@bitkyc08/opencodex 2.7.43-preview.20260728 → 2.8.0

package/README.md

@@ -240,11 +240,15 @@ next Codex session. opencodex keeps these behaviors:
 
 - **Existing sessions keep affinity.** A thread id is bound to the selected account and reused on
   later turns, so a long request or a mobile/SSH-attached session keeps using the same account.
+  Pausing an account clears its affinity map: in-flight requests keep captured credentials, but
+  subsequent turns are re-routed and cannot reuse the paused account.
 - **New sessions can auto-route.** When auto-switch is enabled, opencodex compares the hottest known
   quota window across 5h, weekly, and 30d usage, then picks a lower-usage eligible account for new
   sessions once the active account crosses the threshold.
 - **Quota lookup is built in.** The dashboard can refresh all account quotas in one click, and the
-  request log labels pool traffic with non-PII account ordinals.
+  request log labels pool traffic with non-PII account ordinals. **Pause exhausted** refreshes
+  eligible accounts that have credentials and pauses only those whose relevant quota window is
+  freshly confirmed at 100%; accounts without credentials and unknown or failed refreshes stay unchanged.
 - **Failures fail closed.** Token failures mark reauthentication instead of falling back to another
   credential silently; 429 quota responses put the account in cooldown and can fail over future work
   to another eligible pool account.
@@ -505,6 +509,9 @@ The public docs — install, providers, routing, sidecars, Codex integration, Co
 Maintainer source-of-truth notes live under [`structure/`](./structure). Historical investigations remain under [`docs/`](./docs).
 Contributor setup lives in [`CONTRIBUTING.md`](./CONTRIBUTING.md), and security reporting guidance
 lives in [`SECURITY.md`](./SECURITY.md).
+Report undisclosed vulnerabilities privately through
+[GitHub private vulnerability reporting](https://github.com/lidge-jun/opencodex/security/advisories/new),
+not a public issue.
 
 ## Development
 

package/bin/ocx.mjs

@@ -10,10 +10,12 @@
  */
 import { spawn, spawnSync } from "node:child_process";
 import { createRequire } from "node:module";
-import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { isRealBunBinary } from "../src/lib/bun-binary-validator.mjs";
+import { npmInvocation } from "../src/update/npm-invocation.mjs";
 import { handoffWindowsTrayForUpdate, planWindowsTrayUpdate } from "../src/update/tray-update-plan.mjs";
 
 const PKG = "@bitkyc08/opencodex";
@@ -29,10 +31,6 @@ function isBunGlobalInstall() {
   return /[\\/]\.bun[\\/]/.test(here);
 }
 
-function npmBin() {
-  return process.platform === "win32" ? "npm.cmd" : "npm";
-}
-
 function currentPackageVersion() {
   try {
     return JSON.parse(readFileSync(join(here, "..", "package.json"), "utf8")).version ?? "?";
@@ -115,15 +113,17 @@ function runTrayLifecycle(launcher, action) {
 function runNpmSelfUpdate() {
   const current = currentPackageVersion();
   const tag = updateTag(current);
-  const npm = npmBin();
-  // Node ≥18.20/20.12 refuses to spawn .cmd/.bat without a shell (CVE-2024-27980
-  // hardening) — spawning "npm.cmd" shell-less throws EINVAL on Windows.
-  const winShell = process.platform === "win32";
-  const latestResult = spawnSync(npm, ["view", `${PKG}@${tag}`, "version"], {
+  const latestInvocation = npmInvocation(["view", `${PKG}@${tag}`, "version"]);
+  const installInvocation = npmInvocation(["install", "-g", `${PKG}@${tag}`]);
+  if (!latestInvocation || !installInvocation) {
+    console.error("opencodex: could not resolve npm from a trusted absolute PATH entry; aborting before stopping the proxy.");
+    process.exit(1);
+  }
+  const latestResult = spawnSync(latestInvocation.file, latestInvocation.args, {
     encoding: "utf8",
     timeout: 12000,
     windowsHide: true,
-    shell: winShell,
+    ...latestInvocation.options,
   });
   const latest = latestResult.status === 0 ? latestResult.stdout.trim() : "";
 
@@ -221,12 +221,12 @@ function runNpmSelfUpdate() {
     }
   }
 
-  console.log(`Updating${latest ? ` to v${latest}` : ""}...\n$ ${npm} install -g ${PKG}@${tag}`);
-  const res = spawnSync(npm, ["install", "-g", `${PKG}@${tag}`], {
+  console.log(`Updating${latest ? ` to v${latest}` : ""}...\n$ npm install -g ${PKG}@${tag}`);
+  const res = spawnSync(installInvocation.file, installInvocation.args, {
     stdio: "inherit",
     timeout: 180000,
     windowsHide: true,
-    shell: winShell,
+    ...installInvocation.options,
   });
   if (res.status === 0) {
     console.log(`\nUpdated${latest ? ` to v${latest}` : ""}.`);
@@ -278,7 +278,7 @@ function runNpmSelfUpdate() {
     process.exit(0);
   }
   if (trayBeforeUpdate.restoreOnFailure) runTrayLifecycle(launcher, "start");
-  console.error(`\nUpdate failed (${npm} exit ${res.status ?? "?"}). Try manually:  ${npm} install -g ${PKG}@${tag}`);
+  console.error(`\nUpdate failed (npm exit ${res.status ?? "?"}). Try manually:  npm install -g ${PKG}@${tag}`);
   process.exit(1);
 }
 
@@ -288,18 +288,14 @@ function bunBinDir() {
   return dirname(require.resolve("bun/package.json"));
 }
 
-// The `bun` package ships a tiny ASCII placeholder at bin/bun.exe until its
-// postinstall downloads the real ~60MB binary. --ignore-scripts / pnpm leave
-// the ~450-byte stub in place, which is NOT executable (ENOEXEC). A size gate
-// cleanly distinguishes the stub from a real binary on every platform.
-const REAL_BUN_MIN_BYTES = 1_000_000;
+const BUN_OVERRIDE_ENV = "OPENCODEX_BUN_PATH";
 
 function findBunBinary(bunDir) {
   // The npm `bun` package ships the binary as bin/bun.exe on every platform;
   // probe bin/bun too for forward compatibility.
   for (const name of ["bun.exe", "bun"]) {
     const p = join(bunDir, "bin", name);
-    if (existsSync(p) && statSync(p).size >= REAL_BUN_MIN_BYTES) return p;
+    if (isRealBunBinary(p)) return p;
   }
   return null;
 }
@@ -318,6 +314,17 @@ function fail(msg) {
 }
 
 function resolveBun() {
+  // Keep direct npm-launcher starts aligned with durable service/shim installs:
+  // a valid explicit runtime must win even when the bundled dependency exists.
+  const override = process.env[BUN_OVERRIDE_ENV]?.trim();
+  if (override) {
+    const overridePath = resolve(override);
+    if (isRealBunBinary(overridePath)) return overridePath;
+    console.error(
+      `opencodex: ${BUN_OVERRIDE_ENV} is missing, unreadable, or not a complete Bun binary; falling back to the bundled runtime.`,
+    );
+  }
+
   let bunDir;
   try {
     bunDir = bunBinDir();
@@ -362,7 +369,25 @@ const bun = resolveBun();
 // signal delivered only to this launcher (Codex app, IDE terminal, service wrapper,
 // or `kill -INT <launcherPid>`) killed the launcher and ORPHANED the Bun proxy —
 // port left bound, pid/runtime-port files left behind, Codex config not restored.
-const child = spawn(bun, [cliPath, ...process.argv.slice(2)], { stdio: "inherit" });
+//
+// Provenance seam for issue #701: THIS launcher runs under Node, which does not
+// auto-load a project `.env`/`.env.local`; the Bun child does, before any opencodex
+// code evaluates. So this is the last point that can still tell a real shell export
+// from a working-directory dotenv value, and we record which Anthropic credential
+// slots already existed. `src/cli/claude.ts` then treats anything present in the Bun
+// child but missing from this list as ambient project pollution rather than user auth,
+// which stopped a project dotenv from silently moving a claude.ai subscriber onto API
+// billing. An EMPTY value is meaningful (the launcher ran and saw no slots) and is
+// distinct from the variable being absent (no launcher at all — change nothing), so
+// this must stay a plain assignment and never be collapsed to a falsy check.
+// Disabling Bun's dotenv wholesale with --no-env-file is NOT an option: config
+// interpolation and provider settings legitimately read the project environment.
+const preBunAnthropicSlots = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"]
+  .filter(name => typeof process.env[name] === "string" && process.env[name] !== "");
+const child = spawn(bun, [cliPath, ...process.argv.slice(2)], {
+  stdio: "inherit",
+  env: { ...process.env, OCX_PRE_BUN_ANTHROPIC_ENV: preBunAnthropicSlots.join(",") },
+});
 
 // Windows has no real POSIX signals (no SIGHUP); forwarding is best-effort there.
 const FORWARDED = process.platform === "win32" ? ["SIGINT", "SIGTERM"] : ["SIGINT", "SIGTERM", "SIGHUP"];