@bitkyc08/opencodex 2.86.0 → 2.88.0

package/src/server/index/model-alias-id.ts

@@ -0,0 +1,36 @@
+import { fastRowBases } from "../fast-row";
+import { previewRouteModel } from "../../router";
+import type { OcxConfig } from "../../types";
+
+/**
+ * Build the alias promoter for one model listing. The Fast-base inventory walks
+ * the configured catalog, so it is computed at most once per listing instead of
+ * once per aliased row.
+ */
+export function modelAliasIdPromoter(config: OcxConfig) {
+  let isFastBase: ((id: string) => boolean) | undefined;
+  const fastBases = () => (isFastBase ??= fastRowBases(config));
+  return (provider: string, model: string, alias: string, fastEligible: boolean) =>
+    preferredModelAliasId(config, provider, model, alias, fastEligible, fastBases);
+}
+
+/** Promote only a short alias whose ordinary route is this exact upstream model. */
+export function preferredModelAliasId(
+  config: OcxConfig, provider: string, model: string, alias: string, fastEligible: boolean,
+  fastBases: () => (id: string) => boolean = () => fastRowBases(config),
+): string | undefined {
+  if (config.preferModelAliasIds !== true) return undefined;
+  // Built-in bare aliases are not stable Fast bases. Preserve the qualified ID
+  // when promotion would publish a synthetic sibling that ingress cannot parse.
+  if (config.fastRows !== false && fastEligible && !fastBases()(alias)) return undefined;
+  try {
+    // Preview cannot consume a combo's round-robin selection state. A policy/combo,
+    // reserved native name or another provider's native id must keep its own meaning.
+    const route = previewRouteModel(config, alias);
+    return route.routeReason === "model-alias" && route.providerName === provider && route.modelId === model
+      ? alias : undefined;
+  } catch {
+    // An ambiguous alias stays available through the existing qualified public id.
+    return undefined;
+  }
+}

package/src/server/index/optional-listeners.ts

@@ -21,6 +21,7 @@ export { LINK_INGRESS_HOSTNAME } from "./link-listener";
 import type { ServerIngress } from "./serve-options";
 
 export interface OptionalListenerStartContext<T> {
+  startProxy?: typeof import("../../claude/intercept/connect-proxy").startConnectProxy;
   config: OcxConfig;
   publicPort: number;
   requestedPort?: number;
@@ -106,6 +107,7 @@ export function createOptionalListenerSet<T>(linkDeps: LinkListenerDeps = {}): O
       }
       supervisorStop = () => supervisor.stop();
       claudeIntercept.start({
+        startProxy: ctx.startProxy,
         config: ctx.config,
         publicPort: ctx.publicPort,
         requestedPort: ctx.requestedPort,

package/src/server/index/serve-options.ts

@@ -1,4 +1,5 @@
 import type { Server, ServerWebSocket } from "bun";
+import { modelAliasIdPromoter } from "./model-alias-id";
 import type { StartServerDeps } from "./startup-warnings";
 import { isLinkManagementPath } from "../../link/management-routes";
 import {
@@ -1252,6 +1253,7 @@ export function createServeOptions(ctx: ServeOptionsContext) {
             effortRowKnownIds,
           ));
         };
+        const promoteAliasId = modelAliasIdPromoter(config);
         const routedRows = await Promise.all(uniqueCatalogModelsForRawPublicList(goOrdered)
           .filter(m => listAllows(m.provider, m.id))
           .map(async m => {
@@ -1269,8 +1271,11 @@ export function createServeOptions(ctx: ServeOptionsContext) {
                 knownModelIdsForProvider(m.provider, provider, config),
               ).get(m.id)
             : undefined;
+          const effectiveId = !isCombo && !fastModelId && effective
+            ? promoteAliasId(m.provider, m.id, effective.alias, catalogRowFastEligible(m)) ?? publicId
+            : publicId;
           const row = {
-            id: publicId,
+            id: effectiveId,
             object: "model",
             created: 0,
             // This endpoint is an OpenAI-compatible inbound contract. Some clients use
@@ -1279,6 +1284,9 @@ export function createServeOptions(ctx: ServeOptionsContext) {
             owned_by: isCombo ? "openai" : (m.owned_by ?? m.provider),
             ...(isCombo ? { is_combo: true } : {}),
             ...(effective ? { alias_of: `${provider?.alias || m.provider}/${effective.alias}` } : {}),
+            // When preferModelAliasIds promotes the alias to `id`, retain the original
+            // provider/nativeId so clients that need the upstream identity can read it.
+            ...(effectiveId !== publicId ? { native_id: publicId } : {}),
             ...grokEffortFields(m.reasoningEfforts ?? [], m.defaultReasoningEffort),
             ...modelCapabilityFields({
               reasoningEfforts: m.reasoningEfforts,
@@ -1610,11 +1618,17 @@ export function createServeOptions(ctx: ServeOptionsContext) {
         // Promote a caller `x-session-id` before admission, as Responses and Messages do (#6520):
         // the ChatGPT bridge forwards only canonical session headers, so the raw marker is lost.
         const sessionReq = withCallerSessionIdentity(req, admission);
-        return runAdmittedHttpTurn(sessionReq, policy, async turnAdmissionLease => withCors(
-          await handleChatCompletions(sessionReq, config, logCtx, { requestId, start, turnAdmissionLease, admission }),
-          req,
-          policy,
-        ), { requestId, start, logCtx });
+        // Only expose an id when the handler or a logged refusal owns its history row.
+        let ownsRequestLog = false;
+        const response = await runAdmittedHttpTurn(sessionReq, policy, async turnAdmissionLease => {
+          ownsRequestLog = true;
+          return withCors(
+            await handleChatCompletions(sessionReq, config, logCtx, { requestId, start, turnAdmissionLease, admission }),
+            req,
+            policy,
+          );
+        }, { requestId, start, logCtx, onLogged: () => { ownsRequestLog = true; } });
+        return ownsRequestLog ? withRequestLogId(response, requestId) : response;
       }
 
       if (url.pathname === "/v1/audio/transcriptions" && req.method === "POST") {

package/src/server/index/startup-warnings.ts

@@ -149,6 +149,8 @@ export function withRequestLogId(response: Response, requestId: string): Respons
 }
 
 export interface StartServerDeps {
+  /** Test-only CONNECT binder; permits kernel-assigned ports without probe-and-release races. */
+  startClaudeInterceptProxy?: typeof import("../../claude/intercept/connect-proxy").startConnectProxy;
   /** Test-only seam; production always initializes its own management credential state. */
   managementAuthState?: ManagementAuthState;
   /** Test-only route dependencies, forwarded only after management admission succeeds. */

package/src/server/index/websocket-handler.ts

@@ -89,6 +89,7 @@ import {
 import type { ServeOptionsContext } from "./serve-options";
 import type { RequestMetricsRecorder } from "../request-metrics";
 import { resolveInboundBodyLimitBytes } from "../request-decompress";
+import { responseToolOwnership } from "../responses/response-tool-ownership";
 
 /**
  * The WebSocket half of the Bun.serve options, split out of serve-options.ts to keep that file
@@ -184,6 +185,8 @@ export function createWebsocketHandler(
           }
           return;
         }
+        if (ws.data.responsesActivity?.closing) return;
+        ws.data.responsesActivity?.touch();
         const rawBytes = typeof raw === "string" ? Buffer.byteLength(raw) : raw.byteLength;
         if (rawBytes > MAX_WS_FRAME_BYTES) {
           sendJsonFrame(ws, buildWsErrorFrame(413, {
@@ -223,6 +226,7 @@ export function createWebsocketHandler(
             if (frame.type === "response.inject") {
               if (!ws.data.nativeControl?.inject) throw new NativeSteeringError("injection_not_supported", "Native injection is disabled or unavailable on this route.");
               ws.data.nativeControl.inject(frame);
+              ws.data.responsesActivity?.acceptResults(frame.input);
               return;
             }
             if (frame.type === "response.steer") {
@@ -230,7 +234,10 @@ export function createWebsocketHandler(
               ws.data.nativeControl.steer(frame);
               return;
             }
-            if (ws.data.nativeControl?.continue(frame)) return;
+            if (ws.data.nativeControl?.continue(frame)) {
+              ws.data.responsesActivity?.acceptResults(frame.input);
+              return;
+            }
           } catch (error) {
             sendJsonFrame(ws, buildWsErrorFrame(400, {
               type: "invalid_request_error",
@@ -294,6 +301,7 @@ export function createWebsocketHandler(
         }
 
         // Only a genuinely admitted turn may receive steering or continuations.
+        const finishActivity = ws.data.responsesActivity?.beginTurn(frame.input);
         ws.data.nativeControl = nativeControl;
         const payload: Record<string, unknown> = { ...frame };
         delete payload.type;
@@ -346,11 +354,16 @@ export function createWebsocketHandler(
                 terminalRecorder = recorder;
               },
             });
+            const observeLog = nativeControl?.relayActive
+              ? createNativeSteeringLogObserver(logCtx, () => recordFirstOutput(logCtx, start))
+              : (payload: string) => inspectResponseLogSsePayload(logCtx, payload);
+            const providerExecuted = responseToolOwnership(response);
             await sendResponseToWebSocket(ws, response, isCurrent, {
               untilEof: nativeControl?.relayActive === true,
-              onSsePayload: nativeControl?.relayActive
-                ? createNativeSteeringLogObserver(logCtx, () => recordFirstOutput(logCtx, start))
-                : payload => inspectResponseLogSsePayload(logCtx, payload),
+              onSsePayload: payload => {
+                ws.data.responsesActivity?.observePayload(payload, providerExecuted);
+                observeLog(payload);
+              },
               onTerminal: status => {
                 terminalRecorder?.(status, logCtx.terminalHttpStatus);
                 finalizeLog(httpStatusForRequestLogTerminal(status, logCtx), {
@@ -392,6 +405,7 @@ export function createWebsocketHandler(
               /* socket already gone or send dropped */
             }
           } finally {
+            finishActivity?.();
             turnAdmissionLease.release();
             if (ws.data.nativeControl === nativeControl) ws.data.nativeControl = undefined;
             if (!logged && turnAbort.signal.aborted) finalizeLog(499);

package/src/server/index.ts

@@ -267,17 +267,17 @@ function startServerWithSpendLedgerOwner(port: number | undefined, deps: StartSe
     startupOwnershipHomes = homes;
     startupOwnershipStatePaths = statePaths;
   } catch { /* inspection below stays unknown */ }
-  const startupCacheOwnership = inspectStartupOwnership(
+  const startupCacheOwnership = shouldSyncCodexOnStart(config) ? inspectStartupOwnership(
     deps,
     startupOwnershipHomes,
     startupOwnershipStatePaths,
     startupWindowsTaskListingCache,
-  );
+  ) : null;
   // Startup cache invalidation is best-effort and applies only when startup sync is enabled.
   // Check OFF before taking K: on Windows K resolves SID + LocalAppData through PowerShell,
   // and run 35093667426 exceeded healthy controls by 33.8 s against that 30 s child budget.
   // The permit callback still re-reads intent under K to close a concurrent disable race.
-  if (shouldSyncCodexOnStart(config) && startupCacheOwnership.ownership === "owned" && startupOwnershipHomes !== null) {
+  if (startupCacheOwnership?.ownership === "owned" && startupOwnershipHomes !== null) {
     try {
       const startupCodexHome = startupOwnershipHomes.codexHome;
       // #1046: record whether this actually rewrote the cache. `handleStart` ORs this
@@ -549,12 +549,12 @@ function startServerWithSpendLedgerOwner(port: number | undefined, deps: StartSe
   // clients; no Codex request can use this lifecycle in that state.
   // Re-probe here instead of trusting the earlier cache decision: startup work
   // between the two sites must not widen the service-install race.
-  const nativeOwnership = inspectStartupOwnership(
+  const nativeOwnership = shouldSyncCodexOnStart(config) ? inspectStartupOwnership(
     deps,
     startupOwnershipHomes,
     startupOwnershipStatePaths,
-  );
-  const preparedNativeMainLifecycle = nativeOwnership.ownership !== "foreign"
+  ) : null;
+  const preparedNativeMainLifecycle = nativeOwnership !== null && nativeOwnership.ownership !== "foreign"
     && startupOwnershipHomes !== null
     ? prepareNativeMainStartupLifecycle(
       deps.nativeMainStartup,
@@ -600,7 +600,7 @@ function startServerWithSpendLedgerOwner(port: number | undefined, deps: StartSe
       return retryPreparedNativeMainLifecycle.start();
     },
   };
-  const nativeMainLifecycle: NativeMainStartupLifecycle = shouldSyncCodexOnStart(config)
+  const nativeMainLifecycle: NativeMainStartupLifecycle = nativeOwnership !== null
     ? nativeOwnership.ownership === "owned"
       ? preparedNativeMainLifecycle
         ? preparedNativeMainLifecycle.start()
@@ -738,7 +738,7 @@ function startServerWithSpendLedgerOwner(port: number | undefined, deps: StartSe
         throw new AuxiliaryListenerBindError("hub.managementIngress", managementIngressPort, "127.0.0.1", error);
       }
     }
-    optionalListeners.start({ config, publicPort: server.port ?? listenPort, requestedPort: listenPort,
+    optionalListeners.start({ config, publicPort: server.port ?? listenPort, requestedPort: listenPort, startProxy: deps.startClaudeInterceptProxy,
       maxRequestBodySize: inboundBodyLimitBytes, dispatch: (req, requestServer) => serveOptions.fetch(req, requestServer) });
   } catch (error) {
     unregisterQuotaAutoRefresh?.();

package/src/server/inference/advisor-diagnostics.ts

@@ -0,0 +1,31 @@
+import type { RequestLogContext } from "../request-log";
+import { ADVISOR_INTERNAL_CAPABILITY_HEADER, isInternalCallCapability } from "../../lib/local-internal-call-capability";
+
+export const ADVISOR_REASONING_HEADER = "x-opencodex-advisor-reasoning";
+const EFFORTS = new Set(["none", "minimal", "low", "medium", "high", "xhigh", "max", "ultra"]);
+
+/** Native Chat sends the finalized body directly instead of the translating adapter builder. */
+export function observeAdvisorNativeReasoning(headers: Headers, log: RequestLogContext, body: string): void {
+  if (!isInternalCallCapability(headers.get(ADVISOR_INTERNAL_CAPABILITY_HEADER))) return;
+  delete log.effectiveEffort;
+  try {
+    const effort = JSON.parse(body)?.reasoning_effort;
+    if (typeof effort === "string" && EFFORTS.has(effort)) log.effectiveEffort = effort;
+  } catch { /* absence of evidence stays unreported */ }
+}
+
+/** Only the authenticated internal caller receives adapter-owned serialization evidence. */
+export function attachAdvisorReasoning(response: Response, log: RequestLogContext): Response {
+  const headers = new Headers(response.headers);
+  headers.set(ADVISOR_REASONING_HEADER, JSON.stringify({
+    effectiveEffort: log.effectiveEffort && EFFORTS.has(log.effectiveEffort) ? log.effectiveEffort : null,
+  }));
+  return new Response(response.body, { status: response.status, statusText: response.statusText, headers });
+}
+
+export function readAdvisorReasoning(headers: Headers): string | null {
+  try {
+    const value = JSON.parse(headers.get(ADVISOR_REASONING_HEADER) ?? "null")?.effectiveEffort;
+    return typeof value === "string" && EFFORTS.has(value) ? value : null;
+  } catch { return null; }
+}

package/src/server/lifecycle.ts

@@ -38,6 +38,7 @@ export interface ActiveTurnLease extends AdmissionLease {
   attach(lease: AdmissionLease): void;
   bindAbortSignal(signal: AbortSignal): () => void;
   bindAbortController(ac: AbortController): void;
+  unbindAbortController(ac: AbortController): void;
   beginCodexAccountSelection(): CodexAccountSelectionAdmission;
   isTransferred(): boolean;
 }
@@ -231,6 +232,17 @@ export function tryAdmitTurn(sessionLaneId?: string, clientSignal?: AbortSignal)
       activeTurns.set(ac, lease);
       lease.bindAbortSignal(ac.signal);
     },
+    unbindAbortController(ac) {
+      if (!controllers.delete(ac)) return;
+      if (activeTurns.get(ac) === lease) activeTurns.delete(ac);
+      const listener = abortListeners.get(ac.signal);
+      if (listener) {
+        ac.signal.removeEventListener("abort", listener);
+        abortListeners.delete(ac.signal);
+      }
+      // A completed child relay cannot retire its still-running parent turn.
+      if (controllers.size === 0) lease.release();
+    },
     beginCodexAccountSelection() {
       const mainProfileDraining = nativeMainDrainOwners.size > 0;
       let selectionActive = active && !mainProfileDraining;
@@ -327,7 +339,7 @@ export function unregisterTurn(ac: AbortController): void {
     turnReleaseMisses += 1;
     return;
   }
-  lease.release();
+  lease.unbindAbortController(ac);
 }
 export function isDraining(): boolean { return shutdownDraining || temporaryDrainOwners.size > 0; }
 export function getActiveTurnCount(): number { return turnGate.metrics().active; }

package/src/server/management/advisor-routes.ts

@@ -20,10 +20,12 @@ import {
   isCurrentAdvisorContextSharingConsent,
   isValidAdvisorEffort,
   isValidAdvisorPolicy,
+  isValidAdvisorTaskLimit,
   resolveAdvisorSettings,
   type AdvisorEffort,
   type AdvisorPolicy,
 } from "../../advisor/settings";
+import { advisorActivityStore } from "../../advisor/activity";
 
 const INVALID_BODY = Symbol("invalid-body");
 
@@ -33,6 +35,7 @@ interface AdvisorPatch {
   effort?: AdvisorEffort;
   policy?: AdvisorPolicy;
   timeoutMs?: number;
+  maxConsultationsPerTask?: number;
   /** "v1" records current consent. null removes it. Enabling does not imply this field. */
   contextSharingConsent?: typeof ADVISOR_CONTEXT_SHARING_CONSENT_VERSION | null;
   reset?: boolean;
@@ -40,7 +43,7 @@ interface AdvisorPatch {
 
 type ParsedPatch = { ok: true; patch: AdvisorPatch } | { ok: false; code: string; message: string };
 
-const PATCH_KEYS = new Set(["enabled", "model", "effort", "policy", "timeoutMs", "contextSharingConsent", "reset"]);
+const PATCH_KEYS = new Set(["enabled", "model", "effort", "policy", "timeoutMs", "maxConsultationsPerTask", "contextSharingConsent", "reset"]);
 
 type Rec = Record<string, unknown>;
 function isRec(value: unknown): value is Rec {
@@ -50,9 +53,9 @@ function isRec(value: unknown): value is Rec {
 /** Strict: unknown keys and wrong types are refused; messages name the field, never the value. */
 export function parseAdvisorSettingsPatch(body: unknown): ParsedPatch {
   if (!isRec(body)) return { ok: false, code: "invalid_body", message: "body must be a JSON object" };
-  if (Object.keys(body).length === 0) return { ok: false, code: "empty_body", message: "body must set at least one of enabled, model, effort, policy, timeoutMs, contextSharingConsent or reset" };
+  if (Object.keys(body).length === 0) return { ok: false, code: "empty_body", message: "body must set at least one supported advisor setting or reset" };
   for (const key of Object.keys(body)) {
-    if (!PATCH_KEYS.has(key)) return { ok: false, code: "unknown_field", message: "body accepts only enabled, model, effort, policy, timeoutMs, contextSharingConsent and reset" };
+    if (!PATCH_KEYS.has(key)) return { ok: false, code: "unknown_field", message: "body accepts only enabled, model, effort, policy, timeoutMs, maxConsultationsPerTask, contextSharingConsent and reset" };
   }
   const patch: AdvisorPatch = {};
   if (body.reset !== undefined) {
@@ -86,7 +89,7 @@ export function parseAdvisorSettingsPatch(body: unknown): ParsedPatch {
   }
   if (body.policy !== undefined) {
     if (!isValidAdvisorPolicy(body.policy)) {
-      return { ok: false, code: "invalid_policy", message: 'policy must be "manual" or "preflight"' };
+      return { ok: false, code: "invalid_policy", message: 'policy must be "manual", "preflight" or "adaptive"' };
     }
     patch.policy = body.policy;
   }
@@ -96,6 +99,10 @@ export function parseAdvisorSettingsPatch(body: unknown): ParsedPatch {
     }
     patch.timeoutMs = Math.floor(body.timeoutMs);
   }
+  if (body.maxConsultationsPerTask !== undefined) {
+    if (!isValidAdvisorTaskLimit(body.maxConsultationsPerTask)) return { ok: false, code: "invalid_task_limit", message: "maxConsultationsPerTask must be an integer between 1 and 3" };
+    patch.maxConsultationsPerTask = body.maxConsultationsPerTask;
+  }
   if (body.contextSharingConsent !== undefined) {
     if (body.contextSharingConsent === null) {
       patch.contextSharingConsent = null;
@@ -139,6 +146,7 @@ function applyPatchInMemory(config: ManagementContext["config"], patch: AdvisorP
   if (patch.effort !== undefined) current.effort = patch.effort;
   if (patch.policy !== undefined) current.policy = patch.policy;
   if (patch.timeoutMs !== undefined) current.timeoutMs = patch.timeoutMs;
+  if (patch.maxConsultationsPerTask !== undefined) current.maxConsultationsPerTask = patch.maxConsultationsPerTask;
   if (patch.contextSharingConsent === null) delete current.contextSharingConsent;
   else if (patch.contextSharingConsent !== undefined) current.contextSharingConsent = patch.contextSharingConsent;
   config.advisor = current as ManagementContext["config"]["advisor"];
@@ -152,6 +160,9 @@ function isConfigLockContention(error: unknown): boolean {
 
 export async function handleAdvisorRoutes(ctx: ManagementContext): Promise<Response | null> {
   const { url, req, config } = ctx;
+  if (url.pathname === "/api/advisor/activity" && req.method === "GET") {
+    return jsonResponse({ entries: advisorActivityStore(config).snapshot(), retention: "process", limit: 100 }, 200, req, config);
+  }
   if (url.pathname !== "/api/advisor/settings") return null;
 
   if (req.method === "GET") return jsonResponse(advisorInfo(config), 200, req, config);

package/src/server/management/claude-desktop-picker-routes.ts

@@ -44,7 +44,7 @@ export function pickerPreferenceOn(config: Pick<OcxConfig, "claudeCode">): boole
 }
 
 const PICKER_BODY_KEYS = new Set(["enabled", "persist", "trustedLocally", "callerAddedTrust"]);
-/** Enable outcomes that are progress, not refusal: on, waiting for a Desktop restart, or for the keychain step. */
+/** Enable outcomes that are progress, not refusal: on, waiting for a Desktop restart, or for certificate trust. */
 const ENABLE_ACCEPTED = new Set(["active", "restart_required", "trust_pending"]);
 
 interface PickerRequestBody { enabled: boolean; persist: boolean; trustedLocally?: boolean; callerAddedTrust?: boolean }