@bitkyc08/opencodex 2.66.0-preview.20260925 → 2.67.0-preview.20260926

package/src/cli/integrations.ts

@@ -20,7 +20,8 @@ const CLAUDE_USAGE = `Usage:
       [--compact-window <tokens|default>] [--inject-agents <on|off>]
       [--small-fast-model <id|->] [--model-map <from=to,from=to|->]
       [--blocked-skills <name,name|->] [--web-model <id|->] [--web-backend <openai|anthropic|xai|gemini|exa|->]
-      [--vision-model <id|->] [--vision-backend <openai|anthropic|->] [--json]`;
+      [--vision-model <id|->] [--vision-backend <openai|anthropic|->] [--json]
+  ocx claude config set --first-party <on|off> [--json]`;
 
 const GROK_USAGE = `Usage:
   ocx grok [status] [--json]
@@ -74,6 +75,7 @@ export async function handleClaudeConfigCommand(argv: string[], deps: RuntimeApi
     if (action !== "set") throw new CliUsageError(`unknown Claude config command ${action}`, CLAUDE_USAGE);
     const body: Record<string, unknown> = {};
     const enabled = takeBooleanOption(args, "--enabled");
+    const firstParty = takeBooleanOption(args, "--first-party");
     const authMode = takeOption(args, "--auth-mode");
     const systemEnv = takeBooleanOption(args, "--system-env");
     const fastMode = takeBooleanOption(args, "--fast-mode");
@@ -116,6 +118,12 @@ export async function handleClaudeConfigCommand(argv: string[], deps: RuntimeApi
     const vision = sidecar(visionModel, visionBackend);
     if (web) body.webSearchSidecar = web;
     if (vision) body.visionSidecar = vision;
+    if (firstParty !== undefined) {
+      if (Object.keys(body).length > 0) {
+        throw new CliUsageError("--first-party must be set on its own (it writes Claude Code's settings file immediately)", CLAUDE_USAGE);
+      }
+      body.cliFirstParty = firstParty;
+    }
     if (Object.keys(body).length === 0) throw new CliUsageError("at least one Claude setting is required", CLAUDE_USAGE);
     const result = await runtimeRequest("/api/claude-code", { method: "PUT", body: JSON.stringify(body) }, deps);
     printData(result, wantsJson, ["Claude Code settings updated."]);

package/src/cli/uninstall-client-state.ts

@@ -6,6 +6,7 @@ import { inspectRemoteDesktopCleanup, readDesktopDisconnectReceipt } from "../cl
 import { removeOwnedConfigState, type ConfigRemovalResult } from "../lib/config-ownership";
 import { windowsSecretAclReapPendingAtOrBelow } from "../lib/windows-secret-acl";
 import { sharedTeardownAuthorized, type UninstallObservation } from "./uninstall-plan";
+import { cleanupOwnedIntegrationsBeforeUninstall } from "./uninstall-integrations";
 
 export interface UninstallClientStateDeps {
   readConnection: typeof readClientConnectionState;
@@ -13,6 +14,7 @@ export interface UninstallClientStateDeps {
   readReceipt: typeof readDesktopDisconnectReceipt;
   disconnect: (options?: Parameters<typeof disconnectClient>[0]) => Promise<unknown>;
   withLifecycle: typeof withClientLifecycle;
+  cleanupIntegrations: typeof cleanupOwnedIntegrationsBeforeUninstall;
   remove: () => ConfigRemovalResult;
   /** True while a timed-out icacls child still owns a path at or below the config directory. */
   aclReapPending: (rootPath: string) => boolean;
@@ -24,6 +26,7 @@ const defaults: UninstallClientStateDeps = {
   readReceipt: readDesktopDisconnectReceipt,
   disconnect: options => disconnectClient(options),
   withLifecycle: withClientLifecycle,
+  cleanupIntegrations: cleanupOwnedIntegrationsBeforeUninstall,
   remove: () => removeOwnedConfigState(getConfigDir()),
   aclReapPending: rootPath => windowsSecretAclReapPendingAtOrBelow(rootPath),
 };
@@ -85,6 +88,9 @@ export async function removeOwnedConfigAfterDesktopCleanup(
     if (deps.aclReapPending(getConfigDir())) {
       throw new Error("Client cleanup refused: ACL hardening still owns a path under the config directory.");
     }
+    // Integration records are the authority that permits removing only OpenCodex-owned fragments
+    // from third-party files. Delete them only after every recorded contribution is retired.
+    await deps.cleanupIntegrations();
     return deps.remove();
   });
 }

package/src/cli/uninstall-integrations.ts

@@ -0,0 +1,115 @@
+import type { ExportModel } from "../clients/config-export";
+import { guardAsideProfileIO, listAsideProfiles } from "../clients/aside-profiles";
+import { loadConfig } from "../config";
+import { listAsideProfileStores } from "../integrations/aside-profile-context";
+import { isIntegrationClientId, type IntegrationClientId } from "../integrations/registry";
+import { createIntegrationStateStore, type IntegrationStateStore } from "../integrations/store";
+import { disableIntegrationCoordinated, type WriteOutcome } from "../integrations/writer";
+import { loadExportModels } from "../server/management/model-rows";
+import type { OcxConfig } from "../types";
+
+export interface UninstallIntegrationCleanupDeps {
+  createStore: () => IntegrationStateStore;
+  loadConfig: () => OcxConfig;
+  loadModels: (config: OcxConfig) => Promise<ExportModel[]>;
+  disable: (input: Parameters<typeof disableIntegrationCoordinated>[0]) => Promise<WriteOutcome>;
+  env?: NodeJS.ProcessEnv;
+  home?: string;
+}
+
+const defaults: UninstallIntegrationCleanupDeps = {
+  createStore: () => createIntegrationStateStore(),
+  loadConfig,
+  loadModels: config => loadExportModels(config),
+  disable: input => disableIntegrationCoordinated(input),
+};
+
+export interface UninstallIntegrationCleanupResult {
+  attempted: number;
+  changed: number;
+}
+
+/**
+ * Remove every contribution we can still prove we own before uninstall deletes that proof.
+ * A single refusal aborts config removal: preserving recovery state is safer than leaving an
+ * external client pointed at a proxy that no longer exists.
+ */
+export async function cleanupOwnedIntegrationsBeforeUninstall(
+  deps: UninstallIntegrationCleanupDeps = defaults,
+): Promise<UninstallIntegrationCleanupResult> {
+  const store = deps.createStore();
+  const records = store.readRecordsStrict();
+  const rawIds = Object.keys(records);
+  for (const id of rawIds) {
+    if (!isIntegrationClientId(id)) {
+      throw new Error(`integration cleanup refused: ownership names unknown client ${id}`);
+    }
+  }
+  type CleanupTarget = Pick<Parameters<typeof disableIntegrationCoordinated>[0], "clientId" | "store" | "io" | "resolvedPaths">
+    & { store: IntegrationStateStore; profileId?: number };
+  const targets: CleanupTarget[] = (rawIds as IntegrationClientId[]).sort()
+    .map(clientId => ({ clientId, store }));
+  // Read every child before any mutation. A broken child must not look like no ownership.
+  for (const child of listAsideProfileStores(store)) {
+    const childRecords = child.store.readRecordsStrict();
+    if (Object.keys(childRecords).some(id => id !== "aside")) {
+      throw new Error("integration cleanup refused: Aside profile storage names another client");
+    }
+    if (childRecords.aside) targets.push({ clientId: "aside", ...child });
+  }
+  if (targets.length === 0) return { attempted: 0, changed: 0 };
+
+  const asideTargets = targets.filter(target => target.clientId === "aside");
+  if (asideTargets.length > 0) {
+    const profiles = listAsideProfiles(deps.env, deps.home);
+    const claimedProfiles = new Set<number>();
+    for (const target of asideTargets) {
+      const record = target.store.readRecordsStrict().aside;
+      const profile = profiles.find(candidate => candidate.configPath === record?.configPath
+        && (target.profileId === undefined || target.profileId === candidate.id));
+      if (!profile || claimedProfiles.has(profile.id)) {
+        throw new Error("integration cleanup refused: Aside profile ownership is missing or mismatched");
+      }
+      claimedProfiles.add(profile.id);
+      target.resolvedPaths = { configPath: profile.configPath, detectDir: profile.detectDir };
+      // io() closes over the raw store; route bookkeeping back through its guarded facade.
+      target.io = guardAsideProfileIO(profile, {
+        ...target.store.io(),
+        appendJournal: entry => target.store.appendJournal(entry),
+        putRecord: record => target.store.putRecord(record),
+        dropRecord: clientId => target.store.dropRecord(clientId),
+      }, profiles);
+    }
+  }
+
+  const config = deps.loadConfig();
+  const models = await deps.loadModels(config);
+  let changed = 0;
+  for (const { clientId, store: targetStore, io, resolvedPaths } of targets) {
+    const result = await deps.disable({
+      clientId,
+      models,
+      config,
+      port: config.port,
+      store: targetStore,
+      ...(io ? { io } : {}),
+      ...(resolvedPaths ? { resolvedPaths } : {}),
+      ...(deps.env ? { env: deps.env } : {}),
+      ...(deps.home ? { home: deps.home } : {}),
+    });
+    if (!result.ok) {
+      throw new Error(`integration cleanup refused for ${clientId}: ${result.message}`
+        + (result.residual ? "; recovery did not complete; inspect the client file and retained snapshots before retrying" : ""));
+    }
+    if (targetStore.readRecordsStrict()[clientId]) {
+      throw new Error(`integration cleanup did not retire ownership for ${clientId}`);
+    }
+    if (result.changed) changed++;
+  }
+  // A profile can gain ownership while catalog loading or an earlier disable awaited its lock.
+  if ([store, ...listAsideProfileStores(store).map(child => child.store)]
+    .some(current => Object.keys(current.readRecordsStrict()).length > 0)) {
+    throw new Error("integration cleanup refused: ownership changed before removal");
+  }
+  return { attempted: targets.length, changed };
+}

package/src/codex/history-job.ts

@@ -24,6 +24,7 @@ import type {
   HistoryWorkerResult,
 } from "./history-worker";
 import { currentHistoryDbBusyTimeoutMs, resolveExistingHistoryBackupPath } from "./history-provider";
+import { spawnWorker } from "../lib/worker-embed";
 import type { CodexHistoryFailureReason, CodexHistoryVerifiedNoopProof } from "./history-provider";
 import { getCodexHome, resolveCodexStateDbPath } from "./paths";
 
@@ -345,7 +346,7 @@ export async function runCodexHistoryJob(
 
   let worker: Worker;
   try {
-    worker = new Worker(new URL("./history-worker.ts", import.meta.url).href);
+    worker = spawnWorker(new URL("./history-worker.ts", import.meta.url).href, "history-worker");
   } catch (error) {
     return {
       kind: "failed",

package/src/codex/main-account-hard-lock.ts

@@ -31,6 +31,30 @@ function resetTimestamp(value: number | undefined): number | undefined {
   return value < 10_000_000_000 ? value * 1000 : value;
 }
 
+type WindowReading = { percent: number | undefined; resetAt: number | undefined };
+
+/**
+ * The windows that govern the lock. The 5h and weekly windows each govern on their own, so either
+ * one at 98% blocks even while the other has headroom. Monthly governs only a monthly-only account:
+ * supplementary monthly data on a 5h/weekly account never becomes a lock. The list is never empty,
+ * so a record with no readings at all classifies as unknown rather than vacuously ready.
+ */
+function governingWindows(quota: NonNullable<ReturnType<typeof getMainPolicyQuota>>): WindowReading[] {
+  const hasShort = quota.shortPercent !== undefined || quota.shortResetAt !== undefined
+    || quota.shortWindowSeconds !== undefined;
+  const hasWeekly = quota.weeklyPercent !== undefined || quota.weeklyResetAt !== undefined;
+  const windows: WindowReading[] = [];
+  if (hasShort) windows.push({ percent: quota.shortPercent, resetAt: quota.shortResetAt });
+  if (hasWeekly) windows.push({ percent: quota.weeklyPercent, resetAt: quota.weeklyResetAt });
+  if (windows.length === 0) windows.push({ percent: quota.monthlyPercent, resetAt: quota.monthlyResetAt });
+  return windows;
+}
+
+function validPercent(percent: number | undefined): percent is number {
+  // The routing score's unknown sentinel is 101. It is never a raw quota observation.
+  return typeof percent === "number" && Number.isFinite(percent) && percent >= 0 && percent <= 100;
+}
+
 /** Observed admission policy, not a reservation of the account's remaining quota. */
 export function getMainAccountHardLockStatus(
   config: PolicyConfig,
@@ -39,26 +63,19 @@ export function getMainAccountHardLockStatus(
   if (!isMainAccountHardLockEnabled(config)) return { enabled: false, state: "off" };
   const quota = getMainPolicyQuota();
   if (!quota) return { enabled: true, state: "unknown" };
-  // Account window priority is deliberate: a 5h account uses that window, even if
-  // its weekly bar is higher. An unknown/expired selected window does not change the choice.
-  const hasShort = quota.shortPercent !== undefined || quota.shortResetAt !== undefined
-    || quota.shortWindowSeconds !== undefined;
-  const hasWeekly = quota.weeklyPercent !== undefined || quota.weeklyResetAt !== undefined;
-  const [percent, rawReset] = hasShort
-    ? [quota.shortPercent, quota.shortResetAt]
-    : hasWeekly ? [quota.weeklyPercent, quota.weeklyResetAt] : [quota.monthlyPercent, quota.monthlyResetAt];
-  const resetAt = resetTimestamp(rawReset);
-  // The routing score's unknown sentinel is 101. It is never a raw quota observation.
-  if (typeof percent !== "number" || !Number.isFinite(percent) || percent < 0 || percent > 100) {
-    return { enabled: true, state: "unknown" };
+  const windows = governingWindows(quota);
+  const blocking = windows.filter(w => validPercent(w.percent) && w.percent >= MAIN_ACCOUNT_HARD_LOCK_PERCENT);
+  if (blocking.length > 0) {
+    // The lock holds until every blocking window reads lower, so the earliest possible unlock is
+    // the latest blocking reset. One blocking window without a future reset makes it unknowable.
+    // A predicted reset is not evidence of recovery either way: only a fresh lower reading releases.
+    const resets = blocking.map(w => resetTimestamp(w.resetAt));
+    const resetAt = resets.every(r => r !== undefined && r > now) ? Math.max(...(resets as number[])) : undefined;
+    return { enabled: true, state: "blocked", ...(resetAt !== undefined ? { resetAt } : {}) };
   }
-  if (percent < MAIN_ACCOUNT_HARD_LOCK_PERCENT) return { enabled: true, state: "ready" };
-  return {
-    enabled: true,
-    state: "blocked",
-    // A predicted reset is not evidence of recovery. Only a fresh lower reading releases.
-    ...(resetAt !== undefined && resetAt > now ? { resetAt } : {}),
-  };
+  // Unknown admits, so an unreadable window never hides a blocking one and never blocks alone.
+  if (windows.some(w => !validPercent(w.percent))) return { enabled: true, state: "unknown" };
+  return { enabled: true, state: "ready" };
 }
 
 export function isMainAccountHardLocked(config: PolicyConfig, now = Date.now()): boolean {

package/src/codex/quota.ts

@@ -354,7 +354,17 @@ function mergeAccountQuota(
     return stampCodexQuotaUsageObservation(next, quota, existing);
   }
 
-  if (snapshotHasWeekly(quota)) {
+  const existingWeeklyPercent = existing?.weeklyPercent;
+  // A reset-only weekly observation is not a lower reading. Policy mode keeps a blocking weekly
+  // tuple whole, exactly like preserveKnownShort; a governing monthly-primary observation still
+  // replaces it, so that release path does not depend on this guard.
+  const preserveKnownWeekly = policyEvidence
+    && quota.weeklyPercent === undefined
+    && quota.monthlyIsPrimaryWindow !== true
+    && finitePercent(existingWeeklyPercent)
+    && existingWeeklyPercent >= MAIN_ACCOUNT_HARD_LOCK_PERCENT
+    && existingWeeklyPercent <= 100;
+  if (snapshotHasWeekly(quota) && !preserveKnownWeekly) {
     if (quota.weeklyPercent !== undefined) next.weeklyPercent = quota.weeklyPercent;
     if (quota.weeklyResetAt !== undefined) next.weeklyResetAt = quota.weeklyResetAt;
   } else if (snapshotHasMonthly(quota)

package/src/combos/resolve.ts

@@ -204,6 +204,8 @@ export function pickComboTarget(
     exclude?: Iterable<string>;
     eligible?: (target: NormalizedComboTarget) => boolean;
     now?: number;
+    /** Inspect a round-robin choice without mutating its sticky/weight state. */
+    preview?: boolean;
   } = {},
 ): ComboPick | null {
   const writerGeneration = captureConfigGeneration();
@@ -222,7 +224,13 @@ export function pickComboTarget(
     let state = selectionState.get(comboId);
     if (!state) {
       state = { successes: 0, currentWeights: new Map(), successfulUses: new Map() };
-      selectionState.set(comboId, state);
+      if (!options.preview) selectionState.set(comboId, state);
+    } else if (options.preview) {
+      state = {
+        ...state,
+        currentWeights: new Map(state.currentWeights),
+        successfulUses: new Map(state.successfulUses),
+      };
     }
     if (state.activeKey) {
       targetIndex = combo.targets.findIndex(target => targetKey(target) === state.activeKey && eligible(target));
@@ -542,11 +550,11 @@ export function clearComboSelectionState(comboId?: string): void {
   selectionState.delete(comboId);
 }
 
-export function tryPickComboModel(config: OcxConfig, modelId: string): ComboPick | null {
+export function tryPickComboModel(config: OcxConfig, modelId: string, preview = false): ComboPick | null {
   const comboId = resolveComboId(config, modelId);
   if (!comboId) return null;
   if (!getCombo(config, comboId)) throw new UnknownComboError(comboId);
-  const picked = pickComboTarget(config, comboId);
+  const picked = pickComboTarget(config, comboId, { preview });
   if (!picked) throw new NoAvailableComboTargetsError(comboId);
   return picked;
 }

package/src/config/load-degrade.ts

@@ -544,6 +544,10 @@ export function normalizePersistedClaudeCode(claudeCode: unknown): OcxConfig["cl
     return claudeCode as OcxConfig["claudeCode"];
   }
   const normalized = { ...claudeCode } as Record<string, unknown>;
+  // A malformed hand edit must not arm CLI interception or discard the whole config.
+  if (Object.hasOwn(normalized, "cliFirstParty") && typeof normalized.cliFirstParty !== "boolean") {
+    delete normalized.cliFirstParty;
+  }
   if (Object.hasOwn(normalized, "subagentEffort") && !isClaudeSubagentEffort(normalized.subagentEffort)) {
     delete normalized.subagentEffort;
   }