@bitkyc08/opencodex 2.23.0-preview.20260816 → 2.24.0

package/src/server/responses/fetch-helpers.ts

@@ -33,7 +33,7 @@ import {
 import { isInjectionDebugEnabled } from "../../lib/debug-settings";
 import { injectionDebugLog } from "../../lib/injection-debug-log";
 import { modelInList, namespacedToolName } from "../../types";
-import type { AdapterEvent, OcxConfig, OcxParsedRequest, OcxProviderConfig, OcxProviderContinuationState, OcxUsage } from "../../types";
+import type { AdapterEvent, OcxConfig, OcxParsedRequest, OcxProviderConfig, OcxProviderContinuationState, OcxUsage, UpstreamHttpVersion } from "../../types";
 import {
   forceRefreshOAuthAccessSnapshot,
   getOAuthCredentialApiBaseUrl,
@@ -149,6 +149,38 @@ export interface ProviderFetchOptions {
   modelId?: string;
 }
 
+/**
+ * Bun's fetch accepts a non-standard `protocol` init to pin the HTTP version
+ * (BunFetchRequestInit.protocol). The DOM lib types do not include it, so the
+ * value is carried on an intersection and stripped before non-Bun callers.
+ * The accepted values are the shared UPSTREAM_HTTP_VERSION_VALUES enum from types.
+ */
+const UPSTREAM_HTTP_VERSION_PROTOCOL: Record<Exclude<UpstreamHttpVersion, "auto">, string> = {
+  "http1.1": "http1.1",
+  h1: "h1",
+  http2: "http2",
+  h2: "h2",
+};
+
+/** Attach Bun's `protocol` pin when the provider opted into a fixed HTTP version. */
+export function withUpstreamHttpVersion(
+  input: Parameters<typeof globalThis.fetch>[0],
+  init: RequestInit | undefined,
+  provider: OcxProviderConfig,
+): RequestInit | undefined {
+  const version = provider.upstreamHttpVersion;
+  if (!version || version === "auto") return init;
+  // Bun's protocol pin requires an https: target; local/plaintext upstreams keep
+  // their existing transport untouched.
+  const target = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+  try {
+    if (new URL(target).protocol !== "https:") return init;
+  } catch {
+    return init;
+  }
+  return { ...(init ?? {}), protocol: UPSTREAM_HTTP_VERSION_PROTOCOL[version] } as RequestInit;
+}
+
 export function providerFetch(
   provider: OcxProviderConfig,
   runtime: BunRuntimeGateInput = currentBunRuntimeIdentity(),
@@ -162,7 +194,7 @@ export function providerFetch(
     if (typeof input === "string" && init && shouldUseCodexWsUpstream(input, init, runtime)) {
       return codexWsUpstreamFetch(input, init, base, runtime);
     }
-    return base(input, init);
+    return base(input, withUpstreamHttpVersion(input, init, provider));
   };
   const waitForPacing = (signal?: AbortSignal) => options.providerName
     ? waitForProviderRequestSlot(options.providerName, provider, options.modelId, signal)

package/src/server/responses/input-admission.ts

@@ -10,7 +10,7 @@
  * catches the pathological case and stays out of the way otherwise. Every uncertainty
  * resolves toward admitting.
  */
-import { nativeOpenAiContextWindow } from "../../codex/catalog/metadata";
+import { nativeOpenAiContextWindow, nativeOpenAiMaxInputTokens } from "../../codex/catalog/metadata";
 import { estimateTokens } from "../../lib/token-estimate";
 import { isCanonicalOpenAiForwardProvider, OPENAI_CODEX_PROVIDER_ID } from "../../providers/openai-tiers";
 import type { OcxContentPart, OcxParsedRequest, OcxProviderConfig } from "../../types";
@@ -129,6 +129,9 @@ export function resolveInputCeiling(
   provider: OcxProviderConfig,
   providerName: string,
   modelId: string,
+  // Operator cap for the canonical native provider. Passed in rather than read from a
+  // config here so this stays pure: no filesystem, no catalog, no registry scan.
+  nativeContextCap?: number,
 ): number | null {
   const configured = positive(provider.modelContextWindows?.[modelId]) ?? positive(provider.contextWindow);
 
@@ -137,18 +140,22 @@ export function resolveInputCeiling(
   // transport-mismatched custom provider named "openai" is preserved verbatim by routing
   // and must not inherit built-in native limits, and a routed `provider/model` id is not a
   // native slug. Static maps only — no catalog read.
-  const native = configured === null
-    && providerName === OPENAI_CODEX_PROVIDER_ID
+  const canonicalNativeBare = providerName === OPENAI_CODEX_PROVIDER_ID
     && isCanonicalOpenAiForwardProvider(provider)
-    && !modelId.includes("/")
-    ? positive(nativeOpenAiContextWindow(modelId))
+    && !modelId.includes("/");
+  const native = configured === null && canonicalNativeBare
+    ? positive(nativeOpenAiContextWindow(modelId, nativeContextCap))
     : null;
+  // The model's own measured input ceiling applies even when the operator configured a
+  // window: a 1,050,000 override must not raise the gate above the 922,000 the upstream
+  // actually accepts. Computed independently of `configured` for exactly that reason.
+  const nativeMaxInput = canonicalNativeBare ? positive(nativeOpenAiMaxInputTokens(modelId, nativeContextCap)) : null;
 
   const window = configured ?? native;
   // modelMaxInputTokens is an input-only cap, so it can only tighten the window.
-  const maxInput = positive(provider.modelMaxInputTokens?.[modelId]);
-  if (window === null) return maxInput;
-  return maxInput === null ? window : Math.min(window, maxInput);
+  const configuredMaxInput = positive(provider.modelMaxInputTokens?.[modelId]);
+  const limits = [window, configuredMaxInput, nativeMaxInput].filter((v): v is number => v !== null);
+  return limits.length === 0 ? null : Math.min(...limits);
 }
 
 /**
@@ -161,8 +168,9 @@ export function checkInputAdmission(
   provider: OcxProviderConfig,
   providerName: string,
   modelId: string,
+  nativeContextCap?: number,
 ): InputAdmissionResult {
-  const ceiling = resolveInputCeiling(provider, providerName, modelId);
+  const ceiling = resolveInputCeiling(provider, providerName, modelId, nativeContextCap);
   if (ceiling === null) return { admitted: true, estimatedTokens: 0, ceiling: null };
   const estimatedTokens = estimateInputTokens(parsed, modelId);
   return { admitted: estimatedTokens <= ceiling * ADMISSION_TOLERANCE, estimatedTokens, ceiling };

package/src/server/responses-undeclared-tool-guard.ts

@@ -0,0 +1,153 @@
+import { namespacedToolName } from "../types";
+import { sseDataPayload, type SseBlockRewrite } from "./sse-payload-rewrite";
+
+/**
+ * Item types the CLIENT executes by name. Hosted calls (`web_search_call`,
+ * `image_generation_call`, `local_shell_call`, `tool_search_call`, …) are run upstream or
+ * carry no tool name, so they are never matched against the request catalog.
+ */
+const CLIENT_EXECUTED_CALL_TYPES = new Set(["function_call", "custom_tool_call"]);
+
+/** An upstream-supplied name reaches the error message; keep it bounded. */
+const MAX_REPORTED_NAME_CHARS = 100;
+
+export const UNDECLARED_TOOL_CALL_ERROR_CODE = "undeclared_tool_call";
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+
+function addWireToolName(names: Set<string>, tool: unknown, namespace?: string): void {
+  if (!isPlainObject(tool) || typeof tool.name !== "string" || tool.name.length === 0) return;
+  names.add(tool.name);
+  // Codex routes MCP calls by an explicit `namespace` field, so the same tool is reachable
+  // as a bare inner name or as the flattened form; accept both rather than guess which
+  // coordinate system this provider echoes back.
+  if (namespace) names.add(namespacedToolName(namespace, tool.name));
+}
+
+function addWireToolSpecs(names: Set<string>, specs: unknown): void {
+  if (!Array.isArray(specs)) return;
+  for (const spec of specs) {
+    if (!isPlainObject(spec)) continue;
+    if (spec.type === "namespace" && Array.isArray(spec.tools)) {
+      const namespace = typeof spec.name === "string" ? spec.name : undefined;
+      for (const inner of spec.tools) addWireToolName(names, inner, namespace);
+      continue;
+    }
+    addWireToolName(names, spec);
+  }
+}
+
+/**
+ * Tool names the OUTBOUND Responses body actually declared.
+ *
+ * This reads the body that goes upstream rather than the parsed internal tool list: the
+ * passthrough forwards wire shapes (namespaced MCP groups, `additional_tools` items carried
+ * inside `input`, routed custom-tool rewrites) that the internal list flattens or renames, and
+ * only the wire names can be compared against what the provider echoes back.
+ */
+export function collectDeclaredWireToolNames(body: unknown): Set<string> {
+  const names = new Set<string>();
+  if (!isPlainObject(body)) return names;
+  addWireToolSpecs(names, body.tools);
+  if (Array.isArray(body.input)) {
+    for (const item of body.input) {
+      if (isPlainObject(item) && item.type === "additional_tools") addWireToolSpecs(names, item.tools);
+    }
+  }
+  return names;
+}
+
+function undeclaredNameInItem(item: unknown, declared: ReadonlySet<string>): string | undefined {
+  if (!isPlainObject(item)) return undefined;
+  if (typeof item.type !== "string" || !CLIENT_EXECUTED_CALL_TYPES.has(item.type)) return undefined;
+  const name = item.name;
+  if (typeof name !== "string" || name.length === 0) return undefined;
+  if (declared.has(name)) return undefined;
+  if (typeof item.namespace === "string" && declared.has(namespacedToolName(item.namespace, name))) {
+    return undefined;
+  }
+  return name;
+}
+
+/** First undeclared client tool named by a Responses SSE payload, or undefined. */
+export function undeclaredToolCallName(
+  payload: unknown,
+  declared: ReadonlySet<string>,
+): string | undefined {
+  if (!isPlainObject(payload)) return undefined;
+  if (payload.type === "response.output_item.added" || payload.type === "response.output_item.done") {
+    return undeclaredNameInItem(payload.item, declared);
+  }
+  // Sparse gateways skip incremental items and only ever ship the terminal snapshot.
+  if (payload.type === "response.completed" || payload.type === "response.incomplete") {
+    return undeclaredToolCallNameInResponse(payload.response, declared);
+  }
+  return undefined;
+}
+
+/** First undeclared client tool in a Responses object's `output` array, or undefined. */
+export function undeclaredToolCallNameInResponse(
+  response: unknown,
+  declared: ReadonlySet<string>,
+): string | undefined {
+  if (!isPlainObject(response) || !Array.isArray(response.output)) return undefined;
+  for (const item of response.output) {
+    const name = undeclaredNameInItem(item, declared);
+    if (name !== undefined) return name;
+  }
+  return undefined;
+}
+
+export function undeclaredToolCallMessage(name: string): string {
+  const reported = name.slice(0, MAX_REPORTED_NAME_CHARS);
+  return `routed provider emitted undeclared client tool "${reported}"; only request-declared tools may be called`;
+}
+
+function failedBlocks(name: string, newline: string): readonly string[] {
+  const failure = {
+    type: "upstream_error",
+    code: UNDECLARED_TOOL_CALL_ERROR_CODE,
+    message: undeclaredToolCallMessage(name),
+  };
+  const payload = JSON.stringify({
+    type: "response.failed",
+    response: { status: "failed", error: failure, last_error: failure },
+  });
+  return [`event: response.failed${newline}data: ${payload}`, "data: [DONE]"];
+}
+
+/**
+ * Fail closed when a routed provider calls a tool the request never declared (#1700).
+ *
+ * The bridged paths already refuse such a call (`declaredToolNames` in src/bridge.ts), but the
+ * native Responses passthrough relayed it verbatim: Codex received a `function_call` for a tool
+ * it has no top-level handler for — `apply_patch`, which under code mode exists only as a nested
+ * `tools.apply_patch(...)` helper inside `exec` — and the turn surfaced as a bare `aborted` with
+ * no output and no explanation. Replacing the offending event with an explicit `response.failed`
+ * turns that silent dead end into a compatibility error naming the tool.
+ *
+ * Everything after the trip is dropped so a later `response.completed` cannot contradict the
+ * terminal already sent. Non-JSON and non-item blocks pass through untouched.
+ */
+export function createUndeclaredToolCallGuardBlockRewrite(
+  declared: ReadonlySet<string>,
+): SseBlockRewrite {
+  let tripped = false;
+  return (block: string) => {
+    if (tripped) return [];
+    const payload = sseDataPayload(block);
+    if (payload === null || payload === "[DONE]") return [block];
+    let parsed: unknown;
+    try {
+      parsed = JSON.parse(payload);
+    } catch {
+      return [block];
+    }
+    const name = undeclaredToolCallName(parsed, declared);
+    if (name === undefined) return [block];
+    tripped = true;
+    return failedBlocks(name, block.includes("\r\n") ? "\r\n" : "\n");
+  };
+}

package/src/server/system-env.ts

@@ -7,6 +7,8 @@ import { PROXY_MARKER, defaultAuthDetectDeps, detectClaudeAuth, ownAdmissionToke
 import { resolveClaudeAuthMode } from "../claude/auth-mode";
 import type { OcxConfig } from "../types";
 import { recordOwnedConfigPath } from "../lib/config-ownership";
+import { providerContextCap } from "../providers/context-cap";
+import { OPENAI_CODEX_PROVIDER_ID } from "../providers/openai-tiers";
 
 /**
  * Does the opencodex dummy marker belong in the system environment?
@@ -237,10 +239,10 @@ async function computeEffectiveModelEnv(config: OcxConfig, auto?: AutoContextMod
   const windows = await boundedContextWindows(async () => {
     const { gatherRoutedModels, visibleNativeSlugs } = await import("../codex/catalog");
     try {
-      return buildClaudeContextWindows([...visibleNativeSlugs(config)], await gatherRoutedModels(config));
+      return buildClaudeContextWindows([...visibleNativeSlugs(config)], await gatherRoutedModels(config), providerContextCap(config, OPENAI_CODEX_PROVIDER_ID));
     } catch (error) {
       if (error && typeof error === "object" && (error as { code?: unknown }).code === "catalog_busy") {
-        return buildClaudeContextWindows([...visibleNativeSlugs(config)], []);
+        return buildClaudeContextWindows([...visibleNativeSlugs(config)], [], providerContextCap(config, OPENAI_CODEX_PROVIDER_ID));
       }
       throw error;
     }

package/src/service.ts

@@ -9,7 +9,7 @@ import { execFileSync, execSync, spawnSync } from "node:child_process";
 import { findLiveProxy, proxyIdentityAt, SERVICE_STOP_LIVENESS } from "./server/proxy-liveness";
 import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmdirSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
-import { dirname, join, resolve, win32 } from "node:path";
+import { dirname, join, posix, resolve, win32 } from "node:path";
 import { expandUserPath, getConfigDir, readPid, removePid, removeRuntimePort, verifyPidIdentity } from "./config";
 import { loadConfig } from "./config";
 import { restoreNativeCodex, restoreNativeCodexAsync } from "./codex/inject";
@@ -113,12 +113,19 @@ function currentCodexSqliteHomeAbsolute(target: "native" | "windows" = "native")
   const raw = process.env.CODEX_SQLITE_HOME?.trim();
   if (!raw) return undefined;
   const expanded = expandUserPath(raw);
-  // Windows service artifacts can be rendered by cross-platform tests and
-  // repair tooling. Preserve an already-absolute drive/UNC path instead of
-  // anchoring it beneath the current POSIX worktree.
-  return target === "windows" && win32.isAbsolute(expanded)
-    ? win32.normalize(expanded)
-    : resolve(expanded);
+  // Service artifacts can be rendered by cross-platform tests and repair tooling, so an
+  // already-absolute path for the TARGET platform is preserved rather than re-anchored
+  // against the writing host. `resolve()` is host-relative in both directions: on a POSIX
+  // host it turns `C:\data` into `<cwd>/C:\data`, and on a Windows host it turns `/tmp/x`
+  // into `D:\tmp\x` — neither is a path the target can use. A relative value still resolves,
+  // because a service unit has no meaningful working directory.
+  //
+  // CODEX_HOME and OPENCODEX_HOME are carried through literally, so without this the same
+  // generated file disagreed with itself about two variables holding the same kind of value.
+  if (target === "windows") {
+    return win32.isAbsolute(expanded) ? win32.normalize(expanded) : resolve(expanded);
+  }
+  return posix.isAbsolute(expanded) ? posix.normalize(expanded) : resolve(expanded);
 }
 
 function currentOpenCodexHome(): string {
@@ -1538,6 +1545,14 @@ export function buildWindowsServiceScript(entry = cliEntry(), port = resolveServ
     '>>"%OCX_SERVICE_LOG%" echo opencodex_home="%OPENCODEX_HOME%"',
     '>>"%OCX_SERVICE_LOG%" echo codex_home="%CODEX_HOME%"',
     '>>"%OCX_SERVICE_LOG%" echo token_file="%OCX_API_TOKEN_FILE%"',
+    'if not exist "%OCX_BUN%" (',
+    '  >>"%OCX_SERVICE_LOG%" echo [%DATE% %TIME%] installation is incomplete: bundled Bun is missing; reinstall opencodex, then run ocx service repair',
+    "  exit /b 3",
+    ")",
+    'if not exist "%OCX_CLI%" (',
+    '  >>"%OCX_SERVICE_LOG%" echo [%DATE% %TIME%] installation is incomplete: CLI entry is missing; reinstall opencodex, then run ocx service repair',
+    "  exit /b 3",
+    ")",
     `"%OCX_BUN%" "%OCX_CLI%" start --port ${port} >>"%OCX_SERVICE_LOG%" 2>&1`,
     "if %ERRORLEVEL% NEQ 0 (",
     '  >>"%OCX_SERVICE_LOG%" echo [%DATE% %TIME%] child exited with code %ERRORLEVEL%; restarting in 5s',

package/src/types.ts

@@ -457,6 +457,17 @@ export interface OcxClaudeCodeConfig {
   smallFastModel?: string;
   /** Inbound model id remaps: exact id first, then date-stripped (`-\d{8}$`). */
   modelMap?: Record<string, string>;
+  /**
+   * Explicit classifier model for Claude Code Auto Mode safety checks (e.g. "RelayA/claude-opus-5").
+   * When unset, bare classifier requests check modelMap, then same-provider affinity from
+   * `claudeCode.model`, then compatible Anthropic-adapter providers, and finally fallbacks.
+   */
+  classifierModel?: string;
+  /**
+   * Ordered fallback candidates for Claude Code Auto Mode classifier routing when the primary
+   * classifier route is not available.
+   */
+  classifierFallbacks?: string[];
   /**
   * Inject ANTHROPIC_BASE_URL etc. into the macOS user domain via `launchctl setenv`
   * so plain `claude` commands route through the proxy without `ocx claude`. Reverted
@@ -514,7 +525,7 @@ export interface OcxClaudeCodeConfig {
    * (the legacy DISABLE_COMPACT pair takes rule-1 precedence in the CLI).
    */
   autoContext?: boolean;
-  /** Compact-window tokens for auto-context. Default 350_000. */
+  /** Compact-window tokens for auto-context. Default 829_800 (AUTO_COMPACT_WINDOW_DEFAULT). */
   autoCompactWindow?: number;
   /**
    * Bundled-skill content elision for ROUTED (non-Anthropic) models (devlog 260712
@@ -1375,6 +1386,14 @@ export interface OcxProviderConfig {
    * link-local, or unique-local upstreams. Metadata endpoints remain blocked.
    */
   allowPrivateNetwork?: boolean;
+  /**
+   * Pin the HTTP version used for upstream provider requests. Bun's fetch negotiates
+   * HTTP/2 via TLS ALPN by default; some Cloudflare-fronted SSE endpoints hang on
+   * HTTP/2 streaming responses (issue #1668). "http1.1" / "h1" forces HTTP/1.1,
+   * "http2" / "h2" forces HTTP/2. Absent or "auto" keeps Bun's default negotiation
+   * (current behavior unchanged). Only meaningful for https: base URLs.
+   */
+  upstreamHttpVersion?: UpstreamHttpVersion;
   /** Keep provider settings on disk but exclude it from routing and model/catalog listings. */
   disabled?: boolean;
   /**
@@ -1668,6 +1687,21 @@ export interface OcxProviderConfig {
   nativeLocalExec?: "off" | "codex-sandbox" | "on";
 }
 
+/**
+ * Accepted values for the per-provider upstream HTTP-version pin (#1668). Shared by the
+ * zod load schema, the management write boundary (POST/PATCH), and the fetch runtime, so
+ * a value that one boundary accepts can never be rejected by another.
+ */
+export const UPSTREAM_HTTP_VERSION_VALUES = [
+  "auto",
+  "http1.1",
+  "h1",
+  "http2",
+  "h2",
+] as const;
+
+export type UpstreamHttpVersion = (typeof UPSTREAM_HTTP_VERSION_VALUES)[number];
+
 export const REASONING_SUMMARY_DELIVERY_VALUES = [
   "sequential",
   "sequential_cutoff",