@yansigit/opencodex 2.36.1-dev.20260829.47 → 2.36.1-dev.20260829.50

package/src/server/responses/core.ts

@@ -43,6 +43,10 @@ import {
   previousResponseScopeMismatch,
   rememberResponseState,
 } from "../../responses/state";
+import {
+  bindTurnTerminationScope,
+  rememberDeliveredFinalAnswer,
+} from "../../responses/turn-termination";
 import {
   isValidProviderContinuationOwner,
   mergeProviderContinuationPayload,
@@ -122,6 +126,7 @@ import {
   resolveAnthropicAccountForSession,
   rotateAnthropicAccountOn429,
 } from "../../oauth/anthropic-routing";
+import { stampOAuthAccountLabel } from "../../providers/label";
 import {
   antigravitySessionKeyFromParts,
   bindAntigravitySessionAffinity,
@@ -2508,6 +2513,10 @@ async function handleResponsesInner(
     threadIdHeader: req.headers.get("thread-id"),
     cursorConversationId: parsed._cursorConversationId,
   });
+  bindTurnTerminationScope(parsed, resolvedConversationId);
+  const rememberKiroDeliveredFinalAnswer = (adapterName: string, response: unknown): void => {
+    if (adapterName === "kiro") rememberDeliveredFinalAnswer(parsed, response);
+  };
   // _clientThreadId remains the routing/continuation identity supplied by Codex. Replay state uses
   // a dedicated raw conversation namespace so mixed headers that carry the same identity still
   // match, and a shared/synthetic session_id cannot coalesce distinct thread/Cursor conversations.
@@ -3040,9 +3049,12 @@ async function handleResponsesInner(
         accountId: snapshot.accountId,
         generation: snapshot.generation,
       };
-      logCtx.accountLogLabel = snapshot.accountId ?? genericFailoverAccountId;
       bindAntigravitySessionAffinity(antigravitySessionKey, snapshot.accountId ?? genericFailoverAccountId);
     }
+    // Re-stamp: a request that rotated accounts must be attributed to the account that actually
+    // served it. All three rotation sites funnel through here, so this is the only re-stamp
+    // needed -- and putting it anywhere else would let one of the three drift.
+    stampOAuthAccountLabel(logCtx, route.providerName, route.provider, snapshot.accountId);
     return true;
   };
   const oauthSessionKeyParts = {
@@ -3151,9 +3163,10 @@ async function handleResponsesInner(
         };
         if (isOAuth401ReplayProvider) sentOAuthSnapshot = resolved;
         route.provider = { ...route.provider, apiKey: resolved.accessToken };
-        if (resolved.accountId) {
-          logCtx.accountLogLabel = resolved.accountId;
-        }
+        // Attribution is independent of failover (#2699): stamped from the resolved snapshot
+        // itself, not from inside the `isGenericFailoverProvider` branch below, so a future
+        // narrowing of that predicate cannot silently switch attribution off.
+        stampOAuthAccountLabel(logCtx, route.providerName, route.provider, resolved.accountId);
         // Remember which account actually served this request so a 429 cools THAT one, not
         // whichever account is active by the time the response comes back (#2568).
         if (isGenericFailoverProvider(route.providerName, route.provider)) {
@@ -4810,6 +4823,7 @@ async function handleResponsesInner(
       ...(options.forceEmptyResponseId ? { forceEmptyResponseId: true } : {}),
       onCompletedResponse: (response, providerState) => {
         commitReasoningReplayServingRoute();
+        rememberKiroDeliveredFinalAnswer(adapter.name, response);
         rememberResponseState(
           parsed._rawBody,
           response,
@@ -5135,6 +5149,7 @@ async function handleResponsesInner(
           },
           onCompletedResponse: (response: Record<string, unknown>, providerState?: OcxProviderContinuationState) => {
             commitReasoningReplayServingRoute();
+            rememberKiroDeliveredFinalAnswer(adapter.name, response);
             if (!routedCompaction) {
               rememberResponseState(
                 parsed._rawBody,
@@ -5204,6 +5219,7 @@ async function handleResponsesInner(
       },
     });
     if (!routedCompaction) {
+      rememberKiroDeliveredFinalAnswer(adapter.name, json);
       rememberResponseState(
         parsed._rawBody,
         json,
@@ -5238,6 +5254,64 @@ async function handleResponsesInner(
   // reuse is safe, and releaseBodyObservation is idempotent per build.
   let initialRequest: AdapterRequest | undefined;
   let inputTokenEstimate: number | undefined;
+  // An adapter may know the turn needs no inference at all — Kiro's replayed history ending in a
+  // delivered final answer. Answer it locally: no build (so no token estimate), no send (so
+  // sendCount stays 0), and crucially no empty-completion guard, which treats an outputless
+  // terminal as a failed turn and re-invokes the identical request. Routing this through the
+  // ordinary event path would therefore reinstate the loop it exists to end.
+  const localTerminal = activeAdapter.localTerminal?.(parsed);
+  if (localTerminal) {
+    logCtx.localTerminalReason = localTerminal.reason;
+    // Mark the physical attempt too, not just the parent row. `finishRequestAttempt` finalizes the
+    // attempt through the same estimated-provider path, so without this the row reads exact while
+    // its own attempt still claims an estimate — the detailed accounting a maintainer actually
+    // reads for a zero-send turn.
+    if (logCtx.activeAttempt) logCtx.activeAttempt.locallyAnswered = true;
+    cleanupUpstreamAbort();
+    upstream.abort();
+    const terminalEvents: AdapterEvent[] = [{
+      type: "done",
+      endTurn: true,
+      usage: { inputTokens: 0, outputTokens: 0, totalTokens: 0 },
+    }];
+    if (parsed.stream) {
+      const localSse = bridgeToResponsesSSE(
+        (async function* () { yield* terminalEvents; })(),
+        parsed._responseModelId ?? parsed.modelId,
+        toolBridgeMaps.toolNsMap,
+        toolBridgeMaps.freeformToolNames,
+        toolBridgeMaps.toolSearchToolNames,
+        undefined,
+        2_000,
+        {
+          translatorBudget,
+          ...(options.forceEmptyResponseId ? { responseId: "" } : {}),
+          ...(options.onFirstOutput ? { onFirstOutput: options.onFirstOutput } : {}),
+        },
+      );
+      // Same lifetime tracking as every other streaming return in this function: the turn
+      // admission lease is released when the body finishes or the client disconnects. Returning
+      // the raw stream would hold a lease for a turn that already has all of its output.
+      const localTurnAc = new AbortController();
+      return new Response(
+        trackStreamLifetime(localSse, localTurnAc, undefined, options.turnAdmissionLease),
+        {
+          headers: {
+            "Content-Type": "text/event-stream",
+            "Cache-Control": "no-cache",
+            "Connection": "keep-alive",
+            "X-Accel-Buffering": "no",
+          },
+        },
+      );
+    }
+    return new Response(
+      JSON.stringify(buildResponseJSON(terminalEvents, parsed._responseModelId ?? parsed.modelId, {
+        translatorBudget,
+      })),
+      { headers: { "Content-Type": "application/json" } },
+    );
+  }
   try {
     assertGoogleOptionsRoute(activeAdapter, route.provider);
     initialRequest = await activeAdapter.buildRequest(parsed, {
@@ -6434,6 +6508,7 @@ async function handleResponsesInner(
         },
         onCompletedResponse: (response: Record<string, unknown>, providerState?: OcxProviderContinuationState) => {
           commitReasoningReplayServingRoute();
+          rememberKiroDeliveredFinalAnswer(activeAdapter.name, response);
           // Compaction turns must NOT enter the continuation cache: _rawBody still holds the full
           // PRE-compaction history, and a later previous_response_id expansion would rehydrate the
           // giant stale chain Codex just replaced.
@@ -6511,6 +6586,7 @@ async function handleResponsesInner(
     });
     // See the streaming branch: compaction turns skip the continuation cache.
     if (!routedCompaction) {
+      rememberKiroDeliveredFinalAnswer(activeAdapter.name, json);
       rememberResponseState(
         parsed._rawBody,
         json,

package/src/server/responses/policy-fallback.ts

@@ -89,7 +89,7 @@ function finishFailedPolicyAttempt(logCtx: RequestLogContext, status: number): v
   const attempt = logCtx.activeAttempt;
   if (attempt) {
     const startedAt = logCtx.activeAttemptStartedAt ?? Date.now();
-    finishRequestAttempt(attempt, status, Math.max(0, Date.now() - startedAt), attempt.usage ?? logCtx.usage, logCtx.upstreamError);
+    finishRequestAttempt(attempt, status, Math.max(0, Date.now() - startedAt), attempt.usage ?? logCtx.usage);
   }
   delete logCtx.activeAttempt;
   delete logCtx.activeAttemptStartedAt;

package/src/service.ts

@@ -19,6 +19,7 @@ import { BUN_RUNTIME_PATH_ENV, BUN_RUNTIME_SOURCE_ENV, durableBunRuntime } from
 import type { BunRuntimeSource } from "./lib/bun-runtime";
 import { isProcessAlive, stopProxy } from "./lib/process-control";
 import { serviceApiTokenFilePath } from "./lib/service-secrets";
+import { tokenCollidesWithAdmin } from "./lib/admin-secrets";
 import { PROXY_ENV_KEYS } from "./lib/proxy-env";
 import { randomUUID } from "node:crypto";
 import {
@@ -366,8 +367,38 @@ export function serviceRetryCommand(
   return diag.installed && !diag.conflict ? "ocx service repair" : "ocx service install";
 }
 
+/**
+ * Refuse a management (admin) token as the data-plane secret.
+ *
+ * The service exports the contents of the service token file as
+ * `OPENCODEX_API_AUTH_TOKEN` before starting the proxy. When that value is the admin
+ * token, the server treats the management credential as a data-plane admission secret
+ * and fails the ENTIRE management plane closed at boot, so every `/api/*` request
+ * returns 503 — even on a loopback install that never needed a data-plane secret.
+ * Exporting the admin token in the CLI cannot recover it, because the fence is decided
+ * server-side at startup (#2696).
+ *
+ * Nothing in this codebase puts an admin token in that env var; it arrives from the
+ * installing shell. This function is the chokepoint that should refuse it rather than
+ * writing a file that produces a broken service. Comparison is the same helper doctor
+ * uses: minted `ocx_admin_…` prefix, or byte-equal to configuredAdminToken (env or file).
+ */
+export function assertNotAdminToken(token: string, env: NodeJS.ProcessEnv = process.env): void {
+  if (!tokenCollidesWithAdmin(token, env)) return;
+  throw new Error(
+    "OPENCODEX_API_AUTH_TOKEN holds a management (admin) token. The service exports it "
+      + "as the data-plane secret, which fences the whole management API closed and makes "
+      + "every ocx management command fail with 503. Unset OPENCODEX_API_AUTH_TOKEN, or set "
+      + "it to a distinct data-plane key, then rerun the install.",
+  );
+}
+
 export function assertServiceAuthEnvironment(): void {
   const config = loadConfig();
+  // Check the collision before the loopback short-circuit: a loopback install writes
+  // the token file too, so returning early here is what let the broken state through.
+  const present = process.env.OPENCODEX_API_AUTH_TOKEN?.trim();
+  if (present) assertNotAdminToken(present);
   if (isLoopbackHostname(config.hostname)) return;
   if (process.env.OPENCODEX_API_AUTH_TOKEN?.trim()) return;
   // Reached from `service repair` as well as `install`, so name a command that can
@@ -383,6 +414,9 @@ export function assertServiceAuthEnvironment(): void {
 function writeServiceApiTokenFile(): string | null {
   const token = process.env.OPENCODEX_API_AUTH_TOKEN?.trim();
   if (!token) return null;
+  // Last line of defence: every install/repair path funnels through here, so a
+  // collision cannot reach disk regardless of which caller ran (#2696).
+  assertNotAdminToken(token);
   const path = serviceApiTokenFilePath();
   const dir = getConfigDir();
   recordOwnedConfigPath(dir, path);

package/src/storage/policy-input.ts

@@ -0,0 +1,166 @@
+import type { StorageCleanupPolicy } from "../types";
+
+export const DEFAULT_ARCHIVED_BYTES_OVER = 5 * 1024 ** 3;
+export const DEFAULT_REMOVE_OLDEST_PERCENT = 25;
+
+export type PolicySchedule = StorageCleanupPolicy["schedule"];
+
+/** Canonical defaults — enabled is always false. */
+export function defaultStorageCleanupPolicy(): StorageCleanupPolicy {
+  return {
+    enabled: false,
+    trigger: { archivedBytesOver: DEFAULT_ARCHIVED_BYTES_OVER },
+    target: { removeOldestPercent: DEFAULT_REMOVE_OLDEST_PERCENT },
+    schedule: "manual",
+    mode: "quarantine",
+  };
+}
+
+function isFiniteNonNegInt(n: unknown): n is number {
+  return typeof n === "number" && Number.isFinite(n) && n >= 0 && Math.floor(n) === n;
+}
+
+function isFinitePositiveInt(n: unknown): n is number {
+  return typeof n === "number" && Number.isFinite(n) && n > 0 && Math.floor(n) === n;
+}
+
+/** True when target has exactly one of reduceToBytes / removeOldestPercent. */
+export function isValidPolicyTarget(target: StorageCleanupPolicy["target"]): boolean {
+  if (!target || typeof target !== "object") return false;
+  const reduce = (target as { reduceToBytes?: unknown }).reduceToBytes;
+  const percent = (target as { removeOldestPercent?: unknown }).removeOldestPercent;
+  const hasReduce = reduce !== undefined;
+  const hasPercent = percent !== undefined;
+  if (hasReduce === hasPercent) return false;
+  if (hasReduce) return isFiniteNonNegInt(reduce);
+  return typeof percent === "number" && Number.isFinite(percent) && percent > 0 && percent <= 100;
+}
+
+/** Normalize persisted or partial policy input without ever enabling implicitly. */
+export function normalizeStorageCleanupPolicy(raw: unknown): StorageCleanupPolicy {
+  const base = defaultStorageCleanupPolicy();
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return base;
+  const o = raw as Record<string, unknown>;
+  let enabled = o.enabled === true;
+
+  let archivedBytesOver = base.trigger.archivedBytesOver;
+  if (o.trigger && typeof o.trigger === "object" && !Array.isArray(o.trigger)) {
+    const value = (o.trigger as { archivedBytesOver?: unknown }).archivedBytesOver;
+    if (isFiniteNonNegInt(value)) archivedBytesOver = value;
+  }
+
+  let target: StorageCleanupPolicy["target"] = base.target;
+  if (Object.hasOwn(o, "target")) {
+    if (o.target && typeof o.target === "object" && !Array.isArray(o.target)) {
+      const candidate = o.target as StorageCleanupPolicy["target"];
+      if (isValidPolicyTarget(candidate)) {
+        const reduce = (candidate as { reduceToBytes?: number }).reduceToBytes;
+        const percent = (candidate as { removeOldestPercent?: number }).removeOldestPercent;
+        target = reduce !== undefined
+          ? { reduceToBytes: reduce }
+          : { removeOldestPercent: Math.min(100, Math.max(1, Math.floor(percent!))) };
+      } else {
+        enabled = false;
+      }
+    } else {
+      enabled = false;
+    }
+  }
+
+  const schedule: PolicySchedule =
+    o.schedule === "startup" || o.schedule === "daily" || o.schedule === "weekly" || o.schedule === "manual"
+      ? o.schedule
+      : base.schedule;
+  const mode = o.mode === "permanent" ? "permanent" : "quarantine";
+
+  let lastRun: StorageCleanupPolicy["lastRun"];
+  if (o.lastRun && typeof o.lastRun === "object" && !Array.isArray(o.lastRun)) {
+    const row = o.lastRun as Record<string, unknown>;
+    if (isFinitePositiveInt(row.at) && isFiniteNonNegInt(row.freedBytes) && isFiniteNonNegInt(row.removed)) {
+      lastRun = { at: row.at, freedBytes: row.freedBytes, removed: row.removed };
+    }
+  }
+
+  const nextRun = o.nextRun === undefined || o.nextRun === null
+    ? undefined
+    : isFinitePositiveInt(o.nextRun) ? o.nextRun : undefined;
+
+  return {
+    enabled,
+    trigger: { archivedBytesOver },
+    target,
+    schedule,
+    mode,
+    ...(lastRun ? { lastRun } : {}),
+    ...(nextRun !== undefined ? { nextRun } : {}),
+  };
+}
+
+/** Validate a management PUT body and merge it over the latest policy. */
+export function parseStorageCleanupPolicyInput(
+  raw: unknown,
+  previous?: StorageCleanupPolicy,
+): { ok: true; policy: StorageCleanupPolicy } | { ok: false; error: string } {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    return { ok: false, error: "body must be a JSON object" };
+  }
+  const o = raw as Record<string, unknown>;
+  const prev = previous ?? defaultStorageCleanupPolicy();
+
+  if (o.enabled !== undefined && typeof o.enabled !== "boolean") {
+    return { ok: false, error: "enabled must be a boolean" };
+  }
+  if (o.mode !== undefined && o.mode !== "quarantine" && o.mode !== "permanent") {
+    return { ok: false, error: "mode must be quarantine or permanent" };
+  }
+  if (o.schedule !== undefined
+    && o.schedule !== "startup"
+    && o.schedule !== "daily"
+    && o.schedule !== "weekly"
+    && o.schedule !== "manual") {
+    return { ok: false, error: "schedule must be startup, daily, weekly, or manual" };
+  }
+
+  const merged: Record<string, unknown> = {
+    ...prev,
+    ...o,
+    trigger: o.trigger !== undefined ? o.trigger : prev.trigger,
+    target: o.target !== undefined ? o.target : prev.target,
+    lastRun: o.lastRun !== undefined ? o.lastRun : prev.lastRun,
+    nextRun: o.nextRun !== undefined ? o.nextRun : prev.nextRun,
+  };
+
+  if (o.trigger !== undefined) {
+    if (!o.trigger || typeof o.trigger !== "object" || Array.isArray(o.trigger)) {
+      return { ok: false, error: "trigger must be an object" };
+    }
+    const bytes = (o.trigger as { archivedBytesOver?: unknown }).archivedBytesOver;
+    if (!isFiniteNonNegInt(bytes)) {
+      return { ok: false, error: "trigger.archivedBytesOver must be a non-negative integer" };
+    }
+  }
+  if (o.target !== undefined && !isValidPolicyTarget(o.target as StorageCleanupPolicy["target"])) {
+    return {
+      ok: false,
+      error: "target must set exactly one of reduceToBytes (non-negative int) or removeOldestPercent (1-100)",
+    };
+  }
+
+  const policy = normalizeStorageCleanupPolicy(merged);
+  if ((policy.schedule === "daily" || policy.schedule === "weekly")
+    && o.nextRun === undefined
+    && (policy.nextRun === undefined || (o.schedule !== undefined && o.schedule !== prev.schedule))) {
+    policy.nextRun = computeNextRun(policy.schedule, Date.now());
+  }
+  if ((policy.schedule === "manual" || policy.schedule === "startup") && o.nextRun === undefined) {
+    delete policy.nextRun;
+  }
+  return { ok: true, policy };
+}
+
+/** Wall-clock next run for daily/weekly. Startup/manual → undefined. */
+export function computeNextRun(schedule: PolicySchedule, now: number): number | undefined {
+  if (schedule === "daily") return now + 24 * 60 * 60 * 1000;
+  if (schedule === "weekly") return now + 7 * 24 * 60 * 60 * 1000;
+  return undefined;
+}

package/src/storage/policy-job.ts

@@ -38,6 +38,7 @@ export interface PolicyJobOutcome {
   freedBytes?: number;
   removed?: number;
   trashDir?: string;
+  metadataPersistenceError?: PolicyRunResult["metadataPersistenceError"];
 }
 
 export interface PolicyJobState {
@@ -246,6 +247,7 @@ export async function abortStorageCleanupPolicyJobAsync(): Promise<void> {
   }
 }
 
+/** Project a run result into the bounded management-API job outcome. */
 function outcomeFromResult(result: PolicyRunResult): PolicyJobOutcome {
   return {
     ok: result.ok,
@@ -256,18 +258,26 @@ function outcomeFromResult(result: PolicyRunResult): PolicyJobOutcome {
     ...(result.freedBytes !== undefined ? { freedBytes: result.freedBytes } : {}),
     ...(result.removed !== undefined ? { removed: result.removed } : {}),
     ...(result.trashDir ? { trashDir: result.trashDir } : {}),
+    ...(result.metadataPersistenceError
+      ? { metadataPersistenceError: result.metadataPersistenceError }
+      : {}),
   };
 }
 
+/** Publish one completed evaluation without losing successful cleanup effects. */
 function applyFinished(result: PolicyRunResult): void {
   // Prefer the latest persisted policy over `result.policy`. The worker (or
   // in-process run) already merged run metadata into disk; a concurrent PUT
   // may also have landed after that write. Re-reading avoids applying a stale
   // start-of-job snapshot when the run skipped without saving.
-  try {
-    livePolicyApply?.(readStorageCleanupPolicyFromConfig());
-  } catch {
-    livePolicyApply?.(result.policy);
+  // A best-effort fallback policy may predate concurrent edits; keep the current
+  // live config untouched when the durable metadata write did not land.
+  if (!result.metadataPersistenceError) {
+    try {
+      livePolicyApply?.(readStorageCleanupPolicyFromConfig());
+    } catch {
+      livePolicyApply?.(result.policy);
+    }
   }
   state = {
     status: "idle",