@bitkyc08/opencodex 2.52.0-preview.20260911 → 2.52.0

package/src/codex/catalog/provider-fetch.ts

@@ -54,6 +54,7 @@ import { fetchCursorUsableModels } from "../../adapters/cursor/live-models";
 import { recordLiveCursorClaudeModels, recordLiveCursorMaxModeModels } from "../../adapters/cursor/catalog";
 import { fetchQoderModels } from "../../adapters/qoder/live-models";
 import { resolveQoderProfile } from "../../adapters/qoder/profiles";
+import { fetchDevinUsableModels } from "../../adapters/devin/live-models";
 import { isCanonicalOpenAiForwardProvider, OPENAI_API_PROVIDER_ID, OPENAI_CODEX_PROVIDER_ID } from "../../providers/openai-tiers";
 import {
   COMBO_NAMESPACE,
@@ -1699,6 +1700,62 @@ async function fetchProviderModelsWithAuth(
       stale ? applyConfigHintsToCachedModels(name, prov, stale, contextCap, metadataModelIdCaseFold, captured.effectiveAlias) : configured,
     ), "degraded");
   }
+  if (prov.adapter === "devin") {
+    if (!apiKey) return observed(configured, "degraded");
+    const cachedDevin = getFreshCached(name, ttlMs);
+    if (cachedDevin) {
+      return observed(
+        withConfiguredRetention(applyConfigHintsToCachedModels(name, prov, cachedDevin)),
+        "authoritative",
+      );
+    }
+    if (isModelsFetchCoolingDown(name)) {
+      const cooling = getStaleCached(name);
+      return observed(
+        withConfiguredRetention(
+          cooling ? applyConfigHintsToCachedModels(name, prov, cooling) : configured,
+        ),
+        "degraded",
+      );
+    }
+    const liveResult = await fetchDevinUsableModels({ apiKey, baseUrl: prov.baseUrl });
+    if (liveResult.ok) {
+      // Live catalog is the source of truth — use the discovered base models
+      // directly, not a filtered subset of the static seed.
+      //
+      // That extends to the context window. Cognition publishes no window
+      // anywhere, so the per-account catalog is the only first-party number,
+      // and the shipped static table is a degraded-mode guess that was wrong
+      // for nine of its eleven rows. The live value is applied first and the
+      // config hints run after it, so an explicit per-model override and an
+      // enabled Context cap still win — this only replaces the number nobody
+      // chose.
+      const result = liveResult.models.map((id) => {
+        const liveWindow = liveResult.contextWindows[id];
+        return {
+          id,
+          provider: name,
+          ...(liveWindow ? { contextWindow: liveWindow } : {}),
+          ...catalogHintsFromProviderConfig(name, prov, id, contextCap, metadataModelIdCaseFold, captured.effectiveAlias),
+        } as CatalogModel;
+      });
+      const forCache = withConfiguredRetention(result, { retainComboTargets: false });
+      if (!setCached(name, forCache, Date.now(), cacheGeneration)) {
+        return observed(withConfiguredRetention(configured), "degraded");
+      }
+      markProviderDiscoveryOk(name, liveResult.models.length);
+      return observed(withConfiguredRetention(forCache), "authoritative");
+    }
+    if (isCurrentCacheGeneration()) {
+      markModelsFetchFailure(name);
+      markProviderDiscoveryFailed(name, { reason: liveResult.error === "auth" ? "provider" : "invalid_response" });
+    }
+    const stale = getStaleCached(name);
+    return observed(
+      withConfiguredRetention(stale ? applyConfigHintsToCachedModels(name, prov, stale) : configured),
+      "degraded",
+    );
+  }
   if (prov.adapter === "cursor") {
     if (!apiKey) return observed(configured, "degraded");
     // Cursor uses a bespoke GetUsableModels RPC (not /models), returning the full effort-suffixed

package/src/codex/catalog/sync.ts

@@ -260,7 +260,7 @@ export function finishUpstreamNativeEntry(clone: RawEntry, priority: number, con
   if (priority !== 9) clone.priority = priority;
   applyNativeOpenAiContextOverride(clone, contextCap);
   // GPT-5.6 natives keep their exact upstream ladders (e.g. luna has max but no ultra).
-  // Older natives (gpt-5.5 / 5.4 / 5.4-mini / 5.3-codex-spark) get mock max + ultra
+  // Older natives (gpt-5.5 / 5.3-codex-spark) get mock max + ultra
   // (wire-clamped to xhigh). Ultra is always advertised regardless of v2 toggle.
   if (!isGpt56NativeSlug(String(clone.slug ?? ""))) ensureUltraReasoningLevel(clone);
   return ensureStrictCatalogFields(normalizeServiceTiers(clone));

package/src/codex/context-compat.ts

@@ -0,0 +1,97 @@
+/** Backend path and opt-in config compatibility for native Codex history/notes. */
+import { readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { getCodexHome } from "./paths";
+
+export const CONTEXT_BACKEND_PREFIX = "/backend-api/codex";
+
+/** The single definition of the opt-in, shared by injection and the runtime gate. */
+export function contextExperimentalEnabled(configContent: string): boolean {
+  let parsed: { features?: { context_management?: { experimental_mode?: boolean } } };
+  try {
+    parsed = Bun.TOML.parse(configContent) as typeof parsed;
+  } catch {
+    // Injection tolerates incomplete user config; malformed TOML is not an opt-in.
+    return false;
+  }
+  return parsed.features?.context_management?.experimental_mode === true;
+}
+
+let activation: { key: string; active: boolean } | undefined;
+
+/**
+ * Whether this proxy may serve the context relay at all, decided by opencodex reading Codex own
+ * config rather than by anything a caller sends.
+ *
+ * Rewriting the injected base URL is what makes the feature REACHABLE, and gating only that would
+ * leave the ownership registry and both endpoint prefixes live for anyone who can already reach
+ * the data plane. An opt-in that a direct POST walks around is not an opt-in, so the same
+ * predicate guards recording and dispatch. An absent, unreadable or malformed config is not an
+ * opt-in. The result is cached against the config identity and re-read when the file changes, so
+ * turning the feature off takes effect without a restart and steady-state traffic does not parse
+ * TOML per request.
+ */
+export function contextRelayActivated(configPath?: string): boolean {
+  let key: string;
+  let path: string;
+  try {
+    // Resolved here, not in a default parameter: those are evaluated before the body, so a
+    // CODEX_HOME that became unreadable while the proxy runs would throw past this try. This
+    // function is now on the model path, where that would abort a turn upstream already served.
+    path = configPath ?? join(getCodexHome(), "config.toml");
+    const seen = statSync(path);
+    key = `${path}:${seen.mtimeMs}:${seen.size}:${String(seen.ino)}`;
+  } catch {
+    activation = undefined;
+    return false;
+  }
+  if (activation?.key === key) return activation.active;
+  let active = false;
+  try {
+    active = contextExperimentalEnabled(readFileSync(path, "utf8"));
+  } catch {
+    // A readable stat with an unreadable body caches false under that identity, so the feature
+    // stays off until the content itself changes. Fail-closed is the right direction here.
+    active = false;
+  }
+  activation = { key, active };
+  return active;
+}
+
+/** Test seam: the cache is keyed by config identity, which a temp home reuses across cases. */
+export function resetContextRelayActivationForTests(): void {
+  activation = undefined;
+}
+
+const CONTEXT_ENDPOINTS = new Set([
+  "alpha/history/v2/list_windows", "alpha/history/v2/list_items",
+  "alpha/history/v2/read_item", "alpha/history/v2/search_contents",
+  "alpha/notes/v2/thread_hint", "alpha/notes/v2/list_files_by_prefix",
+  "alpha/notes/v2/read_file", "alpha/notes/v2/search_contents",
+  "alpha/notes/v2/append_to_file", "alpha/notes/v2/write_file",
+]);
+
+export function contextEndpoint(path: string): string | undefined {
+  const endpoint = path.startsWith("/v1/") ? path.slice(4) : "";
+  return CONTEXT_ENDPOINTS.has(endpoint) ? endpoint : undefined;
+}
+
+/** Alias only the data-plane prefix. Existing auth/origin and route gates still run. */
+export function codexCompatibleUrl(rawUrl: string): URL {
+  const url = new URL(rawUrl);
+  if (url.pathname === CONTEXT_BACKEND_PREFIX || url.pathname.startsWith(CONTEXT_BACKEND_PREFIX + "/")) {
+    url.pathname = "/v1" + url.pathname.slice(CONTEXT_BACKEND_PREFIX.length);
+  }
+  return url;
+}
+
+/** Change only marker-managed built-in routing, and only with an explicit context opt-in. */
+export function contextCompatibleBaseLine(content: string, line: string): string {
+  if (!contextExperimentalEnabled(content)) return line;
+  const match = /^openai_base_url = "([^"]+)"$/.exec(line);
+  if (!match) return line;
+  const url = new URL(match[1]);
+  if (url.pathname !== "/v1" || !["127.0.0.1", "localhost", "[::1]"].includes(url.hostname)) return line;
+  url.pathname = CONTEXT_BACKEND_PREFIX;
+  return `openai_base_url = "${url.href}"`;
+}

package/src/codex/context-owner.ts

@@ -0,0 +1,201 @@
+import { createHmac, randomBytes } from "node:crypto";
+import type { CodexAuthContext } from "./auth-context";
+import { MAIN_CODEX_ACCOUNT_ID } from "./account-id";
+import { nativeUserIdClaims } from "./reserve-availability";
+
+export type ContextSessionOwner = Readonly<
+  | { kind: "stored"; accountId: string; physicalIdentity: string; userIdentity?: string;
+      callerCredentialIdentity: string; ambiguous: boolean }
+  | { kind: "caller"; physicalIdentity?: string; userIdentity?: string;
+      callerCredentialIdentity: string; ambiguous: boolean }
+>;
+
+const TTL_MS = 24 * 60 * 60_000;
+const MAX_ENTRIES = 2048;
+const MAX_BYTES = 1024 * 1024;
+const salt = randomBytes(32);
+type Entry = { owner: ContextSessionOwner; destination: string; touchedAt: number; bytes: number };
+const owners = new Map<string, Entry>();
+let totalBytes = 0;
+
+function digest(domain: string, value: string): string {
+  return createHmac("sha256", salt).update(domain).update("\0").update(value).digest("hex");
+}
+
+function validId(value: string | null | undefined): value is string {
+  return typeof value === "string" && /^[A-Za-z0-9._:-]{1,512}$/.test(value);
+}
+
+function destinationIdentity(destination: string): string | undefined {
+  if (!destination || destination.length > 4096) return undefined;
+  try {
+    const url = new URL(destination);
+    if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.hash) return undefined;
+    return digest("destination", url.href.replace(/\/+$/, ""));
+  } catch { return undefined; }
+}
+
+function physicalIdentity(headers: Headers): string | undefined {
+  const account = headers.get("chatgpt-account-id");
+  return validId(account) ? digest("physical-account", account) : undefined;
+}
+
+/**
+ * The stable person behind an accepted credential, when the token says so.
+ *
+ * `chatgpt-account-id` names a WORKSPACE, and two people in one workspace send the same value.
+ * Ownership therefore also binds the user claim carried by the credential that upstream actually
+ * accepted. The claim is read without signature verification, which is why upstream acceptance
+ * remains the evidence and a conflicting pair of claims fails closed instead of picking one.
+ */
+function stableUserIdentity(headers: Headers): { identity?: string; conflict: boolean } {
+  const authorization = headers.get("authorization");
+  if (!authorization || authorization.length > 32_768 || !/^Bearer [^\s]+$/i.test(authorization)) {
+    return { conflict: false };
+  }
+  const claims = nativeUserIdClaims(authorization.slice(7));
+  if (claims.conflict) return { conflict: true };
+  return { ...(claims.userId ? { identity: digest("native-user", claims.userId) } : {}), conflict: false };
+}
+
+function callerCredentialIdentity(headers: Headers): string | undefined {
+  const authorization = headers.get("authorization");
+  if (!authorization || authorization.length > 32_768 || !/^Bearer [^\s]+$/i.test(authorization)) return undefined;
+  const account = headers.get("chatgpt-account-id");
+  if (account !== null && !validId(account)) return undefined;
+  return digest("caller-credential", JSON.stringify([authorization.slice(7), account]));
+}
+
+/**
+ * Whether two accepted observations describe the same owner.
+ *
+ * A proven stable user may present a refreshed credential. Without that proof on BOTH sides the
+ * only continuity evidence left is the credential itself, because a workspace id is shared by
+ * everyone in the organization and would otherwise let one member rebind another session.
+ */
+function sameOwnerIdentity(prior: ContextSessionOwner, next: ContextSessionOwner): boolean {
+  if (prior.kind !== next.kind) return false;
+  if (prior.physicalIdentity !== next.physicalIdentity) return false;
+  return prior.userIdentity !== undefined && next.userIdentity !== undefined
+    ? prior.userIdentity === next.userIdentity
+    : prior.callerCredentialIdentity === next.callerCredentialIdentity;
+}
+
+function remove(key: string): void {
+  const prior = owners.get(key);
+  if (!prior) return;
+  owners.delete(key);
+  totalBytes -= prior.bytes;
+}
+
+function sweep(now: number): void {
+  for (const [key, entry] of owners) {
+    if (now < entry.touchedAt || now - entry.touchedAt >= TTL_MS) remove(key);
+  }
+}
+
+/** Called only after a model attempt was accepted by its actual destination. */
+export function recordContextSessionOwner(
+  principalId: string | undefined, inboundHeaders: Headers, destination: string, auth: CodexAuthContext,
+  outboundHeaders: Headers, substituteMainCredential: boolean, now = Date.now(),
+): void {
+  // Ownership is partitioned per admission principal. Without one there is no caller identity to
+  // own anything, so nothing is recorded rather than creating an entry any local process matches.
+  if (!principalId || !Number.isFinite(now)) return;
+  // A malformed explicit parent must not fall back to an unrelated local session.
+  const root = inboundHeaders.get("x-codex-parent-thread-id") ?? inboundHeaders.get("session-id");
+  if (!validId(root)) return;
+  const destinationKey = destinationIdentity(destination);
+  const credential = callerCredentialIdentity(outboundHeaders);
+  if (!destinationKey || !credential) return;
+  const physical = physicalIdentity(outboundHeaders);
+  const user = stableUserIdentity(outboundHeaders);
+  if (user.conflict) {
+    // An accepted credential naming two different users is evidence of nobody. Whatever entry
+    // this session already had stops being trustworthy at that moment.
+    markContextSessionAmbiguous(principalId, root, now);
+    return;
+  }
+  let owner: ContextSessionOwner;
+  if (auth.kind !== "main" || substituteMainCredential) {
+    if (!physical) return;
+    if (auth.kind !== "main" && (!validId(auth.accountId)
+      || auth.chatgptAccountId !== outboundHeaders.get("chatgpt-account-id"))) return;
+    // Direct proxy-bearer substitution has no token snapshot in its `main` context;
+    // its accepted outbound identity is still evidence for the stored main slot.
+    owner = { kind: "stored", accountId: auth.kind === "main" ? MAIN_CODEX_ACCOUNT_ID : auth.accountId,
+      physicalIdentity: physical, ...(user.identity ? { userIdentity: user.identity } : {}),
+      callerCredentialIdentity: credential, ambiguous: false };
+  } else {
+    owner = { kind: "caller", ...(physical ? { physicalIdentity: physical } : {}),
+      ...(user.identity ? { userIdentity: user.identity } : {}),
+      callerCredentialIdentity: credential, ambiguous: false };
+  }
+  sweep(now);
+  const key = digest("root-session", `${principalId}\u0000${root}`);
+  const prior = owners.get(key);
+  if (prior) {
+    // Same workspace, different person is exactly the case a workspace id cannot see, and a
+    // credential proving nobody must not inherit an entry just by sharing that id.
+    if (prior.owner.ambiguous || prior.destination !== destinationKey
+      || !sameOwnerIdentity(prior.owner, owner)) {
+      owner = { ...prior.owner, ambiguous: true };
+    }
+  }
+  const ownerDestination = prior?.destination ?? destinationKey;
+  const bytes = Buffer.byteLength(JSON.stringify([key, ownerDestination, owner]), "utf8");
+  remove(key);
+  owners.set(key, { owner: Object.freeze(owner), destination: ownerDestination, touchedAt: now, bytes });
+  totalBytes += bytes;
+  while (owners.size > MAX_ENTRIES || totalBytes > MAX_BYTES) {
+    const oldest = owners.keys().next().value;
+    if (oldest === undefined) break;
+    remove(oldest);
+  }
+}
+
+/** Missing/expired/evicted ownership is unknown; never infer it from active routing. */
+export function getContextSessionOwner(
+  principalId: string | undefined, sessionId: string, destination: string, now = Date.now(),
+): ContextSessionOwner | undefined {
+  if (!principalId || !validId(sessionId) || !Number.isFinite(now)) return undefined;
+  const destinationKey = destinationIdentity(destination);
+  if (!destinationKey) return undefined;
+  sweep(now);
+  const key = digest("root-session", `${principalId}\u0000${sessionId}`);
+  const entry = owners.get(key);
+  if (!entry || entry.destination !== destinationKey) return undefined;
+  owners.delete(key);
+  entry.touchedAt = now;
+  owners.set(key, entry);
+  return entry.owner;
+}
+
+/** Compare only already-materialized headers; this function never reads credentials. */
+export function contextSessionOwnerMatches(owner: ContextSessionOwner, headers: Headers): boolean {
+  if (owner.ambiguous) return false;
+  const user = stableUserIdentity(headers);
+  if (user.conflict) return false;
+  if (owner.physicalIdentity !== physicalIdentity(headers)) return false;
+  if (owner.userIdentity !== user.identity) return false;
+  // A stored credential was minted by this proxy for the account it selected, so a proven user
+  // may present a refreshed token. A caller-supplied bearer is not ours: it becomes this
+  // session credential only when a model turn was accepted with it, so history has to present
+  // exactly that credential rather than any token carrying the same claims.
+  return owner.kind === "stored" && owner.userIdentity !== undefined
+    ? true
+    : owner.callerCredentialIdentity === callerCredentialIdentity(headers);
+}
+
+/** Poison an entry whose accepted evidence stopped being coherent. */
+function markContextSessionAmbiguous(principalId: string, root: string | null, now: number): void {
+  if (!validId(root)) return;
+  const key = digest("root-session", principalId + "\u0000" + root);
+  const prior = owners.get(key);
+  if (!prior || prior.owner.ambiguous) return;
+  owners.set(key, { ...prior, owner: Object.freeze({ ...prior.owner, ambiguous: true }), touchedAt: now });
+}
+
+export function clearContextSessionOwnersForTests(): void {
+  owners.clear(); totalBytes = 0;
+}