@bitkyc08/opencodex 2.68.0 → 2.69.0

package/src/update/pnpm-read-policy.mjs

@@ -0,0 +1,44 @@
+import { mkdtempSync, lstatSync, writeFileSync, unlinkSync, rmdirSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+/** Read probes never inherit the caller's project as their working directory. */
+export const PNPM_READ_CWD = dirname(fileURLToPath(import.meta.url));
+const MUTATIONS = new Set(["add", "install", "update", "remove", "uninstall"]);
+
+/** Run a synchronous pnpm mutation outside the package, in a private workspace boundary. */
+export function withPnpmCommandCwd(args, run) {
+  if (!MUTATIONS.has(args?.[0])) return run(PNPM_READ_CWD);
+  const cwd = mkdtempSync(join(tmpdir(), "ocx-pnpm-command-"));
+  const created = lstatSync(cwd);
+  const files = ["pnpm-workspace.yaml", ".npmrc"];
+  try {
+    // Stop discovery at our own workspace, rather than inheriting a shared /tmp workspace.
+    writeFileSync(join(cwd, files[0]), "packages: []\nignorePnpmfile: true\n", { flag: "wx", mode: 0o600 });
+    writeFileSync(join(cwd, files[1]), "ignore-pnpmfile=true\n", { flag: "wx", mode: 0o600 });
+    return run(cwd);
+  } finally {
+    try {
+      const now = lstatSync(cwd);
+      if (!now.isDirectory() || now.isSymbolicLink() || now.dev !== created.dev || now.ino !== created.ino) {
+        throw new Error("temporary directory identity changed");
+      }
+      // Never recursively remove pnpm-created or replacement contents.
+      for (const name of files) {
+        try { unlinkSync(join(cwd, name)); }
+        catch (error) { if (error?.code !== "ENOENT") throw error; }
+      }
+      rmdirSync(cwd);
+    } catch {
+      console.warn("[opencodex] Temporary pnpm workspace cleanup was incomplete; retained for inspection.");
+    }
+  }
+}
+
+/** pnpm 11 uses pnpm_config_ while earlier versions use npm_config_. */
+export function pnpmReadEnvironment(env = process.env) {
+  const ignored = new Set(["npm_config_ignore_pnpmfile", "pnpm_config_ignore_pnpmfile"]);
+  const isolated = Object.fromEntries(Object.entries(env).filter(([key]) => !ignored.has(key.toLowerCase())));
+  return { ...isolated, npm_config_ignore_pnpmfile: "true", pnpm_config_ignore_pnpmfile: "true" };
+}

package/src/update/worker-launch.ts

@@ -1,4 +1,6 @@
-import { spawnSync } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
+import { accessSync, constants, realpathSync, statSync } from "node:fs";
+import { dirname, isAbsolute } from "node:path";
 
 /**
  * How to launch the dashboard update worker on POSIX.
@@ -16,19 +18,157 @@ export const SYSTEMD_SCOPE_ARGS = ["--user", "--scope", "--quiet", "--collect",
 export interface WorkerLaunchContext {
   platform?: NodeJS.Platform;
   env?: NodeJS.ProcessEnv;
-  hasSystemdRun?: () => boolean;
+  resolveSystemdRun?: () => string | undefined;
 }
 
-let systemdRunProbe: boolean | undefined;
+// Absolute install paths only — PATH is never consulted, so a caller-controlled entry cannot
+// redirect the launch. `/usr/local/bin` is where systemd lands when built or stowed outside the
+// distro layout, and `/run/current-system/sw/bin` is the NixOS layout, where the binary lives
+// nowhere else even though the user bus works. A candidate only counts when the binary and its
+// directory are root-owned and not group/world-writable, so a lower-trust local actor cannot
+// plant the launcher the scope probe execs.
+const TRUSTED_SYSTEMD_RUN_PATHS = [
+  "/usr/bin/systemd-run", "/bin/systemd-run", "/usr/local/bin/systemd-run",
+  "/run/current-system/sw/bin/systemd-run",
+] as const;
 
-function probeSystemdRun(): boolean {
+export interface SystemdRunHooks {
+  isExecutableFile: (path: string) => boolean;
+  probeScope: (path: string) => boolean;
+  /** Async variant of probeScope; resolveSystemdRunAsync prefers it when present. */
+  probeScopeAsync?: (path: string) => Promise<boolean>;
+}
+
+const GROUP_OR_WORLD_WRITE = 0o022;
+
+// stat (follow) rather than lstat: a root-owned symlink to a user-writable directory must fail
+// on the target's mode, not pass on the symlink's (mirrors isTrustedSystemPath in
+// src/codex/desktop-app/linux.ts).
+export interface SystemdRunTrustDeps {
+  /** Test seam: canonicalizes the candidate before its substitution chain is checked. */
+  realpathSync?: (path: string) => string;
+  /** Test seam: stats a resolved path for ownership and mode. */
+  statSync?: (path: string) => { isFile(): boolean; uid: number; mode: number };
+  /** Test seam: checks the candidate's executable bit. */
+  accessSync?: (path: string, mode: number) => void;
+}
+
+function rootOnlyWritable(path: string, stat: SystemdRunTrustDeps["statSync"] = statSync): boolean {
+  try {
+    const st = stat!(path);
+    return st.uid === 0 && (st.mode & GROUP_OR_WORLD_WRITE) === 0;
+  } catch {
+    return false;
+  }
+}
+
+// "Executable" here includes trust: the binary and its directory must be root-owned and not
+// group/world-writable. /usr/local/bin is group-writable on some systems, and a planted or
+// replaced systemd-run there would be exec'd by the scope probe under the service account;
+// the fallback is the plain detached spawn, so nothing breaks when it is skipped.
+// Exported for unit tests.
+export function isTrustedSystemdRunFile(path: string, deps: SystemdRunTrustDeps = {}): boolean {
+  try {
+    if (!isAbsolute(path)) return false;
+    (deps.accessSync ?? accessSync)(path, constants.X_OK);
+    // The lexical path may be a symlink. Checking the link's own parent only proves
+    // the *entry* is pinned; the file it resolves to — and every ancestor able to
+    // substitute that resolved file — is what the scope probe will actually exec.
+    const realpath = deps.realpathSync ?? realpathSync;
+    const resolved = realpath(path);
+    const stat = deps.statSync ?? statSync;
+    const st = stat(resolved);
+    if (!(st.isFile() && st.uid === 0 && (st.mode & GROUP_OR_WORLD_WRITE) === 0)) {
+      return false;
+    }
+    for (const start of [dirname(path), dirname(resolved)]) {
+      for (let dir = start, previous = ""; dir !== previous; previous = dir, dir = dirname(dir)) {
+        if (!rootOnlyWritable(dir, stat)) return false;
+      }
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/** Scope discovery gets only user-bus identity, never inherited management credentials. */
+function scopeProbeEnvironment(): NodeJS.ProcessEnv {
+  const env: NodeJS.ProcessEnv = { PATH: "/usr/bin:/bin" };
+  for (const name of ["HOME", "USER", "LOGNAME", "XDG_RUNTIME_DIR", "DBUS_SESSION_BUS_ADDRESS"]) {
+    if (process.env[name] !== undefined) env[name] = process.env[name];
+  }
+  return env;
+}
+
+const systemdRunHooks: SystemdRunHooks = {
+  isExecutableFile: isTrustedSystemdRunFile,
+  // Run a real scope with the same absolute binary as its harmless version payload.
+  // Probing only the outer --version would not verify the user bus.
+  probeScope: path => {
+    const probe = spawnSync(path, [...SYSTEMD_SCOPE_ARGS, path, "--version"], { stdio: "ignore", timeout: 5_000, env: scopeProbeEnvironment() });
+    return !probe.error && probe.status === 0;
+  },
+  probeScopeAsync: path => new Promise<boolean>(resolve => {
+    const probe = spawn(path, [...SYSTEMD_SCOPE_ARGS, path, "--version"], { stdio: "ignore", env: scopeProbeEnvironment() });
+    probe.unref();
+    const timer = setTimeout(() => {
+      try { probe.kill("SIGKILL"); } catch { /* failed termination is not a successful probe */ }
+      resolve(false);
+    }, 5_000);
+    timer.unref();
+    probe.once("error", () => { clearTimeout(timer); resolve(false); });
+    probe.once("close", code => { clearTimeout(timer); resolve(code === 0); });
+  }),
+};
+
+let systemdRunProbe: string | null | undefined;
+let systemdRunProbePending: Promise<string | null> | undefined;
+
+export function resolveSystemdRun(hooks: SystemdRunHooks = systemdRunHooks): string | undefined {
   if (systemdRunProbe === undefined) {
-    // Run a real no-op scope rather than `--version`: a present binary without a reachable user
-    // bus would otherwise pass the probe and then fail to start the worker at all.
-    const probe = spawnSync("systemd-run", [...SYSTEMD_SCOPE_ARGS, "true"], { stdio: "ignore", timeout: 5_000 });
-    systemdRunProbe = !probe.error && probe.status === 0;
+    systemdRunProbe = null;
+    for (const command of TRUSTED_SYSTEMD_RUN_PATHS) {
+      if (!hooks.isExecutableFile(command)) continue;
+      if (hooks.probeScope(command)) {
+        systemdRunProbe = command;
+        break;
+      }
+    }
   }
-  return systemdRunProbe;
+  return systemdRunProbe ?? undefined;
+}
+
+/**
+ * Management-request path variant. The synchronous resolver blocks the shared
+ * event loop for up to four sequential five-second scope probes on first use;
+ * the dashboard update route awaits this instead, so probing overlaps other
+ * requests. Concurrent first callers share one probe pass.
+ */
+export async function resolveSystemdRunAsync(hooks: SystemdRunHooks = systemdRunHooks): Promise<string | undefined> {
+  if (systemdRunProbe !== undefined) return systemdRunProbe ?? undefined;
+  if (!systemdRunProbePending) {
+    systemdRunProbePending = (async () => {
+      const probeScope = hooks.probeScopeAsync ?? (async (path: string) => hooks.probeScope(path));
+      for (const command of TRUSTED_SYSTEMD_RUN_PATHS) {
+        if (!hooks.isExecutableFile(command)) continue;
+        if (await probeScope(command)) {
+          return command;
+        }
+      }
+      return null;
+    })();
+  }
+  const found = await systemdRunProbePending;
+  // Honor a cache the sync resolver may have filled while the probe ran — the
+  // older observation wins so every caller converges on one launcher.
+  if (systemdRunProbe === undefined) systemdRunProbe = found;
+  return systemdRunProbe ?? undefined;
+}
+
+export function resetSystemdRunProbeForTests(): void {
+  systemdRunProbe = undefined;
+  systemdRunProbePending = undefined;
 }
 
 export function guiUpdateWorkerCommand(
@@ -39,8 +179,9 @@ export function guiUpdateWorkerCommand(
   const platform = context.platform ?? process.platform;
   const env = context.env ?? process.env;
   const underSystemd = platform === "linux" && Boolean(env.INVOCATION_ID);
-  if (underSystemd && (context.hasSystemdRun ?? probeSystemdRun)()) {
-    return { command: "systemd-run", argv: [...SYSTEMD_SCOPE_ARGS, execPath, ...args] };
+  const systemdRun = underSystemd ? (context.resolveSystemdRun ?? resolveSystemdRun)() : undefined;
+  if (systemdRun) {
+    return { command: systemdRun, argv: [...SYSTEMD_SCOPE_ARGS, execPath, ...args] };
   }
   return { command: execPath, argv: [...args] };
 }

package/src/usage/cost.ts

@@ -439,13 +439,16 @@ export function serviceTierContext(entry: ServiceTierContext): ServiceTierContex
 
 /** Convert one adapter-observed attempt outcome into the existing pricing provenance shape. */
 export function serviceTierContextFromOutcome(outcome: AttemptTierOutcome): ServiceTierContext {
-  if (outcome.canonical === "priority" && outcome.confirmation === "confirmed") {
+  const responseAuthoritative = outcome.responseTierAuthoritative !== false;
+  if (responseAuthoritative && outcome.canonical === "priority" && outcome.confirmation === "confirmed") {
     return { responseServiceTier: "priority" };
   }
-  if (outcome.responseServiceTier !== undefined) {
+  // Non-authoritative echoes remain in the log, but cannot become pricing confirmation either.
+  if (responseAuthoritative && outcome.responseServiceTier !== undefined) {
     return { responseServiceTier: outcome.responseServiceTier };
   }
-  if (outcome.canonical === "priority" && outcome.confirmation === "assumed") {
+  if (outcome.canonical === "priority"
+    && (outcome.confirmation === "assumed" || (!responseAuthoritative && outcome.confirmation === "confirmed"))) {
     return { requestedServiceTier: "priority" };
   }
   // An unclassified route makes no canonical Fast claim, but its adapter can still prove that

package/src/usage/log.ts

@@ -656,6 +656,7 @@ function normalizeAttemptTierOutcome(raw: unknown): AttemptTierOutcome | null {
   if ("callerFastSuppressedByConfig" in outcome
     && typeof outcome.callerFastSuppressedByConfig !== "boolean") return null;
   if ("responseServiceTier" in outcome && typeof outcome.responseServiceTier !== "string") return null;
+  if ("responseTierAuthoritative" in outcome && typeof outcome.responseTierAuthoritative !== "boolean") return null;
   const wireValue = sanitizeLogMetadataString(outcome.wireValue);
   const responseServiceTier = sanitizeLogMetadataString(outcome.responseServiceTier);
   return {
@@ -678,6 +679,9 @@ function normalizeAttemptTierOutcome(raw: unknown): AttemptTierOutcome | null {
       ? { callerFastSuppressedByConfig: outcome.callerFastSuppressedByConfig }
       : {}),
     confirmation: outcome.confirmation as AttemptTierOutcome["confirmation"],
+    ...(typeof outcome.responseTierAuthoritative === "boolean"
+      ? { responseTierAuthoritative: outcome.responseTierAuthoritative }
+      : {}),
     ...(responseServiceTier ? { responseServiceTier } : {}),
   };
 }

package/src/web-search/backends.ts

@@ -62,7 +62,7 @@ export const WEB_SEARCH_BACKENDS: readonly WebSearchBackendDescriptor[] = [
       if (!provider || provider.disabled === true || provider.authMode !== "oauth") return false;
       const set = getAccountSet("xai");
       const active = set?.accounts.find(account => account.id === set.activeAccountId);
-      return !!active && active.needsReauth !== true;
+      return !!active && active.needsReauth !== true && active.paused !== true;
     },
     eligibleModel: candidate => candidate.provider === "xai",
   },
@@ -74,7 +74,7 @@ export const WEB_SEARCH_BACKENDS: readonly WebSearchBackendDescriptor[] = [
       if (!provider || provider.disabled === true || provider.authMode !== "oauth") return false;
       const set = getAccountSet("google-antigravity");
       const active = set?.accounts.find(account => account.id === set.activeAccountId);
-      if (!active || active.needsReauth === true) return false;
+      if (!active || active.needsReauth === true || active.paused === true) return false;
       return !!(active.credential as { projectId?: string } | undefined)?.projectId;
     },
     eligibleModel: candidate => candidate.provider === "google-antigravity",

package/src/web-search/devin-executor.ts

@@ -126,7 +126,7 @@ export async function resolveDevinWebSearchSnapshot(
   try {
     const selection = captureOAuthAccountSelection(credentialProvider);
     if (!selection) return { error: "devin web search auth failed: no signed-in account" };
-    const snapshot = await getValidAccessTokenSnapshot(credentialProvider);
+    const snapshot = await getValidAccessTokenSnapshot(credentialProvider, { oauthProvider: "devin" });
     const committed = await commitOAuthAccountSelection(credentialProvider, snapshot.accountId, {
       expectedSelection: selection,
       expectedCredentialGeneration: snapshot.generation,

package/src/web-search/sidecar-providers.ts

@@ -52,9 +52,9 @@ export function findAnthropicSidecarProvider(config: OcxConfig): AnthropicSideca
 }
 
 /**
- * First enabled provider whose stored Grok OAuth account is active and not marked for
- * reauth — the only credential the xai web-search executor may spend. Same account-set
- * predicate the shared sidecar auth module applies to Anthropic.
+ * First enabled provider whose stored Grok OAuth account is active, not paused by the
+ * operator and not marked for reauth — the only credential the xai web-search executor may
+ * spend. Same account-set predicate the shared sidecar auth module applies to Anthropic.
  */
 export function findXaiSidecarProvider(config: OcxConfig): { providerName: string; provider: OcxProviderConfig } | undefined {
   // The stored Grok credential lives under the provider named "xai" (registry id);
@@ -63,7 +63,7 @@ export function findXaiSidecarProvider(config: OcxConfig): { providerName: strin
   if (!provider || provider.disabled === true || provider.authMode !== "oauth") return undefined;
   const set = getAccountSet("xai");
   const active = set?.accounts.find(account => account.id === set.activeAccountId);
-  if (active && active.needsReauth !== true) return { providerName: "xai", provider };
+  if (active && active.needsReauth !== true && active.paused !== true) return { providerName: "xai", provider };
   return undefined;
 }
 
@@ -78,7 +78,7 @@ export function findGeminiSidecarProvider(config: OcxConfig): { providerName: st
   if (!provider || provider.disabled === true || provider.authMode !== "oauth") return undefined;
   const set = getAccountSet("google-antigravity");
   const active = set?.accounts.find(account => account.id === set.activeAccountId);
-  if (!active || active.needsReauth === true) return undefined;
+  if (!active || active.needsReauth === true || active.paused === true) return undefined;
   const projectId = (active.credential as { projectId?: string } | undefined)?.projectId;
   if (!projectId) return undefined;
   return { providerName: "google-antigravity", provider };