@bitkyc08/opencodex 2.82.0 → 2.84.0

package/src/server/management/agent-settings-routes.ts

@@ -1,6 +1,7 @@
 import { ensureManagementClaudeIntercept, interceptStartRefusal, interceptStatus } from "./claude-intercept-routes";
 import { persistCommittedDesktopGateway } from "../../claude/desktop-gateway-state";
 import { captureDesktopAppliedMarker, commitDesktopAppliedMarker } from "../../claude/desktop-applied-marker";
+import { isPassiveRead } from "../../lib/passive-read";
 import { randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { dirname } from "node:path";
@@ -230,6 +231,32 @@ async function injectionModelOptions(config: OcxConfig, models: readonly Catalog
   return [...nativeModels, ...routedModels];
 }
 
+/**
+ * The GET /api/injection-model body. `routed` is the discovered routed catalog, or `null` in a
+ * passive read (a Remote Link Child's, #6959). That body lists the native
+ * options and the current pick, which is all a read-only Child shows.
+ */
+export async function injectionModelView(config: OcxConfig, routed: readonly CatalogModel[] | null) {
+  const { CODEX_REASONING_LEVELS } = await import("../../reasoning-effort");
+  const available = await injectionModelOptions(config, routed ?? []);
+  const picked = config.injectionModel;
+  if (routed === null && picked && !available.some(option => option.namespaced === picked)) {
+    const slash = picked.indexOf("/");
+    available.push(slash > 0
+      ? { provider: picked.slice(0, slash), model: picked.slice(slash + 1), namespaced: picked }
+      : { provider: "openai", model: picked, namespaced: picked });
+  }
+  return {
+    multiAgentGuidanceEnabled: multiAgentGuidanceEnabled(config),
+    syncCodexSubagentDefaults: subagentDefaultSyncEffective(config),
+    model: config.injectionModel ?? null,
+    effort: config.injectionEffort ?? null,
+    prompt: config.injectionPrompt ?? null,
+    efforts: CODEX_REASONING_LEVELS.map(l => l.effort),
+    available,
+  };
+}
+
 export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise<Response | null> {
   const { req, url, config, deps, convergeCodexCatalog, syncClaudeAgentDefsBestEffort } = ctx;
 
@@ -620,16 +647,7 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
   // effort the prompt tells the agent to pass to spawn_agent. GET returns the current
   // picks + available models/efforts; PUT sets or clears them.
   if (url.pathname === "/api/injection-model" && req.method === "GET") {
-    const { CODEX_REASONING_LEVELS } = await import("../../reasoning-effort");
-    return jsonResponse({
-      multiAgentGuidanceEnabled: multiAgentGuidanceEnabled(config),
-      syncCodexSubagentDefaults: subagentDefaultSyncEffective(config),
-      model: config.injectionModel ?? null,
-      effort: config.injectionEffort ?? null,
-      prompt: config.injectionPrompt ?? null,
-      efforts: CODEX_REASONING_LEVELS.map(l => l.effort),
-      available: await injectionModelOptions(config, await fetchAllModels(config)),
-    });
+    return jsonResponse(await injectionModelView(config, isPassiveRead() ? null : await fetchAllModels(config)));
   }
   // Read-only: sizes the described delegated work and proposes a model and effort from the
   // same options GET offers. The page applies an accepted proposal through the PUT below.

package/src/server/management/anthropic-reset-grant-routes.ts

@@ -19,6 +19,7 @@ import { captureAnthropicPhysicalSendOwnership, anthropicPhysicalSendOwnershipIs
 import { anthropicCooldownRecoveryFor } from "../../providers/quota/anthropic-cooldown-recovery";
 import { captureProviderAccountQuotaEpoch } from "../../providers/quota/account-cache";
 import { captureOAuthAccountSelection, getAccountSet, getAccountCredentialWithStatus, listAccounts } from "../../oauth/store";
+import { admitAnthropicAccountAfterReset, type AnthropicResetAdmissionEvidence } from "../../providers/anthropic-reset-admission";
 import {
   ANTHROPIC_RESET_GRANT_ID_RE,
   AnthropicResetGrantError,
@@ -74,6 +75,8 @@ export interface AnthropicResetGrantRouteDeps {
   listAccountIds: () => string[];
   activeAccountId: () => string | null;
   accessTokenFor: (accountId: string) => Promise<string>;
+  /** Lift local admission after a journaled reset, bounded by its journal evidence. Tests omit it. */
+  admitReset?: (accountId: string, evidence: AnthropicResetAdmissionEvidence) => Promise<void>;
 }
 
 function defaultDepsFor(ctx: ManagementContext, provider: AnthropicInstanceId): AnthropicResetGrantRouteDeps | null {
@@ -109,6 +112,7 @@ function defaultDepsFor(ctx: ManagementContext, provider: AnthropicInstanceId):
       if (!targetCurrent() || !owner) throw new Error("reset owner changed");
       return snapshot.accessToken;
     },
+    admitReset: (accountId, evidence) => admitAnthropicAccountAfterReset(provider, accountId, evidence),
   };
 }
 
@@ -209,6 +213,16 @@ async function handleConsume(ctx: ManagementContext, injected?: AnthropicResetGr
   }
   if (deps.isCurrent?.() === false) return scopedFail(401, "auth_failed");
   const ledger = { journalPath: deps.journalPath, now: deps.now?.() };
+  // Retry-after cooldowns survive a usage probe. A journaled reset, including a
+  // replay after the process died before admission, has to lift this account,
+  // but only refusals recorded before the claim was journaled and only for the
+  // windows the journal says were cleared. A failed reread must not turn a
+  // spent grant into an error.
+  const admitJournaledReset = async (code: string, evidence: AnthropicResetAdmissionEvidence): Promise<void> => {
+    if (code !== "reset" || deps.isCurrent?.() === false) return;
+    try { await deps.admitReset?.(accountId, evidence); }
+    catch { /* The grant is already spent. */ }
+  };
 
   // A new operation must pass the spend gate on a fresh read. A same-id retry of
   // an open record skips it: that attempt was already gated, and upstream
@@ -242,6 +256,7 @@ async function handleConsume(ctx: ManagementContext, injected?: AnthropicResetGr
   }
   switch (begin.kind) {
     case "replay":
+      await admitJournaledReset(begin.code, { claimedAt: begin.claimedAt, cleared: begin.cleared });
       return jsonResponse(
         { provider, code: begin.code, replayed: true, resetsLeft: begin.resetsLeft, accountId, grantId, operationId },
         200, ctx.req, ctx.config,
@@ -268,7 +283,7 @@ async function handleConsume(ctx: ManagementContext, injected?: AnthropicResetGr
   let settled;
   try {
     settled = settleAnthropicResetOperation(
-      { operationId, code: answer.code, resetsLeft: answer.resetsLeft },
+      { operationId, code: answer.code, resetsLeft: answer.resetsLeft, cleared: answer.cleared },
       { journalPath: deps.journalPath, now: deps.now?.() },
     );
   } catch {
@@ -278,6 +293,7 @@ async function handleConsume(ctx: ManagementContext, injected?: AnthropicResetGr
   // Report what the journal holds. An overlapping same-id attempt may have
   // settled first; its answer is the canonical one.
   const replayed = settled.code !== answer.code || settled.resetsLeft !== answer.resetsLeft;
+  await admitJournaledReset(settled.code, { claimedAt: settled.claimedAt, cleared: settled.cleared });
   return jsonResponse(
     {
       provider,

package/src/server/management/codex-agent-role-routes.ts

@@ -96,12 +96,18 @@ export async function handleCodexAgentRoleRoutes(ctx: ManagementContext): Promis
     return jsonResponse({ error: "invalid JSON body" }, 400, req, config);
   }
 
-  let model: string;
-  let effort: string | undefined;
+  // An omitted model leaves the role's model pin (or its inheritance) alone, an omitted effort
+  // keeps the effort, and an effort of null clears it. A body with neither changes nothing, which
+  // is a client mistake rather than a save, so it is refused before any role file is read.
+  if (body?.model === undefined && body?.effort === undefined) {
+    return jsonResponse({ error: "send a model, an effort, or both", code: "empty_update" }, 400, req, config);
+  }
+  let model: string | undefined;
+  let effort: string | null | undefined;
   let toml: { status: "written" | "unchanged" };
   try {
-    model = roles.validateAgentRoleModel(body?.model);
-    effort = body?.effort === undefined || body.effort === null ? undefined : roles.validateAgentRoleEffort(body.effort);
+    model = body?.model === undefined ? undefined : roles.validateAgentRoleModel(body.model);
+    effort = body?.effort === undefined ? undefined : body.effort === null ? null : roles.validateAgentRoleEffort(body.effort);
     toml = roles.writeCodexAgentRoleModel(role, model, codexHome, effort);
   } catch (error) {
     if (error instanceof roles.AgentRoleModelError) {
@@ -115,10 +121,17 @@ export async function handleCodexAgentRoleRoutes(ctx: ManagementContext): Promis
   // The role TOML is what Codex obeys, so its write stands even when the omo mirror cannot follow.
   let omoStatus: ReturnType<typeof omo.writeOmoRoleModel> | "write_failed";
   try {
-    const reasoning = effort === undefined ? undefined : omo.omoReasoningFor(effort);
+    const reasoning = effort === undefined ? undefined : effort === null ? null : omo.omoReasoningFor(effort);
     omoStatus = omo.writeOmoRoleModel(role, model, omo.omoJsoncPath(), reasoning);
   } catch {
     omoStatus = "write_failed";
   }
-  return jsonResponse({ ok: true, role, model, ...(effort ? { effort } : {}), toml, omoJsonc: { status: omoStatus } }, 200, req, config);
+  return jsonResponse({
+    ok: true,
+    role,
+    ...(model !== undefined ? { model } : {}),
+    ...(effort !== undefined ? { effort } : {}),
+    toml,
+    omoJsonc: { status: omoStatus },
+  }, 200, req, config);
 }

package/src/server/management/codex-prompt-routes.ts

@@ -30,11 +30,14 @@ import {
   composeProjection,
   computePromptProbeStateFingerprint,
   findInvalidCharacter,
+  importBaseVariant,
   inspectOwnership,
   normalizeBody,
   previewAdopt,
+  previewBaseImport,
   previewSalvage,
   readPromptLayers,
+  recoverPromptJournal,
   salvageProjection,
   selectBaseVariant,
   setToggle,
@@ -76,6 +79,7 @@ const WRITE_ERROR_STATUS: Record<WriteError, number> = {
   unknown_layer: 400,
   store_unreadable: 409,
   invalid_characters: 400,
+  body_too_large: 400,
   write_superseded: 409,
   // Not the caller's fault and not a race: the filesystem refused the write and the
   // transaction rolled itself back. 500 rather than 409 — retrying the same request
@@ -84,6 +88,8 @@ const WRITE_ERROR_STATUS: Record<WriteError, number> = {
   recovery_required: 409,
   locked: 409,
   unsafe: 422,
+  import_body_changed: 409,
+  unsupported_form: 409,
 };
 
 /** Read-only view for the route test that asserts every mapping is a client error. */
@@ -335,7 +341,12 @@ export async function handleCodexPromptRoutes(ctx: ManagementContext): Promise<R
     if (!body) return fail(ctx, "invalid_body", 400, "expected a JSON object");
     const id = body.id;
     if (typeof id !== "string") return fail(ctx, "invalid_body", 400, "id must be a string");
-    if (typeof body.enabled !== "boolean") return fail(ctx, "invalid_body", 400, "enabled must be a boolean");
+    // `null` is the restore-the-default verb: it deletes the line instead of
+    // writing the documented default back as a literal, so a later upstream
+    // change to the default still reaches this file.
+    if (typeof body.enabled !== "boolean" && body.enabled !== null) {
+      return fail(ctx, "invalid_body", 400, "enabled must be a boolean or null");
+    }
     const revision = revisionOf(body);
     if (!revision) return fail(ctx, "stale_revision", 409, "revision required");
 
@@ -388,6 +399,109 @@ export async function handleCodexPromptRoutes(ctx: ManagementContext): Promise<R
     return settle(ctx, selectBaseVariant(selection, revision, paths(ctx)));
   }
 
+  if (url.pathname === "/api/codex-prompt/base/import" && req.method === "POST") {
+    // The adopt flow for `model_instructions_file`: preview first, write only on
+    // confirmation. The verb exists because /base/select refuses the `external`
+    // state by design — that refusal is about SILENT retargeting, and an
+    // explicit, previewed import is precisely the opt-in it protects.
+    //
+    // The preview carries the SERIALIZED variant file — `# {title}\n{body}` —
+    // not just the body: the heading is part of what Codex will read, so the
+    // thing confirmed must be the whole stored text, title included. Both byte
+    // counts are reported and separately named: `bodyBytes` is the budget the
+    // 64 KiB cap applies to, `serializedBytes` is the complete file.
+    const body = await readBody(ctx);
+    if (!body) return fail(ctx, "invalid_body", 400, "expected a JSON object");
+    const readState = readPromptLayers(paths(ctx));
+    if (!readState.readable) {
+      return fail(ctx, "config_unreadable", 409, "the configuration file exists but could not be read", { path: readState.configPath });
+    }
+    // The title is validated before anything is previewed or written: a caller
+    // that supplies one gets the same contract as a custom-layer title —
+    // 1-80 characters on a single line.
+    if (body.title !== undefined) {
+      const t = body.title;
+      if (typeof t !== "string" || t.trim().length === 0
+        || t.length > MAX_TITLE_CHARS || /[\r\n]/.test(t)) {
+        return fail(ctx, "invalid_title", 400, "title must be 1-80 characters on a single line");
+      }
+    }
+    const preview = previewBaseImport(paths(ctx), typeof body.title === "string" ? body.title : undefined);
+    if (preview.reason === "nothing_to_import") {
+      return fail(ctx, "nothing_to_import", 409,
+        "model_instructions_file is absent or already points at a managed variant");
+    }
+    if (preview.reason === "unsupported_form") {
+      return fail(ctx, "import_unsupported_form", 409, preview.detail, {
+        path: preview.rawPath,
+      });
+    }
+    if (preview.reason === "file_unreadable") {
+      return fail(ctx, "import_file_unreadable", 409, preview.detail, {
+        path: preview.resolvedPath ?? preview.rawPath,
+      });
+    }
+    if (preview.reason === "invalid_characters") {
+      return fail(ctx, "invalid_characters", 400, preview.detail, { path: preview.resolvedPath });
+    }
+    // Same boundary as every other write to this key: the 64 KiB cap applies to
+    // the BODY alone — the title heading lives outside that budget, unchanged
+    // from the managed-variant contract.
+    if (preview.reason === "body_too_large" || utf8Bytes(preview.body!) > MAX_BODY_BYTES) {
+      return fail(ctx, "body_too_large", 400, `the file body exceeds ${MAX_BODY_BYTES} bytes`, {
+        path: preview.resolvedPath,
+      });
+    }
+    if (preview.reason === "slots_full") {
+      return fail(ctx, "variant_slots_full", 409,
+        `at most ${MAX_BASE_VARIANTS} base variants; delete one first`, {
+          maxBaseVariants: MAX_BASE_VARIANTS,
+          serialized: preview.serialized,
+          resolvedPath: preview.resolvedPath,
+        });
+    }
+    if (body.confirm !== true) {
+      // Preview writes nothing, by construction: previewBaseImport is a pure read.
+      return jsonResponse({
+        ok: true,
+        changed: false,
+        preview: {
+          rawPath: preview.rawPath,
+          resolvedPath: preview.resolvedPath,
+          serialized: preview.serialized,
+          serializedBytes: utf8Bytes(preview.serialized!),
+          bodyBytes: utf8Bytes(preview.body!),
+          suggestedTitle: preview.suggestedTitle,
+          effectiveTitle: preview.effectiveTitle,
+          previewSha256: preview.previewSha256,
+        },
+      }, 200, req, ctx.config);
+    }
+    const revision = revisionOf(body);
+    if (!revision) return fail(ctx, "stale_revision", 409, "revision required");
+    // The preview hash is REQUIRED — a confirm that does not name exactly what
+    // was previewed (serialized text, title included) cannot be checked against
+    // it and is refused without writing.
+    const previewSha256 = body.previewSha256;
+    if (typeof previewSha256 !== "string" || !/^[0-9a-f]{64}$/.test(previewSha256)) {
+      return fail(ctx, "import_preview_required", 400,
+        "confirm requires the previewSha256 returned by a preview of the same title");
+    }
+    if (previewSha256 !== preview.previewSha256) {
+      // The file or the selected title moved between preview and confirm. Refuse
+      // rather than import a serialization nobody previewed.
+      return fail(ctx, "import_body_changed", 409,
+        "the preview no longer matches; preview it again", {
+          resolvedPath: preview.resolvedPath,
+        });
+    }
+    return settle(ctx, importBaseVariant(
+      { title: typeof body.title === "string" ? body.title : undefined, previewSha256 },
+      revision,
+      paths(ctx),
+    ));
+  }
+
   if (url.pathname === "/api/codex-prompt/base" && req.method === "PUT") {
     const body = await readBody(ctx);
     if (!body) return fail(ctx, "invalid_body", 400, "expected a JSON object");
@@ -568,11 +682,28 @@ export async function handleCodexPromptRoutes(ctx: ManagementContext): Promise<R
       return settle(ctx, adoptDeveloperInstructions(revision, paths(ctx)));
     }
 
-    // journal-present: recovery lives inside WP1's commit and is not exported.
-    // Any ordinary mutation replays it on its own path, so the honest answer is
-    // to name the state rather than duplicate the transaction here.
+    if (drift === "journal-present") {
+      // Recovery as its own locked operation — never a disguised layers write.
+      // The GUI used to replay recovery through a byte-identical custom PUT,
+      // which projected custom=[] over a config still carrying instructions
+      // whenever the store file was missing.
+      if (!confirm) {
+        return jsonResponse({
+          ok: true,
+          changed: false,
+          preview: { drift, storePath: snapshot.storePath },
+        }, 200, req, ctx.config);
+      }
+      if (!revision) return fail(ctx, "stale_revision", 409, "revision required");
+      if (revision !== snapshot.revision) {
+        return fail(ctx, "stale_revision", 409, "the configuration moved since it was read");
+      }
+      return settle(ctx, recoverPromptJournal(paths(ctx)));
+    }
+
+    // A drift kind this build does not repair: name it rather than guess.
     return fail(ctx, "repair_unsupported", 409,
-      "a write journal is present; recovery runs automatically on the next write", {
+      "this drift has no repair on this route", {
         drift, storePath: snapshot.storePath,
       });
   }

package/src/server/management/codex-role-auto-assign.ts

@@ -209,7 +209,7 @@ export async function proposeDelegationModel(options: {
     role: DELEGATED_WORK_ROLE,
     model: options.config.injectionModel ?? null,
     effort: options.config.injectionEffort ?? null,
-  }], outcomes, classified, { alwaysProposeEffort: true });
+  }], outcomes, classified);
   return {
     sizingModel,
     sizingError,