@bitkyc08/opencodex 2.23.0 → 2.24.0

package/src/server/auth-cors.ts

@@ -493,6 +493,37 @@ function sameCanonicalProviderSeed(actual: Record<string, unknown>, expected: Oc
   return actualKeys.every(key => JSON.stringify(actual[key]) === JSON.stringify((expected as unknown as Record<string, unknown>)[key]));
 }
 
+function positiveWindowValue(value: unknown): boolean {
+  return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+}
+
+/**
+ * Shape-check the two context overlays before the canonical seed comparison drops them.
+ *
+ * `null` means "clear this" and is normalized by the PATCH field mask, but this validator
+ * also runs for POST and reload, where a whole provider object lands on disk verbatim. A
+ * `null` surviving there would be a value no reader expects, so full objects must carry a
+ * real number or omit the field.
+ */
+function nativeContextOverlayError(raw: Record<string, unknown>): string | null {
+  if (Object.hasOwn(raw, "contextWindow") && !positiveWindowValue(raw.contextWindow)) {
+    return "provider openai contextWindow must be a positive safe integer";
+  }
+  if (Object.hasOwn(raw, "modelContextWindows")) {
+    const windows = raw.modelContextWindows;
+    if (typeof windows !== "object" || windows === null || Array.isArray(windows)) {
+      return "provider openai modelContextWindows must be a plain object";
+    }
+    for (const [model, value] of Object.entries(windows as Record<string, unknown>)) {
+      if (model.trim() === "") return "provider openai modelContextWindows keys must be nonblank model ids";
+      if (!positiveWindowValue(value)) {
+        return "provider openai modelContextWindows values must be positive safe integers";
+      }
+    }
+  }
+  return null;
+}
+
 /**
  * Validate a provider object arriving at the management write boundary. Returns an error
  * string, or null when the provider may be persisted. Caller-controlled names/fields are
@@ -522,6 +553,15 @@ export function providerManagementConfigError(name: unknown, provider: unknown):
     delete canonicalCandidate.modelCosts;
     // requestPacing is a user-owned transport overlay, not part of the canonical seed.
     delete canonicalCandidate.requestPacing;
+    // Context windows are the same kind of user-owned overlay as requestPacing: the operator
+    // narrowing what their own native rows advertise. They can only ever LOWER the measured
+    // window (see nativeOpenAiContextWindow), so admitting them cannot widen what the proxy
+    // claims. Validated first — this function also guards POST/reload, where nothing
+    // normalizes the shape afterwards, so a bad value would reach disk.
+    const contextOverlayError = nativeContextOverlayError(raw);
+    if (contextOverlayError) return contextOverlayError;
+    delete canonicalCandidate.contextWindow;
+    delete canonicalCandidate.modelContextWindows;
     const canonical = seed && sameCanonicalProviderSeed(canonicalCandidate, seed);
     if (!canonical) {
       return `provider ${name} must equal the canonical built-in provider seed`;

package/src/server/chat-native.ts

@@ -7,6 +7,7 @@ import {
   isChatCompletionsStreamError,
 } from "../chat/outbound";
 import { classifyError, CYBER_POLICY_ERROR_CODE, isCyberPolicyCode } from "../lib/errors";
+import type { AdmissionLease } from "../lib/admission";
 import { readBoundedResponseBody } from "../lib/bounded-body";
 import { redactSecretString } from "../lib/redact";
 import { resolveClientRetryAfter } from "../lib/retry-after";
@@ -39,6 +40,7 @@ import {
   type RequestLogContext,
 } from "./request-log";
 import { jsonCompletionSse, nativeChatSse, structuredError, usageFromChat } from "./chat-native-sse";
+import { registerTurn, unregisterTurn } from "./lifecycle";
 
 type Rec = Record<string, unknown>;
 
@@ -78,7 +80,7 @@ interface HandleNativeChatOptions {
   req: Request;
   config: OcxConfig;
   logCtx: RequestLogContext;
-  logIds?: { requestId: string; start: number };
+  logIds?: { requestId: string; start: number; turnAdmissionLease?: AdmissionLease };
   route: RouteResult;
   chatBody: Rec;
   requestedModel: string;
@@ -122,6 +124,21 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
 
   const upstream = new AbortController();
   const cleanupAbort = linkAbortSignal(upstream, req.signal);
+  // nativeChatSse already owns the translated stream's async pull/cancel path.
+  // Bind the lease to that same controller and its terminal callbacks instead
+  // of adding another trackStreamLifetime wrapper (unsafe on bundled Bun#32111).
+  let streamTurnRegistered = false;
+  const transferTurnToStream = () => {
+    const lease = logIds?.turnAdmissionLease;
+    if (!lease || typeof (lease as { bindAbortController?: unknown }).bindAbortController !== "function") return;
+    registerTurn(upstream, lease);
+    streamTurnRegistered = true;
+  };
+  const releaseStreamTurn = () => {
+    if (!streamTurnRegistered) return;
+    streamTurnRegistered = false;
+    unregisterTurn(upstream);
+  };
   const connectMs = config.connectTimeoutMs ?? 200_000;
   let activeProvider: OcxProviderConfig = route.provider;
   let activeAdapter: ProviderAdapter = createOpenAIChatAdapter(activeProvider);
@@ -276,6 +293,7 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
 
   const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
   if (contentType.includes("text/event-stream") && response.body) {
+    if (requestedStream) transferTurnToStream();
     const stream = nativeChatSse(response.body, {
       requestedModel,
       translatorBudget,
@@ -287,13 +305,21 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
       },
       ...(requestedStream ? {
         onTerminal: (status: number, message?: string) => {
-          cleanupAbort();
-          finishLog(status, message, "terminal");
+          try {
+            cleanupAbort();
+            finishLog(status, message, "terminal");
+          } finally {
+            releaseStreamTurn();
+          }
         },
         onCancel: () => {
-          cleanupAbort();
-          upstream.abort();
-          finishLog(499, undefined, "client_cancel");
+          try {
+            cleanupAbort();
+            upstream.abort();
+            finishLog(499, undefined, "client_cancel");
+          } finally {
+            releaseStreamTurn();
+          }
         },
       } : {}),
     });

package/src/server/management/config-routes.ts

@@ -37,7 +37,7 @@ import { deriveProviderPresets } from "../../providers/derive";
 import { providerCodexAccountMode } from "../../providers/registry";
 import { routedSlug, slugEquals } from "../../providers/slug-codec";
 import { clearProviderQuotaCache, fetchProviderQuotaReports } from "../../providers/quota";
-import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
+import { isCanonicalOpenAiForwardProvider, OPENAI_CODEX_PROVIDER_ID } from "../../providers/openai-tiers";
 import { clearThreadAccountMap } from "../../codex/routing";
 import { primeCodexPoolQuotas } from "../../codex/auth-api";
 import {
@@ -118,6 +118,74 @@ async function sidecarVisionResponseSettings(config: OcxConfig): Promise<{
   return { model, reasoning, models };
 }
 
+/** One client's outcome from a fan-out sync. Absent from the list means "left alone". */
+interface ClientIntegrationSyncOutcome {
+  readonly client: "grok" | "claude-desktop";
+  readonly ok: boolean;
+  readonly changed?: boolean;
+  readonly reason?: string;
+}
+
+/**
+ * Re-inject every client integration the operator has switched ON.
+ *
+ * Only Codex used to run here, so a catalog change reached Codex and nothing else: a Grok
+ * fence or a written Desktop profile kept the context windows it was created with until the
+ * next `ocx start`. The startup path already gates each client on its own toggle
+ * (`src/cli/index.ts`), and this is that same fan-out for the on-demand command.
+ *
+ * A client that is OFF is omitted from the result rather than reported as skipped — the
+ * caller has to be able to tell "not touched" from "tried and failed". A client that fails
+ * does not fail the sync: Codex is the one that matters for routing, and a broken Grok file
+ * should surface as a warning, not as a 500 on a command that did its main job.
+ */
+async function syncEnabledClientIntegrations(
+  port: number | undefined,
+  config: OcxConfig,
+): Promise<ClientIntegrationSyncOutcome[]> {
+  if (port === undefined) return [];
+  const { claudeDesktopIntegrationEnabled, grokIntegrationEnabled } = await import("../../codex/desired-state");
+  const out: ClientIntegrationSyncOutcome[] = [];
+
+  if (grokIntegrationEnabled(config)) {
+    try {
+      const { syncGrokConfig } = await import("../../grok/sync");
+      const r = await syncGrokConfig(port, config, config.hostname ? { hostname: config.hostname } : {});
+      out.push(r.ok
+        ? { client: "grok", ok: true, changed: r.changed === true }
+        : { client: "grok", ok: false, reason: r.message });
+    } catch (error) {
+      out.push({ client: "grok", ok: false, reason: error instanceof Error ? error.message : String(error) });
+    }
+  }
+
+  if (claudeDesktopIntegrationEnabled(config)) {
+    try {
+      const { writeDesktop3pConfig } = await import("../../claude/desktop-3p");
+      const { desktopVisibleNativeSlugs, filterCatalogVisibleModels } = await import("../../codex/catalog");
+      const { fetchAllModels } = await import("../management-api");
+      const routed = filterCatalogVisibleModels(await fetchAllModels(config), config)
+        .map(model => ({ provider: model.provider, id: model.id, contextWindow: model.contextWindow }));
+      const r = writeDesktop3pConfig(
+        port,
+        [...desktopVisibleNativeSlugs(config)],
+        routed,
+        config.apiKeys?.[0]?.key,
+        "static",
+        config.claudeCode?.desktopProfile,
+        providerContextCap(config, OPENAI_CODEX_PROVIDER_ID),
+      );
+      out.push(r.written
+        ? { client: "claude-desktop", ok: true, changed: true }
+        : { client: "claude-desktop", ok: false, reason: r.reason ?? "Claude Desktop write failed" });
+    } catch (error) {
+      out.push({ client: "claude-desktop", ok: false, reason: error instanceof Error ? error.message : String(error) });
+    }
+  }
+
+  return out;
+}
+
 function publicVisionSidecarSettings(
   config: OcxConfig,
   vision: Awaited<ReturnType<typeof sidecarVisionResponseSettings>>,
@@ -387,10 +455,19 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
     // Never use the server-captured startup object for a durable integration
     // decision. A toggle may have persisted while this process was gathering.
     const runtime = readRuntimePort(process.pid);
-    const result = await syncModelsToCodex(runtime?.port, loadConfig(), null);
+    const config = loadConfig();
+    const result = await syncModelsToCodex(runtime?.port, config, null);
+    // A sync used to stop here, so a Grok fence or a Desktop profile kept whatever
+    // context windows it was written with while the Codex catalog moved on. The
+    // startup path already fans out to every enabled client; this is the same fan-out
+    // for the on-demand command. Codex goes first because the others read its catalog.
+    const integrations = result.status === "refused"
+      ? []
+      : await syncEnabledClientIntegrations(runtime?.port, config);
     const status = result.status === "refused" ? 409 : (result.status === "skipped" || result.ok ? 200 : 500);
     return jsonResponse({
       ...attachStaleAppServerHint(result),
+      ...(integrations.length > 0 ? { integrations } : {}),
       ...(result.ok ? {} : { error: result.message }),
     }, status);
   }

package/src/service.ts

@@ -1545,6 +1545,14 @@ export function buildWindowsServiceScript(entry = cliEntry(), port = resolveServ
     '>>"%OCX_SERVICE_LOG%" echo opencodex_home="%OPENCODEX_HOME%"',
     '>>"%OCX_SERVICE_LOG%" echo codex_home="%CODEX_HOME%"',
     '>>"%OCX_SERVICE_LOG%" echo token_file="%OCX_API_TOKEN_FILE%"',
+    'if not exist "%OCX_BUN%" (',
+    '  >>"%OCX_SERVICE_LOG%" echo [%DATE% %TIME%] installation is incomplete: bundled Bun is missing; reinstall opencodex, then run ocx service repair',
+    "  exit /b 3",
+    ")",
+    'if not exist "%OCX_CLI%" (',
+    '  >>"%OCX_SERVICE_LOG%" echo [%DATE% %TIME%] installation is incomplete: CLI entry is missing; reinstall opencodex, then run ocx service repair',
+    "  exit /b 3",
+    ")",
     `"%OCX_BUN%" "%OCX_CLI%" start --port ${port} >>"%OCX_SERVICE_LOG%" 2>&1`,
     "if %ERRORLEVEL% NEQ 0 (",
     '  >>"%OCX_SERVICE_LOG%" echo [%DATE% %TIME%] child exited with code %ERRORLEVEL%; restarting in 5s',

package/src/types.ts

@@ -525,7 +525,7 @@ export interface OcxClaudeCodeConfig {
    * (the legacy DISABLE_COMPACT pair takes rule-1 precedence in the CLI).
    */
   autoContext?: boolean;
-  /** Compact-window tokens for auto-context. Default 350_000. */
+  /** Compact-window tokens for auto-context. Default 829_800 (AUTO_COMPACT_WINDOW_DEFAULT). */
   autoCompactWindow?: number;
   /**
    * Bundled-skill content elision for ROUTED (non-Anthropic) models (devlog 260712