@bitkyc08/opencodex 2.67.0 → 2.68.0-preview.20260927

package/src/codex/model-entitlements.ts

@@ -407,17 +407,21 @@ interface CachedAccountModels {
   readonly clientVersion: string;
   readonly expiresAt: number;
   readonly models: ReadonlySet<string>;
+  readonly accessProgramsByModel?: ReadonlyMap<string, CodexAvailableAccessPrograms>;
   readonly confirmed: boolean;
   readonly provenance?: CodexModelEntitlementProvenance;
 }
 
 export interface CodexModelEntitlementSnapshot {
   readonly modelsByAccount: ReadonlyMap<string, ReadonlySet<string>>;
+  readonly accessProgramsByAccount?: ReadonlyMap<string, ReadonlyMap<string, CodexAvailableAccessPrograms>>;
   readonly clientVersionByAccount: ReadonlyMap<string, string>;
   readonly confirmedAccountIds: ReadonlySet<string>;
   readonly credentialIdentities: ReadonlyMap<string, string>;
 }
 
+export type CodexAvailableAccessPrograms = Readonly<Record<string, readonly string[]>> | null;
+
 export type CodexModelEntitlementState = "granted" | "denied" | "unknown";
 
 export interface CodexModelEntitlementResolveOptions {
@@ -633,17 +637,29 @@ async function accountCredentialSnapshot(
   }
 }
 
-function parseAccountModels(text: string): ReadonlySet<string> | null {
+/** Keep valid roster slugs while dropping malformed program metadata; preserve explicit null separately from absence. */
+function parseAccountModels(text: string): { models: ReadonlySet<string>; accessProgramsByModel: ReadonlyMap<string, CodexAvailableAccessPrograms> } | null {
   try {
     const payload = JSON.parse(text) as { models?: unknown };
     if (!Array.isArray(payload.models)) return null;
+    const accessProgramsByModel = new Map<string, CodexAvailableAccessPrograms>();
     const models = payload.models.flatMap(entry => {
       if (!entry || typeof entry !== "object" || Array.isArray(entry)) return [];
-      const row = entry as { slug?: unknown; supported_in_api?: unknown; visibility?: unknown };
+      const row = entry as { slug?: unknown; supported_in_api?: unknown; visibility?: unknown; available_access_programs?: unknown };
       if (typeof row.slug !== "string" || row.supported_in_api !== true || row.visibility === "hide") return [];
+      const programs = row.available_access_programs;
+      if (programs === null) accessProgramsByModel.set(row.slug, null);
+      else if (programs && typeof programs === "object" && !Array.isArray(programs)) {
+        const record = programs as Record<string, unknown>;
+        if (Array.isArray(record.cyber) && record.cyber.every(item => typeof item === "string")) {
+          const validPrograms = Object.fromEntries(Object.entries(record).filter(([, value]) =>
+            Array.isArray(value) && value.every(item => typeof item === "string"))) as Record<string, string[]>;
+          accessProgramsByModel.set(row.slug, validPrograms);
+        }
+      }
       return [row.slug];
     });
-    return new Set(models);
+    return { models: new Set(models), accessProgramsByModel };
   } catch {
     return null;
   }
@@ -669,6 +685,7 @@ function isTimeoutError(error: unknown): boolean {
   return error instanceof Error && error.name === "TimeoutError";
 }
 
+/** Fetch one bounded, version-scoped roster; failures and empty results remain unconfirmed for a short retry. */
 async function fetchAccountModels(
   credential: CodexModelEntitlementCredentialSnapshot,
   fetcher: typeof fetch,
@@ -702,8 +719,8 @@ async function fetchAccountModels(
     if (!body.displaySafe || body.truncated) {
       return unconfirmedAccountModels(credential, clientVersion, now, { kind: "unparseable" });
     }
-    const models = parseAccountModels(body.text);
-    if (models === null) {
+    const parsed = parseAccountModels(body.text);
+    if (parsed === null) {
       return unconfirmedAccountModels(credential, clientVersion, now, { kind: "unparseable" });
     }
     // A roster is a confirmation only when it lists something usable. `models` is a Set, and an
@@ -713,6 +730,7 @@ async function fetchAccountModels(
     // account asked under too old a client version answers with no gated rows, and treating
     // that as authoritative is exactly how 2.36.0 denied sol/terra/luna to accounts that own
     // them (#3022). No usable rows means unconfirmed, on the 15s failure TTL, asked again.
+    const { models, accessProgramsByModel } = parsed;
     const usable = models.size > 0;
     if (!usable) {
       return unconfirmedAccountModels(credential, clientVersion, now, { kind: "parsed-empty" });
@@ -735,6 +753,7 @@ async function fetchAccountModels(
         ? MODEL_ROSTER_TTL_MS
         : MODEL_ROSTER_FAILURE_TTL_MS),
       models,
+      accessProgramsByModel,
       confirmed: true,
     };
   } catch (error) {
@@ -1173,6 +1192,10 @@ export async function resolveCodexModelEntitlements(
   })));
   return {
     modelsByAccount: new Map(results.map(({ credential, result }) => [credential.accountId, result.models])),
+    accessProgramsByAccount: new Map(results.flatMap(({ credential, result }) => (
+      result.confirmed && result.accessProgramsByModel
+        ? [[credential.accountId, result.accessProgramsByModel] as const] : []
+    ))),
     clientVersionByAccount: new Map(results.map(({ credential, result }) => (
       [credential.accountId, result.clientVersion]
     ))),

package/src/codex/routing/idle-window.ts

@@ -0,0 +1,58 @@
+import type { OcxConfig } from "../../types";
+import type { CodexAccountUsabilityOptions } from "../account-usability";
+import { pinnedCodexAccountId } from "../account-priority";
+import { getAccountQuota, resetAtToMs } from "../quota";
+import { manualPreferenceBlocks } from "./active-account";
+import { codexPoolKeyForScope, isIndependentCodexQuotaScope, type CodexQuotaScope } from "./health-store";
+import { getEligiblePoolAccounts, hasCodexQuotaHeadroom } from "./selection";
+import { bindThreadAffinity } from "./thread-affinity";
+
+const WINDOW_MS = 5 * 60 * 60_000;
+const TOLERANCE_MS = 60_000;
+const FRESHNESS_MS = 5 * 60_000;
+// Reservation is synchronous, so concurrent resolves cannot start the same window twice.
+// Keep the deadline fixed: idle observations may slide their reset forward on every poll.
+const steeredUntil = new Map<string, number>();
+
+export function clearIdleWindowSteering(): void {
+  steeredUntil.clear();
+}
+
+/** Only called for first placement, after conversation/family affinity has had precedence. */
+export function pickIdleWindowAccount(
+  config: OcxConfig,
+  threadId: string | null,
+  now: number,
+  commit: boolean,
+  quotaScope?: CodexQuotaScope,
+  selectionOptions?: CodexAccountUsabilityOptions,
+): string | null {
+  if (config.codexPool?.startIdleWindows !== true || isIndependentCodexQuotaScope(quotaScope)
+    || pinnedCodexAccountId(config) !== undefined) return null;
+  const eligible = getEligiblePoolAccounts(config, undefined, now, quotaScope, selectionOptions, true);
+  for (const id of eligible) {
+    if (manualPreferenceBlocks(codexPoolKeyForScope(quotaScope), id)
+      || selectionOptions?.deniedModelAccountIds?.has(id)
+      || !hasCodexQuotaHeadroom(config, id, selectionOptions, now)) continue;
+    const quota = getAccountQuota(id);
+    const observed = quota?.shortObservedAt;
+    const reset = quota?.shortResetAt;
+    if (quota?.shortPercent !== 0 || quota.shortWindowSeconds !== WINDOW_MS / 1000
+      || observed === undefined || !Number.isFinite(observed)
+      || reset === undefined || !Number.isFinite(reset)
+      || now < observed || now - observed > FRESHNESS_MS) continue;
+    const resetMs = resetAtToMs(reset);
+    const previous = steeredUntil.get(id);
+    if (Math.abs(resetMs - observed - WINDOW_MS) > TOLERANCE_MS || resetMs <= now
+      || (previous !== undefined && (now <= previous || observed <= previous))) continue;
+    if (commit) {
+      for (const [accountId, until] of steeredUntil) {
+        if (until < now - FRESHNESS_MS) steeredUntil.delete(accountId);
+      }
+      steeredUntil.set(id, Math.max(resetMs, now + WINDOW_MS) + TOLERANCE_MS);
+      if (threadId) bindThreadAffinity(threadId, id, now, quotaScope);
+    }
+    return id;
+  }
+  return null;
+}

package/src/codex/routing-drift.ts

@@ -0,0 +1,134 @@
+/**
+ * Does opencodex-owned Codex routing name a loopback port this process does not serve?
+ *
+ * `classifyCodexRouting` answers "opencodex-local" whatever the port, so a live proxy cannot tell
+ * from it that `config.toml` still points at a port a dead instance left behind. That is the state a
+ * killed second instance produced: the owner kept serving its port while every new Codex thread
+ * failed with "Connection refused" against the other one, and nothing looked again after startup.
+ *
+ * Pure: the caller passes the file bytes, the ports it serves, and (lazily) the journaled values.
+ * Only OWNED routing counts. Native config, a user's own root URL, a custom provider and an external
+ * `model_provider` are all `not-owned`, so nothing built on this can undo `ocx restore`, an eject, a
+ * Codex-OFF toggle or a stop teardown. Only loopback endpoints with an explicit port can be foreign:
+ * LAN and admission-token routing is never reported.
+ */
+import { externalCodexModelProvider } from "./inject/config-toml";
+import { classifyRoutingEndpoint } from "./inject/routing-classify";
+import {
+  OCX_SECTION_MARKER,
+  REALTIME_WS_BASE_URL_KEY,
+  isRootOpenaiBaseUrlLine,
+  isRootRealtimeWsBaseUrlLine,
+  providerTableString,
+  rootTomlString,
+} from "./injected-marker";
+
+export type CodexRoutingDriftKey =
+  | "openai_base_url"
+  | typeof REALTIME_WS_BASE_URL_KEY
+  | "model_providers.opencodex.base_url";
+
+export interface CodexRoutingDriftTarget {
+  readonly key: CodexRoutingDriftKey;
+  readonly url: string;
+  /** Host as written, brackets removed (`127.0.0.1`, `localhost`, `::1`). */
+  readonly hostname: string;
+  readonly port: number;
+}
+
+export type CodexRoutingDrift =
+  | { readonly kind: "none" }
+  | { readonly kind: "not-owned" }
+  | { readonly kind: "foreign"; readonly targets: readonly CodexRoutingDriftTarget[] };
+
+/** The root URLs the last injection recorded writing (`journal.ts`), read without side effects. */
+export interface JournaledCodexRouting {
+  readonly openaiBaseUrl: string | null;
+  readonly realtimeWsBaseUrl: string | null;
+}
+
+export interface CodexRoutingDriftInput {
+  /** Ports this process serves: the bound port and the loopback listener port. */
+  readonly ownPorts: Iterable<number>;
+  /**
+   * Value evidence for a root line whose marker comment a Codex app rewrite dropped (#1798). A
+   * function is called at most once, and only when an unmarked root URL names a foreign port.
+   */
+  readonly journaled?: JournaledCodexRouting | (() => JournaledCodexRouting);
+}
+
+/** The root line's value, and whether the ownership marker sits directly above it. */
+function rootLine(content: string, key: string, isLine: (line: string) => boolean): { value: string | null; marked: boolean } {
+  const lines = content.split("\n");
+  const firstTable = lines.findIndex(line => /^\s*\[/.test(line));
+  const rootEnd = firstTable === -1 ? lines.length : firstTable;
+  for (let index = 0; index < rootEnd; index += 1) {
+    if (!isLine(lines[index]!)) continue;
+    return {
+      value: rootTomlString(lines[index]!, key),
+      marked: index > 0 && lines[index - 1]!.includes(OCX_SECTION_MARKER),
+    };
+  }
+  return { value: null, marked: false };
+}
+
+/** A loopback endpoint with an explicit port, or null for anything the detector must ignore. */
+function loopbackEndpoint(url: string): { hostname: string; port: number } | null {
+  if (classifyRoutingEndpoint(url) !== "local") return null;
+  try {
+    const parsed = new URL(url);
+    if (!parsed.port) return null;
+    const port = Number(parsed.port);
+    if (!Number.isInteger(port) || port <= 0 || port > 65535) return null;
+    return { hostname: parsed.hostname.replace(/^\[|\]$/g, ""), port };
+  } catch {
+    return null;
+  }
+}
+
+export function detectCodexRoutingDrift(content: string, input: CodexRoutingDriftInput): CodexRoutingDrift {
+  const own = new Set(input.ownPorts);
+  const normalized = content.replace(/\r\n/g, "\n");
+  let journaled: JournaledCodexRouting | undefined;
+  const readJournaled = (): JournaledCodexRouting => {
+    if (journaled) return journaled;
+    const source = input.journaled;
+    journaled = typeof source === "function" ? source() : (source ?? { openaiBaseUrl: null, realtimeWsBaseUrl: null });
+    return journaled;
+  };
+
+  // `marked` is the cheap ownership proof; `owned` adds the journal's value evidence, which is read
+  // only for an unmarked line that names a foreign port.
+  const candidates: Array<{ key: CodexRoutingDriftKey; url: string; marked: boolean; owned: () => boolean }> = [];
+  const base = rootLine(normalized, "openai_base_url", isRootOpenaiBaseUrlLine);
+  if (base.value) {
+    const url = base.value;
+    candidates.push({ key: "openai_base_url", url, marked: base.marked, owned: () => base.marked || readJournaled().openaiBaseUrl === url });
+  }
+  const realtime = rootLine(normalized, REALTIME_WS_BASE_URL_KEY, isRootRealtimeWsBaseUrlLine);
+  if (realtime.value) {
+    const url = realtime.value;
+    candidates.push({ key: REALTIME_WS_BASE_URL_KEY, url, marked: realtime.marked, owned: () => realtime.marked || readJournaled().realtimeWsBaseUrl === url });
+  }
+  if (rootTomlString(normalized, "model_provider") === "opencodex") {
+    const url = providerTableString(normalized, "opencodex", "base_url");
+    if (url) candidates.push({ key: "model_providers.opencodex.base_url", url, marked: true, owned: () => true });
+  }
+  if (candidates.length === 0) return { kind: "not-owned" };
+  // An external provider owns routing even when an old opencodex line is still in the file.
+  if (externalCodexModelProvider(normalized) !== null) return { kind: "not-owned" };
+
+  const targets: CodexRoutingDriftTarget[] = [];
+  let ours = false;
+  for (const candidate of candidates) {
+    const endpoint = loopbackEndpoint(candidate.url);
+    if (endpoint !== null && !own.has(endpoint.port)) {
+      if (candidate.owned()) targets.push({ key: candidate.key, url: candidate.url, ...endpoint });
+      continue;
+    }
+    // A URL naming a port we serve is never drift, whoever wrote it; neither is non-loopback routing.
+    ours ||= candidate.marked || endpoint !== null;
+  }
+  if (targets.length > 0) return { kind: "foreign", targets };
+  return ours ? { kind: "none" } : { kind: "not-owned" };
+}