@iislee/opencodex 2.11.0

package/src/server/search.ts

@@ -0,0 +1,136 @@
+/**
+ * /v1/alpha/search relay.
+ *
+ * codex-rs's built-in search client executes CLIENT-SIDE: it POSTs `alpha/search` against the
+ * configured base_url with the same ChatGPT bearer auth used for model requests. Under Design B
+ * injection base_url is this proxy, so the request otherwise dies on the /v1/* JSON-404 guard.
+ * The endpoint is private to the ChatGPT Codex backend, so routed providers and OpenAI API-key
+ * providers cannot serve it. Relay the JSON request and response verbatim through the configured
+ * ChatGPT forward provider.
+ */
+import { formatErrorResponse } from "../bridge";
+import {
+  CodexAccountCooldownError,
+  cooldownErrorResponse,
+  CodexAuthContextError,
+  CodexPoolAuthenticationError,
+  CodexThreadAffinityExpiredError,
+} from "../codex/auth-context";
+import { formatCodexProviderForLog } from "../codex/routing";
+import { signalWithTimeout } from "../lib/abort";
+import { sidecarEnter } from "../lib/sidecar-tracker";
+import type { OcxConfig } from "../types";
+import { listOpenAiForwardSidecarCandidates, resolveFirstUsableOpenAiSidecar } from "../providers/openai-sidecar";
+import { readJsonRequestBody } from "./request-decompress";
+import { ForwardAdmissionCredentialError, validateForwardAdmissionCredential } from "./auth-cors";
+import type { RequestLogContext } from "./request-log";
+import { codexLogAccountId, decodeRequestErrorResponse } from "./responses";
+
+/**
+ * Default TOTAL deadline for one search relay. alpha/search is non-streaming JSON — response
+ * headers arrive only when the search finishes — so the budget must cover the whole request.
+ * Overridable via config.search.timeoutMs; never config.connectTimeoutMs, whose documented
+ * contract is the DNS/TCP/TLS/header-arrival budget (a 10s connect budget would kill every
+ * long-running search).
+ */
+const SEARCH_UPSTREAM_TIMEOUT_MS = 200_000;
+const SEARCH_RESPONSE_MAX_BYTES = 16 * 1024 * 1024;
+
+export async function handleSearch(
+  req: Request,
+  config: OcxConfig,
+  logCtx: RequestLogContext,
+): Promise<Response> {
+  try { validateForwardAdmissionCredential(req.headers, config); }
+  catch (err) {
+    if (err instanceof ForwardAdmissionCredentialError) return formatErrorResponse(401, "authentication_error", err.message);
+    throw err;
+  }
+  let body: unknown;
+  try {
+    body = await readJsonRequestBody(req);
+  } catch (err) {
+    return decodeRequestErrorResponse(err, "search");
+  }
+  const model = (body as { model?: unknown } | null)?.model;
+  if (typeof model === "string" && model) logCtx.model = model;
+
+  const candidates = listOpenAiForwardSidecarCandidates(config);
+  if (candidates.length === 0) {
+    return formatErrorResponse(
+      400,
+      "invalid_request_error",
+      "Built-in web search needs a ChatGPT forward provider, but none is configured in opencodex. "
+      + "Routed and OpenAI API-key providers cannot serve /v1/alpha/search.",
+    );
+  }
+
+  let upstream: Awaited<ReturnType<typeof resolveFirstUsableOpenAiSidecar>>;
+  try {
+    upstream = await resolveFirstUsableOpenAiSidecar(candidates, req.headers, config);
+    if (!upstream) {
+      return formatErrorResponse(
+        401,
+        "authentication_error",
+        "web search relay needs ChatGPT auth (Authorization header)",
+      );
+    }
+    logCtx.provider = formatCodexProviderForLog(upstream.providerName, codexLogAccountId(upstream.authContext), config);
+  } catch (err) {
+    if (err instanceof CodexAccountCooldownError) {
+      return cooldownErrorResponse(err);
+    }
+    if (err instanceof CodexThreadAffinityExpiredError) {
+      return formatErrorResponse(409, "invalid_request_error", "Codex thread account affinity expired; start a new session");
+    }
+    if (err instanceof CodexAuthContextError) {
+      const safeAccountLabel = formatCodexProviderForLog("openai", err.accountId, config);
+      console.error(`[search] Pool account ${safeAccountLabel} token failed; reauthentication required`);
+      return formatErrorResponse(401, "authentication_error", "Selected Codex account needs reauthentication");
+    }
+    if (err instanceof CodexPoolAuthenticationError) return formatErrorResponse(401, "authentication_error", err.message);
+    throw err;
+  }
+
+  const headers: Record<string, string> = { "content-type": "application/json" };
+  if (upstream.provider.headers) Object.assign(headers, upstream.provider.headers);
+  for (const [name, value] of upstream.headers) headers[name] = value;
+  const url = `${upstream.provider.baseUrl}/alpha/search`;
+  const timeoutMs = config.search?.timeoutMs ?? SEARCH_UPSTREAM_TIMEOUT_MS;
+  const linkedSignal = signalWithTimeout(timeoutMs, req.signal);
+  const sidecarExit = sidecarEnter("search");
+  try {
+    const upstreamResponse = await fetch(url, {
+      method: "POST",
+      headers,
+      body: JSON.stringify(body),
+      signal: linkedSignal.signal,
+    });
+    const payload = await upstreamResponse.arrayBuffer();
+    if (payload.byteLength > SEARCH_RESPONSE_MAX_BYTES) {
+      return formatErrorResponse(502, "upstream_error", `search response too large (${payload.byteLength} bytes)`);
+    }
+    upstream.recordOutcome?.(upstreamResponse.status);
+    const relayHeaders: Record<string, string> = {};
+    const contentType = upstreamResponse.headers.get("content-type");
+    if (contentType) relayHeaders["content-type"] = contentType;
+    return new Response(payload, { status: upstreamResponse.status, headers: relayHeaders });
+  } catch (err) {
+    if (req.signal.aborted) {
+      return formatErrorResponse(499, "client_closed_request", "search request canceled by client");
+    }
+    if (err instanceof Error && err.name === "TimeoutError") {
+      upstream.recordOutcome?.("timeout");
+      return formatErrorResponse(504, "upstream_error", "search upstream timed out");
+    }
+    upstream.recordOutcome?.("connect_error");
+    return formatErrorResponse(
+      502,
+      "upstream_error",
+      `search relay failed: ${err instanceof Error ? err.message : String(err)}`,
+    );
+  } finally {
+    sidecarExit();
+    linkedSignal.cleanup();
+  }
+}

package/src/server/sse-payload-rewrite.ts

@@ -0,0 +1,175 @@
+import type { TranslatorBudget } from "../lib/translator-budget";
+
+/**
+ * Shared client-facing SSE payload rewrite shell.
+ *
+ * Multiple opt-in transforms (image-gen namespace restore, item-id repair, …) compose into one
+ * parse/stringify pass so a tee'd stream is not re-framed twice per event.
+ */
+
+export type SsePayloadRewrite = (payload: string) => string;
+
+/** Split one complete SSE event block while retaining its original blank-line delimiter. */
+export function nextSseBlock(buffer: string): { block: string; delimiter: string; rest: string } | null {
+  const match = buffer.match(/\r?\n\r?\n/);
+  if (!match || match.index === undefined) return null;
+  return {
+    block: buffer.slice(0, match.index),
+    delimiter: match[0],
+    rest: buffer.slice(match.index + match[0].length),
+  };
+}
+
+/** Join all data lines from one SSE event according to the event-stream field rules. */
+export function sseDataPayload(block: string): string | null {
+  const data: string[] = [];
+  for (const line of block.split(/\r?\n/)) {
+    if (!line.startsWith("data:")) continue;
+    const value = line.slice(5);
+    data.push(value.startsWith(" ") ? value.slice(1) : value);
+  }
+  return data.length > 0 ? data.join("\n") : null;
+}
+
+/** Replace an SSE event's data field while preserving non-data fields and newline style. */
+export function replaceSseDataPayload(block: string, payload: string): string {
+  const newline = block.includes("\r\n") ? "\r\n" : "\n";
+  const lines = block.split(/\r?\n/);
+  const rewritten: string[] = [];
+  let replaced = false;
+  for (const line of lines) {
+    if (!line.startsWith("data:")) {
+      rewritten.push(line);
+      continue;
+    }
+    if (!replaced) {
+      rewritten.push(`data: ${payload}`);
+      replaced = true;
+    }
+  }
+  return replaced ? rewritten.join(newline) : block;
+}
+
+/** Apply rewrites left-to-right; empty list is identity. */
+export function composeSsePayloadRewrites(...rewrites: SsePayloadRewrite[]): SsePayloadRewrite {
+  if (rewrites.length === 0) return (payload) => payload;
+  if (rewrites.length === 1) return rewrites[0]!;
+  return (payload) => {
+    let next = payload;
+    for (const rewrite of rewrites) next = rewrite(next);
+    return next;
+  };
+}
+
+/**
+ * Relay an SSE body through a single JS pull wrapper, rewriting each event's data payload in place.
+ * Non-data fields and framing are preserved; invalid JSON payloads are left to the rewrite callback.
+ */
+export function relaySseWithPayloadRewrite(
+  body: ReadableStream<Uint8Array>,
+  rewrite: SsePayloadRewrite,
+  translatorBudget: TranslatorBudget,
+): ReadableStream<Uint8Array> {
+  const reader = body.getReader();
+  const decoder = new TextDecoder();
+  const encoder = new TextEncoder();
+  let buffer = "";
+  let bufferBytes = 0;
+
+  const appendBuffer = (fragment: string): void => {
+    if (!fragment) return;
+    const nextBytes = bufferBytes + encoder.encode(fragment).byteLength;
+    const reservation = translatorBudget.reserveTransient(nextBytes, { kind: "live_transient" });
+    try {
+      buffer += fragment;
+      reservation.commitRetained();
+      translatorBudget.releaseRetained(bufferBytes, { kind: "live_transient" });
+      bufferBytes = nextBytes;
+    } catch (error) {
+      reservation.release();
+      throw error;
+    }
+  };
+
+  const replaceBuffer = (next: string): void => {
+    const nextBytes = encoder.encode(next).byteLength;
+    const reservation = translatorBudget.reserveTransient(nextBytes, { kind: "live_transient" });
+    reservation.commitRetained();
+    buffer = next;
+    translatorBudget.releaseRetained(bufferBytes, { kind: "live_transient" });
+    bufferBytes = nextBytes;
+  };
+
+  const enqueueText = (
+    controller: ReadableStreamDefaultController<Uint8Array>,
+    text: string,
+  ): void => {
+    const bytes = encoder.encode(text).byteLength;
+    const reservation = translatorBudget.reserveTransient(bytes, { kind: "live_transient" });
+    try {
+      const encoded = encoder.encode(text);
+      reservation.commitRetained();
+      controller.enqueue(encoded);
+      translatorBudget.releaseRetained(bytes, { kind: "live_transient" });
+    } catch (error) {
+      reservation.release();
+      throw error;
+    }
+  };
+
+  const releaseBuffer = (): void => {
+    translatorBudget.releaseRetained(bufferBytes, { kind: "live_transient" });
+    buffer = "";
+    bufferBytes = 0;
+  };
+
+  const emitProcessedBlocks = (
+    controller: ReadableStreamDefaultController<Uint8Array>,
+    flushFinal = false,
+  ): void => {
+    let next: { block: string; delimiter: string; rest: string } | null;
+    while ((next = nextSseBlock(buffer))) {
+      replaceBuffer(next.rest);
+      const payload = sseDataPayload(next.block);
+      const rewrittenPayload = payload ? rewrite(payload) : undefined;
+      const block = payload && rewrittenPayload !== undefined && rewrittenPayload !== payload
+        ? replaceSseDataPayload(next.block, rewrittenPayload)
+        : next.block;
+      enqueueText(controller, block + next.delimiter);
+    }
+    if (flushFinal && buffer.length > 0) {
+      const payload = sseDataPayload(buffer);
+      const rewrittenPayload = payload ? rewrite(payload) : undefined;
+      const block = payload && rewrittenPayload !== undefined && rewrittenPayload !== payload
+        ? replaceSseDataPayload(buffer, rewrittenPayload)
+        : buffer;
+      enqueueText(controller, block);
+      releaseBuffer();
+    }
+  };
+
+  return new ReadableStream<Uint8Array>({
+    async pull(controller) {
+      try {
+        const { done, value } = await reader.read();
+        if (done) {
+          appendBuffer(decoder.decode());
+          emitProcessedBlocks(controller, true);
+          releaseBuffer();
+          controller.close();
+          return;
+        }
+        appendBuffer(decoder.decode(value, { stream: true }));
+        emitProcessedBlocks(controller);
+      } catch (error) {
+        releaseBuffer();
+        try { await reader.cancel(error); } catch { /* already closed */ }
+        controller.error(error);
+      }
+    },
+    cancel(reason) {
+      releaseBuffer();
+      reader.cancel(reason).catch(() => {});
+    },
+  });
+}

package/src/server/startup-action-control.ts

@@ -0,0 +1,308 @@
+import { randomUUID } from "node:crypto";
+import { execFile } from "node:child_process";
+import { join } from "node:path";
+import { durableBunPath } from "../lib/bun-runtime";
+import {
+  WINDOWS_SCHTASKS_CREATE_ACCESS_DENIED_MARKER,
+  isWindowsSchtasksCreateAccessDenied,
+} from "../lib/windows-elevation";
+import {
+  finalizeWindowsSchedulerServiceRegistration,
+  type ElevatedReconciliationOutcome,
+  type FinalizeWindowsSchedulerOptions,
+  type FinalizeWindowsSchedulerResult,
+  type WindowsSchedulerTaskProbe,
+} from "../service";
+
+export type StartupInstallAction = "install-service" | "install-shim";
+
+export type StartupInstallState =
+  | { status: "idle" }
+  | {
+      status: "running";
+      action: StartupInstallAction;
+      attemptId: string;
+      startedAt: number;
+    }
+  | {
+      status: "indeterminate";
+      action: "install-service";
+      attemptId: string;
+      startedAt: number;
+      timedOutAt: number;
+      reconciliation: Promise<ElevatedReconciliationOutcome>;
+    }
+  | {
+      status: "blocked";
+      reason: "partial-elevated-install";
+      action: "install-service";
+      attemptId: string;
+      detail: string;
+    };
+
+const INSTALL_DETAIL_LIMIT = 2_000;
+const INDETERMINATE_MESSAGE =
+  "Windows elevation timed out, but the elevated Task Scheduler transaction may still be running. New service installation attempts are temporarily blocked while OpenCodex reconciles its final state.";
+const RECONCILING_MESSAGE =
+  "A previous elevated Windows service installation is still being reconciled. Wait for it to finish or inspect the Task Scheduler state before retrying.";
+const BLOCKED_PARTIAL_MESSAGE =
+  "A previous elevated Windows service installation left a partial Task Scheduler state. Remove the OpenCodex scheduler task (or confirm it is absent), then clear the install block before retrying.";
+
+let installState: StartupInstallState = { status: "idle" };
+
+type FinalizeFn = (
+  script?: string,
+  options?: FinalizeWindowsSchedulerOptions,
+) => Promise<FinalizeWindowsSchedulerResult>;
+let finalizeImpl: FinalizeFn = finalizeWindowsSchedulerServiceRegistration;
+
+/** Test-only seam so elevation retry tests do not mock.module the service package. */
+export function setStartupInstallFinalizeForTests(next: FinalizeFn | null): void {
+  finalizeImpl = next ?? finalizeWindowsSchedulerServiceRegistration;
+}
+
+/** Snapshot of the install lock for diagnostics and tests. */
+export function getStartupInstallState(): StartupInstallState {
+  return installState;
+}
+
+/** True when this attempt still owns the active/indeterminate/blocked lock. */
+export function ownsStartupInstallAttempt(attemptId: string): boolean {
+  return (installState.status === "running"
+    || installState.status === "indeterminate"
+    || installState.status === "blocked")
+    && installState.attemptId === attemptId;
+}
+
+/**
+ * Clear a partial-install block after the operator has cleaned up Task Scheduler.
+ * Requires an observed probe and clears only when the task is proven absent.
+ * Does not itself delete the task.
+ */
+export function clearStartupInstallPartialBlock(options: {
+  probe: WindowsSchedulerTaskProbe;
+}): { cleared: boolean; detail: string } {
+  if (installState.status !== "blocked") {
+    return { cleared: false, detail: `Install lock is ${installState.status}, not blocked.` };
+  }
+  if (options.probe.status === "present") {
+    return {
+      cleared: false,
+      detail: "OpenCodex Task Scheduler task is still present; remove it before clearing the block.",
+    };
+  }
+  if (options.probe.status === "unknown") {
+    return {
+      cleared: false,
+      detail: `Could not verify Task Scheduler absence (${options.probe.detail}); not clearing the block.`,
+    };
+  }
+  installState = { status: "idle" };
+  return { cleared: true, detail: "Partial-install block cleared." };
+}
+
+/** Test-only reset of the install lock. */
+export function resetStartupInstallStateForTests(): void {
+  installState = { status: "idle" };
+}
+
+export function startupInstallArgv(
+  action: StartupInstallAction,
+  options?: { repair?: boolean },
+): string[] {
+  if (action === "install-service") {
+    return options?.repair ? ["service", "repair"] : ["service", "install"];
+  }
+  return ["codex-shim", "install"];
+}
+
+export interface CliInstallFailure {
+  /** Machine marker such as OCX_ERROR_CODE=..., when present in any stream. */
+  code: string | null;
+  stdout: string;
+  stderr: string;
+  message: string;
+  /** Bounded user-facing diagnostic (may append the marker if truncated away). */
+  detail: string;
+}
+
+function extractOcxErrorCode(text: string): string | null {
+  const match = text.match(/OCX_ERROR_CODE=[A-Z0-9_]+/);
+  return match ? match[0] : null;
+}
+
+/**
+ * Classify a CLI install failure, keeping the machine marker separate from the
+ * truncated user-facing diagnostic.
+ */
+export function classifyCliInstallFailure(stdout: string, stderr: string, error: Error): CliInstallFailure {
+  const stdoutText = stdout.trim();
+  const stderrText = stderr.trim();
+  const message = error.message.trim();
+  const combined = [stderrText, stdoutText, message].filter(Boolean).join("\n");
+  const code = extractOcxErrorCode(combined);
+  let detail = combined || message;
+  if (detail.length > INSTALL_DETAIL_LIMIT) {
+    const truncated = detail.slice(0, INSTALL_DETAIL_LIMIT);
+    detail = code && !truncated.includes(code)
+      ? `${truncated}\n${code}… (truncated)`
+      : `${truncated}… (truncated)`;
+  }
+  return { code, stdout: stdoutText, stderr: stderrText, message, detail };
+}
+
+/** @deprecated Prefer classifyCliInstallFailure; kept for existing tests. */
+export function installFailureDetail(stdout: string, stderr: string, error: Error): string {
+  return classifyCliInstallFailure(stdout, stderr, error).detail;
+}
+
+function runCliInstall(
+  action: StartupInstallAction,
+  options?: { repair?: boolean },
+): Promise<{ stdout: string; stderr: string }> {
+  const bun = durableBunPath();
+  const cli = join(import.meta.dir, "..", "cli", "index.ts");
+  const argv = [cli, ...startupInstallArgv(action, options)];
+  return new Promise((resolve, reject) => {
+    execFile(bun, argv, {
+      encoding: "utf8",
+      env: process.env,
+      timeout: 60_000,
+      windowsHide: true,
+      maxBuffer: 256 * 1024,
+    }, (error, stdout, stderr) => {
+      if (error) {
+        const failure = classifyCliInstallFailure(stdout, stderr, error);
+        reject(Object.assign(new Error(failure.detail), { ocxInstallFailure: failure }));
+        return;
+      }
+      resolve({ stdout, stderr });
+    });
+  });
+}
+
+function installFailureCode(error: unknown): string | null {
+  if (error && typeof error === "object" && "ocxInstallFailure" in error) {
+    const failure = (error as { ocxInstallFailure?: CliInstallFailure }).ocxInstallFailure;
+    if (failure?.code) return failure.code;
+  }
+  const detail = error instanceof Error ? error.message : String(error);
+  return extractOcxErrorCode(detail);
+}
+
+function rejectIfBusy(_action: StartupInstallAction): Error | null {
+  if (installState.status === "running") {
+    return new Error(`Another startup installation is already running: ${installState.action}`);
+  }
+  if (installState.status === "indeterminate") {
+    return new Error(RECONCILING_MESSAGE);
+  }
+  if (installState.status === "blocked") {
+    return new Error(BLOCKED_PARTIAL_MESSAGE);
+  }
+  return null;
+}
+
+function applyReconciliationOutcome(
+  attemptId: string,
+  outcome: ElevatedReconciliationOutcome,
+): void {
+  if (installState.status !== "indeterminate" || installState.attemptId !== attemptId) {
+    return;
+  }
+  if (outcome === "blocked-partial") {
+    installState = {
+      status: "blocked",
+      reason: "partial-elevated-install",
+      action: "install-service",
+      attemptId,
+      detail: BLOCKED_PARTIAL_MESSAGE,
+    };
+    return;
+  }
+  installState = { status: "idle" };
+}
+
+/**
+ * Execute the existing fixed CLI installer outside the proxy event loop.
+ *
+ * Repair mode (`options.repair`) runs `ocx service repair` — asset rewrite + restart
+ * without Task Scheduler re-registration, so it must not enter the UAC elevation path.
+ *
+ * After an elevation request timeout the lock becomes `indeterminate` until the
+ * original elevated transaction completes and is reconciled. A process restart
+ * clears this in-memory lock — callers must then inspect Task Scheduler reality
+ * (see evaluateSchedulerInstallRestartReconciliation) before installing again.
+ */
+export function runStartupInstallAction(
+  action: StartupInstallAction,
+  options?: { repair?: boolean },
+): Promise<{ message: string }> {
+  const busy = rejectIfBusy(action);
+  if (busy) return Promise.reject(busy);
+
+  const repair = options?.repair === true;
+  const attemptId = randomUUID();
+  const startedAt = Date.now();
+  installState = { status: "running", action, attemptId, startedAt };
+
+  const operation = (async () => {
+    try {
+      await runCliInstall(action, { repair });
+    } catch (error) {
+      const code = installFailureCode(error);
+      const detail = error instanceof Error ? error.message : String(error);
+      // Elevate only for fresh install + structured Task Scheduler /create access denial —
+      // never for repair, WinSW removal, asset writes, or generic permission errors.
+      if (
+        !repair
+        && action === "install-service"
+        && process.platform === "win32"
+        && (code === WINDOWS_SCHTASKS_CREATE_ACCESS_DENIED_MARKER
+          || isWindowsSchtasksCreateAccessDenied(detail))
+      ) {
+        const finalized = await finalizeImpl(undefined, {
+          attemptId,
+          stillOwnsAttempt: ownsStartupInstallAttempt,
+        });
+        if (finalized.kind === "indeterminate") {
+          const ownedAttemptId = finalized.attemptId;
+          installState = {
+            status: "indeterminate",
+            action: "install-service",
+            attemptId: ownedAttemptId,
+            startedAt,
+            timedOutAt: Date.now(),
+            reconciliation: finalized.reconciliation,
+          };
+          void finalized.reconciliation.then(
+            outcome => {
+              applyReconciliationOutcome(ownedAttemptId, outcome);
+            },
+            () => {
+              // Fail closed: a rejected reconciliation must not leave an unhandled rejection
+              // or silently idle the lock while Task Scheduler state may still be partial.
+              applyReconciliationOutcome(ownedAttemptId, "blocked-partial");
+            },
+          );
+          throw new Error(INDETERMINATE_MESSAGE);
+        }
+      } else {
+        throw error;
+      }
+    }
+    if (action === "install-service") {
+      return { message: repair ? "Background service repaired." : "Background service installed." };
+    }
+    return {
+      message: repair ? "Codex launcher shim repaired." : "Codex launcher shim installed.",
+    };
+  })();
+
+  return operation.finally(() => {
+    // Do not clear an indeterminate or blocked lock from a timed-out elevation.
+    if (installState.status === "running" && installState.attemptId === attemptId) {
+      installState = { status: "idle" };
+    }
+  });
+}