@iislee/opencodex 2.11.0 → 2.35.0

package/src/codex/paths.ts

@@ -1,4 +1,4 @@
-import { realpathSync, statSync } from "node:fs";
+import { readFileSync, realpathSync, statSync } from "node:fs";
 import { isAbsolute, join, resolve } from "node:path";
 import { expandUserPath } from "../config";
 import { defaultCodexHome } from "./home";
@@ -34,6 +34,85 @@ export function getCodexHome(): string {
   return resolveCodexHome();
 }
 
+export interface CodexSqliteHomeDeps {
+  env?: NodeJS.ProcessEnv;
+  cwd?: () => string;
+  codexHome?: string;
+  readConfig?: (path: string) => string;
+}
+
+type RootTomlStringState =
+  | { kind: "absent" }
+  | { kind: "value"; value: string }
+  | { kind: "invalid" };
+
+/**
+ * Parse the authoritative SQLite setting without changing the tolerant helper
+ * used by injection/catalog readers. History ownership must distinguish a
+ * missing key from a present value that Codex cannot interpret as a path.
+ */
+function readAuthoritativeRootTomlString(content: string, key: string): RootTomlStringState {
+  let parsed: unknown;
+  try {
+    parsed = Bun.TOML.parse(content);
+  } catch {
+    return { kind: "invalid" };
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return { kind: "invalid" };
+  const root = parsed as Record<string, unknown>;
+  if (!Object.prototype.hasOwnProperty.call(root, key)) return { kind: "absent" };
+  const value = root[key];
+  if (typeof value !== "string" || value.trim() === "") return { kind: "invalid" };
+  return { kind: "value", value: value.trim() };
+}
+
+/**
+ * Resolve Codex's SQLite state root at call time.
+ *
+ * Codex permits SQLite-backed state to live outside CODEX_HOME, especially for
+ * Windows Desktop sessions whose app-server runs in WSL. Keep the precedence
+ * identical to Codex: root config, then environment, then the effective home.
+ */
+export function resolveCodexSqliteHome(deps: CodexSqliteHomeDeps = {}): string {
+  const codexHome = deps.codexHome ?? getCodexHome();
+  const readConfig = deps.readConfig ?? (path => readFileSync(path, "utf8"));
+  const configPath = join(codexHome, "config.toml");
+  let configured: RootTomlStringState = { kind: "absent" };
+  try {
+    configured = readAuthoritativeRootTomlString(readConfig(configPath), "sqlite_home");
+  } catch (cause) {
+    if ((cause as NodeJS.ErrnoException | undefined)?.code !== "ENOENT") {
+      throw new Error(
+        `Codex config could not be read while resolving sqlite_home: ${configPath}`,
+        { cause },
+      );
+    }
+    // A genuinely absent config cannot contain the authoritative root override,
+    // so only ENOENT may continue to the documented environment/home fallback.
+  }
+  if (configured.kind === "invalid") {
+    throw new Error(`Codex config has an invalid sqlite_home setting: ${configPath}`);
+  }
+  const raw = configured.kind === "value"
+    ? configured.value
+    : (deps.env ?? process.env).CODEX_SQLITE_HOME?.trim() || "";
+  if (!raw) return codexHome;
+  const expanded = expandUserPath(raw);
+  return isAbsolute(expanded)
+    ? resolve(expanded)
+    : resolve((deps.cwd ?? process.cwd)(), expanded);
+}
+
+/** Active Codex thread-state database, derived from the call-time SQLite root. */
+export function resolveCodexStateDbPath(deps: CodexSqliteHomeDeps = {}): string {
+  return join(resolveCodexSqliteHome(deps), "state_5.sqlite");
+}
+
+/** Active Codex diagnostic-log database, derived from the call-time SQLite root. */
+export function resolveCodexLogsDbPath(deps: CodexSqliteHomeDeps = {}): string {
+  return join(resolveCodexSqliteHome(deps), "logs_2.sqlite");
+}
+
 export function tomlString(value: string): string {
   return JSON.stringify(value);
 }

package/src/codex/plan-from-token.ts

@@ -0,0 +1,140 @@
+import {
+  ConfigMutationLockError,
+  loadConfig,
+  mutatePersistedConfig,
+} from "../config";
+import type { CodexAccount, OcxConfig } from "../types";
+import { isSelectableCodexPoolAccount, isValidCodexAccountId } from "./account-id";
+import {
+  getCodexAccountCredential,
+  isCodexAccountGenerationLive,
+  readCodexAccountRecord,
+} from "./account-store";
+import { extractChatgptPlanType, codexPlanValue } from "./plan";
+
+interface FreshPoolPlanUpdate {
+  accountId: string;
+  plan: string;
+  credentialGeneration: number;
+}
+
+function configuredPoolAccount(config: OcxConfig, accountId: string): CodexAccount | null {
+  if (!isValidCodexAccountId(accountId)) return null;
+  return (config.codexAccounts ?? [])
+    .find(account => account.id === accountId && isSelectableCodexPoolAccount(account)) ?? null;
+}
+
+function jwtPlanFromPoolCredential(accountId: string): string | undefined {
+  const cred = getCodexAccountCredential(accountId);
+  return cred ? extractChatgptPlanType(undefined, cred.accessToken) : undefined;
+}
+
+/**
+ * WHAM-wins gate (release-audit fix). A JWT-derived plan may be persisted only when no
+ * WHAM-sourced plan exists for the CURRENT credential generation. A token refresh bumps the
+ * generation, and the refreshed JWT is then genuinely newer information than the previous
+ * generation's WHAM read, so it may write again until WHAM re-observes. Records without
+ * provenance (legacy) stay writable so the original #1989 recovery still works.
+ */
+function jwtMayWritePlan(account: CodexAccount, generation: number): boolean {
+  if (account.planSource !== "wham") return true;
+  const whamGeneration = account.planCredentialGeneration;
+  return whamGeneration !== undefined && generation > whamGeneration;
+}
+
+function collectJwtPoolPlanUpdates(runtimeConfig: OcxConfig): FreshPoolPlanUpdate[] {
+  const updates: FreshPoolPlanUpdate[] = [];
+  for (const account of (runtimeConfig.codexAccounts ?? []).filter(isSelectableCodexPoolAccount)) {
+    const jwtPlan = jwtPlanFromPoolCredential(account.id);
+    if (!jwtPlan || codexPlanValue(account.plan) === jwtPlan) continue;
+    const generation = readCodexAccountRecord(account.id)?.generation;
+    if (generation === undefined) continue;
+    if (!jwtMayWritePlan(account, generation)) continue;
+    updates.push({ accountId: account.id, plan: jwtPlan, credentialGeneration: generation });
+  }
+  return updates;
+}
+
+const appliedJwtPlans = new Map<string, string>();
+
+function persistJwtPlanUpdates(runtimeConfig: OcxConfig, updates: FreshPoolPlanUpdate[]): void {
+  if (updates.length === 0) return;
+  let outcome: ReturnType<typeof mutatePersistedConfig<FreshPoolPlanUpdate[]>>;
+  try {
+    outcome = mutatePersistedConfig(persistedConfig => {
+      const accepted: FreshPoolPlanUpdate[] = [];
+      let changed = false;
+      for (const update of updates) {
+        if (!isCodexAccountGenerationLive(update.accountId, update.credentialGeneration)) continue;
+        const liveAccount = configuredPoolAccount(runtimeConfig, update.accountId);
+        const persistedAccount = configuredPoolAccount(persistedConfig, update.accountId);
+        if (!liveAccount || !persistedAccount) continue;
+        // Re-check against the PERSISTED row: another process may have landed a WHAM
+        // observation between collect and this mutation.
+        if (!jwtMayWritePlan(persistedAccount, update.credentialGeneration)) continue;
+        accepted.push(update);
+        if (persistedAccount.plan !== update.plan) {
+          persistedAccount.plan = update.plan;
+          changed = true;
+        }
+        if (persistedAccount.planSource !== "jwt" || persistedAccount.planCredentialGeneration !== update.credentialGeneration) {
+          persistedAccount.planSource = "jwt";
+          persistedAccount.planCredentialGeneration = update.credentialGeneration;
+          changed = true;
+        }
+      }
+      return { changed, value: accepted };
+    });
+  } catch (error) {
+    if (error instanceof ConfigMutationLockError) return;
+    throw error;
+  }
+  if (outcome.status === "unavailable") return;
+  for (const update of outcome.value) {
+    if (!isCodexAccountGenerationLive(update.accountId, update.credentialGeneration)) continue;
+    const liveAccount = configuredPoolAccount(runtimeConfig, update.accountId);
+    if (liveAccount) {
+      liveAccount.plan = update.plan;
+      liveAccount.planSource = "jwt";
+      liveAccount.planCredentialGeneration = update.credentialGeneration;
+      appliedJwtPlans.set(update.accountId, update.plan);
+    }
+  }
+}
+
+/**
+ * Persist JWT `chatgpt_plan_type` onto `codexAccounts[].plan` when it contradicts the stored
+ * label. Generation-gated, same fail-closed lock policy as the WHAM plan patch. Does not
+ * overwrite a plan that already matches the token.
+ */
+export function reconcileCodexPlansFromTokens(runtimeConfig: OcxConfig = loadConfig()): void {
+  persistJwtPlanUpdates(runtimeConfig, collectJwtPoolPlanUpdates(runtimeConfig));
+}
+
+export function resetJwtPlanNotesForTests(): void {
+  appliedJwtPlans.clear();
+}
+
+/** Apply one account's live token claim without blocking the credential read path. */
+export function noteCodexAccountAccessToken(
+  accountId: string,
+  accessToken: string,
+  credentialGeneration: number,
+): void {
+  const jwtPlan = extractChatgptPlanType(undefined, accessToken);
+  if (!jwtPlan) return;
+  if (appliedJwtPlans.get(accountId) === jwtPlan) return;
+  try {
+    const runtimeConfig = loadConfig();
+    const live = configuredPoolAccount(runtimeConfig, accountId);
+    if (!live || codexPlanValue(live.plan) === jwtPlan) {
+      appliedJwtPlans.set(accountId, jwtPlan);
+      return;
+    }
+    if (!jwtMayWritePlan(live, credentialGeneration)) return;
+    persistJwtPlanUpdates(runtimeConfig, [{ accountId, plan: jwtPlan, credentialGeneration }]);
+    if (codexPlanValue(live.plan) === jwtPlan) appliedJwtPlans.set(accountId, jwtPlan);
+  } catch {
+    appliedJwtPlans.delete(accountId);
+  }
+}

package/src/codex/plan.ts

@@ -0,0 +1,40 @@
+import { decodeJwtPayload } from "../oauth/chatgpt";
+
+/** Preserve user/provider plan labels only when they are usable strings. */
+export function codexPlanValue(value: unknown): string | undefined {
+  if (typeof value !== "string") return undefined;
+  return value.trim() ? value : undefined;
+}
+
+/** Case-insensitive key used by quota, capacity, and collision policy. */
+export function codexPlanKey(value: unknown): string | undefined {
+  return codexPlanValue(value)?.trim().toLowerCase();
+}
+
+export function isThirtyDayOnlyCodexPlan(value: unknown): boolean {
+  const key = codexPlanKey(value);
+  return key === "go" || key === "free";
+}
+
+/**
+ * ChatGPT plan label from a live access/id token (`chatgpt_plan_type`).
+ * Used when WHAM has not run yet so a stale stored `free` cannot outrank the token (#1989).
+ */
+export function extractChatgptPlanType(idToken?: string, accessToken?: string): string | undefined {
+  for (const token of [idToken, accessToken]) {
+    if (!token) continue;
+    const payload = decodeJwtPayload(token);
+    if (!payload) continue;
+    if (typeof payload.chatgpt_plan_type === "string") {
+      const plan = codexPlanValue(payload.chatgpt_plan_type);
+      if (plan) return plan;
+    }
+    const ns = payload["https://api.openai.com/auth"];
+    if (ns && typeof ns === "object") {
+      const nested = (ns as Record<string, unknown>).chatgpt_plan_type;
+      const plan = codexPlanValue(nested);
+      if (plan) return plan;
+    }
+  }
+  return undefined;
+}

package/src/codex/plugins-doctor.ts

@@ -59,7 +59,7 @@ function readMarketplaceTable(configText: string, name: string): Record<string,
   for (let i = start; i < lines.length; i++) {
     const line = lines[i] ?? "";
     if (/^\s*\[/.test(line)) break; // next table starts; stop
-    const m = line.match(/^\s*([A-Za-z0-9_-]+)\s*=\s*("(?:\\.|[^"])*"|'[^']*'|[^#]+?)\s*(?:#.*)?$/);
+    const m = line.match(/^\s*([A-Za-z0-9_-]+)\s*=\s*("(?:\\.|[^"\\])*"|'[^']*'|(?!["'])[^\s#]+)\s*(?:#.*)?$/);
     if (!m) continue;
     table[m[1]] = unquoteTomlValue(m[2].trim());
   }

package/src/codex/pool-rotation.ts

@@ -19,6 +19,11 @@ const MAX_STICKY_LIMIT = 100;
 const DEFAULT_STRATEGY: OcxAccountPoolRotationStrategy = "quota";
 const VALID_STRATEGIES = new Set<OcxAccountPoolRotationStrategy>(["quota", "round-robin", "fill-first"]);
 
+/** Selection order for an account with no stored preference: one flat tier. */
+export const DEFAULT_ACCOUNT_PRIORITY = 0;
+export const MIN_ACCOUNT_PRIORITY = -100;
+export const MAX_ACCOUNT_PRIORITY = 100;
+
 /** Strict parse for management APIs — returns null instead of defaulting. */
 export function parseAccountPoolStrategy(raw: unknown): OcxAccountPoolRotationStrategy | null {
   if (typeof raw === "string" && VALID_STRATEGIES.has(raw as OcxAccountPoolRotationStrategy)) {
@@ -43,6 +48,71 @@ export function normalizeAccountPoolStickyLimit(raw: unknown): number {
   return parseAccountPoolStickyLimit(raw) ?? DEFAULT_STICKY_LIMIT;
 }
 
+/** Strict parse for management APIs — returns null instead of defaulting. */
+export function parseAccountPriority(raw: unknown): number | null {
+  if (
+    typeof raw === "number"
+    && Number.isInteger(raw)
+    && raw >= MIN_ACCOUNT_PRIORITY
+    && raw <= MAX_ACCOUNT_PRIORITY
+  ) {
+    return raw;
+  }
+  return null;
+}
+
+export function normalizeAccountPriority(raw: unknown): number {
+  return parseAccountPriority(raw) ?? DEFAULT_ACCOUNT_PRIORITY;
+}
+
+/**
+ * Narrow an already-eligible account list to the highest selection-order tier that
+ * still has usable quota. Priority is an *ordering* boundary layered on top of
+ * eligibility: it never admits an account the caller already filtered out, and it
+ * never keeps the pool on a tier whose every member is drained.
+ *
+ * Contract (each clause is load-bearing for "no behavior change when unconfigured"):
+ * - one distinct priority across `ids` (the unconfigured case) returns `ids` unchanged,
+ *   so today's pick sequence is preserved byte for byte;
+ * - input order is preserved inside the returned tier, which keeps the `__main__`
+ *   head-of-list bias and the first-index tie-break used by SWRR/lowest-usage;
+ * - every tier drained returns `ids` unchanged, reproducing today's
+ *   stay-put-until-429 behavior rather than inventing a pick;
+ * - a `pinnedId` that is present *and* has headroom lowers the ceiling to its own
+ *   tier, which is what makes a manual "use this now" survive round-robin and
+ *   fill-first without any mutable selection state. A drained or absent pin is
+ *   ignored, so the pin expires on its own once the account crosses the threshold.
+ */
+export function selectPriorityTier(
+  ids: readonly string[],
+  priorityOf: (id: string) => number,
+  hasHeadroom: (id: string) => boolean,
+  pinnedId?: string,
+): readonly string[] {
+  // Readonly out as well as in: the no-change cases return the caller's own array, so a
+  // mutating caller would corrupt its input in exactly the cases that must not change.
+  const list = ids;
+  if (list.length <= 1) return list;
+
+  const priorities = list.map(priorityOf);
+  const firstPriority = priorities[0]!;
+  if (priorities.every(priority => priority === firstPriority)) return list;
+
+  let ceiling = Number.POSITIVE_INFINITY;
+  if (pinnedId !== undefined) {
+    const pinnedIndex = list.indexOf(pinnedId);
+    if (pinnedIndex >= 0 && hasHeadroom(pinnedId)) ceiling = priorities[pinnedIndex]!;
+  }
+
+  const tiers = [...new Set(priorities)].sort((a, b) => b - a);
+  for (const tier of tiers) {
+    if (tier > ceiling) continue;
+    const members = list.filter((_, index) => priorities[index] === tier);
+    if (members.some(hasHeadroom)) return members;
+  }
+  return list;
+}
+
 function getOrCreateState(poolKey: string): SelectionState {
   let state = selectionState.get(poolKey);
   if (!state) {
@@ -60,7 +130,7 @@ function cloneSelectionState(state: SelectionState): SelectionState {
   };
 }
 
-function smoothWeightedIndex(ids: string[], state: SelectionState): number {
+function smoothWeightedIndex(ids: readonly string[], state: SelectionState): number {
   let best = -1;
   let bestScore = Number.NEGATIVE_INFINITY;
   let total = 0;
@@ -87,7 +157,7 @@ function smoothWeightedIndex(ids: string[], state: SelectionState): number {
  * either the live map entry or a scratch/clone for dry-run peek.
  */
 function pickRoundRobinFromState(
-  eligibleIds: string[],
+  eligibleIds: readonly string[],
   stickyLimit: number,
   state: SelectionState,
   commitSticky: boolean,
@@ -118,7 +188,7 @@ function pickRoundRobinFromState(
 
 export function pickRoundRobinAccount(
   poolKey: string,
-  eligibleIds: string[],
+  eligibleIds: readonly string[],
   stickyLimit: number,
 ): string | null {
   return pickRoundRobinFromState(eligibleIds, stickyLimit, getOrCreateState(poolKey), true);
@@ -130,7 +200,7 @@ export function pickRoundRobinAccount(
  */
 export function peekRoundRobinAccount(
   poolKey: string,
-  eligibleIds: string[],
+  eligibleIds: readonly string[],
   stickyLimit: number,
 ): string | null {
   const live = selectionState.get(poolKey);

package/src/codex/project-config-warnings.ts

@@ -1,4 +1,4 @@
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, realpathSync } from "node:fs";
 import path, { dirname, join, resolve } from "node:path";
 import { expandUserPath } from "../config";
 import { defaultCodexHome } from "./home";
@@ -70,7 +70,7 @@ export function parseTomlDocument(content: string): TomlDocument {
       current = section;
       continue;
     }
-    const kv = line.match(/^\s*([A-Za-z0-9_.-]+)\s*=\s*("(?:\\.|[^"])*"|'[^']*'|[^\s#]+)\s*(?:#.*)?$/);
+    const kv = line.match(/^\s*([A-Za-z0-9_.-]+)\s*=\s*("(?:\\.|[^"\\])*"|'[^']*'|[^\s#]+)\s*(?:#.*)?$/);
     if (kv) current[kv[1]!] = parseTomlString(kv[2]!);
   }
 
@@ -252,9 +252,23 @@ export function discoverProjectCodexConfigPaths(options: {
 } = {}): string[] {
   const found = new Set<string>();
   const codexConfigPath = options.codexConfigPath ?? resolveCodexConfigPath();
+  // A parent walk can reach the user's home and rediscover this global file as
+  // `$HOME/.codex/config.toml`; compare real paths so symlink aliases are excluded too.
+  const normalizeExistingPath = (candidate: string): string | null => {
+    if (!existsSync(candidate)) return null;
+    let canonical: string;
+    try {
+      canonical = realpathSync.native(candidate);
+    } catch {
+      canonical = resolve(candidate);
+    }
+    return process.platform === "win32" ? canonical.toLowerCase() : canonical;
+  };
+  const globalConfigIdentity = normalizeExistingPath(codexConfigPath);
   const addIfExists = (projectRoot: string) => {
-    const path = join(resolve(projectRoot), ".codex", "config.toml");
-    if (existsSync(path)) found.add(path);
+    const candidate = join(resolve(projectRoot), ".codex", "config.toml");
+    const candidateIdentity = normalizeExistingPath(candidate);
+    if (candidateIdentity && candidateIdentity !== globalConfigIdentity) found.add(candidate);
   };
 
   let cwd = resolve(options.cwd ?? process.cwd());
@@ -339,7 +353,7 @@ export function summarizeProjectCodexIssue(warning: ProjectCodexConfigWarning):
 
 function humanizeProviderDetail(detail: string): string {
   if (detail === "opencode_go") return "OpenCode Go";
-  if (detail.startsWith("opencode")) return "OpenCode";
+  if (/^opencode(?:$|[-_.:/])/.test(detail)) return "OpenCode";
   if (detail === "opencodex") return "OpenCodex";
   return detail;
 }
@@ -408,4 +422,4 @@ export function printProjectCodexConfigWarnings(
     }
   }
   return warnings;
-}
+}