@bitkyc08/opencodex 2.6.18 → 2.6.19

package/src/providers/registry.ts

@@ -73,6 +73,15 @@ const ZAI_GLM_52_REASONING_MAP: Record<string, string> = {
   xhigh: "max",
   max: "max",
 };
+const DEEPSEEK_THINKING_MODELS = ["deepseek-v4-pro", "deepseek-v4-flash"];
+const DEEPSEEK_THINKING_EFFORTS = ["high", "xhigh"];
+const DEEPSEEK_THINKING_REASONING_MAP: Record<string, string> = {
+  low: "high",
+  medium: "high",
+  high: "high",
+  xhigh: "max",
+  max: "max",
+};
 const KIMI_THINKING_MODELS = ["kimi-k2.7-code", "kimi-k2.7-code-highspeed", "kimi-k2.6", "kimi-k2.5", "kimi-k2-0905-preview"];
 const KIMI_LOCKED_PARAMETER_MODELS = ["kimi-k2.7-code", "kimi-k2.7-code-highspeed", "kimi-k2.6", "kimi-k2.5"];
 const NEURALWATT_REASONING_HISTORY_MODELS = [
@@ -297,7 +306,24 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
   { id: "ollama", label: "Ollama (local)", adapter: "openai-chat", baseUrl: "http://localhost:11434/v1", authKind: "local", featured: true, note: "Local — key usually blank", reasoningEffortMap: OLLAMA_REASONING_MAP },
   { id: "vllm", label: "vLLM (local)", adapter: "openai-chat", baseUrl: "http://localhost:8000/v1", authKind: "local", featured: true, note: "Local — key usually blank" },
   { id: "lm-studio", label: "LM Studio (local)", adapter: "openai-chat", baseUrl: "http://localhost:1234/v1", authKind: "local", featured: true, note: "Local — no key needed" },
-  { id: "deepseek", label: "DeepSeek", baseUrl: "https://api.deepseek.com", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://platform.deepseek.com/api_keys", models: ["deepseek-chat", "deepseek-reasoner"], defaultModel: "deepseek-chat" },
+  {
+    id: "deepseek",
+    label: "DeepSeek",
+    baseUrl: "https://api.deepseek.com",
+    adapter: "openai-chat",
+    authKind: "key",
+    dashboardUrl: "https://platform.deepseek.com/api_keys",
+    models: ["deepseek-chat", "deepseek-reasoner", ...DEEPSEEK_THINKING_MODELS],
+    defaultModel: "deepseek-chat",
+    /* [Decision Log]
+    - 목적: DeepSeek V4 thinking mode multi-turn/tool-call requests must replay prior assistant reasoning_content.
+    - 대안 분석: Globally preserve reasoning_content for all OpenAI-compatible models; preserve it for legacy deepseek-reasoner too; mark only V4 thinking models in registry metadata.
+    - 선택 근거: DeepSeek V4 thinking mode requires history replay, while older DeepSeek reasoner has different compatibility rules. A model-scoped registry flag fixes built-in and stale saved configs without broad provider regressions.
+    */
+    modelReasoningEfforts: Object.fromEntries(DEEPSEEK_THINKING_MODELS.map(id => [id, DEEPSEEK_THINKING_EFFORTS])),
+    modelReasoningEffortMap: Object.fromEntries(DEEPSEEK_THINKING_MODELS.map(id => [id, DEEPSEEK_THINKING_REASONING_MAP])),
+    preserveReasoningContentModels: DEEPSEEK_THINKING_MODELS,
+  },
   { id: "cerebras", label: "Cerebras", baseUrl: "https://api.cerebras.ai/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://cloud.cerebras.ai/platform/apikeys", defaultModel: "llama-3.3-70b" },
   { id: "together", label: "Together", baseUrl: "https://api.together.xyz/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://api.together.xyz/settings/api-keys" },
   { id: "fireworks", label: "Fireworks", baseUrl: "https://api.fireworks.ai/inference/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://fireworks.ai/account/api-keys" },

package/src/server.ts

@@ -84,6 +84,7 @@ import {
 } from "./codex-routing";
 import { registerCodexWebSocket, unregisterCodexWebSocket, updateCodexWebSocketAuthContext } from "./codex-websocket-registry";
 import { resolveGuiFilePath, rootFallbackPayload, serveGuiFile } from "./server/gui-static";
+import { fetchWithResetRetry } from "./upstream-retry";
 export { resolveGuiFilePath, rootFallbackPayload } from "./server/gui-static";
 import { resolveAdapter, resolveWireProtocolOverride } from "./server/adapter-resolve";
 export { resolveAdapter } from "./server/adapter-resolve";
@@ -368,11 +369,14 @@ async function handleResponses(
     const connectMs = config.connectTimeoutMs ?? 100_000;
     let upstreamResponse: Response;
     try {
-      upstreamResponse = await fetchWithHeaderTimeout(request.url, {
-        method: request.method,
-        headers: request.headers,
-        body: request.body,
-      }, upstream.signal, connectMs);
+      upstreamResponse = await fetchWithResetRetry(
+        () => fetchWithHeaderTimeout(request.url, {
+          method: request.method,
+          headers: request.headers,
+          body: request.body,
+        }, upstream.signal, connectMs),
+        { abortSignal: upstream.signal, label: safeHostLabel(request.url) },
+      );
     } catch (err) {
       upstream.abort();
       const outcome = err instanceof Error && err.name === "TimeoutError" ? "timeout" : "connect_error";
@@ -453,7 +457,13 @@ async function handleResponses(
         consumeForResponseLogMetadata(inspectBody, logCtx, turnAc.signal, () => unregisterTurn(turnAc));
       }
       if (!headers.has("content-type")) headers.set("content-type", "text/event-stream");
-      return markNativePassthroughSseResponse(new Response(nativeBody, {
+      // win32 must keep the pure native relay (Bun#32111 JS-sink segfault); elsewhere a JS pull
+      // relay is established practice (relayWithAbort, relaySseWithHeartbeat) and lets a
+      // mid-stream reset end with a clean response.failed terminal instead of a raw socket error.
+      const clientBody = process.platform === "win32"
+        ? nativeBody
+        : relaySseWithFailedTail(nativeBody, upstream);
+      return markNativePassthroughSseResponse(new Response(clientBody, {
         status: upstreamResponse.status,
         headers,
       }));
@@ -563,9 +573,12 @@ async function handleResponses(
   try {
     upstreamResponse = adapter.fetchResponse
       ? await adapter.fetchResponse(request, { abortSignal: upstream.signal, timeoutMs: connectMs })
-      : await fetchWithHeaderTimeout(request.url, {
-          method: request.method, headers: request.headers, body: request.body,
-        }, upstream.signal, connectMs);
+      : await fetchWithResetRetry(
+          () => fetchWithHeaderTimeout(request.url, {
+            method: request.method, headers: request.headers, body: request.body,
+          }, upstream.signal, connectMs),
+          { abortSignal: upstream.signal, label: safeHostLabel(request.url) },
+        );
   } catch (err) {
     cleanupUpstreamAbort();
     upstream.abort();
@@ -643,6 +656,15 @@ export function disableResponsesRequestTimeout(req: Request, server: Pick<Server
   }
 }
 
+/** Host-only label for retry logs — never leaks path/query/credentials. */
+function safeHostLabel(url: string): string {
+  try {
+    return new URL(url).host;
+  } catch {
+    return "upstream";
+  }
+}
+
 async function fetchWithHeaderTimeout(
   url: string,
   init: Omit<RequestInit, "signal">,
@@ -966,6 +988,54 @@ export function relayWithAbort(
   });
 }
 
+/**
+ * Relay a passthrough SSE body like relayWithAbort, but convert a MID-STREAM failure (upstream
+ * reset after headers) into a clean terminal: any partial block is closed off, then a synthetic
+ * `response.failed` event and `data: [DONE]` are emitted and the stream closes. Without this the
+ * client sees a raw socket teardown with no terminal SSE event. Deliberately NOT a resend: the
+ * upstream already committed the request (duplicate-completion risk — same policy as cursor's
+ * committed=non-replayable transport retry).
+ */
+export function relaySseWithFailedTail(
+  body: ReadableStream<Uint8Array>,
+  upstream: AbortController,
+): ReadableStream<Uint8Array> {
+  const reader = body.getReader();
+  const encoder = new TextEncoder();
+  return new ReadableStream<Uint8Array>({
+    async pull(controller) {
+      try {
+        const { done, value } = await reader.read();
+        if (done) {
+          controller.close();
+          return;
+        }
+        controller.enqueue(value);
+      } catch (err) {
+        const failure = {
+          type: "upstream_error",
+          code: "upstream_reset",
+          message: `Upstream stream terminated unexpectedly: ${err instanceof Error ? err.message : String(err)}`,
+        };
+        const payload = JSON.stringify({
+          type: "response.failed",
+          response: { status: "failed", error: failure, last_error: failure },
+        });
+        try {
+          // Leading blank line terminates a partial SSE block so the failed frame parses cleanly.
+          controller.enqueue(encoder.encode(`\n\nevent: response.failed\ndata: ${payload}\n\ndata: [DONE]\n\n`));
+          controller.close();
+        } catch { /* client already torn down */ }
+        upstream.abort();
+      }
+    },
+    cancel(reason) {
+      upstream.abort(reason);
+      reader.cancel(reason).catch(() => {});
+    },
+  });
+}
+
 function nextSseBlock(buffer: string): { block: string; rest: string } | null {
   const match = buffer.match(/\r?\n\r?\n/);
   if (!match || match.index === undefined) return null;
@@ -1911,6 +1981,38 @@ async function handleManagementAPI(req: Request, url: URL, config: OcxConfig): P
     return jsonResponse({ ok: true, applied: chosen });
   }
 
+  // Per-provider catalog allowlist (issue #52): when a provider has a non-empty selectedModels list,
+  // only those ids ship to Codex's catalog / /v1/models. GET returns the CURRENT selection plus the
+  // FULL available set per provider (unfiltered — the picker needs everything to choose from).
+  if (url.pathname === "/api/selected-models" && req.method === "GET") {
+    const models = await fetchAllModels(config);
+    const available: Record<string, string[]> = {};
+    for (const m of models) (available[m.provider] ??= []).push(m.id);
+    const selected: Record<string, string[]> = {};
+    for (const [name, prov] of Object.entries(config.providers)) {
+      if (Array.isArray(prov.selectedModels) && prov.selectedModels.length > 0) selected[name] = [...prov.selectedModels];
+    }
+    return jsonResponse({ selected, available });
+  }
+  if (url.pathname === "/api/selected-models" && req.method === "PUT") {
+    let body: { provider?: unknown; models?: unknown };
+    try { body = await req.json(); } catch { return jsonResponse({ error: "invalid JSON body" }, 400); }
+    const provider = typeof body.provider === "string" ? body.provider : "";
+    if (!provider || !hasOwnProvider(config.providers, provider)) {
+      return jsonResponse({ error: "unknown provider" }, provider ? 404 : 400);
+    }
+    const models = Array.isArray(body.models)
+      ? [...new Set(body.models.filter((m): m is string => typeof m === "string"))]
+      : [];
+    // Empty list clears the allowlist (provider reverts to exposing all models).
+    if (models.length > 0) config.providers[provider].selectedModels = models;
+    else delete config.providers[provider].selectedModels;
+    const { saveConfig: save } = await import("./config");
+    save(config);
+    await refreshCodexCatalogBestEffort();
+    return jsonResponse({ ok: true, provider, selected: models });
+  }
+
   // OAuth login (xai now; anthropic/kimi in cycle 2). Starts the flow and returns the auth URL;
   // the provider's loopback callback server (inside this process) captures the redirect in the
   // background, then the credential is persisted. The GUI opens the URL and polls /api/oauth/status.
@@ -2071,10 +2173,9 @@ export function startServer(port?: number) {
           return withCors(formatErrorResponse(403, "origin_rejected", "cross-origin data-plane request blocked"), req, config);
         }
         const goModels = await fetchAllModels(config);
-        const { buildCatalogEntries, loadCatalogTemplate, nativeOpenAiSlugs, orderForSubagents } = await import("./codex-catalog");
+        const { buildCatalogEntries, loadCatalogTemplate, nativeOpenAiSlugs, orderForSubagents, filterCatalogVisibleModels } = await import("./codex-catalog");
         const nativeSlugs = nativeOpenAiSlugs();
-        const disabledSet = new Set(config.disabledModels ?? []);
-        const goEnabled = goModels.filter(m => !disabledSet.has(`${m.provider}/${m.id}`));
+        const goEnabled = filterCatalogVisibleModels(goModels, config);
         const goOrdered = orderForSubagents(goEnabled, config.subagentModels);
         if (url.searchParams.has("client_version")) {
           // Codex client → Codex catalog shape: native gpt + namespaced routed models,

package/src/types.ts

@@ -274,6 +274,33 @@ export interface OcxConfig {
   autoSwitchThreshold?: number;
   /** Consecutive non-2xx upstream responses before switching future new threads. Default 3. 0 = disabled. */
   upstreamFailoverThreshold?: number;
+  /** Background proactive token refresh ("Token Guardian"). Off by default; see OcxTokenGuardianConfig. */
+  tokenGuardian?: OcxTokenGuardianConfig;
+}
+
+/**
+ * Per-provider proactive-refresh policy. The guardian only ever touches a provider whose EFFECTIVE
+ * policy is "proactive"; "lazy-only" keeps today's on-demand refresh, "disabled" forbids the
+ * guardian entirely (used for providers whose ToS actively enforces against non-official-client
+ * token traffic, e.g. Anthropic subscription OAuth). See devlog 260703_oauth-multi-account-refresh-and-tos.
+ */
+export type RefreshPolicy = "proactive" | "lazy-only" | "disabled";
+
+export interface OcxTokenGuardianConfig {
+  /** Global kill-switch. Default false — the guardian does nothing unless explicitly enabled. */
+  enabled?: boolean;
+  /** Seconds between refresh sweeps. Default 21600 (6h). Min 60. */
+  tickSeconds?: number;
+  /** Random 0..jitterSeconds added before each sweep to de-synchronize. Default 300. */
+  jitterSeconds?: number;
+  /** Max concurrent refreshes per sweep. Default 3. Min 1. */
+  concurrency?: number;
+  /** Extra lead (seconds) beyond one tick when deciding a token is "expiring soon". Default 900. */
+  leadSeconds?: number;
+  /** First backoff (seconds) after a permanent refresh failure. Default 300. */
+  failureBackoffBaseSeconds?: number;
+  /** Backoff ceiling (seconds). Default 3600. */
+  failureBackoffMaxSeconds?: number;
 }
 
 export interface OcxVisionSidecarConfig {
@@ -312,6 +339,14 @@ export interface OcxProviderConfig {
    * or too flaky for startup/catalog sync.
    */
   liveModels?: boolean;
+  /**
+   * Per-provider catalog allowlist. When non-empty, ONLY these model ids are emitted to Codex's
+   * catalog and `/v1/models` — live discovery still runs, this just narrows what ships (so a proxy
+   * exposing thousands of models, or an aggregator like OpenRouter, doesn't bloat the catalog).
+   * Empty/undefined = expose all. The admin `/api/models` list is unaffected (it always shows the
+   * full set so the user can pick). See devlog issue_052_provider-model-allowlist.
+   */
+  selectedModels?: string[];
   /** Provider-wide Codex-visible context-window cap for routed catalog entries. */
   contextWindow?: number;
   /** Model-specific Codex-visible context-window caps. Values cap live metadata, never raise it. */
@@ -326,6 +361,12 @@ export interface OcxProviderConfig {
    * Only the openai-responses adapter implements "forward"; openai-chat uses its own key/token.
    */
   authMode?: "key" | "forward" | "oauth";
+  /**
+   * Override the guardian's proactive-refresh policy for this provider. When unset, the provider's
+   * built-in risk-tiered default applies (see OAUTH_PROVIDERS in src/oauth/index.ts). Set "proactive"
+   * to opt this provider into background refresh; "disabled"/"lazy-only" to forbid/limit it.
+   */
+  refreshPolicy?: RefreshPolicy;
   /**
    * Provider-wide Codex-visible reasoning tiers for routed models. Use only Codex-supported labels
    * here (`low`, `medium`, `high`, `xhigh`); translate to provider-specific wire values with

package/src/upstream-retry.ts

@@ -0,0 +1,96 @@
+/**
+ * Retry guard for upstream fetches that die on stale pooled keep-alive sockets.
+ *
+ * chatgpt.com (Cloudflare) closes idle keep-alive connections server-side; Bun's fetch pool
+ * reuses the half-closed socket and the request write fails with ECONNRESET before any
+ * response bytes arrive. Retrying on a fresh connection is safe for our replayable
+ * (string-body) upstream requests, because fetch() rejects only before response headers —
+ * a caught error here means no response was ever received.
+ *
+ * Deliberately narrow: timeouts, aborts, ECONNREFUSED/DNS/TLS failures, and HTTP error
+ * statuses (returned as Response, never thrown) are NOT retried. Mid-stream SSE resets are
+ * out of scope — the response has already resolved by then.
+ *
+ * MUST stay a leaf module: imports nothing from server.ts or adapters (kiro-retry imports
+ * the shared abort helpers from here).
+ */
+
+// 1 initial + 2 retries: the pool may hold more than one stale socket.
+const RESET_RETRY_MAX_ATTEMPTS = 3;
+const RESET_RETRY_BASE_DELAY_MS = 150;
+const RESET_RETRY_MAX_DELAY_MS = 1_000;
+
+export function abortError(signal?: AbortSignal): unknown {
+  return signal?.reason ?? new DOMException("The operation was aborted", "AbortError");
+}
+
+export async function sleepWithAbort(ms: number, signal?: AbortSignal): Promise<void> {
+  if (ms <= 0) return;
+  if (signal?.aborted) throw abortError(signal);
+  await new Promise<void>((resolve, reject) => {
+    let timer: ReturnType<typeof setTimeout>;
+    const cleanup = () => {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", onAbort);
+    };
+    const onAbort = () => {
+      cleanup();
+      reject(abortError(signal));
+    };
+    timer = setTimeout(() => {
+      cleanup();
+      resolve();
+    }, ms);
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+
+export function isConnectionResetError(err: unknown): boolean {
+  if (!(err instanceof Error)) return false;
+  // Aborts and timeouts are caller decisions / honest failures — never retryable.
+  if (err.name === "AbortError" || err.name === "TimeoutError") return false;
+  const code = (err as { code?: unknown }).code;
+  if (code === "ECONNRESET" || code === "EPIPE") return true;
+  const msg = err.message.toLowerCase();
+  return msg.includes("socket connection was closed unexpectedly")
+    || msg.includes("connection reset by peer");
+}
+
+function retryDelayMs(attempt: number): number {
+  const exp = Math.min(RESET_RETRY_BASE_DELAY_MS * (2 ** attempt), RESET_RETRY_MAX_DELAY_MS);
+  return Math.floor(exp * (0.8 + Math.random() * 0.4));
+}
+
+export interface ResetRetryOptions {
+  abortSignal?: AbortSignal;
+  /** Short host/path label for the retry warn log (no secrets/query strings). */
+  label?: string;
+  attempts?: number;
+}
+
+/**
+ * Run `doFetch`, retrying only connection-reset-shaped rejections (see
+ * isConnectionResetError) with jittered backoff. The caller's thunk must be replay-safe
+ * (string body); every retry is logged so persistent resets stay visible.
+ */
+export async function fetchWithResetRetry(
+  doFetch: () => Promise<Response>,
+  opts: ResetRetryOptions = {},
+): Promise<Response> {
+  const attempts = Math.max(1, opts.attempts ?? RESET_RETRY_MAX_ATTEMPTS);
+  let lastError: unknown;
+  for (let attempt = 0; attempt < attempts; attempt++) {
+    if (opts.abortSignal?.aborted) throw abortError(opts.abortSignal);
+    try {
+      return await doFetch();
+    } catch (err) {
+      if (opts.abortSignal?.aborted || !isConnectionResetError(err) || attempt === attempts - 1) throw err;
+      lastError = err;
+      console.warn(
+        `[upstream-retry] connection reset${opts.label ? ` (${opts.label})` : ""} — retrying (${attempt + 2}/${attempts})`,
+      );
+      await sleepWithAbort(retryDelayMs(attempt), opts.abortSignal);
+    }
+  }
+  throw lastError ?? new Error("upstream fetch failed");
+}

package/src/vision/describe.ts

@@ -2,6 +2,7 @@ import type { OcxProviderConfig } from "../types";
 import { FORWARD_HEADERS } from "../adapters/openai-responses";
 import { signalWithTimeout, cancelBodyOnAbort } from "../abort";
 import { sidecarEnter } from "../sidecar-tracker";
+import { fetchWithResetRetry } from "../upstream-retry";
 import { parseSidecarSSE } from "../web-search/parse";
 import type { SidecarOutcomeRecorder } from "../web-search/executor";
 
@@ -84,12 +85,15 @@ export async function describeImage(
   const linkedSignal = signalWithTimeout(settings.timeoutMs, abortSignal);
   const sidecarExit = sidecarEnter("vision");
   try {
-    const res = await fetch(`${forwardProvider.baseUrl}/responses`, {
-      method: "POST",
-      headers,
-      body: JSON.stringify(body),
-      signal: linkedSignal.signal,
-    });
+    const res = await fetchWithResetRetry(
+      () => fetch(`${forwardProvider.baseUrl}/responses`, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(body),
+        signal: linkedSignal.signal,
+      }),
+      { abortSignal: linkedSignal.signal, label: "vision-sidecar" },
+    );
     recordOutcome?.(res.status);
     if (!res.ok) {
       const t = await res.text().catch(() => "");

package/src/web-search/executor.ts

@@ -2,6 +2,7 @@ import type { OcxProviderConfig } from "../types";
 import { FORWARD_HEADERS } from "../adapters/openai-responses";
 import { signalWithTimeout, cancelBodyOnAbort } from "../abort";
 import { sidecarEnter } from "../sidecar-tracker";
+import { fetchWithResetRetry } from "../upstream-retry";
 import { parseSidecarSSE, type WebSearchResult } from "./parse";
 import type { CodexUpstreamOutcome } from "../codex-routing";
 
@@ -67,12 +68,15 @@ export async function runWebSearch(
   const linkedSignal = signalWithTimeout(settings.timeoutMs, abortSignal);
   const sidecarExit = sidecarEnter("web-search");
   try {
-    const res = await fetch(url, {
-      method: "POST",
-      headers,
-      body: JSON.stringify(body),
-      signal: linkedSignal.signal,
-    });
+    const res = await fetchWithResetRetry(
+      () => fetch(url, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(body),
+        signal: linkedSignal.signal,
+      }),
+      { abortSignal: linkedSignal.signal, label: "web-search-sidecar" },
+    );
     recordOutcome?.(res.status);
     if (!res.ok) {
       const t = await res.text().catch(() => "");

package/src/web-search/loop.ts

@@ -4,6 +4,7 @@ import { namespacedToolName } from "../types";
 import { bridgeToResponsesSSE } from "../bridge";
 import { runWebSearch, type SidecarOutcome, type SidecarOutcomeRecorder, type SidecarSettings } from "./executor";
 import { cancelBodyOnAbort } from "../abort";
+import { fetchWithResetRetry } from "../upstream-retry";
 import { formatWebSearchResults } from "./format-result";
 import { WEB_SEARCH_TOOL_NAME } from "./synthetic-tool";
 
@@ -200,12 +201,15 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
     try {
       resp = adapter.fetchResponse
         ? await adapter.fetchResponse(request, { abortSignal: signal })
-        : await fetch(request.url, {
-            method: request.method,
-            headers: request.headers,
-            body: request.body,
-            signal,
-          });
+        : await fetchWithResetRetry(
+            () => fetch(request.url, {
+              method: request.method,
+              headers: request.headers,
+              body: request.body,
+              signal,
+            }),
+            { abortSignal: signal, label: "web-search-loop" },
+          );
     } catch (e) {
       throw new LoopError(502, `Provider unreachable: ${e instanceof Error ? e.message : String(e)}`);
     }