@yansigit/opencodex 2.31.0

package/src/sidecar/auth.ts

@@ -0,0 +1,92 @@
+/**
+ * The one place that decides whether a sidecar may treat ChatGPT or Anthropic
+ * auth as PRESENT (#2188). Web-search and vision consumed two hand-rolled
+ * copies of the Anthropic predicate and no Codex-login predicate at all —
+ * provider presence was standing in for "logged in", which let a fresh install
+ * with the built-in forward provider but no credential offer Luna as a
+ * describer it could never run.
+ *
+ * Both flags are request-context-free: they read config plus the stored
+ * account state, never headers. Per-request usability (exact accounts,
+ * generation fences) stays in resolveFirstUsableOpenAiSidecar and the
+ * executors; this module only answers "is this side worth offering at all?".
+ */
+import type { OcxConfig, OcxProviderConfig } from "../types";
+import { listOpenAiForwardSidecarCandidates } from "../providers/openai-sidecar";
+import { OPENAI_CODEX_PROVIDER_ID } from "../providers/openai-tiers";
+import { isCodexAccountUsable } from "../codex/account-usability";
+import { MAIN_CODEX_ACCOUNT_ID, isSelectableCodexPoolAccount } from "../codex/account-id";
+import { getAccountSet } from "../oauth/store";
+
+export interface SidecarAuthState {
+  /** ChatGPT login usable: canonical forward provider AND a live stored credential. */
+  isCodexAuth: boolean;
+  /** Enabled anthropic-adapter OAuth provider whose active account is not marked for reauth. */
+  isAnthropicAuth: boolean;
+  /** The provider an Anthropic-side executor would dispatch through, when isAnthropicAuth. */
+  anthropicProviderName?: string;
+  anthropicProvider?: OcxProviderConfig;
+}
+
+/**
+ * Fixed auth-slot models (#2188): logged-in sides keep these candidates even
+ * when the picker hides or disables them. The slot is the LOGIN's entitlement,
+ * not the catalog's.
+ */
+export const AUTH_SLOT_MODELS = {
+  codex: "gpt-5.6-luna",
+  anthropic: "claude-haiku-4-5",
+} as const;
+
+export interface SidecarAuthSlot {
+  provider: string;
+  id: string;
+  slot: keyof typeof AUTH_SLOT_MODELS;
+}
+
+/** Login-shaped, not provider-shaped: a forward provider with no credential is NOT Codex auth. */
+function hasUsableCodexLogin(config: OcxConfig): boolean {
+  if (listOpenAiForwardSidecarCandidates(config).length === 0) return false;
+  if (isCodexAccountUsable(config, MAIN_CODEX_ACCOUNT_ID)) return true;
+  return (config.codexAccounts ?? []).some(account =>
+    isSelectableCodexPoolAccount(account) && isCodexAccountUsable(config, account.id));
+}
+
+/**
+ * The predicate previously duplicated as findAnthropicSidecarProvider
+ * (web-search) and findAnthropicVisionProvider (vision): first enabled
+ * anthropic-adapter OAuth provider whose ACTIVE stored account holds a usable
+ * credential. getAccountSet + needsReauth, not getCredential — a terminally
+ * invalid account must not present as auth (audit F1).
+ */
+function findAnthropicAuthProvider(
+  config: OcxConfig,
+): { providerName: string; provider: OcxProviderConfig } | undefined {
+  for (const [providerName, provider] of Object.entries(config.providers)) {
+    if (provider.disabled === true) continue;
+    if (provider.adapter !== "anthropic" || provider.authMode !== "oauth") continue;
+    const set = getAccountSet(providerName);
+    const active = set?.accounts.find(account => account.id === set.activeAccountId);
+    if (active && active.needsReauth !== true) return { providerName, provider };
+  }
+  return undefined;
+}
+
+export function resolveSidecarAuth(config: OcxConfig): SidecarAuthState {
+  const anthropic = findAnthropicAuthProvider(config);
+  return {
+    isCodexAuth: hasUsableCodexLogin(config),
+    isAnthropicAuth: anthropic !== undefined,
+    ...(anthropic ? { anthropicProviderName: anthropic.providerName, anthropicProvider: anthropic.provider } : {}),
+  };
+}
+
+/** The auth-entitled fixed candidates. Emitted regardless of picker visibility. */
+export function sidecarAuthSlots(auth: SidecarAuthState): SidecarAuthSlot[] {
+  const slots: SidecarAuthSlot[] = [];
+  if (auth.isCodexAuth) slots.push({ provider: OPENAI_CODEX_PROVIDER_ID, id: AUTH_SLOT_MODELS.codex, slot: "codex" });
+  if (auth.isAnthropicAuth && auth.anthropicProviderName) {
+    slots.push({ provider: auth.anthropicProviderName, id: AUTH_SLOT_MODELS.anthropic, slot: "anthropic" });
+  }
+  return slots;
+}

package/src/sidecar/candidates.ts

@@ -0,0 +1,83 @@
+/**
+ * The unified picker-visibility candidate set both sidecars consume (#2188).
+ *
+ * Rule 1 (picker): a model may be OFFERED as a sidecar backend only if the
+ * management picker would show it — the same `listManagementModelRows` rows
+ * the GUI Models tab renders, minus disabled rows. Rule 1's only exception is
+ * the auth slots: a logged-in side keeps its fixed slot model (Luna/Haiku)
+ * even when the picker hides it, because the slot is the login's entitlement.
+ *
+ * Vision additionally applies rule 2 (− provably text-only); web-search
+ * applies its own rule 2 (∩ probed backend with an executor) in
+ * src/web-search/backends.ts. Both start from THIS set so the two sidecars
+ * cannot diverge on what "visible" means.
+ */
+import type { OcxConfig } from "../types";
+import { listManagementModelRows } from "../server/management/model-rows";
+import { modelAcceptsImageInput, type VisionCandidateModel } from "../vision/eligibility";
+import { sidecarAuthSlots, type SidecarAuthState } from "./auth";
+
+export interface SidecarCandidate {
+  provider: string;
+  id: string;
+  native?: boolean;
+  inputModalities?: string[];
+  /** True when this row is an auth-slot entitlement rather than a picker row. */
+  authSlot?: boolean;
+}
+
+/**
+ * (picker-visible rows) ∪ (auth slots). De-duplicated by provider+id with the
+ * auth-slot flag winning, so a slot model that is ALSO picker-visible still
+ * reads as slot-backed. A catalog outage degrades to slots only — the settings
+ * routes must not 500 and must keep the logged-in floor populated.
+ */
+export async function pickerVisibleSidecarCandidates(
+  config: OcxConfig,
+  auth: SidecarAuthState,
+): Promise<SidecarCandidate[]> {
+  let rows: Awaited<ReturnType<typeof listManagementModelRows>> = [];
+  try { rows = await listManagementModelRows(config); } catch { rows = []; }
+  const byKey = new Map<string, SidecarCandidate>();
+  for (const row of rows) {
+    if (row.disabled === true) continue;
+    byKey.set(`${row.provider}/${row.id}`, {
+      provider: row.provider,
+      id: row.id,
+      ...(row.inputModalities ? { inputModalities: row.inputModalities } : {}),
+      ...(row.native ? { native: true } : {}),
+    });
+  }
+  for (const slot of sidecarAuthSlots(auth)) {
+    byKey.set(`${slot.provider}/${slot.id}`, {
+      provider: slot.provider,
+      id: slot.id,
+      // Slot models are known image-capable; their only exclusion path is the
+      // provider's explicit consumer list (same stance as baselineCandidate).
+      inputModalities: ["text", "image"],
+      authSlot: true,
+    });
+  }
+  return [...byKey.values()];
+}
+
+/**
+ * Rule 2 for vision: drop rows PROVABLY text-only. Unknown stays eligible —
+ * the picker filter (rule 1) already bounded the set, so permissive-unknown
+ * no longer expands to the whole catalog.
+ */
+export function visionSidecarCandidates(
+  config: Pick<OcxConfig, "providers">,
+  all: readonly SidecarCandidate[],
+): SidecarCandidate[] {
+  return all.filter(candidate => modelAcceptsImageInput(config, toVisionCandidate(candidate)) !== false);
+}
+
+function toVisionCandidate(candidate: SidecarCandidate): VisionCandidateModel {
+  return {
+    provider: candidate.provider,
+    id: candidate.id,
+    ...(candidate.inputModalities ? { inputModalities: candidate.inputModalities } : {}),
+    ...(candidate.native ? { native: true } : {}),
+  };
+}

package/src/stall-timeout.ts

@@ -0,0 +1,20 @@
+/**
+ * Bridge upstream stall budget: seconds of silence (no adapter events) before the
+ * Responses bridge emits `response.incomplete` / `upstream_stall_timeout`.
+ *
+ * Raised from 90s so long reasoning + large tool writes are not cut mid-turn.
+ * Hung streams still die; they just get a more realistic window.
+ */
+export const DEFAULT_STALL_TIMEOUT_SEC = 300;
+
+/**
+ * Resolve the effective bridge stall deadline for a turn.
+ * - unset / non-finite config → {@link DEFAULT_STALL_TIMEOUT_SEC}
+ * - finite config → ceil, minimum 1
+ */
+export function resolveStallTimeoutSec(configuredSec: number | undefined): number {
+  if (typeof configuredSec === "number" && Number.isFinite(configuredSec)) {
+    return Math.max(1, Math.ceil(configuredSec));
+  }
+  return DEFAULT_STALL_TIMEOUT_SEC;
+}

package/src/storage/cleanup-job.ts

@@ -0,0 +1,57 @@
+/**
+ * Single-flight wrapper for manual archived cleanup (management API).
+ *
+ * Shares the CODEX_HOME storage-mutation coordinator with trash restore and
+ * (Phase 3) policy-driven cleanup.
+ */
+import { resolveCodexHomeDir } from "../codex/home";
+import {
+  executeArchivedCleanup,
+  type CleanupResult,
+  type ExecuteCleanupOptions,
+} from "./cleanup";
+import {
+  resetStorageMutationCoordinatorForTests,
+  setStorageMutationCoordinatorTestHooks,
+  withStorageMutationSlot,
+  type StorageMutationCoordinatorTestHooks,
+} from "./storage-mutation-coordinator";
+
+export type CleanupJobTestHooks = StorageMutationCoordinatorTestHooks;
+
+export function setArchivedCleanupJobTestHooks(hooks: CleanupJobTestHooks | null): void {
+  setStorageMutationCoordinatorTestHooks(hooks);
+}
+
+export function resetArchivedCleanupJobForTests(): void {
+  resetStorageMutationCoordinatorForTests();
+}
+
+/**
+ * Run archived cleanup under the shared storage-mutation gate.
+ * Returns immediately with `storage_mutation_busy` when restore or another
+ * cleanup is in flight for the same CODEX_HOME.
+ */
+export async function runArchivedCleanupJob(
+  options: ExecuteCleanupOptions,
+): Promise<CleanupResult> {
+  const codexHome = options.codexHome ?? resolveCodexHomeDir();
+  const mode = options.mode;
+  const percent = options.percent;
+  const result = await withStorageMutationSlot("cleanup", codexHome, () =>
+    executeArchivedCleanup(options),
+  );
+  if (result && typeof result === "object" && "ok" in result && result.ok === false
+    && "error" in result && result.error === "storage_mutation_busy") {
+    return {
+      ok: false,
+      mode,
+      percent,
+      count: 0,
+      bytes: 0,
+      removedPaths: [],
+      error: "storage_mutation_busy",
+    };
+  }
+  return result as CleanupResult;
+}