@bitkyc08/opencodex 2.7.43-preview.20260728 → 2.8.0

package/src/server/management/system-routes.ts

@@ -1,25 +1,31 @@
 /**
- * /api/system/* — service-process runtime/memory introspection (#314 WP3).
+ * /api/system/* — service-process runtime/memory introspection (#314 WP3)
+ * and the memory-card drain-and-restart action (#563).
  *
  * Rides the standard management gate: every /api/* request already passed
- * requireApiAuth("management") + the origin check before dispatch, so these
+ * the independent management-auth gate + the origin check before dispatch, so these
  * routes add no auth of their own. NEVER expose this data on the
  * unauthenticated /healthz surface.
  *
- * The payload is scalar-only (numbers, enum strings): no paths, no tokens, no
- * account identifiers. `external` and `arrayBuffers` keep Windows diagnostics
- * honest when RSS/working-set counters under-report committed retention.
- * `jscHeap` (bun:jsc heapStats) is useful context, but on Bun 1.3.14 it is not a
- * standalone leak discriminator. `responseState` attributes growth further: it
- * is the proxy's previous_response_id continuation store, so a growing
- * responseState.totalBytes under rising observed memory points at conversation
- * retention rather than the runtime allocator.
+ * The payload is scalar-only (numbers, enum strings, booleans): no paths, no
+ * tokens, no account identifiers. `external` and `arrayBuffers` keep Windows
+ * diagnostics honest when RSS/working-set counters under-report committed
+ * retention. `jscHeap` (bun:jsc heapStats) is useful context, but on Bun 1.3.14
+ * it is not a standalone leak discriminator. `responseState` attributes growth
+ * further: it is the proxy's previous_response_id continuation store, so a
+ * growing responseState.totalBytes under rising observed memory points at
+ * conversation retention rather than the runtime allocator.
+ *
+ * `activeTurnCount` / `isDraining` are scalar lifecycle counters for the
+ * dashboard drain-and-restart confirm UX — never request bodies or IDs.
  */
 import { decideEagerRelay } from "../../lib/bun-stream-caps";
+import { getActiveTurnCount, isDraining } from "../lifecycle";
 import { getActiveMemoryWatchdog, observedMemoryCounter } from "../memory-watchdog";
 import { responseStateMetrics } from "../../responses/state";
 import { jsonResponse } from "../auth-cors";
 import type { ManagementContext } from "./context";
+import { acceptSystemRestart } from "./system-restart";
 
 const ENDPOINT_SAMPLE_LIMIT = 60;
 
@@ -76,7 +82,24 @@ export async function handleSystemRoutes(ctx: ManagementContext): Promise<Respon
       streamMode,
       eagerRelay: process.platform === "win32" ? decideEagerRelay(streamMode) : null,
       watchdog,
+      activeTurnCount: getActiveTurnCount(),
+      isDraining: isDraining(),
     });
   }
+
+  if (url.pathname === "/api/system/restart" && req.method === "POST") {
+    // Longer informed drain than /api/stop; does not tear down Codex/Grok injection.
+    const result = acceptSystemRestart();
+    return jsonResponse({
+      success: true,
+      message: result.alreadyDraining
+        ? "Drain already in progress."
+        : "Draining in-flight requests, then restarting.",
+      activeTurnCount: result.activeTurnCount,
+      drainTimeoutMs: result.drainTimeoutMs,
+      alreadyDraining: result.alreadyDraining,
+    }, 202, req, config);
+  }
+
   return null;
 }

package/src/server/management-api.ts

@@ -53,7 +53,7 @@ import { drainAndShutdown } from "./lifecycle";
 import { filterRequestLogs, getRequestLogEntries, type RequestLogEntry } from "./request-log";
 import { estimateComboCost, estimateRequestCost, normalizeCostTokens, tokensPerSecond } from "../usage/cost";
 import type { PersistedUsageAttempt } from "../usage/log";
-import { isAllowedRequestOrigin, jsonResponse, providerManagementConfigError, publicProviderBaseUrl, safeConfigDTO } from "./auth-cors";
+import { isAllowedManagementOrigin, jsonResponse, providerManagementConfigError, publicProviderBaseUrl, safeConfigDTO } from "./auth-cors";
 import { applySystemEnvToggle } from "./system-env";
 
 import type { ManagementApiDeps } from "./management/context";
@@ -65,6 +65,7 @@ import { handleAgentSettingsRoutes } from "./management/agent-settings-routes";
 import { handleOauthAccountRoutes } from "./management/oauth-account-routes";
 import { handleComboRoutes } from "./management/combo-routes";
 import { handleSystemRoutes } from "./management/system-routes";
+import { handleSidebarRoutes } from "./management/sidebar-routes";
 import type { ManagementContext } from "./management/context";
 export type { ManagementApiDeps } from "./management/context";
 import { fetchAllModels } from "./management/shared";
@@ -79,7 +80,7 @@ export const VERSION = (() => {
 })();
 
 export async function handleManagementAPI(req: Request, url: URL, config: OcxConfig, deps: ManagementApiDeps = {}): Promise<Response | null> {
-  if (!isAllowedRequestOrigin(req, config)) {
+  if (!isAllowedManagementOrigin(req, config)) {
     return jsonResponse({ error: "cross-origin request blocked" }, 403, req, config);
   }
   // Management bodies are small JSON (provider names, key ids, settings). Reject oversized
@@ -130,7 +131,8 @@ export async function handleManagementAPI(req: Request, url: URL, config: OcxCon
     ??     (await handleAgentSettingsRoutes(ctx))
     ??     (await handleOauthAccountRoutes(ctx))
     ??     (await handleComboRoutes(ctx))
-    ??     (await handleSystemRoutes(ctx));
+    ??     (await handleSystemRoutes(ctx))
+    ??     (await handleSidebarRoutes(ctx));
   if (routed) return routed;
 
   if (url.pathname === "/api/stop" && req.method === "POST") {

package/src/server/management-auth.ts

@@ -0,0 +1,216 @@
+import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import {
+  chmodSync,
+  closeSync,
+  fsyncSync,
+  linkSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  unlinkSync,
+  writeFileSync,
+} from "node:fs";
+import { dirname, join } from "node:path";
+import { adminApiTokenFilePath } from "../lib/admin-secrets";
+import { hardenSecretDir, hardenSecretPath } from "../lib/windows-secret-acl";
+import type { OcxConfig } from "../types";
+import {
+  isAllowedManagementOrigin,
+  isApiAuthRequired,
+  isDataPlaneAdmissionSecret,
+  isLoopbackHostname,
+  managementRequestOrigin,
+  parseHttpHost,
+} from "./auth-cors";
+
+const GUI_SESSION_TTL_MS = 5 * 60_000;
+const GUI_SESSION_LIMIT = 128;
+
+interface GuiSessionRecord {
+  csrfToken: string;
+  origin: string;
+  expiresAt: number;
+}
+
+export interface GuiSessionBootstrap extends GuiSessionRecord {
+  token: string;
+}
+
+export type ManagementAuthState =
+  | {
+    available: true;
+    token: string;
+    source: "environment" | "file";
+    sessions: Map<string, GuiSessionRecord>;
+  }
+  | { available: false; reason: string };
+
+function fail(reason: string): ManagementAuthState {
+  return { available: false, reason };
+}
+
+function assertSafeDirectory(path: string): void {
+  mkdirSync(path, { recursive: true, mode: 0o700 });
+  const stat = lstatSync(path);
+  if (!stat.isDirectory() || stat.isSymbolicLink()) throw new Error("management token directory is not a regular directory");
+  chmodSync(path, 0o700);
+  const hardened = hardenSecretDir(path, { required: true });
+  if (!hardened.ok) throw new Error("management token directory ACL hardening did not complete");
+}
+
+function readExistingToken(path: string): string {
+  const stat = lstatSync(path);
+  if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 512) {
+    throw new Error("management token path is not a regular secret file");
+  }
+  chmodSync(path, 0o600);
+  const hardened = hardenSecretPath(path, { required: true });
+  if (!hardened.ok) throw new Error("management token file ACL hardening did not complete");
+  const token = readFileSync(path, "utf8").trim();
+  if (!/^ocx_admin_[A-Za-z0-9_-]{43}$/.test(token)) throw new Error("management token file is invalid");
+  return token;
+}
+
+function removeBestEffort(path: string): void {
+  try { unlinkSync(path); } catch { /* fail-closed state is preserved by the caller */ }
+}
+
+function createTokenFile(path: string): string {
+  const directory = dirname(path);
+  const token = `ocx_admin_${randomBytes(32).toString("base64url")}`;
+  const temporary = join(directory, `.${randomUUID()}.admin-token.tmp`);
+  let linked = false;
+  let fd: number | null = null;
+  try {
+    fd = openSync(temporary, "wx", 0o600);
+    writeFileSync(fd, `${token}\n`, "utf8");
+    fsyncSync(fd);
+    closeSync(fd);
+    fd = null;
+    chmodSync(temporary, 0o600);
+    const temporaryHardened = hardenSecretPath(temporary, { required: true });
+    if (!temporaryHardened.ok) throw new Error("management token temporary ACL hardening did not complete");
+    try {
+      linkSync(temporary, path);
+      linked = true;
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === "EEXIST") return readExistingToken(path);
+      throw error;
+    }
+    const finalHardened = hardenSecretPath(path, { required: true });
+    if (!finalHardened.ok) throw new Error("management token file ACL hardening did not complete");
+    return token;
+  } catch (error) {
+    if (linked) removeBestEffort(path);
+    throw error;
+  } finally {
+    if (fd !== null) {
+      try { closeSync(fd); } catch { /* best effort */ }
+    }
+    removeBestEffort(temporary);
+  }
+}
+
+function ready(token: string, source: "environment" | "file", config: OcxConfig): ManagementAuthState {
+  if (isDataPlaneAdmissionSecret(token, config)) {
+    return fail("management credential conflicts with a data-plane credential");
+  }
+  return { available: true, token, source, sessions: new Map() };
+}
+
+export function initializeManagementAuthState(config: OcxConfig): ManagementAuthState {
+  const environmentToken = process.env.OPENCODEX_ADMIN_AUTH_TOKEN?.trim();
+  if (environmentToken) {
+    return ready(environmentToken, "environment", config);
+  }
+  try {
+    const path = adminApiTokenFilePath();
+    assertSafeDirectory(dirname(path));
+    let token: string;
+    try {
+      token = readExistingToken(path);
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+      token = createTokenFile(path);
+    }
+    return ready(token, "file", config);
+  } catch (error) {
+    return fail(error instanceof Error ? error.message : "management token initialization failed");
+  }
+}
+
+function equalSecret(actual: string, expected: string): boolean {
+  const encoder = new TextEncoder();
+  const left = encoder.encode(actual);
+  const right = encoder.encode(expected);
+  return left.length === right.length && timingSafeEqual(left, right);
+}
+
+function removeExpiredSessions(state: Extract<ManagementAuthState, { available: true }>, now = Date.now()): void {
+  for (const [token, session] of state.sessions) {
+    if (session.expiresAt <= now) state.sessions.delete(token);
+  }
+}
+
+function randomSessionSecret(prefix: "ocx_session_"): string {
+  return `${prefix}${randomBytes(32).toString("base64url")}`;
+}
+
+export function issueGuiSession(
+  req: Request,
+  config: OcxConfig,
+  state: ManagementAuthState,
+): GuiSessionBootstrap | null {
+  if (isApiAuthRequired(config) || !state.available || req.method !== "GET" || !isAllowedManagementOrigin(req, config)) return null;
+  const host = parseHttpHost(req.headers.get("Host"));
+  if (!host || !isLoopbackHostname(host.hostname)) return null;
+  const origin = managementRequestOrigin(req, config);
+  if (!origin) return null;
+  const now = Date.now();
+  removeExpiredSessions(state, now);
+  while (state.sessions.size >= GUI_SESSION_LIMIT) {
+    const oldest = state.sessions.keys().next().value as string | undefined;
+    if (!oldest) break;
+    state.sessions.delete(oldest);
+  }
+  const token = randomSessionSecret("ocx_session_");
+  const session: GuiSessionRecord = {
+    csrfToken: randomBytes(32).toString("base64url"),
+    origin,
+    expiresAt: now + GUI_SESSION_TTL_MS,
+  };
+  state.sessions.set(token, session);
+  return { token, ...session };
+}
+
+export function requireManagementAuth(
+  req: Request,
+  state: ManagementAuthState,
+  config?: OcxConfig,
+): Response | null {
+  if (!state.available) {
+    return Response.json({ error: "management API unavailable" }, { status: 503 });
+  }
+  const actual = req.headers.get("x-opencodex-api-key")?.trim()
+    || req.headers.get("authorization")?.replace(/^Bearer\s+/i, "").trim();
+  if (actual && equalSecret(actual, state.token)) return null;
+  if (actual && config) {
+    removeExpiredSessions(state);
+    const session = state.sessions.get(actual);
+    if (session) {
+      const requestOrigin = managementRequestOrigin(req, config);
+      const claimedOrigin = req.headers.get("x-opencodex-gui-origin");
+      const browserOrigin = req.headers.get("Origin");
+      const sameOrigin = requestOrigin === session.origin
+        && claimedOrigin === session.origin
+        && (!browserOrigin || browserOrigin === session.origin);
+      const safeMethod = req.method === "GET" || req.method === "HEAD";
+      const csrf = req.headers.get("x-opencodex-csrf-token")?.trim();
+      if (sameOrigin && (safeMethod || (browserOrigin === session.origin && !!csrf && equalSecret(csrf, session.csrfToken)))) {
+        return null;
+      }
+    }
+  }
+  return Response.json({ error: "opencodex admin token required" }, { status: 401 });
+}

package/src/server/proxy-liveness.ts

@@ -37,6 +37,8 @@ export interface LiveProxy {
   port: number;
   /** Raw bind hostname the probe succeeded against; compose URLs via `probeHostname`. */
   hostname?: string;
+  /** Whether the successful probe used runtime-port metadata or the configured listen port. */
+  source: "runtime" | "config";
 }
 
 /**
@@ -118,7 +120,7 @@ export async function findLiveProxy(io: LivenessIo = {}): Promise<LiveProxy | nu
         // healthz confirmed the pid itself → trusted; a pidless legacy body did not,
         // so the cheap pid must pass full identity verification before it is returned.
         const trusted = identity.pid === pid ? pid : killablePid(pid);
-        return { pid: trusted, port: runtime.port, hostname: runtime.hostname };
+        return { pid: trusted, port: runtime.port, hostname: runtime.hostname, source: "runtime" };
       }
     }
   }
@@ -133,12 +135,21 @@ export async function findLiveProxy(io: LivenessIo = {}): Promise<LiveProxy | nu
     // Only the healthz-reported pid is authoritative here. The record's pid may be stale
     // (its process dead, the port reused by a pidless legacy proxy) — synthesizing it
     // would hand destructive callers (stopProxy → kill fallback) a reusable pid.
-    if (identity) return { pid: identity.pid ?? null, port: record.port, hostname: record.hostname };
+    if (identity) {
+      return { pid: identity.pid ?? null, port: record.port, hostname: record.hostname, source: "runtime" };
+    }
   }
 
   const config = configFn();
   const port = config.port ?? 10100;
   const identity = await proxyIdentityAt(port, { hostname: config.hostname }, io);
-  if (identity) return { pid: identity.pid ?? killablePid(pid), port, hostname: config.hostname };
+  if (identity) {
+    return {
+      pid: identity.pid ?? killablePid(pid),
+      port,
+      hostname: config.hostname,
+      source: "config",
+    };
+  }
   return null;
 }

package/src/server/responses/compact.ts

@@ -51,6 +51,7 @@ import {
   isCodexAuthContextUsable,
   resolveCodexAuthContext,
   codexProbeLeaseId,
+  codexProbeQuotaScope,
   type CodexAuthContext,
 } from "../../codex/auth-context";
 import {
@@ -217,7 +218,7 @@ export async function handleResponsesCompact(
     const headers = new Headers({ "content-type": "application/json" });
     try {
       if (route.codexAccountMode) {
-        authCtx = await resolveCodexAuthContext(req.headers, config, route.codexAccountMode);
+        authCtx = await resolveCodexAuthContext(req.headers, config, route.codexAccountMode, { modelId: selectedModelId });
         const selected = headersForCodexAuthContext(req.headers, authCtx);
         compactProvider = applyCodexAuthContextToProvider(route.provider, authCtx, route.codexAccountMode);
         for (const name of FORWARD_HEADERS) {
@@ -255,12 +256,17 @@ export async function handleResponsesCompact(
     const compactUrl = `${base}/responses/compact`;
     const compactThreadId = req.headers.get("x-codex-parent-thread-id");
     const connectMs = config.connectTimeoutMs ?? 200_000;
-    const recordCompactPoolOutcome = (outcome: CodexUpstreamOutcome, meta: { retryAfter?: string | null } = {}) => {
+    const recordCompactPoolOutcome = (
+      outcome: CodexUpstreamOutcome,
+      meta: { retryAfter?: string | null; resetAt?: unknown | unknown[] } = {},
+    ) => {
       if (!usesCodexForwardPoolAuth(authCtx, route.provider)) return;
       recordCodexUpstreamOutcome(config, authCtx.accountId, outcome, {
         ...meta,
         threadId: compactThreadId,
+        modelId: selectedModelId,
         probeLeaseId: codexProbeLeaseId(authCtx),
+        probeQuotaScope: codexProbeQuotaScope(authCtx),
       });
     };
     let upstream: Response;
@@ -283,28 +289,30 @@ export async function handleResponsesCompact(
         { abortSignal: req.signal, label: safeHostLabel(compactUrl) },
       );
     } catch (err) {
-      if (req.signal.aborted) return formatErrorResponse(499, "client_cancelled", "Client cancelled compact request");
+      if (req.signal.aborted) {
+        recordCompactPoolOutcome(499);
+        return formatErrorResponse(499, "client_cancelled", "Client cancelled compact request");
+      }
       const outcome = err instanceof Error && err.name === "TimeoutError" ? "timeout" : "connect_error";
       recordCompactPoolOutcome(outcome);
       return formatErrorResponse(502, "upstream_error", "Failed to connect to compact upstream");
     }
     const retryAfter = upstream.headers.get("retry-after");
+    const resetAt = [
+      upstream.headers.get("x-codex-primary-reset-at"),
+      upstream.headers.get("x-codex-secondary-reset-at"),
+      upstream.headers.get("x-codex-tertiary-reset-at"),
+    ].filter(Boolean);
     const buffered = await bufferCompactResponse(upstream, req.signal);
     // Record pool health only after the body is fully delivered (or definitively failed).
     // A premature 200 would clear soft-avoid while the client still sees a buffer 502.
     if (buffered.status === 499) {
+      recordCompactPoolOutcome(499);
       return buffered;
     }
-    if (upstream.ok && buffered.status >= 500) {
-      // The upstream account returned 200 — it is healthy. The buffering failure
-      // (oversized body exceeding COMPACT_RESPONSE_MAX_BYTES, or a rare mid-read
-      // reset on a small JSON payload) is a local proxy issue, not account flakiness.
-      // Record the upstream status so a deterministic payload-size limit does not
-      // soft-avoid a healthy account and rotate a thread for 30s.
-      recordCompactPoolOutcome(upstream.status, { retryAfter });
-    } else {
-      recordCompactPoolOutcome(upstream.status, { retryAfter });
-    }
+    // Always record the real upstream status: a local buffering failure after a
+    // 200 upstream response must not soft-avoid a healthy account or rotate a thread.
+    recordCompactPoolOutcome(upstream.status, { retryAfter, resetAt });
     return buffered;
   }