@bitkyc08/opencodex 2.19.0 → 2.20.0

package/src/chat/inbound.ts

@@ -8,11 +8,23 @@
 export class ChatCompletionsRequestError extends Error {}
 
 type Rec = Record<string, unknown>;
+type ChatCompletionsRoutingBody = Rec & { model: string; messages: unknown[] };
 
 function isRec(v: unknown): v is Rec {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 
+/** Validate only the fields needed before Chat routing, without projecting the body. */
+export function assertChatCompletionsRoutingBody(raw: unknown): asserts raw is ChatCompletionsRoutingBody {
+  if (!isRec(raw)) throw new ChatCompletionsRequestError("request body must be a JSON object");
+  if (typeof raw.model !== "string" || raw.model.length === 0) {
+    throw new ChatCompletionsRequestError("model is required");
+  }
+  if (!Array.isArray(raw.messages) || raw.messages.length === 0) {
+    throw new ChatCompletionsRequestError("messages must be a non-empty array");
+  }
+}
+
 const OUTPUT_CONFIG_EFFORTS = new Set(["minimal", "low", "medium", "high", "xhigh", "max", "ultra"]);
 const OUTPUT_CONFIG_SUMMARIES = new Set(["auto", "concise", "detailed", "none"]);
 
@@ -227,13 +239,7 @@ function resolveReasoningSummary(raw: Rec): string | undefined {
  * Throws ChatCompletionsRequestError (-> 400) on malformed input.
  */
 export function chatCompletionsToResponsesBody(raw: unknown): Rec {
-  if (!isRec(raw)) throw new ChatCompletionsRequestError("request body must be a JSON object");
-  if (typeof raw.model !== "string" || raw.model.length === 0) {
-    throw new ChatCompletionsRequestError("model is required");
-  }
-  if (!Array.isArray(raw.messages) || raw.messages.length === 0) {
-    throw new ChatCompletionsRequestError("messages must be a non-empty array");
-  }
+  assertChatCompletionsRoutingBody(raw);
 
   const systemParts: string[] = [];
   const input: Rec[] = [];

package/src/cli/claude.ts

@@ -19,6 +19,7 @@ import { configuredAdminToken } from "../lib/admin-secrets";
 import { PROXY_MARKER, ownAdmissionTokens, defaultAuthDetectDeps, detectClaudeAuth, type AuthDetectDeps } from "../claude/auth-detect";
 import { resolveClaudeAuthMode } from "../claude/auth-mode";
 import { withProcessRuntimeProvenance } from "../lib/bun-runtime";
+import { selfLaunchArgv } from "../lib/self-launch-argv";
 import { ANTHROPIC_PARENT_ENV_SLOTS, trustedNodeLauncherContext, type AnthropicParentEnvSlot } from "./launcher-context";
 
 export interface ClaudeLaunchEnv {
@@ -269,7 +270,7 @@ async function ensureProxyForClaude(): Promise<number | null> {
   if (live) return live.port;
   const cfgPort = loadConfig().port;
   const pinPort = typeof cfgPort === "number" && cfgPort > 0 ? cfgPort : 10100;
-  const child = spawn(process.execPath, [process.argv[1], "start", "--port", String(pinPort)], {
+  const child = spawn(process.execPath, selfLaunchArgv(["start", "--port", String(pinPort)]), {
     detached: true,
     stdio: "ignore",
     windowsHide: true,

package/src/cli/combo.ts

@@ -91,6 +91,9 @@ async function set(argv: string[], deps: RuntimeApiDeps): Promise<void> {
   if (alias !== undefined) combo.alias = alias === "-" ? "" : alias;
   if (nativeAlias) combo.nativeAlias = true;
   if (displayName !== undefined) combo.displayName = displayName === "-" ? "" : displayName;
+  const current = await runtimeRequest<{ combos?: ComboRow[] }>("/api/combos", {}, deps);
+  const existing = (current.combos ?? []).find(row => row.id === (renameFrom ?? id));
+  if (existing?.imageInput === "disabled") combo.imageInput = "disabled";
   const result = await runtimeRequest("/api/combos", {
     method: "PUT",
     body: JSON.stringify({ id, combo, ...(renameFrom ? { renameFrom } : {}) }),

package/src/cli/dispatch.ts

@@ -488,6 +488,14 @@ const commandRunners: Record<string, CommandRunner> = {
     const { cmdOpencode } = await import("./opencode");
     return await cmdOpencode(deps.args.slice(1));
   },
+  mcode: async deps => {
+    const { cmdMcode } = await import("./minimax");
+    return await cmdMcode(deps.args.slice(1));
+  },
+  mmx: async deps => {
+    const { cmdMmx } = await import("./minimax");
+    return await cmdMmx(deps.args.slice(1));
+  },
   help: async () => {
     printUsage();
     return 0;

package/src/cli/export-command.ts

@@ -1,8 +1,8 @@
 /**
  * `ocx export --client <id>` — print a client config for the live proxy.
  *
- * Seven clients, four formats: opencode and Pi are JSON, OMP, Hermes and Gajae
- * are YAML, OpenClaw JSON5, Kimi TOML.
+ * Eight clients, four formats: OpenCode and Pi are JSON; OMP, Hermes, Gajae and
+ * MiniMax Code are YAML; OpenClaw is JSON5; Kimi is TOML.
  *
  * Two consumers, one payload (devlog 260731_client_config_export/020):
  *

package/src/cli/help.ts

@@ -67,6 +67,8 @@ Usage:
   ocx claude [args...]        Launch Claude Code wired to the proxy (model discovery on)
   ocx claude desktop [sub]    Manage and apply Claude Desktop's four-family profile
   ocx opencode [args...]      Launch opencode wired to the proxy (runtime provider config)
+  ocx mcode [args...]         Launch MiniMax Code through its managed provider
+  ocx mmx text <sub> [args]   Launch MiniMax CLI text through the proxy
   ocx help [command]          Show help
   ocx --version | -v          Print version
 

package/src/cli/index.ts

@@ -60,6 +60,7 @@ import { setIntegrationEnabled, shouldSyncCodexOnStart, shouldSyncGrokOnStart, s
 
 import { removeOwnedConfigState } from "../lib/config-ownership";
 import { withProcessRuntimeProvenance } from "../lib/bun-runtime";
+import { selfLaunchArgv } from "../lib/self-launch-argv";
 import { initializeNodeLauncherContext } from "./launcher-context";
 import { createLocalAttestationSecret } from "../lib/local-management-attestation";
 import { MEMORY_DRAIN_RESTART_MS, REPLACEMENT_READY_TIMEOUT_MS } from "../lib/system-restart-contract";
@@ -121,11 +122,11 @@ function grokSyncFailureMessage(err: unknown): string {
 
 /** Argv for detached `start`, optionally hard-pinning the listen port. */
 function startArgv(port?: number): string[] {
-  const args = [process.argv[1], "start"];
+  const args = ["start"];
   if (typeof port === "number" && Number.isFinite(port) && port > 0 && port <= 65535) {
     args.push("--port", String(Math.trunc(port)));
   }
-  return args;
+  return selfLaunchArgv(args);
 }
 
 async function chooseListenPort(requestedPort?: number): Promise<number> {

package/src/cli/lab.ts

@@ -36,6 +36,7 @@ import {
   queryPassiveProductionSignals,
   type PassiveProductionQueryResultV1,
 } from "../lab/query";
+import { isLabRouteSubjectId } from "../usage/log";
 import {
   CliUsageError,
   RuntimeApiError,
@@ -63,6 +64,14 @@ import { planManualLabRun } from "../lab/automation/planner";
 import { listLabAutomationRuns } from "../lab/automation/runs-query";
 import { LabAutomationError, type LabAutomationLayer } from "../lab/automation/types";
 import { createProductionLabRouteExecutor } from "../lib/lab-live-route-production";
+import {
+  exportLocalPublicEvidence,
+  importCommunityEvidenceFile,
+  listCommunityEvidenceContext,
+  previewLocalPublicEvidence,
+  verifyPublicEvidenceFile,
+  type PublicVerificationSummaryV1,
+} from "../lab/public";
 
 const USAGE = `Usage:
   ocx lab status [--json]
@@ -76,6 +85,11 @@ const USAGE = `Usage:
   ocx lab artifacts [--status <s>] [--artifact-class <c>] [--limit <n>] [--cursor <c>] [--json]
   ocx lab artifact <digest> [--json]
   ocx lab catalog [--layer <layer>] [--suite <id>] [--json]
+  ocx lab public preview --event <eventId> [--event <eventId> ...] [--json]
+  ocx lab public export --event <eventId> [--event <eventId> ...] [--json]
+  ocx lab public verify --file <bundle.json> [--json]
+  ocx lab public import --file <bundle.json> [--json]
+  ocx lab public community [--json]
   ocx lab automation status [--json]
   ocx lab automation enable [--protocol] [--live] [--json]
   ocx lab automation disable [--json]
@@ -223,6 +237,119 @@ function runListLines(page: ReturnType<typeof listLabAutomationRuns>): string[]
   return lines.length > 0 ? lines : ["No automation runs"];
 }
 
+function takeRepeatedOptions(args: string[], flag: string): string[] {
+  const values: string[] = [];
+  while (true) {
+    const index = args.indexOf(flag);
+    if (index < 0) break;
+    const value = args[index + 1];
+    if (!value || value.startsWith("--")) {
+      throw new CliUsageError(`${flag} requires a value`, USAGE);
+    }
+    values.push(value);
+    args.splice(index, 2);
+  }
+  return values;
+}
+
+function publicPreviewLines(result: ReturnType<typeof previewLocalPublicEvidence>): string[] {
+  return [
+    `Public evidence preview: ${result.bundle.records.length} exportable record(s)`,
+    `Excluded: ${result.excluded.length}`,
+    "Unsigned local preview; no publisher key or remote publish is created.",
+  ];
+}
+
+function publicExportLines(result: ReturnType<typeof exportLocalPublicEvidence>): string[] {
+  return [
+    "Public evidence exported locally",
+    `Bundle: ${result.bundle.bundleId}`,
+    `Publisher: ${result.bundle.publisher.keyId}`,
+    `Path: ${result.stored.path}`,
+    `Excluded: ${result.excluded.length}`,
+    "No remote publish occurred.",
+  ];
+}
+
+function publicVerificationLines(result: PublicVerificationSummaryV1): string[] {
+  if (result.status !== "cryptographically_valid") {
+    return [
+      `Public evidence verification: ${result.status}`,
+      "Not locally verified.",
+    ];
+  }
+  return [
+    "Public evidence verification: cryptographically valid",
+    `Bundle: ${result.bundleId}`,
+    `Publisher: ${result.publisherKeyId}`,
+    "Not locally verified. Signature validity proves integrity/continuity only.",
+  ];
+}
+
+function handlePublicLabCommand(
+  argv: string[],
+  wantsJson: boolean,
+  configDir: string,
+): void {
+  const [action, ...restInput] = argv;
+  const rest = [...restInput];
+  switch (action) {
+    case "preview": {
+      const eventIds = takeRepeatedOptions(rest, "--event");
+      rejectArgs(rest, USAGE);
+      const result = previewLocalPublicEvidence({ eventIds }, configDir);
+      printData(result, wantsJson, publicPreviewLines(result));
+      return;
+    }
+    case "export": {
+      const eventIds = takeRepeatedOptions(rest, "--event");
+      rejectArgs(rest, USAGE);
+      const result = exportLocalPublicEvidence({ eventIds }, configDir);
+      printData(result, wantsJson, publicExportLines(result));
+      return;
+    }
+    case "verify": {
+      const path = takeOption(rest, "--file");
+      if (!path) throw new CliUsageError("public verify requires --file", USAGE);
+      rejectArgs(rest, USAGE);
+      const result = verifyPublicEvidenceFile(path);
+      printData(result, wantsJson, publicVerificationLines(result));
+      if (result.status !== "cryptographically_valid") {
+        throw new RuntimeApiError(`public evidence verification failed: ${result.status}`, 422, result);
+      }
+      return;
+    }
+    case "import": {
+      const path = takeOption(rest, "--file");
+      if (!path) throw new CliUsageError("public import requires --file", USAGE);
+      rejectArgs(rest, USAGE);
+      const result = importCommunityEvidenceFile(path, configDir);
+      printData(result, wantsJson, [
+        `Community evidence imported: ${result.bundleId}`,
+        `Publisher: ${result.publisherKeyId}`,
+        "Trust: community_untrusted_v1; not locally verified.",
+      ]);
+      return;
+    }
+    case "community": {
+      rejectArgs(rest, USAGE);
+      const result = listCommunityEvidenceContext(configDir);
+      const lines = result.evidence.length > 0
+        ? result.evidence.map((row) =>
+          `${row.bundleId} publisher=${row.publisherKeyId} active=${row.activeRecordCount} revoked=${row.revokedRecordCount}`,
+        )
+        : ["No community evidence"];
+      printData(result, wantsJson, [
+        "Community evidence (untrusted, read-only context; not locally verified)",
+        ...lines,
+      ]);
+      return;
+    }
+    default:
+      throw new CliUsageError("unknown public subcommand", USAGE);
+  }
+}
+
 export async function handleLabCommand(argv: string[], deps: LabCliDeps = {}): Promise<number> {
   return runCliAction(async () => {
     const configDir = deps.configDir ?? getConfigDir();
@@ -232,6 +359,10 @@ export async function handleLabCommand(argv: string[], deps: LabCliDeps = {}): P
 
     try {
       switch (sub) {
+        case "public": {
+          handlePublicLabCommand(rest, wantsJson, configDir);
+          return;
+        }
         case "status": {
           rejectArgs(rest, USAGE);
           const status = queryLabStatus(configDir);
@@ -243,6 +374,9 @@ export async function handleLabCommand(argv: string[], deps: LabCliDeps = {}): P
           const limit = takeIntegerOption(rest, "--limit", { min: 1 });
           rejectArgs(rest, USAGE);
           if (!subjectId) throw new CliUsageError("--subject is required", USAGE);
+          if (!isLabRouteSubjectId(subjectId)) {
+            throw new CliUsageError("--subject must be an exact Lab route subject id", USAGE);
+          }
           const result = queryPassiveProductionSignals(subjectId, limit, configDir);
           printData(result, wantsJson, passiveProductionLines(result));
           return;
@@ -461,7 +595,7 @@ export async function handleLabCommand(argv: string[], deps: LabCliDeps = {}): P
           throw new CliUsageError(`unknown lab subcommand: ${sub}`, USAGE);
       }
     } catch (err) {
-      if (err instanceof CliUsageError) throw err;
+      if (err instanceof CliUsageError || err instanceof RuntimeApiError) throw err;
       if (err instanceof LabProjectionUnavailableError || err instanceof LabProjectionIncompatibleError) {
         throw new LabStateError(labErrorMessage(err));
       }