@bitkyc08/opencodex 2.48.0 → 2.50.0

package/src/cli/models-runtime.ts

@@ -21,7 +21,7 @@ import { MAX_COST4_RATE } from "../usage/expected-prices";
 import { isValidCost4Rate } from "../usage/user-cost-overlays";
 
 const USAGE = `Usage:
-  ocx models live [--provider <name>] [--json]
+  ocx models live [--provider <name>] [--free-only] [--json]
   ocx models price <provider/model> [--json]
   ocx models set-price <provider/model> --input N --output N [--cache-read N] [--cache-write N] [--json]
   ocx models set-price <provider/model> --auto [--json]
@@ -52,17 +52,22 @@ type ModelRow = {
   custom?: boolean;
   customId?: string;
   displayName?: string;
+  pricingStatus?: "free" | "paid";
 };
 
 async function live(argv: string[], deps: RuntimeApiDeps): Promise<void> {
   const args = [...argv];
   const wantsJson = takeFlag(args, "--json");
   const provider = takeOption(args, "--provider");
+  // Absent pricingStatus means the provider published no usable per-token pair, so it is
+  // excluded here for the same fail-closed reason the classifier omits it (#3666).
+  const freeOnly = takeFlag(args, "--free-only");
   rejectArgs(args, USAGE);
   const rows = await runtimeRequest<ModelRow[]>("/api/models", {}, deps);
-  const filtered = provider ? rows.filter(row => row.provider === provider) : rows;
+  const byProvider = provider ? rows.filter(row => row.provider === provider) : rows;
+  const filtered = freeOnly ? byProvider.filter(row => row.pricingStatus === "free") : byProvider;
   printData(filtered, wantsJson, filtered.map(row => {
-    const flags = [row.native ? "native" : "routed", row.custom ? "custom" : "", row.initialSelectionPending ? "initial discovery pending" : row.disabled ? "disabled" : "enabled"].filter(Boolean);
+    const flags = [row.native ? "native" : "routed", row.custom ? "custom" : "", row.pricingStatus === "free" ? "free" : "", row.initialSelectionPending ? "initial discovery pending" : row.disabled ? "disabled" : "enabled"].filter(Boolean);
     return `${row.namespaced ?? `${row.provider}/${row.id}`}  [${flags.join(", ")}]`;
   }));
 }

package/src/cli/observe.ts

@@ -17,7 +17,7 @@ import { redactSecretString } from "../lib/redact";
 
 const USAGE = `Usage:
   ocx observe logs [--provider <name>] [--model <id>] [--status <code>]
-      [--conversation <id>] [--limit <n>] [--follow] [--json|--jsonl]
+      [--conversation <id>] [--account <label>] [--limit <n>] [--follow] [--json|--jsonl]
   ocx logs explain <request-id> [--json]
   ocx logs rebuild-index
   ocx logs index-status
@@ -58,7 +58,14 @@ function formatLog(row: LogEntry): string {
   const conversation = typeof row.conversationId === "string" && row.conversationId.length > 0
     ? `conv=${row.conversationId}`
     : "";
-  return [time, String(status), route, duration, conversation].filter(Boolean).join("  ");
+  // The account label is printed for the same reason, and for one more: it is the answer to
+  // "which of my accounts served this?" (#4057). It is only ever the stable non-PII label the
+  // proxy already persists (`main`, `p<hex6>`, `o<hex6>`) — never an email, a key, or an
+  // upstream account id. Rows from a single-account provider carry no label and print none.
+  const account = typeof row.accountLogLabel === "string" && row.accountLogLabel.length > 0
+    ? `acct=${row.accountLogLabel}`
+    : "";
+  return [time, String(status), route, duration, account, conversation].filter(Boolean).join("  ");
 }
 
 async function logs(argv: string[], deps: RuntimeApiDeps): Promise<void> {
@@ -72,6 +79,9 @@ async function logs(argv: string[], deps: RuntimeApiDeps): Promise<void> {
   // Both spellings, because the server accepts both (`request-log.ts:1032`) and an operator
   // should not have to remember which one this surface wanted.
   const conversationId = takeOption(args, "--conversation") ?? takeOption(args, "--conversationId");
+  // Server-side, so `--limit` caps the rows that MATCHED rather than the rows scanned; a
+  // client-side filter after a 200-row cap would silently hide older matches.
+  const account = takeOption(args, "--account");
   const limit = takeIntegerOption(args, "--limit", { min: 1 }) ?? 200;
   rejectArgs(args, USAGE);
   if (wantsJson && wantsJsonl) throw new CliUsageError("--json and --jsonl cannot be combined", USAGE);
@@ -80,7 +90,7 @@ async function logs(argv: string[], deps: RuntimeApiDeps): Promise<void> {
   }
   let seen = new Set<string>();
   do {
-    const data = await runtimeRequest(`/api/logs${query({ provider, model, status, conversationId, limit })}`, {}, deps);
+    const data = await runtimeRequest(`/api/logs${query({ provider, model, status, conversationId, account, limit })}`, {}, deps);
     const rows = logRows(data);
     if (!follow && wantsJson) printData(data, true);
     else {

package/src/cli/provider-runtime.ts

@@ -204,7 +204,8 @@ async function presets(argv: string[], deps: RuntimeApiDeps): Promise<void> {
   const rows = Array.isArray(result) ? result : result.providers ?? [];
   printData(result, wantsJson, rows.map(row => {
     const record = row as Record<string, unknown>;
-    return `${String(record.id ?? record.name ?? "?")}  ${String(record.label ?? record.adapter ?? "")}`.trimEnd();
+    const sponsor = record.sponsor ? `  (sponsor: ${String(record.sponsor)})` : "";
+    return `${String(record.id ?? record.name ?? "?")}  ${String(record.label ?? record.adapter ?? "")}${sponsor}`.trimEnd();
   }));
 }
 

package/src/cli/registry.ts

@@ -36,8 +36,8 @@ export const CLI_COMMANDS: CliCommandEntry[] = [
   },
   {
     name: "recover-history",
-    usage: "ocx recover-history --legacy-openai --yes",
-    summary: "Force all user-message opencodex rows to OpenAI for legacy recovery.",
+    usage: "ocx recover-history (--legacy-openai | --ocx-compaction <thread-id>) --yes",
+    summary: "Recover legacy provider metadata or one OpenCodeX-compacted thread for native replay.",
   },
   {
     name: "uninstall",

package/src/cli/system-command.ts

@@ -14,7 +14,7 @@ import {
 const USAGE = `Usage:
   ocx system [status] [--json]
   ocx system settings [--auto-start <on|off>] [--stream-mode <auto|legacy-tee|eager-relay>]
-      [--desktop-authless <on|off>] [--json]
+      [--desktop-authless <on|off>] [--client-compaction <on|off>] [--json]
   ocx system startup <health|install-service|install-shim> [--json]
   ocx system diagnostics [--json]
   ocx system sync [--json]
@@ -23,7 +23,11 @@ const USAGE = `Usage:
   ocx system codex-cli-update check [--json]
   ocx system update check [--channel <latest|preview>] [--json]
   ocx system update run [--channel <latest|preview>] [--restart <on|off>] --yes [--json]
-  ocx system update status <job-id> [--json]`;
+  ocx system update status <job-id> [--json]
+
+--client-compaction favors native replay portability for future compactions while
+keeping OpenCodeX routing active; the configured provider may process summaries
+and consume its quota.`;
 
 async function status(argv: string[], deps: RuntimeApiDeps): Promise<void> {
   const args = [...argv];
@@ -44,8 +48,10 @@ async function settings(argv: string[], deps: RuntimeApiDeps): Promise<void> {
   const autoStart = takeBooleanOption(args, "--auto-start");
   const streamMode = takeOption(args, "--stream-mode");
   const desktopAuthless = takeBooleanOption(args, "--desktop-authless");
+  const clientCompaction = takeBooleanOption(args, "--client-compaction");
   rejectArgs(args, USAGE);
-  if (autoStart === undefined && streamMode === undefined && desktopAuthless === undefined) {
+  if (autoStart === undefined && streamMode === undefined
+    && desktopAuthless === undefined && clientCompaction === undefined) {
     const result = await runtimeRequest("/api/settings", {}, deps);
     printData(result, wantsJson, summaryLines(result));
     return;
@@ -54,6 +60,7 @@ async function settings(argv: string[], deps: RuntimeApiDeps): Promise<void> {
     ...(autoStart !== undefined ? { codexAutoStart: autoStart } : {}),
     ...(streamMode !== undefined ? { streamMode } : {}),
     ...(desktopAuthless !== undefined ? { codexDesktopAuthless: desktopAuthless } : {}),
+    ...(clientCompaction !== undefined ? { codexClientCompaction: clientCompaction } : {}),
   };
   const result = await runtimeRequest("/api/settings", { method: "PUT", body: JSON.stringify(body) }, deps);
   printData(result, wantsJson, ["System settings updated."]);

package/src/cli/usage-report.ts

@@ -59,8 +59,11 @@ interface UsageReportInput {
 
 const MAX_MODEL_ROWS = 10;
 
-function terminalText(value: string): string {
-  return value.replace(/[\x00-\x1f\x7f-\x9f]/g, character => {
+function terminalText(value: unknown): string {
+  const text = typeof value === "string" ? value
+    : value === null || value === undefined ? ""
+    : typeof value === "number" || typeof value === "boolean" ? String(value) : "[invalid]";
+  return text.replace(/[\x00-\x1f\x7f-\x9f\u2028\u2029]/g, character => {
     const code = character.charCodeAt(0);
     return code <= 0x7f
       ? `\\x${code.toString(16).padStart(2, "0")}`
@@ -69,7 +72,8 @@ function terminalText(value: string): string {
 }
 
 function count(value: number | undefined): string {
-  return (value ?? 0).toLocaleString("en-US");
+  if (value === undefined || value === null) return "0";
+  return typeof value === "number" && Number.isFinite(value) ? value.toLocaleString("en-US") : "—";
 }
 
 /**
@@ -111,7 +115,7 @@ export function formatUsageReport(data: UsageReportInput): string[] {
       .filter(Boolean).join(" and ");
     lines.push(`No usage recorded for ${terminalText(what)} in this range.`);
     lines.push("Check the spelling against `ocx usage --json`, or widen --range.");
-    return lines;
+    return lines.map(terminalText);
   }
 
   const tokenSplit = [
@@ -185,5 +189,5 @@ export function formatUsageReport(data: UsageReportInput): string[] {
 
   lines.push("");
   lines.push("Not a billing receipt. Subscription usage or provider credits may apply instead.");
-  return lines;
+  return lines.map(terminalText);
 }

package/src/clients/config-export/zcode.ts

@@ -1,6 +1,7 @@
 // ZCode config export.
 import type { ExportContext, ManagedContribution } from "./contracts";
 import { normalizeExportModels, inputModalitiesForClient, exportModelLabel, authoritativeContextWindow, singleFragment } from "./model-metadata";
+import { sanitizeCodexReasoningEfforts } from "../../reasoning-effort";
 import { OPENCODE_PROVIDER_ID, LOOPBACK_API_KEY_PLACEHOLDER } from "./constants";
 
 
@@ -15,6 +16,16 @@ export interface ZcodeModelEntry {
   name?: string;
   limit?: { context: number; output?: number };
   modalities: { input: string[]; output: string[] };
+  /**
+   * On-disk Thought Level block. ZCode 3.x persists `variants`/`defaultVariant`
+   * and parses them into in-memory `levels`/`defaultLevel`. Omit the field when
+   * the catalog has no selectable ladder, so the picker stays hidden.
+   */
+  reasoning?: {
+    enabled: boolean;
+    variants: string[];
+    defaultVariant?: string;
+  };
 }
 
 export interface ZcodeProviderBlock {
@@ -61,6 +72,19 @@ export function buildZcodeClientConfig(ctx: ExportContext): ZcodeGeneratedConfig
     if (context !== undefined) {
       entry.limit = { context };
     }
+    // `none` is a Codex omit-sentinel, not a ZCode picker option. Keep catalog
+    // `ultra` when present: ZCode forwards the selected variant as
+    // `reasoning_effort`. Set `defaultVariant` only when it survives that filter.
+    const efforts = sanitizeCodexReasoningEfforts(model.reasoningEfforts)
+      ?.filter(effort => effort !== "none");
+    if (efforts && efforts.length > 0) {
+      const defaultVariant = model.defaultReasoningEffort?.trim().toLowerCase();
+      entry.reasoning = {
+        enabled: true,
+        variants: efforts,
+        ...(defaultVariant && efforts.includes(defaultVariant) ? { defaultVariant } : {}),
+      };
+    }
     models[model.namespaced] = entry;
   }
   return {

package/src/codex/account-lifecycle.ts

@@ -7,12 +7,13 @@ import {
 } from "../config";
 import { removeCodexAccountCredential } from "./account-store";
 import { clearAccountNeedsReauth } from "./account-runtime-state";
-import { getMainChatgptAccountId } from "./auth-collision";
+import { getMainChatgptAccountId, readCodexTokensResult } from "./auth-collision";
 import { MAIN_CODEX_ACCOUNT_ID, setMainAccountPlan } from "./main-account";
 import { clearAccountQuota } from "./quota";
 import { clearCodexUpstreamHealthForAccount, clearThreadAccountMapForAccount } from "./routing";
 import { invalidateCodexWebSocketsForAccount } from "./websocket-registry";
-import { clearMainAccountCredentialPresence, clearMainAccountInfoCache, observeMainQuotaIdentity } from "./main-account-cache";
+import { clearMainAccountCredentialPresence, clearMainAccountInfoCache, observeMainQuotaCredential, observeMainQuotaIdentity } from "./main-account-cache";
+import { extractAccountIdClaims } from "../oauth/chatgpt";
 import { forgetCodexAccountPause } from "./account-pause";
 import { clearCodexAccountPin, forgetCodexAccountPriority } from "./account-priority";
 import { forgetCodexQuotaAutoRefreshAccount } from "./quota-auto-refresh-state";
@@ -75,6 +76,38 @@ export function reconcileMainCodexAccountRuntimeState(): boolean {
   return true;
 }
 
+/**
+ * Rebuild the memory-only policy binding from a startup-owned, recovered auth path.
+ * The caller holds the native owner and exclusive claim; an incoming bearer is never evidence.
+ * A failed read creates no binding and cannot revoke a prior verified observation or its block.
+ * Only a valid replacement observation or confirmed account transition supersedes that evidence.
+ */
+export function initializeMainAccountPolicyBinding(authPath: string): boolean {
+  // Startup observes the pinned owned path inside the exclusive claim: bound the read so a
+  // replaced non-regular or oversized file cannot stall startup inside that claim.
+  const result = readCodexTokensResult(authPath, { bounded: true });
+  if (result.status !== "ok") return false;
+  const { tokens } = result;
+  if (typeof tokens.access_token !== "string" || !tokens.access_token
+    || typeof tokens.account_id !== "string" || !tokens.account_id) return false;
+  if (tokens.id_token != null && typeof tokens.id_token !== "string") return false;
+  const accountId = tokens.account_id;
+  // An owned file may contain an opaque bearer, but every decoded identity must agree —
+  // including the two account-id encodings within a single token.
+  const idTokenClaims = extractAccountIdClaims(tokens.id_token);
+  const accessTokenClaims = extractAccountIdClaims(tokens.access_token);
+  if (idTokenClaims.conflict || accessTokenClaims.conflict) return false;
+  const idTokenAccountId = idTokenClaims.accountId;
+  const accessTokenAccountId = accessTokenClaims.accountId;
+  if ((idTokenAccountId !== undefined && idTokenAccountId !== accountId)
+    || (accessTokenAccountId !== undefined && accessTokenAccountId !== accountId)) return false;
+  const previousAccountId = observedMainChatgptAccountId;
+  observedMainChatgptAccountId = accountId;
+  if (previousAccountId !== undefined && previousAccountId !== accountId) purgeMainCodexAccountRuntimeState();
+  observeMainQuotaIdentity(accountId);
+  return observeMainQuotaCredential(tokens.access_token, accountId) !== undefined;
+}
+
 /**
  * Apply a transaction-confirmed physical native-login change without waiting for
  * a later auth.json observation. The caller owns credential commit/rollback.

package/src/codex/account-runtime-state.ts

@@ -60,6 +60,11 @@ export function isAccountNeedsReauth(id: string): boolean {
   return true;
 }
 
-export function clearAccountNeedsReauth(id: string): void {
+export function clearAccountNeedsReauth(id: string, credentialGeneration?: number): void {
+  // A model response proves only the credential it used. Keep account-wide
+  // quarantine and evidence from another generation intact.
+  if (credentialGeneration !== undefined
+    && (reauthAccounts.get(id) !== credentialGeneration
+      || !isCodexAccountGenerationLive(id, credentialGeneration))) return;
   reauthAccounts.delete(id);
 }

package/src/codex/account-store.ts

@@ -58,7 +58,9 @@ function isCredentialRecord(value: unknown): value is CodexAccountCredentialReco
     && (value.replacedAt === undefined || typeof value.replacedAt === "number")
     && (value.lastCodexValidatedAt === undefined || typeof value.lastCodexValidatedAt === "number")
     && (value.lastCodexValidationStatus === undefined || value.lastCodexValidationStatus === "ok" || value.lastCodexValidationStatus === "failed")
-    && (value.lastCodexValidationError === undefined || typeof value.lastCodexValidationError === "string");
+    && (value.lastCodexValidationError === undefined || typeof value.lastCodexValidationError === "string")
+    && (value.codexValidationPending === undefined || typeof value.codexValidationPending === "boolean")
+    && (value.lastCodexValidationTerminal === undefined || typeof value.lastCodexValidationTerminal === "boolean");
 }
 
 export function refreshGrantFingerprintForToken(refreshToken: string): string {
@@ -118,11 +120,21 @@ function persistCredentialMutation(store: CodexAccountStore): void {
   advanceCodexCredentialMutationEpoch();
 }
 
+/**
+ * Validation metadata that survives a credential write.
+ *
+ * `lastCodexValidationTerminal` is deliberately NOT in this list. Every credential write —
+ * re-login, the CAS refresh commit, same-grant alias propagation — rebuilds the record from this
+ * pick list, so leaving the marker out is what makes a successful refresh or a re-authentication
+ * erase a terminal verdict. Both events disprove "the grant was revoked", and a verdict that
+ * could only ever be set would brand an account dead forever on one spurious `invalid_grant`.
+ */
 function preservedValidationMetadata(record: CodexAccountCredentialRecord | undefined): Pick<
   CodexAccountCredentialRecord,
-  "lastCodexValidatedAt" | "lastCodexValidationStatus" | "lastCodexValidationError"
+  "lastCodexValidatedAt" | "lastCodexValidationStatus" | "lastCodexValidationError" | "codexValidationPending"
 > {
   return {
+    ...(record?.codexValidationPending === true ? { codexValidationPending: true } : {}),
     ...(record?.lastCodexValidatedAt !== undefined ? { lastCodexValidatedAt: record.lastCodexValidatedAt } : {}),
     ...(record?.lastCodexValidationStatus !== undefined ? { lastCodexValidationStatus: record.lastCodexValidationStatus } : {}),
     ...(record?.lastCodexValidationError !== undefined ? { lastCodexValidationError: record.lastCodexValidationError } : {}),
@@ -135,8 +147,12 @@ export function getCodexAccountCredential(id: string): CodexAccountCredentials |
   return record.credential ?? null;
 }
 
-export function saveCodexAccountCredential(id: string, cred: CodexAccountCredentials): void {
-  withCredentialMutationLockSync(() => {
+export function saveCodexAccountCredential(
+  id: string,
+  cred: CodexAccountCredentials,
+  options: { validationPending?: boolean } = {},
+): number {
+  return withCredentialMutationLockSync(() => {
     const store = loadCodexAccountRecordStore();
     const current = store[id];
     const refreshGrantFingerprint = current?.credential?.refreshToken === cred.refreshToken
@@ -148,37 +164,84 @@ export function saveCodexAccountCredential(id: string, cred: CodexAccountCredent
       refreshGrantFingerprint,
       replacedAt: current ? Date.now() : undefined,
       ...preservedValidationMetadata(current),
+      ...(options.validationPending ? {
+        codexValidationPending: true,
+        lastCodexValidatedAt: undefined,
+        lastCodexValidationStatus: undefined,
+        lastCodexValidationError: undefined,
+      } : {}),
     };
     persistCredentialMutation(store);
+    return store[id].generation;
   });
 }
 
-export function markCodexAccountValidated(id: string, atMs: number = Date.now()): void {
+export function markCodexAccountValidated(id: string, atMs: number = Date.now(), generation?: number): void {
   withCredentialMutationLockSync(() => {
     const store = loadCodexAccountRecordStore();
     const current = store[id];
     if (!current || current.deletedAt != null || !current.credential) return;
+    if (current.codexValidationPending && generation === undefined) return;
+    if (generation !== undefined && current.generation !== generation) return;
     store[id] = {
       ...current,
       lastCodexValidatedAt: atMs,
       lastCodexValidationStatus: "ok",
       lastCodexValidationError: undefined,
+      codexValidationPending: undefined,
+      // A completed validation is the direct refutation of a terminal verdict, and this
+      // spread would otherwise carry the old marker forward.
+      lastCodexValidationTerminal: undefined,
     };
-    persist(store);
+    // Becoming routable invalidates credential-derived caches; a timestamp-only
+    // update on an already validated account preserves the existing epoch policy.
+    if (current.codexValidationPending) persistCredentialMutation(store);
+    else persist(store);
   });
 }
 
-export function markCodexAccountValidationFailed(id: string, reason: string): void {
-  withCredentialMutationLockSync(() => {
+export interface MarkCodexAccountValidationFailedOptions {
+  /**
+   * Write only while the stored record is still at this generation.
+   *
+   * A validation attempt is not atomic with the store: an operator can re-authenticate the
+   * account, or another writer can commit a refresh, while a probe is still in flight. Without
+   * this fence the late failure lands on whatever credential happens to be there and brands a
+   * freshly installed one dead. Declining to write is the safe direction — the failure cannot be
+   * attributed to a credential the caller never observed.
+   */
+  expectedGeneration?: number;
+  /** The grant itself is revoked or expired; only a re-login clears it. */
+  terminal?: boolean;
+}
+
+/** Returns whether the verdict was actually persisted (false when the fence declined it). */
+export function markCodexAccountValidationFailed(
+  id: string,
+  reason: string,
+  options: MarkCodexAccountValidationFailedOptions = {},
+): boolean {
+  return withCredentialMutationLockSync(() => {
     const store = loadCodexAccountRecordStore();
     const current = store[id];
-    if (!current || current.deletedAt != null || !current.credential) return;
+    if (!current || current.deletedAt != null || !current.credential) return false;
+    // Deferred validation is settled only by a caller that names the generation it observed.
+    // An unfenced write must never resolve a pending account, whichever verdict it carries.
+    if (current.codexValidationPending && options.expectedGeneration === undefined) return false;
+    if (options.expectedGeneration !== undefined && current.generation !== options.expectedGeneration) {
+      return false;
+    }
     store[id] = {
       ...current,
       lastCodexValidationStatus: "failed",
       lastCodexValidationError: reason,
+      // Only ever set here. A transient failure must not clear a terminal marker set earlier,
+      // and it must not invent one either, so the flag is written only when the caller proves
+      // the grant is dead.
+      ...(options.terminal ? { lastCodexValidationTerminal: true } : {}),
     };
     persist(store);
+    return true;
   });
 }
 

package/src/codex/account-usability.ts

@@ -1,4 +1,4 @@
-import { getCodexAccountCredential } from "./account-store";
+import { readCodexAccountRecord } from "./account-store";
 import { isAccountNeedsReauth } from "./account-runtime-state";
 import {
   MAIN_CODEX_ACCOUNT_ID,
@@ -48,5 +48,6 @@ export function isCodexAccountUsable(
     .some(account => isSelectableCodexPoolAccount(account) && account.id === accountId);
   if (!exists) return false;
   if (isAccountNeedsReauth(accountId)) return false;
-  return !!getCodexAccountCredential(accountId);
+  const record = readCodexAccountRecord(accountId);
+  return !!record?.credential && record.deletedAt == null && !record.codexValidationPending;
 }