@bitkyc08/opencodex 2.91.0 → 2.92.0

package/src/link/tunnel-state.ts

@@ -9,18 +9,35 @@
  *   Without a retry policy it needs the user. With one (the Home's `-R` supervisor and the Child's
  *   own `-L` tunnel both run with one) a reason that has a delay is tried again at `retryAt`, and
  *   the retry attempt runs with `inFlight` while the state still reads failed; a reason without a
- *   delay stays terminal.
+ *   delay stays terminal. Each retry that fails again doubles the next delay, up to the policy's
+ *   `maxRetryDelayMs`; `retries` counts those failed retries (absent before the first one). A due
+ *   retry whose ssh could not even be started counts too (`failedSpawnTunnel`).
  */
 
 export type TunnelFailure = "auth" | "hostkey" | "forward" | "timeout";
-export type StderrClass = "auth" | "hostkey" | "forward" | "network" | "unknown";
+/**
+ * `remote_forward` is the Home's `-R` request refused by the peer's sshd: the port is still held,
+ * usually by an earlier session the peer has not dropped yet. It fails the link as `forward` and
+ * keeps the finer cause in `detail`.
+ */
+export type StderrClass = "auth" | "hostkey" | "forward" | "remote_forward" | "network" | "unknown";
+export type TunnelFailureDetail = "remote_forward_conflict";
 
 export type TunnelState =
   | { kind: "idle" }
   | { kind: "connecting"; since: number }
   | { kind: "connected"; since: number }
   | { kind: "reconnecting"; since: number; attempt: number; retryAt: number; inFlight: boolean }
-  | { kind: "failed"; since: number; reason: TunnelFailure; retryAt?: number; inFlight?: boolean };
+  | {
+    kind: "failed";
+    since: number;
+    reason: TunnelFailure;
+    retryAt?: number;
+    inFlight?: boolean;
+    /** Failed retries since the link failed; absent until the first retry fails. */
+    retries?: number;
+    detail?: TunnelFailureDetail;
+  };
 
 export type TunnelEvent =
   | { type: "spawn"; now: number }
@@ -29,9 +46,13 @@ export type TunnelEvent =
   | { type: "tick"; now: number }
   | { type: "stop" };
 
-/** Opt-in retry of a failed tunnel: the delay before each failure reason is tried again. */
+/**
+ * Opt-in retry of a failed tunnel: the first delay before each failure reason is tried again, and
+ * the cap the doubling delay of later retries stops at.
+ */
 export interface TunnelRetryPolicy {
   retryFailedAfterMs: Partial<Record<TunnelFailure, number>>;
+  maxRetryDelayMs?: number;
 }
 
 export const FAILED_AFTER_MS = 5 * 60_000;
@@ -39,19 +60,20 @@ export const BASE_DELAY_MS = 1_000;
 export const MAX_DELAY_MS = 30_000;
 
 /**
- * The client-owned tunnel's policy. Timeout and forward failures retry about once a minute. Auth
- * retries every five minutes, and because each auth failure schedules the next attempt five
- * minutes out, no more than 12 attempts reach the Home's sshd in an hour. A changed host key is a
- * security signal and is never retried.
+ * The client-owned tunnel's policy. Timeout and forward failures are first retried after a minute,
+ * and each retry that fails again doubles the delay up to five minutes (60, 120, 240, then every
+ * 300 seconds). Auth starts at the five-minute cap, so no more than 12 attempts reach the Home's
+ * sshd in an hour. A changed host key is a security signal and is never retried.
  */
 export const CLIENT_TUNNEL_RETRY_POLICY: TunnelRetryPolicy = {
   retryFailedAfterMs: { timeout: 60_000, forward: 60_000, auth: 5 * 60_000 },
+  maxRetryDelayMs: 5 * 60_000,
 };
 
 /**
  * The Home's `-R` supervisor dials the Child's sshd on the same cadence and limits. A sleep, an
- * outage longer than FAILED_AFTER_MS, or a forward the Child's sshd still holds for the session
- * that just died heals about a minute after it clears, instead of waiting for a proxy restart.
+ * outage longer than FAILED_AFTER_MS, or a forward the Child's sshd still holds for a session that
+ * died heals at most five minutes after it clears, instead of waiting for a proxy restart.
  */
 export const HOME_TUNNEL_RETRY_POLICY: TunnelRetryPolicy = CLIENT_TUNNEL_RETRY_POLICY;
 
@@ -65,23 +87,59 @@ export function nextDelayMs(attempt: number, random: () => number = Math.random)
   return Math.round(Math.min(MAX_DELAY_MS, base * jitter));
 }
 
+/** The delay before the next retry of `reason` after `retries` failed retries, or undefined. */
+export function failedRetryDelayMs(reason: TunnelFailure, retries: number, policy?: TunnelRetryPolicy): number | undefined {
+  const base = policy?.retryFailedAfterMs[reason];
+  if (base === undefined) return undefined;
+  const cap = Math.max(base, policy?.maxRetryDelayMs ?? base);
+  return Math.min(cap, base * 2 ** Math.max(0, Math.min(retries, 16)));
+}
+
 /** A failed state; under a policy that retries `reason` it carries the next attempt's time. */
 export function failedTunnel(
   reason: TunnelFailure,
   now: number,
   policy?: TunnelRetryPolicy,
   since: number = now,
+  options: { retries?: number; detail?: TunnelFailureDetail } = {},
 ): TunnelState {
-  const delay = policy?.retryFailedAfterMs[reason];
+  const retries = options.retries ?? 0;
+  const delay = failedRetryDelayMs(reason, retries, policy);
+  const extra = {
+    ...(retries > 0 ? { retries } : {}),
+    ...(options.detail ? { detail: options.detail } : {}),
+  };
   return delay === undefined
-    ? { kind: "failed", since, reason }
-    : { kind: "failed", since, reason, retryAt: now + delay, inFlight: false };
+    ? { kind: "failed", since, reason, ...extra }
+    : { kind: "failed", since, reason, retryAt: now + delay, inFlight: false, ...extra };
+}
+
+/**
+ * The state after an attempt whose ssh could not be started (ssh missing, a pidfile that cannot be
+ * written, no listener port). On a due retry of a failed link it counts as one more failed retry
+ * from the original moment and keeps the reason it was retrying: an attempt that reached no peer
+ * says nothing new about the link, so the backoff keeps its step and an auth failure keeps its
+ * five-minute cadence. Any other state fails fresh with `reason`.
+ */
+export function failedSpawnTunnel(
+  prior: TunnelState | undefined,
+  reason: TunnelFailure,
+  now: number,
+  policy?: TunnelRetryPolicy,
+): TunnelState {
+  if (prior?.kind !== "failed") return failedTunnel(reason, now, policy);
+  return failedTunnel(prior.reason, now, policy, prior.since, { retries: (prior.retries ?? 0) + 1, detail: prior.detail });
 }
 
 function failureOf(cls: StderrClass): TunnelFailure | null {
+  if (cls === "remote_forward") return "forward";
   return cls === "auth" || cls === "hostkey" || cls === "forward" ? cls : null;
 }
 
+function detailOf(cls: StderrClass): TunnelFailureDetail | undefined {
+  return cls === "remote_forward" ? "remote_forward_conflict" : undefined;
+}
+
 export function reduceTunnel(
   state: TunnelState,
   event: TunnelEvent,
@@ -104,11 +162,15 @@ export function reduceTunnel(
       if (state.kind === "failed") {
         if (!state.inFlight) return state;
         // A retry of a failed link failed again. It stays failed from the original moment; a
-        // transient exit keeps the slow cadence (timeout) instead of restarting fast backoff.
-        return failedTunnel(failureOf(event.stderrClass) ?? "timeout", event.now, policy, state.since);
+        // transient exit keeps the slow cadence (timeout) instead of restarting fast backoff, and
+        // the next delay doubles up to the policy's cap.
+        return failedTunnel(failureOf(event.stderrClass) ?? "timeout", event.now, policy, state.since, {
+          retries: (state.retries ?? 0) + 1,
+          detail: detailOf(event.stderrClass),
+        });
       }
       const failure = failureOf(event.stderrClass);
-      if (failure) return failedTunnel(failure, event.now, policy);
+      if (failure) return failedTunnel(failure, event.now, policy, event.now, { detail: detailOf(event.stderrClass) });
       const since = state.kind === "reconnecting" || state.kind === "connecting" ? state.since : event.now;
       if (event.now - since >= FAILED_AFTER_MS) return failedTunnel("timeout", event.now, policy);
       const attempt = state.kind === "reconnecting" ? state.attempt + 1 : 1;
@@ -137,7 +199,8 @@ export function classifySshStderr(stderr: string): StderrClass {
     || text.includes("no ecdsa host key is known") || text.includes("no ed25519 host key is known")
     || text.includes("no rsa host key is known") || text.includes("host key is known for")) return "hostkey";
   if (text.includes("permission denied") || text.includes("too many authentication failures")) return "auth";
-  if (text.includes("remote port forwarding failed") || text.includes("port forwarding failed")
+  if (text.includes("remote port forwarding failed")) return "remote_forward";
+  if (text.includes("port forwarding failed")
     || text.includes("address already in use") || text.includes("cannot listen to port")
     || text.includes("could not request local forwarding")) return "forward";
   if (text.includes("connection refused") || text.includes("timed out") || text.includes("could not resolve")

package/src/messaging/remote-files.ts

@@ -1,9 +1,24 @@
 import { constants, closeSync, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readSync,
   realpathSync, renameSync, rmdirSync, unlinkSync, writeFileSync } from "node:fs";
+import { spawnSync } from "node:child_process";
 import { dirname, isAbsolute, join } from "node:path";
 import { assertNotRealHomeUnderTest } from "../lib/test-home-guard";
 import { remoteError, REMOTE_LIMITS } from "./remote-contract";
 
+/** macOS reports access ACLs separately from otherwise-private POSIX mode bits. */
+export function macAclOutputIsPrivate(output: string): boolean {
+  const lines = output.trimEnd().split("\n");
+  return lines.length === 1 && /^[d-][rwxStTs-]{9}[.@]?\s/.test(lines[0]!);
+}
+function checkMacAcl(path: string): void {
+  if (process.platform !== "darwin") return;
+  const result = spawnSync("/bin/ls", ["-lde", path], {
+    encoding: "utf8", timeout: 1_000, shell: false, windowsHide: true,
+    env: { ...process.env, LC_ALL: "C" },
+  });
+  if (result.error || result.status !== 0 || result.stderr || !macAclOutputIsPrivate(result.stdout)) throw new Error();
+}
+
 /** Check the entire path ancestry before using the private messaging subtree. */
 export function checkRemoteDirectory(path: string): void {
   checkDirectory(path, true);
@@ -17,6 +32,7 @@ function checkDirectory(path: string, privateLeaf: boolean): void {
     const final = lstatSync(path);
     if (!final.isDirectory() || final.isSymbolicLink()
       || (privateLeaf && (final.uid !== process.getuid!() || (final.mode & 0o077)))) throw new Error();
+    if (privateLeaf) checkMacAcl(path);
     // Root-controlled OS aliases (/tmp and /var on macOS) are not user-controlled redirects.
     for (let entry = path; ; entry = dirname(entry)) {
       const stat = lstatSync(entry);
@@ -81,6 +97,7 @@ export function readRemoteFile(path: string): string | null {
     const stat = fstatSync(fd);
     if (!stat.isFile() || stat.nlink !== 1 || stat.uid !== process.getuid!() || (stat.mode & 0o077)
       || stat.size > REMOTE_LIMITS.storeBytes) throw new Error();
+    checkMacAcl(path);
     const bytes = Buffer.alloc(REMOTE_LIMITS.storeBytes + 1);
     let size = 0;
     while (size < bytes.length) { const count = readSync(fd, bytes, size, bytes.length - size, size); if (!count) break; size += count; }
@@ -98,8 +115,14 @@ export function writeRemoteFile(path: string, text: string, sync = fsyncSync): v
   const temporary = join(dirname(path), `.write-${crypto.randomUUID()}`);
   const fd = openSync(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
   try {
-    try { writeFileSync(fd, text, "utf8"); sync(fd); } finally { closeSync(fd); }
+    try {
+      try { checkMacAcl(temporary); }
+      catch { throw remoteError("unsafe_remote_storage", "Cannot safely publish messaging state: temporary file ACL privacy could not be confirmed."); }
+      writeFileSync(fd, text, "utf8"); sync(fd);
+    } finally { closeSync(fd); }
     renameSync(temporary, path);
+    try { checkMacAcl(path); }
+    catch { throw remoteError("remote_storage_unknown", "Messaging state was replaced, but its ACL privacy and crash durability could not be confirmed; inspect state and permissions before explicit recovery."); }
     syncRemoteDirectory(dirname(path), sync);
   } finally { if (remotePathExists(temporary)) unlinkSync(temporary); }
 }

package/src/oauth/generic-account-failover.ts

@@ -260,9 +260,12 @@ function accountListsModel(providerName: string, accountId: string, model: strin
 /**
  * Model evidence only ranks accounts already eligible and below any configured cap.
  *
- * Kiro and Antigravity both gate models per account. For Antigravity (Claude 4.6 vs 5.5, Argon)
- * an account whose discovered roster lists the model wins; an account whose roster omits it is
- * skipped while any other remains; an account with no roster yet is unknown and stays usable.
+ * Kiro and Antigravity both gate models per account, but only Antigravity's roster is a gate
+ * (#7500). An account whose discovered roster lists the model wins; an account with no fresh
+ * roster is unknown and stays usable after it; an account whose fresh roster omits the model is
+ * never returned, so a field of only such accounts answers EMPTY rather than falling back to them.
+ * Callers treat empty as "no account to move to", and the transport refuses the request through
+ * {@link routeAntigravityModel}. Kiro listings remain a preference only.
  */
 export function preferKiroModelSupport(
   providerName: string, ids: string[], model?: string | null, config?: OcxConfig,
@@ -271,8 +274,7 @@ export function preferKiroModelSupport(
   if (providerName === "google-antigravity") {
     const positive = ids.filter(id => accountListsModel(providerName, id, model) === true);
     if (positive.length) return positive;
-    const notListedAgainst = ids.filter(id => accountListsModel(providerName, id, model) !== false);
-    return notListedAgainst.length ? notListedAgainst : ids;
+    return ids.filter(id => accountListsModel(providerName, id, model) !== false);
   }
   if (providerName !== "kiro") return ids;
   const cap = config?.providers?.kiro?.oauthAccountFailover?.maxConcurrentPerAccount;
@@ -282,6 +284,83 @@ export function preferKiroModelSupport(
   return positive.length ? positive : ids;
 }
 
+/** Where an Antigravity request may be sent, judged from per-account model discovery (#7500). */
+export type AntigravityModelRoute =
+  | { readonly kind: "keep" }
+  | { readonly kind: "reroute"; readonly accountId: string }
+  | { readonly kind: "refuse"; readonly message: string };
+
+const KEEP_ANTIGRAVITY_ROUTE: AntigravityModelRoute = { kind: "keep" };
+
+/** Client-facing refusal when no usable account's discovery lists the model. Mirrored in docs-site. */
+export function antigravityModelUnlistedMessage(model: string): string {
+  return `No usable Google Antigravity account lists the model "${model}" in its model discovery. `
+    + "Choose a model your accounts list, or add an account that has access to it.";
+}
+
+/** Client-facing refusal when the chosen account omits the model but a sibling may serve it. */
+export function antigravitySelectedAccountUnlistedMessage(model: string): string {
+  return `The selected Google Antigravity account does not list the model "${model}" in its model discovery. `
+    + "Select an account that lists it, or enable oauthAccountFailover so OpenCodex can choose one.";
+}
+
+/**
+ * Fail-closed model routing for Antigravity (#7500).
+ *
+ * `plannedAccountId` is the account the request would otherwise be sent with. It is kept unless
+ * its own fresh roster omits the model: absence of a roster is unknown, never a denial, because
+ * rosters live in memory, are refreshed only for the account active during discovery, and expire
+ * after six hours, so a restart must not take every account out of service.
+ *
+ * A planned account with a proven omission is replaced by a usable sibling (not paused, not
+ * flagged for reauth) that lists the model, then by one whose roster is unknown; siblings out
+ * of cooldown win over cooled ones within each tier. Moving a request before upstream refused it
+ * is a proactive choice, so a replacement needs {@link isProactivePreferenceEnabled}, exactly as
+ * Kiro's known-refusal exclusion does. Otherwise, or when no sibling qualifies, the request is
+ * refused locally instead of being sent to an account known not to serve the model.
+ */
+export function routeAntigravityModel(
+  config: OcxConfig,
+  providerName: string,
+  plannedAccountId: string | null | undefined,
+  model: string | null | undefined,
+  now = Date.now(),
+): AntigravityModelRoute {
+  if (providerName !== "google-antigravity" || !model || !plannedAccountId
+    || accountListsModel(providerName, plannedAccountId, model) !== false) return KEEP_ANTIGRAVITY_ROUTE;
+  const serving = (getAccountSet(providerName)?.accounts ?? [])
+    .filter(account => account.id !== plannedAccountId && account.paused !== true && account.needsReauth !== true)
+    .map(account => account.id)
+    .filter(id => accountListsModel(providerName, id, model) !== false);
+  if (serving.length === 0) return { kind: "refuse", message: antigravityModelUnlistedMessage(model) };
+  if (!isProactivePreferenceEnabled(config, providerName, now)) {
+    return { kind: "refuse", message: antigravitySelectedAccountUnlistedMessage(model) };
+  }
+  const ready = new Set(eligibleFailoverAccounts(providerName, now, classifyModelFamilyForQuota(providerName, model)));
+  const rank = (id: string) => (ready.has(id) ? 0 : 2) + (accountListsModel(providerName, id, model) === true ? 0 : 1);
+  const best = serving.reduce((left, right) => rank(right) < rank(left) ? right : left);
+  return { kind: "reroute", accountId: best };
+}
+
+/**
+ * Client-facing refusal when failover is on and a sibling may serve the model, but the request
+ * still resolved to an omitting account (the sibling could not be resolved or admitted).
+ */
+export function antigravityReplacementUnavailableMessage(model: string): string {
+  return `The selected Google Antigravity account does not list the model "${model}" in its model discovery, `
+    + "and no account that may serve it could be used for this request. Retry the request.";
+}
+
+/** The refusal for an account that already resolved, or null when it may serve the model. */
+export function antigravityModelRefusal(
+  config: OcxConfig, providerName: string, accountId: string, model: string | null | undefined, now = Date.now(),
+): string | null {
+  const verdict = routeAntigravityModel(config, providerName, accountId, model, now);
+  if (verdict.kind === "keep") return null;
+  // A reroute verdict exists only with failover on, so advising to enable it would be wrong.
+  return verdict.kind === "refuse" ? verdict.message : antigravityReplacementUnavailableMessage(model!);
+}
+
 function kiroModelListingHasRoom(config: OcxConfig, accountId: string, model: string): boolean {
   if (kiroAccountSupportsModel(accountId, model) !== true) return false;
   const cap = config.providers?.kiro?.oauthAccountFailover?.maxConcurrentPerAccount;
@@ -320,7 +399,11 @@ export function hasEligibleGenericOAuthFailoverTarget(
   const set = getAccountSet(providerName);
   if (!set || set.accounts.length < 2) return false;
   const family = classifyModelFamilyForQuota(providerName, requestedModelId);
-  return eligibleIdsIn(set, providerName, now, family).some(id => id !== failedAccountId);
+  // Same model filter rotation applies, so an Antigravity sibling whose roster omits the
+  // model is not advertised as a target rotation would then refuse to pick.
+  const siblings = eligibleIdsIn(set, providerName, now, family).filter(id => id !== failedAccountId);
+  return (providerName === "google-antigravity"
+    ? preferKiroModelSupport(providerName, siblings, requestedModelId) : siblings).length > 0;
 }
 
 /** Select a live Antigravity sibling using activation captured before the refused send. */
@@ -344,7 +427,8 @@ export function rotateAntigravityAccountOnAuthRefusal(
     });
     sweepExpiredOnWrite(now);
   }
-  const eligible = new Set(eligibleIdsIn(set, "google-antigravity", now, family));
+  const eligible = new Set(preferKiroModelSupport("google-antigravity",
+    eligibleIdsIn(set, "google-antigravity", now, family).filter(id => id !== failedAccountId), requestedModelId));
   const order = set.accounts.map(row => row.id);
   const start = order.indexOf(failedAccountId);
   const ring = start >= 0 ? [...order.slice(start + 1), ...order.slice(0, start)] : order;

package/src/oauth/index.ts

@@ -50,6 +50,8 @@ import { validateDevinApiBaseUrl } from "./devin/api-base";
 import { loginGithubCopilot, refreshGithubCopilotToken, validateCopilotApiBaseUrl } from "./github-copilot";
 import { loginCommandCode, refreshCommandCodeToken } from "./command-code";
 import { loginMetaMuse, refreshMetaMuseToken } from "./meta-muse";
+import { loginWorkBuddy, refreshWorkBuddyToken } from "./workbuddy";
+import { WORKBUDDY_CONFIG_URL, workBuddyHeaders } from "../providers/workbuddy";
 import { DSH_ACCOUNT_AUTH } from "./dsh";
 import { loginOrcaRouter, orcaRouterInferenceBaseUrl, refreshOrcaRouterKey } from "./orcarouter";
 import { ANTIGRAVITY_DISCOVERY_UA } from "../adapters/google-antigravity-wire";
@@ -98,6 +100,7 @@ import { normalizeOAuthPlan, mergeOAuthPlan } from "./plan";
 import { mergeAnthropicIdentity, type AnthropicIdentityResolver } from "./anthropic-identity";
 import { AnthropicCrossInstanceDuplicateError, AnthropicLocalCliImportError, assertAnthropicCredentialSource } from "./store-anthropic-instance";
 export interface OAuthAccessSnapshot {
+  workbuddy?: import("./types").WorkBuddyOAuthMetadata;
   provider: string;
   accountId: string;
   generation: string;
@@ -246,6 +249,11 @@ function oauthDefaultModel(id: string): string {
 }
 
 export const OAUTH_PROVIDERS: Record<string, OAuthProviderDef> = {
+  "workbuddy-ai": {
+    login: loginWorkBuddy, refresh: refreshWorkBuddyToken,
+    providerConfig: oauthConfig("workbuddy-ai"), defaultModel: oauthDefaultModel("workbuddy-ai"),
+    defaultRefreshPolicy: "lazy-only",
+  },
   "dsh-account": {
     ...DSH_ACCOUNT_AUTH,
     providerConfig: oauthConfig("dsh-account"),
@@ -561,6 +569,7 @@ function accessSnapshot(provider: string, accountId: string, cred: OAuthCredenti
     accountId,
     generation: credentialGeneration(cred),
     accessToken: cred.access,
+    ...(oauthProvider === "workbuddy-ai" && cred.workbuddy ? { workbuddy: { ...cred.workbuddy } } : {}),
     ...(cred.projectId ? { projectId: cred.projectId } : {}),
     ...(accountApiBaseUrl ? { apiBaseUrl: accountApiBaseUrl } : {}),
     ...(oauthProvider === "zed" && cred.accountId ? { providerUserId: cred.accountId } : {}),
@@ -717,6 +726,7 @@ export async function getValidAccessTokenSnapshot(
 
 /** Providers whose upstream-401 replay path may force a snapshot refresh. */
 const FORCE_REFRESH_PROVIDERS = new Set([
+  "workbuddy-ai",
   "xai",
   "github-copilot",
   "kiro",
@@ -1177,6 +1187,7 @@ function modelDiscoveryTransportSeed(providerName: string, prov: OcxProviderConf
  * `/models` + Bearer with a `{ data: [{ id, owned_by? }] }` response.
  */
 export interface ModelsRequestObservedAuth {
+  readonly workbuddy?: import("./types").WorkBuddyOAuthMetadata;
   readonly oauthApiBaseUrl?: string;
 }
 
@@ -1186,6 +1197,10 @@ export function buildModelsRequest(
   providerName = "",
   observedAuth?: ModelsRequestObservedAuth,
 ): { method?: "POST"; url: string; headers: Record<string, string> } {
+  if (providerName === "workbuddy-ai" || prov.adapter === "workbuddy-ai") {
+    const allowed = mayResolveModelsOAuth(providerName, prov);
+    return { url: WORKBUDDY_CONFIG_URL, headers: workBuddyHeaders(allowed && observedAuth?.workbuddy ? apiKey : undefined, observedAuth?.workbuddy) };
+  }
   const authorizedTarget = captureModelsOAuthTarget(providerName, prov);
   if (prov.authMode === "oauth" && !mayResolveModelsOAuth(providerName, prov)) apiKey = undefined;
   const transportSeed = modelDiscoveryTransportSeed(providerName, prov);

package/src/oauth/model-discovery-auth.ts

@@ -1,3 +1,4 @@
+import { assertWorkBuddyDestination } from "../providers/workbuddy";
 import type { OcxProviderConfig } from "../types";
 import { isBuiltinAnthropicInstanceRow } from "../providers/anthropic-instance";
 import { resolveProviderModelDiscoveryUrl } from "../providers/model-discovery";
@@ -8,6 +9,10 @@ export function mayResolveModelsOAuth(name: string, provider: OcxProviderConfig
   // The DSH account token is pinned to its own adapter and fixed DeepSeek hosts. Its catalog is
   // static, so no discovery path may resolve it, whatever adapter or baseUrl the row was edited to.
   if (name === "dsh-account") return false;
+  if (name === "workbuddy-ai" || provider?.adapter === "workbuddy-ai") {
+    if (name !== "workbuddy-ai" || provider?.adapter !== "workbuddy-ai" || provider.disabled) return false;
+    try { assertWorkBuddyDestination(provider.baseUrl); return true; } catch { return false; }
+  }
   return name !== "anthropic2" || (provider !== undefined && provider.disabled !== true
     && isBuiltinAnthropicInstanceRow(name, provider));
 }

package/src/oauth/store.ts

@@ -23,6 +23,7 @@ import { notifyAuthStoreLoaded } from "../lib/decision-quota-sink";
 import { accountPauseDetailsSchema } from "../config/schema/account-auto-pause";
 import { normalizeOAuthPlan, mergeOAuthPlan } from "./plan";
 import { normalizeAnthropicIdentity, matchesAnthropicImport, mergeAnthropicIdentity } from "./anthropic-identity";
+import { normalizeWorkBuddyMetadata } from "../providers/workbuddy";
 import { findKiroAccountForLogin, withRetainedKiroUser } from "./kiro-account-identity";
 import { isAnthropicInstanceId, type AnthropicInstanceId } from "../providers/anthropic-instance-id";
 import { assertNoCrossAnthropicRegistration, assertAnthropicCredentialSource, assertAnthropicInstanceLoginConfig } from "./store-anthropic-instance";
@@ -354,7 +355,7 @@ export function clearOAuthRefreshIntent(provider: string, accountId: string, gen
   });
 }
 export function credentialGeneration(cred: OAuthCredentials): string {
-  return createHash("sha256").update(JSON.stringify([cred.refresh, cred.access, cred.expires])).digest("hex");
+  return createHash("sha256").update(JSON.stringify([cred.refresh, cred.access, cred.expires, ...(cred.workbuddy ? [cred.workbuddy] : [])])).digest("hex");
 }
 
 /** Load and normalize the OAuth auth store with hardened permissions, and hand the result to the opt-in decision-quota slot (a no-op unless JEV quota signals are active). */
@@ -548,6 +549,8 @@ function normalizeCredential(cred: unknown): OAuthCredentials | null {
   };
   if (typeof candidate.email === "string" && candidate.email.length > 0) normalized.email = candidate.email;
   if (typeof candidate.accountId === "string" && candidate.accountId.length > 0) normalized.accountId = candidate.accountId;
+  const workbuddy = normalizeWorkBuddyMetadata(candidate.workbuddy);
+  if (workbuddy) normalized.workbuddy = workbuddy;
   const identity = normalizeAnthropicIdentity(candidate.anthropicIdentity, candidate.access);
   if (identity) normalized.anthropicIdentity = identity;
   if (candidate.plan !== undefined) normalized.plan = normalizeOAuthPlan(candidate.plan) ?? null;

package/src/oauth/token-guardian.ts

@@ -215,6 +215,13 @@ export async function guardianSweep(nowMs: number = Date.now()): Promise<Guardia
       if (!record || record.deletedAt != null) continue;
       const cred = record.credential;
       if (!cred) continue;
+      // A grant the token endpoint already called revoked or expired cannot be refreshed; posting
+      // it again only buys another 401 per backoff window (#7592). The OAuth branch above skips
+      // needsReauth for the same reason. A re-login or a completed validation rewrites the record
+      // without the marker, which is what readmits the account. A source-linked credential spends
+      // no grant of its own, so it keeps the sweep, matching the quota probe's hold.
+      if (record.lastCodexValidationTerminal === true && record.lastCodexValidationStatus === "failed"
+        && !cred.sourceAuthPath) continue;
       const needsRefresh = cred.expiresAt <= nowMs + horizonMs;
       const needsWarmup = opts.codexWarmupEnabled
         && !record.codexValidationPending

package/src/oauth/types.ts

@@ -54,7 +54,16 @@ export interface MuseOAuthMetadata {
   tierName?: string;
 }
 
+export interface WorkBuddyOAuthMetadata {
+  uid: string;
+  domain: string;
+  enterpriseId?: string;
+  refreshExpiresAt?: number;
+}
+
 export type OAuthCredentials = {
+  /** Account-scoped WorkBuddy identity, kept inside the protected credential store. */
+  workbuddy?: WorkBuddyOAuthMetadata;
   refresh: string;
   access: string;
   /** Epoch ms after any small provider-specific early-refresh margin; the shared gate adds 1 minute. */

package/src/oauth/workbuddy.ts

@@ -0,0 +1,139 @@
+import { randomUUID } from "node:crypto";
+import { setTimeout as delay } from "node:timers/promises";
+import { readBoundedResponseBody } from "../lib/bounded-body";
+import { WORKBUDDY_ORIGIN, WORKBUDDY_USER_AGENT, workBuddyHeaderValue, workBuddyHeaders } from "../providers/workbuddy";
+import type { OAuthController, OAuthCredentials, WorkBuddyOAuthMetadata } from "./types";
+
+type Json = Record<string, unknown>;
+function record(value: unknown): Json {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value as Json : {};
+}
+
+export class WorkBuddyApiError extends Error {
+  constructor(readonly status: number, readonly code: number) {
+    super(`WorkBuddy AI request failed (HTTP ${status}, code ${code})`);
+  }
+}
+
+/** Fixed-origin, bounded reads; upstream error/profile text never enters diagnostics. */
+export async function workBuddyApi(
+  path: string, headers: Record<string, string>, signal?: AbortSignal, post = false, payload: Json = {},
+): Promise<Json> {
+  const timeout = AbortSignal.timeout(15_000);
+  const boundedSignal = signal ? AbortSignal.any([signal, timeout]) : timeout;
+  const response = await fetch(`${WORKBUDDY_ORIGIN}${path}`, {
+    method: post ? "POST" : "GET", redirect: "error", signal: boundedSignal,
+    headers: { "Content-Type": "application/json", Accept: "application/json", "User-Agent": WORKBUDDY_USER_AGENT, ...headers },
+    ...(post ? { body: JSON.stringify(payload) } : {}),
+  }).catch(() => {
+    signal?.throwIfAborted();
+    throw new Error("WorkBuddy AI request unavailable");
+  });
+  const body = await readBoundedResponseBody(response, {
+    signal: boundedSignal, maxBytes: 256 * 1024, totalTimeoutMs: 15_000, inactivityTimeoutMs: 15_000, fatalUtf8: true,
+  }).catch(() => {
+    signal?.throwIfAborted();
+    throw new Error("WorkBuddy AI response unavailable");
+  });
+  let env: Json;
+  try {
+    if (body.oversized || body.truncated || !body.displaySafe) throw new Error();
+    env = record(JSON.parse(body.text));
+  } catch {
+    signal?.throwIfAborted();
+    if (!response.ok) throw new WorkBuddyApiError(response.status, -1);
+    throw new Error("WorkBuddy AI returned an invalid response");
+  }
+  const code = typeof env.code === "number" || typeof env.code === "string" && /^\d+$/.test(env.code)
+    ? Number(env.code) : NaN;
+  if (!response.ok || !Number.isFinite(code) || code !== 0) {
+    throw new WorkBuddyApiError(response.status, Number.isSafeInteger(code) ? code : -1);
+  }
+  return record(env.data);
+}
+
+function expiry(got: Json, absolute: string, relative: string, fallback?: number): number | undefined {
+  const at = got[absolute], seconds = got[relative];
+  if (typeof at === "number" && Number.isSafeInteger(at) && at > 0) return at;
+  if (typeof seconds === "number" && Number.isFinite(seconds) && seconds > 0) {
+    const result = Date.now() + seconds * 1000;
+    if (Number.isSafeInteger(result)) return result;
+  }
+  return fallback;
+}
+
+function credentials(got: Json, metadata: WorkBuddyOAuthMetadata, previous?: OAuthCredentials): OAuthCredentials {
+  const access = got.accessToken;
+  const refresh = got.refreshToken ?? previous?.refresh;
+  const expires = expiry(got, "expiresAt", "expiresIn");
+  const domain = got.domain ?? metadata.domain;
+  if (!workBuddyHeaderValue(access, 32768) || !workBuddyHeaderValue(refresh, 32768)
+    || !expires || expires <= Date.now() || !workBuddyHeaderValue(domain)) throw new Error("WorkBuddy AI returned invalid credentials");
+  return {
+    access, refresh, expires, source: "oauth",
+    // A uid may belong to both a personal plan and a team; they are separate account slots.
+    accountId: JSON.stringify([metadata.uid, metadata.enterpriseId ?? ""]),
+    workbuddy: { ...metadata, domain,
+      refreshExpiresAt: expiry(got, "refreshExpiresAt", "refreshExpiresIn", metadata.refreshExpiresAt) },
+  };
+}
+
+async function poll(path: string, headers: Record<string, string>, retryCode: number, signal: AbortSignal): Promise<Json> {
+  while (true) {
+    signal.throwIfAborted();
+    try {
+      const result = await workBuddyApi(path, headers, signal);
+      if (Object.keys(result).length) return result;
+    } catch (error) {
+      if (!(error instanceof WorkBuddyApiError) || (error.code !== retryCode && ![408, 429].includes(error.status))) throw error;
+    }
+    await delay(1000, undefined, { signal });
+  }
+}
+
+export async function loginWorkBuddy(ctrl: OAuthController): Promise<OAuthCredentials> {
+  const deadline = AbortSignal.timeout(5 * 60_000);
+  const signal = ctrl.signal ? AbortSignal.any([ctrl.signal, deadline]) : deadline;
+  signal.throwIfAborted();
+  const state = await workBuddyApi("/v2/plugin/auth/state?platform=workbuddy-ai", {
+    "X-No-Authorization": "true", "X-No-User-Id": "true",
+    "X-No-Enterprise-Id": "true", "X-No-Department-Info": "true",
+  }, signal, true);
+  if (!workBuddyHeaderValue(state.state, 4096) || typeof state.authUrl !== "string" || state.authUrl.length > 8192) throw new Error("WorkBuddy AI returned an invalid login state");
+  let url: URL;
+  try { url = new URL(state.authUrl); } catch { throw new Error("WorkBuddy AI returned an invalid login URL"); }
+  if (![WORKBUDDY_ORIGIN, "https://www.codebuddy.ai"].includes(url.origin) || url.username || url.password) throw new Error("WorkBuddy AI returned an untrusted login URL");
+  url.searchParams.set("version", "2.0.0");
+  url.searchParams.set("loginSessionId", randomUUID());
+  ctrl.onAuth?.({ url: url.href, instructions: "Sign in to WorkBuddy AI in your browser. OpenCodex will finish automatically." });
+  const query = encodeURIComponent(state.state);
+  const token = await poll(`/v2/plugin/auth/token?state=${query}`, {}, 11217, signal);
+  if (!workBuddyHeaderValue(token.accessToken, 32768)) throw new Error("WorkBuddy AI returned no access token");
+  const domain = token.domain ?? "www.workbuddy.ai";
+  if (!workBuddyHeaderValue(domain)) throw new Error("WorkBuddy AI returned an invalid account domain");
+  const headers = { Authorization: `Bearer ${token.accessToken}`, "X-Domain": domain, "X-No-User-Id": "true", "X-No-Enterprise-Id": "true" };
+  const who = await poll(`/v2/plugin/login/account?state=${query}`, headers, 12151, signal);
+  if (!workBuddyHeaderValue(who.uid)) throw new Error("WorkBuddy AI account identity unavailable");
+  let enterpriseId = who.enterpriseId;
+  if (!enterpriseId && typeof who.type === "string" && who.type.toLowerCase() !== "personal") {
+    const result = await workBuddyApi("/v2/plugin/accounts", headers, signal);
+    const mine = (Array.isArray(result.accounts) ? result.accounts : []).map(record)
+      .filter(a => a.uid === who.uid && workBuddyHeaderValue(a.enterpriseId));
+    const same = mine.filter(a => a.type === who.type), last = mine.filter(a => a.lastLogin === true);
+    enterpriseId = (same.length === 1 ? same[0] : last.length === 1 ? last[0] : mine.length === 1 ? mine[0] : undefined)?.enterpriseId;
+    if (!enterpriseId) throw new Error("WorkBuddy AI team identity unavailable; sign in again");
+  }
+  if (enterpriseId !== undefined && enterpriseId !== "" && !workBuddyHeaderValue(enterpriseId)) throw new Error("WorkBuddy AI returned an invalid team identity");
+  return credentials(token, { uid: who.uid, domain, ...(enterpriseId ? { enterpriseId: enterpriseId as string } : {}) });
+}
+
+export async function refreshWorkBuddyToken(refresh: string, signal?: AbortSignal, previous?: OAuthCredentials): Promise<OAuthCredentials> {
+  const metadata = previous?.workbuddy;
+  if (!metadata || !workBuddyHeaderValue(refresh, 32768)) throw new Error("WorkBuddy AI requires a new browser login");
+  if (metadata.refreshExpiresAt && metadata.refreshExpiresAt <= Date.now()) throw new Error("WorkBuddy AI refresh token expired; sign in again");
+  const headers = workBuddyHeaders(undefined, metadata);
+  headers["X-Refresh-Token"] = refresh;
+  headers["X-Auth-Refresh-Source"] = "plugin";
+  const token = await workBuddyApi("/v2/plugin/auth/token/refresh", headers, signal, true);
+  return credentials(token, metadata, previous);
+}