@bitkyc08/opencodex 2.10.2 → 2.11.0

package/src/update/npm-cache-preflight.mjs

@@ -0,0 +1,201 @@
+import { lstatSync, readdirSync, realpathSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { isAbsolute, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { npmInvocation } from "./npm-invocation.mjs";
+
+const WORKER_ARG = "--ocx-npm-cache-preflight-worker";
+const PROTOCOL_VERSION = 1;
+const WORKER_TIMEOUT_MS = 10_000;
+const NPM_CONFIG_TIMEOUT_MS = 5_000;
+const INSPECTION_TIMEOUT_MS = 7_500;
+const MAX_ENTRIES = 100_000;
+const MAX_DEPTH = 64;
+
+const RESULT_REASONS = new Set([
+  "cache_accessible",
+  "cache_entry_foreign_owner",
+  "cache_entry_inaccessible",
+  "cache_path_malformed",
+  "inspection_incomplete",
+  "npm_config_failed",
+  "npm_unavailable",
+]);
+
+function inaccessibleByMode(stat) {
+  if (stat.isSymbolicLink()) return false;
+  const ownerBits = stat.mode & 0o700;
+  if (stat.isDirectory()) return (ownerBits & 0o700) !== 0o700;
+  return (ownerBits & 0o400) === 0;
+}
+
+/**
+ * Inspect an existing Unix npm cache without following symlinks. The limits are
+ * deliberately part of the result contract: an incomplete inspection cannot prove
+ * that replacing the live package will succeed.
+ */
+export function inspectNpmCacheDirectory(cachePath, options = {}) {
+  const expectedUid = options.expectedUid ?? process.getuid?.();
+  const deadline = (options.nowMs ?? Date.now)() + (options.timeoutMs ?? INSPECTION_TIMEOUT_MS);
+  const maxEntries = options.maxEntries ?? MAX_ENTRIES;
+  const maxDepth = options.maxDepth ?? MAX_DEPTH;
+  const nowMs = options.nowMs ?? Date.now;
+  // Injected uid seam. A test cannot create a genuinely foreign-owned file without a second
+  // account, and without this the symlink-before-ownership rule cannot be pinned: `!isDirectory`
+  // skips a link anyway, so removing the rule leaves every assertion green.
+  const uidOf = options.uidOf ?? ((_path, stat) => stat.uid);
+  const stack = [{ path: cachePath, depth: 0 }];
+  let inspected = 0;
+  let rootResolved = false;
+
+  while (stack.length > 0) {
+    // Budget exhausted is NOT a failure. A mature npm cache legitimately holds hundreds of
+    // thousands of entries — this machine's has ~256k — and treating "we ran out of time to
+    // look" as "your cache is broken" would block updates for ordinary users, which is worse
+    // than the bug this preflight exists to prevent. We looked at a bounded prefix, found
+    // nothing wrong, and let the update proceed.
+    if (inspected >= maxEntries || nowMs() > deadline) {
+      return { ok: true, reason: "inspection_incomplete" };
+    }
+    const current = stack.pop();
+    let stat;
+    try {
+      stat = lstatSync(current.path);
+    } catch (error) {
+      if (current.depth === 0 && error?.code === "ENOENT") {
+        return { ok: true, reason: "cache_accessible" };
+      }
+      return { ok: false, reason: "cache_entry_inaccessible" };
+    }
+    inspected += 1;
+
+    // A symlinked cache ROOT used to be rejected outright, but pointing ~/.npm at another volume
+    // is ordinary npm configuration, and blocking those users would be the same false-positive
+    // failure this preflight exists to avoid. Resolve the root once and inspect the target;
+    // only an unresolvable root is a real problem. Nested links are still never followed.
+    if (current.depth === 0 && stat.isSymbolicLink()) {
+      // Resolve exactly once. realpath already collapses a chain, so a second pass would only
+      // happen if the target is itself reported as a link — treat that as unresolvable rather
+      // than looping.
+      if (rootResolved) return { ok: false, reason: "cache_entry_inaccessible" };
+      rootResolved = true;
+      let resolved;
+      try {
+        resolved = (options.realpathFn ?? realpathSync)(current.path);
+      } catch {
+        return { ok: false, reason: "cache_entry_inaccessible" };
+      }
+      stack.push({ path: resolved, depth: 0 });
+      continue;
+    }
+    // A nested symlink is not. npm creates them constantly below _npx, node_modules and .bin,
+    // and we never follow them — so its owner is irrelevant and must not abort the update.
+    // This has to come BEFORE the ownership check: a foreign-owned but never-followed link is
+    // exactly the false positive that made the previous attempt at this feature unusable.
+    if (stat.isSymbolicLink()) continue;
+
+    if (expectedUid !== undefined && uidOf(current.path, stat) !== expectedUid) {
+      return { ok: false, reason: "cache_entry_foreign_owner" };
+    }
+    if (inaccessibleByMode(stat)) {
+      return { ok: false, reason: "cache_entry_inaccessible" };
+    }
+    if (!stat.isDirectory()) continue;
+    // Same reasoning as the entry budget: too deep to finish is not evidence of a bad cache.
+    if (current.depth >= maxDepth) return { ok: true, reason: "inspection_incomplete" };
+
+    let entries;
+    try {
+      entries = readdirSync(current.path, { withFileTypes: true });
+    } catch {
+      return { ok: false, reason: "cache_entry_inaccessible" };
+    }
+    for (const entry of entries) {
+      stack.push({ path: resolve(current.path, entry.name), depth: current.depth + 1 });
+    }
+  }
+
+  return { ok: true, reason: "cache_accessible" };
+}
+
+function workerResult() {
+  const invocation = npmInvocation(["config", "get", "cache"]);
+  if (!invocation) return { ok: false, reason: "npm_unavailable" };
+  const npm = spawnSync(invocation.file, invocation.args, {
+    encoding: "utf8",
+    timeout: NPM_CONFIG_TIMEOUT_MS,
+    windowsHide: true,
+    ...invocation.options,
+  });
+  if (npm.status !== 0) return { ok: false, reason: "npm_config_failed" };
+
+  const output = typeof npm.stdout === "string" ? npm.stdout.trim() : "";
+  if (!output || output.length > 4096 || output.includes("\0") || /[\r\n]/.test(output) || !isAbsolute(output)) {
+    return { ok: false, reason: "cache_path_malformed" };
+  }
+  return inspectNpmCacheDirectory(output);
+}
+
+// Reasons that legitimately accompany `ok: true`. The parser below cross-checks the flag against
+// this set so a worker cannot claim success with a failure reason (or the reverse). It is a SET,
+// not a single value: a bounded inspection that ran out of budget without finding a problem is a
+// pass, and hardcoding `cache_accessible` here silently rejected exactly that — the pass never
+// reached the caller and every large cache still failed, as `worker_output_malformed`.
+const OK_REASONS = new Set([
+  "cache_accessible",
+  "inspection_incomplete",
+  "windows_skip",
+]);
+
+function parseWorkerOutput(stdout) {
+  if (typeof stdout !== "string" || stdout.length > 1024) return null;
+  try {
+    const parsed = JSON.parse(stdout);
+    if (!parsed || parsed.protocol !== PROTOCOL_VERSION || typeof parsed.ok !== "boolean") return null;
+    if (typeof parsed.reason !== "string" || !RESULT_REASONS.has(parsed.reason)) return null;
+    if (parsed.ok !== OK_REASONS.has(parsed.reason)) return null;
+    if (Object.keys(parsed).sort().join(",") !== "ok,protocol,reason") return null;
+    return { ok: parsed.ok, reason: parsed.reason };
+  } catch {
+    return null;
+  }
+}
+
+/** Run the bounded cache inspection in an isolated, synchronously-timeboxed worker. */
+export function runNpmCachePreflight(options = {}) {
+  if ((options.platform ?? process.platform) === "win32") {
+    return { ok: true, reason: "windows_skip" };
+  }
+  const spawn = options.spawnSyncFn ?? spawnSync;
+  const result = spawn(
+    options.execPath ?? process.execPath,
+    [fileURLToPath(import.meta.url), WORKER_ARG],
+    {
+      encoding: "utf8",
+      timeout: options.timeoutMs ?? WORKER_TIMEOUT_MS,
+      windowsHide: true,
+      env: options.env ?? process.env,
+    },
+  );
+  if (result.status === null) return { ok: false, reason: "worker_timeout" };
+  if (result.status !== 0) return { ok: false, reason: "worker_failed" };
+  return parseWorkerOutput(result.stdout) ?? { ok: false, reason: "worker_output_malformed" };
+}
+
+/** Fixed operator guidance; worker/npm output is intentionally never interpolated. */
+export function npmCachePreflightFailureMessage(reason) {
+  return `npm cache access pre-flight failed (${reason}); fix cache ownership and permissions, then retry`;
+}
+
+const isWorker = process.argv[1]
+  && resolve(process.argv[1]) === fileURLToPath(import.meta.url)
+  && process.argv[2] === WORKER_ARG;
+if (isWorker) {
+  let result;
+  try {
+    result = workerResult();
+  } catch {
+    result = { ok: false, reason: "cache_entry_inaccessible" };
+  }
+  process.stdout.write(JSON.stringify({ protocol: PROTOCOL_VERSION, ...result }));
+}

package/src/usage/log.ts

@@ -385,7 +385,7 @@ function normalizeUsageEntry(entry: PersistedUsageEntry): PersistedUsageEntry {
     usageStatus: entry.usageStatus,
     ...(entry.usage ? { usage: normalizeUsageValue(entry.usage) } : {}),
     ...(typeof entry.totalTokens === "number" ? { totalTokens: entry.totalTokens } : {}),
-    ...(attempts.length > 0 ? { attempts } : {}),
+    ...(Array.isArray(entry.attempts) ? { attempts } : {}),
     ...(entry.errorCode ? { errorCode: entry.errorCode } : {}),
     ...(entry.terminalStatus ? { terminalStatus: entry.terminalStatus } : {}),
     ...(entry.closeReason ? { closeReason: entry.closeReason } : {}),

package/src/vision/index.ts

@@ -275,6 +275,72 @@ function renderDescription(out: { text: string; error?: string }): OcxTextConten
   };
 }
 
+const IMAGE_OMITTED_TEXT = "[image omitted: this model is text-only and the vision sidecar is unavailable (no ChatGPT login)]";
+
+function isPlainRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+/**
+ * Keep the native Responses passthrough body aligned with image replacements made in the parsed
+ * message graph. The passthrough adapter serializes `_rawBody`, while translated adapters serialize
+ * `context.messages`; updating only the latter would send the original pixels to a text-only
+ * Responses upstream even after the vision sidecar produced a caption.
+ *
+ * Rewrites only image-bearing user/developer messages and tool outputs. All other native Responses
+ * items (reasoning, calls, ids, compaction, and provider-specific metadata) remain byte-structurally
+ * untouched.
+ */
+function syncRawBodyImageDescriptions(parsed: OcxParsedRequest, descriptions: readonly string[]): void {
+  const rawBody = parsed._rawBody;
+  if (!isPlainRecord(rawBody) || !Array.isArray(rawBody.input)) return;
+
+  let nextDescription = 0;
+  const rewriteImages = (value: unknown, nonEmptyImageUrlsOnly: boolean): unknown => {
+    if (Array.isArray(value)) {
+      let changed = false;
+      const rewritten = value.map(entry => {
+        const next = rewriteImages(entry, nonEmptyImageUrlsOnly);
+        if (next !== entry) changed = true;
+        return next;
+      });
+      return changed ? rewritten : value;
+    }
+    if (!isPlainRecord(value)) return value;
+    if (value.type === "input_image" && typeof value.image_url === "string") {
+      if (nonEmptyImageUrlsOnly && value.image_url.length === 0) {
+        return { type: "input_text", text: IMAGE_OMITTED_TEXT };
+      }
+      const description = descriptions[nextDescription++];
+      return { type: "input_text", text: description ?? IMAGE_OMITTED_TEXT };
+    }
+    return value;
+  };
+
+  let changed = false;
+  const input = rawBody.input.map(item => {
+    if (!isPlainRecord(item)) return item;
+    const type = typeof item.type === "string" ? item.type : (typeof item.role === "string" ? "message" : "");
+    const role = typeof item.role === "string" ? item.role : "";
+    const isMessageContent = (
+      (type === "message" && (role === "user" || role === "developer"))
+      || type === "agent_message"
+    );
+    const field = isMessageContent
+      ? "content"
+      : (type === "function_call_output" || type === "custom_tool_call_output")
+        ? "output"
+        : undefined;
+    if (!field) return item;
+    const rewritten = rewriteImages(item[field], isMessageContent);
+    if (rewritten === item[field]) return item;
+    changed = true;
+    return { ...item, [field]: rewritten };
+  });
+
+  if (changed) rawBody.input = input;
+}
+
 function sha256(value: string | Uint8Array): string {
   return createHash("sha256").update(value).digest("hex");
 }
@@ -369,7 +435,10 @@ export async function describeImagesInPlace(
     }
     targets.push({ msg, parts });
   }
-  if (jobs.length === 0) return;
+  if (jobs.length === 0) {
+    syncRawBodyImageDescriptions(parsed, []);
+    return;
+  }
 
   // 2. Admit misses in source order. Cache hits and same-turn waiters do not consume the cap.
   const inFlight = new Map<string, Promise<DescribeOutcome>>();
@@ -425,6 +494,7 @@ export async function describeImagesInPlace(
 
   // 3. Rebuild each message, replacing image parts with their descriptions in order.
   let oi = 0;
+  const descriptions: string[] = [];
   for (const { msg, parts } of targets) {
     const newParts: OcxContentPart[] = [];
     for (const p of parts) {
@@ -433,6 +503,7 @@ export async function describeImagesInPlace(
         continue;
       }
       const replacement = renderDescription(outcomes[oi++]);
+      descriptions.push(replacement.text);
       const reservation = translatorBudget?.reserveTransient(
         descriptionEncoder.encode(replacement.text).byteLength,
         { kind: "request_copies" },
@@ -442,6 +513,7 @@ export async function describeImagesInPlace(
     }
     msg.content = newParts;
   }
+  syncRawBodyImageDescriptions(parsed, descriptions);
 }
 
 /**
@@ -452,13 +524,15 @@ export async function describeImagesInPlace(
  */
 export function stripImagesInPlace(parsed: OcxParsedRequest, translatorBudget?: TranslatorBudget): boolean {
   let stripped = false;
+  const descriptions: string[] = [];
   for (const msg of parsed.context.messages) {
     if (!carriesImages(msg.role) || !Array.isArray(msg.content)) continue;
     const parts = msg.content as OcxContentPart[];
     if (!parts.some(p => p.type === "image")) continue;
     msg.content = parts.map(p => {
       if (p.type !== "image") return p;
-      const replacement = { type: "text", text: "[image omitted: this model is text-only and the vision sidecar is unavailable (no ChatGPT login)]" } as OcxContentPart;
+      const replacement = { type: "text", text: IMAGE_OMITTED_TEXT } as OcxContentPart;
+      descriptions.push((replacement as OcxTextContent).text);
       const reservation = translatorBudget?.reserveTransient(
         descriptionEncoder.encode((replacement as OcxTextContent).text).byteLength,
         { kind: "request_copies" },
@@ -468,5 +542,6 @@ export function stripImagesInPlace(parsed: OcxParsedRequest, translatorBudget?:
     });
     stripped = true;
   }
+  syncRawBodyImageDescriptions(parsed, descriptions);
   return stripped;
 }

package/src/web-search/loop.ts

@@ -770,7 +770,7 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
   }
 
   const sse = bridgeToResponsesSSE(
-    produce(), parsed.modelId, toolNsMap, freeform, toolSearch, () => {
+    produce(), parsed._responseModelId ?? parsed.modelId, toolNsMap, freeform, toolSearch, () => {
       const elapsed = Date.now() - loopT0;
       if (executedSearchCount > 0 || searchesExecuted > 0) {
         console.warn(`[web-search-loop] cancelled — ${executedSearchCount} real searches, ${searchesExecuted - executedSearchCount} placeholders, ${elapsed}ms`);

package/src/web-search/parse.ts

@@ -1,3 +1,5 @@
+import { sseFieldValue } from "../lib/sse-decoder";
+
 /** A single web source backing the sidecar's answer. */
 export interface WebSearchSource {
   url: string;
@@ -187,7 +189,8 @@ export async function parseSidecarSSE(response: Response): Promise<WebSearchResu
       const lines = buffer.split("\n");
       buffer = lines.pop() ?? "";
       for (const line of lines) {
-        if (line.startsWith("data: ")) handle(line.slice(6).trim());
+        const data = sseFieldValue(line, "data");
+        if (data !== null) handle(data.trim());
       }
     }
   } finally {