@iislee/opencodex 2.31.0 → 2.35.0

package/src/server/management/routing-profile-routes.ts

@@ -20,7 +20,7 @@ import { assemblePolicyCandidateEvidence } from "../../routing/compatibility/ass
 import { activateLab, labActivationRequired } from "../../lib/lab-activation";
 import { quotaEvidenceForCandidate } from "../../routing/quota";
 import { routedProviderConfig } from "../../router";
-import { saveConfigPreservingClaudeCode, getConfigDir } from "../../config";
+import { deleteConfigTopLevelKey, saveConfigPreservingClaudeCode, getConfigDir } from "../../config";
 import { reconcileLiveStateStores } from "../../lib/state-store-registrations";
 import { isPlainRecord } from "./shared";
 import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
@@ -329,7 +329,7 @@ export async function handleRoutingProfileRoutes(ctx: ManagementContext): Promis
     const nextProfiles = { ...(config.routingProfiles ?? {}) };
     delete nextProfiles[id];
     if (Object.keys(nextProfiles).length > 0) config.routingProfiles = nextProfiles;
-    else delete config.routingProfiles;
+    else deleteConfigTopLevelKey(config, "routingProfiles");
     const saveConfigPreservingClaudeCodeSafe = deps.saveConfigPreservingClaudeCode ?? saveConfigPreservingClaudeCode;
     saveConfigPreservingClaudeCodeSafe(config);
     reconcileLiveStateStores();

package/src/server/management/system-restart.ts

@@ -33,7 +33,7 @@ import {
   stopServerListener,
 } from "../lifecycle";
 import { isServiceViable } from "../../service";
-import { readRuntimePort } from "../../config";
+import { readRuntimePort } from "../../config/process-state";
 import { withProcessRuntimeProvenance } from "../../lib/bun-runtime";
 import { selfLaunchArgv } from "../../lib/self-launch-argv";
 import {

package/src/server/management-api.ts

@@ -71,6 +71,7 @@ import { handleComboRoutes } from "./management/combo-routes";
 import { handleSystemRoutes } from "./management/system-routes";
 import { handleCloudSyncRoutes } from "./management/cloud-sync-routes";
 import { handleSidebarRoutes } from "./management/sidebar-routes";
+import { handleCodexPromptRoutes } from "./management/codex-prompt-routes";
 import { handleIntegrationRoutes } from "./management/integration-routes";
 import { handleNativeIntegrationRoutes } from "./management/native-integration-routes";
 import type { ManagementContext } from "./management/context";
@@ -219,22 +220,23 @@ export async function handleManagementAPI(
   let routed: Response | null;
   try {
     routed = (await handleConfigRoutes(ctx))
-      ?? (await handleStorageLogGuardRoutes(ctx))
-      ?? (await handleLogsUsageRoutes(ctx))
-      ?? (await handleRequestHistoryRoutes(ctx))
-      ?? (await handleRoutingAnalyticsRoutes(ctx))
-      ?? (await handleRoutingProfileRoutesOnDemand(ctx))
-      ?? (await handleProviderRoutes(ctx))
-      ?? (await handleModelRoutes(ctx))
-      ?? (await handleIntegrationRoutes(ctx))
-      ?? (await handleNativeIntegrationRoutes(ctx))
-      ?? (await handleAgentSettingsRoutes(ctx))
-      ?? (await handleClientsRoutes(ctx))
-      ?? (await handleOauthAccountRoutes(ctx))
-      ?? (await handleComboRoutes(ctx))
-      ?? (await handleSystemRoutes(ctx))
-      ?? (await handleCloudSyncRoutes(ctx))
-      ?? (await handleLabRoutesOnDemand(ctx))
+    ??     (await handleStorageLogGuardRoutes(ctx))
+    ??     (await handleLogsUsageRoutes(ctx))
+    ??     (await handleRequestHistoryRoutes(ctx))
+    ??     (await handleRoutingAnalyticsRoutes(ctx))
+    ??     (await handleRoutingProfileRoutesOnDemand(ctx))
+    ??     (await handleProviderRoutes(ctx))
+    ??     (await handleModelRoutes(ctx))
+    ??     (await handleIntegrationRoutes(ctx))
+    ??     (await handleNativeIntegrationRoutes(ctx))
+    ??     (await handleAgentSettingsRoutes(ctx))
+    ??     (await handleCodexPromptRoutes(ctx))
+    ??     (await handleClientsRoutes(ctx))
+    ??     (await handleOauthAccountRoutes(ctx))
+    ??     (await handleComboRoutes(ctx))
+    ??     (await handleSystemRoutes(ctx))
+    ??     (await handleCloudSyncRoutes(ctx))
+    ??     (await handleLabRoutesOnDemand(ctx))
       ?? (await handleSidebarRoutes(ctx));
   } catch (error) {
     const tooLarge = managementBodyTooLargeResponse(error, req, config);

package/src/server/port-reclaim.ts

@@ -9,7 +9,7 @@
  * (non-ocx, non-allowlisted) processes are never killed.
  */
 import { execFileSync } from "node:child_process";
-import { verifyPidIdentity } from "../config";
+import { verifyPidIdentity } from "../config/process-state";
 import { isProcessAlive, killProxy } from "../lib/process-control";
 import { isPortAvailable, type WaitForPortOptions } from "./ports";
 import { dropWindowsTcpRowsForLocalPort } from "./windows-tcp-drop";

package/src/server/proxy-liveness.ts

@@ -9,7 +9,8 @@
  *
  * Lives outside cli.ts (which dispatches argv at module top level) so tests can import it.
  */
-import { loadConfig, readAlivePid, readRuntimePort, verifyPidIdentity } from "../config";
+import { loadConfig } from "../config";
+import { readAlivePid, readRuntimePort, verifyPidIdentity } from "../config/process-state";
 import { directLocalHttpFetch } from "./direct-local-http";
 
 export interface HealthzIdentity {
@@ -67,6 +68,14 @@ export interface LiveProxy {
   hostname?: string;
   /** Whether the successful probe used runtime-port metadata or the configured listen port. */
   source: "runtime" | "config";
+  /**
+   * Version the live proxy reported on `/healthz`, when it reported one.
+   *
+   * Carried so a stale `ocx` on PATH can be detected without a second request: the
+   * identity probe already parsed and validated this body. Absent for a legacy proxy whose
+   * healthz body predates the field.
+   */
+  version?: string;
 }
 
 /**
@@ -98,7 +107,7 @@ export async function proxyIdentityAt(
   port: number,
   opts: { hostname?: string; expectedPid?: number } = {},
   io: LivenessIo = {},
-): Promise<{ pid: number | null } | null> {
+): Promise<{ pid: number | null; version?: string } | null> {
   const fetchFn = io.fetchFn ?? directLocalHttpFetch;
   const sleepFn = io.sleepFn ?? ((ms: number) => new Promise<void>(r => setTimeout(r, ms)));
   const nowFn = io.nowFn ?? Date.now;
@@ -121,7 +130,9 @@ export async function proxyIdentityAt(
       if (!isOpencodexHealthz(body)) return null;
       const pid = typeof body?.pid === "number" ? body.pid : null;
       if (opts.expectedPid !== undefined && pid !== null && pid !== opts.expectedPid) return null;
-      return { pid };
+      // Guarded the same way `pid` is: a non-string version is absent, not coerced.
+      const version = typeof body?.version === "string" ? body.version : undefined;
+      return version === undefined ? { pid } : { pid, version };
     } catch {
       // Transport failure (timeout / refused) — retry while budget remains; a proxy that
       // has only just begun listening can miss a single short probe (#764).
@@ -179,7 +190,13 @@ export async function findLiveProxy(io: LivenessIo = {}): Promise<LiveProxy | nu
         // healthz confirmed the pid itself → trusted; a pidless legacy body did not,
         // so the cheap pid must pass full identity verification before it is returned.
         const trusted = identity.pid === pid ? pid : killablePid(pid);
-        return { pid: trusted, port: runtime.port, hostname: runtime.hostname, source: "runtime" };
+        return {
+          pid: trusted,
+          port: runtime.port,
+          hostname: runtime.hostname,
+          source: "runtime",
+          ...(identity.version === undefined ? {} : { version: identity.version }),
+        };
       }
     }
   }
@@ -196,7 +213,13 @@ export async function findLiveProxy(io: LivenessIo = {}): Promise<LiveProxy | nu
     // (its process dead, the port reused by a pidless legacy proxy) — synthesizing it
     // would hand destructive callers (stopProxy → kill fallback) a reusable pid.
     if (identity) {
-      return { pid: verifiedReportedPid(identity.pid), port: record.port, hostname: record.hostname, source: "runtime" };
+      return {
+        pid: verifiedReportedPid(identity.pid),
+        port: record.port,
+        hostname: record.hostname,
+        source: "runtime",
+        ...(identity.version === undefined ? {} : { version: identity.version }),
+      };
     }
   }
 
@@ -210,6 +233,7 @@ export async function findLiveProxy(io: LivenessIo = {}): Promise<LiveProxy | nu
       port,
       hostname: config.hostname,
       source: "config",
+      ...(identity.version === undefined ? {} : { version: identity.version }),
     };
   }
   return null;

package/src/server/relay-eager.ts

@@ -24,7 +24,12 @@
  * up to the drain window.
  */
 
-import { buildFailedTailPayload, createSseTerminalOutputBoundary } from "./relay";
+import {
+  adapterEofIncompleteFrame,
+  createSseTerminalOutputBoundary,
+  doneFrame,
+  failedTailFrame,
+} from "./relay";
 import {
   nextSseBlock,
   payloadRewriteAsBlockRewrite,
@@ -100,9 +105,19 @@ export function relaySseEagerBounded(
   const now = opts?.now ?? Date.now;
 
   const reader = body.getReader();
+  const terminalEncoder = new TextEncoder();
+  const adapterEofFrame = adapterEofIncompleteFrame(terminalEncoder);
+  const terminalSentinel = doneFrame(terminalEncoder);
   const terminalBoundary = createSseTerminalOutputBoundary();
   const activeRewrite: SseBlockRewrite | undefined = hooks.rewriteBlocks
     ?? (hooks.rewritePayload ? payloadRewriteAsBlockRewrite(hooks.rewritePayload) : undefined);
+  const encodeFailedTail = (error: unknown): Uint8Array | null => {
+    try {
+      return failedTailFrame(terminalEncoder, error);
+    } catch {
+      return null;
+    }
+  };
   const rewriteDecoder = activeRewrite ? new TextDecoder() : null;
   const rewriteEncoder = activeRewrite ? new TextEncoder() : null;
   const rewriteBudget = opts?.rewriteBudget;
@@ -164,13 +179,21 @@ export function relaySseEagerBounded(
   let queuedBytes = 0;
   let cancelled = false;
   let done = false;
-  const terminalSentinel = new TextEncoder().encode("data: [DONE]\n\n");
   // Pause gate: resolved by client pull, client cancel, or upstream abort so a
   // paused producer ALWAYS resumes (audit blocker 2 — no deadlock; onDone and
   // turn unregistration stay reachable, drainAndShutdown never hangs).
   let wake: (() => void) | null = null;
   const wakeUp = () => { const w = wake; wake = null; w?.(); };
-  const paused = () => new Promise<void>(resolve => { wake = resolve; });
+  const paused = () => new Promise<void>(resolve => {
+    wake = resolve;
+    // A pull, cancel, or abort can win the tiny window between the loop's
+    // predicate check and installing this resolver. Re-check every wake
+    // predicate after installation so that an already-fired wake cannot leave
+    // the producer parked forever.
+    if (queuedBytes <= maxQueueBytes || cancelled || upstream.signal.aborted) {
+      wakeUp();
+    }
+  });
   upstream.signal.addEventListener("abort", wakeUp, { once: true });
 
   let controllerRef: ReadableStreamDefaultController<Uint8Array> | null = null;
@@ -196,6 +219,9 @@ export function relaySseEagerBounded(
 
   const producer = async () => {
     let syntheticKind: "incomplete" | "failed" | null = null;
+    let deliveryFallbackSent = false;
+    let priorRewriteFailure = false;
+    let priorRewriteError: unknown;
     // reader.read() is not intrinsically tied to the upstream AbortController
     // (a fetch body usually rejects on abort, but that coupling is the fetch
     // implementation's, not the stream's), so abort must break a parked read on
@@ -221,18 +247,46 @@ export function relaySseEagerBounded(
         if (upstreamDone) {
           hooks.finishInspection();
           const boundedTail = terminalBoundary.finish();
+          let clientTail = boundedTail;
+          let rewriteFailed = false;
+          let rewriteError: unknown;
           if (activeRewrite) {
-            const rewritten = rewriteOutbound(boundedTail);
-            const tail = joinUint8Arrays(rewritten, flushRewriteTail());
-            if (tail.byteLength > 0 && !cancelled) {
-              queuedBytes += tail.byteLength;
-              try { controllerRef?.enqueue(tail); } catch { /* client already gone */ }
+            try {
+              const rewritten = rewriteOutbound(boundedTail);
+              clientTail = joinUint8Arrays(rewritten, flushRewriteTail());
+            } catch (error) {
+              rewriteFailed = true;
+              rewriteError = error;
+              clientTail = new Uint8Array(0);
+            }
+          }
+          if (rewriteFailed) {
+            const safeTail = encodeFailedTail(rewriteError);
+            if (safeTail && !cancelled && !upstream.signal.aborted) {
+              if (!hooks.sawTerminal()) syntheticKind = "failed";
+              queuedBytes += safeTail.byteLength;
+              try { controllerRef?.enqueue(safeTail); } catch { /* client already torn down */ }
+              try { controllerRef?.close(); } catch { /* client already gone */ }
             }
-          } else if (boundedTail.byteLength > 0 && !cancelled) {
-            queuedBytes += boundedTail.byteLength;
-            try { controllerRef?.enqueue(boundedTail); } catch { /* client already gone */ }
+            break;
+          }
+          if (clientTail.byteLength > 0 && !cancelled) {
+            queuedBytes += clientTail.byteLength;
+            try { controllerRef?.enqueue(clientTail); } catch { /* client already gone */ }
           }
-          if (!hooks.sawTerminal() && !cancelled && !upstream.signal.aborted) {
+          if (terminalBoundary.terminalSeen()) {
+            if (!terminalBoundary.doneSeen() && !cancelled) {
+              queuedBytes += terminalSentinel.byteLength;
+              try { controllerRef?.enqueue(terminalSentinel); } catch { /* client already gone */ }
+            }
+          } else if (!hooks.sawTerminal() && !cancelled && !upstream.signal.aborted) {
+            // A clean 200 EOF without a Responses terminal must be visible to
+            // Codex as one incomplete turn, followed by the normal sentinel.
+            queuedBytes += adapterEofFrame.byteLength + terminalSentinel.byteLength;
+            try {
+              controllerRef?.enqueue(adapterEofFrame);
+              controllerRef?.enqueue(terminalSentinel);
+            } catch { /* client already gone */ }
             syntheticKind = "incomplete";
           }
           break;
@@ -247,7 +301,21 @@ export function relaySseEagerBounded(
           continue;
         }
         const terminalBounded = terminalBoundary.feed(value);
-        const outbound = activeRewrite ? rewriteOutbound(terminalBounded) : terminalBounded;
+        let outbound: Uint8Array;
+        if (activeRewrite) {
+          try {
+            outbound = rewriteOutbound(terminalBounded);
+          } catch (error) {
+            // Preserve the first rewrite failure across the teardown flush. A
+            // second empty flush may succeed, but the terminal bytes still
+            // must not bypass the failed rewrite or become DONE-only output.
+            priorRewriteFailure = true;
+            priorRewriteError = error;
+            throw error;
+          }
+        } else {
+          outbound = terminalBounded;
+        }
         if (outbound.byteLength > 0) {
           queuedBytes += outbound.byteLength;
           try {
@@ -278,16 +346,75 @@ export function relaySseEagerBounded(
     } catch (err) {
       // Upstream read failure. Distinguish genuine mid-stream reset from
       // abort-driven teardown (shutdown/cancel-expiry) — audit M3.
-      if (!hooks.sawTerminal() && !cancelled && !upstream.signal.aborted) {
+      // A read can fail after delivering an unterminated terminal block. Flush
+      // both observers before deciding whether this is a synthetic reset so
+      // eager mode matches the tee/pull boundary semantics at EOF.
+      let boundedTail: Uint8Array<ArrayBufferLike> = new Uint8Array(0);
+      let tailTerminal = false;
+      let tailDone = false;
+      try { hooks.finishInspection(); } catch { /* preserve the original read failure */ }
+      try {
+        boundedTail = terminalBoundary.finish();
+        tailTerminal = terminalBoundary.terminalSeen();
+        tailDone = terminalBoundary.doneSeen();
+      } catch {
+        // A near-cap ambiguous delimiter tail may itself overflow at EOF.
+        // Preserve the original read/framing failure and continue emitting
+        // the bounded failed tail instead of letting cleanup throw again.
+      }
+      let clientTail: Uint8Array<ArrayBufferLike> = boundedTail;
+      let rewriteFailed = false;
+      let rewriteError: unknown;
+      if (priorRewriteFailure) {
+        rewriteFailed = true;
+        rewriteError = priorRewriteError;
+        clientTail = new Uint8Array(0);
+      } else if (activeRewrite) {
+        try {
+          const rewritten = rewriteOutbound(boundedTail);
+          clientTail = joinUint8Arrays(rewritten, flushRewriteTail());
+        } catch (error) {
+          rewriteFailed = true;
+          rewriteError = error;
+          clientTail = new Uint8Array(0);
+        }
+      }
+      if (clientTail.byteLength > 0 && !cancelled && !upstream.signal.aborted) {
+        queuedBytes += clientTail.byteLength;
+        try { controllerRef?.enqueue(clientTail); } catch { /* client already torn down */ }
+      }
+      if (rewriteFailed && !cancelled && !upstream.signal.aborted) {
+        // Never bypass a client rewrite after it fails: boundedTail can contain
+        // provider metadata or content that the active rewrite was required to
+        // remove. Emit one safe failed envelope instead. When inspection has
+        // already reported the real upstream terminal, this is a delivery
+        // fallback only and must not create a second accounting outcome.
+        const safeTail = encodeFailedTail(rewriteError ?? err);
+        if (safeTail && !cancelled && !upstream.signal.aborted) {
+          if (!hooks.sawTerminal()) syntheticKind = "failed";
+          deliveryFallbackSent = true;
+          queuedBytes += safeTail.byteLength;
+          try { controllerRef?.enqueue(safeTail); } catch { /* client already torn down */ }
+          try { controllerRef?.close(); } catch { /* client already gone */ }
+        }
+      } else if (tailTerminal && !cancelled && !upstream.signal.aborted) {
+        if (!tailDone) {
+          queuedBytes += terminalSentinel.byteLength;
+          try { controllerRef?.enqueue(terminalSentinel); } catch { /* client already gone */ }
+        }
+      } else if (!tailTerminal && !cancelled && !upstream.signal.aborted) {
         // Serializing `err` can run user-defined accessors (Error.message
         // getters, toString) that re-entrantly cancel the client or abort the
         // upstream. Build the tail FIRST, then re-check eligibility before
         // committing to the synthetic terminal (adversarial review blocker).
-        const tail = new TextEncoder().encode(
-          `\n\nevent: response.failed\ndata: ${buildFailedTailPayload(err)}\n\ndata: [DONE]\n\n`,
-        );
-        if (!hooks.sawTerminal() && !cancelled && !upstream.signal.aborted) {
-          syntheticKind = "failed";
+        const tail = encodeFailedTail(err);
+        if (tail && !cancelled && !upstream.signal.aborted) {
+          // Inspection and client framing have separate bounded parsers. If
+          // inspection resynchronized after an oversized frame and observed a
+          // later real terminal, it still must not suppress a terminal delivery
+          // to the client. Only accounting remains tied to the inspected result.
+          if (!hooks.sawTerminal()) syntheticKind = "failed";
+          deliveryFallbackSent = true;
           queuedBytes += tail.byteLength;
           try { controllerRef?.enqueue(tail); } catch { /* client already torn down */ }
           try { controllerRef?.close(); } catch { /* client already torn down */ }
@@ -306,7 +433,7 @@ export function relaySseEagerBounded(
       if (cancelled && !hooks.sawTerminal()) {
         hooks.onClientCancel();
       }
-      if (cancelled || upstream.signal.aborted || syntheticKind === "failed") {
+      if (cancelled || upstream.signal.aborted || syntheticKind === "failed" || deliveryFallbackSent) {
         upstream.abort();
         reader.cancel().catch(() => {});
       }