@bitkyc08/opencodex 2.7.38-preview.20260724 → 2.7.39

package/src/codex/auth-context.ts

@@ -7,7 +7,11 @@ import {
 import { markAccountNeedsReauth } from "./account-runtime-state";
 import { isCodexAccountUsable } from "./account-usability";
 import { MAIN_CODEX_ACCOUNT_ID, getMainAccountToken } from "./main-account";
-import { getCodexAccountCooldownUntil, resolveCodexAccountForThreadDetailed } from "./routing";
+import {
+  getCodexAccountCooldownUntil,
+  pickLowestUsageCodexAccount,
+  resolveCodexAccountForThreadDetailed,
+} from "./routing";
 import { getAccountQuota } from "./quota";
 import type { CodexAccountMode, OcxConfig, OcxProviderConfig } from "../types";
 import { FORWARD_HEADERS } from "../adapters/openai-responses";
@@ -89,17 +93,29 @@ export function shouldMarkAccountNeedsReauthForCodexAuthFailure(cause: unknown):
   return !(cause instanceof CodexCredentialGenerationConflictError) && !(cause instanceof CodexCredentialRefreshLockTimeoutError);
 }
 
+export interface ResolveCodexAuthContextOptions {
+  excludeAccountId?: string;
+}
+
 export async function resolveCodexAuthContext(
   headers: Headers,
   config: OcxConfig,
   mode: CodexAccountMode,
+  options: ResolveCodexAuthContextOptions = {},
 ): Promise<CodexAuthContext> {
   if (mode === "direct") {
     if (!hasCallerCodexBearer(headers)) throw new CodexDirectAuthenticationError();
     return { kind: "main", accountId: null };
   }
   const threadId = headers.get("x-codex-parent-thread-id");
-  const resolution = resolveCodexAccountForThreadDetailed(threadId, config);
+  const resolution = options.excludeAccountId
+    ? (() => {
+        const accountId = pickLowestUsageCodexAccount(config, options.excludeAccountId);
+        return accountId
+          ? { status: "selected" as const, accountId }
+          : { status: "none" as const };
+      })()
+    : resolveCodexAccountForThreadDetailed(threadId, config);
   if (resolution.status === "expired") throw new CodexThreadAffinityExpiredError(resolution.accountId);
   const accountId = resolution.status === "selected" ? resolution.accountId : null;
   if (!accountId) throw new CodexPoolAuthenticationError();

package/src/codex/catalog/provider-fetch.ts

@@ -4,7 +4,19 @@ import { copyFileSync, existsSync, mkdirSync, readFileSync, realpathSync } from
 import { delimiter, dirname, join, resolve } from "node:path";
 import { atomicWriteFile, expandUserPath, getConfigDir, websocketsEnabled } from "../../config";
 import { CODEX_CONFIG_PATH, CODEX_MODELS_CACHE_PATH, DEFAULT_CATALOG_PATH, readRootTomlString, resolveCodexConfigPath } from "../paths";
-import { clearModelCache, DEFAULT_MODEL_CACHE_TTL_MS, getFreshCached, getStaleCached, isModelsFetchCoolingDown, markModelsFetchFailure, setCached } from "../model-cache";
+import {
+  clearModelCache,
+  clearProviderDiscoveryStatus,
+  DEFAULT_MODEL_CACHE_TTL_MS,
+  getFreshCached,
+  getStaleCached,
+  isModelsFetchCoolingDown,
+  markModelsFetchFailure,
+  markProviderDiscoveryFailed,
+  markProviderDiscoveryOk,
+  setCached,
+  type ProviderModelDiscoveryFailure,
+} from "../model-cache";
 import { buildModelsRequest, resolveModelsAuthToken } from "../../oauth";
 import type { OcxConfig, OcxProviderConfig } from "../../types";
 import { modelInList } from "../../types";
@@ -235,7 +247,11 @@ export async function fetchProviderModels(name: string, prov: OcxProviderConfig,
       : models
   );
   if (prov.adapter === "cursor") {
-    if (prov.liveModels === false || !apiKey) return configured;
+    if (prov.liveModels === false) {
+      clearProviderDiscoveryStatus(name);
+      return configured;
+    }
+    if (!apiKey) return configured;
     // Cursor uses a bespoke GetUsableModels RPC (not /models), returning the full effort-suffixed
     // variants this PLAN can use. Keep the base-model UX (the request builder appends the effort
     // suffix) but filter the static seed to the bases the account actually has — so models not on the
@@ -250,10 +266,12 @@ export async function fetchProviderModels(name: string, prov: OcxProviderConfig,
     if (liveResult.ok) {
       const available = filterCursorConfiguredModelsByLiveDiscovery(configured, liveResult.models);
       const result = available.length > 0 ? available : configured;
+      markProviderDiscoveryOk(name);
       setCached(name, result);
       return result;
     }
     markModelsFetchFailure(name);
+    markProviderDiscoveryFailed(name, { reason: "provider" });
     console.warn(
       `[opencodex] Cursor model discovery for "${name}" failed [${liveResult.error}]${liveResult.detail ? `: ${liveResult.detail}` : ""}; using stale/static catalog degradation.`,
     );
@@ -267,6 +285,7 @@ export async function fetchProviderModels(name: string, prov: OcxProviderConfig,
     return configured;
   }
   if (prov.liveModels === false) {
+    clearProviderDiscoveryStatus(name);
     return configured;
   }
   const fresh = getFreshCached(name, ttlMs);
@@ -281,8 +300,11 @@ export async function fetchProviderModels(name: string, prov: OcxProviderConfig,
   const urlClass = new URL(url).hostname.endsWith("aiplatform.googleapis.com")
     ? "vertex-aiplatform"
     : "provider-models";
-  const failedDiscoveryFallback = (): { models: CatalogModel[]; fallback: "stale" | "configured" } => {
+  const failedDiscoveryFallback = (
+    failure: ProviderModelDiscoveryFailure,
+  ): { models: CatalogModel[]; fallback: "stale" | "configured" } => {
     markModelsFetchFailure(name);
+    markProviderDiscoveryFailed(name, failure);
     const stale = getStaleCached(name);
     return {
       models: stale
@@ -297,7 +319,7 @@ export async function fetchProviderModels(name: string, prov: OcxProviderConfig,
       allowPrivateNetwork: prov.allowPrivateNetwork,
     });
     if (destinationError) {
-      const { models, fallback } = failedDiscoveryFallback();
+      const { models, fallback } = failedDiscoveryFallback({ reason: "blocked" });
       console.warn(
         `[opencodex] Provider model discovery for "${name}" was blocked by destination policy: ${destinationError} [urlClass=${urlClass}, fallback=${fallback}].`,
       );
@@ -306,7 +328,7 @@ export async function fetchProviderModels(name: string, prov: OcxProviderConfig,
 
     const res = await fetch(url, { headers, signal: AbortSignal.timeout(8000) });
     if (!res.ok) {
-      const { models, fallback } = failedDiscoveryFallback();
+      const { models, fallback } = failedDiscoveryFallback({ reason: "http", httpStatus: res.status });
       console.warn(
         `[opencodex] Provider model discovery for "${name}" failed with HTTP ${res.status} [urlClass=${urlClass}, fallback=${fallback}].`,
       );
@@ -321,7 +343,7 @@ export async function fetchProviderModels(name: string, prov: OcxProviderConfig,
     try {
       json = JSON.parse(body) as unknown;
     } catch {
-      const { models, fallback } = failedDiscoveryFallback();
+      const { models, fallback } = failedDiscoveryFallback({ reason: "invalid_response" });
       const diagnostic = contentType === "application/json" || contentType.endsWith("+json")
         ? "returned invalid JSON in a 2xx response"
         : "returned a non-JSON 2xx response";
@@ -334,7 +356,7 @@ export async function fetchProviderModels(name: string, prov: OcxProviderConfig,
       ? (json as { data?: unknown }).data
       : undefined;
     if (!isProviderModelsApiItems(data)) {
-      const { models, fallback } = failedDiscoveryFallback();
+      const { models, fallback } = failedDiscoveryFallback({ reason: "invalid_response" });
       console.warn(
         `[opencodex] Provider model discovery for "${name}" returned malformed 2xx data [status=${res.status}, contentType=${contentType}, urlClass=${urlClass}, fallback=${fallback}].`,
       );
@@ -376,10 +398,11 @@ export async function fetchProviderModels(name: string, prov: OcxProviderConfig,
       && !QUIET_AUTHORITATIVE_CATALOG_PROVIDERS.has(name)) {
       warnDroppedConfiguredIdsOnce(name, droppedConfiguredIds);
     }
+    markProviderDiscoveryOk(name);
     setCached(name, live);
     return live;
   } catch (error) {
-    const { models, fallback } = failedDiscoveryFallback();
+    const { models, fallback } = failedDiscoveryFallback({ reason: "network" });
     console.warn(
       `[opencodex] Provider model discovery for "${name}" threw ${error instanceof Error ? error.name : "unknown"} [urlClass=${urlClass}, fallback=${fallback}].`,
     );

package/src/codex/model-cache.ts

@@ -17,6 +17,28 @@ interface CacheEntry {
   fetchedAt: number;
 }
 
+export type ProviderModelDiscoveryFailureReason =
+  | "http"
+  | "blocked"
+  | "invalid_response"
+  | "network"
+  | "provider";
+
+export type ProviderModelDiscoveryStatus =
+  | { status: "ok" }
+  | { status: "failed"; reason: "http"; httpStatus: number }
+  | {
+      status: "failed";
+      reason: Exclude<ProviderModelDiscoveryFailureReason, "http">;
+      httpStatus?: never;
+    };
+
+export type ProviderModelDiscoveryFailure = ProviderModelDiscoveryStatus extends infer Status
+  ? Status extends { status: "failed" }
+    ? Omit<Status, "status">
+    : never
+  : never;
+
 const cache = new Map<string, CacheEntry>();
 
 /** Cooldown after a failed live `/models` fetch, so a dead/unreachable provider doesn't re-pay
@@ -24,11 +46,31 @@ const cache = new Map<string, CacheEntry>();
 export const MODELS_FETCH_FAILURE_COOLDOWN_MS = 30_000;
 
 const failureAt = new Map<string, number>();
+const discoveryStatus = new Map<string, ProviderModelDiscoveryStatus>();
 
 export function markModelsFetchFailure(provider: string, now = Date.now()): void {
   failureAt.set(provider, now);
 }
 
+export function markProviderDiscoveryOk(provider: string): void {
+  discoveryStatus.set(provider, { status: "ok" });
+}
+
+export function markProviderDiscoveryFailed(
+  provider: string,
+  failure: ProviderModelDiscoveryFailure,
+): void {
+  discoveryStatus.set(provider, { status: "failed", ...failure });
+}
+
+export function clearProviderDiscoveryStatus(provider: string): void {
+  discoveryStatus.delete(provider);
+}
+
+export function getProviderDiscoveryStatus(provider: string): ProviderModelDiscoveryStatus | undefined {
+  return discoveryStatus.get(provider);
+}
+
 export function isModelsFetchCoolingDown(provider: string, cooldownMs = MODELS_FETCH_FAILURE_COOLDOWN_MS, now = Date.now()): boolean {
   const at = failureAt.get(provider);
   return at !== undefined && now - at < cooldownMs;
@@ -55,8 +97,10 @@ export function clearModelCache(provider?: string): void {
   if (provider) {
     cache.delete(provider);
     failureAt.delete(provider);
+    discoveryStatus.delete(provider);
   } else {
     cache.clear();
     failureAt.clear();
+    discoveryStatus.clear();
   }
 }

package/src/codex/runtime.ts

@@ -1,5 +1,6 @@
 import { execFileSync } from "node:child_process";
-import { existsSync, mkdirSync, readFileSync, unlinkSync } from "node:fs";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, unlinkSync } from "node:fs";
+import { tmpdir } from "node:os";
 import { delimiter, join } from "node:path";
 import { atomicWriteFile, getConfigDir } from "../config";
 import { codexExecInvocation, isSpawnableCodexCandidate } from "./exec-invocation";
@@ -50,6 +51,7 @@ export type RuntimeExecFile = (
     windowsHide: boolean;
     shell?: boolean;
     windowsVerbatimArguments?: boolean;
+    env?: NodeJS.ProcessEnv;
   },
 ) => string;
 
@@ -239,7 +241,14 @@ function probeVersion(
     }
   }
   const execFile = deps.execFileSync ?? (execFileSync as unknown as RuntimeExecFile);
+  // Sandbox the probe's CODEX_HOME: a real Codex CLI creates state (tmp/, logs) under
+  // CODEX_HOME even for `--version`, and the probe inherits the caller's env — so a
+  // read-only `ocx status` would dirty the user's CODEX_HOME. Redirect it to a
+  // throwaway dir; if the sandbox cannot be created, skip the probe rather than
+  // probe with the inherited env (keeps probeVersion total: it never throws).
+  let probeHome: string | undefined;
   try {
+    probeHome = mkdtempSync(join(tmpdir(), "ocx-codex-probe-"));
     const invocation = codexExecInvocation(command, ["--version"], platform, {
       env: deps.env,
       exists: deps.existsSync,
@@ -249,6 +258,7 @@ function probeVersion(
       stdio: ["ignore", "pipe", "ignore"],
       timeout: 8_000,
       windowsHide: true,
+      env: { ...(deps.env ?? process.env), CODEX_HOME: probeHome },
       ...invocation.options,
     });
     const version = parseCodexVersionOutput(output);
@@ -257,9 +267,15 @@ function probeVersion(
     }
     return { ok: true, version };
   } catch (error) {
+    if (!probeHome) return { ok: false, reason: "probe sandbox unavailable" };
     const message = error instanceof Error ? error.message : String(error);
     const redacted = redactUserPath(redactSecretString(message)).slice(0, 160);
     return { ok: false, reason: `failed --version (${redacted})` };
+  } finally {
+    if (probeHome) {
+      // Nested catch: a transient Windows EBUSY must never mask the probe result.
+      try { rmSync(probeHome, { recursive: true, force: true }); } catch { /* best effort */ }
+    }
   }
 }