@bitkyc08/opencodex 2.7.43-preview.20260728 → 2.8.0

package/src/server/management/config-routes.ts

@@ -24,6 +24,7 @@ import {
 import { removeCredential } from "../../oauth/store";
 import { providerDestinationResolvedError } from "../../lib/destination-policy";
 import { isStreamMode } from "../../lib/bun-stream-caps";
+import { shadowSourceModels } from "../../lib/shadow-call";
 import { enrichProviderFromCatalog, listKeyLoginProviders } from "../../oauth/key-providers";
 import { deriveProviderPresets } from "../../providers/derive";
 import { providerCodexAccountMode } from "../../providers/registry";
@@ -140,16 +141,20 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
   }
 
   if (url.pathname === "/api/startup-action" && req.method === "POST") {
-    let body: { action?: unknown };
+    let body: { action?: unknown; repair?: unknown };
     try { body = await req.json(); } catch { return jsonResponse({ error: "invalid JSON body" }, 400); }
     if (!body || !["install-service", "install-shim"].includes(String(body.action))) {
       return jsonResponse({ error: "action must be install-service or install-shim" }, 400);
     }
+    if (body.repair !== undefined && typeof body.repair !== "boolean") {
+      return jsonResponse({ error: "repair must be a boolean when provided" }, 400);
+    }
     try {
       const action = body.action as StartupInstallAction;
-      const result = await (deps.runStartupInstallAction ?? runStartupInstallAction)(action);
+      const repair = body.repair === true;
+      const result = await (deps.runStartupInstallAction ?? runStartupInstallAction)(action, { repair });
       invalidateStartupHealthCache();
-      return jsonResponse({ ok: true, action, message: result.message });
+      return jsonResponse({ ok: true, action, repair, message: result.message });
     } catch (error) {
       return jsonResponse({ error: error instanceof Error ? error.message : String(error) }, 500);
     }
@@ -225,10 +230,11 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
 
   if (url.pathname === "/api/sync" && req.method === "POST") {
     const { syncModelsToCodex } = await import("../../codex/sync");
+    const { attachStaleAppServerHint } = await import("../../codex/app-server-processes");
     const result = await syncModelsToCodex(undefined, config, null);
     return jsonResponse({
-      ...result,
-      staleAppServerHint: "If Codex App still shows an older model list, restart its long-lived app-server process after sync.",
+      ...attachStaleAppServerHint(result),
+      ...(result.ok ? {} : { error: result.message }),
     }, result.ok ? 200 : 500);
   }
 
@@ -349,7 +355,11 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
 
   if (url.pathname === "/api/shadow-call-settings" && req.method === "GET") {
     const sci = config.shadowCallIntercept ?? {};
-    return jsonResponse({ enabled: sci.enabled === true, model: sci.model ?? "" });
+    return jsonResponse({
+      enabled: sci.enabled === true,
+      model: sci.model ?? "",
+      sourceModels: shadowSourceModels(sci.sourceModels),
+    });
   }
 
   if (url.pathname === "/api/shadow-call-settings" && req.method === "PUT") {
@@ -371,7 +381,12 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
     }
     saveConfigPreservingClaudeCode(config);
     const sci = config.shadowCallIntercept;
-    return jsonResponse({ ok: true, enabled: sci.enabled === true, model: sci.model ?? "" });
+    return jsonResponse({
+      ok: true,
+      enabled: sci.enabled === true,
+      model: sci.model ?? "",
+      sourceModels: shadowSourceModels(sci.sourceModels),
+    });
   }
   return null;
 }

package/src/server/management/context.ts

@@ -4,10 +4,20 @@ import type { StartupInstallAction } from "../startup-action-control";
 export interface ManagementApiDeps {
   toggleCodexMultiAgentV2?: (enabled: boolean) => void;
   refreshCodexCatalog?: () => Promise<void>;
+  /**
+   * Persistence seam for route-level tests. Production leaves this unset and uses
+   * `saveConfigPreservingClaudeCode`; tests that pass an in-memory fixture config
+   * MUST inject a no-op/spy so the fixture can never overwrite the user's real
+   * OPENCODEX_HOME (incident: devlog 260730.../070).
+   */
+  saveConfigPreservingClaudeCode?: (config: OcxConfig) => void;
   clearThreadAccountMap?: () => void;
   clearProviderQuotaCache?: () => void;
   primeCodexPoolQuotas?: (config: OcxConfig, reason: string) => Promise<void> | void;
-  runStartupInstallAction?: (action: StartupInstallAction) => Promise<{ message: string }>;
+  runStartupInstallAction?: (
+    action: StartupInstallAction,
+    options?: { repair?: boolean },
+  ) => Promise<{ message: string }>;
 }
 
 

package/src/server/management/logs-usage-routes.ts

@@ -34,7 +34,19 @@ import { primeCodexPoolQuotas } from "../../codex/auth-api";
 import { DEFAULT_PROVIDER_CONTEXT_CAP, globalContextCapValue, providerContextCap, providerContextCaps, setAllProviderContextCaps, setGlobalContextCapValue, setProviderContextCap } from "../../providers/context-cap";
 import { resolveCodexHomeDir } from "../../codex/home";
 import { scanStorage } from "../../storage/scanner";
-import { executeArchivedCleanup, pickWireCleanupTestHooks, previewArchivedCleanup, type CleanupMode } from "../../storage/cleanup";
+import { executeArchivedCleanup, listTrashEntries, pickWireCleanupTestHooks, previewArchivedCleanup, type CleanupMode, type RestoreErrorCode } from "../../storage/cleanup";
+import { runArchivedCleanupJob } from "../../storage/cleanup-job";
+import { getRestoreTrashTestStreamResponse, runRestoreTrashEntryJob } from "../../storage/restore-job";
+import {
+  normalizeStorageCleanupPolicy,
+  parseStorageCleanupPolicyInput,
+  writeStorageCleanupPolicyToConfig,
+} from "../../storage/policy";
+import {
+  getStorageCleanupPolicyJobState,
+  getStorageCleanupPolicyTestStreamResponse,
+  requestStorageCleanupPolicyRun,
+} from "../../storage/policy-job";
 import {
   currentUsageLogRevision,
   readUsageSnapshotForManagement,
@@ -278,7 +290,7 @@ export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Res
         ? pickWireCleanupTestHooks(body._test)
         : undefined;
     try {
-      const result = executeArchivedCleanup({
+      const result = await runArchivedCleanupJob({
         percent,
         mode: mode as CleanupMode,
         digest,
@@ -286,14 +298,20 @@ export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Res
       });
       if (!result.ok) {
         const status =
-          result.error === "codex_busy" || result.error === "stale_preview" || result.error === "referenced_history"
+          result.error === "codex_busy"
+            || result.error === "stale_preview"
+            || result.error === "referenced_history"
+            || result.error === "storage_mutation_busy"
+            || result.error === "restore_pending_overlap"
             ? 409
             : result.error === "invalid_mode" || result.error === "invalid_digest"
               ? 400
               : 500;
         const messages: Record<string, string> = {
           codex_busy: "Codex is using state.sqlite — try again after quitting Codex.",
+          storage_mutation_busy: "Another storage cleanup or restore is in progress — try again shortly.",
           stale_preview: "Archived files changed since preview — run Preview again.",
+          restore_pending_overlap: "Selected archives overlap an incomplete trash restore — finish or retry restore first.",
           referenced_history: "Selected archives are still referenced by forked or paginated history.",
           invalid_digest: "Preview digest is missing or invalid.",
           invalid_mode: "mode must be quarantine or permanent.",
@@ -326,5 +344,151 @@ export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Res
     }
   }
 
+  if (url.pathname === "/api/storage/trash" && req.method === "GET") {
+    try {
+      const entries = listTrashEntries();
+      return jsonResponse({
+        entries: entries.map(({ id, epoch, fileCount, bytes, quarantinedAt, mode }) => ({
+          id,
+          epoch,
+          fileCount,
+          bytes,
+          ...(quarantinedAt !== undefined ? { quarantinedAt } : {}),
+          ...(mode ? { mode } : {}),
+        })),
+      });
+    } catch {
+      return jsonResponse({ error: "trash_list_failed", entries: [] }, 500);
+    }
+  }
+
+  if (url.pathname === "/api/storage/trash/restore/test-stream" && req.method === "GET") {
+    if (process.env.OPENCODEX_CLEANUP_TEST_HOOKS === "1") {
+      const stream = getRestoreTrashTestStreamResponse();
+      if (stream) return stream;
+    }
+    // Always answer this test-only path — never fall through to the GUI SPA (200 HTML).
+    return jsonResponse({ error: "not_available" }, 404);
+  }
+
+  if (url.pathname === "/api/storage/trash/restore" && req.method === "POST") {
+    let body: { id?: unknown };
+    try { body = await req.json(); } catch { return jsonResponse({ error: "invalid_json" }, 400); }
+    const id = typeof body?.id === "string" ? body.id : "";
+    if (!id.trim()) {
+      return jsonResponse({ error: "invalid_trash", message: "Trash entry id is required." }, 400);
+    }
+    try {
+      const result = await runRestoreTrashEntryJob(id);
+      if (!result.ok) {
+        const status =
+          result.error === "codex_busy"
+            || result.error === "dest_exists"
+            || result.error === "storage_mutation_busy"
+            ? 409
+            : result.error === "missing_trash"
+              ? 404
+              : result.error === "invalid_trash"
+                ? 400
+                : 500;
+        const messages: Record<RestoreErrorCode, string> = {
+          invalid_trash: "Trash entry id is missing or invalid.",
+          missing_trash: "Trash entry was not found.",
+          codex_busy: "Codex is using state.sqlite — try again after quitting Codex.",
+          storage_mutation_busy: "Another storage cleanup or restore is in progress — try again shortly.",
+          dest_exists: "Restore destination already exists — remove or rename the archived file and retry.",
+          fs_failed: "Filesystem restore failed. Some files may already be restored — check archived_sessions and .trash.",
+          db_reconcile_failed: "Could not restore Codex state database rows.",
+          restore_failed: "Restore failed.",
+          restore_worker_timeout: "Restore took too long (over 10 minutes) and was stopped.",
+          restore_worker_aborted: "Restore was cancelled during shutdown.",
+          restore_worker_failed: "Restore worker crashed or failed unexpectedly.",
+        };
+        const errorCode = result.error ?? "restore_failed";
+        const baseMessage = messages[errorCode] ?? messages.restore_failed;
+        const message =
+          result.message && errorCode === "restore_worker_failed"
+            ? `${baseMessage} (${result.message})`
+            : baseMessage;
+        return jsonResponse({
+          ok: false,
+          error: errorCode,
+          message,
+          count: result.count,
+          bytes: result.bytes,
+          restoredPaths: result.restoredPaths,
+          ...(result.trashDir ? { trashDir: result.trashDir } : {}),
+        }, status);
+      }
+      return jsonResponse({
+        ok: true,
+        trashDir: result.trashDir,
+        count: result.count,
+        bytes: result.bytes,
+        restoredPaths: result.restoredPaths,
+      });
+    } catch {
+      return jsonResponse({
+        ok: false,
+        error: "restore_failed",
+        message: "Restore failed.",
+      }, 500);
+    }
+  }
+
+  if (url.pathname === "/api/storage/cleanup-policy/test-stream" && req.method === "GET") {
+    const stream = getStorageCleanupPolicyTestStreamResponse();
+    if (stream) return stream;
+    // Production: hook is off. Return an explicit JSON 404 — do not fall through to the GUI.
+    return jsonResponse({ error: "not_found" }, 404);
+  }
+
+  if (url.pathname === "/api/storage/cleanup-policy" && req.method === "GET") {
+    const policy = normalizeStorageCleanupPolicy(config.storageCleanupPolicy);
+    return jsonResponse({
+      ...policy,
+      job: getStorageCleanupPolicyJobState(),
+    });
+  }
+
+  if (url.pathname === "/api/storage/cleanup-policy" && req.method === "PUT") {
+    let raw: unknown;
+    try { raw = await req.json(); } catch { return jsonResponse({ error: "invalid_json" }, 400); }
+    const previous = normalizeStorageCleanupPolicy(config.storageCleanupPolicy);
+    const parsed = parseStorageCleanupPolicyInput(raw, previous);
+    if (!parsed.ok) return jsonResponse({ error: parsed.error }, 400);
+    // Never enable implicitly: if client omitted enabled, keep previous (default false).
+    const body = raw as Record<string, unknown>;
+    if (body.enabled === undefined) parsed.policy.enabled = previous.enabled;
+    const saved = writeStorageCleanupPolicyToConfig(parsed.policy);
+    config.storageCleanupPolicy = saved;
+    return jsonResponse({ ok: true, policy: saved, job: getStorageCleanupPolicyJobState() });
+  }
+
+  if (url.pathname === "/api/storage/cleanup-policy/run" && req.method === "POST") {
+    try {
+      const accepted = requestStorageCleanupPolicyRun({ reason: "manual", force: true });
+      if (!accepted.accepted) {
+        return jsonResponse({
+          ok: false,
+          started: false,
+          error: "already_running",
+          message: "A cleanup policy run is already in progress.",
+          job: accepted.state,
+          policy: normalizeStorageCleanupPolicy(config.storageCleanupPolicy),
+        }, 409);
+      }
+      // Return promptly — clients poll GET for skip/defer/success/error outcomes.
+      return jsonResponse({
+        ok: true,
+        started: true,
+        job: accepted.state,
+        policy: normalizeStorageCleanupPolicy(config.storageCleanupPolicy),
+      });
+    } catch {
+      return jsonResponse({ ok: false, error: "cleanup_failed" }, 500);
+    }
+  }
+
   return null;
 }

package/src/server/management/model-routes.ts

@@ -1,5 +1,34 @@
 import { randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
+
+/**
+ * Codex parses a catalog entry's `input_modalities` as a closed enum, and one out-of-enum
+ * value makes it reject the ENTIRE catalog file — plugins, apps and MCP servers all stop
+ * loading over one model's metadata (#759).
+ *
+ * The catalog writer normalizes on the way out, but a rejected value stored here would still
+ * be handed back to the GUI and CLI as if it were real, and the offline `ocx models add` path
+ * already refuses it. Validate at ingress so all three paths agree.
+ */
+const ALLOWED_INPUT_MODALITIES = new Set(["text", "image", "audio"]);
+
+function readInputModalities(raw: unknown): { values?: string[]; error?: string } {
+  if (raw === undefined) return {};
+  if (!Array.isArray(raw)) return { error: "inputModalities must be an array" };
+  // Reject non-strings rather than filtering them out. Dropping them silently accepted a
+  // malformed POST and, worse, let a PUT of `[42]` clear the stored modalities while
+  // answering 200 — the opposite of the contract this validator exists to state. An empty
+  // array stays valid: that is how `ocx models edit --modalities -` clears the field.
+  const rejected: string[] = [];
+  for (const value of raw) {
+    if (typeof value !== "string") return { error: "inputModalities must contain only strings" };
+    if (!ALLOWED_INPUT_MODALITIES.has(value)) rejected.push(value);
+  }
+  if (rejected.length > 0) {
+    return { error: `unsupported input modality: ${rejected.join(", ")} (allowed: text, image, audio)` };
+  }
+  return { values: raw as string[] };
+}
 import type { CatalogModel } from "../../codex/catalog";
 import { catalogModelSlug, disabledNativeSlugs, invalidateCodexModelsCache, nativeModelRows, uniqueCatalogModelsForPublicList } from "../../codex/catalog";
 import { getProviderLiveModelCount } from "../../codex/model-cache";
@@ -63,6 +92,11 @@ import type { ManagementContext } from "./context";
 
 export async function handleModelRoutes(ctx: ManagementContext): Promise<Response | null> {
   const { req, url, config, deps, refreshCodexCatalogBestEffort, syncClaudeAgentDefsBestEffort } = ctx;
+  // A handler persists the exact config object passed in. Production defaults to
+  // the real store; tests that pass an in-memory fixture inject a no-op/spy. Do not
+  // bypass this seam with a dynamic config import — doing so replaced a user's
+  // ~/.opencodex/config.json with the `existing-uuid` test fixture.
+  const persistConfig = deps.saveConfigPreservingClaudeCode ?? saveConfigPreservingClaudeCode;
 
   if (url.pathname === "/api/models" && req.method === "GET") {
     const models = await fetchAllModels(config);
@@ -123,8 +157,7 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
     try { body = await req.json(); } catch { return jsonResponse({ error: "invalid JSON body" }, 400); }
     const disabled = Array.isArray(body.models) ? body.models.filter((m): m is string => typeof m === "string") : [];
     config.disabledModels = disabled;
-    const { saveConfigPreservingClaudeCode: save } = await import("../../config");
-    save(config);
+    persistConfig(config);
     await refreshCodexCatalogBestEffort();
     return jsonResponse({ ok: true, disabled });
   }
@@ -223,7 +256,7 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
     }
 
     config.disabledModels = disabled;
-    saveConfigPreservingClaudeCode(config);
+    persistConfig(config);
     await refreshCodexCatalogBestEffort();
     return jsonResponse({ ok: true, scope, provider, enabled: body.enabled, disabled });
   }
@@ -244,7 +277,9 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
     const displayName = typeof body.displayName === "string" && body.displayName.trim() ? body.displayName.trim() : undefined;
     if (displayName?.includes("/")) return jsonResponse({ error: "displayName must not contain /" }, 400);
     const contextWindow = typeof body.contextWindow === "number" && body.contextWindow > 0 ? Math.floor(body.contextWindow) : undefined;
-    const inputModalities = Array.isArray(body.inputModalities) ? body.inputModalities.filter((m): m is string => typeof m === "string") : undefined;
+    const modalities = readInputModalities(body.inputModalities);
+    if (modalities.error) return jsonResponse({ error: modalities.error }, 400);
+    const inputModalities = modalities.values;
     const existing = config.customModels ?? [];
     const newSlug = routedSlug(provider, modelId);
     if (existing.some(cm => routedSlug(cm.provider, cm.modelId) === newSlug)) {
@@ -260,8 +295,7 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
       addedAt: new Date().toISOString(),
     };
     config.customModels = [...existing, entry];
-    const { saveConfigPreservingClaudeCode: save } = await import("../../config");
-    save(config);
+    persistConfig(config);
     await refreshCodexCatalogBestEffort();
     return jsonResponse(entry, 201);
   }
@@ -289,7 +323,9 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
       cm.contextWindow = typeof body.contextWindow === "number" && body.contextWindow > 0 ? Math.floor(body.contextWindow) : undefined;
     }
     if (body.inputModalities !== undefined) {
-      cm.inputModalities = Array.isArray(body.inputModalities) ? body.inputModalities.filter((m): m is string => typeof m === "string") : undefined;
+      const edited = readInputModalities(body.inputModalities);
+      if (edited.error) return jsonResponse({ error: edited.error }, 400);
+      cm.inputModalities = edited.values && edited.values.length > 0 ? edited.values : undefined;
     }
     const updatedSlug = routedSlug(cm.provider, cm.modelId);
     if (list.some((other, i) => i !== idx && routedSlug(other.provider, other.modelId) === updatedSlug)) {
@@ -297,8 +333,7 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
     }
     list[idx] = cm;
     config.customModels = list;
-    const { saveConfigPreservingClaudeCode: save } = await import("../../config");
-    save(config);
+    persistConfig(config);
     await refreshCodexCatalogBestEffort();
     return jsonResponse(cm);
   }
@@ -312,8 +347,7 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
     if (idx === -1) return jsonResponse({ error: "not found" }, 404);
     list.splice(idx, 1);
     config.customModels = list.length > 0 ? list : undefined;
-    const { saveConfigPreservingClaudeCode: save } = await import("../../config");
-    save(config);
+    persistConfig(config);
     await refreshCodexCatalogBestEffort();
     return jsonResponse({ ok: true });
   }
@@ -349,8 +383,7 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
     // Empty list clears the allowlist (provider reverts to exposing all models).
     if (models.length > 0) config.providers[provider].selectedModels = models;
     else delete config.providers[provider].selectedModels;
-    const { saveConfigPreservingClaudeCode: save } = await import("../../config");
-    save(config);
+    persistConfig(config);
     await refreshCodexCatalogBestEffort();
     return jsonResponse({ ok: true, provider, selected: models });
   }