@bitkyc08/opencodex 2.82.0 → 2.84.0

package/src/config/api-key-reconcile.ts

@@ -0,0 +1,34 @@
+type KeyRecord = Record<string, unknown> & { id: string };
+
+function index(value: unknown): Map<string, KeyRecord> | null {
+  if (value === undefined) return new Map();
+  if (!Array.isArray(value)) return null;
+  const rows = new Map<string, KeyRecord>();
+  for (const row of value) {
+    if (!row || typeof row !== "object" || Array.isArray(row) || typeof row.id !== "string" || !row.id || rows.has(row.id)) return null;
+    rows.set(row.id, row);
+  }
+  return rows;
+}
+
+/** Stable-ID three-way merge: either side's revocation defeats stale edits to that ID. */
+export function reconcileApiKeys(
+  baseline: unknown, live: unknown, persisted: unknown,
+  mergeRecord: (live: Record<string, unknown>, baseline: Record<string, unknown>, persisted: Record<string, unknown>) => void,
+): unknown[] | null {
+  if (baseline === undefined && live === undefined && persisted === undefined) return null;
+  const before = index(baseline), pending = index(live), disk = index(persisted);
+  if (!before || !pending || !disk) return null;
+  const merged: KeyRecord[] = [];
+  const liveOrder = [...pending.keys()], diskOrder = [...disk.keys()];
+  const order = JSON.stringify(liveOrder) === JSON.stringify([...before.keys()])
+    ? [...diskOrder, ...liveOrder] : [...liveOrder, ...diskOrder];
+  for (const id of new Set(order)) {
+    const local = pending.get(id), saved = disk.get(id);
+    if (before.has(id) && (!local || !saved)) continue;
+    const row = structuredClone(local ?? saved!);
+    if (local && saved) mergeRecord(row, before.get(id) ?? {}, saved);
+    merged.push(row);
+  }
+  return merged;
+}

package/src/config/diagnostics.ts

@@ -648,6 +648,21 @@ export function metricsExportConfigError(value: unknown): string | null {
   return null;
 }
 
+/** Load degrades a malformed service health recovery section to off; live writes reject it. */
+export function serviceHealthRecoveryConfigError(value: unknown): string | null {
+  const raw = rawConfigRecord(value);
+  if (!raw || !Object.hasOwn(raw, "serviceHealthRecovery") || raw.serviceHealthRecovery === undefined) return null;
+  const section = rawConfigRecord(raw.serviceHealthRecovery);
+  if (!section) return "schema_invalid: serviceHealthRecovery: must be an object or omitted";
+  if (Object.keys(section).some(key => key !== "enabled")) {
+    return "schema_invalid: serviceHealthRecovery: contains an unsupported field";
+  }
+  if (section.enabled !== undefined && typeof section.enabled !== "boolean") {
+    return "schema_invalid: serviceHealthRecovery.enabled: must be a boolean";
+  }
+  return null;
+}
+
 
 function skillsConfigError(value: unknown): string | null {
   const raw = rawConfigRecord(value);
@@ -710,6 +725,7 @@ export function validateConfigCandidate(value: unknown): { ok: true; config: Ocx
     ?? loopbackListenerPortError(value)
     ?? managementIngressConfigError(value)
     ?? metricsExportConfigError(value)
+    ?? serviceHealthRecoveryConfigError(value)
     ?? skillsConfigError(value);
   if (boundaryError) return { ok: false, error: boundaryError };
   const result = configSchema.safeParse(value);

package/src/config/feature-flags.ts

@@ -17,6 +17,11 @@ export function metricsExportEnabled(config: Pick<OcxConfig, "metricsExport">):
   return config.metricsExport?.enabled === true;
 }
 
+/** Default-off service health recovery (#6671); read once when the proxy starts. */
+export function serviceHealthRecoveryEnabled(config: Pick<OcxConfig, "serviceHealthRecovery">): boolean {
+  return config.serviceHealthRecovery?.enabled === true;
+}
+
 /**
  * Default cadence for catalog auto-refresh (issue #3630): one converge pass
  * per hour. Each pass spends a live /models call against every enabled provider, and

package/src/config/live-reconcile.ts

@@ -18,6 +18,8 @@ import { withConfigMutationLockSync, bumpGenerationForCooperatingConfigWrite } f
 import { ConfigWritePublishedError, persistConfigUnlocked, readRawConfigJson } from "./persist-unlocked";
 import { configDiagnosticsFromRaw, readConfigDiagnostics } from "./diagnostics";
 import { normalizePersistedClaudeCode } from "./load-degrade";
+import { reconcileApiKeys } from "./api-key-reconcile";
+import { captureLiveTopologyBaseline, LIVE_TOPOLOGY_KEYS, projectLiveTopology } from "./live-topology";
 
 // ---------------------------------------------------------------------------
 // Hand-edit protection for the `claudeCode` subtree (devlog 260726_claude_auth_auto/040 H1).
@@ -104,6 +106,7 @@ const detachedConfigSnapshots = new WeakSet<OcxConfig>();
 export function armClaudeCodeBaseline(config: OcxConfig): void {
   liveConfigBaseline.set(config, structuredClone(config));
   claudeCodeBaseline.set(config, structuredClone(config.claudeCode));
+  captureLiveTopologyBaseline(config);
 }
 
 /**
@@ -321,7 +324,12 @@ function reconcileConfigRecord(
         && baselineValue !== MISSING_CONFIG_VALUE
         && persistedValue === MISSING_CONFIG_VALUE
       ? MISSING_CONFIG_VALUE
-      : key === "customModels"
+      : key === "apiKeys"
+        ? reconcileApiKeys(baselineValue === MISSING_CONFIG_VALUE ? undefined : baselineValue,
+            liveValue === MISSING_CONFIG_VALUE ? undefined : liveValue,
+            persistedValue === MISSING_CONFIG_VALUE ? undefined : persistedValue, reconcileConfigRecord)
+          ?? reconcileConfigValue(baselineValue, liveValue, persistedValue)
+        : key === "customModels"
         ? reconcileCustomModels(baselineValue, liveValue, persistedValue)
           ?? reconcileConfigValue(baselineValue, liveValue, persistedValue)
         : key === "disabledModels"
@@ -401,7 +409,7 @@ export function reconcileLiveConfigFromDisk(config: OcxConfig, persistedBaseline
     config as unknown as Record<string, unknown>,
     persistedBaseline as unknown as Record<string, unknown>,
     persisted as unknown as Record<string, unknown>,
-    new Set(["hostname", "port", ...(claudeGuardArmed ? ["claudeCode"] : [])]),
+    new Set([...LIVE_TOPOLOGY_KEYS, ...(claudeGuardArmed ? ["claudeCode"] : [])]),
   );
   applyConfigObjectChildDeletions(config, childDeletions);
 
@@ -473,36 +481,32 @@ export function saveConfigPreservingClaudeCode(config: OcxConfig): void {
     // custom-model deletion migration. A second read could observe different bytes.
     const onDisk = readRawConfigJson();
     const baseline = liveConfigBaseline.get(config);
+    let diskDeletedKeys = new Set<string>();
+    let persistedSnapshot: OcxConfig | undefined;
     if (baseline && onDisk !== undefined) {
       const persistedDiagnostics = configDiagnosticsFromRaw(JSON.stringify(onDisk));
       if (persistedDiagnostics.source === "file") {
-        // A detached snapshot diverged only where this pipeline mutated it (model
-        // discovery fields for the auto-refresh tick): it cannot express a
-        // deliberate deletion, so the disk-only-key and listener-binding skips
-        // below would only discard concurrent hand edits. It merges every top-level
-        // key — including configRebaseProvenance, so a cooperating writer's
-        // deletion marker adopted from disk is honored instead of silently dropped —
-        // and captures deletion intent from the current disk snapshot before the
-        // merge can temporarily restore a key and invalidate its deletion marker.
+        persistedSnapshot = persistedDiagnostics.config;
+        // Capture authoritative disk deletions before reconciliation can restore a key.
+        // Live instances retain actual socket identity; detached discovery snapshots
+        // own no socket and also merge listener fields and disk-only sections.
         const detached = detachedConfigSnapshots.has(config);
-        const deletedKeys = detached
-          ? configRebaseDeletionKeys(persistedDiagnostics.config)
-          : configRebaseDeletionKeys(config);
+        diskDeletedKeys = configRebaseDeletionKeys(persistedDiagnostics.config);
+        // Preserve explicit pending live edits; stale retention is not an edit.
+        if (!detached) for (const key of diskDeletedKeys) {
+          if (!LIVE_TOPOLOGY_KEYS.has(key) && !deepEqual(
+            ownConfigValue(config as unknown as Record<string, unknown>, key),
+            ownConfigValue(baseline as unknown as Record<string, unknown>, key))) diskDeletedKeys.delete(key);
+        }
+        const deletedKeys = new Set([...diskDeletedKeys, ...configRebaseDeletionKeys(config)]);
         const skipped = detached
           ? new Set(["claudeCode"])
-          : new Set(["hostname", "port", "claudeCode", CONFIG_REBASE_PROVENANCE_KEY]);
+          : new Set([...LIVE_TOPOLOGY_KEYS, "claudeCode", CONFIG_REBASE_PROVENANCE_KEY]);
         if (!detached) {
-          const provenanceExists = configHasRebaseProvenance(config);
-          // Only keys this live config is actually known to have diverged on may be
-          // rebased. The baseline is captured once when the server arms it, so any key
-          // that appeared on disk afterwards — through saveConfig(), a hand edit, or
-          // another process — is absent from the baseline as well as from the live
-          // config. Reconciling those keys reads "live never changed this" and adopts
-          // the disk value, which resurrects a field the live writer had deliberately
-          // deleted (#1462 regression: PUT /api/grok/selection with an empty list).
-          // Restrict the merge to keys the baseline knew about, plus keys the live
-          // config still carries; a key that exists only on disk is left to the
-          // ordinary whole-config write below.
+          const provenanceExists = configHasRebaseProvenance(config) || configHasRebaseProvenance(persistedDiagnostics.config);
+          // Without provenance, disk-only keys remain subject to the legacy whole-
+          // config write: adopting them could resurrect a deliberate live deletion
+          // absent from its baseline (#1462). Provenance makes that intent explicit.
           const rebaseableKeys = new Set([
             ...Object.keys(baseline as unknown as Record<string, unknown>),
             ...Object.keys(config as unknown as Record<string, unknown>),
@@ -521,6 +525,7 @@ export function saveConfigPreservingClaudeCode(config: OcxConfig): void {
           skipped,
         );
         for (const key of deletedKeys) {
+          if (!detached && LIVE_TOPOLOGY_KEYS.has(key)) continue;
           delete (config as unknown as Record<string, unknown>)[key];
         }
       }
@@ -537,15 +542,23 @@ export function saveConfigPreservingClaudeCode(config: OcxConfig): void {
         }
       }
     }
-    const provenanceProjection = projectConfigRebaseProvenance(config);
+    const desired = persistedSnapshot && !detachedConfigSnapshots.has(config)
+      ? projectLiveTopology(config, persistedSnapshot, reconcileConfigRecord) : config;
+    const durableProjection = { ...desired, configRebaseProvenance: projectConfigRebaseProvenance(config).configRebaseProvenance };
+    for (const key of diskDeletedKeys) {
+      delete (durableProjection as unknown as Record<string, unknown>)[key];
+    }
+    if (diskDeletedKeys.size) durableProjection.configRebaseProvenance = { version: 1,
+      deletedTopLevelKeys: [...new Set([...configRebaseDeletionKeys(durableProjection), ...diskDeletedKeys])].sort() };
+    const provenanceProjection = projectConfigRebaseProvenance(durableProjection);
     const projectedConfig = projectCustomModelCatalogMigration(
       onDisk,
-      config,
+      durableProjection,
     );
     if (provenanceProjection.configRebaseProvenance === undefined) delete projectedConfig.configRebaseProvenance;
     else projectedConfig.configRebaseProvenance = provenanceProjection.configRebaseProvenance;
-    const persistedBinding = bindingBaseline && onDisk
-      ? readPersistedServerBinding(onDisk, bindingBaseline)
+    const persistedBinding = (bindingBaseline || diskDeletedKeys.has("hostname")) && onDisk
+      ? readPersistedServerBinding(onDisk, bindingBaseline ?? { port: config.port, hostname: config.hostname })
       : bindingBaseline;
     if (persistedBinding) {
       const persistedConfig: OcxConfig = { ...projectedConfig, port: persistedBinding.port };
@@ -557,6 +570,7 @@ export function saveConfigPreservingClaudeCode(config: OcxConfig): void {
       persist(projectedConfig);
     }
     adoptCustomModelCatalogMigration(config, projectedConfig);
+    captureLiveTopologyBaseline(config);
     if (claudeCodeBaseline.has(config)) {
       claudeCodeBaseline.set(config, structuredClone(config.claudeCode));
     }

package/src/config/live-topology.ts

@@ -0,0 +1,29 @@
+import type { OcxConfig } from "../types";
+
+export const LIVE_TOPOLOGY_KEYS = new Set(["hostname", "port", "runtimeRole", "hub", "client", "unauthenticatedLoopbackListener"]);
+const baselines = new WeakMap<OcxConfig, Record<string, unknown>>();
+
+function snapshot(config: OcxConfig): Record<string, unknown> {
+  const record = config as unknown as Record<string, unknown>;
+  return Object.fromEntries([...LIVE_TOPOLOGY_KEYS].filter(key => Object.hasOwn(record, key))
+    .map(key => [key, structuredClone(record[key])]));
+}
+
+/** Track actual active values independently of the desired config last persisted. */
+export function captureLiveTopologyBaseline(config: OcxConfig): void {
+  baselines.set(config, snapshot(config));
+}
+
+/** Merge desired next-start topology without mutating the active listener/role objects. */
+export function projectLiveTopology(
+  config: OcxConfig, persisted: OcxConfig,
+  mergeRecord: (live: Record<string, unknown>, baseline: Record<string, unknown>, disk: Record<string, unknown>, skipped: ReadonlySet<string>) => void,
+): OcxConfig {
+  const projected = { ...config, ...snapshot(config) } as unknown as Record<string, unknown>;
+  const baseline = baselines.get(config) ?? snapshot(config);
+  const disk = persisted as unknown as Record<string, unknown>;
+  const skipped = new Set([...Object.keys(projected), ...Object.keys(baseline), ...Object.keys(disk)]
+    .filter(key => !LIVE_TOPOLOGY_KEYS.has(key)));
+  mergeRecord(projected, baseline, disk, skipped);
+  return projected as unknown as OcxConfig;
+}

package/src/config/load-degrade.ts

@@ -16,6 +16,7 @@ import {
 } from "./provider-validation";
 import { UPSTREAM_HOST_CIRCUIT_MAX_THRESHOLD } from "../codex/upstream-host-health";
 import { hardenSecretPath } from "../lib/windows-secret-acl";
+import { isPassiveRead } from "../lib/passive-read";
 import { redactSecretString } from "../lib/redact";
 import { isValidProviderName } from "./provider-name";
 import { MODEL_ALIAS_PATTERN } from "../providers/default-aliases";
@@ -49,7 +50,7 @@ import {
 import { hasWarnedInheritedFastWireConflict, markWarnedInheritedFastWireConflict } from "./warn-memo";
 
 export function hardenExistingSecret(path: string): void {
-  if (existsSync(path)) {
+  if (existsSync(path) && !isPassiveRead()) {
     try { chmodSync(path, 0o600); } catch { /* best-effort */ }
     if (process.platform === "win32") {
       hardenSecretPath(path, { required: false });

package/src/config/paths.ts

@@ -3,6 +3,7 @@ import { homedir } from "node:os";
 import { join, resolve } from "node:path";
 import { flushWindowsSecretAclReapsBeforeRemoval, hardenSecretDirAsync, windowsSecretAclApplies } from "../lib/windows-secret-acl";
 import { assertNotRealHomeUnderTest } from "../lib/test-home-guard";
+import { isPassiveRead } from "../lib/passive-read";
 
 /**
  * Expand a leading `~` in user-supplied paths without interpreting shell
@@ -29,6 +30,8 @@ export function getConfigPath(): string {
 }
 
 export function hardenConfigDir(): void {
+  // A passive read (a Remote Link Child's, #6959) repairs nothing on this machine.
+  if (isPassiveRead()) return;
   const dir = getConfigDir();
   // The guard runs before any mutation: refusing after chmod/ACL would already
   // have changed the protected directory used by the test-home boundary.

package/src/config/salvage.ts

@@ -3,6 +3,7 @@ import { join } from "node:path";
 import * as z from "zod/v4";
 import { CODEX_ACCOUNT_NAMESPACE_COMBO_ALIAS_COLLISION_ERROR } from "../codex/account-namespace-match";
 import { redactSecretString } from "../lib/redact";
+import { isPassiveRead } from "../lib/passive-read";
 import { hasWarnedConfigFallback, markWarnedConfigFallback } from "./warn-memo";
 import { configSchema } from "./schema/config-schema";
 import type { OcxConfig } from "../types";
@@ -232,7 +233,8 @@ export function warnAndBackupInvalidConfig(configPath: string, error: unknown):
 }
 
 export function backupInvalidConfig(configPath: string): string | null {
-  if (!existsSync(configPath)) return null;
+  // A passive read leaves a malformed file for the Home's own load to back up (#6959).
+  if (!existsSync(configPath) || isPassiveRead()) return null;
   const backupPath = `${configPath}.invalid-${new Date().toISOString().replace(/[:.]/g, "-")}`;
   try {
     copyFileSync(configPath, backupPath);

package/src/config/schema/config-schema.ts

@@ -105,6 +105,8 @@ export const configSchema = z.object({
   skills: skillsConfigSchema.optional().catch(undefined),
   // Malformed hand edits disable this opt-in exporter. Live writes reject them in diagnostics.ts.
   metricsExport: z.object({ enabled: z.boolean().optional() }).strict().optional().catch(undefined),
+  // Same contract as metricsExport: a malformed hand edit leaves recovery off; live writes reject it.
+  serviceHealthRecovery: z.object({ enabled: z.boolean().optional() }).strict().optional().catch(undefined),
   // Kept raw on purpose: `.catch(undefined)` would turn a mistyped `enabled` into "inherit",
   // which can reopen a surface the operator meant to close. src/protocols/settings.ts parses it
   // and fails closed instead.