@yansigit/opencodex 2.31.0

package/src/codex/log-guard/sqlite-errors.ts

@@ -0,0 +1,9 @@
+/** Classify SQLite lock contention consistently across Log Guard mutation paths. */
+export function isSqliteBusy(error: unknown): boolean {
+  const code = error && typeof error === "object" && "code" in error
+    ? String((error as { code?: unknown }).code)
+    : "";
+  const message = error instanceof Error ? error.message : String(error);
+  return code === "SQLITE_BUSY" || code === "SQLITE_LOCKED"
+    || /database (?:is|table is) locked/i.test(message);
+}

package/src/codex/main-account-cache.ts

@@ -0,0 +1,56 @@
+import type { StoredAccountQuota } from "./quota";
+import { truncateRetainedUtf8 } from "../lib/admission";
+
+const MAX_DIAGNOSTIC_VALUE_BYTES = 8 * 1024;
+
+export interface MainAccountInfo {
+  email: string | null;
+  plan: string | null;
+  quota: Omit<StoredAccountQuota, "updatedAt"> | null;
+}
+
+export interface CachedMainAccountInfo extends MainAccountInfo {
+  ts: number;
+}
+
+let cachedMainAccountInfo: CachedMainAccountInfo | null = null;
+let cachedMainCredentialPresence: boolean | null = null;
+let mainAccountIdentityGeneration = 0;
+
+export function captureMainAccountIdentityGeneration(): number {
+  return mainAccountIdentityGeneration;
+}
+
+export function isMainAccountIdentityGenerationLive(generation: number): boolean {
+  return generation === mainAccountIdentityGeneration;
+}
+
+export function getMainAccountInfoCache(): CachedMainAccountInfo | null {
+  return cachedMainAccountInfo;
+}
+
+export function setMainAccountInfoCache(value: CachedMainAccountInfo): void {
+  cachedMainAccountInfo = {
+    ...value,
+    email: value.email === null ? null : truncateRetainedUtf8(value.email, MAX_DIAGNOSTIC_VALUE_BYTES),
+    plan: value.plan === null ? null : truncateRetainedUtf8(value.plan, MAX_DIAGNOSTIC_VALUE_BYTES),
+  };
+}
+
+export function clearMainAccountInfoCache(): void {
+  cachedMainAccountInfo = null;
+  mainAccountIdentityGeneration += 1;
+}
+
+/** Last physical credential presence observed while native-main ownership was held. */
+export function getMainAccountCredentialPresence(): boolean | null {
+  return cachedMainCredentialPresence;
+}
+
+export function setMainAccountCredentialPresence(present: boolean): void {
+  cachedMainCredentialPresence = present;
+}
+
+export function clearMainAccountCredentialPresence(): void {
+  cachedMainCredentialPresence = null;
+}

package/src/codex/main-account.ts

@@ -0,0 +1,68 @@
+import { readCodexTokens } from "./auth-collision";
+import { decodeJwtPayload } from "../oauth/chatgpt";
+import { extractChatgptPlanType } from "./plan";
+import { MAIN_CODEX_ACCOUNT_ID } from "./account-id";
+
+export { MAIN_CODEX_ACCOUNT_ID } from "./account-id";
+
+/**
+ * Main account plan (e.g. "plus", "go", "free", "team"), populated from the WHAM usage
+ * fetch. Used by the rotation usage-score so go/free main accounts score on monthly
+ * percent, matching pool-account behavior.
+ */
+let mainAccountPlan: string | null = null;
+let jwtPlanAttempted = false;
+
+export function setMainAccountPlan(plan: string | null): void {
+  mainAccountPlan = plan;
+  if (plan === null) jwtPlanAttempted = false;
+}
+
+export function getMainAccountPlan(): string | undefined {
+  if (mainAccountPlan) return mainAccountPlan;
+  if (jwtPlanAttempted) return undefined;
+  jwtPlanAttempted = true;
+  const tokens = readCodexTokens();
+  const jwtPlan = tokens
+    ? extractChatgptPlanType(tokens.id_token, tokens.access_token)
+    : undefined;
+  if (jwtPlan) mainAccountPlan = jwtPlan;
+  return jwtPlan;
+}
+
+/** Read-only main account token from ~/.codex/auth.json, or null when not logged in. */
+export function getMainAccountToken(): { accessToken: string; chatgptAccountId: string } | null {
+  const tokens = readCodexTokens();
+  if (!tokens?.access_token) return null;
+  return { accessToken: tokens.access_token, chatgptAccountId: tokens.account_id };
+}
+
+/**
+ * The main token is usable when it exists and — if its JWT carries a decodable `exp` — is
+ * not expired. When `exp` cannot be decoded we treat the token as live (best-effort); an
+ * actually-invalid token then surfaces via the upstream 401 → cooldown path.
+ */
+export function isMainAccountTokenLive(now = Date.now()): boolean {
+  const tokens = readCodexTokens();
+  if (!tokens?.access_token) return false;
+  const payload = decodeJwtPayload(tokens.access_token);
+  const exp = typeof payload?.exp === "number" ? payload.exp * 1000 : undefined;
+  return exp === undefined || exp > now;
+}
+
+/**
+ * Strict liveness for auth-terminality decisions: true only when the access-token JWT
+ * carries a decodable `exp` that is still in the future.
+ *
+ * Unlike {@link isMainAccountTokenLive}, an undecodable `exp` counts as NOT live here.
+ * This gate decides whether a bare WHAM 401 is downgraded to a transient failure; if an
+ * undecodable token could vouch for itself, a genuinely dead credential would keep every
+ * 401 "transient" and needsReauth could never flip.
+ */
+export function isMainAccountTokenVerifiablyLive(now = Date.now()): boolean {
+  const tokens = readCodexTokens();
+  if (!tokens?.access_token) return false;
+  const payload = decodeJwtPayload(tokens.access_token);
+  const exp = typeof payload?.exp === "number" ? payload.exp * 1000 : undefined;
+  return exp !== undefined && exp > now;
+}

package/src/codex/management-convergence.ts

@@ -0,0 +1,167 @@
+import type { OcxConfig } from "../types";
+import { captureCatalogAdmissionSnapshot } from "./catalog-admission";
+import { convergeCodexCatalog } from "./convergence";
+import type {
+  CatalogDisposition,
+  CatalogFailureCause,
+  CatalogOnlyOutcome,
+  CodexHistoryState,
+  CodexObservedState,
+  ConvergeCodex,
+  ProjectCatalogOnlyOutcomeInput,
+} from "./convergence-types";
+
+function notEvaluatedHistory(): CodexHistoryState {
+  return {
+    status: "not-evaluated",
+    attempts: 0,
+    nextRetryAt: null,
+    txId: null,
+    pendingRows: null,
+    backupEntries: null,
+  };
+}
+
+function notEvaluatedObserved(history: CodexHistoryState): CodexObservedState {
+  return {
+    aggregate: "not-evaluated",
+    isApplied: null,
+    desired: "unknown",
+    converged: null,
+    authority: { service: "unknown", externalProvider: null },
+    surfaces: {
+      config: "not-evaluated",
+      profile: "not-evaluated",
+      catalog: "not-evaluated",
+      cache: "not-evaluated",
+      journal: "not-evaluated",
+      history: {
+        state: history,
+        database: "not-evaluated",
+        manifest: "not-evaluated",
+        rollouts: "not-evaluated",
+      },
+      provenance: {
+        state: "not-evaluated",
+        nativeGeneration: null,
+        currentTxId: null,
+      },
+    },
+  };
+}
+
+/** Recognized errno/code tokens. Anything else is dropped rather than echoed. */
+const RECOGNIZED_FAILURE_CODES: ReadonlySet<string> = new Set([
+  "ENOSPC", "EACCES", "EPERM", "EROFS", "ENOENT", "SQLITE_BUSY",
+]);
+
+/**
+ * Reduce a caught error to an allowlisted cause (#1784).
+ *
+ * Nothing from the error text reaches the caller: `kind` is chosen from a closed set and
+ * `code` is only emitted when it is a recognized token. An `Error.message` routinely carries
+ * paths, home directories and account ids, and `redactSecretString` masks token shapes but
+ * none of those, so the message is never a safe thing to forward from here.
+ */
+function catalogFailureCause(error: unknown): CatalogFailureCause {
+  const raw = (error as { code?: unknown } | null)?.code;
+  const code = typeof raw === "string" && RECOGNIZED_FAILURE_CODES.has(raw)
+    ? raw as CatalogFailureCause["code"]
+    : undefined;
+  if (error instanceof TypeError || error instanceof RangeError || error instanceof SyntaxError) {
+    return { kind: "invalid-request", ...(code ? { code } : {}) };
+  }
+  if (code === "SQLITE_BUSY") return { kind: "lock-busy", code };
+  if (code !== undefined) return { kind: "io", code };
+  return { kind: "unknown" };
+}
+
+/**
+ * Classify a failure that is NOT a filesystem problem.
+ *
+ * `disk` used to be the catch-all, so an operator saw "non-retryable disk failure" for a
+ * malformed request. Reserve `disk` for real IO and route the rest to honest reasons.
+ */
+function classifiedCatalogFailure(error: unknown, commitBegan: boolean): CatalogDisposition {
+  const cause = catalogFailureCause(error);
+  const reason = cause.kind === "invalid-request"
+    ? "request-invalid" as const
+    : cause.kind === "lock-busy"
+      ? "admission" as const
+      : cause.kind === "io"
+        ? "disk" as const
+        : "internal" as const;
+  return {
+    status: "failed",
+    reason,
+    phase: commitBegan ? "commit" : "gather",
+    // Contention is the one class worth retrying unchanged.
+    retryable: reason === "admission",
+    partialWrite: commitBegan,
+    cause,
+  };
+}
+
+function unexpectedCatalogFailure(commitBegan: boolean): CatalogDisposition {
+  return {
+    status: "failed",
+    reason: "disk",
+    phase: commitBegan ? "commit" : "gather",
+    retryable: false,
+    partialWrite: commitBegan,
+  };
+}
+
+function admissionFailure(error: unknown): CatalogDisposition {
+  const message = error instanceof Error ? error.message : "";
+  if (message.includes("config generation is busy") || message.includes("config generation is database")) {
+    return { status: "skipped", reason: "busy", retryable: true };
+  }
+  return classifiedCatalogFailure(error, false);
+}
+
+/** Project catalog work into the shared no-change/not-evaluated outcome shape. */
+export function projectCatalogOnlyOutcome({
+  changed,
+  catalogRefresh,
+}: ProjectCatalogOnlyOutcomeInput): CatalogOnlyOutcome {
+  const history = notEvaluatedHistory();
+  return {
+    kind: "catalog-only",
+    changed,
+    observed: notEvaluatedObserved(history),
+    catalogRefresh,
+    history,
+  };
+}
+
+/**
+ * Bind the management callback's exact config authority to a catalog-only
+ * funnel. This module is intentionally not re-exported by a public Codex facade.
+ */
+export function createManagementConvergeCodex(
+  config: Readonly<OcxConfig>,
+): ConvergeCodex {
+  const retainedConfig = config;
+  return async request => {
+    let commitBegan = false;
+    try {
+      if (request.scope !== "catalog" || request.action !== "converge") {
+        return projectCatalogOnlyOutcome({
+          changed: false,
+          catalogRefresh: unexpectedCatalogFailure(false),
+        });
+      }
+      const snapshot = captureCatalogAdmissionSnapshot(retainedConfig);
+      const result = await convergeCodexCatalog(snapshot, request, {
+        onCommitBegin: () => { commitBegan = true; },
+      });
+      return projectCatalogOnlyOutcome(result);
+    } catch (error) {
+      return projectCatalogOnlyOutcome({
+        changed: false,
+        catalogRefresh: commitBegan ? classifiedCatalogFailure(error, true) : admissionFailure(error),
+      });
+    }
+  };
+}

package/src/codex/model-cache.ts

@@ -0,0 +1,273 @@
+/**
+ * In-memory, per-provider TTL cache for live `/models` results.
+ *
+ * Ported in spirit from jawcode's packages/ai/src/model-manager.ts (the "always load the latest
+ * model list" resolver): live fetch when the cache is stale, serve the cache while it is fresh,
+ * and fall back to the last-known-good list when a live fetch fails. opencodex's proxy is a single
+ * long-running process and the on-disk Codex catalog already persists the last sync across
+ * restarts, so an in-memory cache is sufficient here (no SQLite layer needed).
+ */
+import type { CatalogModel } from "./catalog";
+import type { GenerationContext } from "../lib/state-store-sweeper";
+import { enforceAppOwnedMemoryBudget, type RetainedStoreSnapshot } from "../lib/app-owned-memory";
+
+/** Default freshness window. Matches Codex's own 5-min models cache so the two stay in step. */
+export const DEFAULT_MODEL_CACHE_TTL_MS = 5 * 60 * 1000;
+
+interface CacheEntry {
+  models: CatalogModel[];
+  fetchedAt: number;
+  sizeBytes: number;
+}
+
+export type ProviderModelDiscoveryFailureReason =
+  | "http"
+  | "blocked"
+  | "invalid_response"
+  | "network"
+  | "provider";
+
+export type ProviderModelDiscoveryStatus =
+  | { status: "ok" }
+  | { status: "failed"; reason: "http"; httpStatus: number }
+  | {
+      status: "failed";
+      reason: Exclude<ProviderModelDiscoveryFailureReason, "http">;
+      httpStatus?: never;
+    };
+
+export type ProviderModelDiscoveryFailure = ProviderModelDiscoveryStatus extends infer Status
+  ? Status extends { status: "failed" }
+    ? Omit<Status, "status">
+    : never
+  : never;
+
+/** Whether clearing cache rows also revokes in-flight discovery authority. */
+export type ModelCacheClearReason = "authority" | "eviction";
+
+const cache = new Map<string, CacheEntry>();
+let globalCacheGeneration = 0;
+export const providerCacheGenerations = new Map<string, number>();
+let cacheBytes = 0;
+let oldestCachedProvider: string | undefined;
+let oldestCachedAt: number | null = null;
+const modelCacheEncoder = new TextEncoder();
+
+function recomputeOldestCachedProvider(): void {
+  oldestCachedProvider = undefined;
+  oldestCachedAt = null;
+  for (const [provider, entry] of cache) {
+    if (oldestCachedAt !== null && entry.fetchedAt >= oldestCachedAt) continue;
+    oldestCachedProvider = provider;
+    oldestCachedAt = entry.fetchedAt;
+  }
+}
+
+function deleteCachedProvider(provider: string): number {
+  const entry = cache.get(provider);
+  if (!entry) return 0;
+  cache.delete(provider);
+  cacheBytes = Math.max(0, cacheBytes - entry.sizeBytes);
+  if (oldestCachedProvider === provider) recomputeOldestCachedProvider();
+  return entry.sizeBytes;
+}
+
+/** Cooldown after a failed live `/models` fetch, so a dead/unreachable provider doesn't re-pay
+ * the full fetch timeout on every catalog poll (issue #54: UI stalls behind corporate proxies). */
+export const MODELS_FETCH_FAILURE_COOLDOWN_MS = 30_000;
+
+const failureAt = new Map<string, number>();
+const discoveryStatus = new Map<string, ProviderModelDiscoveryStatus>();
+/**
+ * How many models the last successful discovery actually returned, before any configured-alias
+ * augmentation or custom-model merge. Consumers cannot recover this by subtracting known custom
+ * ids: a custom id that later also appears upstream would make a real live catalog look
+ * custom-only, and the provider's configured fallback would wrongly stay authoritative.
+ */
+const liveModelCounts = new Map<string, number>();
+let lastReconciledGeneration = 0;
+
+export function markModelsFetchFailure(provider: string, now = Date.now()): void {
+  failureAt.set(provider, now);
+}
+
+/** `liveModelCount` is required so a caller that forgets to pass it fails typecheck instead of
+ * silently recording zero and misclassifying the provider as having no live catalog. */
+export function markProviderDiscoveryOk(provider: string, liveModelCount: number): void {
+  discoveryStatus.set(provider, { status: "ok" });
+  liveModelCounts.set(provider, Math.max(0, Math.floor(liveModelCount)));
+}
+
+export function markProviderDiscoveryFailed(
+  provider: string,
+  failure: ProviderModelDiscoveryFailure,
+): void {
+  discoveryStatus.set(provider, { status: "failed", ...failure });
+}
+
+/**
+ * Decide whether a discovery FAILURE should be logged, to avoid flooding the log with an identical
+ * warning on every poll (#395: an anthropic-adapter baseUrl without `/v1/models`, e.g. Azure AI
+ * Foundry, returns HTTP 404 forever; the 30s cooldown re-probes and previously re-logged each time).
+ *
+ * Returns true only when the failure SIGNATURE changed since the last observed status — i.e. the
+ * previous state was ok/undefined, or a different reason/httpStatus. Repeated identical failures
+ * stay observable through `getProviderDiscoveryStatus()` / the providers API without log spam.
+ * Call this BEFORE `markProviderDiscoveryFailed` so it can see the prior state.
+ */
+export function shouldLogDiscoveryFailure(
+  provider: string,
+  failure: ProviderModelDiscoveryFailure,
+): boolean {
+  const prev = discoveryStatus.get(provider);
+  if (!prev || prev.status !== "failed") return true;
+  if (prev.reason !== failure.reason) return true;
+  if (prev.reason === "http" && failure.reason === "http") {
+    return prev.httpStatus !== failure.httpStatus;
+  }
+  return false;
+}
+
+export function clearProviderDiscoveryStatus(provider: string): void {
+  discoveryStatus.delete(provider);
+  liveModelCounts.delete(provider);
+}
+
+export function getProviderDiscoveryStatus(provider: string): ProviderModelDiscoveryStatus | undefined {
+  return discoveryStatus.get(provider);
+}
+
+/** Undefined when discovery has never succeeded for this provider. A failed refresh keeps the
+ * last successful count so a stale catalog is still recognised as live-origin. */
+export function getProviderLiveModelCount(provider: string): number | undefined {
+  return liveModelCounts.get(provider);
+}
+
+export function isModelsFetchCoolingDown(provider: string, cooldownMs = MODELS_FETCH_FAILURE_COOLDOWN_MS, now = Date.now()): boolean {
+  const at = failureAt.get(provider);
+  return at !== undefined && now - at < cooldownMs;
+}
+
+/** Fresh cached models for a provider, or null when absent/stale (caller should re-fetch). */
+export function getFreshCached(provider: string, ttlMs: number, now = Date.now()): CatalogModel[] | null {
+  const entry = cache.get(provider);
+  if (!entry) return null;
+  return now - entry.fetchedAt < ttlMs ? entry.models : null;
+}
+
+/** Last-known-good models regardless of age — the fallback when a live fetch fails. */
+export function getStaleCached(provider: string): CatalogModel[] | null {
+  return cache.get(provider)?.models ?? null;
+}
+
+/** Capture the cache generation before an asynchronous provider discovery starts. */
+export function captureModelCacheGeneration(provider: string): string {
+  if (!providerCacheGenerations.has(provider)) providerCacheGenerations.set(provider, 0);
+  return `${globalCacheGeneration}:${providerCacheGenerations.get(provider)!}`;
+}
+
+/** Whether a discovery started under {@link captureModelCacheGeneration} may still write. */
+export function isModelCacheGenerationCurrent(provider: string, generation: string): boolean {
+  return generation === captureModelCacheGeneration(provider);
+}
+
+/**
+ * Store a live result unless the cache was cleared while that asynchronous discovery was running.
+ * The optional generation keeps existing direct cache writers unchanged while discovery callers can
+ * prevent a previous OAuth account from repopulating the current account's cache.
+ */
+export function setCached(
+  provider: string,
+  models: CatalogModel[],
+  now = Date.now(),
+  generation?: string,
+): boolean {
+  if (generation !== undefined && !isModelCacheGenerationCurrent(provider, generation)) return false;
+  deleteCachedProvider(provider);
+  const sizeBytes = modelCacheEncoder.encode(provider).byteLength
+    + modelCacheEncoder.encode(JSON.stringify(models)).byteLength;
+  cache.set(provider, { models, fetchedAt: now, sizeBytes });
+  cacheBytes += sizeBytes;
+  if (oldestCachedAt === null || now < oldestCachedAt) {
+    oldestCachedProvider = provider;
+    oldestCachedAt = now;
+  }
+  enforceAppOwnedMemoryBudget();
+  return true;
+}
+
+/** Drop one provider's cache (or all) so the next resolve forces a live re-fetch. */
+export function clearModelCache(
+  provider?: string,
+  reason: ModelCacheClearReason = "authority",
+): void {
+  const revokesInFlightDiscovery = reason === "authority";
+  if (provider) {
+    if (revokesInFlightDiscovery) {
+      providerCacheGenerations.set(provider, (providerCacheGenerations.get(provider) ?? 0) + 1);
+    }
+    deleteCachedProvider(provider);
+    failureAt.delete(provider);
+    discoveryStatus.delete(provider);
+    liveModelCounts.delete(provider);
+  } else {
+    if (revokesInFlightDiscovery) globalCacheGeneration += 1;
+    cache.clear();
+    cacheBytes = 0;
+    oldestCachedProvider = undefined;
+    oldestCachedAt = null;
+    failureAt.clear();
+    discoveryStatus.clear();
+    liveModelCounts.clear();
+  }
+}
+
+export function reconcileModelCacheProviders(
+  validProviders: ReadonlySet<string>,
+  generation = lastReconciledGeneration + 1,
+): number {
+  if (generation <= lastReconciledGeneration) return 0;
+  const removedProviders = new Set<string>();
+  const trackedProviders = new Set([
+    ...providerCacheGenerations.keys(),
+    ...failureAt.keys(),
+    ...discoveryStatus.keys(),
+    ...liveModelCounts.keys(),
+    ...cache.keys(),
+  ]);
+  let revokedRemovedProviderAuthority = false;
+  for (const provider of trackedProviders) {
+    if (validProviders.has(provider)) continue;
+    if (!revokedRemovedProviderAuthority) {
+      globalCacheGeneration += 1;
+      revokedRemovedProviderAuthority = true;
+    }
+    providerCacheGenerations.set(provider, (providerCacheGenerations.get(provider) ?? 0) + 1);
+    providerCacheGenerations.delete(provider);
+    deleteCachedProvider(provider);
+    failureAt.delete(provider);
+    discoveryStatus.delete(provider);
+    liveModelCounts.delete(provider);
+    removedProviders.add(provider);
+  }
+  lastReconciledGeneration = generation;
+  return removedProviders.size;
+}
+
+export function reconcileModelCacheGeneration(context: GenerationContext): number {
+  return reconcileModelCacheProviders(context.providerNames, context.generation);
+}
+
+export function modelCacheRetainedStoreSnapshot(): RetainedStoreSnapshot {
+  return {
+    count: cache.size,
+    bytes: cacheBytes,
+    evictableBytes: cacheBytes,
+    pinnedBytes: 0,
+    oldestAt: oldestCachedAt,
+  };
+}
+
+export function evictOldestModelCacheForBudget(): number {
+  return oldestCachedProvider === undefined ? 0 : deleteCachedProvider(oldestCachedProvider);
+}