@yansigit/opencodex 2.31.3 → 2.32.0

package/src/server/management/logs-usage-routes.ts

@@ -55,7 +55,7 @@ import {
   type PersistedUsageEntry,
 } from "../../usage/log";
 import { getUsageDebugLogEntries } from "../../usage/debug";
-import { parseRange, parseUsageSurface, rangeWindow, summarizeUsage, type UsageRange, type UsageSummary, type UsageSurface } from "../../usage/summary";
+import { USAGE_RANGES, USAGE_SURFACES, parseRange, parseUsageSurface, projectUsageSummary, rangeWindow, summarizeUsage, type UsageRange, type UsageSummary, type UsageSurface } from "../../usage/summary";
 import { stripCodexRuntimeProviderFields } from "../../codex/auth-context";
 import { getProviderRegistryEntry } from "../../providers/registry";
 import { getDebugLogEntries } from "../../lib/debug-log-buffer";
@@ -197,6 +197,17 @@ export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Res
   if (url.pathname === "/api/usage" && req.method === "GET") {
     const range = parseRange(url.searchParams.get("range"));
     const surface = parseUsageSurface(url.searchParams.get("surface"));
+    // Applied to the OUTGOING payload only. A filtered summary must never reach
+    // the cache or the warm loop below: the key is `range:surface`, so a
+    // filtered entry stored under it would be served to the next unfiltered
+    // caller, dashboard included.
+    const filter = {
+      provider: url.searchParams.get("provider"),
+      model: url.searchParams.get("model"),
+    };
+    const project = <T extends UsageSummary>(summary: T, entries?: PersistedUsageEntry[]) =>
+      projectUsageSummary(summary, filter, entries);
+    const filterRequested = Boolean(filter.provider ?? filter.model);
     const now = Date.now();
     try {
       const cacheKey = `${range}:${surface}`;
@@ -206,6 +217,12 @@ export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Res
       const observedSize = observed?.size ?? 0;
       const cached = getUsageSummaryCacheEntry(cacheKey);
       if (cached
+        // A filtered response is re-summarised from entries, which a cached
+        // summary does not carry. Serving it from cache would mean projecting
+        // over collapsed breakdown rows again — the exact defect the
+        // re-summarisation replaced. The unfiltered cache stays warm either
+        // way; only the filtered caller pays for the read.
+        && !filterRequested
         && cached.identityKey === identityKey
         && cached.maxReadBytes === effectiveReadLimit
         && cached.overlayVersion === userCostOverlayVersion()
@@ -214,7 +231,7 @@ export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Res
         && observedSize >= cached.lastSeenSize) {
         return jsonResponse(refreshedUsageSummary(cached.summary, range, now));
       }
-      if (cached) discardUsageSummaryCacheEntry(cacheKey);
+      if (cached && !filterRequested) discardUsageSummaryCacheEntry(cacheKey);
       // Capture the overlay version BEFORE reading/computing: the cache entry
       // must be stamped with the version the summary was priced under. Reading
       // it again at stamp time could cache an old-price summary as current,
@@ -238,14 +255,18 @@ export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Res
         // summary may mix old and new prices. Serve it uncached: the next
         // request recomputes against the settled overlay instead of caching a
         // mixed-price entry under either version.
-        return jsonResponse(summary);
+        return jsonResponse(project(summary, snapshot.entries));
       }
       const freshUntil = now + 60_000;
       const snapshotIdentity = `${usageLogIdentityKey(snapshot.revision)}\0${effectiveReadLimit}`;
       const revisionKey = `${usageLogRevisionKey(snapshot.revision)}\0${effectiveReadLimit}`;
       const lastSeenSize = snapshot.revision?.size ?? 0;
-      const ranges: UsageRange[] = ["7d", "30d", "all"];
-      const surfaces: UsageSurface[] = ["all", "codex", "claude", "grok"];
+      // Derived from the canonical constants rather than re-listed: a subset
+      // literal type-checks perfectly happily, so a range added to the union
+      // and forgotten here would never be warmed and never invalidated
+      // alongside its siblings.
+      const ranges: readonly UsageRange[] = USAGE_RANGES;
+      const surfaces: readonly UsageSurface[] = USAGE_SURFACES;
       for (const nextRange of ranges) {
         for (const nextSurface of surfaces) {
           const nextSummary = nextRange === range && nextSurface === surface ? summary : {
@@ -279,7 +300,7 @@ export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Res
         effectiveReadLimit,
         now,
       );
-      return jsonResponse(summary);
+      return jsonResponse(project(summary, snapshot.entries));
     } catch {
       return jsonResponse({
         range,

package/src/server/management/model-routes.ts

@@ -394,8 +394,10 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
   }
 
   if (url.pathname === "/api/custom-models" && req.method === "POST") {
-    let body: { provider?: unknown; modelId?: unknown; displayName?: unknown; contextWindow?: unknown; inputModalities?: unknown; reasoningEfforts?: unknown; defaultReasoningEffort?: unknown };
-    try { body = await readManagementJsonBody(req); } catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid JSON body" }, 400); }
+    let parsedBody: unknown;
+    try { parsedBody = await readManagementJsonBody(req); } catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid JSON body" }, 400); }
+    if (!isPlainRecord(parsedBody)) return jsonResponse({ error: "invalid JSON body" }, 400);
+    const body = parsedBody;
     const provider = typeof body.provider === "string" ? body.provider.trim() : "";
     const modelId = typeof body.modelId === "string" ? body.modelId.trim() : "";
     if (!provider || !modelId) return jsonResponse({ error: "provider and modelId are required" }, 400);
@@ -441,8 +443,10 @@ export async function handleModelRoutes(ctx: ManagementContext): Promise<Respons
   if (customPutMatch && req.method === "PUT") {
     let id: string;
     try { id = decodeURIComponent(customPutMatch[1]); } catch { return jsonResponse({ error: "invalid id encoding" }, 400); }
-    let body: { displayName?: unknown; contextWindow?: unknown; inputModalities?: unknown; modelId?: unknown; reasoningEfforts?: unknown; defaultReasoningEffort?: unknown };
-    try { body = await readManagementJsonBody(req); } catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid JSON body" }, 400); }
+    let parsedBody: unknown;
+    try { parsedBody = await readManagementJsonBody(req); } catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid JSON body" }, 400); }
+    if (!isPlainRecord(parsedBody)) return jsonResponse({ error: "invalid JSON body" }, 400);
+    const body = parsedBody;
     const list = config.customModels ?? [];
     const idx = list.findIndex(cm => cm.id === id);
     if (idx === -1) return jsonResponse({ error: "not found" }, 404);

package/src/server/management/native-integration-routes.ts

@@ -17,7 +17,8 @@
  * Design of record: devlog/_fin/260803_integrations_toggle_all/030 (routes),
  * 011 (Claude Code), 012 (Grok).
  */
-import { loadConfig, readRuntimePort, saveConfigPreservingClaudeCode } from "../../config";
+import { loadConfig, saveConfigPreservingClaudeCode } from "../../config";
+import { readRuntimePort } from "../../config/process-state";
 import { desktopVisibleNativeSlugs, filterCatalogVisibleModels, nativeContextLimits, nativeOpenAiContextWindow, visibleNativeSlugs } from "../../codex/catalog";
 import { providerContextCap } from "../../providers/context-cap";
 import { OPENAI_CODEX_PROVIDER_ID } from "../../providers/openai-tiers";

package/src/server/management/provider-capability-config.ts

@@ -1,4 +1,4 @@
-import { booleanRecordConfigError } from "../../config";
+import { booleanRecordConfigError } from "../../config/provider-validation";
 import type { OcxConfig } from "../../types";
 
 /**

package/src/server/management/system-restart.ts

@@ -33,7 +33,7 @@ import {
   stopServerListener,
 } from "../lifecycle";
 import { isServiceViable } from "../../service";
-import { readRuntimePort } from "../../config";
+import { readRuntimePort } from "../../config/process-state";
 import { withProcessRuntimeProvenance } from "../../lib/bun-runtime";
 import { selfLaunchArgv } from "../../lib/self-launch-argv";
 import {

package/src/server/port-reclaim.ts

@@ -9,7 +9,7 @@
  * (non-ocx, non-allowlisted) processes are never killed.
  */
 import { execFileSync } from "node:child_process";
-import { verifyPidIdentity } from "../config";
+import { verifyPidIdentity } from "../config/process-state";
 import { isProcessAlive, killProxy } from "../lib/process-control";
 import { isPortAvailable, type WaitForPortOptions } from "./ports";
 import { dropWindowsTcpRowsForLocalPort } from "./windows-tcp-drop";

package/src/server/proxy-liveness.ts

@@ -9,7 +9,8 @@
  *
  * Lives outside cli.ts (which dispatches argv at module top level) so tests can import it.
  */
-import { loadConfig, readAlivePid, readRuntimePort, verifyPidIdentity } from "../config";
+import { loadConfig } from "../config";
+import { readAlivePid, readRuntimePort, verifyPidIdentity } from "../config/process-state";
 import { directLocalHttpFetch } from "./direct-local-http";
 
 export interface HealthzIdentity {

package/src/server/request-log-conversation.ts

@@ -61,6 +61,36 @@ export function sessionIdHeaderFromRequest(headers: Headers): string | null {
   return headers.get("session_id") ?? headers.get("session-id");
 }
 
+function firstSanitizedConversationId(
+  ...values: Array<string | null | undefined>
+): string | undefined {
+  for (const value of values) {
+    const sanitized = sanitizeConversationIdInput(value);
+    if (sanitized) return sanitized;
+  }
+  return undefined;
+}
+
+/**
+ * Conversation namespace for reasoning replay. Unlike the persisted log id, this stays the raw
+ * sanitized identity so mixed headers that carry the same conversation still hit one serving
+ * record. Do not hash, and do not prefer session_id over a true per-conversation thread/Cursor
+ * identity: session_id can be synthesized from a shared prompt_cache_key.
+ */
+export function reasoningReplayConversationIdFromResponsesRequest(input: {
+  clientThreadId?: string;
+  threadIdHeader?: string | null;
+  cursorConversationId?: string;
+  sessionIdHeader?: string | null;
+}): string | undefined {
+  return firstSanitizedConversationId(
+    input.clientThreadId,
+    input.threadIdHeader,
+    input.cursorConversationId,
+    input.sessionIdHeader,
+  );
+}
+
 export function conversationIdFromResponsesRequest(input: {
   clientThreadId?: string;
   sessionIdHeader?: string | null;

package/src/server/responses/codex-auth-error.ts

@@ -0,0 +1,55 @@
+import { formatErrorResponse } from "../../bridge";
+import {
+  CodexAccountCooldownError,
+  codexMainProfileDrainingResponse,
+  cooldownErrorResponse,
+  CodexAuthContextError,
+  CodexDirectAuthenticationError,
+  CodexMainProfileDrainingError,
+  CodexMainSubstitutionUnavailableError,
+  CodexPoolAuthenticationError,
+  CodexThreadAffinityExpiredError,
+} from "../../codex/auth-context";
+
+export interface CodexAuthContextErrorResponseOptions {
+  accountSelector?: string;
+  now: number;
+}
+
+/** Shared HTTP contract for Codex auth-context failures on Responses surfaces. */
+export function mapCodexAuthContextErrorToResponse(
+  error: unknown,
+  options: CodexAuthContextErrorResponseOptions,
+): Response | undefined {
+  if (error instanceof CodexAccountCooldownError) {
+    return cooldownErrorResponse(error, options.now, options.accountSelector);
+  }
+  if (error instanceof CodexMainProfileDrainingError) {
+    return codexMainProfileDrainingResponse();
+  }
+  if (error instanceof CodexThreadAffinityExpiredError) {
+    return formatErrorResponse(
+      409,
+      "invalid_request_error",
+      "Codex thread account affinity expired; start a new session",
+    );
+  }
+  if (error instanceof CodexAuthContextError) {
+    return formatErrorResponse(
+      401,
+      "authentication_error",
+      "Selected Codex account needs reauthentication",
+    );
+  }
+  if (error instanceof CodexPoolAuthenticationError || error instanceof CodexDirectAuthenticationError) {
+    return formatErrorResponse(401, "authentication_error", error.message);
+  }
+  if (error instanceof CodexMainSubstitutionUnavailableError) {
+    return formatErrorResponse(
+      401,
+      "authentication_error",
+      "No usable Codex main credential to serve this request",
+    );
+  }
+  return undefined;
+}

package/src/server/responses/combo-stream-preflight.ts

@@ -0,0 +1,171 @@
+import type { ResponsesTerminalStatus } from "../../bridge";
+import type { RequestLogContext } from "../request-log";
+import { createSseInspector } from "../relay";
+import { MAX_CLIENT_SSE_FRAME_BYTES } from "../sse-frame-buffer";
+
+const COMBO_STREAM_PREFLIGHT_MAX_BYTES = MAX_CLIENT_SSE_FRAME_BYTES;
+
+const PRE_OUTPUT_CONTROL_EVENTS = new Set([
+  "response.created",
+  "response.in_progress",
+  "response.queued",
+  "response.heartbeat",
+]);
+
+const TERMINAL_EVENTS = new Set([
+  "response.completed",
+  "response.failed",
+  "response.incomplete",
+]);
+
+/**
+ * Decide when replaying the request on another combo target would risk duplicating
+ * client-visible output or a tool-side effect. Unknown event types commit the child
+ * conservatively; only the small Responses lifecycle preamble remains replayable.
+ */
+export function comboStreamPayloadCommitsOutput(payload: unknown): boolean {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return true;
+  const type = (payload as { type?: unknown }).type;
+  if (typeof type !== "string") return true;
+  return !PRE_OUTPUT_CONTROL_EVENTS.has(type) && !TERMINAL_EVENTS.has(type);
+}
+
+function replayBufferedResponse(
+  response: Response,
+  reader: ReadableStreamDefaultReader<Uint8Array>,
+  buffered: Uint8Array[],
+): Response {
+  let index = 0;
+  const body = new ReadableStream<Uint8Array>({
+    async pull(controller) {
+      if (index < buffered.length) {
+        controller.enqueue(buffered[index++]!);
+        return;
+      }
+      try {
+        const next = await reader.read();
+        if (next.done) controller.close();
+        else controller.enqueue(next.value);
+      } catch (error) {
+        try { controller.error(error); } catch { /* consumer already closed */ }
+      }
+    },
+    cancel(reason) {
+      reader.cancel(reason).catch(() => undefined);
+    },
+  });
+  return new Response(body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: response.headers,
+  });
+}
+
+function failedTerminalResponse(
+  response: Response,
+  terminalPayload: Record<string, unknown>,
+  logCtx: RequestLogContext,
+): Response {
+  const nested = terminalPayload.response;
+  const terminalResponse = nested && typeof nested === "object" && !Array.isArray(nested)
+    ? nested as Record<string, unknown>
+    : {};
+  const nestedError = terminalResponse.error;
+  const error = nestedError && typeof nestedError === "object" && !Array.isArray(nestedError)
+    ? nestedError as Record<string, unknown>
+    : {
+      type: "upstream_error",
+      code: "upstream_server_error",
+      message: logCtx.upstreamError ?? "Provider stream failed before producing output",
+    };
+  const headers = new Headers(response.headers);
+  headers.set("content-type", "application/json");
+  headers.delete("content-length");
+  headers.delete("content-encoding");
+  const usage = terminalResponse.usage;
+  return new Response(JSON.stringify({
+    error,
+    // The combo classifier needs only the error and optional usage. Do not carry
+    // response ids, provider metadata, or future terminal fields into the client
+    // error envelope merely because they shared the terminal snapshot.
+    response: {
+      error,
+      ...(usage && typeof usage === "object" && !Array.isArray(usage) ? { usage } : {}),
+    },
+  }), {
+    status: logCtx.terminalHttpStatus ?? 502,
+    headers,
+  });
+}
+
+export type ComboStreamPreflightResult =
+  | { kind: "accepted"; response: Response }
+  | { kind: "failed"; response: Response };
+
+/**
+ * Buffer a combo child's downstream SSE only until the request becomes unsafe to
+ * replay or reaches a terminal. This owns exactly one body reader. The aggregate
+ * buffer is capped; hitting the cap commits the current target instead of growing
+ * memory or guessing that replay is safe.
+ */
+export async function preflightComboStreamResponse(
+  response: Response,
+  logCtx: RequestLogContext,
+): Promise<ComboStreamPreflightResult> {
+  const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
+  if (!response.ok || !response.body || !contentType.includes("text/event-stream")) {
+    return { kind: "accepted", response };
+  }
+
+  const reader = response.body.getReader();
+  const buffered: Uint8Array[] = [];
+  let bufferedBytes = 0;
+  let outputCommitted = false;
+  let terminalStatus: ResponsesTerminalStatus | undefined;
+  let failedPayload: Record<string, unknown> | undefined;
+  const inspector = createSseInspector({
+    logCtx,
+    onParsedPayload: payload => {
+      if (comboStreamPayloadCommitsOutput(payload)) outputCommitted = true;
+      if (!payload || typeof payload !== "object" || Array.isArray(payload)) return;
+      if ((payload as { type?: unknown }).type === "response.failed") {
+        failedPayload = payload as Record<string, unknown>;
+      }
+    },
+    onTerminal: status => { terminalStatus = status; },
+  });
+
+  try {
+    for (;;) {
+      const next = await reader.read();
+      if (next.done) {
+        inspector.finish();
+      } else {
+        if (bufferedBytes + next.value.byteLength > COMBO_STREAM_PREFLIGHT_MAX_BYTES) {
+          // Keep the cap about memory the preflight allocates. The upstream chunk already exists;
+          // copying it before committing would transiently exceed the boundary for no
+          // replay benefit. Preserve it unsliced behind the already-bounded prefix.
+          return {
+            kind: "accepted",
+            response: replayBufferedResponse(response, reader, [...buffered, next.value]),
+          };
+        }
+        const retained = next.value.slice();
+        buffered.push(retained);
+        bufferedBytes += retained.byteLength;
+        inspector.feed(retained);
+      }
+
+      if (terminalStatus === "failed" && !outputCommitted && failedPayload) {
+        await reader.cancel("retrying zero-output combo stream failure").catch(() => undefined);
+        return { kind: "failed", response: failedTerminalResponse(response, failedPayload, logCtx) };
+      }
+      if (next.done || terminalStatus !== undefined || outputCommitted
+        || bufferedBytes >= COMBO_STREAM_PREFLIGHT_MAX_BYTES) {
+        return { kind: "accepted", response: replayBufferedResponse(response, reader, buffered) };
+      }
+    }
+  } finally {
+    inspector.dispose();
+  }
+}

package/src/server/responses/compact.ts

@@ -42,17 +42,9 @@ import { describeImagesInPlace, planVisionSidecar, shouldResolveOpenAiVisionSide
 import { createAdapterEventQueue, preflightAdapterEvents } from "../../adapters/run-turn-queue";
 import {
   applyCodexAuthContextToProvider,
-  CodexAccountCooldownError,
-  codexMainProfileDrainingResponse,
-  cooldownErrorResponse,
-  CodexAuthContextError,
-  CodexDirectAuthenticationError,
   CodexMainProfileDrainingError,
-  CodexPoolAuthenticationError,
-  CodexThreadAffinityExpiredError,
   headersForCodexAuthContext,
   materializeCodexUpstreamAuth,
-  CodexMainSubstitutionUnavailableError,
   isCodexAuthContextUsable,
   resolveCodexAuthContext,
   codexProbeLeaseId,
@@ -134,6 +126,7 @@ import {
   usesCodexForwardPoolAuth,
 } from "./core";
 import { fetchWithHeaderTimeout, providerFetch, safeHostLabel, safeOriginLabel } from "./fetch-helpers";
+import { mapCodexAuthContextErrorToResponse } from "./codex-auth-error";
 
 export const COMPACT_RESPONSE_MAX_BYTES = 32 * 1024 * 1024;
 
@@ -395,19 +388,11 @@ export async function handleResponsesCompact(
         }
       }
     } catch (err) {
-      if (err instanceof CodexAccountCooldownError) {
-        return cooldownErrorResponse(err, Date.now(), route.codexAccountNamespace);
-      }
-      if (err instanceof CodexMainProfileDrainingError) return codexMainProfileDrainingResponse();
-      if (err instanceof CodexThreadAffinityExpiredError) {
-        return formatErrorResponse(409, "invalid_request_error", "Codex thread account affinity expired; start a new session");
-      }
-      if (err instanceof CodexAuthContextError) {
-        return formatErrorResponse(401, "authentication_error", "Selected Codex account needs reauthentication");
-      }
-      if (err instanceof CodexPoolAuthenticationError || err instanceof CodexDirectAuthenticationError) {
-        return formatErrorResponse(401, "authentication_error", err.message);
-      }
+      const response = mapCodexAuthContextErrorToResponse(err, {
+        accountSelector: route.codexAccountNamespace,
+        now: Date.now(),
+      });
+      if (response) return response;
       throw err;
     }
     const base = isCanonicalOpenAiForwardProvider(compactProvider)