@yansigit/opencodex 2.33.0 → 2.35.0

package/src/generated/model-metadata.ts

@@ -27,6 +27,9 @@ const PROVIDER_ALIASES: Record<string, string> = {
   "google-antigravity": "google",
   "antigravity": "google",
   "gemini-antigravity": "google",
+  "google-aistudio": "google",
+  "aistudio": "google",
+  "gemini-aistudio": "google",
   "deepseek": "deepseek",
   "moonshot": "moonshot",
   "zhipu-bigmodel": "zai",

package/src/images/loop.ts

@@ -274,10 +274,11 @@ export interface ImageBridgeDeps {
   /** Raw adapter usage at the terminal event, pre wire-normalization (see bridgeToResponsesSSE onUsage). */
   onUsage?: (usage: OcxUsage | undefined) => void;
   /**
-   * Optional 429 key-failover for the routed (non-xAI) model. Return a rebuilt adapter for the
-   * rotated key, or null when the pool is exhausted.
+   * Optional 429 failover for the routed (non-xAI) model. Return a rebuilt adapter for the
+   * rotated credential, or null when the pool is exhausted. Async hooks support OAuth refresh;
+   * existing synchronous key-pool hooks remain valid.
    */
-  on429?: (retryAfterHeader: string | null) => ProviderAdapter | null;
+  on429?: (retryAfterHeader: string | null) => ProviderAdapter | null | Promise<ProviderAdapter | null>;
   /** Opt-in same-target 429 policy (key-auth providers). When present, 429 replays on the SAME key before on429 rotation. */
   retryOn429Policy?: Required<RateLimitRetryPolicy> | null;
   /** Called when the bridged Responses stream completes (parity with runTurn / routed paths). */
@@ -592,7 +593,7 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
       }
       // 429 key-failover parity with web-search / normal routed path.
       while (prepared.response.status === 429 && deps.on429) {
-        const rotated = deps.on429(prepared.response.headers.get("retry-after"));
+        const rotated = await deps.on429(prepared.response.headers.get("retry-after"));
         if (!rotated) break;
         try { void prepared.response.body?.cancel().catch(() => {}); } catch { /* already closed */ }
         adapter = rotated;

package/src/lab/conformance/fixtures/protocol-v1-cases.json

@@ -274,7 +274,7 @@
       "assertions": [
         { "id": "text", "operator": "normalized_text_equals", "selector": "/client/response/normalizedText", "expected": "OK", "required": true },
         { "id": "terminal", "operator": "terminal_signal_equals", "selector": "/client/response/terminal", "expected": "completed", "required": true },
-        { "id": "phase", "operator": "json_path_equals", "selector": "/client/response/events/6/data/item/phase", "expected": "final_answer", "required": true }
+        { "id": "phase", "operator": "json_path_equals", "selector": "/client/response/events/7/data/item/phase", "expected": "final_answer", "required": true }
       ]
     },
     {

package/src/lab/fabric/producer-child.ts

@@ -128,7 +128,7 @@ async function main(): Promise<void> {
   writeLine({ type: "result", patch });
 }
 
-main().catch((error: unknown) => {
+await main().catch((error: unknown) => {
   writeLine({
     type: "error",
     code: "harness_failure",

package/src/lib/config-ownership.ts

@@ -40,6 +40,7 @@ const INITIAL_OWNED_PATHS = [
   "artifacts",
   "auth.json",
   "auth.store.lock",
+  "admin-api-token",
   "catalog-backup.json",
   "claude-env.sh",
   "codex-accounts.json",
@@ -333,6 +334,25 @@ export function removeOwnedConfigState(configDir: string): ConfigRemovalResult {
     }
   }
 
+  // Per-catalog backups are named `catalog-backup-<16 hex>.json` (catalogBackupPathFor), one per
+  // CODEX_HOME, so they cannot be enumerated as literal manifest entries the way every other
+  // owned file can. Without this, `ocx uninstall` always reported "unowned files remain" and
+  // refused to remove a home OpenCodex created itself — the file is unambiguously ours, produced
+  // by our own writer, and the strict hex shape keeps the match from widening.
+  for (const name of readdirSync(configDir)) {
+    if (!/^catalog-backup-[0-9a-f]{16}\.json$/.test(name)) continue;
+    const path = join(configDir, name);
+    try {
+      removeOwnedEntry(rootPath, path);
+    } catch (error) {
+      return {
+        status: "partial",
+        reason: `could not remove owned path ${name}: ${error instanceof Error ? error.message : String(error)}`,
+        residualPaths: [path],
+      };
+    }
+  }
+
   try {
     unlinkSync(join(configDir, CONFIG_UNINSTALL_MANIFEST));
     unlinkSync(join(configDir, CONFIG_OWNER_FILE));

package/src/lib/errors.ts

@@ -16,11 +16,18 @@ export class OcxRequestValidationError extends Error {
 
 /** OpenAI / Codex hard block for high-risk cybersecurity activity (HTTP 400 or mid-stream). */
 export const CYBER_POLICY_ERROR_CODE = "cyber_policy";
+export const CYBER_POLICY_FALLBACK_MESSAGE = "Request blocked by the upstream cybersecurity policy.";
 
 export function isCyberPolicyCode(code: string | null | undefined): boolean {
   return code === CYBER_POLICY_ERROR_CODE;
 }
 
+/** Preserve a structured upstream error type; otherwise use the dedicated policy identity. */
+export function cyberPolicyErrorType(type: string | null | undefined): string {
+  const trimmed = typeof type === "string" ? type.trim() : "";
+  return trimmed || CYBER_POLICY_ERROR_CODE;
+}
+
 /**
  * Detect OpenAI cyber-policy refusals from message text when structured `code` was stripped.
  * Matches Codex fallback copy and Cursor/API agent wording (session evidence 2026-07-24).
@@ -149,9 +156,11 @@ export function classifyError(status: number, type: string, message: string): Oc
     return { message, type: "invalid_request_error", code: "client_closed_request" };
   }
   // Codex only shows the dedicated cyber UI when error.code === "cyber_policy".
-  // Prefer that code (and invalid_request_error) over generic remaps / 502 upstream_server_error.
+  // The public wire does not establish invalid_request_error as the canonical type, so
+  // message-only classification keeps the dedicated identity instead of inventing one.
+  // Structured callers re-apply their real upstream type with cyberPolicyErrorType().
   if (type === CYBER_POLICY_ERROR_CODE || isCyberPolicyMessage(text)) {
-    return { message, type: "invalid_request_error", code: CYBER_POLICY_ERROR_CODE };
+    return { message, type: CYBER_POLICY_ERROR_CODE, code: CYBER_POLICY_ERROR_CODE };
   }
   // A LOCAL preflight refusal keeps its own code (#1524). The message necessarily says
   // "context window" -- that is what it is refusing on -- so the generic remap below would

package/src/lib/package-tree-integrity.ts

@@ -0,0 +1,101 @@
+import { statSync } from "node:fs";
+
+export interface PackageTreeObservation {
+  readonly device: bigint;
+  readonly inode: bigint;
+  readonly contentTimeNs: bigint;
+  readonly size: bigint;
+}
+
+export type PackageTreeIntegrityStatus =
+  | { readonly ok: true }
+  | { readonly ok: false; readonly reason: "package_tree_replaced" | "package_tree_unreadable" };
+
+export interface PackageTreeIntegrityGuard {
+  status(): PackageTreeIntegrityStatus;
+}
+
+type ObservePackageTree = () => PackageTreeObservation | null;
+type PackageTreeRuntimeInstall = "bun" | "npm" | "source";
+
+const packageManifestUrl = new URL("../../package.json", import.meta.url);
+
+function observePackageManifest(): PackageTreeObservation | null {
+  try {
+    const stat = statSync(packageManifestUrl, { bigint: true });
+    return {
+      device: stat.dev,
+      inode: stat.ino,
+      // mtimeNs, NOT ctimeNs. An inode-change time moves for METADATA writes that
+      // replace nothing: chmod, chown, touch, an editor normalizing permissions, a
+      // backup tool restoring modes. Each of those left device, inode and size
+      // identical, so the comparison below called the manifest "replaced" and every
+      // /v1/* request answered 503 until the process was restarted. Measured on
+      // macOS: chmod alone moved ctimeNs and left mtimeNs untouched.
+      //
+      // mtimeNs still catches every real replacement. An in-place rewrite of the
+      // same byte length moves mtimeNs while inode and size hold; an atomic
+      // install (write-then-rename, which is what a package manager does) changes
+      // the inode as well. Both were measured before this change was made.
+      contentTimeNs: stat.mtimeNs,
+      size: stat.size,
+    };
+  } catch {
+    return null;
+  }
+}
+
+function sameObservation(left: PackageTreeObservation, right: PackageTreeObservation): boolean {
+  return left.device === right.device
+    && left.inode === right.inode
+    && left.contentTimeNs === right.contentTimeNs
+    && left.size === right.size;
+}
+
+/**
+ * How long an `ok` observation is reused before the manifest is stat'd again.
+ *
+ * `status()` runs on `/healthz`, `/readyz` and every `/v1/*` request, so an unthrottled guard
+ * adds a filesystem syscall to the proxy's hot path to detect an event that happens at most
+ * once per install. A replaced tree is not time-critical either: the process is already
+ * serving broken imports, and one more second of that is not worse than a syscall per turn
+ * forever.
+ *
+ * A NEGATIVE result is never cached — once the tree looks wrong, every later request re-checks,
+ * so a repaired install recovers on its own instead of staying refused for a window.
+ */
+const PACKAGE_TREE_RECHECK_MS = 1_000;
+
+export function createPackageTreeIntegrityGuard(
+  observe: ObservePackageTree = observePackageManifest,
+  now: () => number = Date.now,
+): PackageTreeIntegrityGuard {
+  const boot = observe();
+  let lastOkAt: number | null = null;
+  return {
+    status(): PackageTreeIntegrityStatus {
+      const at = now();
+      if (lastOkAt !== null && at - lastOkAt < PACKAGE_TREE_RECHECK_MS) return { ok: true };
+      const current = observe();
+      if (boot === null || current === null) return { ok: false, reason: "package_tree_unreadable" };
+      if (!sameObservation(boot, current)) return { ok: false, reason: "package_tree_replaced" };
+      lastOkAt = at;
+      return { ok: true };
+    },
+  };
+}
+
+/**
+ * Installed packages fail closed when their manifest is replaced under a live process.
+ * A source checkout is different: editing package.json is ordinary development work, and
+ * Bun keeps serving the module snapshot already loaded by this process until the operator
+ * chooses to restart. Fencing every request there makes running dev directly impossible.
+ */
+export function createRuntimePackageTreeIntegrityGuard(
+  installer: PackageTreeRuntimeInstall,
+  observe: ObservePackageTree = observePackageManifest,
+  now: () => number = Date.now,
+): PackageTreeIntegrityGuard {
+  if (installer === "source") return { status: () => ({ ok: true }) };
+  return createPackageTreeIntegrityGuard(observe, now);
+}

package/src/oauth/aistudio-credentials.ts

@@ -0,0 +1,65 @@
+import { createHash } from "node:crypto";
+import type { OcxProviderConfig } from "../types";
+import {
+  parseGoogleCookieJar,
+  validateAiStudioCookies,
+} from "./google-aistudio-auth";
+import {
+  cookieHeaderFromSession,
+  loadAiStudioSession,
+  type AiStudioSessionData,
+} from "./aistudio-session-sync";
+
+export type AiStudioCredentialResolution =
+  | { kind: "ready"; cookieHeader: string; source: "provider-api-key" | "provider-header" | "session"; fingerprint: string }
+  | { kind: "missing"; reason: string }
+  | { kind: "invalid"; reason: string };
+
+const CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/;
+
+function validCookieHeader(value: unknown): string | undefined {
+  if (typeof value !== "string") return undefined;
+  const cookieHeader = value.trim();
+  if (!cookieHeader || CONTROL_CHARACTERS.test(cookieHeader)) return undefined;
+  const jar = parseGoogleCookieJar(cookieHeader);
+  return validateAiStudioCookies(jar).valid ? jar.cookieHeader : undefined;
+}
+
+function ready(cookieHeader: string, source: "provider-api-key" | "provider-header" | "session"): AiStudioCredentialResolution {
+  return {
+    kind: "ready",
+    cookieHeader,
+    source,
+    fingerprint: createHash("sha256").update(cookieHeader).digest("hex"),
+  };
+}
+
+export function resolveAiStudioCredentials(
+  provider: OcxProviderConfig,
+  session?: AiStudioSessionData | null,
+): AiStudioCredentialResolution {
+  const invalidSources: string[] = [];
+  const apiKey = validCookieHeader(provider.apiKey);
+  if (apiKey) return ready(apiKey, "provider-api-key");
+  if ((typeof provider.apiKey === "string" && provider.apiKey.trim())
+    || (provider.apiKey !== undefined && provider.apiKey !== null && typeof provider.apiKey !== "string")) {
+    invalidSources.push("provider apiKey");
+  }
+
+  const cookieEntry = Object.entries(provider.headers ?? {}).find(([name]) => name.toLowerCase() === "cookie");
+  const headerCookie = validCookieHeader(cookieEntry?.[1]);
+  if (headerCookie) return ready(headerCookie, "provider-header");
+  if ((typeof cookieEntry?.[1] === "string" && cookieEntry[1].trim())
+    || (cookieEntry !== undefined && typeof cookieEntry[1] !== "string")) {
+    invalidSources.push("provider Cookie header");
+  }
+
+  const savedSession = session === undefined ? loadAiStudioSession() : session;
+  const sessionCookie = validCookieHeader(cookieHeaderFromSession(savedSession));
+  if (sessionCookie) return ready(sessionCookie, "session");
+  if (savedSession) invalidSources.push("saved session");
+
+  return invalidSources.length > 0
+    ? { kind: "invalid", reason: "AI Studio credentials are malformed or missing SAPISID." }
+    : { kind: "missing", reason: "AI Studio credentials are missing." };
+}

package/src/oauth/aistudio-native-daemon.ts

@@ -0,0 +1,116 @@
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { spawn, type ChildProcess } from "node:child_process";
+import { loadAiStudioSession, getAiStudioSessionPath } from "./aistudio-session-sync";
+import { resolveAiStudioCredentials } from "./aistudio-credentials";
+import type { OcxProviderConfig } from "../types";
+
+export function isNativeWebKitSupported(): boolean {
+  return process.platform === "darwin";
+}
+
+export function getAiStudioNativeDaemonSourcePath(): string {
+  return join(process.cwd(), "integrations/aistudio-daemon/main.swift");
+}
+
+export function getAiStudioNativeDaemonBinaryPath(): string {
+  return join(process.cwd(), ".tmp/aistudio-webkit-daemon");
+}
+
+export async function buildAiStudioNativeDaemon(outputPath?: string): Promise<string> {
+  const src = getAiStudioNativeDaemonSourcePath();
+  const dest = outputPath ?? getAiStudioNativeDaemonBinaryPath();
+
+  const proc = Bun.spawn(["swiftc", "-O", src, "-o", dest], {
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  const exitCode = await proc.exited;
+  if (exitCode !== 0) {
+    const errText = await new Response(proc.stderr).text();
+    throw new Error(`Failed to compile native WebKit daemon: ${errText}`);
+  }
+  return dest;
+}
+
+type NativeLoginChild = { exited: Promise<number>; kill: () => void };
+type NativeLoginSpawn = (command: string[], options: { stdout: "pipe"; stderr: "pipe" }) => NativeLoginChild;
+
+export type AiStudioNativeLoginResult =
+  | { kind: "authenticated"; sessionPath: string }
+  | { kind: "cancelled" }
+  | { kind: "unsupported" }
+  | { kind: "failed"; error: string };
+
+export interface AiStudioNativeLoginOptions {
+  platform?: NodeJS.Platform;
+  sessionPath?: string;
+  signal?: AbortSignal;
+  /** Test-only process seam. Production always uses Bun.spawn. */
+  spawn?: NativeLoginSpawn;
+}
+
+/** Spawn one visible native login and report only after its session is durable and valid. */
+export async function runAiStudioNativeLogin(options: AiStudioNativeLoginOptions = {}): Promise<AiStudioNativeLoginResult> {
+  if ((options.platform ?? process.platform) !== "darwin") return { kind: "unsupported" };
+  const sessionPath = options.sessionPath ?? getAiStudioSessionPath();
+  const spawnLogin = options.spawn ?? ((command, spawnOptions) => Bun.spawn(command, spawnOptions) as unknown as NativeLoginChild);
+  let child: NativeLoginChild;
+  try {
+    child = spawnLogin(["swift", getAiStudioNativeDaemonSourcePath(), "--login"], { stdout: "pipe", stderr: "pipe" });
+  } catch (error) {
+    return { kind: "failed", error: `Could not start native AI Studio login: ${error instanceof Error ? error.message : String(error)}` };
+  }
+  let aborted = options.signal?.aborted === true;
+  const terminate = () => {
+    aborted = true;
+    try { child.kill(); } catch { /* already exited */ }
+  };
+  options.signal?.addEventListener("abort", terminate, { once: true });
+  try {
+    const exitCode = await child.exited;
+    if (aborted || options.signal?.aborted) return { kind: "cancelled" };
+    if (exitCode === 2) return { kind: "cancelled" };
+    if (exitCode !== 0) return { kind: "failed", error: `Native AI Studio login failed (exit code ${exitCode})` };
+    const session = loadAiStudioSession(sessionPath);
+    const credentials = resolveAiStudioCredentials({} as OcxProviderConfig, session);
+    return credentials.kind === "ready"
+      ? { kind: "authenticated", sessionPath }
+      : { kind: "failed", error: "Native login completed without a valid AI Studio session" };
+  } catch (error) {
+    return { kind: "failed", error: error instanceof Error ? error.message : String(error) };
+  } finally {
+    options.signal?.removeEventListener("abort", terminate);
+  }
+}
+
+export interface NativeDaemonHandle {
+  process: ChildProcess;
+  stop: () => void;
+}
+
+export function startAiStudioNativeDaemon(port = 10100): NativeDaemonHandle {
+  const binPath = getAiStudioNativeDaemonBinaryPath();
+  const srcPath = getAiStudioNativeDaemonSourcePath();
+
+  const runner = existsSync(binPath)
+    ? [binPath, "--port", String(port)]
+    : ["swift", srcPath, "--port", String(port)];
+
+  const child = spawn(runner[0]!, runner.slice(1), {
+    detached: true,
+    stdio: "ignore",
+  });
+  child.unref();
+
+  return {
+    process: child,
+    stop: () => {
+      try {
+        child.kill();
+      } catch (err) {
+        void err;
+      }
+    },
+  };
+}

package/src/oauth/aistudio-session-sync.ts

@@ -0,0 +1,95 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { getConfigDir } from "../config";
+
+export interface AiStudioCookieItem {
+  name: string;
+  value: string;
+  domain?: string;
+  path?: string;
+}
+
+export interface AiStudioSessionData {
+  selectedProject: string;
+  windowId: string;
+  cookies: AiStudioCookieItem[];
+}
+
+export function serializeSessionBundle(data: AiStudioSessionData): string {
+  const jsonStr = JSON.stringify(data);
+  return Buffer.from(jsonStr, "utf-8").toString("base64");
+}
+
+export function parseSessionBundle(encoded: string): AiStudioSessionData {
+  if (!encoded || typeof encoded !== "string") {
+    throw new Error("Invalid session token");
+  }
+
+  const raw = Buffer.from(encoded.trim(), "base64").toString("utf-8");
+  let data: any;
+  try {
+    data = JSON.parse(raw);
+  } catch (err) {
+    void err;
+    throw new Error("Failed to parse session token: invalid JSON");
+  }
+
+  if (!data || typeof data !== "object" || !Array.isArray(data.cookies)) {
+    throw new Error("Invalid session bundle schema: cookies array required");
+  }
+
+  return {
+    selectedProject: String(data.selectedProject || ""),
+    windowId: String(data.windowId || ""),
+    cookies: data.cookies.map((c: any) => ({
+      name: String(c.name || ""),
+      value: String(c.value || ""),
+      domain: c.domain ? String(c.domain) : undefined,
+      path: c.path ? String(c.path) : undefined,
+    })),
+  };
+}
+
+export function getAiStudioSessionPath(): string {
+  return join(getConfigDir(), "aistudio-session.json");
+}
+
+export function saveAiStudioSession(data: AiStudioSessionData, dest = getAiStudioSessionPath()): string {
+  mkdirSync(join(dest, ".."), { recursive: true });
+  writeFileSync(dest, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 0o600 });
+  try { chmodSync(dest, 0o600); } catch { /* best-effort on platforms without POSIX modes */ }
+  return dest;
+}
+
+export function saveAiStudioSessionFromToken(tokenOrBase64: string, dest?: string): string {
+  const session = parseSessionBundle(tokenOrBase64);
+  return saveAiStudioSession(session, dest);
+}
+
+export function loadAiStudioSession(path = getAiStudioSessionPath()): AiStudioSessionData | null {
+  if (!existsSync(path)) return null;
+  try {
+    const data = JSON.parse(readFileSync(path, "utf-8"));
+    if (!data || typeof data !== "object" || !Array.isArray(data.cookies)) return null;
+    return {
+      selectedProject: String(data.selectedProject || ""),
+      windowId: String(data.windowId || ""),
+      cookies: data.cookies.map((c: any) => ({
+        name: String(c.name || ""),
+        value: String(c.value || ""),
+        domain: c.domain ? String(c.domain) : undefined,
+        path: c.path ? String(c.path) : undefined,
+      })),
+    };
+  } catch {
+    return null;
+  }
+}
+
+export function cookieHeaderFromSession(session: AiStudioSessionData | null | undefined): string {
+  if (!session?.cookies?.length) return "";
+  return session.cookies
+    .filter((c) => c && c.name && c.value && !/[\r\n\u0000]/.test(c.name) && !/[\r\n\u0000]/.test(c.value))
+    .map((c) => c.name.trim() + "=" + c.value.trim())
+    .join("; ");
+}