@bitkyc08/opencodex 2.12.0 → 2.13.0

package/src/responses/reasoning-replay-cache.ts

@@ -9,19 +9,42 @@
  * assistant message is about to serialize without thinking parts (compacted
  * history, lost assistant turn, orphan-repaired tool results).
  *
- * Entries are scoped by an optional conversation identity in addition to the
- * call id: provider-generated ids like `call_1` are not globally unique, so a
- * process-wide key would let one conversation's reasoning bleed into another
- * when ids collide (CodeRabbit P1 on #971).
+ * Entries require a conversation identity in addition to the call id:
+ * provider-generated ids like `call_1` are not globally unique, so an
+ * unscoped process-wide key would let one conversation's reasoning bleed into
+ * another when ids collide (CodeRabbit P1 on #971).
  *
  * Privacy: entries hold reasoning text in memory only — never logged,
  * serialized, or exported. Bounded by entry count, total bytes, and TTL, so a
  * long-lived proxy cannot grow without limit.
  */
 
+import { createHmac, randomBytes } from "node:crypto";
+import type {
+  OcxProviderConfig,
+  OcxReasoningReplayIdentity,
+  OcxReasoningReplayScopeRef,
+} from "../types";
+
 const MAX_ENTRIES = 64;
 const MAX_TOTAL_BYTES = 256 * 1024;
 const TTL_MS = 60 * 60 * 1000;
+const replayIdentityKey = randomBytes(32);
+const CREDENTIAL_HEADER_NAMES = new Set([
+  "authorization",
+  "api-key",
+  "chatgpt-account-id",
+  "cookie",
+  "openai-organization",
+  "openai-project",
+  "proxy-authorization",
+  "x-api-key",
+  "x-api-token",
+  "x-auth-token",
+  "x-goog-api-key",
+  "x-openai-organization",
+  "x-openai-project",
+]);
 
 interface CacheEntry {
   text: string;
@@ -34,8 +57,131 @@ let totalBytes = 0;
 let clockForTests: (() => number) | null = null;
 
 const now = (): number => clockForTests?.() ?? Date.now();
-const keyFor = (callId: string, scope: string | undefined): string =>
-  `${scope ?? "global"}\u0000${callId}`;
+
+function nonEmpty(value: unknown): value is string {
+  return typeof value === "string" && value.trim().length > 0;
+}
+
+function keyFor(callId: string, scope: OcxReasoningReplayScopeRef | undefined): string | undefined {
+  const identity = scope?.current;
+  if (
+    !nonEmpty(callId)
+    || !nonEmpty(scope?.clientThreadId)
+    || !nonEmpty(identity?.providerName)
+    || !nonEmpty(identity?.providerDestinationIdentity)
+    || !nonEmpty(identity?.adapterName)
+    || !nonEmpty(identity?.modelId)
+    || !nonEmpty(identity?.credentialIdentity)
+  ) return undefined;
+  return JSON.stringify([
+    scope.clientThreadId,
+    identity.providerName,
+    identity.providerDestinationIdentity,
+    identity.adapterName,
+    identity.modelId,
+    identity.credentialIdentity,
+    callId,
+  ]);
+}
+
+function processLocalIdentity(domain: string, material: string): string {
+  return createHmac("sha256", replayIdentityKey)
+    .update(domain)
+    .update("\0")
+    .update(material)
+    .digest("hex");
+}
+
+function credentialHeaderOverrides(headers: Record<string, string> | undefined): [string, string][] {
+  return Object.entries(headers ?? {})
+    .filter(([name, value]) => CREDENTIAL_HEADER_NAMES.has(name.trim().toLowerCase()) && nonEmpty(value))
+    .map(([name, value]) => [name.trim().toLowerCase(), value] as [string, string])
+    .sort(([leftName, leftValue], [rightName, rightValue]) => (
+      leftName.localeCompare(rightName) || leftValue.localeCompare(rightValue)
+    ));
+}
+
+/** Produce a non-reversible process-local identity for an exact upstream destination. */
+export function reasoningReplayDestinationIdentity(baseUrl: string | undefined): string | undefined {
+  if (!nonEmpty(baseUrl)) return undefined;
+  const canonical = baseUrl.trim().replace(/\/+$/, "");
+  return `destination:${processLocalIdentity("destination", canonical)}`;
+}
+
+/** Produce a non-reversible process-local identity for credential material. */
+export function reasoningReplayCredentialIdentity(
+  kind: "key" | "oauth" | "codex",
+  material: string | undefined,
+  headers?: Record<string, string>,
+): string | undefined {
+  if (!nonEmpty(material)) return undefined;
+  const overrides = credentialHeaderOverrides(headers);
+  return `${kind}:${processLocalIdentity(`credential:${kind}`, JSON.stringify([material, overrides]))}`;
+}
+
+/** Bind Codex forwarding to the effective bearer/account and selected physical pool slot. */
+export function reasoningReplayCodexCredentialIdentity(args: {
+  authorization?: string | null;
+  chatgptAccountId?: string | null;
+  accountId?: string | null;
+  credentialGeneration?: number | string | null;
+  writerGeneration?: number | string | null;
+  headers?: Record<string, string>;
+}): string | undefined {
+  const configuredAuthorization = credentialHeaderOverrides(args.headers)
+    .find(([name]) => name === "authorization")?.[1];
+  const authorization = nonEmpty(args.authorization) ? args.authorization : configuredAuthorization;
+  if (!authorization) return undefined;
+  const material = JSON.stringify([
+    authorization,
+    nonEmpty(args.chatgptAccountId) ? args.chatgptAccountId : "",
+    nonEmpty(args.accountId) ? args.accountId : "",
+    args.credentialGeneration === null || args.credentialGeneration === undefined
+      ? ""
+      : String(args.credentialGeneration),
+    args.writerGeneration === null || args.writerGeneration === undefined
+      ? ""
+      : String(args.writerGeneration),
+  ]);
+  return reasoningReplayCredentialIdentity("codex", material, args.headers);
+}
+
+/** Bind OAuth replay to one persisted credential slot and exact token generation. */
+export function reasoningReplayOAuthCredentialIdentity(
+  snapshot: Readonly<{ accountId: string; generation: string }> | undefined,
+  headers?: Record<string, string>,
+): string | undefined {
+  if (!snapshot || !nonEmpty(snapshot.accountId) || !nonEmpty(snapshot.generation)) return undefined;
+  return reasoningReplayCredentialIdentity(
+    "oauth",
+    `${snapshot.accountId}\0${snapshot.generation}`,
+    headers,
+  );
+}
+
+/** Bind key-auth provider material without putting raw secrets in the replay key. */
+export function reasoningReplayKeyCredentialIdentity(
+  provider: Pick<OcxProviderConfig, "apiKey" | "headers">,
+): string | undefined {
+  const apiKey = nonEmpty(provider.apiKey) ? provider.apiKey : undefined;
+  // Public/static headers do not establish a physical credential boundary.
+  // Header-only/key-optional providers therefore fail closed for replay.
+  if (!apiKey) return undefined;
+  return reasoningReplayCredentialIdentity("key", apiKey, provider.headers);
+}
+
+/** Replace only the holder snapshot so parsed-request copies observe rotations. */
+export function bindReasoningReplayScope(
+  scope: OcxReasoningReplayScopeRef | undefined,
+  identity: OcxReasoningReplayIdentity | undefined,
+): void {
+  if (!scope) return;
+  if (!identity || !keyFor("binding-check", { ...scope, current: identity })) {
+    delete scope.current;
+    return;
+  }
+  scope.current = { ...identity };
+}
 
 /**
  * Record the raw reasoning text that preceded the given tool call.
@@ -43,9 +189,18 @@ const keyFor = (callId: string, scope: string | undefined): string =>
  * Expired entries are swept on insert so the TTL bound holds even when a call
  * id is never read again.
  */
-export function rememberReasoningForCall(callId: string, text: string, scope?: string): void {
+export function rememberReasoningForCall(
+  callId: string,
+  text: string,
+  scope?: OcxReasoningReplayScopeRef,
+): void {
+  // Never fall back to a process-wide namespace. Call ids are supplied by
+  // clients/providers and are therefore neither unique nor trustworthy; an
+  // unscoped entry could be recovered by an unrelated request that reuses the
+  // same id.
   // Empty provider deltas are absence of new reasoning, not a request to erase a candidate.
-  if (!callId || typeof text !== "string" || text.length === 0) return;
+  const key = keyFor(callId, scope);
+  if (!key || typeof text !== "string" || text.length === 0) return;
   const bytes = Buffer.byteLength(text, "utf8");
   // A single entry larger than the whole budget would immediately evict itself.
   if (bytes > MAX_TOTAL_BYTES) return;
@@ -58,7 +213,6 @@ export function rememberReasoningForCall(callId: string, text: string, scope?: s
       totalBytes -= entry.bytes;
     }
   }
-  const key = keyFor(callId, scope);
   const previous = entries.get(key);
   if (previous) totalBytes -= previous.bytes;
   entries.set(key, { text, bytes, at });
@@ -85,9 +239,12 @@ export function rememberReasoningForCall(callId: string, text: string, scope?: s
  * Read the recorded reasoning for a call id without removing it: retries after
  * a failed continuation reuse the same fallback.
  */
-export function peekReasoningForCall(callId: string, scope?: string): string | undefined {
-  if (!callId) return undefined;
+export function peekReasoningForCall(
+  callId: string,
+  scope?: OcxReasoningReplayScopeRef,
+): string | undefined {
   const key = keyFor(callId, scope);
+  if (!key) return undefined;
   const entry = entries.get(key);
   if (!entry) return undefined;
   if (now() - entry.at >= TTL_MS) {

package/src/responses/schema.ts

@@ -107,7 +107,7 @@ export const toolSchema = z.object({
 const builtinToolSchema = z.object({ type: z.string() }).loose();
 
 const hostedToolType = z.enum([
-  "web_search_preview", "file_search", "computer_use_preview",
+  "web_search", "web_search_preview", "file_search", "computer_use_preview",
   "code_interpreter", "image_generation", "mcp",
 ]);
 

package/src/router.ts

@@ -31,10 +31,7 @@ import {
 } from "./routing/trace";
 import { getRoutingProfile, resolvePolicyProfileId } from "./routing/profile";
 import { evaluatePolicyProfile, type PolicyRequestEvidence } from "./routing/evaluator";
-import { candidateCapabilityEvidence } from "./routing/capability";
-import { policyCandidateHealthEvidence } from "./routing/health";
-import { quotaEvidenceForCandidate } from "./routing/quota";
-import { costEvidenceForCandidate } from "./routing/cost";
+import { assemblePolicyCandidateEvidence } from "./routing/compatibility/assemble";
 
 export class NoEligiblePolicyCandidateError extends Error {
   /** Evaluation trace (with per-candidate exclusions) when nothing qualified. */
@@ -250,7 +247,7 @@ function usableResolvedApiKey(apiKey: string | undefined): string | undefined {
   return typeof resolved === "string" && resolved.trim().length > 0 ? resolved : undefined;
 }
 
-function routedProviderConfig(providerName: string, provider: OcxProviderConfig): OcxProviderConfig {
+export function routedProviderConfig(providerName: string, provider: OcxProviderConfig): OcxProviderConfig {
   const registryEntry = PROVIDER_REGISTRY.find(entry => entry.id === providerName);
   if (!registryEntry || !providerMatchesRegistryTransport(providerName, provider)) {
     assertProviderDestinationAllowed(providerName, provider);
@@ -512,21 +509,9 @@ function routeModelInternal(
     // One clock read per decision keeps candidate evidence, exclusions, and
     // scores mutually consistent and reproducible.
     const now = Date.now();
-    const candidateEvidence = profile.candidates.map(candidate => ({
-      provider: candidate.provider,
-      model: candidate.model,
-      capability: candidateCapabilityEvidence(config, candidate.provider, candidate.model),
-      health: policyCandidateHealthEvidence(config, candidate, now),
-      quota: quotaEvidenceForCandidate({
-        provider: candidate.provider,
-        model: candidate.model,
-      }),
-      cost: costEvidenceForCandidate({
-        provider: candidate.provider,
-        model: candidate.model,
-        limitUsd: profile.limits.maxEstimatedCostUsd,
-      }),
-    }));
+    const candidateEvidence = assemblePolicyCandidateEvidence(config, profile, now, {
+      routedProviderConfig,
+    });
     const evaluation = evaluatePolicyProfile(config, policyId, policyEvidence ?? {}, candidateEvidence, now);
     if (evaluation.selectedIndex === null) {
       throw new NoEligiblePolicyCandidateError(policyId, evaluation.trace);

package/src/routing/capability.ts

@@ -11,7 +11,8 @@
  */
 
 import type { OcxConfig } from "../types";
-import { isCanonicalOpenAiForwardProvider } from "../providers/openai-tiers";
+import { isCanonicalOpenAiForwardProvider, OPENAI_CODEX_PROVIDER_ID } from "../providers/openai-tiers";
+import { applyProviderContextCap, providerContextCap } from "../providers/context-cap";
 import { PROVIDER_REGISTRY } from "../providers/registry";
 import {
   nativeInputModalities,
@@ -145,13 +146,18 @@ export function candidateCapabilityEvidence(
   const provider = config.providers[providerName];
   const registryEntry = PROVIDER_REGISTRY.find(entry => entry.id === providerName);
   const catalogRow = cachedCatalogModels().find(model => model.provider === providerName && model.id === modelId);
-  const isNative = providerName === "openai" && !modelId.includes("/");
+  const isNative = providerName === OPENAI_CODEX_PROVIDER_ID && !modelId.includes("/");
 
-  const contextWindow = provider?.modelContextWindows?.[modelId]
+  const rawContextWindow = provider?.modelContextWindows?.[modelId]
     ?? provider?.contextWindow
     ?? registryEntry?.modelContextWindows?.[modelId]
     ?? catalogRow?.contextWindow
     ?? (isNative ? nativeOpenAiContextWindow(modelId) : undefined);
+  // providerContextCaps.openai also ceilings native OpenAI rows (#1430), so routing
+  // evidence never contradicts a capped catalog entry.
+  const contextWindow = isNative
+    ? applyProviderContextCap(rawContextWindow, providerContextCap(config, OPENAI_CODEX_PROVIDER_ID)) ?? rawContextWindow
+    : rawContextWindow;
 
   const modalities = provider?.modelInputModalities?.[modelId]
     ?? registryEntry?.modelInputModalities?.[modelId]

package/src/routing/compatibility/assemble.ts

@@ -0,0 +1,159 @@
+import type { OcxConfig, OcxProviderConfig } from "../../types";
+import { candidateCapabilityEvidence } from "../capability";
+import { costEvidenceForCandidate } from "../cost";
+import type { PolicyCandidateEvidence } from "../evaluator";
+import { policyCandidateHealthEvidence } from "../health";
+import type { NormalizedRoutingProfile } from "../profile";
+import { quotaEvidenceForCandidate } from "../quota";
+import {
+  compatibilitySuiteKey,
+  loadCompatibilityCatalogSnapshot,
+  type CompatibilityCatalogSnapshot,
+} from "./catalog";
+import { findVerdictForSuite, loadCompatibilityEvidenceSnapshot } from "./reader";
+import {
+  resolvePolicyCompatibilitySubjects,
+  type ResolvedPolicyCompatibilitySubjects,
+} from "./subject";
+import type { CandidateCompatibilityEvidence } from "./types";
+
+export type RoutedProviderResolver = (
+  providerName: string,
+  provider: OcxProviderConfig,
+) => OcxProviderConfig;
+
+export interface AssemblePolicyEvidenceOptions {
+  configDir?: string;
+  routedProviderConfig: RoutedProviderResolver;
+  resolveSubjects?: typeof resolvePolicyCompatibilitySubjects;
+  loadEvidenceSnapshot?: typeof loadCompatibilityEvidenceSnapshot;
+  loadCatalogSnapshot?: typeof loadCompatibilityCatalogSnapshot;
+}
+
+function attachCompatibilityEvidence(
+  resolved: ResolvedPolicyCompatibilitySubjects | undefined,
+  snapshot: ReturnType<typeof loadCompatibilityEvidenceSnapshot>,
+  catalog: CompatibilityCatalogSnapshot,
+  profile: NonNullable<NormalizedRoutingProfile["compatibility"]>,
+): CandidateCompatibilityEvidence {
+  const subjectIds = resolved?.subjectIds ?? {};
+  const suites: CandidateCompatibilityEvidence["suites"] = [];
+
+  for (const requirement of profile.requiredSuites) {
+    const subjectId = subjectIds[requirement.evidenceLayer];
+    if (!subjectId) continue;
+    const metadata = catalog.get(compatibilitySuiteKey(requirement.evidenceLayer, requirement.suiteId));
+    if (!metadata) continue;
+    const row = findVerdictForSuite(
+      snapshot,
+      subjectId,
+      requirement.evidenceLayer,
+      requirement.suiteId,
+      metadata.suiteVersion,
+      metadata.suiteManifestDigest,
+    );
+    if (!row) continue;
+    suites.push({
+      subjectId,
+      suiteId: row.suiteId,
+      evidenceLayer: requirement.evidenceLayer,
+      suiteVersion: row.suiteVersion,
+      suiteManifestDigest: row.suiteManifestDigest,
+      verdict: row.verdict,
+      asOf: row.asOf,
+      maxAgeMs: metadata.maxAgeMs,
+      notes: row.notes,
+    });
+  }
+
+  return {
+    subjectIds: { ...subjectIds },
+    projectionAvailable: snapshot.projectionAvailable,
+    suites,
+  };
+}
+
+/**
+ * Assemble production policy candidate evidence including compatibility snapshots.
+ * Compatibility work is completely skipped for legacy/no-requirement profiles.
+ * Active compatibility profiles use one catalog snapshot and one bounded SQLite
+ * read for all candidate subject IDs.
+ */
+export function assemblePolicyCandidateEvidence(
+  config: OcxConfig,
+  profile: NormalizedRoutingProfile,
+  now: number,
+  options: AssemblePolicyEvidenceOptions,
+): PolicyCandidateEvidence[] {
+  const compatibilityPolicy = profile.compatibility;
+  const hasCompatibilityRequirements = Boolean(
+    compatibilityPolicy && compatibilityPolicy.requiredSuites.length > 0,
+  );
+  const resolvedByCandidate = new Map<string, ResolvedPolicyCompatibilitySubjects>();
+  let catalog: CompatibilityCatalogSnapshot = new Map();
+  let snapshot: ReturnType<typeof loadCompatibilityEvidenceSnapshot> = {
+    projectionAvailable: true,
+    projectionIncompatible: false,
+    bySubject: new Map(),
+  };
+
+  if (hasCompatibilityRequirements && compatibilityPolicy) {
+    const resolveSubjects = options.resolveSubjects ?? resolvePolicyCompatibilitySubjects;
+    const loadCatalog = options.loadCatalogSnapshot ?? loadCompatibilityCatalogSnapshot;
+    const loadEvidence = options.loadEvidenceSnapshot ?? loadCompatibilityEvidenceSnapshot;
+    catalog = loadCatalog(compatibilityPolicy.requiredSuites);
+    const subjectIds = new Set<string>();
+
+    for (const candidate of profile.candidates) {
+      const provider = config.providers[candidate.provider];
+      if (!provider) continue;
+      try {
+        const routed = options.routedProviderConfig(candidate.provider, provider);
+        const resolved = resolveSubjects(
+          config,
+          candidate.provider,
+          candidate.model,
+          routed,
+          options.configDir,
+        );
+        resolvedByCandidate.set(`${candidate.provider}/${candidate.model}`, resolved);
+        for (const subjectId of Object.values(resolved.subjectIds)) {
+          if (subjectId) subjectIds.add(subjectId);
+        }
+      } catch {
+        // Subject construction failure is handled per required layer as unknown.
+      }
+    }
+
+    snapshot = loadEvidence([...subjectIds], options.configDir);
+  }
+
+  return profile.candidates.map(candidate => {
+    const key = `${candidate.provider}/${candidate.model}`;
+    const compatibility = hasCompatibilityRequirements && compatibilityPolicy
+      ? attachCompatibilityEvidence(
+        resolvedByCandidate.get(key),
+        snapshot,
+        catalog,
+        compatibilityPolicy,
+      )
+      : undefined;
+
+    return {
+      provider: candidate.provider,
+      model: candidate.model,
+      capability: candidateCapabilityEvidence(config, candidate.provider, candidate.model),
+      health: policyCandidateHealthEvidence(config, candidate, now),
+      quota: quotaEvidenceForCandidate({
+        provider: candidate.provider,
+        model: candidate.model,
+      }),
+      cost: costEvidenceForCandidate({
+        provider: candidate.provider,
+        model: candidate.model,
+        limitUsd: profile.limits.maxEstimatedCostUsd,
+      }),
+      ...(compatibility ? { compatibility } : {}),
+    };
+  });
+}