@bitkyc08/opencodex 2.37.0 → 2.39.0-preview.20260901

package/src/server/index.ts

@@ -66,6 +66,7 @@ import { codexAccountNamespaceEntries, isMainCodexAccountTarget } from "../codex
 import { MAIN_CODEX_ACCOUNT_ID } from "../codex/main-account";
 import {
   availableAccountGatedNativeModels,
+  codexModelEntitlementStateForAccount,
   resolveCodexModelEntitlements,
 } from "../codex/model-entitlements";
 export {
@@ -1211,10 +1212,10 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
           ? new Map([...accountBoundNativeOpenAiSlugsBySelector(config)].map(([selector, slugs]) => {
             const target = accountTargets.get(selector);
             const accountId = target && isMainCodexAccountTarget(target) ? MAIN_CODEX_ACCOUNT_ID : target;
-            const entitled = accountId ? modelEntitlements.modelsByAccount.get(accountId) : undefined;
-            const confirmed = accountId ? modelEntitlements.confirmedAccountIds.has(accountId) : false;
             return [selector, slugs.filter(slug => (
-              !ACCOUNT_GATED_NATIVE_OPENAI_MODELS.has(slug) || (confirmed && entitled?.has(slug) === true)
+              !ACCOUNT_GATED_NATIVE_OPENAI_MODELS.has(slug)
+              || (accountId !== undefined
+                && codexModelEntitlementStateForAccount(modelEntitlements, accountId, slug) === "granted")
             ))] as const;
           }))
           : new Map<string, readonly string[]>();

package/src/server/lifecycle.ts

@@ -458,8 +458,9 @@ export function trackStreamLifetime(
 export async function drainAndShutdown(
   server: ReturnType<typeof Bun.serve> | undefined,
   timeoutMs: number,
-): Promise<void> {
+): Promise<boolean> {
   const s = server ?? _serverRef;
+  let shutdownSucceeded = true;
   // One absolute budget covers both a pre-existing scoped profile drain and
   // ordinary in-flight turns. A stuck scoped owner must not pin shutdown forever.
   const deadline = Date.now() + Math.max(0, timeoutMs);
@@ -491,9 +492,11 @@ export async function drainAndShutdown(
     // shutdown is usually part of.
     const stateFlush = await Promise.allSettled([flushResponseState(), flushAntigravityReplay()]);
     if (stateFlush[0]?.status === "rejected") {
+      shutdownSucceeded = false;
       console.warn("[responses] state flush during shutdown failed");
     }
     if (stateFlush[1]?.status === "rejected") {
+      shutdownSucceeded = false;
       console.warn("[antigravity] replay flush during shutdown failed");
     }
 
@@ -546,4 +549,5 @@ export async function drainAndShutdown(
       // never resume admission merely because shutdown cleanup returned.
     }
   }
+  return shutdownSucceeded;
 }

package/src/server/management/integration-routes.ts

@@ -21,6 +21,7 @@ import { createIntegrationStateStore, type IntegrationStateStore } from "../../i
 import {
   applyIntegrationCoordinated,
   disableIntegrationCoordinated,
+  overwriteIntegrationCoordinated,
   restoreIntegrationCoordinated,
   type IntegrationRestoreInput,
   type IntegrationWriteInput,
@@ -70,7 +71,7 @@ export interface IntegrationJournalEnvelope {
 export interface IntegrationJournalRow {
   opId: string;
   clientId: IntegrationClientId;
-  kind: "apply" | "disable" | "refresh" | "restore";
+  kind: "apply" | "disable" | "refresh" | "restore" | "overwrite";
   at: string;
   configPath: string;
   snapshot: "none" | "stored" | "expired";
@@ -79,6 +80,14 @@ export interface IntegrationJournalRow {
 
 export interface IntegrationToggleBody {
   enabled: boolean;
+  /**
+   * Opt in to replacing a conflicted block with the one opencodex would write.
+   *
+   * Absent and `false` behave identically and are the only states a caller
+   * reaches by accident, which is the point: the conflict refusal protects work
+   * we did not author, so it can only be waived by asking for it by name.
+   */
+  overwriteConflict?: boolean;
 }
 
 export interface IntegrationRestoreBody {
@@ -472,16 +481,38 @@ export async function handleIntegrationRoutes(ctx: ManagementContext): Promise<R
       code: "invalid_enabled",
     }, 400, req, ctx.config);
   }
+  if (parsed.overwriteConflict !== undefined && typeof parsed.overwriteConflict !== "boolean") {
+    return jsonResponse({
+      error: "overwriteConflict must be a boolean",
+      code: "invalid_overwrite_conflict",
+    }, 400, req, ctx.config);
+  }
+  /*
+   * Rejected rather than ignored. Disabling a block we do not own is precisely
+   * the deletion this subsystem exists to prevent, so a caller sending this
+   * combination has misunderstood the field, and silently dropping it would
+   * answer 200 for a request whose intent we refused.
+   */
+  if (parsed.overwriteConflict === true && parsed.enabled === false) {
+    return jsonResponse({
+      error: "overwriteConflict applies only to enabling an integration",
+      code: "invalid_overwrite_conflict",
+    }, 400, req, ctx.config);
+  }
 
   try {
     const input = await buildIntegrationWriteInput(requestedClient, ctx, integrationStore());
     const result = await runIntegrationMutationFlight(
       requestedClient,
-      parsed.enabled ? "apply" : "disable",
+      parsed.enabled ? (parsed.overwriteConflict === true ? "overwrite" : "apply") : "disable",
       input.io?.now ?? Date.now,
-      () => parsed.enabled
-        ? applyIntegrationCoordinated(input, { lockSeams: integrationMutationTestHooks?.lockSeams })
-        : disableIntegrationCoordinated(input, { lockSeams: integrationMutationTestHooks?.lockSeams }),
+      () => {
+        const options = { lockSeams: integrationMutationTestHooks?.lockSeams };
+        if (!parsed.enabled) return disableIntegrationCoordinated(input, options);
+        return parsed.overwriteConflict === true
+          ? overwriteIntegrationCoordinated(input, options)
+          : applyIntegrationCoordinated(input, options);
+      },
     );
     if (!result.ok) return writerFailureResponse(requestedClient, result, ctx);
     return jsonResponse(result satisfies IntegrationToggleEnvelope, 200, req, ctx.config);

package/src/server/management/model-rows.ts

@@ -25,6 +25,7 @@ import { providerContextCap } from "../../providers/context-cap";
 import { isVisionReasoningEffort } from "../../reasoning-effort";
 import { routedSlug, slugEquals } from "../../providers/slug-codec";
 import type { OcxConfig } from "../../types";
+import { ensureCodexEntitlementFreshness } from "../../codex/model-entitlements";
 import { fetchAllModels } from "./shared";
 
 /**
@@ -47,8 +48,16 @@ export type ManagementModelRow = Partial<CatalogModel> & {
  * models the GUI's Models tab shows — including this function's `disabled` computation,
  * which the export core (src/clients/config-export.ts) deliberately does not perform.
  */
-export async function listManagementModelRows(config: OcxConfig): Promise<ManagementModelRow[]> {
-  const models = await fetchAllModels(config);
+export async function listManagementModelRows(
+  config: OcxConfig,
+  options: { entitlementWaitMs?: number } = {},
+): Promise<ManagementModelRow[]> {
+  const [models] = await Promise.all([
+    fetchAllModels(config),
+    ensureCodexEntitlementFreshness(config, {
+      waitMs: options.entitlementWaitMs ?? 3_000,
+    }),
+  ]);
   const disabled = new Set(config.disabledModels ?? []);
   // Native GPT passthrough rows lead (provider "openai", bare-slug namespaced ids): sourced
   // from the static supported set so a disabled model stays listed and re-enableable.

package/src/server/management/provider-routes.ts

@@ -53,6 +53,7 @@ import { codexAccountNamespaceProviderCollisionError } from "../../codex/account
 import { clearThreadAccountMap } from "../../codex/routing";
 import { primeCodexPoolQuotas } from "../../codex/auth-api";
 import { clearModelCache, getProviderDiscoveryStatus } from "../../codex/model-cache";
+import { getCodexModelEntitlementStatus } from "../../codex/model-entitlements";
 import { DEFAULT_PROVIDER_CONTEXT_CAP, globalContextCapValue, providerContextCap, providerContextCaps, setAllProviderContextCaps, setGlobalContextCapValue, setProviderContextCap } from "../../providers/context-cap";
 import { modelAutoCompactTokenLimitsConfigError } from "../../providers/auto-compact-budget";
 import { resolveCodexHomeDir } from "../../codex/home";
@@ -474,6 +475,9 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       codexAccountMode: providerCodexAccountMode(name, p),
       ...(name === "xai" ? { xaiResponsesOptInState: xaiResponsesOptInState(p) } : {}),
       discovery: p.liveModels === false ? undefined : getProviderDiscoveryStatus(name),
+      ...(name === "openai" && isCanonicalOpenAiForwardProvider(p)
+        ? { entitlement: getCodexModelEntitlementStatus(config) }
+        : {}),
     })));
   }
 

package/src/server/management/system-restart.ts

@@ -78,11 +78,11 @@ let restartIo: SystemRestartIo = {};
 /** Prevents double-scheduling in the 200ms window before drainAndShutdown sets draining. */
 let restartAccepted = false;
 
-type RestartDrainOutcome = "completed" | "rejected" | "deadline";
+type RestartDrainOutcome = "completed" | "failed" | "rejected" | "deadline";
 type BoundedSettlementOutcome = "completed" | "rejected" | "deadline";
 
 function waitForRestartDrain(
-  drainPromise: Promise<void>,
+  drainPromise: Promise<boolean | void>,
   deadlineMs: number,
   now: () => number,
   scheduleDeadline: NonNullable<SystemRestartIo["scheduleDeadline"]>,
@@ -105,7 +105,7 @@ function waitForRestartDrain(
     cancelDeadline = scheduleDeadline(() => finish("deadline"), remainingMs);
     if (settled) cancelDeadline();
     void drainPromise.then(
-      () => finish("completed"),
+      succeeded => finish(succeeded === false ? "failed" : "completed"),
       () => finish("rejected"),
     );
   });
@@ -382,7 +382,7 @@ export function acceptSystemRestart(io: SystemRestartIo = restartIo): {
         await completeDeadlineRestartHandoff(io, exitProcess, restartPort, scheduleDeadline);
         return;
       }
-      if (drainOutcome === "rejected") {
+      if (drainOutcome === "failed" || drainOutcome === "rejected") {
         // drainAndShutdown stops the listener in finally. Even if ancillary cleanup
         // rejects, an accepted restart must still reach replacement or terminal exit.
         console.warn("Drain-and-restart cleanup failed; continuing terminal restart handoff");
@@ -422,7 +422,7 @@ export function acceptSystemRestart(io: SystemRestartIo = restartIo): {
         return;
       }
       (io.markRecycling ?? markRecyclingForExit)();
-      exitProcess(0);
+      exitProcess(drainOutcome === "failed" || drainOutcome === "rejected" ? 1 : 0);
     }, 200);
   }
 

package/src/server/management-api.ts

@@ -256,10 +256,46 @@ export async function handleManagementAPI(
   if (routed) return routed;
 
   if (url.pathname === "/api/stop" && req.method === "POST") {
-    const { restoreNativeCodexAsync } = await import("../codex/inject");
-    const { stopServiceIfInstalled, isServiceOwnershipError } = await import("../service");
+    const { installedServiceRespawnRisk, stopServiceIfInstalledDetailed, isServiceOwnershipError } = await import("../service");
+    // `ocx stop` performs its own shared teardown AFTER verifying the scheduler did not
+    // respawn the proxy (#3008). Without this the child restores native Codex and strips
+    // the Grok fence here, so a survivor found moments later has already had the shared
+    // config pulled out from under it — and the parent's `ownershipBlocked` guard can
+    // only prevent a second, redundant teardown. A direct caller sends nothing and keeps
+    // the self-contained behaviour.
+    //
+    // The query flag alone is not enough to hand over the obligation: any authenticated
+    // caller could set it and simply exit, leaving client config pointed at a proxy that
+    // no longer exists. Honour the deferral only when the caller left a pending-teardown
+    // receipt on disk, which a later stop/update can find and finish.
+    // Decide BEFORE touching the manager. Stopping the Task Scheduler task and then
+    // refusing left the proxy running with its manager stopped — worse than either
+    // outcome. This process cannot verify its own post-exit respawn window; only the
+    // receipt-backed parent `ocx stop` can, which is what the deferral exists for.
+    const { deferralMatchesReceipt } = await import("../config/pending-teardown");
+    const { deferralHonored, performStopTeardown } = await import("./stop-teardown");
+    const holdsReceipt = deferralHonored(url, deferralMatchesReceipt);
+    const respawnRisk = holdsReceipt ? "none" : installedServiceRespawnRisk();
+    if (respawnRisk === "respawnable") {
+      return jsonResponse({
+        success: false,
+        code: "respawnable_service",
+        message: "This proxy is managed by a Task Scheduler wrapper that can respawn it, so the stop must be run by `ocx stop`, which verifies the respawn window. Nothing was changed.",
+      }, 409, req, config);
+    }
+    if (respawnRisk === "unknown") {
+      // Do NOT send them to `ocx stop`: it maps the same unanswerable probe to a stop
+      // failure, so that advice would be a loop. The scheduler query itself is what needs
+      // fixing (#3008).
+      return jsonResponse({
+        success: false,
+        code: "service_state_unknown",
+        message: "The Windows Task Scheduler state could not be read, so this proxy cannot tell whether a wrapper would respawn it. Nothing was changed. Run `ocx service status` to see the query error, repair Task Scheduler access, then retry.",
+      }, 409, req, config);
+    }
+    let serviceStop: import("../service").ServiceStopOutcome;
     try {
-      stopServiceIfInstalled();
+      serviceStop = stopServiceIfInstalledDetailed();
     } catch (err) {
       if (isServiceOwnershipError(err)) {
         // The installed service belongs to another CODEX_HOME/OPENCODEX_HOME: it would respawn
@@ -269,20 +305,43 @@ export async function handleManagementAPI(
       }
       throw err;
     }
-    const restore = await restoreNativeCodexAsync();
+    // The boolean helper collapses "failed" into the same false as "no service installed",
+    // so this route used to tear down shared config and exit while a manager that refused
+    // to stop was still there to respawn the proxy (#3008).
+    if (serviceStop === "failed") {
+      return jsonResponse({
+        success: false,
+        message: "The installed service manager did not stop; it may respawn the proxy. Shared client config was left alone. Run `ocx stop` from the home that owns the service.",
+      }, 409, req, config);
+    }
+    if (serviceStop === "state-unknown") {
+      // Same case, same remedy as the pre-check: the query is what needs fixing.
+      return jsonResponse({
+        success: false,
+        code: "service_state_unknown",
+        message: "The Windows Task Scheduler state could not be read, so this proxy cannot tell whether a wrapper would respawn it. Shared client config was left alone. Run `ocx service status` to see the query error, repair Task Scheduler access, then retry.",
+      }, 409, req, config);
+    }
+    // The pre-check above already refused the respawnable case without a receipt, so
+    // reaching here with one means the parent owns the verification.
     // Both managed configs come down together on an explicit teardown. The daemon's own
     // syncCleanup skips this when OCX_SERVICE is set (so a crash/respawn keeps the fence),
-    // which is exactly why an intentional stop has to do it here.
-    const { stripGrokConfig } = await import("../grok/inject");
-    const grok = stripGrokConfig();
+    // which is exactly why an intentional stop has to do it here — unless the caller is
+    // `ocx stop`, which does it itself once the proxy is proven down.
+    const teardown = await performStopTeardown(url, { ownsReceipt: deferralMatchesReceipt });
     setTimeout(async () => {
-      await drainAndShutdown(undefined, config.shutdownTimeoutMs ?? 5000);
-      process.exit(0);
+      let shutdownSucceeded = false;
+      try {
+        shutdownSucceeded = await drainAndShutdown(undefined, config.shutdownTimeoutMs ?? 5000);
+      } catch {
+        console.warn("[opencodex] shutdown drain failed");
+      }
+      // A drained proxy whose shared teardown failed did not finish the job. Exiting 0
+      // told a supervisor the stop was clean while native Codex or the Grok fence was
+      // still pointed at this process (#3008).
+      process.exit(shutdownSucceeded && teardown.success ? 0 : 1);
     }, 200);
-    const grokNote = grok.ok ? "" : ` Grok config cleanup failed: ${grok.message}`;
-    return jsonResponse(restore.success
-      ? { success: true, message: `Proxy stopping, native Codex restored.${grokNote}` }
-      : { success: false, message: `Proxy stopping, but native Codex restore failed: ${restore.message}. Run \`ocx restore\`.${grokNote}` });
+    return jsonResponse(teardown);
   }
 
   if (url.pathname.startsWith("/api/native-main-profiles")) {

package/src/server/responses/encrypted-payload.ts

@@ -175,7 +175,24 @@ function textWithoutFernetRuns(payload: string, runs: readonly FernetTokenRun[])
   return `${text}${payload.slice(last)}`;
 }
 
-export const AGENT_MESSAGE_ROUTING_ENVELOPE = /(?:^|\n)Message Type\s*:\s*NEW_TASK[^\n]*\nTask name\s*:[^\n]*\nSender\s*:[^\n]*\nPayload\s*:\s*(?:\n|$)/gi;
+/**
+ * The routing header codex-rs writes above a delegated agent payload.
+ *
+ * `MESSAGE` is matched as well as `NEW_TASK`, and only for the unreadability CHECK --
+ * recovery stays NEW_TASK-only. #3021 reported a subagent `MESSAGE` arriving in the
+ * parent conversation as raw `gAAAA...` ciphertext after an `adapter_eof`. The detector
+ * decides "unreadable" by stripping the envelope and asking whether any plaintext
+ * survives, so an envelope shape it does not recognise counts as surviving text: a
+ * `MESSAGE` whose entire body is one Fernet token measured as READABLE and was forwarded
+ * verbatim.
+ *
+ * Widening the strip is not the same as widening recovery. Recovery decrypts, and
+ * decrypting a `MESSAGE` on the parent's behalf would build a plaintext oracle out of a
+ * payload the parent's session may have no right to read. This only lets the proxy
+ * NOTICE that what it is about to forward is unreadable ciphertext, which is what the
+ * report asks for: fail closed with a structured error rather than paste the token.
+ */
+export const AGENT_MESSAGE_ROUTING_ENVELOPE = /(?:^|\n)Message Type\s*:\s*(?:NEW_TASK|MESSAGE)[^\n]*\nTask name\s*:[^\n]*\nSender\s*:[^\n]*\nPayload\s*:\s*(?:\n|$)/gi;
 
 // CXC is the compatibility-hook control namespace. Strip only the tagged paragraph:
 // later untagged paragraphs may be genuine task text. Repeated CXC paragraphs are

package/src/server/startup-action-control.ts

@@ -233,8 +233,9 @@ function applyReconciliationOutcome(
 /**
  * Execute the existing fixed CLI installer outside the proxy event loop.
  *
- * Repair mode (`options.repair`) runs `ocx service repair` — asset rewrite + restart
- * without Task Scheduler re-registration, so it must not enter the UAC elevation path.
+ * Repair mode (`options.repair`) runs `ocx service repair`. A stale definition may be
+ * re-registered and elevate inside repair; this wrapper must not retry it through the separate
+ * fresh-install UAC path.
  *
  * After an elevation request timeout the lock becomes `indeterminate` until the
  * original elevated transaction completes and is reconciled. A process restart

package/src/server/stop-teardown.ts

@@ -0,0 +1,84 @@
+import type { CodexNativeRestoreResult } from "../codex/inject";
+import { deferralMatchesReceipt } from "../config/pending-teardown";
+
+/**
+ * Shared-teardown decision and execution for `POST /api/stop` (#3008).
+ *
+ * Lives outside the route handler because the handler schedules `process.exit` 200ms
+ * after it answers, which makes it uncallable from a test. The part worth testing is
+ * exactly this: whether the deferral is honoured, whether the restores actually run, and
+ * whether the response says what happened.
+ */
+
+export type GrokStripResult = { ok: boolean; changed: boolean; message: string };
+
+export type StopTeardownIo = {
+  /** Does the nonce this request carries name a readable obligation on disk? */
+  ownsReceipt?: (nonce: string | null) => boolean;
+  restoreNativeCodex?: () => Promise<CodexNativeRestoreResult>;
+  stripGrok?: () => GrokStripResult;
+};
+
+export type StopTeardownBody = {
+  success: boolean;
+  message: string;
+  sharedTeardown: "deferred" | "performed";
+};
+
+/**
+ * A deferral is honoured only when the caller proves it owns the obligation.
+ *
+ * The query flag names an intention; the receipt is the obligation. Without the second
+ * half any authenticated caller could ask the proxy to skip teardown and then exit,
+ * leaving native Codex and the Grok fence pointed at a proxy that no longer exists.
+ *
+ * "A receipt exists" is not that proof either: it would let any caller ride on another
+ * stop's outstanding obligation and get a deferral it never owns. The request has to name
+ * the receipt's nonce, which only the process that wrote it (and anything that can read
+ * the 0700 config directory, which is already the trust boundary for the admin token)
+ * can know.
+ */
+export function deferralHonored(url: URL, ownsReceipt: (nonce: string | null) => boolean): boolean {
+  if (url.searchParams.get("deferSharedTeardown") !== "1") return false;
+  return ownsReceipt(url.searchParams.get("teardownNonce"));
+}
+
+/** Run (or skip) the shared teardown and describe the outcome truthfully. */
+export async function performStopTeardown(url: URL, io: StopTeardownIo = {}): Promise<StopTeardownBody> {
+  const ownsReceipt = io.ownsReceipt ?? deferralMatchesReceipt;
+  if (deferralHonored(url, ownsReceipt)) {
+    // Not "native Codex restored": nothing was restored here, and claiming otherwise
+    // would be a success message the operator cannot verify.
+    return {
+      success: true,
+      message: "Proxy stopping; shared teardown deferred to the stopping client.",
+      sharedTeardown: "deferred",
+    };
+  }
+  const restore = io.restoreNativeCodex
+    ? await io.restoreNativeCodex()
+    : await (await import("../codex/inject")).restoreNativeCodexAsync();
+  const grok = io.stripGrok
+    ? io.stripGrok()
+    : (await import("../grok/inject")).stripGrokConfig();
+  // Success means BOTH halves came down. Deciding it from the native restore alone and
+  // appending the Grok text let a caller read `success: true` while the fence still
+  // pointed at a proxy that was exiting — the teardown reported done with half of it
+  // undone (#3008).
+  const grokNote = grok.ok ? "" : ` Grok config cleanup failed: ${grok.message}`;
+  if (restore.success && grok.ok) {
+    return { success: true, message: "Proxy stopping, native Codex restored.", sharedTeardown: "performed" };
+  }
+  if (restore.success) {
+    return {
+      success: false,
+      message: `Proxy stopping, native Codex restored, but the Grok fence was not removed:${grokNote} Run \`ocx restore\`.`,
+      sharedTeardown: "performed",
+    };
+  }
+  return {
+    success: false,
+    message: `Proxy stopping, but native Codex restore failed: ${restore.message}. Run \`ocx restore\`.${grokNote}`,
+    sharedTeardown: "performed",
+  };
+}