@bitkyc08/opencodex 2.43.0 → 2.44.0

package/src/clients/aside-profiles.ts

@@ -0,0 +1,224 @@
+import { lstatSync, readFileSync, readlinkSync, realpathSync, statSync, type Stats } from "node:fs";
+import { homedir } from "node:os";
+import { basename, dirname, isAbsolute, join, resolve } from "node:path";
+import type { IntegrationIO } from "../integrations/config-io";
+import { asideHomeDir, ClientPathError } from "./config-export";
+
+export interface AsideProfile {
+  id: number;
+  name?: string;
+  current: boolean;
+  root: string;
+  configPath: string;
+  detectDir: string;
+}
+
+const MAX_PROFILES = 128;
+const MAX_MANIFEST_BYTES = 4 * 1024 * 1024;
+const MAX_LEAF_LINKS = 40;
+
+function refuse(message: string): never {
+  // Never include manifest contents or underlying filesystem error messages.
+  throw new ClientPathError(`Aside profile: ${message}`);
+}
+
+function isId(value: unknown): value is number {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 && !Object.is(value, -0);
+}
+
+function object(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function inspect(path: string, follow = false): Stats | null {
+  try {
+    return follow ? statSync(path) : lstatSync(path);
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return null;
+    return refuse("a filesystem boundary could not be inspected.");
+  }
+}
+
+function canonical(path: string): string {
+  try { return realpathSync.native(path); } catch {
+    return refuse("a filesystem boundary could not be resolved.");
+  }
+}
+
+/** Resolve a peer's leaf link even when its final model file does not exist yet. */
+function leafDestination(path: string): string | null {
+  const visited = new Set<string>();
+  while (inspect(path)?.isSymbolicLink()) {
+    if (visited.has(path) || visited.size >= MAX_LEAF_LINKS) refuse("an account catalog has a cyclic or excessive link chain.");
+    visited.add(path);
+    try { path = resolve(dirname(path), readlinkSync(path)); } catch {
+      return refuse("an account catalog link could not be inspected.");
+    }
+  }
+  if (!inspect(dirname(path), true)?.isDirectory()) return null;
+  return join(canonical(dirname(path)), basename(path));
+}
+
+function readProfiles(root: string): AsideProfile[] {
+  const rootStat = inspect(root);
+  if (!rootStat || rootStat.isSymbolicLink() || !rootStat.isDirectory()) {
+    refuse("the configured root is missing or is not a safe directory.");
+  }
+  const manifest = join(root, "accounts.json");
+  const manifestStat = inspect(manifest);
+  if (!manifestStat || manifestStat.isSymbolicLink() || !manifestStat.isFile()
+    || manifestStat.size > MAX_MANIFEST_BYTES) {
+    refuse("the account manifest is missing, unreadable or unsafe. Launch Aside to create it.");
+  }
+  let parsed: unknown;
+  try { parsed = JSON.parse(readFileSync(manifest, "utf8")); } catch {
+    return refuse("the account manifest is not readable JSON.");
+  }
+  if (!object(parsed) || !isId(parsed.currentAccountId)) {
+    refuse("the account manifest has no valid current account ID.");
+  }
+  const currentId = parsed.currentAccountId;
+  const accounts: unknown = Object.hasOwn(parsed, "accounts") ? parsed.accounts : [{ id: currentId }];
+  if (!Array.isArray(accounts) || accounts.length === 0 || accounts.length > MAX_PROFILES) {
+    refuse("the account manifest must contain between 1 and 128 accounts.");
+  }
+  const ids = new Set<number>();
+  const profiles = accounts.map((account: unknown): AsideProfile => {
+    if (!object(account) || !isId(account.id) || ids.has(account.id)) {
+      return refuse("the account manifest contains an invalid or duplicate account ID.");
+    }
+    const current = account.id === currentId;
+    if (Object.hasOwn(account, "current") && account.current !== current) {
+      refuse("the account manifest has inconsistent current account metadata.");
+    }
+    ids.add(account.id);
+    const detectDir = join(root, "u", String(account.id));
+    return {
+      id: account.id,
+      ...(typeof account.name === "string" ? { name: account.name } : {}),
+      current, root, detectDir, configPath: join(detectDir, "models.json"),
+    };
+  });
+  if (!ids.has(currentId)) refuse("the current account is not registered in the account manifest.");
+  return profiles;
+}
+
+/** Enumerate account catalogs; browser bindings and session data are never projected. */
+export function listAsideProfiles(env: NodeJS.ProcessEnv = process.env, home: string = homedir()): AsideProfile[] {
+  const root = asideHomeDir(env, home);
+  if (!isAbsolute(root)) refuse("the configured root must be absolute.");
+  return readProfiles(root);
+}
+
+type DirectoryIdentity = { path: string; dev: number; ino: number };
+type Boundary = Array<DirectoryIdentity | null>;
+
+function sameIdentity(a: Pick<Stats, "dev" | "ino">, b: Pick<Stats, "dev" | "ino">): boolean {
+  return a.dev === b.dev && a.ino === b.ino;
+}
+
+function validatePaths(profile: AsideProfile): void {
+  if (!isId(profile.id) || !isAbsolute(profile.root) || resolve(profile.root) !== profile.root
+    || profile.detectDir !== join(profile.root, "u", String(profile.id))
+    || profile.configPath !== join(profile.detectDir, "models.json")) {
+    refuse("the selected account paths are invalid.");
+  }
+}
+
+function registeredProfiles(profile: AsideProfile, profiles?: AsideProfile[]): AsideProfile[] {
+  validatePaths(profile);
+  const registered = profiles ?? readProfiles(profile.root);
+  if (registered.length === 0 || registered.length > MAX_PROFILES) refuse("the account list is invalid.");
+  const ids = new Set<number>();
+  for (const peer of registered) {
+    validatePaths(peer);
+    if (peer.root !== profile.root || ids.has(peer.id)) refuse("the account list has conflicting paths.");
+    ids.add(peer.id);
+  }
+  if (!ids.has(profile.id)) refuse("the selected account is not registered.");
+  return registered;
+}
+
+function boundary(profile: AsideProfile, profiles: AsideProfile[], mutation: boolean): Boundary {
+  const directories = [profile.root, join(profile.root, "u"), profile.detectDir];
+  const identities: Boundary = [];
+  let parent: string | undefined;
+  let absent = false;
+  for (const [index, directory] of directories.entries()) {
+    const stats = absent ? null : inspect(directory);
+    if (!stats) {
+      if (index === 0 || mutation) refuse("the account directory is not installed; it will not be created.");
+      absent = true;
+      identities.push(null);
+      continue;
+    }
+    if (stats.isSymbolicLink() || !stats.isDirectory()) refuse("an account directory is a link or is unsafe.");
+    const path = canonical(directory);
+    // Aliases ABOVE the chosen root (notably macOS /var) are valid.
+    const child = index === 1 ? "u" : String(profile.id);
+    if (parent && path !== join(parent, child)) refuse("an account directory resolves outside its boundary.");
+    identities.push({ path, dev: stats.dev, ino: stats.ino });
+    parent = path;
+  }
+  if (absent) return identities;
+  const leaf = inspect(profile.configPath);
+  if (leaf && (leaf.isSymbolicLink() || !leaf.isFile() || leaf.nlink > 1)) {
+    refuse("the model catalog is a link, shared file or non-regular file.");
+  }
+  if (leaf && canonical(profile.configPath) !== join(parent!, "models.json")) {
+    refuse("the model catalog resolves outside its account directory.");
+  }
+  const account = identities[2]!;
+  for (const peer of profiles) {
+    if (peer.id === profile.id) continue;
+    // Follow peers only for identity comparison, never for content or writes.
+    // This also detects a sibling symlink pointing BACK at this safe target.
+    const peerDirectory = inspect(peer.detectDir, true);
+    if (peerDirectory && sameIdentity(account, peerDirectory)) refuse("account directories share a target.");
+    if (!peerDirectory?.isDirectory()) continue;
+    if (inspect(peer.configPath)?.isSymbolicLink()
+      && leafDestination(peer.configPath) === join(parent!, "models.json")) {
+      refuse("account catalogs share a target.");
+    }
+    const peerLeaf = inspect(peer.configPath, true);
+    if (leaf && peerLeaf && sameIdentity(leaf, peerLeaf)) refuse("account catalogs share a target.");
+  }
+  return identities;
+}
+
+/** Missing account directories are readable as not installed, but never writable. */
+export function assertAsideProfileBoundary(profile: AsideProfile, profiles?: AsideProfile[], mutation = false): void {
+  boundary(profile, registeredProfiles(profile, profiles), mutation);
+}
+
+/**
+ * Pin directories for one status/write operation, retaining the caller's IO and store.
+ * Rechecks complement atomic writes; they do not defeat a hostile same-user process
+ * racing every filesystem syscall. Leaf inodes may change during our atomic writes.
+ */
+export function guardAsideProfileIO(profile: AsideProfile, io: IntegrationIO, profiles?: AsideProfile[]): IntegrationIO {
+  const selected = { ...profile };
+  const registered = registeredProfiles(selected, profiles).map(peer => ({ ...peer }));
+  const captured = boundary(selected, registered, false);
+  function check(path: string, directory: boolean, mutation: boolean): void {
+    if (path !== (directory ? selected.detectDir : selected.configPath)) {
+      refuse("IO attempted to access a different account path.");
+    }
+    const current = boundary(selected, registered, mutation);
+    if (current.some((item, index) => {
+      const prior = captured[index];
+      return item === null || prior == null ? item !== prior : item.path !== prior.path || !sameIdentity(item, prior);
+    })) refuse("the account directory changed after the operation began.");
+  }
+  return {
+    readText: path => { check(path, false, false); return io.readText(path); },
+    statKind: path => { check(path, path === selected.detectDir, false); return io.statKind(path); },
+    writeText: (path, text) => { check(path, false, true); io.writeText(path, text); },
+    removeFile: path => { check(path, false, true); io.removeFile(path); },
+    mkdirp: path => { check(path, true, true); io.mkdirp(path); },
+    now: () => io.now(),
+    appendJournal: entry => io.appendJournal(entry),
+    putRecord: record => io.putRecord(record),
+    dropRecord: clientId => io.dropRecord(clientId),
+  };
+}

package/src/codex/account-lifecycle.ts

@@ -1,6 +1,5 @@
 import { existsSync, readFileSync } from "node:fs";
 import {
-  atomicWriteFile,
   deleteConfigTopLevelKey,
   getConfigPath,
   saveConfigPreservingClaudeCode,
@@ -107,13 +106,10 @@ function restoreRuntimeConfig(target: OcxConfig, snapshot: OcxConfig): void {
   Object.assign(target, snapshot);
 }
 
-function restorePersistedConfig(configPath: string, previousBytes: string): void {
-  try {
-    if (readFileSync(configPath, "utf8") === previousBytes) return;
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+function assertPersistedConfigUnchanged(configPath: string, previousBytes: Buffer): void {
+  if (!readFileSync(configPath).equals(previousBytes)) {
+    throw new CodexAccountDeleteRollbackError();
   }
-  atomicWriteFile(configPath, previousBytes);
 }
 
 /**
@@ -133,7 +129,7 @@ export function deleteCodexAccount(runtimeConfig: OcxConfig, accountId: string):
     const previousConfig = structuredClone(runtimeConfig);
     const configPath = getConfigPath();
     const hasPersistedConfig = existsSync(configPath);
-    const previousPersistedConfig = hasPersistedConfig ? readFileSync(configPath, "utf8") : undefined;
+    const previousPersistedConfig = hasPersistedConfig ? readFileSync(configPath) : undefined;
     const hadStoredAccount = (runtimeConfig.codexAccounts ?? [])
       .some(account => !account.isMain && account.id === accountId);
     const hadVisiblePickerBinding = hadStoredAccount
@@ -162,7 +158,7 @@ export function deleteCodexAccount(runtimeConfig: OcxConfig, accountId: string):
       } catch (error) {
         restoreRuntimeConfig(runtimeConfig, previousConfig);
         try {
-          restorePersistedConfig(configPath, previousPersistedConfig);
+          assertPersistedConfigUnchanged(configPath, previousPersistedConfig);
         } catch {
           throw new CodexAccountDeleteRollbackError();
         }

package/src/codex/auth-api.ts

@@ -105,6 +105,7 @@ import {
   type MainAccountInfo,
 } from "./main-account-cache";
 export { clearMainAccountInfoCache } from "./main-account-cache";
+import type { CodexQuotaRefreshOutcome } from "./quota-refresh-outcome";
 import { getMainAccountHardLockStatus, type MainAccountHardLockStatus } from "./main-account-hard-lock";
 import { observeMainReserveRevocation } from "./reserve-availability";
 import { maskEmail } from "../lib/privacy";
@@ -777,6 +778,10 @@ async function readMainAuthErrorCode(resp: Response): Promise<unknown> {
 
 interface MainAccountInfoFetchResult {
   info: MainAccountInfo;
+  /** Ephemeral result of this attempt, omitted when no WHAM request was made. */
+  quotaRefresh?: CodexQuotaRefreshOutcome;
+  /** Internal dispatch fence for diagnostics only; never copied into a public DTO or cache. */
+  quotaRefreshGeneration?: number;
   /** Whether this attempt safely inspected the physical native-main credential. */
   credentialChecked: boolean;
   /** Meaningful only when credentialChecked is true. */
@@ -792,12 +797,16 @@ interface MainAccountInfoFetchResult {
 export interface MainAccountInfoSnapshot {
   info: MainAccountInfo;
   mainIdentityGeneration: number;
+  quotaRefresh?: CodexQuotaRefreshOutcome;
 }
 
 export async function fetchMainAccountInfoSnapshot(forceRefresh = false): Promise<MainAccountInfoSnapshot> {
   const result = await fetchMainAccountInfoAttempt(forceRefresh, 1);
   return {
     info: result.info,
+    ...(result.quotaRefresh && result.quotaRefreshGeneration !== undefined
+      && isMainAccountIdentityGenerationLive(result.quotaRefreshGeneration)
+      ? { quotaRefresh: result.quotaRefresh } : {}),
     mainIdentityGeneration: result.identityGeneration ?? captureMainAccountIdentityGeneration(),
   };
 }
@@ -900,34 +909,55 @@ async function fetchMainAccountInfoWhileOwned(
     ? observeMainQuotaCredential(tokens.access_token, tokens.account_id)
     : undefined;
   const mainQuotaCredentialGeneration = getMainQuotaCredentialGeneration();
+  // Keep diagnostics separate from authentication and freshness policy. Never serialize errors.
+  const quotaSignal = AbortSignal.timeout(WHAM_REQUEST_TIMEOUT_MS);
+  let quotaPhase: "request" | "body" | "decode" | "publish" = "request";
+  let quotaRefreshGeneration = captureMainAccountIdentityGeneration();
   try {
     const resp = await fetch("https://chatgpt.com/backend-api/wham/usage", {
       headers: { Authorization: `Bearer ${tokens.access_token}`, "ChatGPT-Account-Id": tokens.account_id },
-      signal: AbortSignal.timeout(WHAM_REQUEST_TIMEOUT_MS),
+      signal: quotaSignal,
     });
+    quotaPhase = "publish";
     if (!resp.ok) {
       const terminalAuthFailure = await isTerminalMainAuthResponse(resp, isMainAccountTokenVerifiablyLive());
       const retried = await retryMainAccountInfoIfIdentityChanged(requestAccountId, retriesRemaining, nativeMainLease, explicitRefresh);
       if (retried) return retried;
       if (terminalAuthFailure) {
+        // Account for this attempt's own synchronous invalidation, never prior external drift.
+        const diagnosticStillLive = isMainAccountIdentityGenerationLive(quotaRefreshGeneration);
         clearMainAccountInfoCache();
+        if (diagnosticStillLive) quotaRefreshGeneration = captureMainAccountIdentityGeneration();
         markAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID, writerGeneration);
       }
-      return { info: EMPTY_MAIN_ACCOUNT_INFO, credentialChecked: true, hasCredential: true };
+      return {
+        info: EMPTY_MAIN_ACCOUNT_INFO, credentialChecked: true, hasCredential: true,
+        quotaRefresh: { status: "http_error", httpStatus: resp.status },
+        quotaRefreshGeneration,
+      };
     }
+    quotaPhase = "body";
     const data = (await resp.json()) as WhamUsageResponse;
+    quotaPhase = "publish";
     const retried = await retryMainAccountInfoIfIdentityChanged(requestAccountId, retriesRemaining, nativeMainLease, explicitRefresh);
     if (retried) return retried;
+    quotaPhase = "decode";
+    if (data === null || typeof data !== "object" || Array.isArray(data)) {
+      throw new Error("Invalid WHAM usage object");
+    }
+    quotaPhase = "publish";
     // A delayed response from a replaced bearer cannot revoke a newer Reserve grant,
     // even in the same workspace or after an A→B→A credential transition.
     if (mainQuotaCredentialGeneration === getMainQuotaCredentialGeneration()
       && matchesMainQuotaCredential(tokens.access_token, tokens.account_id)) {
       observeMainReserveRevocation(data, mainQuotaWriter);
     }
+    quotaPhase = "decode";
     const plan = nonEmptyPlan(data.plan_type) ?? nonEmptyPlan(cached?.plan) ?? nonEmptyPlan(getMainAccountPlan());
     const usage = { ...data, ...(plan ? { plan_type: plan } : {}) };
     const quota = parseUsageQuota(usage);
     const policyQuota = parseMainPolicyUsageQuota(usage);
+    quotaPhase = "publish";
     const freshResetCredits = quota?.resetCredits;
     // Tag the count with the identity it was read from, so a later response that omits the
     // summary can restore the badge without ever crossing an account boundary.
@@ -957,14 +987,26 @@ async function fetchMainAccountInfoWhileOwned(
     }
     return {
       info: result,
+      quotaRefresh: { status: quota ? "ok" : "not_reported" },
+      quotaRefreshGeneration,
       credentialChecked: true,
       hasCredential: true,
       ...(quota ? { freshQuota: quota } : {}),
       ...(freshResetCredits !== undefined ? { freshResetCredits } : {}),
     };
-  } catch {
+  } catch (error) {
     const retried = await retryMainAccountInfoIfIdentityChanged(requestAccountId, retriesRemaining, nativeMainLease, explicitRefresh);
-    return retried ?? { info: EMPTY_MAIN_ACCOUNT_INFO, credentialChecked: true, hasCredential: true };
+    if (retried) return retried;
+    let status: CodexQuotaRefreshOutcome["status"] = "internal_error";
+    if ((quotaPhase === "request" || quotaPhase === "body") && quotaSignal.aborted) status = "timeout";
+    else if (quotaPhase === "request") status = "network_error";
+    else if (quotaPhase === "body") status = error instanceof SyntaxError ? "invalid_response" : "network_error";
+    else if (quotaPhase === "decode") status = "invalid_response";
+    return {
+      info: EMPTY_MAIN_ACCOUNT_INFO, credentialChecked: true, hasCredential: true,
+      quotaRefresh: { status },
+      quotaRefreshGeneration,
+    };
   }
 }
 
@@ -1061,6 +1103,7 @@ export interface CodexAuthAccountDto {
   healthSummary: string;
   healthAction?: string;
   quotaProbeSkipped?: true;
+  quotaRefresh?: CodexQuotaRefreshOutcome;
   mainAccountHardLock?: MainAccountHardLockStatus;
 }
 
@@ -1769,6 +1812,9 @@ export async function listCodexAuthAccountsSnapshot(
     id: MAIN_CODEX_ACCOUNT_ID,
     email: maskEmail(mainInfo.email) ?? "Codex App login",
     plan: mainInfo.plan,
+    ...(mainSnapshotLive && mainResult.quotaRefresh && mainResult.quotaRefreshGeneration !== undefined
+      && isMainAccountIdentityGenerationLive(mainResult.quotaRefreshGeneration)
+      ? { quotaRefresh: mainResult.quotaRefresh } : {}),
     logLabel: "main",
     isMain: true,
     paused: isCodexAccountPaused(runtimeConfig, MAIN_CODEX_ACCOUNT_ID),

package/src/codex/catalog/metadata.ts

@@ -299,8 +299,6 @@ function narrowToLimits(raw: number | undefined, slug: string, input: NativeCont
     return overlay !== undefined && cap !== undefined ? Math.min(window, cap) : window;
   }
   const narrowed = overlay === undefined ? raw : Math.min(raw, overlay);
-  // 922k is the GPT-5.6 1M opt-in, not a request to shrink gpt-5.4's 1M window.
-  if (cap === NATIVE_GPT56_MAX_INPUT_TOKENS) return narrowed;
   return applyProviderContextCap(narrowed, cap) ?? narrowed;
 }
 

package/src/codex/catalog/provider-fetch.ts

@@ -1506,11 +1506,14 @@ async function fetchProviderModelsWithAuth(
     && prov.googleMode === "vertex"
     && (prov.models?.length ?? 0) === 0
     && Boolean(prov.defaultModel);
-  // Ordered dedupe union: Vertex seed, then `models`, then `retainModels`. `configured` is the
+  const seedStaticDefault = prov.liveModels === false
+    && (prov.models?.length ?? 0) === 0
+    && Boolean(prov.defaultModel);
+  // Ordered dedupe union: implicit default seed, then `models`, then `retainModels`. `configured` is the
   // single seed for the static path, the degraded fallback, drop diagnostics, and provider hints,
   // so a retain-only id must enter here or it never exists to be retained (#1690).
   const configuredIds = [...new Set([
-    ...(seedVertexDefault && prov.defaultModel ? [prov.defaultModel] : []),
+    ...((seedVertexDefault || seedStaticDefault) && prov.defaultModel ? [prov.defaultModel] : []),
     ...(prov.models ?? []),
     ...(prov.retainModels ?? []),
   ])];
@@ -1563,9 +1566,8 @@ async function fetchProviderModelsWithAuth(
     : resolveAuth.resolve(name, prov));
   const apiKey = auth.apiKey;
   // A configured default is a real callable selector and must remain discoverable when a
-  // compatible provider's live /models request fails (issue #308). Keep this separate from the
-  // explicit static list: `liveModels: false` + empty `models[]` intentionally publishes zero
-  // rows, while a failed live discovery may degrade to the default selector.
+  // compatible provider's live /models request fails (issue #308). Static providers already seed
+  // their default selector above when no explicit model list exists.
   const failedDiscoveryConfigured = configured.length > 0 || !prov.defaultModel || prov.adapter !== "anthropic"
     ? configured
     : [{