@bitkyc08/opencodex 2.67.0 → 2.68.0-preview.20260927

package/src/combos/reset-window.ts

@@ -1,6 +1,9 @@
-import type { ProviderQuota } from "../providers/quota";
+import type { ProviderQuota, ProviderQuotaWindow } from "../providers/quota";
 
-function collectResetCandidates(quota: ProviderQuota): number[] {
+/** Which custom windows count for a ranking; provider-wide windows always count. */
+export type QuotaWindowFilter = (window: ProviderQuotaWindow) => boolean;
+
+function collectResetCandidates(quota: ProviderQuota, includeWindow?: QuotaWindowFilter): number[] {
   const candidates: number[] = [];
   const push = (value: number | undefined): void => {
     if (value !== undefined && Number.isFinite(value)) candidates.push(value);
@@ -10,7 +13,7 @@ function collectResetCandidates(quota: ProviderQuota): number[] {
   push(quota.monthlyResetAt);
   if (quota.customWindows) {
     for (const w of quota.customWindows) {
-      push(w.resetAt);
+      if (!includeWindow || includeWindow(w)) push(w.resetAt);
     }
   }
   return candidates;
@@ -23,9 +26,10 @@ function collectResetCandidates(quota: ProviderQuota): number[] {
 export function earliestQuotaResetAt(
   quota: ProviderQuota | null,
   now: number,
+  includeWindow?: QuotaWindowFilter,
 ): number | null {
   if (!quota) return null;
-  const future = collectResetCandidates(quota).filter(ts => ts > now);
+  const future = collectResetCandidates(quota, includeWindow).filter(ts => ts > now);
   if (future.length > 0) return Math.min(...future);
   return null;
 }
@@ -39,8 +43,9 @@ export function earliestQuotaResetAt(
 export function quotaResetRemainingMs(
   quota: ProviderQuota | null,
   now: number,
+  includeWindow?: QuotaWindowFilter,
 ): number {
-  const nearest = earliestQuotaResetAt(quota, now);
+  const nearest = earliestQuotaResetAt(quota, now, includeWindow);
   if (nearest === null) return Number.POSITIVE_INFINITY;
   return nearest - now;
 }

package/src/combos/resolve.ts

@@ -1,6 +1,6 @@
 import type { OcxComboTarget, OcxConfig } from "../types";
 import { getCachedProviderRoutingQuota } from "../providers/quota-routing-cache";
-import type { ProviderQuota } from "../providers/quota-types";
+import type { ProviderQuota, ProviderQuotaWindow } from "../providers/quota-types";
 import { sleepWithAbort } from "../lib/upstream-retry";
 import {
   coolComboTarget,
@@ -64,7 +64,7 @@ function targetProviderIsUsable(config: OcxConfig, target: OcxComboTarget, now:
   if (!Object.hasOwn(config.providers, target.provider)) return false;
   const provider = config.providers[target.provider];
   if (!provider || provider.disabled === true) return false;
-  return !cachedProviderQuotaIsExhausted(getCachedProviderRoutingQuota(target.provider, provider, now), now);
+  return !cachedProviderQuotaIsExhausted(getCachedProviderRoutingQuota(target.provider, provider, now), now, target.model);
 }
 
 function quotaWindowExhausted(percent: number | undefined, resetAt: number | undefined, now: number): boolean {
@@ -72,15 +72,39 @@ function quotaWindowExhausted(percent: number | undefined, resetAt: number | und
   return typeof resetAt !== "number" || !Number.isFinite(resetAt) || resetAt > now;
 }
 
+// `customWindows` is a generic carrier. Most labels are provider-wide counters ("Prepaid
+// credits", "Free trial", "burst", "Spark") and must gate every model. Anthropic also rides it
+// for per-model family counters, where a spent Opus week says nothing about a Sonnet request.
+// `routing/quota.ts` already scopes those per model when it ranks accounts
+// (`anthropicFamilyWindow`); this is the same fact applied to combo target selection.
+//
+// The scoping keys on `window.scope`, which the PRODUCER sets only where it proved model scope
+// structurally, NEVER on the label text: `quota/antigravity.ts` forwards an upstream
+// `group.displayName` unchanged, so a provider-wide group named "Opus" read as per-model would
+// leave a spent window unenforced and send a doomed request. Every unproven direction keeps
+// gating everything, which is the behaviour before this change: no scope on the window, no
+// model on the request, or a family this gateway cannot match against a model id. Failing
+// closed there costs at most a diverted target.
+const MODEL_FAMILY_WINDOW_LABELS = new Set(["fable", "opus", "sonnet"]);
+
+function customWindowAppliesToModel(window: ProviderQuotaWindow, model: string | undefined): boolean {
+  if (window.scope !== "model" || model === undefined) return true;
+  const family = window.label.trim().toLowerCase();
+  if (!MODEL_FAMILY_WINDOW_LABELS.has(family)) return true;
+  return model.toLowerCase().includes(family);
+}
+
 export function cachedProviderQuotaIsExhausted(
   quota: ProviderQuota | null,
   now = Date.now(),
+  model?: string,
 ): boolean {
   if (!quota) return false;
   if (quotaWindowExhausted(quota.fiveHourPercent, quota.fiveHourResetAt, now)) return true;
   if (quotaWindowExhausted(quota.weeklyPercent, quota.weeklyResetAt, now)) return true;
   if (quotaWindowExhausted(quota.monthlyPercent, quota.monthlyResetAt, now)) return true;
-  if (quota.customWindows?.some(window => quotaWindowExhausted(window.percent, window.resetAt, now))) return true;
+  if (quota.customWindows?.some(window => customWindowAppliesToModel(window, model)
+    && quotaWindowExhausted(window.percent, window.resetAt, now))) return true;
   if (quota.creditsUsd?.unlimited !== true
       && typeof quota.creditsUsd?.percent === "number"
       && Number.isFinite(quota.creditsUsd.percent)
@@ -120,7 +144,9 @@ export type QuotaInactiveReason = "no_credit";
  */
 export function quotaInactiveReason(
   config: OcxConfig,
-  targets: readonly { provider: string }[],
+  // A combo votes over its own targets, which carry a model; the single-provider case has none,
+  // and an absent model keeps gating on every window exactly as before.
+  targets: readonly { provider: string; model?: string }[],
   now = Date.now(),
 ): QuotaInactiveReason | undefined {
   const usable = targets.filter(target => {
@@ -132,7 +158,7 @@ export function quotaInactiveReason(
   for (const target of usable) {
     const provider = config.providers[target.provider]!;
     const quota = getCachedProviderRoutingQuota(target.provider, provider, now);
-    if (!quota || !cachedProviderQuotaIsExhausted(quota, now)) return undefined;
+    if (!quota || !cachedProviderQuotaIsExhausted(quota, now, target.model)) return undefined;
   }
   return "no_credit";
 }
@@ -185,7 +211,11 @@ function resetWindowIndex(
     const target = targets[index]!;
     if (!eligible(target)) continue;
     const remaining = quotaResetRemainingMs(
-      getCachedProviderRoutingQuota(target.provider, config.providers[target.provider], now), now,
+      getCachedProviderRoutingQuota(target.provider, config.providers[target.provider], now),
+      now,
+      // Rank by the windows that gate this target: a model-scoped window of another family
+      // says nothing about when this model regains capacity.
+      window => customWindowAppliesToModel(window, target.model),
     );
     // Strict comparison deliberately retains configured order for ties,
     // including the no-snapshot fallback where every value is Infinity.

package/src/config/diagnostics.ts

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { lstatSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import * as z from "zod/v4";
+import { compactionRecoveryConfigError } from "./schema/compaction-recovery";
 import type { OcxConfig } from "../types";
 import { configReasoningPinsConfigError } from "./provider-validation";
 import { loopbackCompanionAllowed } from "../codex/loopback-target";
@@ -598,7 +599,7 @@ export function validateConfigCandidate(value: unknown): { ok: true; config: Ocx
   if (compactionRouting !== undefined && !compactionRoutingSchema.safeParse(compactionRouting).success) {
     return { ok: false, error: "schema_invalid: compactionRouting: requires a nonblank model, an optional valid reasoningEffort, and optional non-repeating triggers drawn from \"manual\" and \"auto\"" };
   }
-  const boundaryError = configReasoningPinsConfigError(value)
+  const boundaryError = compactionRecoveryConfigError(value) ?? configReasoningPinsConfigError(value)
     ?? blankHostnameError(value)
     ?? claudeSubagentEffortError(value)
     ?? appOwnedMemoryBudgetError(value)

package/src/config/load-degrade.ts

@@ -1,5 +1,6 @@
 import { chmodSync, existsSync } from "node:fs";
 import { join } from "node:path";
+import { compactionRecoveryConfigError } from "./schema/compaction-recovery";
 import {
   modelPinnedEffortsConfigError,
   pinnedReasoningEffortConfigError,
@@ -118,6 +119,7 @@ export function warnDegradedCompactionRouting(rawParsed: unknown, validated: Ocx
  * the ratchet only ever moves down: a per-block call there costs a line the file does not have.
  */
 export function warnDegradedTopLevelOptIns(rawParsed: unknown, validated: OcxConfig): void {
+  if (compactionRecoveryConfigError(rawParsed)) console.warn("⚠️  invalid compactionRecovery disabled; the original compaction failure is preserved");
   warnDegradedStreamMode(rawParsed, validated);
   warnDegradedCompactionRouting(rawParsed, validated);
 }

package/src/config/paths.ts

@@ -1,7 +1,7 @@
 import { chmodSync, existsSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
-import { hardenSecretDirAsync, windowsSecretAclApplies } from "../lib/windows-secret-acl";
+import { flushWindowsSecretAclReapsBeforeRemoval, hardenSecretDirAsync, windowsSecretAclApplies } from "../lib/windows-secret-acl";
 import { assertNotRealHomeUnderTest } from "../lib/test-home-guard";
 
 /**
@@ -63,6 +63,12 @@ export async function flushConfigDirHardening(dir: string = getConfigDir()): Pro
   if (flight) await flight;
 }
 
+/** A settled ACL deadline is not proof its child has exited; stop must drain both before removal. */
+export async function flushConfigDirHardeningAndReaps(dir: string): Promise<void> {
+  try { await flushConfigDirHardening(dir); }
+  finally { await flushWindowsSecretAclReapsBeforeRemoval(dir); }
+}
+
 /** Test-only: settle every in-flight config-directory harden regardless of directory. */
 export async function flushConfigDirHardeningForTests(): Promise<void> {
   await Promise.all([...configDirHardeningFlights.values()]);

package/src/config/process-state.ts

@@ -36,6 +36,12 @@ export type RuntimePortState = {
   hostname?: string;
   /** Per-process proof key; protected by the config directory and never served. */
   attestationSecret?: string;
+  /**
+   * The live proxy's port when this runtime is a sibling instance started beside it
+   * (`src/codex/sibling-start.ts`). `ocx stop` reads it to leave shared client routing alone.
+   * Absent for every other runtime, so those records keep their bytes.
+   */
+  siblingOfPort?: number;
 };
 
 function isValidRuntimePortState(value: unknown): value is RuntimePortState {
@@ -43,13 +49,16 @@ function isValidRuntimePortState(value: unknown): value is RuntimePortState {
   const state = value as Record<string, unknown>;
   const hostnameOk = state.hostname === undefined || typeof state.hostname === "string";
   const attestationOk = state.attestationSecret === undefined || isLocalAttestationSecret(state.attestationSecret);
+  const siblingOk = state.siblingOfPort === undefined
+    || (Number.isInteger(state.siblingOfPort) && Number(state.siblingOfPort) > 0 && Number(state.siblingOfPort) <= 65535);
   return Number.isSafeInteger(state.pid)
     && Number(state.pid) > 0
     && Number.isInteger(state.port)
     && Number(state.port) > 0
     && Number(state.port) <= 65535
     && hostnameOk
-    && attestationOk;
+    && attestationOk
+    && siblingOk;
 }
 
 export function writeRuntimePort(state: RuntimePortState): void {

package/src/config/schema/compaction-recovery.ts

@@ -0,0 +1,15 @@
+import * as z from "zod/v4";
+
+/** Failure-only, opt-in recovery; it never chooses the initial compaction model. */
+export const compactionRecoverySchema = z.object({
+  enabled: z.boolean(),
+  model: z.string().trim().min(1).max(512).regex(/^[^\s\u0000-\u0020\u007f-\u009f]+$/),
+  allowDevinInvalidArgument: z.boolean().optional(),
+}).strict();
+
+export function compactionRecoveryConfigError(value: unknown): string | null {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const recovery = (value as Record<string, unknown>).compactionRecovery;
+  return recovery === undefined || compactionRecoverySchema.safeParse(recovery).success
+    ? null : "schema_invalid: compactionRecovery: requires enabled, a nonblank model, and optional boolean allowDevinInvalidArgument";
+}

package/src/config/schema/config-schema.ts

@@ -1,4 +1,5 @@
 import * as z from "zod/v4";
+import { compactionRecoverySchema } from "./compaction-recovery";
 import {
   agentTaskRecoverySchema,
   catalogAutoRefreshSchema,
@@ -156,6 +157,7 @@ export const configSchema = z.object({
   providers: z.record(z.string(), providerConfigSchema),
   modelPinnedEfforts: modelPinnedEffortsSchema.optional(),
   compactionRouting: compactionRoutingSchema.optional().catch(undefined),
+  compactionRecovery: compactionRecoverySchema.optional().catch(undefined),
   defaultProvider: z.string().min(1).default("openai"),
   defaultModelAliases: z.boolean().optional(),
   // Malformed hand edits disable this opt-in projection without rejecting providers.

package/src/config/schema/leaf-validators.ts

@@ -97,18 +97,23 @@ const requestPacingRuleSchema = z.object({
   // Keep the RPM-derived timer within the same one-hour bound as minIntervalMs.
   requestsPerMinute: z.number().min(1 / 60).max(60_000).optional(),
   minIntervalMs: z.number().int().min(1).max(3_600_000).optional(),
-}).strict().refine(value => value.requestsPerMinute !== undefined || value.minIntervalMs !== undefined, {
-  message: "request pacing rules need requestsPerMinute or minIntervalMs",
+  maxConcurrentRequests: z.number().int().min(1).optional(),
+}).strict().refine(value => value.requestsPerMinute !== undefined
+  || value.minIntervalMs !== undefined
+  || value.maxConcurrentRequests !== undefined, {
+  message: "request pacing rules need requestsPerMinute, minIntervalMs, or maxConcurrentRequests",
 });
 
 const requestPacingSchema = z.object({
   enabled: z.boolean(),
   requestsPerMinute: z.number().min(1 / 60).max(60_000).optional(),
   minIntervalMs: z.number().int().min(1).max(3_600_000).optional(),
+  maxConcurrentRequests: z.number().int().min(1).optional(),
   models: z.record(z.string().trim().min(1), requestPacingRuleSchema).optional(),
 }).strict().refine(value => value.enabled === false
   || value.requestsPerMinute !== undefined
   || value.minIntervalMs !== undefined
+  || value.maxConcurrentRequests !== undefined
   || (value.models !== undefined && Object.keys(value.models).length > 0), {
   message: "enabled request pacing needs a provider rule or model override",
 });
@@ -117,7 +122,7 @@ export function requestPacingConfigError(value: unknown): string | null {
   if (value === undefined) return null;
   const parsed = requestPacingSchema.safeParse(value);
   if (parsed.success) return null;
-  return "requestPacing must contain enabled and a valid requestsPerMinute/minIntervalMs provider rule or model overrides";
+  return "requestPacing must contain enabled and a valid requestsPerMinute/minIntervalMs/maxConcurrentRequests provider rule or model overrides";
 }
 
 /**
@@ -938,6 +943,7 @@ export const clientConnectionSchema = z.object({
  */
 export const codexPoolSchema = z.object({
   excludedPlans: z.array(z.string().trim().min(1)).optional(),
+  startIdleWindows: z.boolean().optional(),
 }).strict();
 
 /**