@bitkyc08/opencodex 2.7.43 → 2.8.0

package/src/storage/worker-lifecycle.ts

@@ -0,0 +1,81 @@
+/**
+ * Deterministic teardown for the storage Bun Workers.
+ *
+ * `Worker.terminate()` returns void and does NOT wait for the thread to be
+ * reclaimed. Every caller here used to fire it and move on, which is fine for
+ * the proxy but not for `bun test --isolate`: the harness tears a test file's
+ * realm down at the file boundary, and on Windows a worker that has not
+ * finished exiting by then trips a Bun-internal assertion and kills the whole
+ * run.
+ *
+ * The crash header names the shape exactly — `workers_spawned(9)
+ * workers_terminated(8)`, one worker still alive — and it lands right at the
+ * `api-storage-policy` → `api-storage` file boundary, the only suite that
+ * spawns policy workers. See `devlog/_plan/260730_remote_issue_merge_round/150`,
+ * which reproduced the panic twice against an unchanged tree and left this
+ * defence as the follow-up if it ever recurred. It recurred.
+ *
+ * So: keep a registry of live workers, and give shutdown/reset paths something
+ * they can actually await. `close` is Bun's post-exit event for a worker
+ * thread, so awaiting it is the real "the thread is gone" signal rather than a
+ * timer we hope is long enough. The timeout only exists so a wedged worker
+ * cannot hang a test teardown forever.
+ */
+
+const liveWorkers = new Set<Worker>();
+
+/** Track a freshly spawned worker so teardown can wait for it later. */
+export function registerStorageWorker(worker: Worker): void {
+  liveWorkers.add(worker);
+}
+
+/**
+ * Terminate a worker and resolve once its thread has actually exited.
+ *
+ * Safe to call twice: the second call finds the worker already deregistered and
+ * resolves immediately.
+ */
+export function terminateStorageWorker(worker: Worker, timeoutMs = 5_000): Promise<void> {
+  if (!liveWorkers.has(worker)) {
+    try { worker.terminate(); } catch { /* already gone */ }
+    return Promise.resolve();
+  }
+  liveWorkers.delete(worker);
+
+  return new Promise<void>(resolve => {
+    let done = false;
+    const settle = (): void => {
+      if (done) return;
+      done = true;
+      clearTimeout(timer);
+      resolve();
+    };
+    // A worker that refuses to exit must not wedge teardown; the proxy path
+    // never awaits this, and a test teardown would rather continue than hang.
+    const timer = setTimeout(settle, timeoutMs);
+    try {
+      worker.addEventListener("close", settle, { once: true });
+    } catch {
+      // No close event available — fall back to the timeout above.
+    }
+    try {
+      worker.terminate();
+    } catch {
+      settle();
+    }
+  });
+}
+
+/**
+ * Await every worker this module still tracks. Used by test resets so no
+ * storage worker outlives the file that spawned it.
+ */
+export async function drainStorageWorkers(timeoutMs = 5_000): Promise<void> {
+  const pending = [...liveWorkers];
+  await Promise.all(pending.map(worker => terminateStorageWorker(worker, timeoutMs)));
+}
+
+/** Live worker count — exported so a regression test can assert the invariant. */
+export function liveStorageWorkerCount(): number {
+  return liveWorkers.size;
+}

package/src/tray/windows.ts

@@ -414,17 +414,43 @@ function assertWindows(): void {
   if (process.platform !== "win32") throw new Error(`The opencodex tray is Windows-only (current platform: ${process.platform}).`);
 }
 
-function spawnTray(state: WindowsTrayEntry): void {
-  const child = spawn(state.bun, [state.cli, "__tray-host"], {
-    detached: true,
+const DETACHED_TRAY_HOST_LAUNCHER = [
+  "$startInfo = New-Object System.Diagnostics.ProcessStartInfo",
+  "$startInfo.FileName = $env:OCX_TRAY_HOST_BUN",
+  "$startInfo.Arguments = $env:OCX_TRAY_HOST_ARGS",
+  "$startInfo.UseShellExecute = $true",
+  "$startInfo.WindowStyle = [System.Diagnostics.ProcessWindowStyle]::Hidden",
+  "$child = [System.Diagnostics.Process]::Start($startInfo)",
+  "if ($null -eq $child) { throw 'Windows tray host did not start.' }",
+  "$child.Dispose()",
+].join("; ");
+
+const DETACHED_TRAY_HOST_LAUNCHER_B64 = Buffer.from(DETACHED_TRAY_HOST_LAUNCHER, "utf16le").toString("base64");
+
+export function launchWindowsTrayHost(state: WindowsTrayEntry): void {
+  const bun = safePath(state.bun);
+  const cli = safePath(state.cli);
+  execFileSync(windowsPowerShellPath(), [
+    "-NoLogo",
+    "-NoProfile",
+    "-NonInteractive",
+    "-EncodedCommand",
+    DETACHED_TRAY_HOST_LAUNCHER_B64,
+  ], {
     stdio: "ignore",
     windowsHide: true,
+    timeout: 15_000,
     env: {
       ...process.env,
+      OCX_TRAY_HOST_BUN: bun,
+      OCX_TRAY_HOST_ARGS: `${quoteRunValue(cli)} __tray-host`,
       OCX_TRAY_ENTRY_B64: Buffer.from(JSON.stringify(state), "utf8").toString("base64"),
     },
   });
-  child.unref();
+}
+
+function spawnTray(state: WindowsTrayEntry): void {
+  launchWindowsTrayHost(state);
 }
 
 function parseTrayHostEntry(): WindowsTrayEntry {
@@ -443,6 +469,8 @@ export async function runWindowsTrayHost(): Promise<void> {
   assertWindows();
   const entry = parseTrayHostEntry();
   delete process.env.OCX_TRAY_ENTRY_B64;
+  delete process.env.OCX_TRAY_HOST_BUN;
+  delete process.env.OCX_TRAY_HOST_ARGS;
   const child = spawn(windowsPowerShellPath(), windowsTrayProcessArgs(entry, "Run", process.pid), {
     stdio: "ignore",
     windowsHide: true,

package/src/types.ts

@@ -546,6 +546,17 @@ export interface OcxConfig {
    * the Codex ladder (src/reasoning-effort.ts CODEX_REASONING_LEVELS) at the API boundary.
    */
   injectionEffort?: string;
+  /**
+   * Explicit sideband websocket base for realtime/live joins, mirroring upstream's
+   * `experimental_realtime_ws_base_url`. The value is a ROOT (or a recognized
+   * `/realtime`, `/realtime/calls/<id>`, `/live/<id>` endpoint form, which is
+   * stripped back to the root); `/v1` is appended during normalization. Intended
+   * for local development against a fake realtime server — plaintext `http`/`ws`
+   * is accepted only for loopback hosts, and URL userinfo is rejected; both
+   * failures close to the canonical `https://api.openai.com/v1`. Configured by
+   * editing this file; there is deliberately no management-API or GUI surface.
+   */
+  experimentalRealtimeWsBaseUrl?: string;
   /**
    * Model ids the user has EXCLUDED from the Grok Build managed block. Absent or empty
    * means "everything visible", which is the historical behaviour — so an existing

package/src/update/badge.ts

@@ -0,0 +1,72 @@
+/**
+ * Cached "is an update available?" answer for the GUI sidebar badge.
+ *
+ * `/api/update/check` spawns `npm view` on every call (~1s, network-bound), so a
+ * sidebar that polls it would spawn a process per tick on every page of the GUI.
+ * The badge instead READS the 20h version cache the CLI update prompt already
+ * maintains (`~/.opencodex/version.json`).
+ *
+ * This is deliberately read-only: it must never trigger a registry refresh. The GUI
+ * polls it, so a refresh-on-read would let repeated polls launch repeated `npm view`
+ * helpers with no coalescing. Cache warming stays with `ocx start`
+ * (`triggerBackgroundRefreshIfStale` in `src/update/notify.ts`) and with the explicit
+ * `/api/update/check` the user reaches by clicking the sidebar update button.
+ */
+import { currentVersion, defaultUpdateTag, detectInstall, type Channel } from "./index";
+import { isNewer, isSourceBuildVersion, readVersionCache } from "./notify";
+
+export interface UpdateBadge {
+  /** True only when a newer version exists on the current channel. */
+  updateAvailable: boolean;
+  currentVersion: string;
+  latestVersion: string | null;
+  channel: Channel;
+  /** False for source checkouts, where the GUI cannot offer a one-click update. */
+  canUpdate: boolean;
+  /** True when no cached registry answer exists yet, so "no update" is unproven. */
+  unknown: boolean;
+}
+
+export interface UpdateBadgeDeps {
+  currentVersion: () => string;
+  detectInstall: () => ReturnType<typeof detectInstall>;
+  readCache: (channel: Channel) => ReturnType<typeof readVersionCache>;
+}
+
+const defaultDeps: UpdateBadgeDeps = {
+  currentVersion,
+  detectInstall,
+  readCache: readVersionCache,
+};
+
+/**
+ * Read-only badge state. Source checkouts and unknown versions report no update
+ * rather than a dead badge the user cannot act on.
+ */
+export function readUpdateBadge(deps: UpdateBadgeDeps = defaultDeps): UpdateBadge {
+  const current = deps.currentVersion();
+  const installer = deps.detectInstall();
+  const channel = defaultUpdateTag(current);
+  const base: UpdateBadge = {
+    updateAvailable: false,
+    currentVersion: current,
+    latestVersion: null,
+    channel,
+    canUpdate: installer !== "source",
+    unknown: true,
+  };
+  // A source checkout has nothing to compare against, so "unknown" is not useful there.
+  if (installer === "source" || current === "?" || isSourceBuildVersion(current)) {
+    return { ...base, canUpdate: false, unknown: false };
+  }
+
+  const cache = deps.readCache(channel);
+  if (!cache) return base;
+
+  return {
+    ...base,
+    latestVersion: cache.latest_version,
+    updateAvailable: isNewer(cache.latest_version, current, channel),
+    unknown: false,
+  };
+}

package/src/update/job.ts

@@ -26,7 +26,7 @@ const RELEASE_NOTES_URL = "https://github.com/lidge-jun/opencodex/releases/lates
 const UPDATE_JOB_FILENAME = "update-job.json";
 const UPDATE_TIMEOUT_MS = 180_000;
 const RESTART_TIMEOUT_MS = 60_000;
-const RESTART_HEALTH_TIMEOUT_MS = 15_000;
+const RESTART_HEALTH_TIMEOUT_MS = 30_000;
 const RESTART_STABILITY_WINDOW_MS = 15_000;
 /** Legacy active records did not persist a worker PID, so age is their only safe recovery signal. */
 export const UPDATE_JOB_LEGACY_STALE_MS = 10 * 60_000;
@@ -533,7 +533,10 @@ async function awaitRestartedProxyHealthy(
   const hostname = captured.hostname;
   const startDeadline = now() + RESTART_HEALTH_TIMEOUT_MS;
 
-  while (now() < startDeadline) {
+  while (true) {
+    // Always make one identity-aware probe at or after the boundary. A replacement
+    // becoming healthy on the final tick must not be mistaken for a timeout.
+    const finalProbe = now() >= startDeadline;
     if (await probe(port, hostname)) {
       updateJob(job, {}, `Proxy reported healthy on ${hostname}:${port}; confirming it stays up...`);
       const stableUntil = now() + RESTART_STABILITY_WINDOW_MS;
@@ -547,7 +550,8 @@ async function awaitRestartedProxyHealthy(
       updateJob(job, {}, `Proxy stayed healthy for ${Math.trunc(RESTART_STABILITY_WINDOW_MS / 1000)}s after restart.`);
       return { ok: true };
     }
-    await sleep(250);
+    if (finalProbe) break;
+    await sleep(Math.min(250, Math.max(0, startDeadline - now())));
   }
 
   return { ok: false, reason: "timeout" };
@@ -570,7 +574,7 @@ async function confirmRestartedProxy(
   - 검토한 주요 대안: (1) 포트 점유만 확인 — 외부 프로세스/죽기 직전 프로세스를 성공으로 오인할 수 있다. (2) 무기한 /healthz 폴링 — UX가 느려지고 worker 종료 시점이 불명확하다. (3) 짧은 healthy 등장 + 안정성 창 확인 — 실제 복귀를 확인하면서도 대기 시간을 제한할 수 있다.
   - 선택한 방식: identity-aware /healthz probe가 일정 시간 안에 나타나고, 추가 안정성 창 동안 유지되는지 확인한다.
   - 다른 대안 대신 이 방식을 선택한 이유: GUI는 "업데이트가 설치됐지만 재시작은 실패"를 분리해 알려줘야 하며, 이 방식이 가장 적은 오탐으로 그 경계를 만든다.
-  - 장점, 단점 및 영향: 장점은 silent restart failure가 update-job 상태로 드러난다는 점이다. 단점은 성공 판정이 최대 30초 늦어질 수 있다는 점이며, 대신 실제 복귀를 더 정확히 반영한다.
+  - 장점, 단점 및 영향: 장점은 silent restart failure가 update-job 상태로 드러난다는 점이다. 단점은 설정상 성공 판정 창이 30초 도착 + 15초 안정성으로 늘어나고 경계 probe 지연이 추가될 수 있다는 점이며, 대신 실제 복귀를 더 정확히 반영한다.
   */
   const result = await awaitRestartedProxyHealthy(job, captured, io);
   if (result.ok) return true;

package/src/usage/expected-prices.ts

@@ -144,16 +144,17 @@ export function findExpectedPriceOverlay(
 }
 
 /**
- * OpenAI service_tier "priority" (Fast) price multipliers by model slug.
- * Source: https://platform.openai.com/docs/models (2026-07-24).
- * Priority pricing applies uniformly to all token types (input, output, cache).
+ * OpenAI Fast mode (`service_tier=priority`) price multipliers by model slug.
+ * Source: https://openai.com/api-fast-mode/ (2026-07-31).
+ * Fast pricing applies uniformly to all token types (input, output, cache).
  * Models not listed here fall back to 1× (no multiplier).
  */
 export const PRIORITY_MULTIPLIERS: Readonly<Record<string, number>> = {
   "gpt-5.6-sol": 2,
-  "gpt-5.6-terra": 2,
-  "gpt-5.6-luna": 2,
+  "gpt-5.6-terra": 1.6,
+  "gpt-5.6-luna": 0.4,
   "gpt-5.5": 2.5,
+  "gpt-5.4-mini": 2,
   "gpt-5.4": 2,
 };
 

package/src/usage/log.ts

@@ -128,6 +128,13 @@ function normalizeUsageValue(usage: OcxUsage | undefined): OcxUsage | undefined
   return {
     inputTokens: usage.inputTokens,
     outputTokens: usage.outputTokens,
+    // Absolute active-context checkpoint (types.ts). Stateful providers such as Kiro report
+    // per-attempt usage only, so this field is the ONLY carrier of the cumulative context
+    // figure once the log records raw adapter usage instead of re-parsing the bridged wire
+    // (usageFromBridge, request-log.ts). Omitting it here silently dropped Kiro's context
+    // growth from every persisted row. It is deliberately NOT folded into totalTokens:
+    // a checkpoint is not a per-request total and must never be summed across requests.
+    ...(typeof usage.contextTotalTokens === "number" ? { contextTotalTokens: usage.contextTotalTokens } : {}),
     ...(typeof usage.totalTokens === "number" ? { totalTokens: usage.totalTokens } : {}),
     ...(typeof usage.cachedInputTokens === "number" ? { cachedInputTokens: usage.cachedInputTokens } : {}),
     ...(typeof usage.cacheReadInputTokens === "number" ? { cacheReadInputTokens: usage.cacheReadInputTokens } : {}),
@@ -162,6 +169,7 @@ function normalizeAttemptUsage(raw: unknown): OcxUsage | null {
   if (!isNonNegativeFiniteNumber(usage.inputTokens)
     || !isNonNegativeFiniteNumber(usage.outputTokens)) return null;
   for (const key of [
+    "contextTotalTokens",
     "totalTokens",
     "cachedInputTokens",
     "cacheReadInputTokens",

package/src/web-search/loop.ts

@@ -103,23 +103,63 @@ async function* replay(events: AdapterEvent[]): AsyncGenerator<AdapterEvent> {
  * replaying a bare toolCall 400s ("Expected `thinking` or `redacted_thinking`, but found
  * `tool_use`"). The signature validity gate stays in the anthropic adapter; other adapters
  * ignore or serialize the part harmlessly.
+ *
+ * Each signed block keeps its OWN signature and text, mirroring src/images/loop.ts: a signature
+ * authenticates the exact block it closed, so flattening two blocks under the last signature
+ * 400s on replay just as it does there.
+ *
+ * Raw reasoning (`reasoning_raw_delta`, what OpenAI-compatible providers emit instead of signed
+ * thinking) accumulates into a SEPARATE UNSIGNED part. It must never join a signed block: the
+ * anthropic serializer skips signature-less parts, while openai-chat serializes their text as
+ * `reasoning_content` — which DeepSeek V4 thinking mode requires back alongside the replayed
+ * tool_calls, and whose absence ended the turn as a provider 400 (issue #688).
+ *
+ * This assumes raw reasoning never interleaves INSIDE an unfinished signed block: Anthropic-family
+ * adapters emit thinking_delta/signature and OpenAI-compatible ones emit reasoning_raw_delta, and
+ * the two never share a stream. Honoring a genuinely mixed stream would need per-segment state,
+ * not another accumulator.
  */
-function extractIterationThinking(events: AdapterEvent[]): OcxThinkingContent | null {
+function extractIterationThinking(events: AdapterEvent[]): OcxThinkingContent[] {
+  const parts: OcxThinkingContent[] = [];
   let thinking = "";
   let signature: string | undefined;
-  const redacted: string[] = [];
+  let rawReasoning = "";
+
+  const flushVisible = () => {
+    if (!thinking && !signature) return;
+    parts.push({
+      type: "thinking",
+      thinking,
+      ...(signature ? { signature } : {}),
+    });
+    thinking = "";
+    signature = undefined;
+  };
+  const flushRaw = () => {
+    if (!rawReasoning) return;
+    parts.push({ type: "thinking", thinking: rawReasoning });
+    rawReasoning = "";
+  };
+
   for (const e of events) {
-    if (e.type === "thinking_delta") thinking += e.thinking;
-    else if (e.type === "thinking_signature") signature = e.signature;
-    else if (e.type === "redacted_thinking") redacted.push(e.data);
+    if (e.type === "thinking_delta") {
+      flushRaw();
+      thinking += e.thinking;
+    } else if (e.type === "reasoning_raw_delta") {
+      flushVisible();
+      rawReasoning += e.text;
+    } else if (e.type === "thinking_signature") {
+      signature = e.signature;
+      flushVisible();
+    } else if (e.type === "redacted_thinking") {
+      flushVisible();
+      flushRaw();
+      parts.push({ type: "thinking", thinking: "", redacted: [e.data] });
+    }
   }
-  if (!thinking && !signature && redacted.length === 0) return null;
-  return {
-    type: "thinking",
-    thinking,
-    ...(signature ? { signature } : {}),
-    ...(redacted.length > 0 ? { redacted } : {}),
-  };
+  flushVisible();
+  flushRaw();
+  return parts;
 }
 
 /** Normalize a query for failed-query de-duplication (case/whitespace-insensitive). */
@@ -406,7 +446,7 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
   // valid, and surface as ONE search cell carrying every attempted query. A real search (one that
   // hits the sidecar) shows the spinner WHILE the batch runs. Empty/limit/repeat placeholders never
   // emit a cell (matching the prior single-query behavior).
-  async function* runSearchCall(call: WebSearchCall, precedingThinking?: OcxThinkingContent | null): AsyncGenerator<AdapterEvent> {
+  async function* runSearchCall(call: WebSearchCall, precedingThinking: OcxThinkingContent[] = []): AsyncGenerator<AdapterEvent> {
     const results: { query: string; outcome: SidecarOutcome }[] = [];
     let beganCell = false;
     if (call.queries.length === 0) {
@@ -465,8 +505,9 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
     messages.push({
       role: "assistant",
       content: [
-        // Signed thinking must precede tool_use on replay (Anthropic extended thinking).
-        ...(precedingThinking ? [precedingThinking] : []),
+        // Signed thinking must precede tool_use on replay (Anthropic extended thinking), and
+        // unsigned raw reasoning has to ride along for providers that require it back (#688).
+        ...precedingThinking,
         { type: "toolCall" as const, id: call.id, name: WEB_SEARCH_TOOL_NAME, arguments: callArgs },
       ],
       timestamp: now,
@@ -559,7 +600,7 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
           // The thinking that led to the search belongs to the FIRST call's assistant replay turn.
           const iterationThinking = extractIterationThinking(split.passthrough);
           for (const [callIndex, call] of split.calls.entries()) {
-            yield* runSearchCall(call, callIndex === 0 ? iterationThinking : null);
+            yield* runSearchCall(call, callIndex === 0 ? iterationThinking : []);
           }
         } catch (e) {
           yield { type: "error", message: e instanceof LoopError ? e.message : (e instanceof Error ? e.message : String(e)) };