@yansigit/opencodex 2.36.1-dev.20260829.42 → 2.36.1-dev.20260829.48

package/src/providers/key-failover.ts

@@ -8,8 +8,9 @@
  *
  * Modelled after src/codex/routing.ts cooldown logic but scoped to plain API-key pools.
  */
-import { saveConfigPreservingClaudeCode } from "../config";
+import { mutatePersistedConfig } from "../config";
 import { isAzureIdentityProvider } from "../config/provider-validation";
+import { routedProviderConfig } from "../router";
 import type { OcxConfig, OcxProviderConfig, RateLimitRetryPolicy } from "../types";
 import { resolveProviderTransport, type OcxProviderTransport } from "./xai-transport";
 import { sweepExpiredOnWrite } from "../lib/state-store-sweeper";
@@ -159,50 +160,66 @@ export function rotateKeyOn429(
   if (isAzureIdentityProvider(provider)) return null;
   if (provider.authMode === "oauth" || provider.authMode === "forward") return null;
 
-  const pool = provider.apiKeyPool;
-  if (!pool || pool.length < 2) return null;
-
-  // Cool the key that ACTUALLY failed. Under concurrent 429s another request may already have
-  // rotated provider.apiKey — cooling the live key would punish an innocent replacement and can
-  // exhaust a 2-key pool from a single bad key. CAS semantics: callers pass the key they used.
   const failedKey = attemptedKey ?? provider.apiKey;
-  const currentEntry = pool.find(e => e.key === failedKey);
-  if (currentEntry) {
-    const cooldownMs = parseRetryAfterMs(retryAfterHeader, now) ?? DEFAULT_COOLDOWN_MS;
-    keyCooldowns.set(cooldownKey(providerName, currentEntry.id), {
-      cooldownUntil: now + cooldownMs,
-    });
-    sweepExpiredOnWrite(now);
-  }
+  type Rotation =
+    | { provider: OcxProviderConfig; failedId?: string; candidateId?: string }
+    | { exhaustedCount: number };
+  const outcome = mutatePersistedConfig<Rotation | null>(fresh => {
+    const freshProvider = fresh.providers[providerName];
+    if (!freshProvider || isAzureIdentityProvider(freshProvider)
+      || freshProvider.authMode === "oauth" || freshProvider.authMode === "forward") {
+      return { changed: false, value: null };
+    }
+    const pool = freshProvider.apiKeyPool;
+    if (!pool || pool.length < 2) return { changed: false, value: null };
 
-  // Lost the race: someone already rotated away from the failed key. If the live key is healthy,
-  // retry with it as-is instead of rotating a second time.
-  if (attemptedKey !== undefined && provider.apiKey !== attemptedKey) {
-    const liveEntry = pool.find(e => e.key === provider.apiKey);
-    if (liveEntry && !isKeyInCooldown(providerName, liveEntry.id, now)) {
-      return { ...provider };
+    // Cool the key that actually failed. The callback is rerun after rebasing,
+    // so both the id and the active-key comparison come from the commit preimage.
+    const failedEntry = pool.find(entry => entry.key === failedKey);
+    if (failedEntry) {
+      const cooldownMs = parseRetryAfterMs(retryAfterHeader, now) ?? DEFAULT_COOLDOWN_MS;
+      keyCooldowns.set(cooldownKey(providerName, failedEntry.id), { cooldownUntil: now + cooldownMs });
+      sweepExpiredOnWrite(now);
     }
-  }
 
-  // Pick the next key that is NOT in cooldown
-  const currentIndex = currentEntry ? pool.indexOf(currentEntry) : -1;
-  for (let i = 1; i < pool.length; i++) {
-    const candidate = pool[(currentIndex + i) % pool.length]!;
-    if (!isKeyInCooldown(providerName, candidate.id, now)) {
-      // Swap active key
-      provider.apiKey = candidate.key;
-      saveConfigPreservingClaudeCode(config);
-      console.warn(
-        // Log ids only — labels are user-supplied free text and could carry secret material.
-        `[key-failover] ${providerName}: 429 on key ${currentEntry?.id ?? "?"}; rotating to key ${candidate.id}`,
-      );
-      return { ...provider };
+    if (freshProvider.apiKey !== failedKey) {
+      const activeEntry = pool.find(entry => entry.key === freshProvider.apiKey);
+      if (activeEntry && !isKeyInCooldown(providerName, activeEntry.id, now)) {
+        return {
+          changed: false,
+          value: { provider: structuredClone(freshProvider), failedId: failedEntry?.id, candidateId: undefined },
+        };
+      }
     }
+
+    const currentIndex = failedEntry ? pool.indexOf(failedEntry) : -1;
+    const candidateCount = failedEntry ? pool.length - 1 : pool.length;
+    for (let offset = 1; offset <= candidateCount; offset += 1) {
+      const candidate = pool[(currentIndex + offset) % pool.length]!;
+      if (isKeyInCooldown(providerName, candidate.id, now)) continue;
+      freshProvider.apiKey = candidate.key;
+      return {
+        changed: true,
+        value: { provider: structuredClone(freshProvider), failedId: failedEntry?.id, candidateId: candidate.id },
+      };
+    }
+    return { changed: false, value: { exhaustedCount: pool.length } };
+  });
+  if (outcome.status === "unavailable" || outcome.value === null) return null;
+  if ("exhaustedCount" in outcome.value) {
+    console.warn(`[key-failover] ${providerName}: all ${outcome.value.exhaustedCount} keys in cooldown; returning 429 to client`);
+    return null;
   }
 
-  // All keys in cooldown
-  console.warn(`[key-failover] ${providerName}: all ${pool.length} keys in cooldown; returning 429 to client`);
-  return null;
+  const committed = structuredClone(outcome.value.provider);
+  config.providers[providerName] = committed;
+  if (outcome.value.candidateId) {
+    console.warn(
+      // Log ids only — labels are user-supplied free text and could carry secret material.
+      `[key-failover] ${providerName}: 429 on key ${outcome.value.failedId ?? "?"}; rotating to key ${outcome.value.candidateId}`,
+    );
+  }
+  return structuredClone(committed);
 }
 
 export function sweepExpiredApiKeyCooldowns(now = Date.now()): number {
@@ -225,13 +242,9 @@ interface RotateProviderTransportOptions {
 /**
  * Rotate a failed key and re-apply provider-specific transport metadata to the replacement.
  *
- * `routedProvider` is the request's active provider (the `routedProviderConfig` output the
- * route was built with). The result inherits it and swaps ONLY the API key: the persisted
- * config that `rotateKeyOn429` snapshots predates registry backfill, so building the retry
- * provider from that snapshot would silently drop every field the registry merged in at
- * routing time (scalar flags like `promptCacheKey`/`parallelToolCalls`, merged model
- * metadata such as `noTemperatureModels`, a pinned baseUrl). Mirrors the OAuth-401 replay
- * path in src/server/responses/core.ts, which spreads `route.provider` for the same reason.
+ * Put the authoritative committed row over request-only fields and registry backfills, then
+ * route it again so concurrent provider edits take effect without losing either kind of runtime
+ * metadata.
  */
 export function rotateProviderTransportOn429(
   config: OcxConfig,
@@ -249,7 +262,7 @@ export function rotateProviderTransportOn429(
   return rotated
     ? resolveProviderTransport(
         providerName,
-        { ...routedProvider, apiKey: rotated.apiKey },
+        routedProviderConfig(providerName, { ...routedProvider, ...rotated }),
         options.promptCacheKey,
       )
     : null;

package/src/providers/model-rename-startup.ts

@@ -1,10 +1,16 @@
-import { saveConfig } from "../config";
+import { mutatePersistedConfig } from "../config";
 import { projectModelRenames } from "./model-rename-migration";
 import type { OcxConfig } from "../types";
 
 export interface ModelRenameStartupDeps {
   project: typeof projectModelRenames;
-  save: (config: OcxConfig) => void;
+  save?: (config: OcxConfig) => void;
+}
+
+function adoptConfig(target: OcxConfig, source: OcxConfig): void {
+  if (target === source) return;
+  for (const key of Object.keys(target)) delete (target as unknown as Record<string, unknown>)[key];
+  Object.assign(target, structuredClone(source));
 }
 
 /**
@@ -18,11 +24,23 @@ export interface ModelRenameStartupDeps {
  */
 export function runModelRenameStartupMigration(
   config: OcxConfig,
-  deps: ModelRenameStartupDeps = { project: projectModelRenames, save: saveConfig },
+  deps: ModelRenameStartupDeps = { project: projectModelRenames },
 ): OcxConfig {
-  const projection = deps.project(config);
-  for (const warning of projection.warnings) console.warn(`[model-rename-migration] ${warning}`);
+  const projection = deps.project(structuredClone(config));
   if (!projection.changed) return projection.config;
-  deps.save(projection.config);
-  return projection.config;
+  if (deps.save) {
+    deps.save(projection.config);
+    adoptConfig(config, projection.config);
+    for (const warning of projection.warnings) console.warn(`[model-rename-migration] ${warning}`);
+    return config;
+  }
+  const outcome = mutatePersistedConfig(fresh => {
+    const next = deps.project(fresh);
+    if (next.changed) adoptConfig(fresh, next.config);
+    return { changed: next.changed, value: next };
+  });
+  if (outcome.status === "unavailable") return config;
+  adoptConfig(config, outcome.value.config);
+  for (const warning of outcome.value.warnings) console.warn(`[model-rename-migration] ${warning}`);
+  return config;
 }

package/src/providers/openai-tier-startup.ts

@@ -2,8 +2,8 @@ import {
   backupConfigBeforeOpenAiTierMigration,
   OpenAiTierBackupCollisionError,
   OpenAiTierRollbackPreserveError,
+  mutatePersistedConfig,
   preserveOpenAiTierRollbackSnapshot,
-  saveConfig,
 } from "../config";
 import type { OcxConfig } from "../types";
 import { projectOpenAiTierMigration } from "./openai-tiers";
@@ -11,7 +11,7 @@ import { projectOpenAiTierMigration } from "./openai-tiers";
 export interface OpenAiTierStartupDeps {
   project: typeof projectOpenAiTierMigration;
   backup: () => void;
-  save: (config: OcxConfig) => void;
+  save?: (config: OcxConfig) => void;
   preserveRollback?: (error: OpenAiTierBackupCollisionError) => void;
 }
 
@@ -34,23 +34,47 @@ function defaultPreserveRollback(error: OpenAiTierBackupCollisionError): void {
 const DEFAULT_DEPS: OpenAiTierStartupDeps = {
   project: projectOpenAiTierMigration,
   backup: backupConfigBeforeOpenAiTierMigration,
-  save: saveConfig,
 };
 
 export function runOpenAiTierStartupMigration(
   config: OcxConfig,
   deps: OpenAiTierStartupDeps = DEFAULT_DEPS,
 ): OcxConfig {
-  const projection = deps.project(config);
-  if (!projection.changed) return projection.config;
-  try {
-    deps.backup();
-  } catch (error) {
-    if (!(error instanceof OpenAiTierBackupCollisionError)) throw error;
-    (deps.preserveRollback ?? defaultPreserveRollback)(error);
-    deps.backup();
+  const backup = (): void => {
+    try {
+      deps.backup();
+    } catch (error) {
+      if (!(error instanceof OpenAiTierBackupCollisionError)) throw error;
+      (deps.preserveRollback ?? defaultPreserveRollback)(error);
+      deps.backup();
+    }
+  };
+  if (deps.save) {
+    const projection = deps.project(config);
+    if (!projection.changed) return projection.config;
+    backup();
+    deps.save(projection.config);
+    for (const warning of projection.warnings) console.warn(`[openai-provider-migration] ${warning}`);
+    return projection.config;
+  }
+
+  let previousSnapshot: string | undefined;
+  const outcome = mutatePersistedConfig(fresh => {
+    const snapshot = JSON.stringify(fresh);
+    const next = deps.project(fresh);
+    // mutatePersistedConfig confirms a candidate by invoking us again with the same
+    // snapshot after rebasing. Back up only that confirmed preimage.
+    if (next.changed && snapshot === previousSnapshot) backup();
+    previousSnapshot = snapshot;
+    if (next.changed) {
+      for (const key of Object.keys(fresh)) delete (fresh as unknown as Record<string, unknown>)[key];
+      Object.assign(fresh, next.config);
+    }
+    return { changed: next.changed, value: next };
+  });
+  if (outcome.status === "unavailable") return config;
+  if (outcome.status === "committed") {
+    for (const warning of outcome.value.warnings) console.warn(`[openai-provider-migration] ${warning}`);
   }
-  deps.save(projection.config);
-  for (const warning of projection.warnings) console.warn(`[openai-provider-migration] ${warning}`);
-  return projection.config;
+  return outcome.value.config;
 }

package/src/server/index.ts

@@ -38,6 +38,11 @@ import {
   setLiveStateStoreConfig,
 } from "../lib/state-store-registrations";
 import { startUserCostOverlayReconciler } from "../usage/user-cost-overlay-reconciler";
+import {
+  getStorageCleanupPolicyJobState,
+  getStorageCleanupPolicyTestStreamResponse,
+  requestStorageCleanupPolicyRun,
+} from "../storage/policy-job";
 import {
   configureAppOwnedMemoryBudget,
   enforceAppOwnedMemoryBudget,
@@ -537,6 +542,11 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
   const managementApi: ManagementApiDeps = {
     saveConfigPreservingClaudeCode,
     mutatePersistedConfig,
+    storageCleanupPolicyJob: {
+      getState: getStorageCleanupPolicyJobState,
+      getTestStream: getStorageCleanupPolicyTestStreamResponse,
+      requestRun: requestStorageCleanupPolicyRun,
+    },
     ...deps.managementApi,
   };
   const localAttestationSecret = deps.localAttestationSecret ?? createLocalAttestationSecret();

package/src/server/management/agent-settings-routes.ts

@@ -792,6 +792,18 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
   // dynamically injected into the v1 proactive prompt, plus an optional reasoning
   // effort the prompt tells the agent to pass to spawn_agent. GET returns the current
   // picks + available models/efforts; PUT sets or clears them.
+  if (url.pathname === "/api/subagent-model-authority" && req.method === "POST") {
+    let body: unknown;
+    try { body = await readManagementJsonBody(req); } catch (error) {
+      rethrowManagementBodyTooLarge(error);
+      return jsonResponse({ error: "invalid JSON body" }, 400);
+    }
+    const { parseSubagentModelAuthorityInput, resolveOpenCodexSubagentModelAuthority } = await import("../../codex/subagent-model-authority");
+    const input = parseSubagentModelAuthorityInput(body);
+    if (!input) return jsonResponse({ error: "invalid subagent model authority input" }, 400);
+    return jsonResponse(await resolveOpenCodexSubagentModelAuthority(input, config));
+  }
+
   if (url.pathname === "/api/injection-model" && req.method === "GET") {
     const models = await fetchAllModels(config);
     const disabled = new Set(config.disabledModels ?? []);

package/src/server/management/context.ts

@@ -1,4 +1,5 @@
 import type { OcxConfig } from "../../types";
+import type { PersistedConfigMutation, PersistedConfigMutationOutcome } from "../../config";
 import type { NativeProfileApiDeps } from "../../codex/native-profile-api";
 import type { CodexLogGuardProtectionDeps } from "../../codex/log-guard/protection";
 import type { CodexLogGuardMaintenanceDeps } from "../../codex/log-guard/maintenance";
@@ -40,6 +41,12 @@ export interface ManagementApiDeps {
   saveConfigPreservingClaudeCode?: (config: OcxConfig) => void;
   /** Config-mutation seam for routes that commit through `mutatePersistedConfig`. */
   mutatePersistedConfig?: typeof import("../../config").mutatePersistedConfig;
+  /** Storage-policy job seam keeps management routes off persistence-bearing worker modules. */
+  storageCleanupPolicyJob?: {
+    getState: typeof import("../../storage/policy-job").getStorageCleanupPolicyJobState;
+    getTestStream: typeof import("../../storage/policy-job").getStorageCleanupPolicyTestStreamResponse;
+    requestRun: typeof import("../../storage/policy-job").requestStorageCleanupPolicyRun;
+  };
   /** Test-only fetch injection for Replit gateway install probes. */
   probeFetch?: typeof globalThis.fetch;
   /**
@@ -142,11 +149,11 @@ export function saveManagementConfig(deps: ManagementApiDeps, config: OcxConfig)
 /** The only locked, field-scoped on-disk mutation boundary available to management routes. */
 export function mutateManagementConfig<T>(
   deps: ManagementApiDeps,
-  mutate: Parameters<NonNullable<ManagementApiDeps["mutatePersistedConfig"]>>[0],
-): ReturnType<NonNullable<ManagementApiDeps["mutatePersistedConfig"]>> {
+  mutate: (config: OcxConfig) => PersistedConfigMutation<T>,
+): PersistedConfigMutationOutcome<T> {
   if (!deps.mutatePersistedConfig) throw new MissingManagementPersistenceError();
   try {
-    return deps.mutatePersistedConfig(mutate) as ReturnType<NonNullable<ManagementApiDeps["mutatePersistedConfig"]>>;
+    return deps.mutatePersistedConfig(mutate);
   } catch (error) {
     throw new ManagementPersistenceError(error);
   }

package/src/server/management/logs-usage-routes.ts

@@ -39,13 +39,7 @@ import { getRestoreTrashTestStreamResponse, runRestoreTrashEntryJob } from "../.
 import {
   normalizeStorageCleanupPolicy,
   parseStorageCleanupPolicyInput,
-  writeStorageCleanupPolicyToConfig,
-} from "../../storage/policy";
-import {
-  getStorageCleanupPolicyJobState,
-  getStorageCleanupPolicyTestStreamResponse,
-  requestStorageCleanupPolicyRun,
-} from "../../storage/policy-job";
+} from "../../storage/policy-input";
 import {
   currentUsageLogRevision,
   readUsageSnapshotForManagement,
@@ -77,7 +71,7 @@ import { applySystemEnvToggle } from "../system-env";
 
 import { isPlainRecord, parseDebugLogQuery, tokPerSecondResult, unavailableCostReason, costResult, requestLogDto, stripRegistryOnlyStaticHeaders, fetchAllModels } from "./shared";
 import type { MetricUnavailableReason, TokPerSecondResult, CostEstimateReason, CostResult, MetricSource } from "./shared";
-import type { ManagementContext } from "./context";
+import { MissingManagementPersistenceError, mutateManagementConfig, type ManagementContext } from "./context";
 import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
 import {
   discardUsageSummaryCacheEntry,
@@ -131,6 +125,7 @@ function snapshotWindow(entries: PersistedUsageEntry[]): { start: number | null;
 
 export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Response | null> {
   const { req, url, config, deps, syncClaudeAgentDefsBestEffort } = ctx;
+  const storagePolicyJobState = () => deps.storageCleanupPolicyJob?.getState() ?? { status: "idle" as const };
 
   if (url.pathname === "/api/logs" && req.method === "GET") {
     const all = getRequestLogEntries();
@@ -555,7 +550,7 @@ export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Res
   }
 
   if (url.pathname === "/api/storage/cleanup-policy/test-stream" && req.method === "GET") {
-    const stream = getStorageCleanupPolicyTestStreamResponse();
+    const stream = deps.storageCleanupPolicyJob?.getTestStream();
     if (stream) return stream;
     // Production: hook is off. Return an explicit JSON 404 — do not fall through to the GUI.
     return jsonResponse({ error: "not_found" }, 404);
@@ -565,7 +560,7 @@ export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Res
     const policy = normalizeStorageCleanupPolicy(config.storageCleanupPolicy);
     return jsonResponse({
       ...policy,
-      job: getStorageCleanupPolicyJobState(),
+      job: storagePolicyJobState(),
     });
   }
 
@@ -575,17 +570,25 @@ export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Res
     const previous = normalizeStorageCleanupPolicy(config.storageCleanupPolicy);
     const parsed = parseStorageCleanupPolicyInput(raw, previous);
     if (!parsed.ok) return jsonResponse({ error: parsed.error }, 400);
-    // Never enable implicitly: if client omitted enabled, keep previous (default false).
     const body = raw as Record<string, unknown>;
-    if (body.enabled === undefined) parsed.policy.enabled = previous.enabled;
-    const saved = writeStorageCleanupPolicyToConfig(parsed.policy);
-    config.storageCleanupPolicy = saved;
-    return jsonResponse({ ok: true, policy: saved, job: getStorageCleanupPolicyJobState() });
+    const persisted = mutateManagementConfig(deps, disk => {
+      const latest = normalizeStorageCleanupPolicy(disk.storageCleanupPolicy);
+      const rebased = parseStorageCleanupPolicyInput(raw, latest);
+      if (!rebased.ok) throw new Error(rebased.error);
+      // Never enable implicitly: if client omitted enabled, keep the latest persisted value.
+      if (body.enabled === undefined) rebased.policy.enabled = latest.enabled;
+      disk.storageCleanupPolicy = rebased.policy;
+      return { changed: true, value: structuredClone(rebased.policy) };
+    });
+    if (persisted.status === "unavailable") return jsonResponse({ error: "management persistence unavailable" }, 500);
+    config.storageCleanupPolicy = persisted.value;
+    return jsonResponse({ ok: true, policy: persisted.value, job: storagePolicyJobState() });
   }
 
   if (url.pathname === "/api/storage/cleanup-policy/run" && req.method === "POST") {
     try {
-      const accepted = requestStorageCleanupPolicyRun({ reason: "manual", force: true });
+      if (!deps.storageCleanupPolicyJob) throw new MissingManagementPersistenceError();
+      const accepted = deps.storageCleanupPolicyJob.requestRun({ reason: "manual", force: true });
       if (!accepted.accepted) {
         return jsonResponse({
           ok: false,