@bitkyc08/opencodex 2.52.0 → 2.53.0

package/src/server/responses/encrypted-payload.ts

@@ -200,6 +200,45 @@ export const AGENT_MESSAGE_ROUTING_ENVELOPE = /(?:^|\n)Message Type\s*:\s*(?:NEW
 // envelope stripper below.
 export const AGENT_MESSAGE_CONTROL_PREAMBLE = /(?:^|\n)\[CXC-[A-Z0-9-]+\][^\n]*(?:\n(?!\n|Message Type\s*:)[^\n]*)*(?=\n{2,}|\nMessage Type\s*:|$)/gi;
 
+export const MAX_AGENT_TASK_ENCRYPTED_PARTS = 32;
+export const MAX_AGENT_TASK_CIPHERTEXT_BYTES = 2 * 1024 * 1024;
+
+/** Detection only: joining fragments never authorizes recovery or proves authenticity. */
+function splitFernetParts(content: unknown[]): Set<object> {
+  const protectedParts = new Set<object>();
+  let run: Array<{ part: object; text: string }> = [];
+  let bytes = 0;
+  let overLimit = false;
+  const finish = (): void => {
+    if (!overLimit && run.length > 1
+      && run.every(({ text }) => !isStructurallyValidFernetToken(text))
+      && isStructurallyValidFernetToken(run.map(({ text }) => text).join(""))) {
+      for (const { part } of run) protectedParts.add(part);
+    }
+    run = [];
+    bytes = 0;
+    overLimit = false;
+  };
+  for (const part of content) {
+    if (!part || typeof part !== "object" || (part as { type?: unknown }).type !== "encrypted_content"
+      || typeof (part as { encrypted_content?: unknown }).encrypted_content !== "string") {
+      finish();
+      continue;
+    }
+    if (overLimit) continue;
+    const text = (part as { encrypted_content: string }).encrypted_content;
+    bytes += Buffer.byteLength(text);
+    if (run.length >= MAX_AGENT_TASK_ENCRYPTED_PARTS || bytes > MAX_AGENT_TASK_CIPHERTEXT_BYTES) {
+      overLimit = true;
+      run = [];
+      continue;
+    }
+    run.push({ part, text });
+  }
+  finish();
+  return protectedParts;
+}
+
 export function hasUnreadableEncryptedAgentTask(input: unknown): boolean {
   if (!Array.isArray(input)) return false;
 
@@ -222,7 +261,8 @@ export function hasUnreadableEncryptedAgentTask(input: unknown): boolean {
   const content = (item as { content?: unknown }).content;
   if (!Array.isArray(content)) return false;
 
-  let hasFernetTask = false;
+  const fragmentParts = splitFernetParts(content);
+  let hasFernetTask = fragmentParts.size > 0;
   const readableParts: string[] = [];
   for (const part of content) {
     if (!part || typeof part !== "object") continue;
@@ -238,6 +278,7 @@ export function hasUnreadableEncryptedAgentTask(input: unknown): boolean {
       continue;
     }
 
+    if (fragmentParts.has(part)) continue;
     const runs = fernetTokenRuns(record.encrypted_content);
     if (runs.length > 0) hasFernetTask = true;
     readableParts.push(textWithoutFernetRuns(record.encrypted_content, runs));
@@ -282,6 +323,7 @@ export function hasEncryptedContentPart(content: unknown): boolean {
 export function sanitizeEncryptedContentInPlace(input: unknown): number {
   if (!Array.isArray(input)) return 0;
   let rewritten = 0;
+  const protectedFragments = new WeakSet<object>();
   type VisitFrame =
     | { kind: "visit"; node: unknown }
     | { kind: "array"; node: unknown[]; index: number }
@@ -293,6 +335,7 @@ export function sanitizeEncryptedContentInPlace(input: unknown): number {
     const frame = stack.pop()!;
     if (frame.kind === "visit") {
       if (Array.isArray(frame.node)) {
+        for (const part of splitFernetParts(frame.node)) protectedFragments.add(part);
         stack.push({ kind: "array", node: frame.node, index: 0 });
       } else if (frame.node && typeof frame.node === "object") {
         stack.push({ kind: "object", values: Object.values(frame.node), index: 0 });
@@ -309,7 +352,7 @@ export function sanitizeEncryptedContentInPlace(input: unknown): number {
         && typeof (child as { encrypted_content?: unknown }).encrypted_content === "string"
       ) {
         const payload = (child as { encrypted_content: string }).encrypted_content;
-        if (!looksLikeBackendCiphertext(payload)) {
+        if (!protectedFragments.has(child) && !looksLikeBackendCiphertext(payload)) {
           const parts = encryptedSlotParts(payload);
           frame.node.splice(frame.index, 1, ...parts);
           rewritten += 1;

package/src/server/responses/ws-upstream.ts

@@ -179,5 +179,8 @@ export function codexWsUpstreamFetch(
   } catch {
     return sseFallback(url, init);
   }
-  return codexWsExchange({ session, url, init, prepared, sseFallback, onQuota, beforeDispatch });
+  return codexWsExchange({
+    session, url, init, prepared, sseFallback, onQuota, beforeDispatch,
+    bunVersion: typeof runtime === "string" ? runtime : runtime.version,
+  });
 }

package/src/server/responses-self-named-namespace-scrub.ts

@@ -115,10 +115,8 @@ export function collectSelfNamedNamespaceScrubAuthorization(
  * `None | "" | "functions"` as the default namespace; anything else is concatenated into a flat
  * name before routing. A backend answer of `{ name: "exec", namespace: "exec" }` therefore
  * becomes `execexec`, which no client tool matches, and Codex re-issues the same call forever.
- * The malformed Spark shape is scrubbed only when the current turn authorized a bare custom tool
+ * The malformed shape is scrubbed only when the current turn authorized a bare custom tool
  * with that name. A genuine namespaced tool may intentionally use the same namespace and name.
- * The adapter fix that stops provoking the answer lives in `stripSparkCompatibility`; this is the
- * belt to that suspender.
  */
 export function scrubSelfNamedToolCallNamespace(
   value: unknown,

package/src/server/responses-undeclared-tool-guard.ts

@@ -106,7 +106,7 @@ function addWireToolName(
   }
   // `exec` is the one name that also switches on nested-helper normalization, so a bare alias
   // for a namespaced MCP tool would silently authorize `exec_command`/`shell_command`/
-  // `apply_patch` the request never declared. Every other inner name keeps the bare alias.
+  // `apply_patch`/`view_image` the request never declared. Every other inner name keeps the bare alias.
   if (name !== CODE_MODE_EXEC_TOOL_NAME) names.add(name);
 }
 

package/src/server/search.ts

@@ -15,6 +15,7 @@ import {
   cooldownErrorResponse,
   CodexAuthContextError,
   CodexMainProfileDrainingError,
+  CodexModelAvailabilityError,
   CodexPoolAuthenticationError,
   CodexThreadAffinityExpiredError,
 } from "../codex/auth-context";
@@ -39,6 +40,7 @@ import type { RequestLogContext } from "./request-log";
 import { codexLogAccountId, decodeRequestErrorResponse } from "./responses";
 import type { AdmissionLease } from "../lib/admission";
 import { codexAccountSelectionForTurn } from "./lifecycle";
+import { codexModelAvailabilityErrorResponse } from "./responses/codex-auth-error";
 
 /**
  * Default TOTAL deadline for one search relay. alpha/search is non-streaming JSON — response
@@ -143,6 +145,7 @@ export async function handleSearch(
       console.error(`[search] Pool account ${safeAccountLabel} token failed; reauthentication required`);
       return formatErrorResponse(401, "authentication_error", "Selected Codex account needs reauthentication");
     }
+    if (err instanceof CodexModelAvailabilityError) return codexModelAvailabilityErrorResponse(err);
     if (err instanceof CodexPoolAuthenticationError) return formatErrorResponse(401, "authentication_error", err.message);
     throw err;
   }

package/src/server/sse-payload-rewrite.ts

@@ -1,4 +1,5 @@
 import type { TranslatorBudget } from "../lib/translator-budget";
+import { Buffer } from "node:buffer";
 
 /**
  * Shared client-facing SSE payload rewrite shell.
@@ -37,18 +38,21 @@ export function payloadRewriteAsBlockRewrite(rewrite: SsePayloadRewrite): SseBlo
 export function composeSseBlockRewrites(...rewrites: SseBlockRewrite[]): SseBlockRewrite {
   const active = rewrites.filter(Boolean);
   if (active.length === 0) return Object.assign((block: string) => [block], {});
+  let disposed = false;
   const composed: SseBlockRewrite = (block: string) => {
     let blocks: readonly string[] = [block];
     for (const rewrite of active) {
       const next: string[] = [];
-      for (const current of blocks) next.push(...rewrite(current));
+      for (const current of blocks) {
+        if (disposed) return [];
+        next.push(...rewrite(current));
+      }
       blocks = next;
     }
     return blocks;
   };
   // Child disposal is part of the contract: one idempotent disposer for the
   // whole chain, so relay teardown never leaks a nested collector.
-  let disposed = false;
   composed.dispose = () => {
     if (disposed) return;
     disposed = true;
@@ -70,10 +74,116 @@ export function nextSseBlock(buffer: string): { block: string; delimiter: string
   };
 }
 
+/**
+ * Incremental form of nextSseBlock for bounded relays. The scan cursor visits only new text and
+ * consuming a block subtracts its byte length instead of recounting the remaining suffix.
+ * Old/new buffer overlap still requires admission before either append or consumption commits.
+ * Call compact before yielding to stop retaining an already-consumed prefix across pulls.
+ */
+export function createSseBlockBuffer(
+  budget: TranslatorBudget,
+  assertAppendSize?: (bytes: number) => void,
+): {
+  append(fragment: string): void;
+  next(): { block: string; delimiter: string } | null;
+  tail(): string;
+  compact(): void;
+  clear(): void;
+} {
+  const scope = { kind: "live_transient" as const };
+  let buffer = "";
+  let offset = 0;
+  let scanOffset = 0;
+  let bufferBytes = 0;
+
+  const compact = (): void => {
+    if (offset === 0) return;
+    buffer = buffer.slice(offset);
+    scanOffset -= offset;
+    offset = 0;
+  };
+
+  return {
+    append(fragment) {
+      if (!fragment) return;
+      let fragmentBytes = Buffer.byteLength(fragment, "utf8");
+      // Decoder output never splits a surrogate pair, but keep the helper exact for string callers.
+      const last = buffer.charCodeAt(buffer.length - 1);
+      const first = fragment.charCodeAt(0);
+      if (offset < buffer.length && last >= 0xd800 && last <= 0xdbff && first >= 0xdc00 && first <= 0xdfff) {
+        fragmentBytes -= 2;
+      }
+      const nextBytes = bufferBytes + fragmentBytes;
+      assertAppendSize?.(nextBytes);
+      const reservation = budget.reserveTransient(nextBytes, scope);
+      try {
+        compact();
+        buffer += fragment;
+        reservation.commitRetained();
+        budget.releaseRetained(bufferBytes, scope);
+        bufferBytes = nextBytes;
+      } catch (error) {
+        reservation.release();
+        throw error;
+      }
+    },
+    next() {
+      for (;;) {
+        const newline = buffer.indexOf("\n", scanOffset);
+        if (newline < 0) {
+          scanOffset = buffer.length;
+          return null;
+        }
+        let end = newline + 1;
+        if (buffer[end] === "\r") end += 1;
+        if (end === buffer.length) {
+          // Keep the candidate first newline until its possible blank-line delimiter arrives.
+          scanOffset = newline;
+          return null;
+        }
+        if (buffer[end] !== "\n") {
+          scanOffset = newline + 1;
+          continue;
+        }
+        end += 1;
+        const start = newline > offset && buffer[newline - 1] === "\r" ? newline - 1 : newline;
+        const block = buffer.slice(offset, start);
+        const delimiter = buffer.slice(start, end);
+        const nextBytes = bufferBytes - Buffer.byteLength(block, "utf8") - delimiter.length;
+        const reservation = budget.reserveTransient(nextBytes, scope);
+        reservation.commitRetained();
+        budget.releaseRetained(bufferBytes, scope);
+        bufferBytes = nextBytes;
+        offset = end;
+        scanOffset = end;
+        if (offset === buffer.length) {
+          buffer = "";
+          offset = 0;
+          scanOffset = 0;
+        }
+        return { block, delimiter };
+      }
+    },
+    tail: () => buffer.slice(offset),
+    compact,
+    clear() {
+      budget.releaseRetained(bufferBytes, scope);
+      buffer = "";
+      offset = 0;
+      scanOffset = 0;
+      bufferBytes = 0;
+    },
+  };
+}
+
 /** Join all data lines from one SSE event according to the event-stream field rules. */
 export function sseDataPayload(block: string): string | null {
   const data: string[] = [];
   for (const line of block.split(/\r?\n/)) {
+    if (line === "data") {
+      data.push("");
+      continue;
+    }
     if (!line.startsWith("data:")) continue;
     const value = line.slice(5);
     data.push(value.startsWith(" ") ? value.slice(1) : value);
@@ -88,7 +198,7 @@ export function replaceSseDataPayload(block: string, payload: string): string {
   const rewritten: string[] = [];
   let replaced = false;
   for (const line of lines) {
-    if (!line.startsWith("data:")) {
+    if (line !== "data" && !line.startsWith("data:")) {
       rewritten.push(line);
       continue;
     }
@@ -137,8 +247,7 @@ export function relaySseWithBlockRewrite(
   const reader = body.getReader();
   const decoder = new TextDecoder();
   const encoder = new TextEncoder();
-  let buffer = "";
-  let bufferBytes = 0;
+  const buffer = createSseBlockBuffer(translatorBudget);
   // Relays have several independent teardown paths; disposal is exactly once.
   let disposed = false;
   let cancelled = false;
@@ -148,40 +257,16 @@ export function relaySseWithBlockRewrite(
     try { rewrite.dispose?.(); } catch { /* teardown must not throw */ }
   };
 
-  const appendBuffer = (fragment: string): void => {
-    if (!fragment) return;
-    const nextBytes = bufferBytes + encoder.encode(fragment).byteLength;
-    const reservation = translatorBudget.reserveTransient(nextBytes, { kind: "live_transient" });
-    try {
-      buffer += fragment;
-      reservation.commitRetained();
-      translatorBudget.releaseRetained(bufferBytes, { kind: "live_transient" });
-      bufferBytes = nextBytes;
-    } catch (error) {
-      reservation.release();
-      throw error;
-    }
-  };
-
-  const replaceBuffer = (next: string): void => {
-    const nextBytes = encoder.encode(next).byteLength;
-    const reservation = translatorBudget.reserveTransient(nextBytes, { kind: "live_transient" });
-    reservation.commitRetained();
-    buffer = next;
-    translatorBudget.releaseRetained(bufferBytes, { kind: "live_transient" });
-    bufferBytes = nextBytes;
-  };
-
   const enqueueText = (
     controller: ReadableStreamDefaultController<Uint8Array>,
     text: string,
   ): void => {
-    const bytes = encoder.encode(text).byteLength;
+    const bytes = Buffer.byteLength(text, "utf8");
     const reservation = translatorBudget.reserveTransient(bytes, { kind: "live_transient" });
     try {
       const encoded = encoder.encode(text);
-      reservation.commitRetained();
       controller.enqueue(encoded);
+      reservation.commitRetained();
       translatorBudget.releaseRetained(bytes, { kind: "live_transient" });
     } catch (error) {
       reservation.release();
@@ -189,35 +274,33 @@ export function relaySseWithBlockRewrite(
     }
   };
 
-  const releaseBuffer = (): void => {
-    translatorBudget.releaseRetained(bufferBytes, { kind: "live_transient" });
-    buffer = "";
-    bufferBytes = 0;
-  };
-
   const emitProcessedBlocks = (
     controller: ReadableStreamDefaultController<Uint8Array>,
     flushFinal = false,
   ): number => {
     let emitted = 0;
-    let next: { block: string; delimiter: string; rest: string } | null;
-    while ((next = nextSseBlock(buffer))) {
-      replaceBuffer(next.rest);
-      for (const outBlock of rewrite(next.block)) {
+    let next: { block: string; delimiter: string } | null;
+    while (!cancelled && (next = buffer.next())) {
+      const outBlocks = rewrite(next.block);
+      if (cancelled) return emitted;
+      for (const outBlock of outBlocks) {
         enqueueText(controller, outBlock + next.delimiter);
         emitted += 1;
       }
     }
-    if (flushFinal && buffer.length > 0) {
-      const tailBlocks = rewrite(buffer);
+    buffer.compact();
+    const tail = flushFinal ? buffer.tail() : "";
+    if (tail.length > 0) {
+      const tailBlocks = rewrite(tail);
+      if (cancelled) return emitted;
       // A trailing fragment has no delimiter of its own; multiple emitted
       // blocks must still be framed as separate events (#893 review).
-      const tailDelimiter = buffer.includes("\r\n") ? "\r\n\r\n" : "\n\n";
+      const tailDelimiter = tail.includes("\r\n") ? "\r\n\r\n" : "\n\n";
       for (let i = 0; i < tailBlocks.length; i++) {
         enqueueText(controller, tailBlocks[i]! + (i < tailBlocks.length - 1 ? tailDelimiter : ""));
         emitted += 1;
       }
-      releaseBuffer();
+      buffer.clear();
     }
     return emitted;
   };
@@ -236,18 +319,20 @@ export function relaySseWithBlockRewrite(
           // after its disposal (#893 review).
           if (cancelled) return;
           if (done) {
-            appendBuffer(decoder.decode());
+            buffer.append(decoder.decode());
             emitProcessedBlocks(controller, true);
-            releaseBuffer();
+            if (cancelled) return;
+            buffer.clear();
             disposeRewrite();
             controller.close();
             return;
           }
-          appendBuffer(decoder.decode(value, { stream: true }));
-          if (emitProcessedBlocks(controller) > 0) return;
+          buffer.append(decoder.decode(value, { stream: true }));
+          const emitted = emitProcessedBlocks(controller);
+          if (cancelled || emitted > 0) return;
         }
       } catch (error) {
-        releaseBuffer();
+        buffer.clear();
         disposeRewrite();
         // Cancelling one tee branch waits for its sibling. Surface the failure
         // now so downstream can abort upstream and release the inspection branch.
@@ -257,7 +342,7 @@ export function relaySseWithBlockRewrite(
     },
     cancel(reason) {
       cancelled = true;
-      releaseBuffer();
+      buffer.clear();
       disposeRewrite();
       reader.cancel(reason).catch(() => {});
     },

package/src/server/ws-bridge.ts

@@ -8,6 +8,7 @@ import type { DataPlaneAdmission } from "./auth-cors";
 import type { AdmissionLease, AdmissionReservation } from "../lib/admission";
 import { BoundedSseFrameBuffer } from "./sse-frame-buffer";
 import { safeResponseHeaders } from "./safe-response-headers";
+import type { AudioSocketTarget } from "./audio-dictation";
 
 export { safeResponseHeaders } from "./safe-response-headers";
 
@@ -31,14 +32,28 @@ export interface WsData {
   /** Fixed-size logical session lane derived at the HTTP upgrade boundary. */
   sessionLaneId?: string;
   /** Discriminator: Responses reframing vs transparent live/realtime sideband relay. */
-  kind?: "responses" | "live-sideband";
+  kind?: "responses" | "live-sideband" | "remote-workspace-agent";
+  remoteWorkspaceConnection?: { receive(raw: string | Uint8Array): void };
+  remoteWorkspaceOpen?: (socket: ServerWebSocket<WsData>) => { receive(raw: string | Uint8Array): void };
+  remoteWorkspaceClose?: () => void;
   liveUpstream?: WebSocket;
   liveUpstreamUrl?: string;
   liveUpstreamHeaders?: Record<string, string>;
+  liveUpstreamProtocols?: string[];
+  liveValidateFrame?: AudioSocketTarget["validateFrame"];
+  liveFinish?: AudioSocketTarget["finish"];
+  liveOutcome?: number | "timeout" | "connect_error";
+  liveMaxSessionMs?: number;
+  liveConnectTimer?: ReturnType<typeof setTimeout>;
+  liveSessionTimer?: ReturnType<typeof setTimeout>;
+  liveAbortSignal?: AbortSignal;
+  liveAbortListener?: () => void;
   livePending?: Array<string | Buffer>;
   /** Total encoded bytes retained in livePending while the upstream connects. */
   livePendingBytes?: number;
   liveOpened?: boolean;
+  /** Owns captured frames and terminal state until the downstream relay attaches. */
+  liveUpstreamHandoff?: LiveSidebandUpstreamHandoff;
   /** Once teardown starts, ignore new client frames until the upstream closes. */
   liveClosing?: boolean;
   /** Schedules one bounded close retry without surrendering native-main ownership. */
@@ -48,6 +63,25 @@ export interface WsData {
   admissionLease?: AdmissionReservation<ServerWebSocket<WsData>>;
 }
 
+export interface LiveSidebandUpstreamFailure {
+  status: number;
+  code: string;
+  message: string;
+  closeCode?: number;
+  closeReason?: string;
+}
+
+export type LiveSidebandUpstreamTakeover =
+  | { ok: true; frames: Array<string | Buffer> }
+  | { ok: false; failure: LiveSidebandUpstreamFailure };
+
+export interface LiveSidebandUpstreamHandoff {
+  /** Observe failure before the downstream upgrade without ending capture. */
+  failure(): LiveSidebandUpstreamFailure | undefined;
+  /** Atomically ends capture and transfers buffered frames or terminal state. */
+  take(): LiveSidebandUpstreamTakeover;
+}
+
 /**
  * Build the Responses WebSocket upgrade payload.
  *