@bitkyc08/opencodex 2.65.0 → 2.66.0-preview.20260925

package/src/combos/resolve.ts

@@ -10,7 +10,7 @@ import {
 } from "./failover";
 import { quotaResetRemainingMs } from "./reset-window";
 import { getCombo, resolveComboId, targetKey } from "./types";
-import type { NormalizedComboConfig } from "./types";
+import type { NormalizedComboConfig, NormalizedComboTarget } from "./types";
 import {
   captureConfigGeneration,
   type GenerationContext,
@@ -18,7 +18,7 @@ import {
 
 export interface ComboPick {
   comboId: string;
-  target: Required<OcxComboTarget>;
+  target: NormalizedComboTarget;
   targetIndex: number;
   attempted: string[];
   writerGeneration: number;
@@ -138,9 +138,9 @@ export function quotaInactiveReason(
 }
 
 function smoothWeightedIndex(
-  targets: Required<OcxComboTarget>[],
+  targets: NormalizedComboTarget[],
   state: SelectionState,
-  eligible: (target: Required<OcxComboTarget>) => boolean,
+  eligible: (target: NormalizedComboTarget) => boolean,
 ): number {
   let best = -1;
   let bestScore = Number.NEGATIVE_INFINITY;
@@ -175,8 +175,8 @@ function smoothWeightedIndex(
  */
 function resetWindowIndex(
   config: OcxConfig,
-  targets: Required<OcxComboTarget>[],
-  eligible: (target: Required<OcxComboTarget>) => boolean,
+  targets: NormalizedComboTarget[],
+  eligible: (target: NormalizedComboTarget) => boolean,
   now = Date.now(),
 ): number {
   let selected = -1;
@@ -202,7 +202,7 @@ export function pickComboTarget(
   comboId: string,
   options: {
     exclude?: Iterable<string>;
-    eligible?: (target: Required<OcxComboTarget>) => boolean;
+    eligible?: (target: NormalizedComboTarget) => boolean;
     now?: number;
   } = {},
 ): ComboPick | null {
@@ -211,7 +211,7 @@ export function pickComboTarget(
   if (!combo) throw new UnknownComboError(comboId);
   const excluded = new Set(options.exclude ?? []);
   const now = options.now ?? Date.now();
-  const eligible = (target: Required<OcxComboTarget>): boolean =>
+  const eligible = (target: NormalizedComboTarget): boolean =>
     targetProviderIsUsable(config, target, now)
     && !isComboTargetInCooldown(comboId, target, now)
     && !excluded.has(targetKey(target))
@@ -291,7 +291,7 @@ export function pickComboTarget(
 export function noteComboSuccess(
   comboId: string,
   combo: NormalizedComboConfig,
-  target: Required<OcxComboTarget>,
+  target: NormalizedComboTarget,
   writerGeneration = captureConfigGeneration(),
 ): void {
   const key = targetKey(target);
@@ -336,8 +336,9 @@ export function advanceComboAfterFailure(
     resetAt?: unknown | unknown[];
     now?: number;
     cooldownMs?: number;
-    eligible?: (target: Required<OcxComboTarget>) => boolean;
+    eligible?: (target: NormalizedComboTarget) => boolean;
     cooldownScope?: ComboFailureCooldownScope;
+    onCooldownRecorded?: (target: Pick<OcxComboTarget, "provider" | "model">) => void;
     status?: number;
     code?: string | null;
     message?: string;
@@ -352,11 +353,12 @@ export function advanceComboAfterFailure(
       ? combo.targets.filter(target => target.provider === pick.target.provider)
       : [pick.target];
     for (const target of cooldownTargets) {
-      coolComboTarget(pick.comboId, target, {
+      const recorded = coolComboTarget(pick.comboId, target, {
         ...options,
         cooldownMs: options.cooldownMs ?? combo?.cooldownMs,
         writerGeneration: pick.writerGeneration,
       });
+      if (recorded) options.onCooldownRecorded?.(target);
     }
   }
   // #5691: under `cooldownWaitPolicy: "before-last-resort"` this final synchronous pick
@@ -380,7 +382,7 @@ export async function pickComboTargetWithWait(
   comboId: string,
   options: {
     exclude?: Iterable<string>;
-    eligible?: (target: Required<OcxComboTarget>) => boolean;
+    eligible?: (target: NormalizedComboTarget) => boolean;
     waitForCooldownMs: number;
     abortSignal?: AbortSignal;
     now?: number;
@@ -390,10 +392,10 @@ export async function pickComboTargetWithWait(
   const now = options.now ?? Date.now();
   const excluded = new Set(options.exclude ?? []);
   const customEligible = options.eligible;
-  const eligibleAt = (target: Required<OcxComboTarget>, at: number): boolean =>
+  const eligibleAt = (target: NormalizedComboTarget, at: number): boolean =>
     !isComboTargetInCooldown(comboId, target, at)
     && (customEligible?.(target) ?? true);
-  const eligible = (target: Required<OcxComboTarget>): boolean => eligibleAt(target, now);
+  const eligible = (target: NormalizedComboTarget): boolean => eligibleAt(target, now);
   // Milliseconds already slept inside this call. `waitForCooldownMs` is documented as a cap
   // per *selection attempt*, so a deferral wait and the ordinary wait below must share it —
   // otherwise a 3s deferral followed by a 9s ordinary wait spends 12s against a 10s budget.
@@ -411,7 +413,7 @@ export async function pickComboTargetWithWait(
   const defersLastResort = policyCombo?.cooldownWaitPolicy === "before-last-resort"
     && policyCombo.targets.some(target => !target.lastResort);
   if (defersLastResort && !options.abortSignal?.aborted) {
-    const normalOnly = (target: Required<OcxComboTarget>): boolean =>
+    const normalOnly = (target: NormalizedComboTarget): boolean =>
       !target.lastResort && eligible(target);
     const normalPick = pickComboTarget(config, comboId, {
       exclude: excluded,

package/src/combos/types.ts

@@ -20,6 +20,15 @@ export interface ComboValidationIssue {
   message: string;
 }
 
+export interface NormalizedComboTarget {
+  provider: string;
+  model: string;
+  weight: number;
+  /** Emergency-only target, deferred under `cooldownWaitPolicy` (#5691). */
+  lastResort: boolean;
+  reasoningEfforts?: OcxComboDefaultEffort[];
+}
+
 export interface NormalizedComboConfig {
   strategy: OcxComboStrategy;
   stickyLimit: number;
@@ -40,7 +49,7 @@ export interface NormalizedComboConfig {
   nativeAlias: boolean;
   /** Display-only label for the catalog row, or null when unset. */
   displayName: string | null;
-  targets: Array<Required<OcxComboTarget>>;
+  targets: NormalizedComboTarget[];
 }
 
 /**
@@ -142,8 +151,9 @@ export function comboConfigIssues(
     && body.strategy !== "round-robin"
     && body.strategy !== "random"
     && body.strategy !== "least-used"
-    && body.strategy !== "reset-window") {
-    issues.push({ path: ["strategy"], message: 'strategy must be "failover", "round-robin", "random", "least-used", or "reset-window"' });
+    && body.strategy !== "reset-window"
+    && body.strategy !== "jev") {
+    issues.push({ path: ["strategy"], message: 'strategy must be "failover", "round-robin", "random", "least-used", "reset-window", or "jev"' });
   }
   if (body.stickyLimit !== undefined
     && (typeof body.stickyLimit !== "number" || !Number.isInteger(body.stickyLimit)
@@ -269,6 +279,11 @@ export function comboConfigIssues(
         path: ["targets", i, "provider"],
         message: `targets[${i}].provider "${provider}" is not configured`,
       });
+    } else if (providers[provider]?.adapter === "jev-decision") {
+      issues.push({
+        path: ["targets", i, "provider"],
+        message: `targets[${i}].provider "${provider}" is a decision service and cannot be a model target`,
+      });
     } else {
       configuredProviderCount += 1;
       if (providers[provider]?.disabled !== true) enabledProviderCount += 1;
@@ -286,6 +301,32 @@ export function comboConfigIssues(
         message: `targets[${i}].weight must be an integer from 1 to 10000`,
       });
     }
+    if (target.reasoningEfforts !== undefined) {
+      if (!Array.isArray(target.reasoningEfforts) || target.reasoningEfforts.length === 0) {
+        issues.push({
+          path: ["targets", i, "reasoningEfforts"],
+          message: `targets[${i}].reasoningEfforts must be a non-empty array`,
+        });
+      } else {
+        const seenEfforts = new Set<OcxComboDefaultEffort>();
+        for (let effortIndex = 0; effortIndex < target.reasoningEfforts.length; effortIndex++) {
+          const effort = target.reasoningEfforts[effortIndex];
+          if (typeof effort !== "string" || !isCodexReasoningEffort(effort)) {
+            issues.push({
+              path: ["targets", i, "reasoningEfforts", effortIndex],
+              message: `targets[${i}].reasoningEfforts[${effortIndex}] must be one of: low, medium, high, xhigh, max, ultra`,
+            });
+          } else if (seenEfforts.has(effort as OcxComboDefaultEffort)) {
+            issues.push({
+              path: ["targets", i, "reasoningEfforts", effortIndex],
+              message: `targets[${i}].reasoningEfforts must not contain duplicates`,
+            });
+          } else {
+            seenEfforts.add(effort as OcxComboDefaultEffort);
+          }
+        }
+      }
+    }
     if (target.lastResort !== undefined && typeof target.lastResort !== "boolean") {
       issues.push({
         path: ["targets", i, "lastResort"],
@@ -345,6 +386,9 @@ export function normalizeComboConfig(raw: OcxComboConfig): NormalizedComboConfig
       provider: target.provider.trim(),
       model: target.model.trim(),
       weight: target.weight ?? 1,
+      ...(target.reasoningEfforts !== undefined
+        ? { reasoningEfforts: [...target.reasoningEfforts] }
+        : {}),
       lastResort: target.lastResort === true,
     })),
   };

package/src/config/atomic-write.ts

@@ -73,6 +73,8 @@ export interface AtomicWriteHooks {
   afterTempWrite?: (tempPath: string, targetPath: string) => void;
   beforeRename?: (tempPath: string, targetPath: string) => void;
   validateBeforeRename?: (targetPath: string) => void;
+  /** Publication receipt; runs before any post-rename cleanup can fail. */
+  afterRename?: (targetPath: string) => void;
 }
 
 export class AtomicWriteResidualTempError extends Error {
@@ -314,6 +316,7 @@ function atomicWriteFileToTarget(
     hooks.beforeRename?.(tmp, target);
     hooks.validateBeforeRename?.(target);
     effective.rename(tmp, target);
+    hooks.afterRename?.(target);
     // The rename is only as durable as the directory entry recording it. Fsyncing the temp's
     // CONTENT and then losing the entry in a power cut leaves the old file in place, or the
     // directory in an indeterminate state, while the caller was told the replacement landed.

package/src/config/live-reconcile.ts

@@ -14,7 +14,7 @@ import {
   projectConfigRebaseProvenance,
 } from "./rebase-provenance";
 import { withConfigMutationLockSync, bumpGenerationForCooperatingConfigWrite } from "./mutation-lock";
-import { persistConfigUnlocked, readRawConfigJson } from "./persist-unlocked";
+import { ConfigWritePublishedError, persistConfigUnlocked, readRawConfigJson } from "./persist-unlocked";
 import { configDiagnosticsFromRaw, readConfigDiagnostics } from "./diagnostics";
 import { normalizePersistedClaudeCode } from "./load-degrade";
 
@@ -425,7 +425,13 @@ function readPersistedServerBinding(
 export function saveConfigPreservingClaudeCode(config: OcxConfig): void {
   const pinError = configReasoningPinsConfigError(config);
   if (pinError) throw new Error(pinError);
-  withConfigMutationLockSync(() => {
+  let published = false;
+  const persist = (candidate: OcxConfig): void => {
+    const changed = persistConfigUnlocked(candidate);
+    published = true;
+    if (changed) bumpGenerationForCooperatingConfigWrite();
+  };
+  const save = () => withConfigMutationLockSync(() => {
     const childDeletions = prepareConfigObjectChildDeletionRebase(config);
     const bindingBaseline = persistedLiveServerBinding.get(config);
     // One authoritative pre-write read feeds both the live-config reconciliation and
@@ -510,10 +516,10 @@ export function saveConfigPreservingClaudeCode(config: OcxConfig): void {
       const persistedConfig: OcxConfig = { ...projectedConfig, port: persistedBinding.port };
       if (persistedBinding.hostname === undefined) delete persistedConfig.hostname;
       else persistedConfig.hostname = persistedBinding.hostname;
-      if (persistConfigUnlocked(persistedConfig)) bumpGenerationForCooperatingConfigWrite();
+      persist(persistedConfig);
       persistedLiveServerBinding.set(config, persistedBinding);
     } else {
-      if (persistConfigUnlocked(projectedConfig)) bumpGenerationForCooperatingConfigWrite();
+      persist(projectedConfig);
     }
     adoptCustomModelCatalogMigration(config, projectedConfig);
     if (claudeCodeBaseline.has(config)) {
@@ -527,4 +533,14 @@ export function saveConfigPreservingClaudeCode(config: OcxConfig): void {
     clearPendingConfigObjectChildDeletions(config);
     clearPendingConfigTopLevelDeletions(config);
   });
+  try {
+    save();
+  } catch (error) {
+    // Generation/baseline updates and the lock's COMMIT run after publication.
+    // They may fail, but the file replacement cannot be undone by a live rollback.
+    if (published && !(error instanceof ConfigWritePublishedError)) {
+      throw new ConfigWritePublishedError(error);
+    }
+    throw error;
+  }
 }

package/src/config/persist-unlocked.ts

@@ -8,6 +8,14 @@ import { getConfigPath } from "./paths";
 import { configRebaseDeletionKeys, projectConfigRebaseProvenance } from "./rebase-provenance";
 import { clientConnectionSchema } from "./schema/leaf-validators";
 
+/** The requested bytes are current; callers must not roll back only live state. */
+export class ConfigWritePublishedError extends Error {
+  constructor(cause: unknown) {
+    super("Config was published, but post-publication bookkeeping failed", { cause });
+    this.name = "ConfigWritePublishedError";
+  }
+}
+
 /** The literal file, with no schema merge or default injection. */
 export function readRawConfigJson(): Record<string, unknown> | undefined {
   try {
@@ -81,13 +89,18 @@ export function persistConfigUnlocked(config: OcxConfig): boolean {
   // including byte-identical saves: a cooperating CLI process may have written
   // the same bytes (e.g. before a proxy notification), and Logs/Usage must
   // adopt the overlay without waiting for a changed save or restart.
-  if (unchanged) {
+  let published = unchanged;
+  try {
+    if (!unchanged) {
+      atomicWriteFile(configPath, bytes, undefined, { afterRename: () => { published = true; } });
+      published = true;
+    }
+    // Publication, not successful cache refresh, is the rollback boundary. A
+    // byte-identical save already has the requested state on disk as well.
     refreshConfigDerivedRegistries(persisted);
-    return false;
+    return !unchanged;
+  } catch (error) {
+    if (published) throw new ConfigWritePublishedError(error);
+    throw error;
   }
-  atomicWriteFile(configPath, bytes);
-  // For changed saves, refresh only AFTER the write succeeded so a failed
-  // write cannot leave estimates reflecting configuration never persisted.
-  refreshConfigDerivedRegistries(persisted);
-  return true;
 }

package/src/config/schema/config-schema.ts

@@ -79,6 +79,22 @@ export const configSchema = z.object({
   privacy: z.object({ maskEmails: z.boolean().optional() }).strict().optional().catch(undefined),
   // Malformed hand edits disable this opt-in exporter. Live writes reject them in diagnostics.ts.
   metricsExport: z.object({ enabled: z.boolean().optional() }).strict().optional().catch(undefined),
+  // Kept raw on purpose: `.catch(undefined)` would turn a mistyped `enabled` into "inherit",
+  // which can reopen a surface the operator meant to close. src/protocols/settings.ts parses it
+  // and fails closed instead.
+  apiSurfaces: z.unknown().optional(),
+  // Every protocol default is the conservative one (legacy policy, rollout off), so a malformed
+  // block dropping to undefined cannot widen behavior.
+  protocols: z.object({
+    unrepresentable: z.enum(["legacy", "reject"]).optional(),
+    rollout: z.object({
+      nativeChatCombos: z.boolean().optional(),
+      managedMessagesNative: z.boolean().optional(),
+      managedMessagesNativeOAuth: z.boolean().optional(),
+      directEncoders: z.boolean().optional(),
+      shadowPlan: z.boolean().optional(),
+    }).strict().optional(),
+  }).strict().optional().catch(undefined),
   // A malformed present client block must remain diagnosable from raw config and
   // fail closed through src/client/state.ts; unrelated provider state still loads.
   client: clientConnectionSchema.optional().catch(undefined),

package/src/config/schema/leaf-validators.ts

@@ -779,6 +779,7 @@ export const agentTaskRecoverySchema = z.object({
   model: z.string().trim().min(1).optional(),
   timeoutMs: z.number().int().min(1_000).max(120_000).optional(),
   cacheEntries: z.number().int().min(1).max(512).optional(),
+  retries: z.number().int().min(0).max(2).optional(),
 }).strict();
 
 export const runtimeRoleSchema = z.enum(["standalone", "hub", "client"]);
@@ -852,6 +853,13 @@ export const remoteGuiConfigSchema = z.object({
 
 const connectedClientIdSchema = z.enum(["codex", "claude"]);
 const clientTimestampSchema = z.string().datetime({ offset: true });
+const clientTransportSchema = z.enum(["hub", "link"]);
+const linkTransportSchema = z.object({
+  // Same range as isLinkPort in src/link/ports.ts, restated here because the config schema sits on
+  // every install's core path and must not import link code (tests/lab/core-link-boundary.test.ts).
+  tunnelPort: z.number().int().min(1024).max(65535),
+  linkId: z.string().regex(/^lnk_[0-9a-f]{16}$/),
+}).strict();
 const clientOriginSchema = z.string().transform((value, ctx) => {
   const origin = canonicalHttpOrigin(value);
   if (!origin) {
@@ -864,6 +872,8 @@ export const clientConnectionSchema = z.object({
   serverUrl: clientOriginSchema,
   managementUrl: clientOriginSchema,
   managementTransport: z.enum(["direct", "relay"]),
+  transport: clientTransportSchema.optional(),
+  link: linkTransportSchema.optional(),
   selectedClients: z.array(connectedClientIdSchema).min(1).max(2).superRefine((clients, ctx) => {
     if (new Set(clients).size !== clients.length) {
       ctx.addIssue({ code: "custom", message: "must contain unique client ids" });
@@ -890,7 +900,34 @@ export const clientConnectionSchema = z.object({
       ctx.addIssue({ code: "custom", path: ["oldKeyBackupPath"], message: `must equal ${expected}` });
     }
   }).optional(),
-}).strict();
+}).strict().superRefine((connection, ctx) => {
+  const transport = connection.transport ?? "hub";
+  if (transport === "hub" && connection.link !== undefined) {
+    ctx.addIssue({ code: "custom", path: ["link"], message: "link is allowed only when transport is link" });
+    return;
+  }
+  if (transport !== "link") return;
+  if (!connection.link) {
+    ctx.addIssue({ code: "custom", path: ["link"], message: "link is required when transport is link" });
+    return;
+  }
+  if (connection.managementTransport !== "direct") {
+    ctx.addIssue({ code: "custom", path: ["managementTransport"], message: "link transport requires direct management transport" });
+  }
+  if (connection.serverUrl !== connection.managementUrl) {
+    ctx.addIssue({ code: "custom", path: ["managementUrl"], message: "link transport requires serverUrl and managementUrl to match" });
+  }
+  let origin: URL;
+  try {
+    origin = new URL(connection.serverUrl);
+  } catch {
+    return;
+  }
+  if (origin.protocol !== "http:" || origin.hostname !== "127.0.0.1"
+    || origin.port !== String(connection.link.tunnelPort)) {
+    ctx.addIssue({ code: "custom", path: ["serverUrl"], message: "link transport requires http://127.0.0.1:<tunnelPort>" });
+  }
+});
 
 /**
  * Codex pool selection policy section.