@bitkyc08/opencodex 2.39.0 → 2.40.0

package/src/codex/main-account.ts

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { readFileSync } from "node:fs";
+import { readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { readCodexTokens } from "./auth-collision";
 import {
@@ -19,6 +19,8 @@ import { resolveCodexHomeDir } from "./home";
 import { assertNotRealCodexHomeUnderTest } from "../lib/test-home-guard";
 import { clearAccountNeedsReauth } from "./account-runtime-state";
 import { advanceCodexCredentialMutationEpoch } from "./credential-mutation-epoch";
+import { withNativeMainExclusiveClaim } from "./native-main-claim";
+import { resolveNativeProfileContext } from "./native-profile-store";
 
 export { MAIN_CODEX_ACCOUNT_ID } from "./account-id";
 
@@ -35,6 +37,16 @@ let beforeMainAuthJsonRenameForTests: (() => void) | null = null;
 type MainAuthJsonCredential = {
   path: string;
   rawSha256: string;
+  /**
+   * Filesystem identity of the file the hash was taken from (#2999).
+   *
+   * A content hash cannot tell "unchanged" from "replaced with a file that happens to
+   * hash the same", and more importantly it is read at a different instant than the
+   * rename. Carrying dev+ino lets the pre-rename guard ask the sharper question: is this
+   * still the same file, not merely one with the same bytes. `null` when the target could
+   * not be stat'ed, which is treated as "cannot prove identity" rather than "matches".
+   */
+  identity: { dev: number; ino: number } | null;
   root: Record<string, unknown>;
   tokens: Record<string, unknown>;
   accessToken?: string;
@@ -71,6 +83,22 @@ function sha256(value: string): string {
   return createHash("sha256").update(value).digest("hex");
 }
 
+/**
+ * Filesystem identity of a path, or null when it cannot be read.
+ *
+ * Null is deliberately NOT "matches anything": a caller that cannot prove identity must
+ * fail closed, because the whole point here is refusing to overwrite a file we can no
+ * longer vouch for.
+ */
+function statIdentity(path: string): { dev: number; ino: number } | null {
+  try {
+    const stat = statSync(path);
+    return { dev: Number(stat.dev), ino: Number(stat.ino) };
+  } catch {
+    return null;
+  }
+}
+
 function readMainAuthJsonCredential(): MainAuthJsonCredential | null {
   const path = resolveWriteTarget(join(resolveCodexHomeDir(), "auth.json"));
   let raw: string;
@@ -96,6 +124,7 @@ function readMainAuthJsonCredential(): MainAuthJsonCredential | null {
     return {
       path,
       rawSha256: sha256(raw),
+      identity: statIdentity(path),
       root,
       tokens,
       ...(accessToken ? { accessToken } : {}),
@@ -129,6 +158,21 @@ function assertMainAuthJsonSnapshotUnchanged(expected: MainAuthJsonCredential):
   if (!current || current.path !== expected.path || current.rawSha256 !== expected.rawSha256) {
     throw new MainAuthJsonChangedDuringRefreshError();
   }
+  // Identity, not just content (#2999). A writer can land between this check and the
+  // rename, and rename(2) replaces unconditionally - so the narrower the question asked
+  // here, the smaller the window where a Codex login gets silently overwritten. An
+  // unreadable identity on either side fails closed: unprovable is not the same as equal.
+  assertMainAuthJsonIdentityUnchanged(expected);
+}
+
+function assertMainAuthJsonIdentityUnchanged(expected: MainAuthJsonCredential): void {
+  const identity = statIdentity(expected.path);
+  if (!identity
+    || !expected.identity
+    || identity.dev !== expected.identity.dev
+    || identity.ino !== expected.identity.ino) {
+    throw new MainAuthJsonChangedDuringRefreshError();
+  }
 }
 
 function persistRefreshedMainAuthJson(
@@ -158,6 +202,9 @@ function persistRefreshedMainAuthJson(
         beforeMainAuthJsonRenameForTests = null;
         hook?.();
       },
+      // Runs immediately before rename(2), after the test hook has had its chance to
+      // simulate an external writer. Full snapshot check (content AND identity): this is
+      // the last look we get, so it asks everything it can rather than the cheap question.
       validateBeforeRename: () => assertMainAuthJsonSnapshotUnchanged(expected),
     },
   );
@@ -187,41 +234,66 @@ async function resolveMainAccountToken(
       : null;
   }
 
+  const refreshTimeout = AbortSignal.timeout(30_000);
   const signal = dependencies.signal
-    ? AbortSignal.any([dependencies.signal, AbortSignal.timeout(30_000)])
-    : AbortSignal.timeout(30_000);
+    ? AbortSignal.any([dependencies.signal, refreshTimeout])
+    : refreshTimeout;
   const lockKey = refreshGrantFingerprintForToken(initial.refreshToken);
-  return withCodexRefreshFileLock(lockKey, signal, async () => {
-    const locked = readMainAuthJsonCredential();
-    if (!locked) throw new MainAuthJsonChangedDuringRefreshError();
-    if (!locked.refreshToken
-      || refreshGrantFingerprintForToken(locked.refreshToken) !== lockKey) {
-      if (locked.accessToken !== rejectedAccessToken
-        && mainAccessTokenFresh(locked.accessToken, Date.now(), 0)) {
-        return { accessToken: locked.accessToken!, chatgptAccountId: locked.chatgptAccountId };
-      }
-      throw new MainAuthJsonChangedDuringRefreshError();
-    }
-    if (locked.accessToken !== rejectedAccessToken
-      && mainAccessTokenFresh(locked.accessToken, Date.now(), MAIN_TOKEN_REFRESH_SKEW_MS)) {
-      return { accessToken: locked.accessToken!, chatgptAccountId: locked.chatgptAccountId };
-    }
-    const refresh = dependencies.refreshToken
-      ?? ((refreshToken: string, options: { signal: AbortSignal }) => refreshChatGPTToken(refreshToken, options));
-    let refreshed: OAuthCredentials;
-    try {
-      refreshed = await refresh(locked.refreshToken, { signal });
-    } catch (cause) {
-      const message = cause instanceof Error ? cause.message.toLowerCase() : "";
-      const reason = /invalid_grant|invalidated|revoked|expired/.test(message)
-        ? "reauth" as const
-        : "transient" as const;
-      throw new MainAccountTokenRefreshError(reason, { cause });
+  // Two locks, because they guard two different things that live in two different
+  // homes. `withCodexRefreshFileLock` is keyed on the grant fingerprint and lives
+  // under OPENCODEX_HOME; it serializes refreshes of the SAME grant within one
+  // install. The file being rewritten is `auth.json` under CODEX_HOME, which every
+  // OpenCodex install on the machine shares no matter what its own home is -- so two
+  // proxies with distinct OPENCODEX_HOMEs took two unrelated fingerprint locks and
+  // refreshed the one credential concurrently (#2999).
+  //
+  // The outer claim is the CODEX_HOME coordination the other native-main paths
+  // already use (`.opencodex-native-main.claim.sqlite`), so this needs no new
+  // primitive and no FFI. Order is claim (machine-wide) then fingerprint lock
+  // (per-grant), never the reverse: two processes holding different fingerprint
+  // locks and then reaching for the same claim would deadlock.
+  try {
+    return await withNativeMainExclusiveClaim(
+      resolveNativeProfileContext(),
+      () => withCodexRefreshFileLock(lockKey, signal, async () => {
+        const locked = readMainAuthJsonCredential();
+        if (!locked) throw new MainAuthJsonChangedDuringRefreshError();
+        if (!locked.refreshToken
+          || refreshGrantFingerprintForToken(locked.refreshToken) !== lockKey) {
+          if (locked.accessToken !== rejectedAccessToken
+            && mainAccessTokenFresh(locked.accessToken, Date.now(), 0)) {
+            return { accessToken: locked.accessToken!, chatgptAccountId: locked.chatgptAccountId };
+          }
+          throw new MainAuthJsonChangedDuringRefreshError();
+        }
+        if (locked.accessToken !== rejectedAccessToken
+          && mainAccessTokenFresh(locked.accessToken, Date.now(), MAIN_TOKEN_REFRESH_SKEW_MS)) {
+          return { accessToken: locked.accessToken!, chatgptAccountId: locked.chatgptAccountId };
+        }
+        const refresh = dependencies.refreshToken
+          ?? ((refreshToken: string, options: { signal: AbortSignal }) => refreshChatGPTToken(refreshToken, options));
+        let refreshed: OAuthCredentials;
+        try {
+          refreshed = await refresh(locked.refreshToken, { signal });
+        } catch (cause) {
+          const message = cause instanceof Error ? cause.message.toLowerCase() : "";
+          const reason = /invalid_grant|invalidated|revoked|expired/.test(message)
+            ? "reauth" as const
+            : "transient" as const;
+          throw new MainAccountTokenRefreshError(reason, { cause });
+        }
+        const result = persistRefreshedMainAuthJson(locked, refreshed);
+        clearAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID);
+        return result;
+      }),
+      { waitMs: 30_000, signal },
+    );
+  } catch (cause) {
+    if (refreshTimeout.aborted && !dependencies.signal?.aborted) {
+      throw new MainAccountTokenRefreshError("transient", { cause });
     }
-    const result = persistRefreshedMainAuthJson(locked, refreshed);
-    clearAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID);
-    return result;
-  });
+    throw cause;
+  }
 }
 
 /** Refresh the CLI-owned native credential before upstream I/O and publish it atomically. */

package/src/codex/native-main-claim.ts

@@ -17,6 +17,7 @@ export const NATIVE_MAIN_CLAIM_DB = ".opencodex-native-main.claim.sqlite";
 export interface NativeMainClaimOptions {
   waitMs?: number;
   pollMs?: number;
+  signal?: AbortSignal;
   hardenPath?: (path: string) => Promise<void>;
   platform?: NodeJS.Platform;
   env?: NodeJS.ProcessEnv;
@@ -121,6 +122,23 @@ function releaseClaim(database: Database | undefined, file: StableLockFile | und
   try { file?.close(); } catch { /* operation already completed */ }
 }
 
+function waitForClaimRetry(ms: number, signal?: AbortSignal): Promise<void> {
+  if (!signal) return Bun.sleep(ms);
+  if (signal.aborted) return Promise.reject(signal.reason);
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      signal.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(timer);
+      signal.removeEventListener("abort", onAbort);
+      reject(signal.reason);
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+}
+
 export async function withNativeMainSharedClaim<T>(
   context: NativeProfileContext,
   operation: () => Promise<T>,
@@ -151,9 +169,11 @@ export async function withNativeMainExclusiveClaim<T>(
   operation: () => Promise<T>,
   options: NativeMainClaimOptions = {},
 ): Promise<T> {
+  const signal = options.signal;
   const deadline = Date.now() + Math.max(0, options.waitMs ?? 0);
   const pollMs = Math.max(1, options.pollMs ?? 50);
   for (;;) {
+    if (signal?.aborted) throw signal.reason;
     let database: Database | undefined;
     let file: StableLockFile | undefined;
     try {
@@ -162,14 +182,16 @@ export async function withNativeMainExclusiveClaim<T>(
       assertStableLockFile(nativeMainClaimPath(context), file);
     } catch (error) {
       releaseClaim(database, file);
+      if (signal?.aborted) throw signal.reason;
       const mapped = mapClaimSetupError(error, "Native-main credentials are in use.");
       if (mapped.code === "NATIVE_MAIN_CLAIM_BUSY" && Date.now() < deadline) {
-        await Bun.sleep(Math.min(pollMs, Math.max(1, deadline - Date.now())));
+        await waitForClaimRetry(Math.min(pollMs, Math.max(1, deadline - Date.now())), signal);
         continue;
       }
       throw mapped;
     }
     try {
+      if (signal?.aborted) throw signal.reason;
       return await operation();
     } finally {
       releaseClaim(database, file);

package/src/codex/native-residue.ts

@@ -133,6 +133,13 @@ function resolveRegularFile(path: string): PathResult {
 function readRegularFile(path: string): ReadResult {
   const resolved = resolveRegularFile(path);
   if (resolved.kind !== "path") return resolved;
+  // Root can read a chmod(000) file on Linux, which made the residue verdict
+  // depend on who ran the suite. No read bit means the configured surface is
+  // operationally unreadable to an ordinary Codex process and must remain
+  // indeterminate even when the inspector itself has elevated privileges.
+  if (process.platform !== "win32" && (resolved.stat.mode & 0o444) === 0) {
+    return { kind: "indeterminate", reason: "EACCES: surface has no read permission bits" };
+  }
   try {
     const content = readFileSync(resolved.path, "utf8");
     const after = statSync(resolved.path);

package/src/codex/reset-credit-auto-redeem.ts

@@ -0,0 +1,237 @@
+import { createHash, randomUUID } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { atomicWriteFile } from "../config/atomic-write";
+import { getConfigDir } from "../config/paths";
+import { registerOptionalShutdownHook } from "../lib/optional-shutdown-hooks";
+import type { OcxConfig } from "../types";
+
+/**
+ * Opt-in auto-redemption of a Codex reset credit shortly before it expires (#822).
+ *
+ * Default off. When enabled, the nearest unexpired credit for the main Codex account is
+ * redeemed `leadTimeMinutes` before its `expires_at`. Every fire re-reads the upstream credit
+ * list first and dispatches only when the same credit (granted_at + expires_at) is still
+ * present, so a credit the operator already spent by hand is never redeemed twice. The
+ * `redeem_request_id` for a credit identity is minted once and journaled to disk before the
+ * consume call, so a crash between dispatch and settle replays the same idempotent request
+ * instead of spending a second credit. Logs carry a hashed account key only.
+ */
+
+export interface ResetCreditAutoRedeemSettings {
+  enabled: boolean;
+  leadTimeMinutes: number;
+}
+
+export const DEFAULT_LEAD_TIME_MINUTES = 10;
+export const MIN_LEAD_TIME_MINUTES = 1;
+export const MAX_LEAD_TIME_MINUTES = 60;
+
+export function resolveResetCreditAutoRedeemSettings(config: Pick<OcxConfig, "resetCreditAutoRedeem">): ResetCreditAutoRedeemSettings {
+  const raw = config.resetCreditAutoRedeem;
+  if (!raw || raw.enabled !== true) return { enabled: false, leadTimeMinutes: DEFAULT_LEAD_TIME_MINUTES };
+  const lead = typeof raw.leadTimeMinutes === "number" && Number.isInteger(raw.leadTimeMinutes)
+    ? Math.min(Math.max(raw.leadTimeMinutes, MIN_LEAD_TIME_MINUTES), MAX_LEAD_TIME_MINUTES)
+    : DEFAULT_LEAD_TIME_MINUTES;
+  return { enabled: true, leadTimeMinutes: lead };
+}
+
+export interface ResetCredit {
+  granted_at: string;
+  expires_at: string;
+}
+
+export interface AutoRedeemPlan {
+  /** Stable identity of the credit being protected. */
+  grantedAt: string;
+  expiresAt: string;
+  /** Epoch ms at which the redeem should be attempted. */
+  dueAt: number;
+}
+
+/** Pick the credit that expires soonest and is still in the future; null when nothing qualifies. */
+export function planAutoRedeem(now: number, credits: readonly ResetCredit[], settings: ResetCreditAutoRedeemSettings): AutoRedeemPlan | null {
+  if (!settings.enabled) return null;
+  let best: AutoRedeemPlan | null = null;
+  for (const credit of credits) {
+    const expires = Date.parse(credit.expires_at);
+    if (!Number.isFinite(expires) || expires <= now) continue;
+    const dueAt = expires - settings.leadTimeMinutes * 60_000;
+    if (!best || expires < Date.parse(best.expiresAt)) best = { grantedAt: credit.granted_at, expiresAt: credit.expires_at, dueAt };
+  }
+  return best;
+}
+
+export function creditStillPresent(credits: readonly ResetCredit[], plan: Pick<AutoRedeemPlan, "grantedAt" | "expiresAt">): boolean {
+  return credits.some(c => c.granted_at === plan.grantedAt && c.expires_at === plan.expiresAt);
+}
+
+interface JournalEntry {
+  accountKey: string;
+  grantedAt: string;
+  expiresAt: string;
+  redeemRequestId: string;
+  state: "dispatched" | "settled";
+  updatedAt: number;
+}
+
+interface Journal { version: 1; entries: JournalEntry[] }
+
+export function journalPath(): string {
+  return join(getConfigDir(), "reset-credit-auto-redeem.json");
+}
+
+function readJournal(path: string): Journal {
+  if (!existsSync(path)) return { version: 1, entries: [] };
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8")) as Journal;
+    return parsed && parsed.version === 1 && Array.isArray(parsed.entries) ? parsed : { version: 1, entries: [] };
+  } catch {
+    return { version: 1, entries: [] };
+  }
+}
+
+function writeJournal(path: string, journal: Journal): void {
+  // Keep only entries whose credit could still matter: settled ones older than a week are noise.
+  const cutoff = Date.now() - 7 * 24 * 60 * 60_000;
+  journal.entries = journal.entries.filter(e => e.state !== "settled" || e.updatedAt > cutoff);
+  atomicWriteFile(path, JSON.stringify(journal, null, 2));
+}
+
+export function hashAccountKey(accountId: string): string {
+  return createHash("sha256").update(accountId).digest("hex").slice(0, 12);
+}
+
+export interface AutoRedeemDeps {
+  accountId: string;
+  settings: () => ResetCreditAutoRedeemSettings;
+  /** Fresh upstream read of the credit list; throws on auth/transport failure. */
+  inspect: () => Promise<{ credits: ResetCredit[] }>;
+  /** Consume with a caller-owned idempotency key. Returns the upstream code. */
+  consume: (redeemRequestId: string) => Promise<{ code: string }>;
+  now?: () => number;
+  setTimer?: (fn: () => void, ms: number) => unknown;
+  clearTimer?: (handle: unknown) => void;
+  journalFile?: string;
+  log?: (line: string) => void;
+  /** Upper bound on one sleep so a laptop sleep or clock jump re-checks rather than trusting a stale plan. */
+  maxSleepMs?: number;
+  /** Interval to re-inspect when no credit is due yet (default 30 min). */
+  idleRecheckMs?: number;
+}
+
+export type AutoRedeemOutcome =
+  | { kind: "disabled" }
+  | { kind: "nothing-to-protect" }
+  | { kind: "scheduled"; dueAt: number }
+  | { kind: "skipped"; reason: "credit-gone" | "disabled-before-dispatch" }
+  | { kind: "dispatched"; code: string; redeemRequestId: string }
+  | { kind: "ambiguous"; redeemRequestId: string }
+  | { kind: "error"; message: string };
+
+export interface ResetCreditAutoRedeemer {
+  /** Inspect, and either dispatch (if due) or schedule the next check. */
+  tick(): Promise<AutoRedeemOutcome>;
+  start(): void;
+  stop(): void;
+}
+
+export function createResetCreditAutoRedeemer(deps: AutoRedeemDeps): ResetCreditAutoRedeemer {
+  const now = deps.now ?? (() => Date.now());
+  const setTimer = deps.setTimer ?? ((fn, ms) => setTimeout(fn, ms));
+  const clearTimer = deps.clearTimer ?? (handle => clearTimeout(handle as ReturnType<typeof setTimeout>));
+  const log = deps.log ?? ((line: string) => console.log(line));
+  const path = deps.journalFile ?? journalPath();
+  const accountKey = hashAccountKey(deps.accountId);
+  const maxSleepMs = deps.maxSleepMs ?? 15 * 60_000;
+  const idleRecheckMs = deps.idleRecheckMs ?? 30 * 60_000;
+  let handle: unknown = null;
+  let stopped = false;
+  let inFlight: Promise<AutoRedeemOutcome> | null = null;
+
+  const schedule = (ms: number): void => {
+    if (stopped) return;
+    if (handle !== null) clearTimer(handle);
+    handle = setTimer(() => { handle = null; void tick(); }, Math.max(0, Math.min(ms, maxSleepMs)));
+  };
+
+  const dispatch = async (plan: AutoRedeemPlan): Promise<AutoRedeemOutcome> => {
+    const journal = readJournal(path);
+    let entry = journal.entries.find(e => e.accountKey === accountKey && e.grantedAt === plan.grantedAt && e.expiresAt === plan.expiresAt);
+    if (entry?.state === "settled") return { kind: "skipped", reason: "credit-gone" };
+    if (!entry) {
+      entry = { accountKey, grantedAt: plan.grantedAt, expiresAt: plan.expiresAt, redeemRequestId: randomUUID(), state: "dispatched", updatedAt: now() };
+      journal.entries.push(entry);
+      // Journal BEFORE the network call: a crash after this line replays the same request id.
+      writeJournal(path, journal);
+    }
+    log(`[opencodex] reset-credit auto-redeem: dispatching for account ${accountKey} (credit expires ${plan.expiresAt})`);
+    let result: { code: string };
+    try {
+      result = await deps.consume(entry.redeemRequestId);
+    } catch (error) {
+      log(`[opencodex] reset-credit auto-redeem: consume uncertain for account ${accountKey}; will retry with the same request id`);
+      schedule(60_000);
+      return { kind: "ambiguous", redeemRequestId: entry.redeemRequestId };
+    }
+    entry.state = "settled";
+    entry.updatedAt = now();
+    writeJournal(path, journal);
+    log(`[opencodex] reset-credit auto-redeem: upstream answered ${result.code} for account ${accountKey}`);
+    schedule(idleRecheckMs);
+    return { kind: "dispatched", code: result.code, redeemRequestId: entry.redeemRequestId };
+  };
+
+  const tick = async (): Promise<AutoRedeemOutcome> => {
+    if (inFlight) return inFlight;
+    inFlight = (async () => {
+      const settings = deps.settings();
+      if (!settings.enabled) return { kind: "disabled" } as AutoRedeemOutcome;
+      let credits: ResetCredit[];
+      try {
+        ({ credits } = await deps.inspect());
+      } catch (error) {
+        schedule(idleRecheckMs);
+        return { kind: "error", message: error instanceof Error ? error.message : "inspect failed" } as AutoRedeemOutcome;
+      }
+      const plan = planAutoRedeem(now(), credits, settings);
+      if (!plan) { schedule(idleRecheckMs); return { kind: "nothing-to-protect" } as AutoRedeemOutcome; }
+      if (plan.dueAt > now()) { schedule(plan.dueAt - now()); return { kind: "scheduled", dueAt: plan.dueAt } as AutoRedeemOutcome; }
+      // Due: re-read right before spending. The plan above came from this same inspect, but
+      // the settings may have flipped and a manual consume may have raced; check both again.
+      if (!deps.settings().enabled) return { kind: "skipped", reason: "disabled-before-dispatch" } as AutoRedeemOutcome;
+      let fresh: ResetCredit[];
+      try { ({ credits: fresh } = await deps.inspect()); } catch (error) {
+        schedule(60_000);
+        return { kind: "error", message: error instanceof Error ? error.message : "inspect failed" } as AutoRedeemOutcome;
+      }
+      if (!creditStillPresent(fresh, plan)) { schedule(idleRecheckMs); return { kind: "skipped", reason: "credit-gone" } as AutoRedeemOutcome; }
+      return dispatch(plan);
+    })().finally(() => { inFlight = null; });
+    return inFlight;
+  };
+
+  return {
+    tick,
+    start() { stopped = false; void tick(); },
+    stop() { stopped = true; if (handle !== null) { clearTimer(handle); handle = null; } },
+  };
+}
+
+/**
+ * Composition-root activation. Returns the redeemer only when the opt-in is on; the caller
+ * (src/server/index.ts) must not await this and must gate on `enabled` itself so a default
+ * install never constructs the timer.
+ */
+export function activateResetCreditAutoRedeem(
+  config: OcxConfig,
+  wham: Pick<AutoRedeemDeps, "inspect" | "consume" | "accountId">,
+): ResetCreditAutoRedeemer {
+  const redeemer = createResetCreditAutoRedeemer({
+    ...wham,
+    settings: () => resolveResetCreditAutoRedeemSettings(config),
+  });
+  const unregister = registerOptionalShutdownHook("reset-credit-auto-redeem", () => { redeemer.stop(); unregister(); });
+  redeemer.start();
+  return redeemer;
+}

package/src/combos/request.ts

@@ -1,4 +1,5 @@
 import type { OcxComboDefaultEffort, OcxComboTarget, OcxConfig } from "../types";
+import { resolveEffortAtOrBelow } from "../reasoning-effort";
 import { resolveComboId } from "./types";
 
 const warnedUnsupportedDefaults = new Set<string>();
@@ -72,7 +73,18 @@ export function concreteComboRequestBody(
   if (!needsDefault) return clone;
   // Picker availability treats an unknown ladder as a wildcard, but runtime
   // injection stays fail-closed until this concrete target advertises support.
-  if (!targetReasoningEfforts?.includes(defaultEffort)) {
+  //
+  // Support is not literal membership. The catalog advertises the combo's default
+  // through effectiveComboDefault, which keeps the highest supported rung at or
+  // below the request rather than dropping it. Testing membership here meant a
+  // combo configured for `max` against a target topping out at `high` sent no
+  // effort at all, so the provider default applied and the turn ran at `none`
+  // while the catalog still advertised `max` (#3108). Resolve the same way the
+  // catalog did.
+  const resolvedEffort = targetReasoningEfforts === undefined
+    ? undefined
+    : resolveEffortAtOrBelow(defaultEffort, targetReasoningEfforts);
+  if (!resolvedEffort) {
     const key = `${target.provider}/${target.model}:${defaultEffort}`;
     if (!warnedUnsupportedDefaults.has(key)) {
       warnedUnsupportedDefaults.add(key);
@@ -86,9 +98,9 @@ export function concreteComboRequestBody(
     return clone;
   }
   if (reasoning === undefined) {
-    clone.reasoning = { effort: defaultEffort };
+    clone.reasoning = { effort: resolvedEffort };
   } else {
-    clone.reasoning = { ...(reasoning as Record<string, unknown>), effort: defaultEffort };
+    clone.reasoning = { ...(reasoning as Record<string, unknown>), effort: resolvedEffort };
   }
   return clone;
 }

package/src/combos/types.ts

@@ -3,6 +3,7 @@ import { SUPPORTED_NATIVE_OPENAI_SLUGS } from "../codex/catalog/native-models";
 import type {
   OcxComboConfig,
   OcxComboDefaultEffort,
+  OcxComboReasoningEffortMode,
   OcxComboStrategy,
   OcxComboTarget,
   OcxConfig,
@@ -37,6 +38,8 @@ export interface NormalizedComboConfig {
   strategy: OcxComboStrategy;
   stickyLimit: number;
   defaultEffort: OcxComboDefaultEffort | null;
+  /** Picker-ladder derivation policy; `strict` preserves the legacy intersection rule. */
+  reasoningEffortMode: OcxComboReasoningEffortMode;
   /** Disable image input; `auto` preserves the intersection derived from all targets. */
   imageInput: "auto" | "disabled";
   /** Trimmed public alias, or null when the combo keeps the default `combo/<id>` slug. */
@@ -238,6 +241,14 @@ export function comboConfigIssues(
   if (body.imageInput !== undefined && body.imageInput !== "auto" && body.imageInput !== "disabled") {
     issues.push({ path: ["imageInput"], message: 'imageInput must be "auto" or "disabled"' });
   }
+  if (body.reasoningEffortMode !== undefined
+    && body.reasoningEffortMode !== "strict"
+    && body.reasoningEffortMode !== "adaptive") {
+    issues.push({
+      path: ["reasoningEffortMode"],
+      message: 'reasoningEffortMode must be "strict" or "adaptive"',
+    });
+  }
 
   if (body.alias !== undefined) {
     if (typeof body.alias !== "string") {
@@ -357,6 +368,7 @@ export function normalizeComboConfig(raw: OcxComboConfig): NormalizedComboConfig
     strategy: raw.strategy ?? "failover",
     stickyLimit: raw.stickyLimit ?? 1,
     defaultEffort: raw.defaultEffort ?? null,
+    reasoningEffortMode: raw.reasoningEffortMode === "adaptive" ? "adaptive" : "strict",
     imageInput: raw.imageInput === "disabled" ? "disabled" : "auto",
     alias: alias || null,
     nativeAlias: raw.nativeAlias === true,

package/src/config/paths.ts

@@ -49,7 +49,21 @@ export function hardenConfigDir(): void {
   }
 }
 
-/** Test-only: settle optional config-directory hardening without exposing it to production callers. */
+/**
+ * Settle the optional hardening flight for one config directory.
+ *
+ * The flight spawns `icacls.exe`, which holds the directory open until it exits. Windows file
+ * locking is mandatory, so anything that removes or renames that directory after a "clean"
+ * shutdown — a test fixture teardown, an uninstaller, a home move — gets EPERM/EBUSY unless the
+ * process that started the child also waits for it. `server.stop` calls this so the shutdown
+ * contract owns every child it started. No-op when nothing is in flight.
+ */
+export async function flushConfigDirHardening(dir: string = getConfigDir()): Promise<void> {
+  const flight = configDirHardeningFlights.get(dir);
+  if (flight) await flight;
+}
+
+/** Test-only: settle every in-flight config-directory harden regardless of directory. */
 export async function flushConfigDirHardeningForTests(): Promise<void> {
   await Promise.all([...configDirHardeningFlights.values()]);
 }

package/src/config/provider-validation.ts

@@ -1,5 +1,9 @@
 import { isCanonicalOpenAiForwardProvider } from "../providers/openai-tiers";
 import { redactSecretString } from "../lib/redact";
+import {
+  isValidModelDiscoveryModelId,
+  MODEL_DISCOVERY_MAX_MODELS,
+} from "../providers/model-discovery-limits";
 import { modelRecordValue } from "../reasoning-effort";
 import {
   isWirePinnedModel,
@@ -20,6 +24,8 @@ const SENSITIVE_PROVIDER_HEADERS = new Set([
   "x-amz-security-token",
 ]);
 const REASONING_SUMMARY_DELIVERY_SET = new Set<string>(REASONING_SUMMARY_DELIVERY_VALUES);
+const DISPLAY_NAME_CONTROL_CHARS = /[\u0000-\u001f\u007f-\u009f\u2028\u2029]/;
+const MAX_MODEL_DISPLAY_NAME_LENGTH = 128;
 
 /** Validate a provider destination without coupling DTO callers to config persistence. */
 export function providerBaseUrlConfigError(baseUrl: string): string | null {
@@ -124,6 +130,40 @@ export function booleanRecordConfigError(value: unknown, field: string): string
   return null;
 }
 
+/** Validate display-only labels without changing the provider's model identity. */
+export function modelDisplayNamesConfigError(
+  value: unknown,
+  field = "modelDisplayNames",
+): string | null {
+  if (value === undefined) return null;
+  if (!value || typeof value !== "object" || Array.isArray(value)) return `${field} must be a plain object`;
+  const prototype = Object.getPrototypeOf(value);
+  if (prototype !== Object.prototype && prototype !== null) {
+    return `${field} must be a plain object with own properties`;
+  }
+  const entries = Object.entries(value);
+  // One discovered model can own one label, so both maps share the same safe cap.
+  if (entries.length > MODEL_DISCOVERY_MAX_MODELS) {
+    return `${field} must contain at most ${MODEL_DISCOVERY_MAX_MODELS} entries`;
+  }
+  for (const [modelId, displayName] of entries) {
+    if (!isValidModelDiscoveryModelId(modelId)) return `${field} keys must be valid model ids`;
+    const safeModelId = JSON.stringify(redactSecretString(modelId));
+    if (typeof displayName !== "string") return `${field}.${safeModelId} must be a string`;
+    const trimmed = displayName.trim();
+    if (!trimmed) return `${field}.${safeModelId} must be nonblank`;
+    if (displayName !== trimmed) return `${field}.${safeModelId} must be trimmed`;
+    if (displayName.length > MAX_MODEL_DISPLAY_NAME_LENGTH) {
+      return `${field}.${safeModelId} must be at most ${MAX_MODEL_DISPLAY_NAME_LENGTH} characters`;
+    }
+    if (displayName.includes("/")) return `${field}.${safeModelId} must not contain /`;
+    if (DISPLAY_NAME_CONTROL_CHARS.test(displayName)) {
+      return `${field}.${safeModelId} must not contain control characters`;
+    }
+  }
+  return null;
+}
+
 /** Validate the management DTO boundary for the opt-in empty-tool-output annotation. */
 export function providerEmptyToolOutputConfigError(name: string, provider: unknown): string | null {
   const raw = provider as Record<string, unknown> | null | undefined;