@bitkyc08/opencodex 2.57.0 → 2.59.0

package/src/config/pending-teardown.ts

@@ -295,6 +295,14 @@ export function quarantinePendingTeardown(nonce: string): string | null {
  * alone. Only an abandoned obligation is a candidate, and a VALID one still has to prove
  * its endpoint is down before anything is restored — an invalid one never can, which is
  * what {@link quarantinePendingTeardown} exists for.
+ *
+ * `isAlive` must answer "is the OWNER still running", which is not "is this PID alive".
+ * PIDs are reused: after the owner exits its number can be handed to an unrelated process,
+ * and a bare liveness probe then reports the owner as running for as long as that process
+ * lives. The receipt is neither recovered nor quarantined nor reported while both updater
+ * gates keep refusing on it, which is a permanent fail-closed with no way forward (#4897).
+ * `handleStop` therefore passes an identity-aware predicate; do not substitute a bare
+ * `process.kill(pid, 0)` here for cheapness.
  */
 export function isPendingTeardownAbandoned(
   read: PendingTeardownRead | TeardownScanFailure,

package/src/config/process-state.ts

@@ -110,16 +110,29 @@ export function removeRuntimePortIfPidIs(snapshotPid: number | null): void {
   try { unlinkSync(getRuntimePortPath()); } catch { /* ignore */ }
 }
 
-export function isOcxStartCommandLine(commandLine: string): boolean {
+/**
+ * Does this command line belong to an opencodex process at all, whatever it is doing?
+ *
+ * {@link isOcxStartCommandLine} answers the narrower question the pidfile needs — "is this
+ * the proxy?" — by additionally requiring the `start` verb. Ownership of a pending-teardown
+ * receipt is the broader question: the owner is whichever invocation claimed it, which is an
+ * `ocx stop` or the `ocx update` worker that drove it, never an `ocx start`. Asking the
+ * start-shaped question there would call every real owner foreign.
+ */
+export function isOcxCommandLine(commandLine: string): boolean {
   const normalized = commandLine.toLowerCase().replace(/\\/g, "/");
   // Keep legacy source launches and npm's in-place Windows rename recognizable:
   // a service wrapper may respawn from `.opencodex-*` during a global update.
-  const hasOcxEntrypoint = normalized.includes("src/cli.ts")
+  return normalized.includes("src/cli.ts")
     || normalized.includes("src/cli/index.ts")
     || normalized.includes("@bitkyc08/opencodex")
     || /@bitkyc08\/\.opencodex-/.test(normalized)
     || /(?:^|[\s/"'])(?:ocx|opencodex)(?:\.cmd)?(?:$|[\s"'])/.test(normalized);
-  return hasOcxEntrypoint && /(?:^|[\s"'])start(?:$|[\s"'])/.test(normalized);
+}
+
+export function isOcxStartCommandLine(commandLine: string): boolean {
+  const normalized = commandLine.toLowerCase().replace(/\\/g, "/");
+  return isOcxCommandLine(commandLine) && /(?:^|[\s"'])start(?:$|[\s"'])/.test(normalized);
 }
 
 /** Avoid spawning WMIC/PowerShell on every short liveness poll. */
@@ -227,6 +240,26 @@ export function verifyPidIdentity(candidatePid: number): number | null {
   return isLikelyOcxStartProcess(candidatePid) ? candidatePid : null;
 }
 
+/**
+ * Is this PID an opencodex process, rather than merely a live one?
+ *
+ * `process.kill(pid, 0)` answers "does this number name a process", which is not the same
+ * question. PIDs are reused, so a recorded owner that exited can have its number handed to
+ * an unrelated process, and bare liveness then reports the owner as still running forever.
+ *
+ * Deliberately uncached, unlike {@link isLikelyOcxStartProcess}. That cache exists because
+ * liveness polling asks about the same PID many times a second; this is asked once per
+ * outstanding teardown receipt in a short-lived `ocx stop`, so the cache would only add an
+ * unswept map. The Windows WMIC/PowerShell probe cost is the point rather than a regression:
+ * the runtime contract requires the identity check, not the cheap one, before acting on
+ * stale state.
+ */
+export function isLikelyOcxProcess(pid: number): boolean {
+  const commandLine = readProcessCommandLine(pid);
+  if (commandLine === undefined) return false;
+  return isOcxCommandLine(commandLine);
+}
+
 type ProcessCommandLineExec = (
   executable: string,
   args: string[],

package/src/config/provider-relative-send-path.ts

@@ -0,0 +1,16 @@
+/** Shared, initialization-independent shape check for provider send-path overrides. */
+export function providerRelativeSendPathConfigError(
+  field: "responsesPath" | "chatCompletionsPath",
+  value: unknown,
+): string | null {
+  if (value === undefined) return null;
+  if (typeof value !== "string") return `${field} must be a string`;
+  if (/^[A-Za-z][A-Za-z0-9+.-]*:/.test(value) || value.includes("://")) {
+    return `${field} must be a relative path without a URL scheme`;
+  }
+  if (!value.startsWith("/")) return `${field} must start with /`;
+  if (value.includes("?") || value.includes("#")) {
+    return `${field} must not include query strings or fragments`;
+  }
+  return null;
+}

package/src/config/proxy-env.ts

@@ -1,3 +1,5 @@
+import { configureSocks5Fetch } from "../lib/proxy-env";
+import { redactUrlForLog } from "../lib/redact";
 import { join } from "node:path";
 import { DEFAULT_SUBAGENT_MODELS, SUBAGENT_MODELS_VERSION } from "./subagent-models";
 import { MULTI_AGENT_SURFACE_ADVISORY_VERSION } from "./multi-agent-surface";
@@ -102,10 +104,15 @@ function warnProxyConfigDiscardOnce(kind: "proxy" | "noProxy" | "noProxyElements
  * variables win; config fills missing scheme proxies, which take precedence over ALL_PROXY for WS.
  * localhost/127.0.0.1 are appended to NO_PROXY so the CLI's own health checks and
  * running-proxy API calls stay direct. Call once per process entry that makes outbound provider
- * requests (server start, catalog sync).
+ * requests (server start, catalog sync). `announce` prints the one-line startup banner naming
+ * the outbound proxy actually in effect; only server start passes it, because on catalog sync
+ * that line is noise. The URL is redacted because a proxy URL can carry credentials.
  */
-export function applyProxyEnv(config: OcxConfig): void {
+export function applyProxyEnv(config: OcxConfig, announce = false): void {
   applyProxyEnvWith(config);
+  if (!announce) return;
+  const outbound = process.env.ALL_PROXY?.trim() || process.env.HTTPS_PROXY?.trim() || process.env.HTTP_PROXY?.trim();
+  if (outbound) console.log(`   outbound proxy: ${redactUrlForLog(outbound)}`);
 }
 
 /** Test seam for `proxy: "auto"`: the registry reader and platform are injectable. */
@@ -123,6 +130,7 @@ export function applyProxyEnvWith(
   let proxy = typeof rawProxy === "string" ? resolveEnvValue(rawProxy) : undefined;
   if (!proxy) {
     if (rawProxy !== undefined) warnProxyConfigDiscardOnce("proxy");
+    configureSocks5Fetch();
     return;
   }
   if (proxy.trim().toLowerCase() === "auto") {
@@ -151,8 +159,18 @@ export function applyProxyEnvWith(
     }
   }
   if (proxy) {
-  if (!process.env.HTTP_PROXY?.trim() && !process.env.http_proxy?.trim()) process.env.HTTP_PROXY = proxy;
-  if (!process.env.HTTPS_PROXY?.trim() && !process.env.https_proxy?.trim()) process.env.HTTPS_PROXY = proxy;
+    if (/^socks/i.test(proxy.trim()) && !/^socks5h?:\/\//i.test(proxy.trim())) {
+      throw new Error("Only SOCKS5 proxy URLs are supported; use socks5://host:port");
+    }
+    if (/^socks5h?:\/\//i.test(proxy.trim())) {
+      for (const key of ["HTTP_PROXY", "HTTPS_PROXY", "http_proxy", "https_proxy", "ALL_PROXY", "all_proxy"] as const) {
+        delete process.env[key];
+      }
+      process.env.ALL_PROXY = proxy;
+    } else {
+      if (!process.env.HTTP_PROXY?.trim() && !process.env.http_proxy?.trim()) process.env.HTTP_PROXY = proxy;
+      if (!process.env.HTTPS_PROXY?.trim() && !process.env.https_proxy?.trim()) process.env.HTTPS_PROXY = proxy;
+    }
   }
   const existing = process.env.NO_PROXY ?? process.env.no_proxy ?? "";
   const entries = existing.split(",").map(s => s.trim()).filter(Boolean);
@@ -184,5 +202,5 @@ export function applyProxyEnvWith(
     }
   }
   process.env.NO_PROXY = entries.join(",");
+  configureSocks5Fetch();
 }
-

package/src/config/schema/config-schema.ts

@@ -13,6 +13,7 @@ import {
   quotaResetNotifySchema,
   remoteGuiConfigSchema,
   runtimeRoleSchema,
+  spendSchema,
   configuredCodexPoolAccountIds,
   apiKeyEntrySchema,
   asideProfileSyncSchema,
@@ -59,6 +60,8 @@ import { parseDesktopProfile } from "../../claude/desktop-profile";
 import { DEFAULT_APP_OWNED_MEMORY_BUDGET_BYTES, MAX_APP_OWNED_MEMORY_BUDGET_MB, MIN_APP_OWNED_MEMORY_BUDGET_MB } from "../../lib/app-owned-memory";
 
 export const configSchema = z.object({
+  codexNativeSteering: z.boolean().optional().catch(false),
+  codexNativeInjection: z.boolean().optional().catch(false),
   port: z.number().int().min(0).max(65535).default(10100),
   // A malformed hand edit must disable only remote-role behavior, not discard
   // providers or data-plane keys. Live writes are rejected explicitly below.
@@ -164,6 +167,11 @@ export const configSchema = z.object({
   quotaResetNotify: quotaResetNotifySchema.optional().catch(undefined),
   // Same rationale: a bad auto-refresh section must not cost the operator their providers.
   catalogAutoRefresh: catalogAutoRefreshSchema.optional().catch(undefined),
+  // Same rationale again, with the failure direction stated: a malformed spend section
+  // degrades to "no ceiling", which means observe-only accounting rather than an outage. That
+  // is the safe degrade for traffic and the dangerous one for the operator, so the write path
+  // rejects it and loadConfig warns -- the same pair codexPool uses below.
+  spend: spendSchema.optional().catch(undefined),
   // These selections pre-date schema validation and used to pass through as
   // unknown fields. Invalid hand edits must disable only the optional
   // delegation/native-default feature, not reject the whole config and hide
@@ -180,6 +188,10 @@ export const configSchema = z.object({
   codexShimAutoRestore: z.boolean().optional(),
   codexDesktopAuthless: z.boolean().optional().catch(undefined),
   codexClientCompaction: z.boolean().optional().catch(undefined),
+  // Presentation-only label for the injected provider. A malformed value degrades to undefined
+  // and the default label is emitted, rather than failing the parse or writing a config Codex
+  // would refuse to load — the provider id routing depends on is never derived from it.
+  codexProviderDisplayName: z.string().trim().min(1).max(128).optional().catch(undefined),
   pausedCodexAccountIds: z.array(z.string().regex(/^[a-zA-Z0-9._-]{1,64}$/)).optional(),
   // A malformed policy degrades to "no policy" rather than failing the parse, so a hand-edited
   // typo cannot trip the backup-and-defaults repair path and wipe providers or pool accounts.
@@ -462,6 +474,17 @@ export const configSchema = z.object({
         message: reasoningSummariesError,
       });
     }
+    const suppressSyntheticMaxError = booleanRecordConfigError(
+      (provider as { modelSuppressSyntheticMax?: unknown }).modelSuppressSyntheticMax,
+      "modelSuppressSyntheticMax",
+    );
+    if (suppressSyntheticMaxError) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["providers", redactSecretString(name), "modelSuppressSyntheticMax"],
+        message: suppressSyntheticMaxError,
+      });
+    }
     const verbositySupportError = booleanRecordConfigError(
       (provider as { modelSupportsVerbosity?: unknown }).modelSupportsVerbosity,
       "modelSupportsVerbosity",

package/src/config/schema/leaf-validators.ts

@@ -32,7 +32,11 @@ import { getProviderRegistryEntry, providerMatchesRegistryTransport, providerMod
 import { resolveOpenAiVirtualModel } from "../../providers/openai-virtual-models";
 import { COST4_RATE_KEYS, isValidCost4Rate } from "../../usage/user-cost-overlays";
 import { MAX_COST4_RATE } from "../../usage/expected-prices";
-import { isHostedToolUnsupportedForModel } from "../../responses/hosted-tool-policy";
+import {
+  DECLARABLE_HOSTED_TOOL_TYPES,
+  declaredUnsupportedHostedTools,
+  isHostedToolUnsupportedForModel,
+} from "../../responses/hosted-tool-policy";
 import { getConfigDir } from "../paths";
 
 /** One definition of "usable secret", shared by the schema and the warnings. */
@@ -243,10 +247,12 @@ export const providerConfigSchema = z.object({
   chatCompletionsPath: z.string().min(1).optional(),
   statelessResponses: z.boolean().optional(),
   requiresAdjacentResponsesToolResults: z.boolean().optional(),
+  requiresPairedResponsesToolResults: z.boolean().optional(),
   annotateEmptyToolOutputs: z.boolean().optional(),
   fastWire: fastWireSchema.nullable().optional(),
   supportsServiceTier: z.boolean().optional(),
   modelSupportsServiceTier: z.record(z.string().min(1), z.boolean()).optional(),
+  modelSuppressSyntheticMax: z.record(z.string().min(1), z.boolean()).optional(),
   preserveResponsesReasoningContent: z.boolean().optional(),
   decodesNativeCompactionBlobs: z.boolean().optional(),
   allowEncryptedV2AgentTasks: z.boolean().optional(),
@@ -274,6 +280,18 @@ export const providerConfigSchema = z.object({
   omitReasoningEffortWithToolsModels: z.array(z.string().min(1))
     .transform(normalizeNonBlankStringArray)
     .optional(),
+  // Validated against a closed vocabulary rather than accepted as free strings. This
+  // schema ends in `.passthrough()`, so a misspelled `web_serch` would otherwise be
+  // accepted, persisted, and strip nothing -- leaving the operator with the upstream 400
+  // the field was set to prevent, and no message saying why (the `codexToolMode` lesson,
+  // #2106).
+  unsupportedHostedTools: z.array(z.string().min(1))
+    .transform(normalizeNonBlankStringArray)
+    .refine(
+      tools => tools.every(tool => DECLARABLE_HOSTED_TOOL_TYPES.has(tool)),
+      { message: `unsupportedHostedTools accepts only hosted tool types: ${[...DECLARABLE_HOSTED_TOOL_TYPES].join(", ")}` },
+    )
+    .optional(),
   retryOn429: retryOn429PolicySchema.optional(),
   transientRetryOn5xx: transientRetryOn5xxPolicySchema.optional(),
   codexAccountMode: z.enum(["pool", "direct"]).optional(),
@@ -299,21 +317,7 @@ export const providerConfigSchema = z.object({
 }).passthrough();
 
 
-/**
- * Shared shape check for the two relative send-path overrides. `field` names the
- * offending key so the message stays specific to what the user actually wrote.
- */
-export function providerRelativeSendPathConfigError(field: string, value: string | undefined): string | null {
-  if (value === undefined) return null;
-  if (/^[A-Za-z][A-Za-z0-9+.-]*:/.test(value) || value.includes("://")) {
-    return `${field} must be a relative path without a URL scheme`;
-  }
-  if (!value.startsWith("/")) return `${field} must start with /`;
-  if (value.includes("?") || value.includes("#")) {
-    return `${field} must not include query strings or fragments`;
-  }
-  return null;
-}
+export { providerRelativeSendPathConfigError } from "../provider-relative-send-path";
 
 /**
  * Validate `providers.<name>.modelCosts`: a plain object keyed by exact model
@@ -390,7 +394,13 @@ export function modelPreferHostedToolsConfigError(
   value: unknown,
   field: string,
   providerName: string,
-  provider: { adapter?: unknown; authMode?: unknown; modelAdapters?: unknown; baseUrl?: unknown },
+  provider: {
+    adapter?: unknown;
+    authMode?: unknown;
+    modelAdapters?: unknown;
+    baseUrl?: unknown;
+    unsupportedHostedTools?: unknown;
+  },
 ): string | null {
   if (value === undefined) return null;
   if (!value || typeof value !== "object" || Array.isArray(value)) return `${field} must be a plain object`;
@@ -398,6 +408,12 @@ export function modelPreferHostedToolsConfigError(
   if (prototype !== Object.prototype && prototype !== null) return `${field} must be a plain object with own properties`;
   const entries = Object.entries(value);
   const registry = getProviderRegistryEntry(providerName);
+  // A provider that denies a hosted tool cannot also prefer it. Both keys are
+  // provider-owned capability statements about the same tool, and the denial wins at
+  // request time, so accepting the pair would silently ignore the preference.
+  const declaredUnsupported = declaredUnsupportedHostedTools(
+    provider as { unsupportedHostedTools?: readonly string[] },
+  );
   // Effective transport: a `preserveCustomDestination` registry row reused under a
   // different endpoint keeps its own adapter AND its own auth at runtime, because
   // `routedProviderConfig()` honors `providerMatchesRegistryTransport()`. Both the
@@ -458,6 +474,9 @@ export function modelPreferHostedToolsConfigError(
       if (typeof tool !== "string" || !SUPPORTED_PREFERRED_HOSTED_TOOLS.has(tool)) {
         return `${field}.${key} supports only image_generation`;
       }
+      if (declaredUnsupported.has(tool)) {
+        return `${field}.${key} cannot prefer ${tool}: unsupportedHostedTools declares it unsupported`;
+      }
       if (isHostedToolUnsupportedForModel(key, tool)) {
         return `${field}.${key} cannot prefer ${tool}: the model does not support it`;
       }
@@ -853,3 +872,32 @@ export const catalogAutoRefreshSchema = z.object({
   enabled: z.boolean().optional(),
   intervalMinutes: z.number().int().min(0).max(1440).optional(),
 }).strict();
+
+/**
+ * One spend scope's ceiling.
+ *
+ * `.strict()` for the usual reason and one sharper one. Elsewhere a silently ignored key
+ * leaves a feature off that the operator believed was on; here it leaves a BUDGET off, and a
+ * budget nobody is enforcing looks exactly like a budget nobody has exceeded. That is #2106 --
+ * an undeclared option accepted, persisted, and then read as its default -- aimed at spend.
+ *
+ * Only positive integers: 0 would read as "no tokens at all" and refuse every request under
+ * the scope, which is never what writing a budget means. An operator who wants no ceiling
+ * removes the key.
+ */
+const spendScopeSchema = z.object({
+  maxTokens: z.number().int().positive().optional(),
+}).strict();
+
+/**
+ * Durable spend ceilings (#4546).
+ *
+ * Absent, empty, and all-scopes-absent are the same thing: observe-only accounting. There is
+ * no default ceiling anywhere in this section, deliberately.
+ */
+export const spendSchema = z.object({
+  root: spendScopeSchema.optional(),
+  identity: spendScopeSchema.optional(),
+  pool: spendScopeSchema.optional(),
+  retentionDays: z.number().int().min(1).max(365).optional(),
+}).strict();