease,
 ): Promise<Response> {
   const candidates = selectImagesProvider(config);
   if (candidates.error) {
@@ -375,11 +380,15 @@ export async function handleImages(
   let forwardAuthError: Response | undefined;
   if (canUseOpenAiForward) {
     try {
-      forward = await resolveFirstUsableOpenAiSidecar(candidates.forwardCandidates, req.headers, config);
+      forward = await resolveFirstUsableOpenAiSidecar(candidates.forwardCandidates, req.headers, config, {
+        beginCodexAccountSelection: codexAccountSelectionForTurn(turnAdmissionLease),
+      });
       if (forward) logCtx.provider = formatCodexProviderForLog(forward.providerName, codexLogAccountId(forward.authContext), config);
     } catch (err) {
       if (err instanceof CodexAccountCooldownError) {
         forwardAuthError = cooldownErrorResponse(err);
+      } else if (err instanceof CodexMainProfileDrainingError) {
+        forwardAuthError = codexMainProfileDrainingResponse();
       } else if (err instanceof CodexThreadAffinityExpiredError) {
         forwardAuthError = formatErrorResponse(409, "invalid_request_error", "Codex thread account affinity expired; start a new session");
       } else if (err instanceof CodexAuthContextError) {