@iislee/opencodex 2.11.0 → 2.31.0

package/src/server/management/shared.ts

@@ -28,7 +28,7 @@ import { deriveProviderPresets } from "../../providers/derive";
 import { providerCodexAccountMode } from "../../providers/registry";
 import { routedSlug, slugEquals } from "../../providers/slug-codec";
 import { clearProviderQuotaCache, fetchProviderQuotaReports } from "../../providers/quota";
-import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
+import { isCanonicalOpenAiForwardProvider, OPENAI_CODEX_PROVIDER_ID } from "../../providers/openai-tiers";
 import { clearThreadAccountMap } from "../../codex/routing";
 import { primeCodexPoolQuotas } from "../../codex/auth-api";
 import { DEFAULT_PROVIDER_CONTEXT_CAP, globalContextCapValue, providerContextCap, providerContextCaps, setAllProviderContextCaps, setGlobalContextCapValue, setProviderContextCap } from "../../providers/context-cap";
@@ -51,7 +51,7 @@ import type { OcxClaudeCodeConfig, OcxClaudeDesktopProfile, OcxConfig, OcxCustom
 import type { DesktopProfileModel } from "../../claude/desktop-profile";
 import { drainAndShutdown } from "../lifecycle";
 import { filterRequestLogs, getRequestLogEntries, type RequestLogEntry } from "../request-log";
-import { estimateComboCost, estimateRequestCost, effectiveServiceTier, normalizeCostTokens, tokensPerSecond } from "../../usage/cost";
+import { estimateComboCost, estimateRequestCost, serviceTierContext, normalizeCostTokens, tokensPerSecond } from "../../usage/cost";
 import type { PersistedUsageAttempt } from "../../usage/log";
 import { isAllowedRequestOrigin, jsonResponse, providerManagementConfigError, publicProviderBaseUrl, safeConfigDTO } from "../auth-cors";
 import { applySystemEnvToggle } from "../system-env";
@@ -82,13 +82,18 @@ export type TokPerSecondResult =
   | { kind: "value"; value: number; estimated: boolean }
   | { kind: "unavailable"; reason: MetricUnavailableReason };
 
-export type CostEstimateReason = "usage_estimated" | "cache_detail_missing" | "expected_price_overlay";
+export type CostEstimateReason =
+  | "usage_estimated"
+  | "cache_detail_missing"
+  | "expected_price_overlay"
+  | "provider_cost_overlay"
+  | "priority_lower_bound";
 
 export type CostResult =
   | { kind: "value"; estimate: NonNullable<ReturnType<typeof estimateRequestCost>>; estimateReasons: CostEstimateReason[] }
   | { kind: "unavailable"; reason: MetricUnavailableReason };
 
-export type MetricSource = Pick<RequestLogEntry, "provider" | "model" | "durationMs" | "usageStatus" | "usage" | "requestedServiceTier" | "configuredServiceTier" | "responseServiceTier"> & {
+export type MetricSource = Pick<RequestLogEntry, "provider" | "model" | "durationMs" | "usageStatus" | "usage" | "requestedServiceTier" | "configuredServiceTier" | "responseServiceTier" | "tierOutcome"> & {
   attempts?: readonly PersistedUsageAttempt[];
 };
 
@@ -123,8 +128,9 @@ export function unavailableCostReason(entry: MetricSource): MetricUnavailableRea
   return "price_unmatched";
 }
 
+/** Display-time cost estimate for one log entry (or its attempt list), including the reasons that qualify the estimate. */
 export function costResult(entry: MetricSource): CostResult {
-  const tier = effectiveServiceTier(entry);
+  const tier = serviceTierContext(entry);
   const estimate = entry.attempts?.length
     ? estimateComboCost(entry.attempts, undefined, tier)
     : estimateRequestCost({ provider: entry.provider, model: entry.model, usage: entry.usage, usageStatus: entry.usageStatus, serviceTier: tier });
@@ -136,6 +142,9 @@ export function costResult(entry: MetricSource): CostResult {
       && entry.usage.cacheCreationInputTokens === undefined ? "cache_detail_missing" as const : undefined,
     estimate.price?.source === "expected" || estimate.attempts?.some(a => a.price.source === "expected")
       ? "expected_price_overlay" as const : undefined,
+    estimate.price?.source === "user" || estimate.attempts?.some(a => a.price.source === "user")
+      ? "provider_cost_overlay" as const : undefined,
+    estimate.priorityLowerBound ? "priority_lower_bound" as const : undefined,
   ].filter((reason): reason is CostEstimateReason => reason !== undefined);
   return { kind: "value", estimate, estimateReasons };
 }
@@ -166,10 +175,17 @@ export function requestLogDto(entry: RequestLogEntry): Record<string, unknown> {
  * canonical, TTL-cached `gatherRoutedModels` (single source of truth) — so the GUI/codex endpoints
  * share the same fetch, the same per-provider cache (dedups Codex's frequent /v1/models polling),
  * and the same stale fallback when a provider blips, instead of a parallel uncached copy.
+ *
+ * Pass `preferCached: true` for management UI lists that must paint immediately from
+ * cache/configured seeds (background live refresh still runs). Codex catalog sync and
+ * `/v1/models` must keep the default so they wait for the authoritative live set.
  */
-export async function fetchAllModels(config: OcxConfig): Promise<CatalogModel[]> {
+export async function fetchAllModels(
+  config: OcxConfig,
+  options?: { preferCached?: boolean },
+): Promise<CatalogModel[]> {
   const { gatherRoutedModels } = await import("../../codex/catalog");
-  return gatherRoutedModels(config);
+  return gatherRoutedModels(config, options?.preferCached ? { preferCached: true } : undefined);
 }
 
 export interface GrokCandidateModel {
@@ -185,11 +201,11 @@ export interface GrokCandidateModel {
  * from the same two sources as the sync so the two can never disagree.
  */
 export async function fetchGrokCandidateModels(config: OcxConfig): Promise<GrokCandidateModel[]> {
-  const { filterCatalogVisibleModels, nativeOpenAiContextWindow, visibleNativeSlugs } = await import("../../codex/catalog");
+  const { filterCatalogVisibleModels, nativeContextLimits, nativeOpenAiContextWindow, visibleNativeSlugs } = await import("../../codex/catalog");
   const routed = filterCatalogVisibleModels(await fetchAllModels(config), config);
   return [
     ...visibleNativeSlugs(config).map(id => {
-      const contextWindow = nativeOpenAiContextWindow(id);
+      const contextWindow = nativeOpenAiContextWindow(id, nativeContextLimits(config));
       return { id, native: true, ...(contextWindow !== undefined ? { contextWindow } : {}) };
     }),
     ...routed.map(m => ({
@@ -214,7 +230,7 @@ export function stripRegistryOnlyStaticHeaders(name: string, provider: OcxProvid
 
 /** Shared Desktop profile DTO builder for the management API and CLI. */
 export async function buildClaudeDesktopState(config: OcxConfig, stored?: OcxClaudeDesktopProfile) {
-  const { filterCatalogVisibleModels, nativeOpenAiContextWindow, desktopVisibleNativeSlugs } = await import("../../codex/catalog");
+  const { filterCatalogVisibleModels, nativeContextLimits, nativeOpenAiContextWindow, desktopVisibleNativeSlugs } = await import("../../codex/catalog");
   const { DESKTOP_SUPPORTS_1M_THRESHOLD } = await import("../../claude/desktop-3p");
   const { reconcileDesktopProfile, renderDesktopProfile } = await import("../../claude/desktop-profile");
   const routed = filterCatalogVisibleModels(await fetchAllModels(config), config);
@@ -222,7 +238,7 @@ export async function buildClaudeDesktopState(config: OcxConfig, stored?: OcxCla
     // Native rows carry their real context window from the same accessor the Grok sync
     // uses — otherwise Sol's 372k and gpt-5.5's 272k render as blank on Desktop.
     ...desktopVisibleNativeSlugs(config).map(id => {
-      const contextWindow = nativeOpenAiContextWindow(id);
+      const contextWindow = nativeOpenAiContextWindow(id, nativeContextLimits(config));
       return { route: `native/${id}`, label: `${id} (native)`,
         ...(contextWindow !== undefined ? { contextWindow } : {}) };
     }),

package/src/server/management/sidebar-routes.ts

@@ -9,40 +9,54 @@
  * this surface only learns the yes/no answer. `gh` writes the authenticated account
  * name to stderr, so that output is discarded at the source rather than forwarded.
  *
- * The star POST additionally refuses agent-driven programmatic callers. Management
- * auth proves the caller reached the admin token, not that a person chose to star:
- * a coding agent runs on the user's machine and can read that token from disk, so
- * the CLI's "ask the user" deferral would be bypassable with one `curl` here.
+ * The star POST additionally requires a dashboard session. Management auth proves
+ * the caller reached the admin token, not that a person chose to star: a coding
+ * agent runs on the user's machine and can read that token from disk, so the CLI's
+ * "ask the user" deferral would be bypassable with one `curl` here.
  *
- * The dashboard button must keep working even when the proxy itself was started by
- * an agent, which is the common case — the person is at the browser, not at the
- * spawning shell. A GUI click is therefore distinguished by its browser session
- * evidence (a same-origin `Origin` plus the minted CSRF header, both already
- * verified by the management auth gate) rather than by the proxy's own env.
+ * The requirement is unconditional, and that is the point. It used to apply only
+ * when `isAgentDriven()` was true — but that function reads the SERVER's
+ * environment, not the caller's, so a proxy already running as a service (no agent
+ * markers, the normal remote setup) accepted a raw-token star from anyone who could
+ * read the token, which includes every agent on the machine. The provenance of the
+ * HTTP caller is not knowable from the server's env; only the credential is. So the
+ * mutation asks for a GUI session this process minted for a browser, which the auth
+ * gate accepts only after matching origin and the per-session CSRF token.
  */
 import { jsonResponse } from "../auth-cors";
-import { agentDrivenMarkers, isAgentDriven } from "../../cli/agent-driven";
+import { agentDrivenMarkers } from "../../cli/agent-driven";
 import type { ManagementContext } from "./context";
 
 /**
- * True when this request carries the browser-session evidence a dashboard click
- * always has: an `Origin` (only a browser sends one) plus the per-session CSRF
- * token, which `requireManagementAuth` has already matched against the minted
- * session before dispatch. A shell/HTTP caller holding only the admin token has
- * neither, which is exactly the case the agent guard is aimed at.
+ * True only when a minted GUI session authorized this request.
+ *
+ * The previous version of this check looked for an `Origin` plus the CSRF headers
+ * and reasoned that the auth gate had already validated them. It had not: the gate
+ * accepts a raw admin token BEFORE it ever consults the session table, so a caller
+ * holding that token (any process running as the user, a coding agent included)
+ * could add three nonempty headers of its choosing and satisfy this check without
+ * a browser ever being involved. The credential itself is the only part of the
+ * request an agent cannot fabricate, so that is what this now reads.
  */
-function hasBrowserSessionEvidence(req: Request): boolean {
-  return !!req.headers.get("Origin")?.trim()
-    && !!req.headers.get("x-opencodex-csrf-token")?.trim()
-    && !!req.headers.get("x-opencodex-gui-origin")?.trim();
+function hasBrowserSessionEvidence(ctx: ManagementContext): boolean {
+  return ctx.principal === "gui-session";
 }
 
-// Known edge, deliberately fail-closed: a non-loopback operator dashboard signs in
-// with the raw admin token instead of a minted GUI session, so its clicks carry no
-// CSRF header. If that proxy was *also* started from an agent shell, the button is
-// refused and the response names the one-line `gh` command to run by hand. A
-// service-run proxy (`OCX_SERVICE`, the usual remote setup) is not agent-driven and
-// is unaffected.
+// Known edge, deliberately fail-closed: a non-loopback operator dashboard that signs
+// in with the raw admin token instead of a minted GUI session gets its click refused,
+// and the response names the one-line `gh` command to run by hand. That is the
+// correct trade — an endpoint reachable with a readable token cannot establish that
+// a human chose to spend their own GitHub identity.
+//
+// The honest limit of this guard: a local process running AS THE USER can mint its
+// own GUI session (the dashboard bootstrap is served to any loopback GET) and can
+// equally just run `gh api -X PUT /user/starred/...` itself, which needs no proxy at
+// all. No check inside this process can distinguish that caller from the browser,
+// because both hold every local credential. So this endpoint is not a technical
+// barrier against a determined local agent — it removes the CASUAL path (an agent
+// that would have POSTed here because the endpoint existed) and makes the refusal
+// legible. The actual boundary is normative and lives in AGENTS.md: an agent must
+// not spend the user's identity, whichever mechanism is at hand.
 
 export async function handleSidebarRoutes(ctx: ManagementContext): Promise<Response | null> {
   const { req, url } = ctx;
@@ -55,10 +69,11 @@ export async function handleSidebarRoutes(ctx: ManagementContext): Promise<Respo
   if (url.pathname === "/api/github/star" && req.method === "POST") {
     const { STAR_REPO, STAR_REPO_URL, starRepository } = await import("../../github/star-state");
     // Starring uses the user's GitHub identity, so consent must come from the
-    // account owner. An agent-driven caller without browser-session evidence
-    // cannot have obtained it, and must relay the question instead of answering
-    // it with an HTTP call.
-    if (isAgentDriven() && !hasBrowserSessionEvidence(req)) {
+    // account owner. Only a minted dashboard session evidences that; a caller
+    // holding the admin token must relay the question instead of answering it
+    // with an HTTP call.
+    if (!hasBrowserSessionEvidence(ctx)) {
+      const markers = agentDrivenMarkers().slice(0, 3);
       return jsonResponse({
         ok: false,
         state: "not-starred",
@@ -66,8 +81,9 @@ export async function handleSidebarRoutes(ctx: ManagementContext): Promise<Respo
         url: STAR_REPO_URL,
         code: "agent_consent_required",
         message:
-          `Refused: agent session detected (${agentDrivenMarkers().slice(0, 3).join(", ")}) and this request `
-          + `carries no dashboard session. Starring writes to the user's own GitHub account, so ask the user `
+          `Refused: this request carries no dashboard session`
+          + `${markers.length ? ` (agent session detected: ${markers.join(", ")})` : ""}. `
+          + `Starring writes to the user's own GitHub account, so ask the user `
           + `directly as a required Yes/No choice — not a soft aside, and no answer is not a No, so re-ask `
           + `it unchanged while it is open — and only if they say yes run: `
           + `gh api -X PUT /user/starred/${STAR_REPO}`,

package/src/server/management/storage-log-guard-routes.ts

@@ -0,0 +1,186 @@
+import { resolveCodexHomeDir } from "../../codex/home";
+import {
+  compactCodexLogs,
+  type CodexLogGuardCompactionResult,
+} from "../../codex/log-guard/maintenance";
+import {
+  getCodexLogGuardProtectionStatus,
+  protectCodexLogs,
+  repairCodexLogGuardProtection,
+  unprotectCodexLogs,
+  type CodexLogGuardMutationResult,
+  type CodexLogGuardStatus,
+} from "../../codex/log-guard/protection";
+import { scanStorage } from "../../storage/scanner";
+import { jsonResponse } from "../auth-cors";
+import {
+  managementBodyTooLargeResponse,
+  readManagementJsonBody,
+} from "./body";
+import type { ManagementContext } from "./context";
+
+const INSPECTION_FAILED_MESSAGE = "Codex log inspection failed";
+
+function inspectionUnavailable(report: CodexLogGuardStatus): boolean {
+  return report.schema.state === "unavailable";
+}
+
+function mutationStatus(result: CodexLogGuardMutationResult): number {
+  if (result.ok) return 200;
+  switch (result.error) {
+    case "process_enumeration_failed":
+      return 503;
+    case "codex_running":
+    case "busy":
+    case "unsupported_schema":
+    case "trigger_collision":
+    case "unsafe_path":
+      return 409;
+    case "database_error":
+    case "config_write_failed":
+      return 500;
+  }
+}
+
+function compactStatus(result: CodexLogGuardCompactionResult): number {
+  if (result.ok) return 200;
+  switch (result.error) {
+    case "process_enumeration_failed":
+      return 503;
+    case "codex_running":
+    case "busy":
+    case "unsupported_schema":
+    case "auto_vacuum_not_incremental":
+    case "unsafe_path":
+    case "integrity_check_failed":
+      return 409;
+    case "database_error":
+      return 500;
+  }
+}
+
+function mutationResponse(
+  result: CodexLogGuardMutationResult,
+  ctx: ManagementContext,
+): Response {
+  return result.ok
+    ? jsonResponse(result.status, 200, ctx.req, ctx.config)
+    : jsonResponse({ error: result.error }, mutationStatus(result), ctx.req, ctx.config);
+}
+
+function compactResponse(
+  result: CodexLogGuardCompactionResult,
+  ctx: ManagementContext,
+): Response {
+  if (result.ok) {
+    return jsonResponse({ report: result.report }, 200, ctx.req, ctx.config);
+  }
+  return jsonResponse(
+    result.error === "integrity_check_failed"
+      ? { error: result.error, phase: result.phase }
+      : { error: result.error },
+    compactStatus(result),
+    ctx.req,
+    ctx.config,
+  );
+}
+
+async function readProtectMode(ctx: ManagementContext): Promise<"compat" | "quiet" | Response> {
+  let body: unknown;
+  try {
+    body = await readManagementJsonBody(ctx.req);
+  } catch (error) {
+    const tooLarge = managementBodyTooLargeResponse(error, ctx.req, ctx.config);
+    if (tooLarge) return tooLarge;
+    return jsonResponse({ error: "invalid_request" }, 400, ctx.req, ctx.config);
+  }
+  if (!body || typeof body !== "object" || Array.isArray(body)) {
+    return jsonResponse({ error: "invalid_request" }, 400, ctx.req, ctx.config);
+  }
+  const mode = (body as Record<string, unknown>).mode;
+  if (mode !== "compat" && mode !== "quiet") {
+    return jsonResponse({ error: "invalid_mode" }, 400, ctx.req, ctx.config);
+  }
+  return mode;
+}
+
+/** Codex Log Guard diagnostics plus explicit protection and maintenance mutations. */
+export async function handleStorageLogGuardRoutes(ctx: ManagementContext): Promise<Response | null> {
+  const { req, url, config, deps } = ctx;
+  const protectionDeps = deps.codexLogGuardProtectionDeps;
+
+  if (url.pathname === "/api/storage/codex-logs") {
+    if (req.method !== "GET") return null;
+    try {
+      const report = getCodexLogGuardProtectionStatus(protectionDeps);
+      if (inspectionUnavailable(report)) {
+        return jsonResponse({ error: "inspect_failed", message: INSPECTION_FAILED_MESSAGE }, 500, req, config);
+      }
+      return jsonResponse(report, 200, req, config);
+    } catch {
+      return jsonResponse({
+        error: "inspect_failed",
+        message: INSPECTION_FAILED_MESSAGE,
+      }, 500, req, config);
+    }
+  }
+
+  if (url.pathname === "/api/storage/codex-logs/protect") {
+    if (req.method !== "POST") return null;
+    const mode = await readProtectMode(ctx);
+    if (mode instanceof Response) return mode;
+    return mutationResponse(protectCodexLogs(mode, protectionDeps), ctx);
+  }
+
+  if (url.pathname === "/api/storage/codex-logs/unprotect") {
+    if (req.method !== "POST") return null;
+    return mutationResponse(unprotectCodexLogs(protectionDeps), ctx);
+  }
+
+  if (url.pathname === "/api/storage/codex-logs/repair") {
+    if (req.method !== "POST") return null;
+    return mutationResponse(repairCodexLogGuardProtection(protectionDeps), ctx);
+  }
+
+  if (url.pathname === "/api/storage/codex-logs/compact") {
+    if (req.method !== "POST") return null;
+    return compactResponse(compactCodexLogs(deps.codexLogGuardMaintenanceDeps), ctx);
+  }
+
+  if (url.pathname !== "/api/storage" || req.method !== "GET") return null;
+
+  // Keep the existing CODEX_HOME scan as the primary storage contract. The Log Guard
+  // report is attached separately so an external sqlite_home is visible without being
+  // silently folded into CODEX_HOME totals.
+  let storage;
+  try {
+    storage = scanStorage();
+  } catch {
+    const fallback = {
+      codexHome: resolveCodexHomeDir(),
+      generatedAt: Date.now(),
+      total: { bytes: 0, fileCount: 0 },
+      buckets: [],
+      error: "scan_failed",
+    };
+    try {
+      const report = getCodexLogGuardProtectionStatus(protectionDeps);
+      return inspectionUnavailable(report)
+        ? jsonResponse({ ...fallback, codexLogs: null, codexLogsError: "inspect_failed" }, 200, req, config)
+        : jsonResponse({ ...fallback, codexLogs: report }, 200, req, config);
+    } catch {
+      return jsonResponse({ ...fallback, codexLogs: null, codexLogsError: "inspect_failed" }, 200, req, config);
+    }
+  }
+
+  try {
+    const report = getCodexLogGuardProtectionStatus(protectionDeps);
+    return inspectionUnavailable(report)
+      ? jsonResponse({ ...storage, codexLogs: null, codexLogsError: "inspect_failed" }, 200, req, config)
+      : jsonResponse({ ...storage, codexLogs: report }, 200, req, config);
+  } catch {
+    // Log Guard inspection is auxiliary to the existing Storage page. A config/path
+    // resolution failure must not take the legacy read-only storage report down with it.
+    return jsonResponse({ ...storage, codexLogs: null, codexLogsError: "inspect_failed" }, 200, req, config);
+  }
+}

package/src/server/management/sync-response.ts

@@ -0,0 +1,69 @@
+/**
+ * The single HTTP projection of ConvergeOutcome.
+ *
+ * Three phase documents once mapped /api/sync independently and one silently
+ * dropped Retry-After. Keeping the exhaustive switch here makes a new domain
+ * outcome a compile error until its management contract is chosen explicitly.
+ */
+import type { ConvergeOutcome } from "../../codex/convergence-types";
+import { jsonResponse } from "../auth-cors";
+
+export function toSyncResponse(outcome: ConvergeOutcome): Response {
+  switch (outcome.kind) {
+    case "catalog-only":
+      return jsonResponse({
+        ok: true,
+        changed: outcome.changed,
+        observed: outcome.observed,
+        catalogRefresh: outcome.catalogRefresh,
+        history: outcome.history,
+      });
+    case "converged":
+      return jsonResponse({
+        ok: true,
+        changed: outcome.changed,
+        observed: outcome.observed,
+        catalogRefresh: outcome.catalogRefresh,
+        history: outcome.history,
+      });
+    case "skipped":
+      return jsonResponse({
+        ok: true,
+        changed: false,
+        observed: outcome.observed,
+        catalogRefresh: outcome.catalogRefresh,
+        history: outcome.history,
+      });
+    case "refused":
+      return jsonResponse({
+        ok: false,
+        authority: outcome.authority,
+        message: outcome.message,
+        observed: outcome.observed,
+      }, 409);
+    case "busy": {
+      const response = jsonResponse({
+        ok: false,
+        surface: outcome.surface,
+        retryAfterMs: outcome.retryAfterMs,
+      }, 503);
+      response.headers.set("Retry-After", String(Math.ceil(outcome.retryAfterMs / 1_000)));
+      return response;
+    }
+    case "deferred":
+      return jsonResponse({
+        ok: true,
+        changed: outcome.changed,
+        unresolved: outcome.unresolved,
+        observed: outcome.observed,
+        catalogRefresh: outcome.catalogRefresh,
+        history: outcome.history,
+      });
+    case "failed":
+      return jsonResponse({ error: outcome.message, surface: outcome.surface }, 500);
+    default: {
+      const exhaustive: never = outcome;
+      return exhaustive;
+    }
+  }
+}