@yansigit/opencodex 2.36.1-dev.20260829.48 → 2.36.1

package/src/integrations/state.ts

@@ -12,10 +12,11 @@ import { ClientPathError, EXPORT_CLIENTS, opencodeProxyBaseUrl, type ExportModel
 import type { OcxConfig } from "../types";
 import { PARSE_FAILED, loadTarget, parseConfig, type IntegrationIO } from "./config-io";
 import { SNAPSHOT_RETENTION } from "./journal";
-import { canonicalContribution, fingerprint, type OwnershipRecord } from "./ownership";
+import { canonicalContribution, fingerprint, semanticContribution, type OwnershipRecord } from "./ownership";
 import {
   protectedContributionFingerprint,
   refreshablePathsOf,
+  semanticProtectedContributionFingerprint,
   validRefreshablePaths,
 } from "./ownership-policy";
 import { INTEGRATION_CLIENTS, type IntegrationClientId } from "./registry";
@@ -153,21 +154,49 @@ function recordedBlockIsOwned(
   if (!observed) return false;
   if (fingerprint(canonicalContribution(observed)) === record.blockFingerprint) return true;
 
+  const observedSemanticFingerprint = fingerprint(semanticContribution(observed));
+  if (
+    typeof record.semanticBlockFingerprint === "string"
+    && observedSemanticFingerprint === record.semanticBlockFingerprint
+  ) return true;
+
+  const desiredFingerprint = fingerprint(canonicalContribution(desired));
+  if (
+    desiredFingerprint === record.blockFingerprint
+    && observedSemanticFingerprint === fingerprint(semanticContribution(desired))
+  ) return true;
+
   if (
     typeof record.protectedBlockFingerprint === "string"
     && validRefreshablePaths(observed, record.refreshablePaths)
     && record.refreshablePaths.length > 0
   ) {
-    return protectedContributionFingerprint(observed, record.refreshablePaths)
-      === record.protectedBlockFingerprint;
+    const observedProtectedFingerprint = protectedContributionFingerprint(
+      observed,
+      record.refreshablePaths,
+    );
+    if (observedProtectedFingerprint === record.protectedBlockFingerprint) return true;
+
+    const observedSemanticProtectedFingerprint = semanticProtectedContributionFingerprint(
+      observed,
+      record.refreshablePaths,
+    );
+    if (
+      typeof record.semanticProtectedBlockFingerprint === "string"
+      && observedSemanticProtectedFingerprint === record.semanticProtectedBlockFingerprint
+    ) return true;
+
+    return protectedContributionFingerprint(desired, record.refreshablePaths)
+        === record.protectedBlockFingerprint
+      && observedSemanticProtectedFingerprint
+        === semanticProtectedContributionFingerprint(desired, record.refreshablePaths);
   }
 
-  const desiredFingerprint = fingerprint(canonicalContribution(desired));
   if (desiredFingerprint !== record.blockFingerprint) return false;
   const legacyPaths = refreshablePathsOf(desired);
   return legacyPaths.length > 0
-    && protectedContributionFingerprint(observed, legacyPaths)
-      === protectedContributionFingerprint(desired, legacyPaths);
+    && semanticProtectedContributionFingerprint(observed, legacyPaths)
+      === semanticProtectedContributionFingerprint(desired, legacyPaths);
 }
 
 /**
@@ -257,7 +286,11 @@ export function classifyIntegration(input: {
     }
     return { state: "stale" };
   }
-  return input.record.blockFingerprint === fingerprint(canonicalContribution(input.contribution))
+  const desiredFingerprint = typeof input.record.semanticBlockFingerprint === "string"
+    ? fingerprint(semanticContribution(input.contribution))
+    : fingerprint(canonicalContribution(input.contribution));
+  const recordedFingerprint = input.record.semanticBlockFingerprint ?? input.record.blockFingerprint;
+  return recordedFingerprint === desiredFingerprint
     ? { state: "current" }
     : { state: "stale" };
 }

package/src/integrations/writer.ts

@@ -15,8 +15,18 @@ import { EXPORT_CLIENTS, type ExportModel, type ManagedContribution } from "../c
 import { isLoopbackHostname } from "../codex/inject";
 import type { OcxConfig } from "../types";
 import { PARSE_FAILED, defaultIntegrationIO, loadTarget, parseConfig, type IntegrationIO } from "./config-io";
-import { fingerprint, canonicalContribution, fragmentPathsOf, type OwnershipRecord } from "./ownership";
-import { protectedContributionFingerprint, refreshablePathsOf } from "./ownership-policy";
+import {
+  fingerprint,
+  canonicalContribution,
+  fragmentPathsOf,
+  semanticContribution,
+  type OwnershipRecord,
+} from "./ownership";
+import {
+  protectedContributionFingerprint,
+  refreshablePathsOf,
+  semanticProtectedContributionFingerprint,
+} from "./ownership-policy";
 import { createdContainerPaths, mergeContribution, removeFragments } from "./merge";
 import { INTEGRATION_CLIENTS, isLoopbackOnly, type IntegrationClientId } from "./registry";
 import { classifyIntegration, exportContextOf } from "./state";
@@ -361,8 +371,13 @@ function applyOrRefreshIntegration(input: IntegrationWriteInput, allowAbsent: bo
     record: {
       clientId, configPath, fileFingerprint: fingerprint(text),
       blockFingerprint: fingerprint(canonicalContribution(contribution)),
+      semanticBlockFingerprint: fingerprint(semanticContribution(contribution)),
       ...(refreshablePaths.length > 0 ? {
         protectedBlockFingerprint: protectedContributionFingerprint(contribution, refreshablePaths),
+        semanticProtectedBlockFingerprint: semanticProtectedContributionFingerprint(
+          contribution,
+          refreshablePaths,
+        ),
         refreshablePaths,
       } : {}),
       fragmentPaths: fragmentPathsOf(contribution), createdContainers: created,
@@ -556,7 +571,10 @@ export function restoreIntegration(input: IntegrationRestoreInput): WriteOutcome
     ? (restoredText === null ? "absent" : "conflict")
     : !recordDescribesBytes
       ? "conflict"
-      : restoredRecord.blockFingerprint === fingerprint(canonicalContribution(fresh))
+      : (
+        restoredRecord.semanticBlockFingerprint === fingerprint(semanticContribution(fresh))
+        || restoredRecord.blockFingerprint === fingerprint(canonicalContribution(fresh))
+      )
         ? "current"
         : "stale";
 

package/src/lib/admin-secrets.ts

@@ -1,3 +1,4 @@
+import { timingSafeEqual } from "node:crypto";
 import { lstatSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { getConfigDir } from "../config";
@@ -23,3 +24,26 @@ export function loadAdminTokenFromFile(configDir = getConfigDir()): string | nul
 export function configuredAdminToken(configDir = getConfigDir(), env: NodeJS.ProcessEnv = process.env): string | null {
   return env.OPENCODEX_ADMIN_AUTH_TOKEN?.trim() || loadAdminTokenFromFile(configDir);
 }
+
+export const ADMIN_TOKEN_PREFIX = "ocx_admin_";
+
+function secretTextEquals(left: string, right: string): boolean {
+  const a = Buffer.from(left);
+  const b = Buffer.from(right);
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+
+/**
+ * True when `token` is a management credential: minted `ocx_admin_…` shape, or
+ * byte-equal to the configured admin token (env or admin-api-token file).
+ * Used by the service write/start chokepoint and by doctor so the two cannot drift.
+ */
+export function tokenCollidesWithAdmin(
+  token: string,
+  env: NodeJS.ProcessEnv = process.env,
+  configDir = getConfigDir(),
+): boolean {
+  if (token.startsWith(ADMIN_TOKEN_PREFIX)) return true;
+  const admin = configuredAdminToken(configDir, env);
+  return admin !== null && secretTextEquals(token, admin);
+}

package/src/lib/errors.ts

@@ -349,6 +349,12 @@ export function inferHttpStatusFromAdapterMessage(message: string): number {
   // subscription/permission wording.
   if (isAuthenticationMessage(lower)) return 401;
   if (isSubscriptionGateMessage(lower) || isPermissionMessage(lower)) return 403;
+  // Same precedence rule as classifyCursorError: an explicit gRPC FAILED_PRECONDITION is a
+  // structured, deterministic rejection, so it outranks the overload keywords that routinely
+  // appear beside it ("failed_precondition: model unavailable for this plan"). Without this,
+  // the message matched "unavailable" and returned a retryable 503, so clients kept retrying
+  // a rejection that can never succeed.
+  if (lower.includes("failed_precondition") || lower.includes("failed precondition")) return 400;
   if (
     lower.includes("unavailable") ||
     lower.includes("overloaded") ||
@@ -424,6 +430,24 @@ export function httpStatusFromTerminalError(error: {
   if (message && isClientClosedMessage(message)) return 499;
   if (error.type === "invalid_request_error") return 400;
   if (error.type === "proxy_error") return 500;
-  if (message) return inferHttpStatusFromAdapterMessage(message);
+  // A structured server class must not be downgraded to a CLIENT error by message wording.
+  // classifyError assigns `server_error` + `upstream_server_error` to every 5xx it sees, so
+  // the class is authoritative about blame: the upstream failed, the caller did not send a
+  // bad request. What it is NOT authoritative about is which server status fits — a stall is
+  // genuinely 504 and an overload genuinely 503, and flattening those to 502 discards
+  // information both the log surface and the retry policy read. So message inference still
+  // chooses the specific status, and only a client-error verdict is overridden.
+  //
+  // The override is deliberately narrowed to 400 alone. 429, 499, 401 and 403 are all
+  // actionable signals the caller routes on — retry-after, client cancellation, re-auth,
+  // entitlement — and overriding them would trade one kind of misreport for another. 400 is
+  // the single verdict that both blames the caller and stops the retry, which is the failure
+  // being fixed: an upstream 500 whose text happens to contain "malformed" or "invalid
+  // request" used to return 400, so Claude Code stopped retrying a retryable failure.
+  const structuredServerClass = error.type === "server_error" || error.code === "upstream_server_error";
+  if (message) {
+    const inferred = inferHttpStatusFromAdapterMessage(message);
+    return structuredServerClass && inferred === 400 ? 502 : inferred;
+  }
   return 502;
 }

package/src/lib/service-secrets.ts

@@ -23,3 +23,18 @@ export function loadServiceTokenFromFile(env: Record<string, string | undefined>
     return null;
   }
 }
+
+/**
+ * Contents of the installed service token file. The launch wrapper always re-exports
+ * this file as OPENCODEX_API_AUTH_TOKEN, so doctor and start must inspect it even
+ * when the calling shell has no data-plane env var.
+ * Returns the token or null — never throws, never logs the value.
+ */
+export function readInstalledServiceToken(): string | null {
+  try {
+    const token = readFileSync(serviceApiTokenFilePath(), "utf8").trim();
+    return token || null;
+  } catch {
+    return null;
+  }
+}

package/src/oauth/store.ts

@@ -591,24 +591,34 @@ export async function upsertCredentialByIdentity(
   }, [provider, safe]);
 }
 
-/** Remove the ACTIVE account; remaining accounts promote the first one. */
-export async function removeCredential(provider: string): Promise<void> {
+/**
+ * Remove the ACTIVE account; remaining accounts promote the first one.
+ *
+ * Returns what actually happened, which a caller cannot otherwise know. A read-then-remove
+ * preflight is not equivalent: `mutateStore` serializes mutations, so between a caller's
+ * `getAccountSet` check and its `removeCredential` call another process can remove the same
+ * account, and both callers would then report a removal that only one of them performed.
+ * Deciding inside the mutation is the only place the answer is true when it is returned.
+ */
+export async function removeCredential(provider: string): Promise<"removed" | "not-found"> {
   let removedAccountId: string | undefined;
-  await mutateStore(store => {
+  const result = await mutateStore(store => {
     const set = store[provider];
-    if (!set) return;
+    if (!set) return "not-found" as const;
     removedAccountId = set.activeAccountId;
     set.accounts = set.accounts.filter(a => a.id !== set.activeAccountId);
     if (set.accounts.length === 0) {
       delete store[provider];
-      return;
+      return "removed" as const;
     }
     set.activeAccountId = set.accounts[0]!.id;
+    return "removed" as const;
   }, [provider]);
-  if (provider === "google-antigravity" && removedAccountId) {
+  if (result === "removed" && provider === "google-antigravity" && removedAccountId) {
     const { clearAntigravityRoutingStateForAccount } = await import("./antigravity-routing");
     clearAntigravityRoutingStateForAccount(removedAccountId);
   }
+  return result;
 }
 
 // ---------------------------------------------------------------------------

package/src/providers/label.ts

@@ -1,4 +1,5 @@
-import { CODEX_ACCOUNT_LOG_LABEL_RE } from "../codex/account-label";
+import { CODEX_ACCOUNT_LOG_LABEL_RE, oauthAccountLogLabel } from "../codex/account-label";
+import type { OcxProviderConfig } from "../types";
 
 export function canonicalUsageProviderLabel(provider: string): string {
   return provider === "chatgpt" || provider === "openai-multi" ? "openai" : provider;
@@ -17,3 +18,35 @@ export function baseProviderLabel(provider: string): string {
   if (suffix === "main") return canonicalUsageProviderLabel(provider.slice(0, cut));
   return CODEX_ACCOUNT_LOG_LABEL_RE.test(suffix) ? canonicalUsageProviderLabel(provider.slice(0, cut)) : provider;
 }
+
+/**
+ * Stamp the per-account usage label for a non-Codex OAuth provider (#2699).
+ *
+ * Call this where the resolved credential is known and NOT inside a failover gate. The obvious
+ * place -- next to the `genericFailoverAccountId` assignment in `core.ts` -- sits inside
+ * `isGenericFailoverProvider`, and the rotation paths additionally require two or more stored
+ * accounts. Stamping there would leave the ordinary case (one xai account, failover off) with no
+ * label at all while every test still passed, which is the bug this fixes rather than a variant
+ * of it.
+ *
+ * Two providers are skipped because they already have attribution:
+ * - `openai` produces its own `p`-labels through `codexAuthContextLogLabel`.
+ * - `anthropic` folds the account into the provider label (`formatAnthropicProviderForLog`).
+ *
+ * It lives here rather than in `account-label.ts` because it needs `baseProviderLabel`, and this
+ * module already imports from that one -- the reverse direction would be an import cycle. This
+ * file stays Lab-clean, which matters because `core.ts` is one of the three files
+ * `tests/core-lab-boundary.test.ts` guards.
+ */
+export function stampOAuthAccountLabel(
+  logCtx: { accountLogLabel?: string },
+  providerName: string,
+  provider: Pick<OcxProviderConfig, "authMode">,
+  accountId: string | undefined,
+): void {
+  if (!accountId) return;
+  if (provider.authMode !== "oauth") return;
+  const base = baseProviderLabel(providerName);
+  if (base === "openai" || base === "anthropic") return;
+  logCtx.accountLogLabel = oauthAccountLogLabel(accountId, base);
+}

package/src/responses/turn-termination.ts

@@ -0,0 +1,107 @@
+import { createHash } from "node:crypto";
+import type { OcxAssistantMessage, OcxMessage, OcxParsedRequest } from "../types";
+
+const DELIVERED_FINAL_ANSWER_TTL_MS = 60 * 60 * 1_000;
+const DELIVERED_FINAL_ANSWER_MAX_ENTRIES = 1_024;
+
+interface DeliveredFinalAnswerRecord {
+  fingerprint: string;
+  createdAt: number;
+}
+
+const scopesByRequest = new WeakMap<OcxParsedRequest, string>();
+const deliveredFinalAnswers = new Map<string, DeliveredFinalAnswerRecord>();
+
+function pruneDeliveredFinalAnswers(at = Date.now()): void {
+  for (const [scope, record] of deliveredFinalAnswers) {
+    if (at - record.createdAt > DELIVERED_FINAL_ANSWER_TTL_MS) deliveredFinalAnswers.delete(scope);
+  }
+  while (deliveredFinalAnswers.size > DELIVERED_FINAL_ANSWER_MAX_ENTRIES) {
+    const oldest = deliveredFinalAnswers.keys().next().value;
+    if (oldest === undefined) break;
+    deliveredFinalAnswers.delete(oldest);
+  }
+}
+
+function textFingerprint(text: string): string {
+  return createHash("sha256").update(text, "utf8").digest("hex");
+}
+
+function assistantText(message: OcxAssistantMessage): string | undefined {
+  if (message.content.some(part => part.type === "toolCall")) return undefined;
+  const text = message.content
+    .filter((part): part is Extract<typeof part, { type: "text" }> => part.type === "text")
+    .map(part => part.text)
+    .join("");
+  return text.trim().length > 0 ? text : undefined;
+}
+
+function deliveredFinalAnswerText(response: unknown): string | undefined {
+  if (!response || typeof response !== "object" || Array.isArray(response)) return undefined;
+  const output = (response as { output?: unknown }).output;
+  if (!Array.isArray(output)) return undefined;
+  for (let i = output.length - 1; i >= 0; i--) {
+    const item = output[i];
+    if (!item || typeof item !== "object" || Array.isArray(item)) continue;
+    const message = item as { type?: unknown; role?: unknown; phase?: unknown; content?: unknown };
+    if (message.type !== "message" || message.role !== "assistant" || message.phase !== "final_answer") continue;
+    if (!Array.isArray(message.content)) return undefined;
+    const text = message.content
+      .filter(part => !!part && typeof part === "object" && !Array.isArray(part)
+        && (part as { type?: unknown }).type === "output_text"
+        && typeof (part as { text?: unknown }).text === "string")
+      .map(part => (part as { text: string }).text)
+      .join("");
+    return text.trim().length > 0 ? text : undefined;
+  }
+  return undefined;
+}
+
+/** Bind the normalized per-conversation digest without adding proxy-private fields to the wire body. */
+export function bindTurnTerminationScope(parsed: OcxParsedRequest, scope: string | undefined): void {
+  // Only the normalized log-conversation digest may key this process-wide map. Refusing any raw
+  // fallback prevents a future caller from retaining a client header or account identifier here.
+  if (!scope || !/^[0-9a-f]{32}$/.test(scope)) return;
+  scopesByRequest.set(parsed, scope);
+}
+
+/** Remember only a final-answer message the proxy actually emitted for this exact conversation. */
+export function rememberDeliveredFinalAnswer(parsed: OcxParsedRequest, response: unknown): void {
+  const scope = scopesByRequest.get(parsed);
+  if (!scope) return;
+  const text = deliveredFinalAnswerText(response);
+  if (!text) return;
+  const at = Date.now();
+  pruneDeliveredFinalAnswers(at);
+  // Refresh insertion order so cap eviction removes the least recently delivered conversation.
+  deliveredFinalAnswers.delete(scope);
+  deliveredFinalAnswers.set(scope, { fingerprint: textFingerprint(text), createdAt: at });
+  pruneDeliveredFinalAnswers(at);
+}
+
+/**
+ * Match only when the delivered assistant answer is still the trailing content-bearing message.
+ * A later user/tool-result message is new work and must reach the provider, even though every
+ * legitimate next turn necessarily contains such a message somewhere in its history.
+ */
+export function hasRecordedTrailingDeliveredFinalAnswer(
+  parsed: OcxParsedRequest,
+  messages: readonly OcxMessage[],
+): boolean {
+  const scope = scopesByRequest.get(parsed);
+  if (!scope) return false;
+  pruneDeliveredFinalAnswers();
+  const record = deliveredFinalAnswers.get(scope);
+  if (!record) return false;
+  for (let i = messages.length - 1; i >= 0; i--) {
+    const message = messages[i];
+    if (message.role !== "assistant") return false;
+    const text = assistantText(message as OcxAssistantMessage);
+    if (text === undefined) {
+      if ((message as OcxAssistantMessage).content.some(part => part.type === "toolCall")) return false;
+      continue;
+    }
+    return textFingerprint(text) === record.fingerprint;
+  }
+  return false;
+}

package/src/server/management/logs-usage-routes.ts

@@ -20,7 +20,7 @@ import {
   submitManualLoginCode,
   upsertOAuthProvider,
 } from "../../oauth";
-import { getAccountSet, removeCredential } from "../../oauth/store";
+import { removeCredential } from "../../oauth/store";
 import { providerDestinationResolvedError } from "../../lib/destination-policy";
 import { enrichProviderFromCatalog, listKeyLoginProviders } from "../../oauth/key-providers";
 import { deriveProviderPresets } from "../../providers/derive";
@@ -31,8 +31,6 @@ import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
 import { clearThreadAccountMap } from "../../codex/routing";
 import { primeCodexPoolQuotas } from "../../codex/auth-api";
 import { DEFAULT_PROVIDER_CONTEXT_CAP, globalContextCapValue, providerContextCap, providerContextCaps, setAllProviderContextCaps, setGlobalContextCapValue, setProviderContextCap } from "../../providers/context-cap";
-import { resolveCodexHomeDir } from "../../codex/home";
-import { scanStorage } from "../../storage/scanner";
 import { executeArchivedCleanup, listTrashEntries, pickWireCleanupTestHooks, previewArchivedCleanup, type CleanupMode, type RestoreErrorCode } from "../../storage/cleanup";
 import { runArchivedCleanupJob } from "../../storage/cleanup-job";
 import { getRestoreTrashTestStreamResponse, runRestoreTrashEntryJob } from "../../storage/restore-job";
@@ -198,16 +196,10 @@ export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Res
     const filter = {
       provider: url.searchParams.get("provider"),
       model: url.searchParams.get("model"),
-      account: url.searchParams.get("account"),
     };
-    const fallbackAccounts: Record<string, string> = {};
-    for (const p of listOAuthProviders()) {
-      const set = getAccountSet(p);
-      if (set && set.accounts.length === 1 && set.activeAccountId) fallbackAccounts[p] = set.activeAccountId;
-    }
     const project = <T extends UsageSummary>(summary: T, entries?: PersistedUsageEntry[]) =>
-      projectUsageSummary(summary, filter, entries, fallbackAccounts);
-    const filterRequested = Boolean(filter.provider ?? filter.model ?? filter.account);
+      projectUsageSummary(summary, filter, entries);
+    const filterRequested = Boolean(filter.provider ?? filter.model);
     const now = Date.now();
     try {
       const cacheKey = `${range}:${surface}`;
@@ -242,7 +234,7 @@ export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Res
       const revisionReadAt = Date.now();
       const window = snapshotWindow(snapshot.entries);
       const summary = {
-        ...summarizeUsage(snapshot.entries, range, now, surface, fallbackAccounts),
+        ...summarizeUsage(snapshot.entries, range, now, surface),
         historyTruncated: snapshot.truncatedPrefixBytes > 0 || snapshot.entriesTruncated,
         truncatedPrefixBytes: snapshot.truncatedPrefixBytes,
         entriesTruncated: snapshot.entriesTruncated,
@@ -270,7 +262,7 @@ export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Res
       for (const nextRange of ranges) {
         for (const nextSurface of surfaces) {
           const nextSummary = nextRange === range && nextSurface === surface ? summary : {
-            ...summarizeUsage(snapshot.entries, nextRange, now, nextSurface, fallbackAccounts),
+            ...summarizeUsage(snapshot.entries, nextRange, now, nextSurface),
             historyTruncated: summary.historyTruncated,
             truncatedPrefixBytes: summary.truncatedPrefixBytes,
             entriesTruncated: summary.entriesTruncated,
@@ -343,20 +335,6 @@ export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Res
     }
   }
 
-  if (url.pathname === "/api/storage" && req.method === "GET") {
-    try {
-      return jsonResponse(scanStorage());
-    } catch {
-      return jsonResponse({
-        codexHome: resolveCodexHomeDir(),
-        generatedAt: Date.now(),
-        total: { bytes: 0, fileCount: 0 },
-        buckets: [],
-        error: "scan_failed",
-      });
-    }
-  }
-
   if (url.pathname === "/api/storage/cleanup/preview" && req.method === "POST") {
     let body: { percent?: unknown };
     try { body = await readManagementJsonBody(req); } catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid_json" }, 400); }