@bitkyc08/opencodex 2.7.43-preview.20260728 → 2.8.0

package/src/lib/bun-runtime.ts

@@ -11,15 +11,13 @@
  * back to `process.execPath` (which is itself Bun when run via `bun src/cli/index.ts`).
  */
 import { createRequire } from "node:module";
-import { existsSync, statSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { dirname, join, resolve } from "node:path";
+import { isRealBunBinary } from "./bun-binary-validator.mjs";
+
+export { isRealBunBinary };
 
 const require = createRequire(import.meta.url);
 
-// The `bun` package leaves a tiny ASCII placeholder at bin/bun.exe until its
-// postinstall downloads the real ~60MB binary; reject the stub by size so we
-// never bake a non-executable path into durable artifacts.
-const REAL_BUN_MIN_BYTES = 1_000_000;
 const BUN_OVERRIDE_ENV = "OPENCODEX_BUN_PATH";
 
 export type DurableBunRuntime = {
@@ -28,19 +26,6 @@ export type DurableBunRuntime = {
   overrideEnv: typeof BUN_OVERRIDE_ENV;
 };
 
-/**
- * True only for a real, downloaded Bun binary — not the ~450-byte ASCII
- * placeholder stub left by `--ignore-scripts` / pnpm. A size gate cleanly
- * separates the two on every platform (real binary is tens of MB).
- */
-export function isRealBunBinary(path: string): boolean {
-  try {
-    return existsSync(path) && statSync(path).size >= REAL_BUN_MIN_BYTES;
-  } catch {
-    return false;
-  }
-}
-
 /**
  * Absolute path to the bundled Bun binary, or null if the `bun` dependency is
  * not installed/resolvable (or only the un-downloaded placeholder is present).
@@ -63,7 +48,8 @@ export function bundledBunPath(): string | null {
 export function overrideBunPath(): string | null {
   const value = process.env[BUN_OVERRIDE_ENV]?.trim();
   if (!value) return null;
-  return isRealBunBinary(value) ? value : null;
+  const resolved = resolve(value);
+  return isRealBunBinary(resolved) ? resolved : null;
 }
 
 export function durableBunRuntime(): DurableBunRuntime {

package/src/lib/config-ownership.ts

@@ -0,0 +1,327 @@
+import {
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  readFileSync,
+  readdirSync,
+  realpathSync,
+  renameSync,
+  rmdirSync,
+  unlinkSync,
+  writeFileSync,
+} from "node:fs";
+import { randomUUID } from "node:crypto";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
+
+export const CONFIG_OWNER_FILE = ".opencodex-owner.json";
+export const CONFIG_UNINSTALL_MANIFEST = ".opencodex-uninstall.json";
+
+export type ConfigRemovalResult = {
+  status: "absent" | "removed" | "partial" | "refused";
+  reason?: string;
+  residualPaths: string[];
+};
+
+type ConfigOwner = {
+  version: 1;
+  ownerId: string;
+  root: string;
+};
+
+type ConfigUninstallManifest = ConfigOwner & {
+  paths: string[];
+};
+
+const METADATA_MAX_BYTES = 64 * 1024;
+const MANIFEST_MAX_PATHS = 1024;
+const INITIAL_OWNED_PATHS = [
+  ".star-prompted",
+  "artifacts",
+  "auth.json",
+  "auth.store.lock",
+  "catalog-backup.json",
+  "claude-env.sh",
+  "codex-accounts.json",
+  "codex-runtime-clamp.json",
+  "codex-runtime.json",
+  "codex-shim.autorestore.lock",
+  "codex-shim.json",
+  "config.json",
+  "crash.log",
+  "kimi-device-id",
+  "mimo-client-id",
+  "ocx.pid",
+  "opencodex-service-launcher.vbs",
+  "opencodex-service-task.xml",
+  "opencodex-service.cmd",
+  "opencodex-tray-offline.ico",
+  "opencodex-tray-online.ico",
+  "opencodex-tray-warning.ico",
+  "opencodex-tray.ps1",
+  "responses-state.json",
+  "runtime-port.json",
+  "service-api-token",
+  "service-state.json",
+  "service.log",
+  "system-env-port",
+  "tray-heartbeat.json",
+  "tray-state.json",
+  "update-job.json",
+  "usage-debug.jsonl",
+  "usage.jsonl",
+  "version.json",
+  "winsw",
+] as const;
+const ownershipCache = new Map<string, {
+  owner: ConfigOwner;
+  manifest: ConfigUninstallManifest;
+} | null>();
+
+function ownershipCacheKey(configDir: string): string {
+  const key = resolve(configDir);
+  return process.platform === "win32" ? key.toLowerCase() : key;
+}
+
+function samePath(left: string, right: string): boolean {
+  return process.platform === "win32"
+    ? left.toLowerCase() === right.toLowerCase()
+    : left === right;
+}
+
+function readBoundedJson(path: string): unknown {
+  const metadata = lstatSync(path);
+  if (!metadata.isFile() || metadata.isSymbolicLink()) {
+    throw new Error("ownership metadata is not a regular file");
+  }
+  if (metadata.size > METADATA_MAX_BYTES) throw new Error("ownership metadata is too large");
+  return JSON.parse(readFileSync(path, "utf8")) as unknown;
+}
+
+function isOwner(value: unknown): value is ConfigOwner {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const owner = value as Record<string, unknown>;
+  return owner.version === 1
+    && typeof owner.ownerId === "string"
+    && /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(owner.ownerId)
+    && typeof owner.root === "string";
+}
+
+function isManifest(value: unknown): value is ConfigUninstallManifest {
+  if (!isOwner(value)) return false;
+  const paths = (value as Record<string, unknown>).paths;
+  return Array.isArray(paths)
+    && paths.length <= MANIFEST_MAX_PATHS
+    && paths.every(path => typeof path === "string");
+}
+
+function canonicalRoot(configDir: string): string {
+  return realpathSync.native(resolve(configDir));
+}
+
+function isWithinRoot(root: string, candidate: string): boolean {
+  const rel = relative(root, candidate);
+  return rel === "" || (
+    rel !== ".."
+    && !rel.startsWith(`..${sep}`)
+    && !isAbsolute(rel)
+  );
+}
+
+function manifestRelativePath(configDir: string, candidatePath: string): string | null {
+  const root = resolve(configDir);
+  const candidate = resolve(candidatePath);
+  const rel = relative(root, candidate);
+  if (
+    !rel
+    || rel === ".."
+    || rel.startsWith(`..${sep}`)
+    || isAbsolute(rel)
+  ) return null;
+  const normalized = rel.split(sep).join("/");
+  if (normalized.split("/").some(part => !part || part === "." || part === ".." || part.includes("\\"))) {
+    return null;
+  }
+  if (normalized === CONFIG_OWNER_FILE || normalized === CONFIG_UNINSTALL_MANIFEST) return null;
+  return normalized;
+}
+
+function loadOwnership(configDir: string): { owner: ConfigOwner; manifest: ConfigUninstallManifest } | null {
+  const ownerPath = join(configDir, CONFIG_OWNER_FILE);
+  const manifestPath = join(configDir, CONFIG_UNINSTALL_MANIFEST);
+  if (!existsSync(ownerPath) || !existsSync(manifestPath)) return null;
+  try {
+    const owner = readBoundedJson(ownerPath);
+    const manifest = readBoundedJson(manifestPath);
+    const root = canonicalRoot(configDir);
+    if (
+      !isOwner(owner)
+      || !isManifest(manifest)
+      || owner.ownerId !== manifest.ownerId
+      || !samePath(owner.root, root)
+      || !samePath(manifest.root, root)
+    ) return null;
+    return { owner, manifest };
+  } catch {
+    return null;
+  }
+}
+
+function createOwnership(configDir: string): { owner: ConfigOwner; manifest: ConfigUninstallManifest } | null {
+  const rootStat = lstatSync(configDir);
+  if (!rootStat.isDirectory() || rootStat.isSymbolicLink() || readdirSync(configDir).length !== 0) return null;
+  const owner: ConfigOwner = {
+    version: 1,
+    ownerId: randomUUID(),
+    root: canonicalRoot(configDir),
+  };
+  const manifest: ConfigUninstallManifest = { ...owner, paths: [...INITIAL_OWNED_PATHS] };
+  writeFileSync(join(configDir, CONFIG_OWNER_FILE), `${JSON.stringify(owner, null, 2)}\n`, {
+    encoding: "utf8",
+    flag: "wx",
+    mode: 0o600,
+  });
+  try {
+    writeFileSync(join(configDir, CONFIG_UNINSTALL_MANIFEST), `${JSON.stringify(manifest, null, 2)}\n`, {
+      encoding: "utf8",
+      flag: "wx",
+      mode: 0o600,
+    });
+  } catch (error) {
+    try { unlinkSync(join(configDir, CONFIG_OWNER_FILE)); } catch { /* incomplete metadata fails closed */ }
+    throw error;
+  }
+  return { owner, manifest };
+}
+
+function writeManifest(configDir: string, manifest: ConfigUninstallManifest): void {
+  const path = join(configDir, CONFIG_UNINSTALL_MANIFEST);
+  const temp = `${path}.${process.pid}.${randomUUID()}.tmp`;
+  writeFileSync(temp, `${JSON.stringify(manifest, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+  try {
+    renameSync(temp, path);
+  } catch (error) {
+    try { unlinkSync(temp); } catch { /* best effort */ }
+    throw error;
+  }
+}
+
+function removeOwnedEntry(root: string, path: string): void {
+  const entry = lstatSync(path);
+  if (entry.isSymbolicLink()) {
+    unlinkSync(path);
+    return;
+  }
+  if (!entry.isDirectory()) {
+    unlinkSync(path);
+    return;
+  }
+
+  const realDirectory = realpathSync.native(path);
+  if (!isWithinRoot(root, realDirectory)) {
+    throw new Error(`owned directory resolves outside the config root: ${path}`);
+  }
+  for (const name of readdirSync(path)) {
+    removeOwnedEntry(root, join(path, name));
+  }
+  rmdirSync(path);
+}
+
+export function recordOwnedConfigPath(configDir: string, candidatePath: string): boolean {
+  const rel = manifestRelativePath(configDir, candidatePath);
+  if (!rel) return false;
+  const cacheKey = ownershipCacheKey(configDir);
+  if (!existsSync(configDir)) {
+    ownershipCache.delete(cacheKey);
+    mkdirSync(configDir, { recursive: true, mode: 0o700 });
+  }
+  let ownership = ownershipCache.get(cacheKey);
+  if (ownership === undefined) {
+    ownership = loadOwnership(configDir) ?? createOwnership(configDir);
+    ownershipCache.set(cacheKey, ownership);
+  }
+  if (!ownership) return false;
+  if (ownership.manifest.paths.includes(rel)) return true;
+  const manifest = {
+    ...ownership.manifest,
+    paths: [...ownership.manifest.paths, rel].sort(),
+  };
+  writeManifest(configDir, manifest);
+  ownershipCache.set(cacheKey, { owner: ownership.owner, manifest });
+  return true;
+}
+
+export function removeOwnedConfigState(configDir: string): ConfigRemovalResult {
+  ownershipCache.delete(ownershipCacheKey(configDir));
+  if (!existsSync(configDir)) return { status: "absent", residualPaths: [] };
+  const root = lstatSync(configDir);
+  if (!root.isDirectory() || root.isSymbolicLink()) {
+    return {
+      status: "refused",
+      reason: "config ownership root is not a real directory",
+      residualPaths: [configDir],
+    };
+  }
+  const ownership = loadOwnership(configDir);
+  if (!ownership) {
+    return {
+      status: "refused",
+      reason: "config ownership metadata is missing or invalid",
+      residualPaths: [configDir],
+    };
+  }
+
+  for (const rel of ownership.manifest.paths) {
+    const path = manifestRelativePath(configDir, join(configDir, ...rel.split("/")));
+    if (path !== rel) {
+      return {
+        status: "refused",
+        reason: "config ownership manifest contains an unsafe path",
+        residualPaths: [configDir],
+      };
+    }
+  }
+
+  const rootPath = canonicalRoot(configDir);
+  for (const rel of ownership.manifest.paths) {
+    const path = join(configDir, ...rel.split("/"));
+    if (!existsSync(path)) continue;
+    try {
+      removeOwnedEntry(rootPath, path);
+    } catch (error) {
+      return {
+        status: "partial",
+        reason: `could not remove owned path ${rel}: ${error instanceof Error ? error.message : String(error)}`,
+        residualPaths: [path],
+      };
+    }
+  }
+
+  try {
+    unlinkSync(join(configDir, CONFIG_UNINSTALL_MANIFEST));
+    unlinkSync(join(configDir, CONFIG_OWNER_FILE));
+  } catch (error) {
+    return {
+      status: "partial",
+      reason: `could not remove ownership metadata: ${error instanceof Error ? error.message : String(error)}`,
+      residualPaths: readdirSync(configDir).map(name => join(configDir, name)),
+    };
+  }
+  const residualPaths = readdirSync(configDir).map(name => join(configDir, name));
+  if (residualPaths.length > 0) {
+    return {
+      status: "partial",
+      reason: "unowned files remain in the config directory",
+      residualPaths,
+    };
+  }
+  try {
+    rmdirSync(configDir);
+  } catch (error) {
+    return {
+      status: "partial",
+      reason: `could not remove the empty config directory: ${error instanceof Error ? error.message : String(error)}`,
+      residualPaths: [configDir],
+    };
+  }
+  return { status: "removed", residualPaths: [] };
+}

package/src/lib/crash-guard.ts

@@ -1,6 +1,7 @@
 import { appendFileSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { getConfigDir } from "../config";
+import { recordOwnedConfigPath } from "./config-ownership";
 import { redactSecretString, redactUrlForLog } from "./redact";
 import { sidecarBreadcrumb, activityBreadcrumb } from "./sidecar-tracker";
 
@@ -27,6 +28,7 @@ let installed = false;
 function crashLogPath(): string {
   const dir = getConfigDir();
   try {
+    recordOwnedConfigPath(dir, join(dir, "crash.log"));
     mkdirSync(dir, { recursive: true });
   } catch {
     /* best-effort: directory usually already exists */

package/src/lib/destination-policy.ts

@@ -19,7 +19,7 @@ const BLOCKED_METADATA_IPV6 = new Set([
   "fd00:ec2::254",
 ]);
 
-type DestinationKind =
+export type DestinationKind =
   | "public"
   | "hostname"
   | "localhost"
@@ -79,13 +79,33 @@ function classifyIpv6(hostname: string): DestinationAssessment {
   if (BLOCKED_METADATA_IPV6.has(hostname)) return { kind: "metadata", detail: "blocked metadata endpoint" };
   const mappedIpv4 = hostname.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/i)?.[1];
   if (mappedIpv4) return classifyIpv4(mappedIpv4);
+  // Decode hex IPv4-mapped IPv6: ::ffff:7f00:1 → 127.0.0.1
+  // The dotted-decimal regex above only matches ::ffff:127.0.0.1; without this,
+  // hex form bypasses all private/loopback checks (hextet is 0 → classified "public").
+  const hexMapped = hostname.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i);
+  if (hexMapped) {
+    const hi = Number.parseInt(hexMapped[1], 16);
+    const lo = Number.parseInt(hexMapped[2], 16);
+    const ipv4 = `${(hi >> 8) & 255}.${hi & 255}.${(lo >> 8) & 255}.${lo & 255}`;
+    return classifyIpv4(ipv4);
+  }
   if (hostname === "::1") return { kind: "loopback", detail: "loopback address" };
   if (hostname === "::") return { kind: "unspecified", detail: "unspecified address" };
   const hextet = firstIpv6Hextet(hostname);
-  if (hextet === null) return { kind: "public", detail: "public IP" };
-  if (hextet >= 0xfc00 && hextet <= 0xfdff) return { kind: "private", detail: "private-network address" };
+  if (hextet === null) return { kind: "private", detail: "non-global address" };
+  // Multicast ff00::/8, deprecated site-local fec0::/10, ULA fc00::/7, link-local fe80::/10.
+  if (hextet >= 0xff00) return { kind: "private", detail: "multicast address" };
   if (hextet >= 0xfe80 && hextet <= 0xfebf) return { kind: "link-local", detail: "link-local address" };
-  return { kind: "public", detail: "public IP" };
+  if (hextet >= 0xfec0 && hextet <= 0xfeff) return { kind: "private", detail: "site-local address" };
+  if (hextet >= 0xfc00 && hextet <= 0xfdff) return { kind: "private", detail: "private-network address" };
+  // Documentation 2001:db8::/32 (inside global-unicast 2000::/3).
+  if (hextet === 0x2001) {
+    const second = Number.parseInt(hostname.split(":")[1] || "0", 16);
+    if (second === 0xdb8) return { kind: "private", detail: "documentation address" };
+  }
+  // Only global unicast 2000::/3 is treated as a public image/CDN peer.
+  if (hextet >= 0x2000 && hextet <= 0x3fff) return { kind: "public", detail: "public IP" };
+  return { kind: "private", detail: "non-global address" };
 }
 
 function assessDestination(baseUrl: string): DestinationAssessment | null {
@@ -110,13 +130,20 @@ function registryAllowsPrivateNetwork(name: string): boolean {
   return getProviderRegistryEntry(name)?.allowPrivateNetworkByDefault === true;
 }
 
+/** True when the provider config or registry default admits private/loopback destinations. */
+export function providerAllowsPrivateNetwork(
+  name: string,
+  provider: Pick<OcxProviderConfig, "allowPrivateNetwork">,
+): boolean {
+  return provider.allowPrivateNetwork === true || registryAllowsPrivateNetwork(name);
+}
+
 export function providerDestinationConfigError(name: string, provider: Pick<OcxProviderConfig, "baseUrl" | "allowPrivateNetwork">): string | null {
   const assessment = assessDestination(provider.baseUrl);
   if (!assessment) return null;
   if (assessment.kind === "public" || assessment.kind === "hostname") return null;
   if (assessment.kind === "metadata") return "baseUrl targets a blocked metadata endpoint";
-  if (registryAllowsPrivateNetwork(name)) return null;
-  if (provider.allowPrivateNetwork === true) return null;
+  if (providerAllowsPrivateNetwork(name, provider)) return null;
   return `baseUrl points to a ${assessment.detail}; set allowPrivateNetwork:true only for intentionally local/self-hosted providers`;
 }
 
@@ -154,7 +181,7 @@ export async function providerDestinationResolvedError(
   if (!hostname || isIP(hostname) !== 0 || hostname === "localhost" || hostname.endsWith(".localhost")) {
     return null; // literals and localhost are fully handled by the sync path
   }
-  if (registryAllowsPrivateNetwork(name) || provider.allowPrivateNetwork === true) return null;
+  if (providerAllowsPrivateNetwork(name, provider)) return null;
   let addresses: { address: string }[];
   try {
     addresses = await lookup(hostname, { all: true, verbatim: true });
@@ -178,3 +205,101 @@ export async function providerDestinationResolvedError(
   }
   return null;
 }
+
+export interface UrlDestinationAssessment {
+  kind: DestinationKind;
+  detail: string;
+}
+
+export class DestinationDnsResolutionError extends Error {
+  override readonly name = "DestinationDnsResolutionError";
+}
+
+/**
+ * Synchronous literal URL destination assessment — classifies the hostname
+ * without DNS resolution. Returns null for unparseable URLs.
+ */
+export function assessUrlDestination(url: string): UrlDestinationAssessment | null {
+  return assessDestination(url);
+}
+
+/**
+ * Async DNS-resolved URL safety check. By default, rejects every non-public
+ * address. Provider diagnostics may explicitly admit loopback/private answers;
+ * metadata, link-local, and unspecified addresses remain unconditionally denied.
+ * Returns the validated addresses so direct callers can pin the connect peer and
+ * avoid a second, rebindable resolution. DNS failures remain fail-closed here;
+ * the provider proxy wrapper alone may recognize that typed failure and degrade.
+ */
+export async function resolvePublicAddresses(
+  url: string,
+  options?: string | { context?: string; allowPrivateNetwork?: boolean },
+): Promise<{
+  hostname: string;
+  addresses: { address: string; family: number }[];
+  privateNetwork: boolean;
+}> {
+  const context = typeof options === "string"
+    ? `${options.trim() || "image"} URL`
+    : options?.context?.trim() || "image URL";
+  const privateNetworkAllowed = typeof options === "object" && options?.allowPrivateNetwork === true;
+  let hostname: string;
+  try {
+    hostname = normalizeHostname(new URL(url.trim()).hostname);
+  } catch {
+    throw new Error(`${context} is not a valid URL`);
+  }
+  if (!hostname) throw new Error(`${context} has no hostname`);
+  const literalAssessment = assessDestination(url);
+  let privateNetwork = false;
+  if (literalAssessment && literalAssessment.kind !== "public" && literalAssessment.kind !== "hostname") {
+    const allowedPrivateLiteral = privateNetworkAllowed
+      && (literalAssessment.kind === "localhost"
+        || literalAssessment.kind === "loopback"
+        || literalAssessment.kind === "private");
+    if (!allowedPrivateLiteral) throw new Error(`${context} targets ${literalAssessment.detail}`);
+    privateNetwork = true;
+  }
+  // Literal public IPs: no DNS round-trip; pin the literal itself.
+  const literalKind = isIP(hostname);
+  if (literalKind !== 0) {
+    return { hostname, addresses: [{ address: hostname, family: literalKind }], privateNetwork };
+  }
+  let addresses: { address: string; family: number }[];
+  try {
+    addresses = await lookup(hostname, { all: true, verbatim: true });
+  } catch {
+    // If DNS fails, we can't verify — fail-closed (unlike provider config-time validation,
+    // this is a runtime fetch to an untrusted URL, so be conservative).
+    throw new DestinationDnsResolutionError(`${context} hostname ${hostname} could not be resolved`);
+  }
+  if (addresses.length === 0) {
+    throw new DestinationDnsResolutionError(`${context} hostname ${hostname} could not be resolved`);
+  }
+  const validatedAddresses: { address: string; family: number }[] = [];
+  for (const { address, family } of addresses) {
+    // Prefer classifying from the address string itself — do not trust a mislabeled
+    // resolver `family` that could skip IPv4/IPv6 private checks.
+    const ipKind = isIP(address) || (family === 4 || family === 6 ? family : 0);
+    const assessment = ipKind === 4 ? classifyIpv4(address) : ipKind === 6 ? classifyIpv6(normalizeHostname(address)) : null;
+    if (!assessment || assessment.kind !== "public") {
+      const allowedPrivateAddress = privateNetworkAllowed
+        && assessment
+        && (assessment.kind === "loopback" || assessment.kind === "private");
+      if (!allowedPrivateAddress) {
+        throw new Error(`${context} hostname ${hostname} resolves to ${assessment?.detail ?? "an unsafe address"} (${address})`);
+      }
+      privateNetwork = true;
+    }
+    validatedAddresses.push({ address, family: ipKind === 4 || ipKind === 6 ? ipKind : (family || 4) });
+  }
+  return { hostname, addresses: validatedAddresses, privateNetwork };
+}
+
+/**
+ * Void assertion wrapper around {@link resolvePublicAddresses} for call sites
+ * that only need the safety check.
+ */
+export async function assertUrlResolvesPublic(url: string): Promise<void> {
+  await resolvePublicAddresses(url);
+}