@yansigit/opencodex 2.36.1 → 2.36.2-dev.20260829.53

package/src/server/responses/fetch-helpers.ts

@@ -11,6 +11,8 @@ import type { WsData } from "../ws-bridge";
 import { waitForProviderRequestSlot } from "../../providers/request-pacing";
 import { withUpstreamHttpVersion } from "../../lib/upstream-http-version";
 import { providerTlsFetch } from "../../lib/provider-tls-profile";
+import { testProviderFetch } from "../../lib/test-provider-fetch";
+import { runtimeProviderFetch } from "../../lib/provider-runtime-fetch";
 
 export { withUpstreamHttpVersion };
 
@@ -58,6 +60,8 @@ export interface ProviderFetchOptions {
   modelId?: string;
   /** One pacing slot was acquired immediately before this fetch wrapper was created. */
   pacingSlotAcquired?: boolean;
+  /** Explicit test/integration executor; never read from serialized provider config. */
+  fetch?: typeof globalThis.fetch;
 }
 
 export function providerFetch(
@@ -65,7 +69,7 @@ export function providerFetch(
   runtime: BunRuntimeGateInput = currentBunRuntimeIdentity(),
   options: ProviderFetchOptions = {},
 ): ProviderFetch {
-  const base = (provider as OcxProviderConfig & { fetch?: typeof globalThis.fetch }).fetch ?? globalThis.fetch;
+  const base = options.fetch ?? testProviderFetch(provider) ?? runtimeProviderFetch(provider, options.providerName) ?? globalThis.fetch;
   const preconnect = (...args: Parameters<typeof globalThis.fetch.preconnect>): void => {
     base.preconnect?.(...args);
   };
@@ -126,7 +130,7 @@ export async function fetchWithHeaderTimeout(
   timeoutMs: number,
   preferIdentityEncoding = false,
   executor: typeof globalThis.fetch = globalThis.fetch,
-  manualRedirect = false,
+  _manualRedirect = true,
 ): Promise<Response> {
   const pacing = executor as ProviderFetch;
   await pacing.waitForPacing?.(abortSignal);
@@ -142,16 +146,20 @@ export async function fetchWithHeaderTimeout(
     headers.set("accept-encoding", "identity");
   }
   try {
-    return await fetchExecutor(url, {
+    const response = await fetchExecutor(url, {
       ...init,
       headers,
-      // Credential-bearing sends opt into manual redirects so a 3xx is relayed
-      // as a Response instead of being followed into a rejection that is
-      // indistinguishable from a pre-connection failure (#914).
-      ...(manualRedirect ? { redirect: "manual" as const } : {}),
+      // Upstream URLs are configuration, not navigation. Refuse every redirect
+      // so POST bodies and provider headers are never replayed to another hop.
+      redirect: "manual",
       signal: AbortSignal.any([abortSignal, timeout.signal]),
       timeout: 0,
     });
+    if (response.status >= 300 && response.status < 400) {
+      try { await response.body?.cancel(); } catch { /* ignore cancellation failures */ }
+      throw new Error(`upstream returned ${response.status} redirect; configure the final upstream URL directly`);
+    }
+    return response;
   } finally {
     clearTimeout(timer);
   }

package/src/server/ws-bridge.ts

@@ -54,6 +54,8 @@ export interface WsData {
   /** Turn/account ownership retained for the complete sideband socket lifetime. */
   liveTurnAdmissionLease?: AdmissionLease;
   admissionLease?: AdmissionReservation<ServerWebSocket<WsData>>;
+  wsDrain?: () => void;
+  wsDrainWaiter?: { resolve: () => void };
 }
 
 /**
@@ -155,6 +157,18 @@ export function sendTextFrame(ws: ServerWebSocket<WsData>, payload: string): voi
   // Bun returns -1 when queued with backpressure. That is accepted; a later 0 is the hard failure.
 }
 
+async function sendTextFrameWithDrain(ws: ServerWebSocket<WsData>, payload: string): Promise<void> {
+  if (ws.readyState !== OPEN) throw new WsSendDroppedError();
+  const result = ws.send(payload);
+  if (result === 0) throw new WsSendDroppedError();
+  if (result === -1) {
+    await new Promise<void>(resolve => {
+      ws.data.wsDrainWaiter = { resolve };
+    });
+    if (ws.readyState !== OPEN) throw new WsSendDroppedError();
+  }
+}
+
 export function sendJsonFrame(ws: ServerWebSocket<WsData>, payload: Record<string, unknown>): void {
   sendTextFrame(ws, JSON.stringify(payload));
 }
@@ -222,6 +236,7 @@ export async function pumpResponsesSseToWebSocket(
   sseStream: ReadableStream<Uint8Array>,
   options: {
     isCurrent?: () => boolean;
+    abortSignal?: AbortSignal;
     onTerminal?: ResponsesTerminalReporter;
     onSsePayload?: ResponsesPayloadObserver;
   } = {},
@@ -237,15 +252,22 @@ export async function pumpResponsesSseToWebSocket(
   };
   const cancel = () => {
     clientCancelled = true;
+    ws.data.wsDrain?.();
     void reader.cancel().catch(() => {});
   };
+  const drain = () => {
+    ws.data.wsDrainWaiter?.resolve();
+    ws.data.wsDrainWaiter = undefined;
+  };
+  ws.data.wsDrain = drain;
   ws.data.cancel = cancel;
+  options.abortSignal?.addEventListener("abort", cancel, { once: true });
 
   const decoder = new TextDecoder();
   const framer = new BoundedSseFrameBuffer();
   let terminalSeen = false;
 
-  const handlePayload = (payload: string): boolean => {
+  const handlePayload = async (payload: string): Promise<boolean> => {
     if (!isCurrent()) return true;
     if (payload === "[DONE]") return false;
     try {
@@ -262,7 +284,7 @@ export async function pumpResponsesSseToWebSocket(
       return true;
     }
     if (terminalSeen) return true;
-    sendTextFrame(ws, payload);
+    await sendTextFrameWithDrain(ws, payload);
     const terminalStatus = terminalStatusFromType(type);
     if (terminalStatus) {
       reportTerminal(terminalStatus);
@@ -279,13 +301,13 @@ export async function pumpResponsesSseToWebSocket(
       if (done) break;
       for (const frame of framer.feed(value)) {
         const payload = parseSseBlock(decoder.decode(frame.block));
-        if (payload && handlePayload(payload)) break;
+        if (payload && await handlePayload(payload)) break;
       }
     }
     const tail = framer.finish();
     if (!terminalSeen && tail.byteLength > 0) {
       const payload = parseSseBlock(decoder.decode(tail));
-      if (payload) handlePayload(payload);
+      if (payload) await handlePayload(payload);
     }
     if (!terminalSeen && isCurrent() && !clientCancelled) {
       reportTerminal("incomplete");
@@ -314,6 +336,10 @@ export async function pumpResponsesSseToWebSocket(
     // release the reader, even when terminal/send paths already cancelled it.
     void reader.cancel().catch(() => {});
     if (ws.data.cancel === cancel) ws.data.cancel = undefined;
+    if (ws.data.wsDrain === drain) ws.data.wsDrain = undefined;
+    options.abortSignal?.removeEventListener("abort", cancel);
+    ws.data.wsDrainWaiter?.resolve();
+    ws.data.wsDrainWaiter = undefined;
   }
 }
 
@@ -363,6 +389,7 @@ export async function sendResponseToWebSocket(
   options: {
     onTerminal?: ResponsesTerminalReporter;
     onSsePayload?: ResponsesPayloadObserver;
+    abortSignal?: AbortSignal;
   } = {},
 ): Promise<void> {
   if (!isCurrent()) {
@@ -391,6 +418,7 @@ export async function sendResponseToWebSocket(
   if (contentType.includes("text/event-stream")) {
     await pumpResponsesSseToWebSocket(ws, response.body, {
       isCurrent,
+      abortSignal: options.abortSignal,
       onTerminal: options.onTerminal,
       onSsePayload: options.onSsePayload,
     });
@@ -413,6 +441,7 @@ export async function sendResponseToWebSocket(
   if (looksLikeSse(prefix)) {
     await pumpResponsesSseToWebSocket(ws, stream, {
       isCurrent,
+      abortSignal: options.abortSignal,
       onTerminal: options.onTerminal,
       onSsePayload: options.onSsePayload,
     });

package/src/service.ts

@@ -3400,6 +3400,9 @@ export type ServiceCommandPlan =
   | { ok: true; parsed: ParsedServiceArgs; command: string }
   | { ok: false; message: string };
 
+const SERVICE_SUBCOMMANDS = new Set(["install", "repair", "start", "stop", "status", "uninstall", "remove"]);
+const SERVICE_USAGE = "Usage: ocx service [install|repair|restart|start|stop|status|uninstall|remove] [--native|--scheduler]";
+
 export function planServiceCommand(
   args: string[],
   options: { platform?: NodeJS.Platform; probeInstallation?: () => ServiceInstallationProbe } = {},
@@ -3408,6 +3411,12 @@ export function planServiceCommand(
   if (parsed.invalid.length > 0) {
     return { ok: false, message: `Unknown service option: ${parsed.invalid.join(" ")}` };
   }
+  // Validate the requested action before touching platform probes. In a Linux
+  // test container (and on a host without systemd), invalid CLI input must
+  // report usage rather than an unrelated service-manager capability error.
+  if (!SERVICE_SUBCOMMANDS.has(parsed.sub)) {
+    return { ok: false, message: SERVICE_USAGE };
+  }
   if (parsed.backend && parsed.sub !== "install") {
     return { ok: false, message: "--native/--scheduler apply to `ocx service install` only; other subcommands use the installed backend." };
   }
@@ -3603,7 +3612,7 @@ export async function serviceCommand(...args: (string | undefined)[]): Promise<v
       console.log("✅ service uninstalled.");
       break;
     default:
-      console.error("Usage: ocx service [install|repair|restart|start|stop|status|uninstall|remove] [--native|--scheduler]");
+      console.error(SERVICE_USAGE);
       console.error("       With no subcommand, installs when absent or repairs/restarts an existing service.");
       console.error("       repair: refresh assets and restart an already-installed service (no admin re-prompt).");
       console.error("       restart: alias of repair.");

package/src/types/config.ts

@@ -260,6 +260,13 @@ export interface OcxConfigRebaseProvenance {
   deletedTopLevelKeys: string[];
 }
 
+export interface OcxServerTlsConfig {
+  certFile: string;
+  keyFile: string;
+  /** Exact externally reachable HTTPS origin; paths, query strings, fragments, and credentials are rejected. */
+  publicOrigin: string;
+}
+
 export interface OcxConfig {
   port: number;
   autonomousRemediation?: {
@@ -512,6 +519,8 @@ export interface OcxConfig {
   contextCapValue?: number;
   /** Bind hostname. Default "127.0.0.1" (loopback only). Set "0.0.0.0" to expose on all interfaces. */
   hostname?: string;
+  /** Native Bun TLS for the public listener. Required for non-loopback binds. */
+  tls?: OcxServerTlsConfig;
   /**
    * Optional second listener bound to 127.0.0.1 that admits data-plane requests without a
    * credential (issue #1102).

package/src/types/provider.ts

@@ -568,6 +568,8 @@ export interface OcxProviderConfig {
    * before any response bytes are relayed, so the replay is lossless.
    */
   retryOn429?: RateLimitRetryPolicy;
+  /** Opt in to replaying transient upstream 5xx responses (at most three total sends). */
+  replayTransientFailures?: boolean;
   /**
    * Model ids whose OpenAI-compatible chat endpoint accepts `reasoning_split: true` and returns
    * thinking separately in `reasoning_content` / `reasoning_details` instead of visible content.

package/src/types.ts

@@ -67,6 +67,7 @@ export type {
   OcxClientIntegrationsConfig,
   OcxSubagentRole,
   OcxConfigRebaseProvenance,
+  OcxServerTlsConfig,
   OcxConfig,
   OcxAccountPoolRotationStrategy,
   OcxComboStrategy,