@iislee/opencodex 2.11.0 → 2.35.0

package/src/responses/spill-store.ts

@@ -17,7 +17,8 @@ import {
 import { createHash, randomBytes } from "node:crypto";
 import { join } from "node:path";
 import { getConfigDir } from "../config";
-import { forgetHardenedSecretPath, hardenSecretDir, hardenSecretPath } from "../lib/windows-secret-acl";
+import { forgetEphemeralSecretPath, forgetHardenedSecretPath, hardenSecretDir, hardenSecretPath } from "../lib/windows-secret-acl";
+import { isValidProviderContinuationOwner } from "./provider-continuation";
 import type { OcxProviderContinuationState } from "../types";
 
 export const RESPONSE_SPILL_VERSION = 1;
@@ -34,7 +35,19 @@ export interface ResponseSpillPayload {
   version: 1;
   responseId: string;
   createdAt: number;
+  clientThreadId?: string;
   items: unknown[];
+  /**
+   * Index in `items` where the provider output begins, used by replay-overlap detection
+   * in state.ts. Optional so a payload written before this field still loads (it simply
+   * never authorizes a skip).
+   *
+   * Compatibility is FORWARD-ONLY: `validPayload` is a strict key allowlist, so a build
+   * predating this field rejects a payload carrying it as corrupt rather than ignoring
+   * it. Rolling back across this change invalidates spilled entries, which degrades to a
+   * replay miss — an already-handled path — not to corrupted live state.
+   */
+  providerOutputStart?: number;
   providers?: OcxProviderContinuationState;
 }
 
@@ -45,9 +58,29 @@ export interface ResponseSpillRef {
   payloadBytes: number;
 }
 
+/**
+ * Hard ceiling for one spill payload, enforced BOTH at direct-spill admission
+ * (state.ts refuses to durably retain a larger candidate) and at replay read
+ * (below). 256 MiB keeps the replay transient under the process-wide
+ * APP_OWNED_WORST_CASE_PINNED_BYTES ceiling (512 MiB); without an admission
+ * ceiling the read ceiling would strand write-only spills on disk.
+ */
+export const MAX_RESPONSE_SPILL_PAYLOAD_BYTES = 256 * 1024 * 1024;
+
+let spillPayloadCapOverride: number | null = null;
+
+/** Test-only: lower/restore the single-spill payload ceiling (null restores). */
+export function setResponseSpillPayloadCapForTests(bytes: number | null): void {
+  spillPayloadCapOverride = bytes;
+}
+
+export function responseSpillPayloadCap(): number {
+  return spillPayloadCapOverride ?? MAX_RESPONSE_SPILL_PAYLOAD_BYTES;
+}
+
 export type ResponseSpillReadResult =
   | { ok: true; payload: ResponseSpillPayload }
-  | { ok: false; reason: "missing" | "corrupt" };
+  | { ok: false; reason: "missing" | "corrupt" | "too_large" };
 
 export interface ResponseSpillCleanupResult {
   scanned: number;
@@ -176,17 +209,28 @@ function closeFile(fd: number): void {
   record("close");
 }
 
-function unlink(path: string): void {
+function unlink(path: string, ephemeral = false): void {
   try {
     if (spillIoForTest?.unlink) spillIoForTest.unlink(path);
     else unlinkSync(path);
-    forgetHardenedSecretPath(path);
+    // Ephemeral release only for publish temps; stable spill files keep their
+    // destination-keyed timeout memos (anti-restall) and drop just the
+    // success memo for the now-deleted file.
+    if (ephemeral) forgetEphemeralSecretPath(path);
+    else forgetHardenedSecretPath(path);
   } catch (error) {
-    if (isErrno(error, "ENOENT")) forgetHardenedSecretPath(path);
+    if (isErrno(error, "ENOENT")) {
+      if (ephemeral) forgetEphemeralSecretPath(path);
+      else forgetHardenedSecretPath(path);
+    }
     throw error;
   }
 }
 
+function unlinkEphemeral(path: string): void {
+  unlink(path, true);
+}
+
 function publishNoReplace(tempPath: string, destinationPath: string): void {
   try {
     if (spillIoForTest?.link) spillIoForTest.link(tempPath, destinationPath);
@@ -229,13 +273,26 @@ function validPayload(value: unknown, responseId: string): value is ResponseSpil
   if (!value || typeof value !== "object" || Array.isArray(value)) return false;
   const payload = value as Record<string, unknown>;
   const keys = Object.keys(payload);
-  if (keys.some(key => !["version", "responseId", "createdAt", "items", "providers"].includes(key))) return false;
+  if (keys.some(key => !["version", "responseId", "createdAt", "clientThreadId", "items", "providerOutputStart", "providers"].includes(key))) return false;
   if (payload.version !== 1 || payload.responseId !== responseId) return false;
   if (typeof payload.createdAt !== "number" || !Number.isFinite(payload.createdAt)) return false;
+  if (payload.clientThreadId !== undefined
+    && (typeof payload.clientThreadId !== "string" || payload.clientThreadId.trim().length === 0)) return false;
   if (!Array.isArray(payload.items)) return false;
+  // A malformed boundary must degrade to "never skip", never to a bad index: reject the
+  // payload outright so materialization treats it as corrupt rather than trusting it.
+  if (payload.providerOutputStart !== undefined) {
+    const anchor = payload.providerOutputStart;
+    if (typeof anchor !== "number" || !Number.isSafeInteger(anchor)
+      || anchor < 0 || anchor > payload.items.length) return false;
+  }
   if (payload.providers !== undefined) {
     if (!payload.providers || typeof payload.providers !== "object" || Array.isArray(payload.providers)) return false;
-    for (const providerState of Object.values(payload.providers)) {
+    const providers = payload.providers as Record<string, unknown>;
+    if (providers.__ocxOwner !== undefined
+      && !isValidProviderContinuationOwner(providers.__ocxOwner)) return false;
+    for (const [provider, providerState] of Object.entries(providers)) {
+      if (provider === "__ocxOwner") continue;
       if (!providerState || typeof providerState !== "object" || Array.isArray(providerState)) return false;
     }
   }
@@ -253,7 +310,9 @@ export function writeResponseSpillDurably(
       version: 1,
       responseId,
       createdAt: state.createdAt,
+      ...(state.clientThreadId ? { clientThreadId: state.clientThreadId } : {}),
       items: state.items,
+      ...(state.providerOutputStart !== undefined ? { providerOutputStart: state.providerOutputStart } : {}),
       ...(state.providers ? { providers: state.providers } : {}),
     };
     const serialized = JSON.stringify(payload);
@@ -284,7 +343,7 @@ export function writeResponseSpillDurably(
       try {
         publishNoReplace(publishTempPath, destinationPath);
         fsyncDirectoryBestEffort(dir);
-        unlink(publishTempPath);
+        unlinkEphemeral(publishTempPath);
         tempPath = null;
         return { version: 1, fileName, digest, payloadBytes: bytes.byteLength };
       } catch (error) {
@@ -298,7 +357,7 @@ export function writeResponseSpillDurably(
       try { closeSync(fd); } catch { /* best effort */ }
     }
     if (tempPath) {
-      try { unlink(tempPath); } catch { /* best effort */ }
+      try { unlinkEphemeral(tempPath); } catch { /* best effort */ }
     }
     throw new Error("Response spill write failed");
   }
@@ -306,6 +365,9 @@ export function writeResponseSpillDurably(
 
 export function readResponseSpill(responseId: string, ref: ResponseSpillRef): ResponseSpillReadResult {
   if (!validSpillRef(ref)) return { ok: false, reason: "corrupt" };
+  // Refuse before any read/parse: an oversized declared payload would otherwise
+  // materialize an unbounded transient (readFileSync + utf8 + JSON.parse).
+  if (ref.payloadBytes > responseSpillPayloadCap()) return { ok: false, reason: "too_large" };
   const match = OWNED_SPILL_NAME.exec(ref.fileName);
   if (!match
     || match[2] !== sha256(responseId).slice(0, 12)
@@ -376,7 +438,10 @@ export function recoverOrphanedResponseSpills(
       try { stat = lstatSync(path); } catch { continue; }
       if (!stat.isFile() || stat.isSymbolicLink() || Date.now() - stat.mtimeMs < graceMs) continue;
       try {
-        unlink(path);
+        // Orphaned publish temps get the full ephemeral release; stable
+        // orphaned spills keep destination-keyed timeout memos.
+        if (isOwnedTemp) unlinkEphemeral(path);
+        else unlink(path);
         result.removed += 1;
         result.bytesRemoved += stat.size;
       } catch {