@bitkyc08/opencodex 2.48.0-preview.20260908 → 2.49.0

package/src/codex/journal.ts

@@ -62,12 +62,40 @@ export interface RestoreJournalResult {
   configChanged: boolean;
   profileChanged: boolean;
   complete: boolean;
+  /** A changed artifact has no recorded injected hash, so snapshot ownership is unknown. */
+  unverified: boolean;
 }
 
 function sha256(content: string | null): string | null {
   return content === null ? null : createHash("sha256").update(content).digest("hex");
 }
 
+function compareJournalState(journal: Journal, config: string | null, profile: string | null) {
+  const originalConfig = Buffer.from(journal.originalConfig, "base64").toString("utf-8");
+  const originalProfile = journal.originalProfile === null
+    ? null
+    : Buffer.from(journal.originalProfile, "base64").toString("utf-8");
+  const configAlreadyOriginal = config === originalConfig;
+  const profileAlreadyOriginal = profile === originalProfile;
+  const configHashKnown = typeof journal.injectedConfigHash === "string" && journal.injectedConfigHash.length > 0;
+  const profileHashKnown = journal.injectedProfileHash !== undefined;
+  return {
+    originalConfig,
+    originalProfile,
+    configAlreadyOriginal,
+    profileAlreadyOriginal,
+    configUnchanged: configAlreadyOriginal || (configHashKnown && sha256(config) === journal.injectedConfigHash),
+    profileUnchanged: profileAlreadyOriginal || (profileHashKnown && sha256(profile) === (journal.injectedProfileHash ?? null)),
+    unverified: (!configHashKnown && !configAlreadyOriginal) || (!profileHashKnown && !profileAlreadyOriginal),
+  };
+}
+
+/** Read-only check of the pre-injection snapshot input, never the newly injected bytes. */
+export function hasUnverifiedJournalBaseline(config: string | null, profile: string | null): boolean {
+  const journal = readJournal(false);
+  return journal !== null && compareJournalState(journal, config, profile).unverified;
+}
+
 export interface WriteJournalOptions {
   /**
    * The caller's verdict on the config it is about to transform: false when
@@ -114,7 +142,7 @@ export function writeJournal(options: WriteJournalOptions = {}): void {
   const journal: Journal = {
     version: 1,
     originalConfig: Buffer.from(config).toString("base64"),
-    originalProfile: profile ? Buffer.from(profile).toString("base64") : null,
+    originalProfile: profile !== null ? Buffer.from(profile).toString("base64") : null,
     pid: process.pid,
     owner: options.owner?.kind === "client"
       ? { kind: "client", apiKeyId: options.owner.apiKeyId }
@@ -208,22 +236,34 @@ export function journalOwner(): JournalOwner | null {
 export function restoreJournalState(): RestoreJournalResult {
   const journal = readJournal();
   if (!journal) {
-    return { configRestored: false, profileRestored: false, configChanged: false, profileChanged: false, complete: false };
+    return { configRestored: false, profileRestored: false, configChanged: false, profileChanged: false, complete: false, unverified: false };
   }
-  const currentConfig = existsSync(CODEX_CONFIG_PATH) ? readFileSync(CODEX_CONFIG_PATH, "utf-8") : "";
+  const currentConfig = existsSync(CODEX_CONFIG_PATH) ? readFileSync(CODEX_CONFIG_PATH, "utf-8") : null;
   const currentProfile = existsSync(CODEX_PROFILE_PATH) ? readFileSync(CODEX_PROFILE_PATH, "utf-8") : null;
-  const configUnchanged = !journal.injectedConfigHash || sha256(currentConfig) === journal.injectedConfigHash;
-  const profileUnchanged = journal.injectedProfileHash === undefined || sha256(currentProfile) === (journal.injectedProfileHash ?? null);
+  const comparison = compareJournalState(journal, currentConfig, currentProfile);
+  const { configUnchanged, profileUnchanged } = comparison;
+  // A legacy record or interruption before markJournalInjectedState is not proof that
+  // later bytes belong to OpenCodex. Keep the whole pair and its recovery evidence intact.
+  if (comparison.unverified) {
+    return {
+      configRestored: comparison.configAlreadyOriginal,
+      profileRestored: comparison.profileAlreadyOriginal,
+      configChanged: !configUnchanged,
+      profileChanged: !profileUnchanged,
+      complete: false,
+      unverified: true,
+    };
+  }
 
-  let configRestored = false;
-  let profileRestored = false;
-  if (configUnchanged) {
-    atomicWriteFile(CODEX_CONFIG_PATH, Buffer.from(journal.originalConfig, "base64").toString("utf-8"));
+  let configRestored = comparison.configAlreadyOriginal;
+  let profileRestored = comparison.profileAlreadyOriginal;
+  if (configUnchanged && !configRestored) {
+    atomicWriteFile(CODEX_CONFIG_PATH, comparison.originalConfig);
     configRestored = true;
   }
-  if (profileUnchanged) {
-    if (journal.originalProfile !== null) {
-      atomicWriteFile(CODEX_PROFILE_PATH, Buffer.from(journal.originalProfile, "base64").toString("utf-8"));
+  if (profileUnchanged && !profileRestored) {
+    if (comparison.originalProfile !== null) {
+      atomicWriteFile(CODEX_PROFILE_PATH, comparison.originalProfile);
       profileRestored = true;
     } else if (existsSync(CODEX_PROFILE_PATH)) {
       // "There was no profile before, so remove the one we generated." Claiming success
@@ -249,6 +289,7 @@ export function restoreJournalState(): RestoreJournalResult {
     configChanged: !configUnchanged,
     profileChanged: !profileUnchanged,
     complete,
+    unverified: false,
   };
 }
 
@@ -267,6 +308,10 @@ export function reconcileJournal(options: ReconcileJournalOptions = {}): boolean
   if (owner?.kind === "client") {
     if (options.activeClientApiKeyId === owner.apiKeyId) return false;
     const restored = restoreJournalState();
+    if (restored.unverified) {
+      console.error("⚠️ Codex journal recovery was not verified; current configuration files and the journal were preserved.");
+      return false;
+    }
     if (!restored.configRestored && !restored.profileRestored) return false;
     console.error(`⚠️  Uncommitted or mismatched client routing (${owner.apiKeyId}) was restored from the Codex journal.`);
     return true;
@@ -281,6 +326,10 @@ export function reconcileJournal(options: ReconcileJournalOptions = {}): boolean
     }
   }
   const restored = restoreJournalState();
+  if (restored.unverified) {
+    console.error("⚠️ Codex journal recovery was not verified; current configuration files and the journal were preserved.");
+    return false;
+  }
   if (!restored.configRestored && !restored.profileRestored) return false;
   console.error(`⚠️  Previous session (PID ${pid}) did not shut down cleanly. Codex state restored from journal.`);
   return true;

package/src/codex/model-cache.ts

@@ -18,6 +18,8 @@ interface CacheEntry {
   models: CatalogModel[];
   fetchedAt: number;
   sizeBytes: number;
+  /** Irreversible credential/account identity for entitlement-sensitive catalogs. */
+  authorityIdentity?: string;
 }
 
 export type ProviderModelDiscoveryFailureReason =
@@ -149,15 +151,19 @@ export function isModelsFetchCoolingDown(provider: string, cooldownMs = MODELS_F
 }
 
 /** Fresh cached models for a provider, or null when absent/stale (caller should re-fetch). */
-export function getFreshCached(provider: string, ttlMs: number, now = Date.now()): CatalogModel[] | null {
+export function getFreshCached(provider: string, ttlMs: number, now = Date.now(), authorityIdentity?: string): CatalogModel[] | null {
   const entry = cache.get(provider);
   if (!entry) return null;
+  if (authorityIdentity !== undefined && entry.authorityIdentity !== authorityIdentity) return null;
   return now - entry.fetchedAt < ttlMs ? entry.models : null;
 }
 
 /** Last-known-good models regardless of age — the fallback when a live fetch fails. */
-export function getStaleCached(provider: string): CatalogModel[] | null {
-  return cache.get(provider)?.models ?? null;
+export function getStaleCached(provider: string, authorityIdentity?: string): CatalogModel[] | null {
+  const entry = cache.get(provider);
+  if (!entry) return null;
+  if (authorityIdentity !== undefined && entry.authorityIdentity !== authorityIdentity) return null;
+  return entry.models;
 }
 
 /** Capture the cache generation before an asynchronous provider discovery starts. */
@@ -181,12 +187,13 @@ export function setCached(
   models: CatalogModel[],
   now = Date.now(),
   generation?: string,
+  authorityIdentity?: string,
 ): boolean {
   if (generation !== undefined && !isModelCacheGenerationCurrent(provider, generation)) return false;
   deleteCachedProvider(provider);
   const sizeBytes = modelCacheEncoder.encode(provider).byteLength
     + modelCacheEncoder.encode(JSON.stringify(models)).byteLength;
-  cache.set(provider, { models, fetchedAt: now, sizeBytes });
+  cache.set(provider, { models, fetchedAt: now, sizeBytes, ...(authorityIdentity ? { authorityIdentity } : {}) });
   cacheBytes += sizeBytes;
   if (oldestCachedAt === null || now < oldestCachedAt) {
     oldestCachedProvider = provider;

package/src/codex/native-profile-startup.ts

@@ -1,4 +1,6 @@
 import { NativeProfileManager } from "./native-profile-manager";
+import { loadConfig } from "../config";
+import { initializeMainAccountPolicyBinding } from "./account-lifecycle";
 import { clearAccountNeedsReauth } from "./account-runtime-state";
 import { MAIN_CODEX_ACCOUNT_ID } from "./main-account";
 import {
@@ -73,6 +75,7 @@ interface StartupEntry {
   owner: NativeMainOwnerReference;
   unsubscribe: () => void;
   recoveryStarted: boolean;
+  policyBindingPending: boolean;
   settled: Promise<NativeMainStartupGateSnapshot>;
   resolveAcquisition?: (value: NativeMainStartupGateSnapshot) => void;
   deps: NativeMainStartupGateDeps;
@@ -172,17 +175,21 @@ async function runOwnedStageSweep(entry: StartupEntry): Promise<boolean> {
 }
 
 function scheduleStageSweep(entry: StartupEntry): void {
-  if (entry.sweepStopping || entry.sweepTimer || startupEntries.get(entry.homeId) !== entry) return;
+  if (entry.sweepStopping || entry.sweepTimer || entry.sweepInFlight || entry.policyBindingPending
+    || startupEntries.get(entry.homeId) !== entry) return;
   const intervalMs = Math.max(10, entry.deps.stageSweepIntervalMs ?? NATIVE_STAGE_SWEEP_INTERVAL_MS);
   entry.sweepTimer = setTimeout(() => {
     entry.sweepTimer = undefined;
     if (entry.sweepStopping || startupEntries.get(entry.homeId) !== entry) return;
+    const sweepEpoch = entry.epoch;
     entry.sweepInFlight = (async () => {
       const safe = await runOwnedStageSweep(entry);
-      if (entry.sweepStopping || startupEntries.get(entry.homeId) !== entry) return;
+      if (entry.sweepStopping || startupEntries.get(entry.homeId) !== entry
+        || entry.epoch !== sweepEpoch || entry.policyBindingPending) return;
       if (!safe) snapshot = { status: "blocked", homeId: entry.homeId, reason: "stage-cleanup-required" };
       else if (snapshot.homeId === entry.homeId && snapshot.status === "blocked" && snapshot.reason === "stage-cleanup-required") {
-        snapshot = ready(entry.homeId);
+        if (loadConfig().codexMainAccountHardLock === true) rearmOwnedMainPolicyBinding(entry);
+        else snapshot = ready(entry.homeId);
       }
     })().finally(() => {
       entry.sweepInFlight = undefined;
@@ -218,8 +225,29 @@ function convergeOwnedStartup(entry: StartupEntry): void {
       ));
       const stageSweepSafe = recoveryState === "none" ? await runOwnedStageSweep(entry) : false;
       if (startupEntries.get(entry.homeId) === entry && entry.epoch === currentEpoch && recoveryState === "none" && stageSweepSafe) {
-        clearAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID);
-        snapshot = ready(entry.homeId);
+        if (loadConfig().codexMainAccountHardLock === true) {
+          await withNativeMainOwnerOperation(entry.manager.context, () => withNativeMainExclusiveClaim(
+            entry.manager.context,
+            async () => {
+              if (startupEntries.get(entry.homeId) !== entry || entry.epoch !== currentEpoch) return;
+              if (probe(entry.manager.context) !== "none") {
+                snapshot = { status: "blocked", homeId: entry.homeId, reason: "manual-recovery" };
+                return;
+              }
+              // The HMAC is deliberately not persisted. Bind only the pinned owned home,
+              // after recovery/cleanup, and before caller-owned admission can observe ready.
+              if (loadConfig().codexMainAccountHardLock === true) {
+                initializeMainAccountPolicyBinding(entry.manager.context.authPath);
+              }
+              clearAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID);
+              snapshot = ready(entry.homeId);
+            },
+            { waitMs: 10_000 },
+          ));
+        } else {
+          clearAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID);
+          snapshot = ready(entry.homeId);
+        }
       } else if (startupEntries.get(entry.homeId) === entry && entry.epoch === currentEpoch && recoveryState === "none") {
         snapshot = { status: "blocked", homeId: entry.homeId, reason: "stage-cleanup-required" };
       } else if (startupEntries.get(entry.homeId) === entry && entry.epoch === currentEpoch) {
@@ -230,12 +258,35 @@ function convergeOwnedStartup(entry: StartupEntry): void {
         snapshot = { status: "blocked", homeId: entry.homeId, reason: "manual-recovery" };
       }
     }
+    entry.policyBindingPending = false;
     if (startupEntries.get(entry.homeId) === entry && entry.epoch === currentEpoch) scheduleStageSweep(entry);
     return snapshot;
   })();
   if (acquisitionWaiter) void entry.settled.then(acquisitionWaiter);
 }
 
+/** Join an active startup, or rearm its held owner before publishing another ready transition. */
+function rearmOwnedMainPolicyBinding(entry: StartupEntry): boolean {
+  if (entry.sweepStopping || startupEntries.get(entry.homeId) !== entry) return false;
+  const owner = entry.owner.snapshot();
+  if (entry.policyBindingPending && (owner.status === "held" || owner.status === "acquiring")) {
+    snapshot = { status: "blocked", homeId: entry.homeId, reason: "recovery-pending" };
+    settled = entry.settled;
+    return true;
+  }
+  if (owner.status !== "held") {
+    snapshot = { status: "blocked", homeId: entry.homeId, reason: ownerBlockedReason(owner) };
+    return false;
+  }
+  if (entry.sweepTimer) clearTimeout(entry.sweepTimer);
+  entry.sweepTimer = undefined;
+  entry.epoch = ++epoch;
+  entry.policyBindingPending = true;
+  entry.recoveryStarted = false;
+  convergeOwnedStartup(entry);
+  return true;
+}
+
 function observeOwner(entry: StartupEntry, owner: NativeMainOwnerSnapshot): void {
   if (startupEntries.get(entry.homeId) !== entry) return;
   if (owner.status === "acquiring") {
@@ -283,6 +334,7 @@ export function startNativeMainStartupLifecycle(
       owner,
       unsubscribe: () => {},
       recoveryStarted: false,
+      policyBindingPending: true,
       settled: acquisition,
       resolveAcquisition,
       deps,
@@ -291,6 +343,12 @@ export function startNativeMainStartupLifecycle(
     };
     startupEntries.set(homeId, entry);
     entry.unsubscribe = owner.subscribe(ownerState => observeOwner(entry!, ownerState));
+  } else if (!entry.policyBindingPending
+    && snapshot.status === "ready" && snapshot.homeId === homeId
+    && loadConfig().codexMainAccountHardLock === true) {
+    // A new same-process listener can enable protection or follow a credential replacement.
+    // Re-read its pinned home through the held owner before admitting caller-owned main.
+    rearmOwnedMainPolicyBinding(entry);
   }
   entry.refs += 1;
   let released = false;
@@ -602,6 +660,8 @@ export function blockNativeMainRecovery(
 
 export function completeNativeMainRecovery(homeId: string): boolean {
   if (snapshot.status !== "blocked" || snapshot.homeId !== homeId) return false;
+  const entry = startupEntries.get(homeId);
+  if (entry && loadConfig().codexMainAccountHardLock === true) return rearmOwnedMainPolicyBinding(entry);
   epoch += 1;
   clearAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID);
   snapshot = ready(homeId);
@@ -615,6 +675,13 @@ export function nativeMainStartupGateSnapshot(): NativeMainStartupGateSnapshot {
   return { ...snapshot };
 }
 
+/** Read-only: caller-owned credentials must not trigger physical-main ownership reprobes. */
+export function isMainAccountPolicyBindingPending(): boolean {
+  const current = nativeMainStartupGateSnapshot();
+  return current.status === "blocked" && current.reason === "recovery-pending"
+    && current.homeId !== null && startupEntries.get(current.homeId)?.policyBindingPending === true;
+}
+
 export function waitForNativeMainStartupGate(): Promise<NativeMainStartupGateSnapshot> {
   const reason = activeServiceOwnershipBlockReason();
   if (reason) return Promise.resolve(serviceOwnershipSnapshot(reason));

package/src/codex/native-profile-store.ts

@@ -41,7 +41,7 @@ const KEYRING_SERVICE = "opencodex.native-main-profile.v1";
 const SHARED_METADATA_DIR = ".opencodex-native-main-profiles";
 const INSTANCE_STAGING_DIR = "native-main-profile-staging";
 const LEGACY_METADATA_DIR = "native-main-profiles";
-const MAX_AUTH_BYTES = 4 * 1024 * 1024;
+export const MAX_AUTH_BYTES = 4 * 1024 * 1024;
 export const MAX_NATIVE_PROFILE_METADATA_BYTES = 4 * 1024 * 1024;
 export const MAX_NATIVE_PROFILE_JOURNAL_BYTES = 17 * 1024 * 1024;
 export const MAX_NATIVE_PROFILES = 32;
@@ -376,7 +376,7 @@ export function resolveNativeProfileContext(options: { codexHome?: string; confi
   };
 }
 
-function readBounded(path: string, limit: number, testSeam?: BoundedReadTestSeam): Buffer {
+export function readBounded(path: string, limit: number, testSeam?: BoundedReadTestSeam): Buffer {
   let fd: number | undefined;
   let failed = false;
   try {

package/src/codex/ocx-compaction-history.ts

@@ -0,0 +1,226 @@
+import { createHash } from "node:crypto";
+import {
+  chmodSync,
+  closeSync,
+  constants,
+  existsSync,
+  fsyncSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  realpathSync,
+  truncateSync,
+  unlinkSync,
+  writeFileSync,
+} from "node:fs";
+import { basename, isAbsolute, join, relative, resolve } from "node:path";
+
+import { Database } from "bun:sqlite";
+
+import { getConfigDir } from "../config";
+import { hardenSecretPath } from "../lib/windows-secret-acl";
+import { renameAtomicFile } from "../lib/windows-atomic-replace";
+import {
+  decodeCompactionSummary,
+  isCompactionItemType,
+  SUMMARY_PREFIX,
+} from "../responses/compaction";
+import { resolveCodexHomeDir } from "./home";
+import { resolveCodexStateDbPath } from "./paths";
+
+export interface OcxCompactionRewriteResult {
+  content: string;
+  replaced: number;
+}
+
+export interface OcxCompactionHistoryRecoveryResult {
+  rolloutPath: string;
+  backupPath: string | null;
+  replaced: number;
+}
+
+export interface OcxCompactionHistoryRecoveryOptions {
+  threadId: string;
+  codexHome?: string;
+  stateDbPath?: string;
+  backupRoot?: string;
+  now?: () => Date;
+}
+
+const THREAD_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+function digest(content: string | Buffer): string {
+  return createHash("sha256").update(content).digest("hex");
+}
+
+function pathInside(root: string, candidate: string): boolean {
+  const rel = relative(root, candidate);
+  return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
+}
+
+function resolveOwnedRolloutPath(codexHome: string, rawPath: string): string {
+  const candidate = resolve(isAbsolute(rawPath) ? rawPath : join(codexHome, rawPath));
+  const roots = [join(codexHome, "sessions"), join(codexHome, "archived_sessions")]
+    .filter(existsSync)
+    .map(root => realpathSync.native(root));
+  const entry = lstatSync(candidate);
+  if (!entry.isFile() || entry.isSymbolicLink()) {
+    throw new Error("the referenced rollout is not a regular file");
+  }
+  const canonical = realpathSync.native(candidate);
+  if (!roots.some(root => pathInside(root, canonical))) {
+    throw new Error("the referenced rollout is outside Codex session storage");
+  }
+  return canonical;
+}
+
+function writePrivateFile(path: string, content: string): void {
+  const fd = openSync(path, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 0o600);
+  try {
+    if (process.platform !== "win32") chmodSync(path, 0o600);
+    else hardenSecretPath(path, { required: true, timeoutMemoKey: path });
+    writeFileSync(fd, content, "utf8");
+    fsyncSync(fd);
+  } finally {
+    closeSync(fd);
+  }
+}
+
+function safeRemovePrivateFile(path: string): void {
+  try { truncateSync(path, 0); } catch { /* best effort before unlink */ }
+  try { unlinkSync(path); } catch { /* caller reports the original failure */ }
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function lowerCompactionItem(item: unknown): { item: unknown; changed: boolean } {
+  if (!isRecord(item) || !isCompactionItemType(item.type)) {
+    return { item, changed: false };
+  }
+  if (typeof item.encrypted_content !== "string") {
+    return { item, changed: false };
+  }
+  const summary = decodeCompactionSummary(item.encrypted_content);
+  if (summary === null) return { item, changed: false };
+  return {
+    item: {
+      type: "message",
+      role: "user",
+      content: [{ type: "input_text", text: `${SUMMARY_PREFIX}\n${summary}` }],
+    },
+    changed: true,
+  };
+}
+
+function rewriteJsonlLine(line: string): { line: string; replaced: number } {
+  let record: unknown;
+  try {
+    record = JSON.parse(line);
+  } catch {
+    return { line, replaced: 0 };
+  }
+  if (!isRecord(record) || record.type !== "compacted" || !isRecord(record.payload)) {
+    return { line, replaced: 0 };
+  }
+  const history = record.payload.replacement_history;
+  if (!Array.isArray(history)) return { line, replaced: 0 };
+
+  let replaced = 0;
+  const replacementHistory = history.map(item => {
+    const lowered = lowerCompactionItem(item);
+    if (lowered.changed) replaced += 1;
+    return lowered.item;
+  });
+  if (replaced === 0) return { line, replaced: 0 };
+
+  return {
+    line: JSON.stringify({
+      ...record,
+      payload: { ...record.payload, replacement_history: replacementHistory },
+    }),
+    replaced,
+  };
+}
+
+/**
+ * Convert OpenCodeX-owned `ocx1:` compaction items into ordinary replayable user messages.
+ *
+ * Only the authoritative `compacted.payload.replacement_history` snapshot is changed. Earlier
+ * response-item events are historical output and are deliberately preserved byte-for-byte.
+ * Native opaque compactions are also untouched because OpenCodeX cannot decode them safely.
+ */
+export function rewriteOcxCompactionsForNativeReplay(content: string): OcxCompactionRewriteResult {
+  const parts = content.split(/(\r?\n)/);
+  let replaced = 0;
+  for (let index = 0; index < parts.length; index += 2) {
+    const line = parts[index];
+    if (!line) continue;
+    const rewritten = rewriteJsonlLine(line);
+    if (rewritten.replaced === 0) continue;
+    parts[index] = rewritten.line;
+    replaced += rewritten.replaced;
+  }
+  return replaced === 0
+    ? { content, replaced: 0 }
+    : { content: parts.join(""), replaced };
+}
+
+/**
+ * Repair one explicitly selected Codex rollout for direct native replay.
+ *
+ * The original bytes are copied to an owner-private backup before the rollout is atomically
+ * replaced. A last-moment digest check refuses a concurrent Codex append instead of losing it.
+ */
+export function recoverOcxCompactionHistory(
+  options: OcxCompactionHistoryRecoveryOptions,
+): OcxCompactionHistoryRecoveryResult {
+  if (!THREAD_ID_RE.test(options.threadId)) throw new Error("thread id must be a UUID");
+  const codexHome = realpathSync.native(options.codexHome ?? resolveCodexHomeDir());
+  const stateDbPath = options.stateDbPath ?? resolveCodexStateDbPath({ codexHome });
+  if (!existsSync(stateDbPath)) throw new Error("Codex state database was not found");
+
+  const db = new Database(stateDbPath, { readonly: true });
+  let rawRolloutPath: string | undefined;
+  try {
+    db.exec("PRAGMA busy_timeout = 1000");
+    rawRolloutPath = db.query<{ rollout_path: string }, [string]>(
+      "SELECT rollout_path FROM threads WHERE id = ? LIMIT 1",
+    ).get(options.threadId)?.rollout_path;
+  } finally {
+    db.close();
+  }
+  if (!rawRolloutPath) throw new Error("thread was not found in the Codex state database");
+
+  const rolloutPath = resolveOwnedRolloutPath(codexHome, rawRolloutPath);
+  const originalBytes = readFileSync(rolloutPath);
+  const original = originalBytes.toString("utf8");
+  if (!Buffer.from(original, "utf8").equals(originalBytes)) {
+    throw new Error("the rollout is not valid UTF-8 and cannot be repaired safely");
+  }
+  const rewritten = rewriteOcxCompactionsForNativeReplay(original);
+  if (rewritten.replaced === 0) {
+    return { rolloutPath, backupPath: null, replaced: 0 };
+  }
+
+  const stamp = (options.now ?? (() => new Date()))().toISOString().replace(/[:.]/g, "-");
+  const backupDir = resolve(options.backupRoot ?? join(getConfigDir(), "history-recovery-backups", options.threadId));
+  mkdirSync(backupDir, { recursive: true, mode: 0o700 });
+  const backupPath = join(backupDir, `${basename(rolloutPath)}.${stamp}.bak`);
+  writePrivateFile(backupPath, original);
+
+  const tempPath = `${rolloutPath}.ocx-repair-${process.pid}-${crypto.randomUUID()}.tmp`;
+  try {
+    writePrivateFile(tempPath, rewritten.content);
+    if (digest(readFileSync(rolloutPath)) !== digest(originalBytes)) {
+      throw new Error("the rollout changed while it was being repaired; close Codex and retry");
+    }
+    renameAtomicFile(tempPath, rolloutPath);
+  } catch (error) {
+    safeRemovePrivateFile(tempPath);
+    throw error;
+  }
+  return { rolloutPath, backupPath, replaced: rewritten.replaced };
+}

package/src/codex/project-config-warnings.ts

@@ -69,7 +69,9 @@ function multilineCloseIndex(
       backslashes += 1;
     }
     if (backslashes % 2 === 0) break;
-    index = line.indexOf(delimiter, index + delimiter.length);
+    // An escaped quote can overlap the real terminator (backslash plus four quotes).
+    // Keep overlapping candidates instead of skipping the entire rejected delimiter.
+    index = line.indexOf(delimiter, index + 1);
   }
   return index;
 }

package/src/codex/quota.ts

@@ -336,6 +336,9 @@ function mergeAccountQuota(
   }
 
   if (snapshotHasCustom(quota)) next.customWindows = quota.customWindows;
+  // Ordinary response headers omit model-specific windows reported by WHAM.
+  // Absence is a partial update; an explicit list (including []) still replaces it.
+  else if (existing?.customWindows !== undefined) next.customWindows = existing.customWindows;
 
   if (quota.resetCredits !== undefined) next.resetCredits = quota.resetCredits;
   else if (existing?.resetCredits !== undefined) next.resetCredits = existing.resetCredits;
@@ -795,6 +798,10 @@ export function parseUsageQuota(data: WhamUsageResponse): Omit<StoredAccountQuot
   });
   const sparkWindows = [spark?.rate_limit?.primary_window, spark?.rate_limit?.secondary_window]
     .filter((window): window is WhamUsageWindow => !!window);
+  const sparkShort = sparkWindows.find(window => {
+    const percent = normalizeUsagePercent(window.used_percent);
+    return percent !== undefined && isExplicitShortWindow(window);
+  });
   const sparkWeekly = sparkWindows.find(window => {
     const percent = normalizeUsagePercent(window.used_percent);
     const seconds = window.limit_window_seconds;
@@ -803,16 +810,19 @@ export function parseUsageQuota(data: WhamUsageResponse): Omit<StoredAccountQuot
       && !isExplicitMonthlyWindow(window)
       && (seconds === undefined || seconds >= WEEKLY_WINDOW_MIN_SECONDS);
   });
-  const sparkPercent = normalizeUsagePercent(sparkWeekly?.used_percent);
-  if (sparkPercent !== undefined) {
-    const sparkWindow: { label: string; percent: number; resetAt?: number } = {
-      label: "GPT-5.3-Codex-Spark Weekly",
-      percent: sparkPercent,
-    };
-    const resetAt = normalizeResetAt(sparkWeekly?.reset_at);
+  const sparkCustomWindows: Array<{ label: string; percent: number; resetAt?: number }> = [];
+  for (const [label, window] of [
+    ["GPT-5.3-Codex-Spark 5h", sparkShort],
+    ["GPT-5.3-Codex-Spark Weekly", sparkWeekly],
+  ] as const) {
+    const percent = normalizeUsagePercent(window?.used_percent);
+    if (percent === undefined) continue;
+    const sparkWindow: { label: string; percent: number; resetAt?: number } = { label, percent };
+    const resetAt = normalizeResetAt(window?.reset_at);
     if (resetAt !== undefined) sparkWindow.resetAt = resetAt;
-    quota.customWindows = [sparkWindow];
+    sparkCustomWindows.push(sparkWindow);
   }
+  if (sparkCustomWindows.length > 0) quota.customWindows = sparkCustomWindows;
   if (resetCredits !== undefined) quota.resetCredits = resetCredits;
 
   return hasKnownQuotaValue(quota) || resetCredits !== undefined ? quota : null;

package/src/codex/reserve-availability.ts

@@ -44,14 +44,30 @@ function owned(token: Token, writer: MainQuotaWriter): boolean {
 function record(value: unknown): value is Record<string, unknown> {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function userId(token: string): string | undefined {
+/**
+ * The ChatGPT per-user identity carried by a native credential, plus whether the token's own two
+ * encodings of it disagree. Precedence stays on the RAW claims, so an empty or non-string
+ * `chatgpt_user_id` still blocks the `user_id` fallback exactly as before; `conflict` is a
+ * separate observation for callers that must fail closed on an ambiguous identity.
+ */
+export function nativeUserIdClaims(token: string): { userId: string | undefined; conflict: boolean } {
+  const none = { userId: undefined, conflict: false };
   try {
     const payload: unknown = JSON.parse(Buffer.from(token.split(".")[1] ?? "", "base64url").toString("utf8"));
     const auth = record(payload) ? payload["https://api.openai.com/auth"] : undefined;
-    if (!record(auth)) return;
-    const value = auth.chatgpt_user_id ?? auth.user_id;
-    return typeof value === "string" && value.length > 0 ? value : undefined;
-  } catch { return; }
+    if (!record(auth)) return none;
+    const named = (value: unknown): string | undefined =>
+      typeof value === "string" && value.length > 0 ? value : undefined;
+    const primary = named(auth.chatgpt_user_id);
+    const secondary = named(auth.user_id);
+    return {
+      userId: named(auth.chatgpt_user_id ?? auth.user_id),
+      conflict: primary !== undefined && secondary !== undefined && primary !== secondary,
+    };
+  } catch { return none; }
+}
+function userId(token: string): string | undefined {
+  return nativeUserIdClaims(token).userId;
 }
 function identityMatches(data: WhamUsageResponse, token: Token): boolean {
   if (data.account_id != null && data.account_id !== token.chatgptAccountId) return false;