@bitkyc08/opencodex 2.25.0 → 2.26.0

package/src/server/responses/responses-field-backfill.ts

@@ -0,0 +1,173 @@
+/**
+ * Stateless SSE block rewrite that backfills the `annotations` field on
+ * `output_text` content parts in Responses SSE events.
+ *
+ * The Responses API spec defines `annotations` as a required field on
+ * `OutputTextContent` (it is `Vec<Annotation>`, not `Option<Vec>`). Some
+ * upstream relays omit it when there are no annotations, which is technically
+ * spec-non-compliant. Strict deserializers — any client that follows the
+ * schema without `#[serde(default)]` on that field — fail with
+ * `missing field `annotations`` when the field is absent.
+ *
+ * This rewrite scans every SSE event for output_text content parts — whether
+ * they appear in item.content[], part, or response.output[].content[] — and
+ * adds annotations: [] if missing.
+ *
+ * Stateless: no retained buffers, no lifecycle tracking, no fail-closed.
+ * Existing values are always authoritative; only absent fields are added.
+ * The field is always valid on the wire, so adding it when absent is safe
+ * for all clients including Codex CLI/App.
+ */
+
+import {
+  replaceSseDataPayload,
+  sseDataPayload,
+  type SseBlockRewrite,
+} from "../sse-payload-rewrite";
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+
+/**
+ * Backfill annotations: [] on an output_text content part if missing.
+ * Returns the same object reference if no change is needed.
+ */
+function backfillOutputTextPart(part: Record<string, unknown>): Record<string, unknown> {
+  if (part.type !== "output_text") return part;
+  // Only add annotations when the key is entirely absent — preserve any
+  // existing value (even null or a malformed type) so we never overwrite
+  // what the upstream actually sent.
+  if ("annotations" in part) return part;
+  return { ...part, annotations: [] };
+}
+
+/**
+ * Walk a content array and backfill output_text parts.
+ * Returns the same array reference if nothing changed.
+ */
+function backfillContentArray(content: unknown): unknown {
+  if (!Array.isArray(content)) return content;
+  let changed = false;
+  const repaired = content.map((part) => {
+    if (!isPlainObject(part)) return part;
+    const next = backfillOutputTextPart(part);
+    if (next !== part) changed = true;
+    return next;
+  });
+  return changed ? repaired : content;
+}
+
+/**
+ * Walk an output item and backfill output_text parts in its content.
+ * Returns the same object reference if nothing changed.
+ */
+function backfillOutputItem(item: unknown): unknown {
+  if (!isPlainObject(item)) return item;
+  const content = item.content;
+  const repaired = backfillContentArray(content);
+  if (repaired === content) return item;
+  return { ...item, content: repaired };
+}
+
+/**
+ * Walk a response object's output[] and backfill output_text parts.
+ * Returns the same object reference if nothing changed.
+ */
+function backfillResponseOutput(response: unknown): unknown {
+  if (!isPlainObject(response)) return response;
+  const output = response.output;
+  if (!Array.isArray(output)) return response;
+  let changed = false;
+  const repaired = output.map((item) => {
+    if (!isPlainObject(item)) return item;
+    const next = backfillOutputItem(item);
+    if (next !== item) changed = true;
+    return next;
+  });
+  return changed ? { ...response, output: repaired } : response;
+}
+
+/**
+ * Statelessly rewrite one SSE event: backfill annotations
+ * on any output_text content part found in the event payload.
+ */
+function rewriteEvent(event: Record<string, unknown>): Record<string, unknown> {
+  const type = typeof event.type === "string" ? event.type : "";
+  let next = event;
+  let changed = false;
+
+  // output_item.added / output_item.done: item.content[] -> output_text parts
+  if ((type === "response.output_item.added" || type === "response.output_item.done")
+    && isPlainObject(event.item)) {
+    const item = backfillOutputItem(event.item);
+    if (item !== event.item) {
+      next = { ...next, item };
+      changed = true;
+    }
+  }
+
+  // content_part.added / content_part.done: part -> output_text
+  if ((type === "response.content_part.added" || type === "response.content_part.done")
+    && isPlainObject(event.part)) {
+    const part = backfillOutputTextPart(event.part);
+    if (part !== event.part) {
+      next = { ...next, part };
+      changed = true;
+    }
+  }
+
+  // response.created / in_progress / completed / incomplete / failed:
+  // response.output[].content[] -> output_text parts
+  if (isPlainObject(event.response)) {
+    const response = backfillResponseOutput(event.response);
+    if (response !== event.response) {
+      next = { ...next, response };
+      changed = true;
+    }
+  }
+
+  return changed ? next : event;
+}
+
+/**
+ * Create a stateless SSE block rewrite that backfills annotations and
+ * on output_text content parts. Unconditional: the field is a required
+ * canonical Responses field, so adding it when absent is safe for all
+ * clients.
+ */
+export function createResponsesFieldBackfillBlockRewrite(): SseBlockRewrite {
+  const rewrite: SseBlockRewrite = (block: string): readonly string[] => {
+    const payload = sseDataPayload(block);
+    if (payload === null) return [block];
+    let event: unknown;
+    try {
+      event = JSON.parse(payload);
+    } catch {
+      return [block];
+    }
+    if (!isPlainObject(event)) return [block];
+    const rewritten = rewriteEvent(event);
+    if (rewritten === event) return [block];
+    return [replaceSseDataPayload(block, JSON.stringify(rewritten))];
+  };
+  return rewrite;
+}
+
+/**
+ * Backfill annotations on a non-streaming Responses JSON
+ * object. Mirrors the SSE block rewrite for the bounded-JSON passthrough
+ * path. Returns the original string if no change is needed.
+ */
+export function backfillResponsesFieldsJson(payload: string): string {
+  let response: unknown;
+  try {
+    response = JSON.parse(payload);
+  } catch {
+    return payload;
+  }
+  if (!isPlainObject(response)) return payload;
+  const repaired = backfillResponseOutput(response);
+  if (repaired === response) return payload;
+  return JSON.stringify(repaired);
+}

package/src/server/responses-reasoning-summary-rewrite.ts

@@ -0,0 +1,171 @@
+import type { SsePayloadRewrite } from "./sse-payload-rewrite";
+
+/**
+ * Route content-channel reasoning from native-Responses upstreams through the
+ * expandable summary channel (issue #45).
+ *
+ * Codex renders the expandable reasoning trace from the Responses reasoning
+ * item's `summary[]` channel. DeepSeek's native `/responses` endpoint emits
+ * raw thinking on the content channel instead (`response.reasoning_text.delta`
+ * plus items with `content: [{type: "reasoning_text", text}]` and an empty
+ * `summary`), so routed DeepSeek turns showed the "Worked for Xs" timer with
+ * nothing to expand. Native OpenAI upstreams already emit summary-channel
+ * events; this rewrite is a no-op for them (no reasoning_text events to
+ * rewrite) and only engages when the upstream produces content-channel
+ * reasoning.
+ *
+ * Replay compatibility: Codex echoes the reasoning item it received back into
+ * the next request's input. DeepSeek's Responses API accepts summary-shaped
+ * reasoning input items (verified live), so the rewrite round-trips.
+ */
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+
+function reasoningTextOf(item: Record<string, unknown>): string {
+  if (!Array.isArray(item.content)) return "";
+  return item.content
+    .filter((part): part is Record<string, unknown> => isPlainObject(part) && part.type === "reasoning_text")
+    .map(part => (typeof part.text === "string" ? part.text : ""))
+    .join("");
+}
+
+/** Move a reasoning item's content channel into the summary channel. */
+function reasoningItemToSummaryShape(item: Record<string, unknown>): Record<string, unknown> {
+  if (item.type !== "reasoning") return item;
+  const text = reasoningTextOf(item);
+  // Items that already use the summary channel (or carry no content text at
+  // all) are left untouched: rewriting them could clear a valid summary.
+  if (text.length === 0) return item;
+  const next: Record<string, unknown> = { ...item };
+  delete next.content;
+  next.summary = [{ type: "summary_text", text }];
+  return next;
+}
+
+/**
+ * Rewrite one parsed SSE payload in place of the content channel, or return
+ * `null` when nothing changed (caller keeps the original payload).
+ */
+function rewritePayload(payload: Record<string, unknown>): Record<string, unknown> | null {
+  switch (payload.type) {
+    case "response.reasoning_text.delta": {
+      const next: Record<string, unknown> = {
+        type: "response.reasoning_summary_text.delta",
+        item_id: payload.item_id,
+        output_index: payload.output_index,
+        summary_index: 0,
+        delta: payload.delta,
+      };
+      if (payload.sequence_number !== undefined) next.sequence_number = payload.sequence_number;
+      return next;
+    }
+    case "response.reasoning_text.done": {
+      const next: Record<string, unknown> = {
+        type: "response.reasoning_summary_text.done",
+        item_id: payload.item_id,
+        output_index: payload.output_index,
+        summary_index: 0,
+        text: payload.text,
+      };
+      if (payload.sequence_number !== undefined) next.sequence_number = payload.sequence_number;
+      return next;
+    }
+    default: {
+      let changed = false;
+      const next: Record<string, unknown> = { ...payload };
+      if (isPlainObject(next.item) && next.item.type === "reasoning") {
+        const rewritten = reasoningItemToSummaryShape(next.item);
+        if (rewritten !== next.item) {
+          next.item = rewritten;
+          changed = true;
+        }
+      }
+      // SSE event shape: {type: "response.completed", response: {output}}.
+      const response = isPlainObject(next.response) ? { ...next.response } : null;
+      if (response && Array.isArray(response.output)) {
+        const output = response.output.map(item => {
+          if (!isPlainObject(item) || item.type !== "reasoning") return item;
+          const rewritten = reasoningItemToSummaryShape(item);
+          if (rewritten !== item) changed = true;
+          return rewritten;
+        });
+        if (changed) {
+          response.output = output;
+          next.response = response;
+        }
+      }
+      // Bare response document shape (non-streaming passthrough):
+      // {object: "response", output: [...]}.
+      if (Array.isArray(next.output)) {
+        const output = next.output.map(item => {
+          if (!isPlainObject(item) || item.type !== "reasoning") return item;
+          const rewritten = reasoningItemToSummaryShape(item);
+          if (rewritten !== item) changed = true;
+          return rewritten;
+        });
+        if (changed) next.output = output;
+      }
+      return changed ? next : null;
+    }
+  }
+}
+
+/** Payload rewrite for passthrough relays whose upstream emits content-channel reasoning. */
+export function createReasoningSummaryChannelPayloadRewrite(): SsePayloadRewrite {
+  return (payload: string): string => {
+    let parsed: unknown;
+    try {
+      parsed = JSON.parse(payload);
+    } catch {
+      return payload;
+    }
+    if (!isPlainObject(parsed)) return payload;
+    const rewritten = rewritePayload(parsed);
+    return rewritten !== null ? JSON.stringify(rewritten) : payload;
+  };
+}
+
+/**
+ * Object-level variant for the non-streaming passthrough: the bounded-JSON
+ * relay bypasses the SSE payload rewrite, so reasoning items inside a full
+ * Responses JSON document need the same normalization before plain JSON
+ * serialization or forced JSON-to-SSE reframing. Returns the same reference
+ * when nothing changed.
+ */
+export function rewriteReasoningSummaryInJson(value: unknown): unknown {
+  if (!isPlainObject(value)) return value;
+  const rewritten = rewritePayload(value);
+  return rewritten !== null ? rewritten : value;
+}
+
+/** String-level variant of {@link rewriteReasoningSummaryInJson}. */
+export function rewriteReasoningSummaryInJsonString(json: string): string {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(json);
+  } catch {
+    return json;
+  }
+  const rewritten = rewriteReasoningSummaryInJson(parsed);
+  return rewritten === parsed ? json : JSON.stringify(rewritten);
+}
+
+/**
+ * True when a routed native-Responses provider emits content-channel reasoning
+ * (raw `reasoning_text`) instead of the summary channel. DeepSeek's
+ * `/responses` endpoint is the current example: it ships raw thinking with an
+ * empty `summary` and keeps `preserveReasoningContentModels` so multi-turn
+ * replays round-trip.
+ */
+export function routeUsesContentChannelReasoning(
+  provider: { statelessResponses?: boolean; preserveReasoningContentModels?: string[] },
+  modelId: string,
+): boolean {
+  if (provider.statelessResponses === true) return true;
+  const preserved = provider.preserveReasoningContentModels;
+  const normalizedModelId = modelId.toLowerCase();
+  return Array.isArray(preserved)
+    && preserved.some(id => id.toLowerCase() === normalizedModelId);
+}

package/src/service.ts

@@ -45,6 +45,7 @@ import {
 } from "./lib/windows-secret-acl";
 import { windowsEnvIndirectBatchPathList, windowsEnvIndirectBatchValue } from "./lib/win-paths";
 import { recordOwnedConfigPath } from "./lib/config-ownership";
+import { killWindowsSchedulerWrappers } from "./lib/windows-service-wrappers";
 import { maybeShowStarPrompt } from "./cli/star-prompt";
 
 const LABEL = "com.opencodex.proxy";
@@ -1534,6 +1535,9 @@ export function buildWindowsServiceScript(entry = cliEntry(), port = resolveServ
     windowsBatchSet("OCX_SERVICE_LOG", serviceLogPath(), "path"),
     windowsBatchSet("OCX_BUN", bun, "path"),
     windowsBatchSet("OCX_CLI", cli, "path"),
+    // Package root for the transactional-update restore path (#1942): cli is
+    // <pkg>\src\cli\index.ts, so the package dir is three levels up.
+    'for %%I in ("%OCX_CLI%\\..\\..\\..") do set "OCX_PKG_DIR=%%~fI"',
     'if exist "%OCX_API_TOKEN_FILE%" (',
     '  set /p OPENCODEX_API_AUTH_TOKEN=<"%OCX_API_TOKEN_FILE%"',
     ")",
@@ -1546,10 +1550,16 @@ export function buildWindowsServiceScript(entry = cliEntry(), port = resolveServ
     '>>"%OCX_SERVICE_LOG%" echo codex_home="%CODEX_HOME%"',
     '>>"%OCX_SERVICE_LOG%" echo token_file="%OCX_API_TOKEN_FILE%"',
     'if not exist "%OCX_BUN%" (',
+    "  call :restore_backup",
+    ")",
+    'if not exist "%OCX_BUN%" (',
     '  >>"%OCX_SERVICE_LOG%" echo [%DATE% %TIME%] installation is incomplete: bundled Bun is missing; reinstall opencodex, then run ocx service repair',
     "  exit /b 3",
     ")",
     'if not exist "%OCX_CLI%" (',
+    "  call :restore_backup",
+    ")",
+    'if not exist "%OCX_CLI%" (',
     '  >>"%OCX_SERVICE_LOG%" echo [%DATE% %TIME%] installation is incomplete: CLI entry is missing; reinstall opencodex, then run ocx service repair',
     "  exit /b 3",
     ")",
@@ -1562,6 +1572,26 @@ export function buildWindowsServiceScript(entry = cliEntry(), port = resolveServ
     "  goto loop",
     ")",
     "endlocal",
+    "goto :eof",
+    "",
+    // #1942/#1849: a power loss mid-swap leaves the live package dir missing/broken and
+    // a sibling .ocx-backup-* holding the previous version. This wrapper lives OUTSIDE
+    // the package tree, so it can restore when the launcher itself is gone — the exact
+    // window the in-launcher boot probe cannot reach.
+    ":restore_backup",
+    '>>"%OCX_SERVICE_LOG%" echo [%DATE% %TIME%] install incomplete - looking for a transactional-update backup to restore',
+    'for /f "delims=" %%B in (\'dir /b /ad /o-n "%OCX_PKG_DIR%\\..\\.ocx-backup-*" 2^>nul\') do (',
+    '  if exist "%OCX_PKG_DIR%\\..\\%%B\\opencodex\\package.json" (',
+    '    if exist "%OCX_PKG_DIR%" rmdir /s /q "%OCX_PKG_DIR%" 2>nul',
+    '    move "%OCX_PKG_DIR%\\..\\%%B\\opencodex" "%OCX_PKG_DIR%" >nul 2>&1',
+    '    if exist "%OCX_PKG_DIR%\\package.json" (',
+    '      >>"%OCX_SERVICE_LOG%" echo [%DATE% %TIME%] restored previous install from %%B',
+    "      goto :eof",
+    "    )",
+    "  )",
+    ")",
+    '>>"%OCX_SERVICE_LOG%" echo [%DATE% %TIME%] no restorable backup found',
+    "goto :eof",
   ].filter((line): line is string => Boolean(line));
   return `${lines.join("\r\n")}\r\n`;
 }
@@ -2323,45 +2353,17 @@ function statusWindowsXml(): string { try { return schtasks(["/query", "/tn", TA
 /**
  * Best-effort termination of surviving Windows scheduler launcher/wrapper processes.
  * `schtasks /end` ends the task instance but often leaves wscript/cmd running the
- * `:loop` batch, which brings the proxy back during a stop or restart. Same killer
- * the update job uses, so both teardown paths share the guarantee.
+ * `:loop` batch, which brings the proxy back during a stop or restart.
  *
- * Matching is scoped to the CANONICAL paths of THIS installation (opencodex-service.cmd
- * and opencodex-service-launcher.vbs under the current config dir), never a bare
- * filename: a wrapper from another OpenCodex home — or an unrelated process whose
- * command line merely contains the filename — must not be force-terminated.
- * The path must appear as a COMPLETE command-line token (wscript.exe spawns the
- * .vbs as an argument; cmd.exe /c runs the .cmd), so a substring-only match is
- * excluded.
+ * The matching rule — canonical paths of THIS installation, as complete
+ * command-line tokens — lives in lib/windows-service-wrappers so the update job
+ * cannot drift away from it again.
  */
 function killWindowsServiceWrapperProcesses(): void {
-  if (process.platform !== "win32") return;
-  try {
-    const script = windowsServiceScriptPath();
-    const launcher = windowsLauncherVbsPath();
-    // Quote for PowerShell: single-quote the value and double any embedded quote.
-    const quote = (value: string) => `'${value.replace(/'/g, "''")}'`;
-    const ps = [
-      `$pats = @(${quote(script)}, ${quote(launcher)});`,
-      "Get-CimInstance Win32_Process | Where-Object {",
-      "  if ($_.ProcessId -eq $PID) { return $false };",
-      "  $c = $_.CommandLine; if (-not $c) { return $false };",
-      "  foreach ($p in $pats) {",
-      "    $i = $c.IndexOf($p, [System.StringComparison]::OrdinalIgnoreCase);",
-      "    if ($i -lt 0) { continue };",
-      "    $before = if ($i -gt 0) { $c.Substring($i - 1, 1) } else { ' ' };",
-      "    $end = $i + $p.Length;",
-      "    $after = if ($end -lt $c.Length) { $c.Substring($end, 1) } else { ' ' };",
-      "    if ($before -match '[\\s\"'']' -and $after -match '[\\s\"'']') { return $true };",
-      "  };",
-      "  $false",
-      "} | ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }",
-    ].join(" ");
-    spawnSync(resolveTrustedWindowsPowerShellExe(), [
-      "-NoProfile", "-NoLogo", "-NonInteractive", "-WindowStyle", "Hidden",
-      "-Command", ps,
-    ], { stdio: "ignore", timeout: 5000, windowsHide: true });
-  } catch { /* best-effort */ }
+  killWindowsSchedulerWrappers({
+    scriptPath: windowsServiceScriptPath(),
+    launcherPath: windowsLauncherVbsPath(),
+  });
 }
 function uninstallWindows(): void {
   const probe = probeWindowsSchedulerTask(TASK);

package/src/storage/cleanup.ts

@@ -1091,7 +1091,7 @@ function writeSatelliteBackup(
     throw new Error("test_fail_satellite_backup_replace");
   }
   try {
-    renameAtomicFile(tmp, dest);
+    renameAtomicFile(tmp, dest, undefined, "storage-cleanup");
   } catch (error) {
     try { unlinkSync(tmp); } catch { /* */ }
     throw error;
@@ -2435,7 +2435,7 @@ function writeRestorePending(
     throw new Error("test_fail_pending_rename");
   }
   try {
-    renameSync(tmp, dest);
+    renameAtomicFile(tmp, dest, undefined, "storage-cleanup");
   } catch (error) {
     try { unlinkSync(tmp); } catch { /* */ }
     throw error;

package/src/tray/windows.ts

@@ -1,6 +1,6 @@
 import { execFile, execFileSync, spawn } from "node:child_process";
 import { createHash } from "node:crypto";
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
 import { expandUserPath, getConfigDir } from "../config";
@@ -8,6 +8,7 @@ import { durableBunRuntime } from "../lib/bun-runtime";
 import type { BunRuntimeSource } from "../lib/bun-runtime";
 import { forgetEphemeralSecretPath, hardenSecretDir, hardenSecretPath } from "../lib/windows-secret-acl";
 import { recordOwnedConfigPath } from "../lib/config-ownership";
+import { renameAtomicFile } from "../lib/windows-atomic-replace";
 
 const RUN_KEY = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run";
 const RUN_PARENT_KEY = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion";
@@ -242,7 +243,7 @@ export function replaceWindowsTrayOwnedFile(
       const hardened = hardenSecretPath(target, { required: true, timeoutMemoKey: path });
       if (!hardened.ok) throw new Error("Windows tray ACL hardening did not complete; refusing to persist executable state.");
     },
-    rename: renameSync,
+    rename: (source, destination) => renameAtomicFile(source, destination, undefined, "tray"),
     unlink: unlinkSync,
   },
 ): void {