@bitkyc08/opencodex 2.89.0 → 2.91.0

package/src/server/responses/request-transport.ts

@@ -71,7 +71,8 @@ import {
   resolveCurrentProviderApiKeyTransport,
 } from "../../providers/api-key-selection";
 import { resolveAdapter, resolveWireProtocolOverride } from "../adapter-resolve";
-import { physicalSendObserverInit, providerFetch, sendWithConnectionPolicy } from "./fetch-helpers";
+import { codexWsExecutorBinding, physicalSendObserverInit, providerFetch, sendWithConnectionPolicy } from "./fetch-helpers";
+import { deepSeekImageFileBody, needsDeepSeekImageFiles } from "./deepseek-image-files";
 import type { ProviderFetchOptions } from "./fetch-helpers";
 import { captureConfigGeneration } from "../../lib/state-store-sweeper";
 import { recordAnthropicAccountQuotaFromHeadersForInstance, hasPassiveAccountQuota } from "../../providers/quota";
@@ -590,10 +591,62 @@ export async function prepareResponsesTransport(
       };
     }
     const build = resolved.buildRequest.bind(resolved);
+    const fileProvider = route.provider;
+    const fileProviderName = route.providerName;
+    // Persistence consent is configuration: capture its generation with the provider snapshot.
+    const fileConsentGeneration = captureConfigGeneration();
     resolved.buildRequest = async (requestParsed, incoming) => {
       const request = await build(requestParsed, incoming);
       // Capture at adapter creation, never from mutable serving state after an await.
       if (binding) requestBindings.set(request, binding);
+      const allowedImageFileModels = fileProvider.modelCapabilities
+        ? Object.entries(fileProvider.modelCapabilities)
+          .filter(([, cap]) => cap?.deepseekImageFiles === true)
+          .map(([model]) => model)
+        : [];
+      if (allowedImageFileModels.includes(request.outboundModelId ?? requestParsed.modelId) && needsDeepSeekImageFiles(request)) {
+        const consentModel = request.outboundModelId ?? requestParsed.modelId;
+        try {
+          // Ordinary uploads use provider pacing. A queued rebuild retains its enclosing
+          // fetch lease; reacquiring that same concurrency slot would deadlock at a limit of one.
+          const uploadFetch = providerFetch(fileProvider, options.codexWsRuntimeIdentity, {
+            httpOnly: true, providerName: fileProviderName, modelId: requestParsed.modelId,
+            beforeDispatch: () => {
+              if (!selectionIsCurrent(binding)) throw new Error("Credential selection changed before image upload");
+              // A queued upload must not outlive a revoked opt-in or a configuration reload.
+              if (captureConfigGeneration() !== fileConsentGeneration
+                || fileProvider.modelCapabilities?.[consentModel]?.deepseekImageFiles !== true) {
+                throw new Error("DeepSeek image file consent changed before image upload");
+              }
+            },
+          });
+          const uploadSignal = incoming.abortSignal ?? options.abortSignal ?? req.signal;
+          const pacedUpload: typeof fetch = incoming.dispatchPacingHeld
+            ? (async (input, init) => {
+              // The inference lease owns concurrency, but each physical upload still
+              // consumes an interval slot, including after a credential rebuild.
+              const slot = await waitForProviderRequestSlot(fileProviderName, fileProvider, requestParsed.modelId,
+                init?.signal ?? uploadSignal, { concurrency: false });
+              try { return await uploadFetch.unpacedFetch!(input, init); }
+              finally { releaseProviderRequestSlot(slot); }
+            }) as typeof fetch
+            : uploadFetch;
+          const body = await deepSeekImageFileBody(request, pacedUpload,
+            uploadSignal, {
+              allowedModels: allowedImageFileModels, budget: incoming.translatorBudget,
+            });
+          if (body !== undefined) {
+            request.releaseBodyObservation?.();
+            request.body = body;
+            const headers = new Headers(request.headers);
+            headers.delete("content-length");
+            request.headers = Object.fromEntries(headers);
+            request.releaseBodyObservation = incoming.translatorBudget.observeExternallyCapped(
+              "passthrough_serialization", Buffer.byteLength(body, "utf8"),
+            );
+          }
+        } catch (error) { request.releaseBodyObservation?.(); throw error; }
+      }
       return request;
     };
     if (resolved.runTurn) {
@@ -758,7 +811,8 @@ export async function prepareResponsesTransport(
           pacingChanged = false;
         }
         if (selectionIsCurrent(requestBindings.get(wireRequest)) && copilotSessionExpiresAt > Date.now() + 1000) {
-          const fetchImpl = (route.provider as OcxProviderConfig & { fetch?: typeof globalThis.fetch }).fetch ?? execute;
+          const ws = codexWsExecutorBinding(execute);
+          const fetchImpl = (route.provider as OcxProviderConfig & { fetch?: typeof globalThis.fetch }).fetch ?? ws?.http ?? execute;
           const binding = requestBindings.get(wireRequest);
           const snapshot = anthropicInstance !== undefined && binding?.kind === "oauth"
             ? binding.snapshot : undefined;
@@ -798,7 +852,10 @@ export async function prepareResponsesTransport(
               passiveQuotaWriterGeneration = writerGeneration;
             }
             commitKeyAttemptSend();
-            response = await sendWithConnectionPolicy(
+            // The WS executor dials its own socket: HTTP connection policy and body coding do not apply.
+            // WS eligibility (egress, pacing, URL) was checked for the provider it was built for; a
+            // provider reselected above was not, so it takes the HTTP fallback under its own route.
+            response = ws?.provider === route.provider ? await execute(destination, dispatchInit) : await sendWithConnectionPolicy(
               distributedKeyPhysicalFetch(anthropicBillingPhysicalFetch(fetchImpl, route.providerName, route.provider), route.providerName, route.provider, target),
               destination,
               { ...dispatchInit, redirect: "manual",
@@ -843,6 +900,7 @@ export async function prepareResponsesTransport(
           adapterName: nextAdapter.name, oauthCredentialSnapshot: replayOAuthCredentialSnapshot });
         const rebuilt = await nextAdapter.buildRequest(requestParsed, {
           headers: requestState.selectedForwardHeaders, providerName: route.providerName, translatorBudget,
+          dispatchPacingHeld: true,
           ...(imageTierBias > 0 ? { imageTierBias } : {}),
         });
         const bodySize = checkOutboundBodySize(rebuilt.body, config.maxUpstreamBodyBytes);

package/src/server/restart-replacement.ts

@@ -214,6 +214,9 @@ export interface ReplacementStartIo extends ReplacementReadinessIo {
   logPath?: string | null;
   parentPid?: number;
   retryDelayMs?: number;
+  /** Exit waits for a terminated not-ready replacement; tests shorten them. */
+  termWaitMs?: number;
+  killWaitMs?: number;
 }
 
 export interface ReplacementStartRequest {
@@ -227,10 +230,19 @@ export interface ReplacementStartRequest {
   waitForHealth: boolean;
   /** The replacement's environment, already prepared by the caller; the parent marker is added here. */
   env: NodeJS.ProcessEnv;
+  /**
+   * What a replacement still unready at the deadline means. `handoff` (the default, every
+   * standalone restart) hands off to it anyway, because the parent is about to exit and release
+   * what it may be waiting for. `terminate` is for a parent that keeps serving when the
+   * replacement fails (the client runtime): the replacement is stopped, its exit is observed, and
+   * the call rejects with `not_ready`, so nothing that may still bind the port survives.
+   */
+  notReady?: "handoff" | "terminate";
 }
 
 type AttemptOutcome =
-  | { kind: "spawned" | "ready" | "not-ready"; pid: number | undefined }
+  | { kind: "spawned" | "ready"; pid: number | undefined }
+  | { kind: "not-ready"; pid: number | undefined; terminate: () => Promise<boolean> }
   | { kind: "early-exit"; pid: number | undefined; code: number | null; signal: NodeJS.Signals | null };
 
 function pinnedPort(port: number | undefined): number | undefined {
@@ -314,7 +326,11 @@ function runReplacementAttempt(
       void waitForReplacementReady(child.pid, parentPid, expectedPort, { ...io, cancelled: () => settled }).then(
         // Never kill a live ordinary start at its valid reclaim boundary. Parent exit is the
         // final resource release the child may still be waiting for.
-        ready => { settle({ kind: ready ? "ready" : "not-ready", pid: child.pid }); },
+        ready => {
+          settle(ready
+            ? { kind: "ready", pid: child.pid }
+            : { kind: "not-ready", pid: child.pid, terminate: () => terminateReplacement(child, io) });
+        },
         err => { settle({ error: err }); },
       );
     };
@@ -369,6 +385,11 @@ export async function spawnReplacementStart(
         continue;
       }
       if (outcome.kind === "not-ready") {
+        if (request.notReady === "terminate") {
+          const exited = await outcome.terminate();
+          log?.note(`replacement pid ${pid} did not answer within the readiness window; ${exited ? "stopped it" : "it did not exit after SIGKILL"}`);
+          throw handoffError(exited ? "not_ready" : "not_ready_unstopped");
+        }
         console.warn("Restart replacement is still starting after the readiness window; handing off to it anyway");
         log?.note(`replacement pid ${pid} is still starting after the readiness window; handing off anyway`);
       } else {
@@ -380,3 +401,30 @@ export async function spawnReplacementStart(
     log?.close();
   }
 }
+
+/** Exit-observation budgets for {@link terminateReplacement}. */
+export const REPLACEMENT_TERM_WAIT_MS = 3_000;
+export const REPLACEMENT_KILL_WAIT_MS = 2_000;
+
+function waitForChildExit(child: ChildProcess, ms: number, sleep: (ms: number) => Promise<void>): Promise<boolean> {
+  if (child.exitCode !== null || child.signalCode !== null) return Promise.resolve(true);
+  return new Promise<boolean>(resolve => {
+    let done = false;
+    const finish = (exited: boolean) => { if (!done) { done = true; child.off("exit", onExit); resolve(exited); } };
+    const onExit = () => finish(true);
+    child.once("exit", onExit);
+    void sleep(ms).then(() => finish(child.exitCode !== null || child.signalCode !== null));
+  });
+}
+
+/**
+ * Stop a replacement that never answered: SIGTERM, wait for its exit, then SIGKILL and wait again.
+ * True only once the exit was observed; a kill call alone is not proof the port is free.
+ */
+async function terminateReplacement(child: ChildProcess, io: ReplacementStartIo): Promise<boolean> {
+  const sleep = io.sleep ?? Bun.sleep;
+  try { child.kill("SIGTERM"); } catch { /* exited between the check and the signal */ }
+  if (await waitForChildExit(child, io.termWaitMs ?? REPLACEMENT_TERM_WAIT_MS, sleep)) return true;
+  try { child.kill("SIGKILL"); } catch { /* exited between the check and the signal */ }
+  return waitForChildExit(child, io.killWaitMs ?? REPLACEMENT_KILL_WAIT_MS, sleep);
+}

package/src/server/ws-bridge.ts

@@ -12,6 +12,7 @@ import { sseDataPayload as parseSseBlock } from "./sse-payload-rewrite";
 import { safeResponseHeaders } from "./safe-response-headers";
 import type { AudioSocketTarget } from "./audio-dictation";
 import type { CodexWebSocketActivity } from "../codex/websocket-activity";
+import { AGENT_ASSERTION_HEADER } from "../lib/authorization-scheme";
 
 export { safeResponseHeaders } from "./safe-response-headers";
 
@@ -131,6 +132,10 @@ export function selectForwardHeaders(
   if (codexOverride) {
     selected.set("authorization", `Bearer ${codexOverride.accessToken}`);
     selected.set("chatgpt-account-id", codexOverride.chatgptAccountId);
+  } else {
+    // Kept for the WS turn pipeline, which drops it again everywhere except first-party Direct.
+    const assertion = headers.get(AGENT_ASSERTION_HEADER);
+    if (assertion) selected.set(AGENT_ASSERTION_HEADER, assertion);
   }
   return selected;
 }

package/src/service/cli.ts

@@ -11,6 +11,7 @@ import { statusWinswRaw, type WinswStatus } from "../lib/winsw";
 import { withWindowsServiceMutationLock } from "../lib/windows-service-mutation-lock";
 import { maybeShowStarPrompt } from "../cli/star-prompt";
 import { serviceStatusReport } from "./diagnostics";
+import { collectServiceStatusJson } from "./status-json";
 import { assertServiceAuthEnvironment } from "./auth-preflight";
 import { assertServiceEnvironmentMatchesInstall } from "./guards";
 import { resolveServiceListenPort } from "./definition";
@@ -47,10 +48,14 @@ export function normalizeServiceSubcommand(sub?: string): string {
   return sub ?? "install";
 }
 
+const SERVICE_JSON_STATUS_ONLY = "--json applies to `ocx service status` only.";
+
 export interface ParsedServiceArgs {
   sub: string;
   backend: ServiceBackend | null;
   invalid: string[];
+  /** `--json`: accepted for `status` only; planServiceCommand rejects it elsewhere. */
+  json: boolean;
 }
 
 export type ServiceInstallationState = "installed" | "absent" | "unknown";
@@ -140,6 +145,9 @@ export function planServiceCommand(
   if (parsed.invalid.length > 0) {
     return { ok: false, message: `Unknown service option: ${parsed.invalid.join(" ")}` };
   }
+  if (parsed.json && parsed.sub !== "status") {
+    return { ok: false, message: SERVICE_JSON_STATUS_ONLY };
+  }
   if (parsed.backend && parsed.sub !== "install") {
     return { ok: false, message: "--native/--scheduler apply to `ocx service install` only; other subcommands use the installed backend." };
   }
@@ -174,9 +182,11 @@ export function planServiceCommand(
 export function parseServiceArgs(args: string[]): ParsedServiceArgs {
   let sub: string | undefined;
   let backend: ServiceBackend | null = null;
+  let json = false;
   const invalid: string[] = [];
   for (const arg of args) {
-    if (arg === "--native") {
+    if (arg === "--json") json = true;
+    else if (arg === "--native") {
       if (backend === "scheduler") { invalid.push("--native (conflicts with --scheduler)"); continue; }
       backend = "native";
     }
@@ -188,7 +198,7 @@ export function parseServiceArgs(args: string[]): ParsedServiceArgs {
     else if (sub === undefined) sub = arg;
     else invalid.push(arg);
   }
-  return { sub: normalizeServiceSubcommand(sub), backend, invalid };
+  return { sub: normalizeServiceSubcommand(sub), backend, invalid, json };
 }
 
 /** Remove the service credential only when no client connection can own it. */
@@ -243,6 +253,12 @@ export async function serviceCommand(...args: (string | undefined)[]): Promise<v
       process.exitCode = 1;
       return;
     }
+  // Answered before platformOps() resolves: the JSON status reaches no install, start, stop,
+  // repair or migration path, and an unsupported platform still gets a document, not an exit.
+  if (command === "status" && parsed.json) {
+    console.log(JSON.stringify(await collectServiceStatusJson(), null, 2));
+    return;
+  }
   if (command === "repair" || command === "restart") {
     const verb: ServiceRepairVerb = command === "restart" ? "restart" : "repair";
     assertServiceEnvironmentMatchesInstall();
@@ -488,6 +504,13 @@ export async function serviceCommand(...args: (string | undefined)[]): Promise<v
   };
 
   const preliminary = parseServiceArgs(filteredArgs);
+  // `claim` parses its own --json. Any other verb is refused here, before the Desktop check
+  // and the Windows mutation lock, so a misplaced --json never reaches either.
+  if (preliminary.json && preliminary.sub !== "status" && preliminary.sub !== "claim") {
+    console.error(SERVICE_JSON_STATUS_ONLY);
+    process.exitCode = 1;
+    return;
+  }
   if (preliminary.invalid.length === 0) {
     const refusal = desktopServiceCommandRefusal(preliminary.sub, undefined, supervisionLatch);
     if (refusal) {

package/src/service/diagnostics.ts

@@ -282,16 +282,30 @@ export function diagnoseService(): ServiceDiagnostic {
     const enabled = installed && (() => { try { return sh(`systemctl --user is-enabled ${TASK}`) === "enabled"; } catch { return false; } })();
     const running = installed && (() => { try { return sh(`systemctl --user is-active ${TASK}`) === "active"; } catch { return false; } })();
     const stale = installed && bakedServicePathsDiagnostic() !== null;
-    const viable = installed && enabled && running && !stale;
-    const summary = !installed ? `not installed (${diagnostics})`
-      : stale ? `installed, but stale (systemd user; ${diagnostics})`
-        : viable ? `installed, enabled and running (systemd user; ${diagnostics})`
-          : `installed, but ${!enabled ? "disabled" : "not running"} (systemd user; ${diagnostics})`;
-    return { supported: true, installed, enabled, running, viable, startable: installed && !stale, stale, conflict: false, backend: "systemd", summary };
+    return deriveSystemdServiceDiagnostic({ installed, enabled, running, stale, diagnostics });
   }
   return { supported: false, installed: false, enabled: false, running: false, viable: false, startable: false, stale: false, conflict: false, backend: null, summary: `unsupported on ${process.platform}` };
 }
 
+export interface SystemdServiceDiagnosticInputs {
+  installed: boolean;
+  enabled: boolean;
+  running: boolean;
+  stale: boolean;
+  diagnostics: string;
+}
+
+/** The systemd user-unit verdict, pure so its states are testable without a user bus. */
+export function deriveSystemdServiceDiagnostic(inputs: SystemdServiceDiagnosticInputs): ServiceDiagnostic {
+  const { installed, enabled, running, stale, diagnostics } = inputs;
+  const viable = installed && enabled && running && !stale;
+  const summary = !installed ? `not installed (${diagnostics})`
+    : stale ? `installed, but stale (systemd user; ${diagnostics})`
+      : viable ? `installed, enabled and running (systemd user; ${diagnostics})`
+        : `installed, but ${!enabled ? "disabled" : "not running"} (systemd user; ${diagnostics})`;
+  return { supported: true, installed, enabled, running, viable, startable: installed && !stale, stale, conflict: false, backend: "systemd", summary };
+}
+
 export function serviceStatusSummary(): string {
   return diagnoseService().summary;
 }

package/src/service/orchestration.ts

@@ -238,6 +238,11 @@ export interface ServiceInstallPreparationDeps extends RuntimePreflightDeps {
   supervisionLatch?: SupervisionLatch;
   diagnose?: () => ServiceDiagnostic;
   managerOps?: (backend: ServiceBackend) => ServiceInstallCleanupOps | null;
+  /**
+   * Task Scheduler only: ends surviving launcher/wrapper processes of THIS
+   * installation. Scoped to canonical script/launcher tokens, never a bare PID.
+   */
+  killServiceWrappers?: () => void;
   stopTrackedProxy?: () => Promise<unknown>;
   platform?: NodeJS.Platform;
 }
@@ -279,6 +284,18 @@ export async function prepareServiceInstall(
     if (!manager) throw new Error(`Background service manager is unavailable for ${backend}.`);
     if (manager.status() !== null) manager.stop();
   }
+  if (platform === "win32") {
+    // `schtasks /end` ends the task instance but leaves the cmd `:loop` wrapper
+    // alive to respawn the proxy mid-install — the same survivor
+    // `ocx stop` kills via killWindowsServiceWrapperProcesses. Run it
+    // after every manager has been asked to stop and before the tracked-proxy
+    // kill so a child respawned in that gap is still caught below. It also runs
+    // when no manager stop happened: a registration deleted mid-uninstall can
+    // leave the detached wrapper looping. A manager stop that refused propagates
+    // above before this runs, so the respawner of a still-running service is
+    // never killed.
+    (deps.killServiceWrappers ?? killWindowsServiceWrapperProcesses)();
+  }
   await (deps.stopTrackedProxy ?? stopTrackedProxyIfRunning)();
 }
 

package/src/service/status-json.ts

@@ -0,0 +1,116 @@
+import { diagnoseService, type ServiceDiagnostic } from "./diagnostics";
+import { desktopLoginStatusSummary, diagnoseDesktopStartup } from "./desktop-startup";
+import { confirmServiceServing } from "./health";
+import { ownershipMutationLeaseStatusLine } from "./ownership-mutation-lease.mjs";
+import { LABEL, TASK, serviceLogPath, serviceStatePaths } from "./state";
+import { WINSW_SERVICE_ID } from "../lib/winsw";
+import { runPassiveRead } from "../lib/passive-read";
+
+/** The service manager holding the registration; `none` when nothing is registered. */
+export type ServiceStatusBackend = "launchd" | "systemd" | "schtasks" | "winsw" | "none";
+
+/**
+ * `ocx service status --json`. Additive within `schemaVersion: 1`.
+ *
+ * `running` is the service manager's own verdict — the value `ocx status --json` already
+ * reports as `startup.serviceRunning` — and `serving` says separately whether a proxy
+ * answers on the installed port, because a loaded job that never bound is the failure the
+ * text report exists to show.
+ */
+export interface ServiceStatusJson {
+  schemaVersion: 1;
+  platform: NodeJS.Platform;
+  supported: boolean;
+  backend: ServiceStatusBackend;
+  label: string | null;
+  installed: boolean;
+  enabled: boolean;
+  running: boolean;
+  viable: boolean;
+  stale: boolean;
+  conflict: boolean;
+  serving: { probed: boolean; ok: boolean; port: number | null };
+  summary: string;
+  logPath: string;
+  ownershipLease: string | null;
+  desktopLogin: string | null;
+}
+
+export interface ServiceStatusJsonDeps {
+  platform?: NodeJS.Platform;
+  diagnose?: () => ServiceDiagnostic;
+  serving?: () => Promise<{ ok: boolean; port: number }>;
+  logPath?: () => string;
+  leaseLine?: () => string | null;
+  desktopLogin?: () => string | null;
+}
+
+export function serviceStatusBackend(diag: ServiceDiagnostic): ServiceStatusBackend {
+  if (!diag.supported || !diag.installed) return "none";
+  switch (diag.backend) {
+    case "launchd": return "launchd";
+    case "systemd": return "systemd";
+    case "scheduler": return "schtasks";
+    case "native": return "winsw";
+    default: return "none";
+  }
+}
+
+const BACKEND_LABEL: Record<ServiceStatusBackend, string | null> = {
+  launchd: LABEL,
+  systemd: `${TASK}.service`,
+  schtasks: TASK,
+  winsw: WINSW_SERVICE_ID,
+  none: null,
+};
+
+/**
+ * Passive by construction: it performs the reads `ocx service status` already performs
+ * (manager diagnosis, the loopback serving probe only when a registration exists, the
+ * ownership-lease and Desktop login lines) and nothing else. The caller answers before
+ * `platformOps()` is resolved, so no install, start, stop or repair path is reachable.
+ * The whole collection runs in a passive-read scope: the serving probe resolves the port
+ * through loadConfig(), which outside that scope hardens config modes and backs up a
+ * malformed config — writes an inventory read must not make.
+ */
+export function collectServiceStatusJson(deps: ServiceStatusJsonDeps = {}): Promise<ServiceStatusJson> {
+  return runPassiveRead(() => collectPassively(deps));
+}
+
+async function collectPassively(deps: ServiceStatusJsonDeps): Promise<ServiceStatusJson> {
+  const diag = (deps.diagnose ?? diagnoseService)();
+  const backend = serviceStatusBackend(diag);
+  let serving: ServiceStatusJson["serving"] = { probed: false, ok: false, port: null };
+  if (diag.installed) {
+    // A probe that throws (config load, port resolution) must not cost the caller the whole
+    // document; it is reported as probed, not serving, with no port.
+    try {
+      const result = await (deps.serving ?? (() => confirmServiceServing({ timeoutMs: 1_500 })))();
+      serving = { probed: true, ok: result.ok, port: result.port };
+    } catch {
+      serving = { probed: true, ok: false, port: null };
+    }
+  }
+  const desktopLogin = deps.desktopLogin ?? (() => {
+    const desktop = diagnoseDesktopStartup();
+    return desktop ? desktopLoginStatusSummary(desktop) : null;
+  });
+  return {
+    schemaVersion: 1,
+    platform: deps.platform ?? process.platform,
+    supported: diag.supported,
+    backend,
+    label: BACKEND_LABEL[backend],
+    installed: diag.installed,
+    enabled: diag.enabled,
+    running: diag.running,
+    viable: diag.viable,
+    stale: diag.stale,
+    conflict: diag.conflict,
+    serving,
+    summary: diag.summary,
+    logPath: (deps.logPath ?? serviceLogPath)(),
+    ownershipLease: (deps.leaseLine ?? (() => ownershipMutationLeaseStatusLine(serviceStatePaths())))() ?? null,
+    desktopLogin: desktopLogin(),
+  };
+}

package/src/types/config.ts

@@ -2,7 +2,9 @@ import type { OcxProviderConfig } from "./provider";
 import type { CodexAccount } from "./accounts";
 import type { AnthropicAccountPoolConfig, OcxAccountPoolRotationStrategy } from "./anthropic-account-pool";
 import type { AnthropicInstanceId } from "../providers/anthropic-instance-id";
+import type { OcxFallbackConfig } from "./fallback";
 export type { AnthropicAccountPoolConfig, AnthropicModelRoute, OcxAccountPoolRotationStrategy, OcxAccountPoolQuotaWindow } from "./anthropic-account-pool";
+export type { OcxFallbackConfig, OcxFallbackDeviceConfig, OcxFallbackKind, OcxFallbackSwitches } from "./fallback";
 
 /** Public inference API exposure. Responses and Chat Completions are always served. */
 export interface OcxApiSurfacesConfig {
@@ -1361,6 +1363,11 @@ export interface OcxConfig {
   tokenGuardian?: OcxTokenGuardianConfig;
   /** Additional exact origins allowed for CORS (e.g. HTTPS or chrome-extension://<id>). Loopback origins are always allowed. */
   corsAllowOrigins?: string[];
+  /**
+   * OCX-11 fallback off: refuse model or provider fallback per scope, and record per-device local
+   * fallback permission. Absent keeps every chain as it was. See src/routing/fallback-policy.ts.
+   */
+  fallback?: OcxFallbackConfig;
 }
 
 export type OcxComboStrategy = "failover" | "round-robin" | "random" | "least-used" | "reset-window" | "jev";

package/src/types/fallback.ts

@@ -0,0 +1,38 @@
+/**
+ * OCX-11 fallback policy (`fallback` in config.json). Every leaf is optional and absence keeps
+ * today's behavior: model and provider fallback allowed, local fallback not granted.
+ *
+ * Contract and precedence: `src/routing/fallback-policy.ts` and `structure/fallback-policy.md`.
+ */
+
+/** A fallback kind this policy governs. Intra-pool account or key rotation is not one of them. */
+export type OcxFallbackKind = "model" | "provider";
+
+export interface OcxFallbackSwitches {
+  /** false refuses a hop to another model of the same provider. */
+  model?: boolean;
+  /** false refuses a hop to another provider. */
+  provider?: boolean;
+}
+
+export interface OcxFallbackDeviceConfig extends OcxFallbackSwitches {
+  /**
+   * Permission only: true tells GOAT it may move this device's work to the device's own
+   * providers while the Home is unreachable. OpenCodex itself never serves a Child or Hub client
+   * from local providers; absent or false means no permission.
+   */
+  localFallback?: boolean;
+}
+
+export interface OcxFallbackConfig extends OcxFallbackSwitches {
+  /**
+   * Keyed by the provider a hop leaves: the resolved provider of the target that just failed or
+   * is known unavailable. In combo [a, b, c] with providers.b.provider false, a to b is allowed and
+   * b to c is refused.
+   */
+  providers?: Record<string, OcxFallbackSwitches>;
+  /** Keyed by an exact public selector: combo/<id>, policy/<id>, provider/model or an alias. */
+  routes?: Record<string, OcxFallbackSwitches>;
+  /** Keyed by a Remote Link id (lnk_…) or a Hub-client data key id. Read on the Home. */
+  devices?: Record<string, OcxFallbackDeviceConfig>;
+}

package/src/types/provider.ts

@@ -288,6 +288,8 @@ export interface ModelCapabilities {
   /** Requested tier only; does not imply an upstream window or activate an unverified wire. */
   contextTier?: "default" | "long_context";
   video?: { processing?: "static" | "agentic" };
+  /** Opt in exact first-party DeepSeek models to one-hour image file persistence. */
+  deepseekImageFiles?: boolean;
 }
 
 export interface OcxProviderConfig {

package/src/types/request.ts

@@ -322,8 +322,23 @@ export interface OcxDocumentContent {
   filename?: string;
 }
 
+/**
+ * Inline audio carried by Codex's Responses input. Chat Completions accepts this as an
+ * `input_audio` content part only for WAV and MP3 payloads, so the normalized form keeps the
+ * base64 bytes and a wire-safe format label rather than the original data URL.
+ */
+export interface OcxAudioContent {
+  type: "audio";
+  /** Base64 payload with no `data:` prefix. */
+  data: string;
+  /** Chat Completions input_audio supports WAV and MP3. */
+  format: "mp3" | "wav";
+  /** Text marker for wires that cannot carry the bytes. */
+  text: string;
+}
+
 /** A user/developer message content part: text, native media, or an attached document. */
-export type OcxContentPart = OcxTextContent | OcxImageContent | OcxVideoContent | OcxDocumentContent;
+export type OcxContentPart = OcxTextContent | OcxImageContent | OcxVideoContent | OcxDocumentContent | OcxAudioContent;
 
 export interface OcxThinkingContent {
   type: "thinking";

package/src/types.ts

@@ -51,6 +51,7 @@ export type {
   OcxToolResultMessage,
   OcxTextContent,
   OcxImageContent,
+  OcxAudioContent,
   OcxDocumentContent,
   OcxContentPart,
   OcxThinkingContent,

package/src/web-search/loop.ts

@@ -24,7 +24,7 @@ import type { WebSearchBackendId } from "./index";
 import { pacingHeaderDeadline } from "./header-deadline";
 import { redactSecretString } from "../lib/redact";
 import { readBoundedResponseBody } from "../lib/bounded-body";
-import { applyUpstreamRecoveryInit, fetchWithResetRetry, prepareSameTarget429Wait, isNonReplayableResponse, SendBudgetExhaustedError } from "../lib/upstream-retry";
+import { applyUpstreamRecoveryInit, fetchWithResetRetry, prepareSameTarget429Wait, isNonReplayableResponse, isSameTargetRetryHold, SendBudgetExhaustedError } from "../lib/upstream-retry";
 import { rateLimitRetryDelayMs } from "../providers/key-failover";
 import { RequestPacingQueueOverloadError } from "../providers/request-pacing";
 import {
@@ -670,7 +670,7 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
       // Same-target 429 wait-and-retry (opt-in `retryOn429`) BEFORE key rotation: a primary-key
       // rate-limit blip replays on the SAME key; rotation only runs after attempts exhaust.
       while (
-        prepared.response.status === 429
+        prepared.response.status === 429 && !isSameTargetRetryHold(prepared.response)
         && rateLimitRetryPolicy !== null
         && rateLimitRetries < rateLimitRetryPolicy.attempts
       ) {