@bitkyc08/opencodex 2.7.42 → 2.7.43

package/src/codex/inject.ts

@@ -1,5 +1,5 @@
 import { existsSync, readFileSync, unlinkSync } from "node:fs";
-import { atomicWriteFile, loadConfig, websocketsEnabled } from "../config";
+import { atomicWriteFile, loadConfig, subagentDefaultSyncEffective, websocketsEnabled } from "../config";
 import { markJournalInjectedState, removeJournal, restoreJournalState, writeJournal } from "./journal";
 import { restoreCodexCatalog } from "./catalog";
 import { migrateHistoryToOpenai, syncCodexHistoryProvider } from "./history-provider";
@@ -15,6 +15,10 @@ import {
 } from "./injected-marker";
 import { CODEX_CONFIG_PATH, CODEX_PROFILE_PATH, DEFAULT_CATALOG_PATH, parseTomlString, readRootTomlString, resolveCodexConfigPath, tomlString } from "./paths";
 import { resolveEffectiveProjectModelProvider } from "./project-config-warnings";
+import {
+  transformManagedSubagentDefaults,
+  type ManagedSubagentDefaults,
+} from "./subagent-defaults";
 import type { OcxConfig } from "../types";
 
 // Ownership predicates live in `./injected-marker` so `journal.ts` can reach them
@@ -68,6 +72,16 @@ export interface InjectCodexOptions {
   catalogPath?: string | null;
 }
 
+function configuredManagedSubagentDefaults(
+  config: Pick<OcxConfig, "injectionModel" | "injectionEffort" | "syncCodexSubagentDefaults"> | undefined,
+): ManagedSubagentDefaults | null {
+  if (!subagentDefaultSyncEffective(config ?? {})) return null;
+  return {
+    model: config!.injectionModel!.trim(),
+    ...(config!.injectionEffort?.trim() ? { reasoningEffort: config!.injectionEffort.trim() } : {}),
+  };
+}
+
 /**
  * The `[model_providers.opencodex]` TABLE only. A table is position-independent in TOML, so it is
  * safe to append at EOF. The bare root key `model_provider = "opencodex"` is NOT included here —
@@ -458,7 +472,13 @@ export function chooseCatalogPathForInjection(content: string, requested?: strin
   return existsSync(DEFAULT_CATALOG_PATH) ? DEFAULT_CATALOG_PATH : null;
 }
 
-export async function injectCodexConfig(port: number, config?: OcxConfig, options: InjectCodexOptions = {}): Promise<{ success: boolean; message: string }> {
+export interface CodexInjectResult {
+  success: boolean;
+  message: string;
+  nativeSubagentDefaultsWarning?: string;
+}
+
+export async function injectCodexConfig(port: number, config?: OcxConfig, options: InjectCodexOptions = {}): Promise<CodexInjectResult> {
   if (!existsSync(CODEX_CONFIG_PATH)) {
     return { success: false, message: `Codex config not found at ${CODEX_CONFIG_PATH}. Is Codex installed?` };
   }
@@ -469,8 +489,12 @@ export async function injectCodexConfig(port: number, config?: OcxConfig, option
     // A launcher may have journaled before the provider manager took ownership. Never let shutdown
     // replay that stale snapshot over externally managed config.
     removeJournal();
+    const nativeSubagentDefaultsWarning = configuredManagedSubagentDefaults(config)
+      ? `Native Codex sub-agent defaults were not injected: external model_provider ${tomlString(activeProvider)} owns config.toml.`
+      : undefined;
     return {
       success: true,
+      ...(nativeSubagentDefaultsWarning ? { nativeSubagentDefaultsWarning } : {}),
       message: `⚠️ Codex routing NOT injected: config.toml selects the external model_provider ${tomlString(activeProvider)}.\n` +
         `  OpenCodex preserves external provider configuration so existing ${tomlString(activeProvider)} session history stays visible.\n` +
         `  Configure that provider for Responses passthrough at http://${providerBaseHost(config?.hostname)}:${port}/v1` +
@@ -479,16 +503,31 @@ export async function injectCodexConfig(port: number, config?: OcxConfig, option
     };
   }
 
+  // Marker-owned native defaults are OpenCodex residue, never part of the
+  // user's journal baseline. Clean them before either snapshotting or adding a
+  // root routing key: inserting that key ahead of a marker-owned first table
+  // would otherwise separate the table marker from its header. Ambiguous
+  // markers fail closed without writing config, profile, or journal state.
+  const nativeDefaultsBaseline = transformManagedSubagentDefaults(rawContent, null);
+  if (!nativeDefaultsBaseline.ok) {
+    return {
+      success: false,
+      message: `Codex config injection refused: existing OpenCodex-managed native sub-agent defaults are ambiguous: ${nativeDefaultsBaseline.error}. `
+        + `No files were changed; inspect ${CODEX_CONFIG_PATH}.`,
+    };
+  }
+  const baselineContent = nativeDefaultsBaseline.content;
+
   // Classify and journal the same bytes: a native config is a valid original and
   // supersedes a stale snapshot (#477), while an injected one must never become
   // one — that is how opencodex routing would survive `ocx stop`.
   writeJournal({
     currentStateIsNative: !hasInjectedCodexRouting(rawContent),
-    configContent: rawContent,
+    configContent: baselineContent,
   });
   // EOL boundary: transforms below are LF-pure; preserve the file's dominant ending on write.
   const eol = dominantEol(rawContent);
-  let content = applyEol(rawContent, "\n");
+  let content = applyEol(baselineContent, "\n");
 
   // Idempotent clean-up of any prior injection: drop the provider table (marker-based) and every
   // stray/mis-nested model_provider line, so re-injecting can't duplicate keys or leave the buggy
@@ -526,6 +565,31 @@ export async function injectCodexConfig(port: number, config?: OcxConfig, option
     keptUserBaseUrl = result.keptUserBaseUrl;
   }
 
+  const desiredSubagentDefaults = configuredManagedSubagentDefaults(config);
+  const routingOwnershipWarning = keptUserBaseUrl && desiredSubagentDefaults
+    ? "Native Codex sub-agent defaults were not injected: a user-owned root openai_base_url prevents OpenCodex from managing active Codex routing."
+    : undefined;
+  const managedDefaults = transformManagedSubagentDefaults(
+    content,
+    keptUserBaseUrl ? null : desiredSubagentDefaults,
+  );
+  let nativeSubagentDefaultsWarning = routingOwnershipWarning;
+  let managedDefaultsMessage = routingOwnershipWarning ? `  ⚠️ ${routingOwnershipWarning}\n` : "";
+  if (managedDefaults.ok) {
+    content = managedDefaults.content;
+    if (desiredSubagentDefaults && managedDefaults.conflicts.length > 0) {
+      const keys = managedDefaults.conflicts.map(conflict => `agents.${conflict.key}`).join(", ");
+      nativeSubagentDefaultsWarning = `Native Codex sub-agent defaults were not injected: user-owned ${keys} preserved.`;
+      managedDefaultsMessage = `  ⚠️ ${nativeSubagentDefaultsWarning}\n`;
+    }
+  } else {
+    const action = desiredSubagentDefaults && !keptUserBaseUrl
+      ? "were not injected"
+      : "could not be safely removed";
+    nativeSubagentDefaultsWarning = `Native Codex sub-agent defaults ${action}: ${managedDefaults.error}.`;
+    managedDefaultsMessage = `  ⚠️ ${nativeSubagentDefaultsWarning}\n`;
+  }
+
   const profileContent = buildProfileFile(port, catalogPath, websocketsEnabled(config ?? {}), legacyMode, config?.hostname);
   content = applyEol(content, eol);
   atomicWriteFile(CODEX_CONFIG_PATH, content);
@@ -560,9 +624,11 @@ export async function injectCodexConfig(port: number, config?: OcxConfig, option
   if (keptUserBaseUrl) {
     return {
       success: true,
+      ...(nativeSubagentDefaultsWarning ? { nativeSubagentDefaultsWarning } : {}),
       message: `⚠️ Codex routing NOT injected: your config already sets a root openai_base_url, and opencodex never overwrites a user-owned override.\n` +
         catalogMessage +
         historyMessage +
+        managedDefaultsMessage +
         `  To route plain codex through the proxy, remove your openai_base_url line from ~/.codex/config.toml and rerun 'ocx start'.\n` +
         `  Reference config: ${CODEX_PROFILE_PATH}`,
     };
@@ -572,9 +638,11 @@ export async function injectCodexConfig(port: number, config?: OcxConfig, option
     : `Pointed Codex's built-in openai provider at the opencodex proxy (openai_base_url).\n`;
   return {
     success: true,
+    ...(nativeSubagentDefaultsWarning ? { nativeSubagentDefaultsWarning } : {}),
     message: headline +
       catalogMessage +
       historyMessage +
+      managedDefaultsMessage +
       `  All models now route through opencodex proxy (like OpenRouter).\n` +
       `  OpenAI models (gpt-5.5, etc.) are passed through to OpenAI.\n` +
       `  Custom models route to their configured providers.\n` +
@@ -607,8 +675,17 @@ function removeOcxSection(content: string): string {
   return filtered.join("\n").replace(/\n{3,}/g, "\n\n").trimEnd() + "\n";
 }
 
-/** Pure transform: strip the opencodex provider block + `model_provider = "opencodex"` lines. */
-export function stripOpencodexConfig(content: string): string {
+interface StripOpencodexConfigResult {
+  content: string;
+  managedDefaultsError: string | null;
+}
+
+/**
+ * Detailed form used by the on-disk restore path. A damaged ownership marker is
+ * ambiguous: keep the associated value, but return the transform error so the
+ * caller cannot report a complete restore.
+ */
+function stripOpencodexConfigResult(content: string): StripOpencodexConfigResult {
   let out = content;
   const hadRootOcxProvider = readRootTomlString(out, "model_provider") === "opencodex";
   const hadInjectedBaseUrl = hasInjectedOpenaiBaseUrl(out);
@@ -623,8 +700,18 @@ export function stripOpencodexConfig(content: string): string {
   // Routed root model ids (`model = "provider/slug"`) only make sense while the proxy serves
   // them — strip on both the legacy re-tag form and the Design B injected-base-url form.
   if (hadRootOcxProvider || hadInjectedBaseUrl) out = stripRootRoutedModel(out);
+  const managedDefaults = transformManagedSubagentDefaults(out, null);
+  if (managedDefaults.ok) out = managedDefaults.content;
   out = stripOpencodexCatalogPath(out);
-  return out.replace(/\n{3,}/g, "\n\n").trimEnd() + "\n";
+  return {
+    content: out.replace(/\n{3,}/g, "\n\n").trimEnd() + "\n",
+    managedDefaultsError: !managedDefaults.ok ? managedDefaults.error : null,
+  };
+}
+
+/** Pure transform: strip the opencodex provider block + `model_provider = "opencodex"` lines. */
+export function stripOpencodexConfig(content: string): string {
+  return stripOpencodexConfigResult(content).content;
 }
 
 function hasOpencodexRouting(content: string): boolean {
@@ -635,7 +722,11 @@ function hasOpencodexRouting(content: string): boolean {
 
 export function removeCodexConfig(options: { preserveProfile?: boolean } = {}): { success: boolean; message: string } {
   if (!existsSync(CODEX_CONFIG_PATH)) {
-    return { success: false, message: "Codex config not found." };
+    if (!options.preserveProfile && existsSync(CODEX_PROFILE_PATH)) unlinkSync(CODEX_PROFILE_PATH);
+    return {
+      success: true,
+      message: `Codex config not found; no native restore was needed${options.preserveProfile ? "." : ", and the opencodex profile was removed if present."}`,
+    };
   }
   const rawContent = readFileSync(CODEX_CONFIG_PATH, "utf-8");
   // Same EOL boundary as inject: strip in LF space, write back in the file's own ending.
@@ -643,16 +734,25 @@ export function removeCodexConfig(options: { preserveProfile?: boolean } = {}):
   const eol = dominantEol(rawContent);
   const content = applyEol(rawContent, "\n");
   const had = hasOpencodexRouting(content);
-  const stripped = stripOpencodexConfig(content);
-  if (had || stripped !== content) {
-    atomicWriteFile(CODEX_CONFIG_PATH, applyEol(stripped, eol));
+  const stripped = stripOpencodexConfigResult(content);
+  if (had || stripped.content !== content) {
+    atomicWriteFile(CODEX_CONFIG_PATH, applyEol(stripped.content, eol));
   }
   if (!options.preserveProfile && existsSync(CODEX_PROFILE_PATH)) unlinkSync(CODEX_PROFILE_PATH);
+  const removedMessage = had
+    ? `Removed opencodex routing from Codex config${options.preserveProfile ? "." : " + profile."}`
+    : "opencodex not present in Codex config.";
+  if (stripped.managedDefaultsError) {
+    const routingMessage = had ? removedMessage : "No opencodex routing was present in Codex config.";
+    return {
+      success: false,
+      message: `${routingMessage} Native Codex sub-agent defaults could not be safely removed: ${stripped.managedDefaultsError}. ` +
+        "The ambiguous marker and adjacent value were preserved; inspect $CODEX_HOME/config.toml before using native Codex.",
+    };
+  }
   return {
     success: true,
-    message: had
-      ? `Removed opencodex routing from Codex config${options.preserveProfile ? "." : " + profile."}`
-      : "opencodex not present in Codex config.",
+    message: removedMessage,
   };
 }
 

package/src/codex/main-account.ts

@@ -1,14 +1,8 @@
 import { readCodexTokens } from "./auth-collision";
 import { decodeJwtPayload } from "../oauth/chatgpt";
+import { MAIN_CODEX_ACCOUNT_ID } from "./account-id";
 
-/**
- * Stable id under which the "main" Codex account (the Codex CLI login stored in
- * ~/.codex/auth.json) participates in opencodex's account rotation. The main account is
- * NOT imported into the managed credential store (Option A): its token is read-only from
- * auth.json, so opencodex never refreshes it — an expired token surfaces as a reauth
- * notice (re-login via the Codex CLI) rather than a background refresh.
- */
-export const MAIN_CODEX_ACCOUNT_ID = "__main__";
+export { MAIN_CODEX_ACCOUNT_ID } from "./account-id";
 
 /**
  * Main account plan (e.g. "plus", "go", "free", "team"), populated from the WHAM usage

package/src/codex/pool-rotation.ts

@@ -0,0 +1,186 @@
+import type { OcxAccountPoolRotationStrategy } from "../types";
+
+export const POOL_KEY_CODEX = "codex";
+export const POOL_KEY_ANTHROPIC = "anthropic";
+
+interface SelectionState {
+  activeKey?: string;
+  successes: number;
+  currentWeights: Map<string, number>;
+}
+
+const selectionState = new Map<string, SelectionState>();
+
+const DEFAULT_STICKY_LIMIT = 1;
+const MIN_STICKY_LIMIT = 1;
+const MAX_STICKY_LIMIT = 100;
+const DEFAULT_STRATEGY: OcxAccountPoolRotationStrategy = "quota";
+const VALID_STRATEGIES = new Set<OcxAccountPoolRotationStrategy>(["quota", "round-robin", "fill-first"]);
+
+/** Strict parse for management APIs — returns null instead of defaulting. */
+export function parseAccountPoolStrategy(raw: unknown): OcxAccountPoolRotationStrategy | null {
+  if (typeof raw === "string" && VALID_STRATEGIES.has(raw as OcxAccountPoolRotationStrategy)) {
+    return raw as OcxAccountPoolRotationStrategy;
+  }
+  return null;
+}
+
+/** Strict parse for management APIs — returns null instead of defaulting. */
+export function parseAccountPoolStickyLimit(raw: unknown): number | null {
+  if (typeof raw === "number" && Number.isInteger(raw) && raw >= MIN_STICKY_LIMIT && raw <= MAX_STICKY_LIMIT) {
+    return raw;
+  }
+  return null;
+}
+
+export function normalizeAccountPoolStrategy(raw: unknown): OcxAccountPoolRotationStrategy {
+  return parseAccountPoolStrategy(raw) ?? DEFAULT_STRATEGY;
+}
+
+export function normalizeAccountPoolStickyLimit(raw: unknown): number {
+  return parseAccountPoolStickyLimit(raw) ?? DEFAULT_STICKY_LIMIT;
+}
+
+function getOrCreateState(poolKey: string): SelectionState {
+  let state = selectionState.get(poolKey);
+  if (!state) {
+    state = { successes: 0, currentWeights: new Map() };
+    selectionState.set(poolKey, state);
+  }
+  return state;
+}
+
+function cloneSelectionState(state: SelectionState): SelectionState {
+  return {
+    activeKey: state.activeKey,
+    successes: state.successes,
+    currentWeights: new Map(state.currentWeights),
+  };
+}
+
+function smoothWeightedIndex(ids: string[], state: SelectionState): number {
+  let best = -1;
+  let bestScore = Number.NEGATIVE_INFINITY;
+  let total = 0;
+  const weight = 1;
+  for (let i = 0; i < ids.length; i++) {
+    const id = ids[i]!;
+    const score = (state.currentWeights.get(id) ?? 0) + weight;
+    state.currentWeights.set(id, score);
+    total += weight;
+    if (score > bestScore) {
+      best = i;
+      bestScore = score;
+    }
+  }
+  if (best >= 0) {
+    const key = ids[best]!;
+    state.currentWeights.set(key, (state.currentWeights.get(key) ?? 0) - total);
+  }
+  return best;
+}
+
+/**
+ * Shared pick core. Mutates `state` the same way live resolve does; callers pass
+ * either the live map entry or a scratch/clone for dry-run peek.
+ */
+function pickRoundRobinFromState(
+  eligibleIds: string[],
+  stickyLimit: number,
+  state: SelectionState,
+  commitSticky: boolean,
+): string | null {
+  if (eligibleIds.length === 0) return null;
+
+  const limit = normalizeAccountPoolStickyLimit(stickyLimit);
+
+  if (state.activeKey && eligibleIds.includes(state.activeKey)) {
+    return state.activeKey;
+  }
+
+  if (state.activeKey) {
+    delete state.activeKey;
+    state.successes = 0;
+  }
+
+  const index = smoothWeightedIndex(eligibleIds, state);
+  if (index < 0) return null;
+
+  const picked = eligibleIds[index]!;
+  if (commitSticky && limit > 1) {
+    state.activeKey = picked;
+    state.successes = 0;
+  }
+  return picked;
+}
+
+export function pickRoundRobinAccount(
+  poolKey: string,
+  eligibleIds: string[],
+  stickyLimit: number,
+): string | null {
+  return pickRoundRobinFromState(eligibleIds, stickyLimit, getOrCreateState(poolKey), true);
+}
+
+/**
+ * Dry-run of {@link pickRoundRobinAccount}: returns the same account resolve would
+ * pick without advancing ring weights, activeKey, or successes.
+ */
+export function peekRoundRobinAccount(
+  poolKey: string,
+  eligibleIds: string[],
+  stickyLimit: number,
+): string | null {
+  const live = selectionState.get(poolKey);
+  const scratch = live
+    ? cloneSelectionState(live)
+    : { successes: 0, currentWeights: new Map<string, number>() };
+  return pickRoundRobinFromState(eligibleIds, stickyLimit, scratch, false);
+}
+
+export function notePoolRotationSuccess(
+  poolKey: string,
+  accountId: string,
+  stickyLimit: number,
+): void {
+  const limit = normalizeAccountPoolStickyLimit(stickyLimit);
+  const state = selectionState.get(poolKey);
+  if (!state) return;
+  if (state.activeKey !== accountId) {
+    state.activeKey = accountId;
+    state.successes = 0;
+  }
+  state.successes += 1;
+  if (state.successes >= limit) {
+    delete state.activeKey;
+    state.successes = 0;
+  }
+}
+
+export function notePoolRotationFailure(poolKey: string, accountId: string): void {
+  const state = selectionState.get(poolKey);
+  if (state?.activeKey === accountId) {
+    delete state.activeKey;
+    state.successes = 0;
+  }
+}
+
+/**
+ * Force the next sticky/RR pick onto `accountId` (manual dashboard selection).
+ * Clears sticky success counters and ring weights so the seeded account is held
+ * for the next new-session pick before ordinary rotation resumes.
+ */
+export function seedPoolRotationAccount(poolKey: string, accountId: string): void {
+  const state = getOrCreateState(poolKey);
+  state.activeKey = accountId;
+  state.successes = 0;
+  state.currentWeights.clear();
+}
+
+export function clearPoolRotationState(poolKey?: string): void {
+  if (poolKey === undefined) {
+    selectionState.clear();
+    return;
+  }
+  selectionState.delete(poolKey);
+}

package/src/codex/quota.ts

@@ -33,6 +33,21 @@ const MONTHLY_WINDOW_MIN_MINUTES = MONTHLY_WINDOW_MIN_SECONDS / 60;
 const accountQuota = new Map<string, StoredAccountQuota>();
 
 export const CODEX_UNKNOWN_USAGE_SCORE = 100;
+export const CODEX_EXHAUSTED_USAGE_PERCENT = 100;
+
+export function isCodexQuotaExhausted(
+  quota: Pick<StoredAccountQuota, "weeklyPercent" | "monthlyPercent"> | null,
+  plan?: string | null,
+): boolean {
+  if (!quota) return false;
+  const normalizedPlan = plan?.trim().toLowerCase();
+  const values = normalizedPlan === "go" || normalizedPlan === "free"
+    ? [quota.monthlyPercent]
+    : [quota.weeklyPercent, quota.monthlyPercent];
+  return values.some(value => typeof value === "number"
+    && Number.isFinite(value)
+    && value >= CODEX_EXHAUSTED_USAGE_PERCENT);
+}
 
 export function normalizeUsagePercent(value: unknown): number | undefined {
   const numeric = typeof value === "number"