@iislee/opencodex 2.11.0 → 2.35.0

package/src/server/github-copilot-responses-repair.ts

@@ -0,0 +1,338 @@
+/**
+ * Client-facing repair for GitHub Copilot's `vscode-chat` Responses stream.
+ *
+ * Copilot can rotate opaque response/item ids between lifecycle events, expose
+ * provider-private reasoning ciphertext, and attach per-delta obfuscation
+ * padding while the authoritative complete tool input arrives on `.done`.
+ * Stock Responses clients cannot reconcile that dialect. This stateful block
+ * rewrite emits one coherent Responses SSE stream while the inspection branch
+ * keeps the raw upstream snapshot for provider replay.
+ */
+import {
+  TranslatorBudgetExceededError,
+  type TranslatorBudget,
+} from "../lib/translator-budget";
+import {
+  replaceSseDataPayload,
+  sseDataPayload,
+  type SseBlockRewrite,
+} from "./sse-payload-rewrite";
+
+const MAX_TRACKED_ITEMS = 256;
+const MAX_TRACKED_DEFERRED_CALLS = 256;
+const RETAINED_STATE_LIMIT_BYTES = 256 * 1024;
+
+type JsonRecord = Record<string, unknown>;
+
+type TrackedItem = {
+  id: string;
+  type?: string;
+  encryptedReasoning: boolean;
+};
+
+type DeferredCallKind = "function" | "custom";
+
+function isRecord(value: unknown): value is JsonRecord {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function outputIndexOf(value: unknown): number | undefined {
+  return typeof value === "number" && Number.isInteger(value) && value >= 0
+    ? value
+    : undefined;
+}
+
+function byteLength(value: unknown): number {
+  return Buffer.byteLength(JSON.stringify(value), "utf8");
+}
+
+function blockNewline(block: string): "\r\n" | "\n" {
+  return block.includes("\r\n") ? "\r\n" : "\n";
+}
+
+/** Keep a named SSE block's `event:` field aligned with its JSON `type`. */
+function withEventName(block: string, eventName: string): string {
+  const newline = blockNewline(block);
+  const lines = block.split(/\r?\n/);
+  let replaced = false;
+  const rewritten = lines.flatMap((line) => {
+    if (!line.startsWith("event:")) return [line];
+    if (replaced) return [];
+    replaced = true;
+    return [`event: ${eventName}`];
+  });
+  if (!replaced) {
+    const dataIndex = rewritten.findIndex(line => line.startsWith("data:"));
+    rewritten.splice(dataIndex >= 0 ? dataIndex : 0, 0, `event: ${eventName}`);
+  }
+  return rewritten.join(newline);
+}
+
+function rewriteJsonBlock(block: string, event: JsonRecord): string {
+  const type = typeof event.type === "string" ? event.type : "message";
+  return withEventName(replaceSseDataPayload(block, JSON.stringify(event)), type);
+}
+
+function syntheticJsonBlock(template: string, event: JsonRecord): string {
+  const newline = blockNewline(template);
+  const type = typeof event.type === "string" ? event.type : "message";
+  return `event: ${type}${newline}data: ${JSON.stringify(event)}`;
+}
+
+function callKindForDelta(type: unknown): DeferredCallKind | undefined {
+  if (type === "response.function_call_arguments.delta") return "function";
+  if (type === "response.custom_tool_call_input.delta") return "custom";
+  return undefined;
+}
+
+function callKindForDone(type: unknown): DeferredCallKind | undefined {
+  if (type === "response.function_call_arguments.done") return "function";
+  if (type === "response.custom_tool_call_input.done") return "custom";
+  return undefined;
+}
+
+function callKey(kind: DeferredCallKind, outputIndex: number): string {
+  return `${kind}:${outputIndex}`;
+}
+
+function deltaTypeFor(kind: DeferredCallKind): string {
+  return kind === "function"
+    ? "response.function_call_arguments.delta"
+    : "response.custom_tool_call_input.delta";
+}
+
+function completeValueFor(kind: DeferredCallKind, event: JsonRecord): string {
+  const value = kind === "function" ? event.arguments : event.input;
+  return typeof value === "string" ? value : "";
+}
+
+/**
+ * Create one provider-scoped block rewrite per upstream response.
+ *
+ * Retained ids and pending-call markers are charged to the request translator
+ * budget and hard-capped. `dispose` releases them on terminal, EOF, cancel, or
+ * relay failure through the shared block-rewrite lifecycle.
+ */
+export function createGithubCopilotResponsesBlockRewrite(
+  budget?: TranslatorBudget,
+): SseBlockRewrite {
+  const items = new Map<number, TrackedItem>();
+  const deferredCalls = new Map<string, number>();
+  let responseId: string | undefined;
+  let itemStateBytes = 0;
+  let callStateBytes = 0;
+  let nextSequenceNumber = 0;
+  let itemTrackingTainted = false;
+  let disposed = false;
+
+  const ensureStateLimit = (nextBytes: number): void => {
+    if (itemStateBytes + callStateBytes + nextBytes > RETAINED_STATE_LIMIT_BYTES) {
+      throw new TranslatorBudgetExceededError("item_ids", RETAINED_STATE_LIMIT_BYTES);
+    }
+  };
+
+  const chargeItemState = (bytes: number): void => {
+    ensureStateLimit(bytes);
+    budget?.chargeRetained(bytes, { kind: "item_ids" });
+    itemStateBytes += bytes;
+  };
+
+  const chargeCallState = (bytes: number): void => {
+    ensureStateLimit(bytes);
+    budget?.chargeRetained(bytes, { kind: "retained_collectors" });
+    callStateBytes += bytes;
+  };
+
+  const releaseDeferredCall = (key: string): boolean => {
+    const bytes = deferredCalls.get(key);
+    if (bytes === undefined) return false;
+    deferredCalls.delete(key);
+    callStateBytes -= bytes;
+    budget?.releaseRetained(bytes, { kind: "retained_collectors" });
+    return true;
+  };
+
+  const rememberResponseId = (candidate: string): string => {
+    if (responseId !== undefined) return responseId;
+    const bytes = byteLength(candidate);
+    chargeItemState(bytes);
+    responseId = candidate;
+    return candidate;
+  };
+
+  const rememberItem = (
+    outputIndex: number,
+    candidateId: string,
+    itemType?: string,
+    encryptedReasoning = false,
+  ): TrackedItem => {
+    const existing = items.get(outputIndex);
+    if (existing) {
+      if (existing.type === undefined && itemType !== undefined) {
+        const extra = byteLength(itemType);
+        chargeItemState(extra);
+        existing.type = itemType;
+      }
+      existing.encryptedReasoning ||= encryptedReasoning;
+      return existing;
+    }
+    if (itemTrackingTainted || items.size >= MAX_TRACKED_ITEMS) {
+      // Keep relaying client-visible events after the count cap, but stop
+      // retaining new output-index mappings. The current event still receives
+      // the provider id, while earlier retained mappings remain available for
+      // stable ids. Byte-budget failures stay hard failures.
+      itemTrackingTainted = true;
+      return { id: candidateId, type: itemType, encryptedReasoning };
+    }
+    chargeItemState(byteLength([outputIndex, candidateId, itemType ?? null]));
+    const tracked = { id: candidateId, type: itemType, encryptedReasoning };
+    items.set(outputIndex, tracked);
+    return tracked;
+  };
+
+  const rememberDeferredCall = (key: string): void => {
+    if (deferredCalls.has(key)) return;
+    if (deferredCalls.size >= MAX_TRACKED_DEFERRED_CALLS) {
+      throw new TranslatorBudgetExceededError("retained_collectors", RETAINED_STATE_LIMIT_BYTES);
+    }
+    const bytes = byteLength(key);
+    chargeCallState(bytes);
+    deferredCalls.set(key, bytes);
+  };
+
+  const sanitizeReasoningItem = (
+    item: JsonRecord,
+    tracked: TrackedItem,
+  ): void => {
+    if (item.type !== "reasoning") return;
+    const encrypted = typeof item.encrypted_content === "string";
+    tracked.encryptedReasoning ||= encrypted;
+    if (encrypted) delete item.encrypted_content;
+    if (tracked.encryptedReasoning) {
+      const summary = Array.isArray(item.summary) ? item.summary : [];
+      const hasPlaintextSummary = summary.some(part =>
+        isRecord(part)
+        && part.type === "summary_text"
+        && typeof part.text === "string"
+        && part.text.length > 0);
+      if (!hasPlaintextSummary) item.summary = [{ type: "summary_text", text: "" }];
+      if (!Array.isArray(item.content)) item.content = [];
+    }
+  };
+
+  const normalizeNestedItem = (item: JsonRecord, outputIndex: number): void => {
+    const candidateId = typeof item.id === "string" ? item.id : undefined;
+    if (candidateId === undefined) return;
+    const itemType = typeof item.type === "string" ? item.type : undefined;
+    const tracked = rememberItem(
+      outputIndex,
+      candidateId,
+      itemType,
+      itemType === "reasoning" && typeof item.encrypted_content === "string",
+    );
+    item.id = tracked.id;
+    sanitizeReasoningItem(item, tracked);
+  };
+
+  const normalizeSequence = (event: JsonRecord): void => {
+    if (typeof event.sequence_number !== "number" || !Number.isFinite(event.sequence_number)) return;
+    event.sequence_number = nextSequenceNumber++;
+  };
+
+  const dispose = (): void => {
+    if (disposed) return;
+    disposed = true;
+    if (itemStateBytes > 0) budget?.releaseRetained(itemStateBytes, { kind: "item_ids" });
+    if (callStateBytes > 0) budget?.releaseRetained(callStateBytes, { kind: "retained_collectors" });
+    items.clear();
+    deferredCalls.clear();
+    responseId = undefined;
+    itemStateBytes = 0;
+    callStateBytes = 0;
+    itemTrackingTainted = false;
+  };
+
+  const rewrite: SseBlockRewrite = (block) => {
+    const payload = sseDataPayload(block);
+    if (payload === null || payload === "[DONE]") return [block];
+
+    let event: unknown;
+    try {
+      event = JSON.parse(payload);
+    } catch {
+      return [block];
+    }
+    if (!isRecord(event)) return [block];
+
+    if (typeof event.obfuscation === "string") delete event.obfuscation;
+
+    const type = event.type;
+    const outputIndex = outputIndexOf(event.output_index);
+    const deltaKind = callKindForDelta(type);
+    const deferToolDelta = deltaKind !== undefined
+      && outputIndex !== undefined;
+
+    if (isRecord(event.response) && typeof event.response.id === "string") {
+      event.response.id = rememberResponseId(event.response.id);
+    }
+
+    if (outputIndex !== undefined && isRecord(event.item)) {
+      normalizeNestedItem(event.item, outputIndex);
+    }
+    // A deferred delta is not client-visible, so it must not establish the
+    // public item id if a malformed provider sends it before output_item.added.
+    if (!deferToolDelta && outputIndex !== undefined && typeof event.item_id === "string") {
+      const tracked = rememberItem(outputIndex, event.item_id);
+      event.item_id = tracked.id;
+    }
+
+    if (type === "response.completed" && isRecord(event.response) && Array.isArray(event.response.output)) {
+      event.response.output.forEach((item, index) => {
+        if (isRecord(item)) normalizeNestedItem(item, index);
+      });
+    }
+
+    if (typeof type === "string" && type.startsWith("response.reasoning")) {
+      if (typeof event.encrypted_content === "string") delete event.encrypted_content;
+      // `encrypted_content` is opaque replay state; summary delta/text fields
+      // are a separate, potentially readable part of the public Responses
+      // contract and must survive when Copilot provides them.
+    }
+
+    if (deferToolDelta) {
+      rememberDeferredCall(callKey(deltaKind, outputIndex));
+      // The OpenAI `obfuscation` field is padding, not a decryption key. Defer
+      // every Copilot tool fragment anyway: mixed padded/unpadded fragments and
+      // rotating ids cannot then produce duplicate or irreconcilable input.
+      // `.done` carries the authoritative complete value, which is emitted as
+      // one canonical delta immediately before the original `.done` event.
+      return [];
+    }
+
+    const emitted: Array<{ event: JsonRecord; synthetic: boolean }> = [];
+    const doneKind = callKindForDone(type);
+    if (doneKind !== undefined && outputIndex !== undefined) {
+      const key = callKey(doneKind, outputIndex);
+      if (releaseDeferredCall(key)) {
+        emitted.push({
+          synthetic: true,
+          event: {
+            type: deltaTypeFor(doneKind),
+            output_index: outputIndex,
+            ...(typeof event.item_id === "string" ? { item_id: event.item_id } : {}),
+            ...(typeof event.sequence_number === "number" ? { sequence_number: event.sequence_number } : {}),
+            delta: completeValueFor(doneKind, event),
+          },
+        });
+      }
+    }
+    emitted.push({ event, synthetic: false });
+
+    for (const entry of emitted) normalizeSequence(entry.event);
+    return emitted.map(entry => entry.synthetic
+      ? syntheticJsonBlock(block, entry.event)
+      : rewriteJsonBlock(block, entry.event));
+  };
+  rewrite.dispose = dispose;
+  return rewrite;
+}

package/src/server/gui-static.ts

@@ -56,16 +56,25 @@ function isFile(path: string): boolean {
   }
 }
 
-function htmlResponse(path: string, session?: GuiSessionBootstrap): Response {
-  let html = readFileSync(path, "utf8");
-  if (session) {
-    const bootstrap = [
-      `<meta name="opencodex-session-token" content="${session.token}">`,
-      `<meta name="opencodex-session-csrf" content="${session.csrfToken}">`,
-      `<meta name="opencodex-session-origin" content="${session.origin}">`,
-    ].join("");
-    html = html.includes("</head>") ? html.replace("</head>", `${bootstrap}</head>`) : `${bootstrap}${html}`;
-  }
+/** HTML-attribute escape for values interpolated into meta tags. */
+function escapeHtmlAttribute(value: string): string {
+  return value
+    .replaceAll("&", "&amp;")
+    .replaceAll('"', "&quot;")
+    .replaceAll("<", "&lt;")
+    .replaceAll(">", "&gt;");
+}
+
+/** Shared session meta-tag block, escaped for quoted attribute interpolation. */
+function sessionBootstrapMeta(session: GuiSessionBootstrap): string {
+  return [
+    `<meta name="opencodex-session-token" content="${escapeHtmlAttribute(session.token)}">`,
+    `<meta name="opencodex-session-csrf" content="${escapeHtmlAttribute(session.csrfToken)}">`,
+    `<meta name="opencodex-session-origin" content="${escapeHtmlAttribute(session.origin)}">`,
+  ].join("");
+}
+
+function htmlDocumentResponse(html: string): Response {
   return new Response(html, {
     headers: {
       "Content-Type": "text/html",
@@ -76,6 +85,26 @@ function htmlResponse(path: string, session?: GuiSessionBootstrap): Response {
   });
 }
 
+function htmlResponse(path: string, session?: GuiSessionBootstrap): Response {
+  let html = readFileSync(path, "utf8");
+  if (session) {
+    const bootstrap = sessionBootstrapMeta(session);
+    html = html.includes("</head>") ? html.replace("</head>", `${bootstrap}</head>`) : `${bootstrap}${html}`;
+  }
+  return htmlDocumentResponse(html);
+}
+
+/**
+ * Minimal session-bootstrap document, independent of any packaged GUI build. The dev
+ * GUI (Vite) proxies /opencodex-session to the backend with the original host so the
+ * backend can mint an origin-bound loopback session even when gui/dist does not exist.
+ */
+export function serveSessionBootstrap(session: GuiSessionBootstrap): Response {
+  const bootstrap = sessionBootstrapMeta(session);
+  const html = `<!doctype html><html><head><meta charset="utf-8">${bootstrap}</head><body></body></html>`;
+  return htmlDocumentResponse(html);
+}
+
 export function serveGuiFile(
   pathname: string,
   guiDist = findGuiDist(),

package/src/server/images.ts

@@ -15,13 +15,16 @@
 import { formatErrorResponse } from "../bridge";
 import {
   CodexAccountCooldownError,
+  codexMainProfileDrainingResponse,
   cooldownErrorResponse,
   CodexAuthContextError,
+  CodexMainProfileDrainingError,
   CodexPoolAuthenticationError,
   CodexThreadAffinityExpiredError,
 } from "../codex/auth-context";
 import { formatCodexProviderForLog } from "../codex/routing";
 import { signalWithTimeout } from "../lib/abort";
+import { readBoundedResponseBytes, type BoundedBytesResult } from "../lib/bounded-body";
 import { sidecarEnter } from "../lib/sidecar-tracker";
 import type { OcxConfig } from "../types";
 import { resolveFirstUsableOpenAiSidecar, selectImagesProvider } from "../providers/openai-sidecar";
@@ -35,6 +38,8 @@ import { safeAntigravityHttpErrorMessage } from "../adapters/google-errors";
 import { sanitizeUpstreamErrorText } from "../adapters/upstream-http-error";
 import { ANTIGRAVITY_REQUEST_UA } from "../adapters/google-antigravity-wire";
 import { decodeValidatedImageBase64, MAX_ENCODED_BYTES_PER_IMAGE } from "../images/artifacts";
+import type { AdmissionLease } from "../lib/admission";
+import { codexAccountSelectionForTurn } from "./lifecycle";
 
 export type ImagesEndpoint = "generations" | "edits";
 
@@ -46,7 +51,56 @@ const IMAGES_UPSTREAM_TIMEOUT_MS = 300_000;
  * containing base64-encoded images — typically a few MB. This prevents an oversized or malicious
  * response from exhausting process memory.
  */
-const IMAGES_RESPONSE_MAX_BYTES = 100 * 1024 * 1024;
+export const IMAGES_RESPONSE_MAX_BYTES = 100 * 1024 * 1024;
+
+interface ImageResponseBytesOptions {
+  signal?: AbortSignal;
+  /** Smaller values are used only by focused reader tests. */
+  maxBytes?: number;
+}
+
+function cancelUnlockedResponseBody(response: Response | undefined, reason?: unknown): void {
+  const body = response?.body;
+  if (!body || body.locked) return;
+  try {
+    void body.cancel(reason).catch(() => undefined);
+  } catch {
+    // A broken stream can throw synchronously from cancel().
+  }
+}
+
+/**
+ * Read one image relay response as exact raw bytes under the same cap used by
+ * the public handler. A trustworthy Content-Length can reject obvious excess
+ * before attaching a reader; the streaming reader remains authoritative when
+ * the header is absent or understated.
+ */
+export async function readImageResponseBytes(
+  response: Response,
+  options: ImageResponseBytesOptions = {},
+): Promise<BoundedBytesResult> {
+  const signal = options.signal;
+  if (signal?.aborted) {
+    cancelUnlockedResponseBody(response, signal.reason);
+    throw signal.reason;
+  }
+  if (response.body === null) {
+    return { bytes: new Uint8Array(0), oversized: false };
+  }
+
+  const maxBytes = options.maxBytes ?? IMAGES_RESPONSE_MAX_BYTES;
+  const contentLength = response.headers.get("content-length");
+  const declaredBytes = contentLength === null ? Number.NaN : Number(contentLength);
+  if (Number.isSafeInteger(declaredBytes) && declaredBytes > maxBytes) {
+    cancelUnlockedResponseBody(
+      response,
+      new DOMException("Response body size limit reached", "QuotaExceededError"),
+    );
+    return { bytes: new Uint8Array(0), oversized: true };
+  }
+
+  return readBoundedResponseBytes(response, { maxBytes, signal });
+}
 
 const CCA_IMAGE_MODEL = "gemini-3.1-flash-image";
 
@@ -323,6 +377,7 @@ export async function handleImages(
   config: OcxConfig,
   endpoint: ImagesEndpoint,
   logCtx: RequestLogContext,
+  turnAdmissionLease?: AdmissionLease,
 ): Promise<Response> {
   const candidates = selectImagesProvider(config);
   if (candidates.error) {
@@ -375,11 +430,15 @@ export async function handleImages(
   let forwardAuthError: Response | undefined;
   if (canUseOpenAiForward) {
     try {
-      forward = await resolveFirstUsableOpenAiSidecar(candidates.forwardCandidates, req.headers, config);
+      forward = await resolveFirstUsableOpenAiSidecar(candidates.forwardCandidates, req.headers, config, {
+        beginCodexAccountSelection: codexAccountSelectionForTurn(turnAdmissionLease),
+      });
       if (forward) logCtx.provider = formatCodexProviderForLog(forward.providerName, codexLogAccountId(forward.authContext), config);
     } catch (err) {
       if (err instanceof CodexAccountCooldownError) {
         forwardAuthError = cooldownErrorResponse(err);
+      } else if (err instanceof CodexMainProfileDrainingError) {
+        forwardAuthError = codexMainProfileDrainingResponse();
       } else if (err instanceof CodexThreadAffinityExpiredError) {
         forwardAuthError = formatErrorResponse(409, "invalid_request_error", "Codex thread account affinity expired; start a new session");
       } else if (err instanceof CodexAuthContextError) {
@@ -431,34 +490,53 @@ export async function handleImages(
   const timeoutMs = config.images?.timeoutMs ?? IMAGES_UPSTREAM_TIMEOUT_MS;
   const linkedSignal = signalWithTimeout(timeoutMs, req.signal);
   const sidecarExit = sidecarEnter("images");
+  let upstreamResponse: Response | undefined;
   try {
     // Images POSTs create paid, non-idempotent work. One fetch only: no reset retry without a
     // source-proven idempotency contract.
-    const upstreamResponse = await fetch(url, {
+    upstreamResponse = await fetch(url, {
       method: "POST",
       headers,
       body: JSON.stringify(body),
       signal: linkedSignal.signal,
+      // Do not follow a cross-origin 3xx while carrying Codex credentials. Bun strips
+      // `Authorization` across origins but forwards nonstandard headers, so
+      // `chatgpt-account-id`, `session_id`, and `x-codex-turn-metadata` would reach the
+      // redirect target. Verified with a two-server probe. The Responses path and native
+      // compact already set this; the credential-bearing sidecars did not.
+      redirect: "manual",
     });
-    // Buffer rather than stream: the payload is one JSON document (base64 image, typically a few
-    // MB), and buffering keeps the timeout window covering the whole exchange. Cap the size to
-    // prevent an oversized response from exhausting process memory.
-    const payload = await upstreamResponse.arrayBuffer();
-    if (payload.byteLength > IMAGES_RESPONSE_MAX_BYTES) {
-      return formatErrorResponse(502, "upstream_error", `image ${endpoint} response too large (${payload.byteLength} bytes)`);
+    const observed = await readImageResponseBytes(upstreamResponse, {
+      maxBytes: IMAGES_RESPONSE_MAX_BYTES,
+      signal: linkedSignal.signal,
+    });
+    if (observed.oversized) {
+      forward?.recordOutcome?.(upstreamResponse.status);
+      return formatErrorResponse(
+        502,
+        "upstream_error",
+        `image ${endpoint} response too large (exceeded ${IMAGES_RESPONSE_MAX_BYTES} bytes)`,
+      );
     }
-    forward?.recordOutcome?.(upstreamResponse.status);
     const relayHeaders: Record<string, string> = {};
     const contentType = upstreamResponse.headers.get("content-type");
     if (contentType) relayHeaders["content-type"] = contentType;
-    return new Response(payload, { status: upstreamResponse.status, headers: relayHeaders });
+    // Fetch represents 204/205/304 responses with a null body. Preserve that
+    // invariant: constructing those statuses with even an empty Uint8Array throws.
+    const relayBody = upstreamResponse.body === null ? null : observed.bytes;
+    const relayResponse = new Response(relayBody, {
+      status: upstreamResponse.status,
+      headers: relayHeaders,
+    });
+    forward?.recordOutcome?.(upstreamResponse.status);
+    return relayResponse;
   } catch (err) {
     // Client cancel first: it aborts the linked signal too, and must not be logged as an
     // upstream failure (499 maps to client_closed_request in the request log).
     if (req.signal.aborted) {
       return formatErrorResponse(499, "client_closed_request", `image ${endpoint} request canceled by client`);
     }
-    if (err instanceof Error && err.name === "TimeoutError") {
+    if (linkedSignal.signal.aborted || (err instanceof Error && err.name === "TimeoutError")) {
       forward?.recordOutcome?.("timeout");
       // codex retries 5xx up to 4 more times; a retried 504 is acceptable for a transient hang.
       return formatErrorResponse(504, "upstream_error", `image ${endpoint} upstream timed out`);
@@ -472,5 +550,9 @@ export async function handleImages(
   } finally {
     sidecarExit();
     linkedSignal.cleanup();
+    // If cancellation won before readImageResponseBytes attached its reader, the
+    // response still owns an upstream body/socket. Consumed or locked bodies are
+    // already owned by the reader and need no second cancellation.
+    cancelUnlockedResponseBody(upstreamResponse);
   }
 }