codex-overleaf-link 2.5.0 → 2.5.1

package/native-host/src/processStopBarrier.js

@@ -4,7 +4,7 @@
 // Native Host restarts and only permits work after positive exit evidence.
 const fs = require('node:fs');
 const path = require('node:path');
-const { getProjectMirror } = require('./mirrorWorkspace');
+const { getProjectMirror, getDefaultMirrorRoot } = require('./mirrorWorkspace');
 const pending = new Map();
 
 function location(projectId, rootDir) {
@@ -13,16 +13,23 @@ function location(projectId, rootDir) {
 }
 
 function load(file) {
-  if (pending.has(file)) return pending.get(file);
   let records = [];
   try {
     if (fs.statSync(file).size > 65536) throw new Error('Oversized stop barrier');
     const value = JSON.parse(fs.readFileSync(file, 'utf8'));
     if (!Array.isArray(value) || value.length > 64) throw new Error('Invalid stop barrier');
-    records = value;
+    records = value.map(record => record && typeof record === 'object' ? record : { unknown: true });
   } catch (error) {
     if (error.code !== 'ENOENT') records = [{ unknown: true }];
   }
+  // Other Hosts can publish a barrier while this Host is already alive. Keep
+  // in-memory callbacks and failed writes, but never cache an empty disk read.
+  const key = ({ isStopped, ...record }) => JSON.stringify(record);
+  const merged = new Map(records.map(record => [key(record), record]));
+  for (const record of pending.get(file) || []) {
+    if (typeof record.isStopped === 'function' || record.persistenceFailed) merged.set(key(record), record);
+  }
+  records = Array.from(merged.values());
   pending.set(file, records);
   return records;
 }
@@ -53,13 +60,17 @@ function stopped(record) {
 function record(projectId, rootDir, error) {
   const file = location(projectId, rootDir);
   const records = load(file);
-  records.push({
+  const entry = {
     processId: error.processId, processGroup: error.processGroup === true,
     platform: process.platform, createdAt: new Date().toISOString(),
     isStopped: error.isStopped
-  });
+  };
+  records.push(entry);
   try { persist(file, records); }
-  catch (failure) { error.stopBarrierPersistenceError = failure.message; }
+  catch (failure) {
+    Object.defineProperty(entry, 'persistenceFailed', { value: true });
+    error.stopBarrierPersistenceError = failure.message;
+  }
 }
 
 function isBlocked(projectId, rootDir) {
@@ -76,5 +87,29 @@ function isBlocked(projectId, rootDir) {
   return remaining.length > 0;
 }
 
-module.exports = { record, isBlocked };
+// Update safety observes the existing project quarantine. It neither searches
+// unrelated OS processes nor mutates a project's recovery records.
+function getBlockedProjectCount(rootDir, options = {}) {
+  const root = path.resolve(rootDir || getDefaultMirrorRoot(options));
+  const files = new Set();
+  let unknown = 0;
+  try {
+    for (const entry of fs.readdirSync(root, { withFileTypes: true })) {
+      if (entry.isDirectory()) files.add(path.join(root, entry.name, '.codex-stop-barrier.json'));
+      else if (entry.isSymbolicLink()) unknown += 1;
+    }
+  } catch (error) {
+    if (error.code !== 'ENOENT') unknown += 1;
+  }
+  // Include failed persistence owned by this Host, even if its directory was
+  // never created. A disk inventory alone cannot release that quarantine.
+  for (const file of pending.keys()) {
+    if (path.dirname(path.dirname(file)) === root) files.add(file);
+  }
+  for (const file of files) {
+    if (load(file).some(value => !stopped(value))) unknown += 1;
+  }
+  return unknown;
+}
 
+module.exports = { record, isBlocked, getBlockedProjectCount };

package/native-host/src/projectPathPlatform.js

@@ -0,0 +1,30 @@
+'use strict';
+
+// Canonical project names stay literal. Reject names the local filesystem would
+// reinterpret instead of attempting to escape, trim or rename them.
+function isRepresentableProjectPath(value, platform = process.platform) {
+  if (typeof value !== 'string' || !value) return false;
+  if (platform !== 'win32') return true;
+  return value.split('/').every(part => part && part !== '.' && part !== '..'
+    && part.length <= 255 && !/[<>:"\\|?*\u0000-\u001f]/.test(part) && !/[ .]$/.test(part)
+    && !/^(?:con|prn|aux|nul|conin\$|conout\$|com[1-9¹²³]|lpt[1-9¹²³])(?:\.|$)/i.test(part));
+}
+
+function assertProjectPathsForPlatform(paths, platform = process.platform) {
+  const identities = new Map();
+  for (const value of paths) {
+    let valid = isRepresentableProjectPath(value, platform);
+    if (valid && platform === 'win32') {
+      const parts = value.split('/');
+      for (let index = 1; index <= parts.length; index += 1) {
+        const literal = parts.slice(0, index).join('/'), key = literal.toLowerCase();
+        if (identities.has(key) && identities.get(key) !== literal) valid = false;
+        identities.set(key, literal);
+      }
+    }
+    if (!valid) throw Object.assign(new Error(`Project path cannot be represented faithfully on ${platform}: ${value}`),
+      { code: 'project_path_unrepresentable', path: value });
+  }
+}
+
+module.exports = { isRepresentableProjectPath, assertProjectPathsForPlatform };

package/native-host/src/providerHttp.js

@@ -0,0 +1,80 @@
+'use strict';
+
+const { providerError } = require('./providerProfile');
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+const BODY_HEADERS = ['content-encoding', 'content-language', 'content-location', 'content-type', 'content-length'];
+
+function carriesEndpointCredentials(headers, launch) {
+  const namedHeader = String(launch.apiKeyHeaderName || '').toLowerCase();
+  return [...headers].some(([name, value]) => value && (
+    name === namedHeader
+    || /(?:^|[-_])(?:authorization|auth|api[-_]?key|token|secret|cookie|credential|password|signature)(?:$|[-_])/i.test(name)
+    || launch.apiKey && value.includes(launch.apiKey)
+  ));
+}
+
+// Fetch's method/body redirect rules remain intact. Credentials configured for
+// this endpoint never authorize a request to a different origin.
+async function fetchProvider(url, options, launch = {}) {
+  let current = new URL(url);
+  let method = String(options.method || 'GET').toUpperCase();
+  let body = options.body;
+  const headers = new Headers(options.headers);
+  const credentialed = carriesEndpointCredentials(headers, launch);
+  for (let redirects = 0; ; redirects += 1) {
+    const response = await fetch(current, { ...options, method, body, headers, redirect: 'manual' });
+    const location = response.headers.get('location');
+    if (!REDIRECT_STATUSES.has(response.status) || location === null) return response;
+    await response.body?.cancel().catch(() => {});
+    if (redirects >= 20) throw providerError('provider_upstream_error', 'The provider exceeded the redirect limit.');
+    let next;
+    try { next = new URL(location, current); }
+    catch (_) { throw providerError('provider_upstream_error', 'The provider returned an invalid redirect.'); }
+    if (!['http:', 'https:'].includes(next.protocol) || next.username || next.password) {
+      throw providerError('provider_upstream_error', 'The provider returned an unsupported redirect.');
+    }
+    if (credentialed && next.origin !== current.origin) {
+      throw providerError('provider_upstream_error', 'The provider redirected to a different origin; endpoint credentials were not forwarded.');
+    }
+    if ((response.status === 301 || response.status === 302) && method === 'POST'
+      || response.status === 303 && method !== 'GET' && method !== 'HEAD') {
+      method = 'GET';
+      body = undefined;
+      for (const name of BODY_HEADERS) headers.delete(name);
+    }
+    current = next;
+  }
+}
+
+// Preserve ordinary Response.text()/json() capacity and UTF-8 semantics while
+// reporting each body chunk to the existing idle lifecycle. Compact/SSE limits
+// remain in their own readers; this does not introduce a new response cap.
+async function readProviderText(response, onActivity = () => {}) {
+  if (!response.body) return '';
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder();
+  const chunks = [];
+  let complete = false;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      onActivity();
+      chunks.push(decoder.decode(value, { stream: true }));
+    }
+    complete = true;
+    chunks.push(decoder.decode());
+    return chunks.join('');
+  } finally {
+    if (!complete) await reader.cancel().catch(() => {});
+    reader.releaseLock();
+  }
+}
+
+async function readProviderJson(response, onActivity) {
+  const text = await readProviderText(response, onActivity);
+  try { return JSON.parse(text); }
+  catch (_) { throw providerError('provider_response_invalid', 'The provider returned an invalid JSON response.'); }
+}
+
+module.exports = { fetchProvider, readProviderText, readProviderJson };

package/native-host/src/providerProfile.js

@@ -65,7 +65,8 @@ function normalizeProviderDraft(value = {}) {
     anthropicThinkingMode: normalizeAnthropicThinkingMode(value.anthropicThinkingMode),
     anthropicPromptCaching: value.anthropicPromptCaching === true,
     impersonateClaudeCode: value.impersonateClaudeCode === true,
-    maxOutputTokens: normalizeMaxOutputTokens(value.maxOutputTokens)
+    maxOutputTokens: normalizeMaxOutputTokens(value.maxOutputTokens),
+    outputBudgetVersion: 1
   };
 }
 
@@ -245,6 +246,7 @@ function sanitizeProfile(profile, hasSecret) {
     anthropicPromptCaching: profile.anthropicPromptCaching === true,
     impersonateClaudeCode: profile.impersonateClaudeCode === true,
     maxOutputTokens: normalizeMaxOutputTokens(profile.maxOutputTokens),
+    outputBudgetVersion: 1,
     hasSecret: Boolean(hasSecret),
     secretUpdatedAt: profile.secretUpdatedAt || 0,
     endpointDisclosureHost: profile.endpointDisclosureHost || '',
@@ -419,7 +421,7 @@ function normalizeUpstreamResponseMode(value, allowAuto) {
 
 function normalizeMaxOutputTokens(value) {
   const number = Number(value);
-  if (!Number.isFinite(number) || number === 8192 || number === 32768) return 65536;
+  if (!Number.isFinite(number)) return 65536;
   return Math.min(65536, Math.max(256, Math.floor(number)));
 }
 

package/native-host/src/providerReasoning.js

@@ -13,7 +13,6 @@ const REASONING_ADAPTERS = new Set([
 ]);
 const REASONING_CAPABILITIES = new Set(['auto', 'none', 'toggle', 'effort']);
 const REASONING_EFFORTS = new Set(['none', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max']);
-const DEEPSEEK_MAX_REASONING_OUTPUT_TOKENS = 65536;
 
 function normalizeReasoningAdapter(value) {
   const normalized = String(value || '').trim().toLowerCase();
@@ -165,12 +164,8 @@ function resolveReasoningMaxOutputTokens(value, responsesRequest = {}, launch =
   if (!Number.isFinite(number)) {
     return value;
   }
-  const normalized = Math.max(1, Math.floor(number));
-  const effort = resolveRequestedReasoningEffort(responsesRequest, launch);
-  const adapter = resolveReasoningAdapter(launch, modelId || launch.modelId);
-  return adapter === 'deepseek' && ['xhigh', 'max'].includes(effort)
-    ? Math.max(normalized, DEEPSEEK_MAX_REASONING_OUTPUT_TOKENS)
-    : normalized;
+  // Reasoning effort cannot silently increase the configured output maximum.
+  return Math.max(1, Math.floor(number));
 }
 
 function requiresReasoningContentReplay(launch = {}, modelId = '') {

package/native-host/src/providerRuntime.js

@@ -92,6 +92,7 @@ async function testProvider(params, env, emit = () => {}, externalSignal = null)
   }, totalBudgetMs);
   const onExternalAbort = () => controller.abort();
   externalSignal?.addEventListener?.('abort', onExternalAbort, { once: true });
+  if (externalSignal?.aborted) onExternalAbort();
   activeTests.get(operationId)?.abort?.();
   activeTests.set(operationId, controller);
   const protocols = draft.wireApiPreference === 'auto'

package/native-host/src/providerStore.js

@@ -4,6 +4,7 @@ const crypto = require('node:crypto');
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
+const { isDeepStrictEqual } = require('node:util');
 const {
   computeConnectionFingerprint,
   computeDraftFingerprint,
@@ -16,6 +17,9 @@ const {
 } = require('./providerProfile');
 
 const SCHEMA_VERSION = 1;
+const STORE_FILE_MAX_BYTES = 1024 * 1024;
+// A compact journal contains two bounded Store files plus revision/schema keys.
+const STORE_TRANSACTION_MAX_BYTES = 2 * STORE_FILE_MAX_BYTES + 1024;
 const STORE_LOCK_TIMEOUT_MS = 2500;
 const STORE_LOCK_STALE_MS = 30000;
 const STORE_LOCK_RETRY_MS = 25;
@@ -357,6 +361,7 @@ function loadProviderStateUnlocked(env = process.env) {
     : [];
   return {
     paths,
+    stored: { public: publicStore, secrets: secretStore },
     public: {
       schemaVersion: SCHEMA_VERSION,
       storeRevision: normalizeRevision(publicStore.storeRevision),
@@ -373,23 +378,35 @@ function loadProviderStateUnlocked(env = process.env) {
 
 function commitProviderState(previous, next) {
   const revision = previous.public.storeRevision + 1;
-  const nextPublic = { ...next.public, schemaVersion: SCHEMA_VERSION, storeRevision: revision };
-  const nextSecrets = { ...next.secrets, schemaVersion: SCHEMA_VERSION, storeRevision: revision };
+  const previousPublic = previous.stored.public;
+  const previousSecrets = previous.stored.secrets;
+  const nextPublic = { ...mergeStoredChanges(previousPublic, previous.public, next.public), schemaVersion: SCHEMA_VERSION, storeRevision: revision };
+  const nextSecrets = { ...mergeStoredChanges(previousSecrets, previous.secrets, next.secrets), schemaVersion: SCHEMA_VERSION, storeRevision: revision };
+  const compactPublic = Buffer.byteLength(`${JSON.stringify(previousPublic, null, 2)}\n`) > STORE_FILE_MAX_BYTES;
+  const compactSecrets = Buffer.byteLength(`${JSON.stringify(previousSecrets, null, 2)}\n`) > STORE_FILE_MAX_BYTES;
   const journal = {
     schemaVersion: SCHEMA_VERSION,
     nextRevision: revision,
-    previousPublic: previous.public,
-    previousSecrets: previous.secrets
+    previousPublic,
+    previousSecrets,
+    compactPublic,
+    compactSecrets
   };
+  // Validate every write, including rollback copies, before replacing any file.
+  serializeStoreJson(previous.paths.publicFile, nextPublic, compactPublic);
+  serializeStoreJson(previous.paths.secretFile, nextSecrets, compactSecrets);
+  serializeStoreJson(previous.paths.publicFile, previousPublic, compactPublic);
+  serializeStoreJson(previous.paths.secretFile, previousSecrets, compactSecrets);
+  serializeStoreJson(previous.paths.transactionFile, journal);
   atomicWriteJson(previous.paths.transactionFile, journal);
   try {
-    atomicWriteJson(previous.paths.secretFile, nextSecrets);
-    atomicWriteJson(previous.paths.publicFile, nextPublic);
+    atomicWriteJson(previous.paths.secretFile, nextSecrets, compactSecrets);
+    atomicWriteJson(previous.paths.publicFile, nextPublic, compactPublic);
     fs.rmSync(previous.paths.transactionFile, { force: true });
   } catch (error) {
     try {
-      atomicWriteJson(previous.paths.secretFile, previous.secrets);
-      atomicWriteJson(previous.paths.publicFile, previous.public);
+      atomicWriteJson(previous.paths.secretFile, previousSecrets, compactSecrets);
+      atomicWriteJson(previous.paths.publicFile, previousPublic, compactPublic);
       fs.rmSync(previous.paths.transactionFile, { force: true });
     } catch (_restoreError) {
       // The journal remains the recovery source on the next Native Host start.
@@ -398,6 +415,26 @@ function commitProviderState(previous, next) {
   }
 }
 
+function mergeStoredChanges(stored, before, after) {
+  if (isDeepStrictEqual(before, after)) return stored;
+  if (!stored || !before || !after || typeof stored !== 'object' || typeof before !== 'object' || typeof after !== 'object') return after;
+  if (Array.isArray(before) || Array.isArray(after)) {
+    // Profiles and models carry stable IDs; changed membership must not persist
+    // normalization defaults into unrelated records at the storage boundary.
+    if (!Array.isArray(stored) || !Array.isArray(before) || !Array.isArray(after)
+      || [...before, ...after].some(item => !item?.id)) return after;
+    const oldById = new Map(before.map(item => [item.id, item]));
+    const storedById = new Map(stored.map(item => [typeof item === 'string' ? item : item?.id, item]));
+    return after.map(item => mergeStoredChanges(storedById.get(item.id), oldById.get(item.id), item));
+  }
+  const result = { ...stored };
+  for (const key of new Set([...Object.keys(before), ...Object.keys(after)])) {
+    if (!Object.prototype.hasOwnProperty.call(after, key)) delete result[key];
+    else if (!isDeepStrictEqual(before[key], after[key])) result[key] = mergeStoredChanges(stored[key], before[key], after[key]);
+  }
+  return result;
+}
+
 function recoverInterruptedTransaction(paths) {
   if (!fs.existsSync(paths.transactionFile)) {
     return;
@@ -412,8 +449,10 @@ function recoverInterruptedTransaction(paths) {
     fs.rmSync(paths.transactionFile, { force: true });
     return;
   }
-  atomicWriteJson(paths.secretFile, journal.previousSecrets);
-  atomicWriteJson(paths.publicFile, journal.previousPublic);
+  serializeStoreJson(paths.secretFile, journal.previousSecrets, journal.compactSecrets === true);
+  serializeStoreJson(paths.publicFile, journal.previousPublic, journal.compactPublic === true);
+  atomicWriteJson(paths.secretFile, journal.previousSecrets, journal.compactSecrets === true);
+  atomicWriteJson(paths.publicFile, journal.previousPublic, journal.compactPublic === true);
   fs.rmSync(paths.transactionFile, { force: true });
 }
 
@@ -502,11 +541,16 @@ function normalizeStoredProfile(value) {
   if (!value || typeof value !== 'object' || !normalizeId(value.id)) {
     throw providerError('provider_store_corrupt', 'Provider store contains an invalid profile.');
   }
-  const normalized = normalizeProviderDraft(value);
+  const legacyOutputBudget = value.outputBudgetVersion !== 1
+    && [8192, 32768].includes(Number(value.maxOutputTokens));
+  const normalized = normalizeProviderDraft(legacyOutputBudget ? { ...value, maxOutputTokens: 65536 } : value);
   return {
     id: normalizeId(value.id),
     revision: Math.max(1, normalizeRevision(value.revision)),
     ...normalized,
+    // Keep the old provenance until an explicit upsert persists the new value.
+    // Unrelated mutations must not mark an unmigrated raw record as current.
+    outputBudgetVersion: value.outputBudgetVersion === 1 ? 1 : 0,
     resolvedWireApi: isResolvedWireApi(value.resolvedWireApi) ? value.resolvedWireApi : '',
     endpointDisclosureHost: String(value.endpointDisclosureHost || ''),
     endpointDisclosureBaseUrl: String(value.endpointDisclosureBaseUrl || ''),
@@ -634,11 +678,12 @@ function ensurePrivateDirectory(directory) {
   }
 }
 
-function atomicWriteJson(target, value) {
+function atomicWriteJson(target, value, compact = false) {
+  const serialized = serializeStoreJson(target, value, compact);
   const temp = `${target}.tmp-${process.pid}-${Date.now()}-${crypto.randomBytes(4).toString('hex')}`;
   const fd = fs.openSync(temp, 'w', 0o600);
   try {
-    fs.writeFileSync(fd, `${JSON.stringify(value, null, 2)}\n`, 'utf8');
+    fs.writeFileSync(fd, serialized, 'utf8');
     fs.fsyncSync(fd);
   } finally {
     fs.closeSync(fd);
@@ -649,13 +694,26 @@ function atomicWriteJson(target, value) {
   fs.renameSync(temp, target);
 }
 
+function getStoreFileMaxBytes(target) {
+  return path.basename(target) === 'provider-transaction.json' ? STORE_TRANSACTION_MAX_BYTES : STORE_FILE_MAX_BYTES;
+}
+
+function serializeStoreJson(target, value, compact = false) {
+  const serialized = `${JSON.stringify(value, null, compact || path.basename(target) === 'provider-transaction.json' ? undefined : 2)}\n`;
+  const maxBytes = getStoreFileMaxBytes(target);
+  if (Buffer.byteLength(serialized, 'utf8') > maxBytes) {
+    throw providerError('provider_store_too_large', `Provider settings exceed the ${maxBytes}-byte limit for ${path.basename(target)}. Reduce the configuration and retry.`);
+  }
+  return serialized;
+}
+
 function readJson(target, fallback) {
   if (!fs.existsSync(target)) {
     return fallback;
   }
   try {
     const stat = fs.statSync(target);
-    if (!stat.isFile() || stat.size > 1024 * 1024) {
+    if (!stat.isFile() || stat.size > getStoreFileMaxBytes(target)) {
       throw new Error('invalid provider store file');
     }
     return JSON.parse(fs.readFileSync(target, 'utf8'));