@bitkyc08/opencodex 2.7.41 → 2.7.42

package/src/server/responses/passthrough-error.ts

@@ -1,11 +1,8 @@
 import { formatErrorResponse } from "../../bridge";
-import { parseRetryAfterMs } from "../../combos";
-
-function sanitizedRetryAfter(value: string | null | undefined, now: number): string | undefined {
-  const trimmed = value?.trim();
-  if (!trimmed || trimmed.length > 128) return undefined;
-  return parseRetryAfterMs(trimmed, now) !== undefined ? trimmed : undefined;
-}
+import {
+  resolveClientRetryAfter,
+  validateClientRetryAfterHeader,
+} from "../../lib/retry-after";
 
 /**
  * Passthrough adapters historically relayed upstream non-2xx bodies verbatim.
@@ -16,9 +13,11 @@ function sanitizedRetryAfter(value: string | null | undefined, now: number): str
  * HTML/text errors) must keep their original bytes and headers so pool-retry
  * activation and client diagnostics stay honest.
  *
- * Normalized (empty-body) responses force `Content-Type: application/json` and
- * preserve a validated `Retry-After` so Responses clients and the chat-completions
- * / Claude bridges that copy that header keep correct backoff.
+ * Retry-After is validated independently of the body path:
+ * - valid upstream values are preserved
+ * - missing/malformed values are replaced when resolveClientRetryAfter yields a value
+ * - malformed/expired values are removed when the resolver returns undefined
+ *   (e.g. quota-exhausted 429s must not keep junk headers or get the synthetic "2")
  */
 export function formatPassthroughUpstreamError(
   status: number,
@@ -31,13 +30,38 @@ export function formatPassthroughUpstreamError(
 ): Response {
   const trimmed = bodyText.trim();
   const now = options?.now ?? Date.now();
-  const retryAfter = sanitizedRetryAfter(options?.headers?.get("retry-after"), now);
+  const upstreamRetryAfter = options?.headers?.get("retry-after")?.trim() || undefined;
+  const originalValid = validateClientRetryAfterHeader(upstreamRetryAfter, now);
+  const resolved = resolveClientRetryAfter({
+    status,
+    message: trimmed || `Provider error ${status}: (empty body)`,
+    upstreamRetryAfter,
+    now,
+  });
 
   if (trimmed) {
+    const needsSet = resolved !== undefined && upstreamRetryAfter !== resolved;
+    const needsDelete = resolved === undefined
+      && upstreamRetryAfter !== undefined
+      && originalValid === undefined;
+
+    if (!needsSet && !needsDelete) {
+      return new Response(bodyText, {
+        status,
+        ...(options?.statusText ? { statusText: options.statusText } : {}),
+        ...(options?.headers ? { headers: options.headers } : { headers: { "Content-Type": "application/json" } }),
+      });
+    }
+
+    const headers = options?.headers
+      ? new Headers(options.headers)
+      : new Headers({ "Content-Type": "application/json" });
+    if (needsSet) headers.set("Retry-After", resolved!);
+    else headers.delete("Retry-After");
     return new Response(bodyText, {
       status,
       ...(options?.statusText ? { statusText: options.statusText } : {}),
-      ...(options?.headers ? { headers: options.headers } : { headers: { "Content-Type": "application/json" } }),
+      headers,
     });
   }
 
@@ -45,9 +69,10 @@ export function formatPassthroughUpstreamError(
     status,
     "upstream_error",
     `Provider error ${status}: (empty body)`,
+    resolved !== undefined ? { retryAfter: resolved } : undefined,
   );
   const headers = new Headers(response.headers);
   headers.set("Content-Type", "application/json");
-  if (retryAfter !== undefined) headers.set("Retry-After", retryAfter);
+  if (resolved !== undefined) headers.set("Retry-After", resolved);
   return new Response(response.body, { status: response.status, headers });
 }

package/src/server/startup-action-control.ts

@@ -1,9 +1,110 @@
+import { randomUUID } from "node:crypto";
 import { execFile } from "node:child_process";
 import { join } from "node:path";
 import { durableBunPath } from "../lib/bun-runtime";
+import {
+  WINDOWS_SCHTASKS_CREATE_ACCESS_DENIED_MARKER,
+  isWindowsSchtasksCreateAccessDenied,
+} from "../lib/windows-elevation";
+import {
+  finalizeWindowsSchedulerServiceRegistration,
+  type ElevatedReconciliationOutcome,
+  type FinalizeWindowsSchedulerOptions,
+  type FinalizeWindowsSchedulerResult,
+  type WindowsSchedulerTaskProbe,
+} from "../service";
 
 export type StartupInstallAction = "install-service" | "install-shim";
-let activeInstall: StartupInstallAction | null = null;
+
+export type StartupInstallState =
+  | { status: "idle" }
+  | {
+      status: "running";
+      action: StartupInstallAction;
+      attemptId: string;
+      startedAt: number;
+    }
+  | {
+      status: "indeterminate";
+      action: "install-service";
+      attemptId: string;
+      startedAt: number;
+      timedOutAt: number;
+      reconciliation: Promise<ElevatedReconciliationOutcome>;
+    }
+  | {
+      status: "blocked";
+      reason: "partial-elevated-install";
+      action: "install-service";
+      attemptId: string;
+      detail: string;
+    };
+
+const INSTALL_DETAIL_LIMIT = 2_000;
+const INDETERMINATE_MESSAGE =
+  "Windows elevation timed out, but the elevated Task Scheduler transaction may still be running. New service installation attempts are temporarily blocked while OpenCodex reconciles its final state.";
+const RECONCILING_MESSAGE =
+  "A previous elevated Windows service installation is still being reconciled. Wait for it to finish or inspect the Task Scheduler state before retrying.";
+const BLOCKED_PARTIAL_MESSAGE =
+  "A previous elevated Windows service installation left a partial Task Scheduler state. Remove the OpenCodex scheduler task (or confirm it is absent), then clear the install block before retrying.";
+
+let installState: StartupInstallState = { status: "idle" };
+
+type FinalizeFn = (
+  script?: string,
+  options?: FinalizeWindowsSchedulerOptions,
+) => Promise<FinalizeWindowsSchedulerResult>;
+let finalizeImpl: FinalizeFn = finalizeWindowsSchedulerServiceRegistration;
+
+/** Test-only seam so elevation retry tests do not mock.module the service package. */
+export function setStartupInstallFinalizeForTests(next: FinalizeFn | null): void {
+  finalizeImpl = next ?? finalizeWindowsSchedulerServiceRegistration;
+}
+
+/** Snapshot of the install lock for diagnostics and tests. */
+export function getStartupInstallState(): StartupInstallState {
+  return installState;
+}
+
+/** True when this attempt still owns the active/indeterminate/blocked lock. */
+export function ownsStartupInstallAttempt(attemptId: string): boolean {
+  return (installState.status === "running"
+    || installState.status === "indeterminate"
+    || installState.status === "blocked")
+    && installState.attemptId === attemptId;
+}
+
+/**
+ * Clear a partial-install block after the operator has cleaned up Task Scheduler.
+ * Requires an observed probe and clears only when the task is proven absent.
+ * Does not itself delete the task.
+ */
+export function clearStartupInstallPartialBlock(options: {
+  probe: WindowsSchedulerTaskProbe;
+}): { cleared: boolean; detail: string } {
+  if (installState.status !== "blocked") {
+    return { cleared: false, detail: `Install lock is ${installState.status}, not blocked.` };
+  }
+  if (options.probe.status === "present") {
+    return {
+      cleared: false,
+      detail: "OpenCodex Task Scheduler task is still present; remove it before clearing the block.",
+    };
+  }
+  if (options.probe.status === "unknown") {
+    return {
+      cleared: false,
+      detail: `Could not verify Task Scheduler absence (${options.probe.detail}); not clearing the block.`,
+    };
+  }
+  installState = { status: "idle" };
+  return { cleared: true, detail: "Partial-install block cleared." };
+}
+
+/** Test-only reset of the install lock. */
+export function resetStartupInstallStateForTests(): void {
+  installState = { status: "idle" };
+}
 
 export function startupInstallArgv(action: StartupInstallAction): string[] {
   return action === "install-service"
@@ -11,14 +112,52 @@ export function startupInstallArgv(action: StartupInstallAction): string[] {
     : ["codex-shim", "install"];
 }
 
-/** Execute the existing fixed CLI installer outside the proxy event loop. */
-export function runStartupInstallAction(action: StartupInstallAction): Promise<{ message: string }> {
-  if (activeInstall) return Promise.reject(new Error(`Another startup installation is already running: ${activeInstall}`));
-  activeInstall = action;
+export interface CliInstallFailure {
+  /** Machine marker such as OCX_ERROR_CODE=..., when present in any stream. */
+  code: string | null;
+  stdout: string;
+  stderr: string;
+  message: string;
+  /** Bounded user-facing diagnostic (may append the marker if truncated away). */
+  detail: string;
+}
+
+function extractOcxErrorCode(text: string): string | null {
+  const match = text.match(/OCX_ERROR_CODE=[A-Z0-9_]+/);
+  return match ? match[0] : null;
+}
+
+/**
+ * Classify a CLI install failure, keeping the machine marker separate from the
+ * truncated user-facing diagnostic.
+ */
+export function classifyCliInstallFailure(stdout: string, stderr: string, error: Error): CliInstallFailure {
+  const stdoutText = stdout.trim();
+  const stderrText = stderr.trim();
+  const message = error.message.trim();
+  const combined = [stderrText, stdoutText, message].filter(Boolean).join("\n");
+  const code = extractOcxErrorCode(combined);
+  let detail = combined || message;
+  if (detail.length > INSTALL_DETAIL_LIMIT) {
+    const truncated = detail.slice(0, INSTALL_DETAIL_LIMIT);
+    detail = code && !truncated.includes(code)
+      ? `${truncated}\n${code}… (truncated)`
+      : `${truncated}… (truncated)`;
+  }
+  return { code, stdout: stdoutText, stderr: stderrText, message, detail };
+}
+
+/** @deprecated Prefer classifyCliInstallFailure; kept for existing tests. */
+export function installFailureDetail(stdout: string, stderr: string, error: Error): string {
+  return classifyCliInstallFailure(stdout, stderr, error).detail;
+}
+
+function runCliInstall(action: StartupInstallAction): Promise<{ stdout: string; stderr: string }> {
   const bun = durableBunPath();
   const cli = join(import.meta.dir, "..", "cli", "index.ts");
-  const operation = new Promise<{ message: string }>((resolve, reject) => {
-    execFile(bun, [cli, ...startupInstallArgv(action)], {
+  const argv = [cli, ...startupInstallArgv(action)];
+  return new Promise((resolve, reject) => {
+    execFile(bun, argv, {
       encoding: "utf8",
       env: process.env,
       timeout: 60_000,
@@ -26,16 +165,128 @@ export function runStartupInstallAction(action: StartupInstallAction): Promise<{
       maxBuffer: 256 * 1024,
     }, (error, stdout, stderr) => {
       if (error) {
-        const detail = stderr.trim() || stdout.trim() || error.message;
-        reject(new Error(detail.slice(0, 2_000)));
+        const failure = classifyCliInstallFailure(stdout, stderr, error);
+        reject(Object.assign(new Error(failure.detail), { ocxInstallFailure: failure }));
         return;
       }
-      resolve({
-        message: action === "install-service"
-          ? "Background service installed."
-          : "Codex launcher shim installed.",
-      });
+      resolve({ stdout, stderr });
     });
   });
-  return operation.finally(() => { activeInstall = null; });
+}
+
+function installFailureCode(error: unknown): string | null {
+  if (error && typeof error === "object" && "ocxInstallFailure" in error) {
+    const failure = (error as { ocxInstallFailure?: CliInstallFailure }).ocxInstallFailure;
+    if (failure?.code) return failure.code;
+  }
+  const detail = error instanceof Error ? error.message : String(error);
+  return extractOcxErrorCode(detail);
+}
+
+function rejectIfBusy(_action: StartupInstallAction): Error | null {
+  if (installState.status === "running") {
+    return new Error(`Another startup installation is already running: ${installState.action}`);
+  }
+  if (installState.status === "indeterminate") {
+    return new Error(RECONCILING_MESSAGE);
+  }
+  if (installState.status === "blocked") {
+    return new Error(BLOCKED_PARTIAL_MESSAGE);
+  }
+  return null;
+}
+
+function applyReconciliationOutcome(
+  attemptId: string,
+  outcome: ElevatedReconciliationOutcome,
+): void {
+  if (installState.status !== "indeterminate" || installState.attemptId !== attemptId) {
+    return;
+  }
+  if (outcome === "blocked-partial") {
+    installState = {
+      status: "blocked",
+      reason: "partial-elevated-install",
+      action: "install-service",
+      attemptId,
+      detail: BLOCKED_PARTIAL_MESSAGE,
+    };
+    return;
+  }
+  installState = { status: "idle" };
+}
+
+/**
+ * Execute the existing fixed CLI installer outside the proxy event loop.
+ *
+ * After an elevation request timeout the lock becomes `indeterminate` until the
+ * original elevated transaction completes and is reconciled. A process restart
+ * clears this in-memory lock — callers must then inspect Task Scheduler reality
+ * (see evaluateSchedulerInstallRestartReconciliation) before installing again.
+ */
+export function runStartupInstallAction(action: StartupInstallAction): Promise<{ message: string }> {
+  const busy = rejectIfBusy(action);
+  if (busy) return Promise.reject(busy);
+
+  const attemptId = randomUUID();
+  const startedAt = Date.now();
+  installState = { status: "running", action, attemptId, startedAt };
+
+  const operation = (async () => {
+    try {
+      await runCliInstall(action);
+    } catch (error) {
+      const code = installFailureCode(error);
+      const detail = error instanceof Error ? error.message : String(error);
+      // Elevate only for a structured Task Scheduler /create access denial — never for
+      // WinSW removal, asset writes, or generic permission errors.
+      if (
+        action === "install-service"
+        && process.platform === "win32"
+        && (code === WINDOWS_SCHTASKS_CREATE_ACCESS_DENIED_MARKER
+          || isWindowsSchtasksCreateAccessDenied(detail))
+      ) {
+        const finalized = await finalizeImpl(undefined, {
+          attemptId,
+          stillOwnsAttempt: ownsStartupInstallAttempt,
+        });
+        if (finalized.kind === "indeterminate") {
+          const ownedAttemptId = finalized.attemptId;
+          installState = {
+            status: "indeterminate",
+            action: "install-service",
+            attemptId: ownedAttemptId,
+            startedAt,
+            timedOutAt: Date.now(),
+            reconciliation: finalized.reconciliation,
+          };
+          void finalized.reconciliation.then(
+            outcome => {
+              applyReconciliationOutcome(ownedAttemptId, outcome);
+            },
+            () => {
+              // Fail closed: a rejected reconciliation must not leave an unhandled rejection
+              // or silently idle the lock while Task Scheduler state may still be partial.
+              applyReconciliationOutcome(ownedAttemptId, "blocked-partial");
+            },
+          );
+          throw new Error(INDETERMINATE_MESSAGE);
+        }
+      } else {
+        throw error;
+      }
+    }
+    return {
+      message: action === "install-service"
+        ? "Background service installed."
+        : "Codex launcher shim installed.",
+    };
+  })();
+
+  return operation.finally(() => {
+    // Do not clear an indeterminate or blocked lock from a timed-out elevation.
+    if (installState.status === "running" && installState.attemptId === attemptId) {
+      installState = { status: "idle" };
+    }
+  });
 }