@bitkyc08/opencodex 2.35.0 → 2.36.0-preview.20260830

package/src/server/management/provider-routes.ts

@@ -77,6 +77,7 @@ import { estimateComboCost, estimateRequestCost, normalizeCostTokens, tokensPerS
 import type { PersistedUsageAttempt } from "../../usage/log";
 import { isAllowedRequestOrigin, jsonResponse, providerManagementConfigError, publicProviderBaseUrl, safeConfigDTO } from "../auth-cors";
 import { providerServiceTierConfigError } from "./provider-capability-config";
+import { providerEmptyToolOutputConfigError } from "../../config/provider-validation";
 import { applySystemEnvToggle } from "../system-env";
 import {
   LOCAL_PROVIDER_RELOAD_NAME_HEADER,
@@ -187,6 +188,17 @@ function applyProviderPatchFields(
     next.liveModels = rawBody.liveModels;
     touched = true;
   }
+  if (Object.hasOwn(rawBody, "annotateEmptyToolOutputs")) {
+    const value = rawBody.annotateEmptyToolOutputs;
+    if (value === null) {
+      delete next.annotateEmptyToolOutputs;
+    } else if (typeof value === "boolean") {
+      next.annotateEmptyToolOutputs = value;
+    } else {
+      return { error: "annotateEmptyToolOutputs must be a boolean or null" };
+    }
+    touched = true;
+  }
   if (Object.hasOwn(rawBody, "xaiResponsesOptIn")) {
     if (name !== "xai") return { error: "xaiResponsesOptIn is valid only for provider xai" };
     if (typeof rawBody.xaiResponsesOptIn !== "boolean") {
@@ -412,7 +424,8 @@ function canonicalOpenAiBudgetPatchError(
   }
   const applied = applyProviderPatchFields("openai", seed, rawBody, keys, config);
   if ("error" in applied) return applied.error;
-  return providerManagementConfigError("openai", applied.next);
+  return providerManagementConfigError("openai", applied.next)
+    ?? providerEmptyToolOutputConfigError("openai", applied.next);
 }
 
 export async function handleProviderRoutes(ctx: ManagementContext): Promise<Response | null> {
@@ -484,7 +497,8 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       return jsonResponse({ error: "provider reload target unavailable" }, 404);
     }
     const provider = diskConfig.providers[name]!;
-    const providerError = providerManagementConfigError(name, provider);
+    const providerError = providerManagementConfigError(name, provider)
+      ?? providerEmptyToolOutputConfigError(name, provider);
     if (providerError) return jsonResponse({ error: "provider reload target invalid" }, 409);
     const namespaceCollision = codexAccountNamespaceProviderCollisionError(
       diskConfig.codexAccountNamespaces,
@@ -543,7 +557,8 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     let body: { name?: unknown; provider?: unknown; setDefault?: boolean };
     try { body = await readManagementJsonBody(req); } catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid JSON body" }, 400); }
     const name = typeof body.name === "string" ? body.name.trim() : "";
-    const providerError = providerManagementConfigError(name, body.provider);
+    const providerError = providerManagementConfigError(name, body.provider)
+      ?? providerEmptyToolOutputConfigError(name, body.provider);
     if (providerError) return jsonResponse({ error: providerError }, 400);
     const serviceTierError = providerServiceTierConfigError(name, body.provider);
     if (serviceTierError) return jsonResponse({ error: serviceTierError }, 400);
@@ -585,6 +600,11 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     const submittedModelContextWindows = Object.hasOwn(prov, "modelContextWindows");
     const submittedModelAutoCompactTokenLimits = Object.hasOwn(prov, "modelAutoCompactTokenLimits");
     const submittedRequestPacing = Object.hasOwn(prov, "requestPacing");
+    // Same trap, one more field: DeepSeek carries a registry default of `true` for
+    // annotateEmptyToolOutputs, so enrichment cannot distinguish "the client omitted it"
+    // from "the registry supplied it" either. Without this sample, an unrelated edit that
+    // omits the key resurrects the registry default over an operator's explicit `false`.
+    const submittedAnnotateEmptyToolOutputs = Object.hasOwn(prov, "annotateEmptyToolOutputs");
     enrichProviderFromCatalog(name, prov);
     const { saveConfigPreservingClaudeCode: save } = await import("../../config");
     // Overwriting an existing provider must not drop its multi-key pool: carry it over, then
@@ -613,6 +633,11 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     if (!submittedContextWindow && existing?.contextWindow !== undefined) {
       prov.contextWindow = existing.contextWindow;
     }
+    // `!== undefined` rather than a truthiness test: the whole point of this field is that
+    // an explicit `false` must survive, and `false` is falsy.
+    if (!submittedAnnotateEmptyToolOutputs && existing?.annotateEmptyToolOutputs !== undefined) {
+      prov.annotateEmptyToolOutputs = existing.annotateEmptyToolOutputs;
+    }
     if (existing?.modelContextWindows) {
       // When the client did send a map, its keys win and the user's other keys survive. When
       // it did not, the stored value is the user's map alone: merging the registry seed in
@@ -717,7 +742,8 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     if (applied.editorTouched && !pacingOnly) {
       const providerError = canonicalBudgetOnly
         ? canonicalOpenAiBudgetPatchError(next, rawBody, keys, config)
-        : providerManagementConfigError(name, next);
+        : providerManagementConfigError(name, next)
+          ?? providerEmptyToolOutputConfigError(name, next);
       if (providerError) return jsonResponse({ error: providerError }, 400);
       if (!canonicalBudgetOnly) {
         const serviceTierError = providerServiceTierConfigError(name, next);
@@ -750,7 +776,8 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       if (replay.editorTouched && !pacingOnly) {
         const syncError = canonicalBudgetOnly
           ? canonicalOpenAiBudgetPatchError(replay.next, rawBody, keys, config)
-          : providerManagementConfigError(name, replay.next);
+          : providerManagementConfigError(name, replay.next)
+            ?? providerEmptyToolOutputConfigError(name, replay.next);
         if (syncError) {
           replayError = syncError;
           return;

package/src/server/management/routing-profile-routes.ts

@@ -27,6 +27,7 @@ import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
 import { jsonResponse } from "../auth-cors";
 import type { ManagementContext } from "./context";
 import type { OcxConfig, OcxRoutingProfileConfig } from "../../types";
+import { shadowCallTargetError } from "./shadow-call-validation";
 
 function profileDto(config: Parameters<typeof getRoutingProfile>[0], id: string): Record<string, unknown> | null {
   const profile = getRoutingProfile(config, id);
@@ -276,10 +277,12 @@ export async function handleRoutingProfileRoutes(ctx: ManagementContext): Promis
     }
 
     const previousProfile = mode === "update" ? getRoutingProfile(config, id) : undefined;
+    let aliasMigration: { oldPublicModel: string; newPublicModel: string } | undefined;
     if (mode === "update" && previousProfile) {
       const oldPublicModel = policyPublicModelId(id, previousProfile);
       const newProfile = normalizeRoutingProfile(id, body.profile as OcxRoutingProfileConfig);
       const newPublicModel = policyPublicModelId(id, newProfile);
+      aliasMigration = { oldPublicModel, newPublicModel };
       const collision = modelMapMigrationCollision(config, oldPublicModel, newPublicModel);
       if (collision) {
         return jsonResponse({
@@ -289,6 +292,18 @@ export async function handleRoutingProfileRoutes(ctx: ManagementContext): Promis
     }
     const nextProfiles = { ...(config.routingProfiles ?? {}) };
     nextProfiles[id] = storedProfile(id, body.profile as OcxRoutingProfileConfig);
+    const currentShadowTarget = config.shadowCallIntercept?.model;
+    if (aliasMigration && currentShadowTarget === aliasMigration.oldPublicModel) {
+      const targetError = shadowCallTargetError(
+        { ...config, routingProfiles: nextProfiles },
+        aliasMigration.newPublicModel,
+      );
+      if (targetError) {
+        return jsonResponse({
+          error: { code: "invalid_shadow_call_target", message: targetError },
+        }, 400, req, config);
+      }
+    }
     config.routingProfiles = nextProfiles;
     // Creating the first profile on a process started profile-less must install the
     // compatibility provider now; activation is synchronous and idempotent per configDir.

package/src/server/management/shadow-call-validation.ts

@@ -0,0 +1,29 @@
+import { shadowCallTargetsIntersect, shadowSourceModels } from "../../lib/shadow-call";
+import { OPENAI_CODEX_PROVIDER_ID } from "../../providers/openai-tiers";
+import { routeConcreteModel, routeModel } from "../../router";
+import type { OcxConfig } from "../../types";
+
+/** Validate a prospective persisted shadow-call target against its resolved source identities. */
+export function shadowCallTargetError(config: OcxConfig, targetModel: string | undefined): string | null {
+  if (!targetModel) return null;
+
+  let target;
+  try {
+    target = routeModel(config, targetModel);
+  } catch {
+    return "model must resolve to a configured provider";
+  }
+
+  const intersectsSource = shadowSourceModels(config.shadowCallIntercept?.sourceModels).some(sourceModel => {
+    let source = { providerName: OPENAI_CODEX_PROVIDER_ID, modelId: sourceModel };
+    try {
+      const resolved = routeConcreteModel(config, sourceModel);
+      source = { providerName: resolved.providerName, modelId: sourceModel };
+    } catch { /* Unconfigured native Codex source models remain OpenAI-owned. */ }
+    return shadowCallTargetsIntersect(source, target);
+  });
+
+  return intersectsSource
+    ? "shadow-call target must not intersect a source model"
+    : null;
+}

package/src/server/management-api.ts

@@ -197,7 +197,7 @@ export async function handleManagementAPI(
     try {
       const { injectClaudeAgentDefs } = await import("../claude/agents-inject");
       if (config.claudeCode?.enabled === false || config.claudeCode?.injectAgents === false) {
-        injectClaudeAgentDefs(config, {});
+        injectClaudeAgentDefs(config, {}, deps.claudeAgentConfigDir);
         return;
       }
       try {
@@ -206,11 +206,15 @@ export async function handleManagementAPI(
           import("../claude/context-windows"),
           import("../codex/catalog"),
         ]);
-        injectClaudeAgentDefs(config, buildClaudeContextWindows([...visibleNativeSlugs(config)], models, nativeContextLimits(config)));
+        injectClaudeAgentDefs(
+          config,
+          buildClaudeContextWindows([...visibleNativeSlugs(config)], models, nativeContextLimits(config)),
+          deps.claudeAgentConfigDir,
+        );
       } catch {
         // Keep routes available through a provider-discovery blip. A later
         // launch-time sync restores any context markers missing from this pass.
-        injectClaudeAgentDefs(config, {});
+        injectClaudeAgentDefs(config, {}, deps.claudeAgentConfigDir);
       }
     } catch { /* best-effort */ }
   }

package/src/server/request-log.ts

@@ -1,4 +1,5 @@
 import { existsSync, readFileSync } from "node:fs";
+import { randomBytes } from "node:crypto";
 import type { ResponsesTerminalStatus } from "../bridge";
 import {
   classifyError,
@@ -201,7 +202,6 @@ const requestLog: RequestLogEntry[] = [];
 const MAX_LOG_SIZE = 2000;
 const requestLogEntryBytes = new WeakMap<RequestLogEntry, number>();
 let requestLogBytes = 0;
-let requestLogSeq = 0;
 /** True after hydrateRequestLogsFromDisk ran once in this process. */
 let requestLogsHydratedFromDisk = false;
 
@@ -430,9 +430,8 @@ export function addRequestLog(entry: RequestLogEntry) {
   }
 }
 
-export function nextRequestLogId(timestamp = Date.now()): string {
-  requestLogSeq = (requestLogSeq % 1_000_000) + 1;
-  return `ocx-${timestamp.toString(36)}-${requestLogSeq.toString(36)}`;
+export function nextRequestLogId(_timestamp = Date.now()): string {
+  return `ocx-${randomBytes(16).toString("hex")}`;
 }
 
 /**
@@ -1308,6 +1307,5 @@ export function getRequestLogEntries(): RequestLogEntry[] { return requestLog; }
 export function clearRequestLogsForTests(): void {
   requestLog.length = 0;
   requestLogBytes = 0;
-  requestLogSeq = 0;
   requestLogsHydratedFromDisk = false;
 }

package/src/server/responses/agent-task-recovery-cache.ts

@@ -128,6 +128,10 @@ export async function resolveCachedAgentTaskRecovery(
   return flight ? waitForRecoveryFlight(flight, abortSignal) : null;
 }
 
+export function discardCachedAgentTaskRecovery(key: string): void {
+  deleteRecoveryCacheEntry(key);
+}
+
 export function resetAgentTaskRecoveryCache(): void {
   for (const flight of RECOVERY_FLIGHTS.values()) {
     flight.controller.abort(new DOMException("Recovery state reset", "AbortError"));
@@ -141,3 +145,7 @@ export function agentTaskRecoveryWaiterCountForTests(): number {
   for (const flight of RECOVERY_FLIGHTS.values()) count += flight.waiters;
   return count;
 }
+
+export function agentTaskRecoveryCacheSnapshotForTests(): { entries: number; bytes: number } {
+  return { entries: RECOVERY_CACHE.size, bytes: recoveryCacheBytes };
+}

package/src/server/responses/agent-task-recovery.ts

@@ -5,6 +5,7 @@ import { readBoundedResponseBody } from "../../lib/bounded-body";
 import { isApiAuthRequired, isProxyAdmissionSecret } from "../auth-cors";
 import { structurallyValidFernetTokens } from "./encrypted-payload";
 import {
+  discardCachedAgentTaskRecovery,
   resetAgentTaskRecoveryCache,
   resolveCachedAgentTaskRecovery,
 } from "./agent-task-recovery-cache";
@@ -266,6 +267,38 @@ function recoveryAdmission(req: Request, config: OcxConfig): RecoveryAdmission |
   return { headers, cacheScope };
 }
 
+interface AdmittedRecovery {
+  envelope: AgentEnvelope;
+  admission: RecoveryAdmission;
+  cacheKey: string;
+}
+
+function admittedRecovery(
+  req: Request,
+  input: unknown,
+  config: OcxConfig,
+  parentThreadId?: string | null,
+): AdmittedRecovery | null {
+  const envelope = findEnvelope(input);
+  if (!envelope) return null;
+  const admission = recoveryAdmission(req, config);
+  if (!admission) return null;
+  const cacheKey = createHash("sha256")
+    .update(admission.cacheScope)
+    .update("\0")
+    .update(parentThreadId ?? "")
+    .update("\0")
+    .update(envelope.messageType)
+    .update("\0")
+    .update(envelope.taskName)
+    .update("\0")
+    .update(envelope.sender)
+    .update("\0")
+    .update(envelope.ciphertext)
+    .digest("hex");
+  return { envelope, admission, cacheKey };
+}
+
 function recoveryPayload(envelope: AgentEnvelope, model: string): string {
   return JSON.stringify({
     model,
@@ -430,34 +463,33 @@ export async function recoverEncryptedAgentTask(
   config: OcxConfig,
   context: { parentThreadId?: string | null; abortSignal?: AbortSignal } = {},
 ): Promise<boolean> {
-  const envelope = findEnvelope(input);
-  if (!envelope) return false;
   // Admission is deliberately checked before cache access. A cache hit must not
   // turn this process into a plaintext oracle for an unauthenticated caller.
-  const admission = recoveryAdmission(req, config);
-  if (!admission) return false;
-
-  const cacheKey = createHash("sha256")
-    .update(admission.cacheScope)
-    .update("\0")
-    .update(context.parentThreadId ?? "")
-    .update("\0")
-    .update(envelope.messageType)
-    .update("\0")
-    .update(envelope.taskName)
-    .update("\0")
-    .update(envelope.sender)
-    .update("\0")
-    .update(envelope.ciphertext)
-    .digest("hex");
+  const admitted = admittedRecovery(req, input, config, context.parentThreadId);
+  if (!admitted) return false;
+  const { admission, cacheKey, envelope } = admitted;
   const assignment = await resolveCachedAgentTaskRecovery(
     cacheKey,
     options.cacheEntries ?? 200,
     signal => requestRecovery(admission, envelope, options, signal),
     context.abortSignal,
   );
-  if (!assignment || context.abortSignal?.aborted) return false;
-  return injectAssignment(input, envelope, assignment);
+  if (!assignment) return false;
+  if (context.abortSignal?.aborted || !injectAssignment(input, envelope, assignment)) {
+    discardCachedAgentTaskRecovery(cacheKey);
+    return false;
+  }
+  return true;
+}
+
+export function discardEncryptedAgentTaskRecovery(
+  req: Request,
+  input: unknown,
+  config: OcxConfig,
+  context: { parentThreadId?: string | null } = {},
+): void {
+  const admitted = admittedRecovery(req, input, config, context.parentThreadId);
+  if (admitted) discardCachedAgentTaskRecovery(admitted.cacheKey);
 }
 
 export function resetAgentTaskRecoveryState(): void {

package/src/server/responses/codex-auth-error.ts

@@ -10,12 +10,35 @@ import {
   CodexPoolAuthenticationError,
   CodexThreadAffinityExpiredError,
 } from "../../codex/auth-context";
+import {
+  MAIN_CODEX_ACCOUNT_ID,
+  MainAccountTokenRefreshError,
+  MainAuthJsonChangedDuringRefreshError,
+} from "../../codex/main-account";
 
 export interface CodexAuthContextErrorResponseOptions {
   accountSelector?: string;
   now: number;
 }
 
+export function nativeMainRefreshFailureResponse(error: unknown): Response {
+  if (error instanceof MainAccountTokenRefreshError && error.reason === "reauth") {
+    return formatErrorResponse(401, "authentication_error", "Codex main account needs reauthentication");
+  }
+  if (error instanceof MainAccountTokenRefreshError
+    || error instanceof MainAuthJsonChangedDuringRefreshError) {
+    const response = formatErrorResponse(
+      503,
+      "server_busy",
+      "Codex main credential refresh did not complete; retry this request",
+    );
+    const headers = new Headers(response.headers);
+    headers.set("Retry-After", "1");
+    return new Response(response.body, { status: response.status, headers });
+  }
+  return formatErrorResponse(401, "authentication_error", "No usable Codex main credential to serve this request");
+}
+
 /** Shared HTTP contract for Codex auth-context failures on Responses surfaces. */
 export function mapCodexAuthContextErrorToResponse(
   error: unknown,
@@ -35,6 +58,9 @@ export function mapCodexAuthContextErrorToResponse(
     );
   }
   if (error instanceof CodexAuthContextError) {
+    if (error.accountId === MAIN_CODEX_ACCOUNT_ID) {
+      return nativeMainRefreshFailureResponse(error.cause);
+    }
     return formatErrorResponse(
       401,
       "authentication_error",