@bitkyc08/opencodex 2.48.0 → 2.50.0

package/src/codex/quota.ts

@@ -336,6 +336,9 @@ function mergeAccountQuota(
   }
 
   if (snapshotHasCustom(quota)) next.customWindows = quota.customWindows;
+  // Ordinary response headers omit model-specific windows reported by WHAM.
+  // Absence is a partial update; an explicit list (including []) still replaces it.
+  else if (existing?.customWindows !== undefined) next.customWindows = existing.customWindows;
 
   if (quota.resetCredits !== undefined) next.resetCredits = quota.resetCredits;
   else if (existing?.resetCredits !== undefined) next.resetCredits = existing.resetCredits;
@@ -404,7 +407,20 @@ export function flushQuotaObservationsForTests(): Promise<void> {
   return pendingObservation;
 }
 
-export function parseUpstreamQuotaHeaders(headers: Headers): Omit<StoredAccountQuota, "updatedAt"> | null {
+/** Wire marker shared by Spark-family models, whose upstream limit family is model-specific. */
+const SPARK_MODEL_MARKER = "codex-spark";
+/**
+ * Custom-window label for the Spark 5h window. The WHAM parser and the response-header path
+ * must write the SAME label so a header refresh replaces the WHAM reading instead of doubling it.
+ */
+const SPARK_SHORT_WINDOW_LABEL = "GPT-5.3-Codex-Spark 5h";
+
+/** True when the routed model belongs to the Spark family, which carries its own rate limit. */
+function isCodexSparkModel(modelId: string | undefined): boolean {
+  return typeof modelId === "string" && modelId.includes(SPARK_MODEL_MARKER);
+}
+
+export function parseUpstreamQuotaHeaders(headers: Headers, options?: { modelId?: string }): Omit<StoredAccountQuota, "updatedAt"> | null {
   const primaryRaw = headers.get("x-codex-primary-used-percent");
   const secondaryRaw = headers.get("x-codex-secondary-used-percent");
   const tertiaryRaw = headers.get("x-codex-tertiary-used-percent");
@@ -427,6 +443,10 @@ export function parseUpstreamQuotaHeaders(headers: Headers): Omit<StoredAccountQ
   // it into weeklyPercent both discards the real weekly reading and leaves the account looking
   // exhausted long after the burst window resets. Duration decides, exactly as parseUsageQuota
   // already does for the WHAM payload — the two parsers must not disagree about the same data.
+  // One more attribution layer (#4122): on a Spark-family model response the sub-day primary is
+  // the MODEL-SPECIFIC limit, not an account window. Filing it as the account short tuple made
+  // one pool account display a 5h bar its identically-limited peers did not have, and fed a
+  // model limit to the account-policy readers (main-account hard lock, five-hour auto-refresh).
   const primaryIsShort = isExplicitShortWindowMinutes(primaryWindowMinutes);
 
   if (primaryIsMonthly) {
@@ -443,10 +463,21 @@ export function parseUpstreamQuotaHeaders(headers: Headers): Omit<StoredAccountQ
       if (secondaryResetAt !== undefined) quota.weeklyResetAt = secondaryResetAt;
     }
   } else if (primaryIsShort) {
-    if (primaryPercent !== undefined) quota.shortPercent = primaryPercent;
-    if (primaryResetAt !== undefined) quota.shortResetAt = primaryResetAt;
-    const minutes = windowMinutes_(primaryWindowMinutes);
-    if (minutes !== undefined) quota.shortWindowSeconds = Math.round(minutes * 60);
+    if (isCodexSparkModel(options?.modelId)) {
+      if (primaryPercent !== undefined) {
+        const sparkWindow: { label: string; percent: number; resetAt?: number } = {
+          label: SPARK_SHORT_WINDOW_LABEL,
+          percent: primaryPercent,
+        };
+        if (primaryResetAt !== undefined) sparkWindow.resetAt = primaryResetAt;
+        quota.customWindows = [sparkWindow];
+      }
+    } else {
+      if (primaryPercent !== undefined) quota.shortPercent = primaryPercent;
+      if (primaryResetAt !== undefined) quota.shortResetAt = primaryResetAt;
+      const minutes = windowMinutes_(primaryWindowMinutes);
+      if (minutes !== undefined) quota.shortWindowSeconds = Math.round(minutes * 60);
+    }
     // The burst window vacates the primary slot, so the weekly reading is the secondary — which
     // is where it was all along. Without this the true weekly value is silently dropped.
     if (secondaryPercent !== undefined) {
@@ -477,13 +508,31 @@ export function applyAccountQuotaFromUpstreamHeaders(
   headers: Headers,
   writerGeneration = captureConfigGeneration(),
   mainWriter?: MainQuotaWriter,
+  options?: { modelId?: string },
 ): void {
-  const quota = parseUpstreamQuotaHeaders(headers);
+  const quota = parseUpstreamQuotaHeaders(headers, options);
   if (!quota) return;
   const policyQuota = [
     "x-codex-primary-used-percent", "x-codex-secondary-used-percent", "x-codex-tertiary-used-percent",
   ].some(name => isInvalidPolicyUsagePercent(headers.get(name))) ? null : filterMainPolicyMonthlyQuota(quota);
-  setAccountQuotaFromParsed(accountId, quota, writerGeneration, mainWriter, policyQuota);
+  // A header-observed Spark window is a partial update against the WHAM-recorded custom windows:
+  // merge by label so the weekly Spark entry survives, and hydrate first so the first call in a
+  // process does not merge against an empty map. The merged list goes only to the legacy
+  // snapshot — the identity-bound policy evidence keeps exactly what this response said.
+  let legacyQuota = quota;
+  if (quota.customWindows !== undefined) {
+    hydrateAccountQuotasFromDisk();
+    const existing = accountQuota.get(accountId)?.customWindows;
+    if (existing !== undefined) {
+      const incoming = new Map(quota.customWindows.map(window => [window.label, window]));
+      const merged = existing.map(window => incoming.get(window.label) ?? window);
+      for (const window of quota.customWindows) {
+        if (!existing.some(entry => entry.label === window.label)) merged.push(window);
+      }
+      legacyQuota = { ...quota, customWindows: merged };
+    }
+  }
+  setAccountQuotaFromParsed(accountId, legacyQuota, writerGeneration, mainWriter, policyQuota);
 }
 
 export function updateAccountQuota(
@@ -795,6 +844,10 @@ export function parseUsageQuota(data: WhamUsageResponse): Omit<StoredAccountQuot
   });
   const sparkWindows = [spark?.rate_limit?.primary_window, spark?.rate_limit?.secondary_window]
     .filter((window): window is WhamUsageWindow => !!window);
+  const sparkShort = sparkWindows.find(window => {
+    const percent = normalizeUsagePercent(window.used_percent);
+    return percent !== undefined && isExplicitShortWindow(window);
+  });
   const sparkWeekly = sparkWindows.find(window => {
     const percent = normalizeUsagePercent(window.used_percent);
     const seconds = window.limit_window_seconds;
@@ -803,16 +856,19 @@ export function parseUsageQuota(data: WhamUsageResponse): Omit<StoredAccountQuot
       && !isExplicitMonthlyWindow(window)
       && (seconds === undefined || seconds >= WEEKLY_WINDOW_MIN_SECONDS);
   });
-  const sparkPercent = normalizeUsagePercent(sparkWeekly?.used_percent);
-  if (sparkPercent !== undefined) {
-    const sparkWindow: { label: string; percent: number; resetAt?: number } = {
-      label: "GPT-5.3-Codex-Spark Weekly",
-      percent: sparkPercent,
-    };
-    const resetAt = normalizeResetAt(sparkWeekly?.reset_at);
+  const sparkCustomWindows: Array<{ label: string; percent: number; resetAt?: number }> = [];
+  for (const [label, window] of [
+    [SPARK_SHORT_WINDOW_LABEL, sparkShort],
+    ["GPT-5.3-Codex-Spark Weekly", sparkWeekly],
+  ] as const) {
+    const percent = normalizeUsagePercent(window?.used_percent);
+    if (percent === undefined) continue;
+    const sparkWindow: { label: string; percent: number; resetAt?: number } = { label, percent };
+    const resetAt = normalizeResetAt(window?.reset_at);
     if (resetAt !== undefined) sparkWindow.resetAt = resetAt;
-    quota.customWindows = [sparkWindow];
+    sparkCustomWindows.push(sparkWindow);
   }
+  if (sparkCustomWindows.length > 0) quota.customWindows = sparkCustomWindows;
   if (resetCredits !== undefined) quota.resetCredits = resetCredits;
 
   return hasKnownQuotaValue(quota) || resetCredits !== undefined ? quota : null;

package/src/codex/reserve-availability.ts

@@ -44,14 +44,30 @@ function owned(token: Token, writer: MainQuotaWriter): boolean {
 function record(value: unknown): value is Record<string, unknown> {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function userId(token: string): string | undefined {
+/**
+ * The ChatGPT per-user identity carried by a native credential, plus whether the token's own two
+ * encodings of it disagree. Precedence stays on the RAW claims, so an empty or non-string
+ * `chatgpt_user_id` still blocks the `user_id` fallback exactly as before; `conflict` is a
+ * separate observation for callers that must fail closed on an ambiguous identity.
+ */
+export function nativeUserIdClaims(token: string): { userId: string | undefined; conflict: boolean } {
+  const none = { userId: undefined, conflict: false };
   try {
     const payload: unknown = JSON.parse(Buffer.from(token.split(".")[1] ?? "", "base64url").toString("utf8"));
     const auth = record(payload) ? payload["https://api.openai.com/auth"] : undefined;
-    if (!record(auth)) return;
-    const value = auth.chatgpt_user_id ?? auth.user_id;
-    return typeof value === "string" && value.length > 0 ? value : undefined;
-  } catch { return; }
+    if (!record(auth)) return none;
+    const named = (value: unknown): string | undefined =>
+      typeof value === "string" && value.length > 0 ? value : undefined;
+    const primary = named(auth.chatgpt_user_id);
+    const secondary = named(auth.user_id);
+    return {
+      userId: named(auth.chatgpt_user_id ?? auth.user_id),
+      conflict: primary !== undefined && secondary !== undefined && primary !== secondary,
+    };
+  } catch { return none; }
+}
+function userId(token: string): string | undefined {
+  return nativeUserIdClaims(token).userId;
 }
 function identityMatches(data: WhamUsageResponse, token: Token): boolean {
   if (data.account_id != null && data.account_id !== token.chatgptAccountId) return false;

package/src/codex/runtime.ts

@@ -86,6 +86,8 @@ export interface PersistedCodexRuntimeState {
 
 const PERSIST_FILE = "codex-runtime.json";
 const CLAMP_PERSIST_FILE = "codex-runtime-clamp.json";
+/** Probe rejection for an absolute candidate whose file is gone. Matched when retiring a dead pin (#4035). */
+const PATH_MISSING_REASON = "path does not exist";
 
 function cloneAndDeepFreeze<T>(value: T): DeepReadonly<T> {
   const clone = (current: unknown): unknown => {
@@ -283,6 +285,31 @@ export function persistCodexRuntime(
   atomicWriteFile(codexRuntimeStatePath(configDir), `${JSON.stringify(payload, null, 2)}\n`);
 }
 
+/**
+ * Delete `codex-runtime.json`. Used to retire a pin whose path no longer exists, so a
+ * later resolve stops re-probing it (#4035).
+ *
+ * Invalidates the process resolve memo the same way `persistCodexRuntime` does: the memo
+ * folds the persisted `updatedAt` into its key, and a removed file has no stamp to fold.
+ */
+export function clearPersistedCodexRuntime(deps: ResolveCodexRuntimeDeps = {}): void {
+  const configDir = deps.configDir ?? getConfigDir();
+  clearCodexRuntimeResolveCache();
+  try {
+    unlinkSync(codexRuntimeStatePath(configDir));
+  } catch (error) {
+    // An already-missing file is the success case: the pin is gone, which is the point.
+    // Anything else means the pin SURVIVES and stays authoritative, so every later
+    // resolve re-probes the same dead path — #4035 unfixed, silently. Say so once.
+    const code = (error as NodeJS.ErrnoException | null)?.code;
+    if (code === "ENOENT") return;
+    console.warn(
+      `[opencodex] Could not remove the stale Codex runtime pin at ${displayCodexRuntimePath(codexRuntimeStatePath(configDir))}`
+      + ` (${code ?? "unknown error"}). It will be re-probed until the file is removed.`,
+    );
+  }
+}
+
 function probeVersion(
   command: string,
   deps: ResolveCodexRuntimeDeps,
@@ -290,7 +317,7 @@ function probeVersion(
   const platform = deps.platform ?? process.platform;
   if (command.includes("/") || command.includes("\\") || /^[A-Za-z]:/.test(command)) {
     const exists = deps.existsSync ?? existsSync;
-    if (!exists(command)) return { ok: false, reason: "path does not exist" };
+    if (!exists(command)) return { ok: false, reason: PATH_MISSING_REASON };
     if (!isSpawnableCodexCandidate(command, platform)) {
       return { ok: false, reason: "not a spawnable Codex launcher on this platform" };
     }
@@ -654,6 +681,23 @@ export function resolveAndPersistCodexRuntime(
       return cloneAndDeepFreeze({ ...result, persistError });
     }
   }
+  // A pin whose path has vanished must be RETIRED, not merely skipped. A Codex App update
+  // replaces the hashed plugin directory the pin names, the probe rejects it with
+  // "path does not exist", nothing else resolves, and the selection degrades to `fallback` —
+  // which the write guard above declines. The dead entry then survived every later resolve
+  // and each one re-probed a path that cannot exist (#4035). Bound narrowly: only when the
+  // degraded result is `fallback`, only for the persisted command, and only for the
+  // path-does-not-exist rejection, so a present-but-unusable binary is left for the operator.
+  else if (result.runtime.source === "fallback" && persistedRuntime?.command) {
+    const pinVanished = result.failures.some(
+      // Exact comparison, not `sameRuntimeCommand`: that helper lowercases, and on a
+      // case-sensitive filesystem `/plugins/Codex` and `/plugins/codex` are different
+      // files. A missing lowercase path must not retire a live uppercase pin.
+      failure => failure.command.trim() === persistedRuntime.command.trim()
+        && failure.reason === PATH_MISSING_REASON,
+    );
+    if (pinVanished) clearPersistedCodexRuntime(deps);
+  }
   return result;
 }
 

package/src/codex/sync.ts

@@ -8,6 +8,7 @@ import { summarizeComboCatalogOmissions, type ComboCatalogOmission } from "./cat
 import { shouldSyncCodexOnStart } from "./desired-state";
 import { admitCodexWrite, type CodexAdmission } from "./admission";
 import type { CodexCatalogSyncOptions } from "./catalog/sync";
+import { resetCodexAppServerCatalogStateCache } from "./app-server-processes";
 
 export interface CodexSyncResult {
   /**
@@ -116,6 +117,10 @@ export async function syncModelsToCodex(
       message: admission.message,
     };
   }
+  // Config injection is a relevant Codex write even when the catalog bytes are unchanged.
+  // Drop cached process evidence before async discovery so a process that appeared since the
+  // last read cannot make native-default guidance report active after this sync.
+  resetCodexAppServerCatalogStateCache();
   const p = port ?? config.port ?? 10100;
   const externalProvider = (deps.currentExternalCodexModelProvider ?? currentExternalCodexModelProvider)();
 

package/src/combos/index.ts

@@ -27,9 +27,11 @@ export {
   noteComboSuccess,
   pickComboTarget,
   pickComboTargetWithWait,
+  quotaInactiveReason,
   tryPickComboModel,
   UnknownComboError,
   type ComboPick,
+  type QuotaInactiveReason,
 } from "./resolve";
 export {
   clearComboTargetCooldowns,

package/src/combos/resolve.ts

@@ -92,6 +92,58 @@ export function cachedProviderQuotaIsExhausted(
   return false;
 }
 
+/**
+ * Why a catalog row is offered but cannot currently serve a request (#1711).
+ *
+ * Only one reason exists today. It is a string rather than a boolean so a later cause — a
+ * cooldown, a revoked key — can be told apart by a consumer that already reads the field.
+ */
+export type QuotaInactiveReason = "no_credit";
+
+/**
+ * `"no_credit"` when every USABLE target of a catalog row has positive exhaustion evidence
+ * (#1711), otherwise undefined.
+ *
+ * This deliberately reuses the runtime rules in `targetProviderIsUsable` above rather than the
+ * Dashboard's `quotaStateFromReport`, which is harsher: it treats `remaining <= 0` as exhausted
+ * without requiring `percent >= 100` and ignores an elapsed `resetAt`. A catalog row marked
+ * inactive on the harsher rule would contradict the router, which would still happily send the
+ * request.
+ *
+ * Three rules carry the correctness, all inherited rather than restated:
+ *
+ * - A target the operator has removed or disabled is not usable and is not evidence either way;
+ *   it drops out before the vote. If nothing is left, the row is unavailable for an operator
+ *   reason rather than a quota one, so this returns undefined.
+ * - The canonical ChatGPT forward provider is exempt. Native account selection owns model-scoped
+ *   quota, and a provider-level summary cannot veto it.
+ * - A stale cache is NOT exhaustion. `getCachedProviderQuota` returns null past its 30-minute
+ *   window, and a null reading ends the vote rather than counting as evidence, so an unprobed
+ *   provider is never marked inactive.
+ *
+ * "Every" is the bar on purpose: one target that can still serve makes the row serviceable, which
+ * is exactly what the combo loop concludes at request time.
+ */
+export function quotaInactiveReason(
+  config: OcxConfig,
+  targets: readonly { provider: string }[],
+  now = Date.now(),
+): QuotaInactiveReason | undefined {
+  const usable = targets.filter(target => {
+    if (!Object.hasOwn(config.providers, target.provider)) return false;
+    const provider = config.providers[target.provider];
+    return !!provider && provider.disabled !== true;
+  });
+  if (usable.length === 0) return undefined;
+  for (const target of usable) {
+    const provider = config.providers[target.provider]!;
+    if (isCanonicalOpenAiForwardProvider(provider)) return undefined;
+    const quota = getCachedProviderQuota(target.provider, now);
+    if (!quota || !cachedProviderQuotaIsExhausted(quota, now)) return undefined;
+  }
+  return "no_credit";
+}
+
 function smoothWeightedIndex(
   targets: Required<OcxComboTarget>[],
   state: SelectionState,

package/src/config.ts

@@ -73,6 +73,7 @@ import {
   MODEL_ADAPTER_OVERRIDE_ALLOWED,
   OPENAI_PROVIDER_TIER_VERSION,
   pinnedWireAdapter,
+  PROVIDER_WEB_SEARCH_BRIDGE_BACKENDS,
   UPSTREAM_HTTP_VERSION_VALUES,
   type OcxClaudeCodeConfig,
   type OcxConfig,
@@ -497,6 +498,47 @@ export function requestPacingConfigError(value: unknown): string | null {
   return "requestPacing must contain enabled and a valid requestsPerMinute/minIntervalMs provider rule or model overrides";
 }
 
+/**
+ * Bounds for the opt-in passthrough web-search bridge (`providers.<name>.webSearchBridge`,
+ * #3761). Strict for the same reason `retryOn429` is: a misspelled key here would silently
+ * leave the bridge disarmed while the operator believes they enabled it. `endpoint` is only
+ * shape-checked here; `planPassthroughWebSearchBridge` re-validates the origin before any key
+ * is sent to it, because config validation is not an authorization boundary.
+ */
+const providerWebSearchBridgeSchema = z.object({
+  enabled: z.boolean().optional(),
+  backend: z.enum(PROVIDER_WEB_SEARCH_BRIDGE_BACKENDS).optional(),
+  maxSearches: z.number().int().min(1).max(10).optional(),
+  timeoutMs: z.number().int().min(1_000).max(600_000).optional(),
+  endpoint: z.string().min(1).optional(),
+}).strict();
+
+export function providerWebSearchBridgeConfigError(value: unknown): string | null {
+  if (value === undefined) return null;
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return "webSearchBridge must be a plain object";
+  }
+  const parsed = providerWebSearchBridgeSchema.safeParse(value);
+  if (!parsed.success) {
+    return "webSearchBridge accepts only enabled (boolean), backend "
+      + `(${PROVIDER_WEB_SEARCH_BRIDGE_BACKENDS.join("|")}), maxSearches (1..10), `
+      + "timeoutMs (1000..600000), and endpoint (absolute http(s) URL)";
+  }
+  const endpoint = parsed.data.endpoint;
+  if (endpoint !== undefined) {
+    let url: URL;
+    try {
+      url = new URL(endpoint);
+    } catch {
+      return "webSearchBridge.endpoint must be an absolute http(s) URL";
+    }
+    if (url.protocol !== "https:" && url.protocol !== "http:") {
+      return "webSearchBridge.endpoint must be an absolute http(s) URL";
+    }
+  }
+  return null;
+}
+
 const fastWireSchema = z.object({
   kind: z.string(),
   canonicalToWire: z.record(z.string().trim(), z.string().trim()),
@@ -600,6 +642,10 @@ const providerConfigSchema = z.object({
     repairInvalidIds: z.boolean().optional(),
   }).strict().optional(),
   responsesSnapshotRepair: z.boolean().optional(),
+  // Invalid blocks degrade to "absent" rather than failing the whole config load: an unusable
+  // bridge block must never send an operator through invalid-config recovery for an opt-in
+  // feature that is off by default. The management write boundary still rejects it loudly.
+  webSearchBridge: providerWebSearchBridgeSchema.optional().catch(undefined),
   xaiResponsesXSearch: z.boolean().optional(),
   xaiResponsesDefaultVersion: z.number().int().positive().optional().catch(undefined),
 }).passthrough();
@@ -1100,6 +1146,9 @@ const configSchema = z.object({
   // candidates are rejected explicitly by remoteGuiConfigError below.
   hub: hubConfigSchema.optional().catch(undefined),
   remoteGui: remoteGuiConfigSchema.optional().catch(undefined),
+  // A malformed privacy block must never be read as "unmask": .catch(undefined) drops it and
+  // emailMaskingEnabled then falls back to masked, which is also what an absent block means.
+  privacy: z.object({ maskEmails: z.boolean().optional() }).strict().optional().catch(undefined),
   // A malformed present client block must remain diagnosable from raw config and
   // fail closed through src/client/state.ts; unrelated provider state still loads.
   client: clientConnectionSchema.optional().catch(undefined),
@@ -1118,6 +1167,15 @@ const configSchema = z.object({
     .min(0)
     .optional()
     .catch(undefined),
+  // Opt-in inbound body ceiling (#3573). An invalid hand edit degrades to the 256 MiB default
+  // rather than failing the parse, matching the outbound guard above: a malformed number must
+  // not change what the proxy admits. The hard ceiling is NOT enforced here — because of that
+  // `.catch`, and because a config object can be built without this schema at all — but in
+  // `resolveInboundBodyLimitBytes()`, which every reader goes through.
+  maxInboundBodyBytes: z.number().int()
+    .min(0)
+    .optional()
+    .catch(undefined),
   appOwnedMemoryBudgetMb: z.number().int()
     .min(MIN_APP_OWNED_MEMORY_BUDGET_MB)
     .max(MAX_APP_OWNED_MEMORY_BUDGET_MB)
@@ -1189,6 +1247,7 @@ const configSchema = z.object({
   ).optional().catch(undefined),
   codexShimAutoRestore: z.boolean().optional(),
   codexDesktopAuthless: z.boolean().optional().catch(undefined),
+  codexClientCompaction: z.boolean().optional().catch(undefined),
   pausedCodexAccountIds: z.array(z.string().regex(/^[a-zA-Z0-9._-]{1,64}$/)).optional(),
   codexQuotaAutoRefresh: codexQuotaAutoRefreshSchema.optional().catch(undefined),
   codexAccountNamespaces: codexAccountNamespacesSchema.optional(),