@bitkyc08/opencodex 2.67.0 → 2.68.0-preview.20260927

package/src/server/index.ts

@@ -23,7 +23,7 @@ import {
   loopbackCompanionBindError,
   websocketsEnabled,
 } from "../config";
-import { flushConfigDirHardening } from "../config/paths";
+import { flushConfigDirHardeningAndReaps } from "../config/paths";
 import { migrateStartupSubagentModels } from "./subagent-models-startup";
 import { migrateStartupXaiResponses } from "./xai-responses-startup";
 import { migrateStartupZaiResponses } from "./zai-responses-startup";
@@ -117,7 +117,7 @@ import { setUsageLedgerRetention } from "./usage-ledger-retention";
 import { admitHttpWorkflowTurn, workflowDecisionRefusalResponse, type WorkflowRefusalLog } from "./workflow-refusal";
 export {
   addFinalRequestLog,
-  filterRequestLogs,
+  filterRequestLogs, queryRequestLogs,
   hydrateRequestLogsFromDisk,
   httpStatusForTerminalStatus,
   httpStatusFromTerminalError,
@@ -788,12 +788,12 @@ function startServerWithSpendLedgerOwner(port: number | undefined, deps: StartSe
             await backgroundLifecycle.release();
             await releaseNativeMainStartupLifecycle(server);
           } finally {
-            // icacls.exe from hardenConfigDir() holds the config dir open; a caller that
-            // removes the dir right after stop() settles would hit EPERM/EBUSY on Windows
-            // otherwise. Config hardening still flushes when an earlier release rejects. The
-            // spend owner is retained when a listener stop failed because the socket may live.
+            // icacls.exe from hardenConfigDir() holds the config dir open. The caller-facing
+            // hardening deadline can settle before its child exits, so also wait for that
+            // child's reap before stop() promises the directory is removable. The spend owner
+            // is retained when a listener stop failed because the socket may live.
             try { if (listenersStopped) spendLedgerLifecycle.release(); }
-            finally { await flushConfigDirHardening(startupConfigDir); }
+            finally { await flushConfigDirHardeningAndReaps(startupConfigDir); }
           }
         },
       );

package/src/server/inference/client-encoder-delivery.ts

@@ -94,6 +94,8 @@ export interface ClientEncodedDelivery {
     toolSearchToolNames?: Set<string>;
   };
   stallTimeoutSec?: number;
+  /** Operator-trusted local upstream: an unset stall budget stays disabled there (#5876). */
+  localUpstream?: boolean;
   turnAdmissionLease?: AdmissionLease;
   onFirstOutput?: () => void;
   /** The bridge's `onCancel`: stop completion notification and abort the upstream. */
@@ -212,6 +214,7 @@ export async function deliverClientEncodedResponse(input: ClientEncodedDelivery)
     translatorBudget,
     ...input.fold,
     ...(input.stallTimeoutSec !== undefined ? { stallTimeoutSec: input.stallTimeoutSec } : {}),
+    ...(input.localUpstream !== undefined ? { localUpstream: input.localUpstream } : {}),
     hooks,
   };
   const encoded = encoder.protocol === "chat"

package/src/server/inference/context.ts

@@ -1,7 +1,16 @@
-import { createRequestExecutionBudget, type RequestExecutionBudget } from "../../lib/request-execution-budget";
+import { CODEX_TEXT_GUARDED_BUDGET_POLICY, createRequestExecutionBudget, type RequestExecutionBudget } from "../../lib/request-execution-budget";
+import { TRANSIENT_RETRY_MAX_ATTEMPTS, type TransientSendBudget } from "../../lib/upstream-retry";
+import { GENERIC_OAUTH_MAX_ACCOUNTS_PER_REQUEST } from "../../oauth/generic-account-failover";
 import type { RequestLogContext } from "../request-log";
 import { attachRequestSpendTracker } from "../responses/request-spend";
 
+// Only ingress owns an expandable policy. Exact caller budgets and combo-derived scopes
+// never enter this map, even when their policy happens to equal the default profile.
+const ingressPolicies = new WeakMap<TransientSendBudget, {
+  maxTotalModelSends: number;
+  baseSendAllowance: number;
+}>();
+
 /**
  * The one construction of an ingress-owned send budget: the default guarded policy, no logical
  * request id, and this request's spend tracker as the send observer. Attaching the tracker
@@ -11,5 +20,24 @@ export function createInferenceSendBudget(
   req: Pick<Request, "headers">,
   logCtx: RequestLogContext,
 ): RequestExecutionBudget {
-  return createRequestExecutionBudget(undefined, undefined, attachRequestSpendTracker(req, logCtx));
+  const policy = { ...CODEX_TEXT_GUARDED_BUDGET_POLICY };
+  const budget = createRequestExecutionBudget(policy, undefined, attachRequestSpendTracker(req, logCtx));
+  ingressPolicies.set(budget, policy);
+  return budget;
+}
+
+/**
+ * Fund each account's normal transient ladder once, before the first physical send. The account
+ * count is clamped here as well as at the caller, so no caller can raise the ceiling past
+ * GENERIC_OAUTH_MAX_ACCOUNTS_PER_REQUEST × TRANSIENT_RETRY_MAX_ATTEMPTS.
+ */
+export function expandInferenceOAuthSendBudget(budget: TransientSendBudget | undefined, accounts: number): void {
+  if (!budget) return;
+  const policy = ingressPolicies.get(budget);
+  if (!policy || budget.used !== 0) return;
+  ingressPolicies.delete(budget);
+  if (accounts < 2 || !Number.isSafeInteger(accounts)) return;
+  const sends = Math.min(accounts, GENERIC_OAUTH_MAX_ACCOUNTS_PER_REQUEST) * TRANSIENT_RETRY_MAX_ATTEMPTS;
+  policy.baseSendAllowance = Math.max(policy.baseSendAllowance, sends);
+  policy.maxTotalModelSends = Math.max(policy.maxTotalModelSends, sends);
 }

package/src/server/local-account-switch-auth.ts

@@ -0,0 +1,79 @@
+import { timingSafeEqual } from "node:crypto";
+import {
+  LOCAL_MANAGEMENT_CAPABILITY_EXPIRES_AT_HEADER,
+  LOCAL_MANAGEMENT_CAPABILITY_HEADER,
+  LOCAL_MANAGEMENT_EXPECTED_PID_HEADER,
+  LOCAL_MANAGEMENT_NONCE_HEADER,
+  parseExpectedLocalManagementPid,
+} from "../lib/local-management-capability";
+import {
+  accountSwitchBodyDigest, isLocalAccountSwitchPath,
+  LOCAL_ACCOUNT_SWITCH_BODY_HEADER, verifyLocalAccountSwitchCapability,
+} from "../lib/local-account-switch-capability";
+import type { LocalManagementAuthContext } from "./management-auth";
+
+const REPLAY_LIMIT = 256;
+const BODY_LIMIT = 1024;
+const consumed = new Map<string, number>();
+const admittedBodyDigests = new WeakMap<Request, string>();
+
+/** Admit one exact body-bound account switch on the attested local listener. */
+export function hasLocalAccountSwitchCapability(
+  req: Request, local: LocalManagementAuthContext | undefined, now = Date.now(),
+): boolean {
+  if (admittedBodyDigests.has(req)) return true;
+  if (!local || req.method !== "PUT" || req.headers.has("origin")) return false;
+  let url: URL;
+  try { url = new URL(req.url); } catch { return false; }
+  if (!isLocalAccountSwitchPath(url.pathname) || url.search !== "") return false;
+  const expectedPid = parseExpectedLocalManagementPid(req.headers.get(LOCAL_MANAGEMENT_EXPECTED_PID_HEADER));
+  if (expectedPid.kind !== "present" || expectedPid.pid !== local.pid) return false;
+  const expiry = req.headers.get(LOCAL_MANAGEMENT_CAPABILITY_EXPIRES_AT_HEADER);
+  if (!expiry || !/^[1-9]\d*$/.test(expiry)) return false;
+  const expiresAt = Number(expiry);
+  const capability = req.headers.get(LOCAL_MANAGEMENT_CAPABILITY_HEADER);
+  const bodyDigest = req.headers.get(LOCAL_ACCOUNT_SWITCH_BODY_HEADER);
+  if (!verifyLocalAccountSwitchCapability(
+    local.attestationSecret, req.headers.get(LOCAL_MANAGEMENT_NONCE_HEADER),
+    req.method, url.pathname, local.pid, local.port, expiresAt, bodyDigest, capability, now,
+  )) return false;
+  for (const [proof, until] of consumed) if (until <= now) consumed.delete(proof);
+  if (!capability || !bodyDigest || consumed.has(capability) || consumed.size >= REPLAY_LIMIT) return false;
+  consumed.set(capability, expiresAt);
+  admittedBodyDigests.set(req, bodyDigest);
+  return true;
+}
+
+/** Stream a bounded raw body and compare it with the authenticated, cached digest. */
+export async function readVerifiedAccountSwitchBody(
+  req: Request,
+): Promise<{ status: 200; body: Uint8Array } | { status: 403 | 413 }> {
+  const expected = admittedBodyDigests.get(req);
+  if (!expected) return { status: 403 };
+  const reader = req.body?.getReader();
+  const chunks: Uint8Array[] = [];
+  let size = 0;
+  if (reader) {
+    try {
+      while (true) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        size += value.byteLength;
+        if (size > BODY_LIMIT) {
+          await reader.cancel();
+          return { status: 413 };
+        }
+        chunks.push(value);
+      }
+    } catch {
+      return { status: 403 };
+    } finally {
+      reader.releaseLock();
+    }
+  }
+  const body = new Uint8Array(size);
+  let offset = 0;
+  for (const chunk of chunks) { body.set(chunk, offset); offset += chunk.byteLength; }
+  if (!timingSafeEqual(Buffer.from(expected), Buffer.from(accountSwitchBodyDigest(body)))) return { status: 403 };
+  return { status: 200, body };
+}

package/src/server/management/agent-settings-routes.ts

@@ -44,6 +44,7 @@ import { clearThreadAccountMap } from "../../codex/routing";
 import { primeCodexPoolQuotas } from "../../codex/auth-api";
 import { DEFAULT_PROVIDER_CONTEXT_CAP, globalContextCapValue, providerContextCap, providerContextCaps, setAllProviderContextCaps, setGlobalContextCapValue, setProviderContextCap } from "../../providers/context-cap";
 import { resolveCodexHomeDir } from "../../codex/home";
+import { siblingOfLivePort } from "../../codex/sibling-start";
 import { MULTI_AGENT_MODE_HINT_RECOMMENDATION } from "../../codex/multi-agent-mode-policy";
 import { readUsageEntries } from "../../usage/log";
 import { getUsageDebugLogEntries } from "../../usage/debug";
@@ -210,6 +211,7 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
 
   /** Best-effort Desktop 3P config auto-reconcile when providers change. */
   async function autoApplyDesktopBestEffort(): Promise<void> {
+    if (siblingOfLivePort() !== null) return;
     try {
       const { claudeDesktopIntegrationEnabled } = await import("../../codex/desired-state");
       const admitted = loadConfig();
@@ -226,9 +228,11 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
       if (["not_installed", "no_owned_state", "foreign", "unsafe", "broken"].includes(beforeKind)) return;
       const { filterCatalogVisibleModels, desktopVisibleNativeSlugs } = await import("../../codex/catalog");
       const allModels = await (deps.fetchAllModels ?? fetchAllModels)(admitted);
+      if (siblingOfLivePort() !== null) return;
       // Serialized with Desktop mode transitions: a first-party switch cannot interleave with this write.
       const { runPickerTransition } = await import("./claude-desktop-picker-routes");
       await runPickerTransition(admitted, async () => {
+        if (siblingOfLivePort() !== null) return undefined;
         const current = loadConfig();
         // This is the real guard: the catalog await admits a concurrent explicit OFF.
         if (!claudeDesktopIntegrationEnabled(current)) return undefined;
@@ -753,9 +757,13 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
       ...[...new Set(chosen)].filter(model => !selectableSet.has(model)),
     ];
     // #857: let CLI/GUI show when a running Codex app-server keeps an older
-    // in-memory catalog than the one on disk.
-    const { collectCodexAppServerCatalogState } = await import("../../codex/app-server-processes");
-    const catalogState = collectCodexAppServerCatalogState();
+    // in-memory catalog than the one on disk. Bounded request-path read: the synchronous
+    // collector blocked the event loop for the whole Windows CIM walk (4-7s measured).
+    const {
+      collectCodexAppServerCatalogStateWithin,
+      DASHBOARD_CATALOG_STATE_DEADLINE_MS,
+    } = await import("../../codex/app-server-processes");
+    const catalogState = await collectCodexAppServerCatalogStateWithin(DASHBOARD_CATALOG_STATE_DEADLINE_MS);
     return jsonResponse({
       chosen, available, catalogState,
       pickerAvailable: [...new Set(filterCatalogVisibleModels(models, config).map(catalogModelSlug).filter(slug => slug.includes("/")))],

package/src/server/management/config-routes.ts

@@ -1,4 +1,5 @@
 import { compactionRoutingSchema } from "../../config/schema/leaf-validators";
+import { compactionRecoverySchema } from "../../config/schema/compaction-recovery";
 import { captureConfigTopLevelRollback } from "../../config/rebase-provenance";
 import type { IntegrationClientId } from "../../integrations/registry";
 import { randomUUID } from "node:crypto";
@@ -69,6 +70,7 @@ import {
   initializeDefaultCodexAccountNamespaces,
 } from "../../codex/account-namespaces";
 import { catalogRefreshIsPending } from "../../codex/catalog-refresh-status";
+import { siblingOfLivePort } from "../../codex/sibling-start";
 import { DEFAULT_PROVIDER_CONTEXT_CAP, globalContextCapValue, providerContextCap, providerContextCaps, setAllProviderContextCaps, setGlobalContextCapValue, setProviderContextCap } from "../../providers/context-cap";
 import { resolveCodexHomeDir } from "../../codex/home";
 import { readUsageEntries } from "../../usage/log";
@@ -119,10 +121,10 @@ import type { PersistedUsageAttempt } from "../../usage/log";
 import { isAllowedRequestOrigin, jsonResponse, providerManagementConfigError, publicProviderBaseUrl, safeConfigDTO } from "../auth-cors";
 import { withProviderCatalogCapabilityDTO } from "./provider-capability-config";
 import { applySystemEnvToggle } from "../system-env";
-import { getCachedStartupHealth, invalidateStartupHealthCache } from "../startup-health-cache";
+import { getCachedStartupHealth, getStartupHealthSnapshot, invalidateStartupHealthCache } from "../startup-health-cache";
 import { runWindowsTrayAction } from "../windows-tray-control";
 import { runStartupInstallAction, type StartupInstallAction } from "../startup-action-control";
-import { displayCodexRuntimePath, effortClampAppliesToRuntime, liveRemovedEfforts, loadLastEffortClamp, resolveCodexRuntime } from "../../codex/runtime";
+import { displayCodexRuntimePath, effortClampAppliesToRuntime, getCodexRuntimeSnapshot, liveRemovedEfforts, loadLastEffortClamp } from "../../codex/runtime";
 
 import { isPlainRecord, parseDebugLogQuery, tokPerSecondResult, unavailableCostReason, costResult, requestLogDto, stripRegistryOnlyStaticHeaders, fetchAllModels } from "./shared";
 import type { MetricUnavailableReason, TokPerSecondResult, CostEstimateReason, CostResult, MetricSource } from "./shared";
@@ -196,7 +198,9 @@ export async function syncEnabledClientIntegrations(
   deps: Pick<ManagementContext["deps"],
     "fetchAllModels" | "refreshOwnedCatalogIntegrations" | "writeDesktop3pConfig"> = {},
 ): Promise<ClientIntegrationSyncOutcome[]> {
-  if (port === undefined) return [];
+  // A sibling instance passes its OWN port here; the Grok fence and the Desktop gateway profile
+  // stay on the live owner's (`src/codex/sibling-start.ts`).
+  if (port === undefined || siblingOfLivePort() !== null) return [];
   const { claudeDesktopIntegrationEnabled, grokIntegrationEnabled } = await import("../../codex/desired-state");
   const out: ClientIntegrationSyncOutcome[] = [];
 
@@ -291,6 +295,10 @@ function publicVisionSidecarSettings(
 export async function handleConfigRoutes(ctx: ManagementContext): Promise<Response | null> {
   const { req, url, config, deps, convergeCodexCatalog, syncClaudeAgentDefsBestEffort } = ctx;
   const readStartupHealth = deps.getCachedStartupHealth ?? getCachedStartupHealth;
+  // Settings only seed the dashboard chip; /api/startup-health owns the bounded fresh read.
+  // Waiting on the Windows service-manager probe here held settings reads and saves open
+  // for up to 15s, including the admin-token check. An injected reader stays authoritative.
+  const readStartupHealthSnapshot = deps.getCachedStartupHealth ?? getStartupHealthSnapshot;
   if (url.pathname === "/api/config" && req.method === "GET") {
     return jsonResponse(withProviderCatalogCapabilityDTO(safeConfigDTO(config), config));
   }
@@ -300,10 +308,12 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
   }
 
   if (url.pathname === "/api/settings" && req.method === "GET") {
-    let resolved: ReturnType<typeof resolveCodexRuntime>;
+    let resolved: ReturnType<typeof getCodexRuntimeSnapshot>;
     try {
-      // Full alternative discovery (memoized) so newerAvailable warnings work.
-      resolved = resolveCodexRuntime();
+      // Full alternative discovery so newerAvailable warnings work, served stale-while-
+      // revalidate: the sync resolver ran `codex --version` per candidate on this request and
+      // froze the whole proxy for ~0.6s every memo expiry while the dashboard polled here.
+      resolved = getCodexRuntimeSnapshot();
     } catch {
       resolved = {
         runtime: { command: "codex", version: null, source: "fallback" },
@@ -363,7 +373,8 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       codexClientCompaction: config.codexClientCompaction === true,
       codexDesktopSwitches: describeCodexDesktopSwitches(config, await observedCodexDesktopSwitchApply()),
       compactionRouting: config.compactionRouting ?? null,
-      startupHealth: await readStartupHealth(config),
+      compactionRecovery: config.compactionRecovery ?? null,
+      startupHealth: await readStartupHealthSnapshot(config),
       codexRuntime: {
         path: displayCodexRuntimePath(resolved.runtime.command),
         version: resolved.runtime.version,
@@ -455,6 +466,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       codexDesktopAuthless?: unknown;
       codexClientCompaction?: unknown;
       compactionRouting?: unknown;
+      compactionRecovery?: unknown;
     };
     if (body.codexAutoStart === undefined
       && body.streamMode === undefined
@@ -467,8 +479,8 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       && body.codexMainAccountHardLock === undefined
       && body.codexDesktopAuthless === undefined
       && body.codexClientCompaction === undefined
-      && body.compactionRouting === undefined) {
-      return jsonResponse({ error: "provide codexAutoStart, streamMode, appOwnedMemoryBudgetMb, codexAccountPickerEnabled, codexQuotaAutoRefresh, oauthOpenBrowser, ultraFastTier, fastRows, codexMainAccountHardLock, codexDesktopAuthless, codexClientCompaction, or compactionRouting" }, 400);
+      && body.compactionRouting === undefined && body.compactionRecovery === undefined) {
+      return jsonResponse({ error: "provide codexAutoStart, streamMode, appOwnedMemoryBudgetMb, codexAccountPickerEnabled, codexQuotaAutoRefresh, oauthOpenBrowser, ultraFastTier, fastRows, codexMainAccountHardLock, codexDesktopAuthless, codexClientCompaction, compactionRouting, or compactionRecovery" }, 400);
     }
     if (body.codexAutoStart !== undefined && typeof body.codexAutoStart !== "boolean") {
       return jsonResponse({ error: "codexAutoStart boolean is required" }, 400);
@@ -501,6 +513,8 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
     const compactionRouting = body.compactionRouting == null
       ? body.compactionRouting
       : compactionRoutingSchema.safeParse(body.compactionRouting);
+    const compactionRecovery = body.compactionRecovery == null ? body.compactionRecovery : compactionRecoverySchema.safeParse(body.compactionRecovery);
+    if (compactionRecovery != null && !compactionRecovery.success) return jsonResponse({ error: "compactionRecovery requires enabled, a model, and optional boolean allowDevinInvalidArgument" }, 400);
     if (compactionRouting != null && !compactionRouting.success) {
       return jsonResponse({ error: "compactionRouting requires a model, an optional valid reasoningEffort, and optional non-repeating triggers drawn from \"manual\" and \"auto\"" }, 400);
     }
@@ -533,7 +547,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
     )) {
       return jsonResponse({ error: `appOwnedMemoryBudgetMb must be an integer from ${MIN_APP_OWNED_MEMORY_BUDGET_MB} to ${MAX_APP_OWNED_MEMORY_BUDGET_MB}` }, 400);
     }
-    const restoreCompactionRouting = captureConfigTopLevelRollback(config, ["compactionRouting"]);
+    const restoreCompactionRouting = captureConfigTopLevelRollback(config, ["compactionRouting", "compactionRecovery"]);
     const previousSettings = {
       codexAutoStart: config.codexAutoStart,
       hasCodexAutoStart: Object.hasOwn(config, "codexAutoStart"),
@@ -604,6 +618,8 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       else if (body.codexClientCompaction === false) deleteConfigTopLevelKey(config, "codexClientCompaction");
       if (compactionRouting === null) deleteConfigTopLevelKey(config, "compactionRouting");
       else if (compactionRouting?.success) config.compactionRouting = compactionRouting.data;
+      if (compactionRecovery === null) deleteConfigTopLevelKey(config, "compactionRecovery");
+      else if (compactionRecovery?.success) config.compactionRecovery = compactionRecovery.data;
       if (quotaAutoRefreshChange) {
         const { id, window, enabled } = quotaAutoRefreshChange;
         const setting = { ...(config.codexQuotaAutoRefresh?.[id] ?? {}) };
@@ -705,9 +721,10 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       codexClientCompaction: clientCompactionIsEnabled,
       codexDesktopSwitches,
       compactionRouting: config.compactionRouting ?? null,
+      compactionRecovery: config.compactionRecovery ?? null,
       codexMainAccountHardLock: isMainAccountHardLockEnabled(config),
       mainAccountHardLock: getMainAccountHardLockStatus(config),
-      startupHealth: await readStartupHealth(config),
+      startupHealth: await readStartupHealthSnapshot(config),
     });
   }
 

package/src/server/management/context.ts

@@ -154,6 +154,8 @@ export interface ManagementApiDeps {
   issueApiKey?: (config: OcxConfig, name: string) => IssuedApiKey;
   revokeApiKey?: (config: OcxConfig, id: string) => boolean;
   loadLinkCandidates?: () => Array<{ alias: string; source: "ssh_config" | "tailscale" }>;
+  /** The port this runtime listens on; a join is refused unless it is the configured port. */
+  liveListenPort?: () => number | undefined;
   now?: () => number;
 }