@bitkyc08/opencodex 2.48.0 → 2.50.0

package/src/types/config.ts

@@ -288,6 +288,26 @@ export interface OcxRemoteGuiConfig {
 
 export type OcxConnectedClientId = "codex" | "claude";
 
+/**
+ * Redaction policy for management and CLI projections (#3859).
+ *
+ * `privacy` rather than `dashboard`: `ocx status` and `ocx account` are not the dashboard, and
+ * they read the same projections.
+ */
+export interface OcxPrivacyConfig {
+  /**
+   * Mask stored account emails before they leave the proxy. Omitted or `true` is the historical
+   * behaviour and the default.
+   *
+   * Setting this to `false` is a real disclosure decision, not a display preference. Management
+   * is not always loopback — under `remoteGui` the unmasked address reaches every management
+   * principal that can reach the hub, not only someone sitting at the machine. The default
+   * therefore stays masked, and turning it off is an explicit opt-in by the operator who owns
+   * those accounts.
+   */
+  maskEmails?: boolean;
+}
+
 export interface OcxClientConnectionConfig {
   serverUrl: string;
   managementUrl: string;
@@ -335,6 +355,8 @@ export interface OcxConfig {
   remoteGui?: OcxRemoteGuiConfig;
   /** Remote-hub client state. The admission secret is stored only in service-api-token. */
   client?: OcxClientConnectionConfig;
+  /** Operator-facing redaction policy for management and CLI projections. */
+  privacy?: OcxPrivacyConfig;
   /** Opt in to one identical-turn retry when a Responses completion has no text or tool call. */
   emptyCompletionRetry?: boolean;
   /**
@@ -693,6 +715,12 @@ export interface OcxConfig {
    * non-loopback binds, whose admission token contract is unchanged.
    */
   codexDesktopAuthless?: boolean;
+  /**
+   * Opt into Codex-owned client compaction while keeping OpenCodex routing. On an authenticated
+   * loopback bind, inject the dedicated `opencodex` model provider instead of overriding the
+   * built-in `openai` provider, so Codex does not select native remote compaction. Default off.
+   */
+  codexClientCompaction?: boolean;
   /**
    * Compatibility mode: temporarily rewrite Codex resume-history metadata while the proxy is active
    * so Codex App can show old OpenAI chats and opencodex-created exec chats under its default
@@ -753,7 +781,7 @@ export interface OcxConfig {
    */
   codexAccountPickerEnabled?: boolean;
   /**
-   * Show the GPT-5.3-Codex-Spark weekly window on Codex quota surfaces. Default false.
+   * Show the GPT-5.3-Codex-Spark 5-hour and weekly windows on Codex quota surfaces. Default false.
    *
    * Spark is a single-model window that reads 0% for most operators, and on a multi-account
    * pool it doubles the bar count for information almost nobody acts on. Hidden by default and
@@ -795,6 +823,20 @@ export interface OcxConfig {
    * that work today — on Azure and custom Responses gateways as well, whose limits are unknown.
    */
   maxUpstreamBodyBytes?: number;
+  /**
+   * Opt-in ceiling, in bytes, on a decompressed INBOUND data-plane request body (#3573).
+   *
+   * Omitted or 0 = the built-in 256 MiB default. The lever exists because a session on the
+   * 922k-token opt-in window serializes its full history past that default, and the request
+   * that crosses it is Codex's own remote-compaction request — so the session hits 413 on the
+   * one operation that would have shrunk it and cannot recover.
+   *
+   * Bounded on purpose. `resolveInboundBodyLimitBytes()` clamps to
+   * [1 MiB, 512 MiB]; an unbounded inbound cap is a memory DoS because the reader materializes
+   * the body several times over. The Bun listener's own `maxRequestBodySize` is fixed when the
+   * server starts, so raising this takes effect on restart.
+   */
+  maxInboundBodyBytes?: number;
   /**
    * Opt-in Anthropic OAuth PROACTIVE routing (#294). Default OFF.
    * Sticky session affinity; new sessions may pick lowest known 5h usage.

package/src/types/provider.ts

@@ -86,6 +86,57 @@ export interface RateLimitRetryPolicy {
   respectRetryAfter?: boolean;
 }
 
+/**
+ * Backend ids admitted by `providers.<name>.webSearchBridge.backend`. Only `"ollama"` has a
+ * shipped executor; every other id is explicit-only and inert, the same contract the top-level
+ * `webSearchSidecar` uses for backends whose executor has not landed. Naming one of them keeps
+ * the bridge disarmed rather than silently falling back to a different search provider — in
+ * particular it never auto-selects a paid Luna or Exa search.
+ */
+export const PROVIDER_WEB_SEARCH_BRIDGE_BACKENDS = [
+  "ollama",
+  "openai",
+  "anthropic",
+  "xai",
+  "gemini",
+  "exa",
+] as const;
+
+export type ProviderWebSearchBridgeBackend = typeof PROVIDER_WEB_SEARCH_BRIDGE_BACKENDS[number];
+
+/**
+ * Opt-in hosted-web-search bridge for a KEY-auth Responses passthrough provider
+ * (`providers.<name>.webSearchBridge`), default OFF (#3761).
+ *
+ * Codex always declares the hosted `{type:"web_search"}` tool. On the passthrough the proxy
+ * treats that as "the destination runs search itself" and relays it unchanged, which is true for
+ * the ChatGPT backend and for xAI but false for an OpenAI-shaped key gateway such as Ollama
+ * Cloud: the model answers with a `function_call` named `web_search` that nothing executes,
+ * and the undeclared-tool guard ends the turn. With this block enabled the proxy intercepts that
+ * call, runs the configured search backend itself, feeds the result back upstream, and shows
+ * Codex a hosted `web_search_call` cell.
+ *
+ * Never armed for `authMode: "forward"` (ChatGPT) or for a provider that executes hosted search
+ * upstream; see `planPassthroughWebSearchBridge` in `src/web-search/passthrough-bridge.ts`.
+ */
+export interface ProviderWebSearchBridgeConfig {
+  /** Master switch. Absent or false keeps today's relay-and-fail behavior exactly. */
+  enabled?: boolean;
+  /** Which executor runs the search. Absent disarms the bridge; there is no implicit default. */
+  backend?: ProviderWebSearchBridgeBackend;
+  /** Searches executed per turn before the bridge refuses further ones (1..10, default 3). */
+  maxSearches?: number;
+  /** Per-search deadline in milliseconds (1000..600000, default 60000). */
+  timeoutMs?: number;
+  /**
+   * Absolute search-API URL. Required to use the `ollama` backend against anything other than
+   * the canonical `https://ollama.com` origin, which is the only origin derived automatically.
+   * The bridge sends the PROVIDER's own API key to this URL, so an operator setting it is
+   * authorizing that key for this destination.
+   */
+  endpoint?: string;
+}
+
 /**
  * User-configured display price for one model (USD per 1M tokens).
  * Mirrors the `Cost4` shape used by the usage cost estimator; structurally
@@ -550,6 +601,11 @@ export interface OcxProviderConfig {
    * SSE/JSON; raw inspection state remains authoritative.
    */
   responsesSnapshotRepair?: boolean;
+  /**
+   * Opt-in hosted-web-search bridge for this KEY-auth Responses passthrough provider (#3761).
+   * Absent or disabled leaves the passthrough byte-identical to today.
+   */
+  webSearchBridge?: ProviderWebSearchBridgeConfig;
   /**
    * Provider-wide mapping from Codex effort labels to upstream `reasoning_effort` values.
    * Map a label to the reserved value `"__omit__"` to send no reasoning field at all for that

package/src/types.ts

@@ -101,6 +101,8 @@ export type {
   ResponsesItemIdRepairConfig,
   RateLimitRetryPolicy,
   TransientRetryPolicy,
+  ProviderWebSearchBridgeBackend,
+  ProviderWebSearchBridgeConfig,
   ProviderCostOverlay,
   RequestPacingRule,
   ProviderRequestPacingConfig,
@@ -111,6 +113,8 @@ export type {
   OcxProviderConfig,
 } from "./types/provider";
 
+export { PROVIDER_WEB_SEARCH_BRIDGE_BACKENDS } from "./types/provider";
+
 export type {
   CodexAccount,
   CodexAccountCredentials,

package/src/usage/log.ts

@@ -172,6 +172,10 @@ export interface PersistedUsageEntry {
   closeReason?: "terminal" | "client_cancel" | "non_stream" | "body_stall" | "body_overflow";
   /** Already redacted + capped at capture (request-log.ts redactSecretString().slice(0,500)). */
   upstreamError?: string;
+  /** Where the terminal/failure was observed; absent on historic rows. */
+  transportPhase?: "pre_headers" | "mid_stream" | "terminal_sse";
+  /** Whether the terminal came from upstream or a proxy-generated tail. */
+  terminalSource?: "upstream" | "synthetic";
   /**
    * Bounded route-decision trace (RI-01): why this provider/model/account was
    * selected. Additive field; old rows without it parse unchanged. Never
@@ -217,6 +221,22 @@ export function isKnownInboundProtocol(value: unknown): value is NonNullable<Per
   return typeof value === "string" && KNOWN_INBOUND_PROTOCOLS.has(value as NonNullable<PersistedUsageEntry["inboundProtocol"]>);
 }
 
+const KNOWN_TRANSPORT_PHASES = new Set<NonNullable<PersistedUsageEntry["transportPhase"]>>([
+  "pre_headers", "mid_stream", "terminal_sse",
+]);
+
+export function isKnownTransportPhase(value: unknown): value is NonNullable<PersistedUsageEntry["transportPhase"]> {
+  return typeof value === "string" && KNOWN_TRANSPORT_PHASES.has(value as NonNullable<PersistedUsageEntry["transportPhase"]>);
+}
+
+const KNOWN_TERMINAL_SOURCES = new Set<NonNullable<PersistedUsageEntry["terminalSource"]>>([
+  "upstream", "synthetic",
+]);
+
+export function isKnownTerminalSource(value: unknown): value is NonNullable<PersistedUsageEntry["terminalSource"]> {
+  return typeof value === "string" && KNOWN_TERMINAL_SOURCES.has(value as NonNullable<PersistedUsageEntry["terminalSource"]>);
+}
+
 export function usageLogPath(configDir?: string): string {
   return join(configDir ?? getConfigDir(), "usage.jsonl");
 }
@@ -511,6 +531,8 @@ function normalizeUsageEntry(entry: PersistedUsageEntry): PersistedUsageEntry {
   const responseServiceTier = sanitizeLogMetadataString(entry.responseServiceTier);
   const shadowCallRewrittenFrom = sanitizeLogMetadataString(entry.shadowCallRewrittenFrom);
   const claudeCompatibility = normalizeClaudeCompatibilityUsageLog(entry.claudeCompatibility);
+  const transportPhase = isKnownTransportPhase(entry.transportPhase) ? entry.transportPhase : undefined;
+  const terminalSource = isKnownTerminalSource(entry.terminalSource) ? entry.terminalSource : undefined;
   const routeDecision = entry.routeDecision
     ? normalizeRouteDecisionTrace(entry.routeDecision)
     : undefined;
@@ -579,6 +601,8 @@ function normalizeUsageEntry(entry: PersistedUsageEntry): PersistedUsageEntry {
     ...(entry.usage ? { usage: normalizeUsageValue(entry.usage) } : {}),
     ...(typeof entry.totalTokens === "number" ? { totalTokens: entry.totalTokens } : {}),
     ...(Array.isArray(entry.attempts) ? { attempts } : {}),
+    ...(transportPhase ? { transportPhase } : {}),
+    ...(terminalSource ? { terminalSource } : {}),
     ...(entry.errorCode ? { errorCode: entry.errorCode } : {}),
     ...(entry.terminalStatus ? { terminalStatus: entry.terminalStatus } : {}),
     ...(entry.closeReason ? { closeReason: entry.closeReason } : {}),

package/src/vision/anthropic-describe.ts

@@ -200,6 +200,7 @@ export async function describeImageAnthropic(
     const res = await fetchWithResetRetry(
       recovery => fetch(`${base}/v1/messages`, applyUpstreamRecoveryInit({
         method: "POST",
+        redirect: "manual",
         headers,
         body: JSON.stringify(body),
         signal: linkedSignal.signal,

package/src/web-search/anthropic-executor.ts

@@ -210,6 +210,7 @@ export async function runAnthropicWebSearch(
       // ignored a bare `Connection: close` (oven-sh/bun#20492).
       recovery => fetch(url, applyUpstreamRecoveryInit({
         method: "POST",
+        redirect: "manual",
         headers,
         body: JSON.stringify(body),
         signal: linkedSignal.signal,

package/src/web-search/loop.ts

@@ -478,6 +478,7 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
                 // replay on this leg eligible for the same dead socket the reset came from.
                 return requestFetch(request.url, applyUpstreamRecoveryInit({
                   method: request.method,
+                  redirect: "manual",
                   headers: h,
                   body: request.body,
                   signal: headerDeadline.signal,

package/src/web-search/ollama-executor.ts

@@ -0,0 +1,127 @@
+/**
+ * Execute ONE web search via the Ollama web-search API — the executor behind
+ * `providers.<name>.webSearchBridge.backend: "ollama"` (#3761).
+ *
+ * Documented contract: POST <origin>/api/web_search with a bearer key returns
+ * {results: [{title, url, content}]}; `max_results` defaults to 5 and caps at 10
+ * (https://docs.ollama.com/web-search). Like Exa, this lane returns ranked results
+ * rather than a prose answer, so the outcome text is a digest the routed model
+ * synthesizes from.
+ *
+ * The key is the PROVIDER's own API key: an operator who enables the bridge is reusing
+ * their Ollama Cloud route key on a second Ollama endpoint. That is why the planner
+ * refuses to derive a non-canonical origin on its own.
+ *
+ * Never throws; every error string passes redactSecretString and scrubs the literal key.
+ */
+import { applyUpstreamRecoveryInit, fetchWithResetRetry } from "../lib/upstream-retry";
+import { cancelBodyOnAbort, signalWithTimeout } from "../lib/abort";
+import { readBoundedResponseBytes } from "../lib/bounded-body";
+import { sidecarEnter } from "../lib/sidecar-tracker";
+import { redactSecretString } from "../lib/redact";
+import { MAX_SIDECAR_RESPONSE_BYTES, type WebSearchSource } from "./parse";
+import type { SidecarOutcome } from "./executor";
+
+/** Documented ceiling for the API's own `max_results`; a larger value is rejected upstream. */
+export const OLLAMA_WEB_SEARCH_MAX_RESULTS = 5;
+const OLLAMA_SNIPPET_CHARS = 1000;
+
+function isRec(value: unknown): value is Record<string, unknown> {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+
+export async function runOllamaWebSearch(
+  query: string,
+  apiKey: string,
+  endpoint: string,
+  timeoutMs: number,
+  abortSignal?: AbortSignal,
+): Promise<SidecarOutcome> {
+  if (!apiKey) {
+    return { text: "", sources: [], error: "ollama web-search backend selected without a provider apiKey" };
+  }
+  // The executor KNOWS the secret, so pattern-based redaction is not enough: scrub the
+  // literal value before anything derived from an upstream body is returned.
+  const scrub = (value: string) =>
+    redactSecretString(value.split(apiKey).join("[redacted-provider-key]"));
+  const linkedSignal = signalWithTimeout(timeoutMs, abortSignal);
+  const sidecarExit = sidecarEnter("web-search");
+  const startedAt = Date.now();
+  try {
+    const res = await fetchWithResetRetry(
+      recovery => fetch(endpoint, applyUpstreamRecoveryInit({
+        method: "POST",
+        headers: { "Content-Type": "application/json", Authorization: `Bearer ${apiKey}` },
+        body: JSON.stringify({ query, max_results: OLLAMA_WEB_SEARCH_MAX_RESULTS }),
+        signal: linkedSignal.signal,
+        // Bun forwards custom headers across redirects, so a redirect would leak the key.
+        redirect: "manual",
+      }, recovery)),
+      { abortSignal: linkedSignal.signal, label: "ollama-web-search-bridge" },
+    );
+    const detachBodyGuard = cancelBodyOnAbort(res.body, linkedSignal.signal);
+    try {
+      let bounded: Awaited<ReturnType<typeof readBoundedResponseBytes>> | null = null;
+      try {
+        bounded = await readBoundedResponseBytes(res, {
+          maxBytes: MAX_SIDECAR_RESPONSE_BYTES,
+          signal: linkedSignal.signal,
+        });
+      } catch {
+        const reason = linkedSignal.signal.reason;
+        if (linkedSignal.signal.aborted && reason instanceof Error && reason.name === "TimeoutError") {
+          throw reason;
+        }
+        // A body-read failure degrades to the status-only outcome below.
+      }
+      if (bounded?.oversized) {
+        const prefix = res.ok ? "ollama web-search response" : `ollama web-search HTTP ${res.status} response`;
+        return { text: "", sources: [], error: `${prefix} exceeded byte bound` };
+      }
+      const text = bounded ? new TextDecoder().decode(bounded.bytes) : "";
+      if (!res.ok) {
+        // Scrub BEFORE truncating: slicing first can cut the literal key at the boundary
+        // and leave an unscrubbable prefix in the surviving text.
+        return { text: "", sources: [], error: `ollama web-search HTTP ${res.status}: ${scrub(text).slice(0, 200)}` };
+      }
+      let payload: unknown = null;
+      try {
+        payload = JSON.parse(text);
+      } catch {
+        // The mapper owns the stable malformed/empty JSON outcome.
+      }
+      return mapOllamaSearchResponse(payload);
+    } finally {
+      detachBodyGuard();
+    }
+  } catch (error) {
+    const kind = error instanceof Error && error.name === "TimeoutError" ? "timeout" : "connect_error";
+    console.warn(`[web-search] ollama bridge ${kind} (${Date.now() - startedAt}ms)`);
+    return { text: "", sources: [], error: scrub(error instanceof Error ? error.message : String(error)) };
+  } finally {
+    sidecarExit();
+    linkedSignal.cleanup();
+  }
+}
+
+/** Map an Ollama /api/web_search payload to a digest the routed model can synthesize from. */
+export function mapOllamaSearchResponse(payload: unknown): SidecarOutcome {
+  if (!isRec(payload) || !Array.isArray(payload.results)) {
+    return { text: "", sources: [], error: "ollama web-search returned a non-JSON or shapeless body" };
+  }
+  const sources: WebSearchSource[] = [];
+  const lines: string[] = [];
+  const seen = new Set<string>();
+  for (const result of payload.results) {
+    if (!isRec(result) || typeof result.url !== "string" || result.url.length === 0) continue;
+    if (seen.has(result.url)) continue;
+    seen.add(result.url);
+    const title = typeof result.title === "string" && result.title.length > 0 ? result.title : result.url;
+    sources.push({ url: result.url, ...(title !== result.url ? { title } : {}) });
+    const snippet = typeof result.content === "string" ? result.content.trim().slice(0, OLLAMA_SNIPPET_CHARS) : "";
+    lines.push(`- ${title}: ${snippet || "(no excerpt)"} [${result.url}]`);
+  }
+  if (lines.length === 0) return { text: "", sources: [], error: "ollama web-search returned no results" };
+  return { text: `Search results:\n${lines.join("\n")}`, sources };
+}
+