@bitkyc08/opencodex 2.7.23 → 2.7.24

package/src/server/images.ts

@@ -15,20 +15,18 @@ import { formatErrorResponse } from "../bridge";
 import {
   CodexAccountCooldownError,
   CodexAuthContextError,
+  CodexPoolAuthenticationError,
   CodexThreadAffinityExpiredError,
-  headersForCodexAuthContext,
-  isCodexAuthContextUsable,
-  resolveCodexAuthContext,
 } from "../codex/auth-context";
 import { formatCodexProviderForLog } from "../codex/routing";
-import { resolveEnvValue } from "../config";
 import { signalWithTimeout } from "../lib/abort";
 import { sidecarEnter } from "../lib/sidecar-tracker";
-import type { OcxConfig, OcxProviderConfig } from "../types";
-import { isProxyAdmissionSecret } from "./auth-cors";
+import type { OcxConfig } from "../types";
+import { resolveFirstUsableOpenAiSidecar, selectOpenAiImagesProvider } from "../providers/openai-sidecar";
 import { readJsonRequestBody } from "./request-decompress";
+import { ForwardAdmissionCredentialError, validateForwardAdmissionCredential } from "./auth-cors";
 import type { RequestLogContext } from "./request-log";
-import { codexLogAccountId, decodeRequestErrorResponse, sidecarOutcomeRecorder } from "./responses";
+import { codexLogAccountId, decodeRequestErrorResponse } from "./responses";
 
 export type ImagesEndpoint = "generations" | "edits";
 
@@ -42,45 +40,17 @@ const IMAGES_UPSTREAM_TIMEOUT_MS = 300_000;
  */
 const IMAGES_RESPONSE_MAX_BYTES = 100 * 1024 * 1024;
 
-interface NamedProvider {
-  name: string;
-  provider: OcxProviderConfig;
-}
-
-interface ImagesUpstreamCandidates {
-  /** ChatGPT passthrough — the backend codex itself would have called absent the base_url override. */
-  forward?: NamedProvider;
-  /** Keyed openai-responses provider (e.g. api.openai.com), whose /v1/images/* is the platform Images API. */
-  keyed?: NamedProvider & { apiKey: string };
-}
-
-/**
- * Collect the upstreams that can serve /images/*. The forward provider is preferred (same
- * precedence as the vision/web-search sidecars) but only usable when the request actually
- * carries relayable ChatGPT auth — startServer auto-upserts a `chatgpt` forward entry into
- * every config, so its mere presence proves nothing about credentials.
- */
-function findImagesUpstreams(config: OcxConfig): ImagesUpstreamCandidates {
-  const candidates: ImagesUpstreamCandidates = {};
-  for (const [name, provider] of Object.entries(config.providers)) {
-    if (provider.disabled === true) continue;
-    if (provider.authMode === "forward") {
-      candidates.forward ??= { name, provider };
-      continue;
-    }
-    if (candidates.keyed || provider.adapter !== "openai-responses" || provider.authMode === "oauth") continue;
-    const apiKey = resolveEnvValue(provider.apiKey);
-    if (apiKey) candidates.keyed = { name, provider, apiKey };
-  }
-  return candidates;
-}
-
 export async function handleImages(
   req: Request,
   config: OcxConfig,
   endpoint: ImagesEndpoint,
   logCtx: RequestLogContext,
 ): Promise<Response> {
+  try { validateForwardAdmissionCredential(req.headers, config); }
+  catch (err) {
+    if (err instanceof ForwardAdmissionCredentialError) return formatErrorResponse(401, "authentication_error", err.message);
+    throw err;
+  }
   let body: unknown;
   try {
     body = await readJsonRequestBody(req);
@@ -90,8 +60,8 @@ export async function handleImages(
   const model = (body as { model?: unknown } | null)?.model;
   if (typeof model === "string" && model) logCtx.model = model;
 
-  const candidates = findImagesUpstreams(config);
-  if (!candidates.forward && !candidates.keyed) {
+  const candidates = selectOpenAiImagesProvider(config);
+  if (candidates.forwardCandidates.length === 0 && !candidates.keyed) {
     // 400, not 5xx: codex retries every 5xx up to 5 total attempts, and this is a permanent
     // configuration state that must surface on the first attempt.
     return formatErrorResponse(
@@ -106,39 +76,23 @@ export async function handleImages(
   // Resolve forward auth first; failures are captured, not returned, so a configured keyed
   // provider can still serve the request (e.g. every pool account cooling down must not
   // 429 image_gen while api.openai.com sits idle).
-  let forwardAuthHeaders: Headers | undefined;
+  let forward: Awaited<ReturnType<typeof resolveFirstUsableOpenAiSidecar>>;
   let forwardAuthError: Response | undefined;
-  let recordOutcome: ReturnType<typeof sidecarOutcomeRecorder>;
-  if (candidates.forward) {
+  if (candidates.forwardCandidates.length > 0) {
     try {
-      const authCtx = await resolveCodexAuthContext(req.headers, config);
-      if (!isCodexAuthContextUsable(authCtx, config)) {
-        forwardAuthError = formatErrorResponse(401, "authentication_error", "Selected Codex account needs reauthentication");
-      } else {
-        // Forwarded caller auth, overridden by the routed pool account's token when one is selected.
-        const authHeaders = headersForCodexAuthContext(req.headers, authCtx);
-        const bearer = authHeaders.get("authorization")?.replace(/^Bearer\s+/i, "") ?? "";
-        // A caller may authenticate to the proxy itself with `Authorization: Bearer <admission
-        // token>` (non-loopback binds); that secret must never be relayed to chatgpt.com.
-        if (bearer && isProxyAdmissionSecret(bearer, config)) authHeaders.delete("authorization");
-        // Only relay through the ChatGPT backend when there is a bearer to relay: startServer
-        // auto-upserts the `chatgpt` provider, so an unauthenticated request must not be bounced
-        // off chatgpt.com when a keyed OpenAI provider (or an honest error) serves it better.
-        if (authHeaders.get("authorization")) {
-          forwardAuthHeaders = authHeaders;
-          recordOutcome = sidecarOutcomeRecorder(config, authCtx);
-          logCtx.provider = formatCodexProviderForLog(candidates.forward.name, codexLogAccountId(authCtx), config);
-        }
-      }
+      forward = await resolveFirstUsableOpenAiSidecar(candidates.forwardCandidates, req.headers, config);
+      if (forward) logCtx.provider = formatCodexProviderForLog(forward.providerName, codexLogAccountId(forward.authContext), config);
     } catch (err) {
       if (err instanceof CodexAccountCooldownError) {
         forwardAuthError = formatErrorResponse(429, "rate_limit_error", "Selected Codex account is cooling down");
       } else if (err instanceof CodexThreadAffinityExpiredError) {
         forwardAuthError = formatErrorResponse(409, "invalid_request_error", "Codex thread account affinity expired; start a new session");
       } else if (err instanceof CodexAuthContextError) {
-        const safeAccountLabel = formatCodexProviderForLog(candidates.forward.name, err.accountId, config);
+        const safeAccountLabel = formatCodexProviderForLog("openai", err.accountId, config);
         console.error(`[images] Pool account ${safeAccountLabel} token failed; reauthentication required`);
         forwardAuthError = formatErrorResponse(401, "authentication_error", "Selected Codex account needs reauthentication");
+      } else if (err instanceof CodexPoolAuthenticationError) {
+        forwardAuthError = formatErrorResponse(401, "authentication_error", err.message);
       } else {
         throw err;
       }
@@ -147,21 +101,23 @@ export async function handleImages(
 
   const headers: Record<string, string> = { "content-type": "application/json" };
   let url: string;
-  if (forwardAuthHeaders && candidates.forward) {
-    const { provider } = candidates.forward;
+  if (forward) {
+    const { provider } = forward;
     if (provider.headers) Object.assign(headers, provider.headers);
-    for (const [name, value] of forwardAuthHeaders) headers[name] = value;
+    for (const [name, value] of forward.headers) headers[name] = value;
     // The ChatGPT codex backend takes bare paths (matches the adapter's `${baseUrl}/responses`).
     url = `${provider.baseUrl}/images/${endpoint}`;
+  } else if (forwardAuthError) {
+    // A configured OpenAI pool mode owns its authentication failure. Do not hide a
+    // broken/expired pool behind separately billed API-key image generation.
+    return forwardAuthError;
   } else if (candidates.keyed) {
-    const { provider, apiKey, name } = candidates.keyed;
+    const { provider, apiKey, providerName } = candidates.keyed;
     if (provider.headers) Object.assign(headers, provider.headers);
     headers["authorization"] = `Bearer ${apiKey}`;
-    logCtx.provider = name;
+    logCtx.provider = providerName;
     // Keyed providers tolerate baseUrl with or without /v1 (mirrors openai-responses.ts).
     url = `${provider.baseUrl.replace(/\/v1\/?$/, "")}/v1/images/${endpoint}`;
-  } else if (forwardAuthError) {
-    return forwardAuthError;
   } else {
     return formatErrorResponse(
       401,
@@ -189,7 +145,7 @@ export async function handleImages(
     if (payload.byteLength > IMAGES_RESPONSE_MAX_BYTES) {
       return formatErrorResponse(502, "upstream_error", `image ${endpoint} response too large (${payload.byteLength} bytes)`);
     }
-    recordOutcome?.(upstreamResponse.status);
+    forward?.recordOutcome?.(upstreamResponse.status);
     const relayHeaders: Record<string, string> = {};
     const contentType = upstreamResponse.headers.get("content-type");
     if (contentType) relayHeaders["content-type"] = contentType;
@@ -201,11 +157,11 @@ export async function handleImages(
       return formatErrorResponse(499, "client_closed_request", `image ${endpoint} request canceled by client`);
     }
     if (err instanceof Error && err.name === "TimeoutError") {
-      recordOutcome?.("timeout");
+      forward?.recordOutcome?.("timeout");
       // codex retries 5xx up to 4 more times; a retried 504 is acceptable for a transient hang.
       return formatErrorResponse(504, "upstream_error", `image ${endpoint} upstream timed out`);
     }
-    recordOutcome?.("connect_error");
+    forward?.recordOutcome?.("connect_error");
     return formatErrorResponse(
       502,
       "upstream_error",

package/src/server/index.ts

@@ -16,18 +16,13 @@ import {
   saveConfig,
   websocketsEnabled,
 } from "../config";
-import {
-  clearLoginState, getLoginStatus, getOAuthCredentialProjectId, getValidAccessToken, isOAuthProvider,
-  listOAuthProviders, reconcileOAuthProviders, startLoginFlow, UnsupportedOAuthProviderError, upsertOAuthProvider,
-} from "../oauth";
+import { reconcileOAuthProviders } from "../oauth";
 import { invalidateCodexModelsCache } from "../codex/catalog";
+import { runOpenAiTierStartupMigration } from "../providers/openai-tier-startup";
+import { isCanonicalOpenAiForwardProvider } from "../providers/openai-tiers";
+import { providerCodexAccountMode } from "../providers/registry";
 import {
   CodexAccountCooldownError,
-  CodexAuthContextError,
-  CodexThreadAffinityExpiredError,
-  headersForCodexAuthContext,
-  resolveCodexAuthContext,
-  type CodexAuthContext,
 } from "../codex/auth-context";
 export {
   clearThreadAccountMap,
@@ -102,6 +97,7 @@ import {
   isLoopbackHostname,
   jsonResponse,
   requireApiAuth,
+  requireResponsesApiAuth,
   safeConfigDTO,
   setCorsOrigin,
   withCors,
@@ -147,17 +143,12 @@ const WEBSOCKET_IDLE_TIMEOUT_SECONDS = 0;
 // export function relaySseWithHeartbeat
 
 export function startServer(port?: number) {
-  const config = loadConfig();
+  const config = runOpenAiTierStartupMigration(loadConfig());
   applyProxyEnv(config);
   assertServerAuthConfig(config);
   // Refresh OAuth provider presets (models/noReasoningModels) from the registry so a proxy update
   // adding/dropping models reaches existing configs on start — not just fresh installs.
   reconcileOAuthProviders(config);
-  // Ensure the ChatGPT passthrough provider exists so gpt-* models route correctly.
-  if (!config.providers["chatgpt"]) {
-    upsertOAuthProvider(config, "chatgpt");
-    saveConfig(config);
-  }
   // Seed default featured subagent models on first run only (UNSET → defaults). A user-set list,
   // even [], is left alone so GUI removals persist.
   if (config.subagentModels === undefined) {
@@ -214,7 +205,7 @@ export function startServer(port?: number) {
         if (isDraining()) {
           return new Response("Service shutting down", { status: 503, headers: { ...corsHeaders(req, config), "Retry-After": "5" } });
         }
-        const apiAuthError = requireApiAuth(req, config, "data-plane");
+        const apiAuthError = requireResponsesApiAuth(req, config);
         if (apiAuthError) return withCors(apiAuthError, req, config);
         if (!isAllowedRequestOrigin(req, config)) {
           return withCors(formatErrorResponse(403, "origin_rejected", "WebSocket upgrade blocked: non-local Origin"), req, config);
@@ -227,27 +218,9 @@ export function startServer(port?: number) {
         if (!websocketsEnabled(config)) {
           return withCors(formatErrorResponse(426, "upgrade_required", "Responses WebSocket transport is disabled; use HTTP"), req, config);
         }
-        let authCtx: CodexAuthContext;
-        try {
-          authCtx = await resolveCodexAuthContext(req.headers, config);
-        } catch (err) {
-          if (err instanceof CodexAccountCooldownError) {
-            return withCors(formatErrorResponse(429, "rate_limit_error", "Selected Codex account is cooling down"), req, config);
-          }
-          if (err instanceof CodexThreadAffinityExpiredError) {
-            return withCors(formatErrorResponse(409, "invalid_request_error", "Codex thread account affinity expired; start a new session"), req, config);
-          }
-          if (err instanceof CodexAuthContextError) {
-            const safeAccountLabel = formatCodexProviderForLog("chatgpt", err.accountId, config);
-            console.error(`[codex-auth] Pool account ${safeAccountLabel} token failed during websocket upgrade; reauthentication required`);
-            return withCors(formatErrorResponse(401, "authentication_error", "Selected Codex account needs reauthentication"), req, config);
-          }
-          throw err;
-        }
         if (server.upgrade(req, {
           data: {
             headers: selectForwardHeaders(req.headers),
-            authContext: authCtx,
           },
         })) return undefined as unknown as Response;
         return withCors(formatErrorResponse(426, "upgrade_required", "WebSocket upgrade failed"), req, config);
@@ -272,7 +245,7 @@ export function startServer(port?: number) {
           return withCors(formatErrorResponse(403, "origin_rejected", "cross-origin data-plane request blocked"), req, config);
         }
         const goModels = await fetchAllModels(config);
-        const { applyNativeVisibility, buildCatalogEntries, disabledNativeSlugs, loadCatalogTemplate, nativeOpenAiSlugs, orderForSubagents, filterCatalogVisibleModels, visibleNativeSlugs } = await import("../codex/catalog");
+        const { applyNativeVisibility, buildCatalogEntries, disabledNativeSlugs, exactComboCatalogSlugs, loadCatalogTemplate, nativeOpenAiSlugs, orderForSubagents, filterCatalogVisibleModels, visibleNativeSlugs } = await import("../codex/catalog");
         const nativeSlugs = nativeOpenAiSlugs();
         const goEnabled = filterCatalogVisibleModels(goModels, config);
         const goOrdered = orderForSubagents(goEnabled, config.subagentModels);
@@ -315,7 +288,7 @@ export function startServer(port?: number) {
           // Disabled natives stay in the catalog shape with visibility "hide" (mirrors the
           // on-disk sync; codex-rs keeps them out of the picker itself).
           const maMode = config.multiAgentMode === "v1" || config.multiAgentMode === "v2" ? config.multiAgentMode : "default";
-          const entries = buildCatalogEntries(loadCatalogTemplate(), nativeSlugs, goOrdered, config.subagentModels, websocketsEnabled(config), maMode as "v1" | "default" | "v2");
+          const entries = buildCatalogEntries(loadCatalogTemplate(), nativeSlugs, goOrdered, config.subagentModels, websocketsEnabled(config), maMode as "v1" | "default" | "v2", exactComboCatalogSlugs(config));
           return jsonResponse({ models: applyNativeVisibility(entries, disabledNativeSlugs(config)) }, 200, req, config);
         }
         // OpenAI list shape: native gpt bare + routed models namespaced "<provider>/<id>"
@@ -334,12 +307,28 @@ export function startServer(port?: number) {
         if (isDraining()) {
           return new Response("Service shutting down", { status: 503, headers: { ...corsHeaders(req, config), "Retry-After": "5" } });
         }
-        const apiAuthError = requireApiAuth(req, config, "data-plane");
+        const apiAuthError = requireResponsesApiAuth(req, config);
         if (apiAuthError) return withCors(apiAuthError, req, config);
         if (!isAllowedRequestOrigin(req, config)) {
           return withCors(formatErrorResponse(403, "origin_rejected", "cross-origin data-plane request blocked"), req, config);
         }
-        return withCors(await handleResponsesCompact(req, config), req, config);
+        const start = Date.now();
+        const requestId = nextRequestLogId(start);
+        const logCtx: RequestLogContext = { model: "unknown", provider: "unknown" };
+        let response: Response;
+        try {
+          response = await handleResponsesCompact(req, config, logCtx);
+        } catch {
+          response = formatErrorResponse(500, "server_error", "Unexpected compact request failure");
+        }
+        addFinalRequestLog(
+          requestId,
+          start,
+          logCtx,
+          response.status,
+          response.status === 499 ? { closeReason: "client_cancel" } : undefined,
+        );
+        return withCors(response, req, config);
       }
 
       if (
@@ -399,7 +388,7 @@ export function startServer(port?: number) {
         if (isDraining()) {
           return new Response("Service shutting down", { status: 503, headers: { ...corsHeaders(req, config), "Retry-After": "5" } });
         }
-        const apiAuthError = requireApiAuth(req, config, "data-plane");
+        const apiAuthError = requireResponsesApiAuth(req, config);
         if (apiAuthError) return withCors(apiAuthError, req, config);
         if (!isAllowedRequestOrigin(req, config)) {
           return withCors(formatErrorResponse(403, "origin_rejected", "cross-origin data-plane request blocked"), req, config);
@@ -521,6 +510,10 @@ export function startServer(port?: number) {
           turnAbort.abort("websocket turn superseded or closed");
         };
         ws.data.cancel = cancelTurn;
+        // A socket may carry several response.create frames. Clear the previous
+        // account before resolving this frame so a failed Multi resolution cannot
+        // leave stale invalidation ownership behind.
+        updateCodexWebSocketAuthContext(ws, undefined);
 
         if (frame.generate === false) {
           for (const payload of buildWarmupCompletionFrames(frame)) {
@@ -548,49 +541,8 @@ export function startServer(port?: number) {
             addFinalRequestLog(requestId, start, logCtx, status, meta);
           };
           const baseHeaders = ws.data.headers ?? new Headers();
-          let authCtx: CodexAuthContext;
-          let selectedForwardHeaders: Headers;
-          try {
-            authCtx = await resolveCodexAuthContext(baseHeaders, config);
-            selectedForwardHeaders = headersForCodexAuthContext(baseHeaders, authCtx);
-            updateCodexWebSocketAuthContext(ws, authCtx);
-          } catch (err) {
-            if (!isCurrent()) return;
-            if (err instanceof CodexAccountCooldownError) {
-              finalizeLog(429);
-              sendJsonFrame(ws, buildWsErrorFrame(429, {
-                type: "rate_limit_error",
-                message: "Selected Codex account is cooling down",
-              }));
-              return;
-            }
-            if (err instanceof CodexThreadAffinityExpiredError) {
-              finalizeLog(409);
-              sendJsonFrame(ws, buildWsErrorFrame(409, {
-                type: "invalid_request_error",
-                message: "Codex thread account affinity expired; start a new session",
-              }));
-              return;
-            }
-            if (err instanceof CodexAuthContextError) {
-              const safeAccountLabel = formatCodexProviderForLog("chatgpt", err.accountId, config);
-              console.error(`[codex-auth] Pool account ${safeAccountLabel} token failed during websocket turn; reauthentication required`);
-              finalizeLog(401);
-              sendJsonFrame(ws, buildWsErrorFrame(401, {
-                type: "authentication_error",
-                message: "Selected Codex account needs reauthentication",
-              }));
-              return;
-            }
-            finalizeLog(502);
-            sendJsonFrame(ws, buildWsErrorFrame(502, {
-              type: "proxy_error",
-              message: err instanceof Error ? err.message : String(err),
-            }));
-            return;
-          }
           const fwd = new Headers({ "content-type": "application/json" });
-          selectedForwardHeaders.forEach((value, key) => fwd.set(key, value));
+          baseHeaders.forEach((value, key) => fwd.set(key, value));
           const req = new Request("http://localhost/v1/responses", {
             method: "POST",
             headers: fwd,
@@ -601,8 +553,7 @@ export function startServer(port?: number) {
             const response = await handleResponses(req, config, logCtx, {
               forceEmptyResponseId: true,
               abortSignal: turnAbort.signal,
-              authContext: authCtx,
-              selectedForwardHeaders,
+              onCodexAuthContextResolved: context => updateCodexWebSocketAuthContext(ws, context),
               recordTerminalOutcomes: false,
               setTerminalOutcomeRecorder: recorder => {
                 terminalRecorder = recorder;
@@ -666,9 +617,17 @@ export function startServer(port?: number) {
   // usage scores from the first routing decision, even when the dashboard is
   // never opened (the common CLI/WSL case). Fire-and-forget: never blocks the
   // listener, and a blocked network silently no-ops (see Phase 30 diagnostics).
-  import("../codex/auth-api")
-    .then(({ primeCodexPoolQuotas }) => primeCodexPoolQuotas(config, "startup"))
-    .catch(() => {});
+  const openAiProvider = config.providers.openai;
+  if (
+    openAiProvider
+    && openAiProvider.disabled !== true
+    && isCanonicalOpenAiForwardProvider(openAiProvider)
+    && providerCodexAccountMode("openai", openAiProvider) === "pool"
+  ) {
+    import("../codex/auth-api")
+      .then(({ primeCodexPoolQuotas }) => primeCodexPoolQuotas(config, "startup"))
+      .catch(() => {});
+  }
 
   return server;
 }