@bitkyc08/opencodex 2.28.0 → 2.29.0

package/src/server/management/integration-routes.ts

@@ -27,6 +27,12 @@ import {
   type WriteRefused,
 } from "../../integrations/writer";
 import { IntegrationWriterLockBusyError, type IntegrationWriterLockSeams } from "../../integrations/writer-lock";
+import {
+  INTEGRATION_MUTATION_TERMINAL_MS,
+  IntegrationMutationBusyError,
+  runIntegrationMutationFlight,
+  setIntegrationMutationFlightTestHook,
+} from "../../integrations/mutation-flight";
 import { jsonResponse } from "../auth-cors";
 import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
 import type { ManagementContext } from "./context";
@@ -34,8 +40,7 @@ import { loadExportModels } from "./model-rows";
 
 
 const INTEGRATION_ROUTE_PREFIX = "/api/client-integrations/";
-const INTEGRATION_MUTATION_JOIN_MS = 120_000;
-export const INTEGRATION_MUTATION_TERMINAL_MS = 10 * 60_000;
+export { INTEGRATION_MUTATION_TERMINAL_MS };
 
 type IntegrationStateRecord = Awaited<ReturnType<typeof readIntegrationState>>;
 type ApplyResult = Awaited<ReturnType<typeof applyIntegrationCoordinated>>;
@@ -81,19 +86,6 @@ export interface IntegrationRestoreBody {
   confirmDrift?: boolean;
 }
 
-interface IntegrationMutationFlight {
-  key: string;
-  startedAt: number;
-  promise: Promise<unknown>;
-}
-
-class IntegrationMutationBusyError extends Error {
-  constructor(readonly clientId: IntegrationClientId) {
-    super("integration_mutation_busy");
-  }
-}
-
-const integrationMutationFlights = new Map<IntegrationClientId, IntegrationMutationFlight>();
 let integrationMutationTestHooks: {
   io?: IntegrationIO;
   lockSeams?: IntegrationWriterLockSeams;
@@ -145,45 +137,6 @@ function decodeClientPath(pathname: string): string | null {
   }
 }
 
-function runIntegrationMutationFlight<T>(
-  clientId: IntegrationClientId,
-  key: string,
-  now: () => number,
-  operation: () => Promise<T>,
-): Promise<T> {
-  const startedAt = now();
-  const current = integrationMutationFlights.get(clientId);
-  if (current) {
-    const age = startedAt - current.startedAt;
-    if (current.key === key && age < INTEGRATION_MUTATION_JOIN_MS) {
-      return current.promise as Promise<T>;
-    }
-    if (age <= INTEGRATION_MUTATION_TERMINAL_MS) {
-      return Promise.reject(new IntegrationMutationBusyError(clientId));
-    }
-    if (integrationMutationFlights.get(clientId) === current) {
-      integrationMutationFlights.delete(clientId);
-    }
-  }
-
-  const flight: IntegrationMutationFlight = {
-    key,
-    startedAt,
-    promise: Promise.resolve(),
-  };
-  const run = async (): Promise<unknown> => operation();
-  flight.promise = (integrationMutationTestHooks?.run
-    ? integrationMutationTestHooks.run(run)
-    : run()
-  ).finally(() => {
-    if (integrationMutationFlights.get(clientId) === flight) {
-      integrationMutationFlights.delete(clientId);
-    }
-  });
-  integrationMutationFlights.set(clientId, flight);
-  return flight.promise as Promise<T>;
-}
-
 export function setIntegrationMutationFlightTestHooks(
   hooks: {
     io?: IntegrationIO;
@@ -194,7 +147,7 @@ export function setIntegrationMutationFlightTestHooks(
   } | null,
 ): void {
   integrationMutationTestHooks = hooks;
-  integrationMutationFlights.clear();
+  setIntegrationMutationFlightTestHook(hooks?.run ?? null);
   // Path overrides are part of the same isolation contract: clearing flights
   // while leaving a temp home bound would let the next suite write real files.
   if (hooks === null) integrationPathTestHooks = null;

package/src/server/management/model-routes.ts

@@ -129,6 +129,7 @@ import type { PersistedUsageAttempt } from "../../usage/log";
 import { isAllowedRequestOrigin, jsonResponse, providerManagementConfigError, publicProviderBaseUrl, safeConfigDTO, corsHeaders } from "../auth-cors";
 import { applySystemEnvToggle } from "../system-env";
 import {
+  ClientPathError,
   EXPORT_CLIENTS,
   EXPORT_CLIENT_IDS,
   OPENCODE_PROVIDER_ID,
@@ -204,6 +205,27 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
       );
     }
     const spec = EXPORT_CLIENTS[requested];
+    // Resolved before the catalog load on purpose. A refused override is a
+    // property of the request, not of the catalog: validating it afterwards
+    // let a busy or failing catalog answer 503 first, so a user with a
+    // relative override never saw the message that says how to fix it — and
+    // the route did the enumeration work anyway for input it was going to
+    // reject.
+    let destination: string;
+    try {
+      destination = spec.destination(process.env);
+    } catch (error) {
+      // A client's own environment override can name a path the resolver
+      // refuses — a relative value, which this process and the client would
+      // resolve against different working directories. That is a
+      // user-correctable configuration error, not a server fault, so it leaves
+      // this boundary as a bounded 400 instead of escaping handleManagementAPI
+      // as a generic 500 and stripping the message that says how to fix it.
+      // `integrations/state.ts` and `integrations/writer.ts` already catch the
+      // same error on their paths; this route was the one that did not.
+      if (!(error instanceof ClientPathError)) throw error;
+      return jsonResponse({ error: error.message }, 400, req, config);
+    }
     let models: ExportModel[];
     try {
       // The ONE loader every export surface uses. It carries the visibility
@@ -231,7 +253,7 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
     return jsonResponse({
       client: spec.id,
       filename: spec.filename,
-      destination: spec.destination(process.env),
+      destination,
       apiKeyEnv: spec.apiKeyEnv,
       exportHint: spec.exportHint,
       // The client's own format and the exact bytes for it. The GUI previously

package/src/server/management/provider-routes.ts

@@ -82,6 +82,10 @@ import {
   LOCAL_PROVIDER_RELOAD_PATH,
 } from "../../lib/local-provider-reload-contract";
 import { refreshUserCostOverlays } from "../../usage/user-cost-overlays";
+import {
+  XAI_RESPONSES_OPT_IN_MODELS,
+  xaiResponsesOptInState,
+} from "../../providers/xai-responses-opt-in";
 
 import { isPlainRecord, parseDebugLogQuery, tokPerSecondResult, unavailableCostReason, costResult, requestLogDto, stripRegistryOnlyStaticHeaders, fetchAllModels } from "./shared";
 import type { MetricUnavailableReason, TokPerSecondResult, CostEstimateReason, CostResult, MetricSource } from "./shared";
@@ -182,6 +186,20 @@ function applyProviderPatchFields(
     next.liveModels = rawBody.liveModels;
     touched = true;
   }
+  if (Object.hasOwn(rawBody, "xaiResponsesOptIn")) {
+    if (name !== "xai") return { error: "xaiResponsesOptIn is valid only for provider xai" };
+    if (typeof rawBody.xaiResponsesOptIn !== "boolean") {
+      return { error: "xaiResponsesOptIn must be a boolean" };
+    }
+    const modelAdapters = { ...(next.modelAdapters ?? {}) };
+    for (const model of XAI_RESPONSES_OPT_IN_MODELS) {
+      if (rawBody.xaiResponsesOptIn) modelAdapters[model] = "openai-responses";
+      else delete modelAdapters[model];
+    }
+    if (Object.keys(modelAdapters).length > 0) next.modelAdapters = modelAdapters;
+    else delete next.modelAdapters;
+    touched = true;
+  }
   if (Object.hasOwn(rawBody, "requestPacing")) {
     const value = rawBody.requestPacing;
     if (value === null) {
@@ -394,6 +412,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       apiKeyTransport: p.apiKeyTransport,
       disabled: p.disabled === true,
       codexAccountMode: providerCodexAccountMode(name, p),
+      ...(name === "xai" ? { xaiResponsesOptInState: xaiResponsesOptInState(p) } : {}),
       discovery: p.liveModels === false ? undefined : getProviderDiscoveryStatus(name),
     })));
   }
@@ -694,6 +713,9 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       name,
       disabled: config.providers[name]!.disabled === true,
       hasApiKey: !!config.providers[name]!.apiKey,
+      ...(name === "xai"
+        ? { xaiResponsesOptInState: xaiResponsesOptInState(config.providers[name]!) }
+        : {}),
       catalogRefresh,
     });
   }

package/src/server/management/vision-sidecar-options.ts

@@ -17,7 +17,8 @@ import {
   type VisionSidecarBackend,
 } from "../../vision/eligibility";
 import { listOpenAiForwardSidecarCandidates } from "../../providers/openai-sidecar";
-import { listManagementModelRows } from "./model-rows";
+import { pickerVisibleSidecarCandidates } from "../../sidecar/candidates";
+import { resolveSidecarAuth } from "../../sidecar/auth";
 
 /**
  * Backends whose executor could actually run: openai forward, anthropic OAuth.
@@ -41,17 +42,23 @@ export function enabledVisionBackends(
   return backends.length > 0 ? backends : ["openai", "anthropic"];
 }
 
-/** Visible catalog rows in the shape the eligibility predicate consumes. */
+/**
+ * Visible catalog rows in the shape the eligibility predicate consumes.
+ * Sourced from the unified picker set (#2188): picker-visible rows ∪ auth
+ * slots, UNFILTERED. Rule 2 (− provably text-only) belongs to the OPTIONS
+ * path only (visionEligibleModelOptions already applies it). The PUT gate
+ * consumes this list as EVIDENCE: a picker row proving an id text-only is
+ * exactly what visionDescriberIsProvablyBlind needs to reject that id, so
+ * pre-filtering here would deaden the gate (review F1: reject → allow flip).
+ */
 export async function visionCandidateRows(config: OcxConfig): Promise<VisionCandidateModel[]> {
-  let rows: Awaited<ReturnType<typeof listManagementModelRows>> = [];
-  // A catalog outage must not 500 the settings route nor reject a write; with []
-  // the option list degrades to the baselines, which is the intended floor.
-  try { rows = await listManagementModelRows(config); } catch { rows = []; }
-  return rows.filter(row => row.disabled !== true).map(row => ({
-    provider: row.provider,
-    id: row.id,
-    ...(row.inputModalities ? { inputModalities: row.inputModalities } : {}),
-    ...(row.native ? { native: true } : {}),
+  const auth = resolveSidecarAuth(config);
+  const all = await pickerVisibleSidecarCandidates(config, auth);
+  return all.map(candidate => ({
+    provider: candidate.provider,
+    id: candidate.id,
+    ...(candidate.inputModalities ? { inputModalities: candidate.inputModalities } : {}),
+    ...(candidate.native ? { native: true } : {}),
   }));
 }
 

package/src/server/management/web-search-sidecar-options.ts

@@ -0,0 +1,120 @@
+/**
+ * The one place that decides which models the management API offers as the
+ * web-search sidecar, and which it refuses to persist (#2188).
+ *
+ * Two routes write `webSearchSidecar.model` — `PUT /api/sidecar-settings`
+ * and the `webSearchSidecar` override in `PUT /api/claude-code`. They share
+ * this module for the same reason the vision routes share
+ * vision-sidecar-options.ts: a gate on one route and a stale copy on the
+ * other is the same as no gate at all. `ocx config set` raw JSON writes
+ * bypass management gates by design (operator escape hatch, same as vision).
+ *
+ * Unlike vision's provably-blind gate (reject only on positive proof), the
+ * web-search gate is MEMBERSHIP: the executor set is closed and known, so an
+ * id outside (candidates ∪ auth slots) can never run and is refused.
+ */
+import type { OcxConfig } from "../../types";
+import { AUTH_SLOT_MODELS, resolveSidecarAuth } from "../../sidecar/auth";
+import { pickerVisibleSidecarCandidates, type SidecarCandidate } from "../../sidecar/candidates";
+import { WEB_SEARCH_BACKENDS, webSearchSidecarCandidates } from "../../web-search/backends";
+import type { WebSearchBackendId } from "../../web-search/index";
+
+// The full configured union. Rows only ever materialize for backends whose
+// executor admits the candidate, so inert arms (gemini/exa without config)
+// simply never produce rows.
+export type WebSearchBackend = WebSearchBackendId;
+
+export interface WebSearchCandidateRow extends SidecarCandidate {
+  /** Executor backend that admitted this exact candidate row. */
+  backend: WebSearchBackend;
+}
+
+export interface WebSearchModelOption {
+  value: string;
+  label: string;
+  /** Exact runnable pair represented by this picker row. */
+  backend: WebSearchBackend;
+  model: string;
+  /** True when the row is an auth-slot entitlement rather than a picker row. */
+  authSlot?: boolean;
+}
+
+/** The candidate rows the web-search executors can actually run right now. */
+export async function webSearchCandidateRows(config: OcxConfig): Promise<WebSearchCandidateRow[]> {
+  const auth = resolveSidecarAuth(config);
+  const all = await pickerVisibleSidecarCandidates(config, auth);
+  return webSearchSidecarCandidates(config, auth, all).flatMap(candidate => {
+   const descriptor = WEB_SEARCH_BACKENDS.find(entry =>
+      entry.isActive(auth, config) && entry.eligibleModel(candidate, auth));
+    return descriptor ? [{ ...candidate, backend: descriptor.backend }] : [];
+  });
+}
+
+/**
+ * The GUI/CLI option list. The persisted model is display-grandfathered so an
+ * operator can SEE a now-illegal setting in the picker (parity with the vision
+ * GET); new writes of such an id are still rejected by the gate below.
+ */
+export function webSearchModelOptionsFrom(
+  config: Pick<OcxConfig, "webSearchSidecar">,
+  candidates: readonly WebSearchCandidateRow[],
+): WebSearchModelOption[] {
+  const byValue = new Map<string, WebSearchModelOption>();
+  for (const candidate of candidates) {
+    if (byValue.has(candidate.id)) continue;
+    byValue.set(candidate.id, {
+      value: candidate.id,
+      label: candidate.id,
+      backend: candidate.backend,
+      model: candidate.id,
+      ...(candidate.authSlot ? { authSlot: true } : {}),
+    });
+  }
+  const persisted = config.webSearchSidecar?.model;
+  if (persisted && !byValue.has(persisted)) {
+    byValue.set(persisted, {
+      value: persisted,
+      label: persisted,
+      backend: config.webSearchSidecar?.backend ?? "openai",
+      model: persisted,
+    });
+  }
+  return [...byValue.values()].sort((a, b) => a.value.localeCompare(b.value));
+}
+
+/**
+ * Membership gate: reject when the id is neither a runnable candidate nor an
+ * auth-slot model. Auth slots pass even when the matching login is currently
+ * absent — the slot is a legal setting whose executor simply is not live yet,
+ * and refusing it would make settings order-dependent on login state.
+ */
+export function webSearchModelIsRejected(
+  backend: WebSearchBackend,
+  requested: string,
+  candidates: readonly WebSearchCandidateRow[],
+): boolean {
+  if (requested === AUTH_SLOT_MODELS.codex) return backend !== "openai";
+  if (requested === AUTH_SLOT_MODELS.anthropic) return backend !== "anthropic";
+  return !candidates.some(candidate => candidate.backend === backend && candidate.id === requested);
+}
+
+/** Uniform 400 payload naming the filter, mirroring visionDescriberRejection's shape. */
+export function webSearchModelRejection(
+  field: string,
+  backend: WebSearchBackend,
+  requested: string,
+  candidates: readonly WebSearchCandidateRow[],
+): { error: string; allowedModels: string[] } {
+  const allowed = new Set(candidates
+    .filter(candidate => candidate.backend === backend)
+    .map(candidate => candidate.id));
+  // Preserve the response contract: allowedModels lists both always-configurable
+  // auth-slot ids even though the pair gate below binds each to its own backend.
+  allowed.add(AUTH_SLOT_MODELS.codex);
+  allowed.add(AUTH_SLOT_MODELS.anthropic);
+  return {
+    error: `${field}: backend/model pair "${backend}/${requested}" is not a web-search sidecar candidate — ` +
+      "the model must be picker-visible and runnable by that executor-backed backend (or its auth-slot model)",
+    allowedModels: [...allowed].sort(),
+  };
+}