@bitkyc08/opencodex 2.78.0 → 2.80.0

package/src/lib/gui-pair-intent.ts

@@ -0,0 +1,170 @@
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { closeSync, constants, fstatSync, lstatSync, mkdirSync, openSync, readdirSync, readSync, rmdirSync, unlinkSync, writeFileSync, type BigIntStats } from "node:fs";
+import { join } from "node:path";
+import { getConfigDir } from "../config/paths";
+import { assertNotRealHomeUnderTest } from "./test-home-guard";
+import { forgetEphemeralSecretPath, hardenSecretDir, hardenSecretPath, windowsSecretAclApplies } from "./windows-secret-acl";
+
+import { verifyWindowsPrivateEntries, WINDOWS_OWNER_ACL_TIMEOUT_MS } from "./windows-owner-acl";
+
+export const GUI_PAIR_INTENT_HEADER = "x-opencodex-gui-pair-intent";
+const TOKEN = /^[A-Za-z0-9_-]{43}$/;
+const INTENT_NAME = /^[0-9a-f]{64}$/;
+// Records outlive their ~10s capability only when the publishing CLI died; a wide
+// margin keeps an active command's fresh record from ever looking stale.
+const STALE_INTENT_MS = 60_000;
+const STALE_INTENT_SWEEP_LIMIT = 256;
+const digest = (value: string) => createHash("sha256").update(value).digest("hex");
+
+function owned(stat: BigIntStats): boolean {
+  return process.platform === "win32" || (stat.uid === BigInt(process.getuid!()) && (stat.mode & 0o022n) === 0n);
+}
+function same(a: BigIntStats, b: BigIntStats): boolean {
+  return a.dev === b.dev && a.ino === b.ino && a.ctimeNs === b.ctimeNs;
+}
+function directory(path: string): BigIntStats {
+  const stat = lstatSync(path, { bigint: true });
+  if (!stat.isDirectory() || stat.isSymbolicLink() || !owned(stat)) throw new Error("Unsafe GUI pairing intent directory");
+  return stat;
+}
+function location(capability: string, configDir: string): { dir: string; path: string } {
+  if (!TOKEN.test(capability)) throw new Error("Invalid GUI pairing capability");
+  const dir = join(configDir, "gui-pair-intents");
+  return { dir, path: join(dir, digest(`opencodex-gui-pair-intent-v1\n${capability}`)) };
+}
+function releaseConsumeLock(path: string, identity: BigIntStats): boolean {
+  try {
+    if (!same(identity, lstatSync(path, { bigint: true }))) return false;
+    rmdirSync(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function removeOwned(path: string, identity: BigIntStats): void {
+  try {
+    if (same(identity, lstatSync(path, { bigint: true }))) unlinkSync(path);
+  } catch { /* expired or already consumed; never remove a replacement */ }
+  forgetEphemeralSecretPath(path);
+}
+
+/** Best-effort stale cleanup; bound per-entry work before creating the next expiring intent. */
+function sweepStaleIntents(dir: string): void {
+  let names: string[];
+  try { names = readdirSync(dir); } catch { return; }
+  const now = Date.now();
+  // Count every entry, including foreign and fresh ones, rather than only successful deletes.
+  // This caps metadata/deletion work, not readdirSync's array allocation or syscall duration.
+  // Bun 1.4.0 also snapshots names behind opendirSync, so an iterator alone is not a memory cap.
+  const limit = Math.min(names.length, STALE_INTENT_SWEEP_LIMIT);
+  for (let index = 0; index < limit; index++) {
+    const name = names[index]!;
+    if (!INTENT_NAME.test(name)) continue;
+    const path = join(dir, name);
+    try {
+      const stat = lstatSync(path, { bigint: true });
+      if (!stat.isFile() || stat.isSymbolicLink() || !owned(stat) || stat.nlink !== 1n) continue;
+      if (now - Number(stat.mtimeMs) < STALE_INTENT_MS) continue;
+      removeOwned(path, stat);
+    } catch { /* leave unreadable entries alone */ }
+  }
+}
+
+export interface GuiPairIntent {
+  proof: string;
+  dispose(): void;
+}
+
+/**
+ * Prove write access to the private configuration home, separately from runtime-state reads.
+ * Only a SHA-256 commitment goes to disk; the random verifier remains in the requesting CLI.
+ * This is an owner-write boundary, NOT proof of human presence or protection from a fully
+ * privileged same-user process. The existing HMAC binds PID, port, origin, nonce and expiry.
+ */
+export function createGuiPairIntent(capability: string, configDir = getConfigDir()): GuiPairIntent {
+  assertNotRealHomeUnderTest(configDir);
+  directory(configDir);
+  const { dir, path } = location(capability, configDir);
+  try { mkdirSync(dir, { mode: 0o700 }); }
+  catch (error) { if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error; }
+  directory(dir);
+  if (!hardenSecretDir(dir, { required: true, deadlineMs: 2_000 }).ok) throw new Error("GUI pairing intent ACL refused");
+  sweepStaleIntents(dir);
+  const parent = directory(dir);
+  const proof = randomBytes(32).toString("base64url");
+  const fd = openSync(path, "wx", 0o600);
+  let identity = fstatSync(fd, { bigint: true });
+  try {
+    writeFileSync(fd, `${digest(proof)}\n`, "utf8");
+    if (!hardenSecretPath(path, { required: true, deadlineMs: 2_000 }).ok) throw new Error("GUI pairing intent ACL refused");
+    identity = fstatSync(fd, { bigint: true });
+    if (!same(identity, lstatSync(path, { bigint: true })) || !owned(identity)
+      || identity.nlink !== 1n || parent.dev !== directory(dir).dev || parent.ino !== directory(dir).ino) {
+      throw new Error("GUI pairing intent changed during publication");
+    }
+  } catch (error) {
+    identity = fstatSync(fd, { bigint: true });
+    closeSync(fd);
+    removeOwned(path, identity);
+    throw error;
+  }
+  closeSync(fd);
+  // Disposal consumes the record: the same directory, identity and content checks as
+  // redemption, so a corrupted or replaced commitment is retained on every platform.
+  const dispose = (): void => { consumeGuiPairIntent(capability, proof, configDir); };
+  return { proof, dispose };
+}
+
+/** Called only after the existing process-bound, expiring capability passed authorization. */
+export function consumeGuiPairIntent(capability: string | null, proof: string | null, configDir = getConfigDir()): boolean {
+  if (!capability || !proof || !TOKEN.test(capability) || !TOKEN.test(proof)) return false;
+  let fd: number | undefined;
+  let consumeLock: string | undefined;
+  let consumeLockIdentity: BigIntStats | undefined;
+  try {
+    assertNotRealHomeUnderTest(configDir);
+    directory(configDir);
+    const { dir, path } = location(capability, configDir);
+    const parent = directory(dir);
+    consumeLock = `${path}.consuming`;
+    mkdirSync(consumeLock, { mode: 0o700 });
+    consumeLockIdentity = directory(consumeLock);
+    const lockedParent = directory(dir);
+    if (parent.dev !== lockedParent.dev || parent.ino !== lockedParent.ino) return false;
+    const before = lstatSync(path, { bigint: true });
+    if (!before.isFile() || before.isSymbolicLink() || !owned(before) || before.nlink !== 1n || before.size !== 65n) return false;
+    // Do not block on a substituted FIFO. Windows retains descriptor/path identity checks.
+    const flags = constants.O_RDONLY | (process.platform === "win32" ? 0 : constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    fd = openSync(path, flags);
+    const opened = fstatSync(fd, { bigint: true });
+    if (!same(before, opened) || !opened.isFile()) return false;
+    const bytes = Buffer.alloc(66);
+    const size = readSync(fd, bytes, 0, bytes.length, 0);
+    if (size !== 65 || !timingSafeEqual(bytes.subarray(0, size), Buffer.from(`${digest(proof)}\n`))) return false;
+    const after = fstatSync(fd, { bigint: true });
+    if (!same(opened, after) || !same(after, lstatSync(path, { bigint: true }))
+      || parent.dev !== directory(dir).dev || parent.ino !== directory(dir).ino) return false;
+    closeSync(fd); fd = undefined;
+    // Verify only a matching commitment, with its descriptor closed and lock held.
+    // Redemption must never harden an untrusted record into acceptable authority.
+    if (windowsSecretAclApplies() && !verifyWindowsPrivateEntries([
+      { path: dir, directory: true }, { path, directory: false },
+    ], WINDOWS_OWNER_ACL_TIMEOUT_MS)) return false;
+    const verifiedParent = directory(dir);
+    if (parent.dev !== verifiedParent.dev || parent.ino !== verifiedParent.ino
+      || !same(after, lstatSync(path, { bigint: true }))) return false;
+    unlinkSync(path);
+    forgetEphemeralSecretPath(path);
+    return true;
+  } catch { return false; }
+  finally {
+    try {
+      if (fd !== undefined) closeSync(fd);
+    } finally {
+      if (consumeLock && consumeLockIdentity) {
+        releaseConsumeLock(consumeLock, consumeLockIdentity);
+      }
+    }
+  }
+}

package/src/lib/windows-owner-acl.ts

@@ -0,0 +1,143 @@
+import { resolveTrustedWindowsPowerShellExe } from "./windows-elevation";
+
+export interface WindowsPrivateEntry {
+  path: string;
+  directory: boolean;
+}
+export interface WindowsOwnerAclResult {
+  success: boolean;
+  timedOut: boolean;
+  stdout: string | Uint8Array;
+}
+export type WindowsOwnerAclRunner = (entries: readonly WindowsPrivateEntry[], timeoutMs: number) => WindowsOwnerAclResult;
+
+export const WINDOWS_OWNER_ACL_TIMEOUT_MS = 5_000;
+const SID = /^S-1-\d+(?:-\d+)+$/i;
+const ADMINISTRATORS = "S-1-5-32-544";
+const PRIVILEGED_GRANTEES = new Set(["S-1-5-18", ADMINISTRATORS]); // LocalSystem, BUILTIN\Administrators
+const PRIVATE_DACL_FLAGS = 0x1004; // DiscretionaryAclPresent | DiscretionaryAclProtected
+const FULL_CONTROL = 2032127;
+
+// This script is constant. Literal paths are environment data, never PowerShell source.
+// Read the descriptor through .NET (Owner, Group and Access, as Get-Acl does). Get-Acl is a module-autoloaded
+// cmdlet: PowerShell 5.1 resolves it through the per-profile module analysis cache, and with a fresh or
+// redirected LOCALAPPDATA that rebuild scans every PSModulePath module and can outlast the inspection budget
+// (hosted Windows runners: the pairing CLI timed out at 30 s). Every call below is a .NET member, so nothing
+// autoloads and no module on PSModulePath can shadow the read. GetAccessRules projects away unsupported ACE details, so the
+// ACEs are read from the serialized descriptor instead. .NET canonicalizes it first: compatible entries for the
+// same principal merge and entries that grant nothing drop, but another principal's entry is never folded into
+// the user's, and the owner is untouched. The policy is therefore the effective DACL, not the on-disk bytes.
+const ACL_SCRIPT = String.raw`
+$ErrorActionPreference='Stop'
+try {
+  # ASCII has no preamble, so a UTF-8 console code page cannot prefix the protocol with a BOM.
+  try { [Console]::OutputEncoding=[System.Text.Encoding]::ASCII } catch { $encodingUnchanged=$true }
+  $countText=[Environment]::GetEnvironmentVariable('OCX_ACL_COUNT')
+  if ($countText -notmatch '^[1-9][0-9]*$') { throw 'count' }
+  $count=[int]$countText
+  $identity=[System.Security.Principal.WindowsIdentity]::GetCurrent()
+  $principal=[System.Security.Principal.WindowsPrincipal]::new($identity)
+  $administrators=[System.Security.Principal.SecurityIdentifier]::new('S-1-5-32-544')
+  $enabled=$principal.IsInRole($administrators)
+  [Console]::WriteLine(('U|{0}|{1}|{2}' -f $identity.User.Value,$identity.Owner.Value,$enabled))
+  $sections=[System.Security.AccessControl.AccessControlSections]'Owner,Group,Access'
+  for ($i=0; $i -lt $count; $i++) {
+    $path=[Environment]::GetEnvironmentVariable(('OCX_ACL_PATH_{0}' -f $i))
+    if ([string]::IsNullOrEmpty($path)) { throw 'path' }
+    if ([System.IO.Directory]::Exists($path)) { $acl=[System.Security.AccessControl.DirectorySecurity]::new($path, $sections) }
+    else { $acl=[System.Security.AccessControl.FileSecurity]::new($path, $sections) }
+    $acls=@($acl)
+    if ($acls.Count -ne 1) { throw 'acl' }
+    $bytes=$acls[0].GetSecurityDescriptorBinaryForm()
+    $raw=[System.Security.AccessControl.RawSecurityDescriptor]::new([byte[]]$bytes, 0)
+    $aceCount=-1
+    if ($null -ne $raw.DiscretionaryAcl) { $aceCount=$raw.DiscretionaryAcl.Count }
+    [Console]::WriteLine(('E|{0}|{1}|{2}|{3}' -f $i,$raw.Owner.Value,[int]$raw.ControlFlags,$aceCount))
+    if ($null -ne $raw.DiscretionaryAcl) {
+      foreach ($ace in $raw.DiscretionaryAcl) {
+        if ($ace -is [System.Security.AccessControl.CommonAce]) {
+          [Console]::WriteLine(('A|{0}|{1}|{2}|{3}|{4}|{5}' -f $i,[int]$ace.AceType,[int]$ace.AceFlags,[int]$ace.AccessMask,$ace.SecurityIdentifier.Value,$ace.IsCallback))
+        } else {
+          [Console]::WriteLine(('A|{0}|{1}|X' -f $i,[int]$ace.AceType))
+        }
+      }
+    }
+  }
+  [Console]::WriteLine('END')
+  exit 0
+} catch { exit 3 }
+`;
+const ENCODED_ACL_SCRIPT = Buffer.from(ACL_SCRIPT, "utf16le").toString("base64");
+
+function defaultWindowsOwnerAclRunner(entries: readonly WindowsPrivateEntry[], timeoutMs: number): WindowsOwnerAclResult {
+  const env: Record<string, string | undefined> = { ...process.env, OCX_ACL_COUNT: String(entries.length) };
+  for (let i = 0; i < entries.length; i++) env[`OCX_ACL_PATH_${i}`] = entries[i]!.path;
+  const result = Bun.spawnSync([
+    resolveTrustedWindowsPowerShellExe(), "-NoLogo", "-NoProfile", "-NonInteractive",
+    "-ExecutionPolicy", "Bypass", "-EncodedCommand", ENCODED_ACL_SCRIPT,
+  ], {
+    env, stdin: "ignore", stdout: "pipe", stderr: "ignore",
+    timeout: timeoutMs, windowsHide: true,
+  });
+  return { success: result.success, timedOut: result.exitedDueToTimeout ?? false, stdout: result.stdout ?? new Uint8Array() };
+}
+let ownerAclRunner: WindowsOwnerAclRunner = defaultWindowsOwnerAclRunner;
+/** Test-only access to the real subprocess runner, for native diagnostics. */
+export const windowsOwnerAclDefaultRunnerForTests: WindowsOwnerAclRunner = defaultWindowsOwnerAclRunner;
+
+export function setWindowsOwnerAclRunnerForTests(runner: WindowsOwnerAclRunner | null): void {
+  ownerAclRunner = runner ?? defaultWindowsOwnerAclRunner;
+}
+
+/** Pure, strict line-protocol parser and owner/effective-DACL policy. No account names or SDDL. */
+export function windowsPrivateEntriesAclMatches(stdout: string | Uint8Array, entries: readonly WindowsPrivateEntry[]): boolean {
+  if (entries.length === 0) return false;
+  // The script emits ASCII only. Reject BOMs, NULs, non-ASCII bytes and replacement decoding.
+  if (typeof stdout !== "string" && stdout.some(byte => byte > 127)) return false;
+  const text = typeof stdout === "string" ? stdout : Buffer.from(stdout).toString("ascii");
+  if (/[^\x20-\x7e\r\n]/.test(text)) return false;
+  const normalized = text.replace(/\r\n/g, "\n");
+  if (normalized.includes("\r")) return false;
+  const lines = (normalized.endsWith("\n") ? normalized.slice(0, -1) : normalized).split("\n");
+  if (lines.at(-1) !== "END") return false;
+  const token = lines[0]!.split("|");
+  if (token.length !== 4 || token[0] !== "U" || !SID.test(token[1]!) || !SID.test(token[2]!)
+    || (token[3] !== "True" && token[3] !== "False")) return false;
+  const user = token[1]!.toUpperCase();
+  const acceptsAdministrators = token[2]!.toUpperCase() === ADMINISTRATORS && token[3] === "True";
+  let at = 1;
+  for (let i = 0; i < entries.length; i++) {
+    const entry = (lines[at++] ?? "").split("|");
+    if (entry.length !== 5 || entry[0] !== "E" || entry[1] !== String(i) || !SID.test(entry[2]!)
+      || !/^(0|[1-9]\d{0,4})$/.test(entry[3]!) || !/^[1-3]$/.test(entry[4]!)) return false;
+    const flags = Number(entry[3]);
+    if (flags > 0xffff || (flags & PRIVATE_DACL_FLAGS) !== PRIVATE_DACL_FLAGS) return false;
+    const owner = entry[2]!.toUpperCase();
+    if (owner !== user && !(owner === ADMINISTRATORS && acceptsAdministrators)) return false;
+    // The serving account needs its own Full Control entry. SYSTEM and Administrators may also hold plain
+    // allow entries: LocalSystem and an elevated administrator can already take ownership of any object, and a
+    // filtered administrator token holds Administrators only as deny-only, so the allow entry grants it nothing.
+    const grantees = new Set<string>();
+    for (let k = Number(entry[4]); k > 0; k--) {
+      const ace = (lines[at++] ?? "").split("|");
+      if (ace.length !== 7 || ace[0] !== "A" || ace[1] !== String(i) || ace[2] !== "0"
+        || ace[3] !== (entries[i]!.directory ? "3" : "0") || !/^[1-9]\d{0,9}$/.test(ace[4]!)
+        || !SID.test(ace[5]!) || ace[6] !== "False") return false;
+      const grantee = ace[5]!.toUpperCase();
+      if (grantees.has(grantee)) return false;
+      grantees.add(grantee);
+      if (grantee === user ? ace[4] !== String(FULL_CONTROL) : !PRIVILEGED_GRANTEES.has(grantee)) return false;
+    }
+    if (!grantees.has(user)) return false;
+  }
+  return at === lines.length - 1;
+}
+
+/** Fresh, read-only verification; runner failures never disclose paths, SIDs or ACL output. */
+export function verifyWindowsPrivateEntries(entries: readonly WindowsPrivateEntry[], timeoutMs: number): boolean {
+  if (entries.length === 0 || !Number.isFinite(timeoutMs) || timeoutMs <= 0) return false;
+  try {
+    const result = ownerAclRunner(entries, Math.max(1, Math.min(WINDOWS_OWNER_ACL_TIMEOUT_MS, Math.floor(timeoutMs))));
+    return result.success && !result.timedOut && windowsPrivateEntriesAclMatches(result.stdout, entries);
+  } catch { return false; }
+}

package/src/providers/openai-sidecar-credit.ts

@@ -0,0 +1,26 @@
+import {
+  CodexPoolAccountCreditsOffError,
+  releaseCodexAuthContextProbeLease,
+  unwrapUpstreamRetryEvidenceError,
+  type CodexAuthContext,
+  type CodexAuthPolicyConfig,
+} from "../codex/auth-context";
+import { poolContextCreditHoldResetAt } from "../codex/pool-credit-policy";
+
+export function createOpenAiSidecarCreditGuard(
+  context: CodexAuthContext,
+  policy: CodexAuthPolicyConfig,
+): (() => void) | undefined {
+  if (context.kind !== "pool") return undefined;
+  return () => {
+    const resetAt = poolContextCreditHoldResetAt(context, policy);
+    if (resetAt === undefined) return;
+    releaseCodexAuthContextProbeLease(context);
+    throw new CodexPoolAccountCreditsOffError(context.accountId, resetAt);
+  };
+}
+
+export function openAiSidecarCreditRefusal(error: unknown): CodexPoolAccountCreditsOffError | undefined {
+  const cause = unwrapUpstreamRetryEvidenceError(error);
+  return cause instanceof CodexPoolAccountCreditsOffError ? cause : undefined;
+}

package/src/providers/openai-sidecar.ts

@@ -1,4 +1,5 @@
 import { resolveProviderApiKey } from "./key-store";
+import { createOpenAiSidecarCreditGuard } from "./openai-sidecar-credit";
 import {
   CodexPoolAuthenticationError,
   headersForCodexAuthContext,
@@ -31,6 +32,7 @@ export interface OpenAiForwardSidecarCandidate {
 export interface ResolvedOpenAiForwardSidecar extends OpenAiForwardSidecarCandidate {
   authContext: CodexAuthContext;
   headers: Headers;
+  beforeDispatch?: () => void;
   recordOutcome?: (outcome: CodexUpstreamOutcome) => void;
   /** Hand back an acquired recovery probe when no sidecar request reached upstream. */
   releaseProbeLease?: () => void;
@@ -123,6 +125,37 @@ function directSidecarHeaders(
   return selected;
 }
 
+/**
+ * The caller's own ChatGPT credential for a call the caller created itself.
+ *
+ * A V3 `existingCall` sideband join attaches to a WebRTC call that ChatGPT voice or Codex Desktop
+ * created with the caller's login, so only that login can join it; a Pool-selected account is a
+ * different ChatGPT account and the upstream refuses the handshake. This hands the join the same
+ * caller-owned headers Codex Direct mode forwards: an explicit bearer whose token claim matches
+ * its `chatgpt-account-id`, never the proxy admission secret, materialized through the same main
+ * policy (hard lock, credits), whose refusals surface as `CodexAccountCooldownError`.
+ * Returns undefined when the caller presents no such credential.
+ */
+export function resolveCallerOwnedOpenAiSidecar(
+  candidates: readonly OpenAiForwardSidecarCandidate[],
+  incomingHeaders: Headers,
+  config: OcxConfig,
+  options: { admission?: Pick<DataPlaneAdmission, "source">; codexAuthPolicy?: CodexAuthPolicyConfig } = {},
+): ResolvedOpenAiForwardSidecar | undefined {
+  const candidate = candidates[0];
+  if (!candidate) return undefined;
+  try {
+    validateForwardAdmissionCredential(incomingHeaders, config);
+  } catch (error) {
+    if (error instanceof ForwardAdmissionCredentialError) return undefined;
+    throw error;
+  }
+  if (!hasCallerCodexBearer(incomingHeaders)) return undefined;
+  const headers = directSidecarHeaders(incomingHeaders, options.codexAuthPolicy ?? config, options.admission);
+  if (!headers) return undefined;
+  return { ...candidate, authContext: { kind: "main", accountId: null }, headers };
+}
+
 export async function resolveFirstUsableOpenAiSidecar(
   candidates: readonly OpenAiForwardSidecarCandidate[],
   incomingHeaders: Headers,
@@ -176,6 +209,7 @@ export async function resolveFirstUsableOpenAiSidecar(
         ...candidate,
         authContext,
         headers: selectedHeaders,
+        beforeDispatch: createOpenAiSidecarCreditGuard(authContext, policy),
         recordOutcome: (outcome: CodexUpstreamOutcome) => recordCodexUpstreamOutcome(
           config,
           authContext.accountId,
@@ -226,6 +260,7 @@ export async function resolveFirstUsableOpenAiSidecar(
       ...candidate,
       authContext,
       headers: selectedHeaders,
+      beforeDispatch: createOpenAiSidecarCreditGuard(authContext, policy),
       ...(authContext.kind === "pool" || authContext.kind === "main-pool"
         ? {
           recordOutcome: (outcome: CodexUpstreamOutcome) => recordCodexUpstreamOutcome(

package/src/server/claude-messages.ts

@@ -1205,6 +1205,7 @@ async function handleClaudeMessagesWithBudget(
     return await handleNativeMessages({
       req, config, logCtx, ...(logIds ? { logIds } : {}),
       route: nativeMessagesRoute, body: nativeBody, requestedModel, translatorBudget, selector: nativeSelector,
+      modelScope: resolveAdmissionModelScope(config, logIds?.admission),
       // Compatibility identity is an opaque request-local handle, separate from credentials.
       clientIdentity: captureAnthropicClientIdentity(req.headers),
       callerAnthropicBeta: req.headers.get("anthropic-beta"),

package/src/server/gui-pair-delivery.ts

@@ -0,0 +1,23 @@
+import type { OcxConfig } from "../types";
+import { GUI_PAIR_BROWSER_ORIGIN_HEADER, GUI_PAIR_CAPABILITY_HEADER, standaloneGuiPairingOrigin } from "../lib/gui-pair-capability";
+import { consumeGuiPairIntent, GUI_PAIR_INTENT_HEADER } from "../lib/gui-pair-intent";
+import { createGuiPairingGrant, type GuiSessionState } from "./gui-session";
+
+export class GuiPairingIntentRequiredError extends Error {
+  constructor() {
+    super("Standalone GUI pairing requires a fresh local CLI intent");
+    this.name = "GuiPairingIntentRequiredError";
+  }
+}
+
+/** The serving route must authenticate the existing process-bound capability first. */
+export function deliverGuiPairingGrant(req: Request, config: OcxConfig, state: GuiSessionState) {
+  const origin = req.headers.get(GUI_PAIR_BROWSER_ORIGIN_HEADER) ?? "";
+  if (config.runtimeRole !== "hub") {
+    if (standaloneGuiPairingOrigin(config) !== origin
+      || !consumeGuiPairIntent(req.headers.get(GUI_PAIR_CAPABILITY_HEADER), req.headers.get(GUI_PAIR_INTENT_HEADER))) {
+      throw new GuiPairingIntentRequiredError();
+    }
+  }
+  return createGuiPairingGrant(origin, config, state);
+}

package/src/server/index/serve-options.ts

@@ -174,15 +174,14 @@ import { LOCAL_MANAGEMENT_NONCE_HEADER } from "../../lib/local-management-capabi
 import { LOCAL_PROVIDER_RELOAD_CAPABILITY_VERSION } from "../../lib/local-provider-reload-contract";
 import { LOCAL_ASIDE_SYNC_CAPABILITY_VERSION } from "../../lib/local-aside-sync-contract";
 import {
-  GUI_PAIR_BROWSER_ORIGIN_HEADER,
   GUI_PAIR_CAPABILITY_VERSION,
   GUI_PAIR_PATH,
 } from "../../lib/gui-pair-capability";
 import {
   GuiPairingGrantRateLimitError,
   consumeGuiPairingGrant,
-  createGuiPairingGrant,
 } from "../gui-session";
+import { deliverGuiPairingGrant, GuiPairingIntentRequiredError } from "../gui-pair-delivery";
 import { recordCursorSeen } from "../../integrations/cursor-seen";
 import { detectCursorInstalls } from "../../integrations/cursor-detect";
 import { loadCursorEffortTable } from "../../integrations/cursor-effort-table";
@@ -681,18 +680,16 @@ export function createServeOptions(ctx: ServeOptionsContext) {
             return withManagementCors(Response.json({ error: "GUI pairing capability required" }, { status: 403 }), req, config);
           }
           try {
-            const grant = createGuiPairingGrant(
-              req.headers.get(GUI_PAIR_BROWSER_ORIGIN_HEADER) ?? "",
-              config,
-              managementAuth,
-            );
+            const grant = deliverGuiPairingGrant(req, config, managementAuth);
             return withManagementCors(Response.json(grant, {
               status: 201,
               headers: { "Cache-Control": "no-store" },
             }), req, config);
           } catch (error) {
             const status = error instanceof GuiPairingGrantRateLimitError ? 429 : 403;
-            return withManagementCors(Response.json({ error: "GUI pairing grant refused" }, {
+            return withManagementCors(Response.json({ error: "GUI pairing grant refused",
+              ...(error instanceof GuiPairingIntentRequiredError ? { code: "local_pairing_intent_required" } : {}),
+            }, {
               status,
               ...(status === 429 ? { headers: { "Retry-After": "60" } } : {}),
             }), req, config);

package/src/server/index.ts

@@ -463,21 +463,19 @@ function startServerWithSpendLedgerOwner(port: number | undefined, deps: StartSe
     return serveGuiFile(rawPath) !== null;
   }
 
-  // Codex treats empty / non-JSON 503 bodies as "Unknown error" (#452). Keep Retry-After and
-  // the server_is_overloaded code so clients can back off, but always return a JSON envelope.
-  // These two run BEFORE the auth/origin checks, so they need the receiving listener's policy
-  // explicitly (#1102). Reaching for the shared `config` here would attach public-policy CORS
-  // headers to a 503 on the loopback listener — no model runs and no credential is spent, but
-  // it is the one error path that would answer a rebinding origin with its own origin echoed
-  // back.
+  // Codex maps 503 + server_is_overloaded to ServerOverloaded ("model at capacity"), retried
+  // only with retry advice that older clients ignore (#6642); server_restarting is a
+  // retryable UnexpectedStatus in every version and never reads as model capacity.
+  // Keep JSON (empty / non-JSON 503 means "Unknown error", #452) and Retry-After.
+  // Drain and busy run BEFORE auth/origin checks: use the receiving listener's policy
+  // (#1102), because shared public `config` could echo a rebinding origin on loopback.
   function drainingResponse(req: Request, policy: RequestPolicyView): Response {
-    const response = formatErrorResponse(503, "server_error", "Service shutting down");
-    const headers = new Headers(response.headers);
-    for (const [name, value] of Object.entries(corsHeaders(req, policy))) {
-      headers.set(name, value);
-    }
-    headers.set("Retry-After", "5");
-    return new Response(response.body, { status: 503, headers });
+    return withCors(new Response(JSON.stringify({
+      error: { type: "server_error", code: "server_restarting", message: "OpenCodex is restarting; retry this request." },
+    }), {
+      status: 503,
+      headers: { "Content-Type": "application/json", "Retry-After": "5" },
+    }), req, policy);
   }
 
   function serverBusyResponse(req: Request, resource: string, policy: RequestPolicyView): Response {

package/src/server/live-native-calls.ts

@@ -0,0 +1,94 @@
+/**
+ * Upstream call ids created through the native voice call-create path (`handleLive`).
+ *
+ * A sideband join names only a call id, and two kinds of call reach the same join routes. A call
+ * this process created was negotiated under the account the Pool selected, and its join must stay
+ * on that account (openai/codex #35830; thread affinity carries it). A call the client created
+ * itself — ChatGPT voice handing a call to a Codex thread, or Codex Desktop when its renderer owns
+ * the call — belongs to the caller's own ChatGPT login and arrives as a V3 `existingCall` join with
+ * no create on this proxy. Membership here is what tells the two apart.
+ *
+ * Ids only: no account, credential, model, or caller is stored. Process-local and bounded, so a
+ * restart, the TTL, or eviction past capacity turns a created call into an unknown one; a later
+ * rejoin is then authenticated as the caller (see `resolveLiveRelay`).
+ */
+export const NATIVE_LIVE_CALL_TTL_MS = 6 * 60 * 60_000;
+export const MAX_NATIVE_LIVE_CALLS = 1024;
+const MAX_LOCATION_LENGTH = 4096;
+const MAX_CALL_ID_LENGTH = 128;
+const RTC_CALL_ID_RE = /^rtc_[A-Za-z0-9_-]+$/;
+const UUID_CALL_ID_RE = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+
+function isRealtimeCallIdSegment(segment: string): boolean {
+  if (segment.length > MAX_CALL_ID_LENGTH) return false;
+  return RTC_CALL_ID_RE.test(segment) || UUID_CALL_ID_RE.test(segment);
+}
+
+/**
+ * The call id a client reads from a call-create Location, extracted the way openai/codex does
+ * (`decode_call_id_from_location`, codex-api realtime_call.rs): drop the query, scan the path
+ * segments from the end, and take the first `rtc_…` or hyphenated-UUID segment. The backend
+ * answers `/v1/realtime/calls/calls/rtc_…`, the API `/v1/live/rtc_…`; both yield the id the client
+ * then joins with.
+ */
+export function liveCallIdFromLocation(location: string | null | undefined): string | null {
+  if (!location || location.length > MAX_LOCATION_LENGTH) return null;
+  const path = location.split("?")[0] ?? "";
+  for (const segment of path.split("/").reverse()) {
+    if (isRealtimeCallIdSegment(segment)) return segment;
+  }
+  return null;
+}
+
+export class NativeLiveCalls {
+  /** Insertion order is creation order, so the first key is always the oldest entry. */
+  private readonly entries = new Map<string, number>();
+
+  constructor(
+    private readonly now: () => number = Date.now,
+    private readonly ttlMs: number = NATIVE_LIVE_CALL_TTL_MS,
+    private readonly capacity: number = MAX_NATIVE_LIVE_CALLS,
+  ) {}
+
+  /** Record the call a successful create's Location names; returns the id, or null when none. */
+  record(location: string | null | undefined): string | null {
+    const id = liveCallIdFromLocation(location);
+    if (!id) return null;
+    this.prune();
+    this.entries.delete(id);
+    while (this.entries.size >= this.capacity) {
+      const oldest = this.entries.keys().next().value;
+      if (oldest === undefined) break;
+      this.entries.delete(oldest);
+    }
+    this.entries.set(id, this.now() + this.ttlMs);
+    return id;
+  }
+
+  has(id: string): boolean {
+    const expiresAt = this.entries.get(id);
+    if (expiresAt === undefined) return false;
+    if (expiresAt <= this.now()) {
+      this.entries.delete(id);
+      return false;
+    }
+    return true;
+  }
+
+  get size(): number {
+    this.prune();
+    return this.entries.size;
+  }
+
+  clear(): void {
+    this.entries.clear();
+  }
+
+  private prune(): void {
+    const now = this.now();
+    for (const [id, expiresAt] of this.entries) if (expiresAt <= now) this.entries.delete(id);
+  }
+}
+
+/** The process-wide registry `handleLive` writes and native sideband joins read. */
+export const nativeLiveCalls = new NativeLiveCalls();