@bitkyc08/opencodex 2.10.2 → 2.11.0

package/src/codex/native-residue.ts

@@ -1,5 +1,15 @@
 import { createHash } from "node:crypto";
-import { lstatSync, readFileSync, readdirSync, realpathSync, statSync } from "node:fs";
+import {
+  closeSync,
+  fstatSync,
+  lstatSync,
+  openSync,
+  readFileSync,
+  readdirSync,
+  realpathSync,
+  readSync,
+  statSync,
+} from "node:fs";
 import type { Stats } from "node:fs";
 import { basename, dirname, join, resolve } from "node:path";
 
@@ -69,6 +79,8 @@ const MODELS_CACHE_FILE_NAME = basename(CODEX_MODELS_CACHE_PATH);
 const JOURNAL_FILE_NAME = "opencodex-journal.json";
 const HISTORY_DATABASE_FILE_NAME = "state_5.sqlite";
 const ROUTED_CATALOG_DESCRIPTION_PREFIX = "Routed via opencodex → ";
+const MAX_ROLLOUT_INSPECTION_BYTES = 64 * 1024 * 1024;
+const ROLLOUT_READ_CHUNK_BYTES = 64 * 1024;
 
 function errorCode(error: unknown): string | undefined {
   return (error as NodeJS.ErrnoException | undefined)?.code;
@@ -141,6 +153,53 @@ function indeterminate(
   return { kind: "indeterminate", surface, path, reason };
 }
 
+function rolloutSessionMetaPayload(
+  line: string,
+): { kind: "payload"; payload: Record<string, unknown> | null } | { kind: "malformed"; reason: string } {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(line);
+  } catch (error) {
+    return { kind: "malformed", reason: `malformed rollout JSONL: ${errorReason(error)}` };
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return { kind: "malformed", reason: "rollout JSONL record is not an object" };
+  }
+  const record = parsed as Record<string, unknown>;
+  if (record.type !== "session_meta") return { kind: "payload", payload: null };
+  if (!record.payload || typeof record.payload !== "object" || Array.isArray(record.payload)) {
+    return { kind: "malformed", reason: "session_meta payload has an unknown shape" };
+  }
+  return { kind: "payload", payload: record.payload as Record<string, unknown> };
+}
+
+function consumeRolloutLines(
+  surface: "history" | "history-backup",
+  path: string,
+  partial: string,
+  first: Record<string, unknown> | undefined,
+  latest: Record<string, unknown> | undefined,
+): NativeRoutedResidueResult | { kind: "continue"; partial: string; first: Record<string, unknown> | undefined; latest: Record<string, unknown> | undefined } {
+  let rest = partial;
+  let newline = rest.indexOf("\n");
+  while (newline !== -1) {
+    const line = rest.slice(0, newline);
+    rest = rest.slice(newline + 1);
+    if (line.trim()) {
+      const payload = rolloutSessionMetaPayload(line);
+      if (payload.kind === "malformed") {
+        return indeterminate(surface, path, payload.reason);
+      }
+      if (payload.payload !== null) {
+        first ??= payload.payload;
+        latest = payload.payload;
+      }
+    }
+    newline = rest.indexOf("\n");
+  }
+  return { kind: "continue", partial: rest, first, latest };
+}
+
 function classifyToml(
   surface: "config" | "profile",
   path: string,
@@ -358,50 +417,104 @@ function classifyReferencedRollout(
   surface: "history" | "history-backup",
   reference: RolloutReference,
 ): NativeRoutedResidueResult {
-  const read = readRegularFile(reference.path);
-  if (read.kind === "absent") {
+  const resolved = resolveRegularFile(reference.path);
+  if (resolved.kind === "absent") {
     return indeterminate(surface, reference.path, "referenced rollout is absent");
   }
-  if (read.kind === "indeterminate") return indeterminate(surface, reference.path, read.reason);
+  if (resolved.kind === "indeterminate") return indeterminate(surface, reference.path, resolved.reason);
+
+  let handle: number;
+  try {
+    handle = openSync(resolved.path, "r");
+  } catch (error) {
+    return indeterminate(surface, resolved.path, `unreadable rollout: ${errorReason(error)}`);
+  }
 
   let first: Record<string, unknown> | undefined;
   let latest: Record<string, unknown> | undefined;
-  for (const line of read.content.split("\n")) {
-    if (!line.trim()) continue;
-    let parsed: unknown;
-    try {
-      parsed = JSON.parse(line);
-    } catch (error) {
-      return indeterminate(surface, read.path, `malformed rollout JSONL: ${errorReason(error)}`);
+  let partial = "";
+  let totalRead = 0;
+  try {
+    const opened = fstatSync(handle);
+    if (opened.size > MAX_ROLLOUT_INSPECTION_BYTES) {
+      return indeterminate(
+        surface,
+        resolved.path,
+        `referenced rollout exceeds the ${MAX_ROLLOUT_INSPECTION_BYTES} byte inspection limit`,
+      );
     }
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-      return indeterminate(surface, read.path, "rollout JSONL record is not an object");
+    const decoder = new TextDecoder("utf-8", { ignoreBOM: true });
+    const buffer = Buffer.allocUnsafe(ROLLOUT_READ_CHUNK_BYTES);
+    while (totalRead < opened.size) {
+      const remaining = Math.min(buffer.length, opened.size - totalRead);
+      const count = readSync(handle, buffer, 0, remaining, totalRead);
+      if (count === 0) {
+        return indeterminate(surface, resolved.path, "rollout read ended before the observed size");
+      }
+      if (count < 0) {
+        return indeterminate(surface, resolved.path, "rollout read ended before the observed size");
+      }
+      totalRead += count;
+      partial += decoder.decode(buffer.subarray(0, count), { stream: true });
+      const consumed = consumeRolloutLines(surface, resolved.path, partial, first, latest);
+      if (consumed.kind !== "continue") return consumed;
+      partial = consumed.partial;
+      first = consumed.first;
+      latest = consumed.latest;
     }
-    const record = parsed as Record<string, unknown>;
-    if (record.type !== "session_meta") continue;
-    if (!record.payload || typeof record.payload !== "object" || Array.isArray(record.payload)) {
-      return indeterminate(surface, read.path, "session_meta payload has an unknown shape");
+    partial += decoder.decode();
+    const consumed = consumeRolloutLines(surface, resolved.path, partial, first, latest);
+    if (consumed.kind !== "continue") return consumed;
+    partial = consumed.partial;
+    first = consumed.first;
+    latest = consumed.latest;
+    if (partial.trim()) {
+      const payload = rolloutSessionMetaPayload(partial);
+      if (payload.kind === "malformed") {
+        return indeterminate(surface, resolved.path, payload.reason);
+      }
+      if (payload.payload !== null) {
+        first ??= payload.payload;
+        latest = payload.payload;
+      }
+    }
+    const after = fstatSync(handle);
+    if (!sameStat(resolved.stat, after)) {
+      return indeterminate(surface, resolved.path, "rollout changed while it was being observed");
+    }
+    const pathAfter = statSync(resolved.path);
+    if (!sameStat(resolved.stat, pathAfter)) {
+      return indeterminate(surface, resolved.path, "rollout pathname was replaced while it was being observed");
+    }
+  } catch (error) {
+    if (errorCode(error) === "ENOENT") {
+      return indeterminate(surface, resolved.path, "referenced rollout is absent");
+    }
+    return indeterminate(surface, resolved.path, `unreadable rollout: ${errorReason(error)}`);
+  } finally {
+    try {
+      closeSync(handle);
+    } catch {
+      // Closing an already-closed descriptor cannot affect the classification.
     }
-    const payload = record.payload as Record<string, unknown>;
-    first ??= payload;
-    latest = payload;
   }
 
   if (!first || !latest) {
-    return indeterminate(surface, read.path, "referenced rollout has no session_meta metadata");
+    return indeterminate(surface, resolved.path, "referenced rollout has no session_meta metadata");
   }
+  let hasOpenCodexProvider = false;
   for (const [position, payload] of [["first", first], ["latest", latest]] as const) {
     if (payload.id !== reference.id) {
-      return indeterminate(surface, read.path, `${position} session_meta does not identify the referenced thread`);
+      return indeterminate(surface, resolved.path, `${position} session_meta does not identify the referenced thread`);
     }
     if (typeof payload.model_provider !== "string" || !payload.model_provider) {
-      return indeterminate(surface, read.path, `${position} session_meta has no provider metadata`);
-    }
-    if (payload.model_provider === "opencodex") {
-      return { kind: "residue", surface, path: read.path };
+      return indeterminate(surface, resolved.path, `${position} session_meta has no provider metadata`);
     }
+    hasOpenCodexProvider = hasOpenCodexProvider || payload.model_provider === "opencodex";
   }
-  return { kind: "clean" };
+  return hasOpenCodexProvider
+    ? { kind: "residue", surface, path: resolved.path }
+    : { kind: "clean" };
 }
 
 function classifyReferencedRollouts(

package/src/codex/pool-rotation.ts

@@ -19,6 +19,11 @@ const MAX_STICKY_LIMIT = 100;
 const DEFAULT_STRATEGY: OcxAccountPoolRotationStrategy = "quota";
 const VALID_STRATEGIES = new Set<OcxAccountPoolRotationStrategy>(["quota", "round-robin", "fill-first"]);
 
+/** Selection order for an account with no stored preference: one flat tier. */
+export const DEFAULT_ACCOUNT_PRIORITY = 0;
+export const MIN_ACCOUNT_PRIORITY = -100;
+export const MAX_ACCOUNT_PRIORITY = 100;
+
 /** Strict parse for management APIs — returns null instead of defaulting. */
 export function parseAccountPoolStrategy(raw: unknown): OcxAccountPoolRotationStrategy | null {
   if (typeof raw === "string" && VALID_STRATEGIES.has(raw as OcxAccountPoolRotationStrategy)) {
@@ -43,6 +48,71 @@ export function normalizeAccountPoolStickyLimit(raw: unknown): number {
   return parseAccountPoolStickyLimit(raw) ?? DEFAULT_STICKY_LIMIT;
 }
 
+/** Strict parse for management APIs — returns null instead of defaulting. */
+export function parseAccountPriority(raw: unknown): number | null {
+  if (
+    typeof raw === "number"
+    && Number.isInteger(raw)
+    && raw >= MIN_ACCOUNT_PRIORITY
+    && raw <= MAX_ACCOUNT_PRIORITY
+  ) {
+    return raw;
+  }
+  return null;
+}
+
+export function normalizeAccountPriority(raw: unknown): number {
+  return parseAccountPriority(raw) ?? DEFAULT_ACCOUNT_PRIORITY;
+}
+
+/**
+ * Narrow an already-eligible account list to the highest selection-order tier that
+ * still has usable quota. Priority is an *ordering* boundary layered on top of
+ * eligibility: it never admits an account the caller already filtered out, and it
+ * never keeps the pool on a tier whose every member is drained.
+ *
+ * Contract (each clause is load-bearing for "no behavior change when unconfigured"):
+ * - one distinct priority across `ids` (the unconfigured case) returns `ids` unchanged,
+ *   so today's pick sequence is preserved byte for byte;
+ * - input order is preserved inside the returned tier, which keeps the `__main__`
+ *   head-of-list bias and the first-index tie-break used by SWRR/lowest-usage;
+ * - every tier drained returns `ids` unchanged, reproducing today's
+ *   stay-put-until-429 behavior rather than inventing a pick;
+ * - a `pinnedId` that is present *and* has headroom lowers the ceiling to its own
+ *   tier, which is what makes a manual "use this now" survive round-robin and
+ *   fill-first without any mutable selection state. A drained or absent pin is
+ *   ignored, so the pin expires on its own once the account crosses the threshold.
+ */
+export function selectPriorityTier(
+  ids: readonly string[],
+  priorityOf: (id: string) => number,
+  hasHeadroom: (id: string) => boolean,
+  pinnedId?: string,
+): readonly string[] {
+  // Readonly out as well as in: the no-change cases return the caller's own array, so a
+  // mutating caller would corrupt its input in exactly the cases that must not change.
+  const list = ids;
+  if (list.length <= 1) return list;
+
+  const priorities = list.map(priorityOf);
+  const firstPriority = priorities[0]!;
+  if (priorities.every(priority => priority === firstPriority)) return list;
+
+  let ceiling = Number.POSITIVE_INFINITY;
+  if (pinnedId !== undefined) {
+    const pinnedIndex = list.indexOf(pinnedId);
+    if (pinnedIndex >= 0 && hasHeadroom(pinnedId)) ceiling = priorities[pinnedIndex]!;
+  }
+
+  const tiers = [...new Set(priorities)].sort((a, b) => b - a);
+  for (const tier of tiers) {
+    if (tier > ceiling) continue;
+    const members = list.filter((_, index) => priorities[index] === tier);
+    if (members.some(hasHeadroom)) return members;
+  }
+  return list;
+}
+
 function getOrCreateState(poolKey: string): SelectionState {
   let state = selectionState.get(poolKey);
   if (!state) {
@@ -60,7 +130,7 @@ function cloneSelectionState(state: SelectionState): SelectionState {
   };
 }
 
-function smoothWeightedIndex(ids: string[], state: SelectionState): number {
+function smoothWeightedIndex(ids: readonly string[], state: SelectionState): number {
   let best = -1;
   let bestScore = Number.NEGATIVE_INFINITY;
   let total = 0;
@@ -87,7 +157,7 @@ function smoothWeightedIndex(ids: string[], state: SelectionState): number {
  * either the live map entry or a scratch/clone for dry-run peek.
  */
 function pickRoundRobinFromState(
-  eligibleIds: string[],
+  eligibleIds: readonly string[],
   stickyLimit: number,
   state: SelectionState,
   commitSticky: boolean,
@@ -118,7 +188,7 @@ function pickRoundRobinFromState(
 
 export function pickRoundRobinAccount(
   poolKey: string,
-  eligibleIds: string[],
+  eligibleIds: readonly string[],
   stickyLimit: number,
 ): string | null {
   return pickRoundRobinFromState(eligibleIds, stickyLimit, getOrCreateState(poolKey), true);
@@ -130,7 +200,7 @@ export function pickRoundRobinAccount(
  */
 export function peekRoundRobinAccount(
   poolKey: string,
-  eligibleIds: string[],
+  eligibleIds: readonly string[],
   stickyLimit: number,
 ): string | null {
   const live = selectionState.get(poolKey);

package/src/codex/refresh.ts

@@ -12,6 +12,8 @@ export interface CodexCatalogRefreshResult {
   catalogWritten: boolean;
   cacheSynced: boolean;
   comboOmissions: ComboCatalogOmission[];
+  /** Desired OFF observed under K during the catalog commit; no cache write either. */
+  skippedReason?: "desired_disabled";
 }
 
 interface RefreshDeps {
@@ -45,6 +47,11 @@ export async function refreshCodexModelCatalog(
   const catalogExists = deps.existsSync(result.path);
   const catalogWritten = result.catalogWritten === true;
   const comboOmissions = result.comboOmissions ?? [];
+  if (result.skippedReason === "desired_disabled") {
+    // The commit path observed OFF under K. Invalidate nothing: rewriting the
+    // models cache here would be exactly the routed-cache write the skip refused.
+    return { ...result, catalogExists, catalogWritten: false, cacheSynced: false, comboOmissions };
+  }
   if (!catalogExists) {
     return { ...result, catalogExists, catalogWritten: false, cacheSynced: false, comboOmissions };
   }