@bitkyc08/opencodex 2.52.0-preview.20260911 → 2.52.0

package/src/server/index.ts

@@ -24,6 +24,7 @@ import { grokDefaultReasoningEffort } from "../grok/effort";
 import { flushConfigDirHardening } from "../config/paths";
 import { migrateStartupSubagentModels } from "./subagent-models-startup";
 import { migrateStartupXaiResponses } from "./xai-responses-startup";
+import { migrateStartupZaiResponses } from "./zai-responses-startup";
 import { reconcileOAuthProviders } from "../oauth";
 import { withCatalogWriteSerialization } from "../codex/catalog-write-serialization";
 import { invalidateCodexModelsCacheWithPermit } from "../codex/catalog/sync";
@@ -192,6 +193,7 @@ import { anthropicErrorResponse } from "../claude/outbound";
 import { buildDesktop3pRegistry, generateDesktop3pModels } from "../claude/desktop-3p";
 import { buildDesktopDiscoveryInputs } from "../claude/desktop-discovery-inputs";
 import { runClaudeAuthModeMigration } from "../claude/auth-mode-migration";
+import { runRetiredCodexModelMigration } from "../codex/retired-model-migration";
 import {
   bindNativeMainStartupLifecycle,
   blockNativeMainStartupForUnownedServiceHome,
@@ -203,6 +205,8 @@ import {
 import { handleImages } from "./images";
 import { handleLive, logLiveSidebandFrame, parseLiveSidebandTarget, resolveLiveSidebandUpgrade } from "./live";
 import { handleSearch } from "./search";
+import { handleContextHistory } from "./context-history";
+import { codexCompatibleUrl, contextEndpoint, contextRelayActivated } from "../codex/context-compat";
 import { fetchAllModels, handleManagementAPI, VERSION, type ManagementApiDeps } from "./management-api";
 import {
   createManagementSessionControl,
@@ -666,7 +670,7 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
   // Reconcile disk-backed presets first: it replaces provider rows and must not undo
   // an in-memory wire upgrade when that upgrade's persistence is temporarily unavailable.
   reconcileOAuthProviders(startupConfig);
-  const config = migrateStartupXaiResponses(startupConfig);
+  const config = migrateStartupZaiResponses(migrateStartupXaiResponses(startupConfig));
   warnAgentTaskRecoveryStartup(config);
   setLiveStateStoreConfig(config);
   applyProxyEnv(config);
@@ -682,24 +686,11 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
   // indistinguishable from "never chose". Pin those to subscription once so an upgrade
   // never silently moves a deliberate subscriber onto proxy.
   if (runClaudeAuthModeMigration(config)) saveConfig(config);
-  // Sidecar model migration (KST 2026-07-10 06:00 = UTC 2026-07-09 21:00): auto-migrate the old
-  // gpt-5.4-mini default to gpt-5.6-luna for both search and vision sidecars. Only touches configs
-  // still on the old default — explicit user choices are preserved.
-  {
-    const SIDECAR_MIGRATION_CUTOFF = Date.UTC(2026, 6, 9, 21, 0); // July 9 21:00 UTC = KST July 10 06:00
-    if (Date.now() >= SIDECAR_MIGRATION_CUTOFF) {
-      let migrated = false;
-      if (config.webSearchSidecar?.model === "gpt-5.4-mini") {
-        config.webSearchSidecar = { ...config.webSearchSidecar, model: "gpt-5.6-luna" };
-        migrated = true;
-      }
-      if (config.visionSidecar?.model === "gpt-5.4-mini") {
-        config.visionSidecar = { ...config.visionSidecar, model: "gpt-5.6-luna" };
-        migrated = true;
-      }
-      if (migrated) saveConfig(config);
-    }
-  }
+  // Retired Codex-login models: a stored gpt-5.4-mini is a guaranteed 404 for the search and
+  // vision sidecars and for pool warmup, so it moves to gpt-5.6-luna. Extracted so the rule is
+  // testable on its own; see src/codex/retired-model-migration.ts for why exact equality also
+  // rewrites an explicit choice.
+  if (runRetiredCodexModelMigration(config)) saveConfig(config);
   // Resolve unattended service-home authority before any Codex lock, cache, owner,
   // journal, or credential path. Both positive foreign evidence and an unprovable
   // ownership state are non-authority.
@@ -856,6 +847,7 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
     if (path === "/v1/messages" || path === "/v1/chat/completions") return req.method === "POST";
     if (path === "/v1/messages/count_tokens") return req.method === "POST";
     if (path === "/v1/alpha/search") return req.method === "POST";
+    if (contextEndpoint(path)) return req.method === "POST";
     if (path === "/v1/images/generations" || path === "/v1/images/edits") {
       return req.method === "POST";
     }
@@ -1102,7 +1094,7 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
       // The unauthenticated loopback listener (#1102) serves a fixed allowlist and nothing
       // else. Rejecting here, before any handler runs, is what keeps the surface from growing
       // silently when a route is added below.
-      if (ingress === "unauthenticated-loopback" && !loopbackRouteAllowed(new URL(req.url), req)) {
+      if (ingress === "unauthenticated-loopback" && !loopbackRouteAllowed(codexCompatibleUrl(req.url), req)) {
         return withCors(
           formatErrorResponse(404, "not_found", `Unknown endpoint: ${req.method} ${new URL(req.url).pathname}`),
           req,
@@ -1111,7 +1103,7 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
       }
       // Tailscale Serve terminates only on this separately bound loopback socket. Reject before
       // dispatch so no data, readiness, health, WebSocket, or unknown-static handler can run.
-      if (ingress === "hub-management" && !managementIngressRouteAllowed(new URL(req.url), req)) {
+      if (ingress === "hub-management" && !managementIngressRouteAllowed(codexCompatibleUrl(req.url), req)) {
         return withCors(
           formatErrorResponse(404, "not_found", `Unknown endpoint: ${req.method} ${new URL(req.url).pathname}`),
           req,
@@ -1124,7 +1116,7 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
       // same code path a plain loopback bind has always taken — Host-header check included.
       // Routing, provider selection and response bodies keep using `config`.
       const policy: RequestPolicyView = ingress === "unauthenticated-loopback" ? loopbackPolicy() : config;
-      const url = new URL(req.url);
+      const url = codexCompatibleUrl(req.url);
       markActivity(`${req.method} ${url.pathname}`);
 
       // Readiness is exact-GET on the literal /readyz path. Compare the DECODED
@@ -1966,6 +1958,34 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
         }), req, policy);
       }
 
+      if (contextEndpoint(url.pathname) !== undefined && req.method === "POST" && contextRelayActivated()) {
+        // No timeout disable here. The relay is a bounded JSON round trip that owns one deadline
+        // from entry; removing the idle timeout first would let an unfinished body hold an
+        // admitted turn slot indefinitely, before that deadline ever starts.
+        if (isDraining()) {
+          return drainingResponse(req, policy);
+        }
+        const admission = resolveApiAuth(req, policy);
+        if (!admission) return withCors(formatErrorResponse(401, "authentication_error", "opencodex API key required"), req, policy);
+        if (!isAllowedRequestOrigin(req, policy)) {
+          return withCors(formatErrorResponse(403, "origin_rejected", "cross-origin data-plane request blocked"), req, policy);
+        }
+        const start = Date.now();
+        const requestId = nextRequestLogId(start);
+        const logCtx: RequestLogContext = {
+          model: "context_history",
+          provider: "unknown",
+          ...admissionFields(admission),
+        };
+        return runAdmittedHttpTurn(req, policy, async turnAdmissionLease => {
+          const response = await handleContextHistory(req, config, logCtx, contextEndpoint(url.pathname)!,
+            turnAdmissionLease, admission, () => resolveApiAuth(req, policy));
+          addFinalRequestLog(requestId, start, logCtx, response.status,
+            response.status === 499 ? { closeReason: "client_cancel" } : undefined);
+          return withCors(response, req, policy);
+        });
+      }
+
       if (url.pathname === "/v1/alpha/search" && req.method === "POST") {
         disableResponsesRequestTimeout(req, requestServer);
         if (isDraining()) {

package/src/server/live.ts

@@ -1,3 +1,4 @@
+import { codexCompatibleUrl } from "../codex/context-compat";
 /**
  * /v1/live and /v1/realtime/calls relay (issue #371).
  *
@@ -635,7 +636,7 @@ export async function handleLive(
     // Frameless API-shape call-create posts to `{base}/live` without the AVAS
     // query (openai/codex RealtimeCallClient, realtime_call.rs); only the
     // realtime/calls inbound shape keeps the legacy keyed AVAS endpoint.
-    url = new URL(req.url).pathname === "/v1/live"
+    url = codexCompatibleUrl(req.url).pathname === "/v1/live"
       ? forwardLiveUrl(relay.providerBaseUrl, /* usesBackendShape */ false)
       : keyedLiveUrl(relay.providerBaseUrl);
   }

package/src/server/management/agent-settings-routes.ts

@@ -948,10 +948,16 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
       const { parseDesktopProfile, reconcileDesktopProfile } = await import("../../claude/desktop-profile");
       const parsed = parseDesktopProfile(body.profile);
       const current = await buildClaudeDesktopState(config);
+      const availableRoutes = new Set(current.models.filter(item => item.available).map(item => item.route));
+      for (const route of Object.keys(parsed.assignments)) {
+        if (!current.profile.assignments[route] && !availableRoutes.has(route)) {
+          throw new Error(`현재 사용할 수 없는 모델은 추가할 수 없습니다: ${route}`);
+        }
+      }
       for (const model of current.models.filter(item => !item.available)) {
         const before = current.profile.assignments[model.route];
         const after = parsed.assignments[model.route];
-        if (JSON.stringify(before) !== JSON.stringify(after)) {
+        if (after !== undefined && JSON.stringify(before) !== JSON.stringify(after)) {
           throw new Error(`현재 사용할 수 없는 모델은 옮길 수 없습니다: ${model.route}`);
         }
       }

package/src/server/management/config-routes.ts

@@ -237,7 +237,7 @@ export async function syncEnabledClientIntegrations(
     },
     config,
     port,
-  }, ["mcode", "pi", "aside", "raycast"]));
+  }, ["mcode", "pi", "aside", "raycast", "omo", "cline"]));
 
   return out;
 }
@@ -820,8 +820,8 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
     if (body.vision && (body.vision.model !== undefined || body.vision.reasoning !== undefined)) {
       visionReasoningTouched = true;
       const model = typeof body.vision.model === "string"
-        ? (body.vision.model === "" ? "gpt-5.4-mini" : body.vision.model)
-        : (config.visionSidecar?.model || "gpt-5.4-mini");
+        ? (body.vision.model === "" ? "gpt-5.6-luna" : body.vision.model)
+        : (config.visionSidecar?.model || "gpt-5.6-luna");
       const sourceReasoning = body.vision.reasoning ?? config.visionSidecar?.reasoning;
       normalizedVisionReasoning = sourceReasoning === undefined
         ? undefined

package/src/server/management/grok-coupon-routes.ts

@@ -0,0 +1,287 @@
+/**
+ * Management API handlers for Grok quota reset coupons.
+ *
+ * Exposes inspection and consumption of Grok billing reset coupons via gRPC-Web
+ * to Grok ConsumerUiSvc upstream endpoints.
+ *
+ * Inherits management authentication from requireManagementAuth in management-api.ts.
+ * Lazy-loaded by handleGrokCouponRoutesOnDemand to keep startup fast and honor the
+ * core-lab boundary contract.
+ */
+
+import { jsonResponse } from "../auth-cors";
+import type { ManagementContext } from "./context";
+import { isCodexResetCreditOperationId } from "../../codex/reset-credit-recovery";
+import { getValidAccessSnapshotForAccount } from "../../oauth";
+import { listAccounts, captureOAuthAccountSelection } from "../../oauth/store";
+import {
+  getGrokRemainingResets,
+  redeemGrokResetCoupon,
+  type GrokResetCoupon,
+} from "../../grok/reset-coupons";
+import {
+  openGrokResetCouponOperation,
+  recordGrokResetCouponSettlement,
+  type GrokResetCouponOperationRecord,
+} from "../../grok/reset-coupon-ledger";
+
+export interface GrokResetCouponsResponse {
+  accountId: string;
+  tokens: Array<{
+    tokenId: string;
+    validityStart: string;
+    validityEnd: string;
+  }>;
+  remaining: number;
+}
+
+export interface GrokConsumeCouponRequestBody {
+  accountId?: string;
+  tokenId?: string;
+  operationId?: string;
+}
+
+function resolveTargetAccountId(requestedAccountId?: string): string {
+  if (requestedAccountId && requestedAccountId.trim() !== "") {
+    return requestedAccountId.trim();
+  }
+  const selection = captureOAuthAccountSelection("xai");
+  if (selection?.accountId) {
+    return selection.accountId;
+  }
+  const accounts = listAccounts("xai");
+  if (accounts.length > 0) {
+    return accounts[0].id;
+  }
+  throw new Error("No xAI account found or active");
+}
+
+export async function handleGrokCouponRoutes(ctx: ManagementContext): Promise<Response | null> {
+  const { url, req, config } = ctx;
+  const { pathname } = url;
+
+  if (pathname === "/api/grok/reset-coupons") {
+    if (req.method !== "GET") {
+      return jsonResponse({ error: "Method not allowed" }, 405, req, config);
+    }
+
+    const queryAccountId = url.searchParams.get("accountId") ?? undefined;
+    let accountId: string;
+    try {
+      accountId = resolveTargetAccountId(queryAccountId);
+    } catch (err) {
+      return jsonResponse(
+        { error: { code: "no_account", message: err instanceof Error ? err.message : String(err) } },
+        400,
+        req,
+        config,
+      );
+    }
+
+    let tokenSnapshot;
+    try {
+      tokenSnapshot = await getValidAccessSnapshotForAccount("xai", accountId, { requireUsableAccount: true });
+    } catch (err) {
+      return jsonResponse(
+        { error: { code: "auth_failed", message: "Failed to resolve valid xAI credentials for account" } },
+        401,
+        req,
+        config,
+      );
+    }
+
+    try {
+      const remainingResult = await getGrokRemainingResets({
+        accessToken: tokenSnapshot.accessToken,
+      });
+
+      const payload: GrokResetCouponsResponse = {
+        accountId,
+        tokens: remainingResult.tokens.map((t) => ({
+          tokenId: t.tokenId,
+          validityStart: t.validityStart,
+          validityEnd: t.validityEnd,
+        })),
+        remaining: remainingResult.tokens.length,
+      };
+
+      return jsonResponse(payload, 200, req, config);
+    } catch (err) {
+      return jsonResponse(
+        { error: { code: "upstream_error", message: err instanceof Error ? err.message : String(err) } },
+        502,
+        req,
+        config,
+      );
+    }
+  }
+
+  if (pathname === "/api/grok/reset-coupons/consume") {
+    if (req.method !== "POST") {
+      return jsonResponse({ error: "Method not allowed" }, 405, req, config);
+    }
+
+    let body: GrokConsumeCouponRequestBody;
+    try {
+      body = (await req.json()) as GrokConsumeCouponRequestBody;
+    } catch {
+      return jsonResponse({ error: { code: "invalid_json", message: "Invalid JSON body" } }, 400, req, config);
+    }
+
+    const { accountId: rawAccountId, tokenId: requestedTokenId, operationId } = body;
+
+    if (operationId !== undefined && !isCodexResetCreditOperationId(operationId)) {
+      return jsonResponse(
+        { error: { code: "invalid_operation_id", message: "operationId must be a valid UUIDv4" } },
+        400,
+        req,
+        config,
+      );
+    }
+
+    let accountId: string;
+    try {
+      accountId = resolveTargetAccountId(rawAccountId);
+    } catch (err) {
+      return jsonResponse(
+        { error: { code: "no_account", message: err instanceof Error ? err.message : String(err) } },
+        400,
+        req,
+        config,
+      );
+    }
+
+    let tokenSnapshot;
+    try {
+      tokenSnapshot = await getValidAccessSnapshotForAccount("xai", accountId, { requireUsableAccount: true });
+    } catch (err) {
+      return jsonResponse(
+        { error: { code: "auth_failed", message: "Failed to resolve valid xAI credentials for account" } },
+        401,
+        req,
+        config,
+      );
+    }
+
+    // Journaling and Idempotency settlement check
+    const effectiveOpId = operationId ?? crypto.randomUUID();
+    const opRecord = openGrokResetCouponOperation({
+      accountId,
+      tokenId: requestedTokenId,
+      operationId: effectiveOpId,
+    });
+
+    if (opRecord.kind === "replay") {
+      return jsonResponse(
+        {
+          code: opRecord.code,
+          replayed: true,
+          tokenId: opRecord.tokenId,
+          settledAt: opRecord.settledAt,
+        },
+        200,
+        req,
+        config,
+      );
+    }
+
+    if (opRecord.kind === "identity-mismatch") {
+      return jsonResponse(
+        {
+          error: {
+            code: "operation_id_owned_by_another_account",
+            message: "Operation ID was previously registered with a different account or token",
+          },
+        },
+        409,
+        req,
+        config,
+      );
+    }
+
+    if (opRecord.kind !== "execute") {
+      return jsonResponse(
+        {
+          error: {
+            code: opRecord.kind,
+            message: "Coupon ledger capacity or unavailable failure",
+          },
+        },
+        503,
+        req,
+        config,
+      );
+    }
+
+    let resolvedTokenId = requestedTokenId;
+    if (!resolvedTokenId) {
+      try {
+        const remaining = await getGrokRemainingResets({ accessToken: tokenSnapshot.accessToken });
+        if (!remaining.tokens || remaining.tokens.length === 0) {
+          recordGrokResetCouponSettlement({
+            operationId: effectiveOpId,
+            code: "no_coupons_available",
+            status: "failed",
+          });
+          return jsonResponse(
+            { error: { code: "no_coupons_available", message: "No reset coupons available to redeem" } },
+            400,
+            req,
+            config,
+          );
+        }
+        resolvedTokenId = remaining.tokens[0].tokenId;
+      } catch (err) {
+        return jsonResponse(
+          { error: { code: "fetch_resets_failed", message: err instanceof Error ? err.message : String(err) } },
+          502,
+          req,
+          config,
+        );
+      }
+    }
+
+    try {
+      const redeemResult = await redeemGrokResetCoupon({
+        accessToken: tokenSnapshot.accessToken,
+        tokenId: resolvedTokenId,
+      });
+
+      recordGrokResetCouponSettlement({
+        operationId: effectiveOpId,
+        tokenId: resolvedTokenId,
+        code: "redeemed",
+        status: "success",
+      });
+
+      return jsonResponse(
+        {
+          success: true,
+          code: "redeemed",
+          replayed: false,
+          tokenId: resolvedTokenId,
+          accountId,
+          operationId: effectiveOpId,
+        },
+        200,
+        req,
+        config,
+      );
+    } catch (err) {
+      recordGrokResetCouponSettlement({
+        operationId: effectiveOpId,
+        tokenId: resolvedTokenId,
+        code: "redeem_failed",
+        status: "failed",
+      });
+      return jsonResponse(
+        { error: { code: "redeem_failed", message: err instanceof Error ? err.message : String(err) } },
+        502,
+        req,
+        config,
+      );
+    }
+  }
+
+  return null;
+}

package/src/server/management/integration-routes.ts

@@ -16,6 +16,7 @@ import {
   asideJournalDeleteResponse, type AsideProfileRouteOptions,
 } from "./aside-profile-routes";
 import type { IntegrationIO } from "../../integrations/config-io";
+import { createClineIO } from "../../integrations/cline-io";
 import { matchesOperationResult } from "../../integrations/journal";
 import {
   INTEGRATION_CLIENT_IDS,
@@ -534,7 +535,11 @@ export async function handleIntegrationRoutes(ctx: ManagementContext): Promise<R
           undoable: (() => {
             if (snapshot === "expired") return false;
             if (newestByClient.get(operation.clientId) !== operation.opId) return false;
-            const current = currentConfigText(operation.configPath);
+            const current = operation.clientId === "cline" ? (() => {
+              const io = createClineIO(integrationMutationTestHooks?.io ?? store.io(), operation.configPath, store);
+              const read = io.readText(operation.configPath);
+              return read.kind === "text" ? read.text : read.kind === "missing" ? null : undefined;
+            })() : currentConfigText(operation.configPath);
             return current === undefined ? false : matchesOperationResult(operation, current);
           })(),
           /*