npm - @bitkyc08/opencodex - Versions diffs - 2.7.6 → 2.7.7 - Mend

@bitkyc08/opencodex 2.7.6 → 2.7.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (16) hide show

package/gui/dist/assets/index-C0xVu72_.css +1 -0
package/gui/dist/assets/index-DzEDGLZh.js +40 -0
package/gui/dist/index.html +2 -2
package/package.json +1 -1
package/src/adapters/openai-responses.ts +42 -0
package/src/codex/catalog.ts +13 -1
package/src/providers/registry.ts +4 -0
package/src/reasoning-effort.ts +5 -0
package/src/server/effort-policy.ts +172 -0
package/src/server/index.ts +29 -1
package/src/server/management-api.ts +28 -0
package/src/server/responses.ts +27 -0
package/src/server/search.ts +150 -0
package/src/types.ts +25 -0
package/gui/dist/assets/index-D7o1qwy-.css +0 -1
package/gui/dist/assets/index-mEjIne-M.js +0 -40

package/gui/dist/index.html CHANGED Viewed

@@ -16,8 +16,8 @@
         } catch (e) {}
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-mEjIne-M.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-D7o1qwy-.css">
+    <script type="module" crossorigin src="/assets/index-DzEDGLZh.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-C0xVu72_.css">
   </head>
   <body>
     <div id="root"></div>

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@bitkyc08/opencodex",
-  "version": "2.7.6",
+  "version": "2.7.7",
   "description": "Universal provider proxy for OpenAI Codex — use any LLM with Codex CLI/App/SDK",
   "type": "module",
   "main": "./bin/package-main.mjs",

package/src/adapters/openai-responses.ts CHANGED Viewed

@@ -21,6 +21,7 @@ export const FORWARD_HEADERS = [
   "x-codex-turn-state",
   "x-codex-window-id",
   "x-oai-attestation",
+  "x-openai-subagent",
   "x-responsesapi-include-timing-metrics",
 ];
@@ -174,6 +175,46 @@ function stripPreviousResponseId(body: unknown, strip: boolean): unknown {
   return rest;
 }
+/**
+ * Hosted tool types whose server-side function names collide with the client tools Codex
+ * declares for the matching app skill. Codex sends BOTH (e.g. hosted `image_generation` plus a
+ * declared `image_gen.imagegen` function/namespace tool for the imagegen skill). The ChatGPT
+ * backend tolerates the pair, but the platform `/v1/responses` rejects it:
+ * `Invalid Value: 'tools'. Function 'image_gen.imagegen' conflicts with a hosted tool in the
+ * same request.` Keyed hosted-type → conflicting client tool-name prefix; the hosted entry is
+ * dropped (the declared tool wins — Codex executes the skill client-side either way).
+ */
+const HOSTED_TOOL_NAME_CONFLICTS: ReadonlyArray<{ hostedType: string; namePrefix: string }> = [
+  { hostedType: "image_generation", namePrefix: "image_gen" },
+];
+/**
+ * Drop hosted tools whose names collide with declared function/namespace tools (see
+ * HOSTED_TOOL_NAME_CONFLICTS). Only applies on the API-key platform path: the ChatGPT backend
+ * ("forward" mode) accepts the pair, and stripping there would disable native imagegen. No-op
+ * (returns the original reference) when nothing matches.
+ */
+function stripConflictingHostedTools(body: unknown): unknown {
+  if (!isPlainObject(body) || !Array.isArray(body.tools)) return body;
+  const allTools = body.tools;
+  const conflicting = HOSTED_TOOL_NAME_CONFLICTS.filter(c =>
+    allTools.some(t => {
+      if (!isPlainObject(t) || typeof t.name !== "string") return false;
+      if (t.type === "namespace") return t.name === c.namePrefix;
+      return t.name === c.namePrefix || t.name.startsWith(`${c.namePrefix}.`);
+    }),
+  );
+  if (conflicting.length === 0) return body;
+  const tools = allTools.filter(t => {
+    const type = isPlainObject(t) && typeof t.type === "string" ? t.type : undefined;
+    if (!type) return true;
+    return !conflicting.some(c => c.hostedType === type);
+  });
+  return tools.length === allTools.length ? body : { ...body, tools };
+}
 /**
  * Remove hosted tool entries the target native slug rejects, so the OAuth-passthrough body never
  * carries a tool the upstream model 400s on. No-op (returns the original reference) when nothing
@@ -236,6 +277,7 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
         forward || parsed._previousResponseInputExpanded === true,
       );
       if (forward) outBody = repairOrphanedInputItems(outBody, unexpandedMiss);
+      else outBody = stripConflictingHostedTools(outBody);
       return {
         url,
         method: "POST",

package/src/codex/catalog.ts CHANGED Viewed

@@ -569,6 +569,18 @@ function codexCommandCandidates(): string[] {
   return unique(candidates);
 }
+/**
+ * Windows probe guard: only PE/batch launchers can be spawned as processes. Anything
+ * else pulled from the shim state (the extensionless Git-Bash sh backup
+ * `codex.opencodex-real`, `.ps1` scripts) risks falling through to the cmd/ShellExecute
+ * document-association path — Windows then OPENS the file in the user's editor
+ * (e.g. VS Code) on every `codex` launch instead of executing it.
+ */
+export function isSpawnableCodexCandidate(path: string, platform: NodeJS.Platform = process.platform): boolean {
+  if (platform !== "win32") return true;
+  return /\.(cmd|bat|exe|com)$/i.test(path);
+}
 function codexShimCommandCandidates(): string[] {
   try {
     const state = JSON.parse(readFileSync(join(getConfigDir(), "codex-shim.json"), "utf8")) as {
@@ -582,7 +594,7 @@ function codexShimCommandCandidates(): string[] {
     for (const file of files) {
       for (const value of [file.backupPath, file.originalPath, file.wrapperPath]) {
         if (typeof value !== "string" || value.length === 0) continue;
-        if (process.platform === "win32" && value.toLowerCase().endsWith(".ps1")) continue;
+        if (!isSpawnableCodexCandidate(value)) continue;
         out.push(value);
       }
     }

package/src/providers/registry.ts CHANGED Viewed

@@ -459,6 +459,10 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     modelReasoningEfforts: Object.fromEntries(DEEPSEEK_THINKING_MODELS.map(id => [id, DEEPSEEK_THINKING_EFFORTS])),
     modelReasoningEffortMap: Object.fromEntries(DEEPSEEK_THINKING_MODELS.map(id => [id, DEEPSEEK_THINKING_REASONING_MAP])),
     preserveReasoningContentModels: DEEPSEEK_THINKING_MODELS,
+    // Issue #88: every DeepSeek API model is text-only input (no image support upstream) — the
+    // vision sidecar describes attached images for them, and the catalog advertises image input
+    // on their behalf (same treatment as opencode-go's DeepSeek V4 entries above).
+    noVisionModels: ["deepseek-chat", "deepseek-reasoner", ...DEEPSEEK_THINKING_MODELS],
   },
   // llama-3.3-70b was deprecated by Cerebras on 2026-02-16. Evidence: devlog/_plan/260710_provider_hardening/003_research_aggregators.md.
   { id: "cerebras", label: "Cerebras", baseUrl: "https://api.cerebras.ai/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://cloud.cerebras.ai/platform/apikeys", defaultModel: "gpt-oss-120b" },

package/src/reasoning-effort.ts CHANGED Viewed

@@ -19,6 +19,11 @@ export function isCodexReasoningEffort(effort: string): boolean {
   return CODEX_REASONING_SET.has(effort);
 }
+/** Position of `effort` in the Codex ladder (low=0 .. ultra=5), or -1 when not a ladder member. */
+export function codexEffortRank(effort: string): number {
+  return CODEX_REASONING_ORDER.indexOf(effort);
+}
 export function modelRecordValue<T>(record: Record<string, T> | undefined, modelId: string): T | undefined {
   if (!record) return undefined;
   if (Object.prototype.hasOwnProperty.call(record, modelId)) return record[modelId];

package/src/server/effort-policy.ts ADDED Viewed

@@ -0,0 +1,172 @@
+/**
+ * Hard reasoning-effort caps (devlog/260710_subagent_effort_intercept).
+ *
+ * Prompt-side effort designation (injectionEffort) is advisory only: codex-rs inherits the
+ * parent's effective effort when spawn_agent carries no model/effort args
+ * (multi_agents_common.rs resolve defaults), rejects overrides on full-history forks, and a
+ * non-empty agent-role file rebuilds the child Config and silently drops spawn-time
+ * model/effort. So a session whose config default is ultra leaks max-tier children whenever
+ * the parent model spawns bare. This module is the enforcement path: it rewrites the effort
+ * of proxied turns at the single choke point every HTTP/WS turn passes through
+ * (handleResponses), using the same dual-shape rewrite contract as nativeEffortClamp —
+ * parsed.options.reasoning feeds routed adapters, _rawBody.reasoning.effort feeds the
+ * ChatGPT passthrough serializer.
+ */
+import type { OcxConfig, OcxParsedRequest, OcxProviderConfig } from "../types";
+import { modelInList } from "../types";
+import { codexEffortRank, configuredReasoningEfforts, isCodexReasoningEffort, modelRecordValue } from "../reasoning-effort";
+import { catalogModelEfforts } from "../codex/catalog";
+/**
+ * True when the request carries codex-rs's spawned-child markers, matched EXACTLY.
+ * Source of truth (openai/codex @ 6138909d): every collab-spawned child turn sends
+ * `x-openai-subagent: collab_spawn` (core/src/responses_metadata.rs) and embeds
+ * `"subagent_kind":"thread_spawn"` in the JSON `x-codex-turn-metadata` compatibility
+ * header. Both are checked: the WS bridge rebuilds internal requests from the
+ * FORWARD_HEADERS allowlist, so either header alone is sufficient evidence.
+ *
+ * Exact matching matters: upstream emits `x-openai-subagent` for OTHER internal
+ * turn categories too (review, compact, memory_consolidation, arbitrary "other"
+ * sources — responses_metadata.rs subagent_source). Those are maintenance turns,
+ * not spawned children, and must never trip subagentEffortCap.
+ */
+export function isThreadSpawnRequest(headers: Headers): boolean {
+  if (headers.get("x-openai-subagent") === "collab_spawn") return true;
+  const turnMeta = headers.get("x-codex-turn-metadata");
+  if (!turnMeta) return false;
+  try {
+    const parsed = JSON.parse(turnMeta) as { subagent_kind?: unknown };
+    return parsed.subagent_kind === "thread_spawn";
+  } catch {
+    return false;
+  }
+}
+/** The effective ceiling for this turn, or undefined when no configured cap applies. */
+export function effortCapFor(config: OcxConfig, subagent: boolean): string | undefined {
+  const caps: string[] = [];
+  if (config.effortCap && isCodexReasoningEffort(config.effortCap)) caps.push(config.effortCap);
+  if (subagent && config.subagentEffortCap && isCodexReasoningEffort(config.subagentEffortCap)) {
+    caps.push(config.subagentEffortCap);
+  }
+  if (caps.length === 0) return undefined;
+  return caps.reduce((low, cap) => (codexEffortRank(cap) < codexEffortRank(low) ? cap : low));
+}
+/**
+ * Whether the effort caps apply to this turn at all. Caps are a V2-surface feature
+ * (v1 sub-agents are pinned via explicit spawn args + injectionEffort prompting, so
+ * the ultra-default leak this module intercepts is v2-specific):
+ *  - compaction turns are maintenance, not agent turns: they bypass caps entirely so
+ *    native /v1/responses/compact (forwarded, never enters handleResponses) and routed
+ *    compaction (synthesized internal request) get identical cap semantics.
+ *  - multiAgentMode "v1" disables caps entirely (mirrors the GUI hiding the panel).
+ *  - a main turn qualifies when its own tool list carries the v2 collab surface.
+ *  - a CHILD turn is admitted by its spawned-child markers (isThreadSpawnRequest)
+ *    REGARDLESS of tool surface: depth-limited leaves carry no collab tools (surface
+ *    null) while children below the spawn-depth limit retain collab tools (spec_plan.rs
+ *    leaf guard), so tool sniffing alone would cap siblings inconsistently.
+ *  - a v1-surface MAIN turn (no child markers) never qualifies.
+ */
+export function effortCapAppliesTo(
+  surface: "v1" | "v2" | null,
+  headers: Headers,
+  config: OcxConfig,
+  compaction = false,
+): boolean {
+  if (compaction) return false;
+  if (config.multiAgentMode === "v1") return false;
+  return surface === "v2" || isThreadSpawnRequest(headers);
+}
+/**
+ * The routed model's supported effort ladder for cap resolution, from the ROUTE's
+ * registry-merged provider (router.ts routedProviderConfig) — the persisted
+ * config.providers entry misses registry seeds, and bare ids can route via
+ * defaultModel/model-list/default-provider, so no "/" heuristic anywhere.
+ *
+ * - `[]`   -> the model intentionally exposes no effort control (noReasoningModels or
+ *             an explicitly empty configured ladder): cap resolution strips.
+ * - list   -> sanitized + healed ladder (configuredReasoningEfforts).
+ * - undefined -> unknown. Includes the raw-nonempty-but-non-rankable case (e.g. a
+ *             thinking-toggle ladder of ["enabled"]): sanitizing would flatten it to []
+ *             and mis-classify it as "no effort control", so it stays unknown.
+ *
+ * Catalog fallback fires only for the ChatGPT-backend native passthrough IDENTITY
+ * (adapter "openai-responses" + authMode "forward", the fresh-install `openai`
+ * provider shape): the injected catalog is authoritative exactly for models Codex
+ * validates against that backend. A custom responses provider (key mode) serving a
+ * native-looking bare id must NOT inherit the unrelated native ladder.
+ */
+export function supportedLadderFor(route: { provider: OcxProviderConfig; modelId: string }): string[] | undefined {
+  const { provider, modelId } = route;
+  if (modelInList(provider.noReasoningModels, modelId)) return [];
+  const raw = modelRecordValue(provider.modelReasoningEfforts, modelId) ?? provider.reasoningEfforts;
+  if (raw !== undefined) {
+    const sanitized = configuredReasoningEfforts(provider, modelId) ?? [];
+    if (sanitized.length === 0 && raw.length > 0) return undefined;
+    return sanitized;
+  }
+  if (provider.adapter === "openai-responses" && provider.authMode === "forward") {
+    const efforts = catalogModelEfforts([modelId]).get(modelId);
+    if (efforts && efforts.length > 0) return efforts;
+  }
+  return undefined;
+}
+/**
+ * Resolve the configured cap against the model's supported ladder. Returns the effective
+ * ceiling rung, or null when the turn must be STRIPPED of its effort entirely. The cap
+ * NEVER raises: when rankable rungs exist but none sits at or below the cap, the model
+ * cannot run within the ceiling, so the effort is stripped and the provider default
+ * applies (never a rung above the cap).
+ */
+export function resolveCappedEffort(cap: string, supported: readonly string[] | undefined): string | null {
+  if (supported === undefined) return cap;
+  const rankable = supported.filter(isCodexReasoningEffort);
+  if (rankable.length === 0) {
+    // Nonempty but non-rankable (e.g. ["enabled"]) -> unknown ladder, cap as-is.
+    // Genuinely empty -> no effort control at all -> strip.
+    return supported.length > 0 ? cap : null;
+  }
+  const capRank = codexEffortRank(cap);
+  let best: string | null = null;
+  for (const rung of rankable) {
+    const rank = codexEffortRank(rung);
+    if (rank <= capRank && (best === null || rank > codexEffortRank(best))) best = rung;
+  }
+  return best;
+}
+/**
+ * Cap the turn's reasoning effort in BOTH request shapes. Non-strip resolution only
+ * lowers: efforts at or below the resolved ceiling (and non-ladder/absent efforts) pass
+ * untouched. Strip resolution (model exposes no effort control, or no supported rung
+ * fits under the cap) removes whatever effort is present — regardless of its rank —
+ * from both shapes while preserving `reasoning.summary`. Returns the applied rewrite
+ * for request-log annotation (`to: "none"` on strip), or null when nothing changed.
+ */
+export function applyEffortCap(
+  parsed: OcxParsedRequest,
+  headers: Headers,
+  config: OcxConfig,
+  supported?: readonly string[] | undefined,
+): { from: string; to: string; subagent: boolean } | null {
+  const subagent = isThreadSpawnRequest(headers);
+  const cap = effortCapFor(config, subagent);
+  if (!cap) return null;
+  const resolved = resolveCappedEffort(cap, supported);
+  const requested = parsed.options.reasoning;
+  const raw = parsed._rawBody as { reasoning?: { effort?: string } } | undefined;
+  if (resolved === null) {
+    if (!requested) return null;
+    parsed.options.reasoning = undefined;
+    if (raw?.reasoning && typeof raw.reasoning === "object") delete raw.reasoning.effort;
+    return { from: requested, to: "none", subagent };
+  }
+  if (!requested || !isCodexReasoningEffort(requested)) return null;
+  if (codexEffortRank(requested) <= codexEffortRank(resolved)) return null;
+  parsed.options.reasoning = resolved;
+  if (raw?.reasoning && typeof raw.reasoning === "object") raw.reasoning.effort = resolved;
+  return { from: requested, to: resolved, subagent };
+}

package/src/server/index.ts CHANGED Viewed

@@ -118,6 +118,7 @@ export {
 import { disableResponsesRequestTimeout, handleResponses, handleResponsesCompact } from "./responses";
 export { disableResponsesRequestTimeout, linkAbortSignal } from "./responses";
 import { handleImages } from "./images";
+import { handleSearch } from "./search";
 import { fetchAllModels, handleManagementAPI, VERSION } from "./management-api";
 const MAX_WS_FRAME_BYTES = 50 * 1024 * 1024;
@@ -331,6 +332,33 @@ export function startServer(port?: number) {
         return withCors(response, req, config);
       }
+      if (url.pathname === "/v1/alpha/search" && req.method === "POST") {
+        disableResponsesRequestTimeout(req, requestServer);
+        if (isDraining()) {
+          return new Response("Service shutting down", {
+            status: 503,
+            headers: { ...corsHeaders(req, config), "Retry-After": "5" },
+          });
+        }
+        const apiAuthError = requireApiAuth(req, config, "data-plane");
+        if (apiAuthError) return withCors(apiAuthError, req, config);
+        if (!isAllowedRequestOrigin(req, config)) {
+          return withCors(formatErrorResponse(403, "origin_rejected", "cross-origin data-plane request blocked"), req, config);
+        }
+        const start = Date.now();
+        const requestId = nextRequestLogId(start);
+        const logCtx: RequestLogContext = { model: "web_search", provider: "unknown" };
+        const response = await handleSearch(req, config, logCtx);
+        addFinalRequestLog(
+          requestId,
+          start,
+          logCtx,
+          response.status,
+          response.status === 499 ? { closeReason: "client_cancel" } : undefined,
+        );
+        return withCors(response, req, config);
+      }
       if (url.pathname === "/v1/responses" && req.method === "POST") {
         disableResponsesRequestTimeout(req, requestServer);
         if (isDraining()) {
@@ -370,7 +398,7 @@ export function startServer(port?: number) {
       // Data-plane guard: unknown /v1/* paths must fail with JSON 404, never fall through to the
       // GUI static handler (extensionless paths would get index.html with HTTP 200 and codex-rs
-      // endpoint clients — alpha/search, memories/*, realtime/* — would surface confusing
+      // endpoint clients — memories/*, realtime/* — would surface confusing
       // serde decode errors instead of a clean not-found).
       if (url.pathname.startsWith("/v1/")) {
         return withCors(formatErrorResponse(404, "not_found", `Unknown endpoint: ${req.method} ${url.pathname}`), req, config);

package/src/server/management-api.ts CHANGED Viewed

@@ -572,6 +572,34 @@ export async function handleManagementAPI(req: Request, url: URL, config: OcxCon
     return jsonResponse({ ok: true, model: config.injectionModel ?? null, effort: config.injectionEffort ?? null, prompt: config.injectionPrompt ?? null });
   }
+  // Hard reasoning-effort caps (devlog/260710_subagent_effort_intercept): a global ceiling and a
+  // sub-agent-only ceiling, enforced per-request in handleResponses (src/server/effort-policy.ts).
+  // Key semantics per field: absent -> unchanged; null/"" -> clear; ladder value -> set; else 400.
+  if (url.pathname === "/api/effort-caps" && req.method === "GET") {
+    const { CODEX_REASONING_LEVELS } = await import("../reasoning-effort");
+    return jsonResponse({
+      effortCap: config.effortCap ?? null,
+      subagentEffortCap: config.subagentEffortCap ?? null,
+      efforts: CODEX_REASONING_LEVELS.map(l => l.effort),
+    });
+  }
+  if (url.pathname === "/api/effort-caps" && req.method === "PUT") {
+    let body: { effortCap?: unknown; subagentEffortCap?: unknown };
+    try { body = await req.json(); } catch { return jsonResponse({ error: "invalid JSON body" }, 400); }
+    const { isCodexReasoningEffort } = await import("../reasoning-effort");
+    for (const key of ["effortCap", "subagentEffortCap"] as const) {
+      if (!(key in body)) continue;
+      const value = body[key];
+      if (value === null || value === "") { delete config[key]; continue; }
+      if (typeof value !== "string" || !isCodexReasoningEffort(value)) {
+        return jsonResponse({ error: `unknown reasoning effort "${String(value)}"` }, 400);
+      }
+      config[key] = value;
+    }
+    saveConfig(config);
+    return jsonResponse({ ok: true, effortCap: config.effortCap ?? null, subagentEffortCap: config.subagentEffortCap ?? null });
+  }
   // Subagent model picker: which ≤5 routed models Codex's spawn_agent advertises (it shows the
   // first 5 routed catalog entries). PUT reorders the injected catalog so the chosen ones lead.
   if (url.pathname === "/api/subagent-models" && req.method === "GET") {

package/src/server/responses.ts CHANGED Viewed

@@ -470,6 +470,33 @@ export async function handleResponses(
     }
   }
+  // Hard effort caps (effortCap / subagentEffortCap): enforcement companion to the advisory
+  // injection above — spawn-arg prompting cannot stop codex-rs from inheriting the parent's
+  // ultra-tier default on bare spawns (see src/server/effort-policy.ts). Runs BEFORE the
+  // mock-max clamp so a capped effort is what nativeness clamping then validates; rewrites
+  // both request shapes (same dual-write contract as the clamp below).
+  // GATE: v2 feature only (effortCapAppliesTo) — v2-surface main turns plus header-marked
+  // child turns admitted regardless of tool surface (depth-limited leaves carry no collab
+  // tools while shallower children do, so tool sniffing alone would cap siblings
+  // inconsistently); multiAgentMode "v1" disables caps entirely; compaction turns bypass
+  // caps so routed compaction matches native /v1/responses/compact (which never enters
+  // handleResponses).
+  {
+    const { applyEffortCap, effortCapAppliesTo, supportedLadderFor } = await import("./effort-policy");
+    const surface = collabSurface(parsed);
+    if (effortCapAppliesTo(surface, req.headers, config, parsed._compactionRequest === true)) {
+      const capped = applyEffortCap(parsed, req.headers, config, supportedLadderFor(route));
+      if (capped) {
+        logCtx.requestedEffort = `${capped.from}->${capped.to}`;
+        if (isInjectionDebugEnabled()) {
+          console.log(`[opencodex] ${route.modelId}: effort cap applied (${capped.from} -> ${capped.to}, ${capped.subagent ? "sub-agent" : "main"} turn)`);
+        }
+      }
+    } else if (isInjectionDebugEnabled() && (config.effortCap || config.subagentEffortCap)) {
+      console.log(`[opencodex] ${route.modelId}: effort cap skipped (surface=${surface ?? "none"}, v2 feature only)`);
+    }
+  }
   // Mock-max clamp: native models whose real ladder stops below max (gpt-5.5/5.4/…)
   // receive `max` when the user picks Ultra (codex converts ultra->max client-side).
   // Clamp to the model's highest real effort BEFORE any adapter — the ChatGPT

package/src/server/search.ts ADDED Viewed

@@ -0,0 +1,150 @@
+/**
+ * /v1/alpha/search relay.
+ *
+ * codex-rs's built-in search client executes CLIENT-SIDE: it POSTs `alpha/search` against the
+ * configured base_url with the same ChatGPT bearer auth used for model requests. Under Design B
+ * injection base_url is this proxy, so the request otherwise dies on the /v1/* JSON-404 guard.
+ * The endpoint is private to the ChatGPT Codex backend, so routed providers and OpenAI API-key
+ * providers cannot serve it. Relay the JSON request and response verbatim through the configured
+ * ChatGPT forward provider.
+ */
+import { formatErrorResponse } from "../bridge";
+import {
+  CodexAccountCooldownError,
+  CodexAuthContextError,
+  CodexThreadAffinityExpiredError,
+  headersForCodexAuthContext,
+  isCodexAuthContextUsable,
+  resolveCodexAuthContext,
+} from "../codex/auth-context";
+import { formatCodexProviderForLog } from "../codex/routing";
+import { signalWithTimeout } from "../lib/abort";
+import { sidecarEnter } from "../lib/sidecar-tracker";
+import type { OcxConfig, OcxProviderConfig } from "../types";
+import { isProxyAdmissionSecret } from "./auth-cors";
+import { readJsonRequestBody } from "./request-decompress";
+import type { RequestLogContext } from "./request-log";
+import { codexLogAccountId, decodeRequestErrorResponse, sidecarOutcomeRecorder } from "./responses";
+/**
+ * Default TOTAL deadline for one search relay. alpha/search is non-streaming JSON — response
+ * headers arrive only when the search finishes — so the budget must cover the whole request.
+ * Overridable via config.search.timeoutMs; never config.connectTimeoutMs, whose documented
+ * contract is the DNS/TCP/TLS/header-arrival budget (a 10s connect budget would kill every
+ * long-running search).
+ */
+const SEARCH_UPSTREAM_TIMEOUT_MS = 200_000;
+const SEARCH_RESPONSE_MAX_BYTES = 16 * 1024 * 1024;
+interface NamedProvider {
+  name: string;
+  provider: OcxProviderConfig;
+}
+function findSearchUpstream(config: OcxConfig): NamedProvider | undefined {
+  for (const [name, provider] of Object.entries(config.providers)) {
+    if (provider.disabled !== true && provider.authMode === "forward") return { name, provider };
+  }
+  return undefined;
+}
+export async function handleSearch(
+  req: Request,
+  config: OcxConfig,
+  logCtx: RequestLogContext,
+): Promise<Response> {
+  let body: unknown;
+  try {
+    body = await readJsonRequestBody(req);
+  } catch (err) {
+    return decodeRequestErrorResponse(err, "search");
+  }
+  const model = (body as { model?: unknown } | null)?.model;
+  if (typeof model === "string" && model) logCtx.model = model;
+  const upstream = findSearchUpstream(config);
+  if (!upstream) {
+    return formatErrorResponse(
+      400,
+      "invalid_request_error",
+      "Built-in web search needs a ChatGPT forward provider, but none is configured in opencodex. "
+      + "Routed and OpenAI API-key providers cannot serve /v1/alpha/search.",
+    );
+  }
+  let authHeaders: Headers;
+  let recordOutcome: ReturnType<typeof sidecarOutcomeRecorder>;
+  try {
+    const authCtx = await resolveCodexAuthContext(req.headers, config);
+    if (!isCodexAuthContextUsable(authCtx, config)) {
+      return formatErrorResponse(401, "authentication_error", "Selected Codex account needs reauthentication");
+    }
+    authHeaders = headersForCodexAuthContext(req.headers, authCtx);
+    const bearer = authHeaders.get("authorization")?.replace(/^Bearer\s+/i, "") ?? "";
+    if (bearer && isProxyAdmissionSecret(bearer, config)) authHeaders.delete("authorization");
+    if (!authHeaders.get("authorization")) {
+      return formatErrorResponse(
+        401,
+        "authentication_error",
+        "web search relay needs ChatGPT auth (Authorization header)",
+      );
+    }
+    recordOutcome = sidecarOutcomeRecorder(config, authCtx);
+    logCtx.provider = formatCodexProviderForLog(upstream.name, codexLogAccountId(authCtx), config);
+  } catch (err) {
+    if (err instanceof CodexAccountCooldownError) {
+      return formatErrorResponse(429, "rate_limit_error", "Selected Codex account is cooling down");
+    }
+    if (err instanceof CodexThreadAffinityExpiredError) {
+      return formatErrorResponse(409, "invalid_request_error", "Codex thread account affinity expired; start a new session");
+    }
+    if (err instanceof CodexAuthContextError) {
+      const safeAccountLabel = formatCodexProviderForLog(upstream.name, err.accountId, config);
+      console.error(`[search] Pool account ${safeAccountLabel} token failed; reauthentication required`);
+      return formatErrorResponse(401, "authentication_error", "Selected Codex account needs reauthentication");
+    }
+    throw err;
+  }
+  const headers: Record<string, string> = { "content-type": "application/json" };
+  if (upstream.provider.headers) Object.assign(headers, upstream.provider.headers);
+  for (const [name, value] of authHeaders) headers[name] = value;
+  const url = `${upstream.provider.baseUrl}/alpha/search`;
+  const timeoutMs = config.search?.timeoutMs ?? SEARCH_UPSTREAM_TIMEOUT_MS;
+  const linkedSignal = signalWithTimeout(timeoutMs, req.signal);
+  const sidecarExit = sidecarEnter("search");
+  try {
+    const upstreamResponse = await fetch(url, {
+      method: "POST",
+      headers,
+      body: JSON.stringify(body),
+      signal: linkedSignal.signal,
+    });
+    const payload = await upstreamResponse.arrayBuffer();
+    if (payload.byteLength > SEARCH_RESPONSE_MAX_BYTES) {
+      return formatErrorResponse(502, "upstream_error", `search response too large (${payload.byteLength} bytes)`);
+    }
+    recordOutcome?.(upstreamResponse.status);
+    const relayHeaders: Record<string, string> = {};
+    const contentType = upstreamResponse.headers.get("content-type");
+    if (contentType) relayHeaders["content-type"] = contentType;
+    return new Response(payload, { status: upstreamResponse.status, headers: relayHeaders });
+  } catch (err) {
+    if (req.signal.aborted) {
+      return formatErrorResponse(499, "client_closed_request", "search request canceled by client");
+    }
+    if (err instanceof Error && err.name === "TimeoutError") {
+      recordOutcome?.("timeout");
+      return formatErrorResponse(504, "upstream_error", "search upstream timed out");
+    }
+    recordOutcome?.("connect_error");
+    return formatErrorResponse(
+      502,
+      "upstream_error",
+      `search relay failed: ${err instanceof Error ? err.message : String(err)}`,
+    );
+  } finally {
+    sidecarExit();
+    linkedSignal.cleanup();
+  }
+}

package/src/types.ts CHANGED Viewed

@@ -259,6 +259,20 @@ export interface OcxConfig {
    * the resolved sub-agent roster block ("" when nothing resolves).
    */
   injectionPrompt?: string;
+  /**
+   * Global hard ceiling for the reasoning effort of EVERY proxied turn (main agent AND
+   * sub-agents). Ladder value "low".."max"; incoming efforts ranking above it are rewritten
+   * in both request shapes before any adapter or clamp. Unset = no cap. codex-rs converts
+   * ultra -> max client-side, so e.g. a "high" cap sends ultra/max-tier turns as high.
+   */
+  effortCap?: string;
+  /**
+   * Hard ceiling applied ONLY to sub-agent turns — requests carrying codex-rs's spawned-child
+   * markers (`x-openai-subagent` header, or `subagent_kind` inside `x-codex-turn-metadata`).
+   * Lets the main agent keep its tier while delegated children are capped. When both caps are
+   * set, the lower one wins for sub-agents. See src/server/effort-policy.ts.
+   */
+  subagentEffortCap?: string;
   /**
    * Models hidden from Codex. Routed ids are namespaced ("<provider>/<model>") and are excluded
    * from the catalog + /v1/models entirely. BARE ids (no "/") are native GPT passthrough slugs:
@@ -314,6 +328,8 @@ export interface OcxConfig {
   visionSidecar?: OcxVisionSidecarConfig;
   /** /v1/images relay for codex's built-in image_gen tool. */
   images?: OcxImagesConfig;
+  /** /v1/alpha/search relay for codex's built-in web search client. */
+  search?: OcxSearchConfig;
   /** Codex multi-account pool. */
   codexAccounts?: CodexAccount[];
   /** Active pool account id for next session. undefined = main (passthrough as-is). */
@@ -364,6 +380,15 @@ export interface OcxImagesConfig {
   timeoutMs?: number;
 }
+export interface OcxSearchConfig {
+  /**
+   * Total upstream deadline (ms) for one /v1/alpha/search relay. Default 200000. The endpoint
+   * is non-streaming JSON (headers arrive only when the search completes), so this is a whole-
+   * request budget — deliberately NOT connectTimeoutMs, which is a header-arrival budget.
+   */
+  timeoutMs?: number;
+}
 export interface OcxVisionSidecarConfig {
   /** Master switch. Default: enabled when a forward (ChatGPT) provider exists and the caller is logged in. */
   enabled?: boolean;