@bitkyc08/opencodex 2.7.41 → 2.7.42

package/src/grok/inject.ts

@@ -77,6 +77,14 @@ const MODEL_TABLE_HEADER = new RegExp(
   "gm",
 );
 
+/**
+ * ANY table header, capturing its full dotted key. Used to compute table SPANS: a table
+ * body runs from its own header to the next header of any kind, so the orphan sweep can
+ * remove a whole table instead of a guessed line range (a partial removal would re-parent
+ * the leftover keys onto the preceding table).
+ */
+const ANY_TABLE_HEADER = /^[ \t]*\[\[?[ \t]*([^\]\r\n]*?)[ \t]*\]\]?[ \t]*(?:#.*)?$/gm;
+
 /** Resolve a header key segment (bare / basic / literal) to the key it actually addresses. */
 function canonicalKeySegment(raw: string): string {
   if (raw.startsWith('"')) return decodeTomlBasicString(raw.slice(1, -1));
@@ -102,6 +110,143 @@ function userModelAliases(content: string, region: ManagedRegion | null): Set<st
   return aliases;
 }
 
+/**
+ * The api_key literal every generated entry carries. It is the STRONG ownership signal:
+ * a value we mint, that a human has no reason to type by hand.
+ */
+const OPENCODEX_API_KEY = "opencodex-loopback";
+
+/** A plain `[model.<alias>]` table outside the fence that opencodex itself wrote. */
+interface OrphanTable {
+  alias: string;
+  /** The model id this entry routes to — used to find its replacement alias. */
+  modelId: string | undefined;
+  /** Offsets into the NORMALIZED content: header start .. next header start (or EOF). */
+  start: number;
+  end: number;
+}
+
+/** `key = "value"` / `key = value` pairs at the top level of one table body. */
+function tableBodyKeys(body: string): Map<string, string> {
+  const keys = new Map<string, string>();
+  for (const line of body.split("\n")) {
+    const match = /^[ \t]*([A-Za-z0-9_-]+)[ \t]*=[ \t]*(.*?)[ \t]*$/.exec(line);
+    if (!match) continue;
+    const raw = match[2]!;
+    const value = raw.startsWith('"') && raw.endsWith('"') && raw.length >= 2
+      ? decodeTomlBasicString(raw.slice(1, -1))
+      : raw;
+    if (!keys.has(match[1]!)) keys.set(match[1]!, value);
+  }
+  return keys;
+}
+
+/** Is this base_url pointed at the local machine? */
+function isLoopbackBaseUrl(value: string | undefined): boolean {
+  if (!value) return false;
+  try {
+    return isLoopbackHostname(new URL(value).hostname);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Model tables OUTSIDE the fence that opencodex itself wrote (#511).
+ *
+ * These are entries from a version that predates the markers (or predates
+ * `context_window`). Because they sit outside the fence, `userModelAliases` reserves
+ * their aliases as user-owned and the writer routes around them with a `-2` suffix — so
+ * every sync adds a CORRECT duplicate and never removes the stale original. Grok then
+ * resolves the original, finds no `context_window`, and falls back to its own 200k.
+ *
+ * Ownership is CONJUNCTIVE and deliberately strict, because a false positive deletes a
+ * hand-written user model:
+ *   - a plain `[model.x]` header (never `[[model.x]]` / `[model.x.sub]` — those spellings
+ *     mark human authorship and stay reserved);
+ *   - `api_key` equal to our own literal;
+ *   - a loopback `base_url`, so an entry that merely copied our key while pointing at a
+ *     remote host is left alone.
+ * A loopback base_url ALONE is not enough: aiming your own model at the local proxy is a
+ * legitimate thing to do.
+ */
+function findOpencodexOrphans(content: string, region: ManagedRegion | null): OrphanTable[] {
+  const orphans: OrphanTable[] = [];
+  // A pre-fence orphan's body must stop AT the fence. The managed block opens with a
+  // COMMENT, not a table header, so a span that runs to "the next table header" swallows
+  // the BEGIN marker whenever no other table separates them — and removing the orphan then
+  // deletes the fence opener itself, which strands the END marker and makes every later
+  // sync re-append a block (the #511 duplicate loop, one layer down).
+  // `region` is null ONLY when BEGIN_MARKER is absent (see findManagedRegion), so -1
+  // disables the clamp for marker-less files without a redundant scan.
+  const fenceStart = region ? region.start : -1;
+  const clampEnd = (start: number, end: number): number =>
+    fenceStart >= 0 && start < fenceStart ? Math.min(end, fenceStart) : end;
+  // Collect every table header first: a table body runs to the NEXT header, whatever it is.
+  const headers: Array<{ index: number; length: number; segments: string[]; array: boolean }> = [];
+  for (const match of content.matchAll(ANY_TABLE_HEADER)) {
+    headers.push({
+      index: match.index!,
+      length: match[0].length,
+      segments: match[1]!.split(".").map(part => canonicalKeySegment(part.trim())),
+      array: match[0].trimStart().startsWith("[["),
+    });
+  }
+  for (const [position, header] of headers.entries()) {
+    if (header.array || header.segments.length !== 2 || header.segments[0] !== "model") continue;
+    // Inside the fence the regular splice already owns it.
+    if (region && header.index >= region.start && header.index < region.end) continue;
+    const bodyEnd = clampEnd(header.index, headers[position + 1]?.index ?? content.length);
+    const keys = tableBodyKeys(content.slice(header.index + header.length, bodyEnd));
+    if (keys.get("api_key") !== OPENCODEX_API_KEY) continue;
+    if (!isLoopbackBaseUrl(keys.get("base_url"))) continue;
+    // Swallow the entry's OWN sub-tables (`[model.<alias>.extra_headers]`). Grok writes
+    // them when it re-serializes the file, and leaving one behind keeps the alias
+    // reserved by `userModelAliases` — so the sweep would remove the parent and STILL
+    // allocate a suffixed duplicate, which is the exact #511 loop we came to close.
+    let end = bodyEnd;
+    for (let next = position + 1; next < headers.length; next += 1) {
+      const child = headers[next]!;
+      // Only a PRE-fence parent may be cut short by the fence. Without the parent test a
+      // below-fence orphan would break on its first child (every index is past the fence),
+      // leaving the sub-table behind to keep the alias reserved — the -2 loop again.
+      if (fenceStart >= 0 && header.index < fenceStart && child.index >= fenceStart) break;
+      if (child.segments.length <= 2) break;
+      if (child.segments[0] !== "model" || child.segments[1] !== header.segments[1]) break;
+      end = clampEnd(header.index, headers[next + 1]?.index ?? content.length);
+    }
+    orphans.push({ alias: header.segments[1]!, modelId: keys.get("model"), start: header.index, end });
+  }
+  return orphans;
+}
+
+/** Remove whole tables, back to front so earlier offsets stay valid. */
+function removeOrphanTables(content: string, orphans: OrphanTable[]): string {
+  let next = content;
+  for (const orphan of [...orphans].sort((a, b) => b.start - a.start)) {
+    next = next.slice(0, orphan.start) + next.slice(orphan.end);
+  }
+  return next;
+}
+
+/**
+ * Repoint `default` / `fork_secondary_model` at the alias that survived.
+ *
+ * Removing an adopted orphan that `[models] default` names would leave Grok pointing at
+ * a model that no longer exists — and on a real machine `default` DOES name one, so this
+ * is the common path rather than an edge case.
+ */
+function rewriteAliasReferences(content: string, renames: Map<string, string>): string {
+  if (renames.size === 0) return content;
+  return content.replace(
+    /^([ \t]*(?:default|fork_secondary_model)[ \t]*=[ \t]*")([^"]*)(")/gm,
+    (whole, prefix: string, value: string, suffix: string) => {
+      const replacement = renames.get(value);
+      return replacement ? `${prefix}${replacement}${suffix}` : whole;
+    },
+  );
+}
+
 function orphanedMarkerResult(action: string): GrokInjectResult {
   return {
     ok: false,
@@ -230,9 +375,20 @@ export function injectGrokConfig(
     const configExisted = existsSync(configPath);
     const rawContent = configExisted ? readFileSync(configPath, "utf8") : "";
     const eol = dominantEol(rawContent);
-    const content = applyEol(rawContent, "\n");
-    const region = findManagedRegion(content);
-    if (region?.orphaned) return orphanedMarkerResult("injection");
+    const originalContent = applyEol(rawContent, "\n");
+    const originalRegion = findManagedRegion(originalContent);
+    // Ambiguous fence: refuse before the sweep, or "outside the region" could mean the
+    // entire file.
+    if (originalRegion?.orphaned) return orphanedMarkerResult("injection");
+
+    // Adopt our own pre-fence entries (#511) BEFORE reserving user aliases, so the stale
+    // duplicate is replaced instead of routed around forever. Runs inside the normalized
+    // window so the user's dominant EOL is still restored below.
+    const orphans = findOpencodexOrphans(originalContent, originalRegion);
+    const content = removeOrphanTables(originalContent, orphans);
+    // Removing bytes above the fence MOVES it: recompute rather than adjust arithmetic,
+    // so the splice below cannot cut the file in the wrong place.
+    const region = orphans.length > 0 ? findManagedRegion(content) : originalRegion;
 
     const block = buildGrokManagedBlock(port, models, opts.hostname, userModelAliases(content, region), opts.excluded);
     let nextContent: string;
@@ -248,11 +404,35 @@ export function injectGrokConfig(
       nextContent = `${content}\n${block}\n`;
     }
 
+    // Repoint `default` / `fork_secondary_model` at whichever alias survived. A removed
+    // model with no replacement keeps its reference untouched — a stale name in a working
+    // file beats a dangling one.
+    if (orphans.length > 0) {
+      const survivors = new Map<string, string>();
+      for (const match of nextContent.matchAll(MODEL_TABLE_HEADER)) {
+        if (canonicalKeySegment(match[1]!) !== "model") continue;
+        const alias = canonicalKeySegment(match[2]!);
+        const body = nextContent.slice(match.index! + match[0].length);
+        const modelId = tableBodyKeys(body.slice(0, body.search(/^[ \t]*\[/m) + 1 || body.length)).get("model");
+        if (modelId !== undefined && !survivors.has(modelId)) survivors.set(modelId, alias);
+      }
+      const renames = new Map<string, string>();
+      for (const orphan of orphans) {
+        const replacement = orphan.modelId === undefined ? undefined : survivors.get(orphan.modelId);
+        if (replacement && replacement !== orphan.alias) renames.set(orphan.alias, replacement);
+      }
+      nextContent = rewriteAliasReferences(nextContent, renames);
+    }
+
     const output = applyEol(nextContent, eol);
     if (output === rawContent) {
       return { ok: true, changed: false, message: "Grok config already contains the current opencodex managed block." };
     }
-    if (configExisted && !region) copyBackupOnce(configPath, backupPath);
+    // Back up before a first-time fence write AND before any sweep, since adopting an orphan
+    // deletes a table the user has in their file. Previously the adjacent-orphan layout got a
+    // backup only as a side effect of the fence being destroyed (which made `region` falsy);
+    // preserving the fence must not silently drop that safety net.
+    if (configExisted && (!region || orphans.length > 0)) copyBackupOnce(configPath, backupPath);
     atomicWriteFile(configPath, output);
     return {
       ok: true,

package/src/grok/status.ts

@@ -86,3 +86,36 @@ export function readGrokStatus(opts: { grokHome?: string } = {}): GrokStatus {
 
   return { configPath, present: true, baseUrl, models: models.filter(model => model.id) };
 }
+
+/**
+ * Does the fence point somewhere the running proxy is NOT?
+ *
+ * Grok resolves its model at request time and retries a refused connection up to 15
+ * times, and those retries are invisible to us: nothing reaches the proxy, so nothing
+ * lands in our log. The user sees a correct context window (the stale entry carries it)
+ * and an endless "Retrying (attempt N/15)". That is a silent failure unless someone
+ * compares the fence's port against the port we actually bound — which is exactly what
+ * `ocx status` is for.
+ *
+ * Returns null when there is nothing to say: no fence, an unparsable endpoint, or a
+ * fence that already agrees with the live listener.
+ */
+export function grokFenceEndpointDrift(
+  status: Pick<GrokStatus, "present" | "baseUrl">,
+  livePort: number | undefined,
+): { fencePort: number; livePort: number } | null {
+  if (!status.present || !status.baseUrl) return null;
+  if (typeof livePort !== "number" || !Number.isFinite(livePort) || livePort <= 0) return null;
+  let fencePort: number;
+  try {
+    const url = new URL(status.baseUrl);
+    // An explicit port is the only thing we write, so an empty one means a shape we did
+    // not produce; stay quiet rather than guess a default.
+    if (!url.port) return null;
+    fencePort = Number(url.port);
+  } catch {
+    return null;
+  }
+  if (!Number.isFinite(fencePort) || fencePort === livePort) return null;
+  return { fencePort, livePort };
+}

package/src/lib/retry-after.ts

@@ -0,0 +1,55 @@
+import { parseRetryAfterMs } from "../combos";
+import { classifyError, parseRetryAfterFromMessage } from "./errors";
+
+/** Small default when a retryable 429 has no upstream Retry-After (#507). */
+export const DEFAULT_RETRYABLE_429_RETRY_AFTER_SEC = "2";
+
+/**
+ * Validate a raw upstream Retry-After for client exposure.
+ * Instant-retry `"0"` is kept even though cooldown parsers reject it.
+ */
+export function validateClientRetryAfterHeader(
+  value: string | null | undefined,
+  now: number,
+): string | undefined {
+  const trimmed = value?.trim();
+  if (!trimmed || trimmed.length > 128) return undefined;
+  // Instant-retry "0" is a valid client directive but rejected by cooldown parsers
+  // (parseRetryAfterMs requires seconds > 0). Preserve it for client headers.
+  if (trimmed === "0") return trimmed;
+  return parseRetryAfterMs(trimmed, now) !== undefined ? trimmed : undefined;
+}
+
+/**
+ * Pick a Retry-After value that clients (especially Codex) can back off on.
+ *
+ * Order: validated upstream header → delay embedded in the error message →
+ * small default for retryable rate-limit 429s. Quota-exhausted 429s get no
+ * default — hammering a spent quota is not a backoff problem.
+ *
+ * Pass `includeDefault: false` when the value feeds cooldown/failover metadata:
+ * the synthetic client fallback must not shorten combo cooldowns from 60s to 2s.
+ */
+export function resolveClientRetryAfter(opts: {
+  status: number;
+  message?: string;
+  upstreamRetryAfter?: string | null;
+  now?: number;
+  includeDefault?: boolean;
+}): string | undefined {
+  const now = opts.now ?? Date.now();
+  const fromHeader = validateClientRetryAfterHeader(opts.upstreamRetryAfter, now);
+  if (fromHeader) return fromHeader;
+
+  const message = opts.message ?? "";
+  const fromMessage = parseRetryAfterFromMessage(message);
+  if (fromMessage !== undefined) return String(fromMessage);
+
+  if (opts.includeDefault === false) return undefined;
+  if (opts.status !== 429) return undefined;
+  const classified = classifyError(429, "rate_limit_error", message || "Too Many Requests");
+  if (classified.type === "insufficient_quota" || classified.code === "insufficient_quota") {
+    return undefined;
+  }
+  return DEFAULT_RETRYABLE_429_RETRY_AFTER_SEC;
+}