@bitkyc08/opencodex 2.50.0 → 2.52.0-preview.20260911

package/src/update/pnpm-invocation.mjs

@@ -0,0 +1,141 @@
+import { existsSync } from "node:fs";
+import { win32 } from "node:path";
+
+const CMD_META = /([()%!^"`<>&|;, *?])/g;
+
+function escapeCmdArg(arg) {
+  const out = String(arg).replace(/(\\*)"/g, "$1$1\\\"").replace(/(\\*)$/, "$1$1");
+  return `"${out}"`.replace(CMD_META, "^$1");
+}
+
+function escapeCmdCommand(command) {
+  return command.replace(CMD_META, "^$1");
+}
+
+function cleanPathEntry(entry) {
+  const trimmed = entry.trim();
+  if (trimmed.startsWith('"') && trimmed.endsWith('"')) return trimmed.slice(1, -1);
+  return trimmed;
+}
+
+function pathEntries(platform, env) {
+  const raw = env.PATH ?? env.Path ?? "";
+  const delimiter = platform === "win32" ? win32.delimiter : ":";
+  return raw.split(delimiter).map(cleanPathEntry).filter(Boolean);
+}
+
+function isCurrentDirectory(cwd, entry) {
+  const left = win32.resolve(entry);
+  const right = win32.resolve(cwd);
+  return left.toLowerCase() === right.toLowerCase();
+}
+
+function systemCommandProcessor(env) {
+  const systemRoot = env.SystemRoot ?? env.windir;
+  if (systemRoot && win32.isAbsolute(systemRoot)) {
+    return win32.join(systemRoot, "System32", "cmd.exe");
+  }
+  const comSpec = env.ComSpec;
+  return comSpec && win32.isAbsolute(comSpec) ? win32.resolve(comSpec) : null;
+}
+
+function commandPaths(platform, env, deps) {
+  const exists = deps.exists ?? existsSync;
+  const cwd = deps.cwd ?? process.cwd();
+  const entries = pathEntries(platform, env);
+  const paths = [];
+
+  if (platform !== "win32") {
+    for (const entry of entries) {
+      if (!entry.startsWith("/")) continue;
+      const candidate = `${entry}/pnpm`;
+      if (exists(candidate) && !paths.includes(candidate)) paths.push(candidate);
+    }
+    return paths;
+  }
+
+  const extensions = (env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD")
+    .split(";")
+    .filter(Boolean);
+  for (const entry of entries) {
+    if (!win32.isAbsolute(entry) || isCurrentDirectory(cwd, entry)) continue;
+    for (const extension of extensions) {
+      const candidate = win32.join(entry, `pnpm${extension.toLowerCase()}`);
+      if (exists(candidate)) {
+        const resolved = win32.resolve(candidate);
+        if (!paths.some(path => path.toLowerCase() === resolved.toLowerCase())) paths.push(resolved);
+      }
+    }
+  }
+  return paths;
+}
+
+function invocationForPath(pnpm, args, platform, env) {
+  if (platform !== "win32" || !/\.(cmd|bat)$/i.test(pnpm)) {
+    return { file: pnpm, args: [...args], options: {} };
+  }
+
+  const commandProcessor = systemCommandProcessor(env);
+  if (!commandProcessor) return null;
+  const line = [escapeCmdCommand(pnpm), ...args.map(escapeCmdArg)].join(" ");
+  return {
+    file: commandProcessor,
+    args: ["/d", "/s", "/c", `"${line}"`],
+    options: { windowsVerbatimArguments: true },
+  };
+}
+
+/** Return every absolute pnpm executable candidate in PATH, in shell order. */
+export function resolvePnpmCommands(
+  platform = process.platform,
+  env = process.env,
+  deps = {},
+) {
+  return commandPaths(platform, env, deps);
+}
+
+/** Build an invocation for one already-selected pnpm executable. */
+export function pnpmInvocationForPath(
+  pnpm,
+  args,
+  platform = process.platform,
+  env = process.env,
+) {
+  return invocationForPath(pnpm, args, platform, env);
+}
+
+/**
+ * Resolve pnpm without relying on cmd.exe's implicit current-directory lookup on Windows.
+ * POSIX returns an absolute PATH candidate as well, so a service receives the same
+ * executable that the interactive shell selected.
+ */
+export function resolvePnpmCommand(
+  platform = process.platform,
+  env = process.env,
+  deps = {},
+) {
+  return resolvePnpmCommands(platform, env, deps)[0] ?? null;
+}
+
+export function pnpmInvocation(
+  args,
+  platform = process.platform,
+  env = process.env,
+  deps = {},
+) {
+  const pnpm = resolvePnpmCommand(platform, env, deps);
+  if (!pnpm) return null;
+  return invocationForPath(pnpm, args, platform, env);
+}
+
+/** Return invocations for every absolute pnpm candidate in PATH. */
+export function pnpmInvocations(
+  args,
+  platform = process.platform,
+  env = process.env,
+  deps = {},
+) {
+  return resolvePnpmCommands(platform, env, deps)
+    .map(command => invocationForPath(command, args, platform, env))
+    .filter(Boolean);
+}

package/src/update/registry-integrity.d.mts

@@ -0,0 +1,16 @@
+export interface RegistryCommandResult {
+  status: number | null;
+  stdout?: string | Uint8Array | null;
+  stderr?: string | Uint8Array | null;
+}
+
+export type RegistryIntegrityResult =
+  | { ok: true; integrity: string }
+  | { ok: false; reason: string }
+  | { ok: "skipped"; reason: string };
+
+export declare function checkRegistryPackageIntegrity(
+  packageName: string,
+  version: string | null | undefined,
+  run: (args: readonly string[], capture?: boolean) => RegistryCommandResult,
+): RegistryIntegrityResult;

package/src/update/registry-integrity.mjs

@@ -0,0 +1,37 @@
+/**
+ * Shared registry metadata pre-flight for every direct package-manager launcher.
+ *
+ * This intentionally does not perform the query itself. The caller supplies the
+ * already-hardened npm/pnpm invocation, so the plain Node launcher and the Bun
+ * update worker apply exactly the same integrity policy without importing TypeScript
+ * into the published launcher.
+ */
+function outputText(value) {
+  if (typeof value === "string") return value;
+  if (value instanceof Uint8Array) return new TextDecoder().decode(value);
+  return "";
+}
+
+/**
+ * Check the registry's dist.integrity value for one immutable package version.
+ * A failed query is a best-effort skip; successful metadata without a sha512 SRI
+ * value is anomalous and fails closed before the caller changes local state.
+ */
+export function checkRegistryPackageIntegrity(packageName, version, run) {
+  if (!version) return { ok: "skipped", reason: "no resolved version (registry unavailable)" };
+
+  let result;
+  try {
+    result = run(["view", `${packageName}@${version}`, "dist.integrity"], true);
+  } catch {
+    return { ok: "skipped", reason: "registry integrity query failed" };
+  }
+  if (result?.status !== 0) {
+    return { ok: "skipped", reason: `registry integrity query failed (status ${result?.status ?? "timeout"})` };
+  }
+
+  const tokens = outputText(result.stdout).replace(/["']/g, "").trim().split(/\s+/).filter(Boolean);
+  const integrity = tokens.find(token => /^sha512-[A-Za-z0-9+/=]+$/.test(token));
+  if (!integrity) return { ok: false, reason: `registry returned no sha512 integrity for ${packageName}@${version}` };
+  return { ok: true, integrity };
+}

package/src/update/transactional-install.d.mts

@@ -1,5 +1,6 @@
 export type InstallTreeVerification = { ok: boolean; failures: string[] };
 export function verifyInstallTree(packageDir: string, expectedVersion?: string): InstallTreeVerification;
+export function verifyPnpmInstallTree(packageDir: string, expectedVersion?: string): InstallTreeVerification;
 export function bootRestoreProbe(
   packageDir: string,
   deps?: { rename?: (from: string, to: string) => void },
@@ -19,4 +20,3 @@ export function transactionalNpmUpdate(args: {
   rolledBack?: boolean;
   backup?: string;
 };
-

package/src/update/transactional-install.mjs

@@ -17,11 +17,88 @@
  *   <scopeDir>/.ocx-recovery.json             double-fault marker with a one-line restore
  */
 import { spawnSync } from "node:child_process";
-import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { basename, dirname, join } from "node:path";
+
+/**
+ * Dependency lookup confined to the candidate's OWN tree. This is the npm contract and it
+ * must stay lexical: Node's resolver walks the ancestor directory chain, so a global npm
+ * candidate at <prefix>/lib/node_modules/@scope/pkg could satisfy its bundled-Bun
+ * requirement from <prefix>/lib/node_modules/bun, which belongs to a different package.
+ * That verdict is not cosmetic — it accepts a stage that cannot start (D2), skips the
+ * post-swap rollback, and lets bootRestoreProbe reap the only known-good backup.
+ */
+function candidateTreeDependencyDir(packageDir, name) {
+  const dir = join(packageDir, "node_modules", ...name.split("/"));
+  return existsSync(join(dir, "package.json")) ? dir : undefined;
+}
+
+/**
+ * The candidate's own bun directory, whether or not it carries a readable package.json.
+ * The size gate keys on the DIRECTORY, matching the pre-carry verifier: a half-extracted
+ * node_modules/bun holding a truncated binary and no manifest is still a broken tree, and
+ * bun is not always among the sentinels, so the sentinel loop cannot be relied on to catch it.
+ */
+function ownTreeBunDir(packageDir) {
+  const dir = join(packageDir, "node_modules", "bun");
+  return existsSync(dir) ? dir : undefined;
+}
+
+/** The node_modules directory a package sits directly inside, or undefined. */
+function enclosingNodeModules(packageDir) {
+  const parent = dirname(packageDir);
+  if (basename(parent) === "node_modules") return parent;
+  // Scoped packages live one level deeper: <node_modules>/@scope/name.
+  const grandparent = dirname(parent);
+  if (basename(parent).startsWith("@") && basename(grandparent) === "node_modules") return grandparent;
+  return undefined;
+}
+
+/** pnpm's own bookkeeping at the root of a node_modules tree it manages. */
+function isPnpmManagedRoot(nodeModulesDir) {
+  if (!nodeModulesDir) return false;
+  if (nodeModulesDir.split(/[\\/]/).includes(".pnpm")) return true;
+  return existsSync(join(nodeModulesDir, ".pnpm")) || existsSync(join(nodeModulesDir, ".modules.yaml"));
+}
+
+/**
+ * Dependency roots this package INSTANCE owns. pnpm exposes dependencies in several shapes —
+ * symlinks inside the package's own node_modules, a package root that is itself a symlink into
+ * the virtual store, or a hoisted group root — so the npm rule alone rejects healthy trees.
+ * Ownership is still bounded: an enclosing node_modules counts only when pnpm's own metadata
+ * says pnpm manages it, which keeps an unrelated ancestor installation out.
+ */
+function ownedDependencyRoots(packageDir) {
+  const roots = [];
+  const add = dir => { if (dir && !roots.includes(dir)) roots.push(dir); };
+  const lexicalGroup = enclosingNodeModules(packageDir);
+  add(join(packageDir, "node_modules"));
+  let real;
+  try { real = realpathSync(packageDir); } catch { /* keep the lexical path only */ }
+  if (real && real !== packageDir) add(join(real, "node_modules"));
+  if (isPnpmManagedRoot(lexicalGroup)) add(lexicalGroup);
+  const realGroup = real ? enclosingNodeModules(real) : undefined;
+  if (isPnpmManagedRoot(realGroup)) add(realGroup);
+  return roots;
+}
+
+/**
+ * pnpm dependency lookup. Probing the owned roots directly, rather than filtering whatever
+ * Node's resolver returned, is deliberate: require.resolve reports the REALPATH of the
+ * resolved file, so a dependency reached through pnpm's own node_modules symlink comes back
+ * as a virtual-store path that no lexical ownership test can recognise. existsSync follows
+ * the symlink, which is exactly the pnpm graph edge that proves ownership.
+ */
+function pnpmOwnedDependencyDir(packageDir, name) {
+  for (const root of ownedDependencyRoots(packageDir)) {
+    const dir = join(root, ...name.split("/"));
+    if (existsSync(join(dir, "package.json"))) return dir;
+  }
+  return undefined;
+}
 
 /** Verification manifest for a staged (or live) package tree. */
-export function verifyInstallTree(packageDir, expectedVersion) {
+function verifyTreeWithDependencyLookup(packageDir, expectedVersion, dependencyDir) {
   const failures = [];
   let pkg;
   try {
@@ -42,8 +119,8 @@ export function verifyInstallTree(packageDir, expectedVersion) {
   // The bundled Bun binary is the load-bearing artifact: without it the launcher exits
   // before serving anything, and a boot probe that called this tree healthy would reap
   // the only backup (review High 3). Size-gate the real binary, not just its package.json.
-  const bunPkgDir = join(packageDir, "node_modules", "bun");
-  if (existsSync(bunPkgDir)) {
+  const bunPkgDir = dependencyDir(packageDir, "bun") ?? ownTreeBunDir(packageDir);
+  if (bunPkgDir) {
     const bunBinary = findLargestFile(bunPkgDir);
     if (!bunBinary || bunBinary.size < 10 * 1024 * 1024) {
       failures.push("bundled Bun binary missing or truncated (< 10MB)");
@@ -56,12 +133,29 @@ export function verifyInstallTree(packageDir, expectedVersion) {
     ? deps.filter(name => name === "bun" || name === "zod")
     : deps.slice(0, 2);
   for (const name of sentinels) {
-    const depPkg = join(packageDir, "node_modules", ...name.split("/"), "package.json");
-    if (!existsSync(depPkg)) failures.push("sentinel dependency missing: " + name);
+    if (!dependencyDir(packageDir, name)) failures.push("sentinel dependency missing: " + name);
   }
   return failures.length === 0 ? { ok: true, failures: [] } : { ok: false, failures };
 }
 
+/**
+ * npm (and every recovery decision): the candidate must be self-contained. Used by
+ * transactionalNpmUpdate's stage and post-swap checks and by bootRestoreProbe.
+ */
+export function verifyInstallTree(packageDir, expectedVersion) {
+  return verifyTreeWithDependencyLookup(packageDir, expectedVersion, candidateTreeDependencyDir);
+}
+
+/**
+ * Verify a package exposed through pnpm's global virtual store. pnpm 10/11 may use an
+ * isolated virtual store, a custom virtualStoreDir, global virtual-store links, or a
+ * hoisted linker, so the dependency may sit outside the package directory — but it must
+ * still be reachable through a root this package instance owns.
+ */
+export function verifyPnpmInstallTree(packageDir, expectedVersion) {
+  return verifyTreeWithDependencyLookup(packageDir, expectedVersion, pnpmOwnedDependencyDir);
+}
+
 function stampedName(prefix) {
   return prefix + "-" + new Date().toISOString().replace(/[:.]/g, "-");
 }

package/src/update/tray-update-plan.mjs

@@ -1,6 +1,6 @@
 /**
  * Shared, side-effect-free contract for preserving the Windows tray across all
- * updater entry points (npm launcher, CLI updater, and GUI worker).
+ * updater entry points (package launcher, CLI updater, and GUI worker).
  */
 export function planWindowsTrayUpdate(status) {
   const installed = status?.installed === true;

package/src/vision/plan.ts

@@ -110,8 +110,8 @@ export interface VisionPlan {
   anthropicSidecar?: AnthropicVisionProvider;
   /** Namespaced "provider/model" describer for the routed backend (roadmap 180). */
   routedModel?: string;
-  /** Loopback dispatch inputs for the routed backend. */
-  routedConfig?: Pick<OcxConfig, "port" | "apiKeys">;
+  /** Loopback dispatch inputs for the routed backend (the listener decides WHICH local port). */
+  routedConfig?: Pick<OcxConfig, "port" | "hostname" | "apiKeys" | "unauthenticatedLoopbackListener">;
   settings: VisionSettings;
   maxDescriptionsPerTurn: number;
 }
@@ -153,7 +153,17 @@ export function planVisionSidecar(
         return {
           backend: "routed",
           routedModel,
-          routedConfig: { port: config.port, ...(config.apiKeys ? { apiKeys: config.apiKeys } : {}) },
+          routedConfig: {
+            port: config.port,
+            ...(config.apiKeys ? { apiKeys: config.apiKeys } : {}),
+            // The self-fetch has to honor the unauthenticated loopback listener AND, with no
+            // listener, the bind address — so BOTH fields the destination resolver reads have to
+            // survive the narrowing or it silently resolves to the wrong local socket (#4236).
+            ...(config.hostname ? { hostname: config.hostname } : {}),
+            ...(config.unauthenticatedLoopbackListener
+              ? { unauthenticatedLoopbackListener: config.unauthenticatedLoopbackListener }
+              : {}),
+          },
           settings: {
             model: routedModel,
             reasoning: DEFAULT_REASONING,

package/src/vision/routed-describe.ts

@@ -19,16 +19,18 @@
  * admission secret in a forwardable header is a forwarding hazard). Loopback
  * binds require no token at all (resolveApiAuth admits loopback).
  *
- * Known limitation (recorded in roadmap 170): a bindHost where 127.0.0.1
- * does not answer cannot reach its own loopback — same latent limitation
- * gateway-cache has.
+ * Destination (#4236): the unauthenticated loopback listener when one is
+ * enabled, otherwise the BIND address — the former roadmap-170 limitation
+ * ("a bindHost where 127.0.0.1 does not answer cannot reach its own
+ * loopback") is closed by resolving through `localInferenceDestination`
+ * rather than composing 127.0.0.1 by hand.
  */
 import type { OcxConfig } from "../types";
+import { localAdmissionToken, localInferenceDestination } from "../lib/local-destinations";
 import { signalWithTimeout, cancelBodyOnAbort } from "../lib/abort";
 import { redactSecretString } from "../lib/redact";
 import { sidecarEnter } from "../lib/sidecar-tracker";
-import { configuredApiAuthToken, configuredPort } from "../server/auth-cors";
-import { loadServiceTokenFromFile } from "../lib/service-secrets";
+import { configuredPort } from "../server/auth-cors";
 import type { DescribeOutcome, VisionSettings } from "./describe";
 
 export const VISION_DESCRIBE_TERMINAL_HEADER = "x-opencodex-vision-describe";
@@ -60,23 +62,43 @@ function validateImageUrl(url: string): string | null {
   return "unsupported image URL scheme (expected data: or https:)";
 }
 
-/** The admission ladder: env token, service token file, first configured API key. */
+/**
+ * The admission ladder: env token, hardened service token file, first configured API key.
+ *
+ * Shared with every other local client through `localAdmissionToken` so the credential this
+ * self-fetch presents cannot drift from the one the Codex provider table and the Claude launch
+ * env carry. Never the admin token.
+ */
 export function routedDescribeAdmissionToken(config: Pick<OcxConfig, "apiKeys">): string | undefined {
-  const envToken = configuredApiAuthToken();
-  if (envToken) return envToken;
-  const fileToken = loadServiceTokenFromFile(process.env);
-  if (fileToken) return fileToken;
-  const first = config.apiKeys?.[0]?.key?.trim();
-  return first || undefined;
+  return localAdmissionToken(config);
 }
 
-/** Base URL seam for tests; production always self-fetches loopback. */
-export function routedDescribeBaseUrl(config: Pick<OcxConfig, "port">): string {
-  // config.port can be 0 (ephemeral bind, tests) or stale after a live port
-  // override; the server records its ACTUAL bound port via setCorsOrigin at
-  // startup, so prefer that when config carries no positive port.
-  const port = config.port && config.port > 0 ? String(config.port) : configuredPort();
-  return `http://127.0.0.1:${port}`;
+/** Base URL seam for tests; production always self-fetches the resolved local destination. */
+export function routedDescribeBaseUrl(
+  config: Pick<OcxConfig, "port" | "hostname" | "unauthenticatedLoopbackListener">,
+): string {
+  return routedDescribeDestination(config).origin;
+}
+
+/**
+ * The local destination this self-fetch dials, and whether it needs a credential.
+ *
+ * This is a local client like any other: the unauthenticated loopback listener when one is
+ * enabled, otherwise the bind address — on a tailnet-bound hub there is no loopback socket at
+ * all (#4236). The helper sends the OpenAI chat wire, which that listener now admits.
+ */
+function routedDescribeDestination(
+  config: Pick<OcxConfig, "port" | "hostname" | "unauthenticatedLoopbackListener">,
+) {
+  // config.port can be 0 (ephemeral bind, tests) or stale after a live port override; the
+  // server records its ACTUAL bound port via setCorsOrigin at startup, so prefer that when
+  // config carries no positive port. `configuredPort()` is itself `0` when `_corsOrigin` has no
+  // explicit port (a default-port origin), so the literal default has to backstop it or the
+  // composed URL names port 0 and the self-fetch cannot connect.
+  const port = config.port && config.port > 0
+    ? config.port
+    : Number(configuredPort()) || 10_100;
+  return localInferenceDestination(config, port);
 }
 
 export async function describeImageRouted(
@@ -84,7 +106,7 @@ export async function describeImageRouted(
   _detail: string | undefined,
   contextText: string,
   routedModel: string,
-  config: Pick<OcxConfig, "port" | "apiKeys">,
+  config: Pick<OcxConfig, "port" | "hostname" | "apiKeys" | "unauthenticatedLoopbackListener">,
   settings: VisionSettings,
   abortSignal?: AbortSignal,
   baseUrlOverride?: string,
@@ -98,6 +120,15 @@ export async function describeImageRouted(
   };
   const admission = routedDescribeAdmissionToken(config);
   if (admission) headers["x-opencodex-api-key"] = admission;
+  // A bind that demands admission with no resolvable credential would return 401 with a body
+  // the caller reports as a describe failure; naming the cause once is the difference between
+  // "vision is broken" and a fixable configuration note.
+  if (!admission && !baseUrlOverride && routedDescribeDestination(config).requiresAdmissionToken) {
+    console.warn(
+      "[vision] routed describe has no opencodex data-plane credential for "
+      + `${routedDescribeBaseUrl(config)} — the self-fetch will be refused.`,
+    );
+  }
 
   const requestBody = {
     model: routedModel,