@yansigit/opencodex 2.36.1-dev.20260829.42 → 2.36.1-dev.20260829.48

package/src/config.ts

@@ -96,7 +96,6 @@ import {
   isValidCost4Rate,
   refreshPreservedProviderOwner,
   refreshUserCostOverlays,
-  withPreservedDiskOnlyProviders,
 } from "./usage/user-cost-overlays";
 import { MAX_COST4_RATE } from "./usage/expected-prices";
 import {
@@ -106,6 +105,8 @@ import {
 } from "./lib/app-owned-memory";
 import { isHostedToolUnsupportedForModel } from "./responses/hosted-tool-policy";
 import {
+  AtomicWriteResidualTempError,
+  AtomicWriteSecretResidualError,
   atomicWriteFile,
   isMissingPathError,
   nextAtomicTempSequence,
@@ -2732,23 +2733,34 @@ export const withExpectedConfigGenerationSync: WithExpectedConfigGenerationSync
  * cost-overlay registry from the persisted config so runtime estimates follow
  * every save path.
  */
-function persistConfigUnlocked(config: OcxConfig): boolean {
+type PersistConfigAuthority = "ordinary" | "mutation" | "replacement";
+
+function persistConfigUnlocked(config: OcxConfig, authority: PersistConfigAuthority = "ordinary"): boolean {
   const configPath = getConfigPath();
   // Check the resolved file target before reading it: a symlink can point from an
   // isolated test home into the protected real home, where another write guard
   // must not mask this refusal based on the target's current contents.
   assertNotRealHomeUnderTest(dirname(resolveWriteTarget(configPath)));
   const raw = readRawConfigJson();
-  if (raw && configNeedsProviderRepair(raw)) {
+  if (authority !== "replacement" && raw && configNeedsProviderRepair(raw)) {
     throw new Error("refusing to overwrite a config repaired with defaults; fix the persisted config first");
   }
-  // External editors can add provider rows the live config deliberately does
-  // not route with yet; merge them at the serialization boundary so an
-  // unrelated in-process save cannot erase the provider or its overlay.
-  // Provider preservation reads symbol-keyed live-owner state, which structuredClone
-  // intentionally drops. Resolve that ownership before projecting JSON provenance.
+  const snapshot = readConfigFileSnapshot();
+  if (authority !== "replacement" && snapshot.diagnostics.source === "fallback") {
+    throw new Error("refusing to overwrite an invalid persisted config; fix the persisted config first");
+  }
+  // Automatic whole-config writes own non-provider settings only. A valid disk
+  // registry is authoritative; explicit locked mutations pass replacement
+  // authority for intentional provider/default changes.
+  const base = snapshot.diagnostics.source === "file" && authority === "ordinary"
+    ? {
+      ...config,
+      providers: snapshot.diagnostics.config.providers,
+      defaultProvider: snapshot.diagnostics.config.defaultProvider,
+    }
+    : config;
   const provenanceProjection = projectConfigRebaseProvenance(config);
-  const persisted = withPreservedDiskOnlyProviders(config);
+  const persisted = base;
   if (provenanceProjection.configRebaseProvenance === undefined) delete persisted.configRebaseProvenance;
   else persisted.configRebaseProvenance = provenanceProjection.configRebaseProvenance;
   const bytes = JSON.stringify(persisted, null, 2) + "\n";
@@ -2790,6 +2802,183 @@ export function saveConfig(config: OcxConfig): void {
   });
 }
 
+/** Replace a validated config under the shared lock for confirmed import/init flows. */
+export function replacePersistedConfig(config: OcxConfig): void {
+  assertNotRealHomeUnderTest(getConfigDir());
+  withConfigMutationLockSync(() => {
+    const projected = projectCustomModelCatalogMigration(
+      readRawConfigJson(),
+      projectConfigRebaseProvenance(config),
+    );
+    if (persistConfigUnlocked(projected, "replacement")) bumpGenerationForCooperatingConfigWrite();
+    adoptCustomModelCatalogMigration(config, projected);
+    if (projected.configRebaseProvenance === undefined) delete config.configRebaseProvenance;
+    else config.configRebaseProvenance = structuredClone(projected.configRebaseProvenance);
+    clearPendingConfigTopLevelDeletions(config);
+  });
+}
+
+export type PersistedConfigInitializationOutcome = "created" | "exists" | "invalid";
+
+export class PersistedConfigInitializationCleanupError extends Error {
+  constructor(options?: ErrorOptions) {
+    super("Initial config publication cleanup failed after rollback", options);
+    this.name = "PersistedConfigInitializationCleanupError";
+  }
+}
+
+export class PersistedConfigInitializationRollbackError extends Error {
+  constructor(options?: ErrorOptions) {
+    super("Initial config publication rollback failed", options);
+    this.name = "PersistedConfigInitializationRollbackError";
+  }
+}
+
+export interface PersistedConfigInitializationIO {
+  createExclusive(path: string): void;
+  write(path: string, bytes: string): void;
+  harden(path: string): void;
+  publishNoReplace(temp: string, target: string): void;
+  truncate(path: string): void;
+  unlink(path: string): void;
+}
+
+let persistedConfigInitializationBeforePublishForTests: (() => void) | null = null;
+
+/** Test-only one-shot seam: create a competing config after staging, before no-replace publication. */
+export function setPersistedConfigInitializationBeforePublishForTests(hook: (() => void) | null): void {
+  persistedConfigInitializationBeforePublishForTests = hook;
+}
+
+function publishInitialConfigNoReplace(
+  config: OcxConfig,
+  io: PersistedConfigInitializationIO,
+): boolean {
+  const configPath = getConfigPath();
+  const target = resolveWriteTarget(configPath);
+  assertNotRealHomeUnderTest(dirname(target));
+  recordOwnedConfigPath(getConfigDir(), configPath);
+  const persisted = projectConfigRebaseProvenance(config);
+  const bytes = JSON.stringify(persisted, null, 2) + "\n";
+  const temp = `${target}.ocx.${process.pid}.${nextAtomicTempSequence()}.tmp`;
+  let staged = false;
+  let hardened = false;
+  let published = false;
+  let cleanupAttempted = false;
+
+  const scrubUnpublishedTemp = (cause?: unknown): void => {
+    cleanupAttempted = true;
+    let scrubbed = false;
+    try {
+      io.truncate(temp);
+      scrubbed = true;
+    } catch (error) {
+      if (isMissingPathError(error)) scrubbed = true;
+      else {
+        try { io.write(temp, ""); scrubbed = true; } catch { /* removal may still succeed */ }
+      }
+    }
+    let removed = false;
+    try {
+      io.unlink(temp);
+      removed = true;
+    } catch (error) {
+      if (isMissingPathError(error)) removed = true;
+      else {
+        try { io.unlink(temp); removed = true; }
+        catch (retryError) { if (isMissingPathError(retryError)) removed = true; }
+      }
+    }
+    if (removed) forgetEphemeralSecretPath(temp);
+    if (!removed && !scrubbed) throw new AtomicWriteSecretResidualError(temp, { cause });
+    if (!removed) throw new AtomicWriteResidualTempError(temp, hardened, { cause });
+  };
+
+  try {
+    io.createExclusive(temp);
+    staged = true;
+    io.write(temp, bytes);
+    io.harden(temp);
+    hardened = true;
+    const hook = persistedConfigInitializationBeforePublishForTests;
+    persistedConfigInitializationBeforePublishForTests = null;
+    hook?.();
+    try {
+      io.publishNoReplace(temp, target);
+    } catch (cause) {
+      if (!isAlreadyExistsError(cause)) throw cause;
+      scrubUnpublishedTemp(cause);
+      return false;
+    }
+    published = true;
+    try {
+      io.unlink(temp);
+      forgetEphemeralSecretPath(temp);
+    } catch (firstError) {
+      if (isMissingPathError(firstError)) {
+        forgetEphemeralSecretPath(temp);
+      } else try {
+        io.unlink(temp);
+        forgetEphemeralSecretPath(temp);
+      } catch (secondError) {
+        if (isMissingPathError(secondError)) {
+          forgetEphemeralSecretPath(temp);
+        } else {
+          // Both names point to one inode. Remove the published name before scrubbing.
+          try { io.unlink(target); }
+          catch (cause) { throw new PersistedConfigInitializationRollbackError({ cause }); }
+          published = false;
+          scrubUnpublishedTemp(secondError);
+          throw new PersistedConfigInitializationCleanupError({ cause: secondError });
+        }
+      }
+    }
+    refreshUserCostOverlays(persisted);
+    return true;
+  } catch (cause) {
+    if (staged && !published && !cleanupAttempted) scrubUnpublishedTemp(cause);
+    throw cause;
+  }
+}
+
+function defaultPersistedConfigInitializationIO(configPath: string): PersistedConfigInitializationIO {
+  return {
+    createExclusive: target => { writeFileSync(target, "", { flag: "wx", mode: 0o600 }); },
+    write: (target, bytes) => writeFileSync(target, bytes),
+    harden: target => {
+      try { chmodSync(target, 0o600); } catch { /* platform may ignore chmod */ }
+      if (process.platform === "win32") hardenSecretPath(target, { required: true, timeoutMemoKey: configPath });
+    },
+    publishNoReplace: (temp, target) => linkSync(temp, target),
+    truncate: target => truncateSync(target, 0),
+    unlink: unlinkSync,
+  };
+}
+
+/** Create the initial config under the shared lock, but never replace existing bytes. */
+export function initializePersistedConfigIfMissing(
+  config: OcxConfig,
+  io = defaultPersistedConfigInitializationIO(getConfigPath()),
+): PersistedConfigInitializationOutcome {
+  assertNotRealHomeUnderTest(getConfigDir());
+  return withConfigMutationLockSync(() => {
+    const snapshot = readConfigFileSnapshot();
+    if (snapshot.diagnostics.source === "file") return "exists";
+    if (snapshot.diagnostics.source !== "default") return "invalid";
+    const projected = projectCustomModelCatalogMigration(
+      readRawConfigJson(),
+      projectConfigRebaseProvenance(config),
+    );
+    if (!publishInitialConfigNoReplace(projected, io)) {
+      const winner = readConfigFileSnapshot();
+      return winner.diagnostics.source === "file" ? "exists" : "invalid";
+    }
+    bumpGenerationForCooperatingConfigWrite();
+    adoptCustomModelCatalogMigration(config, projected);
+    return "created";
+  });
+}
+
 export type PersistedConfigMutation<T> = {
   changed: boolean;
   value: T;
@@ -2799,6 +2988,13 @@ export type PersistedConfigMutationOutcome<T> =
   | { status: "committed" | "unchanged"; value: T }
   | { status: "unavailable"; reason: "missing" | "invalid" | "conflict" };
 
+export class ConfigMutationValidationError extends Error {
+  constructor(readonly validationError: string) {
+    super(`Config mutation rejected: ${validationError}`);
+    this.name = "ConfigMutationValidationError";
+  }
+}
+
 const CONFIG_MUTATION_MAX_REBASE_ATTEMPTS = 3;
 let persistedConfigMutationBeforeCommitForTests: (() => void) | null = null;
 
@@ -2871,7 +3067,9 @@ export function mutatePersistedConfig<T>(
         commitBase.diagnostics.config,
         confirmedConfig,
       );
-      if (persistConfigUnlocked(projected)) bumpGenerationForCooperatingConfigWrite();
+      const validation = validateConfigCandidate(projected);
+      if (!validation.ok) throw new ConfigMutationValidationError(validation.error);
+      if (persistConfigUnlocked(projected, "mutation")) bumpGenerationForCooperatingConfigWrite();
       return { status: "committed", value: confirmed.value };
     }
     return { status: "unavailable", reason: "conflict" };
@@ -3193,7 +3391,7 @@ function readPersistedServerBinding(
  *   conflict keeps the live value;
  * - a provider or custom-model row deleted on disk stays deleted even if stale
  *   live state edited that same row;
- * - file missing/unreadable → save what we have, no throw.
+ * - missing file → save what we have; invalid existing file → fail closed.
  *
  * Custom-model rows are merged by their stable `id`, preserving independent
  * edits and deletions across stale whole-config saves.

package/src/generated/compatibility-version.json

@@ -10,7 +10,7 @@
     },
     {
       "path": "package.json",
-      "sha256": "2f5a421719b3d052a71a69af74f225ff812e3168681e71687faae37846e50f90"
+      "sha256": "c223c9a248049f4e19e7dee2837311746d85ba6e2b79498d6b1a3b07a2201c03"
     },
     {
       "path": "scripts/model-metadata.source.json",
@@ -486,7 +486,7 @@
     },
     {
       "path": "src/cli/agent.ts",
-      "sha256": "549c31a1ffe8e856094e0db1eb376e9b82d6b5f3763edd2e410acc403dadb771"
+      "sha256": "3caa13112d1023cafefc56addb66d7e36fcb05b1b71a29caf675a7893d69d574"
     },
     {
       "path": "src/cli/alias.ts",
@@ -526,7 +526,7 @@
     },
     {
       "path": "src/cli/config-command.ts",
-      "sha256": "fa4b09ccb9a24384520818d11510f0400679597ee2936bc180a2555c329689bc"
+      "sha256": "1fbca0cbbdfbdab499c354f4e76d063b709ee7da99ad2334061bea580506a04c"
     },
     {
       "path": "src/cli/debug.ts",
@@ -558,7 +558,7 @@
     },
     {
       "path": "src/cli/init.ts",
-      "sha256": "9eeb5b5916c35f5c3994b6ef3dd6e230b30c05605c7d463ff0a604635639cef2"
+      "sha256": "ced149008c298c1167f8e710055ec5a293522e81dcc9e3bba2c8049dd32d3ec5"
     },
     {
       "path": "src/cli/integrations.ts",
@@ -606,7 +606,7 @@
     },
     {
       "path": "src/cli/provider.ts",
-      "sha256": "8cb7c9364cdb40989af7ee267c87c5b3e04e6557cbad91c428074cd4a461bb5e"
+      "sha256": "51f3110937eb259c93e5e04d4a1cdb07b0d546be8c8adcc9c1a410f728265d2c"
     },
     {
       "path": "src/cli/ready.ts",
@@ -614,7 +614,7 @@
     },
     {
       "path": "src/cli/registry.ts",
-      "sha256": "a90b57f449e91d67a409abb89ad8126c97f899b82930de18c205bf5553753f77"
+      "sha256": "66f2c0dad2451db553e7e0ae7905c78c3261e8ce2d76684d358a7148ab1582c9"
     },
     {
       "path": "src/cli/replit-gateway-key-input.ts",
@@ -766,7 +766,7 @@
     },
     {
       "path": "src/codex/catalog.ts",
-      "sha256": "2916321bbfbd26112dc816055a452348251a1b65a2a2535b089c9135c690499a"
+      "sha256": "9e7af66b04e8718f4b7bf822994941a06b4135253a98668963e77bd88c9c3076"
     },
     {
       "path": "src/codex/catalog/account-models.ts",
@@ -826,7 +826,7 @@
     },
     {
       "path": "src/codex/convergence.ts",
-      "sha256": "dfb4a900ca40eb4e112f5fd1b9ed73058301b0c6533a7a6d210b80aeef62c3ab"
+      "sha256": "f6ae4b0bdacfc59e9227d8bf3b5f118d9264abb1ec8224c8dc1203bcfacadf8e"
     },
     {
       "path": "src/codex/coordinator-doctor.ts",
@@ -898,7 +898,7 @@
     },
     {
       "path": "src/codex/inject.ts",
-      "sha256": "fed0dd2913d0ca07fb8486a91e74411dce65ca96fb8ca989e4fca0984e71f14e"
+      "sha256": "22fe9dc3b8fe3994b921ad619807b899e609834ea69e47c5b9494075327341a2"
     },
     {
       "path": "src/codex/injected-marker.ts",
@@ -1098,7 +1098,11 @@
     },
     {
       "path": "src/codex/subagent-defaults.ts",
-      "sha256": "08e3efa192430891d9d221d41e5124177c2c03656e3eb832087fdfb778a7703e"
+      "sha256": "c2683dd65ab7565c703e6637c5aa6c22c6a937d264e369efabb3eddabe7ba88a"
+    },
+    {
+      "path": "src/codex/subagent-model-authority.ts",
+      "sha256": "09928c56938d711365c324653e5870fc9f7aad021abae20e7d7a7ad870e52053"
     },
     {
       "path": "src/codex/subagent-model-fallback.ts",
@@ -1166,7 +1170,7 @@
     },
     {
       "path": "src/config.ts",
-      "sha256": "f5fb76e03c8e27883d2522cf78daf7ef4643e36625e126683d470f4f7616d3f8"
+      "sha256": "ab945b93888473c8165ca9cfe43b5ddca53c01d6de26b5c76b89903471aa7e24"
     },
     {
       "path": "src/config/atomic-write.ts",
@@ -2174,7 +2178,7 @@
     },
     {
       "path": "src/oauth/index.ts",
-      "sha256": "d2891b2d232f7c4821e6a83860f335a6179e82b7f4f58d840bd2be8e5e8ba701"
+      "sha256": "608e24a1883561d5638e21aa0cc66530c512e37afbf2917c9510c5ee19fac6b3"
     },
     {
       "path": "src/oauth/key-providers.ts",
@@ -2202,7 +2206,7 @@
     },
     {
       "path": "src/oauth/login-cli.ts",
-      "sha256": "7d98c1b8e45a36d367e7019733c8975f7fe562db2fb71f40798aa04c59f6bec0"
+      "sha256": "331024c25a8e2df86879dfa465b905bc35c5157b21f1da711c82618cb9f5e4c5"
     },
     {
       "path": "src/oauth/nous.ts",
@@ -2242,7 +2246,7 @@
     },
     {
       "path": "src/providers/alibaba-region-startup.ts",
-      "sha256": "310b2a0575bdaea6bd7fb5d5ac8dba1228f8e383e258755b7e93c72f7ef01ec1"
+      "sha256": "0915c6e813c955ddefbd610891a4d91e546f904aaf7777514563a66bff0b5cbe"
     },
     {
       "path": "src/providers/antigravity-models.ts",
@@ -2254,7 +2258,7 @@
     },
     {
       "path": "src/providers/api-keys.ts",
-      "sha256": "23d44706556147475ff87a71f409afcd201b656d3c62cb750a4cb6c60df44e80"
+      "sha256": "36e2b59bf5b61ef601426d507c09acd9df09854405c8c4dfda0afb9829709be8"
     },
     {
       "path": "src/providers/auto-compact-budget.ts",
@@ -2306,7 +2310,7 @@
     },
     {
       "path": "src/providers/key-failover.ts",
-      "sha256": "56ad909cc9007b644a737f0283fc4d4ae2819794446fa278187abd7841322904"
+      "sha256": "60bb2974bdda5825ad54974617c688139fceaa1c9d9b0d107fc06f8ba30ccc46"
     },
     {
       "path": "src/providers/kiro-models.ts",
@@ -2334,7 +2338,7 @@
     },
     {
       "path": "src/providers/model-rename-startup.ts",
-      "sha256": "8a143284d736759bf63c8cb296c19e61dec9596dfc781d8dd87038778153f55f"
+      "sha256": "6a98ec00772e7b45c056d7c4161a454cceeaa9780de58ca5e89b674c6cc58ca5"
     },
     {
       "path": "src/providers/new-model-policy.ts",
@@ -2346,7 +2350,7 @@
     },
     {
       "path": "src/providers/openai-tier-startup.ts",
-      "sha256": "41256c1ef4b2271168a52dcfb3ab986077cfa8edc0386230a01f5b196155ca42"
+      "sha256": "cb2631ad03a7727d34e7df97137848514b114790bb94276d71729efe9d605815"
     },
     {
       "path": "src/providers/openai-tiers.ts",
@@ -2682,7 +2686,7 @@
     },
     {
       "path": "src/server/index.ts",
-      "sha256": "e39a7d1b9812bdf91677f27be4b4ef0a486015170f41e69fb3d8c330970f0aba"
+      "sha256": "748a821368960a58228937a15582cb05a087bcc438849d367dc74c05eb5dbf6c"
     },
     {
       "path": "src/server/lifecycle.ts",
@@ -2710,7 +2714,7 @@
     },
     {
       "path": "src/server/management/agent-settings-routes.ts",
-      "sha256": "2ba31a9adb7ba798a7a9fdeada3a2430ad2497205ec3671f4c3a5bfbab68f8c5"
+      "sha256": "8046634493d0317a25b283e5ffa0007cf3a54dadcda5b6e7e7dcf83743f718bc"
     },
     {
       "path": "src/server/management/api-access.ts",
@@ -2738,7 +2742,7 @@
     },
     {
       "path": "src/server/management/context.ts",
-      "sha256": "48b53d840a12a08da2e22864d209099bb3832d9571360899f670956ed0e2a5fa"
+      "sha256": "13dfe2bb83ddc157d53b5e5e9340a677d9a80fbf0209f63d8598a8e9da44f269"
     },
     {
       "path": "src/server/management/integration-routes.ts",
@@ -2754,11 +2758,11 @@
     },
     {
       "path": "src/server/management/logs-usage-routes.ts",
-      "sha256": "24f5aec4c42a7ae0460d60acab8242facaa1b8f27d67d96f22ebb439a85955c2"
+      "sha256": "77bd7f6ffef94bea9b11a5c0bdefb30cce9d6c69a4bea0281db7e71ad1a48cbc"
     },
     {
       "path": "src/server/management/model-routes.ts",
-      "sha256": "eaa34ed610ea3651c48d36b47f1b34eaf7ac74b33ccfff1f5852f809d71845f2"
+      "sha256": "5651f71ad65fcc46d74176aa6119393ef074502e1b6c6d29a235c294850cd594"
     },
     {
       "path": "src/server/management/model-rows.ts",
@@ -2770,7 +2774,7 @@
     },
     {
       "path": "src/server/management/oauth-account-routes.ts",
-      "sha256": "2fd9233cd2994161950747fc771e67a5724d1a961ff474fd0cd2e4693638938f"
+      "sha256": "29050746283e3fd553e0de399fda85cbc9b0760e25e0dc3ba8e6fdbc4b33c7f6"
     },
     {
       "path": "src/server/management/provider-capability-config.ts",
@@ -2778,7 +2782,7 @@
     },
     {
       "path": "src/server/management/provider-routes.ts",
-      "sha256": "5e9d3b6985b2e498034a4d06336be2de6a6d77ddab7dc794ed3eb2979bd4ce25"
+      "sha256": "7abf9c86655670bc2de1383577b85e1a4cac5e92447d2a77421820e3126a2d97"
     },
     {
       "path": "src/server/management/replit-provider-routes.ts",
@@ -2934,7 +2938,7 @@
     },
     {
       "path": "src/server/responses/collaboration.ts",
-      "sha256": "c06f21efd00814eb1021b73e4fe16e693a93205768f8f1a55c63e854e657075d"
+      "sha256": "614afac38832befe772e6b59f6dedd3dfd44546a8f48ea2660fdcb0f9f1c089f"
     },
     {
       "path": "src/server/responses/combo-stream-preflight.ts",
@@ -3076,6 +3080,10 @@
       "path": "src/storage/cleanup.ts",
       "sha256": "2a90e83983c7da9bdb2ac0134870dd7ba85d4469237fae798c60b34985c8e554"
     },
+    {
+      "path": "src/storage/policy-input.ts",
+      "sha256": "94537ac1a988156404ab598c644ed86f2ffac3b286ad73cbf5d84f5ee5b07f35"
+    },
     {
       "path": "src/storage/policy-job.ts",
       "sha256": "4fa9f2297feb1a9404af6173adbf875c19f5e79f4b1aca0056744e83d503ad8a"
@@ -3090,7 +3098,7 @@
     },
     {
       "path": "src/storage/policy.ts",
-      "sha256": "93050c0be848f0df9c7114d903272738fb817b62fb0cdd9d7a59e55b9b267601"
+      "sha256": "aaefd080cf74c38596134ac4a62ef16128c090b38e9bf13eaf749fbd82862204"
     },
     {
       "path": "src/storage/restore-job.ts",