@iislee/opencodex 2.11.0

package/src/claude/auth-mode.ts

@@ -0,0 +1,62 @@
+/**
+ * Claude auth-mode resolution.
+ *
+ * The resolver answers exactly ONE question: does the opencodex-owned dummy token
+ * (`ANTHROPIC_AUTH_TOKEN=opencodex-proxy`) get injected? That is narrower than "how
+ * will Claude authenticate" — native passthrough additionally needs an `sk-ant-`
+ * credential on the incoming request — so the field is `markerMode`, not
+ * `effectiveAuthMode` (devlog/_plan/260726_claude_auth_auto/002 R2-1).
+ *
+ * The admission-key axis is separate and untouched: when the proxy requires an
+ * admission key, `buildClaudeEnv` injects it regardless of mode.
+ */
+import type { OcxConfig } from "../types";
+import type { AuthDetectResult, AuthSourceId } from "./auth-detect";
+
+export type MarkerMode = "proxy" | "subscription";
+
+export type AuthModeOrigin = "manual" | "auto-present" | "auto-absent" | "auto-unknown";
+
+export interface ResolvedAuthMode {
+  /** Does the owned dummy marker get injected. NOT a claim about native auth. */
+  markerMode: MarkerMode;
+  origin: AuthModeOrigin;
+  /** The detector source that proved presence (origin auto-present only). */
+  foundBy?: AuthSourceId;
+  detection: AuthDetectResult;
+}
+
+/**
+ * Reads `authMode`; never writes it. An explicit "proxy"/"subscription" bypasses the
+ * detector forever, which is what makes a manual choice stick across auth changes.
+ *
+ * `unknown` resolves to subscription — the historical default — because flipping a
+ * subscriber into proxy mode on a failed read (denied keychain, unreadable file) is
+ * the worst outcome this feature can produce.
+ */
+export function resolveClaudeAuthMode(config: OcxConfig, detection: AuthDetectResult): ResolvedAuthMode {
+  const authMode = config.claudeCode?.authMode;
+  if (authMode === "proxy") return { markerMode: "proxy", origin: "manual", detection };
+  if (authMode === "subscription") return { markerMode: "subscription", origin: "manual", detection };
+
+  switch (detection.presence) {
+    case "present":
+      return {
+        markerMode: "subscription",
+        origin: "auto-present",
+        ...(detection.foundBy ? { foundBy: detection.foundBy } : {}),
+        detection,
+      };
+    case "absent":
+      return { markerMode: "proxy", origin: "auto-absent", detection };
+    default:
+      return { markerMode: "subscription", origin: "auto-unknown", detection };
+  }
+}
+
+/** The three-state intent as the API and GUI express it. */
+export type AuthModeIntent = "auto" | "proxy" | "subscription";
+
+export function authModeIntent(config: OcxConfig): AuthModeIntent {
+  return config.claudeCode?.authMode ?? "auto";
+}

package/src/claude/context-windows.ts

@@ -0,0 +1,189 @@
+/**
+ * Claude-surface context-window map + effective model-env computation
+ * (devlog/260712_cli_context_cache/010 B2, audit R2#1/R3#1/R3#4/R4#3).
+ *
+ * The map registers EVERY selector form a Claude Code model slot might store —
+ * bare native slug, provider/id, desktop3p alias, legacy claude-ocx-* alias —
+ * with first-wins dedupe (mirrors the desktop3p registry collision policy).
+ * Values are authoritative context windows only (native override table /
+ * adapter-reported CatalogModel.contextWindow); nothing is guessed.
+ */
+import { aliasForNative, aliasForRoute } from "./alias";
+import { desktop3pAlias } from "./desktop-3p";
+import { nativeOpenAiContextWindow, type CatalogModel } from "../codex/catalog";
+
+const ONE_MILLION = 1_000_000;
+
+/** Auto-context defaults (devlog 260712 020, user-approved). */
+export const AUTO_COMPACT_WINDOW_DEFAULT = 350_000;
+export const AUTO_CONTEXT_FLOOR = 200_000;
+/** Binary-verified accepted range for CLAUDE_CODE_AUTO_COMPACT_WINDOW (2.1.207: pSo=1e5, yDs=1e6). */
+export const AUTO_COMPACT_WINDOW_MIN = 100_000;
+export const AUTO_COMPACT_WINDOW_MAX = ONE_MILLION;
+
+/** Case-insensitive [1m] marker helpers — the CLI matches /\[1m\]/i (audit 021 #7). */
+const ONE_M_MARKER_RE = /\[1m\]$/i;
+export function hasOneMillionMarker(value: string): boolean {
+  return ONE_M_MARKER_RE.test(value);
+}
+export function stripOneMillionMarker(value: string): string {
+  return value.replace(ONE_M_MARKER_RE, "");
+}
+
+export interface AutoContextMode {
+  enabled: boolean;
+  /** Effective CLAUDE_CODE_AUTO_COMPACT_WINDOW value (tokens). */
+  compactWindow: number;
+}
+
+export const AUTO_CONTEXT_OFF: AutoContextMode = { enabled: false, compactWindow: AUTO_COMPACT_WINDOW_DEFAULT };
+
+interface AutoContextConfigSlice {
+  autoContext?: boolean;
+  autoCompactWindow?: number;
+  maxContextTokens?: number;
+}
+
+function inAutoCompactRange(value: number): boolean {
+  return Number.isInteger(value) && value >= AUTO_COMPACT_WINDOW_MIN && value <= AUTO_COMPACT_WINDOW_MAX;
+}
+
+/**
+ * Resolve the auto-context mode from claudeCode config. Disabled when the user
+ * turned it off OR when the legacy maxContextTokens override is set — that pair
+ * (MAX_CONTEXT_TOKENS + DISABLE_COMPACT) takes rule-1 precedence inside the CLI,
+ * making both AUTO_COMPACT_WINDOW and [1m] accounting inert.
+ *
+ * `envOverride` is the raw CLAUDE_CODE_AUTO_COMPACT_WINDOW the USER already
+ * exported (user-wins injection keeps it): a valid value drives the marking
+ * predicate so marker and threshold never separate (audit 021 #2); an invalid
+ * value disables auto marking entirely (the CLI would ignore it, leaving marked
+ * sub-1M models without their safety net). Out-of-range CONFIG values fall back
+ * to the 350k default (the management API rejects them; this guards hand-edits).
+ */
+export function resolveAutoContext(claudeCode: AutoContextConfigSlice | undefined, envOverride?: string): AutoContextMode {
+  if (claudeCode?.autoContext === false) return AUTO_CONTEXT_OFF;
+  const maxCtx = claudeCode?.maxContextTokens;
+  if (typeof maxCtx === "number" && Number.isFinite(maxCtx) && maxCtx > 0) return AUTO_CONTEXT_OFF;
+  if (typeof envOverride === "string" && envOverride !== "") {
+    const parsed = Number(envOverride);
+    return inAutoCompactRange(parsed) ? { enabled: true, compactWindow: parsed } : AUTO_CONTEXT_OFF;
+  }
+  const raw = claudeCode?.autoCompactWindow;
+  const compactWindow = typeof raw === "number" && inAutoCompactRange(raw) ? raw : AUTO_COMPACT_WINDOW_DEFAULT;
+  return { enabled: true, compactWindow };
+}
+
+/**
+ * [1m]-marking predicate. Windows >= 1M always mark (CLI accounts exactly 1M).
+ * Auto-context additionally marks windows > 200k that can safely host the compact
+ * window — marking a model whose real window is BELOW the compact window would put
+ * the compaction safety net behind the real API limit (mid-session 400s).
+ */
+export function shouldMarkOneMillion(window: number | undefined, auto: AutoContextMode): boolean {
+  if (typeof window !== "number" || window <= 0) return false;
+  if (window >= ONE_MILLION) return true;
+  return auto.enabled && window > AUTO_CONTEXT_FLOOR && window >= auto.compactWindow;
+}
+
+export function buildClaudeContextWindows(
+  nativeSlugs: readonly string[],
+  routedModels: readonly CatalogModel[],
+): Record<string, number> {
+  const out: Record<string, number> = {};
+  const put = (key: string | null, value: number) => {
+    if (!key) return;
+    if (out[key] === undefined) out[key] = value; // first-wins (registry policy)
+  };
+  for (const slug of nativeSlugs) {
+    const window = nativeOpenAiContextWindow(slug);
+    if (typeof window !== "number" || window <= 0) continue;
+    put(slug, window);
+    put(desktop3pAlias("native", slug), window);
+    put(aliasForNative(slug), window);
+  }
+  // Bare routed ids are registered only when unambiguous across providers (audit
+  // 021 #5) — natives are registered first, so a native slug always wins the bare key.
+  const bareCounts = new Map<string, number>();
+  for (const m of routedModels) bareCounts.set(m.id, (bareCounts.get(m.id) ?? 0) + 1);
+  for (const m of routedModels) {
+    const window = m.contextWindow;
+    if (typeof window !== "number" || window <= 0) continue;
+    // Anthropic passthrough guard (audit 021 #3): canonical claude ids ride the
+    // subscription passthrough — marking a sub-1M one would strap [1m]/1M-beta onto
+    // a model that cannot host it. Register anthropic rows only at >=1M.
+    if (m.provider === "anthropic" && window < ONE_MILLION) continue;
+    put(`${m.provider}/${m.id}`, window);
+    put(desktop3pAlias(m.provider, m.id), window);
+    put(aliasForRoute(m.provider, m.id), window);
+    if (bareCounts.get(m.id) === 1) put(m.id, window);
+  }
+  return out;
+}
+
+/** Strip a trailing [1m] marker before map lookup (selector may already carry it). */
+function bareSelector(value: string): string {
+  return stripOneMillionMarker(value);
+}
+
+/**
+ * Apply the [1m] context-variant marker to a model selector when its authoritative
+ * window is >= 1M (Claude Code accounts exactly 1M for the marker; compaction stays
+ * alive) — or, in auto-context mode, when the window clears the marking predicate
+ * above. Already-marked selectors pass through; unknown selectors stay untouched.
+ */
+export function withOneMillionMarker(selector: string | undefined, windows: Record<string, number>, auto: AutoContextMode = AUTO_CONTEXT_OFF): string | undefined {
+  if (!selector) return selector;
+  if (hasOneMillionMarker(selector)) return selector;
+  const window = windows[bareSelector(selector)];
+  return shouldMarkOneMillion(window, auto) ? `${selector}[1m]` : selector;
+}
+
+export interface ClaudeTierModels {
+  opus?: string;
+  sonnet?: string;
+  haiku?: string;
+  fable?: string;
+}
+
+/**
+ * The exact env map Claude Code consumes for model slots (audit R4#4):
+ * ANTHROPIC_MODEL + the four tier defaults + the legacy small-fast alias.
+ * effective-haiku contract (audit R1#8): tierModels.haiku ?? smallFastModel, one
+ * value injected into BOTH haiku variables.
+ */
+export function effectiveModelEnv(
+  claudeCode: { model?: string; smallFastModel?: string; tierModels?: ClaudeTierModels; autoContext?: boolean; autoCompactWindow?: number; maxContextTokens?: number } | undefined,
+  windows: Record<string, number>,
+  autoOverride?: AutoContextMode,
+): Record<string, string> {
+  const out: Record<string, string> = {};
+  const auto = autoOverride ?? resolveAutoContext(claudeCode);
+  const set = (name: string, value: string | undefined) => {
+    const marked = withOneMillionMarker(value, windows, auto);
+    if (marked) out[name] = marked;
+  };
+  set("ANTHROPIC_MODEL", claudeCode?.model);
+  set("ANTHROPIC_DEFAULT_OPUS_MODEL", claudeCode?.tierModels?.opus);
+  set("ANTHROPIC_DEFAULT_SONNET_MODEL", claudeCode?.tierModels?.sonnet);
+  set("ANTHROPIC_DEFAULT_FABLE_MODEL", claudeCode?.tierModels?.fable);
+  const effectiveHaiku = claudeCode?.tierModels?.haiku ?? claudeCode?.smallFastModel;
+  set("ANTHROPIC_DEFAULT_HAIKU_MODEL", effectiveHaiku);
+  set("ANTHROPIC_SMALL_FAST_MODEL", effectiveHaiku);
+  return out;
+}
+
+/** Shared 3s bounded acquisition (audit R4#3) for context-window sources. */
+export async function boundedContextWindows(
+  acquire: () => Promise<Record<string, number>>,
+  timeoutMs = 3_000,
+): Promise<Record<string, number> | null> {
+  try {
+    return await Promise.race([
+      acquire(),
+      new Promise<null>(resolve => setTimeout(() => resolve(null), timeoutMs)),
+    ]);
+  } catch {
+    return null;
+  }
+}

package/src/claude/desktop-3p-guard.ts

@@ -0,0 +1,35 @@
+/**
+ * Write-path validation for the Desktop 3P model list.
+ *
+ * The request path has its own guards (anthropic-image-guard.ts); this is the
+ * config-output counterpart. A bad entry here ships inside a user-visible config file,
+ * so it fails LOUD at the write boundary rather than silently producing a config
+ * Desktop rejects or mislabels.
+ */
+import type { Desktop3pModelEntry } from "./desktop-3p";
+
+const NAME_PATTERN = /^claude-[a-z0-9-]+$/;
+const MAX_LABEL_CHARS = 80;
+/** Bracket capability markers must already have been normalized away by displayModelId. */
+const FORBIDDEN_LABEL_CHARS = /[[\]]/;
+
+export function assertDesktop3pModelsValid(models: readonly Desktop3pModelEntry[]): void {
+  const seen = new Set<string>();
+  for (const model of models) {
+    if (!NAME_PATTERN.test(model.name)) {
+      throw new Error(`Desktop 3P model name is not a valid Claude-shaped id: ${model.name}`);
+    }
+    // Alias collisions are skipped upstream; if that skip ever regresses, a duplicate
+    // must fail here instead of writing a config Desktop cannot decode.
+    if (seen.has(model.name)) {
+      throw new Error(`Desktop 3P model name duplicated: ${model.name}`);
+    }
+    seen.add(model.name);
+    if (FORBIDDEN_LABEL_CHARS.test(model.labelOverride)) {
+      throw new Error(`Desktop 3P label carries a raw capability marker: ${model.labelOverride}`);
+    }
+    if (model.labelOverride.length > MAX_LABEL_CHARS) {
+      throw new Error(`Desktop 3P label exceeds ${MAX_LABEL_CHARS} chars: ${model.labelOverride}`);
+    }
+  }
+}

package/src/claude/desktop-3p-paths.ts

@@ -0,0 +1,84 @@
+import { homedir } from "node:os";
+import { posix, win32 } from "node:path";
+
+/**
+ * Claude Desktop's own configLibrary location, ported from the shipped app bundle.
+ *
+ * Desktop assembles the directory name at runtime, which is why searching the
+ * bundle for the literal "Claude-3p" finds almost nothing (app.asar, v1.18286.0):
+ *
+ *   const Bu = "-3p", zW = "Claude", ND = `${zW}${Bu}`;
+ *   function GE(){
+ *     if (process.env.CLAUDE_USER_DATA_DIR) return app.getPath("userData");
+ *     if (process.platform === "win32" && process.env.LOCALAPPDATA) return join(process.env.LOCALAPPDATA, ND);
+ *     const t = app.getPath("userData");
+ *     return t.endsWith(Bu) ? t : `${t}${Bu}`;
+ *   }
+ *   function mD(){ return join(GE(), "configLibrary") }
+ *
+ * So `Claude-3p` is Desktop's correct default, not a mistake to "fix" — but the
+ * first two branches were missing here, which is what GitHub #539 actually hit.
+ *
+ * Resolution is a pure function of (env, platform, home) so tests can exercise the
+ * win32 branch on any host: stubbing `process.platform` does NOT propagate to
+ * `os.platform()` under Bun, so a platform-sniffing implementation would be
+ * untestable in this repo.
+ */
+const SUFFIX = "-3p";
+const APP_DIR = `Claude${SUFFIX}`;
+
+function joinForPlatform(platform: NodeJS.Platform, ...parts: string[]): string {
+  return platform === "win32" ? win32.join(...parts) : posix.join(...parts);
+}
+
+export interface DesktopPathInputs {
+  env: Record<string, string | undefined>;
+  platform: NodeJS.Platform;
+  home: string;
+}
+
+/** Electron `app.getPath("userData")`: per-platform appData + productName ("Claude"). */
+export function resolveElectronUserData(inputs: DesktopPathInputs): string {
+  const { env, platform, home } = inputs;
+  if (platform === "win32") {
+    const appData = env.APPDATA?.trim();
+    return appData ? win32.join(appData, "Claude") : win32.join(home, "AppData", "Roaming", "Claude");
+  }
+  if (platform === "darwin") return posix.join(home, "Library", "Application Support", "Claude");
+  const xdg = env.XDG_CONFIG_HOME?.trim();
+  return xdg ? posix.join(xdg, "Claude") : posix.join(home, ".config", "Claude");
+}
+
+/** Desktop's userData root, mirroring `GE()` branch for branch. */
+export function resolveUserDataDir(inputs: DesktopPathInputs): string {
+  const explicit = inputs.env.CLAUDE_USER_DATA_DIR?.trim();
+  // Desktop calls app.setPath("userData", CLAUDE_USER_DATA_DIR) at startup, so this
+  // path is used verbatim — notably WITHOUT the "-3p" suffix.
+  if (explicit) return explicit;
+
+  if (inputs.platform === "win32") {
+    const localAppData = inputs.env.LOCALAPPDATA?.trim();
+    if (localAppData) return win32.join(localAppData, APP_DIR);
+  }
+
+  const root = resolveElectronUserData(inputs);
+  // Concatenated, not joined: "Claude-3p" is one path component.
+  return root.endsWith(SUFFIX) ? root : `${root}${SUFFIX}`;
+}
+
+/**
+ * The directory opencodex writes its 3P profile into.
+ *
+ * OPENCODEX_CLAUDE_DESKTOP_CONFIG_DIR wins over every other branch and is returned
+ * verbatim (no `join`), because tests point it straight at a temp directory.
+ */
+export function resolveConfigLibraryDir(inputs: DesktopPathInputs): string {
+  const override = inputs.env.OPENCODEX_CLAUDE_DESKTOP_CONFIG_DIR?.trim();
+  if (override) return override;
+  return joinForPlatform(inputs.platform, resolveUserDataDir(inputs), "configLibrary");
+}
+
+/** Runtime wrapper. Keep it thin: all branching lives in the pure functions above. */
+export function claudeDesktopConfigLibraryDir(): string {
+  return resolveConfigLibraryDir({ env: process.env, platform: process.platform, home: homedir() });
+}