create-walle 0.10.2 → 0.10.3

package/template/coding-task-manager/oauth-proxy.js

@@ -60,6 +60,7 @@ const { budgetRefusalResponse } = require('./lib/model-proxy/budget-response');
 const { applyWorkerFinalization, minimumOutputForRequest } = require('./lib/model-proxy/worker-finalization');
 const routes = require('./lib/model-proxy/routes');
 const tokens = require('./lib/model-proxy/tokens');
+const { handleLeadTokenRegistration: _handleLeadTokenRegistration } = require('./lib/model-proxy/lead-token-admin');
 const leadWorkerPicks = require('./lib/model-proxy/lead-worker-picks');
 const anthropicFace = require('./lib/model-proxy/anthropic-face');
 const responsesFace = require('./lib/model-proxy/responses-face');
@@ -69,15 +70,23 @@ const nativeEndpoint = require('./lib/native-lead-endpoint');
 const nativeForwarder = require('./lib/model-proxy/native-claude-forwarder');
 const { createNativeLeadListener, wrapHttpServerClose } = require('./lib/model-proxy/native-lead-listener');
 const { getDataDir } = require('./lib/data-dir');
+// WP-9 §9b L-1 (docs/deepseek-harness-acp-agent-2026-10-28.html D-19): the per-request usage writer for
+// a dsh lead token. ACP carries no token counts, so the proxy appends one contract row per completed
+// request to <dataDir>/dsh-usage/<ctmSessionId>.jsonl.
+const { appendDshUsageRow } = require('./lib/acp/dsh-usage-log');
 const { validateLeadWorkerTarget, safeRefusalReason } = require('./lib/model-proxy/lead-request-validation');
 const { buildCodexModelsResponse } = require('./lib/harness-model-profile');
+const { normalizeHistoricalAdditionalTools } = require('./lib/model-proxy/historical-tool-declarations');
 const legacyRelay = require('./lib/model-proxy/legacy-relay');
 const streamAccountingMod = require('./lib/model-proxy/stream-accounting');
 const instanceRecord = require('./lib/model-proxy/proxy-instance-record');
 const handoff = require('./lib/model-proxy/handoff');
 const {
-  unsupportedSafeguards, logReviewDiagnostic,
+  unsupportedSafeguards, logReviewDiagnostic, requestClassFromHeaders, serverReviewAsked,
 } = require('./lib/model-proxy/auto-mode-review');
+const {
+  refusalEntry, clientVersion, scopeVerification, warnIfUnverified,
+} = require('./lib/model-proxy/refusal-scope');
 
 const PORT = parseInt(process.env.OAUTH_PROXY_PORT || '3459', 10);
 const HOST = '127.0.0.1';
@@ -451,11 +460,21 @@ async function _handleAdmin(req, res, pathName, ctx) {
       res.end(JSON.stringify({ error: 'model_required' }));
       return;
     }
+    // WP-1b (§12a rule 1): an optional `face` names the harness whose wire the probe must dial. The
+    // set is closed (`anthropic`, `responses`, or absent = the legacy preference order); anything
+    // else is a caller bug, not a probe, so it is answered 400 rather than silently probed on a
+    // wire the caller did not ask for.
+    const face = body.face;
+    if (face !== undefined && face !== null && face !== 'anthropic' && face !== 'responses') {
+      res.writeHead(400, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'invalid_face' }));
+      return;
+    }
     const requestedTimeout = Number(body.timeoutMs);
     const timeoutMs = Number.isFinite(requestedTimeout) && requestedTimeout > 0
       ? Math.min(requestedTimeout, generationProbe.MAX_TIMEOUT_MS)
       : generationProbe.DEFAULT_TIMEOUT_MS;
-    const result = await generationProbe.probeGeneration(route, { model: body.model, timeoutMs });
+    const result = await generationProbe.probeGeneration(route, { model: body.model, timeoutMs, face: face == null ? undefined : face });
     res.writeHead(200, { 'Content-Type': 'application/json' });
     res.end(JSON.stringify(result));
     return;
@@ -489,6 +508,9 @@ async function _handleAdmin(req, res, pathName, ctx) {
         nativeTransport: body.nativeTransport,
         nativeCertFingerprint: body.nativeCertFingerprint,
         nativeSettingsRef: body.nativeSettingsRef,
+        // WP-9 §9b L-2: the OPTIONAL per-request usage mark. It is not secret and not an identity
+        // credential of its own — it only tells this proxy to append usage rows for the token's session.
+        usageLog: body.usageLog,
       };
       return _handleLeadTokenRegistration(res, registration, ctx);
     }
@@ -559,111 +581,6 @@ async function _handleAdmin(req, res, pathName, ctx) {
   res.end(JSON.stringify({ error: 'not_found' }));
 }
 
-// ── WP-1 §6.4/§6.5: the TLS-ready acknowledgment of an mtls-v1 registration ─────────────────────
-//
-// A legacy (or routed-primary) registration is unchanged: it is synchronous, creates no listener and
-// never loads the CA. An `mtls-v1` registration is the one thing that starts this transport, and it is
-// acknowledged ONLY once BOTH of these are true:
-//
-//   1. the strict HTTPS listener is bound and ready, and
-//   2. the pending registration has committed against the live registry.
-//
-// The order matters, and so does the ticket. Between "the registration is well formed" and "the
-// listener is ready" the caller is awaiting, which is exactly when a `DELETE /_admin/tokens` can land:
-// a plain revalidation would still see the token as absent (it was never live) and commit a grant the
-// caller already gave up on. The registry-owned ticket fences that operation, so commit refuses with a
-// bounded code and no token is created. A failed bind cancels the ticket and leaves no grant either.
-//
-// Review item 3 adds the OTHER half of that window: the caller can also simply GO AWAY. The supervisor's
-// admin fetch has a 2s budget, and the child's TLS bind can outlive it — so an interrupted registration
-// must not leave a live owner behind that the parent never learned about. The response is therefore
-// watched from BEFORE the await (a `res.close` listener installed up front, not after the fact), the
-// ticket is cancelled the moment the response can no longer be written, and the commit is guarded by a
-// re-check on both sides of the await. Nothing is ever written to a closed response.
-function _responseIsGone(res) {
-  if (!res) return true;
-  if (res.writableEnded) return true; // we already answered
-  if (res.destroyed) return true; // the socket went away
-  return false;
-}
-
-async function _handleLeadTokenRegistration(res, registration, ctx) {
-  const sendJson = (status, payload) => {
-    // Never write on a response whose client is gone: a torn-down socket has no reader, and writing
-    // would surface as an unhandled error rather than as the honest "this registration was abandoned".
-    if (_responseIsGone(res)) return;
-    res.writeHead(status, { 'Content-Type': 'application/json' });
-    res.end(JSON.stringify(payload));
-  };
-  if (registration.nativeTransport !== tokens.NATIVE_TRANSPORT_MTLS) {
-    // Existing synchronous contract, byte-for-byte: no listener, no CA, no await.
-    try {
-      const result = tokens.registerLeadToken(registration);
-      sendJson(200, { token: result.token });
-    } catch (err) {
-      sendJson(400, { error: err.message });
-    }
-    return;
-  }
-  let ticket;
-  try {
-    // Validated, conflict-checked read-only against the live registry, and captured BEFORE the first
-    // await: the caller's own object cannot change what commits, a malformed OR already-conflicting
-    // registration never reaches the listener (no CA load, no bind), and the ticket exists before any
-    // await can be interrupted.
-    ticket = tokens.beginLeadTokenRegistration(registration);
-  } catch (err) {
-    sendJson(400, { error: err.message });
-    return;
-  }
-  let settled = false;
-  const cancelOwnTicket = () => {
-    if (settled) return;
-    settled = true;
-    ticket.cancel();
-  };
-  // Installed BEFORE the await, so a disconnect that happens while the listener is still binding is
-  // observed rather than discovered later as an orphaned owner.
-  const onClientGone = () => {
-    if (!res.writableEnded) cancelOwnTicket();
-  };
-  res.on('close', onClientGone);
-  try {
-    // Entry check: a caller that vanished before we even started has already given up on this attempt.
-    if (_responseIsGone(res)) return;
-    // This server's OWN controller, never another live server's.
-    if (!ctx.nativeListener) {
-      cancelOwnTicket();
-      sendJson(503, { error: 'native_lead_listener_unavailable' });
-      return;
-    }
-    await ctx.nativeListener.ensureReady();
-    // Re-check after the await: the interruption window is exactly the one the ticket exists for.
-    if (_responseIsGone(res)) return;
-    // The commit is synchronous and happens while the response is still writable, so the ticket is
-    // retired from the cancellation path here: from this point the grant is real and the only remaining
-    // hazard is a LOST acknowledgment, which the caller (the supervisor) owns via its pending-revoke
-    // obligation — the child cannot distinguish "the parent read it" from "the parent timed out".
-    settled = true;
-    const committed = ticket.commit();
-    if (!committed.ok) {
-      // A revoke/reset/cancel landed while the listener was starting, or the live revalidation found a
-      // concurrent owner: no grant, and the caller is told why by bounded code only.
-      sendJson(409, { error: committed.code });
-      return;
-    }
-    sendJson(200, { token: committed.token });
-  } catch (err) {
-    cancelOwnTicket();
-    sendJson(503, { error: (err && err.code) || 'native_lead_listener_unavailable' });
-  } finally {
-    // The response is no longer ours to reason about, so the listener and any unsettled ticket are
-    // released here. An already-committed ticket is untouched (cancel() only moves a PENDING ticket).
-    res.removeListener('close', onClientGone);
-    cancelOwnTicket();
-  }
-}
-
 // ── D-2 client faces: /r/<alias>/v1/... ────────────────────────────────
 function _selectFaceModule(pathSuffix) {
   // /v1/models is answered by the Responses face only (Codex's pre-turn probe,
@@ -1011,6 +928,23 @@ async function _handleRouted(req, res, pathName, trusted = null, ctx = null) {
         rawBody,
         telemetry,
       }, context);
+      // WP-0 (docs/auto-mode-native-lead-subagent-latch-2026-10-30.html §8): the native-lead lane had no
+      // observation line at all, so a lead could keep asking for the server-side review with nothing to
+      // see. ONE request-side line per generation POST, built only from the client's own headers and the
+      // body it already parsed -- never a second parse, a prompt, a token or a model. Results/completion
+      // stay 'unobserved': this line is the request, not a claim about the response. It must never throw,
+      // so a null body and a 0 status (an aborted dial) are both fine -- the builder bounds them.
+      if (endpoint === 'generation' && req.method === 'POST') {
+        logReviewDiagnostic({
+          pathKind: 'native-lead',
+          transport: 'native',
+          status: telemetry.status,
+          results: 'unobserved',
+          completion: 'unobserved',
+          requestClass: requestClassFromHeaders(req.headers),
+          review: serverReviewAsked(parsedBody, req.headers) ? 'requested' : 'not_requested',
+        });
+      }
       _logProxyRequest(alias, (parsedBody && parsedBody.model) || '-', telemetry);
       return;
     }
@@ -1159,29 +1093,59 @@ async function _handleRouted(req, res, pathName, trusted = null, ctx = null) {
     faceModule.writeJson(res, 403, faceModule.errorEnvelope(bindingCheck.code, bindingCheck.code));
     return;
   }
-  // D-2: the client's own top-level `safeguards` request can only be answered by a
-  // server-side review. When CTM itself is translating this POST /v1/messages to a chat
-  // wire, say so with the documented 400 instead of dropping the field and paying for a
-  // generation the client did not ask for. Native (passthrough), count_tokens, Responses
-  // and unknown paths keep their previous behaviour; no provider call or budget
-  // reservation happens on this path.
+  const trustedRoutedCodexLead = endpoint === 'generation' && !workerSwap.swapped
+    && requestHarness === 'codex-cli'
+    && leadBinding?.purpose === 'routed-primary' && leadBinding.harness === 'codex-cli'
+    && faceModule === responsesFace;
+  if (trustedRoutedCodexLead) {
+    const normalized = normalizeHistoricalAdditionalTools(parsedBody, { trustedRoutedCodexLead: true });
+    if (!normalized.ok) {
+      detachOwnListeners();
+      invalidLeadRequest(normalized.reason);
+      return;
+    }
+    if (normalized.removedCount > 0) {
+      parsedBody = normalized.body;
+      rawBody = Buffer.from(JSON.stringify(parsedBody));
+    }
+  }
+  // D-2: the client's own top-level `safeguards` (or dangerous-tool-use beta) request can
+  // only be answered by a server-side review. When CTM itself is translating this
+  // POST /v1/messages to a chat wire, say so with the documented 400 instead of dropping
+  // the field and paying for a generation the client did not ask for. The wording is the
+  // registry's conversation-scoped refusal (refusal-scope.js §6): a 400 NAMING the review
+  // tokens would make the client latch server review off for its whole session (§1.2), so
+  // this message names none of them. Native (passthrough), count_tokens, Responses and
+  // unknown paths keep their previous behaviour; no provider call or budget reservation
+  // happens on this path.
   if (faceModule === anthropicFace && req.method === 'POST' && pathSuffix === '/v1/messages') {
     const selection = routes.selectUpstream(route, 'anthropic', parsedBody && parsedBody.model);
-    const negotiation = unsupportedSafeguards(parsedBody, selection && selection.mode);
+    const negotiation = unsupportedSafeguards(parsedBody, selection && selection.mode, req.headers);
     if (negotiation) {
+      const entry = refusalEntry('claude-code', 'server-review');
+      const version = clientVersion(entry, req.headers);
+      const scope = scopeVerification(entry, version);
+      warnIfUnverified(entry, version);
       detachOwnListeners();
       telemetry.status = negotiation.status;
       faceModule.writeJson(res, negotiation.status, negotiation.body, telemetry);
       _logProxyRequest(routeAlias, (parsedBody && parsedBody.model) || '-', telemetry);
       // WP-1 AC-1a: the translated cycle answers the review request with CTM's own fixed
       // 400 -- a complete response that carries no review result because this transport
-      // cannot. One diagnostic, no provider call, no fabricated verdict.
+      // cannot. One diagnostic, no provider call, no fabricated verdict. `refusal=conversation`
+      // is the measured scope of this wording, and `scope=` records whether the installed
+      // client version is the one the entry was measured on.
+      // WP-0 §8: the same line also names which kind of client request this was, from the
+      // caller's own headers only (never a body value).
       logReviewDiagnostic({
         pathKind: 'routed',
         transport: 'translated',
         status: negotiation.status,
         results: 'unsupported',
         completion: 'complete',
+        requestClass: requestClassFromHeaders(req.headers),
+        refusal: 'conversation',
+        scope,
       });
       return;
     }
@@ -1307,6 +1271,39 @@ async function _handleRouted(req, res, pathName, trusted = null, ctx = null) {
         downstreamResponseId: telemetry.downstreamResponseId,
       });
     }
+    // WP-9 §9b L-1 (docs/deepseek-harness-acp-agent-2026-10-28.html D-19): a dsh session's spend. Its
+    // ACP wire carries no per-request token counts, so this is the only place CTM can see them — one
+    // contract row per completed request, counts only (never a token, key, header, prompt or response
+    // byte). Deliberately INDEPENDENT of the budget block above: a lead token never has a
+    // budgetAdmission.requestId, and this writer must not depend on one. Never awaited on the response
+    // path — the reply has already been written by the time this runs.
+    if (leadBinding && leadBinding.usageLog === 'dsh' && leadBinding.ctmSessionId
+        && telemetry.usage && telemetry.status >= 200 && telemetry.status < 300) {
+      void appendDshUsageRow({
+        // This server's OWN captured data directory, never a module global (see the context note above).
+        dataDir: context.dataDir,
+        ctmSessionId: leadBinding.ctmSessionId,
+        row: {
+          ts: new Date().toISOString(),
+          requestId: telemetry.downstreamRequestId || telemetry.requestId,
+          model: (parsedBody && parsedBody.model) || '',
+          input_tokens: telemetry.usage.input_tokens,
+          output_tokens: telemetry.usage.output_tokens,
+          cache_read_input_tokens: telemetry.usage.cache_read_input_tokens,
+          cache_creation_input_tokens: telemetry.usage.cache_creation_input_tokens,
+        },
+      }).then((result) => {
+        // REPORT: the writer never throws and never writes a partial line; a refusal is surfaced on the
+        // proxy's existing diagnostic channel, with a bounded reason and no caller value.
+        if (result && result.ok === false) {
+          console.log(`[model-proxy] dsh_usage_write_failed reason=${result.reason}`);
+        }
+      }).catch((err) => {
+        // The writer returns a result object rather than throwing, so this is belt-and-braces for a
+        // future edit; it must never become an unhandled rejection on the response path.
+        console.log(`[model-proxy] dsh_usage_write_failed reason=exception detail=${String(err && err.message || err).slice(0, 200)}`);
+      });
+    }
     _logProxyRequest(routeAlias, (parsedBody && parsedBody.model) || '-', telemetry);
   }
 }