@bitkyc08/opencodex 2.8.0 → 2.9.0

package/src/server/responses-image-gen-repair.ts

@@ -1,5 +1,6 @@
 import { collectResponsesToolGroups } from "../responses/tool-groups";
 import { relaySseWithPayloadRewrite, type SsePayloadRewrite } from "./sse-payload-rewrite";
+import type { TranslatorBudget } from "../lib/translator-budget";
 
 interface NamespacedTool {
   namespace: string;
@@ -22,12 +23,24 @@ function isPlainObject(value: unknown): value is Record<string, unknown> {
 export function imageGenToolCallAliases(
   toolNsMap: ReadonlyMap<string, NamespacedTool>,
   requestBody?: unknown,
+  translatorBudget?: TranslatorBudget,
 ): Map<string, NamespacedTool> {
   const aliases = new Map<string, NamespacedTool>();
+  const retainAlias = (key: string, tool: NamespacedTool) => {
+    if (aliases.has(key)) {
+      aliases.set(key, tool);
+      return;
+    }
+    translatorBudget?.chargeRetained(
+      Buffer.byteLength(key) + Buffer.byteLength(tool.namespace) + Buffer.byteLength(tool.name),
+      { kind: "request_copies" },
+    );
+    aliases.set(key, tool);
+  };
   for (const [wireName, tool] of toolNsMap) {
     if (tool.namespace !== IMAGE_GEN_NAMESPACE) continue;
-    aliases.set(wireName, tool);
-    aliases.set(`${tool.namespace}.${tool.name}`, tool);
+    retainAlias(wireName, tool);
+    retainAlias(`${tool.namespace}.${tool.name}`, tool);
   }
   for (const group of collectResponsesToolGroups(requestBody)) {
     for (const tool of group) {
@@ -40,8 +53,8 @@ export function imageGenToolCallAliases(
       ) continue;
       const localName = tool.name.slice(IMAGE_GEN_DOTTED_PREFIX.length);
       const target = { namespace: IMAGE_GEN_NAMESPACE, name: localName };
-      aliases.set(`${IMAGE_GEN_NAMESPACE}__${localName}`, target);
-      aliases.set(tool.name, target);
+      retainAlias(`${IMAGE_GEN_NAMESPACE}__${localName}`, target);
+      retainAlias(tool.name, target);
     }
   }
   return aliases;
@@ -112,7 +125,8 @@ export function createImageGenCallRestoreRewrite(
 export function relaySseWithImageGenCallRestore(
   body: ReadableStream<Uint8Array>,
   aliases: ReadonlyMap<string, NamespacedTool>,
+  translatorBudget: TranslatorBudget,
 ): ReadableStream<Uint8Array> {
   const rewrite = createImageGenCallRestoreRewrite(aliases);
-  return rewrite ? relaySseWithPayloadRewrite(body, rewrite) : body;
+  return rewrite ? relaySseWithPayloadRewrite(body, rewrite, translatorBudget) : body;
 }

package/src/server/responses-item-id-repair.ts

@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
 import type { ResponsesItemIdRepairConfig } from "../types";
 import { relaySseWithPayloadRewrite, type SsePayloadRewrite } from "./sse-payload-rewrite";
+import type { TranslatorBudget } from "../lib/translator-budget";
 
 type RepairableItemType = "message" | "reasoning";
 
@@ -9,6 +10,7 @@ interface ResponsesItemIdRepairState {
   readonly placeholders: Record<RepairableItemType, ReadonlySet<string>>;
   readonly outputIds: Record<RepairableItemType, Map<number, string>>;
   readonly scope: string;
+  readonly budget?: TranslatorBudget;
 }
 
 const REPAIRABLE_PREFIXES: Record<RepairableItemType, string> = {
@@ -48,8 +50,8 @@ function mintCanonicalId(type: RepairableItemType, scope: string, outputIndex: n
   return `${REPAIRABLE_PREFIXES[type]}ocx_${scope}_${outputIndex}`;
 }
 
-function createRepairState(config: ResponsesItemIdRepairConfig): ResponsesItemIdRepairState {
-  return {
+function createRepairState(config: ResponsesItemIdRepairConfig, budget?: TranslatorBudget): ResponsesItemIdRepairState {
+  const state = {
     repairMissingTerminalIds: config.repairMissingTerminalIds === true,
     placeholders: {
       message: new Set(config.message ?? []),
@@ -60,7 +62,14 @@ function createRepairState(config: ResponsesItemIdRepairConfig): ResponsesItemId
       reasoning: new Map<number, string>(),
     },
     scope: randomUUID().replace(/-/g, ""),
+    budget,
   };
+  budget?.chargeRetained(new TextEncoder().encode(JSON.stringify({
+    message: [...state.placeholders.message],
+    reasoning: [...state.placeholders.reasoning],
+    scope: state.scope,
+  })).byteLength, { kind: "item_ids" });
+  return state;
 }
 
 function rememberMappedId(
@@ -80,6 +89,7 @@ function rememberMappedId(
       ? rawId
       : null;
   if (!mapped) return null;
+  state.budget?.chargeRetained(new TextEncoder().encode(JSON.stringify([outputIndex, rawId, mapped])).byteLength, { kind: "item_ids" });
   state.outputIds[type].set(outputIndex, mapped);
   return mapped;
 }
@@ -163,7 +173,13 @@ function repairEventPayload(
       changed = true;
     }
   }
-  return changed ? JSON.stringify(nextEvent) : payload;
+  if (!changed) return payload;
+  const rewritten = JSON.stringify(nextEvent);
+  const bytes = new TextEncoder().encode(rewritten).byteLength;
+  const reservation = state.budget?.reserveTransient(bytes, { kind: "item_ids" });
+  reservation?.commitRetained();
+  if (state.budget) queueMicrotask(() => state.budget?.releaseRetained(bytes, { kind: "item_ids" }));
+  return rewritten;
 }
 
 /**
@@ -187,16 +203,18 @@ function repairEventPayload(
 /** Stateful payload rewrite for composition with other client-facing SSE transforms. */
 export function createResponsesItemIdPayloadRewrite(
   config: ResponsesItemIdRepairConfig,
+  budget?: TranslatorBudget,
 ): SsePayloadRewrite {
-  const state = createRepairState(config);
+  const state = createRepairState(config, budget);
   return (payload) => repairEventPayload(payload, state);
 }
 
 export function relaySseWithResponsesItemIdRepair(
   body: ReadableStream<Uint8Array>,
   config: ResponsesItemIdRepairConfig,
+  budget: TranslatorBudget,
 ): ReadableStream<Uint8Array> {
-  return relaySseWithPayloadRewrite(body, createResponsesItemIdPayloadRewrite(config));
+  return relaySseWithPayloadRewrite(body, createResponsesItemIdPayloadRewrite(config, budget), budget);
 }
 
 export function hasResponsesItemIdRepair(config: ResponsesItemIdRepairConfig | undefined): boolean {

package/src/server/sse-payload-rewrite.ts

@@ -1,3 +1,5 @@
+import type { TranslatorBudget } from "../lib/translator-budget";
+
 /**
  * Shared client-facing SSE payload rewrite shell.
  *
@@ -66,11 +68,60 @@ export function composeSsePayloadRewrites(...rewrites: SsePayloadRewrite[]): Sse
 export function relaySseWithPayloadRewrite(
   body: ReadableStream<Uint8Array>,
   rewrite: SsePayloadRewrite,
+  translatorBudget: TranslatorBudget,
 ): ReadableStream<Uint8Array> {
   const reader = body.getReader();
   const decoder = new TextDecoder();
   const encoder = new TextEncoder();
   let buffer = "";
+  let bufferBytes = 0;
+
+  const appendBuffer = (fragment: string): void => {
+    if (!fragment) return;
+    const nextBytes = bufferBytes + encoder.encode(fragment).byteLength;
+    const reservation = translatorBudget.reserveTransient(nextBytes, { kind: "live_transient" });
+    try {
+      buffer += fragment;
+      reservation.commitRetained();
+      translatorBudget.releaseRetained(bufferBytes, { kind: "live_transient" });
+      bufferBytes = nextBytes;
+    } catch (error) {
+      reservation.release();
+      throw error;
+    }
+  };
+
+  const replaceBuffer = (next: string): void => {
+    const nextBytes = encoder.encode(next).byteLength;
+    const reservation = translatorBudget.reserveTransient(nextBytes, { kind: "live_transient" });
+    reservation.commitRetained();
+    buffer = next;
+    translatorBudget.releaseRetained(bufferBytes, { kind: "live_transient" });
+    bufferBytes = nextBytes;
+  };
+
+  const enqueueText = (
+    controller: ReadableStreamDefaultController<Uint8Array>,
+    text: string,
+  ): void => {
+    const bytes = encoder.encode(text).byteLength;
+    const reservation = translatorBudget.reserveTransient(bytes, { kind: "live_transient" });
+    try {
+      const encoded = encoder.encode(text);
+      reservation.commitRetained();
+      controller.enqueue(encoded);
+      translatorBudget.releaseRetained(bytes, { kind: "live_transient" });
+    } catch (error) {
+      reservation.release();
+      throw error;
+    }
+  };
+
+  const releaseBuffer = (): void => {
+    translatorBudget.releaseRetained(bufferBytes, { kind: "live_transient" });
+    buffer = "";
+    bufferBytes = 0;
+  };
 
   const emitProcessedBlocks = (
     controller: ReadableStreamDefaultController<Uint8Array>,
@@ -78,13 +129,13 @@ export function relaySseWithPayloadRewrite(
   ): void => {
     let next: { block: string; delimiter: string; rest: string } | null;
     while ((next = nextSseBlock(buffer))) {
-      buffer = next.rest;
+      replaceBuffer(next.rest);
       const payload = sseDataPayload(next.block);
       const rewrittenPayload = payload ? rewrite(payload) : undefined;
       const block = payload && rewrittenPayload !== undefined && rewrittenPayload !== payload
         ? replaceSseDataPayload(next.block, rewrittenPayload)
         : next.block;
-      controller.enqueue(encoder.encode(block + next.delimiter));
+      enqueueText(controller, block + next.delimiter);
     }
     if (flushFinal && buffer.length > 0) {
       const payload = sseDataPayload(buffer);
@@ -92,24 +143,32 @@ export function relaySseWithPayloadRewrite(
       const block = payload && rewrittenPayload !== undefined && rewrittenPayload !== payload
         ? replaceSseDataPayload(buffer, rewrittenPayload)
         : buffer;
-      controller.enqueue(encoder.encode(block));
-      buffer = "";
+      enqueueText(controller, block);
+      releaseBuffer();
     }
   };
 
   return new ReadableStream<Uint8Array>({
     async pull(controller) {
-      const { done, value } = await reader.read();
-      if (done) {
-        buffer += decoder.decode();
-        emitProcessedBlocks(controller, true);
-        controller.close();
-        return;
+      try {
+        const { done, value } = await reader.read();
+        if (done) {
+          appendBuffer(decoder.decode());
+          emitProcessedBlocks(controller, true);
+          releaseBuffer();
+          controller.close();
+          return;
+        }
+        appendBuffer(decoder.decode(value, { stream: true }));
+        emitProcessedBlocks(controller);
+      } catch (error) {
+        releaseBuffer();
+        try { await reader.cancel(error); } catch { /* already closed */ }
+        controller.error(error);
       }
-      buffer += decoder.decode(value, { stream: true });
-      emitProcessedBlocks(controller);
     },
     cancel(reason) {
+      releaseBuffer();
       reader.cancel(reason).catch(() => {});
     },
   });

package/src/server/startup-health-cache.ts

@@ -6,9 +6,11 @@ import { getCodexRoutingKind } from "../codex/inject";
 import { diagnoseCodexShim } from "../codex/shim";
 import { durableBunPath } from "../lib/bun-runtime";
 import type { OcxConfig } from "../types";
+import { truncateRetainedUtf8 } from "../lib/admission";
 
 const CACHE_TTL_MS = 30_000;
 const PROBE_TIMEOUT_MS = 5_000;
+const MAX_DIAGNOSTIC_VALUE_BYTES = 8 * 1024;
 let cached: { timestamp: number; value: StartupHealth } | null = null;
 let inflight: Promise<StartupHealth> | null = null;
 let generation = 0;
@@ -63,7 +65,18 @@ function runProbe(config: Pick<OcxConfig, "codexAutoStart">): Promise<StartupHea
           try {
             const parsed = JSON.parse(lines[index]) as StartupHealth;
             if (["native", "protected", "at-risk"].includes(parsed.status) && typeof parsed.rebootSafe === "boolean") {
-              resolve({ ...parsed, diagnosticStale: false });
+              resolve({
+                ...parsed,
+                recommendedCommand: parsed.recommendedCommand === null
+                  ? null
+                  : truncateRetainedUtf8(parsed.recommendedCommand, MAX_DIAGNOSTIC_VALUE_BYTES),
+                commands: {
+                  installService: truncateRetainedUtf8(parsed.commands.installService, MAX_DIAGNOSTIC_VALUE_BYTES),
+                  installShim: truncateRetainedUtf8(parsed.commands.installShim, MAX_DIAGNOSTIC_VALUE_BYTES),
+                  restoreNative: truncateRetainedUtf8(parsed.commands.restoreNative, MAX_DIAGNOSTIC_VALUE_BYTES),
+                },
+                diagnosticStale: false,
+              });
               return;
             }
           } catch { /* scan earlier output; config repair messages may precede JSON */ }

package/src/server/system-env.ts

@@ -236,7 +236,14 @@ async function computeEffectiveModelEnv(config: OcxConfig, auto?: AutoContextMod
   const { boundedContextWindows, buildClaudeContextWindows, effectiveModelEnv } = await import("../claude/context-windows");
   const windows = await boundedContextWindows(async () => {
     const { gatherRoutedModels, visibleNativeSlugs } = await import("../codex/catalog");
-    return buildClaudeContextWindows([...visibleNativeSlugs(config)], await gatherRoutedModels(config));
+    try {
+      return buildClaudeContextWindows([...visibleNativeSlugs(config)], await gatherRoutedModels(config));
+    } catch (error) {
+      if (error && typeof error === "object" && (error as { code?: unknown }).code === "catalog_busy") {
+        return buildClaudeContextWindows([...visibleNativeSlugs(config)], []);
+      }
+      throw error;
+    }
   });
   return { modelEnv: effectiveModelEnv(config.claudeCode, windows ?? {}, auto), windows: windows ?? {} };
 }

package/src/server/windows-tcp-drop.ts

@@ -79,6 +79,12 @@ export type WindowsTcpDropResult = {
   dropped: number;
   /** IPv6 (or unparseable) rows skipped — never coerced into IPv4 wildcards. */
   skippedIpv6: number;
+  /**
+   * SetTcpEntry returned ERROR_ACCESS_DENIED (5) or the UAC-non-elevated code (317).
+   * On a normal (non-admin) update worker this is expected — ghost LISTEN rows must
+   * clear by waiting for the OS, not by SetTcpEntry.
+   */
+  accessDenied: number;
 };
 
 function htons(port: number): number {
@@ -133,21 +139,22 @@ function readNetstatAno(): string {
  */
 export function dropWindowsTcpRowsForLocalPort(port: number): WindowsTcpDropResult {
   if (process.platform !== "win32" || !Number.isFinite(port) || port <= 0) {
-    return { dropped: 0, skippedIpv6: 0 };
+    return { dropped: 0, skippedIpv6: 0, accessDenied: 0 };
   }
   const setTcpEntry = loadSetTcpEntry();
-  if (!setTcpEntry) return { dropped: 0, skippedIpv6: 0 };
+  if (!setTcpEntry) return { dropped: 0, skippedIpv6: 0, accessDenied: 0 };
 
   let output = "";
   try {
     output = readNetstatAno();
   } catch {
-    return { dropped: 0, skippedIpv6: 0 };
+    return { dropped: 0, skippedIpv6: 0, accessDenied: 0 };
   }
 
   const rows = parseTcpQuadsForLocalPort(output, Math.trunc(port));
   let dropped = 0;
   let skippedIpv6 = 0;
+  let accessDenied = 0;
   for (const row of rows) {
     const localDw = ipv4ToWinUint32(row.localAddr);
     const remoteDw = ipv4ToWinUint32(row.remoteAddr);
@@ -165,10 +172,13 @@ export function dropWindowsTcpRowsForLocalPort(port: number): WindowsTcpDropResu
     view.setUint32(12, remoteDw, true);
     view.setUint32(16, htons(row.remotePort), true);
     try {
-      if (setTcpEntry(ptr(buf)) === 0) dropped += 1;
+      const rc = setTcpEntry(ptr(buf));
+      if (rc === 0) dropped += 1;
+      // 5 = ERROR_ACCESS_DENIED, 317 = non-elevated SetTcpEntry (MSDN).
+      else if (rc === 5 || rc === 317) accessDenied += 1;
     } catch {
       /* keep going */
     }
   }
-  return { dropped, skippedIpv6 };
+  return { dropped, skippedIpv6, accessDenied };
 }

package/src/server/ws-bridge.ts

@@ -3,6 +3,8 @@ import { FORWARD_HEADERS } from "../adapters/openai-responses";
 import type { CodexAuthContext } from "../codex/auth-context";
 import { headersForCodexAuthContext } from "../codex/auth-context";
 import type { ResponsesTerminalStatus } from "../bridge";
+import type { DataPlaneAdmission } from "./auth-cors";
+import type { AdmissionReservation } from "../lib/admission";
 
 const OPEN = 1;
 type ResponsesTerminalReporter = (status: ResponsesTerminalStatus) => void;
@@ -19,6 +21,14 @@ const SAFE_RESPONSE_HEADER_EXACT = new Set([
 
 export interface WsData {
   headers?: Headers; // base inbound forward headers only; per-turn auth refresh injects current pool tokens
+  /**
+   * Resolved once at the handshake. Auth is handshake-time only on this path, so
+   * the per-frame log contexts have no request headers left to re-resolve from.
+   * Optional like every other member here: a socket object can exist before the
+   * handshake fills it, and an unattributed frame is preferable to a fabricated
+   * attribution.
+   */
+  admission?: DataPlaneAdmission;
   authContext?: CodexAuthContext; // last resolved account decision for observability/registry cleanup
   cancel?: () => void; // cancels the in-flight stream reader/fetch
   turnId?: number; // monotonically increasing per socket; prevents stale frames after replacement turns
@@ -29,6 +39,21 @@ export interface WsData {
   liveUpstreamHeaders?: Record<string, string>;
   livePending?: Array<string | Buffer>;
   liveOpened?: boolean;
+  admissionLease?: AdmissionReservation<ServerWebSocket<WsData>>;
+}
+
+/**
+ * Build the Responses WebSocket upgrade payload.
+ *
+ * Extracted so the handshake's contract is testable: `server.upgrade` hands its
+ * `data` straight to the socket, and a client has no way to read `ws.data` back.
+ * A test that only asserts "the socket opened" would still pass if the admission
+ * were dropped from the payload, so the payload itself is what gets asserted.
+ */
+export function buildResponsesWsData(headers: Headers, admission: DataPlaneAdmission, admissionLease?: AdmissionReservation<ServerWebSocket<WsData>>): WsData {
+  // Auth is handshake-time only on this path: the per-frame contexts have no
+  // request headers left to re-resolve from, so the decision rides along here.
+  return { headers, admission, ...(admissionLease ? { admissionLease } : {}) };
 }
 
 export class WsSendDroppedError extends Error {