@iislee/opencodex 2.11.0 → 2.31.0

package/src/codex/log-guard/sqlite-errors.ts

@@ -0,0 +1,9 @@
+/** Classify SQLite lock contention consistently across Log Guard mutation paths. */
+export function isSqliteBusy(error: unknown): boolean {
+  const code = error && typeof error === "object" && "code" in error
+    ? String((error as { code?: unknown }).code)
+    : "";
+  const message = error instanceof Error ? error.message : String(error);
+  return code === "SQLITE_BUSY" || code === "SQLITE_LOCKED"
+    || /database (?:is|table is) locked/i.test(message);
+}

package/src/codex/main-account-cache.ts

@@ -14,6 +14,16 @@ export interface CachedMainAccountInfo extends MainAccountInfo {
 }
 
 let cachedMainAccountInfo: CachedMainAccountInfo | null = null;
+let cachedMainCredentialPresence: boolean | null = null;
+let mainAccountIdentityGeneration = 0;
+
+export function captureMainAccountIdentityGeneration(): number {
+  return mainAccountIdentityGeneration;
+}
+
+export function isMainAccountIdentityGenerationLive(generation: number): boolean {
+  return generation === mainAccountIdentityGeneration;
+}
 
 export function getMainAccountInfoCache(): CachedMainAccountInfo | null {
   return cachedMainAccountInfo;
@@ -29,4 +39,18 @@ export function setMainAccountInfoCache(value: CachedMainAccountInfo): void {
 
 export function clearMainAccountInfoCache(): void {
   cachedMainAccountInfo = null;
+  mainAccountIdentityGeneration += 1;
+}
+
+/** Last physical credential presence observed while native-main ownership was held. */
+export function getMainAccountCredentialPresence(): boolean | null {
+  return cachedMainCredentialPresence;
+}
+
+export function setMainAccountCredentialPresence(present: boolean): void {
+  cachedMainCredentialPresence = present;
+}
+
+export function clearMainAccountCredentialPresence(): void {
+  cachedMainCredentialPresence = null;
 }

package/src/codex/main-account.ts

@@ -1,5 +1,6 @@
 import { readCodexTokens } from "./auth-collision";
 import { decodeJwtPayload } from "../oauth/chatgpt";
+import { extractChatgptPlanType } from "./plan";
 import { MAIN_CODEX_ACCOUNT_ID } from "./account-id";
 
 export { MAIN_CODEX_ACCOUNT_ID } from "./account-id";
@@ -10,13 +11,23 @@ export { MAIN_CODEX_ACCOUNT_ID } from "./account-id";
  * percent, matching pool-account behavior.
  */
 let mainAccountPlan: string | null = null;
+let jwtPlanAttempted = false;
 
 export function setMainAccountPlan(plan: string | null): void {
   mainAccountPlan = plan;
+  if (plan === null) jwtPlanAttempted = false;
 }
 
 export function getMainAccountPlan(): string | undefined {
-  return mainAccountPlan ?? undefined;
+  if (mainAccountPlan) return mainAccountPlan;
+  if (jwtPlanAttempted) return undefined;
+  jwtPlanAttempted = true;
+  const tokens = readCodexTokens();
+  const jwtPlan = tokens
+    ? extractChatgptPlanType(tokens.id_token, tokens.access_token)
+    : undefined;
+  if (jwtPlan) mainAccountPlan = jwtPlan;
+  return jwtPlan;
 }
 
 /** Read-only main account token from ~/.codex/auth.json, or null when not logged in. */
@@ -38,3 +49,20 @@ export function isMainAccountTokenLive(now = Date.now()): boolean {
   const exp = typeof payload?.exp === "number" ? payload.exp * 1000 : undefined;
   return exp === undefined || exp > now;
 }
+
+/**
+ * Strict liveness for auth-terminality decisions: true only when the access-token JWT
+ * carries a decodable `exp` that is still in the future.
+ *
+ * Unlike {@link isMainAccountTokenLive}, an undecodable `exp` counts as NOT live here.
+ * This gate decides whether a bare WHAM 401 is downgraded to a transient failure; if an
+ * undecodable token could vouch for itself, a genuinely dead credential would keep every
+ * 401 "transient" and needsReauth could never flip.
+ */
+export function isMainAccountTokenVerifiablyLive(now = Date.now()): boolean {
+  const tokens = readCodexTokens();
+  if (!tokens?.access_token) return false;
+  const payload = decodeJwtPayload(tokens.access_token);
+  const exp = typeof payload?.exp === "number" ? payload.exp * 1000 : undefined;
+  return exp !== undefined && exp > now;
+}

package/src/codex/management-convergence.ts

@@ -0,0 +1,167 @@
+import type { OcxConfig } from "../types";
+import { captureCatalogAdmissionSnapshot } from "./catalog-admission";
+import { convergeCodexCatalog } from "./convergence";
+import type {
+  CatalogDisposition,
+  CatalogFailureCause,
+  CatalogOnlyOutcome,
+  CodexHistoryState,
+  CodexObservedState,
+  ConvergeCodex,
+  ProjectCatalogOnlyOutcomeInput,
+} from "./convergence-types";
+
+function notEvaluatedHistory(): CodexHistoryState {
+  return {
+    status: "not-evaluated",
+    attempts: 0,
+    nextRetryAt: null,
+    txId: null,
+    pendingRows: null,
+    backupEntries: null,
+  };
+}
+
+function notEvaluatedObserved(history: CodexHistoryState): CodexObservedState {
+  return {
+    aggregate: "not-evaluated",
+    isApplied: null,
+    desired: "unknown",
+    converged: null,
+    authority: { service: "unknown", externalProvider: null },
+    surfaces: {
+      config: "not-evaluated",
+      profile: "not-evaluated",
+      catalog: "not-evaluated",
+      cache: "not-evaluated",
+      journal: "not-evaluated",
+      history: {
+        state: history,
+        database: "not-evaluated",
+        manifest: "not-evaluated",
+        rollouts: "not-evaluated",
+      },
+      provenance: {
+        state: "not-evaluated",
+        nativeGeneration: null,
+        currentTxId: null,
+      },
+    },
+  };
+}
+
+/** Recognized errno/code tokens. Anything else is dropped rather than echoed. */
+const RECOGNIZED_FAILURE_CODES: ReadonlySet<string> = new Set([
+  "ENOSPC", "EACCES", "EPERM", "EROFS", "ENOENT", "SQLITE_BUSY",
+]);
+
+/**
+ * Reduce a caught error to an allowlisted cause (#1784).
+ *
+ * Nothing from the error text reaches the caller: `kind` is chosen from a closed set and
+ * `code` is only emitted when it is a recognized token. An `Error.message` routinely carries
+ * paths, home directories and account ids, and `redactSecretString` masks token shapes but
+ * none of those, so the message is never a safe thing to forward from here.
+ */
+function catalogFailureCause(error: unknown): CatalogFailureCause {
+  const raw = (error as { code?: unknown } | null)?.code;
+  const code = typeof raw === "string" && RECOGNIZED_FAILURE_CODES.has(raw)
+    ? raw as CatalogFailureCause["code"]
+    : undefined;
+  if (error instanceof TypeError || error instanceof RangeError || error instanceof SyntaxError) {
+    return { kind: "invalid-request", ...(code ? { code } : {}) };
+  }
+  if (code === "SQLITE_BUSY") return { kind: "lock-busy", code };
+  if (code !== undefined) return { kind: "io", code };
+  return { kind: "unknown" };
+}
+
+/**
+ * Classify a failure that is NOT a filesystem problem.
+ *
+ * `disk` used to be the catch-all, so an operator saw "non-retryable disk failure" for a
+ * malformed request. Reserve `disk` for real IO and route the rest to honest reasons.
+ */
+function classifiedCatalogFailure(error: unknown, commitBegan: boolean): CatalogDisposition {
+  const cause = catalogFailureCause(error);
+  const reason = cause.kind === "invalid-request"
+    ? "request-invalid" as const
+    : cause.kind === "lock-busy"
+      ? "admission" as const
+      : cause.kind === "io"
+        ? "disk" as const
+        : "internal" as const;
+  return {
+    status: "failed",
+    reason,
+    phase: commitBegan ? "commit" : "gather",
+    // Contention is the one class worth retrying unchanged.
+    retryable: reason === "admission",
+    partialWrite: commitBegan,
+    cause,
+  };
+}
+
+function unexpectedCatalogFailure(commitBegan: boolean): CatalogDisposition {
+  return {
+    status: "failed",
+    reason: "disk",
+    phase: commitBegan ? "commit" : "gather",
+    retryable: false,
+    partialWrite: commitBegan,
+  };
+}
+
+function admissionFailure(error: unknown): CatalogDisposition {
+  const message = error instanceof Error ? error.message : "";
+  if (message.includes("config generation is busy") || message.includes("config generation is database")) {
+    return { status: "skipped", reason: "busy", retryable: true };
+  }
+  return classifiedCatalogFailure(error, false);
+}
+
+/** Project catalog work into the shared no-change/not-evaluated outcome shape. */
+export function projectCatalogOnlyOutcome({
+  changed,
+  catalogRefresh,
+}: ProjectCatalogOnlyOutcomeInput): CatalogOnlyOutcome {
+  const history = notEvaluatedHistory();
+  return {
+    kind: "catalog-only",
+    changed,
+    observed: notEvaluatedObserved(history),
+    catalogRefresh,
+    history,
+  };
+}
+
+/**
+ * Bind the management callback's exact config authority to a catalog-only
+ * funnel. This module is intentionally not re-exported by a public Codex facade.
+ */
+export function createManagementConvergeCodex(
+  config: Readonly<OcxConfig>,
+): ConvergeCodex {
+  const retainedConfig = config;
+  return async request => {
+    let commitBegan = false;
+    try {
+      if (request.scope !== "catalog" || request.action !== "converge") {
+        return projectCatalogOnlyOutcome({
+          changed: false,
+          catalogRefresh: unexpectedCatalogFailure(false),
+        });
+      }
+      const snapshot = captureCatalogAdmissionSnapshot(retainedConfig);
+      const result = await convergeCodexCatalog(snapshot, request, {
+        onCommitBegin: () => { commitBegan = true; },
+      });
+      return projectCatalogOnlyOutcome(result);
+    } catch (error) {
+      return projectCatalogOnlyOutcome({
+        changed: false,
+        catalogRefresh: commitBegan ? classifiedCatalogFailure(error, true) : admissionFailure(error),
+      });
+    }
+  };
+}

package/src/codex/model-cache.ts

@@ -42,7 +42,12 @@ export type ProviderModelDiscoveryFailure = ProviderModelDiscoveryStatus extends
     : never
   : never;
 
+/** Whether clearing cache rows also revokes in-flight discovery authority. */
+export type ModelCacheClearReason = "authority" | "eviction";
+
 const cache = new Map<string, CacheEntry>();
+let globalCacheGeneration = 0;
+export const providerCacheGenerations = new Map<string, number>();
 let cacheBytes = 0;
 let oldestCachedProvider: string | undefined;
 let oldestCachedAt: number | null = null;
@@ -155,7 +160,29 @@ export function getStaleCached(provider: string): CatalogModel[] | null {
   return cache.get(provider)?.models ?? null;
 }
 
-export function setCached(provider: string, models: CatalogModel[], now = Date.now()): void {
+/** Capture the cache generation before an asynchronous provider discovery starts. */
+export function captureModelCacheGeneration(provider: string): string {
+  if (!providerCacheGenerations.has(provider)) providerCacheGenerations.set(provider, 0);
+  return `${globalCacheGeneration}:${providerCacheGenerations.get(provider)!}`;
+}
+
+/** Whether a discovery started under {@link captureModelCacheGeneration} may still write. */
+export function isModelCacheGenerationCurrent(provider: string, generation: string): boolean {
+  return generation === captureModelCacheGeneration(provider);
+}
+
+/**
+ * Store a live result unless the cache was cleared while that asynchronous discovery was running.
+ * The optional generation keeps existing direct cache writers unchanged while discovery callers can
+ * prevent a previous OAuth account from repopulating the current account's cache.
+ */
+export function setCached(
+  provider: string,
+  models: CatalogModel[],
+  now = Date.now(),
+  generation?: string,
+): boolean {
+  if (generation !== undefined && !isModelCacheGenerationCurrent(provider, generation)) return false;
   deleteCachedProvider(provider);
   const sizeBytes = modelCacheEncoder.encode(provider).byteLength
     + modelCacheEncoder.encode(JSON.stringify(models)).byteLength;
@@ -166,16 +193,25 @@ export function setCached(provider: string, models: CatalogModel[], now = Date.n
     oldestCachedAt = now;
   }
   enforceAppOwnedMemoryBudget();
+  return true;
 }
 
 /** Drop one provider's cache (or all) so the next resolve forces a live re-fetch. */
-export function clearModelCache(provider?: string): void {
+export function clearModelCache(
+  provider?: string,
+  reason: ModelCacheClearReason = "authority",
+): void {
+  const revokesInFlightDiscovery = reason === "authority";
   if (provider) {
+    if (revokesInFlightDiscovery) {
+      providerCacheGenerations.set(provider, (providerCacheGenerations.get(provider) ?? 0) + 1);
+    }
     deleteCachedProvider(provider);
     failureAt.delete(provider);
     discoveryStatus.delete(provider);
     liveModelCounts.delete(provider);
   } else {
+    if (revokesInFlightDiscovery) globalCacheGeneration += 1;
     cache.clear();
     cacheBytes = 0;
     oldestCachedProvider = undefined;
@@ -192,16 +228,26 @@ export function reconcileModelCacheProviders(
 ): number {
   if (generation <= lastReconciledGeneration) return 0;
   const removedProviders = new Set<string>();
-  for (const store of [failureAt, discoveryStatus, liveModelCounts]) {
-    for (const provider of store.keys()) {
-      if (validProviders.has(provider)) continue;
-      store.delete(provider);
-      removedProviders.add(provider);
-    }
-  }
-  for (const provider of cache.keys()) {
+  const trackedProviders = new Set([
+    ...providerCacheGenerations.keys(),
+    ...failureAt.keys(),
+    ...discoveryStatus.keys(),
+    ...liveModelCounts.keys(),
+    ...cache.keys(),
+  ]);
+  let revokedRemovedProviderAuthority = false;
+  for (const provider of trackedProviders) {
     if (validProviders.has(provider)) continue;
+    if (!revokedRemovedProviderAuthority) {
+      globalCacheGeneration += 1;
+      revokedRemovedProviderAuthority = true;
+    }
+    providerCacheGenerations.set(provider, (providerCacheGenerations.get(provider) ?? 0) + 1);
+    providerCacheGenerations.delete(provider);
     deleteCachedProvider(provider);
+    failureAt.delete(provider);
+    discoveryStatus.delete(provider);
+    liveModelCounts.delete(provider);
     removedProviders.add(provider);
   }
   lastReconciledGeneration = generation;