@bitkyc08/opencodex 2.53.0 → 2.54.0

package/src/server/responses/core.ts

@@ -158,9 +158,11 @@ import {
 import { resolveCopilotApiBaseUrl } from "../../oauth/github-copilot";
 import { buildWebSearchTool, planWebSearch, runWithWebSearch, shouldResolveOpenAiWebSearchSidecar } from "../../web-search";
 import {
-  createOllamaBridgeExecutor,
+  createPassthroughWebSearchBridgeExecutor,
   createPassthroughWebSearchBridgeStream,
   planPassthroughWebSearchBridge,
+  resolvePassthroughWebSearchBridgeAuth,
+  shouldResolveOpenAiPassthroughWebSearchBridge,
 } from "../../web-search/passthrough-bridge";
 import { buildImageTool, buildVideoTool, planImageBridge, planVideoBridge, runWithImageBridge, clampImageMaxRounds, IMAGE_GEN_TOOL_NAME, VIDEO_GEN_TOOL_NAME } from "../../images";
 import { describeImagesInPlace, isModelTextOnly, planVisionSidecar, resolveOpenAiVisionModel, shouldResolveOpenAiVisionSidecar, stripImagesInPlace } from "../../vision";
@@ -394,7 +396,7 @@ import type { EffectiveSubagentRoster, SpawnAgentSurface } from "../../codex/cat
 
 import { buildToolBridgeMaps, collabSurface, injectDeveloperMessage, multiAgentGuidanceText } from "./collaboration";
 import { mapCodexAuthContextErrorToResponse, nativeMainRefreshFailureResponse } from "./codex-auth-error";
-import { hasUnreadableEncryptedAgentTask, looksLikeBackendCiphertext, sanitizeEncryptedContentInPlace } from "./encrypted-payload";
+import { hasUnreadableEncryptedAgentTask, looksLikeBackendCiphertext, sanitizeEncryptedContentInPlace, stripAgentMessageCiphertextInPlace } from "./encrypted-payload";
 import { fetchWithHeaderTimeout, providerFetch, safeHostLabel, safeOriginLabel, storedPoolReplayDispatchNotifier, type ProviderFetchOptions } from "./fetch-helpers";
 import { classifyTransportFailureKind, transportErrorCode } from "../../lib/upstream-reachability";
 import {
@@ -4024,6 +4026,49 @@ async function handleResponsesInner(
     return unreadableEncryptedAgentTaskResponse(recoveryFailureReason);
   }
 
+  // The guard above asks whether the CURRENT worker task is readable, and it only inspects the
+  // tail item. An `agent_message` that mixes readable text with backend ciphertext answers
+  // "readable" to that question at every position, so it passed -- and then
+  // `normalizeRoutedAgentMessages` refused to lower it, because lowering requires every part to
+  // be representable. The raw Responses passthrough serialized the private item as it stood, so
+  // backend ciphertext and an item type only the Codex backend declares reached a third-party
+  // provider, which answered `422 unknown item type "agent_message"` (#4454).
+  //
+  // The opaque-blob path already knows the repair: replace the undecryptable part with an
+  // omission marker, which leaves the item lowerable. It applied that repair only AFTER an
+  // upstream rejection. For a destination that cannot accept the private item under any
+  // circumstances, that round trip was never going to succeed and sent the ciphertext to find
+  // out, so do the repair here instead. Recovery above has already had its chance to turn the
+  // same bytes into real plaintext; only what it could not rescue reaches this.
+  if (inboundWire === "responses" && !finalRouteCanPassThroughEncryptedTask) {
+    // Only the raw Responses passthrough puts input items on the wire verbatim, so that is the
+    // only wire this has to repair: translated wires rebuild the body from parsed messages, where
+    // `inputContentParts` drops an encrypted part instead of forwarding it. The exemption is the
+    // canonical Codex backend alone, because it is the one destination that minted these bytes and
+    // can read them. `authMode: "forward"` is NOT that test -- a noncanonical forward gateway is
+    // somebody else's server that happens to be configured for passthrough, and it receives the
+    // ciphertext like any other third party.
+    //
+    // Combo children run this too. Each child carries its own `structuredClone` of the body
+    // (`concreteComboRequestBody`) and its own concrete route, so a sibling's repair is invisible
+    // here and a target that resolves to a routed Responses wire would otherwise send the
+    // ciphertext that the parent's own dispatch no longer does.
+    const wireProvider = resolveWireProtocolOverride(
+      route.providerName,
+      route.modelId,
+      route.provider,
+      inboundWire,
+    );
+    if (wireProvider.adapter === "openai-responses" && !isCanonicalOpenAiForwardProvider(wireProvider)) {
+      const repaired = stripAgentMessageCiphertextInPlace((body as { input?: unknown } | undefined)?.input);
+      if (repaired > 0) {
+        console.warn(
+          `[opencodex] replaced ciphertext in ${repaired} replayed agent message(s) with an omission marker; the selected provider cannot read native ChatGPT ciphertext`,
+        );
+      }
+    }
+  }
+
   // The canonical ChatGPT backend rejects previous_response_id, so a local replay miss leaves no
   // safe way to recover the omitted history. Fail before auth, adapter construction, or upstream
   // I/O instead of stripping the id and silently forwarding a context-free delta (#702).
@@ -4726,7 +4771,8 @@ async function handleResponsesInner(
   const needsOpenAiVision = !visionDescribeTerminal
     && shouldResolveOpenAiVisionSidecar(config, route.provider, route.modelId, parsed);
   const needsOpenAiSearch = !routedCompaction && !adapter.runTurn
-    && shouldResolveOpenAiWebSearchSidecar(config, parsed, isPassthrough);
+    && (shouldResolveOpenAiWebSearchSidecar(config, parsed, isPassthrough)
+      || shouldResolveOpenAiPassthroughWebSearchBridge(route.provider, parsed, isPassthrough));
   if (needsOpenAiVision || needsOpenAiSearch) {
     try {
       const candidates = listOpenAiForwardSidecarCandidates(config);
@@ -6199,9 +6245,15 @@ async function handleResponsesInner(
       // conversation upstream, and hands back ordinary Responses SSE — so every rewrite below,
       // including the guard itself, still inspects the client-facing stream. Default OFF: without
       // the opt-in this is one planner call and the relay is byte-identical to before.
+      const webSearchBridgeAuth = resolvePassthroughWebSearchBridgeAuth(
+        route.provider.webSearchBridge?.backend,
+        config,
+        openAiSidecar,
+      );
       const webSearchBridgePlan = planPassthroughWebSearchBridge(parsed, route.provider, {
         isPassthrough: true,
         stream: parsed.stream === true,
+        auth: webSearchBridgeAuth,
       });
       // Capture the binding that actually served the first leg, after its permitted reselection.
       const webSearchBridgeBinding = requestBindings.get(request);
@@ -6235,7 +6287,13 @@ async function handleResponsesInner(
             }),
             false,
           ),
-          execute: createOllamaBridgeExecutor(webSearchBridgePlan, route.provider.apiKey ?? ""),
+          execute: createPassthroughWebSearchBridgeExecutor(webSearchBridgePlan, {
+            providerApiKey: route.provider.apiKey ?? "",
+            auth: webSearchBridgeAuth,
+            hostedTool: parsed._webSearch,
+            describeImages: isModelTextOnly(route.provider, route.modelId),
+            sidecar: config.webSearchSidecar,
+          }),
           // Appending a search result can push the continuation past the ceiling the first leg
           // was admitted under, so the same limit is re-applied before every later send.
           checkOutboundBody: (continuationBody: string) => {

package/src/server/responses/encrypted-payload.ts

@@ -319,6 +319,167 @@ export function hasEncryptedContentPart(content: unknown): boolean {
 }
 
 
+/** The marker `prepareOpaqueBlobRecovery` already substitutes for an undecryptable part. */
+export const OMITTED_ENCRYPTED_CONTENT_TEXT = "[encrypted content omitted]";
+
+/**
+ * The Fernet WIRE shape, without validating the body: version prefix, base64url alphabet, and a
+ * canonical encoded length. Free text is judged by this rather than by
+ * `looksLikeBackendCiphertext`, which is length >= 64 over a character class that a SHA-256 hex
+ * digest matches exactly at 64 characters -- as do a SHA-512 digest, a long key, and adjacent
+ * short encoded fragments. An `encrypted_content` slot carries ciphertext by definition and is
+ * stripped whatever it holds; a text part does not, and replacing a digest a child deliberately
+ * printed would destroy readable content to protect bytes that were never secret.
+ */
+const FERNET_SHAPED = /^g[A-Za-z0-9_-]+={0,2}$/;
+
+function looksLikeFernetToken(text: string): boolean {
+  return text.length >= 100 && text.length % 4 === 0 && FERNET_SHAPED.test(text);
+}
+
+function textWithRunsOmitted(payload: string, runs: readonly FernetTokenRun[]): string {
+  let last = 0;
+  let out = "";
+  for (const run of runs) {
+    out += payload.slice(last, run.index) + OMITTED_ENCRYPTED_CONTENT_TEXT;
+    last = run.index + run.token.length;
+  }
+  return out + payload.slice(last);
+}
+
+/**
+ * Replace ciphertext inside `agent_message` items with an omission marker, so
+ * `normalizeRoutedAgentMessages` can lower them onto public messages. Returns how many items
+ * were repaired. Items are replaced rather than mutated, and every other item type is left
+ * alone: reasoning and function-output blobs keep their own reactive recovery.
+ *
+ * `hasUnreadableEncryptedAgentTask` above answers a different question: can the CURRENT worker
+ * task be read at all? It inspects only the tail item and reports false the moment any plaintext
+ * survives the envelope. `normalizeRoutedAgentMessages` asks the opposite question -- is EVERY
+ * part lowerable? -- and forwards the private item verbatim when one is not. A mixed
+ * `input_text` + `encrypted_content` item answers "readable" to the first and "not lowerable"
+ * to the second, so it fell between them: the guard never fired, the adapter refused to lower it,
+ * and the raw Responses passthrough put a private item and backend ciphertext on the wire
+ * (#4454). Position was never the discriminator -- a replayed child result lands mid-history and
+ * the tail-only scan cannot see it -- but the tail is equally exposed when it is mixed.
+ *
+ * This is the repair `prepareOpaqueBlobRecovery` performs after an upstream rejection, applied
+ * before dispatch for a destination that cannot accept the private item under any circumstances.
+ * The round trip it replaces was never going to succeed, and it sent ciphertext to a third party
+ * to find that out. Nothing is decrypted, and nothing readable is lost: the parent could not read
+ * these bytes either.
+ *
+ * The two kinds of slot are judged differently, because they carry different guarantees. An
+ * `encrypted_content` slot holds ciphertext by definition, so it is stripped whatever it holds:
+ * demanding a well-formed token there would reopen this defect one payload later, since a
+ * truncated token, a standard-base64 blob carrying `+` or `/`, an unexpected version byte, or a
+ * run past the recovery size limits would each keep the item and forward the bytes.
+ *
+ * A text part carries no such guarantee, so it is matched strictly: embedded runs that validate
+ * as Fernet, or a whole slot with the Fernet wire shape. A loose character-class test would be
+ * worse than the defect for that half -- a SHA-256 digest is exactly 64 characters of
+ * `[A-Za-z0-9]` and would be replaced with a marker, silently deleting something a child
+ * deliberately printed.
+ */
+export function stripAgentMessageCiphertextInPlace(input: unknown): number {
+  if (!Array.isArray(input)) return 0;
+  let repaired = 0;
+  for (let index = 0; index < input.length; index += 1) {
+    const item = input[index];
+    if (!item || typeof item !== "object" || Array.isArray(item)) continue;
+    const record = item as Record<string, unknown>;
+    if (record.type !== "agent_message") continue;
+    const content = record.content;
+    if (typeof content === "string") {
+      const replaced = textWithoutCiphertext(content);
+      if (replaced === content) continue;
+      input[index] = { ...record, content: replaced };
+      repaired += 1;
+      continue;
+    }
+    if (!Array.isArray(content)) continue;
+    const parts = contentWithoutCiphertext(content);
+    if (parts === content) continue;
+    input[index] = { ...record, content: parts };
+    repaired += 1;
+  }
+  return repaired;
+}
+
+/** Free text: drop embedded token runs, and replace a slot that is nothing but a token. */
+function textWithoutCiphertext(text: string): string {
+  const runs = fernetTokenRuns(text);
+  if (runs.length > 0) return textWithRunsOmitted(text, runs);
+  return looksLikeFernetToken(text.trim()) ? OMITTED_ENCRYPTED_CONTENT_TEXT : text;
+}
+
+function ciphertextTextOfPart(part: unknown): string | undefined {
+  if (!part || typeof part !== "object") return undefined;
+  const record = part as { type?: unknown; text?: unknown };
+  return (record.type === "input_text" || record.type === "text") && typeof record.text === "string"
+    ? record.text
+    : undefined;
+}
+
+/**
+ * Adjacent text slots that are one token between them. Each fragment can be too short to judge on
+ * its own, which is the text-side twin of the split `encrypted_content` run. The join must still
+ * be Fernet-shaped, so two ordinary encoded fragments do not become a marker by being adjacent.
+ */
+function joinedCiphertextTextParts(content: readonly unknown[]): Set<object> {
+  const flagged = new Set<object>();
+  let run: Array<{ part: object; text: string }> = [];
+  const finish = (): void => {
+    if (run.length > 1 && looksLikeFernetToken(run.map(entry => entry.text).join(""))) {
+      for (const entry of run) flagged.add(entry.part);
+    }
+    run = [];
+  };
+  for (const part of content) {
+    const text = ciphertextTextOfPart(part);
+    if (text === undefined || text.trim().length === 0 || !/^[A-Za-z0-9_-]+={0,2}$/.test(text)) {
+      finish();
+      continue;
+    }
+    run.push({ part: part as object, text });
+  }
+  finish();
+  return flagged;
+}
+
+function contentWithoutCiphertext(content: unknown[]): unknown[] {
+  let changed = false;
+  const joined = joinedCiphertextTextParts(content);
+  const parts = content.map((part: unknown) => {
+    if (!part || typeof part !== "object") return part;
+    if (joined.has(part)) {
+      changed = true;
+      return { type: "input_text", text: OMITTED_ENCRYPTED_CONTENT_TEXT };
+    }
+    const record = part as { type?: unknown; text?: unknown; encrypted_content?: unknown };
+    if (record.type === "encrypted_content" && typeof record.encrypted_content === "string") {
+      changed = true;
+      // Keep whatever plaintext a recognizable slot carries around its token; a slot this
+      // cannot parse is replaced whole rather than forwarded on the chance that it is benign.
+      const runs = fernetTokenRuns(record.encrypted_content);
+      return {
+        type: "input_text",
+        text: runs.length > 0
+          ? textWithRunsOmitted(record.encrypted_content, runs)
+          : OMITTED_ENCRYPTED_CONTENT_TEXT,
+      };
+    }
+    const text = ciphertextTextOfPart(part);
+    if (text === undefined) return part;
+    const replaced = textWithoutCiphertext(text);
+    if (replaced === text) return part;
+    changed = true;
+    return { ...record, text: replaced };
+  });
+  return changed ? parts : content;
+}
+
+
 
 export function sanitizeEncryptedContentInPlace(input: unknown): number {
   if (!Array.isArray(input)) return 0;

package/src/server/responses.ts

@@ -5,7 +5,7 @@ import { requestPacingOverloadResponse } from "./responses/pacing-overload";
 
 export { buildToolBridgeMaps, isV1CollabSurface, collabSurface, multiAgentGuidanceText, V2_GUIDANCE_CHAR_BUDGET, injectDeveloperMessage } from "./responses/collaboration";
 export type { MultiAgentGuidanceOptions, MultiAgentGuidanceDeps } from "./responses/collaboration";
-export { hasUnreadableEncryptedAgentTask, sanitizeEncryptedContentInPlace } from "./responses/encrypted-payload";
+export { hasUnreadableEncryptedAgentTask, sanitizeEncryptedContentInPlace, stripAgentMessageCiphertextInPlace } from "./responses/encrypted-payload";
 export { COMPACT_RESPONSE_MAX_BYTES, bufferCompactResponse } from "./responses/compact";
 export { disableResponsesRequestTimeout, safeHostLabel, fetchWithHeaderTimeout } from "./responses/fetch-helpers";
 export { sidecarOutcomeRecorder, isShadowSourceModel, codexLogAccountId, usesCodexForwardPoolAuth, codexForwardTerminalOutcomeRecorder, decodeRequestErrorResponse, buildComboChildHeaders, linkAbortSignal } from "./responses/core";

package/src/types/provider.ts

@@ -87,11 +87,11 @@ export interface RateLimitRetryPolicy {
 }
 
 /**
- * Backend ids admitted by `providers.<name>.webSearchBridge.backend`. Only `"ollama"` has a
- * shipped executor; every other id is explicit-only and inert, the same contract the top-level
- * `webSearchSidecar` uses for backends whose executor has not landed. Naming one of them keeps
- * the bridge disarmed rather than silently falling back to a different search provider — in
- * particular it never auto-selects a paid Luna or Exa search.
+ * Backend ids admitted by `providers.<name>.webSearchBridge.backend`. Each id is explicit-only:
+ * an omitted backend keeps the bridge disarmed rather than silently falling back to a paid
+ * Luna or Exa search. `ollama` spends this provider's API key on the search endpoint.
+ * `openai` / `anthropic` / `xai` / `gemini` / `exa` reuse the matching sidecar executor and
+ * that executor's own credential; a missing credential leaves the bridge disarmed.
  */
 export const PROVIDER_WEB_SEARCH_BRIDGE_BACKENDS = [
   "ollama",
@@ -118,6 +118,7 @@ export type ProviderWebSearchBridgeBackend = typeof PROVIDER_WEB_SEARCH_BRIDGE_B
  *
  * Never armed for `authMode: "forward"` (ChatGPT) or for a provider that executes hosted search
  * upstream; see `planPassthroughWebSearchBridge` in `src/web-search/passthrough-bridge.ts`.
+ * A mixed `web_search` + client tool call still fails closed. Assistant text is not a search call.
  */
 export interface ProviderWebSearchBridgeConfig {
   /** Master switch. Absent or false keeps today's relay-and-fail behavior exactly. */

package/src/web-search/index.ts

@@ -7,11 +7,17 @@ import { isCodexReserveRequestEligible } from "../codex/loopback-target";
 import type { DataPlaneAdmission } from "../server/auth-cors";
 import type { ResolvedOpenAiForwardSidecar } from "../providers/openai-sidecar";
 import { resolveSidecarAuth } from "../sidecar/auth";
-import { getAccountSet } from "../oauth/store";
 import { validateXaiSearchOptions, type XaiSearchOptions } from "./xai-executor";
 import type { OcxWebSearchSidecarConfig } from "../types";
 import { DEFAULT_STALL_TIMEOUT_SEC } from "../stall-timeout";
 import { buildWebSearchTool, extractHostedWebSearch, WEB_SEARCH_TOOL_NAME } from "./synthetic-tool";
+import {
+  findAnthropicSidecarProvider,
+  findGeminiSidecarProvider,
+  findXaiSidecarProvider,
+  xaiSearchOptionsFromConfig,
+  type AnthropicSidecarProvider,
+} from "./sidecar-providers";
 
 export { runWithWebSearch } from "./loop";
 export { buildWebSearchTool, extractHostedWebSearch, WEB_SEARCH_TOOL_NAME };
@@ -19,6 +25,13 @@ export { runAnthropicWebSearch, parseAnthropicSidecarSSE } from "./anthropic-exe
 export { runXaiWebSearch, parseXaiResponsesSSE, validateXaiSearchOptions, type XaiSearchOptions } from "./xai-executor";
 export { runGeminiWebSearch, mapCcaGroundedResponse } from "./gemini-executor";
 export { runExaWebSearch, mapExaSearchResponse } from "./exa-executor";
+export {
+  findAnthropicSidecarProvider,
+  findGeminiSidecarProvider,
+  findXaiSidecarProvider,
+  xaiSearchOptionsFromConfig,
+  type AnthropicSidecarProvider,
+};
 
 const DEFAULT_SIDECAR_MODEL = "gpt-5.6-luna";
 // Default Claude model for the anthropic-backed sidecar (used when cfg.model is unset).
@@ -85,72 +98,6 @@ export function webSearchStallTimeoutSec(
   return Math.min(Number.MAX_VALUE, Math.ceil(largestUnitSec) + STALL_MARGIN_SEC);
 }
 
-/** A configured anthropic-adapter OAuth provider whose ACTIVE stored account is usable (not needs-reauth). */
-export interface AnthropicSidecarProvider {
-  providerName: string;
-  provider: OcxProviderConfig;
-}
-
-/**
- * First enabled anthropic-adapter OAuth provider whose ACTIVE account holds a usable credential — the
- * only path that can run web_search_20250305 without a ChatGPT forward provider. Presence is decided by
- * getAccountSet + the active account's `needsReauth` marker (audit F1: getCredential alone can pick a
- * terminally-invalid account); token refresh happens later at executor time.
- * Delegates to the shared sidecar auth module (#2188) so web-search and vision
- * cannot drift on what "Anthropic auth present" means.
- */
-export function findAnthropicSidecarProvider(config: OcxConfig): AnthropicSidecarProvider | undefined {
-  const auth = resolveSidecarAuth(config);
-  if (!auth.isAnthropicAuth || !auth.anthropicProviderName || !auth.anthropicProvider) return undefined;
-  return { providerName: auth.anthropicProviderName, provider: auth.anthropicProvider };
-}
-
-/**
- * First enabled provider whose stored Grok OAuth account is active and not marked for
- * reauth — the only credential the xai web-search executor may spend. Same account-set
- * predicate the shared sidecar auth module applies to Anthropic.
- */
-export function findXaiSidecarProvider(config: OcxConfig): { providerName: string; provider: OcxProviderConfig } | undefined {
-  // The stored Grok credential lives under the provider named "xai" (registry id);
-  // OAuth account sets are keyed by provider name, so the name IS the credential key.
-  const provider = config.providers["xai"];
-  if (!provider || provider.disabled === true || provider.authMode !== "oauth") return undefined;
-  const set = getAccountSet("xai");
-  const active = set?.accounts.find(account => account.id === set.activeAccountId);
-  if (active && active.needsReauth !== true) return { providerName: "xai", provider };
-  return undefined;
-}
-
-/**
- * First usable Antigravity credential holder: the "google-antigravity" provider
- * (registry id = OAuth store key, same narrowing as findXaiSidecarProvider) whose
- * active stored account is healthy AND carries a discovered CCA projectId — the
- * executor cannot form the envelope without it.
- */
-export function findGeminiSidecarProvider(config: OcxConfig): { providerName: string; provider: OcxProviderConfig } | undefined {
-  const provider = config.providers["google-antigravity"];
-  if (!provider || provider.disabled === true || provider.authMode !== "oauth") return undefined;
-  const set = getAccountSet("google-antigravity");
-  const active = set?.accounts.find(account => account.id === set.activeAccountId);
-  if (!active || active.needsReauth === true) return undefined;
-  const projectId = (active.credential as { projectId?: string } | undefined)?.projectId;
-  if (!projectId) return undefined;
-  return { providerName: "google-antigravity", provider };
-}
-
-/** Lift the persisted xSearch config block into executor options (absent block = web_search only). */
-export function xaiSearchOptionsFromConfig(cfg: Pick<OcxWebSearchSidecarConfig, "xSearch">): XaiSearchOptions {
-  const x = cfg.xSearch;
-  if (!x || x.enabled !== true) return {};
-  return {
-    xSearch: true,
-    ...(x.allowedXHandles ? { allowedXHandles: x.allowedXHandles } : {}),
-    ...(x.excludedXHandles ? { excludedXHandles: x.excludedXHandles } : {}),
-    ...(x.fromDate ? { fromDate: x.fromDate } : {}),
-    ...(x.toDate ? { toDate: x.toDate } : {}),
-  };
-}
-
 /** Every backend id the config union admits. New ids are explicit-only and inert until their executor ships. */
 export type WebSearchBackendId = "openai" | "anthropic" | "xai" | "gemini" | "exa";