diff --git a/devlog/_fin/260907_init_publication_guidance/010_implementation.md b/devlog/_fin/260907_init_publication_guidance/010_implementation.md new file mode 100644 index 0000000000..80b5954924 --- /dev/null +++ b/devlog/_fin/260907_init_publication_guidance/010_implementation.md @@ -0,0 +1,28 @@ +# Issue #3893: implementation plan + +Satisfy-spec work, triggered by issue #3893 and the request to implement separate draft PRs. Goal: actionable first-run publication diagnostics. Non-goals: changing file writes, permissions, replacement/cleanup guarantees, or adding a filesystem fallback. Stop after a verified draft PR; unresolved platform checks are reported, never marked passed. Escalate if resolving the issue requires weakening publication guarantees. This file records the plan and eventual evidence. + +Class C2: diagnostic propagation and user documentation. One independent branch from 522ce5f8c; no branch dependencies or orchestration state changes. + +File map: +- MODIFY src/config/initialize.ts: add an optional hardeningFailed flag to constructor options; select a fixed privacy-safe permission diagnostic when hardening throws. Track the flag around the existing harden call only, and pass it in the existing error options. Append supported-location guidance to denied-link diagnostics. All I/O order and cleanup remain identical. +- MODIFY tests/config/config-mutation-lock.test.ts: inject a harden failure and prove write/link never happen, target remains absent, no residue remains, and raw error details do not appear. Assert all five denied-link codes provide recovery guidance while retaining uncertain-publication state. Partial-write errors must not be mislabeled as permission failures. +- MODIFY tests/service/init-eof.test.ts: use its existing child bootstrap seam to inject publication errors during the real CLI wizard; verify exit=1, diagnostics and residue warnings, no configuration/backup damage or integration prompts. +- MODIFY docs-site/src/content/docs/getting-started/quickstart.md and structure/02_config-and-codex-home.md: explain supported locations, inspection before retry, separate permission and link failures, and fresh-install OPENCODEX_HOME examples. Existing translations reviewed for contradictions. + +Optional constructor input chain: created by the publication function; consumed by Error.message; no config serialization, migration, or persistent state. Existing constructor calls keep their meaning. + +Verification: focused config/init tests read the real publication and CLI code; typecheck includes src; privacy scan; required docs-site build. Baseline focused run: 35 pass, 3 skip, 2 fail (Windows file-symlink privilege: symlinkSync EPERM and dependent missing-residue assertion). No baseline failure will be hidden by changing tests. New regression checks must pass. Windows-native filesystem support remains bounded by the host. + +Audit: direct O_EXCL and replacement fallbacks rejected because they change complete-file/no-replace guarantees. Reuse the existing error and test seams; no new diagnostic module. Guidance never prints raw cause text or candidate bytes. + +## Verification before draft publication + +- `bun install --frozen-lockfile`: passed; lockfile unchanged. +- New diagnostics were observed failing before implementation: 9 failures across the focused hardening/link/CLI fault cases. After implementation: 9 passed. +- `bun test tests/config/config-mutation-lock.test.ts tests/service/init-eof.test.ts`: 38 passed, 3 skipped, 2 failed. The same two tests failed on unchanged 522ce5f8c: file-symlink creation is denied on this Windows host, and the swapped-symlink test then lacks its expected residue. New recovery tests pass; no skips or weakened assertions were added. +- `bun run typecheck`: passed. +- `bun run privacy:scan`: passed. +- `cd docs-site; bun install --frozen-lockfile; bun run build`: passed, 425 pages. Translated quickstarts contain no conflicting recovery/fallback instructions. +- CLI fault scenarios verify exit=1, distinct permission/link messages, uncertain-publication/residue warnings, backup preservation and no integration prompts. Partial-write errors keep the generic diagnostic. +- No physical non-NTFS filesystem support is claimed. Maintainer review remains required; this is a draft handoff. diff --git a/devlog/_fin/260908_b_track_quota_recovery_stack/000_plan.md b/devlog/_fin/260908_b_track_quota_recovery_stack/000_plan.md new file mode 100644 index 0000000000..d73b85568a --- /dev/null +++ b/devlog/_fin/260908_b_track_quota_recovery_stack/000_plan.md @@ -0,0 +1,69 @@ +# 000_plan.md — B트랙 대화 복구·quota 스택 배송 + +## 목표 +#3889(만료된 forward continuation의 WebSocket 복구)과 #3934(자격증명 세대 기반 늦은 WS quota 차단)를 +원저자 기여를 보존한 수동 종속 브랜치 체인으로 재구성하고, 최종 tip 한 곳에서만 CI를 태워 +green이면 tip을 dev에 통합한다. + +## 제약 (사용자 지시) +- 로컬 스위트 절대 실행 금지: bun run test / test:changed / typecheck / build / install 모두 NOT RUN. +- 푸시는 `--no-verify`. +- CI는 최종 tip에만 트리거한다. 하위 레이어에는 PR을 열지 않는다. +- 원작 PR이 있으면 원저자를 Co-authored-by로 보존한다. +- tip이 dev에 머지되는 순간 연결 이슈도 닫는다. + +## CI 트리거 계약 (근거) +`.github/workflows/ci.yml`의 `on.pull_request`에는 base 브랜치 필터가 없다(주석에 stacked child PR을 +일부러 포함시켰다고 명시). 따라서 **PR을 여는 것 자체가 CI run을 만든다.** +`push:`는 `branches: [main, preview, dev]`로 제한되므로 포크/작업 브랜치 푸시는 CI를 만들지 않는다. +결론: 하위 레이어 L1은 **브랜치 푸시만** 하고 PR을 열지 않는다. tip L2에만 PR을 연다. + +## 의존성 정렬 (PHASE-SPLIT-01) +효율이 아니라 의존 구조로 나눈다. 두 변경 모두 `src/server/responses/core.ts`를 만지므로 +같은 파일 위에서 순서를 가진 체인으로 쌓는다. + +- L1 = #3889 continuation 복구 (core.ts:3598 부근 오류 코드 계약) +- L2 = #3934 WS quota 세대 펜싱 (core.ts:1004 부근 observer) — L1 위에 쌓는다 + +텍스트 충돌은 없다(두 훅 사이 거리 약 2600줄). 체인 순서는 리뷰 단위 분리를 위한 것이다. + +## 파일 변경 맵 +### L1 (#3889, 원저자 ykvv / y2ambition-ai) +- MODIFY `src/server/responses/core.ts` — 400 응답 코드를 `invalid_request_error` → `previous_response_not_found`, + 메시지를 "전체 대화를 다시 보내라"로 변경. HTTP 상태와 인증 전 거부 위치는 유지. +- MODIFY `tests/codex-integration/issue-702-expired-replay-state.test.ts` — 기존 HTTP 기대값의 code 갱신 + + expired/missing 두 모드의 WebSocket 재연결·전체 도구 이력 재전송 회귀 추가. +- MODIFY `docs-site/src/content/docs/guides/codex-integration.md`, `.../ko/guides/codex-integration.md` + +### L2 (#3934, 원저자 luvs01) +- MODIFY `src/server/responses/core.ts` — `codexWsQuotaObserver`에서 pool 자격증명 generation을 포착하고 + `isCodexAccountGenerationLive`가 false면 늦게 도착한 quota 프레임을 무시. +- MODIFY `tests/responses/responses-account-label.test.ts` — 교체된 자격증명의 늦은 quota가 지워진 상태를 + 되살리지 못하는 회귀 추가. + +## 범위 밖 (OUT) +- `REPLAY_TTL_MS` 등 캐시 보존 기간 변경 +- 인증/자격증명 회전 정책 변경 +- main-pool writer 소유권 규칙 변경 +- B트랙 외 항목(#3906/#3886/#3922/#3917/#3900/#3896/#3924/#3930/#3890) + +## 검증자 (PLAN-VERIFIER-REAL-01) +로컬 스위트가 금지되었으므로 **로컬 검증자는 NOT RUN으로 기록한다**. 유일한 실행 검증자는 +tip PR head SHA에 대한 hosted Cross-platform CI다. 관측 대상: 4 Linux shard, Windows, +macOS lane, gates(typecheck/lint/privacy scan), packaging. +- `gh api repos/lidge-jun/opencodex/actions/runs?head_sha=` → conclusion=success +- 이 CI는 `src/**`와 `tests/**`를 changes 필터에 포함하므로 실제로 이번 변경 대상을 관측한다. + +## 수용 기준 +1. L1/L2 커밋 각각에 원저자 Co-authored-by 트레일러가 살아 있다. +2. L1에는 PR이 없고 CI run도 없다. CI run은 tip 하나뿐이다. +3. tip head SHA의 CI conclusion이 success다. +4. 로컬 스위트 미실행, 푸시는 --no-verify. +5. tip이 dev 조상이 되고, #3889/#3934가 정리되며 연결 이슈가 닫힌다. + +## 우회 경로 (PLAN-BYPASS-NAMED-01) +- tier: E2 (hosted CI 게이트) +- 실행 주체: GitHub Actions + maintainer 통합 +- 알려진 우회: admin 권한 보유자는 CI 미완료 상태에서도 머지 가능. 이 계획은 그러지 않는다. +- 잔여 위험: 하위 레이어 L1은 자체 CI 없이 tip 누적 CI로만 증명된다. 사용자 지시에 따른 의도된 선택. +- 문구 하향: 없음. diff --git a/devlog/_fin/260908_b_track_quota_recovery_stack/010_phase1_l1_continuation_recovery.md b/devlog/_fin/260908_b_track_quota_recovery_stack/010_phase1_l1_continuation_recovery.md new file mode 100644 index 0000000000..4c054dd8c3 --- /dev/null +++ b/devlog/_fin/260908_b_track_quota_recovery_stack/010_phase1_l1_continuation_recovery.md @@ -0,0 +1,56 @@ +# 010_phase1_l1_continuation_recovery.md — L1 (#3889) 브랜치 구성 + +## 목적 +만료·부재한 forward continuation 상태를 Codex WebSocket 클라이언트가 스스로 복구할 수 있게, +프록시가 돌려주는 400 오류의 코드를 클라이언트가 인식하는 `previous_response_not_found`로 바꾼다. + +## 브랜치 +`codex/b-stack-l1-continuation-recovery`, base = `origin/dev`. + +## 커밋 계약 +원저자 보존이 필수다. 체리픽으로 원 커밋의 author를 그대로 유지한다. + +``` +git cherry-pick -x e8d82a181ea0daa06c5111c09e0148475e45458f +``` + +체리픽은 원 커밋의 author(ykvv <229483879+y2ambition-ai@users.noreply.github.com>)를 보존한다. +squash 병합 시 author가 소실될 수 있으므로 커밋 메시지에 트레일러도 추가한다: + +``` +Co-authored-by: ykvv <229483879+y2ambition-ai@users.noreply.github.com> +``` + +## 정확한 변경 (before → after) +`src/server/responses/core.ts` 약 3598행: + +```diff + if ( + hasUnexpandedPreviousResponse + && isCanonicalOpenAiForwardProvider(route.provider) + ) { + return formatErrorResponse( + 400, +- "invalid_request_error", +- "OpenAI forward continuation state is unavailable or expired; start a new session instead of reusing this previous_response_id.", ++ "previous_response_not_found", ++ "OpenAI forward continuation state is unavailable or expired; resend the full conversation without previous_response_id.", + ); + } +``` + +가드 위치(인증·어댑터·upstream I/O 이전)는 바뀌지 않는다. HTTP 상태 400도 유지한다. + +테스트: `tests/codex-integration/issue-702-expired-replay-state.test.ts` +- 기존 HTTP 케이스: `code`를 `previous_response_not_found`로 갱신, `type`은 `invalid_request_error` 유지. +- 신규: expired/missing 두 모드로 WebSocket 연결 → 거부 확인 → upstream 요청 0건 확인 → + 재연결 후 전체 이력 재전송 → upstream 1건 + `previous_response_id` 없음 + 도구 호출/결과 쌍 보존. + +문서: `docs-site/src/content/docs/guides/codex-integration.md` 및 한국어 페이지에 복구 경계 문단 추가. + +## 검증 +로컬 스위트 NOT RUN(사용자 금지). 이 레이어는 PR을 열지 않으므로 자체 CI도 없다. +증명은 L2 tip의 누적 CI가 담당한다. + +## 감사 반영 +서브에이전트 audit-3889의 결과에 따라 문서의 TTL 수치와 error type/code 매핑을 확정한다. diff --git a/devlog/_fin/260908_b_track_quota_recovery_stack/020_phase2_l2_ws_quota_generation_fence.md b/devlog/_fin/260908_b_track_quota_recovery_stack/020_phase2_l2_ws_quota_generation_fence.md new file mode 100644 index 0000000000..8ac37b83f9 --- /dev/null +++ b/devlog/_fin/260908_b_track_quota_recovery_stack/020_phase2_l2_ws_quota_generation_fence.md @@ -0,0 +1,54 @@ +# 020_phase2_l2_ws_quota_generation_fence.md — L2 (#3934) tip 레이어 + +## 목적 +pool 자격증명이 교체된 뒤 이전 WebSocket 연결에서 늦게 도착한 quota 프레임이, +새 자격증명을 위해 비워둔 quota 상태를 되살리지 못하게 막는다. + +## 브랜치 +`codex/b-stack-l2-ws-quota-generation`, base = `codex/b-stack-l1-continuation-recovery` (L1 위에 쌓음). +이 브랜치가 스택의 tip이며, **PR은 여기에만 연다.** + +## 커밋 계약 +``` +git cherry-pick -x e5c01f44e9736baba5b3a993c7f489f6b60d5ddd +``` +원저자 luvs01 보존 + `Co-authored-by: luvs01 ` 트레일러. + +## 정확한 변경 (before → after) +`src/server/responses/core.ts` 약 1004행: + +```diff ++import { isCodexAccountGenerationLive } from "../../codex/account-store"; + + function codexWsQuotaObserver(authCtx, provider): CodexWsQuotaObserver | undefined { + if (!isCanonicalOpenAiForwardProvider(provider) || !usesCodexForwardPoolAuth(authCtx, provider)) return undefined; + const { accountId, writerGeneration } = authCtx; ++ const credentialGeneration = authCtx.kind === "pool" ? authCtx.generation : undefined; + const mainWriter = authCtx.kind === "main-pool" ? authCtx.mainQuotaWriter : undefined; +- return headers => applyCapturedCodexQuota(accountId, headers, writerGeneration, mainWriter); ++ return headers => { ++ if (credentialGeneration !== undefined && !isCodexAccountGenerationLive(accountId, credentialGeneration)) return; ++ applyCapturedCodexQuota(accountId, headers, writerGeneration, mainWriter); ++ }; + } +``` + +`credentialGeneration === undefined`면 기존 동작을 그대로 유지한다(main-pool·비pool 경로 무변경). + +테스트: `tests/responses/responses-account-label.test.ts` +- quota 10 전달 → 자격증명 교체 → quota clear → 옛 연결에서 quota 100 전달 → 최종 상태가 null인지 확인. + +## L1과의 관계 +같은 파일이지만 서로 다른 함수(약 2600줄 간격)라 텍스트 충돌이 없다. +체인 순서는 리뷰 단위를 나누기 위한 것이며, L2 diff는 이 변경만 보여준다. + +## CI 계약 +`.github/workflows/ci.yml`의 `on.pull_request`는 base 필터가 없어 PR 생성 즉시 CI가 붙는다. +따라서 L1에는 PR을 열지 않고, tip인 L2에만 PR을 연다 → CI run 정확히 1개. +`changes` 필터가 `src/**`, `tests/**`, `docs-site` 외 경로를 보므로 이 변경 세트는 `ci=true`가 되어 +4개 Linux shard, Windows, macOS lane, gates가 모두 돈다. + +## 머지 후 처리 +- tip PR 머지 → `git merge-base --is-ancestor`로 dev 조상 확인 +- #3889, #3934: 내용이 dev에 들어갔으므로 원저자 크레딧을 명시하며 닫는다 +- 연결 이슈: dev 머지 시점에 닫는다 (PR base가 dev라 GitHub 자동 종료가 안 됨 — AGENTS.md 명시) diff --git a/devlog/_fin/260908_b_track_quota_recovery_stack/030_outcome.md b/devlog/_fin/260908_b_track_quota_recovery_stack/030_outcome.md new file mode 100644 index 0000000000..7f5ef7e74e --- /dev/null +++ b/devlog/_fin/260908_b_track_quota_recovery_stack/030_outcome.md @@ -0,0 +1,58 @@ +# 030_outcome.md — 배송 결과 + +## 결과 +PR [#3937](https://github.com/lidge-jun/opencodex/pull/3937)이 `dev`에 머지되었다. +머지 커밋 `ca381ea764cfbc63bec978f53eb58e96c00c0c64`, 2026-09-07T18:31:27Z. + +## 스택 구조 (실제) +``` +dev 942c02873 + └─ 7273a0d1f docs(devlog): plan the B-track ... [계획] + └─ 531753340 fix(responses): recover expired ... [L1, author ykvv] + └─ a06bfa2f2 fix(codex): fence late WS quota [L2 = tip, author luvs01] +``` +L1에는 PR을 열지 않았다. tip에만 PR을 열어 CI를 1회 트리거했다. + +## CI 증거 +- tip `a06bfa2f2`: Cross-platform CI run 1건, conclusion=success, run_attempt=1 + ([run 34149252860](https://github.com/lidge-jun/opencodex/actions/runs/34149252860)). + 잡 21/21 완료, failure 0. Linux shard 4, macOS lane 2, gates, packaging, keyring, Docker smoke 포함. +- 하위 레이어 `531753340`: workflow run **0건**. 브랜치 푸시가 CI를 만들지 않는다는 계약이 실측으로 확인됐다. +- `enforce-target`은 동시성 그룹 충돌로 1차 시도가 취소되어, 대기 중이던 중복 run을 취소하고 재실행해 success를 받았다. + +## 검증 한계 (사실대로 기록) +- **로컬 제품 스위트는 한 번도 실행하지 않았다** (`bun run test`/`test:changed`/`typecheck`/`build`/`install`: NOT RUN). + 사용자 지시에 따른 것이며, hosted CI가 유일한 실행 검증자였다. 푸시는 전부 `--no-verify`. +- tip SHA에 취소된 체크 2건이 남아 있다: `enforce-target`(101832157192, 옛 시도)과 `label`(101827844691). + 같은 워크플로의 후속 시도가 success로 끝났고 failure는 0건이다. 체크 목록이 전부 깨끗하다고 말하면 사실이 아니다. +- CI가 검증한 트리(tip)와 최종 dev 트리는 동일하지 않다. 머지 직전 별도 PR #3936(문서)이 먼저 착륙해 + lifecycle 문서 5개가 차이로 남는다. `git diff --exit-code a06bfa2f2 ca381ea76 -- src tests`는 exit 0으로, + **소스와 테스트는 CI가 본 그대로** 착륙했다. + +## 감사 (astra-high 서브에이전트 4기) +1. `audit-3889`: PASS. `formatErrorResponse`의 2번째 인자는 `classifyError` 입력이며 + `previous_response_not_found` 분기가 `type=invalid_request_error`/`code=previous_response_not_found`를 만든다 + (`src/bridge.ts:2130`, `src/lib/errors.ts:179`). 문서의 1시간은 `RESPONSE_TTL_MS=3_600_000`과 일치. +2. `audit-3934`: PASS. `main-pool`에 `generation`이 없는 것은 의도된 분리이며 `mainQuotaWriter`가 별도 펜싱한다. + `writerGeneration`(설정 재조정)과 `generation`(영속 자격증명)은 다른 개념이라 새 검사가 중복이 아니다. + generation `0`은 엄격 동등으로 정상 처리된다. +3. `verify-stack`: PASS. 체리픽 hunk 무결성, 두 변경의 공존, import/export, 테스트 심볼, layout, privacy 6항목. +4. `verify-landing`: 7개 주장 중 6개 CONFIRMED, 1개 REFUTED(위 취소 체크 건). 이 문서가 그 반증을 반영한다. + +## 원저자 크레딧 +머지 커밋에 두 트레일러가 모두 살아 있다. +``` +Co-authored-by: ykvv <229483879+y2ambition-ai@users.noreply.github.com> +Co-authored-by: luvs01 +``` +원본 PR #3889·#3934는 배송 완료 안내와 함께 closed(미머지)로 처리했다. + +## 연결 이슈 +GraphQL `closingIssuesReferences`로 확인한 결과 #3889·#3934·#3937 모두 종료 대상 이슈가 **0건**이다. +따라서 이번 머지로 닫을 이슈는 없었다. (#3885는 A트랙 #3886 소관이라 대상이 아니다.) + +## 이번에 나아지지 않은 것 +- 하위 레이어 L1은 자체 CI 증거 없이 tip 누적 CI로만 증명됐다. 사용자 지시에 따른 의도된 선택이며, + 레이어별 독립 회귀 증거가 필요한 변경에는 이 방식을 그대로 쓰면 안 된다. +- `enforce-target` 동시성 충돌은 재실행으로 우회했을 뿐 원인을 고치지 않았다. + 같은 SHA에 워크플로가 두 번 트리거되는 조건이 남아 있다. diff --git a/devlog/_fin/260908_bug6_manual_stack/000_plan.md b/devlog/_fin/260908_bug6_manual_stack/000_plan.md new file mode 100644 index 0000000000..cda1225ad6 --- /dev/null +++ b/devlog/_fin/260908_bug6_manual_stack/000_plan.md @@ -0,0 +1,18 @@ +# Six-item bug stack — completed delivery + +All five new product PRs merged into `dev` on 2026-09-08. The sixth source item, #3965, had independently landed and required no duplicate PR. [071](071_delivery.md) records verification and retained failure history; [072](072_final_proof.md) records actual landing proof. + +| Source | Delivery | Disposition | +| --- | --- | --- | +| #3838 Go placement/stateless residual | #3986 | Landed; source closed; lossy mixed-ciphertext filtering declined | +| #3907 xAI string child result | #3991 | Landed; issue completed | +| #3944 V2 proxy guidance | #3992 | Landed; source closed | +| #3951 server-owned delegation preset | #3993 | Landed; source closed | +| #3965 canonical operation alias | Existing merge402be7c1f | Verified landed NOOP for another PR | +| #3973 cooldown recovery, consolidated #3995 | #4002 | Landed; issue completed and source PR closed | + +This was one ordinary manual chain. Children were retargeted to dev before their parents merged because repository settings automatically delete merged branches. Original authorship and Co-authored-by trailers were preserved. #3997/#3996 remain outside this delivery. + +The earlier decade documents are historical plans and audit amendments. Their future-tense steps describe what was required at that point; this outcome and the final ledger are authoritative for completion. The work used repeated PABCD cycles and independent Astra high source/security reviews. + +Local product tests, installs, typechecks and builds: **NOT RUN**, by owner instruction. Commits disabled hooks per invocation and pushes used --no-verify. Hosted CI, synthetic dashboard observation and isolated remote documentation builds supplied verification. No release, deployment, main/preview promotion, live account operation or reset credit was used. All 30 pre-existing user files were preserved. diff --git a/devlog/_fin/260908_bug6_manual_stack/010_go_compatibility.md b/devlog/_fin/260908_bug6_manual_stack/010_go_compatibility.md new file mode 100644 index 0000000000..fa7a4e7845 --- /dev/null +++ b/devlog/_fin/260908_bug6_manual_stack/010_go_compatibility.md @@ -0,0 +1,42 @@ +# wp1: Go compatibility residuals + +Historical phase record. Delivery is complete; see [071](071_delivery.md) and [072](072_final_proof.md) for terminal evidence. + +Depends on wp0. C3 with independent boundary review. Source PR #3838 head `d84e5a80a5e40a65462a0466d82cdcec463a847e`; baseline dev `9e1468d4b7a41b498ed2aca98507ada2c741afea`. #3942 already landed the generic array agent-message normalizer. Reimplement the remaining Go behavior on current owners; do not restore the removed `opencode-go.ts` or duplicate namespace logic. + +## Main decisions + +Carry Go additional-tools placement and the canonical preset's stateless intent. Retain current all-parts readable/fail-closed agent-message behavior; the old lossy mixed-content hunk is deliberately declined because successful transport alone does not prove complete task content. Original PR disposition must name that decision rather than claim every historical hunk landed. Custom renamed providers retain explicit configuration semantics; no destination-based configuration migration is added. + +## File changes + +- NEW `src/adapters/opencode-go-additional-tools.ts`: export a small immutable placement helper taking body and base URL. Match HTTPS `opencode.ai`, standard port, exact `/zen/go/v1` (optional terminal slash); reject credentials/query/fragment and other paths. For valid `additional_tools` array wrappers append their already-normalized tools to top-level tools and remove the wrapper. Preserve unrelated input and supported nameless hosted tools. Non-array malformed wrappers remain unchanged; no valid wrappers returns the original body. Existing namespace/custom owners perform identity lowering and dedupe before this pass. +- MODIFY `src/adapters/openai-responses.ts`: import helper; invoke only inside non-forward dispatch after existing namespace/custom/search lowering around baseline line 2455, before code-mode/compaction and later hosted-tool pruning. Response alias maps stay owned by prior normalization. +- MODIFY `src/providers/registry.ts`: canonical `opencode-go` entry gains `statelessResponses: true`. Existing derive logic seeds/backfills only absent values; explicit false remains authoritative. +- MODIFY `tests/providers/opencode-go-grok46-responses.test.ts`: replace the old expected private wrapper with promoted tools; cover duplicate containers, distinct namespace same-name children, custom/function handling, hosted Luna search versus Go Grok denial, tool_choice none/allowed list, tool_search_output activation, forward/Zen/lookalike/wrong-port exclusion and immutable replay. +- MODIFY `tests/providers/opencode-go-luna-wire.test.ts`: cover seed/backfill/false, full-history continuation with synthetic reasoning and paired tool results; assert previous_response_id removed, store false, call pairing/history retained. Cover stateless orphan and reasoning-summary interactions through existing focused suites. No new test file is required if these current owners remain reviewable. +- MODIFY `docs-site/src/content/docs/reference/configuration/providers.md` and `structure/04_transports-and-sidecars.md`: record Go wrapper placement and canonical stateless default with explicit override and full-history limits. Update only contradicting translated statements. + +## Before / after flow + +Before: namespace normalization leaves valid declarations inside `input.additional_tools`; strict Go receives a private wrapper. After: the same normalized declarations appear in `tools`, and valid wrappers are removed. Before: canonical Go may forward previous_response_id with replay history. After: existing stateless normalization strips the stored-continuation parameters and sends complete history. + +## Activation and observable coverage + +Use production adapter fixtures, not a duplicate normalizer oracle. Namespace alpha.lookup and beta.lookup must both remain callable; duplicate wire identities follow the existing canonical owner. Nameless hosted tools must survive placement until provider/model pruning. Malformed wrapper, unapproved destination and forward controls stay byte-identical. Seed false must differ from default true. A two-turn synthetic continuation must preserve meaningful reasoning/tool history while removing stored-state references. Inspect existing stateless orphan repair and summary tests; extend any missing Go model coverage without weakening assertions. + +Hosted verification: PR CI covers changed runtime and provider suites, with final full dispatch before integration. Local product tests/install/typecheck/build are NOT RUN. Preserve original PR account-linked Co-authored-by credit; resolve identity from GitHub before commit. The full source investigation is in ignored `.tmp/bug6-01a07e9d/go-xai-plan.md`; it is not public implementation proof. + +## wp1 P refresh + +Previous wp0 D directs Go residual implementation. During live refresh dev advanced to c15662855 (#3975), changing only tests/codex-integration/codex-prompt-text-probe.test.ts. Hook-disabled merge incorporated that unrelated probe fixture correction before B; Go owners and this design are unchanged. The initial A narrative said unchanged dev based on the pre-fetch snapshot; this entry corrects it. + +## C audit foldback and repair plan + +Independent review at 9b42c1a80 found two blockers. F1 accepted: the stateless flag enables content-to-summary output normalization, but the continuation cache records original output; full-history overlap then fails. The adapter-only full-history fixture bypassed the affected server boundary. F2 accepted: baseUrl-only matching misses split/endpoint-inclusive configurations and can affect an overridden non-Go resource. Neither finding conflicts with preserving opaque items or existing fail-closed policy. + +Repair F1: MODIFY `src/server/responses/core.ts` at `rememberPassthroughResponseChecked` only. After current namespace/custom/function restoration, apply existing `rewriteReasoningSummaryInJson` under the same `hideThinkingSummary !== true && routeUsesContentChannelReasoning(provider, model)` condition as client output, then record that representation. Preserve item content and IDs under the existing opaque-item rule; do not weaken overlap comparison or use ID-only matching. This aligns stored output with the actual client serialization for SSE and JSON. Extend the current Go server fixture to send actual full-history plus previous_response_id and assert each prior call/message occurs exactly once; retain delta replay and hiding/opaque controls. The shared callback is an explicit narrow scope expansion required by this newly activated path, not unrelated state refactoring. + +Repair F2: the helper now accepts the final resolved Responses request URL already built by the adapter. Match exact origin and `/zen/go/v1/responses`, rejecting userinfo/query/fragment. Positive fixtures cover normal base, endpoint-inclusive base and split custom path; negative fixtures cover an override resolving to Zen/non-Go and assert both actual request URL and body. Update destination wording in docs and preserve all prior host/port/immutability controls. + +Re-review the repaired diff with the same implementation auditor; retain CI failures and repair evidence. No local product commands are authorized. diff --git a/devlog/_fin/260908_bug6_manual_stack/020_xai_continuation.md b/devlog/_fin/260908_bug6_manual_stack/020_xai_continuation.md new file mode 100644 index 0000000000..8308cc290e --- /dev/null +++ b/devlog/_fin/260908_bug6_manual_stack/020_xai_continuation.md @@ -0,0 +1,25 @@ +# wp2: xAI string child-result continuation + +Historical phase record. Delivery is complete; see [071](071_delivery.md) and [072](072_final_proof.md) for terminal evidence. + +Depends on wp1 current outbound placement and full-history regression controls. C3. Issue #3907 posts string `agent_message.content`; #3942 already implements arrays for all non-forward destinations. Scope is the string residual only. + +## File changes + +- MODIFY `src/adapters/routed-agent-messages.ts`: extend `normalizeRoutedAgentMessages` with optional `{ allowStringContent?: boolean }`, default false. If enabled and content is a nonblank string, create one input_text part containing the exact original string. Existing attribution and array handling continue. Whitespace-only, unknown, malformed and ciphertext shapes remain unchanged; never trim the forwarded text or mutate the input. +- MODIFY `src/adapters/openai-responses.ts`: reuse `isXaiResponsesDestination` from `src/providers/xai-transport.ts`, pass its result as allowStringContent inside the existing `!forward` call. Existing array behavior stays available for other non-forward destinations. No custom-forward exception. +- MODIFY `tests/adapters/routed-agent-messages.test.ts`: exercise both exact xAI hosts, API-key and OAuth, exact text/newlines, attribution, missing transport item ID and input immutability. String controls: native/custom forward, other providers, lookalike hosts and blank content stay unchanged; existing all-parts array/ciphertext tests remain. +- MODIFY `tests/server/server-xai-responses-streaming.test.ts`: extend the synthetic server fixture with parent request, child request, then parent continuation containing string child result plus genuine paired tool history. Upstream stub rejects surviving private agent_message with 422; assert user-message child text, ordinary response completion, paired calls preserved and no repeated incompatible dispatch. This exercises the wire boundary, not the actual Codex scheduler. +- MODIFY `docs-site/src/content/docs/reference/adapters.md`, `docs-site/src/content/docs/reference/configuration/providers.md`, and the contradicting Russian adapters paragraph: describe existing non-forward array conversion and xAI string extension, preserving forward/encrypted exclusions. Sync `structure/04_transports-and-sidecars.md` without broadening the passive manifest claims. + +## Before / after + +Before the raw-body outbound normalizer requires array content and leaves the issue's string item on the strict xAI wire. After it produces `{type: message, role: user, content: [{type: input_text, text: originalText}]}` through the existing attribution rules, only for an approved non-forward xAI destination. No tool result is synthesized and no encrypted message is partially discarded. + +## Verification + +Pin parent/child fixtures to synthetic input. The strict upstream stub must reject the pre-fix request shape and accept the normalized one; destination-negative controls prove the guard is active. Hosted PR CI and final full dispatch execute adapter/server regressions. Local tests/install/typecheck/build remain NOT RUN. Source audit checks raw-body call placement and all consumers of the added option. There is no serialized configuration field or migration: option creation and consumption are both in-memory adapter calls. + +## wp2 P refresh + +Previous wp1 D: PR3986 at d1f61e933 passed run34178540141 and independent source/security audit, with18Go replay scenarios and remote docs425pages. Proceed to xAI string residual. Candidate339e42c1e was prepared in an isolated worktree under the owner-authorized parallel-preparation amendment; it is not yet adopted. Its base exactly equals the certified preceding layer, and the eight-file diff matches this plan. Existing xAI predicate remains the destination owner; no account changes. Issue3907 is still open. Main revalidates candidate before B and retains fresh hosted CI before wp2 closure. diff --git a/devlog/_fin/260908_bug6_manual_stack/030_v2_guidance.md b/devlog/_fin/260908_bug6_manual_stack/030_v2_guidance.md new file mode 100644 index 0000000000..aac9ffab00 --- /dev/null +++ b/devlog/_fin/260908_bug6_manual_stack/030_v2_guidance.md @@ -0,0 +1,55 @@ +# wp3: V2 guidance carry + +Historical phase record. Delivery is complete; see [071](071_delivery.md) and [072](072_final_proof.md) for terminal evidence. + +Depends on wp2 in the owner-requested manual chain. Carry PR #3944 at 6fb0fc6f1d34c77b98a74fe817e5bd90063a7d1a with both original commits and contributor trailer. Local product verification is NOT RUN. + + separate proxy routing metadata from native policy + +Source: [pinned collaboration implementation](https://github.com/lidge-jun/opencodex/blob/6fb0fc6f1d34c77b98a74fe817e5bd90063a7d1a/src/server/responses/collaboration.ts#L244), [pinned regression changes](https://github.com/lidge-jun/opencodex/blob/6fb0fc6f1d34c77b98a74fe817e5bd90063a7d1a/tests/codex-integration/multi-agent-compat.test.ts#L1188). C3 source change, with C4 care for developer-instruction and public-contract semantics; this lane does not run orchestration. + +### Concrete before -> after hunks + +| Exact path / baseline anchor | Before | After to carry | +| --- | --- | --- | +| `src/server/responses/collaboration.ts:242` | Only the native proactive constant exists. | Add private `OPENCODEX_SUBAGENT_GUIDANCE_OPEN_TAG` / `CLOSE_TAG` constants after it. Leave `PROACTIVE_MULTI_AGENT_MODE_TEXT` unchanged. | +| `src/server/responses/collaboration.ts:466-490` | Custom and built-in v2 bodies use native tags; built-in prescribes overrides, `fork_turns`, and preferred-model use. | Wrap both v2 paths in the proxy tag; replace only built-in preamble with routing-metadata wording; preferred clause ends with a period. Preserve placeholder substitution, effective preferred model, account namespace filtering, roster/fallback text, stale/unknown suppression and roster-drop budget. | +| `src/server/responses/collaboration.ts:543-545` | Exact generated-item predicate only. | Add `generatedGuidanceFamily(text)` recognizing exactly the two outer tag families. This is a dedup classification, not an authorship assertion. | +| `src/server/responses/collaboration.ts:583-594` | Latest-match handling only for native tag; other text dedups against any earlier exact match. | For either known family, compare incoming text to the latest exact generated developer text within that family in the replay prefix. For untagged text retain existing exact-item behavior. | +| `src/types/config.ts:472-475,515-516` | Effort JSDoc prescribes spawn overrides; custom-body wrapper is native tag. | Describe effort as advisory v2 metadata; update wrapper name. Preserve type declarations, injectionModel dependency and reasoning-level validation documentation. | +| `tests/codex-integration/multi-agent-compat.test.ts:270,387,615,741,781,847,1185` | Old v2 wrapper and imperative expectations; native-family A-B-A only. | Carry all changed expectations and new proxy/native replay matrices from the head; preserve existing v1, catalog, placement, sanitization and shape-negative tests. | +| `docs-site/src/content/docs/reference/configuration/agents.md:77-93` | Excludes v1 leaf workers and describes model/fork overrides. | Correct already-shipped leaf eligibility; describe proxy wrapper, advisory metadata, preserved custom body and per-family latest-text dedup. State mixed-version limitations. | +| `docs-site/src/content/docs/ja/reference/configuration/agents.md:31-37` | Old roster/guidance contract. | Carry corresponding roster correction and proxy/native/replay qualification. | +| `docs-site/src/content/docs/ko/reference/configuration/agents.md:31-37` | Same old contract. | Same localized contract. | +| `docs-site/src/content/docs/ru/reference/configuration/agents.md:38-57` | Same old contract, longer prose. | Carry full localized explanation including historical-message limitation. | +| `docs-site/src/content/docs/zh-cn/reference/configuration/agents.md:31-37` | Same old contract. | Same localized contract. | + +Do not mass-replace ``: `collaboration.ts:493-497` remains the v1 max/ultra parity path, and native/legacy history must remain byte-identical. Do not add a settings migration or infer the author of an old tagged message. No revocation of already injected instructions is claimed. + +### Data creation and consumers + +Existing config fields, not new fields: `/api/injection-model` maps `model`, `effort`, `prompt`, `multiAgentGuidanceEnabled` to `OcxConfig.injectionModel`, `injectionEffort`, `injectionPrompt`, `multiAgentGuidanceEnabled` (`agent-settings-routes.ts:501-508,529-589`). `saveConfigPreservingClaudeCode` persists the existing JSON config. No changes to that input/storage contract are needed. + +`src/server/responses/core.ts:2421-2429` passes those fields, route account namespace, featured models and fallback to `multiAgentGuidanceText`. `collaboration.ts:366-405` retains feature/tool/catalog admission; `:409-464` retains request-scoped roster and preferred/fallback derivation. Only the final rendered text changes. `applyInjectionPlaceholders` at `:504-509` still substitutes the four placeholders and preserves unknown placeholders. + +`core.ts:2430-2433` calls `injectDeveloperMessage`. `collaboration.ts:583` creates raw `{type:"message",role:"developer",content:[{type:"input_text",text}]}`; `:597-613` creates the parsed `{role:"developer",content:text,timestamp}` and places it; `:616-621` splices raw input at the matching conversation position. Both representations must retain the same ordered text across stateful replay. `src/server/responses.ts:6` reexports the same public helpers unchanged. `src/codex/subagent-model-fallback.ts:688-692` continues owning fallback prose. Native default sync is an independent consumer per `structure/03_catalog-and-subagents.md:459-465`; do not merge it with guidance. + +### Regression activation + +Carry the existing hermetic `CODEX_HOME` / catalog fixture builders (`multi-agent-compat.test.ts:23-103`), including the fresh catalog override and its cleanup. Test the actual helpers through `parseRequest`, raw input, `_replayPrefixLen`, and `_continuationConversationMessageIndex`. + +1. V2 built-in has proxy tags and model/effort/roster/fallback metadata, and lacks native tag, `fork_turns`, and preferred-model imperative. V1 max/ultra retains native tag and below-top silence. Disabled guidance and stale/unknown catalog produce null. +2. Built-in A -> custom B -> built-in A appends last A; unknown placeholders/newlines in custom B remain unchanged. +3. Native A -> proxy P -> native B -> same proxy P adds nothing; native text dedup ignores later proxy P. +4. Old built-in/native-tagged custom text + native policy + new proxy text preserves the original prefix and appends new proxy metadata. Never assert historical authorship or automatic cleanup. +5. Keep exact-shape negatives, 700-character fixture, external-task input, leading tool-result, compaction marker and raw/parsed alignment cases. +6. Small additional hunk recommended in `tests/server/server-combo-failover-e2e.test.ts:2285` beside the existing generated-guidance replay case: configure a synthetic v2 tool/catalog route, change built-in -> custom -> built-in across actual response continuations, capture adapter input, assert latest proxy guidance and native policy survive once and precede the current task. Use the existing server harness. Preserve current-dev compaction/recall fixtures in this file. This activates the caller/replay integration rather than only manually assigning parsed indices. + +Remote-only focused activation: `bun test tests/codex-integration/multi-agent-compat.test.ts`; additionally `bun test tests/server/server-combo-failover-e2e.test.ts` if adding the caller fixture. **NOT RUN here.** Negative controls for the remote verification owner: reverting the custom wrapper, collapsing the two families, or changing latest-family comparison to any-ever comparison must fail the corresponding transition tests. No local mutation/control execution. + + +Main decision: preserve the complete original diff. The optional extra server caller fixture is deferred unless source audit reveals an untested change; do not duplicate the existing replay matrix merely for volume. Sync structure/03_catalog-and-subagents.md to the new tag and policy boundary. + +## wp3 P refresh + +Previous wp2 D: PR3991 head00eb47886 passed run34180674115, source audit and remote docs425pages; proceed guidance carry. Prepared layer3 consists of24977adf2,21757b71a,8000e2482, based on d1f61e933. Intervening wp2 changes affect xAI adapter/tests, provider/adapters docs and structure04; none overlap the9layer3 files. Original #3944 remains open at6fb0fc6f. Independent prepared-source/security audit PASS in isolated v2GuidanceReviewer.md; actual adoption requires unchanged-delta/interdiff verification and own hostedCI. diff --git a/devlog/_fin/260908_bug6_manual_stack/040_v2_preset.md b/devlog/_fin/260908_bug6_manual_stack/040_v2_preset.md new file mode 100644 index 0000000000..4ab32b4768 --- /dev/null +++ b/devlog/_fin/260908_bug6_manual_stack/040_v2_preset.md @@ -0,0 +1,96 @@ +# wp4: server-owned proactive preset carry + +Historical phase record. Delivery is complete; see [071](071_delivery.md) and [072](072_final_proof.md) for terminal evidence. + +Depends on wp3. Carry PR #3951 at db502d486c8d8de80c0143fcfd6f86238d1ce917 with its contributor trailer. All local product commands are NOT RUN. + + make the server own proactive preset recommendations + +Source: [pinned policy module](https://github.com/lidge-jun/opencodex/blob/db502d486c8d8de80c0143fcfd6f86238d1ce917/src/codex/multi-agent-mode-policy.ts#L1), [pinned API additions](https://github.com/lidge-jun/opencodex/blob/db502d486c8d8de80c0143fcfd6f86238d1ce917/src/server/management/agent-settings-routes.ts#L252), [pinned GUI source binding](https://github.com/lidge-jun/opencodex/blob/db502d486c8d8de80c0143fcfd6f86238d1ce917/gui/src/pages/Subagents.tsx#L48). C3 API/GUI change, C4 care for persisted developer-policy text and management boundary. + +### Concrete before -> after hunks + +| Exact path / baseline anchor | Before | After to carry | +| --- | --- | --- | +| `src/codex/multi-agent-mode-policy.ts` (new, head lines 1-24) | Browser owns the preset; no recommendation owner. | Create dependency-free constant `{revision:"proactive-trigger-v1",text:[six clauses].join(" ")}`, two exact released legacy strings, and exact-equality canonicalizer. The recommendation changes the delegation trigger while preserving user/authority/scope/tool rules. | +| `src/codex/features.ts:39,1077-1094` | Non-null writer probes support then forwards original text. | Import canonicalizer; after existing capability probe set `canonicalValue = value === null ? null : canonicalizeOpenCodexModeHint(value)`; pass only that value to existing `setV2StringField`. No read-time/startup migration. | +| `src/server/management/agent-settings-routes.ts:43,250,423` | GET/PUT return stored hint only. | Import recommendation constant and append `multiAgentModeHintRecommendation: MULTI_AGENT_MODE_HINT_RECOMMENDATION` to both successful serializers. Do not add it to accepted PUT fields or config storage. | +| `gui/src/pages/use-subagent-delegation.ts:22-31` | State has stored hint but no recommendation. | Export `UltraModeHintRecommendation {text:string;revision:string}`; require `recommendation: UltraModeHintRecommendation \| null` in `UltraModeState`. Keep patch type as hint text/null and mode. | +| `gui/src/pages/Subagents.tsx:11,43,60-79` | Mode state outlives apiBase; no recommendation validation. | Add `UNLOADED_ULTRA_MODE` including null recommendation; hold `{apiBase,mode}`; derive current/unloaded state by exact apiBase. Validate nonblank string text AND revision, retaining their exact bytes; malformed/missing recommendation becomes null. Preserve abort/generation/current-server guards. | +| `gui/src/pages/Subagents.tsx:97-118,343` | Save checks busy only; forwarded busy does not describe hydration. | Refuse save without current-server mode or matching current apiBase; forward `ultraSaving || !ultraModeCurrent`. Keep PUT then GET refresh and stale-server outcome suppression. | +| `gui/src/components/subagents-workspace/SubagentDelegationSection.tsx:299-328` | Enable/Restore use local constant. | Enable sends current server recommendation.text; disable still sends null. Disable install if forced-v2 eligibility or recommendation is absent; existing nonblank hint remains clearable. Pass nullable server preset to editor. Keep editor key based on stored hint, not recommendation revision. | +| `gui/src/components/subagents-workspace/SubagentDelegationSection.tsx:341-391` | Editor requires string preset; exported browser preset remains. | Nullable preset; Restore changes draft only and is disabled without preset; Save preserves nonblank draft bytes. Remove local `ULTRA_MODE_PRESET` export. | +| `gui/tests/multi-agent-guidance.test.tsx:68,153` | Fixtures lack new field. | Add null recommendation and recommendation-refresh/unsaved-draft regression. | +| `gui/tests/subagents-ultra-mode.test.tsx:1-178` | Imports local preset and asserts duplicated text. | Remove preset import; lazy-import createRoot after DOM setup; use distinctive server recommendation fixture; carry API/malformed/edit/restore/save/server-switch cases. | +| `tests/codex-integration/codex-v2-gate.test.ts:47,426,1342` | Existing TOML and API contracts only. | Import recommendation; independently pin both released strings; add writer normalization, custom preservation, GET-no-write/unrelated-PUT preservation, readback and idempotence cases. | + +All nine locale modules retain keys and change exactly these five values: `sub.ultraMode`, `sub.ultraModeText`, `sub.ultraModeLoadFail`, `sub.ultraModeSaveFail`, `sub.ultraModeSaved`. Exact baseline anchors: `gui/src/i18n/en.ts:712`, `de.ts:683`, `fr.ts:695`, `ja.ts:643`, `ko.ts:700`, `ru.ts:698`, `tr.ts:705`, `zh-TW.ts:550`, `zh.ts:693`. English label becomes “Always proactive delegation”; no hardcoded JSX copy or locale-key rename. + +Docs: merge the wp4 proactive-preset section into `docs-site/src/content/docs/reference/configuration/agents.md:48-60`, and add the equivalent section to `ja/`, `ko/`, `ru/`, `zh-cn/` versions of that same path. Preserve every wp3 roster/proxy-wrapper/replay paragraph. These five files are the only shared files between the original PRs; carry their hunks, not whole-file replacement from #3951. The combined original carry touches 26 distinct files. + +Recommended small SOT followups, main to include in its phase write allowlist: at `structure/03_catalog-and-subagents.md:459` record the separate native-hint versus proxy-guidance owners; at `structure/05_gui-and-management-api.md:129` add the response-only recommendation and explicit-save-only canonicalization contract. No broader restructuring. + +### Complete field lifecycle / consumer audit + +1. **Creation:** policy module owns constant `text` and `revision`. Revision labels server guidance; the GUI validates a nonblank string, does not whitelist revisions, does not infer installed native capability from it. +2. **Serialization:** GET at route `:234-254` and successful PUT at `:413-427` add the same nested object. `src/server/auth-cors.ts:259-263` JSON.stringify serializes it with the existing JSON content type. No new envelope, endpoint, auth path or DTO needed. +3. **GUI hydration:** `Subagents.loadUltraMode` GET reads the object, retains both fields only if valid, and stores it with exact apiBase. `SubagentsWorkspace.tsx:47-60` forwards typed state; it needs no runtime logic change. The recommendation is not written to session-list cache. +4. **GUI interaction:** `ultraOn` remains derived from nonblank stored hint (`SubagentDelegationSection.tsx:57-60`). Enable uses recommendation.text, Clear sends null, Restore only updates local draft, Save sends draft. Recommendation-only refresh must not remount the editor; stored-hint changes still do. While a new API source is pending, the previous source's editor/hint disappears and all mode writes are disabled. +5. **Write input:** `/api/v2` accepts only the existing `multiAgentModeHintText?: string|null` for this behavior. Blank/non-string validation at route `:308-310` and unsupported-runtime preflight at `:335-339` remain before mutations. The recommendation object and revision are never sent back as configuration. The GUI PUT body at `Subagents.tsx:103-107` is JSON.stringify(patch). +6. **Persistence:** route `:390` calls `setMultiAgentModeHintText`. Its capability check remains first. Exact legacy strings become recommendation.text; arbitrary custom text, including one-space variants, stays byte-identical; null stays null. `features.ts:951-1061` owns dedicated/inline/boolean TOML forms, sibling/comment/EOL preservation and atomic writes; `:485` owns string escaping. Persist only `features.multi_agent_v2.multi_agent_mode_hint_text`. Never persist text/revision as extra TOML keys: native config rejects unknown members. +7. **Readback:** `getMultiAgentModeHintText` at `features.ts:935-937` uses `getV2StringField` at `:857`; no canonicalization on read. The successful PUT re-reads stored hint and independently returns recommendation. CLI `src/cli/v2.ts:138,151,167` reads or invokes the same writer, so CLI explicit writes also gain exact-legacy normalization without a CLI implementation edit. +8. **Other consumers:** `gui/src/pages/Models.tsx:476-486,1116-1127,1244-1255` deliberately projects flag/mode/thread/hybrid fields and ignores recommendation; `dashboard-core-poll.ts:233-244` projects mode only; `use-dashboard-data.ts:609-615` sends mode only. These clients need no new required field. Existing synthetic missing-recommendation responses remain useful old-server fixtures. `ULTRA_MODE_PRESET` has only the local component and `subagents-ultra-mode.test.tsx` consumers found in the repository. +9. **Native consumer boundary:** the stored hint is for native Codex sessions; OpenCodex's v2 request guidance does not read this field. Keep the v1 proactive constant and new recommendation as distinct owners rather than replacing one with the other. No capability claim or live native delegation behavior was tested here. + +### Regression activation + +Carry backend fixtures at pinned #3951 `codex-v2-gate.test.ts:52-57,434-446,1382-1412`. Independently pinned release strings must remain in tests; do not import the production legacy array, which would make deleting a compatibility entry delete its oracle too. + +Backend cases: each legacy input canonicalizes only on an explicit write; GET preserves exact TOML bytes; unrelated PUT preserves stored legacy; successful PUT returns canonical stored hint plus unchanged recommendation; re-save is changed:false; adjacent comments and concurrency limit survive; null clears; whitespace variants/custom text survive; unsupported binary leaves a combined request unchanged; existing inline, dedicated, boolean, CRLF, quoting and multiline-refusal tests remain active. + +Small additional hunks recommended in the same registered file: + +- Beside baseline API tests at `:1360`: PUT a custom string with leading/trailing spaces, newline, quotes and backslash; assert exact response hint and decoded TOML equality, same recommendation, and no persisted recommendation/revision keys. Assert a recommendation-only body is rejected without changing files, and recommendation extras beside a valid hint never replace the server constant. +- Beside CLI test at `:1626`: `cmdV2(["mode-hint", legacy])` for both released values; read/status returns canonical text; re-save no change; custom one-space variant preserved; `--clear` removes only hint. Use `fixtureConfig`, temporary CODEX_HOME and `installModeHintRuntime(true)` with existing cleanup. + +GUI cases, pinned [subagents-ultra-mode.test.tsx:126-318](https://github.com/lidge-jun/opencodex/blob/db502d486c8d8de80c0143fcfd6f86238d1ce917/gui/tests/subagents-ultra-mode.test.tsx#L126): distinctive server text in exact PUT; missing/bad fields block install; existing custom text remains editable/clearable; Restore sends no PUT; Save sends one; A -> pending B hides A and blocks writes; B missing/malformed/valid selects correct behavior; late A response cannot overwrite B. Preserve recommendation-only refresh draft test in `multi-agent-guidance.test.tsx:154-182`. Extend malformed matrix with null, empty revision, omitted text/revision, and non-object values; no local preset fallback. + +Remote-only focused activation: `bun test tests/codex-integration/codex-v2-gate.test.ts`; from gui, `bun test tests/subagents-ultra-mode.test.tsx tests/multi-agent-guidance.test.tsx`. **NOT RUN here.** The existing test-layout entries are already present at `scripts/test-layout/layout.json:488,825` and `tests/fixtures/test-layout-expected.json:323,660`; additions to these existing files need no new registration. GUI test discovery already covers `gui/tests`. Main's full hosted gates remain authoritative. + +## UI proof: hosted bundle, synthetic API, existing browser (main-owned) + +The author's missing screenshot is **not a blocker**. Use the current workflow's existing artifact: [ci.yml at baseline](https://github.com/lidge-jun/opencodex/blob/9e1468d4b7a41b498ed2aca98507ada2c741afea/.github/workflows/ci.yml#L451). The `gates` job builds GUI when GUI changes, writes `build-commit.txt` / `build-gui-tree.txt`, and uploads `dashboard-preview-${github.sha}` (`:451-470`). No workflow edits are required for this source lane. + +Main's execution recipe: + +1. Select the hosted artifact covering the cumulative carry candidate. Verify run/event/head, archive artifact ID, build-commit, and build-gui-tree against the actual CI checkout. A pull_request merge SHA may differ from branch head; record that and prove the GUI tree matches the carried candidate. Do not relabel an old artifact as current. +2. Unpack into isolated scratch; serve prebuilt JS/CSS/assets unchanged using a small static/synthetic HTTP server. No Bun/Vite/TypeScript build or product server locally. Fixture state lives in memory and receives only synthetic local requests. +3. Serve the actual SPA at `/#subagents` (`gui/src/App.tsx:431`) and open Advanced (`SubagentDelegationSection.tsx:235-236`). Supply synthetic bootstrap metadata in served HTML: token `ocx_session_fixture`, CSRF `fixture-csrf`, browser/server origins equal the scratch origin. `gui/src/api.ts:90-105,139-149` requires these fields. This modifies only served bootstrap HTML, not bundled implementation. Implement the fixture bootstrap path if requested; never connect it to the user's daemon or credentials. +4. Minimal page fixtures: GET `/api/subagent-models` -> `{available:[],chosen:[]}`; GET `/api/subagent-model-fallback` -> `{available:[],models:[],pollMs:60000}`; GET `/api/injection-model` -> `{multiAgentGuidanceEnabled:true,syncCodexSubagentDefaults:false,model:null,effort:null,efforts:[],available:[]}`. Give other app-shell reads safe synthetic responses with appropriate content types; record requested routes rather than silently forwarding unknown routes. Nonfixture writes must fail closed. +5. GET `/api/v2` baseline -> `{enabled:true,multiAgentMode:"v2",keepNativeChatGptOnV1:false,multiAgentModeHintText:null,multiAgentModeHintRecommendation:{text:,revision:"proactive-trigger-v1"}}`. PUT validates/captures the JSON patch, changes only fixture hint/mode, and returns fresh full state plus `ok:true`. Subsequent GET echoes that state. Use the exact candidate text for screenshots, and a second distinctive text/revision for source-of-preset behavioral proof. +6. Exercise: enable -> expected text PUT and editor; edit custom -> no PUT until Save; Restore -> draft changes without PUT; Save -> exact text PUT; Clear -> null; missing and malformed recommendation with/without existing hint; disabled v2; initial GET 503 then retry; PUT 502 -> error without false saved state. Keep request log assertions next to screenshots. +7. Server switching: the actual App keys Subagents by sharedBase (`App.tsx:431`), while unit tests also cover in-place prop updates. Use two synthetic fixture sources through the existing connection UI if supported by the host; otherwise retain hosted component-test proof for the delayed A/B update and explicitly label that branch browser-NOT-RUN. Do not rebuild a special component harness locally or fake a source switch by altering product code. +8. Capture the changed component at 1440, 1024, 768, 390 and dense 320 px widths; EN and KO long labels, light/dark and visible keyboard focus. Check textarea readability, label/button clipping and horizontal overflow. Save representative off/on/custom/old-server/error screenshots and viewport/state/request-log manifest. No need for decorative assets. + +Suggested main-owned scratch outputs: `ui-v2/source-manifest.json`, `ui-v2/requests.jsonl`, `ui-v2/en-desktop-on.png`, `ui-v2/ko-mobile-custom.png`, `ui-v2/old-server.png`, `ui-v2/error-retry.png`. This lane has created none of them. Screenshots prove the carried GUI rendering and fixture interaction; they do not prove real native delegation or TOML persistence. Backend hosted tests supply persistence evidence. Main can attach its observed images to the carrying PR; it need not wait for the author's images. + + +Main decision: preserve original 23-file diff and all regressions. Suggested extra CLI/API test cases remain a targeted audit decision rather than mandatory scope expansion. Sync structure/03_catalog-and-subagents.md and structure/05_gui-and-management-api.md with the response-only recommendation and explicit-write behavior. Render QA uses the existing built artifact. + +## wp4 P refresh and artifact publication + +Previous wp3 D: PR3992 at3ceef0121 passed CI34181398746, target-check rerun34181398713, independent source/security audit and425page remote docs build. Proceed server-owned preset. Candidate5b60a4fa7+e5a6f35b8 was independently audited25files; all25preimage files on actual predecessor3ceef0121 equal candidatebase8000e2482. Preserve original contribution and both layers of agent guides. + +UI proof uses the immutable matching hosted dashboard artifact and reviewed auxiliary stdlib fixture at /tmp/ocx-bug6-prep-v2-01a07e9d/.tmp/ui-v2/server.py. No product server/build or actual account operations. Capture and inspect representative desktop/mobileEN/KO, valid/custom/restore/save/clear/missing/malformed/error cases; hosted tests retain in-place delayed-server-switch coverage. Publish only sanitized screenshot assets on an owned evidence branch via noverify push and link immutable commit URLs in this PR, so adding review evidence does not rewrite the tested product head. This evidence-only branch is not another product PR or native stack. Actual product delivery remains the one six-layer chain. Preserve asset provenance/buildGUI-tree checks and teardown proof. + +## C render foldback: narrow editor layout + +Real prebuilt GUI capture at320px shows an unbroken configuration-key hint clipped and the textarea compressed beside both actions;390px has no page overflow but editing space is unnecessarily narrow. Evidence ui-qa/ko-320-custom.png and ko-mobile-custom.png under ignored scratch. This is a bounded improvement of the changed preset surface, not a claim that the original PR introduced the old layout. + +MODIFY gui/src/styles-subagents-workspace.css only: add overflow-wrap:anywhere to existing delegation setting hints; give the preset editor a minmax(0,1fr)/auto/auto grid with min-width0 textarea; reuse existing640px media breakpoint to span textarea across a full first row and place two actions on the second row. NoJS, labels, fields or authority semantics change. Rebuild only remotely; compare head-stamped320/390/1440captures and DOMwidth/textareawidth, plus existing frontendgates. Retain prior functional UI request evidence becauseJS unchanged; verify a representative Save on finalrender. Main re-audits this CSS scope before B and captures finalartifact before publishing screenshotproof. + +## C verification foldback: bounded guard probes + +Run34183701289 timed out on macos1/2 after test-home-guard passed its unregistered-home case, then Bun reported a dangling process. Runtime root cause remains unproven (H1retainedchildhandles/H2syncwait/H3isolate state); source establishes an unbounded synchronous probe owner. This is a verification-harness correction, not a claim to fix Bun internals. No production guard behavior changes. + +MODIFY tests/ci-workflows/test-home-guard.test.ts only: convert runProbe and all its callers to awaited async Bun.spawn; reuse exported captureTestOutput from scripts/test.ts (its executable entry is import.meta.main gated, already imported by test-runner tests); preserve exact argv/cwd/environment filtering/fake homes and all existing assertions. Use existing watchdogMs(5000) below CI60s test ceiling, bounded execution/TERM/KILL/reap/output-drain stages with cleared timers and cleanup of probe scratch. Require natural exit0, no signal, complete output; timeout/nonzero/incomplete/unreaped is a thrown diagnostic, never a success marker. Record safe probe-boundary ID/PID/exit diagnostics without inherited environment. Add synthetic nonzero-exit and nonterminating-probe controls proving failures are reported and owned child gone; do not skip guards or extend CI deadlines. All product verification stays remote. If new diagnostics still stall/fail, investigate that boundary; passing the converted harness is not an upstream-root-cause claim. diff --git a/devlog/_fin/260908_bug6_manual_stack/050_credit_alias.md b/devlog/_fin/260908_bug6_manual_stack/050_credit_alias.md new file mode 100644 index 0000000000..30c38ee20b --- /dev/null +++ b/devlog/_fin/260908_bug6_manual_stack/050_credit_alias.md @@ -0,0 +1,29 @@ +# wp5: canonical reset-credit operation identity + +Historical phase record. Delivery is complete; see [071](071_delivery.md) and [072](072_final_proof.md) for terminal evidence. + +Depends on wp4 for the owner-requested delivery chain. C4; no live credit consumption. Source PR #3965 at `6c1477d19c7d1a77a1866cabfd2b4411f1a210d7` carries #3919 by luvs01. Revalidate both source heads and current dev before implementation; do not rewrite their branches. + +## Published patch to carry + +- MODIFY `src/codex/auth-api.ts` at the reset consume handler: `const identity` becomes `let identity`; after execute admission assign `identity = { ...identity, operationId: opened.operationId };`. Upstream dispatch and both durable settlement paths then share the canonical operation ID. Authentication, admission failures, account binding and terminal replay stay before this assignment. +- MODIFY `tests/codex-integration/codex-auth-api.test.ts`: import the existing ledger opener, assert a settled alias replay consumes no additional credit, and construct truly pending canonical operations for thrown fetch, non-2xx and unknown-code alias failures. Assert the durable row becomes ambiguous while account key and canonical ID remain unchanged and terminal code remains null. +- MODIFY `docs-site/src/content/docs/reference/management-api.md`: carry the source paragraph distinguishing unfinished alias joins, known terminal replay and new explicit intent after settlement. + +Retain `Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>` and original source commit references. Do not carry auto-redeem worker changes: #3970 is already on baseline. + +## Verification + +The final immutable three-file source range is `abb46a1599ec0d0bbfbe03905114178df92e67f5..62412d38606851f7cace76360f3c5737db9cae20`; the landed equivalent is `abb46a1599ec0d0bbfbe03905114178df92e67f5..402be7c1f88283eb8465c3aec8437ccecd2542ec`. These final pins supersede the initial intake head above. A live source-head mismatch requires renewed comparison before carry; the mutable PR files page is navigation, not patch authority. Each negative fixture begins pending, so it observes the changed failure-settlement path instead of rechecking an already ambiguous row. Existing no-operationId and ordinary terminal paths remain regression controls. Hosted CI runs the auth and ledger suites; local tests/typecheck/build/install are NOT RUN by owner instruction. A source/security reviewer verifies the exact carried head before merge. Existing source-PR CI failure is historical and must not be described as passing. + +All additional unpublished security analysis lives in ignored `.tmp/bug6-01a07e9d/credit-plan.md` and later audit artifacts. It must not be copied into this public unit. + +## wp5 P refresh + +Previous wp4 D certified PR3993 head727683f44 with CI34185870948, source/security/GUI audits, QA and remote docs. Proceed canonical alias carry. Live refresh supersedes the prepared pin: #3965 merged at03:17:07Z with head62412d386 and merge402be7c1f; prepared bdb9f4bfe+9eb44cfb4 passed two source/security audits. All three target files on actual predecessor727683f44 equal preparedbase d1f61e933; intervening V2/GUI/test-harness deltas do not modify this owner. Keep exact3filecarry and original attribution. No real credentials/resetcredits and no localproductcommands. Actual adoption equality and hostedCI remain required. + +## Verified landed disposition + +Current origin/dev402be7c1f contains the #3965 merge402be7c1f. Its three target files exactly equal prepared candidate9eb44cfb4 (git diff exit0); PR CI34181771859 passed at exacthead62412d386, including Linux4/macOS2/gates. Thus the source item is already landed, not a new product fix. The initial A narrative retained the old OPEN assumption; this fresh source/API evidence corrects it before B. + +NOOP for a new PR. Adopt the identical two contribution commits locally only as the prerequisite for wp6; preserve provenance and contributor credit. The final new recovery PR targets existing layer4 and explains the already-landed alias dependency in its base-relative diff. No duplicate fifth PR is created and no original branch is rewritten. c5 closes on live merged-state/CI/ancestry/file equality evidence; wp6 and final cumulative integration still run their full gates. The single product stack has five new PRs plus this independently landed sixth source item. diff --git a/devlog/_fin/260908_bug6_manual_stack/060_credit_recovery.md b/devlog/_fin/260908_bug6_manual_stack/060_credit_recovery.md new file mode 100644 index 0000000000..1fe1b8137e --- /dev/null +++ b/devlog/_fin/260908_bug6_manual_stack/060_credit_recovery.md @@ -0,0 +1,43 @@ +# wp6: manual reset recovery + +Historical phase record. Delivery is complete; see [071](071_delivery.md) and [072](072_final_proof.md) for terminal evidence. + +Depends on wp5 canonical operation identity. C4. Implements the user-visible contract in public issue https://github.com/lidge-jun/opencodex/issues/3973 . No real account actions or credit consumption are authorized by this development task. + +## File map and private implementation appendix + +- MODIFY `src/codex/auth-api.ts`: connect the authenticated manual operation with the existing quota-observation and routing-recovery ownership contracts. +- MODIFY `src/codex/routing.ts`: reuse narrowly targeted recovery ownership rather than broad account-health clearing. +- MODIFY `tests/codex-integration/codex-auth-api.test.ts` and `tests/codex-integration/codex-cooldown-recovery.test.ts`: mocked endpoint and ownership-race regressions using existing fixture conventions. +- MODIFY `docs-site/src/content/docs/reference/management-api.md` and `structure/08_openai-provider-tiers.md`: document the resulting supported contract when the patch is public, without account examples or internal proof material. +- NO CHANGE to persisted ledger schemas, auto-redemption policy, selected-account policy, GUI, or real credentials. + +The complete before/after design, exact current source anchors, threat model, reachable activation cases and observable negative assertions are recorded in ignored `.tmp/bug6-01a07e9d/credit-plan.md`, section "Layer 2", against baseline `9e1468d4b7a41b498ed2aca98507ada2c741afea`. This is a mandatory implementation appendix, not deferred planning. Repository AGENTS.md requires unpublished security working notes to stay in scratch, overriding public devlog placement. Both the A reviewer and B worker must read the appendix; loss of the appendix requires reconstructing and auditing it before B. + +## Acceptance and verification + +Only the matching account's eligible pre-existing cooldown may be recovered after confirmed reset and fresh supporting evidence. Ordinary successful requests, uncertain results and replay do not gain broader recovery authority. Existing unrelated scopes and caller selections remain intact. The private appendix enumerates the full mocked positive/negative matrix and claim cleanup requirements. + +Run no local product commands. Hosted CI must execute the affected auth, cooldown, quota and provenance suites; independent security review remains required. PR #3848 overlaps the flight interface: refresh before B and integrate any landed change without absorbing its unrelated registration behavior. New code belongs to this owned stack; do not modify other open PRs. Record privacy-safe outcome evidence here only after publication. + +## wp6 P refresh + +Previous wp5 D verified #3965 already landed in dev402be7c1f, exacthead62412d386CIpassed, and locally adopted identical prerequisite (926b3719f); no duplicatePR5. This recovery PR targets existing layer4 #3993 and identifies the already-landed alias prerequisite in its relative diff. Source3973 remains open. Fresh inventory found overlapping contributorPR3995 (e172453052bf7bbc4a0ae5aa24592982c0c64b15) and independent fallbackPR3997; the latter resolves3996 and is outside this goal. The earlier no-overlap narrative was incorrect and is superseded before B. + +Prepared recovery e6e081c09 plus repair a87a3f624 passed independent security and behavior audits. The private repair synthesis and updated handoff under ignored scratch resolve main-publication ordering and positive refresh provenance; never copy security working analysis into this public unit. All six target preimages on actual predecessor926b3719f equal auditedbase9eb44cfb4. Revalidate the unchanged candidate across intervening V2/GUI/testharness context, then adopt. All mocked regressions, current-head hostedCI, privacy, finalfullcohort proof and source-item closeout remain required. No localproductcommands or realcreditactions. + +## Concurrent source reconciliation in P/A + +Review new3995 against the prepared candidate before adoption. Preserve originalcontributor credit and include its useful language/CLI docs or regression cases when source comparison warrants. Existing prepared recovery provides bounded claims/publication/provenance invariants; no competing implementation is accepted solely from prior green claims. Comparative security/behavior source reviews are in progress, all notes remain scratch. No productdelta forwp6 has been adopted yet. + +## Consolidated source decision + +Retain audited recovery e6e081c09+a87a3f624 and consolidate contributorPR3995 rather than creating competing deliveries. Comparative security review retains its PASS; detailed algorithm findings remain private in credit3995Comparison.md. Keep pause/reauth eligibility and existing background lease ownership conservative and document that recovery can remain pending under those conditions. #3997/#3996 stays outside scope. + +Additional MODIFY paths: docs-site/src/content/docs/ko/reference/management-api.md and docs-site/src/content/docs/reference/cli/providers-accounts.md, carrying the matching contributor guidance with parity to the final conditional recovery contract. This expands six unique files to eight. Do not duplicate the fuller English API paragraph. Adapt PR3995 tests into the existing auth-api test: two cold-main reset/already_redeemed cases without prior listing/reconciliation, bogus consume99 versus freshWHAM1; strengthen the existing saturation test with pre-existing shared cooldown, one consume, zero usage and retainedcooldown; adapt the two-old-flight/current-generation convergence scenario to assert fresh fourthdispatch completes before oldresponses, then oldresponses cannotoverwritefreshquota or recoveredcooldown. Preserve and await every deferred fixture cleanup. No new testfile, account-store schema or CLI runtime change. + +Carry sourcee172453052 with Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> in the adaptation commit and final PR body; describe exactly which tests/docs are adopted. B includes local candidate adoption and these bounded test/doc additions; independent interdiff review and exacthead hostedCI remain mandatory. No local tests/install/typecheck/build or realcredits. + +## C fixture foldback + +CI34188041321 caught a shared401-recovery budget leaking between fake-home cases: prior manual-a selfrefresh spends generation2, and the next case creates a different generation2 in a newhome but doesnotreset the module budget. The early spent-budget refusal prevents the intended external-replacement replay. MODIFY only the existing auth-api test: import/call resetQuotaRecoveryForTests in beforeEach/afterEach, assert empty budget at the negative-case start, observe real force-refresh provenance, and KEEP expectedfreshremaining2, replay URLs and cooldown-preservation assertions. No production relaxation. Also use existing watchdogMs(10000) and60souter ceiling for the new convergence fixture; its current run passed, so this is convention/contended-runner safety, not increasing a failing behavioral timeout. Source/interdiff review and newexactheadCI are required. diff --git a/devlog/_fin/260908_bug6_manual_stack/070_integration.md b/devlog/_fin/260908_bug6_manual_stack/070_integration.md new file mode 100644 index 0000000000..8a2dac4482 --- /dev/null +++ b/devlog/_fin/260908_bug6_manual_stack/070_integration.md @@ -0,0 +1,61 @@ +# wp7: hosted verification and integration + +Historical phase record. Delivery is complete; see [071](071_delivery.md) and [072](072_final_proof.md) for terminal evidence. + +Depends on wp1–wp6. The owner explicitly requested a single manual branch chain. This cycle changes only its delivery records and evidence; a discovered product defect is assigned an audited repair cycle before integration continues. + +## File changes + +- MODIFY this unit's `000_plan.md`: replace in-progress outcomes with exact source commit, PR, run IDs, tested heads and terminal dispositions; record failed/skipped checks separately. +- NEW `071_delivery.md`: six-row original-to-carried PR mapping, attribution, pinned GitHub evidence, active branch/base topology and merge result per layer. Store no account identifiers or private payloads. +- NEW `072_final_proof.md`: fetched dev SHA; per-layer ancestry command results; final candidate tree and landed tree comparison; unchanged pre-existing-file fingerprint verification. If a merge commit contains concurrent changes, isolate and explain each difference rather than claiming whole-tree equality. +- MOVE this completed unit to `devlog/_fin/260908_bug6_manual_stack/` only when all outcomes are terminal. Evidence generated before moving records both paths. Do not move other units. +- GUI screenshot files, if needed, use the existing `.github/pr-assets/` convention after verifying the generated image contains synthetic settings only. + +## Exact delivery actions + +1. For each nonempty candidate use a new owned `codex/bug6-01a07e9d-*` branch. Bottom base is dev; each upper base is the prior owned branch. Preserve author trailers and satisfy every section of `.github/PULL_REQUEST_TEMPLATE.md`. +2. Commit with `git -c core.hooksPath=/dev/null commit`; push with `git -c core.hooksPath=/dev/null push --no-verify`. No install, test, typecheck or build hook runs locally. +3. Read each PR's current head/base and native `stack` field. A native membership conflict is inspected without mutating membership. Our newly created ordinary PRs must remain manual. +4. Inspect `gh pr checks` and matching workflow runs. Before landing obtain final candidate `ci.yml` `workflow_dispatch` with `lane=all` as well as required PR checks. Bind conclusions to `head_sha`, event and run attempt. Retry failed jobs only after investigating the actual failure and ensuring it does not hide a product regression. +5. For the preset UI, download the hosted `dashboard-preview-*` artifact from the verified head. Verify `build-commit.txt` and `build-gui-tree.txt`; serve the prebuilt bundle with synthetic API fixtures on a disposable loopback port; observe preset activation/restoration and server-switch behavior in a browser; capture/read the screenshot. No local product compilation. Existing browser driver only, no installation. +6. Refresh MAINTAINERS.md, live actor permission, reviewer objections and security evidence. Record maintainer integration in the owned PR body. The repository deletes merged head branches: inspect direct children and retarget our next child to dev immediately before merging its parent, so automatic deletion cannot close it. Land only the bottom PR with `--match-head-commit`; verify the resulting integration head and CI evidence before advancing. Never merge an upper PR into its parent branch as if that landed it in dev. Do not change repository settings or unrelated children. +7. Fetch dev after each merge and prove the merged commit is an ancestor. At final integration compare actual trees against the final certified candidate, including any explicitly reviewed concurrent dev changes. +8. Refresh each original item and mark closed only if its entire user-visible bug is resolved by the landed tree. Preserve unresolved residuals as open; report the exact residual rather than treating overlap as duplication. + +## Activation and observation + +- Failed/queued/cancelled hosted job: inspect actual run/head; no merge until required evidence is successful. +- Base advances: recompute integration tree and obtain fresh evidence; old SHA checks are historical. +- A maintainer objection remains: resolve its concrete finding or obtain withdrawal before merge. +- A source PR lands concurrently: verify its actual delta and remaining contract; use an evidence-backed NOOP rather than reapplying it. +- UI stale-server or malformed-recommendation fixture: preset install disabled; custom edit/clear retained; no cross-server write. +- Final condition: all six source contracts mapped to landed results; no destructive changes to user files, service state or credentials. + +## Validation limits + +Local product tests, installs, typechecks and builds: NOT RUN by owner instruction. Hosted tests and independent source audits provide product evidence; docs-only filesystem/link/whitespace checks provide document evidence. Neither substitutes for the other. + +## wp7 P refresh + +Previous wp6 D:6904ecd9c passed CI34188893148 and source/security/interdiff audits; coldmain, busy, same-tick replacement and converged-flight regressions passed; docs425pages plus renderedlink/KOparity passed. Latestdev402be7c1f is pinned for integration. Read-only merge-tree predicts conflicts only in reference/management-api.md and codex-auth-api.test.ts because dev already contains the canonicalalias prefix. Both dev versions exactly equal our adopted alias predecessor9eb44cfb4; resolve those two to our current versions, which include that prefix plus the audited recovery. No pre-existing userfile overlaps the incomingdevdelta. + +Merge402be7c1f into the topbranch with hooksdisabled, preserving all other incomingfiles. Record exactresolvedtree, recheckcurrentdev, publishnoverify, and dispatchci.yml lane=all on that exacthead. NewPRchain is3986→3991→3992→3993→4002;3965alreadymerged. All original candidateheads retain passingPRCI; any rewrittenhead gets freshproof. Refresh each target/head/membership/review/CI before its separately authorized ordinary merge. Use merge commits to preserve ancestry/attribution, retarget each nextchild todev, and prove resolved integration content is covered by the certifiedtop. Current-headrequiredchecks and source/security duties remain separate. + +After productlanding, close only satisfied sourceitems, including superseded3995 aftercore3973lands; preserve3997. Archive this unit with an evidence-only closing PR if needed, so completedrecords do not change the tested product tree. Verify that closingdelta is documentation-only and receives its properCI; retain exact product-tree equivalence to the full-matrix candidate rather than attributing skipped productjobs to passingexecution. No release/main/preview/deployment changes. + +## Final CI repair amendment + +Full run34190287787 at f1b436324 failed Windows3/6: the first restart-help correctness test returned an unobserved exit status after its fixed10s synchronous subprocess bound. Other observed shards passed; wait for the complete run before deciding whether any additional repair is needed. The source investigation does not establish a Bun defect or a startup latency cause. + +Modify only `tests/cli/cli-restart-health.test.ts` for this repair. Replace synchronous spawning with awaited Bun.spawn, existing captureTestOutput and watchdogMs(10000). Preserve all eight command tests, arguments, private homes, output assertions and legitimate health exit1. Independently bound execution, TERM grace5s, KILL reap2s and output drain1s; clear timers and keep timeout, signal, rejected observation, incomplete output and unreaped child as failures even after eventual exit0/1. Use an outer cleanup envelope below the existing60s CI ceiling. Keep child ownership and avoid deleting an unreaped child's private home. Emit safe stage/PID/exit diagnostics without inherited environment or credentials. Add small controlled wrapper regressions for sticky timeout, incomplete output at0/1, unreaped child and spawn/observation errors; reuse capture-owner coverage for its internals. No production CLI or workflow timeout changes, assertion removal, skip, retry loop or local product execution. + +An independent plan audit precedes implementation; an independent patch audit precedes publication. Publish the repaired top head with hooks disabled and --no-verify, obtain fresh PR checks and a new full lane=all dispatch on that exact SHA, and verify the original Windows lane. Passing results establish that head's observed outcomes, not the historical root cause. The final docs build runs remotely on the integrated docs tree. Preserve failed-run evidence and all prior user files. + +## Last-layer ancestry repair + +Four lower PRs landed with exact predicted trees; current dev is `74f62f9c2914ead2fba474aa97734e322251bd46`. Candidate `f80f39d20e8395901d3b62758d118ea3a559a9f4` passed PR CI34193213502 attempt2 and full CI34193218874 attempt2 (26 named jobs and execution steps). Each investigated macOS retry was limited to its failed/cancelled job; prior failures remain recorded. + +GitHub refuses the last PR as conflicting even after its base metadata was refreshed to actual dev; ordinary GraphQL and REST merges both refused. Local merge-tree remains clean and equals candidate tree `1b3bd117702b86da5810b1ad21988a2c60df6d17`. The histories have two merge bases, `727683f44e9f1daa9b6b1e2dbf93167e4ce30cc1` and `402be7c1f88283eb8465c3aec8437ccecd2542ec`; this explains the need to simplify ancestry without claiming a proven server implementation cause. + +Merge that exact current dev into the owned top branch with hooks disabled. Before adding this record, require exact candidate-tree equality; no product files may change. Include only this integration record in the merge commit. Independently audit both parents and the exact record-only tree delta, preserve all 30 user files, push no-verify, and obtain fresh PR and full lane=all CI on the new head before merging #4002. Preserve the earlier successful candidate evidence as historical; do not label it new-head execution. All source closures and final archive duties remain pending until landing. diff --git a/devlog/_fin/260908_bug6_manual_stack/071_delivery.md b/devlog/_fin/260908_bug6_manual_stack/071_delivery.md new file mode 100644 index 0000000000..0598a4b401 --- /dev/null +++ b/devlog/_fin/260908_bug6_manual_stack/071_delivery.md @@ -0,0 +1,35 @@ +# Delivery and verification ledger + +Certified final head `5d5d35756b9b672aecf10a64be0db1f7afc144ae` has tree `5fba579b0d10183e921657dbcf4edbd166c20ec7`. All five owned PRs merged bottom-up, and actual product dev `9ad218a9bdd34ee33004c35706d78396bf02eef2` has exactly the same tree. + +| Owned PR | Certified head | Actual dev merge | PR CI run / attempt | +| --- | --- | --- | --- | +| #3986 | `d1f61e933b0cde3df3862baed65546a5cf81066f` | `7b2223776450804a6b8a4509a115dd42ee1b9c40` | 34178540141 / 1 | +| #3991 | `00eb47886690e7b24b0eed69b6d870c33ceade62` | `7730f666ee1acabe2cd7729ec56f4c53149d926c` | 34180674115 / 1 | +| #3992 | `3ceef0121712b290c3d4443e9fc3f0a04cecead6` | `74292a21e6d504960ef753b403341498fd5bfe30` | 34181398746 / 1 | +| #3993 | `727683f44e9f1daa9b6b1e2dbf93167e4ce30cc1` | `74f62f9c2914ead2fba474aa97734e322251bd46` | 34185870948 / 1 | +| #4002 | `5d5d35756b9b672aecf10a64be0db1f7afc144ae` | `9ad218a9bdd34ee33004c35706d78396bf02eef2` | 34198172044 / 1 | + +Final full `ci.yml` workflow_dispatch lane=all: [34198186409](https://github.com/lidge-jun/opencodex/actions/runs/34198186409), attempt2. All 26 named jobs and mandatory execution steps were verified successful. PR #4002 CI [34198172044](https://github.com/lidge-jun/opencodex/actions/runs/34198172044) passed at the exact final head. A successful attempt2 summary includes successful jobs retained from attempt1; it does not mean those jobs executed again. + +## Failures and bounded repairs + +- Go's initial synthetic userinfo fixture failed privacy scanning; fixture construction was corrected before candidate CI34178540141 passed. +- The preset's home-guard subprocess stalled on macOS. Its bounded execution/reap/capture repair retained all10 original fixtures and38 assertions; CI34185870948 passed. The native cause remains unproven. +- Recovery CI34188041321 exposed shared test-budget state between synthetic homes. Isolation was corrected without dropping assertions; CI34188893148 passed. +- Full34190287787 at f1b436324 failed Windows restart-help with an unobserved synchronous child exit at10s. The bounded asynchronous CLI harness retained8 original tests/18 assertions and added10 lifecycle controls. Independent source review and later Windows execution passed. +- At f80f39d20, PR34193213502 attempt1 hit a macOS job cancellation at an unchanged injection-lock test boundary. Same-head full macOS1 passed the same tests; one investigated job-only rerun passed. Full34193218874 attempt1 separately timed out in an unchanged Copilot cancellation test; the same-head macOS shard passed that case. One control-only rerun passed, with21,805 main-suite passes and0 failures. Scheduler, ordering and native causes were not established. +- After four parents landed, GitHub refused the last merge while local merge calculation was clean. Two common ancestors were observed. The final ancestry merge incorporated actual dev74f62f9c; independent review proved that only the070 record changed from the already certified f80 product. Fresh exact-head CI was obtained; no old run was relabeled as execution on the new head. +- Full34198186409 attempt1 failed Windows3 cleanup: EPERM removing a fixed test directory in afterEach caused subsequent setup/cleanup failures. Identical product files had passed the preceding Windows3 run. Independent inspection supported one failed-job-only diagnostic rerun. Job101977029312 passed3,304 tests with0 failures; the affected TTL case passed172.72ms. The handle/permission owner remains unknown. No test threshold or product code changed for this retry. + +Passing jobs were retained during these job retries, not rerun. Failed/cancelled attempts remain historical evidence. No root-cause or flake-eradication claim follows from a successful retry. + +## Attribution, UI and documentation + +The carried Go intent retains `Co-authored-by: jpierrevd <265811239+jpierrevd@users.noreply.github.com>`. V2, alias and adapted #3995 coverage/docs retain `Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>`. Merge commits preserve their history. The lossy mixed-ciphertext filtering proposal from #3838 was declined; fail-closed behavior remains. + +Dashboard tree `b0bc09ba867906375e52cf0180caa4ea4ea95bea` equals the inspected artifact tree. Hosted artifact10039810403 from34183701289 was observed against a synthetic API: enable, exact custom Save, draft-only Restore, Clear, malformed/missing recommendation, error/retry, server switching,320/390px and desktop layouts, and keyboard focus. Two independent reviewers accepted it. Immutable screenshots are in [#3993](https://github.com/lidge-jun/opencodex/pull/3993), evidence commit924327cdd71a14a0aea1936e4c5e1f6b6b660438. Owned fixture/browser ports were closed. + +Docs tree `7041e912691a5150893fbf4f782734c94e49d056` equals the remotely built integrated tree. Bun1.4.0 / Node24.20.0 frozen install and build on isolated macmini-cf scratch produced425 pages; rendered CLI/API anchor and English/Korean recovery text were checked. Archive SHA-256 a51cdbd83f409472defcb7758873734edba167f116a17869ec345366e0e9063d. An early incomplete-transfer attempt was excluded from passing evidence. No docs deployment occurred. + +Local product tests/install/typecheck/build: **NOT RUN**. This archive changes only this unit's Markdown records; its own metadata/CI/privacy verification is separate from product execution. diff --git a/devlog/_fin/260908_bug6_manual_stack/072_final_proof.md b/devlog/_fin/260908_bug6_manual_stack/072_final_proof.md new file mode 100644 index 0000000000..7763124487 --- /dev/null +++ b/devlog/_fin/260908_bug6_manual_stack/072_final_proof.md @@ -0,0 +1,23 @@ +# Actual product landing proof + +Verified 2026-09-08. Final candidate `5d5d35756b9b672aecf10a64be0db1f7afc144ae` and fetched product dev `9ad218a9bdd34ee33004c35706d78396bf02eef2` have identical tree `5fba579b0d10183e921657dbcf4edbd166c20ec7`. `git diff --exit-code` returned0. Each owned head and actual merge commit is ancestral to fetched dev; #3965's existing402be7c1f merge is also ancestral. + +| PR | Actual merge commit | +| --- | --- | +| #3986 | `7b2223776450804a6b8a4509a115dd42ee1b9c40` | +| #3991 | `7730f666ee1acabe2cd7729ec56f4c53149d926c` | +| #3992 | `74292a21e6d504960ef753b403341498fd5bfe30` | +| #3993 | `74f62f9c2914ead2fba474aa97734e322251bd46` | +| #4002 | `9ad218a9bdd34ee33004c35706d78396bf02eef2` | + +Before each merge, current head/base, actor admin permission, maintainer roster/reviews, CI, native membership and direct-child inventory were refreshed. The dev-only maintainer-integration decision and exact verification were recorded in each owned PR body. No maintainer change request remained. Independent technical/security review duties were retained; this was not self-approval. Native stack membership was empty. + +The first four actual merge trees matched their serial predictions. GitHub's final merge refusal was repaired with an independently audited ancestry merge; the final actual dev tree then matched the newly certified head exactly. Full CI34198186409 attempt2 verified all26 named jobs and mandatory execution steps; PR CI34198172044 attempt1 passed. Earlier failed attempts are recorded in071. + +Sources3838/3944/3951 are closed, issue3907 is completed, and3965 was already merged. After actual4002 landing, issue3973 was completed and3995 was closed as consolidated. The scope excludes3997/3996. Thirty original user files matched their pinned SHA-256 values with0 missing and0 mismatched; they were excluded from all commits. Scratch/evidence directories remain untracked. + +## Archive-only completion record + +This closing change moves exactly this unit from `devlog/_plan/260908_bug6_manual_stack/` to `devlog/_fin/260908_bug6_manual_stack/`, updates its terminal records and adds this proof. Product content is unchanged. The closing PR and session receipt verify the exact old/new paths, regular-file modes and blob IDs against the reviewed delta, plus closing CI/metadata and a remote privacy scan. Documentation-only skipped product jobs are NOT RUN, not passing product executions. + +The closing PR's own merge SHA cannot be embedded in the commit that creates it. Its observed post-merge ancestry and exact record-only delta are verified after landing in the final session receipt and delivery report, rather than predicted here. diff --git a/devlog/_fin/260908_c248_individual_fixes/000_plan.md b/devlog/_fin/260908_c248_individual_fixes/000_plan.md new file mode 100644 index 0000000000..3dca83c8cb --- /dev/null +++ b/devlog/_fin/260908_c248_individual_fixes/000_plan.md @@ -0,0 +1,33 @@ +# Lane C: independently reviewable 2.48 preparation fixes + +Scope: satisfy-spec HOTL requested by the owner on 2026-09-08. Goal: independently land #3953, #3899 and the timezone-only part of #3950 into dev, retaining original authors. This returned/stored roadmap is the memory artifact. Baseline dev: `514350e6f79ed4539378388bc39d3fc79ff2c70c`. No resource budget was specified; native host limits apply. Tool scope: local Git/source/artifact checks, GitHub repository/Actions, and explicitly authorized A/B coordination; astra high read-only auditors. No local product tests, typechecks, builds or dependency installation, including incidental Git-hook execution. Use per-command `git -c core.hooksPath=/dev/null` for mutating Git operations, and `push --no-verify`; do not modify shared Git configuration. + +## Work phases and ownership + +`roadmap` (this docs-only full PABCD) precedes three independent delivery cycles: `privacy`, `release_notes`, `timezone`. `reconcile` depends on those deliveries and lane B's JWT evidence. The processing order is scheduling, not a code dependency: each delivery remains a separate dev-targeted PR. Reuse original #3953 if unchanged and reviewable; carry #3899 onto current dev if needed; timezone gets a new PR sourced from only commit 1d8f6ff7e8d48f33c3ce7a1b7118068754bbbe83. Never create a combined code-delivery PR or squash different bugs together. Local roadmap/outcome commits stay on this coordination branch until a separate documentation-only closeout is appropriate. A separately audited evidence-only workflow branch may add supplemental hosted platform proof without entering any delivery PR or changing its required CI. + +## Boundaries + +No JWT changes, provider/routing work, main/preview promotions, version changes, deployments, release execution, live-account/service probes, history rewriting or public reproduction of removed material. Confidential investigation stays in ignored `.tmp/c248/`. The public docs describe only approved correction scope, not sensitive values. No new runtime type/enum/field is added, so creation/serialization/deserialization/consumer field-chain work is N/A. + +## Verification contract + +The roadmap uses actual file and source-object inspection plus `git diff --check` (run in this checkout before the roadmap close). Delivery uses the repository's existing hosted CI on each PR's current head; source-sensitive suites and the actual workflow scope must be checked. Local product commands are explicitly NOT RUN. No blind retries, cancelled/skipped/pending-as-pass, broad test weakening or artificial screenshots. A docs-only scope check is not a product-suite pass. Head rewrites require fresh current-head evidence. If dev moves, classify the actual delta and do not claim an unexecuted integration tree was tested. Before merge, validate required gates and exact head; preserve unrelated destination changes and prove the landed source diff. + +## Integration coordination + +The active A and B workstreams agreed on `/ocx-248-dev-merge.lock`: atomic mkdir, owner.json with sessionId/pid/hostname/PR/SHA/acquiredAt, owned only from final refresh through landed verification. Never hold it while waiting for CI or delete another owner's lock. This is a cooperative serialization convention, not a security boundary; an uncooperative actor can bypass it. The main thread resolves collisions, missing permissions or contradictory evidence without expanding worker scope; a new worker slice requires a plan amendment, and two distinct failed workers return the slice to main. + +Use the repository PR template and MAINTAINERS.md. Explicit maintainer integration is allowed only after checking live identity/role, outstanding objections, required CI, and required security review. Existing PR head authors remain attributed; carried commits use cherry-pick provenance and a Co-authored-by trailer surviving squash. After landing, verify merge SHA ancestry, actual file delta, destination preservation, and authors. Close original carry PRs only then. #3950 stays open until both timezone and B JWT fixes are proven on dev; C owns final closure. A/B status contributes to a readiness report, not release authority. + +## Stop and outcomes + +DONE requires all three delivered/proven already present and #3950 reconciled; final report lists source PR, delivery PR, landed SHA, actual CI results, authors and residuals. A blocked item does not stop independent work. Missing authority or unsafe evidence is unresolved, not a successful criterion. Read goalplan/ledger after each D and continue remaining cycles. Scope does not include a fixed cost/time budget or new paid service purchases. + +## Roadmap audit and completion + +Independent astra high roadmap audit: PASS, no blocking findings. The timeout prose was aligned with the dedicated child marker used in the exact patch. The roadmap-only check is Git diff whitespace plus independent source/semantic audit; no product suite was run. Next cycle: adopt and validate the unchanged #3953 correction. + +## Final reconciliation + +Privacy and release-note cycles completed before the timezone cycle. All delivery evidence and residuals are in050_outcome.md. Original3950 closed after both BJWT and Ctimezone landing proof. This unit archives to_fin through a separate docs-only PR; no product commit is combined with this record. diff --git a/devlog/_fin/260908_c248_individual_fixes/010_privacy.md b/devlog/_fin/260908_c248_individual_fixes/010_privacy.md new file mode 100644 index 0000000000..6e22b7a5f2 --- /dev/null +++ b/devlog/_fin/260908_c248_individual_fixes/010_privacy.md @@ -0,0 +1,19 @@ +# Phase privacy: adopt the exact #3953 correction + +Source SHA: 05fd82807b4a0014f84b9d74d05b70a3591cb574. Source URL: https://github.com/lidge-jun/opencodex/pull/3953 + +MODIFY the two existing records under devlog/_plan/260904_provider_quota_refresh/: 030_wp3_live_verification_and_pr.md and 031_live_verification_record.md. DELETE assets/030_accounts_refresh_button.png and assets/040_accounts_refresh_result.png. The exact after-content is the existing source SHA's Git blobs, retrieved by `git show :`; do not copy removed values into this plan. The two deletions and two post-image blobs define the complete executable patch; no other path changes. Reuse the unchanged existing PR if its head still matches; otherwise refresh and re-audit instead of force-pushing the contributor branch. + +Acceptance: both asset paths are absent in the candidate tree; no retained Markdown literal reference points to them; the isolated-instance and real forced-read evidence remains; the cleanup statement still says moved to Trash, never permanent destruction. Do not open/display either removed PNG. Independent privacy/semantic review checks this exact source. Current-head hosted PR scope check and aggregate must complete, with all skipped jobs described as skipped. Inspect full candidate delta and workflow equality before approving a fork run. No public operating values are recorded in new artifacts. Public documentation is the SoT target; history cleanup is out of scope. + +Rollback: retain source/landed SHAs, but do not automatically reintroduce removed captures; any rollback needs explicit privacy assessment. Completion uses actual merged PR state/merge SHA, touched-path equality, unchanged destination paths and author attribution. + +Execution decision: use a maintainer-owned carry PR with the identical source commit. The contributor checklist asks for local-CI attestation that this run cannot truthfully supply under the no-local-product-check instruction; no source rewrite or new behavior is needed. Original #3953 remains open until the carry lands, and its author is preserved in the squash trailer. + +C review repair: CodeRabbit requested American-English afterward at the existing isolation sentence. Accepted one-word correction in 0ed232d5c, with surrounding historical facts unchanged. Previous CI 34166442230 passed 3 scope/aggregate jobs and skipped 10 product jobs; it does not certify the new head. The new head must be checked before landing. + +Source refresh correction: original #3953 advanced to ca21efd29730086ede902c4701124893ce58b404 before closure. It remains OPEN; any earlier closure claim in the operational task log was premature and has been corrected. The initial carry is already landed and must not be rewritten. Audit and carry the incremental 05fd828..ca21efd2 delta as a separate privacy follow-up: MODIFY 000_plan.md, 030_wp3_live_verification_and_pr.md, 031_live_verification_record.md under the source unit; DELETE assets/010_meta_usage_quota.png and assets/020_usage_refresh_result.png. Exact post-images are sourceca21efd2 blobs, retaining the landed afterward spelling. The complete delta is retrieved with git diff05fd828..ca21efd2 scoped to those five paths. Acceptance: one retention rule covers both Accounts/Usage, textual behavior and Trash historical outcomes remain, no PNG inspected, all four capture assets and all scoped old references absent, current-head hosted scope checks and fresh source/author/landing proof. + +Review synthesis: #3959 exposed two issues. Accepted the source plan/actual isolation mismatch and corrected both old restart sites so completed scratch evidence supersedes the working-service restart plan (fc6b07eaf). Declined history purge as explicitly outside owner scope; the historical reachability residual is preserved, not claimed fixed. Both review threads have documented dispositions. No runtime operation was performed. Latest head needs fresh hosted scope CI. + +DONE: initial carry#3955 landed9c54000c9 and follow-up#3959 landed01c23aedc. Current-head hosted scope CI34167651789 success3/skipped10, independent final privacy audit PASS, all known review findings dispositioned; automatic rereview was pending at merge and not counted as successful. Both landed trees, parents, dev ancestry and actual author trailers verified. Original#3953 closed at refreshedca21efd2. History purge remains explicitly outside scope. diff --git a/devlog/_fin/260908_c248_individual_fixes/020_release_notes.md b/devlog/_fin/260908_c248_individual_fixes/020_release_notes.md new file mode 100644 index 0000000000..de8b38e701 --- /dev/null +++ b/devlog/_fin/260908_c248_individual_fixes/020_release_notes.md @@ -0,0 +1,144 @@ +# Phase release_notes: exact leading enforcement marker normalization + +Source PR #3899, source SHA 4d6896cd0bd62434b4703a1956fe57a99cd4959a. MODIFY the three files below. Preserve/reuse the source PR's related numbered implementation record if carrying its whole commit; it is documentation for this same bug, not another feature. Security review covers title text handling only: no workflow, command dispatch, credentials, publishing or release execution change. SoT: structure/06_docs-and-release.md. + +Activation/acceptance: prefixed generated and carried notes lose only the exact leading marker in summaries and full changelog; conventional scope grouping and attribution remain; unrelated bracketed/nonleading/near-match markers remain. Hosted CI must execute tests/ci-workflows/release-notes.test.ts (via the existing shard manifest) plus required gates. Explicit security review is recorded before maintainer sponsorship/integration. No local tests or typecheck are run. Rebase/carry applies only to our branch, uses original author and -x/Co-authored-by, and exact current-head checks. Issue #3895 closes only after verified dev landing. One independent revert restores only this bug's diff. + +Exact source patch follows; refresh against latest dev at its P phase: + +```diff +diff --git a/scripts/release-notes.ts b/scripts/release-notes.ts +index 16627f5f9..d0a58a043 100644 +--- a/scripts/release-notes.ts ++++ b/scripts/release-notes.ts +@@ -546,8 +546,14 @@ export function parseGeneratedNotes(body: string): ReleaseNoteCategory[] { + const CONVENTIONAL_COMMIT_PREFIX = + /^(?:feat|fix|docs|chore|refactor|perf|test|build|ci|style|revert|merge|release)(?:\(([^)]+)\))?:\s*(.+)$/i; + ++function stripPrEnforcementPrefix(title: string): string { ++ const text = title.trim(); ++ const prefix = "[WRONG BRANCH] "; ++ return text.startsWith(prefix) ? text.slice(prefix.length).trim() : text; ++} ++ + export function cleanPrTitle(title: string, prNumber: number | null = null): { scope: string | null; text: string } { +- let text = title.trim(); ++ let text = stripPrEnforcementPrefix(title); + let scope: string | null = null; + const prefix = CONVENTIONAL_COMMIT_PREFIX.exec(text); + if (prefix) { +@@ -689,7 +695,7 @@ export function renderReleaseNotes(input: { + changelog.push(`Full Changelog: https://github.com/${repo}/compare/${from}...${to}`, ""); + } + for (const pr of allPrs) { +- changelog.push(`- #${pr.number} ${pr.title.trim()} @${pr.author}`); ++ changelog.push(`- #${pr.number} ${stripPrEnforcementPrefix(pr.title)} @${pr.author}`); + } + parts.push(changelog.join("\n")); + } +diff --git a/structure/06_docs-and-release.md b/structure/06_docs-and-release.md +index 8c6149802..886c8fc04 100644 +--- a/structure/06_docs-and-release.md ++++ b/structure/06_docs-and-release.md +@@ -227,6 +227,11 @@ so stable notes are the aggregate of their preview train. The raw commit dump is + intentionally gone — non-PR commits stay reachable via the Full Changelog compare link when + that link is available. + ++Both summary bullets and full-changelog titles strip the exact leading `[WRONG BRANCH] ` ++enforcement marker. Other bracketed text is preserved. Summary bullets still remove conventional ++commit prefixes and group by scope; full-changelog entries keep those conventional prefixes, ++PR numbers, and author attribution. This normalization does not change PR-target enforcement. ++ + The deterministic renderer produces the structure but not curated prose. Maintainers who want + the OpenAI-style grouped summaries can run the optional local polish step against the rendered + body (needs an OpenAI-compatible API key): +diff --git a/tests/ci-workflows/release-notes.test.ts b/tests/ci-workflows/release-notes.test.ts +index 11196108d..d27036008 100644 +--- a/tests/ci-workflows/release-notes.test.ts ++++ b/tests/ci-workflows/release-notes.test.ts +@@ -455,6 +455,20 @@ describe("rewriteTakeoverCredits", () => { + }); + + describe("cleanPrTitle", () => { ++ test("removes the enforcement marker before extracting scope and sentence casing", () => { ++ expect(cleanPrTitle(" [WRONG BRANCH] chore(release): promote validated 2.45.0 to main (#3813) ", 3813)).toEqual({ ++ scope: "release", ++ text: "Promote validated 2.45.0 to main", ++ }); ++ }); ++ ++ test.each([ ++ ["[Preview] chore(release): keep this marker", "[Preview] chore(release): keep this marker"], ++ ["fix: document [WRONG BRANCH] markers", "Document [WRONG BRANCH] markers"], ++ ["[WRONG BRANCH]ish: keep this title", "[WRONG BRANCH]ish: keep this title"], ++ ])("preserves meaningful title text: %s", (title, text) => { ++ expect(cleanPrTitle(title).text).toBe(text); ++ }); + test("strips conventional prefix, keeps scope, and sentence-cases the title", () => { + expect(cleanPrTitle("feat(providers): add Baseten Model APIs preset", 653)).toEqual({ + scope: "providers", +@@ -488,6 +502,55 @@ describe("cleanPrTitle", () => { + }); + + describe("renderReleaseNotes", () => { ++ test.each(["delta", "carried"])("removes the bot marker from summaries and full changelogs (%s)", source => { ++ const body = [ ++ "## What's Changed", ++ "### Chores", ++ "* [WRONG BRANCH] chore(release): promote validated 2.45.0 to main by @lidge-jun in https://github.com/lidge-jun/opencodex/pull/3813", ++ ].join("\n"); ++ const notes = renderReleaseNotes({ ++ npmMetadata: "", ++ ...(source === "delta" ? { deltaPrNotes: body } : { carriedPreviewNotes: [ ++ "## Chores", "", ++ "- [WRONG BRANCH] chore(release): promote validated 2.45.0 to main (#3813)", "", ++ "## Changelog", "", ++ "- #3813 [WRONG BRANCH] chore(release): promote validated 2.45.0 to main @lidge-jun", ++ ].join("\n") }), ++ }); ++ expect(notes).toBe([ ++ "## Chores", "", ++ "- Promote validated 2.45.0 to main (#3813)", "", ++ "## Changelog", "", ++ "- #3813 chore(release): promote validated 2.45.0 to main @lidge-jun", "", ++ ].join("\n")); ++ }); ++ ++ test("groups a bot-prefixed title with ordinary titles of the same scope", () => { ++ const notes = renderReleaseNotes({ ++ npmMetadata: "", ++ deltaPrNotes: [ ++ "## What's Changed", "### Chores", ++ "* [WRONG BRANCH] chore(release): promote verified version by @maintainer in https://github.com/lidge-jun/opencodex/pull/10", ++ "* chore(release): update notes by @contributor in https://github.com/lidge-jun/opencodex/pull/11", ++ ].join("\n"), ++ }); ++ expect(notes).toContain("- Release: Promote verified version; Update notes (#10, #11)"); ++ expect(notes).toContain("- #10 chore(release): promote verified version @maintainer"); ++ expect(notes).toContain("- #11 chore(release): update notes @contributor"); ++ expect(notes).not.toContain("[WRONG BRANCH]"); ++ }); ++ ++ test.each([ ++ "[Preview] chore(release): retain the preview marker", ++ "fix: document [WRONG BRANCH] markers (#99)", ++ "[WRONG BRANCH]ish: retain this title", ++ ])("preserves meaningful full-changelog title text: %s", title => { ++ const notes = renderReleaseNotes({ ++ npmMetadata: "", ++ deltaPrNotes: `## What's Changed\n### Chores\n* ${title} by @contributor in https://github.com/lidge-jun/opencodex/pull/12`, ++ }); ++ expect(notes).toContain(`- #12 ${title} @contributor`); ++ }); + const carried = [ + "", + "", +``` + +## C-stage correction: active release builder + +Accepted Codex review: actual release.yml invokes scripts/build-release-changelog.ts, whose changelog still used pr.title.trim(). The original tests certified a renderer but not this active entry. Extend the same bug fix: export stripPrEnforcementPrefix from scripts/release-notes.ts, import/use it for PR changelog titles in scripts/build-release-changelog.ts; add public buildReleaseNotes regressions in existing tests/ci-workflows/build-release-changelog.test.ts for generated-note enrichment and associated-PR fallback, asserting cleaned summary, preserved conventional changelog title/author/ID, and unrelated/embedded/near-match preservation. Keep category policy, direct-commit policy, network/dispatch and release coverage rules unchanged. The two new paths are part of this one bug, not a new delivery. Hosted current-head CI must execute both renderer test files. No local product test. Re-audit active caller and pure-string security boundary before accepting the repair. + +Repair source audit PASS at ef15842fc: actual builder emission and generated/associated regression paths verified. Source-of-truth paragraph corrected in be1f60f28 to distinguish active builder from standalone renderer; category selection/direct-commit policy unchanged. Final proof compares landed blobs to final reviewed candidate, not the original incomplete source. Prior run34167832861 passed16/skipped3 and showed original renderer cases onLinux/macOS; final newhead must be certified separately. + +DONE: PR3960 landed9c8f66b9d, finalheadbe1f60f28; CI34168481093 success16/skipped3. Both renderer files and new5 active-builder cases were observed in Linux logs; macOS lanespassed. Independent final source/security auditPASS. Exact destination60bcb9050 plus reviewed patch tree verified; coauthor present; source3899 and issue3895 closed. The combined destination tree was verified structurally, not claimed executed as the PR test tree. Local productcommandsNOTRUN. diff --git a/devlog/_fin/260908_c248_individual_fixes/030_timezone.md b/devlog/_fin/260908_c248_individual_fixes/030_timezone.md new file mode 100644 index 0000000000..479027db3f --- /dev/null +++ b/devlog/_fin/260908_c248_individual_fixes/030_timezone.md @@ -0,0 +1,157 @@ +# Phase timezone: extract only the Santiago fixture + +Source PR #3950. Carry ONLY commit 1d8f6ff7e8d48f33c3ce7a1b7118068754bbbe83 onto current dev, retaining luvs01's author and adding a surviving Co-authored-by. MODIFY only gui/tests/usage-custom-range.test.tsx. No JWT, product UI, dependency or workflow change. No UI screenshot is fabricated: describe the test-only scope truthfully in the PR. No new SoT contract beyond fixture isolation; production date interpretation is unchanged. + +Activation/acceptance: parent TZ absent and set cases retain exact presence/value and local Date epoch; a child Bun process is created with TZ=America/Santiago and an exact anchored test-name filter, preventing recursion by that timezone value. Child asserts skipped midnight, final-day activity and tooltip as before. Process deadline 12s, child test timeout 10s, parent test timeout 15s; timeout, signal and nonzero exit surface captured diagnostics. Reviewer must check config/preload behavior under direct child invocation and Windows Bun 1.4.0 compatibility. Hosted dashboard test gate explicitly executes this test file; inspect result and logs, not only a generic check badge. Additional fault-path testing is required only if audit reveals a reachable unprotected failure; amend this doc before any code change. Local product tests/build/typecheck/install NOT RUN. + +#3950 original stays open until B's separate JWT fix is independently confirmed on dev. No assumption that the original mixed PR's CI certifies this split head. One independent revert covers the timezone test only. + +Exact source patch follows: + +```diff +diff --git a/gui/tests/usage-custom-range.test.tsx b/gui/tests/usage-custom-range.test.tsx +index 887c31134..02df29f3d 100644 +--- a/gui/tests/usage-custom-range.test.tsx ++++ b/gui/tests/usage-custom-range.test.tsx +@@ -154,31 +154,45 @@ for (const connected of [false, true]) { + } + + test("America/Santiago midnight DST retains final-day activity and tooltip", async () => { +- const previous = process.env.TZ; +- process.env.TZ = "America/Santiago"; +- try { +- expect(new Date(2026, 8, 6, 0).getHours()).toBe(1); +- await mount(); +- await respond(0, "preset-marker"); +- await enter("2026-09-05T00:00", "2026-09-07T23:59"); +- await apply(); +- const gate = requests.at(-1)!; +- const data = report(gate, "santiago-marker", "2026-09-07"); +- data.days = ["2026-09-05", "2026-09-06", "2026-09-07"].map(date => ({ +- date, requests: date === "2026-09-07" ? 7 : 0, measuredRequests: 0, reportedRequests: 0, +- totalTokens: date === "2026-09-07" ? 700 : 0, models: [], +- })); +- await act(async () => gate.resolve(Response.json(data))); +- const active = container.querySelector('.heatmap-grid .heatmap-cell:not(.heatmap-cell-0)'); +- expect(active).not.toBeNull(); +- await act(async () => active!.dispatchEvent(new testWindow.MouseEvent("mouseover", { bubbles: true }))); +- expect(container.querySelector(".heatmap-tip-date")?.textContent).toBe("2026-09-07"); +- expect(container.querySelector(".heatmap-tip")?.textContent).toContain("700"); +- } finally { +- if (previous === undefined) delete process.env.TZ; +- else process.env.TZ = previous; ++ if (process.env.TZ !== "America/Santiago") { ++ // Restoring an absent TZ can change Bun's effective timezone on Windows. ++ // Start the DST case in its timezone without mutating this suite's clock. ++ const timezone = { present: Object.hasOwn(process.env, "TZ"), value: process.env.TZ }; ++ const localTime = new Date(2020, 8, 15, 10, 20).getTime(); ++ const child = Bun.spawnSync([ ++ process.execPath, "test", import.meta.path, ++ "-t", "^America/Santiago midnight DST retains final-day activity and tooltip$", ++ "--timeout", "10000", ++ ], { ++ env: { ...process.env, TZ: "America/Santiago" }, ++ stdout: "pipe", stderr: "pipe", timeout: 12000, killSignal: "SIGKILL", ++ }); ++ const diagnostics = `${child.stdout.toString()}\n${child.stderr.toString()}`; ++ expect(child.exitedDueToTimeout, diagnostics).not.toBe(true); ++ expect(child.signalCode, diagnostics).toBeUndefined(); ++ expect(child.exitCode, diagnostics).toBe(0); ++ expect({ present: Object.hasOwn(process.env, "TZ"), value: process.env.TZ }).toEqual(timezone); ++ expect(new Date(2020, 8, 15, 10, 20).getTime()).toBe(localTime); ++ return; + } +-}); ++ expect(new Date(2026, 8, 6, 0).getHours()).toBe(1); ++ await mount(); ++ await respond(0, "preset-marker"); ++ await enter("2026-09-05T00:00", "2026-09-07T23:59"); ++ await apply(); ++ const gate = requests.at(-1)!; ++ const data = report(gate, "santiago-marker", "2026-09-07"); ++ data.days = ["2026-09-05", "2026-09-06", "2026-09-07"].map(date => ({ ++ date, requests: date === "2026-09-07" ? 7 : 0, measuredRequests: 0, reportedRequests: 0, ++ totalTokens: date === "2026-09-07" ? 700 : 0, models: [], ++ })); ++ await act(async () => gate.resolve(Response.json(data))); ++ const active = container.querySelector('.heatmap-grid .heatmap-cell:not(.heatmap-cell-0)'); ++ expect(active).not.toBeNull(); ++ await act(async () => active!.dispatchEvent(new testWindow.MouseEvent("mouseover", { bubbles: true }))); ++ expect(container.querySelector(".heatmap-tip-date")?.textContent).toBe("2026-09-07"); ++ expect(container.querySelector(".heatmap-tip")?.textContent).toContain("700"); ++}, 15000); + + test("Apply submits inclusive bounds once; Clear restores the held preset without custom cache entries", async () => { + await mount(); +``` + +## Audit-driven amendment before implementation + +The source patch's explicit 15-second per-test timeout overrides its child CLI 10-second timeout. Change the final test timeout to `process.env.OCX_USAGE_SANTIAGO_CHILD === "1" ? 10000 : 15000`. Add a unique completion marker printed only after the child's last UI assertion; require the marker in the parent as well as exit/signal/timeout checks. Set the child's cwd explicitly to the dashboard root resolved from import.meta.dir. These are same-bug test integrity changes; no production code changes. Preserve the original assertions and parameterized test cases. + +Existing hosted Windows/macOS jobs do not run gui/tests. A supplemental verification-only branch will use the already-registered ci.yml workflow_dispatch path, with a separately reviewed minimal workflow that checks out an immutable candidate SHA and executes only focused timezone proof on GitHub-hosted ubuntu/windows/macos. This branch/workflow is excluded from delivery and never merged. Candidate PR CI remains unchanged and required; the supplemental run is independently labeled, not passed off as normal candidate workflow CI. Actions use existing pinned SHAs, contents:read only, no secrets, checkout persist-credentials:false, Bun1.4.0, frozen root and dashboard installs on the hosted machines, and bounded jobs/processes. Never run any of these commands locally. Negative controls must restore candidate bytes before the final positive run and record source identity. + +The proposed hosted verification starts in gui/: `bun test --isolate ./tests/usage-custom-range.test.tsx`, with TZ absent, Etc/UTC, Asia/Seoul and America/Santiago in distinct subprocess environments. Verify parent environment and next tests, child success marker, nonzero-exit/absent-marker propagation and process deadline; no fixture/process may survive teardown. Exact workflow YAML, pinned commit and control script are reviewed before dispatch. The repository's Windows product runtime suite is distinct from this Windows dashboard proof. + +### Exact test-integrity follow-up diff atop the original source commit + +```diff +--- a/gui/tests/usage-custom-range.test.tsx ++++ b/gui/tests/usage-custom-range.test.tsx +@@ -1,5 +1,6 @@ + import { afterEach, beforeEach, expect, test } from "bun:test"; + import { Window } from "happy-dom"; ++import { resolve } from "node:path"; + import { act } from "react"; + import type { Root } from "react-dom/client"; + import { LanguageProvider } from "../src/i18n/provider"; +@@ -154,7 +155,7 @@ + } + + test("America/Santiago midnight DST retains final-day activity and tooltip", async () => { +- if (process.env.TZ !== "America/Santiago") { ++ if (process.env.OCX_USAGE_SANTIAGO_CHILD !== "1" && process.env.TZ !== "America/Santiago") { + // Restoring an absent TZ can change Bun's effective timezone on Windows. + // Start the DST case in its timezone without mutating this suite's clock. + const timezone = { present: Object.hasOwn(process.env, "TZ"), value: process.env.TZ }; +@@ -164,17 +165,20 @@ + "-t", "^America/Santiago midnight DST retains final-day activity and tooltip$", + "--timeout", "10000", + ], { +- env: { ...process.env, TZ: "America/Santiago" }, ++ cwd: resolve(import.meta.dir, ".."), ++ env: { ...process.env, TZ: "America/Santiago", OCX_USAGE_SANTIAGO_CHILD: "1" }, + stdout: "pipe", stderr: "pipe", timeout: 12000, killSignal: "SIGKILL", + }); + const diagnostics = `${child.stdout.toString()}\n${child.stderr.toString()}`; + expect(child.exitedDueToTimeout, diagnostics).not.toBe(true); + expect(child.signalCode, diagnostics).toBeUndefined(); + expect(child.exitCode, diagnostics).toBe(0); ++ expect(child.stdout.toString().split(/\r?\n/), diagnostics).toContain("OCX_SANTIAGO_CASE_COMPLETED"); + expect({ present: Object.hasOwn(process.env, "TZ"), value: process.env.TZ }).toEqual(timezone); + expect(new Date(2020, 8, 15, 10, 20).getTime()).toBe(localTime); + return; + } ++ expect(process.env.TZ).toBe("America/Santiago"); + expect(new Date(2026, 8, 6, 0).getHours()).toBe(1); + await mount(); + await respond(0, "preset-marker"); +@@ -192,7 +196,8 @@ + await act(async () => active!.dispatchEvent(new testWindow.MouseEvent("mouseover", { bubbles: true }))); + expect(container.querySelector(".heatmap-tip-date")?.textContent).toBe("2026-09-07"); + expect(container.querySelector(".heatmap-tip")?.textContent).toContain("700"); +-}, 15000); ++ if (process.env.OCX_USAGE_SANTIAGO_CHILD === "1") console.log("OCX_SANTIAGO_CASE_COMPLETED"); ++}, process.env.OCX_USAGE_SANTIAGO_CHILD === "1" ? 10000 : 15000); + + test("Apply submits inclusive bounds once; Clear restores the held preset without custom cache entries", async () => { + await mount(); +``` + +C review amendment: use the dedicated child marker as the sole recursion guard, even when the parent already starts in Santiago. This preserves all original DST assertions and makes completion/state checks run for every parent TZ. Accepted CodeRabbit finding; final source/evidence checkout SHA will be repinned and hosted proof rerun. Prior Linux/Windows proof8223788bd remains historical, not finalhead evidence. + +Final candidate ce71d9171 passed independent marker-guard source re-audit. Evidence workflow7d5f1097e/run34170111719 checks out exactcandidatece71d9171; Linux/Windows/macOS each completed10scenarios, fivepositive/fiveexpectednegative, with exactfailure attribution, timeoutPIDabsence and candidatebytesrestored. Actual evidence JSON logs checked. Normal PR3967CI34170093095 pending; no completion/landing claim yet. Existing maintainer gui-screenshot-waived exception applied for test-only change after workflow/label policy inspection. No UI screenshot fabricated, no product gate waived. + +NormalCI attempt1 of34170093095 was cancelled at macos1 job20-minute deadline. Last emitted test was the unchanged client-connect CLI rejection case, followed by dangling-process cleanup and no completion. This root macOS lane does not include gui/tests; exact cause remains under investigation. Preserve cancellation as an unsuccessful/incomplete attempt. One same-head failed-job recheck was requested for diagnosis; a green recheck alone does not establish the unrelated runner stall is fixed. Supplemental3OS timezoneproof remains separately valid. + +DONE: PR3967 landedc46c22f3e with luvs01 trailer and exactcandidate file. Final candidatece71d9171 supplemental3OS run34170111719 passed all30expected scenarios. StandardCI34170093095 attempt2 passed19jobs/skipped2; attempt1 macos1 stalled/cancelled20min at unchangedclientconnect boundary remains unresolved reliability residual, not a fixedflake claim. Exact destinationbbea77a48+candidatepatch tree and devancestry verified. BJWT3962/eb4188a9 confirmed ondev; source3950 closure follows reconciliation. diff --git a/devlog/_fin/260908_c248_individual_fixes/040_reconcile.md b/devlog/_fin/260908_c248_individual_fixes/040_reconcile.md new file mode 100644 index 0000000000..753a2fa2ee --- /dev/null +++ b/devlog/_fin/260908_c248_individual_fixes/040_reconcile.md @@ -0,0 +1,3 @@ +# Phase reconcile: independent delivery and release readiness + +No product delta. MODIFY this unit's outcome record (050_outcome.md) with each original PR, actual delivery PR, reviewed head, CI run/check counts, landed SHA, author trailer and issue state. Query B for the JWT-only landing and independently verify it in dev together with C's timezone commit before closing #3950. Inspect A/B status and record readiness without doing their work or publishing a release. Move this unit from devlog/_plan to devlog/_fin only after all scoped tasks are complete; publish a separate docs-only closeout PR if needed, keeping it out of all three bug commits. Verify that closeout's scope check and diff preserve product files. No version change or promotion. Outcomes must distinguish true merged source PRs from closed carry sources. diff --git a/devlog/_fin/260908_c248_individual_fixes/050_outcome.md b/devlog/_fin/260908_c248_individual_fixes/050_outcome.md new file mode 100644 index 0000000000..aa085d5840 --- /dev/null +++ b/devlog/_fin/260908_c248_individual_fixes/050_outcome.md @@ -0,0 +1,35 @@ +# Lane C outcome + +All three scoped corrections landed into dev through independent bug PRs. The capture correction needed a separate follow-up after its author advanced the source PR during CI. No already-landed commit was rewritten. This record is documentation only and is not another product fix. + +| Source | Delivery PR | Landed SHA | Current-head CI | Scope | +|---|---|---|---|---| +| #3953 initial | [3955](https://github.com/lidge-jun/opencodex/pull/3955) | `9c54000c937276ba8d93ce63a922b3fe6797cbde` | [34166758020](https://github.com/lidge-jun/opencodex/actions/runs/34166758020) (3 success / 10 skipped) | Current-tree Accounts capture cleanup | +| #3953 follow-up | [3959](https://github.com/lidge-jun/opencodex/pull/3959) | `01c23aedcdfcb913151a2ac8f7acebda58d91eee` | [34167651789](https://github.com/lidge-jun/opencodex/actions/runs/34167651789) (3 success / 10 skipped) | Consistent capture retention and isolation guidance | +| #3899 / #3895 | [3960](https://github.com/lidge-jun/opencodex/pull/3960) | `9c8f66b9df4cdf133a16c95a95ee07ff5171a46d` | [34168481093](https://github.com/lidge-jun/opencodex/actions/runs/34168481093) (16 success / 3 skipped) | Release-note marker in both actual and standalone builders | +| #3950 timezone only | [3967](https://github.com/lidge-jun/opencodex/pull/3967) | `c46c22f3e4d00ff31a0e6bb10f74505577806776` | [34170093095](https://github.com/lidge-jun/opencodex/actions/runs/34170093095) (19 success / 2 skipped) | Santiago subprocess isolation and oracle integrity | + +## Proof and attribution + +Each landing was serialized through the shared merge lock and checked against the then-current destination: actual merge parent, computed combined tree, dev ancestry and surviving Co-authored-by trailer. luvs01 is credited in both capture carries and the timezone carry; Joonsuh Park is credited in the release-note correction. The original source PRs were closed as carried, not described as directly merged. + +#3953 was closed only after its refreshed ca21efd2 follow-up was included. #3899 and issue #3895 closed after the active release builder was corrected and verified. #3950 was closed only after B's independent JWT delivery #3962 (eb4188a9f2e127f5ee2980b62d6e5bb213c43c70) and C's timezone delivery #3967 were both confirmed on dev. Product commits remain independently revertible. + +The release-note original patch missed scripts/build-release-changelog.ts, the actual release workflow entry. Review led to a shared normalizer and five public-builder cases covering generated and associated PR sources and negative marker preservation. Those cases and the original renderer cases were observed passing in the final Linux CI logs; the final macOS lanes also passed. The structure guide now accurately distinguishes the active and standalone renderers. + +Timezone final candidate ce71d917143ddcbd5675b6ba92d8b1053971cd25 was separately exercised by evidence workflow7d5f1097ec587a0ced441f475eb02d750e06b9ac in [run34170111719](https://github.com/lidge-jun/opencodex/actions/runs/34170111719). The workflow checked out that immutable candidate separately. Linux, Windows and macOS each completed ten scenarios: five positive/restored runs and five deliberately failing controls. Controls require the intended test failure and specific diagnostics, not any nonzero exit. All platforms verified the final candidate file hash recorded below. Child timeout termination and restored candidate bytes/HEAD were verified. The evidence branch is not in any delivery PR and is never merged. + +## Limits and remaining work + +- All local product tests, test:changed, typechecks, builds and dependency installs were NOT RUN. Mutating Git operations disabled hooks per command, and pushes used --no-verify. Git/diff/source and operational evidence checks are distinct from product tests. +- Skipped jobs are not counted as passing tests. Normal PR workflows skip the full Windows runtime suite and macOS whole-pool control; the supplementary timezone run explicitly supplies Windows/macOS focused dashboard evidence, not a full runtime-suite result. +- Timezone normal CI34170093095 attempt1 timed out after20minutes in the unchanged root macOS client-connect test. The next helper contains an unbounded synchronous child wait, but the actual stopping mechanism is unproven. Attempt2 succeeded on the same candidate without a source change. The cancelled attempt remains unsuccessful evidence and the unrelated CI reliability defect is not claimed fixed. +- Privacy cleanup affects the current tree only. Historical blobs/links were not purged, and no claim of historical erasure is made. The working proxy was not restarted or reconfigured by this task. +- Concurrent dev changes were preserved through actual-tree comparison. That structural proof does not imply every merged integration tree was separately executed by the candidate CI. +- A and B were still active at reconciliation. B's JWT slice is verified; no assertion is made that their remaining changes or the overall2.48 release are complete. main/preview promotion, version changes and npm publication were outside C's authority and were not performed. + +## Final supplemental evidence + +- win32: Bun1.4.0, candidate file SHA-256 `6cbb58c96643f500cf2541ef3b7707aed072c1f981b16b49f97949536fe30f50`, ten scenarios, restored=True. +- linux: Bun1.4.0, candidate file SHA-256 `6cbb58c96643f500cf2541ef3b7707aed072c1f981b16b49f97949536fe30f50`, ten scenarios, restored=True. +- darwin: Bun1.4.0, candidate file SHA-256 `6cbb58c96643f500cf2541ef3b7707aed072c1f981b16b49f97949536fe30f50`, ten scenarios, restored=True. diff --git a/devlog/_fin/260908_c_track_config_init_stack/000_plan.md b/devlog/_fin/260908_c_track_config_init_stack/000_plan.md new file mode 100644 index 0000000000..046e2c627d --- /dev/null +++ b/devlog/_fin/260908_c_track_config_init_stack/000_plan.md @@ -0,0 +1,79 @@ +# 000_plan.md — C track: config file + init as a manual PR stack + +## Objective + +Land the C triage track (config-file and init surfaces) on `dev` as one manual, +dependency-ordered branch chain whose tip carries every layer. The track has two +existing contributor pull requests plus one gap discovered while planning: + +| Layer | Source | Surface | +|---|---|---| +| wp1 | PR #3900 by @x3M3x | `src/config/atomic-write.ts` Bun/Windows ENOENT | +| wp2 | new (this unit) | `src/config/initialize.ts` sibling numeric flag | +| wp3 | PR #3896 by @parkjs101 | `ocx init` publication recovery guidance (closes #3893) | + +wp2 exists on its own merit, not as glue. `publishInitialConfigNoReplace` still +opens its temp file with the numeric spelling that Bun miscompiles on Windows, +so shipping wp1 alone leaves first-run config publication exposed to the same +`ENOENT`. #3900 never touches `initialize.ts`; the file overlap is between wp2 +and wp3 only. + +## Constraints (owner-stated, this session) + +- **No local product suite.** No `bun run test`, `bun run typecheck`, + `bun run build`, or install. Every such check is recorded **NOT RUN**. +- **Push with `--no-verify`** on every layer. +- **CI on the tip only.** Verified mechanism in `040`: the lower layers are + pushed as branches but **no pull request is opened for them** until the tip + has landed. `.github/workflows/ci.yml` triggers on `pull_request: {}` with no + draft filter, so opening a lower PR would start CI; draft status suppresses + nothing. +- **Green tip merges; the rest resolve.** When the tip's exact head SHA is green + against a current `dev` base, merge the tip, then resolve the source PRs and + close issue #3893. +- **Original authors are preserved** with full `Co-authored-by: Name ` + trailers that survive the squash (AGENTS.md "Landing another author's work"). + +## Build order + +``` +codex/c-track-init-guidance → the ONLY pull request (base dev) ← wp3 tip +codex/c-track-initialize-flag → branch only, no PR ← wp2 +codex/c-track-atomic-write → branch only, no PR ← wp1 +──────────────────────────────── dev +``` + +Each branch is based on the one below, so the tip's tree is the cumulative +result. wp2 sits between the carried PRs because wp3 inserts a line directly +after the `openSync` call that wp2 rewrites; constructing wp2 first means that +adjacent-hunk overlap is resolved once while carrying wp3. This is a chosen +construction order for a single conflict resolution, not a semantic +prerequisite — either change could be written first. + +## Scope boundary + +IN: the three layers above, their regression tests, the docs/structure text that +#3896 already carries, and this devlog unit. + +OUT: `#3838`/`#3917` adapter work, any other triage track, release promotion, +`main`/`preview`, and any behavioral change to hard-link publication, ACL +hardening, or credential storage beyond the flag spelling. + +## Verifiers + +Local product gates are forbidden this session, so acceptance rests on +repository CI against the tip plus read-only inspection. + +| Claim | Evidence | Status | +|---|---|---| +| Layers carry original authorship | `git log --format='%(trailers:key=Co-authored-by)'` on the tip, then on the landed commit | to run (read-only) | +| wp2 removes the numeric spelling | `rg 'constants\.O_' src/config/initialize.ts` on the pushed tip tree | to run (read-only) | +| Carried content really landed | tip tree vs. each source PR's pinned patch, then landed-merge tree comparison (see `040`) | to run (read-only) | +| Layers build and pass | repository CI on the tip head SHA, base `dev` | tip only | +| Local suite / typecheck / build | — | **NOT RUN** (owner instruction) | + +## Terminal outcome + +DONE requires: tip CI success on its exact head SHA against a current `dev` +base, tip merged into `dev` proven by fetched ancestry and tree comparison, +source PRs resolved with credit intact, and #3893 closed. diff --git a/devlog/_fin/260908_c_track_config_init_stack/010_layer1_atomic_write.md b/devlog/_fin/260908_c_track_config_init_stack/010_layer1_atomic_write.md new file mode 100644 index 0000000000..d9e76ba2bb --- /dev/null +++ b/devlog/_fin/260908_c_track_config_init_stack/010_layer1_atomic_write.md @@ -0,0 +1,72 @@ +# 010_layer1_atomic_write.md — wp1: carry PR #3900 + +Source: [PR #3900](https://github.com/lidge-jun/opencodex/pull/3900) by @x3M3x, +head `744eb644028492784446fe9f0f73813d5d1fe59f`, two commits +(`52c749561`, `744eb6440`). + +Branch: `codex/c-track-atomic-write`, base `dev`. + +## Problem + +`src/config/atomic-write.ts` builds its exclusive-create flags numerically. +Bun on Windows misreads that combination and drops the creation bit, so every +private temp write fails with `ENOENT`: `ocx start`, management-API config +saves, and OAuth credential refreshes all route through these two writers. + +## Change (MODIFY, carried unmodified from #3900) + +`src/config/atomic-write.ts` + +```diff +- const descriptor = openSync(path, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 0o600); ++ const descriptor = openSync(path, "wx", 0o600); +``` + +Applied in both `writePrivateTempFile` and `writePrivateTempFileAsync`; the now +unused `constants` import is dropped. + +`tests/windows/windows-secret-acl.test.ts` gains the source-oracle guard +"atomic secret temp writer portability", asserting exactly two portable calls. + +## Semantics note (audit correction) + +The PR description calls `"wx"` exactly `O_WRONLY | O_CREAT | O_EXCL`. Node and +Bun actually map it to `O_WRONLY | O_CREAT | O_EXCL | O_TRUNC`. It is +**behaviorally** equivalent here rather than bit-identical: exclusive creation +rejects an existing path, so `O_TRUNC` can never truncate one. `0o600` remains +a separate mode argument and still applies. Recorded so a later reader does not +inherit the imprecise claim. + +## Security review (independent, read-only) + +No blocking finding. Exclusivity is preserved for every caller of the default +wrappers, which include OAuth `auth.json`, Codex account credentials, service +API tokens, `config.json`, and `ocx.pid`. Ownership is marked only after a +successful create, so no new pre-existing-temp or symlink-following path opens. +Windows ACL ordering (create → own → harden → identity check → write → close) +is untouched. + +## Authorship + +Both commits are cherry-picked with `-x`, so each retains +`x3M3x ` as its git author and records the source SHA: + +| Carried commit | Source commit | +|---|---| +| `6a0abcf90` fix: use portable exclusive config temp creation | `52c7495618f18f2847b7f9468421442c1c573da1` | +| `24a078d80` test: guard atomic temp writes against Bun/Windows ENOENT | `744eb644028492784446fe9f0f73813d5d1fe59f` | + +A squash landing keeps only the squash message and drops per-commit authors, so +`b1a7f111c` adds the `Co-authored-by: x3M3x ` trailer to +the branch. That trailer must be carried into the tip PR squash message and +re-read on the landed commit. + +## Verification + +An independent read-only audit of the built branch confirmed the carried +source-and-test diff is byte-identical to #3900 pinned patch (2,176 bytes), +that both `-x` annotations and the original author survive, that the trailer +parses through `git interpret-trailers`, and that no other `src/` file changed. + +Repository CI on the stack tip only. Local suite, typecheck, and build: +**NOT RUN** (owner instruction). diff --git a/devlog/_fin/260908_c_track_config_init_stack/020_layer2_initialize_flag.md b/devlog/_fin/260908_c_track_config_init_stack/020_layer2_initialize_flag.md new file mode 100644 index 0000000000..b25a419481 --- /dev/null +++ b/devlog/_fin/260908_c_track_config_init_stack/020_layer2_initialize_flag.md @@ -0,0 +1,69 @@ +# 020_layer2_initialize_flag.md — wp2: sibling flag in initialize.ts + +New work in this unit. Branch `codex/c-track-initialize-flag`, base +`codex/c-track-atomic-write`. + +## Why this layer exists + +wp1 fixes the two writers in `atomic-write.ts`, but +`publishInitialConfigNoReplace` in `src/config/initialize.ts` still opens its +temp file with the same numeric spelling. Independent inspection confirms the +identical Bun/Windows exposure: first-run `ocx init` fails before writing or +publishing `config.json`, leaving `publication = "not-published"` and +`hardLinkUnavailable = false`, so the CLI prints "Initial config publication +did not finish." and exits 1. + +It also sits between the two carried PRs deliberately. #3896 inserts a line +immediately after this `openSync` call, so building wp2 first means the +adjacent-hunk overlap is resolved once, while carrying #3896 in wp3. This is a +chosen construction order rather than a semantic prerequisite: #3900 does not +touch this file at all, and either change could be written first. + +## Change (MODIFY) + +`src/config/initialize.ts` + +```diff + import { +- closeSync, constants, fchmodSync, fstatSync, linkSync, lstatSync, ++ closeSync, fchmodSync, fstatSync, linkSync, lstatSync, + openSync, unlinkSync, writeFileSync, + } from "node:fs"; +@@ +- fd = openSync(temp, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 0o600); ++ fd = openSync(temp, "wx", 0o600); +``` + +`constants` is referenced only by the import and that one expression, so the +import entry is removed with it. + +## Change (MODIFY, regression) + +`tests/windows/windows-secret-acl.test.ts` gains a sibling source-oracle test +next to the wp1 guard, asserting exactly one portable call in +`src/config/initialize.ts`. + +## Contract preserved + +The no-replace publication contract does not depend on the numeric spelling: +hardening, `verifyPrivateTemp`, the single `linkSync` publication with its +`EEXIST`/`collided` and `hardLinkUnavailable` handling, and the +descriptor-owned `removeOwnedTemp` cleanup are all unchanged. + +## Out of scope: the same pattern under `src/lab/` + +An independent scan found three more exclusive opens sharing this combination: +`src/lab/ledger/store.ts:153` and `:185` (recovery mutex, ledger lock) and +`src/lab/public/private-file.ts:209` (private publication temp). They deserve the +same portability follow-up, but Lab is an opt-in subsystem off the core request +path, so they stay out of this track rather than widening a config-surface fix. + +Two further matches are not exclusive opens and must not be swept in: +`src/codex/native-main-lock-file.ts:89` and `src/lab/fabric/scratch.ts:416`. The +read/write sites in `src/lab/artifacts/secure-fs.ts` need individual treatment because +`"wx"` would drop read access. + +## Verification + +Repository CI on the stack tip only. Local suite, typecheck, and build: +**NOT RUN** (owner instruction). diff --git a/devlog/_fin/260908_c_track_config_init_stack/030_layer3_init_guidance.md b/devlog/_fin/260908_c_track_config_init_stack/030_layer3_init_guidance.md new file mode 100644 index 0000000000..5f755c686d --- /dev/null +++ b/devlog/_fin/260908_c_track_config_init_stack/030_layer3_init_guidance.md @@ -0,0 +1,65 @@ +# 030_layer3_init_guidance.md — wp3: carry PR #3896 (stack tip) + +Source: [PR #3896](https://github.com/lidge-jun/opencodex/pull/3896) by +@parkjs101 (Joonsuh Park), head `fc78bc37d419576061b995281baf39c46655eaa9`, +closes [#3893](https://github.com/lidge-jun/opencodex/issues/3893). + +Branch: `codex/c-track-init-guidance`, based on `codex/c-track-initialize-flag`. +This is the stack tip and the only pull request opened for this unit. + +## Problem + +`ocx init` already separates denied hard-link publication from a generic +failure, but a required permission-hardening failure falls into the generic +message, and neither message tells the user what to do next. The user cannot +tell why publication stopped or where to move `OPENCODEX_HOME`. + +## Change (carried from #3896, rebased onto wp2) + +- `src/config/initialize.ts`: a `hardeningFailed` flag set immediately before + the hardening call and cleared immediately after it returns — the assignments + surround `hardenInitialConfig`, which runs after `openSync`. The flag selects + a distinct message; `InitialConfigPublicationError` takes the matching option, + and both messages gain `OPENCODEX_HOME` recovery direction. +- `docs-site/src/content/docs/getting-started/quickstart.md`: inspection before + retry, preserving existing configuration, choosing a supported location. +- `structure/02_config-and-codex-home.md`: records the diagnostic distinction. +- `tests/config/config-mutation-lock.test.ts`, `tests/service/init-eof.test.ts`: + permission, link, and cleanup faults, privacy-safe messages, backup + preservation. Both files already exist in the test-layout registries, so no + registry entry is added. +- `devlog/_plan/260907_init_publication_guidance/010_implementation.md`: carried + as-is; on terminal closure that unit moves to `_fin/`. + +The rebase keeps wp2's `openSync(temp, "wx", 0o600)` and both `hardeningFailed` +assignments around the hardening call. + +## Review (independent subagent audit, read-only, this session) + +Reviewed at `fc78bc37d`, all six files. No blocking finding: + +- The flag cannot be left incorrectly true. Write, verify, link, and close + failures all occur after it is cleared (`src/config/initialize.ts:95-115`, + `:129-134`). A throwing injected `io.harden` test seam would select the same + message, which is a seam edge rather than a production defect. +- File I/O ordering, the no-replace guarantee, and private permissions are + unchanged (`:38-43`, `:98-130`). +- The new messages are fixed text naming the `OPENCODEX_HOME` variable; they + interpolate no real paths, bytes, or filesystem error text, and raw errors + stay in the `cause` the CLI does not print (`src/cli/init.ts:262-267`). + +This is a static agent review, not the maintainer security review or the +approval required by `MAINTAINERS.md`; those are recorded separately in `040`. + +## Authorship + +Carried with `Co-authored-by: Joonsuh Park `, the identity +on the source commit. The trailer must appear in the **squash message** of the +landed commit, and is verified on the landed commit rather than only on the +branch. + +## Verification + +This tip is the only layer that triggers repository CI, and its exact head SHA +must be green against a current `dev` base. Local suite, typecheck, and build: +**NOT RUN** (owner instruction). diff --git a/devlog/_fin/260908_c_track_config_init_stack/040_layer4_landing.md b/devlog/_fin/260908_c_track_config_init_stack/040_layer4_landing.md new file mode 100644 index 0000000000..4413166db9 --- /dev/null +++ b/devlog/_fin/260908_c_track_config_init_stack/040_layer4_landing.md @@ -0,0 +1,62 @@ +# 040_layer4_landing.md — wp4: tip CI, merge, and closure + +## CI suppression: mechanism, not draft status + +`.github/workflows/ci.yml` triggers on `pull_request: {}` with **no draft +filter** (line 7), and the `changes` job gates expensive work on the PR's own +file list, which includes `src/**` and `tests/**`. Opening a lower-layer pull +request — draft or not — therefore starts repository CI. + +The mechanism that actually satisfies "CI on the tip only" is to **open no pull +request for wp1 and wp2**. Their branches are pushed so the tip has a real +parent chain, but only `codex/c-track-init-guidance` gets a PR, based directly +on `dev` so its diff is the cumulative stack. One workflow run, one subject. + +## Landing sequence + +1. Push all three branches with `--no-verify`. +2. Open the tip PR only, base `dev`, with the full repository template + (Summary, Verification, Checklist) and `Closes #3893`. Record the local + suite as NOT RUN with the owner instruction as the reason; the Verification + section must not imply a local green run. +3. Confirm the tip is based on the current `dev` head before CI. If `dev` has + advanced, rebase and cascade first — CI against a stale base does not certify + the integration tree that will actually merge. +4. Wait for CI on the tip's exact head SHA. Skipped or cancelled checks are not + passing evidence. +5. Record the merge decision. Both current maintainers hold `admin`, and + `MAINTAINERS.md` permits explicit maintainer integration into `dev` without a + second approval, provided the decision and exact-head CI evidence are + recorded and security review is kept separate. The credential-adjacent + `atomic-write.ts` carry is the security-review subject; its independent audit + is summarized in `010` and must be named in the merge record. +6. Merge the tip, pinning the reviewed head SHA. + +## Proving the carried work landed + +Ancestry alone is insufficient: `dev` can contain the merge while a conflict +resolution silently dropped a contributor hunk. Before closing anything: + +- Compare each source PR's pinned patch against the tip tree, documenting the + one intentional adaptation (wp2 rewrites the `openSync` line that #3896's + hunk sits next to). +- After the merge, compare the landed tree on fetched `dev` against the + reviewed tip tree. +- Re-read the landed commit's trailers to confirm both `Co-authored-by` entries + survived the squash. + +A squash landing does not make the original contributor SHAs ancestors, so +trailer and content comparison are the credit and delivery evidence. + +## Closure + +1. Close #3900 and #3896 as landed through the tip, naming the merge commit and + crediting @x3M3x and @parkjs101 with the evidence above. +2. Close issue #3893: PRs here target `dev`, and GitHub only auto-closes linked + issues on the default branch. + +## Failure handling + +If the tip's CI fails, fix the responsible layer and cascade the rebase upward +(`DEV-STACK-02`) before re-running CI on the new tip head. Do not open or merge +a lower layer independently to bypass a red tip. diff --git a/devlog/_fin/260908_c_track_config_init_stack/050_outcome.md b/devlog/_fin/260908_c_track_config_init_stack/050_outcome.md new file mode 100644 index 0000000000..05e19c97a1 --- /dev/null +++ b/devlog/_fin/260908_c_track_config_init_stack/050_outcome.md @@ -0,0 +1,82 @@ +# 050_outcome.md — terminal record + +## Result + +Landed on `dev` as `6188458ae3f4fd84ef57344b60cf3ceeed80aa6f` through +[#3941](https://github.com/lidge-jun/opencodex/pull/3941) on 2026-09-07. + +| Layer | Source | Disposition | +|---|---|---| +| wp1 | [#3900](https://github.com/lidge-jun/opencodex/pull/3900) by @x3M3x | carried, PR closed as superseded | +| wp2 | new here | landed | +| wp3 | [#3896](https://github.com/lidge-jun/opencodex/pull/3896) by @parkjs101 | carried, PR closed as superseded | +| — | [#3893](https://github.com/lidge-jun/opencodex/issues/3893) | closed | + +Both `Co-authored-by` trailers are on the landed squash commit. The 13 files in +the reviewed tip hash identical to their landed counterparts, `atomic-write.ts` +on `dev` hashes identical to #3900's pinned version, and `initialize.ts` equals +#3896's pinned file apart from wp2's two intended substitutions. + +## What the plan got right + +The tip-only CI mechanism worked exactly as designed. `ci.yml` triggers on +`pull_request` with no draft filter, so the first plan's assumption that draft +status suppresses CI was wrong; opening no pull request for the lower layers is +what actually produced one workflow subject. No Cross-platform CI run exists for +either lower branch. + +Ordering wp2 between the two carried PRs also paid off as predicted. The cherry-pick +of #3896 produced exactly one conflict — the adjacent hunk where `hardeningFailed = true` +sits directly after the rewritten `openSync` line — and it was resolved once. + +## What the plan got wrong, and what caught it + +The first roadmap draft failed its independent audit with seven findings. Three +mattered: the false draft-CI claim above, merging on stale-base CI evidence, and +proving delivery by ancestry alone when a squash can silently drop a contributor +hunk. It also misstated the file overlap as wp1/wp3 when #3900 never touches +`initialize.ts`. The revised plan passed re-audit, and the stale-base rule +earned itself back: `dev` moved twice during this delivery, so the tip was +rebased and re-certified rather than merged on its first green run. + +## The CI failure that was not ours + +The pre-rebase head failed one job, `test 4/4`, in +`prompt probe process lifecycle > the last cancellation drains the exact child`. +Investigation attributed it to that test's final parent-side PID poll expiring at +its 15-second internal deadline: every preceding assertion passed, the replacement +command had already observed the old child gone, and the same test passed on macOS +in the same run. `src/codex/prompt-text-probe.ts` imports `node:fs` only for +`existsSync`/`statSync` and never calls the changed writers. A same-head rerun +passed; the rebased head passed 25/25 on the first attempt. + +Worth recording honestly: the investigation could not name the exact mechanism. +The replacement considered the PID absent while the parent still considered it +alive, which PID reuse, runtime liveness behavior, or a real observation defect +could all explain. It is a flake by evidence of non-reproducibility, not by proof. + +## Follow-up left open + +Three exclusive opens under `src/lab/` share the numeric spelling this track +replaced: `ledger/store.ts` (two) and `public/private-file.ts`. Lab is opt-in and +off the core request path, so they stayed out rather than widening a config-surface +fix. The read/write sites in `artifacts/secure-fs.ts` need individual treatment +because `"wx"` would drop read access; they are not a mechanical substitution. + +## Verification boundary + +The local product suite, typecheck, and build were **NOT RUN** by owner +instruction. Acceptance rested on repository CI against the tip +([run 34153124187](https://github.com/lidge-jun/opencodex/actions/runs/34153124187): +19 jobs succeeded, 2 skipped, zero failures on the first attempt) plus independent +read-only audits at each layer. The two skips are the dispatch-only `macos control` +and Windows shard lanes, so Windows packaging and keyring smoke passed but the +Windows suite itself did not run. + +One limit worth stating plainly: the green PR run tested the tip against the base it +was rebased onto, and #3940 landed on `dev` between that run and the merge. The +C-track content is byte-identical either way, and the four files #3940 touched do not +overlap this change, but the combined tree is certified by the post-merge `dev` run +rather than by the PR run. That run has since completed: +[run 34153892496](https://github.com/lidge-jun/opencodex/actions/runs/34153892496) on +`6188458ae` succeeded, 19 jobs and 2 skips, so the landed combined tree is certified. diff --git a/devlog/_plan/260904_provider_quota_refresh/000_plan.md b/devlog/_plan/260904_provider_quota_refresh/000_plan.md index e37cdca4c2..9a378ce965 100644 --- a/devlog/_plan/260904_provider_quota_refresh/000_plan.md +++ b/devlog/_plan/260904_provider_quota_refresh/000_plan.md @@ -1,7 +1,6 @@ # Provider quota refresh affordance + Meta usage visibility -Unit opened 2026-09-04. Two defects reported against the live Providers dashboard -on `http://localhost:10100/#providers`: +Unit opened 2026-09-04. Two defects reported against the live Providers dashboard: 1. Only the Codex account pool has a "Refresh quotas" button. Every other provider — anthropic, xai, cursor, google-antigravity, meta-muse — offers the operator no @@ -9,7 +8,7 @@ on `http://localhost:10100/#providers`: 2. Meta Muse shows no quota on the provider Usage tab even though the proxy has an observation for it. -## Evidence gathered at P (live proxy, port 10100, v2.42.0, pid 73184) +## Evidence gathered at P (live proxy, v2.42.0) `GET /api/provider-quotas` returns six reports, and `meta-muse` is one of them: @@ -77,6 +76,7 @@ config save, provider add/remove. There is no operator-initiated path. The `bun x tsc --noEmit`, `bun run lint:gui` only. - Push with `--no-verify`; branch `codex/260904-provider-quota-refresh`; target `dev`. - A GUI-mentioning PR requires a screenshot in the description (`enforce-target`). -- The live proxy on port 10100 is the user's working service. Read it, restart it - only when a rebuild must be picked up, never repoint or reconfigure it. +- Verification must use an isolated scratch instance. Do not restart, repoint or + reconfigure the user's working proxy. The completed isolation record supersedes + the original working-service restart plan. - `refresh=1` must never cause a passive provider to spend an inference turn. diff --git a/devlog/_plan/260904_provider_quota_refresh/030_wp3_live_verification_and_pr.md b/devlog/_plan/260904_provider_quota_refresh/030_wp3_live_verification_and_pr.md index a8c4168b63..29fdc19756 100644 --- a/devlog/_plan/260904_provider_quota_refresh/030_wp3_live_verification_and_pr.md +++ b/devlog/_plan/260904_provider_quota_refresh/030_wp3_live_verification_and_pr.md @@ -8,32 +8,34 @@ phase is the evidence phase. 1. `bun run build:gui` — the service serves `gui/dist`, so an unbuilt change is invisible no matter how green the tests are. -2. `ocx service restart` — picks up the server-side `observed` flag. Confirm a new - pid and fresh uptime on `/healthz`, and that the port is still 10100. The service - is the user's own; restart it, never repoint or reconfigure it. -3. `curl /api/provider-quotas` with the admin token — the meta-muse row must now +2. Load the rebuilt code in the isolated scratch instance and confirm its identity + and fresh uptime on `/healthz`. The completed isolation record supersedes the + original `ocx service restart` plan; do not restart, repoint or reconfigure the + user's working proxy. +3. Query the scratch instance's `/api/provider-quotas` with its admin token — the meta-muse row must now carry `"observed": true`. This is the wire-level proof, checked before the UI so a blank screen can be attributed correctly. -## Browser verification (`aside-jun`, CLI repl on the signed-in profile) +## Browser verification (aside CLI repl on the signed-in profile) The dashboard is loopback and needs no login, so `aside repl` is the right surface: one invocation is one session, it throws on a bad path instead of skipping, and the screenshots land as real files. A whole inspect-act-verify flow must fit in a single invocation because bindings do not persist between calls. -Shots to capture into `devlog/_plan/260904_provider_quota_refresh/assets/`: +The planned capture set covered the Usage quota display, the Usage and Accounts +refresh controls, and the post-click success state. The completed record in +`031_live_verification_record.md` preserves the observed outcomes. -| File | Content | -|------|---------| -| `010_meta_usage_quota.png` | meta-muse → Usage tab with both windows and the observation age | -| `020_usage_refresh_button.png` | the Usage rate-limits header with its refresh control | -| `030_accounts_refresh_button.png` | the Accounts tab refresh control for an OAuth provider | -| `040_refresh_result.png` | the post-click success status | +Those live captures were subsequently removed from the current tree under one +retention rule for both surfaces: account and usage screenshots from a real +operator profile are unnecessary once the behavioral evidence is recorded in +text. The planned filename list is also retired; it differed from the delivered +filenames and must not be treated as an asset inventory. -Aside writes under `~/.aside/u/0/`; Codex copies the files into the repository. Every -`aside` invocation runs under `perl -e 'alarm shift; exec @ARGV' 300` because macOS -has no `timeout` and the bare spelling exits 127 without ever starting the run. +The plan required each `aside` invocation to run under +`perl -e 'alarm shift; exec @ARGV' 300` because macOS has no `timeout` and the bare +spelling exits 127 without starting the run. ## Push and PR diff --git a/devlog/_plan/260904_provider_quota_refresh/031_live_verification_record.md b/devlog/_plan/260904_provider_quota_refresh/031_live_verification_record.md index cda6fdbe9e..3dfbafb318 100644 --- a/devlog/_plan/260904_provider_quota_refresh/031_live_verification_record.md +++ b/devlog/_plan/260904_provider_quota_refresh/031_live_verification_record.md @@ -1,20 +1,14 @@ # Live verification record — 2026-09-04 Both defects were reproduced and then confirmed fixed against a running proxy serving the -built GUI. Screenshots in `assets/`. +built GUI. The observations below preserve that historical verification. ## Isolation -The user's own proxy runs on port 10100 from -`/Users/jun/Developer/new/700_projects/opencodex` under launchd — a different checkout -from this worktree, so restarting it would NOT have loaded this change, and repointing it -is out of bounds. Verification therefore ran on a scratch instance: - -- `OPENCODEX_HOME` = a `mktemp -d` directory holding only `config.json` (three providers), - `auth.json`, and `provider-account-quota-cache.json` copied from the real home. -- port 10399, started with `bun run src/cli/index.ts start --port 10399` from this worktree. -- Port 10100 was confirmed untouched afterwards: same pid 73184, uptime still climbing. -- The scratch home was moved to Trash when finished. +Verification ran against an isolated scratch instance. The existing proxy used a +separate checkout and was left untouched; its process identity and increasing +uptime were confirmed afterward. The scratch home was moved to Trash when +verification finished. ## Wire evidence @@ -46,17 +40,16 @@ The refresh control was exercised, not merely rendered: - Usage tab: clicking `Refresh quotas` produced `status: "Quotas refreshed"` and the age line re-derived from `5h ago` to `6h ago` — the read really happened. -- Accounts tab (anthropic, three pooled accounts): the control appears beside +- Accounts tab (pooled OAuth provider): the control appears beside `Add account` and reported `Quotas refreshed` after a real forced read. -## Assets +## Capture retention -| File | Content | -|---|---| -| `010_meta_usage_quota.png` | Muse Code → Usage with both windows and the refresh control | -| `020_usage_refresh_result.png` | the same tab after a click, showing the success status | -| `030_accounts_refresh_button.png` | Accounts tab control for a pooled OAuth provider | -| `040_accounts_refresh_result.png` | Accounts tab after a click | +The Accounts and Usage captures were subsequently removed from the current tree. +Both came from a real operator profile; retaining either surface is unnecessary +for the behavioral evidence above. This applies the same retention rule to both +surfaces without claiming that the Usage captures were independently cleared of +personal information. Git history is unchanged. ## CI (PR #3448, head 232afdd97) diff --git a/devlog/_plan/260904_provider_quota_refresh/assets/010_meta_usage_quota.png b/devlog/_plan/260904_provider_quota_refresh/assets/010_meta_usage_quota.png deleted file mode 100644 index f36ca63dd7..0000000000 Binary files a/devlog/_plan/260904_provider_quota_refresh/assets/010_meta_usage_quota.png and /dev/null differ diff --git a/devlog/_plan/260904_provider_quota_refresh/assets/020_usage_refresh_result.png b/devlog/_plan/260904_provider_quota_refresh/assets/020_usage_refresh_result.png deleted file mode 100644 index 944b12533e..0000000000 Binary files a/devlog/_plan/260904_provider_quota_refresh/assets/020_usage_refresh_result.png and /dev/null differ diff --git a/devlog/_plan/260904_provider_quota_refresh/assets/030_accounts_refresh_button.png b/devlog/_plan/260904_provider_quota_refresh/assets/030_accounts_refresh_button.png deleted file mode 100644 index 986fa60ad6..0000000000 Binary files a/devlog/_plan/260904_provider_quota_refresh/assets/030_accounts_refresh_button.png and /dev/null differ diff --git a/devlog/_plan/260904_provider_quota_refresh/assets/040_accounts_refresh_result.png b/devlog/_plan/260904_provider_quota_refresh/assets/040_accounts_refresh_result.png deleted file mode 100644 index ef6c83693f..0000000000 Binary files a/devlog/_plan/260904_provider_quota_refresh/assets/040_accounts_refresh_result.png and /dev/null differ diff --git a/devlog/_plan/260907_release_note_prefix/010_implementation.md b/devlog/_plan/260907_release_note_prefix/010_implementation.md new file mode 100644 index 0000000000..ebc3fbf229 --- /dev/null +++ b/devlog/_plan/260907_release_note_prefix/010_implementation.md @@ -0,0 +1,25 @@ +# Issue #3895: implementation plan + +Satisfy-spec work, triggered by issue #3895 and the request to implement separate draft PRs. Goal: remove the exact leading enforcement marker from release summaries and full changelogs. Non-goals: changing workflow enforcement, publishing a release, modifying historical releases, or generic bracket stripping. Stop after verified draft PR; report unresolved gates. Escalate if renderer changes require workflow/security-policy changes. This file records plan and evidence. + +Class C2: pure formatting behavior, without modifying release authorization or execution. Independent branch from 522ce5f8c. + +File map: +- MODIFY scripts/release-notes.ts: introduce a private exact-prefix normalization helper next to cleanPrTitle. Trim whitespace, remove one leading "[WRONG BRANCH] " marker, retain the rest. Call it before conventional-prefix parsing and for full-changelog titles. Preserve conventional prefixes and author/PR attribution in changelog entries. +- MODIFY tests/ci-workflows/release-notes.test.ts: helper expected scope/casing; complete renderer on generated and carried notes; same-scope grouping; preservation of unrelated bracket tags, nonleading marker, author and PR references. Assert both category and Changelog output. +- MODIFY structure/06_docs-and-release.md: record known-marker handling and preservation of original conventional titles in full changelogs. + +Verification: release-notes tests directly import changed helpers; typecheck covers src only and is not represented as script type checking; full prepush is required by scripts/AGENTS.md; privacy scan. Baseline on unchanged code: 71 passed. Regression expectations come from the published issue, not from cleanPrTitle itself. + +Audit: cleaning only cleanPrTitle was rejected because changelog emits the raw title. General bracket normalization would remove meaningful content. Private helper is shared by exactly two consumers and adds no runtime dependency. Explicit maintainer review for release-related changes remains pending at draft handoff. + +## Verification before draft publication + +- `bun install --frozen-lockfile`: passed; lockfile unchanged. +- Before the production change, four new assertions failed for marker leakage: helper cleanup, delta renderer, carried renderer, and same-scope grouping. Existing baseline: 71 passed. +- `bun test tests/ci-workflows/release-notes.test.ts`: 81 passed, 0 failed after expanding preservation cases. +- `bun run typecheck`: passed during prepush. +- `bun x tsc --ignoreConfig --noEmit --strict --target ESNext --module ESNext --moduleResolution bundler --skipLibCheck --types bun scripts/release-notes.ts`: passed; this explicitly covers the script outside the root tsconfig. +- `bun run privacy:scan`: passed. +- `bun run prepush`: not green. The parallel test lane exceeded its repository-defined 900-second deadline and exited 124; later lanes/stages did not run. Eleven failures were emitted before termination: six timeout cases across combo management, Claude messages, loopback injection, integration restore and Responses overflow; one Claude compatibility assertion failure; four Aside file-symlink EPERM cases. The full suite is incomplete, and no successful full-suite count is claimed. These files are outside the renderer change; causes other than the explicit symlink errors remain unverified. Raw local evidence is in ignored `.tmp/prepush.log`. +- Focused independent review found no concrete production blocker; it was limited and did not replace maintainer security review or complete-suite verification. Linux and macOS were not run locally. diff --git a/devlog/_plan/260908_a_stack_responses_compat/000_plan.md b/devlog/_plan/260908_a_stack_responses_compat/000_plan.md new file mode 100644 index 0000000000..3a22b2d98f --- /dev/null +++ b/devlog/_plan/260908_a_stack_responses_compat/000_plan.md @@ -0,0 +1,103 @@ +# 000 — a_stack_responses_compat: Plan + +## Objective + +Land four Responses-compatibility changes on `dev` as one manual dependent branch +chain whose tip carries all of them, so a single CI run certifies the whole set. +Three layers carry existing contributor pull requests; one is new work for an +issue that has no pull request. + +| Layer | Source | Author to preserve | Subject | +|---|---|---|---| +| 1 | PR #3906, commit `11c498b6c` | MohamadSabree8 | Muse Spark Contributor Free tiers keep unsupported `web_search` fields | +| 2 | PR #3886, commit `83c1d9b12` | cb8010d6 | Spark streams end `adapter_eof` when the Responses Lite header is present | +| 3 | Issue #3922, new work | — | Claude optional tool parameters become strict on Responses routes | +| 4 | PR #3917, commit `2430724e5` | mashfromband | Routed destinations reject Codex `agent_message` with 422 | + +Evidence base: four read-only `gpt-6-astra` explorer lanes read the current tree at +`2abf071e0` and returned quoted `path:line` anchors, reproduced in each phase doc. + +## Loop-spec + +- Loop archetype: satisfy-spec. Each layer has a stated correct behavior; there is + no metric to optimize. +- Trigger: maintainer request to execute workstream A as a stack. +- Goal: the tip merged into `dev`, children settled with authors preserved, linked + issues closed. +- Non-goals: registry `modelWireDefaults` for the `-free` ids; setting the Lite + header to `"false"` instead of removing it; PR #3838's tool-promotion, + `customToolWireName` export and `statelessResponses` work; any other open PR; + `main`/`preview` promotion. +- Verifier: the single Cross-platform CI run on the tip pull request's head SHA. + It runs the repository's own workflow over the cumulative tree, so it observes + every file changed by all four layers. +- Write scope: `src/adapters/openai-responses.ts`, `src/adapters/opencode-go.ts` -> + `src/adapters/routed-agent-messages.ts`, `src/claude/inbound-content-options.ts`, + their regressions, the two test-layout registries, + `docs-site/src/content/docs/reference/adapters.md`, + `docs-site/src/content/docs/reference/configuration/providers.md`, and this unit. +- Budget: no local suite runs at all (instructed). Wall-clock bound is the CI run + plus merge; a red tip after one bounded repair attempt is BLOCKED, not DONE. +- Stop condition: the stack landed on `dev`, proven for the merge method actually + used (see 050): original-tip ancestry for a merge commit, or landed-commit + ancestry plus per-path content equality for squash and rebase. +- Memory artifact: this unit, plus the goalplan at + `.codexclaw/goalplans/deliver-opencodex-workstream-a-responses-compati/`. +- Escalation: a finding that changes a carried author's intended behavior, or a + provider that rejects an explicit `strict: false`, returns to the maintainer. + +## Constraints (from the requesting maintainer) + +- No local product suite, typecheck, build or install runs in this session. Every + such check is recorded `NOT RUN`. +- Every push uses `--no-verify`. +- CI triggers on the stack tip only. When that one run is green, the tip merges + into `dev`; the remaining pull requests are then settled and the issues closed. +- Carried work keeps its original author through a `Co-authored-by` trailer. + +## Why tip-only CI is achievable + +`.github/workflows/ci.yml` declares `pull_request: {}` with no base filter, and +`push: branches: [main, preview, dev]`. Pushing `codex/a-stack-l1..l3` starts no +workflow: those refs are not integration branches and no pull request points at +them. Opening exactly one pull request, for layer 4 against `dev`, produces +exactly one Cross-platform CI run whose head contains all four layers. + +## Base and chain + +Base: `origin/dev` = `942c028735d39b2ad410b1baa95670984e16576d`. + +``` +codex/a-stack-l4-routed-agentmsg (tip, the only pull request) -> base dev +codex/a-stack-l3-claude-strict +codex/a-stack-l2-spark-lite +codex/a-stack-l1-muse-free +origin/dev 942c02873 +``` + +An ordinary dependent branch chain. GitHub native stacks are not used and were +not requested. + +## Work-phase map (one phase = one full PABCD cycle) + +| WP | Doc | Slice | Depends on | +|----|-----|-------|------------| +| wp0 | 000 | This roadmap (docs only) | — | +| wp1 | 010 | Layer 1, carry #3906 | wp0 | +| wp2 | 020 | Layer 2, carry #3886 | wp1 | +| wp3 | 030 | Layer 3, implement #3922 | wp2 | +| wp4 | 040 | Layer 4, carry #3917 | wp3 | +| wp5 | 050 | Publish, one CI run, merge, settle | wp4 | + +Ordering follows textual adjacency in `src/adapters/openai-responses.ts`, which +layers 1, 2 and 4 all touch at distinct hunks (≈2125, ≈2503, ≈2366 and its import). +Layer 3 touches `src/claude/inbound-content-options.ts` only. + +## Terminal outcomes + +- DONE — the stack landed on `dev` with the merge-method-specific proof recorded, + children settled with authors preserved, issues #3885/#3922/#3911 closed. +- BLOCKED — CI red on the tip after a bounded repair attempt, or an unmet merge + requirement. +- NEEDS_HUMAN — an audit finding that would change a carried author's intended + behavior beyond what the issue asks. diff --git a/devlog/_plan/260908_a_stack_responses_compat/010_phase1.md b/devlog/_plan/260908_a_stack_responses_compat/010_phase1.md new file mode 100644 index 0000000000..85f9e11d3d --- /dev/null +++ b/devlog/_plan/260908_a_stack_responses_compat/010_phase1.md @@ -0,0 +1,62 @@ +# 010 — Phase 1: carry PR #3906 (Muse Spark Contributor Free web_search strip) + +Branch `codex/a-stack-l1-muse-free`, based on `origin/dev` `942c02873`. +Carried commit `11c498b6c62ae9f7c5b0d25ca24fc6612f607a5c` by MohamadSabree8. + +## Problem + +`stripMuseSparkUnsupportedWebSearchFields` removes `search_content_types` and +`indexed_web_access` from a Codex `web_search` tool before it reaches the Zen +Responses wire, because that gateway 400s on them. The model guard only lists the +two paid contributor ids, so the two Contributor Free ids ride the same wire and +same gateway contract but keep the rejected fields. + +## MODIFY map + +`src/adapters/openai-responses.ts` — the constant at 2125-2128. + +Before: + +```ts +const MUSE_SPARK_WEB_SEARCH_STRICT_MODELS = new Set([ + "muse-spark-1.3-contributor", + "muse-spark-1.2-contributor", +]); +``` + +After: + +```ts +const MUSE_SPARK_WEB_SEARCH_STRICT_MODELS = new Set([ + "muse-spark-1.3-contributor", + "muse-spark-1.3-contributor-free", + "muse-spark-1.2-contributor", + "muse-spark-1.2-contributor-free", +]); +``` + +Nothing else changes. The consumer at 2148, its model guard at 2155 +(`if (!MUSE_SPARK_WEB_SEARCH_STRICT_MODELS.has(modelId.trim().toLowerCase())) return body;`), +the destination guard at 2159-2164 and the call site at 2451 are untouched. + +## TESTS + +`tests/providers/muse-spark-web-search-compat.test.ts` — add free-tier cases that +mirror the paid-tier assertions already in the file: + +- top-level `tools`: type stays `web_search`, `search_context_size` preserved, + `search_content_types` and `indexed_web_access` absent (mirrors 81-87, 131-137); +- nested `input[].additional_tools.tools`: same removal (mirrors 106-114, 150-158); +- `web_search_preview` untouched for the free ids (mirrors 90-97, 140-147). + +## Known limit (recorded, not fixed here) + +`src/providers/registry.ts:1685-1690` maps only the paid ids in +`modelWireDefaults`, so the `-free` ids do not select the Responses wire +automatically; this fix applies when that wire is chosen explicitly. Changing the +registry is out of scope, matching the carried pull request. + +## Verification (C) + +No local command. The layer is verified by the single tip CI run described in 050. +Local suites: NOT RUN by instruction. diff --git a/devlog/_plan/260908_a_stack_responses_compat/020_phase2.md b/devlog/_plan/260908_a_stack_responses_compat/020_phase2.md new file mode 100644 index 0000000000..13b4cc949c --- /dev/null +++ b/devlog/_plan/260908_a_stack_responses_compat/020_phase2.md @@ -0,0 +1,73 @@ +# 020 — Phase 2: carry PR #3886 (disable Responses Lite transport for Spark) + +Branch `codex/a-stack-l2-spark-lite`, based on layer 1. +Carried commit `83c1d9b129b80d4f65a797fd61a2026deb8c8123` by cb8010d6. + +## Problem + +Issue #3885: with `x-openai-internal-codex-responses-lite: true`, the canonical +backend opens a `gpt-5.3-codex-spark` SSE response and closes it before a terminal +event, which the adapter reports as `response.incomplete` / `adapter_eof`. The same +request without that header completes. + +## MODIFY map + +`src/adapters/openai-responses.ts` — inside the canonical-forward block, before +the existing routing-hint work. Line numbers here are against the pinned base +`942c02873` (block at 2503-2513); layer 1 adds two lines above it, so on this +branch the block sits at 2505-2515. + +After: + +```ts + if (isCanonicalOpenAiForwardProvider(provider)) { + // Spark closes Responses Lite streams before a terminal completion. Select compatibility + // from the final wire model so aliases cannot leave the caller or a static header enabled. + if (isPlainObject(finalBody) && finalBody.model === "gpt-5.3-codex-spark") { + for (const name of Object.keys(headers)) { + if (name.toLowerCase() === CODEX_RESPONSES_LITE_HEADER) delete headers[name]; + } + } + const routingHeaders = new Headers(headers); + applyCodexRoutingHint(routingHeaders, finalBody); +``` + +`finalBody` is computed at 2494-2502 and serialized at 2523 on the pinned base +(2496-2504 and 2525 on this branch), so it is the actual wire model. +`parsed.modelId` can differ; the existing test at 187-188 pins that distinction +deliberately. Keying on `finalBody.model` therefore also covers aliases. The loop +removes every case spelling, which matters because static provider headers merge +in at 2315 and 2353 on the pinned base (2317 and 2355 here) with arbitrary casing. + +## Scope of the fix, and what it does not cover (audit finding 1) + +The independent audit established a real boundary, verified against source: + +- **Covered.** Removing the header fixes the reported defect on the HTTP header + replay path, including the HTTP fallback: `prepareCodexHttpInit()` recomputes + only the routing hint (`src/server/responses/codex-ws-request.ts:46-52`) and + `httpInit` carries the header-deleted request forward (`:68`). +- **Not covered.** On the WebSocket path, `codex-ws-request.ts:30-33` writes + `client_metadata[CODEX_RESPONSES_LITE_METADATA_KEY]` only when the header is + present and reads `"true"`/`"false"`. Deleting the header leaves any + pre-existing `client_metadata` Lite value in the body untouched, and that value + reaches the frame at `:71` and the pool reuse key at + `codex-ws-pool.ts:53-55`. + +Setting the header to `"false"` instead of deleting it would also cover the WS +case, but that expands the carried author's diff beyond issue #3885 and changes +socket reuse identity. This phase carries the author's delete-only form and +records the WS metadata case as unresolved rather than silently expanding scope. +The tip pull request states this limit explicitly so the residual is visible. + +## TESTS + +`tests/codex-integration/codex-metadata-integrity.test.ts`, beside the mixed-case +test at 171: Spark wire model with a caller-provided Lite header, with a +mixed-case static header, and with `parsed.modelId` set to an alias while the +serialized model is Spark; `gpt-5.6-sol` keeps the header. Existing guards at 185, +211, 225 and 267 stay intact. + +## Verification (C) + +No local command. Verified by the single tip CI run in 050. Local suites: NOT RUN. diff --git a/devlog/_plan/260908_a_stack_responses_compat/030_phase3.md b/devlog/_plan/260908_a_stack_responses_compat/030_phase3.md new file mode 100644 index 0000000000..c0e6a00b3f --- /dev/null +++ b/devlog/_plan/260908_a_stack_responses_compat/030_phase3.md @@ -0,0 +1,141 @@ +# 030 — Phase 3: fix issue #3922 (Claude tool strict default on Responses routes) + +Branch `codex/a-stack-l3-claude-strict`, based on layer 2. New work; no existing +pull request. This is the only layer authored here. + +## Problem + +When Claude Code sends a custom tool without an explicit `strict`, the +Messages -> Responses translation emits a function tool that also omits `strict`. +The Responses API treats an omitted `strict` as an attempt to normalize the schema +into strict mode, so parameters that the Anthropic `input_schema` marks optional +are treated as required upstream, and a tool call that omits them fails. Anthropic +requires an explicit `strict: true` to opt in, so the two defaults disagree. + +## MODIFY map + +`src/claude/inbound-content-options.ts` — `toolsToResponses`, the function-tool +branch at 26-33. + +Before: + +```ts + if (typeof raw.name === "string" && raw.name.length > 0 && isRec(raw.input_schema)) { + out.push({ + type: "function", + name: raw.name, + ...(typeof raw.description === "string" ? { description: raw.description } : {}), + parameters: raw.input_schema as Record, + }); + continue; + } +``` + +After: + +```ts + if (typeof raw.name === "string" && raw.name.length > 0 && isRec(raw.input_schema)) { + out.push({ + type: "function", + name: raw.name, + ...(typeof raw.description === "string" ? { description: raw.description } : {}), + parameters: raw.input_schema as Record, + // Anthropic opts into strict tool use explicitly, while Responses normalizes + // an omitted strict into strict mode. Carry the source intent rather than the + // destination default, so an optional input_schema parameter stays optional. + strict: typeof raw.strict === "boolean" ? raw.strict : false, + }); + continue; + } +``` + +The value is derived from the source tool rather than hardcoded, so an explicit +`strict: true` or `strict: false` from the client survives translation, which is +what issue #3922 asks for. + +## How the existing strict-tool admission policy relates (audit finding 2) + +An earlier draft of this document described `src/claude/compatibility.ts:102` +backwards. What that line actually does: + +```ts +if (tool.strict === true) codes.add("strict_tools"); +``` + +`strict_tools` is listed as an incompatible feature at `compatibility.ts:16`, and +`analyzeClaudeCompatibility` (`compatibility.ts:179`) returns `"reject"` for an +incompatible request under enforce mode (decision expression at `:189`), which +`src/server/claude-messages.ts:733-740` applies **before** +translation. So an explicit `strict: true` is already refused in enforce mode and +only reaches translation on the default and shadow paths. + +This phase does not change that policy. Detection reads the **source** Anthropic +tool before translation, so emitting a default `strict: false` downstream adds no +new rejection; `tests/claude-integration/claude-compatibility.test.ts:73-78` +already covers the explicit-false allow case, and `:24` lists strict tools among +rejected features. + +## Propagation (independently traced twice, no further change needed) + +- `src/claude/inbound-content-options.ts:26-32` builds the tool. +- `src/claude/inbound.ts:350-351` assigns it to `body.tools`. +- `src/server/claude-messages.ts:875,897` serializes that body into the internal + Responses request; `src/server/responses/core.ts:3160` parses it. +- `src/responses/schema.ts:114` accepts `strict`; `parser-tools.ts:63` preserves an + explicit value including `false`. +- `src/responses/parser.ts:570` keeps `_rawBody`, and + `src/adapters/openai-responses.ts:2362-2364` starts from it. Canonical-field + stripping only removes `external_web_access`/`defer_loading` (`:189-200`) and + schema normalization spreads the tool (`{ ...tool, parameters }`, `:648-658`), + so `strict` reaches `JSON.stringify(finalBody)` at `:2523`. + +## Boundaries + +- Hosted `web_search` leaves the function at 22-24, before this branch, so it gains + no `strict` field. +- Native Anthropic passthrough never reaches translation: + `src/server/claude-messages.ts:721-722` returns from `anthropicNativePassthrough` + before the translation call at 757. +- Other Anthropic server tools still drop at 35. + +## Schema promise, stated precisely (audit finding 4) + +At translation, `parameters` is the caller's `input_schema` reference +(`inbound-content-options.ts:31`), so `properties`, `required` and nested schemas +are unchanged there. That is not a promise of a byte-identical schema on every +outbound route: `openai-responses.ts:651` runs `normalizeXaiToolParameters`, `:657` +supplies a root `type: "object"` when absent, `responses-code-mode.ts:23-27` can +rewrite an `exec` parameter description, and Azure Chat sanitizes at +`openai-chat.ts:1359-1361`. The regression asserts an unchanged schema through the +ordinary OpenAI Responses route. + +Adding the field also shifts fallback cache-cohort hashes, because translated tool +definitions participate in the hash at `src/claude/inbound.ts:386-392`. That is a +cohort change, not a correctness change. + +## Known risk + +The same translated tools feed translated Chat Completions routes, where +`openai-chat.ts:1343` forwards an explicit `strict`; Azure deletes it at `:1364`, +and `tests/providers/azure-model-router-tool-schema.test.ts:42` already pins that +absence. No repository-declared rejection of an explicit `strict: false` was found, +but universal upstream acceptance is not proven. A provider rejecting it is an +escalation. + +## TESTS + +`tests/claude-integration/claude-inbound.test.ts`: + +- **Update the existing assertion at 80-83.** It is an exact `toEqual` on the + translated `Read` tool and will fail once `strict` is present; the expected + object gains `strict: false`. +- Keep `expect(tools[1]).toEqual({ type: "web_search" })` at 84 unchanged. +- New cases: omitted `strict` -> `false`; explicit `false` -> preserved; explicit + `true` -> preserved; an `input_schema` with one required and one optional + property keeps its `required` array through `parseRequest`. +- Assert the three values on the **serialized adapter output**, not only the + translator return, so the wire body is what is pinned. + +## Verification (C) + +No local command. Verified by the single tip CI run in 050. Local suites: NOT RUN. diff --git a/devlog/_plan/260908_a_stack_responses_compat/040_phase4.md b/devlog/_plan/260908_a_stack_responses_compat/040_phase4.md new file mode 100644 index 0000000000..b5a0f94be3 --- /dev/null +++ b/devlog/_plan/260908_a_stack_responses_compat/040_phase4.md @@ -0,0 +1,121 @@ +# 040 — Phase 4: carry PR #3917 (routed agent_message conversion), stack tip + +Branch `codex/a-stack-l4-routed-agentmsg`, based on layer 3. This branch is the +stack tip and the only one with a pull request. +Carried commit `2430724e57e0950bde4b006c0175a2d5c70a0baf` by mashfromband. + +## Problem + +Codex writes every sub-agent reply into the rollout as an `agent_message` input +item, which is private to the ChatGPT Codex schema, so it is replayed in the input +of every later turn of that thread. The routed Responses destinations reported in +#3911 and #3907 reject the whole body with +`422 unknown item type "agent_message"`. 422 is a client error, so nothing fails +over and the thread stays broken. The plaintext conversion already existed but was +scoped to the OpenCode Go destination, and nothing in those reports is specific to +that destination. + +## MODIFY / RENAME map + +1. `src/adapters/opencode-go.ts` -> `src/adapters/routed-agent-messages.ts`. + `isOpenCodeGo` is deleted; its only production consumer is the call site below. + `normalizeOpenCodeGoAgentMessages` becomes `normalizeRoutedAgentMessages` with + the algorithm unchanged, including the fail-closed check that every content part + is `input_text`/`input_image`/`input_file`. + +2. `src/adapters/openai-responses.ts:1` and `:2366`. + + Before: + + ```ts + import { isOpenCodeGo, normalizeOpenCodeGoAgentMessages } from "./opencode-go"; + ... + if (!forward && isOpenCodeGo(provider.baseUrl)) outBody = normalizeOpenCodeGoAgentMessages(outBody); + ``` + + After: + + ```ts + import { normalizeRoutedAgentMessages } from "./routed-agent-messages"; + ... + if (!forward) outBody = normalizeRoutedAgentMessages(outBody); + ``` + + `forward` is `provider.authMode === "forward"` (2356). All forward destinations + retain the existing behavior and keep the item unchanged. + +3. `tests/providers/opencode-go-agent-messages.test.ts` -> + `tests/adapters/routed-agent-messages.test.ts`, with the two Go-specific + expectations (54, 120-122) changed from `agent_message` to the converted + `message`/`user` shape for arbitrary routed URLs. + +4. `tests/responses/responses-opaque-blob-recovery.test.ts` — the four assertions + at 553, 583, 611 and 754. That fixture is `authMode: "key"` (163-164), so its + retried item is now converted. Opaque-blob recovery repairs an undecryptable part + into `[encrypted content omitted]`, which leaves the item fully plaintext; on a + routed retry it is converted too, which is what lets the retry be accepted. + Expected object becomes: + + ```ts + { + type: "message", + role: "user", + content: [ + { type: "input_text", text: 'Agent message {"author":"/root/child_task","recipient":"/root"}' }, + { type: "input_text", text: "Message Type: MESSAGE\nTask name: /root\nSender: /root/child_task\nPayload:" }, + { type: "input_text", text: "[encrypted content omitted]" }, + ], + } + ``` + + The `authMode: "forward"` case in the same file is untouched. + +5. Both test-layout registries, because the test basename and directory change: + `scripts/test-layout/layout.json:917` and + `tests/fixtures/test-layout-expected.json:752` drop + `"opencode-go-agent-messages.test.ts": "providers"` and gain + `"routed-agent-messages.test.ts": "adapters"`. + `tests/test-layout-tooling.test.ts:250` compares the two tables exactly, so + missing either one fails. + +6. `docs-site/src/content/docs/reference/adapters.md` and + `docs-site/src/content/docs/reference/configuration/providers.md`, whose wording + describes the conversion as Go-specific, as in the carried pull request. The + carried text's universal "any routed destination" phrasing is narrowed to the + observed non-forward destinations rather than copied unchanged. + +## Preserved behavior + +Forward destinations, ciphertext and unknown part types (the `every` guard), +replay immutability and no-op reference identity, the identity prefix text, and +the session-header assertion at 55 of the moved test. + +## PR #3838 boundary + +#3838 stays open and independent. Its `normalizeOpenCodeGoAdditionalTools` +promotion, `customToolWireName` export and `statelessResponses` registry flag are +unrelated to this conversion. Its mixed-content policy drops ciphertext and unknown +parts whenever plaintext survives, which contradicts the fail-closed retention kept +here; it is not carried. + +## Verification (C) + +No local command. Verified by the single tip CI run in 050. Local suites: NOT RUN. + + +## Which destinations actually change (audit finding 5) + +`src/types/provider.ts:449` declares `authMode?: "key" | "forward" | "oauth" | "local"`. +Because the new gate is `!forward` and `forward` is `provider.authMode === "forward"` +(`openai-responses.ts:2356`), the conversion now applies to **key, oauth, local and +undefined** whenever this adapter is selected. Every forward destination is +unchanged, including noncanonical forward gateways; the built-in ChatGPT +destination is forward (`src/providers/registry.ts:1200-1204`), so its native items +stay intact. + +No repository-declared non-forward destination requires plaintext `agent_message` +preservation. Authentication mode alone cannot prove what an arbitrary custom +upstream accepts, so the carried claim that *every* routed destination rejects the +item is stated here as the observed pattern rather than a proven universal. +Regression coverage adds a non-forward mode beyond the carried key/forward +fixtures. diff --git a/devlog/_plan/260908_a_stack_responses_compat/050_phase5.md b/devlog/_plan/260908_a_stack_responses_compat/050_phase5.md new file mode 100644 index 0000000000..97b928d92c --- /dev/null +++ b/devlog/_plan/260908_a_stack_responses_compat/050_phase5.md @@ -0,0 +1,95 @@ +# 050 — Phase 5: publish, single CI run, merge, settle + +## Publication + +Push all four branches with `--no-verify`, in chain order: + +``` +git push --no-verify origin codex/a-stack-l1-muse-free +git push --no-verify origin codex/a-stack-l2-spark-lite +git push --no-verify origin codex/a-stack-l3-claude-strict +git push --no-verify origin codex/a-stack-l4-routed-agentmsg +``` + +Pushing l1-l3 starts no workflow: `.github/workflows/ci.yml` limits its `push` +trigger to `[main, preview, dev]`, and no pull request points at those refs. + +## The single pull request + +Open exactly one pull request: `codex/a-stack-l4-routed-agentmsg` -> `dev`. Its +head contains all four layers, so the one Cross-platform CI run it starts is +cumulative evidence for the whole stack. The description follows +`.github/PULL_REQUEST_TEMPLATE.md` (Summary, Verification, Checklist), states that +local suites were NOT RUN by maintainer instruction with CI as the verification +gate, and names every carried pull request and issue. + +Author preservation: each carried commit keeps its original author through a +`Co-authored-by` trailer that survives a squash, satisfying +`missing_coauthor_credit` in `.github/scripts/pr-carry-attribution.cjs`: + +- `Co-authored-by: MohamadSabree8 ` +- `Co-authored-by: R <53855466+cb8010d6@users.noreply.github.com>` +- `Co-authored-by: mashfromband ` + +## Merge gate + +Merge only when the tip's Cross-platform CI is green on the exact head SHA of the +pull request. Skipped, cancelled or queued jobs are not passing evidence, and a +green run on an earlier head does not certify a newer one. After merging, fetch +`origin/dev` and prove landing in the way the chosen merge method allows. + +The method decides the proof, and only one of the three preserves the tip SHA: + +- **Create a merge commit.** The tip SHA itself becomes reachable from `dev`, so + `git merge-base --is-ancestor origin/dev` exits 0 and is sufficient. +- **Squash and merge.** GitHub writes one new commit, so the tip SHA never becomes + an ancestor and that check would fail on a successful merge. +- **Rebase and merge.** GitHub replays the commits onto `dev` with new SHAs, so the + original tip SHA is likewise not an ancestor. + +For the two rewriting methods, identify the landed commit or commits on `dev` +first, then prove landing by content and attribution rather than by the original +SHA: + +- `git diff origin/dev -- ` is empty; +- `git merge-base --is-ancestor origin/dev` exits 0 for the landed + commit; +- the landed record carries all three `Co-authored-by` trailers. + +Record the method used together with its matching proof, rather than asserting +ancestry of the original tip generically. + +## Settlement + +Once the change is confirmed on `dev`: + +- PRs #3906, #3886 and #3917 — comment that the work landed on `dev` through the + stack tip, name the merge commit, and close them. Their authors are already + preserved in the trailers. +- Issues #3885 (Spark `adapter_eof`), #3922 (Claude tool strict) and #3911 + (routed `agent_message` 422) — close, since PRs target `dev` and GitHub only + auto-closes on merges into the default branch. +- PR #3838 stays open; its residual work is unrelated to this stack. + +## Verification (C) + +The tip CI run identified by its run id and head SHA, with every required job +reporting success, plus the merge-method-specific landing proof above against a +freshly fetched `origin/dev`. Local suites: NOT RUN by maintainer instruction. + + +## Merge readiness is broader than one workflow (audit finding 7) + +The single tip CI run is the verification evidence this session produces, but it is +not by itself the whole merge gate. `MAINTAINERS.md:57-69` also requires the +applicable required checks, resolution of outstanding maintainer objections, and +applicable security review. The `dev`-only maintainer-integration path still +records the decision and the exact-head evidence. Anything in that set that this +session cannot satisfy is reported rather than assumed. + +## Attribution is added, not inherited + +The three carried commits do **not** already contain `Co-authored-by` trailers in +their original messages. The trailers listed above are added when the commits are +carried onto the stack, and their presence is verified on the final squash-surviving +record before the children are closed. diff --git a/devlog/_plan/260908_voice_relay/000_plan.md b/devlog/_plan/260908_voice_relay/000_plan.md new file mode 100644 index 0000000000..2675c20c84 --- /dev/null +++ b/devlog/_plan/260908_voice_relay/000_plan.md @@ -0,0 +1,39 @@ +# Codex voice relay follow-up + +Satisfy-spec HOTL loop, triggered by the maintainer's September voice source comparison request. +Goal: carry only verified OpenCodex-owned improvements and document the client/proxy boundary. +No local product tests, typecheck, build or installs; no release, deployment or user settings changes. +Verification: read pinned upstream source and Aside findings; independent review; final cumulative +remote Cross-platform CI dispatch (all lanes), followed by exact-head merge and fetched dev tree proof. +Local product verification is NOT RUN by explicit user instruction. Git diff/document inspection is +allowed but does not certify runtime behavior. No latency or live audio improvement is claimed. +Stop: audited no-change conclusion, or required corrections landed with fresh remote evidence. +Outcomes: DONE, evidence-backed NOOP, or explicit unmet external gate. No invented time/cost budget; +existing tools/credentials only, bounded individual probes, no new services or installs. +Escalation: unresolved maintainer objection, missing external authority, or unavailable required CI. + +## Ordered work phases + +1. wp1: source research and audited roadmap (documents only). +2. wp2: scoped relay correction and adjacent regression coverage; depends on wp1. +3. wp3: publish the documented contract, final cumulative CI, and merge; depends on wp2. + +Existing owners: `src/server/live.ts`, `src/server/index.ts`, `tests/server/server-live.test.ts`, +`docs-site/src/content/docs/guides/codex-integration.md`, `structure/04_transports-and-sidecars.md`. +No new production abstraction, endpoint or dependency. Preserve preexisting worktree documents. +Manual two-PR chain: relay implementation/tests, then integration documentation. User explicitly +requests final-tip-only product CI, overriding per-layer local/full-suite defaults. Automatic +redundant product CI on these task PRs may be cancelled; it is never counted as passing evidence. +Use merge commits to preserve stack ancestry, retarget the child only after the parent lands, +and recheck the current dev tree before final merge. Required checks remain truthful. + +Security working material is kept only in ignored scratch per AGENTS.md. The detailed audited +roadmap resides in `.tmp/voice-0908/010_runtime.md` and `.tmp/voice-0908/020_delivery.md` until +publication of the fix; it is intentionally not copied into this public planning directory. + +## Roadmap audit and lock + +Independent plan and security audit: PASS, no blockers. The implementation will preserve view +bounds and original frame delivery. Diagnostic replacement-character flags are not evidence of +which peer introduced malformed text. Existing logs are outside this prospective logging change. +The roadmap is locked for wp2; final runtime evidence remains due in wp3, on the cumulative tree. diff --git a/devlog/_plan/260908_voice_relay/001_sources.md b/devlog/_plan/260908_voice_relay/001_sources.md new file mode 100644 index 0000000000..b5a6c2658f --- /dev/null +++ b/devlog/_plan/260908_voice_relay/001_sources.md @@ -0,0 +1,24 @@ +# Source comparison + +Pinned upstream: openai/codex b01c3986fd2e79b8a477a08d81430f52f22bc0dc (2026-09-07 UTC). +The local corpus is `/Users/jun/Developer/codex`; its 120 and 121 upstream checkouts had older +working heads, so the named commit was fetched without modifying their worktrees. + +- https://github.com/openai/codex/commit/1b53f6a44eff890b5169bde8d3bd5b12b8766946: + local voice helper offer/answer, ordered oai-events data channel and UDP/TCP transport. +- https://github.com/openai/codex/commit/b01c3986fd2e79b8a477a08d81430f52f22bc0dc: + feature-gated TUI voice commands, captions, handoff answer delivery and lifecycle cleanup. +- `codex-rs/codex-api/src/endpoint/realtime_call.rs` at the pinned head: + backend JSON and API multipart call creation, Frameless `/live`, AVAS `/realtime/calls`. +- OpenCodex `src/server/live.ts` already implements these call-create and sideband shapes; + `src/server/index.ts` transparently relays frames and bounds pending queues and teardown. +- `tests/server/server-live.test.ts` already covers call creation, protocol headers, pool identity, + sideband joins and frame delivery. Existing implementation is reused, not duplicated. + +Fast-tier display text and local audio negotiation do not demonstrate a proxy latency gain. +The TUI merge date does not establish when a desktop binary shipped. Live microphone/audio +verification is outside the automated evidence gathered here. + +The Fast-tier metadata commit is 0e0f55fc4ec9308840e54ceba1f1f1dc9547380f, +2026-09-04T00:12:18Z; it changes only `codex-rs/models-manager/models.json`. +It describes the supported service tier, not OpenCodex voice transport performance. diff --git a/docs-site/src/content/docs/contributing.md b/docs-site/src/content/docs/contributing.md index 19f694d3eb..58eb9792ae 100644 --- a/docs-site/src/content/docs/contributing.md +++ b/docs-site/src/content/docs/contributing.md @@ -42,6 +42,12 @@ bun run prepare:package # refresh package launchers/assets `origin/dev`, then local `dev`. It reports that ref and the exact `git merge-base HEAD ` commit, then passes the merge-base SHA to Bun. +If a test lane times out, the runner prints the stdout and stderr it has already +captured and exits with code 124. After a process exits, captured pipes have a +one-second drain limit so a descendant holding a pipe open cannot stall the runner. +Incomplete capture is reported explicitly and does not count as a successful run, +even if the direct child exited with code 0. + Tests are Bun tests in domain directories that mirror `src/`: `tests/server/`, `tests/providers/`, `tests/adapters/openai/`, `tests/cli/` and so on. `scripts/test-layout/layout.json` is the map and `tests/test-layout.test.ts` enforces it, so a new test goes into its domain directory and gets diff --git a/docs-site/src/content/docs/getting-started/quickstart.md b/docs-site/src/content/docs/getting-started/quickstart.md index 1fdcf922d8..867a06cec1 100644 --- a/docs-site/src/content/docs/getting-started/quickstart.md +++ b/docs-site/src/content/docs/getting-started/quickstart.md @@ -36,6 +36,34 @@ stop setup without falling back to an overwrite. If publication or temporary-fil finish, inspect the config directory before retrying: a complete config or private temporary file may remain. +If setup reports that initial config permissions could not be secured, the filesystem or account +could not apply the required private permissions (NTFS ACLs on Windows). This happens before +config contents are written. A hard-link publication error is a separate failure: private +permissions were applied, but publishing the completed file failed or its outcome is uncertain. + +Inspect the selected config directory before retrying. Preserve any existing `config.json`; +do not delete it to force setup to proceed. For a fresh installation, choose a writable location +that supports both hard links and private permissions. A local NTFS directory is a suitable +Windows choice when your account can apply its ACLs. For example, select a new location in the +same terminal before running setup: + +```powershell +# Windows PowerShell: choose a fresh directory on a local NTFS volume. +$env:OPENCODEX_HOME = Join-Path $env:LOCALAPPDATA "opencodex-local" +ocx init +``` + +```sh +# macOS/Linux: choose a fresh directory on a filesystem with hard links and Unix permissions. +export OPENCODEX_HOME="$HOME/.opencodex-local" +ocx init +``` + +Use the same `OPENCODEX_HOME` for subsequent commands and the service that runs the proxy. +Changing this variable selects a separate configuration location; it does not migrate an existing +installation. Setup intentionally has no direct-write or replacing-rename fallback: creating an +exclusive file and then writing to it could expose partial config contents. + :::note[GPT-5.6 rollout entries] The current stable release seeds GPT-5.6 Sol/Terra/Luna for ChatGPT passthrough, OpenAI API-key, OpenRouter, and diff --git a/docs-site/src/content/docs/guides/codex-integration.md b/docs-site/src/content/docs/guides/codex-integration.md index f5592c0a72..2944208279 100644 --- a/docs-site/src/content/docs/guides/codex-integration.md +++ b/docs-site/src/content/docs/guides/codex-integration.md @@ -49,10 +49,33 @@ current bearer, so the key only keeps the join on the proxy path. It is written `openai_base_url` form, is removed together with it, and a user-owned `experimental_realtime_ws_base_url` is never overwritten. +### Voice transport and task handoffs + +Codex owns the microphone and speaker, WebRTC media negotiation, captions, mute controls, and +voice cleanup when switching threads. OpenCodex relays call creation and the sideband connection; +work delegated by voice uses the normal Responses routing path. Choosing a text provider does +not replace the realtime speech model or enable voice in a client that does not support it. + +The upstream [WebRTC helper change](https://github.com/openai/codex/commit/1b53f6a44eff890b5169bde8d3bd5b12b8766946) +and [TUI voice integration](https://github.com/openai/codex/commit/b01c3986fd2e79b8a477a08d81430f52f22bc0dc) +describe these client responsibilities, including speaking final answers from voice handoffs. +Their merge dates do not establish when the same behavior reached the desktop app. + +Optional `OCX_LIVE_FRAME_LOG` diagnostics write only frame timestamp, direction, kind, byte count, +and a replacement-character flag (`ts`, `dir`, `kind`, `bytes`, `fffd`). They do not store voice +text or frame excerpts. For binary frames, UTF-8 decoding can itself produce replacement +characters, so the flag alone does not identify where corruption occurred. Existing log files +are not rewritten. + +### Fast mode + The injected `fast_mode` follows the tri-state `fastMode` setting: `true` writes `fast_mode = true`, `false` writes `fast_mode = false`, and unset leaves an existing `fast_mode` untouched without adding a `[features]` table. +Fast mode is separate from voice transport. A supported model's service-tier speed description +does not guarantee lower microphone, WebRTC, or end-to-end voice latency through OpenCodex. + The proxy listens on port `10100` by default and serves `POST /v1/responses`, `POST /v1/responses/compact`, `POST /v1/images/generations`, `POST /v1/images/edits`, `GET /v1/models`, `GET /healthz`, and the `/api/*` management surface. @@ -213,6 +236,15 @@ provider advertises `supports_websockets = true` only when `"websockets": true`; built-in provider may try WebSocket first, and a disabled proxy returns `426` so Codex falls back to HTTP/SSE. +If a canonical ChatGPT forward continuation references expired or missing local replay state, +opencodex returns `previous_response_not_found` before sending anything upstream. Codex's +WebSocket client recognizes this error and can reconnect with its full retained context, +including completed tool calls and their results, within its normal stream retry budget. An +idle task therefore does not need a new task solely because the proxy's one-hour cache expired. +The cache remains bounded; this does not extend retention or recover history the client no +longer has. HTTP clients must handle the error explicitly and resend their full context without +`previous_response_id`. Retrying only the same ID cannot recover missing state. + ### Authless Codex Desktop (opt-in) In **Dashboard → Overview**, **Open Codex without signing in** controls this existing diff --git a/docs-site/src/content/docs/guides/combos.md b/docs-site/src/content/docs/guides/combos.md index 031766373e..db94da045f 100644 --- a/docs-site/src/content/docs/guides/combos.md +++ b/docs-site/src/content/docs/guides/combos.md @@ -74,6 +74,19 @@ Aliases change the public name clients request; they do not change the combo's s concrete provider/model selectors behind it. ::: +## Compaction after switching combos + +When a client compacts using a bare model name after switching combos, opencodex can recall the +combo that most recently completed successfully on that conversation lane. The model must match +the completed response, and the combo and its target must still exist in the current configuration. +The request then follows normal combo selection and failover. + +Explicit provider/combo selectors and configured combo aliases take precedence over this recall. +Failed, incomplete, or cancelled responses do not replace the last successful selection. Recall is +process-local and bounded to 256 lanes for 30 minutes; it does not store account credentials. +Without usable conversation identity or valid remembered state, normal compaction routing applies. +A restart clears the remembered state. + ## Codex Desktop native-allowlist compatibility Some Codex Desktop releases apply a remote native-only `available_models` allowlist after the diff --git a/docs-site/src/content/docs/ja/reference/cli/lifecycle.md b/docs-site/src/content/docs/ja/reference/cli/lifecycle.md index b187ff7fd3..b7952b5c28 100644 --- a/docs-site/src/content/docs/ja/reference/cli/lifecycle.md +++ b/docs-site/src/content/docs/ja/reference/cli/lifecycle.md @@ -212,10 +212,28 @@ ocx codex-shim status ocx codex-shim uninstall ``` +:::note[Windows のトークン環境] +新しく生成される Windows CMD と PowerShell のシムは、実行後に呼び出し元の `OPENCODEX_API_AUTH_TOKEN` を元の状態に戻します。Codex とその子プロセスには、引き続きトークンが継承される可能性があります。 + +OpenCodex の更新後、既存の Windows シムにこの動作を適用するには、`ocx codex-shim uninstall`、続いて `ocx codex-shim install` を実行して再作成してください。通常の更新では、正常な Windows シムは書き換えられません。 +::: + :::tip[サービス vs シム] 常時オンのバックグラウンド プロキシには `ocx service` を使用します (推奨)。デーモンを使用しない軽量のオンデマンド起動には、`ocx codex-shim` を使用します。プロキシは、`codex` が起動された場合にのみ起動します。 ::: +#### Codex へのトークン注入 + +非ループバックアドレスにバインドする場合、注入されるプロバイダーには `env_key = "OPENCODEX_API_AUTH_TOKEN"` が含まれます。この行は、読み取る変数を Codex に指定するだけで、変数を作成するものではありません。変数が存在しない場合、Codex はリクエストの開始を拒否し（`Missing environment variable: OPENCODEX_API_AUTH_TOKEN`）、プロキシには到達しません。値は `$OPENCODEX_HOME/service-api-token` に保存されており、起動元のプロセスが Codex の環境にその値を渡す必要があります。 + +`ocx codex-shim install` でインストールされる、保守対象のシムを使用してください。起動コンテキストでこのシムが選択されると、シムは OpenCodex が作成したトークンファイルを読み取り、変数を Codex に渡します。デスクトップ、cron、サービスから起動する場合は、このシムが選択される PATH またはランチャーパスを使用する必要があります。インストールによって、それらの環境が自動的に設定されるわけではありません。Codex 自身の子プロセスにも、トークンが継承される可能性があります。 + +この Bearer トークンをシェルの起動ファイルからエクスポートしたり、`config.toml` にコピーしたりしないでください。`service-api-token` ファイルに含まれるのは `NAME=value` 形式の代入ではなくトークンそのものなので、systemd の `EnvironmentFile=` として直接使用することはできません。 + +`opencodex-proxy.service` の `EnvironmentFile=` または `OCX_API_TOKEN_FILE` は、プロキシプロセスだけを設定するものであり、独立して起動された `codex exec` に渡されることはありません。 + +ランチャーを置き換える Codex のアップグレードによって、シムは削除されます。次に通常の `ocx` コマンドを実行すると復元されますが（上記参照）、その前に実行された `codex exec` は失敗します。`ocx doctor` は、この状態（env_key が設定済み、変数が未設定、シムが存在しないか正常でない、トークンファイルは存在する）を修復コマンドとともに "Codex env_key launch readiness" の項目で報告し、トークンを表示することはありません。トークンファイルの読み取りは、注入された `env_key` の契約には含まれません。起動元のプロセスがその変数を渡す必要があります。 + ### `ocx tray [--json] [--no-start]` Windows ステータス トレイ アイコンをインストールして制御します。 Windows ログイン時に開始され、ワンクリックでプロキシ コントロールを提供します。 `start` および `stop` はアイコンのみを制御します。そのメニューを使用してプロキシを制御します。 `--no-start` は `install` に適用され、トレイをすぐに起動せずにインストールします。 diff --git a/docs-site/src/content/docs/ja/reference/configuration/agents.md b/docs-site/src/content/docs/ja/reference/configuration/agents.md index 2b185b81c4..6dc3f39162 100644 --- a/docs-site/src/content/docs/ja/reference/configuration/agents.md +++ b/docs-site/src/content/docs/ja/reference/configuration/agents.md @@ -26,15 +26,25 @@ description: マルチエージェント サーフェス、委任ガイダンス 管理 API は、`GET`/`PUT /api/v2`、`/api/injection-model`、`/api/effort-caps`、`/api/subagent-models`、および `/api/subagent-model-fallback` を公開します。インジェクションモデルの更新は部分的です。カスタム プロンプトは、その API の `prompt` フィールドです。 +## 常時プロアクティブ委任 + +Subagents → 詳細設定の **常時プロアクティブ委任**（旧 **Ultra mode**）は、推論のエフォートを変更せず、委任を開始する条件だけを変更します。推奨プリセットでも、ユーザーの指示、権限の境界、タスクの範囲、ツールの規則は維持されます。 + +`GET` と `PUT /api/v2` は、追加で `multiAgentModeHintRecommendation: { text, revision }` を返します。ダッシュボードはプリセットの有効化と復元にサーバー提供のテキストを使い、固定文へのフォールバックは行いません。旧サーバーが推奨値を返さない場合や値の形式が不正な場合、プリセットの適用と復元は利用できませんが、既存のカスタムヒントの編集と削除は引き続き利用できます。プリセットの復元はローカルの下書きだけを変更し、保存操作で確定します。 + +設定の読み取り、無関係な更新、アップグレードでは、保存済みのヒントは移行されません。ヒントを明示的に更新し、その本文が既知の旧 OpenCodex プリセット2種類のいずれかとバイト単位で完全一致する場合に限り、現在の推奨文に置き換わります。それ以外の有効なカスタムテキストは、空白だけが異なるものも含め、バイト単位で保持されます。既存の v2 有効化、機能サポート確認、ヒント削除の規則は変わらず、変更は新しい Codex セッションに適用されます。 + ## ロスターとガイダンス -有効な v2 ロスターは、v2 と互換性があり、挿入されたカタログに存在する、構成され、ピッカーに表示され、優先順位で並べ替えられた最初の 5 つのモデルです。 V2 の適格性は、明示的な `"v2"`、`null`、または欠落しているアップストリーム ピンを適格なものとして扱います。実際の `"v1"` ピンは除外されます。除外されたエントリは設定に残るため、後で適格になる可能性があります。 +有効な v2 ロスターは、設定済みでピッカーに表示され、優先順位で並べ替えられた最初の 5 つのモデルのうち、挿入されたカタログに存在し、明示的に `"disabled"` とされていないモデルです。明示的な `"v2"` ピンは再帰的なワーカーをサポートし、`"v1"`、`null`、ピンの省略はリーフワーカーとして引き続き適格です。除外されたエントリは設定に残るため、後で適格になる可能性があります。 表面検出はツール形状を使用します。 `send_input`、`resume_agent`、または `close_agent` を持つ名前空間付き `spawn_agent` は v1 です。 `send_message`、`followup_task`、`interrupt_agent`、または `list_agents` を備えたフラット `spawn_agent` は v2 です。 V1 ガイダンスは、`max` または `ultra` でのみプロアクティブ テキストです。 V2 は、優先モデル、適格なロスター、またはフォールバック チェーンが存在する場合にのみ、プロキシ作成の開発者メッセージを受信します。組み込みの v2 ガイダンスには 700 文字のバジェットがあり、必要に応じて最初にロスターが削除されます。ガイダンスはリプレイ プレフィックス全体で重複排除され、後続の `compaction_trigger` の前に挿入されます。 -`injectionModel` および `injectionEffort` は、ネイティブデフォルト同期が有効になっていない限り、推奨事項です。組み込みの v2 テキストは、サポートされているモデル/エフォートのオーバーライドを `fork_turns: "none"` を使用して `spawn_agent` に渡すように Codex に要求します。カスタム `injectionPrompt` は、欠落している値を空の文字列に置き換えます。 +組み込みの v2 サブエージェントガイダンスとカスタム `injectionPrompt` 本文は、どちらも `` を使用し、Codex ネイティブの `` メッセージとは区別されます。組み込みテキストは、解決済みの優先モデル、ロスター、フォールバックチェーンを示しますが、委任、モデルのオーバーライド、`fork_turns` は指示しません。カスタム本文のプレースホルダー置換と内容は維持されます。`injectionModel` および `injectionEffort` は、ネイティブデフォルト同期が有効になっていない限り推奨事項であり、カスタムプレースホルダーの欠落値は引き続き空の文字列に置き換えられます。 + +リプレイの重複排除では、タグの種類ごとに最新のテキストとの完全一致を確認します。両方の値が新しいプロキシのタグを使用する場合、カスタムガイダンスから組み込み形式へ戻すと、その時点の内容が追加されます。途中でネイティブモードが変わっても、変更のないプロキシガイダンスは重複追加されません。既存のネイティブメッセージと旧タグ付きの履歴は保持されます。ラッパーの変更によって過去のメッセージの作成者が判明したり、以前の指示が取り消されたりするわけではありません。複数バージョンが混在する履歴は、旧タグだけでは分類できず、そのような履歴での設定変更の検出は保証されません。 ## ネイティブ Codex のデフォルト同期 diff --git a/docs-site/src/content/docs/ja/reference/configuration/providers.md b/docs-site/src/content/docs/ja/reference/configuration/providers.md index eb79145fac..608e66deb2 100644 --- a/docs-site/src/content/docs/ja/reference/configuration/providers.md +++ b/docs-site/src/content/docs/ja/reference/configuration/providers.md @@ -66,6 +66,10 @@ account を削除しても mapping は保持され、同じ id を再追加す `openaiProviderTierVersion: 2` は、現在の単一プロバイダーの投影をマークします。出荷された v1 設定を移行する前に、opencodex は別のバックアップを置き換えずに `config.json.pre-openai-tiers-v2.bak` を作成し、既知の名前空間で選択された既知のレガシー ID を裸の ID に書き換えます。 +## プロバイダー名前空間のエイリアス + +プロバイダーには、`google-antigravity` の `agy` のような組み込みの短縮名があります。設定済みのプロバイダー名または明示的なエイリアスが、大文字と小文字を区別せずにその短縮名を使用している場合、別のプロバイダーの組み込み短縮名はカタログ表示とエイリアスルーティングの両方で無効になります。たとえば、`agy` というプロバイダーを設定すると、Google のモデルは `google-antigravity/` と表示され、`agy/` は設定済みのプロバイダーを選択します。正規のプロバイダー名は引き続き大文字と小文字の完全一致が必要で、認識されない接頭辞には既存のモデルルーティングのフォールバックが適用されます。 + ## プロバイダーエントリー (`OcxProviderConfig`) |フィールド |タイプ |意味 | diff --git a/docs-site/src/content/docs/ko/guides/codex-integration.md b/docs-site/src/content/docs/ko/guides/codex-integration.md index 1f324adaf2..41f90537cd 100644 --- a/docs-site/src/content/docs/ko/guides/codex-integration.md +++ b/docs-site/src/content/docs/ko/guides/codex-integration.md @@ -119,6 +119,15 @@ Windows에서 Orca shell은 `CODEX_HOME`과 `ORCA_CODEX_HOME`을 Orca의 번들 전용 provider 모드의 `requires_openai_auth = true`는 Codex App/TUI의 계정 게이트 화면을 네이티브 Codex와 같은 조건으로 맞춥니다. opencodex는 `/v1/responses`도 WebSocket으로 제공합니다. 전용 provider는 `"websockets": true`일 때만 `supports_websockets = true`를 광고합니다. loopback에서는 Codex의 빌트인 provider가 먼저 WebSocket을 시도할 수 있으며, 비활성화된 proxy는 `426`을 반환해서 Codex가 HTTP/SSE로 fallback합니다. +네이티브 ChatGPT forward 요청의 로컬 재생 상태가 만료되었거나 없으면 opencodex는 +upstream 요청 전에 `previous_response_not_found`를 반환합니다. Codex WebSocket 클라이언트는 +일반 스트림 재시도 한도 안에서 다시 연결하고, 완료된 도구 호출과 결과를 포함한 현재 보유 +컨텍스트 전체를 다시 보낼 수 있습니다. 따라서 프록시의 1시간 캐시가 만료되었다는 이유만으로 +새 작업을 만들 필요는 없습니다. 캐시 한도와 보존 기간은 그대로이며, 클라이언트가 더 이상 +보유하지 않는 기록을 복구하는 기능은 아닙니다. HTTP 클라이언트는 이 오류를 직접 처리하고 +`previous_response_id` 없이 전체 컨텍스트를 다시 보내야 합니다. 같은 ID만 재시도해서는 +누락된 상태를 복구할 수 없습니다. + ## 스레드 식별자와 대화 기록 기본 loopback 형식은 새 thread에 네이티브 `openai` provider 태그를 유지하므로 일반적인 resume history는 다시 매핑할 필요가 없습니다. sync와 restore는 일치하는 백업 manifest만 적용하여 각 thread의 원래 provider, source, event marker를 정확히 복원합니다. manifest가 없는 `opencodex` row는 변경하지 않으며, legacy 재태깅을 명시적으로 강제하려는 경우에만 `ocx recover-history --legacy-openai --yes`를 사용합니다. 이 명령은 의도적으로 범위가 넓습니다. 사용자 메시지가 있고 현재 `opencodex`로 표시된 모든 thread를 `openai`로 바꾸고, `exec`를 `cli`로 정규화하며 event marker를 설정합니다. 정상적인 dedicated-provider history도 포함됩니다. 상태를 백업하고 이 전체 범위를 의도한 경우에만 사용하세요. non-loopback 전용 provider 모드는 활성 상태일 때만 history를 `opencodex` provider 아래로 미러링하고, 종료할 때는 백업된 메타데이터를 복원합니다. history를 건드리지 않으려면 `syncResumeHistory: false`로 설정하세요. diff --git a/docs-site/src/content/docs/ko/guides/combos.md b/docs-site/src/content/docs/ko/guides/combos.md index aef5ca1cc1..633feb838b 100644 --- a/docs-site/src/content/docs/ko/guides/combos.md +++ b/docs-site/src/content/docs/ko/guides/combos.md @@ -62,6 +62,12 @@ alias를 설정해도 정식 `combo/` 형식은 계속 해석됩니다. 정 alias는 클라이언트가 요청하는 공개 이름만 바꿉니다. 콤보에 저장된 ID나 그 뒤의 실제 공급자/모델 선택자는 바꾸지 않습니다. ::: +## 콤보를 바꾼 뒤 대화 압축 + +클라이언트가 콤보를 바꾼 뒤 공급자 접두사 없는 모델 이름으로 압축을 요청하면, opencodex는 같은 대화에서 가장 최근에 응답을 성공적으로 마친 콤보를 기억해 사용할 수 있습니다. 모델 이름이 완료된 응답과 일치하고, 현재 설정에 해당 콤보와 대상이 남아 있어야 합니다. 압축 요청도 일반 콤보 선택과 페일오버를 따릅니다. + +명시한 공급자·콤보 선택자와 설정된 콤보 별칭이 기억한 값보다 우선합니다. 실패·미완료·취소된 응답은 마지막 성공 기록을 덮어쓰지 않습니다. 기록은 프로세스 안에서 최대 256개 대화, 30분 동안 유지하며 계정 자격증명을 저장하지 않습니다. 유효한 대화 식별자나 기록이 없으면 일반 압축 라우팅을 사용합니다. 재시작하면 기록은 사라집니다. + ## 전략 선택 ### 페일오버: 순서가 있는 기본값과 예비값 diff --git a/docs-site/src/content/docs/ko/reference/cli/lifecycle.md b/docs-site/src/content/docs/ko/reference/cli/lifecycle.md index 068807025b..d4c19ebd46 100644 --- a/docs-site/src/content/docs/ko/reference/cli/lifecycle.md +++ b/docs-site/src/content/docs/ko/reference/cli/lifecycle.md @@ -293,11 +293,29 @@ ocx codex-shim status ocx codex-shim uninstall ``` +:::note[Windows 토큰 환경] +새로 생성된 Windows CMD 및 PowerShell shim은 실행 후 호출자의 `OPENCODEX_API_AUTH_TOKEN`을 원래 상태로 복원합니다. Codex와 자식 프로세스는 여전히 토큰을 상속할 수 있습니다. + +OpenCodex를 업데이트한 뒤 기존 Windows shim에 이 동작을 적용하려면 `ocx codex-shim uninstall`을 실행한 다음 `ocx codex-shim install`로 다시 설치하세요. 일반 업데이트는 정상인 Windows shim을 다시 작성하지 않습니다. +::: + :::tip[서비스와 shim] 항상 켜져 있는 백그라운드 프록시에는 `ocx service`를 사용합니다(권장). 데몬 없이 가볍게 필요할 때만 시작하려면 `ocx codex-shim`을 사용합니다. 이 경우 프록시는 `codex`를 실행할 때만 시작됩니다. ::: +#### Codex에 토큰 주입 + +루프백이 아닌 주소에 바인딩하면 주입된 공급자에 `env_key = "OPENCODEX_API_AUTH_TOKEN"`이 포함됩니다. 이 줄은 Codex가 읽을 변수를 지정할 뿐, 변수를 생성하지는 않습니다. 변수가 없으면 Codex는 요청 시작을 거부하며(`Missing environment variable: OPENCODEX_API_AUTH_TOKEN`), 요청은 프록시에 도달하지 않습니다. 값은 `$OPENCODEX_HOME/service-api-token`에 저장되며, 실행을 시작하는 프로세스가 Codex의 환경에 이 값을 제공해야 합니다. + +`ocx codex-shim install`로 설치되는 shim을 사용하세요. 실행 환경에서 이 shim이 선택되면 OpenCodex가 생성한 토큰 파일을 읽고 Codex에 변수를 제공합니다. 데스크톱, cron, 서비스에서 실행할 때는 shim을 선택하는 PATH 또는 실행기 경로를 사용해야 합니다. 설치 과정에서 이러한 환경이 자동으로 구성되지는 않습니다. Codex 자체의 자식 프로세스도 토큰을 상속할 수 있습니다. + +이 Bearer 토큰을 셸 시작 파일에서 내보내거나 `config.toml`에 복사하지 마세요. `service-api-token` 파일에는 `NAME=value` 형식의 대입문이 아닌 토큰 원문이 들어 있으므로 systemd의 `EnvironmentFile=`로 직접 사용할 수 없습니다. + +`opencodex-proxy.service`의 `EnvironmentFile=` 또는 `OCX_API_TOKEN_FILE`은 프록시 프로세스만 구성하며, 별도로 실행된 `codex exec`에 전달되지 않습니다. + +실행기를 교체하는 Codex 업그레이드는 shim을 제거합니다. 다음 일반 `ocx` 명령이 shim을 복원하지만(위 내용 참조), 그보다 먼저 실행되는 `codex exec`는 실패합니다. `ocx doctor`는 이 상태(env_key 구성됨, 변수 미설정, shim 누락 또는 비정상, 토큰 파일 존재)를 "Codex env_key launch readiness" 항목에서 복구 명령과 함께 보고하며, 토큰은 출력하지 않습니다. 토큰 파일 읽기는 주입된 `env_key`의 계약에 포함되지 않습니다. 실행을 시작하는 프로세스가 해당 변수를 제공해야 합니다. + ### `ocx tray [--json] [--no-start]` Windows 상태 트레이 아이콘을 설치하고 제어합니다. Windows 로그인 시 시작되며, 프록시를 원클릭으로 diff --git a/docs-site/src/content/docs/ko/reference/configuration/agents.md b/docs-site/src/content/docs/ko/reference/configuration/agents.md index 1c999536f2..611989e71c 100644 --- a/docs-site/src/content/docs/ko/reference/configuration/agents.md +++ b/docs-site/src/content/docs/ko/reference/configuration/agents.md @@ -26,15 +26,25 @@ description: 멀티 에이전트 표면, 위임 안내, 선호 모델, 대체 관리 API는 `GET`/`PUT /api/v2`, `/api/injection-model`, `/api/effort-caps`, `/api/subagent-models`, `/api/subagent-model-fallback`를 제공합니다. injection-model 업데이트는 부분 업데이트입니다. 사용자 지정 프롬프트는 이 API의 `prompt` 필드입니다. +## 항상 능동 위임 + +서브에이전트 → 고급의 **항상 능동 위임**(이전 이름: **울트라 모드**)은 추론 노력을 바꾸지 않고 위임을 시작하는 조건만 변경합니다. 권장 프리셋에서도 사용자 지침, 권한 경계, 작업 범위, 도구 규칙은 유지됩니다. + +`GET`과 `PUT /api/v2`는 `multiAgentModeHintRecommendation: { text, revision }`도 반환합니다. 대시보드는 프리셋을 켜거나 복원할 때 서버가 제공한 텍스트를 사용하며, 고정된 대체 문구는 사용하지 않습니다. 이전 서버가 권장값을 제공하지 않거나 잘못된 형식으로 반환하면 프리셋 적용·복원은 사용할 수 없으며, 기존 사용자 지정 힌트의 편집·삭제는 계속 사용할 수 있습니다. **프리셋 복원**은 로컬 초안만 바꾸고, **저장**을 눌러야 저장됩니다. + +설정 조회, 관련 없는 업데이트, 업그레이드는 저장된 힌트를 자동 변경하지 않습니다. 힌트를 명시적으로 업데이트할 때 본문이 알려진 두 가지 이전 OpenCodex 프리셋 중 하나와 바이트 단위로 정확히 일치하는 경우에만 현재 권장 문구로 바뀝니다. 그 밖의 유효한 사용자 지정 텍스트는 공백 차이가 있는 변형까지 바이트 단위로 보존됩니다. 기존 v2 활성화·기능 지원 확인·힌트 해제 규칙은 그대로이며, 변경은 새 Codex 세션에 적용됩니다. + ## 로스터와 안내 -실제 v2 로스터는 설정되어 있고, 선택기에 보이며, 우선순위로 정렬된 상위 다섯 모델 중 v2와 호환되고 주입된 카탈로그에 존재하는 모델입니다. v2 적격성은 명시적인 `"v2"`, `null`, 또는 생략된 상위 고정값을 적격으로 보고, 실제 `"v1"` 고정값은 제외합니다. 제외된 항목은 나중에 적격이 될 수 있도록 설정에 그대로 남습니다. +실제 v2 로스터는 설정되어 있고, 선택기에 보이며, 우선순위로 정렬된 상위 다섯 모델 중 주입된 카탈로그에 존재하고 명시적으로 `"disabled"`로 표시되지 않은 모델입니다. 명시적인 `"v2"` 고정값은 재귀 작업자를 지원하며, `"v1"`, `null`, 생략된 고정값도 하위 작업을 다시 위임하지 않는 작업자로 참여할 수 있습니다. 제외된 항목은 나중에 적격이 될 수 있도록 설정에 그대로 남습니다. 표면 판별은 도구 형태를 기준으로 합니다. 네임스페이스가 붙은 `spawn_agent`에 `send_input`, `resume_agent`, `close_agent`가 있으면 v1입니다. 평평한 `spawn_agent`에 `send_message`, `followup_task`, `interrupt_agent`, `list_agents`가 있으면 v2입니다. V1 안내는 `max` 또는 `ultra`에서만 선제 텍스트로 제공됩니다. V2는 선호 모델, 적격 로스터, 대체 체인 중 하나가 있을 때만 프록시가 작성한 개발자 메시지를 받습니다. 내장 v2 안내에는 700자 예산이 있고, 필요하면 로스터를 먼저 줄입니다. 안내는 replay prefix 전반에서 중복 제거되며, 뒤에 오는 `compaction_trigger` 앞에 삽입됩니다. -`injectionModel`과 `injectionEffort`는 네이티브 기본값 동기화가 활성화되지 않으면 권고 수준입니다. 내장 v2 텍스트는 Codex에게 지원되는 모델/노력 오버라이드를 `fork_turns: "none"`과 함께 `spawn_agent`로 전달하라고 요청합니다. 사용자 지정 `injectionPrompt`는 누락된 값을 빈 문자열로 대체합니다. +내장 v2 서브에이전트 안내와 사용자 지정 `injectionPrompt` 본문은 모두 ``를 사용하며, Codex 네이티브 `` 메시지와 구분됩니다. 내장 텍스트는 결정된 선호 모델, 모델 목록, 대체 체인을 알리지만 위임, 모델 오버라이드, `fork_turns`를 지시하지는 않습니다. 사용자 지정 본문의 자리표시자 치환과 내용은 유지됩니다. `injectionModel`과 `injectionEffort`는 네이티브 기본값 동기화가 활성화되지 않으면 계속 권고 수준이며, 사용자 지정 자리표시자의 누락된 값은 빈 문자열로 대체됩니다. + +replay 중복 제거는 각 태그 계열의 가장 최근 텍스트와 정확히 일치하는지 비교합니다. 두 값 모두 새 프록시 태그 계열을 사용하는 경우, 사용자 지정 안내에서 내장 형식으로 돌아오면 현재 안내가 추가됩니다. 그 사이에 네이티브 모드가 바뀌어도 변경되지 않은 프록시 안내가 중복 추가되지는 않습니다. 기존 네이티브 메시지와 예전 태그가 붙은 이력은 보존됩니다. 래퍼 변경으로 과거 메시지의 작성자가 판별되거나 이전 지침이 철회되는 것은 아닙니다. 여러 버전이 섞인 이력은 예전 태그만으로 분류할 수 없으며, 이러한 이력에서 설정 전환이 감지된다고 보장하지 않습니다. ## Codex 기본값 동기화 diff --git a/docs-site/src/content/docs/ko/reference/configuration/providers.md b/docs-site/src/content/docs/ko/reference/configuration/providers.md index 8b5f310f7a..342441eca1 100644 --- a/docs-site/src/content/docs/ko/reference/configuration/providers.md +++ b/docs-site/src/content/docs/ko/reference/configuration/providers.md @@ -66,6 +66,10 @@ managed map을 활성화하면 privacy-safe selector를 만들고, 이후 계정 `openaiProviderTierVersion: 2`는 현재의 단일 공급자 투영을 표시합니다. 출시된 v1 설정을 마이그레이션하기 전에 opencodex는 `config.json.pre-openai-tiers-v2.bak`를 만들고, 기존에 다른 백업이 있더라도 덮어쓰지 않으며, 알려진 레거시 네임스페이스 지정 선택 id를 bare id로 다시 씁니다. +## 공급자 네임스페이스 별칭 + +공급자는 `google-antigravity`의 `agy`처럼 기본 축약 이름을 제공할 수 있습니다. 설정된 공급자 이름이나 명시적 별칭이 대소문자 구분 없이 그 이름을 사용하면, 다른 공급자의 기본 축약 이름은 카탈로그 표시와 별칭 라우팅 모두에서 비활성화됩니다. 예를 들어 `agy`라는 공급자를 설정하면 Google 모델은 `google-antigravity/`로 표시되고, `agy/`는 설정된 공급자를 선택합니다. 정식 공급자 이름은 계속 대소문자가 정확히 일치해야 하며, 인식되지 않는 접두사는 기존 모델 라우팅의 대체 경로를 따릅니다. + ## 공급자 항목 (`OcxProviderConfig`) | 필드 | 타입 | 의미 | diff --git a/docs-site/src/content/docs/ko/reference/management-api.md b/docs-site/src/content/docs/ko/reference/management-api.md index a9a54c69c3..086dc5aa49 100644 --- a/docs-site/src/content/docs/ko/reference/management-api.md +++ b/docs-site/src/content/docs/ko/reference/management-api.md @@ -253,6 +253,20 @@ OpenAI도 같은 규칙을 따르며, 스위치를 켠다고 별도의 922k 모 | `POST /api/codex-auth/login/cancel` | Codex 로그인 흐름을 취소합니다 | — | | `GET /api/codex-auth/login-status` | 흐름 또는 account 로그인 상태를 조회합니다. 새 계정 완료 시 복구가 필요할 때만 `catalogRefreshPending: true`를 포함합니다. | 알 수 없는 흐름은 `expired`로 보고되며, 활성 흐름이 없으면 `idle`로 보고됩니다 | +수동 소비가 `reset`으로 확인되면 같은 계정의 새 usage를 조회하여 기존 shared reset-derived +쿨다운을 즉시 복구할 수 있습니다. 복구는 조건부입니다. 계정이 일시 정지되었거나 재인증이 +필요하거나 다른 진행 중인 probe가 쿨다운을 소유하면 쿨다운은 유지됩니다. reset 이전에 시작한 +조회, 불완전하거나 소진된 usage, 신원이 바뀐 계정, 더 최근의 quota 실패로는 복구하지 않습니다. +오래된 main usage 응답은 더 최근에 반영한 관측을 덮어쓰지 않습니다. credential 갱신을 거쳤다면 +해당 인증에서 이어진 갱신인지 확인되어야 하며, 외부에서 교체된 credential은 같은 계정이어도 +복구 근거가 되지 않습니다. 명시적 `Retry-After`, Spark/Reserve 쿨다운, pause·pin·선택 +설정도 보존됩니다. `already_redeemed`와 저장된 결과 재생은 새 reset을 증명하지 않습니다. + +`reset` 또는 `already_redeemed`가 확인된 뒤 usage 조회가 실패하거나 바쁘더라도 소비 응답은 +HTTP 200과 원래 `code`를 유지합니다. 새 잔여 수를 얻지 못하면 `remaining`을 생략합니다. +이는 소비 결과의 확인이며 라우팅 가능 상태를 보장하지 않습니다. usage를 다시 조회하십시오. +usage 조회 실패를 재시도하기 위해 reset credit을 다시 소비하지 마십시오. + 새 account의 config row는 저장되었지만 credential setup을 완료하지 못하면 OAuth `login-status`는 `status: "error"`를 보고하며 `code: "codex_credential_persistence_failed"`, `accountId`, `needsReauth: true`, 필요한 경우 diff --git a/docs-site/src/content/docs/reference/adapters.md b/docs-site/src/content/docs/reference/adapters.md index b1d6029ca9..596fc2255f 100644 --- a/docs-site/src/content/docs/reference/adapters.md +++ b/docs-site/src/content/docs/reference/adapters.md @@ -133,11 +133,18 @@ collision-safe public function tool. Matching request history and JSON/SSE funct translated back to the private `tool_search` lifecycle for the client. Canonical OpenAI forward keeps the native private type unchanged. -For OpenCode Go at `https://opencode.ai/zen/go/v1`, requests with `authMode` other -than `"forward"` convert plaintext Codex `agent_message` items into public user messages, preserving content parts and readable author/recipient -metadata. This conversion leaves encrypted or unknown content unchanged and does not apply -to other destinations. Providers using `authMode: "forward"` retain these items unchanged. -See [Go agent messages](/reference/configuration/providers/#opencode-go-session-and-agent-messages) +Requests with `authMode` other than `"forward"` convert Codex `agent_message` +items containing nonempty arrays of supported plaintext parts into public user messages, preserving those parts and readable author/recipient +metadata. `agent_message` is private to the ChatGPT Codex backend, and the routed +destinations reported so far reject the entire body with +`422 unknown item type "agent_message"` — and because Codex replays sub-agent history on +every turn, that failure repeats for the rest of the thread. This conversion leaves +encrypted or unknown content unchanged. Providers using `authMode: "forward"` retain +these items unchanged. For xAI Responses on HTTPS `api.x.ai` or `cli-chat-proxy.grok.com` +using the standard port, a nonblank string child result is also converted into an `input_text` +part with its exact whitespace and newlines. Other destinations retain string-valued items; +blank strings and mixed encrypted/unknown parts are not partially converted. +See [agent messages](/reference/configuration/providers/#routed-agent-messages) for the separate opt-in encrypted-task recovery behavior. The canonical ChatGPT Codex forward destination also normalizes two public Responses shapes that diff --git a/docs-site/src/content/docs/reference/cli/lifecycle.md b/docs-site/src/content/docs/reference/cli/lifecycle.md index 0dda487b3a..a7d61a0bee 100644 --- a/docs-site/src/content/docs/reference/cli/lifecycle.md +++ b/docs-site/src/content/docs/reference/cli/lifecycle.md @@ -440,36 +440,43 @@ ocx codex-shim status ocx codex-shim uninstall ``` +:::note[Windows token environment] +Newly generated Windows CMD and PowerShell shims restore the caller's `OPENCODEX_API_AUTH_TOKEN` after execution. Codex and its child processes can still inherit the token. + +After updating OpenCodex, recreate an existing Windows shim with `ocx codex-shim uninstall` followed by `ocx codex-shim install` to obtain this behavior. An ordinary update does not rewrite a healthy Windows shim. +::: + :::tip[Service vs Shim] Use `ocx service` for an always-on background proxy (recommended). Use `ocx codex-shim` for lightweight, on-demand startup without a daemon — the proxy starts only when `codex` is launched. ::: -#### Token injection without the shim +#### Token injection into Codex On a non-loopback bind the injected provider carries `env_key = "OPENCODEX_API_AUTH_TOKEN"`. That line tells Codex which variable to read; it does not create it. Codex refuses to start a request when the variable is missing (`Missing environment variable: OPENCODEX_API_AUTH_TOKEN`), and the -proxy is never reached. The value lives in `$OPENCODEX_HOME/service-api-token`; only a process that -exports it into Codex's environment closes the gap. +proxy is never reached. The value lives in `$OPENCODEX_HOME/service-api-token`; the launching process +must supply it in Codex's environment. -What does carry the token into a Codex process: +Use the maintained shim installed by `ocx codex-shim install`. When the launching context resolves +this shim, it reads the token file created by OpenCodex and supplies the variable to Codex. +Desktop, cron, and service launches must use a PATH or launcher path that selects the shim; +installation does not configure those environments automatically. Codex's own child processes +may still inherit the token. -- the shim installed by `ocx codex-shim install` (reads the token file at launch; the supported path - for Codex started from shells, Desktop, cron, or another service); -- exporting `OPENCODEX_API_AUTH_TOKEN` yourself in the process that starts Codex — a shell profile, - the cron line, or an `Environment=`/`EnvironmentFile=` on the systemd unit that launches - **Codex** (not the proxy). Point it at the existing token file; do not copy the value into - `config.toml`. +Do not export this bearer token from a shell startup file or copy it into `config.toml`. The +`service-api-token` file contains the raw token, not `NAME=value` assignments, so it cannot be used +directly as a systemd `EnvironmentFile=`. -What does not: an `EnvironmentFile=` or `OCX_API_TOKEN_FILE` on `opencodex-proxy.service`. Those -configure the proxy process only and never flow into an independently launched `codex exec`. +An `EnvironmentFile=` or `OCX_API_TOKEN_FILE` on `opencodex-proxy.service` configures the proxy process +only and never flows into an independently launched `codex exec`. A Codex upgrade that replaces the launcher removes the shim; the next ordinary `ocx` command restores it (see above), but a `codex exec` that runs before that fails. `ocx doctor` reports this exact state under "Codex env_key launch readiness" (env_key configured, variable unset, shim missing or unhealthy, token file present) with the repair command, and never prints the token. Reading the token -file directly from Codex is not something Codex supports, so there is no OpenCodex directive for it. +file is not part of the injected `env_key` contract; the launching process must supply that variable. ### `ocx tray [--json] [--no-start]` diff --git a/docs-site/src/content/docs/reference/cli/providers-accounts.md b/docs-site/src/content/docs/reference/cli/providers-accounts.md index 82c30a2c30..21760eef0f 100644 --- a/docs-site/src/content/docs/reference/cli/providers-accounts.md +++ b/docs-site/src/content/docs/reference/cli/providers-accounts.md @@ -440,6 +440,14 @@ security find-generic-password -w openrouter | ocx account add-key openrouter -- Inspect Codex reset credits for an account. Consuming a credit is destructive and requires both `--consume` and `--yes`. +After a confirmed `reset`, fresh usage can recover the same account's eligible existing +shared reset-derived cooldown. Paused accounts, accounts needing reauthentication and +cooldowns owned by an in-flight probe remain excluded from this recovery. A failed or busy +usage refresh after confirmed consumption does not require another credit: check usage +again instead of repeating `--consume`. Consume success does not guarantee routability; +see the [management API recovery contract](/reference/management-api/#codex-authentication-delegation) +for reset/replay, freshness and scope limits. + ### `ocx account main ` Manage named native Codex main-login profiles without changing OpenCodex account-pool routing: diff --git a/docs-site/src/content/docs/reference/configuration/agents.md b/docs-site/src/content/docs/reference/configuration/agents.md index f3caea02f2..5a4ccf650b 100644 --- a/docs-site/src/content/docs/reference/configuration/agents.md +++ b/docs-site/src/content/docs/reference/configuration/agents.md @@ -45,20 +45,33 @@ Mode changes apply to new sessions. `maxConcurrentThreadsPerSession` is a `PUT / `config.json` key; `ocx v2 threads ` writes `max_concurrent_threads_per_session` under `[features.multi_agent_v2]` in Codex's `$CODEX_HOME/config.toml` after v2 is enabled. -**Ultra mode** (the Subagents dashboard toggle, `PUT /api/v2` field -`multiAgentModeHintText`, and `ocx v2 mode-hint`) writes +**Always proactive delegation** in Subagents → Advanced (formerly **Ultra mode**) changes the +delegation trigger without changing reasoning effort. Its preset preserves user instructions, +authority boundaries, task scope, and tool rules. The dashboard toggle, `PUT /api/v2` field +`multiAgentModeHintText`, and `ocx v2 mode-hint` write `features.multi_agent_v2.multi_agent_mode_hint_text` in Codex's `$CODEX_HOME/config.toml`. The CLI `ocx v2 mode-hint` command persists this key even -when `multi_agent_v2` is disabled; it does not toggle the feature. The hint overrides -codex-rs's effort-derived multi-agent policy, so any model and any reasoning effort -receives the Proactive delegation prompt; it does **not** change reasoning effort. +when `multi_agent_v2` is disabled; it does not toggle the feature. The hint replaces +codex-rs's effort-derived multi-agent policy when that native surface is active. A `null` value removes the key so the effort-derived policy (ultra = proactive, otherwise explicit) resumes; empty or whitespace-only values are rejected because a present empty override would suppress even the ultra-derived Proactive message. The -Subagents dashboard's Ultra mode **on** toggle requires both the native feature and +Subagents dashboard's **Always proactive delegation** toggle requires both the native feature and an explicit v2 surface (`multiAgentMode: "v2"`, equivalent to `ocx v2 mode v2`); `ocx v2 on` alone does not satisfy that dashboard gate. +`GET` and `PUT /api/v2` also return `multiAgentModeHintRecommendation: { text, revision }`. +The dashboard uses this server-provided text when enabling or restoring the preset, with no +hardcoded fallback. If an older server omits the recommendation or returns a malformed value, +preset installation and restoration are unavailable; editing or clearing an existing custom hint +remains available. **Restore preset** changes only the local draft; **Save** persists it. + +Reading settings, unrelated updates, and upgrades do not migrate a stored hint. Only an explicit +hint update that matches either of the two recognized legacy OpenCodex presets byte-for-byte is +replaced with the current recommendation. Other valid custom text, including whitespace variants, +is preserved byte-for-byte. Mode-hint support is still checked before writing, and changes apply +to new Codex sessions. + The management API exposes `GET`/`PUT /api/v2`, `/api/injection-model`, `/api/effort-caps`, `/api/subagent-models`, and `/api/subagent-model-fallback`. Injection-model updates are partial; the custom prompt is the `prompt` field on that API. @@ -75,9 +88,9 @@ loudly when the installed Codex build does not know the flag yet. ## Roster and guidance The effective v2 roster is the configured, picker-visible, priority-sorted first five models that -are compatible with v2 and present in the injected catalog. V2 eligibility treats an explicit `"v2"`, -`null`, or absent upstream pin as eligible; a real `"v1"` pin is excluded. Excluded entries remain in -configuration so they can become eligible later. +are present in the injected catalog and are not explicitly marked `"disabled"`. An explicit `"v2"` +pin supports recursive workers; `"v1"`, `null`, and absent pins remain eligible as leaf workers. +Excluded entries remain in configuration so they can become eligible later. Surface detection uses tool shape. A namespaced `spawn_agent` with `send_input`, `resume_agent`, or `close_agent` is v1. A flat `spawn_agent` with `send_message`, `followup_task`, `interrupt_agent`, or @@ -88,9 +101,19 @@ message only when a preferred model, eligible roster, or fallback chain exists. has a 700-character budget and drops the roster first if necessary. Guidance is deduplicated across replay prefixes and inserted before a trailing `compaction_trigger`. -`injectionModel` and `injectionEffort` are advisory unless native-default sync is enabled. The built-in -v2 text asks Codex to pass supported model/effort overrides to `spawn_agent` with -`fork_turns: "none"`. A custom `injectionPrompt` substitutes missing values with an empty string. +Both built-in v2 subagent guidance and custom `injectionPrompt` bodies use +``, separate from Codex's native `` messages. +Built-in text reports the resolved preferred model, roster, and fallback chain without prescribing +delegation, model overrides, or `fork_turns`. Custom bodies retain their placeholder substitution +and content. `injectionModel` and `injectionEffort` remain advisory unless native-default sync is +enabled; missing custom placeholder values are still replaced with an empty string. + +Replay deduplication compares the latest exact text in each tag family. When both values use the +new proxy family, switching custom guidance back to the built-in form appends the current value; +intervening native mode changes do not duplicate unchanged proxy guidance. Existing native and +legacy-tagged history is preserved. This wrapper change does not identify the author of old +messages or revoke prior instructions. Mixed-version histories cannot be classified from the +legacy tag alone, and transition detection across such histories is not guaranteed. ## Native Codex default sync diff --git a/docs-site/src/content/docs/reference/configuration/providers.md b/docs-site/src/content/docs/reference/configuration/providers.md index a6ecac02ae..f32a2fdc09 100644 --- a/docs-site/src/content/docs/reference/configuration/providers.md +++ b/docs-site/src/content/docs/reference/configuration/providers.md @@ -116,6 +116,10 @@ published long-context bands on `openai` and `openai-apikey`. The two Daybreak B follow the Sol API reference. These are comparison estimates, not invoices or credit-balance predictions. Explicit provider/model price overrides still take precedence. +## Provider namespace aliases + +Providers can expose a built-in shorthand, such as `agy` for `google-antigravity`. A configured provider name or explicit alias claims that shorthand case-insensitively; a different provider's built-in shorthand is then suppressed in both catalog names and alias routing. For example, configuring a provider named `agy` keeps Google's models under `google-antigravity/`, while `agy/` selects the configured provider. Canonical provider names still require an exact case match, and unrecognized prefixes retain the existing model-routing fallback. + ## Provider entries (`OcxProviderConfig`) | Field | Type | Meaning | @@ -917,6 +921,32 @@ ids with context `922000` and max input `922000`; OpenRouter seeds `openai/gpt-5 } ``` +## OpenCode Go Responses compatibility + +On non-forward requests whose resolved endpoint is `https://opencode.ai/zen/go/v1/responses`, OpenCodex moves +Codex's `additional_tools` input declarations into top-level `tools` after tool and namespace +normalization. Supported hosted tools are preserved until model-specific filtering; malformed +wrappers remain unchanged. This does not discard ciphertext or unknown agent-message content. +The check uses the final URL, so endpoint-inclusive base URLs and split `baseUrl`/`responsesPath` +configurations receive the same behavior. A custom path resolving elsewhere does not. + +The canonical `opencode-go` preset defaults to `statelessResponses: true`: requests use explicit +history with `store: false`, without `previous_response_id`, `conversation`, `background`, +`metadata`, or stored `prompt` references. This avoids Go's rejection of reasoning ciphertext +combined with `previous_response_id`. The continuation cache records reasoning in the same +representation returned to the client, including the visible content-to-summary rewrite, so +echoing full history with `previous_response_id` does not duplicate that history. Hidden-summary +requests and opaque reasoning blobs retain their existing representation. Cache hits can also +supply earlier history for delta continuations; +after a cache miss, resend the complete conversation without `previous_response_id`. Stateless +repair labels orphan results and missing tool results; it cannot reconstruct lost history or +prove whether a missing tool execution succeeded. + +An explicit `statelessResponses: false` is preserved. Existing canonical preset configurations +receive the default only when the setting is absent; custom renamed entries keep their configured +value and do not acquire this default by destination matching. Chat model routes keep their +existing protocol. The stateless flag does not force Responses streaming into JSON. + ## OpenCode Go reasoning efforts Go catalog rows preserve their configured reasoning efforts exactly, including during @@ -936,14 +966,21 @@ their previous behavior. See the [ordering migration note](/guides/model-ordering/#migration-note-native-ids-in-existing-orders). `modelDisplayNames` on a provider controls readable labels without changing wire ids. -## OpenCode Go session and agent messages +## Routed agent messages -With the [`openai-responses` adapter](/reference/adapters/#openai-responses) and -base URL `https://opencode.ai/zen/go/v1`, plaintext Codex `agent_message` items -become user messages when `authMode` is not `"forward"` (for example, `"key"`). -Providers using `authMode: "forward"` retain these items unchanged. This conversion is scoped to that destination, including -renamed provider entries; other Responses destinations keep their input unchanged. +With the [`openai-responses` adapter](/reference/adapters/#openai-responses), Codex +`agent_message` items containing nonempty arrays of supported plaintext parts become user messages when `authMode` is not `"forward"` +(for example, `"key"`). Providers using `authMode: "forward"` retain these items unchanged. +`agent_message` is private to the ChatGPT Codex backend, and the routed destinations +reported so far answer the whole request with +`422 unknown item type "agent_message"`; Codex replays sub-agent history on every +subsequent turn, so the thread keeps failing until the item is converted. Author and recipient remain explicit text metadata, and the content parts are preserved. +For HTTPS `api.x.ai` and `cli-chat-proxy.grok.com` on the standard port, non-forward +Responses dispatch also accepts a nonblank string child result and turns it into one +`input_text` part. The original string, including leading/trailing whitespace and newlines, +is preserved. Other destinations keep string-valued agent messages unchanged. Empty or +whitespace-only strings remain unchanged, as do incomplete and mixed encrypted/unknown shapes. Encrypted and unknown content is not normalized; native encrypted tasks still require the separate opt-in [task recovery](/reference/configuration/agents/#encrypted-v2-task-recovery). @@ -961,6 +998,6 @@ current tail message (ignoring trailing `compaction_trigger` or `additional_tool It does not batch-recover unseen historical messages; those remain unchanged. A cache miss or expiry does not extend the history-recovery contract. -Sender and recipient on Go Responses are context for the receiving model, not a new +Sender and recipient on routed Responses are context for the receiving model, not a new machine-readable routing protocol. Tool routing continues to use the existing collaboration contracts. diff --git a/docs-site/src/content/docs/reference/configuration/server.md b/docs-site/src/content/docs/reference/configuration/server.md index d80d6991af..cdc8d6af52 100644 --- a/docs-site/src/content/docs/reference/configuration/server.md +++ b/docs-site/src/content/docs/reference/configuration/server.md @@ -27,7 +27,7 @@ runs helper features around provider requests. | `codexAutoStart?` | `boolean` | `true` | Let the Codex shim run `ocx ensure` before launching Codex. False makes ensure a no-op. | | `codexShimAutoRestore?` | `boolean` | `true` | Restore an installed shim after a completed external Codex update replaces it. Environment opt-out: `OPENCODEX_CODEX_SHIM_AUTO_RESTORE=0`. | | `codexDesktopAuthless?` | `boolean` | `false` | Opt-in authless Codex Desktop routing on a loopback bind: inject the dedicated `opencodex` provider with `requires_openai_auth = false` so Desktop opens without a ChatGPT login. Ignored on non-loopback binds. `ocx system settings --desktop-authless on`. See [Codex integration](/guides/codex-integration/#authless-codex-desktop-opt-in). | -| `resetCreditAutoRedeem?` | `{ enabled?: boolean; leadTimeMinutes?: number }` | off | Opt-in: redeem the main Codex account's soonest-expiring reset credit `leadTimeMinutes` (1–60, default 10) before it expires. Every attempt re-reads the upstream credit list first and skips when the credit is gone (for example, redeemed by hand); the `redeem_request_id` is journaled in `$OPENCODEX_HOME/reset-credit-auto-redeem.json` before the call so a crash replays the same idempotent request instead of spending a second credit. Logs carry a hashed account key only. | +| `resetCreditAutoRedeem?` | `{ enabled?: boolean; leadTimeMinutes?: number }` | off | Opt-in: redeem the main Codex account's soonest-expiring reset credit `leadTimeMinutes` (1–60, default 10) before it expires. Every attempt re-reads the upstream credit list first and skips when the credit is gone (for example, redeemed by hand); the `redeem_request_id` is journaled in `$OPENCODEX_HOME/reset-credit-auto-redeem.json` before the call so a crash replays the same idempotent request instead of spending a second credit. Servers sharing this configuration directory coordinate reservations and settlements so one process does not replace another's request record. Logs carry a hashed account key only. | | `syncResumeHistory?` | `boolean` | `true` | Reversible Codex App history compatibility. Original metadata is backed up and restored by `ocx stop` / `ocx restore`. | | `shadowCallIntercept?` | `{ enabled?: boolean; model?: string; sourceModels?: string[] }` | off | Redirect recognized Codex helper/shadow calls to a chosen model while preserving the request's configured reasoning effort. The default source prefix is `gpt-5.6-luna`; older clients through 0.144.x used `gpt-5.4-mini`, which `sourceModels` can restore. | | `webSearchSidecar?` | `OcxWebSearchSidecarConfig` | on when usable | Web-search sidecar options. | diff --git a/docs-site/src/content/docs/reference/management-api.md b/docs-site/src/content/docs/reference/management-api.md index 238d23b336..c0dd38f1fb 100644 --- a/docs-site/src/content/docs/reference/management-api.md +++ b/docs-site/src/content/docs/reference/management-api.md @@ -427,6 +427,31 @@ manager. Its routes are: | `POST /api/codex-auth/login/cancel` | Cancel a Codex login flow | — | | `GET /api/codex-auth/login-status` | Poll a flow or account login state. A completed new-account flow includes `catalogRefreshPending: true` only when recovery is needed. | Unknown flows report `expired`; no active flow reports `idle` | +For reset-credit consumption, a different `operationId` supplied while the same physical +account has an unfinished operation joins that operation as an alias. Its retry uses the +original upstream request ID and records the outcome under that same identity, so later +requests with the original ID or a known alias replay the stored result without another +consume request. A previously unseen ID supplied after settlement starts a new explicit +redemption; clients retrying an existing action should keep its ID. + +After a confirmed manual `reset`, OpenCodex checks fresh usage for that same account +and can reconcile its eligible pre-existing shared reset-derived cooldown immediately. +Paused accounts, accounts requiring reauthentication and cooldowns already owned by an +in-flight probe remain excluded from this recovery; their cooldowns are retained. Usage +started before the reset, incomplete or exhausted usage, a changed account, and a newer +quota failure do not qualify. Older main-account usage responses cannot replace a newer +published observation. If usage needs credential refresh, recovery requires that refresh's +confirmed lineage; an externally replaced credential does not qualify merely because it +belongs to the same account. Explicit `Retry-After`, Spark/Reserve cooldowns, pause +settings, pins and the selected account are preserved. `already_redeemed` and durable +replay do not prove a new reset and do not gain this recovery behavior. + +A failed or busy usage refresh after a confirmed `reset` or `already_redeemed` does not +turn the completed consumption into an error: the response remains HTTP 200 with its +consume `code`, omitting `remaining` when no fresh count was obtained. This response +confirms the consume outcome, not that the account is now routable. Refresh usage to +check availability; do not consume another credit to retry a failed usage refresh. + If a new account config row is saved but credential setup cannot finish, OAuth `login-status` reports `status: "error"` with `code: "codex_credential_persistence_failed"`, `accountId`, `needsReauth: true`, and optional diff --git a/docs-site/src/content/docs/ru/reference/adapters.md b/docs-site/src/content/docs/ru/reference/adapters.md index 548192f357..0ec59367b7 100644 --- a/docs-site/src/content/docs/ru/reference/adapters.md +++ b/docs-site/src/content/docs/ru/reference/adapters.md @@ -94,10 +94,20 @@ interface ProviderAdapter { ## `openai-responses` -**Назначение:** OpenAI **Responses API**. **`passthrough: true`** — пересылает исходное тело -запроса и стримит ответ обратно **без преобразования**. +**Назначение:** OpenAI **Responses API**. **`passthrough: true`** — пересылает тело +запроса и ответ с преобразованиями совместимости для выбранного провайдера. **Аутентификация:** `forward` (ретрансляция заголовков вызывающей стороны) или `key`. +При `authMode`, отличном от `"forward"`, элементы Codex `agent_message` с непустым +массивом поддерживаемых открытых частей преобразуются в обычные сообщения пользователя. +Содержимое и читаемые поля author/recipient сохраняются. Для HTTPS `api.x.ai` и +`cli-chat-proxy.grok.com` на стандартном порту также поддерживается непустой строковый +результат дочерней задачи: он становится частью `input_text` без удаления пробелов и +переносов строк. Другие адреса сохраняют строковые элементы без изменений. Пустые строки, +зашифрованное содержимое и смешанные массивы с неизвестными или зашифрованными частями +не преобразуются частично. При `authMode: "forward"` элементы `agent_message` остаются +без изменений. + При `key`-аутентификации [`retryOn429`](/ru/reference/configuration/) действует и здесь: 429 до начала потока ждёт и, до любой другой обработки или фейловера, повторяет идентичный запрос на том же ключе, как и в переводимом пути `openai-chat`/Anthropic. Пользовательские транспорты diff --git a/docs-site/src/content/docs/ru/reference/cli/lifecycle.md b/docs-site/src/content/docs/ru/reference/cli/lifecycle.md index 7be5d5ad77..f743f5f468 100644 --- a/docs-site/src/content/docs/ru/reference/cli/lifecycle.md +++ b/docs-site/src/content/docs/ru/reference/cli/lifecycle.md @@ -313,12 +313,30 @@ ocx codex-shim status ocx codex-shim uninstall ``` +:::note[Окружение токена в Windows] +Новые обёртки для Windows CMD и PowerShell восстанавливают исходное состояние `OPENCODEX_API_AUTH_TOKEN` в вызывающей оболочке после выполнения. Codex и его дочерние процессы по-прежнему могут унаследовать токен. + +После обновления OpenCodex пересоздайте существующую обёртку Windows командами `ocx codex-shim uninstall`, затем `ocx codex-shim install`, чтобы применить это поведение. Обычное обновление не перезаписывает исправную обёртку Windows. +::: + :::tip[Service vs Shim] Используйте `ocx service` для всегда работающего фонового прокси (рекомендуется). Используйте `ocx codex-shim` для лёгкого on-demand запуска без демона — в этом случае прокси стартует только когда запускается `codex`. ::: +#### Передача токена в Codex + +При привязке к адресу, отличному от loopback, внедрённый провайдер содержит `env_key = "OPENCODEX_API_AUTH_TOKEN"`. Эта строка указывает Codex, какую переменную читать, но не создаёт её. Если переменная отсутствует, Codex отказывается начинать запрос (`Missing environment variable: OPENCODEX_API_AUTH_TOKEN`), и запрос не доходит до прокси. Значение хранится в `$OPENCODEX_HOME/service-api-token`; запускающий процесс должен передать его в окружение Codex. + +Используйте поддерживаемую обёртку, устанавливаемую командой `ocx codex-shim install`. Если в контексте запуска выбирается эта обёртка, она читает файл токена, созданный OpenCodex, и передаёт переменную Codex. При запуске из настольной среды, cron или службы необходимо использовать PATH либо путь к средству запуска, который выбирает обёртку; установка не настраивает эти окружения автоматически. Собственные дочерние процессы Codex также могут унаследовать токен. + +Не экспортируйте этот Bearer-токен из файла запуска оболочки и не копируйте его в `config.toml`. Файл `service-api-token` содержит сам токен, а не присваивания вида `NAME=value`, поэтому его нельзя напрямую использовать как `EnvironmentFile=` в systemd. + +`EnvironmentFile=` или `OCX_API_TOKEN_FILE` в `opencodex-proxy.service` настраивает только процесс прокси и никогда не передаётся в независимо запущенный `codex exec`. + +Обновление Codex, заменяющее средство запуска, удаляет обёртку; следующая обычная команда `ocx` восстанавливает её (см. выше), но `codex exec`, запущенный до этого, завершается ошибкой. `ocx doctor` сообщает именно об этом состоянии в разделе "Codex env_key launch readiness" (env_key настроен, переменная не задана, обёртка отсутствует или неисправна, файл токена присутствует), приводит команду исправления и никогда не выводит токен. Чтение файла токена не входит в контракт внедрённого `env_key`; запускающий процесс должен передать эту переменную. + ### `ocx tray [--json] [--no-start]` Установить и управлять Windows tray icon со статусом. Иконка стартует при логине в Windows и даёт diff --git a/docs-site/src/content/docs/ru/reference/configuration/agents.md b/docs-site/src/content/docs/ru/reference/configuration/agents.md index a3a0bc434b..6dcf3be84b 100644 --- a/docs-site/src/content/docs/ru/reference/configuration/agents.md +++ b/docs-site/src/content/docs/ru/reference/configuration/agents.md @@ -33,13 +33,21 @@ Management API предоставляет `GET`/`PUT /api/v2`, `/api/injection-m `/api/subagent-models` и `/api/subagent-model-fallback`. Обновления injection-model частичные; custom prompt на этом API передаётся полем `prompt`. +## Всегда проактивное делегирование + +**Всегда проактивное делегирование** в Subagents → Дополнительно (прежнее название — **Ultra mode**) меняет только условие запуска делегирования, не меняя reasoning effort. Рекомендуемый preset сохраняет инструкции пользователя, границы полномочий, область задачи и правила работы с инструментами. + +`GET` и `PUT /api/v2` дополнительно возвращают `multiAgentModeHintRecommendation: { text, revision }`. При включении или восстановлении preset дашборд использует текст сервера без встроенного запасного варианта. Если старый сервер не возвращает рекомендацию или возвращает некорректное значение, применение и восстановление preset недоступны; существующий custom hint по-прежнему можно редактировать или удалять. Восстановление preset меняет только локальный черновик; действие сохранения записывает его. + +Чтение настроек, несвязанные изменения и обновление версии не мигрируют сохранённый hint. Только явное обновление hint, текст которого побайтово совпадает с одним из двух известных старых preset OpenCodex, заменяет его текущей рекомендацией. Остальной допустимый custom text, включая варианты с отличиями в пробельных символах, сохраняется побайтово. Существующие правила включения v2, проверки поддержки и удаления hint не меняются; изменения применяются к новым сессиям Codex. + ## Roster и guidance Эффективный ростер v2 — это настроенные, видимые в picker'е, отсортированные по priority первые -пять моделей, совместимых с v2 и присутствующих во внедряемом каталоге. Для v2 запись считается -допустимой, если upstream pin равен `"v2"`, `null` либо вовсе отсутствует; реальный pin `"v1"` -исключает модель. Исключённые записи всё равно остаются в конфигурации, чтобы позже снова стать -допустимыми. +пять моделей, присутствующих во внедряемом каталоге и не отмеченных явно как `"disabled"`. +Явный pin `"v2"` поддерживает рекурсивных подагентов; `"v1"`, `null` и отсутствующий pin +остаются допустимыми для подагентов без дальнейшего делегирования. Исключённые записи остаются +в конфигурации, чтобы позже снова стать допустимыми. Определение surface основано на форме tool'ов. Namespaced `spawn_agent` вместе с `send_input`, `resume_agent` или `close_agent` — это v1. Плоский `spawn_agent` вместе с `send_message`, @@ -51,10 +59,22 @@ roster или fallback chain. Встроенное guidance v2 ограниче сначала удаляет roster. Guidance дедуплицируется по replay-prefix и вставляется перед завершающим `compaction_trigger`. -`injectionModel` и `injectionEffort` носят рекомендательный характер, если только не включён -native-default sync. Встроенный текст v2 просит Codex передавать поддерживаемые override'ы model -и effort в `spawn_agent` с `fork_turns: "none"`. В custom `injectionPrompt` отсутствующие значения -подставляются как пустая строка. +И встроенные указания v2 для подагентов, и пользовательские тела `injectionPrompt` используют +``, отдельно от нативных сообщений Codex ``. +Встроенный текст сообщает итоговую предпочтительную модель, список моделей и цепочку резервных +моделей, но не предписывает делегирование, переопределение модели или `fork_turns`. Подстановка +значений в плейсхолдеры и содержимое пользовательских тел сохраняются. `injectionModel` и +`injectionEffort` остаются рекомендациями, если не включена синхронизация нативных значений по +умолчанию; отсутствующие значения пользовательских плейсхолдеров заменяются пустой строкой. + +Дедупликация replay проверяет точное совпадение с последним текстом в каждой группе тегов. +Если оба значения используют новую группу тегов прокси, при возврате от пользовательских указаний +к встроенной форме добавляется её текущее содержимое; промежуточные изменения нативного режима +не дублируют неизменившиеся указания прокси. +Существующая история нативных сообщений и сообщений со старым тегом сохраняется. Изменение +обёртки не устанавливает автора старых сообщений и не отменяет прежние инструкции; историю +со смешанными версиями нельзя классифицировать только по старому тегу, и обнаружение переходов +в такой истории не гарантируется. ## Синхронизация native default'ов Codex diff --git a/docs-site/src/content/docs/ru/reference/configuration/providers.md b/docs-site/src/content/docs/ru/reference/configuration/providers.md index 1a4643cc1e..78bca4d40d 100644 --- a/docs-site/src/content/docs/ru/reference/configuration/providers.md +++ b/docs-site/src/content/docs/ru/reference/configuration/providers.md @@ -79,6 +79,10 @@ cross-route credential fallback не существует. Строки API GPT- перезаписывая отличающуюся backup-копию, и переписывает известные legacy namespaced-id, выбранные в `selectedModels`, в bare-id. +## Псевдонимы пространств имён провайдеров + +У провайдеров могут быть встроенные сокращения, например `agy` для `google-antigravity`. Если имя настроенного провайдера или явный псевдоним занимает такое сокращение без учёта регистра, встроенное сокращение другого провайдера отключается и в каталоге, и при маршрутизации по псевдониму. Например, при настройке провайдера с именем `agy` модели Google отображаются как `google-antigravity/`, а `agy/` выбирает настроенного провайдера. Канонические имена провайдеров по-прежнему требуют точного совпадения регистра; для нераспознанных префиксов сохраняется существующий резервный путь маршрутизации модели. + ## Записи провайдеров (`OcxProviderConfig`) | Поле | Тип | Значение | diff --git a/docs-site/src/content/docs/zh-cn/reference/cli/lifecycle.md b/docs-site/src/content/docs/zh-cn/reference/cli/lifecycle.md index f0c6ee5a59..5977c734de 100644 --- a/docs-site/src/content/docs/zh-cn/reference/cli/lifecycle.md +++ b/docs-site/src/content/docs/zh-cn/reference/cli/lifecycle.md @@ -209,10 +209,28 @@ ocx codex-shim status ocx codex-shim uninstall ``` +:::note[Windows 令牌环境] +新生成的 Windows CMD 和 PowerShell shim 会在执行后恢复调用方原有的 `OPENCODEX_API_AUTH_TOKEN` 状态。Codex 及其子进程仍可能继承令牌。 + +更新 OpenCodex 后，如需让现有 Windows shim 采用此行为，请先运行 `ocx codex-shim uninstall`，再运行 `ocx codex-shim install` 重新安装。常规更新不会重写正常的 Windows shim。 +::: + :::tip[Service vs Shim] 将 `ocx service` 用于始终在线的后台代理（推荐）。将 `ocx codex-shim` 用于无需守护进程的轻量按需启动——代理只会在启动 `codex` 时运行。 ::: +#### 向 Codex 注入令牌 + +绑定到非回环地址时，注入的提供程序包含 `env_key = "OPENCODEX_API_AUTH_TOKEN"`。这一行告诉 Codex 应读取哪个变量，但不会创建该变量。如果变量不存在，Codex 会拒绝发起请求（`Missing environment variable: OPENCODEX_API_AUTH_TOKEN`），请求也不会到达代理。变量值保存在 `$OPENCODEX_HOME/service-api-token` 中；启动进程必须将其传入 Codex 的环境。 + +请使用通过 `ocx codex-shim install` 安装且受维护的 shim。如果启动上下文选择此 shim，它会读取 OpenCodex 创建的令牌文件，并将变量传给 Codex。从桌面、cron 或服务启动时，必须使用能够选中该 shim 的 PATH 或启动器路径；安装过程不会自动配置这些环境。Codex 自身的子进程也可能继承令牌。 + +不要在 shell 启动文件中导出此 Bearer 令牌，也不要将其复制到 `config.toml`。`service-api-token` 文件包含的是原始令牌，而不是 `NAME=value` 形式的赋值，因此不能直接用作 systemd 的 `EnvironmentFile=`。 + +`opencodex-proxy.service` 中的 `EnvironmentFile=` 或 `OCX_API_TOKEN_FILE` 仅配置代理进程，绝不会传入独立启动的 `codex exec`。 + +替换启动器的 Codex 升级会移除 shim；下一次执行普通的 `ocx` 命令时会将其恢复（见上文），但在此之前运行的 `codex exec` 会失败。`ocx doctor` 会在 "Codex env_key launch readiness" 项下报告这一确切状态（env_key 已配置、变量未设置、shim 缺失或不正常、令牌文件存在），并给出修复命令，且绝不会输出令牌。读取令牌文件不属于注入的 `env_key` 的约定；启动进程必须提供该变量。 + ### `ocx tray [--json] [--no-start]` 安装并控制 Windows 状态托盘图标。它会在 Windows 登录时启动，并提供一键代理控制。`start` 和 `stop` 只控制图标本身；要控制代理，请使用其菜单。`--no-start` 适用于 `install`，会安装托盘但不会立即启动。 diff --git a/docs-site/src/content/docs/zh-cn/reference/configuration/agents.md b/docs-site/src/content/docs/zh-cn/reference/configuration/agents.md index 1c8d71eeca..8bb438cd20 100644 --- a/docs-site/src/content/docs/zh-cn/reference/configuration/agents.md +++ b/docs-site/src/content/docs/zh-cn/reference/configuration/agents.md @@ -26,15 +26,25 @@ description: 多代理界面、委派引导、首选模型、回退链、原生 管理 API 公开 `GET`/`PUT /api/v2`、`/api/injection-model`、`/api/effort-caps`、`/api/subagent-models` 和 `/api/subagent-model-fallback`。injection-model 更新是部分更新；自定义 prompt 是该 API 上的 `prompt` 字段。 +## 始终主动委派 + +Subagents → 高级中的 **始终主动委派**（原名 **Ultra mode**）只改变触发委派的条件，不改变推理 effort。推荐预设仍遵循用户指令、权限边界、任务范围和工具规则。 + +`GET` 和 `PUT /api/v2` 还会返回 `multiAgentModeHintRecommendation: { text, revision }`。仪表板在启用或恢复预设时使用服务器提供的文本，不会回退到硬编码文案。如果旧服务器没有提供推荐值，或返回的值格式无效，则无法应用或恢复预设；仍可编辑或清除现有的自定义提示。恢复预设只修改本地草稿，保存操作才会将其写入配置。 + +读取设置、无关更新和版本升级不会迁移已保存的提示。只有显式更新提示，且正文与两种已知旧版 OpenCodex 预设之一逐字节完全一致时，才会替换为当前推荐文本。其他有效的自定义文本，包括仅空白字符不同的变体，都会逐字节保留。现有的 v2 启用、功能支持检查和清除提示规则保持不变；更改会应用于新的 Codex 会话。 + ## 名单与引导 -有效的 v2 名单，是已配置、在选择器中可见、按优先级排序的前五个模型中，和 v2 兼容且存在于注入目录中的那些模型。v2 资格判定会把显式的 `"v2"`、`null`，或缺失的上游固定值视为可用；真正的 `"v1"` 固定值会被排除。被排除的条目仍会保留在配置中，以便将来重新变为可用。 +有效的 v2 名单，是已配置、在选择器中可见、按优先级排序的前五个模型中，存在于注入目录且未明确标记为 `"disabled"` 的模型。显式的 `"v2"` 标记支持递归子代理；`"v1"`、`null` 和缺失的标记仍可作为叶子子代理。被排除的条目仍会保留在配置中，以便将来重新变为可用。 界面检测使用工具形状来判断。带命名空间的 `spawn_agent`，如果具有 `send_input`、`resume_agent` 或 `close_agent`，就是 v1。平铺的 `spawn_agent`，如果具有 `send_message`、`followup_task`、`interrupt_agent` 或 `list_agents`，就是 v2。 V1 引导只会在 `max` 或 `ultra` 时以主动文本形式出现。V2 只有在存在首选模型、可用名单或回退链时，才会收到代理生成的开发者消息。内置 v2 引导有 700 个字符的预算，必要时会先删减名单。引导会在 replay prefix 之间去重，并插入到末尾的 `compaction_trigger` 之前。 -除非启用了原生默认值同步，`injectionModel` 和 `injectionEffort` 都只是建议。内置 v2 文本会要求 Codex 使用 `fork_turns: "none"` 将受支持的模型/effort 覆盖传给 `spawn_agent`。自定义 `injectionPrompt` 会把缺失值替换为空字符串。 +内置 v2 子代理引导和自定义 `injectionPrompt` 正文都使用 ``，与 Codex 原生的 `` 消息区分开来。内置文本会说明解析后的首选模型、名单和回退链，但不会指示委派、模型覆盖或 `fork_turns`。自定义正文的占位符替换和内容保持不变。除非启用了原生默认值同步，`injectionModel` 和 `injectionEffort` 仍只是建议；自定义占位符的缺失值仍替换为空字符串。 + +replay 去重会分别与每类标签的最新文本进行精确比较。当两个值都使用新的代理标签时，从自定义引导切回内置形式会追加当前的引导内容；期间原生模式的变化不会导致未改变的代理引导被重复添加。现有的原生消息历史和带旧标签的历史都会保留。更换包装标签并不能确定旧消息的作者，也不会撤销先前的指令；对于混合版本的历史，不能仅凭旧标签进行分类，也不保证检测到这类历史中的设置切换。 ## Codex 原生默认值同步 diff --git a/docs-site/src/content/docs/zh-cn/reference/configuration/providers.md b/docs-site/src/content/docs/zh-cn/reference/configuration/providers.md index a3008db320..99fba1fbb4 100644 --- a/docs-site/src/content/docs/zh-cn/reference/configuration/providers.md +++ b/docs-site/src/content/docs/zh-cn/reference/configuration/providers.md @@ -66,6 +66,10 @@ selector，而不是分配一个新名称。 `openaiProviderTierVersion: 2` 标记当前的单提供者投影。对已发布的 v1 配置进行迁移之前，opencodex 会创建 `config.json.pre-openai-tiers-v2.bak`，且不会覆盖不同的备份文件，并会把已知的旧式命名空间选择 id 重写为裸 id。 +## 提供者命名空间别名 + +提供者可以有内置缩写，例如 `google-antigravity` 的 `agy`。如果已配置的提供者名称或显式别名占用了该缩写（不区分大小写），另一个提供者的内置缩写就会在目录名称和别名路由中同时禁用。例如，配置名为 `agy` 的提供者后，Google 模型会显示为 `google-antigravity/`，而 `agy/` 会选择已配置的提供者。规范提供者名称仍要求大小写完全一致；无法识别的前缀继续沿用现有的模型路由回退行为。 + ## 提供者条目（`OcxProviderConfig`） | 字段 | 类型 | 含义 | diff --git a/gui/src/components/subagents-workspace/SubagentDelegationSection.tsx b/gui/src/components/subagents-workspace/SubagentDelegationSection.tsx index a975786a94..19108e04cd 100644 --- a/gui/src/components/subagents-workspace/SubagentDelegationSection.tsx +++ b/gui/src/components/subagents-workspace/SubagentDelegationSection.tsx @@ -299,10 +299,15 @@ export default function SubagentDelegationSection({ @@ -385,7 +390,3 @@ function UltraModeEditor({ ); } - -/** Canonical Proactive delegation text mirrored from codex-rs (multi_agent_mode_instructions.rs). */ -export const ULTRA_MODE_PRESET = - "Proactive multi-agent delegation is active. Any earlier instruction requiring an explicit user request before spawning sub-agents no longer applies. Delegate independent sub-tasks to sub-agents whenever parallel work would materially improve speed or quality — do not serialize work that can run concurrently. Each sub-agent runs in its own context and can use all available tools; prefer spawning specialists over doing everything yourself. This mode remains active until a later multi-agent mode developer message changes it."; diff --git a/gui/src/i18n/de.ts b/gui/src/i18n/de.ts index b7e62e0ea8..40ee6ea36f 100644 --- a/gui/src/i18n/de.ts +++ b/gui/src/i18n/de.ts @@ -680,14 +680,14 @@ export const de: Record = { "sub.workspace.selectModel": "Modell auswählen", "sub.workspace.selectModelDesc": "Wählen Sie ein Modell aus der Liste, um Details anzuzeigen und es für spawn_agent hervorzuheben.", "sub.workspace.selector": "Öffentlicher Selektor", - "sub.ultraMode": "Ultra-Modus", + "sub.ultraMode": "Immer proaktiv delegieren", "sub.ultraModeHint": "Aktiviert die proaktive Multi-Agent-Delegierungsrichtlinie für alle Modelle und Reasoning-Efforts (ändert den Reasoning-Effort selbst nicht). Schreibt features.multi_agent_v2.multi_agent_mode_hint_text in config.toml.", "sub.ultraModeV2Required": "Erfordert die v2-Multi-Agent-Oberfläche — aktivieren Sie zuerst multi_agent_v2 und wählen Sie v2 in der Subagentenmodus-Steuerung.", - "sub.ultraModeText": "Delegierungstext des Ultra-Modus", + "sub.ultraModeText": "Text für proaktive Delegierung", "sub.ultraModePreset": "Voreinstellung wiederherstellen", - "sub.ultraModeLoadFail": "Ultra-Modus-Einstellungen konnten nicht geladen werden — läuft der Proxy?", - "sub.ultraModeSaveFail": "Ultra-Modus-Einstellungen konnten nicht gespeichert werden", - "sub.ultraModeSaved": "Ultra-Modus gespeichert. Gilt für neue Codex-Sitzungen.", + "sub.ultraModeLoadFail": "Einstellungen für proaktive Delegierung konnten nicht geladen werden — läuft der Proxy?", + "sub.ultraModeSaveFail": "Einstellungen für proaktive Delegierung konnten nicht gespeichert werden", + "sub.ultraModeSaved": "Proaktive Delegierung gespeichert. Gilt für neue Codex-Sitzungen.", "logs.title": "Anfrage-Protokolle", "logs.tabLogs": "Protokolle", "logs.tabDebug": "Diagnose", diff --git a/gui/src/i18n/en.ts b/gui/src/i18n/en.ts index fdb91fad32..53d940d7e6 100644 --- a/gui/src/i18n/en.ts +++ b/gui/src/i18n/en.ts @@ -709,14 +709,14 @@ export const en = { "sub.workspace.mainAria": "Subagent model details", "sub.workspace.notFeatured": "Not featured", "sub.workspace.priority": "Priority", - "sub.ultraMode": "Ultra mode", + "sub.ultraMode": "Always proactive delegation", "sub.ultraModeHint": "Enable the Proactive multi-agent delegation policy for every model and reasoning effort (does not change reasoning effort itself). Writes features.multi_agent_v2.multi_agent_mode_hint_text in config.toml.", "sub.ultraModeV2Required": "Requires the v2 multi-agent surface — enable multi_agent_v2 and select v2 in the Sub-agent mode control first.", - "sub.ultraModeText": "Ultra mode delegation text", + "sub.ultraModeText": "Proactive delegation text", "sub.ultraModePreset": "Restore preset", - "sub.ultraModeLoadFail": "Failed to load Ultra mode settings — is the proxy running?", - "sub.ultraModeSaveFail": "Failed to save Ultra mode settings", - "sub.ultraModeSaved": "Ultra mode saved. Applies to new Codex sessions.", + "sub.ultraModeLoadFail": "Failed to load proactive delegation settings — is the proxy running?", + "sub.ultraModeSaveFail": "Failed to save proactive delegation settings", + "sub.ultraModeSaved": "Proactive delegation saved. Applies to new Codex sessions.", "sub.workspace.removeFromFeatured": "Remove {m} from featured", "sub.workspace.selectModel": "Select a model", "sub.workspace.selectModelDesc": "Pick a model from the list to see details and feature it for spawn_agent.", diff --git a/gui/src/i18n/fr.ts b/gui/src/i18n/fr.ts index 4354e6fd56..7afb44ab2c 100644 --- a/gui/src/i18n/fr.ts +++ b/gui/src/i18n/fr.ts @@ -692,14 +692,14 @@ export const fr: Record = { "sub.workspace.mainAria": "Détails du modèle de sous-agent", "sub.workspace.notFeatured": "Non mis à la une", "sub.workspace.priority": "Priorité", - "sub.ultraMode": "Mode Ultra", + "sub.ultraMode": "Délégation toujours proactive", "sub.ultraModeHint": "Activer la politique de délégation multi-agent proactive pour tous les modèles et niveaux de raisonnement (sans modifier le niveau de raisonnement lui-même). Écrit features.multi_agent_v2.multi_agent_mode_hint_text dans config.toml.", "sub.ultraModeV2Required": "Nécessite l’interface multi-agent v2 — activez multi_agent_v2 et sélectionnez d’abord v2 dans le contrôle du mode Sous-agent.", - "sub.ultraModeText": "Texte de délégation du mode Ultra", + "sub.ultraModeText": "Texte de délégation proactive", "sub.ultraModePreset": "Rétablir le préréglage", - "sub.ultraModeLoadFail": "Échec du chargement des paramètres du mode Ultra — le proxy est-il en cours d’exécution ?", - "sub.ultraModeSaveFail": "Échec de l’enregistrement des paramètres du mode Ultra", - "sub.ultraModeSaved": "Mode Ultra enregistré. S’applique aux nouvelles sessions Codex.", + "sub.ultraModeLoadFail": "Échec du chargement des paramètres de délégation proactive — le proxy est-il en cours d’exécution ?", + "sub.ultraModeSaveFail": "Échec de l’enregistrement des paramètres de délégation proactive", + "sub.ultraModeSaved": "Délégation proactive enregistrée. S’applique aux nouvelles sessions Codex.", "sub.workspace.removeFromFeatured": "Retirer {m} de la sélection À la une", "sub.workspace.selectModel": "Sélectionner un modèle", "sub.workspace.selectModelDesc": "Choisissez un modèle dans la liste pour afficher ses détails et le mettre à la une pour spawn_agent.", diff --git a/gui/src/i18n/ja.ts b/gui/src/i18n/ja.ts index dfbab83390..75095da332 100644 --- a/gui/src/i18n/ja.ts +++ b/gui/src/i18n/ja.ts @@ -640,14 +640,14 @@ export const ja: Record = { "sub.workspace.selectModel": "モデルを選択", "sub.workspace.selectModelDesc": "一覧からモデルを選んで詳細を確認し、spawn_agent のおすすめに設定します。", "sub.workspace.selector": "公開セレクター", - "sub.ultraMode": "ウルトラモード", + "sub.ultraMode": "常時プロアクティブ委任", "sub.ultraModeHint": "すべてのモデルと reasoning effort で Proactive マルチエージェント委任ポリシーを有効にします（reasoning effort 自体は変更しません）。config.toml に features.multi_agent_v2.multi_agent_mode_hint_text を書き込みます。", "sub.ultraModeV2Required": "v2 マルチエージェントサーフェスが必要です — 先に multi_agent_v2 を有効にし、サブエージェントモードで v2 を選択してください。", - "sub.ultraModeText": "ウルトラモード委任テキスト", + "sub.ultraModeText": "プロアクティブ委任テキスト", "sub.ultraModePreset": "プリセットを復元", - "sub.ultraModeLoadFail": "ウルトラモード設定を読み込めませんでした — プロキシは実行中ですか？", - "sub.ultraModeSaveFail": "ウルトラモード設定の保存に失敗しました", - "sub.ultraModeSaved": "ウルトラモードを保存しました。新しい Codex セッションから適用されます。", + "sub.ultraModeLoadFail": "プロアクティブ委任設定を読み込めませんでした — プロキシは実行中ですか？", + "sub.ultraModeSaveFail": "プロアクティブ委任設定の保存に失敗しました", + "sub.ultraModeSaved": "プロアクティブ委任設定を保存しました。新しい Codex セッションから適用されます。", // logs "logs.title": "リクエストログ", diff --git a/gui/src/i18n/ko.ts b/gui/src/i18n/ko.ts index 19855bdd33..5ae812e9e8 100644 --- a/gui/src/i18n/ko.ts +++ b/gui/src/i18n/ko.ts @@ -697,14 +697,14 @@ export const ko: Record = { "sub.workspace.selectModel": "모델 선택", "sub.workspace.selectModelDesc": "목록에서 모델을 선택하여 세부 정보를 확인하고 spawn_agent에 추천하세요.", "sub.workspace.selector": "공개 셀렉터", - "sub.ultraMode": "울트라 모드", + "sub.ultraMode": "항상 능동 위임", "sub.ultraModeHint": "모든 모델과 reasoning effort에서 Proactive 멀티에이전트 위임 정책을 켭니다 (reasoning effort 자체는 변경하지 않음). config.toml에 features.multi_agent_v2.multi_agent_mode_hint_text를 기록합니다.", "sub.ultraModeV2Required": "v2 멀티에이전트 서피스가 필요합니다 — 먼저 multi_agent_v2를 켜고 서브에이전트 모드에서 v2를 선택하세요.", - "sub.ultraModeText": "울트라 모드 위임 텍스트", + "sub.ultraModeText": "능동 위임 텍스트", "sub.ultraModePreset": "프리셋 복원", - "sub.ultraModeLoadFail": "울트라 모드 설정을 불러오지 못했습니다 — 프록시가 실행 중인가요?", - "sub.ultraModeSaveFail": "울트라 모드 설정 저장에 실패했습니다", - "sub.ultraModeSaved": "울트라 모드가 저장되었습니다. 새 Codex 세션부터 적용됩니다.", + "sub.ultraModeLoadFail": "능동 위임 설정을 불러오지 못했습니다 — 프록시가 실행 중인가요?", + "sub.ultraModeSaveFail": "능동 위임 설정 저장에 실패했습니다", + "sub.ultraModeSaved": "능동 위임 설정이 저장되었습니다. 새 Codex 세션부터 적용됩니다.", "sub.fallbackLabel": "서브에이전트 폴백 체인", "sub.fallbackHint": "서브에이전트 모델을 사용할 수 없거나 실패할 때 순서대로 시도할 모델입니다.", "sub.fallbackAdd": "폴백 모델 추가…", diff --git a/gui/src/i18n/ru.ts b/gui/src/i18n/ru.ts index 194d7aa72a..2900abb6f3 100644 --- a/gui/src/i18n/ru.ts +++ b/gui/src/i18n/ru.ts @@ -695,14 +695,14 @@ export const ru: Record = { "sub.workspace.selectModel": "Выберите модель", "sub.workspace.selectModelDesc": "Выберите модель из списка, чтобы увидеть детали и добавить её в избранные для spawn_agent.", "sub.workspace.selector": "Публичный селектор", - "sub.ultraMode": "Ультра-режим", + "sub.ultraMode": "Всегда проактивное делегирование", "sub.ultraModeHint": "Включает политику упреждающего делегирования мультиагентов для всех моделей и уровней reasoning effort (сам reasoning effort не меняется). Записывает features.multi_agent_v2.multi_agent_mode_hint_text в config.toml.", "sub.ultraModeV2Required": "Требуется мультиагентная поверхность v2 — сначала включите multi_agent_v2 и выберите v2 в переключателе режима субагентов.", - "sub.ultraModeText": "Текст делегирования ультра-режима", + "sub.ultraModeText": "Текст проактивного делегирования", "sub.ultraModePreset": "Восстановить пресет", - "sub.ultraModeLoadFail": "Не удалось загрузить настройки ультра-режима — работает ли прокси?", - "sub.ultraModeSaveFail": "Не удалось сохранить настройки ультра-режима", - "sub.ultraModeSaved": "Ультра-режим сохранён. Применяется к новым сеансам Codex.", + "sub.ultraModeLoadFail": "Не удалось загрузить настройки проактивного делегирования — работает ли прокси?", + "sub.ultraModeSaveFail": "Не удалось сохранить настройки проактивного делегирования", + "sub.ultraModeSaved": "Проактивное делегирование сохранено. Применяется к новым сеансам Codex.", // logs "logs.title": "Журнал запросов", diff --git a/gui/src/i18n/tr.ts b/gui/src/i18n/tr.ts index aa97b22ff2..f551a97d43 100644 --- a/gui/src/i18n/tr.ts +++ b/gui/src/i18n/tr.ts @@ -702,14 +702,14 @@ export const tr: Record = { "sub.workspace.selectModel": "Bir model seçin", "sub.workspace.selectModelDesc": "Detayları görmek için listeden bir model seçin.", "sub.workspace.selector": "Genel seçici", - "sub.ultraMode": "Ultra modu", + "sub.ultraMode": "Her zaman proaktif delegasyon", "sub.ultraModeHint": "Tüm modeller ve reasoning effort için Proactive çoklu ajan delegasyon politikasını etkinleştirir (reasoning effort değerini değiştirmez). config.toml dosyasına features.multi_agent_v2.multi_agent_mode_hint_text yazar.", "sub.ultraModeV2Required": "v2 çoklu ajan yüzeyi gerekir — önce multi_agent_v2'yi etkinleştirin ve alt ajan modu denetiminde v2'yi seçin.", - "sub.ultraModeText": "Ultra modu delegasyon metni", + "sub.ultraModeText": "Proaktif delegasyon metni", "sub.ultraModePreset": "Ön ayarı geri yükle", - "sub.ultraModeLoadFail": "Ultra modu ayarları yüklenemedi — proxy çalışıyor mu?", - "sub.ultraModeSaveFail": "Ultra modu ayarları kaydedilemedi", - "sub.ultraModeSaved": "Ultra modu kaydedildi. Yeni Codex oturumlarına uygulanır.", + "sub.ultraModeLoadFail": "Proaktif delegasyon ayarları yüklenemedi — proxy çalışıyor mu?", + "sub.ultraModeSaveFail": "Proaktif delegasyon ayarları kaydedilemedi", + "sub.ultraModeSaved": "Proaktif delegasyon kaydedildi. Yeni Codex oturumlarına uygulanır.", "sub.fallbackLabel": "Alt ajan yedek zinciri", "sub.fallbackHint": "Alt ajan modeli kullanılamadığında veya başarısız olduğunda sırayla denenecek modeller.", "sub.fallbackAdd": "Yedek model ekle…", diff --git a/gui/src/i18n/zh-TW.ts b/gui/src/i18n/zh-TW.ts index db9829821d..ae0ee0517b 100644 --- a/gui/src/i18n/zh-TW.ts +++ b/gui/src/i18n/zh-TW.ts @@ -547,14 +547,14 @@ export const zhTW: Record = { "sub.moveUp": "上移 {m}", "sub.moveDown": "下移 {m}", "sub.removeAria": "移除 {m}", - "sub.ultraMode": "超級模式", + "sub.ultraMode": "始終主動委派", "sub.ultraModeHint": "為所有模型和推理力度啟用主動多代理委派策略（不改變推理力度本身）。將 features.multi_agent_v2.multi_agent_mode_hint_text 寫入 config.toml。", "sub.ultraModeV2Required": "需要 v2 多代理表面 — 請先啟用 multi_agent_v2，並在子代理模式控制項中選擇 v2。", - "sub.ultraModeText": "超級模式委派文字", + "sub.ultraModeText": "主動委派文字", "sub.ultraModePreset": "還原預設", - "sub.ultraModeLoadFail": "無法載入超級模式設定 — 代理是否在執行？", - "sub.ultraModeSaveFail": "儲存超級模式設定失敗", - "sub.ultraModeSaved": "超級模式已儲存。適用於新的 Codex 會話。", + "sub.ultraModeLoadFail": "無法載入主動委派設定 — 代理是否在執行？", + "sub.ultraModeSaveFail": "儲存主動委派設定失敗", + "sub.ultraModeSaved": "主動委派設定已儲存。適用於新的 Codex 會話。", "logs.title": "請求日誌", "logs.tabLogs": "日誌", "logs.tabDebug": "除錯", diff --git a/gui/src/i18n/zh.ts b/gui/src/i18n/zh.ts index a13ff07973..ca92aaeafc 100644 --- a/gui/src/i18n/zh.ts +++ b/gui/src/i18n/zh.ts @@ -690,14 +690,14 @@ export const zh: Record = { "sub.workspace.selectModel": "选择模型", "sub.workspace.selectModelDesc": "从列表中选择一个模型以查看详情，并将其设为 spawn_agent 的精选模型。", "sub.workspace.selector": "公开选择器", - "sub.ultraMode": "超级模式", + "sub.ultraMode": "始终主动委派", "sub.ultraModeHint": "为所有模型和推理力度启用主动多代理委派策略（不改变推理力度本身）。将 features.multi_agent_v2.multi_agent_mode_hint_text 写入 config.toml。", "sub.ultraModeV2Required": "需要 v2 多代理表面 — 请先启用 multi_agent_v2，并在子代理模式控件中选择 v2。", - "sub.ultraModeText": "超级模式委派文本", + "sub.ultraModeText": "主动委派文本", "sub.ultraModePreset": "恢复预设", - "sub.ultraModeLoadFail": "无法加载超级模式设置 — 代理是否在运行？", - "sub.ultraModeSaveFail": "保存超级模式设置失败", - "sub.ultraModeSaved": "超级模式已保存。适用于新的 Codex 会话。", + "sub.ultraModeLoadFail": "无法加载主动委派设置 — 代理是否在运行？", + "sub.ultraModeSaveFail": "保存主动委派设置失败", + "sub.ultraModeSaved": "主动委派设置已保存。适用于新的 Codex 会话。", // logs "logs.title": "请求日志", diff --git a/gui/src/pages/Subagents.tsx b/gui/src/pages/Subagents.tsx index 0b9806066d..94a8df7086 100644 --- a/gui/src/pages/Subagents.tsx +++ b/gui/src/pages/Subagents.tsx @@ -10,6 +10,11 @@ import { useSubagentDelegation, type UltraModePatch, type UltraModeState } from type CachedSubagents = { available: string[]; chosen: string[]; fallback?: string[]; pollMs?: number; fallbackAvailable?: string[] }; +const UNLOADED_ULTRA_MODE: UltraModeState = { + enabled: false, hintText: null, recommendation: null, + multiAgentV2Enabled: false, multiAgentMode: "default", +}; + function seedSubagents(cacheKey: string): CachedSubagents | null { return readSessionListCache(cacheKey); } @@ -40,7 +45,9 @@ export default function Subagents({ apiBase }: { apiBase: string }) { /** Sync guard: state-only `busy` can miss clicks before the disabled re-render commits. */ const saveInFlight = useRef(false); const delegation = useSubagentDelegation(apiBase); - const [ultraMode, setUltraMode] = useState({ enabled: false, hintText: null, multiAgentV2Enabled: false, multiAgentMode: "default" }); + const [ultraState, setUltraState] = useState<{ apiBase: string; mode: UltraModeState } | null>(null); + const ultraModeCurrent = ultraState?.apiBase === apiBase; + const ultraMode = ultraModeCurrent ? ultraState.mode : UNLOADED_ULTRA_MODE; const [ultraSaving, setUltraSaving] = useState(false); const [ultraLoadFailed, setUltraLoadFailed] = useState(false); const ultraLoadGeneration = useRef(0); @@ -62,21 +69,31 @@ export default function Subagents({ apiBase }: { apiBase: string }) { multiAgentMode?: "v1" | "default" | "v2"; multiAgentModeHintText?: string | null; keepNativeChatGptOnV1?: boolean; + multiAgentModeHintRecommendation?: { text?: unknown; revision?: unknown }; }>(res, t("sub.ultraModeLoadFail")); if (!data) return false; if (signal?.aborted || generation !== ultraLoadGeneration.current || currentUltraApiBase.current !== apiBase) return false; setUltraLoadFailed(false); - setUltraMode({ + const rawRecommendation = data.multiAgentModeHintRecommendation; + const recommendation = rawRecommendation + && typeof rawRecommendation.text === "string" + && rawRecommendation.text.trim().length > 0 + && typeof rawRecommendation.revision === "string" + && rawRecommendation.revision.trim().length > 0 + ? { text: rawRecommendation.text, revision: rawRecommendation.revision } + : null; + setUltraState({ apiBase, mode: { enabled: data.enabled ?? false, loaded: true, keepNativeChatGptOnV1: data.keepNativeChatGptOnV1 === true, hintText: data.multiAgentModeHintText ?? null, + recommendation, // Ultra mode replaces Codex's effort-derived policy for every model. The // `default` surface still preserves upstream V1 pins (for example luna), // so only an explicitly forced V2 catalog is an effective surface here. multiAgentV2Enabled: data.enabled === true && data.multiAgentMode === "v2", multiAgentMode: data.multiAgentMode ?? "default", - }); + } }); return true; }, [apiBase, t]); @@ -95,7 +112,7 @@ export default function Subagents({ apiBase }: { apiBase: string }) { }, [loadUltraMode, t]); const saveUltraMode = async (patch: UltraModePatch) => { - if (ultraSaving) return; + if (ultraSaving || !ultraModeCurrent || currentUltraApiBase.current !== apiBase) return; const requestApiBase = apiBase; setUltraSaving(true); setStatus(""); @@ -343,7 +360,7 @@ export default function Subagents({ apiBase }: { apiBase: string }) { saving: delegation.saving, onSave: patch => { void delegation.save(patch); }, ultraMode, - ultraSaving, + ultraSaving: ultraSaving || !ultraModeCurrent, onUltraModeSave: patch => { void saveUltraMode(patch); }, ultraLoadFailed, onUltraModeRetry: () => { void retryUltraMode(); }, diff --git a/gui/src/pages/use-subagent-delegation.ts b/gui/src/pages/use-subagent-delegation.ts index 9baa5baa9a..1a7829dc51 100644 --- a/gui/src/pages/use-subagent-delegation.ts +++ b/gui/src/pages/use-subagent-delegation.ts @@ -20,11 +20,17 @@ export type DelegationPatch = { }; /** Ultra mode (Proactive delegation for every model/effort) via /api/v2. */ +export type UltraModeHintRecommendation = { + text: string; + revision: string; +}; + export type UltraModeState = { loaded?: boolean; keepNativeChatGptOnV1?: boolean; enabled: boolean; hintText: string | null; + recommendation: UltraModeHintRecommendation | null; multiAgentV2Enabled: boolean; /** The raw multi-agent mode; Subagents renders the v1/base/v2 switch from it. */ multiAgentMode: "v1" | "default" | "v2"; diff --git a/gui/src/styles-subagents-workspace.css b/gui/src/styles-subagents-workspace.css index a9f9466ce7..2e4bde01ed 100644 --- a/gui/src/styles-subagents-workspace.css +++ b/gui/src/styles-subagents-workspace.css @@ -88,8 +88,22 @@ margin-top: 3px; max-width: 72ch; line-height: 1.5; + overflow-wrap: anywhere; } +.swi-ultra-mode-editor { + display: grid; + grid-template-columns: minmax(0, 1fr) auto auto; + align-items: start; +} + +.swi-ultra-mode-textarea { + min-width: 0; + width: 100%; +} + +.swi-ultra-mode-editor > button { justify-self: end; } + .swi-delegation-controls { display: flex; align-items: center; @@ -587,4 +601,6 @@ @media (max-width: 640px) { .swi-fallback-editor { flex-direction: column; } .swi-fallback-controls { width: 100%; } + .swi-ultra-mode-editor { grid-template-columns: minmax(0, 1fr) auto; } + .swi-ultra-mode-textarea { grid-column: 1 / -1; } } diff --git a/gui/tests/multi-agent-guidance.test.tsx b/gui/tests/multi-agent-guidance.test.tsx index 8907406f0e..a2f2af5259 100644 --- a/gui/tests/multi-agent-guidance.test.tsx +++ b/gui/tests/multi-agent-guidance.test.tsx @@ -65,7 +65,7 @@ function props(overrides: Partial = {}): Props { guidanceEnabled: false, syncCodexDefaults: true, onSave: (patch) => { requests.push(patch); }, - ultraMode: { enabled: false, hintText: null, multiAgentV2Enabled: false, multiAgentMode: "default" }, + ultraMode: { enabled: false, hintText: null, recommendation: null, multiAgentV2Enabled: false, multiAgentMode: "default" }, fallback: [], fallbackPollMs: 60000, fallbackBusy: false, @@ -150,3 +150,32 @@ test("sends model clearing through the shared save path", async () => { expect(requests).toEqual([{ model: null, effort: "high" }]); }); + +test("a recommendation-only refresh preserves the draft until Restore is chosen", async () => { + const current = props({ + ultraMode: { + enabled: true, hintText: "stored custom", multiAgentV2Enabled: true, multiAgentMode: "v2", + recommendation: { text: "old recommendation", revision: "old" }, + }, + onUltraModeSave: patch => { requests.push(patch); }, + }); + await mount(current); + const textarea = host.querySelector(".swi-ultra-mode-editor textarea")!; + await act(async () => { + Object.getOwnPropertyDescriptor(testWindow.HTMLTextAreaElement.prototype, "value")!.set!.call(textarea, "unsaved custom draft"); + textarea.dispatchEvent(new testWindow.Event("input", { bubbles: true })); + textarea.dispatchEvent(new testWindow.Event("change", { bubbles: true })); + }); + await act(async () => { + root!.render(); + }); + expect(textarea.value).toBe("unsaved custom draft"); + expect(requests).toHaveLength(0); + const restore = [...host.querySelectorAll(".swi-ultra-mode-editor button")] + .find(button => button.textContent?.trim() === "Restore preset")!; + await act(async () => { restore.click(); }); + expect(textarea.value).toBe("new recommendation"); + expect(requests).toHaveLength(0); +}); diff --git a/gui/tests/subagents-ultra-mode.test.tsx b/gui/tests/subagents-ultra-mode.test.tsx index 6c2c1d8719..22cfc459be 100644 --- a/gui/tests/subagents-ultra-mode.test.tsx +++ b/gui/tests/subagents-ultra-mode.test.tsx @@ -1,9 +1,8 @@ import { afterEach, beforeEach, expect, test } from "bun:test"; import { Window } from "happy-dom"; import { act } from "react"; -import { createRoot, type Root } from "react-dom/client"; +import type { Root } from "react-dom/client"; import Subagents from "../src/pages/Subagents"; -import { ULTRA_MODE_PRESET } from "../src/components/subagents-workspace/SubagentDelegationSection"; import { LanguageProvider } from "../src/i18n/provider"; const globals = ["document", "window", "navigator", "localStorage", "fetch", "IS_REACT_ACT_ENVIRONMENT"] as const; @@ -14,6 +13,7 @@ let root: Root | null = null; let v2Responses: Array<{ ok: boolean; body: unknown; status?: number }> = []; let v2Call = 0; let requests: Array<{ url: string; init?: RequestInit }> = []; +const recommendation = { text: "server-supplied proactive policy", revision: "test-policy-v1" }; function response(body: unknown, ok = true, status = 200): Response { return { @@ -75,6 +75,7 @@ afterEach(async () => { }); async function mount(apiBase = "") { + const { createRoot } = await import("react-dom/client"); await act(async () => { root = createRoot(container); root.render( @@ -88,13 +89,13 @@ async function mount(apiBase = "") { function ultraSwitch(): HTMLButtonElement { const button = Array.from(container.querySelectorAll("button")) - .find(candidate => candidate.getAttribute("aria-label") === "Ultra mode"); - if (!button) throw new Error("Ultra mode switch not found"); + .find(candidate => candidate.getAttribute("aria-label") === "Always proactive delegation"); + if (!button) throw new Error("Always proactive delegation switch not found"); return button as HTMLButtonElement; } test("does not enable Ultra mode for the default surface even when V2 is enabled", async () => { - v2Responses = [{ ok: true, body: { enabled: true, multiAgentMode: "default", multiAgentModeHintText: null } }]; + v2Responses = [{ ok: true, body: { enabled: true, multiAgentMode: "default", multiAgentModeHintText: null, multiAgentModeHintRecommendation: recommendation } }]; await mount(); expect(ultraSwitch().disabled).toBe(true); @@ -104,13 +105,13 @@ test("does not enable Ultra mode for the default surface even when V2 is enabled test("clears the page load error after a successful Ultra mode retry", async () => { v2Responses = [ { ok: false, body: { error: "temporary failure" }, status: 503 }, - { ok: true, body: { enabled: true, multiAgentMode: "v2", multiAgentModeHintText: null } }, + { ok: true, body: { enabled: true, multiAgentMode: "v2", multiAgentModeHintText: null, multiAgentModeHintRecommendation: recommendation } }, ]; await mount(); - expect(container.textContent).toContain("Failed to load Ultra mode settings"); + expect(container.textContent).toContain("Failed to load proactive delegation settings"); const ultraErrorRow = Array.from(container.querySelectorAll(".swi-delegation-row")) - .find(row => row.textContent?.includes("Failed to load Ultra mode settings")); + .find(row => row.textContent?.includes("Failed to load proactive delegation settings")); const retry = ultraErrorRow?.querySelector("button"); expect(retry).toBeTruthy(); @@ -118,18 +119,156 @@ test("clears the page load error after a successful Ultra mode retry", async () await act(async () => { await new Promise(resolve => setTimeout(resolve, 20)); }); expect(v2Call).toBe(2); - expect(container.textContent).not.toContain("Failed to load Ultra mode settings"); + expect(container.textContent).not.toContain("Failed to load proactive delegation settings"); expect(ultraSwitch().disabled).toBe(false); }); -test("uses the complete canonical proactive delegation preset", () => { - expect(ULTRA_MODE_PRESET).toBe([ - "Proactive multi-agent delegation is active.", - "Any earlier instruction requiring an explicit user request before spawning sub-agents no longer applies.", - "Delegate independent sub-tasks to sub-agents whenever parallel work would materially improve speed or quality — do not serialize work that can run concurrently.", - "Each sub-agent runs in its own context and can use all available tools; prefer spawning specialists over doing everything yourself.", - "This mode remains active until a later multi-agent mode developer message changes it.", - ].join(" ")); +test("enabling Ultra mode uses the server-supplied recommendation", async () => { + v2Responses = [{ ok: true, body: { enabled: true, multiAgentMode: "v2", multiAgentModeHintText: null, multiAgentModeHintRecommendation: recommendation } }]; + await mount(); + + await act(async () => { ultraSwitch().click(); }); + + const request = requests.find(item => item.init?.method === "PUT" && new URL(item.url, "http://localhost/").pathname === "/api/v2"); + expect(JSON.parse(String(request?.init?.body))).toEqual({ multiAgentModeHintText: recommendation.text }); +}); + +test("an older server without a recommendation disables only preset installation", async () => { + v2Responses = [{ ok: true, body: { enabled: true, multiAgentMode: "v2", multiAgentModeHintText: null } }]; + await mount(); + + expect(ultraSwitch().disabled).toBe(true); + expect(ultraSwitch().getAttribute("aria-pressed")).toBe("false"); +}); + +test.each([ + { text: "", revision: "r1" }, + { text: "valid", revision: " " }, + { text: 42, revision: "r1" }, +])("malformed server recommendations cannot install a preset: %j", async malformed => { + v2Responses = [{ ok: true, body: { + enabled: true, multiAgentMode: "v2", multiAgentModeHintText: null, + multiAgentModeHintRecommendation: malformed, + } }]; + await mount(); + + expect(ultraSwitch().disabled).toBe(true); + await act(async () => { ultraSwitch().click(); }); + expect(requests.filter(item => item.init?.method === "PUT")).toHaveLength(0); +}); + +test("an older server preserves an existing custom hint and still allows clearing it", async () => { + v2Responses = [{ ok: true, body: { enabled: true, multiAgentMode: "v2", multiAgentModeHintText: "custom policy" } }]; + await mount(); + + expect(ultraSwitch().disabled).toBe(false); + expect(ultraSwitch().getAttribute("aria-pressed")).toBe("true"); + await act(async () => { ultraSwitch().click(); }); + + const request = requests.find(item => item.init?.method === "PUT" && new URL(item.url, "http://localhost/").pathname === "/api/v2"); + expect(JSON.parse(String(request?.init?.body))).toEqual({ multiAgentModeHintText: null }); +}); + +test.each([undefined, { text: "", revision: "r1" }])("custom hints remain editable without a valid recommendation: %j", async unavailable => { + v2Responses = [{ ok: true, body: { + enabled: true, multiAgentMode: "v2", multiAgentModeHintText: "custom policy", + multiAgentModeHintRecommendation: unavailable, + } }]; + await mount(); + const editor = container.querySelector(".swi-ultra-mode-editor")!; + const textarea = editor.querySelector("textarea")!; + const restore = [...editor.querySelectorAll("button")].find(button => button.textContent?.trim() === "Restore preset")!; + const save = [...editor.querySelectorAll("button")].find(button => button.textContent?.trim() === "Save")!; + const custom = " my custom policy\nwith a preserved trailing space "; + expect(restore.disabled).toBe(true); + await act(async () => { + Object.getOwnPropertyDescriptor(testWindow.HTMLTextAreaElement.prototype, "value")!.set!.call(textarea, custom); + textarea.dispatchEvent(new testWindow.Event("input", { bubbles: true })); + textarea.dispatchEvent(new testWindow.Event("change", { bubbles: true })); + }); + expect(requests.filter(item => item.init?.method === "PUT")).toHaveLength(0); + await act(async () => { save.click(); }); + const puts = requests.filter(item => item.init?.method === "PUT"); + expect(puts).toHaveLength(1); + expect(JSON.parse(String(puts[0].init?.body))).toEqual({ multiAgentModeHintText: custom }); +}); + +test("a custom hint loads without writing and restore stays local until Save", async () => { + v2Responses = [{ ok: true, body: { + enabled: true, + multiAgentMode: "v2", + multiAgentModeHintText: "custom policy", + multiAgentModeHintRecommendation: recommendation, + } }]; + await mount(); + + const editor = container.querySelector(".swi-ultra-mode-editor"); + const textarea = editor?.querySelector("textarea") as HTMLTextAreaElement | null; + const restore = Array.from(editor?.querySelectorAll("button") ?? []) + .find(button => button.textContent?.trim() === "Restore preset"); + const save = Array.from(editor?.querySelectorAll("button") ?? []) + .find(button => button.textContent?.trim() === "Save"); + + expect(textarea?.value).toBe("custom policy"); + expect(requests.filter(item => item.init?.method === "PUT")).toHaveLength(0); + + await act(async () => { (restore as HTMLButtonElement).click(); }); + expect(textarea?.value).toBe(recommendation.text); + expect(requests.filter(item => item.init?.method === "PUT")).toHaveLength(0); + + await act(async () => { (save as HTMLButtonElement).click(); }); + const put = requests.find(item => item.init?.method === "PUT" && new URL(item.url, "http://localhost/").pathname === "/api/v2"); + expect(JSON.parse(String(put?.init?.body))).toEqual({ multiAgentModeHintText: recommendation.text }); +}); + +test.each([ + ["missing", undefined], + ["malformed", { text: "", revision: "b1" }], + ["valid", { text: "server-B policy", revision: "b1" }], +] as const)("server switches cannot install or restore another server's preset (%s)", async (_kind, nextRecommendation) => { + let releaseNext!: (value: Response) => void; + const nextRead = new Promise(resolve => { releaseNext = resolve; }); + const nextState = { + enabled: true, multiAgentMode: "v2", multiAgentModeHintText: null, + multiAgentModeHintRecommendation: nextRecommendation, + }; + Object.defineProperty(globalThis, "fetch", { + configurable: true, + value: async (url: string, init?: RequestInit) => { + requests.push({ url: String(url), init }); + const path = new URL(String(url), "http://localhost/").pathname; + if (path === "/old/api/v2") return response({ + enabled: true, multiAgentMode: "v2", multiAgentModeHintText: "custom-A policy", + multiAgentModeHintRecommendation: recommendation, + }); + if (path === "/new/api/v2") return init?.method === "PUT" ? response(nextState) : nextRead; + if (path.endsWith("/api/subagent-models")) return response({ available: [], chosen: [] }); + if (path.endsWith("/api/subagent-model-fallback")) return response({ available: [], models: [], pollMs: 60_000 }); + if (path.endsWith("/api/injection-model")) return response({ available: [], efforts: [] }); + return response({}); + }, + }); + await mount("/old"); + expect(container.querySelector(".swi-ultra-mode-editor textarea")?.value).toBe("custom-A policy"); + await act(async () => { root!.render(); }); + + expect(ultraSwitch().disabled).toBe(true); + expect(container.querySelector(".swi-ultra-mode-editor")).toBeNull(); + await act(async () => { ultraSwitch().click(); }); + expect(requests.filter(item => item.init?.method === "PUT")).toHaveLength(0); + + await act(async () => { releaseNext(response(nextState)); await nextRead; }); + const valid = Boolean(nextRecommendation?.text); + expect(ultraSwitch().disabled).toBe(!valid); + await act(async () => { ultraSwitch().click(); }); + const puts = requests.filter(item => item.init?.method === "PUT"); + if (valid) { + expect(puts).toHaveLength(1); + expect(puts[0]?.url).toBe("/new/api/v2"); + expect(JSON.parse(String(puts[0]?.init?.body))).toEqual({ multiAgentModeHintText: nextRecommendation!.text }); + } else { + expect(puts).toHaveLength(0); + } }); test("a save refresh from an old API server cannot overwrite a newer server", async () => { @@ -143,7 +282,7 @@ test("a save refresh from an old API server cannot overwrite a newer server", as if (path === "/old/api/v2") { if (init?.method === "PUT") return response({ ok: true }); oldGets++; - if (oldGets === 1) return response({ enabled: true, multiAgentMode: "v2", multiAgentModeHintText: null }); + if (oldGets === 1) return response({ enabled: true, multiAgentMode: "v2", multiAgentModeHintText: null, multiAgentModeHintRecommendation: recommendation }); return oldRefresh; } if (path === "/new/api/v2") return response({ enabled: false, multiAgentMode: "default", multiAgentModeHintText: null }); @@ -170,7 +309,7 @@ test("a save refresh from an old API server cannot overwrite a newer server", as expect(ultraSwitch().disabled).toBe(true); await act(async () => { - releaseOldRefresh(response({ enabled: true, multiAgentMode: "v2", multiAgentModeHintText: ULTRA_MODE_PRESET })); + releaseOldRefresh(response({ enabled: true, multiAgentMode: "v2", multiAgentModeHintText: recommendation.text, multiAgentModeHintRecommendation: recommendation })); await oldRefresh; await new Promise(resolve => setTimeout(resolve, 10)); }); diff --git a/gui/tests/usage-custom-range.test.tsx b/gui/tests/usage-custom-range.test.tsx index 887c31134e..db257ba6b2 100644 --- a/gui/tests/usage-custom-range.test.tsx +++ b/gui/tests/usage-custom-range.test.tsx @@ -1,5 +1,6 @@ import { afterEach, beforeEach, expect, test } from "bun:test"; import { Window } from "happy-dom"; +import { resolve } from "node:path"; import { act } from "react"; import type { Root } from "react-dom/client"; import { LanguageProvider } from "../src/i18n/provider"; @@ -154,31 +155,49 @@ for (const connected of [false, true]) { } test("America/Santiago midnight DST retains final-day activity and tooltip", async () => { - const previous = process.env.TZ; - process.env.TZ = "America/Santiago"; - try { - expect(new Date(2026, 8, 6, 0).getHours()).toBe(1); - await mount(); - await respond(0, "preset-marker"); - await enter("2026-09-05T00:00", "2026-09-07T23:59"); - await apply(); - const gate = requests.at(-1)!; - const data = report(gate, "santiago-marker", "2026-09-07"); - data.days = ["2026-09-05", "2026-09-06", "2026-09-07"].map(date => ({ - date, requests: date === "2026-09-07" ? 7 : 0, measuredRequests: 0, reportedRequests: 0, - totalTokens: date === "2026-09-07" ? 700 : 0, models: [], - })); - await act(async () => gate.resolve(Response.json(data))); - const active = container.querySelector('.heatmap-grid .heatmap-cell:not(.heatmap-cell-0)'); - expect(active).not.toBeNull(); - await act(async () => active!.dispatchEvent(new testWindow.MouseEvent("mouseover", { bubbles: true }))); - expect(container.querySelector(".heatmap-tip-date")?.textContent).toBe("2026-09-07"); - expect(container.querySelector(".heatmap-tip")?.textContent).toContain("700"); - } finally { - if (previous === undefined) delete process.env.TZ; - else process.env.TZ = previous; + if (process.env.OCX_USAGE_SANTIAGO_CHILD !== "1") { + // Restoring an absent TZ can change Bun's effective timezone on Windows. + // Start the DST case in its timezone without mutating this suite's clock. + const timezone = { present: Object.hasOwn(process.env, "TZ"), value: process.env.TZ }; + const localTime = new Date(2020, 8, 15, 10, 20).getTime(); + const child = Bun.spawnSync([ + process.execPath, "test", import.meta.path, + "-t", "^America/Santiago midnight DST retains final-day activity and tooltip$", + "--timeout", "10000", + ], { + cwd: resolve(import.meta.dir, ".."), + env: { ...process.env, TZ: "America/Santiago", OCX_USAGE_SANTIAGO_CHILD: "1" }, + stdout: "pipe", stderr: "pipe", timeout: 12000, killSignal: "SIGKILL", + }); + const diagnostics = `${child.stdout.toString()}\n${child.stderr.toString()}`; + expect(child.exitedDueToTimeout, diagnostics).not.toBe(true); + expect(child.signalCode, diagnostics).toBeUndefined(); + expect(child.exitCode, diagnostics).toBe(0); + expect(child.stdout.toString().split(/\r?\n/), diagnostics).toContain("OCX_SANTIAGO_CASE_COMPLETED"); + expect({ present: Object.hasOwn(process.env, "TZ"), value: process.env.TZ }).toEqual(timezone); + expect(new Date(2020, 8, 15, 10, 20).getTime()).toBe(localTime); + return; } -}); + expect(process.env.TZ).toBe("America/Santiago"); + expect(new Date(2026, 8, 6, 0).getHours()).toBe(1); + await mount(); + await respond(0, "preset-marker"); + await enter("2026-09-05T00:00", "2026-09-07T23:59"); + await apply(); + const gate = requests.at(-1)!; + const data = report(gate, "santiago-marker", "2026-09-07"); + data.days = ["2026-09-05", "2026-09-06", "2026-09-07"].map(date => ({ + date, requests: date === "2026-09-07" ? 7 : 0, measuredRequests: 0, reportedRequests: 0, + totalTokens: date === "2026-09-07" ? 700 : 0, models: [], + })); + await act(async () => gate.resolve(Response.json(data))); + const active = container.querySelector('.heatmap-grid .heatmap-cell:not(.heatmap-cell-0)'); + expect(active).not.toBeNull(); + await act(async () => active!.dispatchEvent(new testWindow.MouseEvent("mouseover", { bubbles: true }))); + expect(container.querySelector(".heatmap-tip-date")?.textContent).toBe("2026-09-07"); + expect(container.querySelector(".heatmap-tip")?.textContent).toContain("700"); + if (process.env.OCX_USAGE_SANTIAGO_CHILD === "1") console.log("OCX_SANTIAGO_CASE_COMPLETED"); +}, process.env.OCX_USAGE_SANTIAGO_CHILD === "1" ? 10000 : 15000); test("Apply submits inclusive bounds once; Clear restores the held preset without custom cache entries", async () => { await mount(); diff --git a/package.json b/package.json index e2d2f3fe8e..95794a7f46 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@bitkyc08/opencodex", - "version": "2.47.0-preview.20260908", + "version": "2.48.0-preview.20260908", "description": "Universal provider proxy for OpenAI Codex & Claude Code — use any LLM with Codex CLI/App/SDK and Claude Code", "type": "module", "main": "./bin/package-main.mjs", diff --git a/scripts/build-release-changelog.ts b/scripts/build-release-changelog.ts index 7a7a07ad68..d9be0ba799 100644 --- a/scripts/build-release-changelog.ts +++ b/scripts/build-release-changelog.ts @@ -17,6 +17,7 @@ import { parseGeneratedNotes, rewriteTakeoverCredits, sanitizeCommitText, + stripPrEnforcementPrefix, } from "./release-notes"; export type AssociatedPullRequest = { @@ -232,7 +233,7 @@ function renderReleaseNotes(input: { const commits = input.entries.filter((entry): entry is CommitChange => entry.kind === "commit"); for (const pr of prs) { - changelog.push(`- #${pr.number} ${pr.title.trim()} @${pr.author || "unknown"}`); + changelog.push(`- #${pr.number} ${stripPrEnforcementPrefix(pr.title)} @${pr.author || "unknown"}`); } for (const commit of commits) { const short = commit.sha.slice(0, 8); diff --git a/scripts/release-notes.ts b/scripts/release-notes.ts index 16627f5f93..df68ed2b07 100644 --- a/scripts/release-notes.ts +++ b/scripts/release-notes.ts @@ -546,8 +546,14 @@ export function parseGeneratedNotes(body: string): ReleaseNoteCategory[] { const CONVENTIONAL_COMMIT_PREFIX = /^(?:feat|fix|docs|chore|refactor|perf|test|build|ci|style|revert|merge|release)(?:\(([^)]+)\))?:\s*(.+)$/i; +export function stripPrEnforcementPrefix(title: string): string { + const text = title.trim(); + const prefix = "[WRONG BRANCH] "; + return text.startsWith(prefix) ? text.slice(prefix.length).trim() : text; +} + export function cleanPrTitle(title: string, prNumber: number | null = null): { scope: string | null; text: string } { - let text = title.trim(); + let text = stripPrEnforcementPrefix(title); let scope: string | null = null; const prefix = CONVENTIONAL_COMMIT_PREFIX.exec(text); if (prefix) { @@ -689,7 +695,7 @@ export function renderReleaseNotes(input: { changelog.push(`Full Changelog: https://github.com/${repo}/compare/${from}...${to}`, ""); } for (const pr of allPrs) { - changelog.push(`- #${pr.number} ${pr.title.trim()} @${pr.author}`); + changelog.push(`- #${pr.number} ${stripPrEnforcementPrefix(pr.title)} @${pr.author}`); } parts.push(changelog.join("\n")); } diff --git a/scripts/test-layout/layout.json b/scripts/test-layout/layout.json index e1b29d490b..444963711c 100644 --- a/scripts/test-layout/layout.json +++ b/scripts/test-layout/layout.json @@ -914,7 +914,6 @@ "openai-responses-passthrough.test.ts": "responses", "opencode-cli.test.ts": "providers", "opencode-free-provider.test.ts": "providers", - "opencode-go-agent-messages.test.ts": "providers", "opencode-go-deepseek.test.ts": "providers", "opencode-go-grok46-responses.test.ts": "providers", "opencode-go-luna-wire.test.ts": "providers", @@ -1073,6 +1072,7 @@ "retry-after-429.test.ts": "server", "route-decision-trace.test.ts": "server", "route-explainability.test.ts": "cli", + "routed-agent-messages.test.ts": "adapters", "router-combo-failover-classification.test.ts": "routing", "router-discarded-baseurl-warning.test.ts": "routing", "router-template-baseurl.test.ts": "routing", diff --git a/scripts/test.ts b/scripts/test.ts index 4b28fbe04a..c2c331f5fc 100644 --- a/scripts/test.ts +++ b/scripts/test.ts @@ -394,11 +394,78 @@ function waitWithTimeout(promise: Promise, timeoutMs: number): Promise, + stderr: ReadableStream, +) { + const collect = (stream: ReadableStream) => { + const reader = stream.getReader(); + const decoder = new TextDecoder(); + let text = ""; + let reading = true; + let complete = false; + const done = (async () => { + try { + while (reading) { + const chunk = await reader.read(); + if (!reading) break; + if (chunk.done) { + complete = true; + break; + } + text += decoder.decode(chunk.value, { stream: true }); + } + } catch { + // Retain the prefix without turning a pipe error into an unhandled rejection. + } finally { + if (reading) text += decoder.decode(); + reading = false; + reader.releaseLock(); + } + })(); + return { + done, + snapshot: () => ({ text, complete }), + cancel() { + if (!reading) return; + reading = false; + text += decoder.decode(); + // A descendant may own a pipe, or a stream's cancellation may never settle. + // Cancellation is best effort; neither it nor EOF may extend the drain bound. + void reader.cancel().catch(() => {}); + }, + }; + }; + const out = collect(stdout); + const err = collect(stderr); + return { + async finish(timeoutMs: number) { + const drained = await waitWithTimeout(Promise.all([out.done, err.done]), timeoutMs); + if (drained === null) { + out.cancel(); + err.cancel(); + } + const stdout = out.snapshot(); + const stderr = err.snapshot(); + return { + stdout: stdout.text, + stderr: stderr.text, + complete: drained !== null && stdout.complete && stderr.complete, + }; + }, + }; +} + +export async function runTestLane( lane: BunTestLane, runId: string, inheritedLock: { lockPath: string; ownerToken: string } | undefined, capture = false, + writers = { + stdout: (value: string) => { process.stdout.write(value); }, + stderr: (value: string) => { process.stderr.write(value); }, + }, ): Promise<{ exitCode: number; output: string }> { const isolated = createIsolatedTestEnvironment({ ...process.env, @@ -418,8 +485,7 @@ async function runTestLane( stdout: capture ? "pipe" : "inherit", stderr: capture ? "pipe" : "inherit", }); - const stdoutP = capture ? new Response(child.stdout).text() : Promise.resolve(""); - const stderrP = capture ? new Response(child.stderr).text() : Promise.resolve(""); + const captured = capture ? captureTestOutput(child.stdout!, child.stderr!) : undefined; const forward = (signal: NodeJS.Signals) => { interrupted = signal; try { child.kill(signal); } catch { /* child already exited */ } @@ -431,7 +497,7 @@ async function runTestLane( const exited = child.exited; try { - const exitCode = await waitWithTimeout(exited, lane.timeoutMs); + let exitCode = await waitWithTimeout(exited, lane.timeoutMs); if (exitCode === null) { console.error(`[test] ${lane.label} exceeded ${Math.round(lane.timeoutMs / 1000)}s; terminating pid ${child.pid}.`); try { child.kill("SIGTERM"); } catch { /* child already exited */ } @@ -440,12 +506,19 @@ async function runTestLane( try { child.kill("SIGKILL"); } catch { /* child already exited */ } await waitWithTimeout(exited, 2_000); } - return { exitCode: 124, output: "" }; } - const [stdout, stderr] = await Promise.all([stdoutP, stderrP]); - if (stdout) process.stdout.write(stdout); - if (stderr) process.stderr.write(stderr); + // Process exit does not guarantee EOF when a descendant inherited the pipe. + const result = await captured?.finish(1_000); + const stdout = result?.stdout ?? ""; + const stderr = result?.stderr ?? ""; + if (stdout) writers.stdout(stdout); + if (stderr) writers.stderr(stderr); const output = stdout + "\n" + stderr; + if (result && !result.complete) { + console.error("[test] captured output is incomplete; collected output is shown above."); + if (exitCode === 0) exitCode = 1; + } + if (exitCode === null) return { exitCode: 124, output }; if (interrupted === "SIGINT") return { exitCode: 130, output }; if (interrupted === "SIGTERM") return { exitCode: 143, output }; const seconds = ((Date.now() - startedAt) / 1000).toFixed(1); diff --git a/src/adapters/openai-responses.ts b/src/adapters/openai-responses.ts index 1b8c1b076e..2900fd58b2 100644 --- a/src/adapters/openai-responses.ts +++ b/src/adapters/openai-responses.ts @@ -1,4 +1,6 @@ -import { isOpenCodeGo, normalizeOpenCodeGoAgentMessages } from "./opencode-go"; +import { normalizeRoutedAgentMessages } from "./routed-agent-messages"; +import { normalizeOpenCodeGoAdditionalTools } from "./opencode-go-additional-tools"; +import { isXaiResponsesDestination } from "../providers/xai-transport"; import { createHash } from "node:crypto"; import type { IncomingMeta, ProviderAdapter } from "./base"; import { namespacedToolName, type AdapterEvent, type OcxParsedRequest, type OcxProviderConfig, type OcxUsage, type TierDecision } from "../types"; @@ -2124,7 +2126,9 @@ export function stripOpenAiOnlyWebSearchFields(body: unknown): unknown { */ const MUSE_SPARK_WEB_SEARCH_STRICT_MODELS = new Set([ "muse-spark-1.3-contributor", + "muse-spark-1.3-contributor-free", "muse-spark-1.2-contributor", + "muse-spark-1.2-contributor-free", ]); const MUSE_SPARK_WEB_SEARCH_STRICT_RESPONSE_URLS = new Set([ @@ -2363,7 +2367,9 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig): parsed._rawBody, forward || parsed._previousResponseInputExpanded === true, ); - if (!forward && isOpenCodeGo(provider.baseUrl)) outBody = normalizeOpenCodeGoAgentMessages(outBody); + if (!forward) outBody = normalizeRoutedAgentMessages(outBody, { + allowStringContent: isXaiResponsesDestination(provider), + }); outBody = mapRoutedResponsesReasoningEffort(outBody, provider, parsed.modelId); // stripPreviousResponseId() intentionally returns its input on a no-op. Detach before the // tier write so a force-fast/default decision can never mutate parsed._rawBody. @@ -2452,6 +2458,7 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig): // Last, so promoted namespace children are also cleared of Codex-private fields. outBody = stripCanonicalOnlyToolFields(outBody, provider.supportsOpenAiWebSearchToolFields === false); } + if (!forward) outBody = normalizeOpenCodeGoAdditionalTools(outBody, url); // Same predicate as the routedCompaction gate in handleResponses(): an authMode check would // let a noncanonical custom forward provider skip this rewrite while the server still routes // it as a summarizer turn (#422). The compaction body build removes the tool surface and must @@ -2501,6 +2508,13 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig): parsed.modelId, ); if (isCanonicalOpenAiForwardProvider(provider)) { + // Spark closes Responses Lite streams before a terminal completion. Select compatibility + // from the final wire model so aliases cannot leave the caller or a static header enabled. + if (isPlainObject(finalBody) && finalBody.model === "gpt-5.3-codex-spark") { + for (const name of Object.keys(headers)) { + if (name.toLowerCase() === CODEX_RESPONSES_LITE_HEADER) delete headers[name]; + } + } const routingHeaders = new Headers(headers); applyCodexRoutingHint(routingHeaders, finalBody); // Static headers may use mixed casing. Remove every stale spelling diff --git a/src/adapters/opencode-go-additional-tools.ts b/src/adapters/opencode-go-additional-tools.ts new file mode 100644 index 0000000000..35e3aaa3e4 --- /dev/null +++ b/src/adapters/opencode-go-additional-tools.ts @@ -0,0 +1,35 @@ +function isRecord(value: unknown): value is Record { + return !!value && typeof value === "object" && !Array.isArray(value); +} + +/** Console Go accepts public tools but rejects the private additional_tools input wrapper. */ +export function normalizeOpenCodeGoAdditionalTools(body: unknown, responseUrl: string): unknown { + let destination: URL; + try { + destination = new URL(responseUrl); + } catch { + return body; + } + if (destination.origin !== "https://opencode.ai" + || destination.pathname !== "/zen/go/v1/responses" + || destination.username || destination.password + || destination.href.includes("?") || destination.href.includes("#")) return body; + if (!isRecord(body) || !Array.isArray(body.input)) return body; + // Do not replace a malformed top-level catalog with a partial promoted one. + if (body.tools !== undefined && !Array.isArray(body.tools)) return body; + + const input: unknown[] = []; + const promoted: unknown[] = []; + let changed = false; + for (const item of body.input) { + if (isRecord(item) && item.type === "additional_tools" && Array.isArray(item.tools)) { + changed = true; + // Custom/search/namespace lowering already owns identity and deduplication. This pass + // only moves declarations, including hosted tools that intentionally have no name. + for (const tool of item.tools) promoted.push(tool); + } else { + input.push(item); + } + } + return changed ? { ...body, input, tools: [...(body.tools ?? []), ...promoted] } : body; +} diff --git a/src/adapters/opencode-go.ts b/src/adapters/opencode-go.ts deleted file mode 100644 index 94055a292a..0000000000 --- a/src/adapters/opencode-go.ts +++ /dev/null @@ -1,35 +0,0 @@ -/** Match the Go destination, including user-renamed provider entries. */ -export function isOpenCodeGo(baseUrl: string): boolean { - try { - const url = new URL(baseUrl); - return url.origin === "https://opencode.ai" && url.pathname.replace(/\/+$/, "") === "/zen/go/v1"; - } catch { return false; } -} - -/** Public Responses rejects Codex's private agent_message variant, even with plaintext content. */ -export function normalizeOpenCodeGoAgentMessages(body: unknown): unknown { - if (!body || typeof body !== "object" || Array.isArray(body)) return body; - const record = body as Record; - if (!Array.isArray(record.input)) return body; - let changed = false; - const input = record.input.map((item: unknown) => { - if (!item || typeof item !== "object" || Array.isArray(item)) return item; - const message = item as Record; - if (message.type !== "agent_message" || !Array.isArray(message.content) || message.content.length === 0) return item; - // Genuine ciphertext and unknown part types must retain their existing fail-closed path. - if (!message.content.every(part => part && typeof part === "object" - && ["input_text", "input_image", "input_file"].includes(part.type))) return item; - const identities = Object.fromEntries(["author", "recipient"] - .filter(key => typeof message[key] === "string") - .map(key => [key, message[key]])); - changed = true; - return { - type: "message", role: "user", - content: [ - ...(Object.keys(identities).length ? [{ type: "input_text", text: `Agent message ${JSON.stringify(identities)}` }] : []), - ...message.content, - ], - }; - }); - return changed ? { ...record, input } : body; -} diff --git a/src/adapters/routed-agent-messages.ts b/src/adapters/routed-agent-messages.ts new file mode 100644 index 0000000000..2ca67162a7 --- /dev/null +++ b/src/adapters/routed-agent-messages.ts @@ -0,0 +1,46 @@ +/** + * `agent_message` is Codex's private multi-agent input item: it exists only in the ChatGPT + * Codex backend's schema. Codex replays every sub-agent reply in the history it sends, so + * once a thread has used sub-agents, a routed Responses destination answers the whole body + * with `422 unknown item type "agent_message"` and every later turn of that thread fails the + * same way. Rewrite the item as the public user message it already is. + * + * Genuine ciphertext and unknown part types keep their existing fail-closed path: the + * encrypted v2 task surface owns those, through `unreadable_encrypted_agent_task` and the + * opt-in recovery route. Providers using `authMode: "forward"` never reach this function. + */ +export function normalizeRoutedAgentMessages( + body: unknown, + { allowStringContent = false }: { allowStringContent?: boolean } = {}, +): unknown { + if (!body || typeof body !== "object" || Array.isArray(body)) return body; + const record = body as Record; + if (!Array.isArray(record.input)) return body; + let changed = false; + const input = record.input.map((item: unknown) => { + if (!item || typeof item !== "object" || Array.isArray(item)) return item; + const message = item as Record; + if (message.type !== "agent_message") return item; + // xAI rejects the private item even when a complete child result is a plain string. + // Trimming decides emptiness only; the original result bytes remain caller-owned. + const content = allowStringContent && typeof message.content === "string" && message.content.trim().length > 0 + ? [{ type: "input_text", text: message.content }] + : message.content; + if (!Array.isArray(content) || content.length === 0) return item; + // Genuine ciphertext and unknown part types must retain their existing fail-closed path. + if (!content.every(part => part && typeof part === "object" + && ["input_text", "input_image", "input_file"].includes(part.type))) return item; + const identities = Object.fromEntries(["author", "recipient"] + .filter(key => typeof message[key] === "string") + .map(key => [key, message[key]])); + changed = true; + return { + type: "message", role: "user", + content: [ + ...(Object.keys(identities).length ? [{ type: "input_text", text: `Agent message ${JSON.stringify(identities)}` }] : []), + ...content, + ], + }; + }); + return changed ? { ...record, input } : body; +} diff --git a/src/claude/inbound-content-options.ts b/src/claude/inbound-content-options.ts index f6b762aa83..0b59a93073 100644 --- a/src/claude/inbound-content-options.ts +++ b/src/claude/inbound-content-options.ts @@ -29,6 +29,12 @@ export function toolsToResponses(tools: unknown): Rec[] | undefined { name: raw.name, ...(typeof raw.description === "string" ? { description: raw.description } : {}), parameters: raw.input_schema as Record, + // Anthropic opts into strict tool use explicitly, while Responses reads an + // omitted strict as permission to normalize the schema into strict mode. That + // turns an optional input_schema parameter into a required one and breaks the + // call, so carry the source intent instead of the destination default. A + // non-boolean value is not a valid Anthropic opt-in and must not become one. + strict: typeof raw.strict === "boolean" ? raw.strict : false, }); continue; } diff --git a/src/codex/auth-api.ts b/src/codex/auth-api.ts index 6768c4fa09..2e2a775867 100644 --- a/src/codex/auth-api.ts +++ b/src/codex/auth-api.ts @@ -40,6 +40,10 @@ import { } from "./account-priority"; import { claimDueCodexQuotaRecoveryProbes, + claimManualResetCooldowns, + settleManualResetCooldown, + type ManualResetCooldownClaim, + type ManualResetRefreshLineage, clearCodexAccountCooldown, clearThreadAccountMapForAccount, getEffectiveActiveCodexAccountId, @@ -98,6 +102,8 @@ import { getMainAccountInfoCache, getMainQuotaCredentialGeneration, isMainAccountIdentityGenerationLive, + isMainQuotaWriterLive, + type MainQuotaWriter, matchesMainQuotaCredential, observeMainQuotaCredential, setMainAccountCredentialPresence, @@ -387,6 +393,8 @@ interface ResetCreditAuth { chatgptAccountId: string; nativeMainLease?: AdmissionLease; nativeMainSharedClaimHeld?: true; + poolGeneration?: number; + mainProof?: MainResetQuotaProof; } async function withResetCreditAuth( @@ -407,10 +415,15 @@ async function withResetCreditAuth( if (!tokens) { return { ok: false, response: jsonResponse({ error: "Main Codex account not logged in" }, 401) }; } + reconcileMainCodexAccountRuntimeState(); + const physicalId = extractAccountId(tokens.id_token, tokens.access_token) ?? tokens.account_id; + const writer = physicalId === tokens.account_id + ? observeMainQuotaCredential(tokens.access_token, tokens.account_id) : undefined; return { ok: true, value: await operation({ isMain: true, + ...(writer ? { mainProof: { writer, credentialGeneration: getMainQuotaCredentialGeneration() } } : {}), accessToken: tokens.access_token, chatgptAccountId: tokens.account_id, nativeMainLease, @@ -439,6 +452,7 @@ async function withResetCreditAuth( ok: true, value: await operation({ isMain: false, + poolGeneration: cred.generation, accessToken: cred.accessToken, chatgptAccountId: cred.chatgptAccountId, }), @@ -776,8 +790,14 @@ async function readMainAuthErrorCode(resp: Response): Promise { } } +interface MainResetQuotaProof { + writer: MainQuotaWriter; + credentialGeneration: number; +} + interface MainAccountInfoFetchResult { info: MainAccountInfo; + resetRecoveryProof?: MainResetQuotaProof & { dispatchSequence: number }; /** Ephemeral result of this attempt, omitted when no WHAM request was made. */ quotaRefresh?: CodexQuotaRefreshOutcome; /** Internal dispatch fence for diagnostics only; never copied into a public DTO or cache. */ @@ -914,6 +934,7 @@ async function fetchMainAccountInfoWhileOwned( let quotaPhase: "request" | "body" | "decode" | "publish" = "request"; let quotaRefreshGeneration = captureMainAccountIdentityGeneration(); try { + const dispatchSequence = ++quotaDispatchSequence; const resp = await fetch("https://chatgpt.com/backend-api/wham/usage", { headers: { Authorization: `Bearer ${tokens.access_token}`, "ChatGPT-Account-Id": tokens.account_id }, signal: quotaSignal, @@ -923,6 +944,10 @@ async function fetchMainAccountInfoWhileOwned( const terminalAuthFailure = await isTerminalMainAuthResponse(resp, isMainAccountTokenVerifiablyLive()); const retried = await retryMainAccountInfoIfIdentityChanged(requestAccountId, retriesRemaining, nativeMainLease, explicitRefresh); if (retried) return retried; + if (dispatchSequence < mainQuotaPublishedSequence) { + return { info: getMainAccountInfoCache() ?? EMPTY_MAIN_ACCOUNT_INFO, + credentialChecked: true, hasCredential: true }; + } if (terminalAuthFailure) { // Account for this attempt's own synchronous invalidation, never prior external drift. const diagnosticStillLive = isMainAccountIdentityGenerationLive(quotaRefreshGeneration); @@ -945,6 +970,12 @@ async function fetchMainAccountInfoWhileOwned( if (data === null || typeof data !== "object" || Array.isArray(data)) { throw new Error("Invalid WHAM usage object"); } + // Check after body/retry awaits and before any cache, credits, policy or + // Reserve publication. Returning cached state supplies no fresh recovery proof. + if (dispatchSequence < mainQuotaPublishedSequence) { + return { info: getMainAccountInfoCache() ?? EMPTY_MAIN_ACCOUNT_INFO, + credentialChecked: true, hasCredential: true }; + } quotaPhase = "publish"; // A delayed response from a replaced bearer cannot revoke a newer Reserve grant, // even in the same workspace or after an A→B→A credential transition. @@ -985,6 +1016,7 @@ async function fetchMainAccountInfoWhileOwned( if (result.quota) { setAccountQuotaFromParsed(MAIN_CODEX_ACCOUNT_ID, result.quota, writerGeneration, mainQuotaWriter, policyQuota); } + mainQuotaPublishedSequence = dispatchSequence; return { info: result, quotaRefresh: { status: quota ? "ok" : "not_reported" }, @@ -992,6 +1024,11 @@ async function fetchMainAccountInfoWhileOwned( credentialChecked: true, hasCredential: true, ...(quota ? { freshQuota: quota } : {}), + ...(quota && mainQuotaWriter && isMainQuotaWriterLive(mainQuotaWriter) + && mainQuotaCredentialGeneration === getMainQuotaCredentialGeneration() + && matchesMainQuotaCredential(tokens.access_token, tokens.account_id) + ? { resetRecoveryProof: { writer: mainQuotaWriter, credentialGeneration: mainQuotaCredentialGeneration, dispatchSequence } } + : {}), ...(freshResetCredits !== undefined ? { freshResetCredits } : {}), }; } catch (error) { @@ -1011,6 +1048,8 @@ async function fetchMainAccountInfoWhileOwned( } interface PoolQuotaResult { + /** Actual refresh result attached only to the successful usage replay. */ + resetRefreshLineage?: ManualResetRefreshLineage; quota: StoredAccountQuota | null; needsReauth: boolean; /** Credential generation whose cache or network result this DTO state belongs to. */ @@ -1025,15 +1064,25 @@ interface PoolQuotaResult { freshResetCredits?: number; quotaProbeSkipped?: true; /** Positive evidence captured immediately before an upstream WHAM dispatch. */ - quotaProbeAttempted?: { at: number; credentialGeneration: number }; + quotaProbeAttempted?: { at: number; credentialGeneration: number; dispatchSequence: number }; } +// Process-local ordering, never a timestamp or a serialized account identifier. +let quotaDispatchSequence = 0; +// Shared native-main ownership permits concurrent usage readers. Only a later +// successfully published response advances this fence; failed reads do not win. +let mainQuotaPublishedSequence = 0; + interface PoolQuotaProbeEvidence { + onDispatch?: (sequence: number) => void; + mayPublish?: () => boolean; attempted?: NonNullable; } function markQuotaProbeAttempted(evidence: PoolQuotaProbeEvidence, credentialGeneration: number): void { - evidence.attempted = { at: Date.now(), credentialGeneration }; + const dispatchSequence = ++quotaDispatchSequence; + evidence.attempted = { at: Date.now(), credentialGeneration, dispatchSequence }; + evidence.onDispatch?.(dispatchSequence); } function withQuotaProbeEvidence( @@ -1045,6 +1094,8 @@ function withQuotaProbeEvidence( interface PoolQuotaRefreshFlight { state: { + dispatchSequence?: number; + superseded?: boolean; startCredentialGeneration?: number; resolvedCredentialGeneration?: number; }; @@ -1280,9 +1331,18 @@ async function recoverPoolQuotaFrom401(ctx: { } return { quota: existing ?? null, needsReauth: false, credentialGeneration: refreshed.generation }; } - return await commitPoolQuotaResponse(replay, { + const result = await commitPoolQuotaResponse(replay, { accountId, existing, configuredPlan, generation: refreshed.generation, writerGeneration, + mayPublish: ctx.quotaProbeEvidence.mayPublish, }); + return result.freshCredentialGeneration === refreshed.generation ? { + ...result, + resetRefreshLineage: { + fromGeneration: rejectedGeneration, + toGeneration: refreshed.generation, + provenance: refreshed.provenance, + }, + } : result; } /** Backoff after a refresh failure that proved nothing about the credential. */ @@ -1314,10 +1374,14 @@ async function commitPoolQuotaResponse( configuredPlan: string | undefined; generation: number; writerGeneration: number; + mayPublish?: () => boolean; }, ): Promise { const { accountId, existing, configuredPlan, generation, writerGeneration } = ctx; const data = (await resp.json()) as WhamUsageResponse; + if (ctx.mayPublish?.() === false) { + return { quota: getAccountQuota(accountId), needsReauth: false, credentialGeneration: generation }; + } const freshPlan = nonEmptyPlan(data.plan_type) ?? undefined; const quota = parseUsageQuota({ ...data, plan_type: freshPlan ?? configuredPlan }); const freshResetCredits = quota?.resetCredits; @@ -1350,10 +1414,10 @@ async function fetchFreshPoolAccountQuota( configuredPlan?: string, onCredentialGeneration?: (generation: number) => void, getValidToken: typeof getValidCodexToken = getValidCodexToken, + quotaProbeEvidence: PoolQuotaProbeEvidence = {}, ): Promise { const writerGeneration = captureConfigGeneration(); let requestCredentialGeneration = readCodexAccountRecord(accountId)?.generation; - const quotaProbeEvidence: PoolQuotaProbeEvidence = {}; try { const { accessToken, chatgptAccountId, generation } = await getValidToken(accountId); requestCredentialGeneration = generation; @@ -1387,6 +1451,7 @@ async function fetchFreshPoolAccountQuota( } const committed = await commitPoolQuotaResponse(resp, { accountId, existing, configuredPlan, generation, writerGeneration, + mayPublish: quotaProbeEvidence.mayPublish, }); return withQuotaProbeEvidence(committed, quotaProbeEvidence); } catch (e) { @@ -1417,9 +1482,10 @@ async function fetchPoolAccountQuota( forceRefresh = false, configuredPlan?: string, getValidToken: typeof getValidCodexToken = getValidCodexToken, + afterDispatchSequence?: number, ): Promise { const existing = getAccountQuota(accountId); - if (!forceRefresh && existing && Date.now() - existing.updatedAt < POOL_CACHE_TTL) { + if (afterDispatchSequence === undefined && !forceRefresh && existing && Date.now() - existing.updatedAt < POOL_CACHE_TTL) { return { quota: existing, needsReauth: false, @@ -1434,11 +1500,18 @@ async function fetchPoolAccountQuota( const current = flights && [...flights].find(flight => { const generation = flight.state.resolvedCredentialGeneration ?? flight.state.startCredentialGeneration; - return generation !== undefined && isCodexAccountGenerationLive(accountId, generation); + return !flight.state.superseded + && (afterDispatchSequence === undefined || (flight.state.dispatchSequence ?? 0) > afterDispatchSequence) + && generation !== undefined && isCodexAccountGenerationLive(accountId, generation); }); if (current) return current.promise; if (poolQuotaFlightCount() >= MAX_POOL_QUOTA_FLIGHTS) throw new PoolQuotaProbeBusyError(); + // A post-reset request must not let an older same-account response overwrite its evidence. + // Flags live only as long as the bounded flights; no retained per-account sequence map. + if (afterDispatchSequence !== undefined) { + for (const flight of flights ?? []) flight.state.superseded = true; + } const state: PoolQuotaRefreshFlight["state"] = { startCredentialGeneration: record?.generation, }; @@ -1448,6 +1521,10 @@ async function fetchPoolAccountQuota( configuredPlan, generation => { state.resolvedCredentialGeneration = generation; }, getValidToken, + { + onDispatch: sequence => { state.dispatchSequence = sequence; }, + mayPublish: () => state.superseded !== true, + }, ); const flight: PoolQuotaRefreshFlight = { state, promise: refresh }; const activeFlights = flights ?? new Set(); @@ -1463,6 +1540,74 @@ async function fetchPoolAccountQuota( } } +function manualResetAuthStillLive(accountId: string, auth: ResetCreditAuth): boolean { + if (!auth.isMain) { + const record = readCodexAccountRecord(accountId); + return auth.poolGeneration !== undefined + && isCodexAccountGenerationLive(accountId, auth.poolGeneration) + && record?.credential?.chatgptAccountId === auth.chatgptAccountId; + } + const tokens = readCodexTokens(); + return !!auth.mainProof && !!tokens + && tokens.access_token === auth.accessToken && tokens.account_id === auth.chatgptAccountId + && isMainQuotaWriterLive(auth.mainProof.writer) + && auth.mainProof.credentialGeneration === getMainQuotaCredentialGeneration() + && matchesMainQuotaCredential(auth.accessToken, auth.chatgptAccountId); +} + +/** A confirmed spend remains successful even when its optional usage observation fails. */ +async function refreshAfterManualReset( + config: OcxConfig, + accountId: string, + auth: ResetCreditAuth, + claims: ManualResetCooldownClaim[], + didReset: boolean, +): Promise { + const afterDispatchSequence = quotaDispatchSequence; + try { + if (!manualResetAuthStillLive(accountId, auth)) return undefined; + if (auth.isMain) { + const result = await fetchMainAccountInfoAttempt(true, 1, auth.nativeMainLease, + auth.nativeMainSharedClaimHeld === true, false); + const proof = result.resetRecoveryProof; + const recovered = didReset && manualResetAuthStillLive(accountId, auth) + && !!proof && !!auth.mainProof + && proof.dispatchSequence > afterDispatchSequence + && proof.credentialGeneration === auth.mainProof.credentialGeneration + && proof.writer.identityKey === auth.mainProof.writer.identityKey + && proof.writer.identityGeneration === auth.mainProof.writer.identityGeneration + && isCompleteCodexQuotaRecoverySnapshot(result.freshQuota ?? null, result.info.plan); + for (const claim of claims) settleManualResetCooldown(getRuntimeConfig(config), claim, recovered); + return manualResetAuthStillLive(accountId, auth) ? result.freshResetCredits : undefined; + } + const account = configuredPoolAccount(getRuntimeConfig(config), accountId); + if (!account) return undefined; + // Reuse the just-authenticated consume credential for the first usage request. + // getValidCodexToken can silently advance a generation without exposing refresh + // provenance. A 401 here instead uses the existing classified refresh/replay path. + const resetToken: typeof getValidCodexToken = async () => { + if (auth.poolGeneration === undefined || !manualResetAuthStillLive(accountId, auth)) { + throw new CodexCredentialGenerationConflictError(); + } + return { accessToken: auth.accessToken, chatgptAccountId: auth.chatgptAccountId, generation: auth.poolGeneration }; + }; + const result = await fetchPoolAccountQuota(accountId, true, account.plan, didReset ? resetToken : getValidCodexToken, + didReset ? afterDispatchSequence : undefined); + const record = readCodexAccountRecord(accountId); + const recovered = didReset && record?.credential?.chatgptAccountId === auth.chatgptAccountId + && (result.quotaProbeAttempted?.dispatchSequence ?? 0) > afterDispatchSequence + && isCompleteCodexQuotaRecoverySnapshot(result.freshQuota ?? null, result.freshPlan ?? account.plan); + for (const claim of claims) settleManualResetCooldown(getRuntimeConfig(config), claim, recovered, { + credentialGeneration: result.freshCredentialGeneration, + refreshLineage: result.resetRefreshLineage, + }); + return record?.credential?.chatgptAccountId === auth.chatgptAccountId ? result.freshResetCredits : undefined; + } catch { + // The upstream reset already happened. A failed refresh must not invite another spend. + return undefined; + } +} + let primeInFlight: Promise | null = null; /** * Last prime attempt per pool account. A failed WHAM lookup stores no quota, so @@ -2341,7 +2486,7 @@ export async function handleCodexAuthAPI( const operation = await withResetCreditAuth(getRuntimeConfig(config), accountId, async auth => { // The ledger keys manual operations by the *physical* ChatGPT account, which is // only known after the auth wrapper resolves credentials. Open here, not earlier. - const identity = requestedOperationId === undefined + let identity = requestedOperationId === undefined ? undefined : { accountId, @@ -2377,75 +2522,74 @@ export async function handleCodexAuthAPI( return response; } // Canonical id, which an alias join may map to an earlier caller id. + identity = { ...identity, operationId: opened.operationId }; idempotencyKey = opened.operationId; } else { idempotencyKey = crypto.randomUUID(); } - let resp: Response; + const claims = manualResetAuthStillLive(accountId, auth) + ? claimManualResetCooldowns(getRuntimeConfig(config), accountId, Date.now(), auth.poolGeneration) : []; try { - resp = await fetch( - "https://chatgpt.com/backend-api/wham/rate-limit-reset-credits/consume", - { - method: "POST", - headers: { - Authorization: `Bearer ${auth.accessToken}`, - "ChatGPT-Account-Id": auth.chatgptAccountId, - "Content-Type": "application/json", + let resp: Response; + try { + resp = await fetch( + "https://chatgpt.com/backend-api/wham/rate-limit-reset-credits/consume", + { + method: "POST", + headers: { + Authorization: `Bearer ${auth.accessToken}`, + "ChatGPT-Account-Id": auth.chatgptAccountId, + "Content-Type": "application/json", + }, + body: JSON.stringify({ redeem_request_id: idempotencyKey }), + signal: AbortSignal.timeout(10_000), }, - body: JSON.stringify({ redeem_request_id: idempotencyKey }), - signal: AbortSignal.timeout(10_000), - }, - ); - } catch (error) { - // Dispatch outcome unknown: the credit may or may not have been spent. - // Mark ambiguous so a replay of this same id is never treated as new. - if (identity) markManualResetCreditOperationAmbiguous(identity); - throw error; - } - if (!resp.ok) { - await resp.body?.cancel().catch(() => {}); - if (identity) markManualResetCreditOperationAmbiguous(identity); - return jsonResponse({ error: `Upstream error ${resp.status}` }, resp.status); - } - const result = safeResetCreditConsumeDto(await resp.json()); - if (identity) { - // Narrow explicitly rather than casting: `safeResetCreditConsumeDto` - // normalizes anything unrecognized to "unknown", and settling that - // would come back as a mismatch and leave the row pending anyway. - // Settlement failure never downgrades the user-visible outcome: the - // spend already happened upstream, and reporting failure would invite - // a manual retry -- the exact double-spend this unit removes. - if (result.code === "reset" || result.code === "already_redeemed" - || result.code === "nothing_to_reset" || result.code === "no_credit") { - settleManualResetCreditOperation(identity, result.code); - } else { - markManualResetCreditOperationAmbiguous(identity); + ); + } catch (error) { + // Dispatch outcome unknown: the credit may or may not have been spent. + // Mark ambiguous so a replay of this same id is never treated as new. + if (identity) markManualResetCreditOperationAmbiguous(identity); + throw error; } - } - // After a successful redeem (or an idempotent already_redeemed), refresh WHAM usage - // and return remaining only when that refresh freshly parsed available_count. - // Do not fall back to a preserved cached resetCredits (failed/omitted refresh). - if (result.code === "reset" || result.code === "already_redeemed") { - let freshResetCredits: number | undefined; - if (auth.isMain) { - ({ freshResetCredits } = await fetchMainAccountInfoAttempt( - true, - 1, - auth.nativeMainLease, - auth.nativeMainSharedClaimHeld === true, - )); - } else { - const account = configuredPoolAccount(getRuntimeConfig(config), accountId); - ({ freshResetCredits } = await fetchPoolAccountQuota(accountId, true, account?.plan)); + if (!resp.ok) { + await resp.body?.cancel().catch(() => {}); + if (identity) markManualResetCreditOperationAmbiguous(identity); + return jsonResponse({ error: `Upstream error ${resp.status}` }, resp.status); } - return jsonResponse({ - code: result.code, - ...(typeof freshResetCredits === "number" && Number.isFinite(freshResetCredits) - ? { remaining: freshResetCredits } - : {}), - }); + const result = safeResetCreditConsumeDto(await resp.json()); + if (identity) { + // Narrow explicitly rather than casting: `safeResetCreditConsumeDto` + // normalizes anything unrecognized to "unknown", and settling that + // would come back as a mismatch and leave the row pending anyway. + // Settlement failure never downgrades the user-visible outcome: the + // spend already happened upstream, and reporting failure would invite + // a manual retry -- the exact double-spend this unit removes. + if (result.code === "reset" || result.code === "already_redeemed" + || result.code === "nothing_to_reset" || result.code === "no_credit") { + settleManualResetCreditOperation(identity, result.code); + } else { + markManualResetCreditOperationAmbiguous(identity); + } + } + // After a successful redeem (or an idempotent already_redeemed), refresh WHAM usage + // and return remaining only when that refresh freshly parsed available_count. + // Do not fall back to a preserved cached resetCredits (failed/omitted refresh). + if (result.code === "reset" || result.code === "already_redeemed") { + const freshResetCredits = await refreshAfterManualReset( + config, accountId, auth, claims, result.code === "reset", + ); + return jsonResponse({ + code: result.code, + ...(typeof freshResetCredits === "number" && Number.isFinite(freshResetCredits) + ? { remaining: freshResetCredits } + : {}), + }); + } + return jsonResponse(result); + } finally { + // Release only this invocation's leases, including every ambiguous/error outcome. + for (const claim of claims) settleManualResetCooldown(getRuntimeConfig(config), claim, false); } - return jsonResponse(result); }); return operation.ok ? operation.value : operation.response; } catch (e) { diff --git a/src/codex/features.ts b/src/codex/features.ts index 9875a6ea2c..a52e9fc46e 100644 --- a/src/codex/features.ts +++ b/src/codex/features.ts @@ -38,6 +38,7 @@ import { AtomicWriteResidualTempError, AtomicWriteSecretResidualError, atomicWri import { forgetEphemeralSecretPath } from "../lib/windows-secret-acl"; import { CODEX_CONFIG_PATH } from "./paths"; import { resolveAndPersistCodexRuntime } from "./runtime"; +import { canonicalizeOpenCodexModeHint } from "./multi-agent-mode-policy"; /** Upstream codex-rs feature key: allow `request_user_input` in Default mode. */ export const DEFAULT_MODE_REQUEST_USER_INPUT_FEATURE_KEY = "default_mode_request_user_input"; @@ -1091,7 +1092,8 @@ export function setMultiAgentModeHintText(value: string | null, configPath?: str }; } } - return setV2StringField("multi_agent_mode_hint_text", value, configPath); + const canonicalValue = value === null ? null : canonicalizeOpenCodexModeHint(value); + return setV2StringField("multi_agent_mode_hint_text", canonicalValue, configPath); } export const MODE_HINT_CAPABILITY_CACHE_MAX_ENTRIES = 8; diff --git a/src/codex/multi-agent-mode-policy.ts b/src/codex/multi-agent-mode-policy.ts new file mode 100644 index 0000000000..395dc72507 --- /dev/null +++ b/src/codex/multi-agent-mode-policy.ts @@ -0,0 +1,24 @@ +export const MULTI_AGENT_MODE_HINT_RECOMMENDATION = { + revision: "proactive-trigger-v1", + text: [ + "Proactive multi-agent delegation is active.", + "Only the delegation trigger changes: a separate explicit request is no longer required.", + "All existing user, authority, task-scope, and collaboration-tool rules continue to apply.", + "Delegate eligible independent work when parallel execution could materially improve speed or quality.", + "User requests override this hint.", + "This mode remains active until a later multi-agent mode developer message changes it.", + ].join(" "), +} as const; + +/** Byte-exact presets previously written by OpenCodex dashboard releases. */ +export const LEGACY_OPENCODEX_MODE_HINTS = [ + "Proactive multi-agent delegation is active. Any earlier instruction requiring an explicit user request before spawning sub-agents no longer applies. Use sub-agents when parallel work would materially improve speed or quality. This mode remains active until a later multi-agent mode developer message changes it.", + "Proactive multi-agent delegation is active. Any earlier instruction requiring an explicit user request before spawning sub-agents no longer applies. Delegate independent sub-tasks to sub-agents whenever parallel work would materially improve speed or quality — do not serialize work that can run concurrently. Each sub-agent runs in its own context and can use all available tools; prefer spawning specialists over doing everything yourself. This mode remains active until a later multi-agent mode developer message changes it.", +] as const; + +/** Upgrade only known OpenCodex-owned values; user-authored variants stay byte-identical. */ +export function canonicalizeOpenCodexModeHint(text: string): string { + return LEGACY_OPENCODEX_MODE_HINTS.some(legacy => legacy === text) + ? MULTI_AGENT_MODE_HINT_RECOMMENDATION.text + : text; +} diff --git a/src/codex/reset-credit-auto-redeem.ts b/src/codex/reset-credit-auto-redeem.ts index 19b6d3ae0e..2c6292368a 100644 --- a/src/codex/reset-credit-auto-redeem.ts +++ b/src/codex/reset-credit-auto-redeem.ts @@ -1,6 +1,7 @@ import { createHash, randomUUID } from "node:crypto"; import { existsSync, readFileSync } from "node:fs"; import { join } from "node:path"; +import { ConfigMutationLockError, withConfigMutationLockSync } from "../config"; import { atomicWriteFile } from "../config/atomic-write"; import { getConfigDir } from "../config/paths"; import { registerOptionalShutdownHook } from "../lib/optional-shutdown-hooks"; @@ -91,9 +92,9 @@ function readJournal(path: string): Journal { } } -function writeJournal(path: string, journal: Journal): void { +function writeJournal(path: string, journal: Journal, now: number): void { // Keep only entries whose credit could still matter: settled ones older than a week are noise. - const cutoff = Date.now() - 7 * 24 * 60 * 60_000; + const cutoff = now - 7 * 24 * 60 * 60_000; journal.entries = journal.entries.filter(e => e.state !== "settled" || e.updatedAt > cutoff); atomicWriteFile(path, JSON.stringify(journal, null, 2)); } @@ -112,6 +113,7 @@ export interface AutoRedeemDeps { now?: () => number; setTimer?: (fn: () => void, ms: number) => unknown; clearTimer?: (handle: unknown) => void; + /** Callers sharing an overridden journal must also share the OPENCODEX_HOME mutation coordinator. */ journalFile?: string; log?: (line: string) => void; /** Upper bound on one sleep so a laptop sleep or clock jump re-checks rather than trusting a stale plan. */ @@ -155,15 +157,38 @@ export function createResetCreditAutoRedeemer(deps: AutoRedeemDeps): ResetCredit handle = setTimer(() => { handle = null; void tick(); }, Math.max(0, Math.min(ms, maxSleepMs))); }; + const retryJournal = (error: unknown): void => { + const cause = error instanceof ConfigMutationLockError ? error.cause : error; + const code = cause && typeof cause === "object" && "code" in cause ? String(cause.code) : ""; + const busy = code === "SQLITE_BUSY" || code === "SQLITE_LOCKED" + || (cause instanceof Error && /database (?:is|table is) locked/i.test(cause.message)); + schedule(busy ? 1_000 : idleRecheckMs); + }; + const dispatch = async (plan: AutoRedeemPlan): Promise => { - const journal = readJournal(path); - let entry = journal.entries.find(e => e.accountKey === accountKey && e.grantedAt === plan.grantedAt && e.expiresAt === plan.expiresAt); - if (entry?.state === "settled") return { kind: "skipped", reason: "credit-gone" }; - if (!entry) { - entry = { accountKey, grantedAt: plan.grantedAt, expiresAt: plan.expiresAt, redeemRequestId: randomUUID(), state: "dispatched", updatedAt: now() }; - journal.entries.push(entry); - // Journal BEFORE the network call: a crash after this line replays the same request id. - writeJournal(path, journal); + // Reserve under the shared config-mutation lock. `inFlight` only serializes ticks inside + // ONE process; two servers on the same config dir would otherwise both read a journal with + // no entry, each mint a different `redeem_request_id`, and spend two credits for one plan. + let entry: JournalEntry; + try { + entry = withConfigMutationLockSync(() => { + const journal = readJournal(path); + const existing = journal.entries.find(e => e.accountKey === accountKey && e.grantedAt === plan.grantedAt && e.expiresAt === plan.expiresAt); + if (existing) return existing; + const created: JournalEntry = { accountKey, grantedAt: plan.grantedAt, expiresAt: plan.expiresAt, redeemRequestId: randomUUID(), state: "dispatched", updatedAt: now() }; + journal.entries.push(created); + // Journal BEFORE the network call: a crash after this line replays the same request id. + writeJournal(path, journal, created.updatedAt); + return created; + }); + } catch (error) { + // Only contention gets a short retry; persistent storage failures must not spin. + retryJournal(error); + return { kind: "error", message: error instanceof Error ? error.message : "journal reservation failed" }; + } + if (entry.state === "settled") { + schedule(idleRecheckMs); + return { kind: "skipped", reason: "credit-gone" }; } log(`[opencodex] reset-credit auto-redeem: dispatching for account ${accountKey} (credit expires ${plan.expiresAt})`); let result: { code: string }; @@ -174,9 +199,25 @@ export function createResetCreditAutoRedeemer(deps: AutoRedeemDeps): ResetCredit schedule(60_000); return { kind: "ambiguous", redeemRequestId: entry.redeemRequestId }; } - entry.state = "settled"; - entry.updatedAt = now(); - writeJournal(path, journal); + // Re-read under the lock: a peer may have appended its own entries since the reservation, + // and writing a stale in-memory journal would drop them. + try { + withConfigMutationLockSync(() => { + const journal = readJournal(path); + const current = journal.entries.find(e => e.accountKey === accountKey && e.grantedAt === plan.grantedAt && e.expiresAt === plan.expiresAt); + if (!current || current.redeemRequestId !== entry.redeemRequestId) { + throw new Error("auto-redeem journal reservation changed before settlement"); + } + current.state = "settled"; + current.updatedAt = now(); + writeJournal(path, journal, current.updatedAt); + }); + } catch (error) { + // Upstream answered, but settlement could not be committed. Preserve any reservation; + // a later dispatch must reuse its request id. A vanished credit may never dispatch again. + retryJournal(error); + return { kind: "error", message: error instanceof Error ? error.message : "journal settlement failed" }; + } log(`[opencodex] reset-credit auto-redeem: upstream answered ${result.code} for account ${accountKey}`); schedule(idleRecheckMs); return { kind: "dispatched", code: result.code, redeemRequestId: entry.redeemRequestId }; diff --git a/src/codex/routing.ts b/src/codex/routing.ts index dbf9cab086..5d8cc17d15 100644 --- a/src/codex/routing.ts +++ b/src/codex/routing.ts @@ -1,6 +1,6 @@ import { randomUUID } from "node:crypto"; import { saveConfigPreservingClaudeCode } from "../config"; -import { isCodexAccountGenerationLive, readCodexAccountRecord } from "./account-store"; +import { isCodexAccountGenerationLive, readCodexAccountRecord, type CodexRefreshProvenance } from "./account-store"; import { codexAccountLogLabel } from "./account-label"; import { NATIVE_RESERVE_MODEL } from "./catalog/native-models"; import { isCodexAccountPaused } from "./account-pause"; @@ -642,6 +642,80 @@ export function claimDueCodexQuotaRecoveryProbes( }); } +type CooldownRecoveryLease = Pick; + +export type ManualResetCooldownClaim = + | { kind: "pool"; probe: CodexQuotaRecoveryProbeClaim } + | { kind: "main"; probe: CooldownRecoveryLease }; + +function manualResetAccountEligible(config: OcxConfig, accountId: string): boolean { + return !isCodexAccountPaused(config, accountId) && !isAccountNeedsReauth(accountId) + && (accountId === MAIN_CODEX_ACCOUNT_ID + || (config.codexAccounts ?? []).some(account => account.id === accountId && isSelectableCodexPoolAccount(account))); +} + +/** Explicit reset bypasses probe pacing, never another owner's lease or quota scope. */ +export function claimManualResetCooldowns( + config: OcxConfig, + accountId: string, + now = Date.now(), + expectedPoolGeneration?: number, +): ManualResetCooldownClaim[] { + if (!manualResetAccountEligible(config, accountId)) return []; + const record = accountId === MAIN_CODEX_ACCOUNT_ID ? undefined : readCodexAccountRecord(accountId); + if (accountId !== MAIN_CODEX_ACCOUNT_ID && (!record?.credential || record.deletedAt != null)) return []; + if (record && expectedPoolGeneration !== undefined && record.generation !== expectedPoolGeneration) return []; + const claims: ManualResetCooldownClaim[] = []; + for (const scope of [undefined, "shared"] as const) { + const health = scope ? scopedHealthFor(accountId, scope) : upstreamHealth.get(accountId); + if (!health || health.cooldownSource !== "reset-derived" || health.probeLeaseId !== undefined + || !Number.isFinite(health.cooldownUntil) || !(health.cooldownUntil! > now)) continue; + const leaseId = randomUUID(); + const cooldownGeneration = health.cooldownGeneration ?? 0; + const next = { ...health, probeLeaseId: leaseId, probeLeaseGeneration: cooldownGeneration, lastProbeAt: now }; + if (scope) setScopedHealth(accountId, scope, next); + else upstreamHealth.set(accountId, next); + const probe = { accountId, scope, leaseId, cooldownGeneration }; + claims.push(record ? { kind: "pool", probe: { + ...probe, credentialGeneration: record.generation, credentialReplacedAt: record.replacedAt, + } } : { kind: "main", probe }); + } + return claims; +} + +export type ManualResetRefreshLineage = Readonly<{ + fromGeneration: number; + toGeneration: number; + provenance: CodexRefreshProvenance; +}>; + +type ManualResetQuotaProof = CodexQuotaRecoveryProbeProof & { + refreshLineage?: ManualResetRefreshLineage; +}; + +/** Main proof is checked by the already-owned auth operation, never by a Pool record. */ +export function settleManualResetCooldown( + config: OcxConfig, + claim: ManualResetCooldownClaim, + recovered: boolean, + proof: ManualResetQuotaProof = {}, + now = Date.now(), +): boolean { + if (!recovered) return settleCooldownRecoveryLease(claim.probe, false, now); + const eligible = manualResetAccountEligible(config, claim.probe.accountId); + if (claim.kind === "main") return settleCooldownRecoveryLease(claim.probe, eligible, now); + const lineage = proof.refreshLineage; + // Equal wall-clock replacement stamps do not establish ancestry. Manual +1 + // recovery additionally needs the actual forced-refresh result for this edge. + const ownedGeneration = proof.credentialGeneration === claim.probe.credentialGeneration + || (proof.credentialGeneration === claim.probe.credentialGeneration + 1 + && lineage?.fromGeneration === claim.probe.credentialGeneration + && lineage.toGeneration === proof.credentialGeneration + && (lineage.provenance === "self-refresh" || lineage.provenance === "joined-lineage")); + return settleCodexQuotaRecoveryProbe(claim.probe, eligible && ownedGeneration, proof, now); +} + /** Settle one background recovery claim without mutating account-wide outcome state. */ export function settleCodexQuotaRecoveryProbe( claim: CodexQuotaRecoveryProbeClaim, @@ -665,9 +739,16 @@ export function settleCodexQuotaRecoveryProbe( : proofGeneration === claim.credentialGeneration + 1 && currentRecord?.replacedAt === claim.credentialReplacedAt && isCodexAccountGenerationLive(claim.accountId, proofGeneration)); - const fenced = (health.cooldownGeneration ?? 0) === claim.cooldownGeneration - && (health.probeLeaseGeneration ?? 0) === claim.cooldownGeneration - && generationFenced; + return settleCooldownRecoveryLease(claim, recovered && generationFenced, now); +} + +function settleCooldownRecoveryLease(claim: CooldownRecoveryLease, recovered: boolean, now: number): boolean { + const health = claim.scope ? scopedHealthFor(claim.accountId, claim.scope) : upstreamHealth.get(claim.accountId); + if (!health || health.probeLeaseId !== claim.leaseId) return false; + const fenced = (claim.scope === undefined || claim.scope === "shared") + && health.cooldownSource === "reset-derived" + && (health.cooldownGeneration ?? 0) === claim.cooldownGeneration + && (health.probeLeaseGeneration ?? 0) === claim.cooldownGeneration; if (!recovered || !fenced) { const released = withProbeLeaseReleased(health, now); if (claim.scope) setScopedHealth(claim.accountId, claim.scope, released); diff --git a/src/codex/shim.ts b/src/codex/shim.ts index a63c48fb7a..57f46cfb0d 100644 --- a/src/codex/shim.ts +++ b/src/codex/shim.ts @@ -1069,6 +1069,7 @@ export function buildWindowsCodexShim(realCodexPath: string, bunPath: string, cl const valueOptionChecks = CODEX_GLOBAL_OPTIONS_WITH_VALUE.map(option => `if /I "%~1"=="${option}" goto skip_option_value`).join("\r\n"); return `@echo off\r rem ${SHIM_MARKER}\r +setlocal\r ${windowsBatchSet("OCX_REAL_CODEX", realCodexPath)}\r ${windowsBatchSet("OCX_BUN", bunPath)}\r ${windowsBatchSet("OCX_CLI", cliPath)}\r @@ -1115,6 +1116,9 @@ export function buildWindowsPowerShellCodexShim(realCodexPath: string, bunPath: const tokenFile = serviceApiTokenFilePath(); return `#!/usr/bin/env pwsh # ${SHIM_MARKER} +$hadApiAuthToken = Test-Path Env:\\OPENCODEX_API_AUTH_TOKEN +$priorApiAuthToken = $env:OPENCODEX_API_AUTH_TOKEN +try { if (-not $env:OPENCODEX_API_AUTH_TOKEN -and (Test-Path -LiteralPath ${psString(tokenFile)})) { $env:OPENCODEX_API_AUTH_TOKEN = (Get-Content -Raw -LiteralPath ${psString(tokenFile)}).Trim() } @@ -1147,7 +1151,12 @@ if (-not $skipEnsure) { } } & ${psString(realCodexPath)} @args -exit $LASTEXITCODE +$codexExitCode = $LASTEXITCODE +} finally { + if ($hadApiAuthToken) { $env:OPENCODEX_API_AUTH_TOKEN = $priorApiAuthToken } + else { Remove-Item Env:\\OPENCODEX_API_AUTH_TOKEN -ErrorAction SilentlyContinue } +} +exit $codexExitCode `; } diff --git a/src/config/atomic-write.ts b/src/config/atomic-write.ts index 0ec0831c4c..69bc112146 100644 --- a/src/config/atomic-write.ts +++ b/src/config/atomic-write.ts @@ -1,7 +1,6 @@ import { chmodSync, closeSync, - constants, fchmodSync, fstatSync, lstatSync, @@ -121,7 +120,7 @@ function writePrivateTempFile( timeoutMemoKey: string, onCreated: () => void, ): void { - const descriptor = openSync(path, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 0o600); + const descriptor = openSync(path, "wx", 0o600); onCreated(); try { if (process.platform === "win32") { @@ -142,7 +141,7 @@ async function writePrivateTempFileAsync( timeoutMemoKey: string, onCreated: () => void, ): Promise { - const descriptor = openSync(path, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 0o600); + const descriptor = openSync(path, "wx", 0o600); onCreated(); try { if (process.platform === "win32") { diff --git a/src/config/initialize.ts b/src/config/initialize.ts index 864b09b036..ed9d121eaa 100644 --- a/src/config/initialize.ts +++ b/src/config/initialize.ts @@ -1,5 +1,5 @@ import { - closeSync, constants, fchmodSync, fstatSync, linkSync, lstatSync, + closeSync, fchmodSync, fstatSync, linkSync, lstatSync, openSync, unlinkSync, writeFileSync, } from "node:fs"; import { dirname } from "node:path"; @@ -15,10 +15,12 @@ export class InitialConfigPublicationError extends Error { readonly publication: PublicationState, readonly residualTemp: boolean, readonly hardLinkUnavailable: boolean, - options?: ErrorOptions, + options?: ErrorOptions & { hardeningFailed?: boolean }, ) { - super(hardLinkUnavailable - ? "Initial config requires hard-link publication; the filesystem or its permissions denied it." + super(options?.hardeningFailed + ? "Initial config permissions could not be secured. Choose an OPENCODEX_HOME location that supports private file permissions (NTFS ACLs on Windows), then rerun `ocx init`." + : hardLinkUnavailable + ? "Initial config requires hard-link publication; the filesystem or its permissions denied it. Inspect the config directory before retrying. Choose an OPENCODEX_HOME location that supports hard links and private file permissions, then rerun `ocx init`." : "Initial config publication did not finish.", options); this.name = "InitialConfigPublicationError"; } @@ -90,10 +92,13 @@ export function publishInitialConfigNoReplace( let failure: unknown; let failed = false; let hardLinkUnavailable = false; + let hardeningFailed = false; let residualTemp = false; try { - fd = openSync(temp, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 0o600); + fd = openSync(temp, "wx", 0o600); + hardeningFailed = true; (io.harden ?? hardenInitialConfig)(fd, temp, target); + hardeningFailed = false; verifyPrivateTemp(fd, temp); (io.write ?? ((descriptor: number, value: string) => writeFileSync(descriptor, value, { encoding: "utf8" })))(fd, bytes); verifyPrivateTemp(fd, temp); @@ -126,7 +131,7 @@ export function publishInitialConfigNoReplace( } } if (failed || residualTemp) { - throw new InitialConfigPublicationError(publication, residualTemp, hardLinkUnavailable, { cause: failure }); + throw new InitialConfigPublicationError(publication, residualTemp, hardLinkUnavailable, { cause: failure, hardeningFailed }); } return !collided; } diff --git a/src/lib/state-store-registrations.ts b/src/lib/state-store-registrations.ts index 433a8989b4..13a22bfce0 100644 --- a/src/lib/state-store-registrations.ts +++ b/src/lib/state-store-registrations.ts @@ -21,6 +21,7 @@ import { } from "../combos/failover"; import { reconcileComboWarningMemos } from "../combos/request"; import { reconcileComboRotationState } from "../combos/resolve"; +import { reconcileComboRecall } from "../server/responses/combo-session-recall"; import { listLiveComboTargetKeys } from "../combos/types"; import { listLiveConfigOwnershipRoots, @@ -111,6 +112,7 @@ export const STATE_STORE_REGISTRATIONS = [ { name: "model-cache-history", reconcileGeneration: reconcileModelCacheGeneration }, { name: "pool-rotation", reconcileGeneration: reconcilePoolRotationState }, { name: "combo-rotation", reconcileGeneration: reconcileComboRotationState }, + { name: "combo-session-recall", reconcileGeneration: reconcileComboRecall }, { name: "guardian-backoff", reconcileGeneration: reconcileGuardianBackoff }, { name: "codex-reauth", reconcileGeneration: reconcileCodexReauthState }, { name: "oauth-reauth", reconcileGeneration: reconcileOAuthReauthState }, diff --git a/src/providers/default-aliases.ts b/src/providers/default-aliases.ts index b11078bedc..dffbd9eb3c 100644 --- a/src/providers/default-aliases.ts +++ b/src/providers/default-aliases.ts @@ -15,7 +15,10 @@ export function effectiveProviderAlias( if (config?.providers) { const lower = regAlias.toLowerCase(); const claimedByOther = Object.entries(config.providers).some(([name, p]) => - name !== providerName && typeof p.alias === "string" && p.alias.trim().toLowerCase() === lower + name !== providerName && ( + name.toLowerCase() === lower + || (typeof p.alias === "string" && p.alias.trim().toLowerCase() === lower) + ) ); if (claimedByOther) return undefined; } diff --git a/src/providers/registry.ts b/src/providers/registry.ts index 5e46f27d60..5beb971a4e 100644 --- a/src/providers/registry.ts +++ b/src/providers/registry.ts @@ -1539,8 +1539,10 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [ modelDiscovery: { // Resolves against effectiveBaseUrl (registry baseUrl .../v1) to the same // canonical endpoint https://inference-api.nousresearch.com/v1/models. + // Nous returns a mixed paid/free catalog whose JSON can exceed 256 KiB; + // keep the provider-specific limit below the process-wide 4 MiB ceiling. path: "models", - maxResponseBytes: 262_144, + maxResponseBytes: 1_048_576, maxModels: 512, }, note: "Nous Research subscription gateway. OAuth device login with your own Portal account; mixed paid + :free models discovered live (fallback seed 2026-08-10: tencent/hy3:free, poolside/laguna-s-2.1:free, stepfun/step-3.7-flash:free, poolside/laguna-xs-2.1:free).", @@ -1674,6 +1676,9 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [ // Zen Go can close a Chat stream after a fully assembled function call without sending // finish_reason or [DONE] (#2260). The adapter still rejects incomplete argument JSON. openaiChatEofTolerance: true, + // Go rejects reasoning.encrypted_content with previous_response_id (#3838). + // Use explicit replay history and the existing stateless Responses policy. + statelessResponses: true, /* [Decision Log] - 목적과 의도: Route the exact models OpenCode Go documents on the Responses endpoint — GPT 5.6 Luna, Grok 4.6, and Muse Spark Contributor (#2617). - 기존 구현 및 제약 조건: The provider is mixed-wire but its provider-wide `openai-chat` adapter sent Luna to `/chat/completions`; explicit user `modelAdapters` entries must remain authoritative. diff --git a/src/router.ts b/src/router.ts index b2f887f0a9..ad1aaeff35 100644 --- a/src/router.ts +++ b/src/router.ts @@ -703,13 +703,16 @@ function routeModelInternal( throw new Error("provider alias '" + requestedProvider + "' is ambiguous: " + configuredMatches.map(([n]) => n).sort().join(", ")); } else { // Pass 2: built-in registry aliases, only for providers that do NOT have an explicit alias override - // and whose registry alias has not been claimed by another configured provider (#3531 review) + // and whose registry alias has not been claimed by another configured provider name or alias const registryMatches = Object.entries(config.providers).filter(([name, provider]) => { if (provider.alias !== undefined) return false; const regAlias = PROVIDER_REGISTRY.find(e => e.id === name)?.alias; if (!regAlias || regAlias.toLowerCase() !== requestedLower) return false; const claimedByOther = Object.entries(config.providers).some(([otherName, p]) => - otherName !== name && typeof p.alias === "string" && p.alias.trim().toLowerCase() === requestedLower + otherName !== name && ( + otherName.toLowerCase() === requestedLower + || (typeof p.alias === "string" && p.alias.trim().toLowerCase() === requestedLower) + ) ); return !claimedByOther; }); diff --git a/src/server/claude-messages.ts b/src/server/claude-messages.ts index f6906de7e0..8c3e37eea8 100644 --- a/src/server/claude-messages.ts +++ b/src/server/claude-messages.ts @@ -30,12 +30,13 @@ import { import { clearableDeadline, idleDeadline } from "../lib/abort"; import { estimateTokens } from "../lib/token-estimate"; import { NoEligiblePolicyCandidateError, UnknownRoutingPolicyError, routeModel } from "../router"; +import { registryEntryForProviderDestination } from "../providers/registry"; import { evidenceFromBody } from "../routing/request-evidence"; import { resolveWireProtocolOverride } from "./adapter-resolve"; import type { OcxConfig } from "../types"; import { readJsonRequestBody } from "./request-decompress"; import { addFinalRequestLog, httpStatusForRequestLogTerminal, recordFirstOutput, type RequestLogContext, type RequestLogEntry } from "./request-log"; -import { conversationIdFromClaudeMetadata } from "./request-log-conversation"; +import { conversationIdFromClaudeMetadata, normalizeLogConversationId, sessionLaneIdFromRequest } from "./request-log-conversation"; import { responseWithDeferredRequestLog } from "./relay"; import { handleResponses } from "./responses"; import { @@ -786,8 +787,12 @@ async function handleClaudeMessagesWithBudget( // bodies: it 400s on sampling params ("Unsupported parameter: max_output_tokens", // verified live 2026-07-11). Strip them for that route; routed providers keep them. let nativeRoute = false; + let opencodeGoRoute = false; try { const route = routeModel(config, internalBody.model as string, evidenceFromBody(internalBody)); + // Match the fixed key-auth destination before per-model wire overrides, including + // renamed Go providers without treating custom or lookalike URLs as Go. + opencodeGoRoute = registryEntryForProviderDestination(route.provider)?.id === "opencode-go"; // Settle the wire once so the sampling decision below reads the effective // adapter rather than the provider-wide default (#404). route.provider = resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, "anthropic"); @@ -851,15 +856,27 @@ async function handleClaudeMessagesWithBudget( headers.set("chatgpt-account-id", token.chatgptAccountId); } } - if (nativeRoute) { + if (opencodeGoRoute) { + const session = req.headers.get("x-opencode-session"); + if (session) headers.set("x-opencode-session", session); + } + const hasExplicitGoSession = opencodeGoRoute + && (sessionLaneIdFromRequest(headers) !== undefined + || normalizeLogConversationId(headers.get("x-opencode-session")) !== undefined); + const synthesizeGoSession = opencodeGoRoute && !hasExplicitGoSession + && isRec(anthropicBody) + && conversationIdFromClaudeMetadata(isRec(anthropicBody.metadata) ? anthropicBody.metadata : undefined) !== undefined; + // Go can also use the Responses adapter; its eligibility gate must win on both wires. + if (opencodeGoRoute ? synthesizeGoSession : nativeRoute) { // ChatGPT-backend prompt-cache affinity rides the session_id HEADER (codex // clients always send their session uuid; devlog 090 follow-up: body-level // prompt_cache_key alone still yielded cached_tokens:0). Claude Code never sends - // the header, so synthesize a stable per-session uuid from the same cache key — + // the header, so synthesize a stable per-session uuid from the same cache key. + // Routed Go requests need this lane too for their x-opencode-session affinity — // but ONLY for a real per-session key (metadata.user_id). The system-hash fallback // key is shared across Desktop conversations, and a shared session_id's backend // semantics are unproven (audit 133 R2#3): body prompt_cache_key only there. - if (cacheKeySource === "metadata" && !headers.has("session_id") && typeof internalBody.prompt_cache_key === "string") { + if (cacheKeySource === "metadata" && (synthesizeGoSession || !headers.has("session_id")) && typeof internalBody.prompt_cache_key === "string") { headers.set("session_id", uuidFromHex(internalBody.prompt_cache_key)); } } diff --git a/src/server/live.ts b/src/server/live.ts index 91caec1f66..6d983ce0aa 100644 --- a/src/server/live.ts +++ b/src/server/live.ts @@ -86,39 +86,29 @@ export const LIVE_CLIENT_PROTOCOL_HEADERS = [ * * When `OCX_LIVE_FRAME_LOG` is set to a file path, every relayed sideband frame appends one * JSONL record: direction, frame kind, byte length, and whether the payload contains U+FFFD. - * Privacy: full frame payloads are never written — only when U+FFFD is present, a short - * excerpt around the first replacement character is included so the corruption point can be - * attributed (upstream vs relay vs client). Disabled entirely when the env var is unset. + * Privacy: no frame content is written, including excerpts around replacement characters. + * For binary frames, U+FFFD may also be introduced by UTF-8 decoding; the flag alone does not + * identify the source of corruption. Disabled entirely when the env var is unset. */ export const LIVE_FRAME_LOG_ENV = "OCX_LIVE_FRAME_LOG"; -const LIVE_FRAME_LOG_CONTEXT_CHARS = 24; - -function fffdContext(text: string): string | undefined { - const idx = text.indexOf("\uFFFD"); - if (idx < 0) return undefined; - const start = Math.max(0, idx - LIVE_FRAME_LOG_CONTEXT_CHARS); - const end = Math.min(text.length, idx + LIVE_FRAME_LOG_CONTEXT_CHARS); - return text.slice(start, end); -} - export function logLiveSidebandFrame(dir: "c2u" | "u2c", data: unknown): void { const logPath = process.env[LIVE_FRAME_LOG_ENV]; if (!logPath) return; try { let kind: "text" | "binary" = "binary"; let bytes = 0; - let context: string | undefined; + let fffd = false; if (typeof data === "string") { kind = "text"; bytes = Buffer.byteLength(data); - context = fffdContext(data); + fffd = data.includes("\uFFFD"); } else if (data instanceof ArrayBuffer) { bytes = data.byteLength; - context = fffdContext(new TextDecoder().decode(new Uint8Array(data))); + fffd = new TextDecoder().decode(new Uint8Array(data)).includes("\uFFFD"); } else if (ArrayBuffer.isView(data)) { const view = new Uint8Array(data.buffer, data.byteOffset, data.byteLength); bytes = data.byteLength; - context = fffdContext(new TextDecoder().decode(view)); + fffd = new TextDecoder().decode(view).includes("\uFFFD"); } else { return; } @@ -127,8 +117,7 @@ export function logLiveSidebandFrame(dir: "c2u" | "u2c", data: unknown): void { dir, kind, bytes, - fffd: context !== undefined, - ...(context !== undefined ? { context } : {}), + fffd, }; appendFileSync(logPath, `${JSON.stringify(record)}\n`); } catch { diff --git a/src/server/management/agent-settings-routes.ts b/src/server/management/agent-settings-routes.ts index 561d00a080..d7617c5884 100644 --- a/src/server/management/agent-settings-routes.ts +++ b/src/server/management/agent-settings-routes.ts @@ -40,6 +40,7 @@ import { clearThreadAccountMap } from "../../codex/routing"; import { primeCodexPoolQuotas } from "../../codex/auth-api"; import { DEFAULT_PROVIDER_CONTEXT_CAP, globalContextCapValue, providerContextCap, providerContextCaps, setAllProviderContextCaps, setGlobalContextCapValue, setProviderContextCap } from "../../providers/context-cap"; import { resolveCodexHomeDir } from "../../codex/home"; +import { MULTI_AGENT_MODE_HINT_RECOMMENDATION } from "../../codex/multi-agent-mode-policy"; import { readUsageEntries } from "../../usage/log"; import { getUsageDebugLogEntries } from "../../usage/debug"; import { parseRange, parseUsageSurface, summarizeUsage } from "../../usage/summary"; @@ -248,6 +249,7 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise agentsMaxDepth: getAgentsMaxDepth(), subagentDeveloperInstructions: getSubagentDeveloperInstructions(), multiAgentModeHintText: getMultiAgentModeHintText(), + multiAgentModeHintRecommendation: MULTI_AGENT_MODE_HINT_RECOMMENDATION, // max_depth is V1-only upstream; this is the global-flag statement, derived // server-side so no client can present it as an effective V2 limit. agentsMaxDepthAppliesWhenV2Disabled: !enabled, @@ -421,6 +423,7 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise agentsMaxDepth: getAgentsMaxDepth(), subagentDeveloperInstructions: getSubagentDeveloperInstructions(), multiAgentModeHintText: getMultiAgentModeHintText(), + multiAgentModeHintRecommendation: MULTI_AGENT_MODE_HINT_RECOMMENDATION, agentsMaxDepthAppliesWhenV2Disabled: !enabled, warnings, catalogRefresh, diff --git a/src/server/responses/collaboration.ts b/src/server/responses/collaboration.ts index 8d8ce42e7f..e01a79cea8 100644 --- a/src/server/responses/collaboration.ts +++ b/src/server/responses/collaboration.ts @@ -241,6 +241,9 @@ export const PROACTIVE_MULTI_AGENT_MODE_TEXT = [ "This mode remains active until a later multi-agent mode developer message changes it.", ].join(" "); +const OPENCODEX_SUBAGENT_GUIDANCE_OPEN_TAG = ""; +const OPENCODEX_SUBAGENT_GUIDANCE_CLOSE_TAG = ""; + export function isV1CollabSurface(parsed: OcxParsedRequest): boolean { return collabSurface(parsed) === "v1"; } @@ -468,18 +471,15 @@ export async function multiAgentGuidanceText( // fallback only for explicit routed/account-qualified ids. const promptModel = preferred?.model ?? (injectionModel?.includes("/") ? injectionModel : undefined); - return `${applyInjectionPlaceholders(injectionPrompt, promptModel, injectionEffort, roster, fallbackGuidance)}`; + return `${OPENCODEX_SUBAGENT_GUIDANCE_OPEN_TAG}${applyInjectionPlaceholders(injectionPrompt, promptModel, injectionEffort, roster, fallbackGuidance)}${OPENCODEX_SUBAGENT_GUIDANCE_CLOSE_TAG}`; } if (!preferred && roster === "" && fallbackGuidance === "") return null; - let text = "When the active spawn_agent tool supports optional \"model\" or \"reasoning_effort\" overrides, " - + "use only models listed for this collaboration surface. " - + "When setting either override, set fork_turns to \"none\" " - + "(or a positive turn count such as \"3\"; full-history forks reject overrides) " - + "and make the task message self-contained."; + let text = "OpenCodex sub-agent routing metadata for this collaboration surface. " + + "This metadata does not override Codex delegation or model-selection rules."; if (preferred) { text += ` Preferred sub-agent: model "${preferred.model}"` + (injectionEffort ? `, reasoning_effort "${injectionEffort}"` : "") - + " — use it unless the user names another."; + + "."; } text += fallbackGuidance; text += roster; @@ -487,7 +487,7 @@ export async function multiAgentGuidanceText( // Roster is the only unbounded part — drop it before breaking the budget. text = text.slice(0, text.length - roster.length); } - return `${text}`; + return `${OPENCODEX_SUBAGENT_GUIDANCE_OPEN_TAG}${text}${OPENCODEX_SUBAGENT_GUIDANCE_CLOSE_TAG}`; } const effort = parsed.options.reasoning; @@ -544,6 +544,17 @@ function isGeneratedDeveloperItem(item: unknown, text: string): boolean { return generatedDeveloperText(item) === text; } +function generatedGuidanceFamily(text: string): "multi_agent_mode" | "opencodex_subagent_guidance" | undefined { + if (text.startsWith("") && text.endsWith("")) { + return "multi_agent_mode"; + } + if (text.startsWith(OPENCODEX_SUBAGENT_GUIDANCE_OPEN_TAG) + && text.endsWith(OPENCODEX_SUBAGENT_GUIDANCE_CLOSE_TAG)) { + return "opencodex_subagent_guidance"; + } + return undefined; +} + function isDeveloperPrefixItem(item: unknown): boolean { if (!isRecord(item)) return false; if (item.type === "additional_tools") return item.role === "developer"; @@ -583,13 +594,13 @@ export function injectDeveloperMessage(parsed: OcxParsedRequest, text: string): const devItem = { type: "message", role: "developer", content: [{ type: "input_text", text }] }; if (rawInput) { const replayPrefix = rawInput.slice(0, replayPrefixLen); - const taggedGuidance = text.startsWith("") && text.endsWith(""); - const lastTaggedGuidance = taggedGuidance + const guidanceFamily = generatedGuidanceFamily(text); + const lastTaggedGuidance = guidanceFamily ? replayPrefix.map(generatedDeveloperText) - .filter(item => item?.startsWith("") && item.endsWith("")) + .filter(item => item !== undefined && generatedGuidanceFamily(item) === guidanceFamily) .at(-1) : undefined; - if (taggedGuidance ? lastTaggedGuidance === text : replayPrefix.some(item => isGeneratedDeveloperItem(item, text))) { + if (guidanceFamily ? lastTaggedGuidance === text : replayPrefix.some(item => isGeneratedDeveloperItem(item, text))) { return; } } diff --git a/src/server/responses/combo-session-recall.ts b/src/server/responses/combo-session-recall.ts new file mode 100644 index 0000000000..84dfd8d466 --- /dev/null +++ b/src/server/responses/combo-session-recall.ts @@ -0,0 +1,89 @@ +/** Process-local recall of the last completed combo response on an explicit session lane. */ +import { getCombo, targetKey } from "../../combos/types"; +import { captureConfigGeneration, type GenerationContext } from "../../lib/state-store-sweeper"; +import type { OcxConfig, OcxComboTarget } from "../../types"; + +interface ComboRecallEntry { + comboId: string; + target: Pick; + responseModel: string; + at: number; +} + +const RECALL_CAPACITY = 256; +const RECALL_TTL_MS = 30 * 60 * 1000; +const recall = new Map(); +let lastReconciledGeneration = 0; +let liveOwners: Pick | undefined; + +function ownsEntry(context: Pick, entry: ComboRecallEntry): boolean { + return context.comboIds.has(entry.comboId) + && context.providerNames.has(entry.target.provider) + && context.comboTargets.has(`${entry.comboId}::${targetKey(entry.target)}`); +} + +export function rememberComboForLane( + lane: string | undefined, + comboId: string, + target: Pick, + responseModel: string, + writerGeneration: number, +): void { + if (!lane || !comboId || !responseModel.trim()) return; + // Reject even a same-named recreated owner: its previous in-flight turn is obsolete. + if (writerGeneration < Math.max(lastReconciledGeneration, captureConfigGeneration())) return; + const entry = { comboId, target: { provider: target.provider, model: target.model }, responseModel, at: Date.now() }; + if (liveOwners && !ownsEntry(liveOwners, entry)) return; + recall.delete(lane); + recall.set(lane, entry); + while (recall.size > RECALL_CAPACITY) { + const oldest = recall.keys().next().value; + if (oldest === undefined) break; + recall.delete(oldest); + } +} + +export function recallComboForLane( + config: OcxConfig, + lane: string | undefined, + model: string, +): string | undefined { + if (!lane || !model || model.includes("/")) return undefined; + const entry = recall.get(lane); + if (!entry) return undefined; + const combo = getCombo(config, entry.comboId); + const provider = config.providers[entry.target.provider]; + if (Date.now() - entry.at >= RECALL_TTL_MS + || !Object.hasOwn(config.providers, entry.target.provider) + || !provider || provider.disabled === true + || !combo?.targets.some(target => targetKey(target) === targetKey(entry.target))) { + recall.delete(lane); + return undefined; + } + return entry.responseModel === model ? entry.comboId : undefined; +} + +export function reconcileComboRecall(context: GenerationContext): number { + if (context.generation <= lastReconciledGeneration) return 0; + lastReconciledGeneration = context.generation; + liveOwners = { + comboIds: new Set(context.comboIds), + comboTargets: new Set(context.comboTargets), + providerNames: new Set(context.providerNames), + }; + let removed = 0; + for (const [lane, entry] of recall) { + if (!ownsEntry(context, entry) || Date.now() - entry.at >= RECALL_TTL_MS) { + recall.delete(lane); + removed += 1; + } + } + return removed; +} + +/** Test-only reset, alongside the combo rotation/cooldown resets. */ +export function clearComboRecallForTests(): void { + recall.clear(); + lastReconciledGeneration = 0; + liveOwners = undefined; +} diff --git a/src/server/responses/compact.ts b/src/server/responses/compact.ts index 4e7481bb2e..567012a0f5 100644 --- a/src/server/responses/compact.ts +++ b/src/server/responses/compact.ts @@ -18,6 +18,7 @@ import { comboIdFromRawBody, concreteComboRequestBody, getCombo, + resolveComboId, isComboTargetInCooldown, NoAvailableComboTargetsError, noteComboSuccess, @@ -152,6 +153,7 @@ import { import { fetchWithHeaderTimeout, providerFetch, safeHostLabel, safeOriginLabel } from "./fetch-helpers"; import { mapCodexAuthContextErrorToResponse, nativeMainRefreshFailureResponse } from "./codex-auth-error"; import { sessionLaneIdFromRequest } from "../request-log-conversation"; +import { recallComboForLane } from "./combo-session-recall"; export const COMPACT_RESPONSE_MAX_BYTES = 32 * 1024 * 1024; @@ -536,13 +538,29 @@ export async function handleResponsesCompact( // a local rather than written back to `raw.model`: assigning to the property widens it out // of the `string` narrowing the guard above just established. const compactFastRow = parseFastOnlyRowId(config, () => raw.model as string); - const compactModel = compactFastRow ? compactFastRow.baseId : raw.model; + let compactModel = compactFastRow ? compactFastRow.baseId : raw.model; if (compactFastRow) (raw as Record).model = compactModel; // The client's own selector, kept for the request log: `raw.model` is rewritten to the // base id above, and logCtx.requestedModel is assigned from it further down, so without // this the log would lose which id the client actually asked for. const compactRequestedModel = compactFastRow ? compactFastRow.baseId + "--fast" : raw.model; + // Recall the last completed client-visible bare model after a combo switch (#3891). + // Configured selectors take precedence over this implicit session hint. + if (typeof compactModel === "string" && !compactModel.includes("/") && !compactFastRow + && !resolveComboId(config, compactModel)) { + const recalledComboId = recallComboForLane(config, sessionLaneIdFromRequest(req.headers), compactModel); + if (recalledComboId) { + (raw as Record).model = `combo/${recalledComboId}`; + // Keep the routed identity in sync: the bare model can 404 outright (no + // canonical openai provider) or resolve straight onto a native-compact + // provider, both bypassing combo failover. The combo selector resolves + // through tryPickComboModel, whose route.combo skips the native compact + // endpoint. + compactModel = `combo/${recalledComboId}`; + } + } + let route; try { // Compact requests route through the same policy evaluation as normal diff --git a/src/server/responses/core.ts b/src/server/responses/core.ts index 7281bcd305..b961e7cef9 100644 --- a/src/server/responses/core.ts +++ b/src/server/responses/core.ts @@ -15,6 +15,7 @@ import { nativeContextLimits } from "../../codex/catalog"; import { describeUpstreamConnectFailure } from "./upstream-error"; import type { CodexWsQuotaObserver } from "./codex-ws-metadata"; import { applyAccountQuotaFromUpstreamHeaders as applyCapturedCodexQuota } from "../../codex/quota"; +import { isCodexAccountGenerationLive } from "../../codex/account-store"; import { isCodexWsQuotaObservedResponse } from "./ws-upstream"; import { multiAgentGuidanceEnabled, @@ -58,6 +59,10 @@ import { providerContinuationRouteScope, sameProviderContinuationOwner, } from "../../responses/provider-continuation"; +import { + rememberComboForLane, + recallComboForLane, +} from "./combo-session-recall"; import { comboRouteDecisionTrace, NoEligiblePolicyCandidateError, @@ -78,6 +83,7 @@ import { comboRequestHasImageInput, concreteComboRequestBody, getCombo, + resolveComboId, isComboTargetInCooldown, NoAvailableComboTargetsError, noteComboSuccess, @@ -310,6 +316,7 @@ import { consumeForInspection, consumeForResponseLogMetadata, createSseInspector, + terminalStatusFromParsed, isEagerRelaySseResponse, isNativePassthroughSseResponse, markEagerRelaySseResponse, @@ -340,6 +347,7 @@ import { } from "../responses-item-id-repair"; import { createReasoningSummaryChannelPayloadRewrite, + rewriteReasoningSummaryInJson, rewriteReasoningSummaryInJsonString, routeUsesContentChannelReasoning, } from "../responses-reasoning-summary-rewrite"; @@ -1004,8 +1012,12 @@ export function usesCodexForwardPoolAuth( function codexWsQuotaObserver(authCtx: CodexAuthContext, provider: OcxProviderConfig): CodexWsQuotaObserver | undefined { if (!isCanonicalOpenAiForwardProvider(provider) || !usesCodexForwardPoolAuth(authCtx, provider)) return undefined; const { accountId, writerGeneration } = authCtx; + const credentialGeneration = authCtx.kind === "pool" ? authCtx.generation : undefined; const mainWriter = authCtx.kind === "main-pool" ? authCtx.mainQuotaWriter : undefined; - return headers => applyCapturedCodexQuota(accountId, headers, writerGeneration, mainWriter); + return headers => { + if (credentialGeneration !== undefined && !isCodexAccountGenerationLive(accountId, credentialGeneration)) return; + applyCapturedCodexQuota(accountId, headers, writerGeneration, mainWriter); + }; } export function preAuthUpstreamHostCircuitKey( @@ -1661,6 +1673,8 @@ export interface HandleResponsesOptions { onCodexAuthContextResolved?: (context: CodexAuthContext | undefined) => void; /** Internal deterministic seam for account-gated native fallback tests. */ resolveCodexModelEntitlements?: typeof resolveCodexModelEntitlements; + /** Internal: validated final client-visible model, after completed terminal success only. */ + onResponseComplete?: (model: string) => void; recordTerminalOutcomes?: boolean; setTerminalOutcomeRecorder?: (recorder: ((status: ResponsesTerminalStatus, httpStatusOverride?: number) => void) | undefined) => void; onNativePassthroughTerminal?: (status: ResponsesTerminalStatus) => void; @@ -1861,34 +1875,54 @@ export function createChildPassthroughCallbackGate(options: HandleResponsesOptio let state: "pending" | "committed" | "discarded" = "pending"; let pending: Pending | undefined; let accepted = false; + let pendingModel: string | undefined; + let completionAccepted = false; + let completionRejected = false; const publish = (value: Pending): void => { if (value.kind === "terminal") options.onNativePassthroughTerminal?.(value.status); else options.onNativePassthroughCancel?.(); }; + const publishCompletion = (): void => { + if (state !== "committed" || completionRejected || pendingModel === undefined) return; + const model = pendingModel; + pendingModel = undefined; + options.onResponseComplete?.(model); + }; const receive = (value: Pending): void => { if (state === "discarded" || accepted) return; accepted = true; + if (value.kind === "cancel" || value.status !== "completed") { + completionRejected = true; + pendingModel = undefined; + } if (state === "committed") return publish(value); pending ??= value; }; return { onTerminal: (status: ResponsesTerminalStatus) => receive({ kind: "terminal", status }), onCancel: () => receive({ kind: "cancel" }), + onResponseComplete: (model: string) => { + if (state === "discarded" || completionRejected || completionAccepted || !model.trim()) return; + completionAccepted = true; + pendingModel = model; + publishCompletion(); + }, commit: () => { if (state !== "pending") return; state = "committed"; if (pending) publish(pending); pending = undefined; + publishCompletion(); }, discard: () => { state = "discarded"; pending = undefined; + pendingModel = undefined; }, }; } - export function buildComboChildHeaders(parentHeaders: HeadersInit): Headers { const childHeaders = new Headers(parentHeaders); // Combo children re-serialize already-decoded JSON. Keeping transport metadata from @@ -2689,9 +2723,22 @@ export async function handleComboResponses( (logCtx.attempts ??= []).push(attempt); attemptRetained = true; }; + const completedTarget = { provider: pick.target.provider, model: pick.target.model }; + const writerGeneration = pick.writerGeneration; let consumedChildFailure: ConsumedComboFailure | undefined; const callbackGate = createChildPassthroughCallbackGate({ ...options, + onResponseComplete: model => { + // The live config can change while the child is streaming. Never retain credentials. + const currentCombo = getCombo(config, comboId); + const provider = config.providers[completedTarget.provider]; + if (Object.hasOwn(config.providers, completedTarget.provider) + && provider && provider.disabled !== true + && currentCombo?.targets.some(target => targetKey(target) === targetKey(completedTarget))) { + rememberComboForLane(sessionLaneIdFromRequest(req.headers), comboId, completedTarget, model, writerGeneration); + } + options.onResponseComplete?.(model); + }, onNativePassthroughTerminal: status => { // A committed stream can acquire terminal metadata after preflight copied // the child log. Publish it before the outer logger finalizes, but only @@ -2732,6 +2779,7 @@ export async function handleComboResponses( onStoredPool401ReplayDispatched: () => { storedPool401ReplayDispatched = true; }, onNativePassthroughTerminal: callbackGate.onTerminal, onNativePassthroughCancel: callbackGate.onCancel, + onResponseComplete: callbackGate.onResponseComplete, }); } catch (error) { callbackGate.discard(); @@ -3104,6 +3152,23 @@ async function handleResponsesInner( effort: comboEffortRow.effort, }; } + // Compaction may send the last client-visible bare model after a combo switch. + // Configured selectors take precedence; otherwise recall before combo dispatch (#3891). + if (!options.comboAttempt && body && typeof body === "object" && !Array.isArray(body)) { + const rawModel = (body as { model?: unknown }).model; + const rawInput = (body as { input?: unknown }).input; + const isCompactionTrigger = Array.isArray(rawInput) + && rawInput.some((item: unknown) => + typeof item === "object" && item !== null && (item as { type?: string }).type === "compaction_trigger"); + if (typeof rawModel === "string" && !rawModel.includes("/") && isCompactionTrigger + && !comboRows.fastRow && !comboEffortRow + && !resolveComboId(config, rawModel)) { + const recalledComboId = recallComboForLane(config, sessionLaneIdFromRequest(req.headers), rawModel); + if (recalledComboId) { + (body as Record).model = `combo/${recalledComboId}`; + } + } + } const comboId = !options.comboAttempt ? comboIdFromRawBody(body, config) : null; if (comboId && Object.hasOwn(config.combos ?? {}, comboId)) { options.onRequestBodyRead?.(); @@ -3595,14 +3660,16 @@ async function handleResponsesInner( // The canonical ChatGPT backend rejects previous_response_id, so a local replay miss leaves no // safe way to recover the omitted history. Fail before auth, adapter construction, or upstream // I/O instead of stripping the id and silently forwarding a context-free delta (#702). + // Codex recognizes previous_response_not_found on WebSocket errors and reconnects with its + // full input. A generic invalid_request_error instead terminates the task after cache expiry. if ( hasUnexpandedPreviousResponse && isCanonicalOpenAiForwardProvider(route.provider) ) { return formatErrorResponse( 400, - "invalid_request_error", - "OpenAI forward continuation state is unavailable or expired; start a new session instead of reusing this previous_response_id.", + "previous_response_not_found", + "OpenAI forward continuation state is unavailable or expired; resend the full conversation without previous_response_id.", ); } @@ -4305,6 +4372,17 @@ async function handleResponsesInner( } const recordTerminalOutcomes = options.recordTerminalOutcomes !== false; + let responseCompletionNotified = false; + let responseCompletionCancelled = false; + const cancelResponseCompletion = (): void => { responseCompletionCancelled = true; }; + const notifyResponseComplete = (response: { status?: unknown; model?: unknown }): void => { + if (responseCompletionNotified || responseCompletionCancelled + || options.abortSignal?.aborted || req.signal.aborted + || response.status !== "completed" + || typeof response.model !== "string" || !response.model.trim()) return; + responseCompletionNotified = true; + options.onResponseComplete?.(response.model); + }; const continuationStateForResponse = ( emitted?: OcxProviderContinuationState, @@ -4582,9 +4660,26 @@ async function handleResponsesInner( // check sees nothing undeclared, and the refused turn enters continuation state anyway. So the // rejection is sticky for the whole turn, set from every parsed payload on the inspection side. let inspectionSawUndeclaredTool = false; + let inspectedTerminal: ResponsesTerminalStatus | null = null; + let inspectedCompletionSeen = false; + let firstTerminalAllowsRecall = false; const passiveQuotaObserved = hasPassiveAccountQuota(route.providerName) && route.provider.authMode === "oauth"; const noteInspectedPayload = (payload: unknown) => { + // First terminal stays authoritative even in metadata-only inspection, which + // intentionally continues parsing after a failed/incomplete terminal. + const terminal = terminalStatusFromParsed(payload); + if (inspectedTerminal === null && terminal !== null) { + inspectedTerminal = terminal; + // The client boundary accepts a terminal by event type, even without a + // response object. Such a terminal must permanently decline recall. + if (terminal === "completed" && payload && typeof payload === "object" + && "response" in payload && payload.response && typeof payload.response === "object" + && !Array.isArray(payload.response) && "model" in payload.response) { + firstTerminalAllowsRecall = typeof payload.response.model === "string" + && payload.response.model.trim().length > 0; + } + } // Meta reports subscription usage ONLY as an in-stream event; there is no endpoint // to poll (003 §E probed 17 paths, all 404). Observed here rather than behind a // dedicated inspector handler because onParsedPayload already reaches every @@ -4606,8 +4701,7 @@ async function handleResponsesInner( // Gated on the same flag as the guard itself: with no readable catalog (or a forward-auth // provider) every name looks undeclared, and flipping this would stop recording continuation // state for exactly the passthrough traffic the guard deliberately stands down for. - if (!undeclaredToolGuardActive || inspectionSawUndeclaredTool) return; - if (undeclaredToolCallName( + if (undeclaredToolGuardActive && !inspectionSawUndeclaredTool && undeclaredToolCallName( restoreAuthorizedBareNamespaceToolCalls(payload), declaredWireToolNames, declaredNamelessClientCallTypes, @@ -4615,33 +4709,61 @@ async function handleResponsesInner( ) !== undefined) { inspectionSawUndeclaredTool = true; } + // The snapshot callback opts the inspector into output reconstruction. Compaction + // has no continuation cache, so use the parsed terminal here without adding retention. + if (!rememberPassthroughResponse && payload && typeof payload === "object" + && "type" in payload && payload.type === "response.completed" + && "response" in payload && payload.response && typeof payload.response === "object" + && !Array.isArray(payload.response)) { + rememberPassthroughResponseChecked(payload.response as Record); + } }; - const rememberPassthroughResponseChecked = rememberPassthroughResponse - ? (response: { id?: unknown; output?: unknown; status?: unknown }) => { - if (inspectionSawUndeclaredTool) return; - const restored = restoreRoutedCustomCalls( - restoreAuthorizedBareNamespaceToolCalls(restoreRoutedNamespaceCalls(response, routedNamespaceToolAliases).value), - routedCustomToolNames, - routedCustomToolRepairNames, + const rememberPassthroughResponseChecked = ( + response: { id?: unknown; output?: unknown; status?: unknown; model?: unknown }, + ) => { + if (inspectionSawUndeclaredTool) return; + const restored = restoreRoutedCustomCalls( + restoreAuthorizedBareNamespaceToolCalls(restoreRoutedNamespaceCalls(response, routedNamespaceToolAliases).value), + routedCustomToolNames, + routedCustomToolRepairNames, + declaredWireToolNames, + ).value; + const restoredResponse = (functionRepairSchemas.size > 0 + ? JSON.parse(normalizeFunctionCompletionJson(JSON.stringify(restored))) + : restored) as { id?: unknown; output?: unknown; status?: unknown }; + // Replay overlap compares the items the client echoes, including visible reasoning shape. + const replayResponse = parsed.options.hideThinkingSummary !== true + && routeUsesContentChannelReasoning(route.provider, route.modelId) + ? rewriteReasoningSummaryInJson(restoredResponse) as typeof restoredResponse + : restoredResponse; + if ( + undeclaredToolGuardActive + && undeclaredToolCallNameInResponse( + restoredResponse, declaredWireToolNames, - ).value; - const restoredResponse = (functionRepairSchemas.size > 0 - ? JSON.parse(normalizeFunctionCompletionJson(JSON.stringify(restored))) - : restored) as { id?: unknown; output?: unknown; status?: unknown }; - if ( - undeclaredToolGuardActive - && undeclaredToolCallNameInResponse( - restoredResponse, - declaredWireToolNames, - declaredNamelessClientCallTypes, - providerExecutedCallTypes, - ) !== undefined - ) { - return; + declaredNamelessClientCallTypes, + providerExecutedCallTypes, + ) !== undefined + ) { + return; + } + rememberPassthroughResponse?.(replayResponse); + const firstCompletion = !inspectedCompletionSeen; + inspectedCompletionSeen = true; + if (firstCompletion && (inspectedTerminal === null || firstTerminalAllowsRecall)) { + // A model-less first completion permanently declines recall; later terminal + // frames are hidden by the client boundary and cannot supply its identity. + // Native inspection sees the pre-rewrite model. Only an actual terminal + // model can seed recall; an absent model never falls back to the pick. + if (typeof response.model === "string" && response.model.trim()) { + notifyResponseComplete({ + status: response.status, + model: parsed._responseModelId !== undefined && parsed._responseModelId !== parsed.modelId + ? parsed._responseModelId : response.model, + }); } - rememberPassthroughResponse(restoredResponse); } - : undefined; + }; recordAdapterReasoning(logCtx, request); recordAdapterTier(logCtx, request); const actualHostKey = upstreamHostHealthKey( @@ -5649,7 +5771,7 @@ async function handleResponsesInner( const inspector = createSseInspector({ onTerminal: reportNativeTerminal, logCtx, - onCompletedResponse: rememberPassthroughResponseChecked, + onCompletedResponse: rememberPassthroughResponse ? rememberPassthroughResponseChecked : undefined, onParsedPayload: noteInspectedPayload, onFirstOutput: options.onFirstOutput, pinCompletedResponseIdToFirstSeen: githubCopilotRepairEnabled, @@ -5679,7 +5801,10 @@ async function handleResponsesInner( reportNativeTerminal("failed", 502); } }, - onClientCancel: () => options.onNativePassthroughCancel?.(), + onClientCancel: () => { + responseCompletionCancelled = true; + options.onNativePassthroughCancel?.(); + }, onDone: () => unregisterTurn(turnAc), }, { clientGoneSignal: options.abortSignal, @@ -5741,8 +5866,11 @@ async function handleResponsesInner( turnAc.signal, () => unregisterTurn(turnAc), logCtx, - () => options.onNativePassthroughCancel?.(), - rememberPassthroughResponseChecked, + () => { + responseCompletionCancelled = true; + options.onNativePassthroughCancel?.(); + }, + rememberPassthroughResponse ? rememberPassthroughResponseChecked : undefined, options.onFirstOutput, inspectionConsumerOptions, ); @@ -5752,7 +5880,7 @@ async function handleResponsesInner( logCtx, turnAc.signal, () => unregisterTurn(turnAc), - rememberPassthroughResponseChecked, + rememberPassthroughResponse ? rememberPassthroughResponseChecked : undefined, options.onFirstOutput, inspectionConsumerOptions, ); @@ -5767,7 +5895,10 @@ async function handleResponsesInner( const clientBody = relaySseWithFailedTail( rewrittenBody, upstream, - reason => clientGone.abort(reason), + reason => { + responseCompletionCancelled = true; + clientGone.abort(reason); + }, { upstreamError: logCtx.upstreamError }, ); return markNativePassthroughSseResponse(new Response(clientBody, { @@ -5847,13 +5978,11 @@ async function handleResponsesInner( } } commitReasoningReplayServingRoute(); - if (rememberPassthroughResponseChecked) { - try { - rememberPassthroughResponseChecked( - JSON.parse(text) as { id?: unknown; output?: unknown; status?: unknown }, - ); - } catch { /* non-JSON despite content-type; recording is best-effort */ } - } + try { + rememberPassthroughResponseChecked( + JSON.parse(text) as { id?: unknown; output?: unknown; status?: unknown; model?: unknown }, + ); + } catch { /* non-JSON despite content-type; recording is best-effort */ } // #875: the transport-neutral reliability policy forced a bounded JSON // upstream for a client that asked for SSE. Reframe the completed JSON // as the canonical terminal SSE sequence (created → output_item.done → @@ -6187,10 +6316,12 @@ async function handleResponsesInner( continuationStateForResponse(providerState), responseStateOptions(adapterNeedsForcedContinuation(adapter.name)), ); + notifyResponseComplete(response); }, }); if (imgResponse.body) { const imgTurnAc = new AbortController(); + imgTurnAc.signal.addEventListener("abort", cancelResponseCompletion, { once: true }); return new Response(trackStreamLifetime(imgResponse.body, imgTurnAc, undefined, options.turnAdmissionLease), { status: imgResponse.status, headers: imgResponse.headers, @@ -6261,12 +6392,16 @@ async function handleResponsesInner( streamRoutedModelOutput: wsPlan.streamRoutedModelOutput, on429: rotateSidecarProviderOn429, retryOn429Policy: rateLimitRetryPolicyFor(route.provider), - onCompletedResponse: commitReasoningReplayServingRoute, + onCompletedResponse: response => { + commitReasoningReplayServingRoute(); + notifyResponseComplete(response); + }, }); // Register the sidecar stream as an active turn so drainAndShutdown waits for (or aborts) // in-flight web-search turns instead of skipping them during graceful shutdown. if (wsResponse.body) { const wsTurnAc = new AbortController(); + wsTurnAc.signal.addEventListener("abort", cancelResponseCompletion, { once: true }); return new Response(trackStreamLifetime(wsResponse.body, wsTurnAc, undefined, options.turnAdmissionLease), { status: wsResponse.status, headers: wsResponse.headers, @@ -6490,6 +6625,7 @@ async function handleResponsesInner( const sseStream = bridgeToResponsesSSE( guardedSource, parsed._responseModelId ?? parsed.modelId, toolNsMap, freeformToolNames, toolSearchToolNames, () => { + cancelResponseCompletion(); runTurnAbort.abort(); queue.close(); }, 2_000, @@ -6526,6 +6662,7 @@ async function handleResponsesInner( responseStateOptions(adapterNeedsForcedContinuation(adapter.name)), ); } + notifyResponseComplete(response); }, }, ); @@ -6602,6 +6739,7 @@ async function handleResponsesInner( if (adapterResponseReachedServingTerminal(events, json)) { commitReasoningReplayServingRoute(); } + notifyResponseComplete(json); return new Response(JSON.stringify(json), { headers: { "Content-Type": "application/json" } }); } @@ -6649,10 +6787,11 @@ async function handleResponsesInner( toolBridgeMaps.toolNsMap, toolBridgeMaps.freeformToolNames, toolBridgeMaps.toolSearchToolNames, - undefined, + cancelResponseCompletion, 2_000, { translatorBudget, + onCompletedResponse: notifyResponseComplete, ...(options.forceEmptyResponseId ? { responseId: "" } : {}), ...(options.onFirstOutput ? { onFirstOutput: options.onFirstOutput } : {}), }, @@ -6673,12 +6812,9 @@ async function handleResponsesInner( }, ); } - return new Response( - JSON.stringify(buildResponseJSON(terminalEvents, parsed._responseModelId ?? parsed.modelId, { - translatorBudget, - })), - { headers: { "Content-Type": "application/json" } }, - ); + const json = buildResponseJSON(terminalEvents, parsed._responseModelId ?? parsed.modelId, { translatorBudget }); + notifyResponseComplete(json); + return new Response(JSON.stringify(json), { headers: { "Content-Type": "application/json" } }); } // One request-scoped transient-retry budget owner, declared here so BOTH the initial send // and the later recovery refetches (429, key/account rotation, OAuth replay) share it. A @@ -7660,7 +7796,7 @@ async function handleResponsesInner( const { toolNsMap, declaredToolNames, toolParameterSchemas, freeformToolNames, toolSearchToolNames } = toolBridgeMaps; const sseStream = bridgeToResponsesSSE( guardedEventStream, parsed._responseModelId ?? parsed.modelId, toolNsMap, freeformToolNames, toolSearchToolNames, - () => upstream.abort(), 2_000, + () => { cancelResponseCompletion(); upstream.abort(); }, 2_000, { translatorBudget, replayCacheScope: parsed._reasoningReplayScope, @@ -7695,6 +7831,7 @@ async function handleResponsesInner( responseStateOptions(activeAdapter.name === "kiro"), ); } + notifyResponseComplete(response); }, }, ); @@ -7774,6 +7911,7 @@ async function handleResponsesInner( if (adapterResponseReachedServingTerminal(events, json)) { commitReasoningReplayServingRoute(); } + notifyResponseComplete(json); return new Response(JSON.stringify(json), { headers: { "Content-Type": "application/json" } }); } diff --git a/src/types/config.ts b/src/types/config.ts index 017d01a94a..0b0a2b2b98 100644 --- a/src/types/config.ts +++ b/src/types/config.ts @@ -469,8 +469,8 @@ export interface OcxConfig { */ syncCodexSubagentDefaults?: boolean; /** - * Optional reasoning effort the delegation prompt tells the agent to pass in spawn_agent calls - * (`reasoning_effort` argument). Only meaningful while `injectionModel` is set; validated against + * Optional reasoning effort reported as advisory metadata in v2 sub-agent guidance. + * It does not prescribe spawn overrides. Only meaningful while `injectionModel` is set; validated against * the Codex ladder (src/reasoning-effort.ts CODEX_REASONING_LEVELS) at the API boundary. */ injectionEffort?: string; @@ -513,7 +513,7 @@ export interface OcxConfig { streamMode?: "auto" | "legacy-tee" | "eager-relay"; /** * Custom override for the injected v2 multi-agent guidance body (the text inside - * the tags). After guidance is enabled and the v2 surface and + * the tags). After guidance is enabled and the v2 surface and * catalog-state gates pass, a configured injectionModel is sufficient to render it; * otherwise an eligible roster or fallback is required. Placeholders: `{{model}}` -> the * effective preferred model for the request (a bare native model is account-qualified diff --git a/structure/02_config-and-codex-home.md b/structure/02_config-and-codex-home.md index 9478343d19..572c73f25f 100644 --- a/structure/02_config-and-codex-home.md +++ b/structure/02_config-and-codex-home.md @@ -284,6 +284,12 @@ and publication followed by a later failure can leave a complete config or priva foreign winner's ownership under future uninstall; the existing ownership manifest and global CLI shim preflight keep their separate contracts. +Initial publication diagnostics distinguish required permission-hardening failures from denied +hard-link publication without exposing raw filesystem causes. Both identify `OPENCODEX_HOME` +as the supported-location recovery path; uncertain publication and cleanup warnings remain in +the CLI. The quickstart documents inspection before retry, private-permission requirements, +and fresh-location examples. Diagnostics do not introduce a fallback or alter file I/O ordering. + `src/config/paths.ts` is the single owner of `OPENCODEX_HOME` expansion and resolution. It exposes the config directory and `config.json` path and retains the existing cache rule: a relative home is resolved once for each distinct raw environment value, so a later working-directory change cannot diff --git a/structure/03_catalog-and-subagents.md b/structure/03_catalog-and-subagents.md index b64cb4bce1..d3f20de401 100644 --- a/structure/03_catalog-and-subagents.md +++ b/structure/03_catalog-and-subagents.md @@ -465,6 +465,30 @@ cause delegation. The TOML edit owns only marker-tagged values, preserves existi user-owned `[agents]` defaults rather than overwriting them, and rejects ambiguous table shapes without changing the file. +V2 proxy guidance uses `` for both built-in metadata and +custom `injectionPrompt` bodies. The built-in text reports the resolved preferred model, +effort, roster and fallback chain without prescribing delegation, spawn overrides or +`fork_turns`. Custom bodies retain their placeholder behavior. The guidance switch and +catalog-state gates still apply; stale or unknown catalog state suppresses proxy guidance. +V1 retains its `` proactive text at `max` or `ultra`. + +Replay deduplication compares the latest exact generated developer text separately for +each tag family, preserving built-in → custom → built-in transitions without duplicating +unchanged proxy metadata after a native policy change. Native and legacy-tagged history +remain intact: tags do not establish historical authorship or revoke old instructions, +and mixed-version transition detection is not guaranteed. + +The native mode hint is separate from proxy guidance and native `[agents]` defaults. +`src/codex/multi-agent-mode-policy.ts` owns the proactive recommendation; the dashboard +obtains it from `/api/v2` rather than maintaining its own preset. An explicit dashboard, +API or CLI hint write passes through `setMultiAgentModeHintText`, which replaces only +the two byte-exact released OpenCodex presets with the current recommendation. Other +valid custom text, including whitespace variants, is preserved. Reads, unrelated writes +and upgrades do not migrate stored hints. The writer retains its native capability check +and stores only `features.multi_agent_v2.multi_agent_mode_hint_text` in Codex TOML; +`null` removes that key. The hint affects new native Codex sessions when their v2 surface +is active, without changing reasoning effort or the proxy guidance switch. + Claude Code `ocx-*` agent definitions consume the same effective `claudeCode.blockedSkills` policy as inbound bundle elision. When the list is non-empty (default: `claude-api`), generated definitions whose marker-stripped model resolves to a routed id receive a preventive instruction not to invoke diff --git a/structure/04_transports-and-sidecars.md b/structure/04_transports-and-sidecars.md index 256bd1eae5..c98c837cec 100644 --- a/structure/04_transports-and-sidecars.md +++ b/structure/04_transports-and-sidecars.md @@ -242,6 +242,13 @@ alone never opt a gateway in. and before the `/v1/*` guard. Unknown `/v1/*` paths return JSON 404 errors instead of falling through to GUI static serving. +Combo compaction recall uses accepted completed-response callbacks to record the final client-visible +model and originating combo target. The existing child callback gate defers publication until an +attempt is accepted and drops discarded/failed attempts. Both compaction entry points preserve +explicit configured selectors before consulting bounded lane state. The existing state-store +reconciliation owns removal of obsolete targets and generation fencing; core imports no registration +composition root or Lab code. Recall retains routing identity only, never account credentials. + [Decision Log] - 목적과 의도: Complete Cursor turns at the protocol terminal instead of waiting for a separate HTTP-body EOF that may never arrive. - 기존 구현 및 제약 조건: Cursor can send turnEnded followed by a clean Connect END_STREAM envelope while RunSSE remains open or later closes through an abort-shaped transport error. The adapter logged the clean envelope but did not settle its terminal owner, so a completed-looking turn could remain open until the Responses stall watchdog. @@ -366,6 +373,22 @@ have no exec-result seam today and are not annotated. - 다른 대안 대신 이 방식을 선택한 이유: One-field stripping exposes the next schema mismatch and turning `external_web_access:false` into xAI live search widens the caller's network policy; destination scoping leaves custom gateways and canonical OpenAI byte-shape native. - 장점, 단점 및 영향: Grok 4.5/4.6 no longer fail every default Codex turn with an unsupported-argument 400; live search remains available when explicitly enabled, while cached search degrades to no hosted search on xAI rather than silently going live. +### xAI string agent-message continuation + +`normalizeRoutedAgentMessages` owns raw Responses `agent_message` lowering. Its existing +nonempty all-readable array behavior remains shared by non-forward destinations. The optional +`allowStringContent` argument defaults to false and is enabled only by the non-forward adapter +call when `isXaiResponsesDestination` recognizes HTTPS `api.x.ai` or `cli-chat-proxy.grok.com` +on the standard port. A nonblank string becomes one `input_text` part with the original text; +the same author/recipient attribution is retained and the private transport item id is removed. + +This addresses readable child-result delivery (#3907), not scheduling or decryption. Blank, +malformed, ciphertext-only and mixed unknown/encrypted content retains the existing fail-closed +path. Forward destinations never enable the option. The parser and encrypted-task recovery +owners are unchanged, and no broad content-schema validation or adapter-wide string conversion +is introduced. Mocked server fixtures cover parent, child, and parent-result continuation over +SSE and JSON while preserving actual tool-call/result pairs. + OpenCode Go documents `gpt-5.6-luna` on `/zen/go/v1/responses` while sibling models use its Chat or Anthropic endpoints. The built-in preset therefore selects `openai-responses` only for Luna and keeps the provider-wide `openai-chat` default for other non-pinned models. This endpoint correction @@ -373,6 +396,32 @@ does not set `modelResponsesUpstreamStreaming`: client `stream: true` remains re streaming until a current-runtime reproduction justifies a separate bounded-JSON compatibility policy. +Go's non-forward Responses request path moves valid `additional_tools` wrappers into top-level +`tools` through `src/adapters/opencode-go-additional-tools.ts`. Placement runs after existing +custom/search/namespace lowering and before code-mode, compaction and final hosted-tool pruning. +It does not recalculate wire identities or response aliases. The matcher reads the constructed +send URL, resolving it with URL semantics, and requires HTTPS `opencode.ai`, the standard port +and exact `/zen/go/v1/responses`. Normal and endpoint-inclusive bases or split `responsesPath` +configurations agree; a custom path resolving to Zen or elsewhere does not acquire Go placement. +Credentials, query, fragment, foreign hosts and other resource paths are excluded. The existing +URL constructor canonicalizes trailing base slashes before this check. Malformed wrappers remain unchanged and +the shared mixed-ciphertext agent-message gate remains fail-closed. + +The canonical `opencode-go` registry entry defaults to `statelessResponses: true` because Go +rejects reasoning ciphertext combined with `previous_response_id` (#3838). Existing derive +logic fills absent values and preserves explicit false; renamed custom configurations receive +no new destination-based migration. The existing stateless pass sets `store: false`, removes +stored continuation parameters, and repairs orphan calls/results without claiming execution +success. A local replay-cache hit supplies history; a miss cannot reconstruct it, so callers +must resend complete history without `previous_response_id`. This flag also enables the existing +visible content-to-summary rewrite for SSE and JSON; summary-channel items and opaque reasoning +blobs keep their existing response handling. The shared recording callback applies the same +reasoning rewrite under the exact client-visible predicate before caching output, after tool +restoration and function normalization. This keeps full-content replay fingerprints comparable +for both full-history-plus-ID and delta continuations without weakening identity checks. Hidden +summaries and opaque blobs keep their existing cache representation. It does not change streaming selection or Chat +model routes. Go fixtures cover Luna, Grok and Muse against both response formats. + The canonical OpenCode Go transport also derives `x-opencode-session` from the existing hashed session lane before per-model wire selection. One conversation keeps one opaque affinity value across Responses, Chat, retries, and key rotation, while sibling subagents remain distinct. An @@ -1778,3 +1827,13 @@ The field is omitted when no classified recovery result exists, and existing com branches that return the original target failure keep that response. `recovery_unavailable` includes cache/singleflight capacity and does not prove an upstream request was attempted. No retry or broader envelope acceptance is enabled. + +## Voice diagnostic metadata + +`src/server/live.ts` owns optional `OCX_LIVE_FRAME_LOG` diagnostics for both sideband directions. +The JSONL schema contains only `ts`, `dir`, `kind`, `bytes`, and `fffd`. It never stores frame +content or transcript excerpts, and logging failures do not affect transparent frame delivery. +Binary detection decodes only the supplied buffer view; malformed UTF-8 can itself produce U+FFFD, +so the flag does not identify the peer responsible for corruption. Existing diagnostic files are +not rewritten. Audio devices, WebRTC media negotiation, captions and spoken handoff delivery remain +client responsibilities. diff --git a/structure/05_gui-and-management-api.md b/structure/05_gui-and-management-api.md index c1562df4ec..d6e66375b7 100644 --- a/structure/05_gui-and-management-api.md +++ b/structure/05_gui-and-management-api.md @@ -126,7 +126,7 @@ this document owns is which module holds which area and what invariant that area | Key providers | `GET /api/key-providers` exposes API-key provider presets for setup and dashboard flows, and `GET/POST/DELETE /api/keys` owns the proxy's own admission keys. Multi-key pool per key-auth provider: `GET /api/providers/keys`, `POST /api/providers/keys`, `PUT /api/providers/keys/active`, `PUT /api/providers/keys/alias`, `DELETE /api/providers/keys` masked list, add (upsert + activate), switch, rename, and remove keys. `provider.apiKey` always mirrors the active pool entry so routing stays single-key. | | OpenAI account mode | Report one OpenAI Codex card with Pool/Direct controls and one API-key card. Mode PATCH persists live without restart or catalog identity changes; Pool owns account/quota controls and Direct uses caller/main login only. Main-account DTOs report real credential presence and terminal `needsReauth` state instead of treating missing/invalid native auth as an unknown quota. Selection order has its own route: `PUT /api/codex-auth/accounts/priority` takes `{ id, priority }`, where `priority` is an integer -100..100 or `null` to restore the default, accepts `__main__`, 404s an unknown id, and echoes the stored value. Re-ordering never clears thread affinity, so the response carries no `appliesImmediately`, but it does release any pin — see [`08_openai-provider-tiers.md`](08_openai-provider-tiers.md) for why. `PUT /api/codex-auth/active` with a null id releases one too, but that drops the operator's account selection along with it, so this route is the only operator-facing way to clear a pin while leaving the selected account in place. `GET /api/codex-auth/active` reports `pinned`, true only while the manually selected account is still the effective active one, plus `pinnedAccountId`, which names the pinned account whether or not it is the active one. Surfaces should render `pinnedAccountId`: under round-robin and fill-first the pin caps the tier ceiling at its own tier while the strategy cursor moves freely inside that tier, so `pinned` goes false on a sibling's turn even though the pin is still suppressing every higher tier — which is why the dashboard badges `pinnedAccountId` and the GUI controller tracks only the id. `pinned` answers the narrower question of whether routing is *currently* on the operator's choice; no surface in this repo asks it, and a new one almost certainly wants the id instead. | | Subagents | Read/write the featured `subagentModels` list capped at five ids. `GET/PUT /api/injection-model` manages the shared delegation model/effort selection, the independent OpenCodex guidance switch, and the default-off `syncCodexSubagentDefaults` opt-in for native Codex subagent defaults. When OpenCodex owns the active Codex routing, native `[agents]` defaults apply to newly created Codex tasks after sync/restart; external user-managed provider configs remain untouched. The defaults do not cause delegation and preserve existing user-owned defaults rather than overwriting them. PUT is partial-update: absent keys are unchanged, `null` clears, and non-object bodies are rejected with 400 before field validation. `syncCodexSubagentDefaults: true` requires a nonblank `model` and a supported Codex reasoning effort when effort is set; clearing `model` (null/empty) always clears effort and disables native-default sync even when the stored effort was invalid. | -| V2 / Multi-agent mode | `GET/PUT /api/v2` — reports/sets the codex `multi_agent_v2` feature flag, the 3-state `multiAgentMode` override (`v1`/`default`/`v2`), the `keepNativeChatGptOnV1` hybrid pin, and the logical maximum thread count. Selecting `v2` normally enables the native flag; with the hybrid pin it disables that global override so native rows can resolve to v1 while routed rows resolve to v2. Selecting `v1` disables the flag; `default` leaves it unchanged. PUT rejects an explicit enabled flag that conflicts with the selected mode or hybrid pin. Every transition preserves the logical thread limit, is rollback-safe, and resyncs the catalog. | +| V2 / Multi-agent mode | `GET/PUT /api/v2` — reports/sets the codex `multi_agent_v2` feature flag, the 3-state `multiAgentMode` override (`v1`/`default`/`v2`), the `keepNativeChatGptOnV1` hybrid pin, and the logical maximum thread count. Selecting `v2` normally enables the native flag; with the hybrid pin it disables that global override so native rows can resolve to v1 while routed rows resolve to v2. Selecting `v1` disables the flag; `default` leaves it unchanged. PUT rejects an explicit enabled flag that conflicts with the selected mode or hybrid pin. Every transition preserves the logical thread limit, is rollback-safe, and resyncs the catalog. GET and successful PUT also return stored `multiAgentModeHintText` plus response-only `multiAgentModeHintRecommendation: { text, revision }`; the recommendation is not a writable or persisted config field. | | Logs & Debug | One sidebar entry (`/#logs`) with two tabs. Logs tab: request/runtime logs for local diagnosis. `LogsFilterBar` owns controls over the shared `LogFilterState`; `filterLogs` composes filters over the loaded ring. The logs envelope adds `generatedAt` (proxy epoch milliseconds); the page advances that sample with monotonic elapsed time and retains a browser-clock fallback for older proxies. Reset returns focus to the stable All surface radio. Provider/model options include attempts, model choices match normalized complete identities, and relative-time filtering refreshes every 30 seconds while the Logs tab is active, independently of network auto-refresh. Debug tab (`/#logs/debug`; legacy `/#debug` deep links redirect there): provider + usage toggles, refresh/follow log viewer. `GET/PUT /api/debug`; `GET /api/debug/logs` and `GET /api/debug/usage-logs` (monotonic `after` cursor, legacy `since` accepted). CLI: `ocx debug provider|usage …` (both streams via running proxy API). | | Usage | `GET /api/usage` aggregate read-only summary derived from the complete `~/.opencodex/usage.jsonl`; the ledger is streamed in fixed 1 MiB chunks, so the former read-byte and parsed-row caps cannot omit its prefix. The response includes measured / reported / unreported / unsupported / estimated counts, a daily zero-filled grid, and model and provider breakdowns. Never exposes prompts. | | System | `POST /api/system/restart` restarts the proxy in place. Local CLI/tray callers first attest the exact runtime PID and port, then send a process-scoped HMAC capability bound to that method, path, PID, and port; the capability authorizes no other management route and is invalid after replacement. The caller observes one absolute deadline and accepts success only after a different runtime PID is healthy on the same port. `GET /api/system/health` is the authenticated scalar-only identity used by shared-plane Dashboard status and restart reconnect polling; it does not widen a Remote Hub management ingress to unauthenticated `/healthz`. `GET /api/system/memory` — service-process runtime/memory identity (pid, Bun version/revision, optional `bunRuntimeSource` provenance, platform, RSS/heap/external/ArrayBuffers scalars, observed memory = max(RSS, external, ArrayBuffers), `bun:jsc` heap context, streamMode + eager-relay gate decision, watchdog snapshot sliced to the last 60 samples) plus privacy-safe `appOwnedBytes` retained-store totals/counters under static store ids. Its response-state block also reports spill-write `initial`/`healthy`/`degraded` status, a consecutive-failure streak, fixed error class, and failure/success timestamps. A successful publication clears the streak in the same process; raw error text and paths never enter this surface. Scalar-only payload; dashboard/admin callers use the standard management gate, while `ocx doctor` may use only the exact process-scoped local-read capability. It must never move to unauthenticated `/healthz`. | @@ -377,6 +377,20 @@ Subagent fallback settings load independently of the main roster. Their failure fallback controls and provides a retry; available fallback options come from that endpoint's availability list while already-configured stale values remain editable. +Subagents → Advanced uses the current API server's recommendation for **Always proactive +delegation** (formerly Ultra mode). Enabling requires the native v2 flag, explicit v2 mode +and a recommendation with nonblank string text and revision. Missing or malformed +recommendations disable preset installation and restoration while existing custom hints +remain editable and clearable. Restore changes only the editor draft; Save writes it. +Recommendation-only refreshes preserve unsaved drafts. Switching API servers hides the +previous hint and blocks mode writes until the new server's settings arrive. + +An explicit `multiAgentModeHintText` write canonicalizes only the two byte-exact legacy +OpenCodex presets; other valid custom text keeps its bytes. GET, unrelated PUTs and upgrades +leave stored hints unchanged. `null` clears the hint, blank strings are rejected, and the +existing native capability check still precedes writes. The text and revision recommendation +is supplied independently of stored TOML and is not evidence of native runtime support. + Account quota discovery is capability-based. Cheap OAuth and provider-key lists include `quotaMode` (`probe`, `passive`, or `unsupported`) without contacting upstream quota APIs. `GET /api/oauth/accounts?provider=..."a=1` and diff --git a/structure/06_docs-and-release.md b/structure/06_docs-and-release.md index 8c6149802b..9475dba43e 100644 --- a/structure/06_docs-and-release.md +++ b/structure/06_docs-and-release.md @@ -217,15 +217,19 @@ separate channel-aware invariant and release-note baseline design. ### Release notes -Release notes are rendered OpenAI-Codex-style by `scripts/release-notes.ts render` inside -`.github/workflows/release.yml`: `## New Features` / `## Bug Fixes` / `## Documentation` / -`## Chores` / `## Other Changes` sections with prefix-free, scope-grouped summary bullets -(`- Providers: Add X; Add Y (#1, #2)`), followed by a `## Changelog` section listing every PR -as `- #N @author`; when a comparison baseline exists, that section also includes a -compare link. Carried preview changelogs and the since-preview delta feed the same renderer, -so stable notes are the aggregate of their preview train. The raw commit dump is -intentionally gone — non-PR commits stay reachable via the Full Changelog compare link when -that link is available. +The release workflow invokes `scripts/build-release-changelog.ts`, which builds notes from +the actual Git range and uses generated PR notes as enrichment. Its categorized summaries +contain one bullet per PR or direct commit, followed by `## Changelog` entries retaining PR +titles and authors or sanitized direct-commit text. A comparison baseline adds a compare link. +Preview notes are incremental; stable notes cover the range since the previous stable tag. +The standalone `scripts/release-notes.ts render` command retains its separate scope-grouped +summary and carried-preview rendering behavior. + +Both renderers strip the exact leading `[WRONG BRANCH]` marker followed by one ASCII space +from PR summary bullets and full-changelog titles. Other bracketed text is preserved. +Summary bullets remove conventional commit prefixes; PR changelog entries keep those prefixes, +PR numbers, and author attribution. This normalization does not change category selection, +direct-commit coverage, or PR-target enforcement. The deterministic renderer produces the structure but not curated prose. Maintainers who want the OpenAI-style grouped summaries can run the optional local polish step against the rendered diff --git a/structure/08_openai-provider-tiers.md b/structure/08_openai-provider-tiers.md index 834cbd46ee..91627acaf0 100644 --- a/structure/08_openai-provider-tiers.md +++ b/structure/08_openai-provider-tiers.md @@ -72,6 +72,20 @@ requests keep their captured credential. An all-paused pool fails closed. The dashboard's bulk pause action refreshes all account quotas and mutates only accounts whose plan-relevant window is freshly confirmed at exactly 100%; unknown and failed refreshes are skipped. +A confirmed manual reset-credit consumption may immediately reconcile that account's +eligible pre-existing ordinary reset-derived cooldown after a complete, non-exhausted usage +observation started after the reset. Paused or reauthentication-required accounts and +cooldowns held by another in-flight probe remain excluded; their cooldowns are retained. +Recovery owns the specific cooldown and authenticates +main and added Pool accounts through their respective credential contracts. Main usage +publication keeps the latest successfully published observation authoritative. Pool recovery +across a credential refresh requires the actual self/joined refresh lineage, not matching +replacement timestamps. It preserves +newer failures, independent Spark/Reserve scopes, explicit Retry-After, pause, pin and +selection state. Replay and `already_redeemed` are not new-reset evidence. Failed usage +recovery leaves the cooldown in place and preserves the confirmed consume success; +retrying usage must not require another credit. + `codexQuotaAutoRefresh` is a separate default-off spending intent. For each explicitly enabled account/window, the one-minute state sweep compares the cached upstream reset timestamp, sends the existing minimal non-stored warmup through that exact account once the timestamp is due, then diff --git a/tests/providers/opencode-go-agent-messages.test.ts b/tests/adapters/routed-agent-messages.test.ts similarity index 50% rename from tests/providers/opencode-go-agent-messages.test.ts rename to tests/adapters/routed-agent-messages.test.ts index f79f529a5e..2a44d11862 100644 --- a/tests/providers/opencode-go-agent-messages.test.ts +++ b/tests/adapters/routed-agent-messages.test.ts @@ -1,6 +1,6 @@ import { expect, test } from "bun:test"; import { createResponsesPassthroughAdapter } from "../../src/adapters/openai-responses"; -import { isOpenCodeGo, normalizeOpenCodeGoAgentMessages } from "../../src/adapters/opencode-go"; +import { normalizeRoutedAgentMessages } from "../../src/adapters/routed-agent-messages"; import { parseRequest } from "../../src/responses/parser"; import { routeModel } from "../../src/router"; import { createTranslatorBudget } from "../../src/lib/translator-budget"; @@ -26,17 +26,113 @@ test("Responses converts plaintext task and peer messages without mutating repla test("ciphertext and unknown content are never reclassified as plaintext", () => { for (const part of [{ type: "encrypted_content", encrypted_content: "opaque" }, { type: "future_type", text: "opaque" }]) { const raw = { input: [{ type: "agent_message", content: [part] }] }; - expect(normalizeOpenCodeGoAgentMessages(raw)).toBe(raw); + expect(normalizeRoutedAgentMessages(raw)).toBe(raw); + } +}); + +test("string agent messages require an explicit opt-in and preserve exact text", () => { + const text = " Child result\nwith a trailing line.\n "; + const message = Object.freeze({ type: "agent_message", id: "amsg_string", content: text }); + const raw = Object.freeze({ input: Object.freeze([message]) }); + expect(normalizeRoutedAgentMessages(raw)).toBe(raw); + expect(normalizeRoutedAgentMessages(raw, { allowStringContent: false })).toBe(raw); + expect(normalizeRoutedAgentMessages(raw, { allowStringContent: true })).toEqual({ input: [{ + type: "message", role: "user", content: [{ type: "input_text", text }], + }] }); + expect(raw.input[0]).toBe(message); + expect(message.content).toBe(text); +}); + +for (const baseUrl of ["https://api.x.ai/v1", "https://cli-chat-proxy.grok.com/v1"]) { + test.each(["key", "oauth"] as const)(`${baseUrl} lowers string child results with %s auth`, async authMode => { + const raw = { model: "grok-4.6", stream: true, input: [{ + type: "agent_message", id: "amsg_string", author: "/root/worker", recipient: "/root", + content: " Complete child result\nSecond line.\n ", + }] }; + const original = structuredClone(raw); + const parsed = parseRequest(raw); + const budget = createTranslatorBudget(); + try { + const request = await createResponsesPassthroughAdapter({ ...base, baseUrl, authMode }).buildRequest(parsed, { + headers: new Headers(), translatorBudget: budget, + }); + const sent = JSON.parse(request.body as string); + expect(sent.input).toEqual([{ + type: "message", role: "user", content: [ + { type: "input_text", text: 'Agent message {"author":"/root/worker","recipient":"/root"}' }, + { type: "input_text", text: original.input[0]!.content }, + ], + }]); + expect(parsed._rawBody).toBe(raw); + expect(raw).toEqual(original); + } finally { + budget.dispose(); + } + }); +} + +test.each([ + { baseUrl: "https://chatgpt.com/backend-api/codex", authMode: "forward" as const }, + { baseUrl: "https://api.x.ai/v1", authMode: "forward" as const }, + { baseUrl: "https://cli-chat-proxy.grok.com/v1", authMode: "forward" as const }, + { baseUrl: "https://custom.test/v1", authMode: "forward" as const }, + { baseUrl: "https://opencode.ai/zen/go/v1", authMode: "key" as const }, + { baseUrl: "https://example.test/v1", authMode: "key" as const }, + { baseUrl: "https://api.x.ai.evil.test/v1", authMode: "key" as const }, + { baseUrl: "https://cli-chat-proxy.grok.com.evil.test/v1", authMode: "key" as const }, + { baseUrl: "http://api.x.ai/v1", authMode: "key" as const }, + { baseUrl: "https://api.x.ai:444/v1", authMode: "key" as const }, +])("preserves string messages for $authMode at $baseUrl", async destination => { + const raw = { model: "grok-4.6", input: [{ type: "agent_message", content: "Child result" }] }; + const original = structuredClone(raw); + const budget = createTranslatorBudget(); + try { + const request = await createResponsesPassthroughAdapter({ ...base, ...destination }).buildRequest(parseRequest(raw), { + headers: new Headers(), translatorBudget: budget, + }); + expect(JSON.parse(request.body as string).input).toEqual(original.input); + expect(raw).toEqual(original); + } finally { + budget.dispose(); + } +}); + +test.each([ + "", " \n\t", null, 42, { text: "not a content string" }, [], + [{ type: "encrypted_content", encrypted_content: "opaque" }], + [{ type: "input_text", text: "Routing header" }, { type: "encrypted_content", encrypted_content: "opaque" }], + [{ type: "input_text", text: "Known prefix" }, { type: "future_type", text: "Unknown suffix" }], +].map(content => ({ content })))("xAI string opt-in leaves incomplete or unreadable content unchanged: %j", async ({ content }) => { + const raw = { model: "grok-4.6", input: [{ type: "agent_message", content }] }; + const original = structuredClone(raw); + expect(normalizeRoutedAgentMessages(raw, { allowStringContent: true })).toBe(raw); + const budget = createTranslatorBudget(); + try { + const request = await createResponsesPassthroughAdapter({ ...base, baseUrl: "https://api.x.ai/v1" }).buildRequest(parseRequest(raw), { + headers: new Headers(), translatorBudget: budget, + }); + expect(JSON.parse(request.body as string).input).toEqual(original.input); + expect(raw).toEqual(original); + } finally { + budget.dispose(); } }); test("image parts stay intact beside the assignment", () => { const image = { type: "input_image", image_url: "data:image/png;base64,AAAA", detail: "high" }; const raw = { input: [{ type: "agent_message", content: [{ type: "input_text", text: "Inspect image" }, image] }] }; - const result = normalizeOpenCodeGoAgentMessages(raw) as typeof raw; + const result = normalizeRoutedAgentMessages(raw) as typeof raw; expect(result.input[0]!.content[1]).toBe(image); }); +test("a body with no agent messages keeps its exact reference", () => { + const raw = { input: [{ type: "message", role: "user", content: [{ type: "input_text", text: "hi" }] }] }; + expect(normalizeRoutedAgentMessages(raw)).toBe(raw); + for (const shape of [null, "a string", [1, 2], { input: "not an array" }]) { + expect(normalizeRoutedAgentMessages(shape)).toBe(shape); + } +}); + test("native forward keeps agent_message and auth/session headers unchanged", async () => { const budget = createTranslatorBudget(); const provider = { ...base, baseUrl: "https://chatgpt.com/backend-api/codex", authMode: "forward" as const }; @@ -48,14 +144,43 @@ test("native forward keeps agent_message and auth/session headers unchanged", as budget.dispose(); }); -test("other destinations do not get Go normalization or session identity", async () => { +test("an arbitrary routed destination converts too, and gains no session identity", async () => { + // The 422 this guards against is not destination-specific: `agent_message` is private to + // the ChatGPT Codex backend, so any routed Responses target rejects the whole body. const budget = createTranslatorBudget(); - const request = await createResponsesPassthroughAdapter({ ...base, baseUrl: "https://example.test/v1" }).buildRequest(parseRequest(body()), { headers: new Headers({ "session-id": "child-id" }), translatorBudget: budget }); - expect(JSON.parse(request.body as string).input[0].type).toBe("agent_message"); + const raw = body(); + const original = structuredClone(raw); + const parsed = parseRequest(raw); + const request = await createResponsesPassthroughAdapter({ ...base, baseUrl: "https://example.test/v1" }).buildRequest(parsed, { headers: new Headers({ "session-id": "child-id" }), translatorBudget: budget }); + const sent = JSON.parse(request.body as string); + expect(sent.input[0]).toMatchObject({ type: "message", role: "user" }); + expect(sent.input[0].content.slice(1)).toEqual(original.input[0]!.content); expect(new Headers(request.headers).get("x-opencode-session")).toBeNull(); + expect(parsed._rawBody).toBe(raw); + expect(raw).toEqual(original); budget.dispose(); }); +test("an OAuth destination converts as well, since the gate reads authMode rather than the URL", async () => { + // The reported xAI/Grok failure (#3907) is an OAuth pool destination, not a key-auth + // one, and the gate is `authMode !== "forward"`. Pin a mode other than key/forward so + // a future narrowing of the gate back toward key-only cannot pass unnoticed. + const budget = createTranslatorBudget(); + const raw = body(); + const original = structuredClone(raw); + try { + const request = await createResponsesPassthroughAdapter({ + ...base, baseUrl: "https://api.x.ai/v1", authMode: "oauth" as const, + }).buildRequest(parseRequest(raw), { headers: new Headers(), translatorBudget: budget }); + const sent = JSON.parse(request.body as string); + expect(sent.input[0]).toMatchObject({ type: "message", role: "user" }); + expect(sent.input[0].content.slice(1)).toEqual(original.input[0]!.content); + expect(raw).toEqual(original); + } finally { + budget.dispose(); + } +}); + test("canonical Go forward auth preserves private agent messages and the raw replay body", async () => { const raw = body(); const original = structuredClone(raw); @@ -108,18 +233,21 @@ test.each([ "http://opencode.ai/zen/go/v1", "https://opencode.ai/zen/v1", "https://opencode.ai/zen/go/v10", -])("Go-like destination %s preserves private agent messages", async baseUrl => { +])("Go-like destination %s converts without inheriting any Go-specific handling", async baseUrl => { + // A spoofed or malformed Go URL is just another routed destination now. It gets the same + // conversion every routed target gets, and still no Go session identity. const raw = body(); const original = structuredClone(raw); const parsed = parseRequest(raw); const budget = createTranslatorBudget(); try { const request = await createResponsesPassthroughAdapter({ ...base, baseUrl }).buildRequest(parsed, { - headers: new Headers(), translatorBudget: budget, - }); - expect(JSON.parse(request.body as string).input[0]).toMatchObject({ - type: "agent_message", content: original.input[0]!.content, + headers: new Headers({ "session-id": "child-id" }), translatorBudget: budget, }); + const sent = JSON.parse(request.body as string); + expect(sent.input[0]).toMatchObject({ type: "message", role: "user" }); + expect(sent.input[0].content.slice(1)).toEqual(original.input[0]!.content); + expect(new Headers(request.headers).get("x-opencode-session")).toBeNull(); expect(parsed._rawBody).toBe(raw); expect(raw).toEqual(original); } finally { @@ -127,12 +255,7 @@ test.each([ } }); -test.each(["not a URL", "https://", "/zen/go/v1"])( - "malformed destination %s is not classified as Go", - baseUrl => expect(isOpenCodeGo(baseUrl)).toBe(false), -); - -test("Go conversion preserves file payloads beside text without mutating raw replay", async () => { +test("conversion preserves file payloads beside text without mutating raw replay", async () => { const file = { type: "input_file", filename: "assignment.txt", file_data: "data:text/plain;base64,SGVsbG8=" }; const message = body().input[0]!; const raw = { ...body(), input: [{ ...message, content: [...message.content, file] }] }; @@ -161,10 +284,10 @@ for (const { name, content } of [ { name: "text mixed with ciphertext", content: [ { type: "input_text", text: "Routing header" }, { type: "encrypted_content", encrypted_content: "opaque" }, ] }, -]) test(`Go preserves ${name} without partially converting it`, async () => { +]) test(`routed destinations preserve ${name} without partially converting it`, async () => { const raw = { ...body(), input: [{ ...body().input[0]!, content }] }; const original = structuredClone(raw); - expect(normalizeOpenCodeGoAgentMessages(raw)).toBe(raw); + expect(normalizeRoutedAgentMessages(raw)).toBe(raw); const parsed = parseRequest(raw); const budget = createTranslatorBudget(); try { diff --git a/tests/ci-workflows/build-release-changelog.test.ts b/tests/ci-workflows/build-release-changelog.test.ts index c749c978e6..886e935c76 100644 --- a/tests/ci-workflows/build-release-changelog.test.ts +++ b/tests/ci-workflows/build-release-changelog.test.ts @@ -41,6 +41,42 @@ const generatedBugFix = [ "**Full Changelog**: https://github.com/lidge-jun/opencodex/compare/v1.0.0...v1.1.0", ].join("\n"); +describe("active release builder enforcement markers", () => { + test.each(["generated", "associated"])("normalizes summary and changelog titles from %s PRs", source => { + const title = "[WRONG BRANCH] fix(api): preserve release coverage"; + const result = buildReleaseNotes({ + version: "1.1.0", tags: ["v1.0.0"], npmMetadata: "", repository: "lidge-jun/opencodex", + generatedNotes: source === "generated" + ? `## What's Changed\n### Bug Fixes\n* ${title} by @alice in https://github.com/lidge-jun/opencodex/pull/10` + : "", + commits: [commit("a", "fix(api): preserve release coverage (#10)", [ + { number: 10, title, author: "alice", labels: ["bug"], merged: true }, + ])], + }); + expect(result.errors).toEqual([]); + expect(result.releasableCommitCount).toBe(1); + expect(result.body).toContain("- Preserve release coverage (#10)"); + expect(result.body).toContain("- #10 fix(api): preserve release coverage @alice"); + expect(result.body).not.toContain("[WRONG BRANCH]"); + }); + + test.each([ + "[Preview] fix(api): retain this marker", + "fix(api): explain [WRONG BRANCH] markers", + "[WRONG BRANCH]ish: retain this title", + ])("retains meaningful changelog title text: %s", title => { + const result = buildReleaseNotes({ + version: "1.1.0", tags: ["v1.0.0"], npmMetadata: "", repository: "lidge-jun/opencodex", + generatedNotes: "", + commits: [commit("a", "fix(api): preserve release coverage (#10)", [ + { number: 10, title, author: "alice", labels: ["bug"], merged: true }, + ])], + }); + expect(result.errors).toEqual([]); + expect(result.body).toContain(`- #10 ${title} @alice`); + }); +}); + describe("selectReleaseBaseline", () => { test("skips a newer release that is not reachable from the target", () => { // A preview lives on its own lineage. Selecting the newest tag regardless of diff --git a/tests/ci-workflows/release-notes.test.ts b/tests/ci-workflows/release-notes.test.ts index 11196108d7..d270360081 100644 --- a/tests/ci-workflows/release-notes.test.ts +++ b/tests/ci-workflows/release-notes.test.ts @@ -455,6 +455,20 @@ describe("rewriteTakeoverCredits", () => { }); describe("cleanPrTitle", () => { + test("removes the enforcement marker before extracting scope and sentence casing", () => { + expect(cleanPrTitle(" [WRONG BRANCH] chore(release): promote validated 2.45.0 to main (#3813) ", 3813)).toEqual({ + scope: "release", + text: "Promote validated 2.45.0 to main", + }); + }); + + test.each([ + ["[Preview] chore(release): keep this marker", "[Preview] chore(release): keep this marker"], + ["fix: document [WRONG BRANCH] markers", "Document [WRONG BRANCH] markers"], + ["[WRONG BRANCH]ish: keep this title", "[WRONG BRANCH]ish: keep this title"], + ])("preserves meaningful title text: %s", (title, text) => { + expect(cleanPrTitle(title).text).toBe(text); + }); test("strips conventional prefix, keeps scope, and sentence-cases the title", () => { expect(cleanPrTitle("feat(providers): add Baseten Model APIs preset", 653)).toEqual({ scope: "providers", @@ -488,6 +502,55 @@ describe("cleanPrTitle", () => { }); describe("renderReleaseNotes", () => { + test.each(["delta", "carried"])("removes the bot marker from summaries and full changelogs (%s)", source => { + const body = [ + "## What's Changed", + "### Chores", + "* [WRONG BRANCH] chore(release): promote validated 2.45.0 to main by @lidge-jun in https://github.com/lidge-jun/opencodex/pull/3813", + ].join("\n"); + const notes = renderReleaseNotes({ + npmMetadata: "", + ...(source === "delta" ? { deltaPrNotes: body } : { carriedPreviewNotes: [ + "## Chores", "", + "- [WRONG BRANCH] chore(release): promote validated 2.45.0 to main (#3813)", "", + "## Changelog", "", + "- #3813 [WRONG BRANCH] chore(release): promote validated 2.45.0 to main @lidge-jun", + ].join("\n") }), + }); + expect(notes).toBe([ + "## Chores", "", + "- Promote validated 2.45.0 to main (#3813)", "", + "## Changelog", "", + "- #3813 chore(release): promote validated 2.45.0 to main @lidge-jun", "", + ].join("\n")); + }); + + test("groups a bot-prefixed title with ordinary titles of the same scope", () => { + const notes = renderReleaseNotes({ + npmMetadata: "", + deltaPrNotes: [ + "## What's Changed", "### Chores", + "* [WRONG BRANCH] chore(release): promote verified version by @maintainer in https://github.com/lidge-jun/opencodex/pull/10", + "* chore(release): update notes by @contributor in https://github.com/lidge-jun/opencodex/pull/11", + ].join("\n"), + }); + expect(notes).toContain("- Release: Promote verified version; Update notes (#10, #11)"); + expect(notes).toContain("- #10 chore(release): promote verified version @maintainer"); + expect(notes).toContain("- #11 chore(release): update notes @contributor"); + expect(notes).not.toContain("[WRONG BRANCH]"); + }); + + test.each([ + "[Preview] chore(release): retain the preview marker", + "fix: document [WRONG BRANCH] markers (#99)", + "[WRONG BRANCH]ish: retain this title", + ])("preserves meaningful full-changelog title text: %s", title => { + const notes = renderReleaseNotes({ + npmMetadata: "", + deltaPrNotes: `## What's Changed\n### Chores\n* ${title} by @contributor in https://github.com/lidge-jun/opencodex/pull/12`, + }); + expect(notes).toContain(`- #12 ${title} @contributor`); + }); const carried = [ "<!-- Release notes generated using configuration in .github/release.yml at abc -->", "", diff --git a/tests/ci-workflows/test-home-guard.test.ts b/tests/ci-workflows/test-home-guard.test.ts index 398e6a2099..47369ed663 100644 --- a/tests/ci-workflows/test-home-guard.test.ts +++ b/tests/ci-workflows/test-home-guard.test.ts @@ -9,8 +9,8 @@ * * Incident: devlog/_fin/260730_codex_rs_upstream_v2_live_handoff/070. */ -import { describe, expect, test } from "bun:test"; -import { mkdtempSync, mkdirSync, readFileSync, statSync, symlinkSync, writeFileSync } from "node:fs"; +import { describe, expect, spyOn, test } from "bun:test"; +import { existsSync, mkdtempSync, mkdirSync, readFileSync, statSync, symlinkSync, writeFileSync } from "node:fs"; import { homedir, tmpdir } from "node:os"; import { join } from "node:path"; import { fileURLToPath, pathToFileURL } from "node:url"; @@ -18,6 +18,8 @@ import { assertNotRealHomeUnderTest, isTestHomeGuardArmed, protectedHomeForTests import { getConfigDir } from "../../src/config"; import { removeTreeWithRetry } from "../helpers/remove-tree"; import { repoRoot } from "../helpers/repo-root"; +import { watchdogMs } from "../helpers/ci-watchdog"; +import { captureTestOutput } from "../../scripts/test"; /** * Two different things are needed from the repo root, and conflating them is @@ -38,26 +40,211 @@ const REPO_ROOT = repoRoot(); */ const REPO_ROOT_URL = pathToFileURL(repoRoot() + "/").href; -/** - * Run a probe in a child process so we control OCX_REAL_HOME at STARTUP — the guard - * captures its protected path at module load, which is exactly the property under test. - */ -function runProbe(source: string, env: Record<string, string | undefined>): { code: number; stdout: string; stderr: string } { - const dir = mkdtempSync(join(tmpdir(), "ocx-guard-probe-")); - const file = join(dir, "probe.ts"); - writeFileSync(file, source, "utf8"); - const childEnv: Record<string, string> = {}; - for (const [key, value] of Object.entries({ ...process.env, ...env })) { - if (value !== undefined) childEnv[key] = value; +// Scale only execution: cleanup retains room below CI's existing 60-second ceiling. +const PROBE_EXECUTION_MS = watchdogMs(5_000); +const PROBE_TERM_MS = 5_000; +const PROBE_REAP_MS = 2_000; +const PROBE_DRAIN_MS = 1_000; + +function beginProbe(id: string): string { + console.warn(`[home-guard:${id}] 01 fixture setup`); + return id; +} + +async function waitForProbe(promise: Promise<void>, timeoutMs: number): Promise<boolean> { + let timer: ReturnType<typeof setTimeout> | undefined; + try { + return await Promise.race([ + promise.then(() => true), + new Promise<boolean>(resolve => { timer = setTimeout(() => resolve(false), timeoutMs); }), + ]); + } finally { + clearTimeout(timer); } - const result = Bun.spawnSync([process.execPath, "run", file], { cwd: REPO_ROOT, env: childEnv, stdout: "pipe", stderr: "pipe" }); - return { - code: result.exitCode ?? 1, - stdout: new TextDecoder().decode(result.stdout), - stderr: new TextDecoder().decode(result.stderr), +} + +type ProbeOutcome = { + pid: number | null; + code: number | null; + signal: NodeJS.Signals | null; + reaped: boolean; + complete: boolean; + stdout: string; + stderr: string; + root: string | undefined; +}; + +class ProbeFailure extends Error { + constructor(readonly id: string, readonly failures: string[], readonly outcome: ProbeOutcome) { + super(`[home-guard:${id}] ${failures.join(", ")}; pid=${outcome.pid} exit=${outcome.code} signal=${outcome.signal} reaped=${outcome.reaped} complete=${outcome.complete}`); + this.name = "ProbeFailure"; + } +} + +/** Keep the startup home contract; own execution, reaping and pipe draining separately. */ +async function runProbe(id: string, source: string, env: Record<string, string | undefined>): Promise<ProbeOutcome> { + const outcome: ProbeOutcome = { + pid: null, code: null, signal: null, reaped: false, complete: false, + stdout: "", stderr: "", root: undefined, }; + const failures: string[] = []; + let child: Bun.Subprocess<"ignore", "pipe", "pipe"> | undefined; + let exited: Promise<void> | undefined; + let capture: ReturnType<typeof captureTestOutput> | undefined; + const stage = (message: string) => console.warn(`[home-guard:${id}] ${message}`); + try { + stage("02 probe file setup"); + outcome.root = mkdtempSync(join(tmpdir(), "ocx-guard-probe-")); + const file = join(outcome.root, "probe.ts"); + writeFileSync(file, source, "utf8"); + const childEnv: Record<string, string> = {}; + for (const [key, value] of Object.entries({ ...process.env, ...env })) { + if (value !== undefined) childEnv[key] = value; + } + stage("03 spawn requested"); + child = Bun.spawn([process.execPath, "run", file], { cwd: REPO_ROOT, env: childEnv, stdout: "pipe", stderr: "pipe" }); + const owned = child; + outcome.pid = owned.pid; + stage(`04 pid=${owned.pid}`); + // Rejection is an observation failure, never evidence that the process was reaped. + exited = owned.exited.then(code => { + outcome.code = code; + outcome.signal = owned.signalCode ?? null; + outcome.reaped = true; + stage(`08 exit pid=${owned.pid} code=${code} signal=${outcome.signal}`); + }, () => { + failures.push("exit-observation-failed"); + stage(`08 exit observation failed pid=${owned.pid}`); + }); + capture = captureTestOutput(owned.stdout, owned.stderr); + if (!await waitForProbe(exited, PROBE_EXECUTION_MS)) { + failures.push("execution-timeout"); + stage(`05 execution timeout pid=${owned.pid}`); + } + } catch { + failures.push("setup-or-observation-failed"); + } finally { + if (child && !outcome.reaped) { + stage(`06 TERM pid=${child.pid}`); + try { child.kill("SIGTERM"); } catch { stage("06 TERM request failed"); } + if (exited) await waitForProbe(exited, PROBE_TERM_MS); + if (!outcome.reaped) { + stage(`07 KILL pid=${child.pid}`); + try { child.kill("SIGKILL"); } catch { stage("07 KILL request failed"); } + if (exited) await waitForProbe(exited, PROBE_REAP_MS); + } + if (!outcome.reaped) failures.push("reap-timeout"); + } + if (capture) { + try { Object.assign(outcome, await capture.finish(PROBE_DRAIN_MS)); } + catch { failures.push("capture-failed"); } + stage(`09 capture complete=${outcome.complete}`); + if (!outcome.complete) failures.push("incomplete-output"); + } + if (outcome.root && (!child || outcome.reaped)) { + try { + removeTreeWithRetry(outcome.root); + stage("10 probe files removed"); + } catch { + failures.push("cleanup-failed"); + stage("10 probe cleanup failed"); + } + } else if (outcome.root) { + stage(`10 probe files retained: child unreaped pid=${outcome.pid}`); + } + } + if (outcome.code !== 0) failures.push("nonzero-exit"); + if (outcome.signal !== null) failures.push("signal-exit"); + // A timeout remains a failure even if TERM subsequently permits a natural exit 0. + if (failures.length) throw new ProbeFailure(id, failures, { ...outcome }); + return outcome; +} + +async function probeFailure(pending: Promise<ProbeOutcome>): Promise<ProbeFailure> { + const failure: unknown = await pending.then(() => undefined, error => error); + expect(failure).toBeInstanceOf(ProbeFailure); + if (!(failure instanceof ProbeFailure)) throw new Error("Expected a failed guard probe"); + return failure; +} + +function expectOwnedProbeGone(outcome: ProbeOutcome): void { + expect(outcome.reaped).toBe(true); + if (outcome.pid === null || outcome.root === undefined) throw new Error("Probe never spawned"); + expect(outcome.pid).toBeGreaterThan(0); + let code: string | undefined; + try { process.kill(outcome.pid, 0); } + catch (error) { code = (error as NodeJS.ErrnoException).code; } + expect(code).toBe("ESRCH"); + expect(existsSync(outcome.root)).toBe(false); } +describe("guard probe lifecycle", () => { + test("nonzero exit retains output, reports failure and reaps the owned child", async () => { + const failure = await probeFailure(runProbe(beginProbe("control-nonzero"), ` + console.log("OCX_GUARD_NONZERO"); + process.exitCode = 23; + `, {})); + expect(failure.failures).toEqual(["nonzero-exit"]); + expect(failure.outcome.code).toBe(23); + expect(failure.outcome.signal).toBeNull(); + expect(failure.outcome.complete).toBe(true); + expect(failure.outcome.stdout.trim()).toBe("OCX_GUARD_NONZERO"); + expectOwnedProbeGone(failure.outcome); + }); + + test("a referenced handle times out and is reaped even if TERM permits exit zero", async () => { + const failure = await probeFailure(runProbe(beginProbe("control-hanging"), ` + const keepAlive = setInterval(() => {}, 1000); + const stop = () => { + clearInterval(keepAlive); + process.off("SIGTERM", stop); + }; + process.on("SIGTERM", stop); + console.log("OCX_GUARD_HANG_READY"); + `, {})); + expect(failure.failures).toContain("execution-timeout"); + expect(failure.failures).not.toContain("reap-timeout"); + expect(failure.outcome.stdout.trim()).toBe("OCX_GUARD_HANG_READY"); + expect(failure.outcome.complete).toBe(true); + // POSIX can handle TERM and exit naturally; Windows may terminate directly. + if (process.platform !== "win32") { + expect(failure.outcome.code).toBe(0); + expect(failure.outcome.signal).toBeNull(); + } + expectOwnedProbeGone(failure.outcome); + }, 60_000); // Match the existing CI ceiling; include bounded TERM/reap/drain locally too. + + test("exit zero with an open output pipe is incomplete, never a successful probe", async () => { + let cancelled = false; + const stdout = new ReadableStream<Uint8Array>({ + start(controller) { controller.enqueue(new TextEncoder().encode("OCX_GUARD_PARTIAL\n")); }, + cancel() { cancelled = true; }, + }); + const stderr = new ReadableStream<Uint8Array>({ start(controller) { controller.close(); } }); + // Exercise runProbe's integration with real capture; no unmanaged descendant is needed. + const spawn = spyOn(Bun, "spawn").mockReturnValue({ + pid: 0, stdout, stderr, exited: Promise.resolve(0), signalCode: null, + kill() { throw new Error("Exited synthetic child must not be killed"); }, + } as unknown as ReturnType<typeof Bun.spawn>); + try { + const pending = runProbe(beginProbe("control-open-pipe"), "", {}); + spawn.mockRestore(); // runProbe spawns synchronously before its first await. + const failure = await probeFailure(pending); + expect(failure.failures).toEqual(["incomplete-output"]); + expect(failure.outcome.code).toBe(0); + expect(failure.outcome.signal).toBeNull(); + expect(failure.outcome.reaped).toBe(true); + expect(failure.outcome.complete).toBe(false); + expect(failure.outcome.stdout).toBe("OCX_GUARD_PARTIAL\n"); + expect(cancelled).toBe(true); + expect(failure.outcome.root).toBeDefined(); + expect(existsSync(failure.outcome.root!)).toBe(false); + } finally { + spawn.mockRestore(); + } + }); +}); + /** A fake "real home" the guard will protect, so no deny case aims at the true one. */ function sentinelHome(): { realHome: string; opencodexHome: string; codexHome: string } { const realHome = mkdtempSync(join(tmpdir(), "ocx-sentinel-home-")); @@ -87,9 +274,10 @@ const canSymlink = (() => { removeTreeWithRetry(probeDir); } })(); - test("armed + the protected home: all three writers throw", () => { + test("armed + the protected home: all three writers throw", async () => { + const probeId = beginProbe("01-protected-writers"); const { realHome, opencodexHome } = sentinelHome(); - const probe = runProbe(` + const probe = await runProbe(probeId, ` import { saveConfig } from "${REPO_ROOT_URL}src/config"; import { mutateStore } from "${REPO_ROOT_URL}src/oauth/store"; import { saveCodexAccountCredential } from "${REPO_ROOT_URL}src/codex/account-store"; @@ -115,9 +303,10 @@ const canSymlink = (() => { expect(() => readFileSync(join(opencodexHome, "codex-accounts.json"))).toThrow(); }); - test("armed native credential writes reject the protected Codex home", () => { + test("armed native credential writes reject the protected Codex home", async () => { + const probeId = beginProbe("02-native-credentials"); const { realHome, codexHome } = sentinelHome(); - const probe = runProbe(` + const probe = await runProbe(probeId, ` import { assertNotRealCodexHomeUnderTest } from "${REPO_ROOT_URL}src/lib/test-home-guard"; try { // JSON.stringify, not raw interpolation: a Windows temp path is @@ -136,7 +325,8 @@ const canSymlink = (() => { expect(probe.stdout).not.toContain("WRITE_ALLOWED"); }); - test.skipIf(!canSymlink)("armed + a symlink escaping a temp home into the protected home: refused", () => { + test.skipIf(!canSymlink)("armed + a symlink escaping a temp home into the protected home: refused", async () => { + const probeId = beginProbe("03-symlink-file"); // Atomic writes resolve their destination through symlinks, so a temp home whose // config.json points into the protected home would otherwise pass the caller's // dir-level check and then write the real file anyway. @@ -146,7 +336,7 @@ const canSymlink = (() => { const dir = mkdtempSync(join(tmpdir(), "ocx-escape-home-")); symlinkSync(protectedFile, join(dir, "config.json")); - const probe = runProbe(` + const probe = await runProbe(probeId, ` import { saveConfig } from "${REPO_ROOT_URL}src/config"; const REFUSAL = "refusing to write the real OpenCodex home"; try { @@ -162,10 +352,11 @@ const canSymlink = (() => { expect(readFileSync(protectedFile, "utf8")).toBe('{"sentinel":true}'); }); - test("armed + an unregistered temp home: writers succeed", () => { + test("armed + an unregistered temp home: writers succeed", async () => { + const probeId = beginProbe("04-unregistered-home"); // The 54 suites that mkdtemp their own home must keep working with no opt-in. const dir = mkdtempSync(join(tmpdir(), "ocx-plain-home-")); - const probe = runProbe(` + const probe = await runProbe(probeId, ` import { saveConfig } from "${REPO_ROOT_URL}src/config"; saveConfig({ providers: {}, defaultProvider: "openai", port: 10100 } as never); console.log("wrote"); @@ -175,7 +366,8 @@ const canSymlink = (() => { expect(JSON.parse(readFileSync(join(dir, "config.json"), "utf8")).port).toBe(10100); }); - test.skipIf(!canSymlink)("armed + a first write beneath a symlinked PARENT escaping into the protected home: refused", () => { + test.skipIf(!canSymlink)("armed + a first write beneath a symlinked PARENT escaping into the protected home: refused", async () => { + const probeId = beginProbe("05-symlink-parent"); // The file does not exist yet, so resolveWriteTarget returns the literal // path and target === path; the guard must resolve the parent directory // instead of skipping (review: symlinked config dir + absent destination). @@ -185,7 +377,7 @@ const canSymlink = (() => { symlinkSync(opencodexHome, linkDir); const modeBefore = statSync(opencodexHome).mode; - const probe = runProbe(` + const probe = await runProbe(probeId, ` import { atomicWriteFile, writePid } from "${REPO_ROOT_URL}src/config"; const REFUSAL = "refusing to write the real OpenCodex home"; try { @@ -215,9 +407,10 @@ const canSymlink = (() => { expect(statSync(opencodexHome).mode).toBe(modeBefore); }); - test("disarmed: the protected home is allowed (production stays inert)", () => { + test("disarmed: the protected home is allowed (production stays inert)", async () => { + const probeId = beginProbe("06-disarmed"); const { realHome, opencodexHome } = sentinelHome(); - const probe = runProbe(` + const probe = await runProbe(probeId, ` import { saveConfig } from "${REPO_ROOT_URL}src/config"; saveConfig({ providers: {}, defaultProvider: "openai", port: 10100 } as never); console.log("wrote"); @@ -226,12 +419,13 @@ const canSymlink = (() => { expect(probe.stdout).toContain("wrote"); }); - test("the protected path comes from OCX_REAL_HOME, not the sandboxed HOME", () => { + test("the protected path comes from OCX_REAL_HOME, not the sandboxed HOME", async () => { + const probeId = beginProbe("07-captured-home"); // The inversion this guards against: if the guard read homedir() after the harness // replaced HOME, it would protect the sandbox and leave the real home writable. const { realHome } = sentinelHome(); const decoyHome = mkdtempSync(join(tmpdir(), "ocx-decoy-home-")); - const probe = runProbe(` + const probe = await runProbe(probeId, ` import { protectedHomeForTests } from "${REPO_ROOT_URL}src/lib/test-home-guard"; console.log(protectedHomeForTests()); `, { OCX_TEST_HOME_GUARD: "1", OCX_REAL_HOME: realHome, HOME: decoyHome }); @@ -240,12 +434,13 @@ const canSymlink = (() => { expect(probe.stdout).not.toContain("ocx-decoy-home-"); }); - test.skipIf(!canSymlink)("a symlink pointing at the protected home is rejected", () => { + test.skipIf(!canSymlink)("a symlink pointing at the protected home is rejected", async () => { + const probeId = beginProbe("08-symlink-home"); const { realHome, opencodexHome } = sentinelHome(); const linkDir = mkdtempSync(join(tmpdir(), "ocx-symlink-")); const link = join(linkDir, "looks-like-temp"); symlinkSync(opencodexHome, link); - const probe = runProbe(` + const probe = await runProbe(probeId, ` import { assertNotRealHomeUnderTest } from "${REPO_ROOT_URL}src/lib/test-home-guard"; try { assertNotRealHomeUnderTest(${JSON.stringify(link)}); console.log("allowed"); } catch { console.log("rejected"); } @@ -254,12 +449,13 @@ const canSymlink = (() => { expect(probe.stdout.trim()).toBe("rejected"); }); - test("/var and /private/var spellings of one path agree", () => { + test("/var and /private/var spellings of one path agree", async () => { + const probeId = beginProbe("09-path-alias"); // macOS hands out /var/folders/... whose realpath is /private/var/folders/...; // a lexical comparison would disagree with itself across those two spellings. const { realHome } = sentinelHome(); const aliased = realHome.startsWith("/var/") ? join("/private", realHome) : realHome.replace(/^\/private/, ""); - const probe = runProbe(` + const probe = await runProbe(probeId, ` import { assertNotRealHomeUnderTest } from "${REPO_ROOT_URL}src/lib/test-home-guard"; const results: string[] = []; for (const path of [${JSON.stringify(join(realHome, ".opencodex"))}, ${JSON.stringify(join(aliased, ".opencodex"))}]) { @@ -327,9 +523,10 @@ const canSymlink = (() => { * And the guard has to hold for a process that never reached the lock at all, which is the * state the timed-out worker was actually in. */ - test("a process that arms the guard is protected even with no lock and a real HOME", () => { + test("a process that arms the guard is protected even with no lock and a real HOME", async () => { + const probeId = beginProbe("10-no-lock"); const { realHome } = sentinelHome(); - const probe = runProbe(` + const probe = await runProbe(probeId, ` import { assertNotRealHomeUnderTest, isTestHomeGuardArmed } from "${REPO_ROOT_URL}src/lib/test-home-guard"; let rejected = false; try { assertNotRealHomeUnderTest(${JSON.stringify(join(realHome, ".opencodex"))}); } catch { rejected = true; } diff --git a/tests/ci-workflows/test-runner.test.ts b/tests/ci-workflows/test-runner.test.ts index 84b0dfc928..9efa54eb1e 100644 --- a/tests/ci-workflows/test-runner.test.ts +++ b/tests/ci-workflows/test-runner.test.ts @@ -1,15 +1,17 @@ -import { describe, expect, test } from "bun:test"; +import { describe, expect, spyOn, test } from "bun:test"; import { spawnSync } from "node:child_process"; import { existsSync, mkdtempSync, readFileSync, statSync, writeFileSync } from "node:fs"; import { tmpdir } from "node:os"; import { basename, dirname, isAbsolute, join, posix, win32 } from "node:path"; import { changedSelectionFailure, + captureTestOutput, createIsolatedTestEnvironment, ensureGuiDependencies, inspectChangedRun, resolveBunTestArgs, resolveBunTestPlan, + runTestLane, selectChangedComparisonRef, SERIAL_FULL_SUITE_FILES, } from "../../scripts/test"; @@ -98,6 +100,150 @@ function initChangedRunFixture(): { cwd: string; base: string } { return { cwd, base }; } +describe("test runner captured output", () => { + test("preserves both streams and UTF-8 characters split across chunks", async () => { + const bytes = new TextEncoder().encode("before 한글 after\n"); + const stdout = new ReadableStream<Uint8Array>({ + start(controller) { + controller.enqueue(bytes.slice(0, 8)); + controller.enqueue(bytes.slice(8)); + controller.close(); + }, + }); + const stderr = new ReadableStream<Uint8Array>({ + start(controller) { + controller.enqueue(new TextEncoder().encode("diagnostic\n")); + controller.close(); + }, + }); + expect(await captureTestOutput(stdout, stderr).finish(1_000)).toEqual({ + stdout: "before 한글 after\n", stderr: "diagnostic\n", complete: true, + }); + }); + + test.each(["pending", "rejected"] as const)( + "bounds an open pipe even when cancellation is %s", + async cancellation => { + let controller!: ReadableStreamDefaultController<Uint8Array>; + let cancelled = false; + const stdout = new ReadableStream<Uint8Array>({ + start(value) { + controller = value; + value.enqueue(new TextEncoder().encode("retained prefix\n")); + }, + cancel() { + cancelled = true; + return cancellation === "pending" + ? new Promise<void>(() => {}) + : Promise.reject(new Error("fixture cancellation failure")); + }, + }); + const stderr = new ReadableStream<Uint8Array>({ start(value) { value.close(); } }); + let timer: ReturnType<typeof setTimeout> | undefined; + try { + const result = await Promise.race([ + captureTestOutput(stdout, stderr).finish(20), + new Promise<null>(resolve => { timer = setTimeout(() => resolve(null), 2_000); }), + ]); + expect(result).toEqual({ stdout: "retained prefix\n", stderr: "", complete: false }); + expect(cancelled).toBe(true); + } finally { + clearTimeout(timer); + try { controller.close(); } catch { /* cancellation already closed it */ } + } + }, + ); + + test("retains a prefix when reading the pipe fails", async () => { + let reads = 0; + const stdout = new ReadableStream<Uint8Array>({ + pull(controller) { + if (reads++ === 0) controller.enqueue(new TextEncoder().encode("before error\n")); + else controller.error(new Error("fixture read failure")); + }, + }); + const stderr = new ReadableStream<Uint8Array>({ start(controller) { controller.close(); } }); + expect(await captureTestOutput(stdout, stderr).finish(1_000)).toEqual({ + stdout: "before error\n", stderr: "", complete: false, + }); + }); + + test("an exited child with an open pipe reports incomplete capture instead of success", async () => { + let cancelled = false; + const stdout = new ReadableStream<Uint8Array>({ + start(controller) { controller.enqueue(new TextEncoder().encode("partial output\n")); }, + cancel() { cancelled = true; }, + }); + const stderr = new ReadableStream<Uint8Array>({ start(controller) { controller.close(); } }); + const spawn = spyOn(Bun, "spawn").mockReturnValue({ + pid: 0, + stdout, + stderr, + exited: Promise.resolve(0), + kill() { throw new Error("the fixture child already exited"); }, + } as unknown as ReturnType<typeof Bun.spawn>); + const emitted: string[] = []; + try { + const pending = runTestLane( + { label: "open pipe fixture", args: [], timeoutMs: 2_000 }, + "capture-fixture", + undefined, + true, + { stdout: value => { emitted.push(value); }, stderr: value => { emitted.push(value); } }, + ); + // Only the synchronous spawn is mocked; no other test or later subprocess uses it. + spawn.mockRestore(); + expect(await pending).toEqual({ exitCode: 1, output: "partial output\n\n" }); + expect(emitted).toEqual(["partial output\n"]); + expect(cancelled).toBe(true); + } finally { + spawn.mockRestore(); + } + }); + + test.each(["pass", "fail", "timeout"] as const)( + "returns and prints a %s lane's output exactly once", + async outcome => { + const root = mkdtempSync(join(tmpdir(), "opencodex-capture-lane-")); + const fixture = join(root, "capture.test.ts"); + const stdout: string[] = []; + const stderr: string[] = []; + writeFileSync(fixture, ` + import { test } from "bun:test"; + test("capture fixture", async () => { + process.stdout.write("OCX_CAPTURE_STDOUT_MARKER\\n"); + process.stderr.write("OCX_CAPTURE_STDERR_MARKER\\n"); + ${outcome === "timeout" ? "await new Promise(() => {});" : ""} + ${outcome === "fail" ? 'throw new Error("fixture assertion failure");' : ""} + }, 60_000); + `); + try { + const runId = process.env[TEST_RUN_ID_ENV]!; + const result = await runTestLane( + { label: "capture fixture", args: [fixture], timeoutMs: INTERNAL_DEADLINE_MS }, + runId, + resolveInheritedTestRunLock({ wrappedRunId: runId, env: process.env }), + true, + { stdout: value => { stdout.push(value); }, stderr: value => { stderr.push(value); } }, + ); + expect(result.exitCode).toBe(outcome === "timeout" ? 124 : outcome === "fail" ? 1 : 0); + expect(result.output).toContain("OCX_CAPTURE_STDOUT_MARKER\n"); + expect(result.output).toContain("OCX_CAPTURE_STDERR_MARKER\n"); + // A failed Bun assertion may quote the fixture source containing the marker. + // Count emitted marker lines, not mentions inside the error's code frame. + expect(stdout.join("").split(/\r?\n/).filter(line => line === "OCX_CAPTURE_STDOUT_MARKER")) + .toHaveLength(1); + expect(stderr.join("").split(/\r?\n/).filter(line => line === "OCX_CAPTURE_STDERR_MARKER")) + .toHaveLength(1); + expect(result.output).toBe(stdout.join("") + "\n" + stderr.join("")); + } finally { + removeTreeWithRetry(root); + } + }, + { timeout: SPAWN_BUDGET_MS }, + ); +}); + describe("test runner isolation", () => { test("redirects user homes to a disposable root", () => { const isolated = createIsolatedTestEnvironment({ PATH: "/test/bin", HOME: "/real/home" }); diff --git a/tests/claude-integration/claude-inbound.test.ts b/tests/claude-integration/claude-inbound.test.ts index 7227bbf2f1..19c99db593 100644 --- a/tests/claude-integration/claude-inbound.test.ts +++ b/tests/claude-integration/claude-inbound.test.ts @@ -5,6 +5,9 @@ import { repoPath } from "../helpers/repo-root"; import { AnthropicRequestError, anthropicToResponsesBody, anthropicToResponsesTranslation, effortForThinkingBudget, extractOcxEffortDirective, resolveInboundModel } from "../../src/claude/inbound"; import { parseRequest } from "../../src/responses/parser"; import { responsesRequestSchema } from "../../src/responses/schema"; +import { createResponsesPassthroughAdapter } from "../../src/adapters/openai-responses"; +import { withTestTranslatorBudget } from "../helpers/translator-budget"; +import type { OcxProviderConfig } from "../../src/types"; // Full Claude Code-shaped request: system array, tool cycle, image, thinking, options. function claudeCodeRequest(): Record<string, unknown> { @@ -80,6 +83,7 @@ describe("claude inbound translation", () => { expect(tools[0]).toEqual({ type: "function", name: "Read", description: "Read a file", parameters: { type: "object", properties: { file_path: { type: "string" } }, required: ["file_path"] }, + strict: false, }); expect(tools[1]).toEqual({ type: "web_search" }); @@ -644,3 +648,97 @@ test("inbound leaves preserve the tool_choice error identity and avoid facade ba .not.toMatch(/from\s+["']\.\/inbound["']/); } }); + + +/** + * #3922: Anthropic enables strict tool use by setting strict: true, while Responses + * reads an omitted strict as permission to normalize the schema into strict mode. + * Translating without the field therefore made every optional input_schema parameter + * behave as required upstream, so a call that omitted one failed. The translated tool + * now carries the source intent, and the value has to survive to the serialized wire + * body rather than only to the translator's return. + */ +describe("#3922 translated tools carry the source strict intent", () => { + const schema = { + type: "object", + properties: { + prompt: { type: "string" }, + isolation: { type: "string", enum: ["worktree", "remote"] }, + options: { type: "object", properties: { enabled: { type: "boolean" } } }, + }, + required: ["prompt"], + additionalProperties: false, + }; + const request = (tool: Record<string, unknown>) => ({ + model: "openai/gpt-5.4", + max_tokens: 32, + messages: [{ role: "user", content: "Run a local agent." }], + tools: [tool], + }); + const agent = (extra: Record<string, unknown> = {}) => ({ + name: "Agent", description: "Run an agent", input_schema: schema, ...extra, + }); + const translatedTool = (tool: Record<string, unknown>) => + (anthropicToResponsesBody(request(tool)).tools as Record<string, unknown>[])[0]!; + + test("an omitted strict becomes an explicit false instead of an implicit strict request", () => { + expect(translatedTool(agent()).strict).toBe(false); + }); + + test("an explicit strict survives in both directions", () => { + expect(translatedTool(agent({ strict: true })).strict).toBe(true); + expect(translatedTool(agent({ strict: false })).strict).toBe(false); + }); + + test("a non-boolean strict cannot opt the tool into strict mode", () => { + expect(translatedTool(agent({ strict: "true" })).strict).toBe(false); + }); + + test("the source input_schema is forwarded unchanged", () => { + for (const extra of [{}, { strict: true }, { strict: false }]) { + const tool = agent(extra); + // Compare against a detached copy: the expected value must not be the very + // object under test, or an in-place mutation would move both sides together. + const expectedSchema = structuredClone(tool.input_schema); + expect(translatedTool(tool).parameters).toEqual(expectedSchema); + expect(tool.input_schema).toEqual(expectedSchema); + } + }); + + test("hosted web_search gains no strict field", () => { + const body = anthropicToResponsesBody(request({ type: "web_search_20250305", name: "web_search" })); + expect((body.tools as Record<string, unknown>[])[0]).toEqual({ type: "web_search" }); + }); + + test("strict intent and schema survive into the serialized Responses body", async () => { + // parsed._rawBody is the translator's own object, so reading it back proves + // nothing about the wire. Build the actual outbound request instead. + const adapter = withTestTranslatorBudget(createResponsesPassthroughAdapter({ + adapter: "openai-responses", + authMode: "key", + baseUrl: "https://api.openai.com/v1", + apiKey: "test-key", + } as OcxProviderConfig)); + + for (const [tool, expected] of [ + [agent(), false], + [agent({ strict: true }), true], + [agent({ strict: false }), false], + ] as const) { + const expectedSchema = structuredClone(tool.input_schema); + const parsed = parseRequest({ ...anthropicToResponsesBody(request(tool)), model: "gpt-5.4" }); + expect(parsed.context.tools?.[0]?.strict).toBe(expected); + + const outbound = await adapter.buildRequest(parsed); + try { + const wire = JSON.parse(String(outbound.body)) as { tools: { strict?: boolean; parameters?: unknown }[] }; + expect(wire.tools).toHaveLength(1); + expect(wire.tools[0]?.strict).toBe(expected); + expect(wire.tools[0]?.parameters).toEqual(expectedSchema); + expect(tool.input_schema).toEqual(expectedSchema); + } finally { + outbound.releaseBodyObservation?.(); + } + } + }); +}); diff --git a/tests/cli/cli-restart-health.test.ts b/tests/cli/cli-restart-health.test.ts index ac2dfae50d..3b9498707f 100644 --- a/tests/cli/cli-restart-health.test.ts +++ b/tests/cli/cli-restart-health.test.ts @@ -1,10 +1,11 @@ import { describe, expect, test } from "bun:test"; -import { spawnSync } from "node:child_process"; -import { mkdtempSync, writeFileSync } from "node:fs"; +import { existsSync, mkdtempSync, writeFileSync } from "node:fs"; import { tmpdir } from "node:os"; import { dirname, join } from "node:path"; import { fileURLToPath } from "node:url"; import { removeTreeWithRetry } from "../helpers/remove-tree"; +import { watchdogMs } from "../helpers/ci-watchdog"; +import { captureTestOutput } from "../../scripts/test"; const repoRoot = dirname(fileURLToPath(new URL("../../package.json", import.meta.url))); const cliPath = join(repoRoot, "src", "cli", "index.ts"); @@ -16,20 +17,144 @@ const cliPath = join(repoRoot, "src", "cli", "index.ts"); * network/no-proxy/argument-validation ready tests live as injected tests in * tests/cli/cli-ready.test.ts (no real loopback/home). */ -function runCli(args: string[], env: Record<string, string> = {}) { - return spawnSync(process.execPath, [cliPath, ...args], { - cwd: repoRoot, - env: { ...process.env, ...env }, - encoding: "utf8", - timeout: 10000, - }); +// These are correctness watchdogs, not startup latency assertions. Scale only execution. +const CLI_BUDGET = { execution: watchdogMs(10_000), term: 5_000, reap: 2_000, drain: 1_000 }; +const CLI_TEST_TIMEOUT = CLI_BUDGET.execution + CLI_BUDGET.term + CLI_BUDGET.reap + CLI_BUDGET.drain + 3_000; +type CliChild = Pick<Bun.Subprocess<"ignore", "pipe", "pipe">, "pid" | "exited" | "signalCode" | "stdout" | "stderr" | "kill">; +type CliSpawn = (argv: string[], options: { + cwd: string; env: NodeJS.ProcessEnv; stdout: "pipe"; stderr: "pipe"; +}) => CliChild; +type CliState = { + id: string; startedAt: number; pid: number | null; reaped: boolean; + status: number | null; signal: NodeJS.Signals | null; + stdout: string; stderr: string; complete: boolean; +}; +const cliHomes = new Map<string, CliState>(); + +function cliStage(state: CliState, stage: string): void { + console.warn(`[cli-probe:${state.id}] ${stage} elapsedMs=${Date.now() - state.startedAt} pid=${state.pid}`); +} + +function errorTag(error: unknown): string { + const name = error instanceof Error ? error.name : "UnknownError"; + const code = error && typeof error === "object" && "code" in error ? String(error.code) : ""; + // Error messages can contain argv or environment. Log only conventional name/code tags. + return `${/^[A-Za-z]+$/.test(name) ? name : "Error"}${/^[A-Z0-9_]+$/.test(code) ? `:${code}` : ""}`; +} + +class CliHarnessError extends Error { + constructor(readonly failures: string[], readonly outcome: CliState) { + super(`[cli-probe:${outcome.id}] ${failures.join(", ")} pid=${outcome.pid} status=${outcome.status} signal=${outcome.signal} reaped=${outcome.reaped} complete=${outcome.complete}`); + this.name = "CliHarnessError"; + } +} + +async function waitForCliExit(exited: Promise<void>, milliseconds: number): Promise<boolean> { + let timer: ReturnType<typeof setTimeout> | undefined; + try { + return await Promise.race([ + exited.then(() => true), + new Promise<boolean>(resolve => { timer = setTimeout(() => resolve(false), milliseconds); }), + ]); + } finally { + clearTimeout(timer); + } +} + +async function runCli(args: string[], env: Record<string, string> = {}, control?: { + spawn: CliSpawn; budget: typeof CLI_BUDGET; +}): Promise<{ status: number; stdout: string; stderr: string }> { + const state = cliHomes.get(env.OPENCODEX_HOME); + if (!state) throw new Error("CLI probe requires an owned isolated home"); + const budget = control?.budget ?? CLI_BUDGET; + const spawn: CliSpawn = control?.spawn ?? ((argv, options) => Bun.spawn(argv, options)); + const failures: string[] = []; + let child: CliChild | undefined; + let exited: Promise<void> | undefined; + let capture: ReturnType<typeof captureTestOutput> | undefined; + let boundary = "spawn"; + try { + cliStage(state, "03 spawn requested"); + child = spawn([process.execPath, cliPath, ...args], { + cwd: repoRoot, env: { ...process.env, ...env }, stdout: "pipe", stderr: "pipe", + }); + state.pid = child.pid; // Establish ownership before any observation or capture can fail. + const owned = child; + exited = owned.exited.then(status => { + state.reaped = true; + state.status = status; + state.signal = owned.signalCode ?? null; + cliStage(state, `08 exit status=${status} signal=${state.signal}`); + }).catch(error => { + failures.push(`exit-observation-error:${errorTag(error)}`); + cliStage(state, `08 ${failures[failures.length - 1]}`); + }); + cliStage(state, "04 child owned"); + boundary = "capture"; + capture = captureTestOutput(owned.stdout, owned.stderr); + boundary = "execution"; + if (!await waitForCliExit(exited, budget.execution)) { + failures.push("execution-timeout"); + cliStage(state, "05 execution timeout"); + } + } catch (error) { + failures.push(`${boundary}-error:${errorTag(error)}`); + } finally { + if (child && !state.reaped) { + cliStage(state, "06 TERM"); + try { child.kill("SIGTERM"); } catch (error) { cliStage(state, `06 TERM error=${errorTag(error)}`); } + if (exited) await waitForCliExit(exited, budget.term); + if (!state.reaped) { + cliStage(state, "07 KILL"); + try { child.kill("SIGKILL"); } catch (error) { cliStage(state, `07 KILL error=${errorTag(error)}`); } + if (exited) await waitForCliExit(exited, budget.reap); + } + if (!state.reaped) failures.push("reap-timeout"); + } + if (capture) { + try { Object.assign(state, await capture.finish(budget.drain)); } + catch (error) { failures.push(`capture-error:${errorTag(error)}`); } + cliStage(state, `09 capture complete=${state.complete}`); + if (!state.complete) failures.push("incomplete-output"); + } + } + if (!state.reaped || state.status === null || !Number.isInteger(state.status)) failures.push("exit-not-observed"); + if (state.signal !== null) failures.push("signal-exit"); + // Never turn timeout/incomplete capture into status 1: health legitimately expects 1. + if (failures.length) throw new CliHarnessError([...failures], { ...state }); + return { status: state.status!, stdout: state.stdout, stderr: state.stderr }; } function isolatedHome(prefix: string): string { - return mkdtempSync(join(tmpdir(), prefix)); + const state: CliState = { + id: prefix, startedAt: Date.now(), pid: null, reaped: false, + status: null, signal: null, stdout: "", stderr: "", complete: false, + }; + cliStage(state, "01 home setup"); + const dir = mkdtempSync(join(tmpdir(), prefix)); + cliHomes.set(dir, state); + return dir; +} + +function cleanupCliHome(dir: string, primaryFailed = false): void { + const state = cliHomes.get(dir); + if (!state) throw new Error("Cannot clean an unowned CLI home"); + if (state.pid !== null && !state.reaped) { + cliStage(state, "10 home retained: child unreaped"); + return; + } + try { + removeTreeWithRetry(dir); + cliHomes.delete(dir); + cliStage(state, "10 home removed"); + } catch (error) { + cliStage(state, `10 cleanup error=${errorTag(error)}`); + if (!primaryFailed) throw error; + } } function writeIsolatedConfig(dir: string): void { + cliStage(cliHomes.get(dir)!, "02 config setup"); writeFileSync(join(dir, "config.json"), JSON.stringify({ port: 19999, providers: { openai: { adapter: "openai-responses", baseUrl: "https://chatgpt.com/backend-api/codex", authMode: "forward" } }, @@ -38,104 +163,227 @@ function writeIsolatedConfig(dir: string): void { }), "utf8"); } +describe("CLI subprocess lifecycle", () => { + const budget = { execution: 10, term: 10, reap: 10, drain: 10 }; + const scenarios: Array<{ + name: string; mode: "exit" | "timeout" | "unreaped" | "spawn-error" | "exit-error"; + status: number | null; signal?: NodeJS.Signals; open?: boolean; + failures: string[]; signals: NodeJS.Signals[]; reaped: boolean; retained?: boolean; + }> = [ + { name: "returns exit 0", mode: "exit", status: 0, failures: [], signals: [], reaped: true }, + { name: "returns health exit 1", mode: "exit", status: 1, failures: [], signals: [], reaped: true }, + { name: "preserves exit 23", mode: "exit", status: 23, failures: [], signals: [], reaped: true }, + { name: "timeout stays failed after TERM yields exit 0", mode: "timeout", status: 0, + failures: ["execution-timeout"], signals: ["SIGTERM"], reaped: true }, + { name: "open output after exit 0 fails", mode: "exit", status: 0, open: true, + failures: ["incomplete-output"], signals: [], reaped: true }, + { name: "open output after exit 1 fails", mode: "exit", status: 1, open: true, + failures: ["incomplete-output"], signals: [], reaped: true }, + { name: "unreaped child retains its home after TERM and KILL", mode: "unreaped", status: null, + failures: ["execution-timeout", "reap-timeout", "exit-not-observed"], + signals: ["SIGTERM", "SIGKILL"], reaped: false, retained: true }, + { name: "spawn error is not command exit 1", mode: "spawn-error", status: null, + failures: ["spawn-error:Error:ENOENT", "exit-not-observed"], signals: [], reaped: false }, + { name: "rejected observation is not reaping", mode: "exit-error", status: null, + failures: ["exit-observation-error:Error:EPIPE", "reap-timeout", "exit-not-observed"], + signals: ["SIGTERM", "SIGKILL"], reaped: false, retained: true }, + { name: "signal exit is not a completed command", mode: "exit", status: 0, signal: "SIGTERM", + failures: ["signal-exit"], signals: [], reaped: true }, + ]; + + for (const scenario of scenarios) test(scenario.name, async () => { + const dir = isolatedHome(`ocx-cli-control-${scenario.name.replace(/[^a-z0-9]+/gi, "-")}-`); + const state = cliHomes.get(dir)!; + let resolveExit!: (status: number) => void; + let rejectExit!: (error: Error) => void; + const exited = new Promise<number>((resolve, reject) => { resolveExit = resolve; rejectExit = reject; }); + const signals: Array<NodeJS.Signals | number | undefined> = []; + let cancelled = false; + const child: CliChild = { + pid: 424242, exited, signalCode: scenario.signal ?? null, + stdout: new ReadableStream<Uint8Array>({ + start(controller) { + controller.enqueue(new TextEncoder().encode("CLI_CONTROL_STDOUT\n")); + if (!scenario.open) controller.close(); + }, + cancel() { cancelled = true; }, + }), + stderr: new ReadableStream<Uint8Array>({ + start(controller) { controller.enqueue(new TextEncoder().encode("CLI_CONTROL_STDERR\n")); controller.close(); }, + }), + kill(signal) { + signals.push(signal); + if (scenario.mode === "timeout") resolveExit(0); + }, + }; + const spawn: CliSpawn = (argv, options) => { + expect(argv).toEqual([process.execPath, cliPath, "health"]); + expect(options.cwd).toBe(repoRoot); + expect(options.env.OPENCODEX_HOME).toBe(dir); + if (scenario.mode === "spawn-error") throw Object.assign(new Error("fixture"), { code: "ENOENT" }); + if (scenario.mode === "exit-error") rejectExit(Object.assign(new Error("fixture"), { code: "EPIPE" })); + if (scenario.mode === "exit") resolveExit(scenario.status!); + return child; + }; + try { + const result: unknown = await runCli(["health"], { OPENCODEX_HOME: dir }, { spawn, budget }) + .then(value => value, error => error); + if (scenario.failures.length) { + expect(result).toBeInstanceOf(CliHarnessError); + if (!(result instanceof CliHarnessError)) throw new Error("Expected CLI harness failure"); + expect(result.failures).toEqual(scenario.failures); + if (scenario.open) expect(result.outcome.stdout).toBe("CLI_CONTROL_STDOUT\n"); + } else { + expect(result).toEqual({ status: scenario.status, stdout: "CLI_CONTROL_STDOUT\n", stderr: "CLI_CONTROL_STDERR\n" }); + } + expect(state.status).toBe(scenario.status); + expect(state.pid).toBe(scenario.mode === "spawn-error" ? null : 424242); + expect(state.signal).toBe(scenario.signal ?? null); + expect(state.reaped).toBe(scenario.reaped); + expect(state.complete).toBe(scenario.mode !== "spawn-error" && !scenario.open); + expect(signals).toEqual(scenario.signals); + expect(cancelled).toBe(Boolean(scenario.open)); + cleanupCliHome(dir, scenario.failures.length > 0); + expect(existsSync(dir)).toBe(Boolean(scenario.retained)); + expect(cliHomes.has(dir)).toBe(Boolean(scenario.retained)); + } finally { + // The seam never launched an OS process; only this test owns the retained fake home. + cliHomes.delete(dir); + removeTreeWithRetry(dir); + } + }); +}); + describe("ocx restart", () => { - test("restart --help prints usage", () => { + test("restart --help prints usage", async () => { const dir = isolatedHome("ocx-restart-help-"); + let failed = false; try { - const result = runCli(["restart", "--help"], { OPENCODEX_HOME: dir }); + const result = await runCli(["restart", "--help"], { OPENCODEX_HOME: dir }); expect(result.status).toBe(0); expect(result.stdout).toContain("ocx restart"); + } catch (error) { + failed = true; + throw error; } finally { - removeTreeWithRetry(dir); + cleanupCliHome(dir, failed); } - }); + }, CLI_TEST_TIMEOUT); - test("help restart shows restart help entry", () => { + test("help restart shows restart help entry", async () => { const dir = isolatedHome("ocx-restart-help-entry-"); + let failed = false; try { - const result = runCli(["help", "restart"], { OPENCODEX_HOME: dir }); + const result = await runCli(["help", "restart"], { OPENCODEX_HOME: dir }); expect(result.status).toBe(0); expect(result.stdout).toContain("Stop the proxy and restart"); + } catch (error) { + failed = true; + throw error; } finally { - removeTreeWithRetry(dir); + cleanupCliHome(dir, failed); } - }); + }, CLI_TEST_TIMEOUT); }); describe("ocx health", () => { - test("health --help prints usage", () => { + test("health --help prints usage", async () => { const dir = isolatedHome("ocx-health-help-"); + let failed = false; try { - const result = runCli(["health", "--help"], { OPENCODEX_HOME: dir }); + const result = await runCli(["health", "--help"], { OPENCODEX_HOME: dir }); expect(result.status).toBe(0); expect(result.stdout).toContain("ocx health"); + } catch (error) { + failed = true; + throw error; } finally { - removeTreeWithRetry(dir); + cleanupCliHome(dir, failed); } - }); + }, CLI_TEST_TIMEOUT); - test("help health shows health help entry", () => { + test("help health shows health help entry", async () => { const dir = isolatedHome("ocx-health-help-entry-"); + let failed = false; try { - const result = runCli(["help", "health"], { OPENCODEX_HOME: dir }); + const result = await runCli(["help", "health"], { OPENCODEX_HOME: dir }); expect(result.status).toBe(0); expect(result.stdout).toContain("Check proxy health"); + } catch (error) { + failed = true; + throw error; } finally { - removeTreeWithRetry(dir); + cleanupCliHome(dir, failed); } - }); + }, CLI_TEST_TIMEOUT); - test("health exits 1 with no proxy running (isolated home)", () => { + test("health exits 1 with no proxy running (isolated home)", async () => { const dir = isolatedHome("ocx-health-"); - writeIsolatedConfig(dir); + let failed = false; try { - const result = runCli(["health"], { OPENCODEX_HOME: dir }); + writeIsolatedConfig(dir); + const result = await runCli(["health"], { OPENCODEX_HOME: dir }); expect(result.status).toBe(1); expect(result.stdout).toContain("not healthy"); + } catch (error) { + failed = true; + throw error; } finally { - removeTreeWithRetry(dir); + cleanupCliHome(dir, failed); } - }); + }, CLI_TEST_TIMEOUT); - test("health --json exits 1 with valid JSON when no proxy", () => { + test("health --json exits 1 with valid JSON when no proxy", async () => { const dir = isolatedHome("ocx-health-json-"); - writeIsolatedConfig(dir); + let failed = false; try { - const result = runCli(["health", "--json"], { OPENCODEX_HOME: dir }); + writeIsolatedConfig(dir); + const result = await runCli(["health", "--json"], { OPENCODEX_HOME: dir }); expect(result.status).toBe(1); const parsed = JSON.parse(result.stdout); expect(parsed.ok).toBe(false); expect(parsed.pid).toBeNull(); + } catch (error) { + failed = true; + throw error; } finally { - removeTreeWithRetry(dir); + cleanupCliHome(dir, failed); } - }); + }, CLI_TEST_TIMEOUT); }); describe("ocx ready", () => { // Only the help-routing subprocess checks live here. The default-probe, // --json, --wait, --timeout, and argument-validation cases are injected tests // in tests/cli/cli-ready.test.ts (no real loopback/home). - test("ready --help prints usage (exit 0)", () => { + test("ready --help prints usage (exit 0)", async () => { const dir = isolatedHome("ocx-ready-help-"); + let failed = false; try { - const result = runCli(["ready", "--help"], { OPENCODEX_HOME: dir }); + const result = await runCli(["ready", "--help"], { OPENCODEX_HOME: dir }); expect(result.status).toBe(0); expect(result.stdout).toContain("ocx ready"); expect(result.stdout).toContain("--wait"); + } catch (error) { + failed = true; + throw error; } finally { - removeTreeWithRetry(dir); + cleanupCliHome(dir, failed); } - }); + }, CLI_TEST_TIMEOUT); - test("help ready shows the ready help entry", () => { + test("help ready shows the ready help entry", async () => { const dir = isolatedHome("ocx-ready-help-entry-"); + let failed = false; try { - const result = runCli(["help", "ready"], { OPENCODEX_HOME: dir }); + const result = await runCli(["help", "ready"], { OPENCODEX_HOME: dir }); expect(result.status).toBe(0); expect(result.stdout).toContain("post-sync readiness"); + } catch (error) { + failed = true; + throw error; } finally { - removeTreeWithRetry(dir); + cleanupCliHome(dir, failed); } - }); + }, CLI_TEST_TIMEOUT); }); diff --git a/tests/codex-integration/codex-auth-api.test.ts b/tests/codex-integration/codex-auth-api.test.ts index 04e19d49fa..3b704d6809 100644 --- a/tests/codex-integration/codex-auth-api.test.ts +++ b/tests/codex-integration/codex-auth-api.test.ts @@ -24,19 +24,28 @@ import { getCodexAccountCredential, listCodexAccountIds, readCodexAccountRecord, + removeCodexAccountCredential, saveCodexAccountCredential, } from "../../src/codex/account-store"; import * as accountStoreModule from "../../src/codex/account-store"; import * as reserveAvailabilityModule from "../../src/codex/reserve-availability"; import { getMainAccountInfoCache, observeMainQuotaCredential } from "../../src/codex/main-account-cache"; +import { openManualResetCreditOperation } from "../../src/codex/reset-credit-operation-ledger"; +import { quotaRecoveryRecordForTests, resetQuotaRecoveryForTests } from "../../src/codex/quota-401-recovery"; +import { watchdogMs } from "../helpers/ci-watchdog"; import { clearCodexUpstreamHealth, + clearCodexUpstreamHealthForAccount, + getCodexQuotaHealthSnapshot, + claimManualResetCooldowns, + settleManualResetCooldown, clearThreadAccountMap, getCodexUpstreamHealth, recordCodexUpstreamOutcome, resetCodexRoutingForManualSelection, resolveCodexAccountForThread, } from "../../src/codex/routing"; +import { pinnedCodexAccountId, setCodexAccountPin } from "../../src/codex/account-priority"; import { clearPoolRotationState } from "../../src/codex/pool-rotation"; import { clearCodexWebSocketRegistry, @@ -47,6 +56,8 @@ import type { OcxConfig } from "../../src/types"; import type { WsData } from "../../src/server/ws-bridge"; import { handleNativeProfileAPI } from "../../src/codex/native-profile-api"; import type { NativeProfileManager } from "../../src/codex/native-profile-manager"; +import { getMainPolicyQuota } from "../../src/codex/quota"; +import { getMainAccountHardLockStatus } from "../../src/codex/main-account-hard-lock"; import { MAIN_CODEX_ACCOUNT_ID, setMainAccountPlan } from "../../src/codex/main-account"; import { reconcileCodexPlansFromTokens, resetJwtPlanNotesForTests } from "../../src/codex/plan-from-token"; import { @@ -542,6 +553,7 @@ beforeEach(() => { clearCodexWebSocketRegistry(); resetMainCodexAccountIdentityTrackingForTests(); resetJwtPlanNotesForTests(); + resetQuotaRecoveryForTests(); }); afterEach(async () => { @@ -557,6 +569,7 @@ afterEach(async () => { clearPoolRotationState(); clearCodexWebSocketRegistry(); globalThis.fetch = previousFetch; + resetQuotaRecoveryForTests(); if (previousOpencodexHome === undefined) delete process.env.OPENCODEX_HOME; else process.env.OPENCODEX_HOME = previousOpencodexHome; if (previousCodexHome === undefined) delete process.env.CODEX_HOME; @@ -971,13 +984,27 @@ describe("codex-auth API", () => { } }); - test("busy pool-quota probe maps reset-credit refresh to 503 server_busy with Retry-After 1", async () => { + test("busy usage observation preserves confirmed reset success without a retry directive", async () => { const config = makeConfig(); seedPoolAccount(config, { id: "quota-reset-busy", email: "busy@example.test" }); + // Adapted from #3995 (e172453052bf7bbc4a0ae5aa24592982c0c64b15). + recordCodexUpstreamOutcome(config, "quota-reset-busy", 429, { + now: Date.now(), resetAt: Date.now() + 3_600_000, modelId: "gpt-5.6-sol", fixedAccount: true, + }); + const cooldown = getCodexQuotaHealthSnapshot("quota-reset-busy", "shared"); + expect(cooldown).not.toBeNull(); const cleanup = seedCodexAuthAdmissionForTests({ quotaFlights: 16 }); - globalThis.fetch = (async (input: RequestInfo | URL) => String(input).includes("/consume") - ? Response.json({ code: "reset" }) - : previousFetch(input)) as typeof fetch; + let consumeCalls = 0; let usageCalls = 0; + const urls: string[] = []; + globalThis.fetch = (async (input: RequestInfo | URL) => { + const url = String(input); urls.push(url); + if (url === "https://chatgpt.com/backend-api/wham/rate-limit-reset-credits/consume") { + consumeCalls += 1; + return Response.json({ code: "reset" }); + } + if (url === "https://chatgpt.com/backend-api/wham/usage") usageCalls += 1; + throw new Error("unexpected mock URL"); + }) as typeof fetch; try { const req = new Request("http://localhost/api/codex-auth/reset-credits/consume", { method: "POST", @@ -985,9 +1012,16 @@ describe("codex-auth API", () => { body: JSON.stringify({ accountId: "quota-reset-busy" }), }); const response = await handleCodexAuthAPI(req, new URL(req.url), config); - expect(response?.status).toBe(503); - expect(response?.headers.get("Retry-After")).toBe("1"); - expect(await response?.json()).toMatchObject({ code: "server_busy" }); + expect(response?.status).toBe(200); + expect(response?.headers.get("Retry-After")).toBeNull(); + expect(await response?.json()).toEqual({ code: "reset" }); + expect(consumeCalls).toBe(1); + expect(usageCalls).toBe(0); + expect(urls).toEqual(["https://chatgpt.com/backend-api/wham/rate-limit-reset-credits/consume"]); + expect(getCodexQuotaHealthSnapshot("quota-reset-busy", "shared")).toEqual(cooldown); + const claims = claimManualResetCooldowns(config, "quota-reset-busy"); + try { expect(claims).toHaveLength(1); } + finally { for (const claim of claims) settleManualResetCooldown(config, claim, false); } } finally { cleanup(); } @@ -3047,6 +3081,42 @@ describe("codex-auth API", () => { } }); + // Adapted from luvs01's #3995, e172453052bf7bbc4a0ae5aa24592982c0c64b15. + test.each(["reset", "already_redeemed"])("cold main %s returns fresh WHAM credits without a prior lookup", async code => { + writeFileSync(join(TEST_CODEX_HOME, "auth.json"), JSON.stringify({ + tokens: { access_token: "cold-main-reset-token", account_id: "cold-main-reset-account" }, + })); + // Intentionally no listing, reconciliation, writer observation or quota seed. + let consumeCalls = 0; let usageCalls = 0; + const urls: string[] = []; + const originalFetch = globalThis.fetch; + globalThis.fetch = (async (input: RequestInfo | URL) => { + const url = String(input); urls.push(url); + if (url === "https://chatgpt.com/backend-api/wham/rate-limit-reset-credits/consume") { + consumeCalls += 1; + return Response.json({ code, remaining: 99 }); + } + if (url === "https://chatgpt.com/backend-api/wham/usage") { + usageCalls += 1; + return Response.json({ plan_type: "team", rate_limit: { secondary_window: { used_percent: 12 } }, + rate_limit_reset_credits: { available_count: 1 } }); + } + throw new Error("unexpected mock URL"); + }) as typeof fetch; + try { + const req = new Request("http://localhost/api/codex-auth/reset-credits/consume", { + method: "POST", headers: { "Content-Type": "application/json" }, + body: JSON.stringify({ accountId: MAIN_CODEX_ACCOUNT_ID }), + }); + const response = await handleCodexAuthAPI(req, new URL(req.url), makeConfig()); + expect(response?.status).toBe(200); + expect(await response?.json()).toEqual({ code, remaining: 1 }); + expect(consumeCalls).toBe(1); expect(usageCalls).toBe(1); + expect(urls).toEqual(["https://chatgpt.com/backend-api/wham/rate-limit-reset-credits/consume", + "https://chatgpt.com/backend-api/wham/usage"]); + } finally { globalThis.fetch = originalFetch; } + }); + test("reset-credit consume returns remaining from fresh main WHAM credits", async () => { writeFileSync(join(TEST_CODEX_HOME, "auth.json"), JSON.stringify({ tokens: { access_token: "main-reset-ok", account_id: "acct-main-reset-ok" }, @@ -3280,12 +3350,61 @@ describe("codex-auth API", () => { config, ); expect(retried!.status).toBe(200); + const replayed = await handleCodexAuthAPI( + consumeRequest({ accountId: "pool-alias", operationId: OTHER_OP_ID }), + new URL("http://localhost/api/codex-auth/reset-credits/consume"), + config, + ); + expect(replayed!.status).toBe(200); + expect(await replayed!.json()).toEqual({ code: "reset", replayed: true }); expect(upstream.redeemRequestIds).toEqual([OP_ID, OP_ID]); } finally { globalThis.fetch = previousFetch; } }); + for (const failure of ["throw", "non-2xx", "unknown-code"] as const) { + test(`an alias marks a pending canonical operation ambiguous after ${failure}`, async () => { + const config = makeConfig(); + const accountId = "pool-pending-alias"; + const chatgptAccountId = "physical-pending-alias"; + seedPoolAccount(config, { id: accountId, email: "pending@example.test", chatgptAccountId }); + expect(openManualResetCreditOperation({ accountId, chatgptAccountId, operationId: OP_ID })) + .toMatchObject({ kind: "execute", operationId: OP_ID }); + const readOperation = () => { + const database = new Database(join(TEST_DIR, "config-mutation.sqlite"), { readonly: true }); + try { + return database.query<{ account_key: string; operation_id: string; state: string; code: string | null }, []>( + "SELECT account_key, operation_id, state, code FROM reset_credit_operations WHERE operation_kind = 'manual'", + ).get(); + } finally { + database.close(); + } + }; + const pending = readOperation(); + expect(pending).toMatchObject({ operation_id: OP_ID, state: "pending", code: null }); + const upstream = stubUpstream(() => { + if (failure === "throw") throw new Error("fixture consume failure"); + return failure === "non-2xx" + ? new Response("fixture unavailable", { status: 503 }) + : Response.json({ code: "weird" }); + }); + try { + const response = await handleCodexAuthAPI( + consumeRequest({ accountId, operationId: OTHER_OP_ID }), + new URL("http://localhost/api/codex-auth/reset-credits/consume"), + config, + ); + expect(response!.status).toBe(failure === "throw" ? 500 : failure === "non-2xx" ? 503 : 200); + expect(readOperation()).toEqual({ ...pending!, state: "ambiguous" }); + expect(upstream.redeemRequestIds).toEqual([OP_ID]); + expect(getCodexAccountCredential(accountId)?.chatgptAccountId).toBe(chatgptAccountId); + } finally { + globalThis.fetch = previousFetch; + } + }); + } + test("an unknown upstream code stays ambiguous instead of settling the ledger", async () => { const config = makeConfig(); seedPoolAccount(config, { id: "pool-weird", email: "weird@example.test" }); @@ -5404,3 +5523,539 @@ describe("codex-auth helpers", () => { expect(isAccountNeedsReauth(id)).toBe(false); }); }); + + +describe("manual reset cooldown recovery (#3973)", () => { + const USAGE = "https://chatgpt.com/backend-api/wham/usage"; + const CONSUME = "https://chatgpt.com/backend-api/wham/rate-limit-reset-credits/consume"; + const OP = "be810596-310c-4c21-95cb-e47f984398a0"; + function gate() { + let release!: () => void; + const promise = new Promise<void>(resolve => { release = resolve; }); + return { promise, release }; + } + function usage(percent = 12) { + return { plan_type: "team", rate_limit: { secondary_window: { used_percent: percent } }, + rate_limit_reset_credits: { available_count: 2 } }; + } + function setup() { + const config = makeConfig({ activeCodexAccountId: "manual-a", accountPoolStrategy: "fill-first" }); + seedPoolAccount(config, { id: "manual-a", email: "manual@example.test", plan: "team" }); + setCodexAccountPin(config, "manual-a"); + cool(config, "manual-a"); + return config; + } + function cool(config: OcxConfig, id: string, modelId = "gpt-5.6-sol", now = Date.now()) { + recordCodexUpstreamOutcome(config, id, 429, { now, resetAt: now + 3_600_000, modelId, fixedAccount: true }); + } + function consume(config: OcxConfig, id = "manual-a", operationId = OP) { + const req = new Request("http://localhost/api/codex-auth/reset-credits/consume", { + method: "POST", headers: { "Content-Type": "application/json" }, + body: JSON.stringify({ accountId: id, operationId }), + }); + return handleCodexAuthAPI(req, new URL(req.url), config); + } + function mock(consumeResponse: () => Response | Promise<Response>, usageResponse: () => Response | Promise<Response>) { + const urls: string[] = []; + globalThis.fetch = (async input => { + const url = String(input); + urls.push(url); + if (url === CONSUME) return consumeResponse(); + if (url === USAGE) return usageResponse(); + throw new Error("unexpected mock URL"); + }) as typeof fetch; + return urls; + } + + test.each(["reset", "already_redeemed", "nothing_to_reset", "no_credit", "unknown"])( + "only a new reset recovers, preserving pin/selection and other scopes: %s", async code => { + const config = setup(); + cool(config, "manual-a", "gpt-5.3-codex-spark"); + cool(config, "manual-a", "gpt-reserve"); + const spark = getCodexQuotaHealthSnapshot("manual-a", "spark"); + const reserve = getCodexQuotaHealthSnapshot("manual-a", "reserve"); + const urls = mock(() => Response.json({ code }), () => Response.json(usage())); + const result = await consume(config); + expect(result?.status).toBe(200); + expect(getCodexQuotaHealthSnapshot("manual-a", "shared") === null).toBe(code === "reset"); + expect(getCodexQuotaHealthSnapshot("manual-a", "spark")).toEqual(spark); + expect(getCodexQuotaHealthSnapshot("manual-a", "reserve")).toEqual(reserve); + expect(config.activeCodexAccountId).toBe("manual-a"); + expect(pinnedCodexAccountId(config)).toBe("manual-a"); + expect(urls).toEqual(code === "reset" || code === "already_redeemed" ? [CONSUME, USAGE] : [CONSUME]); + if (code === "reset") { + cool(config, "manual-a"); + const replay = await consume(config); + expect(await replay?.json()).toEqual({ code: "reset", replayed: true }); + expect(getCodexQuotaHealthSnapshot("manual-a", "shared")).not.toBeNull(); + expect(urls).toEqual([CONSUME, USAGE]); + } + }, + ); + + test.each(["credits-only", "exhausted", "short-exhausted", "tertiary-only", "empty", "non-2xx", "malformed", "timeout"])( + "confirmed reset stays successful but incomplete/failed observation retains cooldown: %s", async kind => { + const config = setup(); + const urls = mock(() => Response.json({ code: "reset" }), () => { + if (kind === "timeout") throw new DOMException("fixture", "TimeoutError"); + if (kind === "non-2xx") return new Response("fixture", { status: 503 }); + if (kind === "malformed") return new Response("not-json"); + if (kind === "empty") return Response.json({}); + if (kind === "credits-only") return Response.json({ rate_limit_reset_credits: { available_count: 2 } }); + if (kind === "tertiary-only") return Response.json({ plan_type: "team", rate_limit: { tertiary_window: { used_percent: 5 } } }); + if (kind === "short-exhausted") return Response.json({ ...usage(), rate_limit: { + primary_window: { used_percent: 100, limit_window_seconds: 18_000 }, secondary_window: { used_percent: 12 }, + } }); + return Response.json(usage(100)); + }); + expect((await consume(config))?.status).toBe(200); + expect(getCodexQuotaHealthSnapshot("manual-a", "shared")).not.toBeNull(); + const nextClaims = claimManualResetCooldowns(config, "manual-a"); + expect(nextClaims).toHaveLength(1); + for (const claim of nextClaims) settleManualResetCooldown(config, claim, false); + expect(await (await consume(config))?.json()).toEqual({ code: "reset", replayed: true }); + expect(urls).toEqual([CONSUME, USAGE]); + }, + ); + + test("recovery never follows a physical-account match to another local alias", async () => { + const config = setup(); + seedPoolAccount(config, { id: "manual-alias", email: "alias@example.test", plan: "team", chatgptAccountId: "acct-manual-a" }); + cool(config, "manual-alias"); + const untouched = getCodexQuotaHealthSnapshot("manual-alias", "shared"); + const urls = mock(() => Response.json({ code: "reset" }), () => Response.json(usage())); + expect((await consume(config))?.status).toBe(200); + expect(getCodexQuotaHealthSnapshot("manual-a", "shared")).toBeNull(); + expect(getCodexQuotaHealthSnapshot("manual-alias", "shared")).toEqual(untouched); + expect(urls).toEqual([CONSUME, USAGE]); + }); + + test.each(["team", "go", "free"])("monthly governing usage can recover %s", async plan => { + const config = setup(); + const urls = mock(() => Response.json({ code: "reset" }), () => Response.json({ plan_type: plan, + rate_limit: { primary_window: { used_percent: 4, limit_window_seconds: 2_628_000 } }, + })); + expect((await consume(config))?.status).toBe(200); + expect(getCodexQuotaHealthSnapshot("manual-a", "shared")).toBeNull(); + expect(urls).toEqual([CONSUME, USAGE]); + }); + + test.each(["throw", "non-2xx", "unknown"])("ambiguous consume releases only its own cooldown claim: %s", async failure => { + const config = setup(); + const urls = mock(() => { + if (failure === "throw") throw new Error("fixture"); + return failure === "non-2xx" ? new Response("fixture", { status: 503 }) : Response.json({ code: "unknown" }); + }, () => Response.json(usage())); + const response = await consume(config); + expect(response?.status).toBe(failure === "throw" ? 500 : failure === "non-2xx" ? 503 : 200); + expect(getCodexQuotaHealthSnapshot("manual-a", "shared")).not.toBeNull(); + const claims = claimManualResetCooldowns(config, "manual-a"); + expect(claims).toHaveLength(1); + for (const claim of claims) settleManualResetCooldown(config, claim, false); + expect(urls).toEqual([CONSUME]); + }); + + test("post-reset 401 refresh carries the successful replay's dispatch and credential proof", async () => { + const config = setup(); const generation = readCodexAccountRecord("manual-a")!.generation; + const urls: string[] = []; let reads = 0; + globalThis.fetch = (async input => { + const url = String(input); urls.push(url); + if (url === CONSUME) return Response.json({ code: "reset" }); + if (url === USAGE) return ++reads === 1 ? new Response("{}", { status: 401 }) : Response.json(usage()); + if (url === "https://auth.openai.com/oauth/token") return Response.json({ + access_token: "refreshed-access", refresh_token: "refreshed-refresh", expires_in: 3600, + }); + throw new Error("unexpected mock URL"); + }) as typeof fetch; + expect((await consume(config))?.status).toBe(200); + expect(getCodexQuotaHealthSnapshot("manual-a", "shared")).toBeNull(); + expect(readCodexAccountRecord("manual-a")!.generation).toBe(generation + 1); + expect(urls).toEqual([CONSUME, USAGE, "https://auth.openai.com/oauth/token", USAGE]); + }); + + test("same-tick external G+1 adopted by 401 replay cannot settle manual recovery", async () => { + const now = Date.now(); const clock = spyOn(Date, "now").mockReturnValue(now); + const firstUsage = gate(); const release401 = gate(); + let pending: ReturnType<typeof consume> | undefined; + const forceRefresh = accountStoreModule.forceRefreshCodexPoolToken; + let observedProvenance: string | undefined; + const refreshSpy = spyOn(accountStoreModule, "forceRefreshCodexPoolToken").mockImplementation(async (id, options) => { + const result = await forceRefresh(id, options); + observedProvenance = result.provenance; + return result; + }); + try { + expect(quotaRecoveryRecordForTests("manual-a")).toBeUndefined(); + const config = setup(); + const original = getCodexAccountCredential("manual-a")!; + // Establish a non-undefined replacement stamp before the manual claim. + saveCodexAccountCredential("manual-a", original); + const before = readCodexAccountRecord("manual-a")!; + expect(before.replacedAt).toBe(now); + let reads = 0; + const urls = mock(() => Response.json({ code: "reset" }), async () => { + if (++reads === 1) { firstUsage.release(); await release401.promise; return new Response("{}", { status: 401 }); } + return Response.json(usage()); + }); + pending = consume(config); + await firstUsage.promise; + saveCodexAccountCredential("manual-a", { ...original, accessToken: "external-access", refreshToken: "external-refresh" }); + const replacement = readCodexAccountRecord("manual-a")!; + expect(replacement.generation).toBe(before.generation + 1); + expect(replacement.replacedAt).toBe(before.replacedAt); + release401.release(); + expect(await (await pending)?.json()).toEqual({ code: "reset", remaining: 2 }); + expect(observedProvenance).toBe("external-replacement"); + expect(getCodexQuotaHealthSnapshot("manual-a", "shared")).not.toBeNull(); + // No OAuth call: forceRefresh adopted the time-valid external replacement. + expect(urls).toEqual([CONSUME, USAGE, USAGE]); + const claims = claimManualResetCooldowns(config, "manual-a"); + expect(claims).toHaveLength(1); + for (const claim of claims) settleManualResetCooldown(config, claim, false); + } finally { + release401.release(); + try { if (pending) await pending; } + finally { refreshSpy.mockRestore(); clock.mockRestore(); } + } + }); + + test("manual 401 can join a genuine owned refresh and retain its +1 lineage", async () => { + const config = setup(); const before = readCodexAccountRecord("manual-a")!; + const firstUsage = gate(); const release401 = gate(); const oauthStarted = gate(); const releaseOAuth = gate(); const joined = gate(); + const forceRefresh = accountStoreModule.forceRefreshCodexPoolToken; + let refreshCalls = 0; + let joinedProvenance: string | undefined; + const spy = spyOn(accountStoreModule, "forceRefreshCodexPoolToken").mockImplementation(async (id, options) => { + const result = forceRefresh(id, options); + const isJoiner = ++refreshCalls === 2; + if (isJoiner) joined.release(); + const resolved = await result; + if (isJoiner) joinedProvenance = resolved.provenance; + return resolved; + }); + const urls: string[] = []; let reads = 0; + globalThis.fetch = (async input => { + const url = String(input); urls.push(url); + if (url === CONSUME) return Response.json({ code: "reset" }); + if (url === USAGE) { + if (++reads === 1) { firstUsage.release(); await release401.promise; return new Response("{}", { status: 401 }); } + return Response.json(usage()); + } + if (url === "https://auth.openai.com/oauth/token") { + oauthStarted.release(); await releaseOAuth.promise; + return Response.json({ access_token: "joined-access", refresh_token: "joined-refresh", expires_in: 3600 }); + } + throw new Error("unexpected mock URL"); + }) as typeof fetch; + const pending = consume(config); + let owner: ReturnType<typeof forceRefresh> | undefined; + try { + await firstUsage.promise; + owner = accountStoreModule.forceRefreshCodexPoolToken("manual-a", { + rejectedGeneration: before.generation, rejectedAccessToken: before.credential!.accessToken, + }); + await oauthStarted.promise; + release401.release(); await joined.promise; + releaseOAuth.release(); + expect((await owner).provenance).toBe("self-refresh"); + expect((await pending)?.status).toBe(200); + expect(joinedProvenance).toBe("joined-lineage"); + expect(getCodexQuotaHealthSnapshot("manual-a", "shared")).toBeNull(); + expect(readCodexAccountRecord("manual-a")!.generation).toBe(before.generation + 1); + expect(urls).toEqual([CONSUME, USAGE, "https://auth.openai.com/oauth/token", USAGE]); + } finally { + release401.release(); releaseOAuth.release(); + if (owner) await owner; await pending; + spy.mockRestore(); + } + }); + + test.each(["consume", "usage"])("new 429 during %s survives the old reset claim", async stage => { + const config = setup(); + const started = gate(); const finish = gate(); + let later: ReturnType<typeof getCodexQuotaHealthSnapshot>; + mock(async () => { + if (stage === "consume") { started.release(); await finish.promise; } + return Response.json({ code: "reset" }); + }, async () => { + if (stage === "usage") { started.release(); await finish.promise; } + return Response.json(usage()); + }); + const pending = consume(config); + try { + await started.promise; + cool(config, "manual-a", "gpt-5.6-sol", Date.now() + 1); + later = getCodexQuotaHealthSnapshot("manual-a", "shared"); + } finally { finish.release(); } + expect((await pending)?.status).toBe(200); + expect(getCodexQuotaHealthSnapshot("manual-a", "shared")).toEqual(later!); + }); + + test.each(["replace", "remove", "readd", "pause", "recreate"])("usage cannot recover after %s", async change => { + const config = setup(); const started = gate(); const finish = gate(); + mock(() => Response.json({ code: "reset" }), async () => { + started.release(); await finish.promise; return Response.json(usage()); + }); + const pending = consume(config); + try { + await started.promise; + if (change === "replace") saveCodexAccountCredential("manual-a", { + accessToken: "replacement", refreshToken: "replacement-refresh", expiresAt: Date.now() + 3_600_000, + chatgptAccountId: "replacement-account", + }); + if (change === "remove") config.codexAccounts = []; + if (change === "readd") { + removeCodexAccountCredential("manual-a"); + saveCodexAccountCredential("manual-a", { accessToken: "readded-access", refreshToken: "readded-refresh", + expiresAt: Date.now() + 3_600_000, chatgptAccountId: "acct-manual-a" }); + } + if (change === "pause") config.pausedCodexAccountIds = ["manual-a"]; + if (change === "recreate") { clearCodexUpstreamHealthForAccount("manual-a"); cool(config, "manual-a"); } + } finally { finish.release(); } + expect((await pending)?.status).toBe(200); + expect(getCodexQuotaHealthSnapshot("manual-a", "shared")).not.toBeNull(); + if (change === "pause") expect(config.pausedCodexAccountIds).toEqual(["manual-a"]); + }); + + test.each([false, true])("old usage cannot prove reset or overwrite a newer observation (old finishes first=%s)", async oldFirst => { + const config = setup(); const oldStarted = gate(); const oldFinish = gate(); + const freshStarted = gate(); const freshFinish = gate(); let reads = 0; + const urls = mock(() => Response.json({ code: "reset" }), async () => { + reads += 1; + if (reads === 1) { oldStarted.release(); await oldFinish.promise; return Response.json(usage(99)); } + freshStarted.release(); await freshFinish.promise; return Response.json(usage(12)); + }); + const frozenNow = Date.now(); + const clock = spyOn(Date, "now").mockReturnValue(frozenNow); + const old = listCodexAuthAccounts(config, true); + let reset: ReturnType<typeof consume> | undefined; + try { + await oldStarted.promise; + reset = consume(config); + await freshStarted.promise; + if (oldFirst) { + oldFinish.release(); await old; + expect(getCodexQuotaHealthSnapshot("manual-a", "shared")).not.toBeNull(); + } + freshFinish.release(); + expect((await reset)?.status).toBe(200); + expect(getCodexQuotaHealthSnapshot("manual-a", "shared")).toBeNull(); + oldFinish.release(); await old; + expect(getAccountQuota("manual-a")?.weeklyPercent).toBe(12); + expect(urls).toEqual([USAGE, CONSUME, USAGE]); + } finally { + oldFinish.release(); freshFinish.release(); + await old; if (reset) await reset; + clock.mockRestore(); + } + }); + + // Adapt #3995/e172453052's two-flight convergence to fresh-before-old scheduling. + test("reset publishes a fourth usage request before two old current-generation flights complete", async () => { + const config = setup(); + const oldCredential = getCodexAccountCredential("manual-a")!; + const oldGeneration = readCodexAccountRecord("manual-a")!.generation; + const firstStarted = gate(); const release401 = gate(); const secondStarted = gate(); const secondFinish = gate(); + const replayStarted = gate(); const replayFinish = gate(); const freshStarted = gate(); + const latches = [firstStarted, release401, secondStarted, secondFinish, replayStarted, replayFinish, freshStarted]; + const pending: Promise<unknown>[] = []; + const urls: string[] = []; const usageBearers: Array<string | null> = []; + let usageCalls = 0; let consumeCalls = 0; let completedOldResponses = 0; + let rejectDeadline!: (error: Error) => void; + const deadline = new Promise<never>((_resolve, reject) => { rejectDeadline = reject; }); + // Failure bound only: success is synchronized on dispatch latches, never elapsed time. + const timeout = setTimeout(() => rejectDeadline(new Error("mock dispatch did not reach its expected phase")), watchdogMs(10_000)); + const originalFetch = globalThis.fetch; + globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => { + const url = String(input); urls.push(url); + if (url === CONSUME) { consumeCalls += 1; return Response.json({ code: "reset" }); } + if (url !== USAGE) throw new Error("unexpected mock URL"); + usageBearers.push(new Headers(init?.headers).get("Authorization")); + switch (++usageCalls) { + case 1: + firstStarted.release(); await release401.promise; + return new Response("{}", { status: 401 }); + case 2: + secondStarted.release(); await secondFinish.promise; completedOldResponses += 1; + return Response.json({ ...usage(88), rate_limit_reset_credits: { available_count: 66 } }); + case 3: + replayStarted.release(); await replayFinish.promise; completedOldResponses += 1; + return Response.json({ ...usage(99), rate_limit_reset_credits: { available_count: 77 } }); + case 4: + freshStarted.release(); return Response.json(usage(12)); + default: throw new Error("unexpected mock usage dispatch"); + } + }) as typeof fetch; + try { + const first = listCodexAuthAccounts(config, true); pending.push(first); + void first.catch(rejectDeadline); + await Promise.race([firstStarted.promise, deadline]); + // A fresh external generation starts its own ordinary flight while P's old 401 is held. + saveCodexAccountCredential("manual-a", { ...oldCredential, accessToken: "converged-access", refreshToken: "converged-refresh" }); + expect(readCodexAccountRecord("manual-a")!.generation).toBe(oldGeneration + 1); + const second = listCodexAuthAccounts(config, true); pending.push(second); + void second.catch(rejectDeadline); + await Promise.race([secondStarted.promise, deadline]); + release401.release(); + await Promise.race([replayStarted.promise, deadline]); + // Both old flights now use the current generation; neither response has completed. + expect(usageBearers).toEqual([`Bearer ${oldCredential.accessToken}`, "Bearer converged-access", "Bearer converged-access"]); + expect(completedOldResponses).toBe(0); + const reset = consume(config); pending.push(reset); + void reset.catch(rejectDeadline); + await Promise.race([freshStarted.promise, deadline]); + const response = await Promise.race([reset, deadline]); + expect(response?.status).toBe(200); + expect(await response?.json()).toEqual({ code: "reset", remaining: 2 }); + expect(completedOldResponses).toBe(0); + expect(getCodexQuotaHealthSnapshot("manual-a", "shared")).toBeNull(); + const fresh = structuredClone(getAccountQuota("manual-a")); + expect(fresh).toMatchObject({ weeklyPercent: 12, resetCredits: 2 }); + secondFinish.release(); replayFinish.release(); + await Promise.all([first, second]); + expect(completedOldResponses).toBe(2); + expect(getAccountQuota("manual-a")).toEqual(fresh); + expect(getCodexQuotaHealthSnapshot("manual-a", "shared")).toBeNull(); + expect(consumeCalls).toBe(1); expect(usageCalls).toBe(4); + expect(usageBearers).toEqual([`Bearer ${oldCredential.accessToken}`, "Bearer converged-access", "Bearer converged-access", "Bearer converged-access"]); + expect(urls).toEqual([USAGE, USAGE, USAGE, CONSUME, USAGE]); + } finally { + clearTimeout(timeout); + for (const latch of latches) latch.release(); + const results = await Promise.allSettled(pending); + globalThis.fetch = originalFetch; + for (const result of results) if (result.status === "rejected") throw result.reason; + } + }, 60_000); + + test("main Q-first/P-last publication preserves post-reset cache, credits and hard-lock readiness", async () => { + const config = makeConfig({ codexMainAccountHardLock: true }); + const accessToken = "ordered-main-token"; const accountId = "ordered-main-account"; + writeFileSync(join(TEST_CODEX_HOME, "auth.json"), JSON.stringify({ tokens: { access_token: accessToken, account_id: accountId } })); + reconcileMainCodexAccountRuntimeState(); + const writer = observeMainQuotaCredential(accessToken, accountId)!; + setAccountQuotaFromParsed(MAIN_CODEX_ACCOUNT_ID, { weeklyPercent: 100, resetCredits: 5 }, captureConfigGeneration(), writer); + expect(getMainAccountHardLockStatus(config).state).toBe("blocked"); + cool(config, MAIN_CODEX_ACCOUNT_ID); + const oldStarted = gate(); const oldFinish = gate(); let reads = 0; + const urls = mock(() => Response.json({ code: "reset" }), () => { + if (++reads === 1) return new Response(new ReadableStream<Uint8Array>({ + async start(controller) { + oldStarted.release(); await oldFinish.promise; + controller.enqueue(new TextEncoder().encode(JSON.stringify({ ...usage(100), + rate_limit_reset_credits: { available_count: 7 } }))); + controller.close(); + }, + }), { headers: { "Content-Type": "application/json" } }); + if (reads === 2) return Response.json(usage(12)); + // Later omission also verifies the private retained-credit slot was not overwritten by P. + return Response.json({ plan_type: "team", rate_limit: { secondary_window: { used_percent: 14 } } }); + }); + const old = fetchMainAccountInfoSnapshot(true); + try { + await oldStarted.promise; + const reset = await consume(config, MAIN_CODEX_ACCOUNT_ID); + expect(await reset?.json()).toEqual({ code: "reset", remaining: 2 }); + expect(getCodexQuotaHealthSnapshot(MAIN_CODEX_ACCOUNT_ID, "shared")).toBeNull(); + const freshCache = structuredClone(getMainAccountInfoCache()); + const freshShared = structuredClone(getAccountQuota(MAIN_CODEX_ACCOUNT_ID)); + const freshPolicy = structuredClone(getMainPolicyQuota()); + expect(freshCache?.quota).toMatchObject({ weeklyPercent: 12, resetCredits: 2 }); + expect(getMainAccountHardLockStatus(config).state).toBe("ready"); + oldFinish.release(); + const stale = await old; + expect(stale.quotaRefresh).toBeUndefined(); + expect(getMainAccountInfoCache()).toEqual(freshCache); + expect(getAccountQuota(MAIN_CODEX_ACCOUNT_ID)).toEqual(freshShared); + expect(getMainPolicyQuota()).toEqual(freshPolicy); + expect(getMainAccountHardLockStatus(config).state).toBe("ready"); + const displayed = (await listCodexAuthAccounts(config, false)).find(account => account.isMain)!; + expect(displayed.quota).toMatchObject({ weeklyPercent: 12, resetCredits: 2 }); + await fetchMainAccountInfoSnapshot(true); + const afterOmission = (await listCodexAuthAccounts(config, false)).find(account => account.isMain)!; + expect(afterOmission.quota?.resetCredits).toBe(2); + expect(getMainAccountHardLockStatus(config).state).toBe("ready"); + expect(urls).toEqual([USAGE, CONSUME, USAGE, USAGE]); + } finally { oldFinish.release(); await old; } + }); + + test("a newer failed main read does not outrank an older successful publication", async () => { + writeFileSync(join(TEST_CODEX_HOME, "auth.json"), JSON.stringify({ + tokens: { access_token: "publication-main-token", account_id: "publication-main-account" }, + })); + reconcileMainCodexAccountRuntimeState(); + const started = gate(); const finish = gate(); let reads = 0; + const urls = mock(() => { throw new Error("consume is not expected"); }, async () => { + if (++reads === 1) { started.release(); await finish.promise; return Response.json(usage()); } + return new Response("fixture unavailable", { status: 503 }); + }); + const old = fetchMainAccountInfoSnapshot(true); + try { + await started.promise; + expect((await fetchMainAccountInfoSnapshot(true)).quotaRefresh).toEqual({ status: "http_error", httpStatus: 503 }); + finish.release(); + expect((await old).quotaRefresh).toEqual({ status: "ok" }); + expect(getMainAccountInfoCache()?.quota).toMatchObject({ weeklyPercent: 12, resetCredits: 2 }); + expect(getMainPolicyQuota()?.weeklyPercent).toBe(12); + expect(getMainAccountHardLockStatus({ codexMainAccountHardLock: true }).state).toBe("ready"); + expect(urls).toEqual([USAGE, USAGE]); + } finally { finish.release(); await old; } + }); + + test("main reset usage does not erase an existing reauth quarantine", async () => { + const config = makeConfig(); + writeFileSync(join(TEST_CODEX_HOME, "auth.json"), JSON.stringify({ + tokens: { access_token: "manual-main-token", account_id: "manual-main-account" }, + })); + reconcileMainCodexAccountRuntimeState(); + cool(config, MAIN_CODEX_ACCOUNT_ID); + markAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID); + const urls = mock(() => Response.json({ code: "reset" }), () => Response.json(usage())); + expect((await consume(config, MAIN_CODEX_ACCOUNT_ID))?.status).toBe(200); + expect(isAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID)).toBe(true); + expect(getCodexQuotaHealthSnapshot(MAIN_CODEX_ACCOUNT_ID, "shared")).not.toBeNull(); + expect(urls).toEqual([CONSUME, USAGE]); + }); + + test("conflicting main token/header identity supplies no recovery proof", async () => { + const config = makeConfig(); + const payload = Buffer.from(JSON.stringify({ "https://api.openai.com/auth": { chatgpt_account_id: "token-account" } })).toString("base64url"); + writeFileSync(join(TEST_CODEX_HOME, "auth.json"), JSON.stringify({ + tokens: { access_token: "manual-main-token", id_token: `e30.${payload}.sig`, account_id: "header-account" }, + })); + reconcileMainCodexAccountRuntimeState(); cool(config, MAIN_CODEX_ACCOUNT_ID); + const urls = mock(() => Response.json({ code: "reset" }), () => Response.json(usage())); + expect(await (await consume(config, MAIN_CODEX_ACCOUNT_ID))?.json()).toEqual({ code: "reset" }); + expect(getCodexQuotaHealthSnapshot(MAIN_CODEX_ACCOUNT_ID, "shared")).not.toBeNull(); + expect(urls).toEqual([CONSUME]); + }); + + test.each(["same", "bearer", "other-account", "aba"])("main recovery uses its own live credential proof: %s", async change => { + const config = makeConfig(); + const writeMain = (accountId: string, accessToken = "manual-main-token") => { + writeFileSync(join(TEST_CODEX_HOME, "auth.json"), JSON.stringify({ tokens: { access_token: accessToken, account_id: accountId } })); + }; + writeMain("manual-main-account"); reconcileMainCodexAccountRuntimeState(); + cool(config, MAIN_CODEX_ACCOUNT_ID); + const started = gate(); const finish = gate(); let usageCalls = 0; + mock(() => Response.json({ code: "reset" }), async () => { + usageCalls += 1; + if (usageCalls === 1) { started.release(); await finish.promise; } + return Response.json(usage()); + }); + const pending = consume(config, MAIN_CODEX_ACCOUNT_ID); + try { + await started.promise; + expect(getNativeMainProfileRequestCount()).toBe(1); + if (change === "bearer") writeMain("manual-main-account", "replacement-main-token"); + if (change === "other-account" || change === "aba") { + writeMain("other-main-account"); reconcileMainCodexAccountRuntimeState(); + if (change === "aba") { writeMain("manual-main-account"); reconcileMainCodexAccountRuntimeState(); } + cool(config, MAIN_CODEX_ACCOUNT_ID); + } + } finally { finish.release(); } + expect((await pending)?.status).toBe(200); + expect(getCodexQuotaHealthSnapshot(MAIN_CODEX_ACCOUNT_ID, "shared") === null).toBe(change === "same"); + expect(getNativeMainProfileRequestCount()).toBe(0); + }); +}); diff --git a/tests/codex-integration/codex-auth-context.test.ts b/tests/codex-integration/codex-auth-context.test.ts index bb4f24a098..73417b85f7 100644 --- a/tests/codex-integration/codex-auth-context.test.ts +++ b/tests/codex-integration/codex-auth-context.test.ts @@ -1447,8 +1447,9 @@ describe("Codex auth context", () => { // The caller proved admission with one of OUR secrets. That secret must never leave the // process, so the only acceptable outcome is the stored main credential in its place. const admissionSecret = "ocx_data_localsecret"; + const storedCredential = liveJwt(); writeFileSync(join(testDir, "auth.json"), JSON.stringify({ - tokens: { access_token: liveJwt(), account_id: "stored_main_acc" }, + tokens: { access_token: storedCredential, account_id: "stored_main_acc" }, })); const headers = materializeCodexUpstreamAuth( @@ -1458,7 +1459,7 @@ describe("Codex auth context", () => { ); expect(headers.get("authorization")).not.toContain(admissionSecret); - expect(headers.get("authorization")).toBe(`Bearer ${liveJwt()}`); + expect(headers.get("authorization")).toBe(`Bearer ${storedCredential}`); expect(headers.get("chatgpt-account-id")).toBe("stored_main_acc"); // Unrelated forwarded headers still ride along. expect(headers.get("openai-beta")).toBe("responses=experimental"); diff --git a/tests/codex-integration/codex-cooldown-recovery.test.ts b/tests/codex-integration/codex-cooldown-recovery.test.ts index a196adcfe8..c898d4ee92 100644 --- a/tests/codex-integration/codex-cooldown-recovery.test.ts +++ b/tests/codex-integration/codex-cooldown-recovery.test.ts @@ -7,7 +7,7 @@ import { runCodexCooldownRecoveryProbes, seedCodexAuthAdmissionForTests, } from "../../src/codex/auth-api"; -import { saveCodexAccountCredential } from "../../src/codex/account-store"; +import { readCodexAccountRecord, saveCodexAccountCredential, saveCodexAccountCredentialIfGeneration } from "../../src/codex/account-store"; import { codexQuotaWindowForPlan, getAccountQuota, @@ -20,6 +20,11 @@ import upstreamModels from "../../src/codex/data/upstream-models.json"; import { CODEX_QUOTA_PROBE_INTERVAL_MS, clearCodexUpstreamHealth, + clearCodexUpstreamHealthForAccount, + claimDueCodexQuotaRecoveryProbes, + claimManualResetCooldowns, + settleCodexQuotaRecoveryProbe, + settleManualResetCooldown, getCodexQuotaHealthSnapshot, recordCodexUpstreamOutcome, resolveCodexAccountForThread, @@ -105,6 +110,78 @@ describe("Codex cooldown recovery worker", () => { if (existsSync(TEST_DIR)) removeTreeWithRetry(TEST_DIR); }); + test("manual reset bypasses pacing but does not steal a live background lease", () => { + const config = makeConfig(["a"]); saveCredential("a"); cool(config, "a"); + const manual = claimManualResetCooldowns(config, "a", START + 1); + expect(manual).toHaveLength(1); + expect(claimDueCodexQuotaRecoveryProbes(config, 1, due())).toEqual([]); + settleManualResetCooldown(config, manual[0]!, false, {}, START + 2); + const [background] = claimDueCodexQuotaRecoveryProbes(config, 1, due(START + 2)); + expect(background).toBeDefined(); + expect(claimManualResetCooldowns(config, "a", due(START + 2))).toEqual([]); + expect(settleManualResetCooldown(config, manual[0]!, false, {}, due(START + 2))).toBe(false); + expect(settleCodexQuotaRecoveryProbe(background!, true, { + credentialGeneration: readCodexAccountRecord("a")!.generation, + }, due(START + 2))).toBe(true); + }); + + test("manual recovery rejects an unrelated refresh edge and preserves exact-generation settlement", () => { + const config = makeConfig(["a"]); saveCredential("a"); cool(config, "a"); + const [claim] = claimManualResetCooldowns(config, "a", START); + expect(claim?.kind).toBe("pool"); + const before = readCodexAccountRecord("a")!; + const generation = before.generation; + expect(saveCodexAccountCredentialIfGeneration("a", generation, { + ...before.credential!, accessToken: "fresh-a", refreshToken: "fresh-refresh-a", + })).toBe(true); + expect(readCodexAccountRecord("a")!.replacedAt).toBe(before.replacedAt); + expect(settleManualResetCooldown(config, claim!, true, { + credentialGeneration: generation + 1, + refreshLineage: { fromGeneration: generation - 1, toGeneration: generation + 1, provenance: "self-refresh" }, + }, START)).toBe(false); + expect(getCodexQuotaHealthSnapshot("a", "shared", START)).not.toBeNull(); + // Rejection releases the lease rather than leaving manual recovery stuck. + const [exact] = claimManualResetCooldowns(config, "a", START); + expect(exact).toBeDefined(); + expect(settleManualResetCooldown(config, exact!, true, { credentialGeneration: generation + 1 }, START)).toBe(true); + }); + + test("a replacement between auth and claiming cannot acquire the replacement's cooldown", () => { + const config = makeConfig(["a"]); saveCredential("a"); cool(config, "a"); + const generation = readCodexAccountRecord("a")!.generation; + saveCredential("a", "-replacement"); + expect(claimManualResetCooldowns(config, "a", START, generation)).toEqual([]); + expect(getCodexQuotaHealthSnapshot("a", "shared", START)).not.toBeNull(); + }); + + test("deleted and recreated cooldown with identical generation and clock cannot reuse a manual lease", () => { + const config = makeConfig(["a"]); saveCredential("a"); cool(config, "a"); + const [old] = claimManualResetCooldowns(config, "a", START); + clearCodexUpstreamHealthForAccount("a"); cool(config, "a"); + const [replacement] = claimManualResetCooldowns(config, "a", START); + expect(replacement!.probe.cooldownGeneration).toBe(old!.probe.cooldownGeneration); + expect(replacement!.probe.leaseId).not.toBe(old!.probe.leaseId); + const proof = { credentialGeneration: readCodexAccountRecord("a")!.generation }; + expect(settleManualResetCooldown(config, old!, true, proof, START)).toBe(false); + expect(getCodexQuotaHealthSnapshot("a", "shared", START)).not.toBeNull(); + expect(settleManualResetCooldown(config, replacement!, true, proof, START)).toBe(true); + }); + + test.each(["retry-after", "default", "spark", "reserve", "paused", "missing"])( + "manual reset never claims an ineligible target: %s", kind => { + const config = makeConfig(["a"]); saveCredential("a"); + if (kind === "retry-after") recordCodexUpstreamOutcome(config, "a", 429, { now: START, retryAfter: "3600" }); + else if (kind === "default") recordCodexUpstreamOutcome(config, "a", 429, { now: START }); + else if (kind === "reserve") recordCodexUpstreamOutcome(config, "a", 429, { + now: START, resetAt: START + 3_600_000, modelId: "gpt-reserve", + }); + else cool(config, "a", kind === "spark" ? "spark" : "shared"); + if (kind === "paused") config.pausedCodexAccountIds = ["a"]; + if (kind === "missing") config.codexAccounts = []; + expect(claimManualResetCooldowns(config, "a", START + 1)).toEqual([]); + }, + ); + test("recovers cooled A independently while ordinary routing only selects B", async () => { const config = makeConfig(); saveCredential("a"); diff --git a/tests/codex-integration/codex-metadata-integrity.test.ts b/tests/codex-integration/codex-metadata-integrity.test.ts index 72fbcad6e9..c03d03eb8c 100644 --- a/tests/codex-integration/codex-metadata-integrity.test.ts +++ b/tests/codex-integration/codex-metadata-integrity.test.ts @@ -208,6 +208,35 @@ describe("Codex request transport metadata", () => { expect(new Headers(dropped.headers).get(hintHeader)).toBe("model=gpt-5.6-sol"); }); + test("canonical adapter drops Lite only for the Spark wire model", async () => { + const adapter = createResponsesPassthroughAdapter({ + adapter: "openai-responses", authMode: "forward", baseUrl: "https://chatgpt.com/backend-api/codex", + headers: { "X-OpenAI-Internal-Codex-Responses-Lite": "true" }, + }); + + for (const [model, incomingLite, expectedLite] of [ + ["gpt-5.3-codex-spark", "true", null], + ["gpt-5.3-codex-spark", undefined, null], + ["gpt-5.6-sol", "true", "true"], + ] as const) { + const parsed = minimalParsed(); + parsed.modelId = model; + parsed._rawBody = { model, input: [], stream: true }; + const incoming = new Headers(); + if (incomingLite !== undefined) incoming.set(liteHeader, incomingLite); + const request = await adapter.buildRequest(parsed, { + headers: incoming, + }); + expect(new Headers(request.headers).get(liteHeader)).toBe(expectedLite); + } + + const routed = minimalParsed(); + routed.modelId = "spark-alias"; + routed._rawBody = { model: "gpt-5.3-codex-spark", input: [], stream: true }; + const request = await adapter.buildRequest(routed, { headers: new Headers({ [liteHeader]: "true" }) }); + expect(new Headers(request.headers).get(liteHeader)).toBeNull(); + }); + test("noncanonical adapters neither forward caller Lite nor synthesize a routing hint", async () => { for (const authMode of ["forward", "key"] as const) { const adapter = createResponsesPassthroughAdapter({ diff --git a/tests/codex-integration/codex-prompt-text-probe.test.ts b/tests/codex-integration/codex-prompt-text-probe.test.ts index 363bcc4798..32b01eac3c 100644 --- a/tests/codex-integration/codex-prompt-text-probe.test.ts +++ b/tests/codex-integration/codex-prompt-text-probe.test.ts @@ -6,8 +6,8 @@ * that a missing body is attributed to the right cause, because the dialog shows * that attribution to a user as an explanation. */ -import { afterEach, describe, expect, test } from "bun:test"; -import { existsSync, mkdtempSync, readFileSync} from "node:fs"; +import { afterEach, describe, expect, spyOn, test } from "bun:test"; +import { existsSync, mkdtempSync, readFileSync, renameSync, writeFileSync } from "node:fs"; import { tmpdir } from "node:os"; import { join } from "node:path"; import { @@ -41,7 +41,30 @@ async function waitUntil(predicate: () => boolean, detail: string): Promise<void } } +function requireProcessId(value: number): number { + if (!Number.isSafeInteger(value) || value <= 0) throw new Error("invalid published process id"); + return value; +} + +function readPublishedPid(path: string): number | undefined { + if (!existsSync(path)) return undefined; + const value = readFileSync(path, "utf8").trim(); + if (!/^\d+$/.test(value)) throw new Error("invalid published process id"); + return requireProcessId(Number(value)); +} + +async function waitForPublishedPid(path: string, detail: string): Promise<number> { + let pid: number | undefined; + await waitUntil(() => (pid = readPublishedPid(path)) !== undefined, detail); + return pid!; +} + +function publishPidSource(path: string): string { + return `const fs = require("node:fs"); const marker = ${JSON.stringify(path)}; const temporary = marker + "." + process.pid + ".tmp"; fs.writeFileSync(temporary, String(process.pid)); fs.renameSync(temporary, marker);`; +} + function isProcessAlive(pid: number): boolean { + requireProcessId(pid); try { process.kill(pid, 0); return true; @@ -61,6 +84,33 @@ afterEach(async () => { while (lifecycleRoots.length) removeTreeWithRetry(lifecycleRoots.pop()!); }); +test("PID markers are invisible until complete atomic publication", () => { + const marker = join(root(), "pid.txt"); + const temporary = marker + ".tmp"; + writeFileSync(temporary, "12"); + expect(readPublishedPid(marker)).toBeUndefined(); + writeFileSync(temporary, String(process.pid)); + renameSync(temporary, marker); + expect(readPublishedPid(marker)).toBe(process.pid); +}); + +test("malformed published PIDs never reach the process liveness check", () => { + const marker = join(root(), "pid.txt"); + const kill = spyOn(process, "kill"); + try { + for (const value of ["", "0", "-1", "1.5", "9007199254740992", "12junk"]) { + writeFileSync(marker, value); + expect(() => readPublishedPid(marker)).toThrow("invalid published process id"); + } + for (const pid of [0, -1, 1.5, Number.NaN, Number.MAX_SAFE_INTEGER + 1]) { + expect(() => isProcessAlive(pid)).toThrow("invalid published process id"); + } + expect(kill).not.toHaveBeenCalled(); + } finally { + kill.mockRestore(); + } +}); + describe("section extraction", () => { test("a tag name containing a space is still matched", () => { // Codex renders `<permissions instructions>`, with a space. A [a-z_]+ pattern @@ -184,21 +234,21 @@ describe("prompt probe process lifecycle", () => { const pidPath = join(dir, "pid.txt"); const overlapPath = join(dir, "overlap.txt"); const hangingSource = [ - `require("node:fs").writeFileSync(${JSON.stringify(pidPath)}, String(process.pid));`, + publishPidSource(pidPath), "setInterval(() => {}, 1_000);", ].join(""); setPromptTextProbeCommandForTests({ binary: process.execPath, args: ["-e", hangingSource] }); const controller = new AbortController(); const hanging = probePromptText(5_000, controller.signal); - await waitUntil(() => existsSync(pidPath), "hanging child pid"); - const pid = Number(readFileSync(pidPath, "utf8")); + const pid = await waitForPublishedPid(pidPath, "hanging child pid"); expect(isProcessAlive(pid)).toBe(true); controller.abort(); expect((await hanging).detail).toBe("prompt probe cancelled"); const replacementSource = [ - `const fs = require("node:fs"); const pid = Number(fs.readFileSync(${JSON.stringify(pidPath)}, "utf8"));`, + `const fs = require("node:fs"); const rawPid = fs.readFileSync(${JSON.stringify(pidPath)}, "utf8").trim(); const pid = Number(rawPid);`, + "if (!/^\\d+$/.test(rawPid) || !Number.isSafeInteger(pid) || pid <= 0) throw new Error(\"invalid published process id\");", "let priorProbeAlive = true;", "try { process.kill(pid, 0); } catch { priorProbeAlive = false; }", `if (priorProbeAlive) fs.writeFileSync(${JSON.stringify(overlapPath)}, "overlap");`, @@ -220,34 +270,52 @@ describe("prompt probe process lifecycle", () => { await waitUntil(() => !isProcessAlive(pid), "cancelled child exit"); }); - test("admission stays occupied between child exit and close handling", async () => { + async function exerciseCloseBoundary(injectFailure: boolean): Promise<void> { const pidPath = join(root(), "exited-parent-pid.txt"); let releaseClose!: () => void; setPromptTextProbeCloseBarrierForTests(new Promise<void>(resolve => { releaseClose = resolve; })); - const delayedCloseSource = [ - `const fs = require("node:fs");`, - `fs.writeFileSync(${JSON.stringify(pidPath)}, String(process.pid));`, - `process.stdout.write(${JSON.stringify(VALID_PROBE_OUTPUT)});`, - ].join(""); - setPromptTextProbeCommandForTests({ binary: process.execPath, args: ["-e", delayedCloseSource] }); - const first = probePromptText(2_000); - await waitUntil(() => existsSync(pidPath), "exit-close parent pid"); - const pid = Number(readFileSync(pidPath, "utf8")); - await waitUntil(() => !isProcessAlive(pid), "probe parent exit"); + let first: ReturnType<typeof probePromptText> | undefined; + try { + const delayedCloseSource = [ + publishPidSource(pidPath), + `process.stdout.write(${JSON.stringify(VALID_PROBE_OUTPUT)});`, + ].join(""); + setPromptTextProbeCommandForTests({ binary: process.execPath, args: ["-e", delayedCloseSource] }); + first = probePromptText(2_000); + const pid = await waitForPublishedPid(pidPath, "exit-close parent pid"); + await waitUntil(() => !isProcessAlive(pid), "probe parent exit"); + if (injectFailure) throw new Error("fixture assertion failure before close release"); + + setPromptTextProbeCommandForTests({ + binary: process.execPath, + args: ["-e", `process.stdout.write(${JSON.stringify(VALID_PROBE_OUTPUT)})`], + }); + const blockedBeforeClose = await probePromptText(2_000); + expect(blockedBeforeClose.ok).toBe(false); + expect(blockedBeforeClose.detail).toBe("another prompt probe is still finishing; retry shortly"); + expect(promptTextProbeSpawnAttemptsForTests()).toBe(1); + releaseClose(); + expect((await first).ok).toBe(true); + const afterClose = await probePromptText(2_000); + expect(afterClose.ok).toBe(true); + expect(promptTextProbeSpawnAttemptsForTests()).toBe(2); + } finally { + releaseClose(); + try { if (first) await first; } finally { await resetPromptTextProbeForTests(); } + } + } + test("admission stays occupied between child exit and close handling", async () => { + await exerciseCloseBoundary(false); + }); + + test("a failure before close release leaves the probe reusable", async () => { + await expect(exerciseCloseBoundary(true)).rejects.toThrow("fixture assertion failure before close release"); setPromptTextProbeCommandForTests({ binary: process.execPath, args: ["-e", `process.stdout.write(${JSON.stringify(VALID_PROBE_OUTPUT)})`], }); - const blockedBeforeClose = await probePromptText(2_000); - - expect(blockedBeforeClose.ok).toBe(false); - expect(blockedBeforeClose.detail).toBe("another prompt probe is still finishing; retry shortly"); + expect((await probePromptText(2_000)).ok).toBe(true); expect(promptTextProbeSpawnAttemptsForTests()).toBe(1); - releaseClose(); - expect((await first).ok).toBe(true); - const afterClose = await probePromptText(2_000); - expect(afterClose.ok).toBe(true); - expect(promptTextProbeSpawnAttemptsForTests()).toBe(2); }); }); diff --git a/tests/codex-integration/codex-reset-credit-auto-redeem.test.ts b/tests/codex-integration/codex-reset-credit-auto-redeem.test.ts index f19f208cc1..eb7e213420 100644 --- a/tests/codex-integration/codex-reset-credit-auto-redeem.test.ts +++ b/tests/codex-integration/codex-reset-credit-auto-redeem.test.ts @@ -1,7 +1,9 @@ import { afterEach, beforeEach, describe, expect, test } from "bun:test"; -import { mkdtempSync, readFileSync} from "node:fs"; +import { Database } from "bun:sqlite"; +import { existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, renameSync, writeFileSync } from "node:fs"; import { tmpdir } from "node:os"; import { join } from "node:path"; +import { pathToFileURL } from "node:url"; import { createResetCreditAutoRedeemer, planAutoRedeem, @@ -9,6 +11,8 @@ import { type ResetCredit, } from "../../src/codex/reset-credit-auto-redeem"; import { removeTreeWithRetry } from "../helpers/remove-tree"; +import { repoPath } from "../helpers/repo-root"; +import { readConfigGeneration } from "../../src/config"; const T0 = Date.parse("2026-09-02T10:00:00Z"); const MIN = 60_000; @@ -18,19 +22,20 @@ const credit = (expiresInMin: number, grantedAt = "2026-09-01T00:00:00Z"): Reset }); /** Fake clock + manual timer: fire() runs the pending timer at its due time. */ -function harness(opts: { credits: () => ResetCredit[]; enabled?: () => boolean; lead?: number; journalFile: string; consumeCode?: string; consumeThrows?: boolean }) { +function harness(opts: { credits: () => ResetCredit[]; enabled?: () => boolean; lead?: number; journalFile: string; accountId?: string; consumeCode?: string; consumeThrows?: boolean; consume?: (id: string) => Promise<{ code: string }> }) { let now = T0; let pending: { fn: () => void; at: number } | null = null; const consumed: string[] = []; const logs: string[] = []; let inspects = 0; const redeemer = createResetCreditAutoRedeemer({ - accountId: "acct-main", + accountId: opts.accountId ?? "acct-main", settings: () => ({ enabled: opts.enabled ? opts.enabled() : true, leadTimeMinutes: opts.lead ?? 10 }), inspect: async () => { inspects += 1; return { credits: opts.credits() }; }, consume: async id => { if (opts.consumeThrows) throw new Error("socket hangup"); consumed.push(id); + if (opts.consume) return opts.consume(id); return { code: opts.consumeCode ?? "reset" }; }, now: () => now, @@ -43,14 +48,24 @@ function harness(opts: { credits: () => ResetCredit[]; enabled?: () => boolean; redeemer, consumed, logs, inspects: () => inspects, pendingAt: () => pending?.at ?? null, - advanceAndFire: async () => { if (!pending) throw new Error("no timer"); now = pending.at; const fn = pending.fn; pending = null; fn(); await new Promise(r => setTimeout(r, 5)); }, + // The timer synchronously installs inFlight; join that tick instead of sleeping. + advanceAndFire: async () => { if (!pending) throw new Error("no timer"); now = pending.at; const fn = pending.fn; pending = null; fn(); return await redeemer.tick(); }, setNow: (t: number) => { now = t; }, }; } let dir = ""; -beforeEach(() => { dir = mkdtempSync(join(tmpdir(), "ocx-auto-redeem-")); }); -afterEach(() => { removeTreeWithRetry(dir); }); +let oldHome: string | undefined; +beforeEach(() => { + dir = mkdtempSync(join(tmpdir(), "ocx-auto-redeem-")); + oldHome = process.env.OPENCODEX_HOME; + process.env.OPENCODEX_HOME = dir; +}); +afterEach(() => { + if (oldHome === undefined) delete process.env.OPENCODEX_HOME; + else process.env.OPENCODEX_HOME = oldHome; + removeTreeWithRetry(dir); +}); describe("reset-credit auto-redeem settings + plan (#822)", () => { test("default off; malformed reads as off; lead time clamped", () => { @@ -72,6 +87,20 @@ describe("reset-credit auto-redeem settings + plan (#822)", () => { }); describe("reset-credit auto-redeemer runtime (#822)", () => { + test("a disabled tick creates neither a journal nor a mutation coordinator", async () => { + const journalFile = join(dir, "reset-credit-auto-redeem.json"); + expect(readdirSync(dir)).toEqual([]); + const h = harness({ credits: () => [credit(30)], enabled: () => false, journalFile }); + h.setNow(T0 + 20 * MIN); + expect(await h.redeemer.tick()).toEqual({ kind: "disabled" }); + expect(h.inspects()).toBe(0); + expect(h.consumed).toHaveLength(0); + expect(h.pendingAt()).toBeNull(); + expect(existsSync(journalFile)).toBe(false); + expect(existsSync(join(dir, "config-mutation.sqlite"))).toBe(false); + expect(readdirSync(dir)).toEqual([]); + }); + test("schedules at expiry minus lead, re-reads before dispatch, journals the request id first", async () => { const journalFile = join(dir, "j.json"); const h = harness({ credits: () => [credit(30)], journalFile }); @@ -150,6 +179,388 @@ describe("reset-credit auto-redeemer runtime (#822)", () => { expect(h.consumed).toHaveLength(0); }); + test("settling a delayed consume preserves a peer's settled journal entry", async () => { + const journalFile = join(dir, "j.json"); + let entered!: () => void; + let release!: () => void; + const started = new Promise<void>(resolve => { entered = resolve; }); + const gate = new Promise<void>(resolve => { release = resolve; }); + const a = harness({ credits: () => [credit(30)], journalFile, accountId: "acct-a", consume: async () => { + entered(); + await gate; + return { code: "reset" }; + } }); + const b = harness({ credits: () => [credit(30)], journalFile, accountId: "acct-b" }); + a.setNow(T0 + 20 * MIN); + b.setNow(T0 + 20 * MIN); + const first = a.redeemer.tick(); + try { + await Promise.race([started, first.then(() => { throw new Error("first consume was not entered"); })]); + expect((await b.redeemer.tick()).kind).toBe("dispatched"); + } finally { + release(); + await first; + } + expect((await first).kind).toBe("dispatched"); + const entries = JSON.parse(readFileSync(journalFile, "utf8")).entries as Array<{ redeemRequestId: string; state: string }>; + expect(entries).toHaveLength(2); + expect(entries.map(entry => entry.redeemRequestId).sort()).toEqual([...a.consumed, ...b.consumed].sort()); + expect(entries.every(entry => entry.state === "settled")).toBe(true); + expect((await b.redeemer.tick()).kind).toBe("skipped"); + expect(b.consumed).toHaveLength(1); + }); + + test("a separate SQLite writer blocks reservation before any consume", async () => { + const journalFile = join(dir, "j.json"); + const h = harness({ credits: () => [credit(30)], journalFile }); + h.setNow(T0 + 20 * MIN); + expect(readConfigGeneration().kind).toBe("ready"); + const holder = new Database(join(dir, "config-mutation.sqlite"), { readwrite: true, create: false }); + holder.exec("PRAGMA busy_timeout = 0; BEGIN IMMEDIATE"); + try { + expect((await h.redeemer.tick()).kind).toBe("error"); + expect(h.consumed).toHaveLength(0); + expect(existsSync(journalFile)).toBe(false); + expect(h.pendingAt()).toBe(T0 + 20 * MIN + 1_000); + } finally { + holder.exec("ROLLBACK"); + holder.close(); + } + h.setNow(T0 + 20 * MIN + 1_000); + expect((await h.redeemer.tick()).kind).toBe("dispatched"); + expect(h.consumed).toHaveLength(1); + const entries = JSON.parse(readFileSync(journalFile, "utf8")).entries; + expect(entries).toHaveLength(1); + expect(entries[0].redeemRequestId).toBe(h.consumed[0]); + expect(entries[0].state).toBe("settled"); + }); + + test("a SQLite reader blocks COMMIT after reservation publication and retries the same id", async () => { + const journalFile = join(dir, "j.json"); + const databaseFile = join(dir, "config-mutation.sqlite"); + expect(existsSync(databaseFile)).toBe(false); + const reader = new Database(databaseFile, { create: true }); + const h = harness({ credits: () => [credit(30)], journalFile }); + h.setNow(T0 + 20 * MIN); + let reservationId = ""; + try { + // No readConfigGeneration pre-initialization: the coordinator's first acquisition + // must write its schema, so COMMIT needs an exclusive rollback-journal lock. + reader.exec("PRAGMA journal_mode = DELETE; PRAGMA busy_timeout = 0"); + reader.exec("BEGIN; CREATE TABLE reader_fixture (value INTEGER); INSERT INTO reader_fixture VALUES (1); COMMIT"); + expect(reader.query("PRAGMA journal_mode").get()).toEqual({ journal_mode: "delete" }); + expect(reader.query("SELECT name FROM sqlite_master WHERE name = 'config_generation'").all()).toEqual([]); + reader.exec("BEGIN"); + // BEGIN alone holds no read lock. This SELECT materializes the read transaction. + expect(reader.query("SELECT value FROM reader_fixture").all()).toEqual([{ value: 1 }]); + expect(reader.inTransaction).toBe(true); + const outcome = await h.redeemer.tick(); + expect(outcome).toEqual({ kind: "error", message: expect.stringMatching(/database (?:is|table is) locked/i) }); + expect(h.consumed).toHaveLength(0); + // An acquisition failure cannot publish this row: the callback ran before COMMIT failed. + const entries = JSON.parse(readFileSync(journalFile, "utf8")).entries; + expect(entries).toHaveLength(1); + expect(entries[0].state).toBe("dispatched"); + reservationId = entries[0].redeemRequestId; + expect(reservationId).toMatch(/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i); + expect(h.pendingAt()).toBe(T0 + 20 * MIN + 1_000); + } finally { + try { if (reader.inTransaction) reader.exec("ROLLBACK"); } finally { reader.close(); } + } + expect(await h.advanceAndFire()).toEqual({ kind: "dispatched", code: "reset", redeemRequestId: reservationId }); + expect(h.consumed).toEqual([reservationId]); + const entries = JSON.parse(readFileSync(journalFile, "utf8")).entries; + expect(entries).toHaveLength(1); + expect(entries[0].redeemRequestId).toBe(reservationId); + expect(entries[0].state).toBe("settled"); + }); + + test("two processes reserve one durable id before either consume settles", async () => { + const journalFile = join(dir, "j.json"); + const moduleUrl = pathToFileURL(repoPath("src/codex/reset-credit-auto-redeem.ts")).href; + const deadline = performance.now() + 25_000; + const markerPath = (name: string) => join(dir, name + ".json"); + const publish = (name: string) => { + const path = markerPath(name); + const temporary = path + "." + process.pid + ".tmp"; + writeFileSync(temporary, JSON.stringify({ pid: process.pid })); + renameSync(temporary, path); + }; + const launch = (worker: string) => { + const source = ` + import { existsSync, writeFileSync, renameSync } from "node:fs"; + import { join } from "node:path"; + import { createResetCreditAutoRedeemer } from ${JSON.stringify(moduleUrl)}; + const home = ${JSON.stringify(dir)}; + const worker = ${JSON.stringify(worker)}; + const deadline = performance.now() + 20_000; + const marker = name => join(home, name + ".json"); + const publish = (name, value) => { + const path = marker(name); + const temporary = path + "." + process.pid + ".tmp"; + writeFileSync(temporary, JSON.stringify({ ...value, pid: process.pid })); + renameSync(temporary, path); + }; + const waitFor = async name => { + while (!existsSync(marker(name))) { + if (performance.now() >= deadline) throw new Error("timed out waiting for " + name); + await Bun.sleep(10); + } + }; + const consumes = []; + const retries = []; + let scheduledMs = null; + const redeemer = createResetCreditAutoRedeemer({ + accountId: "acct-process-fixture", + journalFile: ${JSON.stringify(journalFile)}, + settings: () => ({ enabled: true, leadTimeMinutes: 10 }), + inspect: async () => ({ credits: [${JSON.stringify(credit(30))}] }), + now: () => ${T0 + 20 * MIN}, + // Only the loop below owns ticks; recorded timers cannot launch overlapping work. + setTimer: (_fn, ms) => { scheduledMs = ms; return 1; }, + clearTimer: () => { scheduledMs = null; }, + log: () => {}, + consume: async redeemRequestId => { + consumes.push(redeemRequestId); + if (consumes.length !== 1) throw new Error("unexpected repeated consume"); + publish(worker + "-consume", { redeemRequestId }); + await waitFor(worker + "-release"); + return { code: "reset" }; + }, + }); + try { + publish(worker + "-ready", {}); + await waitFor("start"); + let outcome; + while (true) { + if (performance.now() >= deadline) throw new Error("reservation contention deadline exceeded"); + scheduledMs = null; + outcome = await redeemer.tick(); + if (outcome.kind === "dispatched") break; + const contention = outcome.kind === "error" && ( + outcome.message === "Config mutation already in progress" + || /database (?:is|table is) locked/i.test(outcome.message) + ); + if (!contention || scheduledMs !== 1000 || consumes.length !== 0) { + throw new Error("unexpected tick: " + JSON.stringify({ outcome, scheduledMs, consumes })); + } + retries.push({ message: outcome.message, scheduledMs }); + // Honor the recorded contention delay; never retry arbitrary errors or settlement. + await Bun.sleep(scheduledMs); + } + publish(worker + "-result", { outcome, consumes, retries }); + } catch (error) { + publish(worker + "-result", { error: String(error), consumes, retries }); + console.error(error); + process.exitCode = 1; + } finally { + redeemer.stop(); + } + `; + const child = Bun.spawn([process.execPath, "-e", source], { + cwd: repoPath(), + env: { ...process.env, OPENCODEX_HOME: dir }, + stdin: "ignore", stdout: "pipe", stderr: "pipe", + }); + const output = { stdout: "", stderr: "" }; + const drain = async (stream: ReadableStream<Uint8Array>, key: "stdout" | "stderr") => { + const reader = stream.getReader(); + const decoder = new TextDecoder(); + try { + while (true) { + const { value, done } = await reader.read(); + if (done) break; + output[key] += decoder.decode(value, { stream: true }); + } + output[key] += decoder.decode(); + } catch (error) { + output[key] += "\npipe read failed: " + String(error); + } finally { reader.releaseLock(); } + }; + // Start draining both pipes immediately, including while waiting at the barriers. + const drained = Promise.all([drain(child.stdout, "stdout"), drain(child.stderr, "stderr")]); + return { worker, child, output, drained }; + }; + const children: ReturnType<typeof launch>[] = []; + const released = new Set<string>(); + const diagnostics = () => children.map(({ worker, child, output }) => + `${worker} pid=${child.pid} exit=${child.exitCode}\nstdout: ${output.stdout}\nstderr: ${output.stderr}`).join("\n"); + const waitUntil = async (label: string, ready: () => boolean) => { + while (true) { + for (const { worker, child } of children) { + if (child.exitCode !== null && (!released.has(worker) || child.exitCode !== 0)) { + throw new Error(`premature child exit waiting for ${label}\n${diagnostics()}`); + } + } + if (ready()) return; + if (performance.now() >= deadline) throw new Error(`timed out waiting for ${label}\n${diagnostics()}`); + await Bun.sleep(10); + } + }; + const readMarker = (name: string) => JSON.parse(readFileSync(markerPath(name), "utf8")); + try { + children.push(launch("a")); + children.push(launch("b")); + await waitUntil("both ready", () => children.every(({ worker }) => existsSync(markerPath(worker + "-ready")))); + for (const { worker, child } of children) expect(readMarker(worker + "-ready").pid).toBe(child.pid); + expect(children[0]!.child.pid).not.toBe(children[1]!.child.pid); + expect(existsSync(journalFile)).toBe(false); + publish("start"); + await waitUntil("both consumes", () => children.every(({ worker }) => existsSync(markerPath(worker + "-consume")))); + const ids = children.map(({ worker, child }) => { + const marker = readMarker(worker + "-consume"); + expect(marker.pid).toBe(child.pid); + expect(marker.redeemRequestId).toMatch(/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i); + expect(existsSync(markerPath(worker + "-result"))).toBe(false); + return marker.redeemRequestId as string; + }); + expect(new Set(ids).size).toBe(1); + const reserved = JSON.parse(readFileSync(journalFile, "utf8")).entries; + expect(reserved).toHaveLength(1); + expect(reserved[0].redeemRequestId).toBe(ids[0]); + expect(reserved[0].state).toBe("dispatched"); + // Release one child at a time so settlement needs no timing-dependent retries. + for (const { worker, child } of children) { + released.add(worker); + publish(worker + "-release"); + await waitUntil(worker + " result", () => existsSync(markerPath(worker + "-result"))); + const result = readMarker(worker + "-result"); + expect(result.pid).toBe(child.pid); + expect(result.error).toBeUndefined(); + expect(result.outcome).toEqual({ kind: "dispatched", code: "reset", redeemRequestId: ids[0] }); + expect(result.consumes).toEqual([ids[0]]); + await waitUntil(worker + " exit", () => child.exitCode !== null); + expect(await child.exited).toBe(0); + } + const settled = JSON.parse(readFileSync(journalFile, "utf8")).entries; + expect(settled).toHaveLength(1); + expect(settled[0].redeemRequestId).toBe(ids[0]); + expect(settled[0].state).toBe("settled"); + } catch (error) { + throw new Error(`${String(error)}\n${diagnostics()}`); + } finally { + try { + for (const { worker } of children) { + if (!existsSync(markerPath(worker + "-release"))) publish(worker + "-release"); + } + } finally { + // Start every cleanup even if another child's kill races its natural exit. + const cleanup = await Promise.allSettled(children.map(async ({ child, drained }) => { + try { + if (child.exitCode === null) child.kill("SIGKILL"); + } finally { + await child.exited; + await drained; + } + })); + const failedCleanup = cleanup.filter(result => result.status === "rejected"); + if (failedCleanup.length > 0) throw new AggregateError(failedCleanup.map(result => result.reason), "journal fixture child cleanup failed"); + } + } + }, 35_000); + + test("a peer that observes a settled credit keeps checking for future credits", async () => { + const journalFile = join(dir, "j.json"); + const first = harness({ credits: () => [credit(30)], journalFile }); + let peerCredits = [credit(30)]; + const peer = harness({ credits: () => peerCredits, journalFile }); + first.setNow(T0 + 20 * MIN); + peer.setNow(T0 + 20 * MIN); + expect((await first.redeemer.tick()).kind).toBe("dispatched"); + expect((await peer.redeemer.tick()).kind).toBe("skipped"); + expect(peer.consumed).toHaveLength(0); + expect(peer.pendingAt()).toBe(T0 + 35 * MIN); + const futureCredit = credit(45, "2026-09-02T10:30:00Z"); + peerCredits = [futureCredit]; + const outcome = await peer.advanceAndFire(); + expect(outcome).toEqual({ kind: "dispatched", code: "reset", redeemRequestId: expect.any(String) }); + expect(peer.consumed).toHaveLength(1); + expect(peer.consumed[0]).not.toBe(first.consumed[0]); + const entries = JSON.parse(readFileSync(journalFile, "utf8")).entries; + expect(entries).toHaveLength(2); + expect(entries.map((entry: { redeemRequestId: string }) => entry.redeemRequestId).sort()).toEqual([...first.consumed, ...peer.consumed].sort()); + expect(entries.find((entry: { redeemRequestId: string }) => entry.redeemRequestId === peer.consumed[0])).toMatchObject({ + grantedAt: futureCredit.granted_at, expiresAt: futureCredit.expires_at, state: "settled", + }); + }); + + test("settlement contention keeps the reserved request id for a later retry", async () => { + const journalFile = join(dir, "j.json"); + let holder: Database | null = null; + let attempts = 0; + const h = harness({ credits: () => [credit(30)], journalFile, consume: async () => { + if (attempts++ === 0) { + holder = new Database(join(dir, "config-mutation.sqlite"), { readwrite: true, create: false }); + holder.exec("PRAGMA busy_timeout = 0; BEGIN IMMEDIATE"); + } + return { code: "reset" }; + } }); + h.setNow(T0 + 20 * MIN); + try { + expect((await h.redeemer.tick()).kind).toBe("error"); + const entries = JSON.parse(readFileSync(journalFile, "utf8")).entries; + expect(entries).toHaveLength(1); + expect(entries[0].state).toBe("dispatched"); + expect(entries[0].redeemRequestId).toBe(h.consumed[0]); + expect(h.pendingAt()).toBe(T0 + 20 * MIN + 1_000); + } finally { + if (holder) { + (holder as Database).exec("ROLLBACK"); + (holder as Database).close(); + } + } + h.setNow(T0 + 20 * MIN + 1_000); + expect((await h.redeemer.tick()).kind).toBe("dispatched"); + expect(h.consumed).toHaveLength(2); + expect(h.consumed[0]).toBe(h.consumed[1]); + expect(JSON.parse(readFileSync(journalFile, "utf8")).entries[0].state).toBe("settled"); + }); + + test("journal retention uses the redeemer's injected clock", async () => { + const start = Date.parse("2000-01-01T00:00:00Z"); + const journalFile = join(dir, "j.json"); + const h = harness({ journalFile, credits: () => [{ + granted_at: "1999-12-31T00:00:00Z", + expires_at: new Date(start + 30 * MIN).toISOString(), + }] }); + h.setNow(start + 20 * MIN); + expect((await h.redeemer.tick()).kind).toBe("dispatched"); + const entries = JSON.parse(readFileSync(journalFile, "utf8")).entries; + expect(entries).toHaveLength(1); + expect(entries[0].updatedAt).toBe(start + 20 * MIN); + }); + + test("a persistent reservation write failure uses the idle retry interval", async () => { + const journalFile = join(dir, "journal-directory"); + mkdirSync(journalFile); + const h = harness({ credits: () => [credit(30)], journalFile }); + h.setNow(T0 + 20 * MIN); + expect((await h.redeemer.tick()).kind).toBe("error"); + expect(h.consumed).toHaveLength(0); + expect(h.pendingAt()).toBe(T0 + 35 * MIN); + }); + + for (const changedReservation of ["missing", "replaced"]) { + test(`settlement rejects a ${changedReservation} reservation without overwriting it`, async () => { + const journalFile = join(dir, "j.json"); + let replacement = ""; + const h = harness({ credits: () => [credit(30)], journalFile, consume: async () => { + const journal = JSON.parse(readFileSync(journalFile, "utf8")); + if (changedReservation === "missing") journal.entries = []; + else journal.entries[0].redeemRequestId = "replacement-request"; + replacement = JSON.stringify(journal); + writeFileSync(journalFile, replacement); + return { code: "reset" }; + } }); + h.setNow(T0 + 20 * MIN); + const outcome = await h.redeemer.tick(); + expect(outcome).toEqual({ kind: "error", message: "auto-redeem journal reservation changed before settlement" }); + expect(h.consumed).toHaveLength(1); + expect(readFileSync(journalFile, "utf8")).toBe(replacement); + expect(h.pendingAt()).toBe(T0 + 35 * MIN); + }); + } + test("stop clears the timer", async () => { const h = harness({ credits: () => [credit(30)], journalFile: join(dir, "j.json") }); await h.redeemer.tick(); diff --git a/tests/codex-integration/codex-routing.test.ts b/tests/codex-integration/codex-routing.test.ts index bc6561e99e..11774ef474 100644 --- a/tests/codex-integration/codex-routing.test.ts +++ b/tests/codex-integration/codex-routing.test.ts @@ -1,5 +1,6 @@ import { describe, expect, test, beforeEach, afterEach } from "bun:test"; -import { existsSync, mkdirSync, writeFileSync } from "node:fs"; +import { existsSync, mkdtempSync, writeFileSync } from "node:fs"; +import { tmpdir } from "node:os"; import { join } from "node:path"; import { STORE_BUDGET_MS } from "../helpers/test-budget"; import { @@ -54,10 +55,76 @@ import { consumeForInspection } from "../../src/server/relay"; import type { OcxConfig } from "../../src/types"; import { removeTreeWithRetry } from "../helpers/remove-tree"; -const TEST_DIR = join(import.meta.dir, ".tmp-codex-routing-test"); +import { flushConfigDirHardeningForTests, hardenConfigDir } from "../../src/config/paths"; +import { setAsyncIcaclsRunnerForTests, setIcaclsRunnerForTests } from "../../src/lib/windows-secret-acl"; + +let TEST_DIR = ""; let previousOpencodexHome: string | undefined; let previousCodexHome: string | undefined; +const ICACLS_OK = { success: true, exitCode: 0, timedOut: false, stdout: "" }; + +function installRoutingScratchHome(): void { + previousOpencodexHome = process.env.OPENCODEX_HOME; + previousCodexHome = process.env.CODEX_HOME; + TEST_DIR = mkdtempSync(join(tmpdir(), "ocx-routing-")); + // Routing cases exercise account state, not the operating system ACL implementation. + setIcaclsRunnerForTests(() => ICACLS_OK); + setAsyncIcaclsRunnerForTests(async () => ICACLS_OK); + process.env.OPENCODEX_HOME = TEST_DIR; + process.env.CODEX_HOME = TEST_DIR; +} + +async function removeRoutingScratchHome(): Promise<void> { + const ownedDirectory = TEST_DIR; + TEST_DIR = ""; + try { + await flushConfigDirHardeningForTests(); + } finally { + setIcaclsRunnerForTests(null); + setAsyncIcaclsRunnerForTests(null); + if (previousOpencodexHome === undefined) delete process.env.OPENCODEX_HOME; + else process.env.OPENCODEX_HOME = previousOpencodexHome; + if (previousCodexHome === undefined) delete process.env.CODEX_HOME; + else process.env.CODEX_HOME = previousCodexHome; + if (ownedDirectory) removeTreeWithRetry(ownedDirectory); + } +} + +test.skipIf(process.platform !== "win32")("routing scratch cleanup waits for its outstanding hardening flight", async () => { + installRoutingScratchHome(); + const ownedDirectory = TEST_DIR; + let entered!: () => void; + let release!: () => void; + const started = new Promise<void>(resolve => { entered = resolve; }); + const gate = new Promise<void>(resolve => { release = resolve; }); + let cleanup: Promise<void> | undefined; + let deadline: ReturnType<typeof setTimeout> | undefined; + try { + setAsyncIcaclsRunnerForTests(async () => { entered(); await gate; return ICACLS_OK; }); + hardenConfigDir(); + await Promise.race([ + started, + new Promise<never>((_, reject) => { deadline = setTimeout(() => reject(new Error("hardening fixture did not start")), 5_000); }), + ]); + let cleaned = false; + cleanup = removeRoutingScratchHome().then(() => { cleaned = true; }); + await Promise.resolve(); + expect(cleaned).toBe(false); + expect(existsSync(ownedDirectory)).toBe(true); + release(); + await cleanup; + expect(cleaned).toBe(true); + expect(existsSync(ownedDirectory)).toBe(false); + } finally { + if (deadline !== undefined) clearTimeout(deadline); + release(); + if (cleanup) await cleanup; + else await removeRoutingScratchHome(); + } +}, STORE_BUDGET_MS); + + function makeConfig(overrides: Partial<OcxConfig> = {}): OcxConfig { return { providers: {}, @@ -89,14 +156,7 @@ function pendingInspectionStream(): ReadableStream<Uint8Array> { describe("codex routing", () => { beforeEach(() => { - previousOpencodexHome = process.env.OPENCODEX_HOME; - if (existsSync(TEST_DIR)) removeTreeWithRetry(TEST_DIR); - mkdirSync(TEST_DIR, { recursive: true }); - process.env.OPENCODEX_HOME = TEST_DIR; - // Isolate the main-account credential source: TEST_DIR has no auth.json, so the main - // account is deterministically absent (these cases test the pool-only scenario). - previousCodexHome = process.env.CODEX_HOME; - process.env.CODEX_HOME = TEST_DIR; + installRoutingScratchHome(); clearThreadAccountMap(); clearCodexUpstreamHealth(); clearAccountQuota(); @@ -107,18 +167,17 @@ describe("codex routing", () => { saveTestCredential("b"); }); - afterEach(() => { - clearAccountQuota(); - clearCodexUpstreamHealth(); - clearThreadAccountMap(); - clearAccountNeedsReauth("a"); - clearAccountNeedsReauth("b"); - clearAccountNeedsReauth("c"); - if (previousOpencodexHome === undefined) delete process.env.OPENCODEX_HOME; - else process.env.OPENCODEX_HOME = previousOpencodexHome; - if (previousCodexHome === undefined) delete process.env.CODEX_HOME; - else process.env.CODEX_HOME = previousCodexHome; - if (existsSync(TEST_DIR)) removeTreeWithRetry(TEST_DIR); + afterEach(async () => { + try { + clearAccountQuota(); + clearCodexUpstreamHealth(); + clearThreadAccountMap(); + clearAccountNeedsReauth("a"); + clearAccountNeedsReauth("b"); + clearAccountNeedsReauth("c"); + } finally { + await removeRoutingScratchHome(); + } }); test("usage score uses the hottest known quota window", () => { @@ -2175,12 +2234,7 @@ describe("codex routing", () => { describe("codex account selection order", () => { beforeEach(() => { - previousOpencodexHome = process.env.OPENCODEX_HOME; - if (existsSync(TEST_DIR)) removeTreeWithRetry(TEST_DIR); - mkdirSync(TEST_DIR, { recursive: true }); - process.env.OPENCODEX_HOME = TEST_DIR; - previousCodexHome = process.env.CODEX_HOME; - process.env.CODEX_HOME = TEST_DIR; + installRoutingScratchHome(); clearThreadAccountMap(); clearCodexUpstreamHealth(); clearAccountQuota(); @@ -2191,18 +2245,17 @@ describe("codex account selection order", () => { saveTestCredential("b"); }); - afterEach(() => { - clearAccountQuota(); - clearCodexUpstreamHealth(); - clearThreadAccountMap(); - clearPoolRotationState(); - clearAccountNeedsReauth("a"); - clearAccountNeedsReauth("b"); - if (previousOpencodexHome === undefined) delete process.env.OPENCODEX_HOME; - else process.env.OPENCODEX_HOME = previousOpencodexHome; - if (previousCodexHome === undefined) delete process.env.CODEX_HOME; - else process.env.CODEX_HOME = previousCodexHome; - if (existsSync(TEST_DIR)) removeTreeWithRetry(TEST_DIR); + afterEach(async () => { + try { + clearAccountQuota(); + clearCodexUpstreamHealth(); + clearThreadAccountMap(); + clearPoolRotationState(); + clearAccountNeedsReauth("a"); + clearAccountNeedsReauth("b"); + } finally { + await removeRoutingScratchHome(); + } }); /** `a` is ordered above `b`; the persisted operator selection is the lower tier. */ diff --git a/tests/codex-integration/codex-shim.test.ts b/tests/codex-integration/codex-shim.test.ts index d9ec5d17d5..3178a7ed3a 100644 --- a/tests/codex-integration/codex-shim.test.ts +++ b/tests/codex-integration/codex-shim.test.ts @@ -6,7 +6,7 @@ import { tmpdir } from "node:os"; import { autoRestoreCodexShim, buildUnixCodexShim, buildWindowsCodexShim, buildWindowsPowerShellCodexShim, diagnoseCodexShim, findCodexOnPath, inspectCodexShimBackingForCommand, installCodexShim, isLocalAbsoluteInspectionPath, isVersionManagerOwnedCodexPath, isWindowsInteropDir, lastCodexDiscoveryError, setCodexShimFreshWriteHookForTests, setCodexShimGuardedWriteHookForTests, setCodexShimProbeHookForTests, setCodexShimProbeObservationMsForTests, setCodexShimProbeShellForTests, setCodexShimRollbackRestoreHookForTests, uninstallCodexShim } from "../../src/codex/shim"; import { removeTreeWithRetry } from "../helpers/remove-tree"; import { repoPath, repoRoot } from "../helpers/repo-root"; -import { INTERNAL_DEADLINE_MS } from "../helpers/test-budget"; +import { INTERNAL_DEADLINE_MS, SPAWN_BUDGET_MS } from "../helpers/test-budget"; const SHIM_MARKER = "opencodex codex autostart shim"; const UNIX_SHIM_REVISION_MARKER = "opencodex unix codex shim revision 2"; @@ -1296,6 +1296,112 @@ printf '%s\\n' child-codex } }); + for (const shell of ["cmd", "powershell", "pwsh"] as const) { + const cases = [ + { callerToken: undefined, bypass: false, label: "missing" }, + ...(shell === "cmd" ? [] : [{ callerToken: "", bypass: false, label: "empty" }]), + { callerToken: "caller-token", bypass: false, label: "explicit token, ensure" }, + { callerToken: "caller-token", bypass: true, label: "explicit token, bypass" }, + ]; + for (const { callerToken, bypass, label } of cases) { + test.skipIf(process.platform !== "win32")(`Windows ${shell} shim restores the caller token (${label})`, () => { + const dir = mkdtempSync(join(tmpdir(), "ocx-shim-token-scope-")); + const oldHome = process.env.OPENCODEX_HOME; + try { + process.env.OPENCODEX_HOME = dir; + const extension = shell === "cmd" ? "cmd" : "ps1"; + const realPath = join(dir, `codex-real.${extension}`); + const wrapperPath = join(dir, `codex.${extension}`); + const driverPath = join(dir, `driver.${extension}`); + const ensurePath = join(dir, "ensure.ts"); + const ensureLog = join(dir, "ensure.log"); + writeFileSync(join(dir, "service-api-token"), "file-token\n"); + writeFileSync(ensurePath, `import { writeFileSync } from "node:fs"; writeFileSync(${JSON.stringify(ensureLog)}, "ensure"); process.exit(19);`); + if (shell === "cmd") { + writeFileSync(realPath, "@echo off\r\necho child:%OPENCODEX_API_AUTH_TOKEN%\r\nexit /b 37\r\n"); + writeFileSync(wrapperPath, buildWindowsCodexShim(realPath, process.execPath, ensurePath, "process")); + writeFileSync(driverPath, `@echo off\r\ncall "${wrapperPath}" exec "arg value"\r\nset "result=%ERRORLEVEL%"\r\necho after:%OPENCODEX_API_AUTH_TOKEN%\r\necho result:%result%\r\nexit /b 0\r\n`); + } else { + writeFileSync(realPath, '"child:$env:OPENCODEX_API_AUTH_TOKEN"\nexit 37\n'); + writeFileSync(wrapperPath, `\uFEFF${buildWindowsPowerShellCodexShim(realPath, process.execPath, ensurePath, "process")}`); + const emptyToken = callerToken === "" ? "$env:OPENCODEX_API_AUTH_TOKEN = ''\n" : ""; + writeFileSync(driverPath, `\uFEFF$ErrorActionPreference = 'Stop'\n${emptyToken}$beforePresence = Test-Path Env:\\OPENCODEX_API_AUTH_TOKEN\n& '${wrapperPath.replace(/'/g, "''")}' exec 'arg value'\n$result = $LASTEXITCODE\n"after:$env:OPENCODEX_API_AUTH_TOKEN"\n"result:$result"\n"presence-preserved:$($beforePresence -eq (Test-Path Env:\\OPENCODEX_API_AUTH_TOKEN))"\n`); + } + const env = shimChildEnv({ + OPENCODEX_HOME: dir, + OPENCODEX_API_AUTH_TOKEN: callerToken ?? "", + OCX_SHIM_BYPASS: bypass ? "1" : "", + }); + if (callerToken === undefined) delete env.OPENCODEX_API_AUTH_TOKEN; + const result = shell === "cmd" + ? spawnSync(process.env.ComSpec ?? "cmd.exe", ["/d", "/c", "driver.cmd"], { cwd: dir, env, encoding: "utf8", timeout: INTERNAL_DEADLINE_MS, windowsHide: true }) + : spawnSync(`${shell}.exe`, ["-NoProfile", "-NonInteractive", "-File", driverPath], { env, encoding: "utf8", timeout: INTERNAL_DEADLINE_MS, windowsHide: true }); + expect(result.status, result.stderr).toBe(0); + expect(result.stdout.trim().split(/\r?\n/)).toEqual([ + `child:${callerToken || "file-token"}`, + `after:${callerToken ?? ""}`, + "result:37", + ...(shell === "cmd" ? [] : ["presence-preserved:True"]), + ]); + expect(existsSync(ensureLog)).toBe(!bypass); + } finally { + if (oldHome === undefined) delete process.env.OPENCODEX_HOME; + else process.env.OPENCODEX_HOME = oldHome; + removeTreeWithRetry(dir); + } + }, SPAWN_BUDGET_MS); + } + } + + for (const failurePhase of ["ensure", "Codex"]) { + for (const executable of ["powershell.exe", "pwsh.exe"]) { + for (const callerToken of [undefined, "", "caller-token"]) { + test.skipIf(process.platform !== "win32")(`Windows ${executable} shim restores ${callerToken === undefined ? "missing" : callerToken === "" ? "empty" : "explicit"} caller token when ${failurePhase} throws`, () => { + const dir = mkdtempSync(join(tmpdir(), "ocx-shim-token-error-")); + const oldHome = process.env.OPENCODEX_HOME; + try { + process.env.OPENCODEX_HOME = dir; + const wrapperPath = join(dir, "codex.ps1"); + const ensurePath = join(dir, "throw.ps1"); + const driverPath = join(dir, "driver.ps1"); + const realPath = join(dir, "codex-real.ps1"); + writeFileSync(join(dir, "service-api-token"), "file-token\n"); + writeFileSync(ensurePath, failurePhase === "ensure" ? "throw 'fixture ensure failure'\n" : "exit 19\n"); + writeFileSync(realPath, "throw 'fixture Codex failure'\n"); + writeFileSync(wrapperPath, `\uFEFF${buildWindowsPowerShellCodexShim(realPath, ensurePath, "unused.ts", "process")}`); + const emptyToken = callerToken === "" ? "$env:OPENCODEX_API_AUTH_TOKEN = ''\n" : ""; + writeFileSync(driverPath, `\uFEFF$ErrorActionPreference = 'Stop'\n${emptyToken}$beforePresence = Test-Path Env:\\OPENCODEX_API_AUTH_TOKEN\ntry { & '${wrapperPath.replace(/'/g, "''")}' exec } catch { "error:$($_.Exception.Message)" }\n"after:$env:OPENCODEX_API_AUTH_TOKEN"\n"presence-preserved:$($beforePresence -eq (Test-Path Env:\\OPENCODEX_API_AUTH_TOKEN))"\n`); + const env = shimChildEnv({ OPENCODEX_HOME: dir, OPENCODEX_API_AUTH_TOKEN: callerToken ?? "", OCX_SHIM_BYPASS: "" }); + if (callerToken === undefined) delete env.OPENCODEX_API_AUTH_TOKEN; + const result = spawnSync(executable, ["-NoProfile", "-NonInteractive", "-File", driverPath], { + env, encoding: "utf8", timeout: INTERNAL_DEADLINE_MS, windowsHide: true, + }); + expect(result.error).toBeUndefined(); + expect(result.status, result.stderr).toBe(0); + expect(result.stdout.trim().split(/\r?\n/)).toEqual([ + `error:fixture ${failurePhase} failure`, `after:${callerToken ?? ""}`, "presence-preserved:True", + ]); + + // A failed process must complete, rather than satisfy the check through a timeout. + writeFileSync(driverPath, `\uFEFF$ErrorActionPreference = 'Stop'\n& '${wrapperPath.replace(/'/g, "''")}' exec\n`); + const uncaught = spawnSync(executable, ["-NoProfile", "-NonInteractive", "-File", driverPath], { + env, encoding: "utf8", timeout: INTERNAL_DEADLINE_MS, windowsHide: true, + }); + expect(uncaught.error).toBeUndefined(); + expect(uncaught.signal).toBeNull(); + expect(typeof uncaught.status, uncaught.stderr).toBe("number"); + expect(uncaught.status, uncaught.stderr).not.toBe(0); + expect(uncaught.stderr).toContain(`fixture ${failurePhase} failure`); + } finally { + if (oldHome === undefined) delete process.env.OPENCODEX_HOME; + else process.env.OPENCODEX_HOME = oldHome; + removeTreeWithRetry(dir); + } + }, SPAWN_BUDGET_MS); + } + } + } + test("Unix shim skips ocx startup only for Codex management commands", () => { if (process.platform === "win32") return; diff --git a/tests/codex-integration/codex-v2-gate.test.ts b/tests/codex-integration/codex-v2-gate.test.ts index 6e8b6a18c1..39ec9a342c 100644 --- a/tests/codex-integration/codex-v2-gate.test.ts +++ b/tests/codex-integration/codex-v2-gate.test.ts @@ -44,10 +44,18 @@ import { v2TotalLimitToV1ChildLimit, } from "../../src/codex/features"; import { resetCodexRuntimeResolveCacheForTests, setCodexRuntimeResolveCacheForTests } from "../../src/codex/runtime"; +import { MULTI_AGENT_MODE_HINT_RECOMMENDATION } from "../../src/codex/multi-agent-mode-policy"; import { cmdV2, codexFeaturesInvocation, v2StatusLine, multiAgentModeLine } from "../../src/cli/v2"; import { handleManagementAPI } from "../../src/server/management-api"; import { catalogConvergenceFactory } from "../helpers/catalog-convergence"; +// Independently pinned release presets: removing a production compatibility +// entry must not silently remove its regression case too. +const RELEASED_MODE_HINTS = [ + "Proactive multi-agent delegation is active. Any earlier instruction requiring an explicit user request before spawning sub-agents no longer applies. Use sub-agents when parallel work would materially improve speed or quality. This mode remains active until a later multi-agent mode developer message changes it.", + "Proactive multi-agent delegation is active. Any earlier instruction requiring an explicit user request before spawning sub-agents no longer applies. Delegate independent sub-tasks to sub-agents whenever parallel work would materially improve speed or quality — do not serialize work that can run concurrently. Each sub-agent runs in its own context and can use all available tools; prefer spawning specialists over doing everything yourself. This mode remains active until a later multi-agent mode developer message changes it.", +] as const; + function template(): Record<string, unknown> { return { slug: "gpt-5.5", @@ -423,6 +431,19 @@ describe("multi_agent_mode_hint_text reader/writer", () => { expect(readFileSync(path, "utf8")).toBe(before); }); + test("writer upgrades exact released presets while preserving user-edited text", () => { + for (const legacy of RELEASED_MODE_HINTS) { + const path = fixtureConfig(TABLE); + expect(setMultiAgentModeHintText(legacy, path)).toEqual({ ok: true, changed: true }); + expect(getMultiAgentModeHintText(path)).toBe(MULTI_AGENT_MODE_HINT_RECOMMENDATION.text); + } + for (const custom of [`${RELEASED_MODE_HINTS[0]} `, `${RELEASED_MODE_HINTS[1]} Ask before delegating.`]) { + const path = fixtureConfig(TABLE); + expect(setMultiAgentModeHintText(custom, path)).toEqual({ ok: true, changed: true }); + expect(getMultiAgentModeHintText(path)).toBe(custom); + } + }); + test("writer clears with null: removes the key, keeps siblings", () => { const path = fixtureConfig("[features.multi_agent_v2]\nenabled = true\nmulti_agent_mode_hint_text = \"Proactive delegation\"\nmax_concurrent_threads_per_session = 17\n"); expect(setMultiAgentModeHintText(null, path)).toEqual({ ok: true, changed: true }); @@ -1348,6 +1369,7 @@ describe("management API parity surface for the WP2 keys", () => { agentsMaxDepth: 2, subagentDeveloperInstructions: null, multiAgentModeHintText: null, + multiAgentModeHintRecommendation: MULTI_AGENT_MODE_HINT_RECOMMENDATION, agentsMaxDepthAppliesWhenV2Disabled: true, }); const v2Path = fixtureConfig("[features.multi_agent_v2]\nenabled = true\n"); @@ -1357,6 +1379,37 @@ describe("management API parity surface for the WP2 keys", () => { }); }); + test.each(RELEASED_MODE_HINTS)("GET preserves a released preset until an explicit hint save: %s", async legacy => { + const initial = `[features.multi_agent_v2]\nenabled = false\n# keep adjacent setting\nmax_concurrent_threads_per_session = 17\nmulti_agent_mode_hint_text = ${JSON.stringify(legacy)}\n`; + await withConfig(initial, async (path, deps) => { + const before = readFileSync(path, "utf8"); + const get = await handleManagementAPI(new Request("http://localhost/api/v2"), new URL("http://localhost/api/v2"), config, deps); + expect(await get?.json()).toMatchObject({ + multiAgentModeHintText: legacy, + multiAgentModeHintRecommendation: MULTI_AGENT_MODE_HINT_RECOMMENDATION, + }); + expect(readFileSync(path, "utf8")).toBe(before); + + const unrelated = await handleManagementAPI(put({ agentsEnabled: false }), new URL("http://localhost/api/v2"), config, deps); + expect(unrelated?.status).toBe(200); + expect(getMultiAgentModeHintText(path)).toBe(legacy); + + const saved = await handleManagementAPI(put({ multiAgentModeHintText: legacy }), new URL("http://localhost/api/v2"), config, deps); + expect(saved?.status).toBe(200); + expect(await saved?.json()).toMatchObject({ + multiAgentModeHintText: MULTI_AGENT_MODE_HINT_RECOMMENDATION.text, + multiAgentModeHintRecommendation: MULTI_AGENT_MODE_HINT_RECOMMENDATION, + }); + expect(getMultiAgentModeHintText(path)).toBe(MULTI_AGENT_MODE_HINT_RECOMMENDATION.text); + expect(readFileSync(path, "utf8")).toContain("# keep adjacent setting"); + expect(getMaxConcurrentThreads(path)).toBe(17); + + const after = readFileSync(path, "utf8"); + expect(setMultiAgentModeHintText(legacy, path)).toEqual({ ok: true, changed: false }); + expect(readFileSync(path, "utf8")).toBe(after); + }); + }); + test("PUT writes each new field independently and re-reads them", async () => { await withConfig("[features.multi_agent_v2]\nenabled = false\n", async (path, deps) => { const onlyNew = await handleManagementAPI(put({ agentsEnabled: false }), new URL("http://localhost/api/v2"), config, deps); diff --git a/tests/codex-integration/issue-702-expired-replay-state.test.ts b/tests/codex-integration/issue-702-expired-replay-state.test.ts index b73439ecc9..13b96be638 100644 --- a/tests/codex-integration/issue-702-expired-replay-state.test.ts +++ b/tests/codex-integration/issue-702-expired-replay-state.test.ts @@ -21,7 +21,7 @@ import { startServer } from "../../src/server"; import type { OcxConfig } from "../../src/types"; import { fakeChatGptJwt } from "../helpers/fake-chatgpt-jwt"; import { installIsolatedCodexHome, type IsolatedCodexHome } from "../helpers/isolated-codex-home"; -import { SERVER_BUDGET_MS } from "../helpers/test-budget"; +import { INTERNAL_DEADLINE_MS, SERVER_BUDGET_MS } from "../helpers/test-budget"; import { removeTreeWithRetry } from "../helpers/remove-tree"; const originalFetch = globalThis.fetch; @@ -104,6 +104,46 @@ function completedSse(responseId: string, text: string): string { ].join("\n"); } +async function openResponseSocket(url: URL, headers: Record<string, string>): Promise<WebSocket> { + const target = new URL("/v1/responses", url); + target.protocol = "ws:"; + const socket = new WebSocket(target, { headers } as unknown as string[]); + await new Promise<void>((resolve, reject) => { + const timer = setTimeout(() => { + socket.close(); + reject(new Error("response socket did not open")); + }, INTERNAL_DEADLINE_MS); + socket.onopen = () => { clearTimeout(timer); resolve(); }; + socket.onerror = () => { clearTimeout(timer); reject(new Error("response socket failed to open")); }; + }); + return socket; +} + +async function sendSocketTurn(socket: WebSocket, body: Record<string, unknown>): Promise<Record<string, unknown>> { + return new Promise((resolve, reject) => { + const finish = (error?: Error, frame?: Record<string, unknown>) => { + clearTimeout(timer); + socket.onmessage = socket.onclose = socket.onerror = null; + if (error) reject(error); + else resolve(frame!); + }; + const timer = setTimeout(() => finish(new Error("response socket did not reach a terminal event")), INTERNAL_DEADLINE_MS); + socket.onclose = () => finish(new Error("response socket closed before its terminal event")); + socket.onerror = () => finish(new Error("response socket failed")); + socket.onmessage = event => { + try { + const frame = JSON.parse(String(event.data)); + if (["error", "response.completed", "response.failed", "response.incomplete"].includes(frame.type)) { + finish(undefined, frame); + } + } catch (error) { + finish(error instanceof Error ? error : new Error(String(error))); + } + }; + socket.send(JSON.stringify({ type: "response.create", ...body })); + }); +} + async function waitForRecordedResponseState(): Promise<ResponseStateMetrics> { const deadline = performance.now() + 1_000; while (performance.now() < deadline) { @@ -364,11 +404,86 @@ describe("Issue #702 expired forward replay state", () => { error: { message: expect.stringMatching(/continuation state.*expired/i), type: "invalid_request_error", - code: "invalid_request_error", + code: "previous_response_not_found", }, }); }); + test.each(["expired", "missing"] as const)("%s forward state lets a WebSocket client reconnect and replay full tool history", async mode => { + const upstreamRequests: Record<string, unknown>[] = []; + const realNow = Date.now; + let server: ReturnType<typeof startServer> | null = null; + let socket: WebSocket | null = null; + const toolCall = { + type: "function_call", id: "fc_issue_702", call_id: "call_issue_702", + name: "lookup", arguments: '{"key":"historical"}', status: "completed", + }; + const toolResult = { + type: "function_call_output", call_id: "call_issue_702", output: "historical tool result", + }; + const history = [inputMessage(HISTORICAL_USER_SENTINEL), toolCall]; + const delta = [toolResult, inputMessage(CURRENT_USER_SENTINEL)]; + try { + if (mode === "expired") { + Date.now = () => realNow() - EXPIRED_AGE_MS; + rememberResponseState( + { input: [history[0]], store: false }, + { id: FIRST_RESPONSE_ID, status: "completed", output: [toolCall] }, + undefined, + { force: true }, + ); + Date.now = realNow; + expect(responseStateMetrics().oldestAgeMs).toBeGreaterThan(REPLAY_TTL_MS); + } + globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => { + const url = new URL(input instanceof Request ? input.url : String(input)); + if (url.hostname === "chatgpt.com" && url.pathname === "/backend-api/codex/responses") { + upstreamRequests.push(JSON.parse(String(init?.body))); + return new Response(completedSse("resp_issue_702_recovered", "recovered with full history"), { + headers: { "content-type": "text/event-stream" }, + }); + } + return originalFetch(input, init); + }) as typeof fetch; + saveConfig({ ...forwardConfig(), websockets: true }); + server = startServer(0); + const headers = { + authorization: `Bearer ${fakeChatGptJwt({ chatgpt_account_id: "acct-issue-702" })}`, + "chatgpt-account-id": "acct-issue-702", + }; + socket = await openResponseSocket(server.url, headers); + const rejected = await sendSocketTurn(socket, { + model: "gpt-5.5", previous_response_id: FIRST_RESPONSE_ID, input: delta, store: false, + }); + expect(rejected).toMatchObject({ + type: "error", status: 400, + error: { type: "invalid_request_error", code: "previous_response_not_found" }, + }); + expect(upstreamRequests).toHaveLength(0); + + // Codex recognizes this code, discards its incremental socket state, and reconnects + // with its complete input. The rejected delta must never be forwarded on its own. + socket.close(); + socket = await openResponseSocket(server.url, headers); + const recovered = await sendSocketTurn(socket, { + model: "gpt-5.5", input: [...history, ...delta], store: false, + tools: [{ type: "function", name: "lookup", parameters: { type: "object" } }], + }); + expect(recovered).toMatchObject({ type: "response.completed", response: { id: "resp_issue_702_recovered" } }); + expect(upstreamRequests).toHaveLength(1); + expect(upstreamRequests[0]!.previous_response_id).toBeUndefined(); + // The canonical forward adapter removes item ids, but must preserve the call/result + // identity and every input item exactly once when the client supplies full history. + const { id: _itemId, ...forwardedToolCall } = toolCall; + expect(upstreamRequests[0]!.input).toEqual([history[0], forwardedToolCall, ...delta]); + } finally { + Date.now = realNow; + globalThis.fetch = originalFetch; + socket?.close(); + await server?.stop(true); + } + }, SERVER_BUDGET_MS); + test("forward mode expands fresh replay state before continuing upstream", async () => { const scenario = await runForwardScenario("fresh"); diff --git a/tests/codex-integration/multi-agent-compat.test.ts b/tests/codex-integration/multi-agent-compat.test.ts index 9430ab657a..6b3d1374b2 100644 --- a/tests/codex-integration/multi-agent-compat.test.ts +++ b/tests/codex-integration/multi-agent-compat.test.ts @@ -267,7 +267,7 @@ describe("multiAgentGuidanceText", () => { } }); - test("v2 built-in guidance is schema-agnostic and keeps fork rules", async () => { + test("v2 built-in guidance reports routing metadata without replacing native delegation rules", async () => { const dir = codexHomeFixture(V2_ON); catalogFixture(dir, [{ slug: "anthropic/claude-sonnet-5", @@ -279,10 +279,13 @@ describe("multiAgentGuidanceText", () => { { injectionModel: "anthropic/claude-sonnet-5" }, ); - expect(text).toContain("When the active spawn_agent tool supports optional"); - expect(text).toContain("use only models listed for this collaboration surface"); - expect(text).toContain("fork_turns"); - expect(text).toContain('"none"'); + expect(text).toStartWith("<opencodex_subagent_guidance>"); + expect(text).toEndWith("</opencodex_subagent_guidance>"); + expect(text).toContain("OpenCodex sub-agent routing metadata"); + expect(text).toContain("does not override Codex delegation or model-selection rules"); + expect(text).not.toContain("fork_turns"); + expect(text).not.toContain("use it unless"); + expect(text).not.toContain("<multi_agent_mode>"); expect(text).not.toMatch(/hidden/i); expect(text).not.toMatch(/not in the schema/i); expect(text).not.toMatch(/never claim/i); @@ -384,7 +387,7 @@ describe("multiAgentGuidanceText", () => { injectionPrompt: "Use {{model}}.", }, ); - expect(custom).toBe('<multi_agent_mode>Use team/gpt-5.6-sol.</multi_agent_mode>'); + expect(custom).toBe('<opencodex_subagent_guidance>Use team/gpt-5.6-sol.</opencodex_subagent_guidance>'); const exactBare = await multiAgentGuidanceText( parsedFixture({ tools: [{ name: "spawn_agent" }] }), @@ -403,7 +406,7 @@ describe("multiAgentGuidanceText", () => { injectionPrompt: "Use {{model}}.", }, ); - expect(exactBareCustom).toBe("<multi_agent_mode>Use local-fast.</multi_agent_mode>"); + expect(exactBareCustom).toBe("<opencodex_subagent_guidance>Use local-fast.</opencodex_subagent_guidance>"); const bareParent = await multiAgentGuidanceText( parsedFixture({ tools: [{ name: "spawn_agent" }] }), @@ -449,7 +452,7 @@ describe("multiAgentGuidanceText", () => { injectionPrompt: "Use {{model}}.", }, ); - expect(ambiguousCustom).toBe("<multi_agent_mode>Use .</multi_agent_mode>"); + expect(ambiguousCustom).toBe("<opencodex_subagent_guidance>Use .</opencodex_subagent_guidance>"); expect(ambiguousCustom).not.toContain("gpt-5.6-sol"); }); @@ -508,7 +511,7 @@ describe("multiAgentGuidanceText", () => { injectionModel: "gpt-5.6-sol", injectionPrompt: "Use {{model}}.", }, - )).toBe("<multi_agent_mode>Use .</multi_agent_mode>"); + )).toBe("<opencodex_subagent_guidance>Use .</opencodex_subagent_guidance>"); }); test("effective roster applies alias, visibility, v2 compatibility, stable priority, cap, and diagnostics", async () => { @@ -612,7 +615,7 @@ describe("multiAgentGuidanceText", () => { { injectionModel: "anthropic/claude-sonnet-5" }, ); expect(text).toContain('"anthropic/claude-sonnet-5"'); - expect(text).toContain("fork_turns"); + expect(text).toContain("OpenCodex sub-agent routing metadata"); expect(text).not.toContain("Proactive multi-agent delegation is active"); // and WITHOUT an injectionModel it stays silent (codex-rs owns the v2 Proactive text) expect(await multiAgentGuidanceText(parsedFixture({ reasoning: "ultra", tools: nativeV2 }))).toBeNull(); @@ -654,7 +657,7 @@ describe("multiAgentGuidanceText", () => { injectionEffort: "xhigh", subagentModels: ["gpt-5.6-terra"], }); - expect(text).toContain("When the active spawn_agent tool supports optional"); + expect(text).toContain("OpenCodex sub-agent routing metadata"); expect(text).not.toMatch(/hidden|not in the schema|never claim/i); expect(text).toContain('(reasoning_effort high/max/ultra): "gpt-5.6-terra"'); }); @@ -738,8 +741,8 @@ describe("multiAgentGuidanceText", () => { // gpt-5.6-luna carries upstream's "v1" pin, which is now an eligible LEAF worker // (codex-rs 6d4d9442c), so it joins the substituted roster. expect(text).toBe( - '<multi_agent_mode>CUSTOM model=raw/preferred-model effort=max' - + ' Available models (reasoning_effort high/max): "gpt-5.6-terra", "gpt-5.6-luna".</multi_agent_mode>', + '<opencodex_subagent_guidance>CUSTOM model=raw/preferred-model effort=max' + + ' Available models (reasoning_effort high/max): "gpt-5.6-terra", "gpt-5.6-luna".</opencodex_subagent_guidance>', ); }); @@ -778,14 +781,14 @@ describe("multiAgentGuidanceText", () => { expect(await multiAgentGuidanceText(parsedFixture({ reasoning: "medium", tools: v2Tools }))).toBeNull(); }); - test("v2 surface + roster alone (no injectionModel) fires with the argument-acceptance preamble", async () => { + test("v2 surface + roster alone (no injectionModel) reports routing metadata", async () => { const dir = codexHomeFixture(V2_ON); catalogFixture(dir, [{ slug: "gpt-5.6-terra", efforts: ["high", "max", "ultra"] }]); const text = await multiAgentGuidanceText( parsedFixture({ reasoning: "medium", tools: [{ name: "spawn_agent" }] }), { subagentModels: ["gpt-5.6-terra"] }, ); - expect(text).toContain("When the active spawn_agent tool supports optional"); + expect(text).toContain("OpenCodex sub-agent routing metadata"); expect(text).not.toMatch(/hidden|not in the schema|never claim/i); expect(text).toContain('(reasoning_effort high/max/ultra): "gpt-5.6-terra"'); expect(text).not.toContain("Preferred sub-agent"); @@ -861,7 +864,7 @@ describe("multiAgentGuidanceText", () => { subagentModels: ["gpt-5.5", "opencode-go/glm-5.2", "anthropic/claude-opus-4-6", "gpt-5.6-sol", "gpt-5.6-terra"], }, ); - const body = text!.replace(/^<multi_agent_mode>/, "").replace(/<\/multi_agent_mode>$/, ""); + const body = text!.replace(/^<opencodex_subagent_guidance>/, "").replace(/<\/opencodex_subagent_guidance>$/, ""); expect(body.length).toBeLessThanOrEqual(700); expect(body).toContain("Available models"); // roster fits inside the budget }); @@ -1182,6 +1185,96 @@ describe("injectDeveloperMessage", () => { expect((replay._rawBody as { input: unknown[] }).input.at(-1)).toEqual(generatedItem(guidanceA)); }); + test("proxy guidance dedup records a metadata A-B-A transition", () => { + const metadataA = "<opencodex_subagent_guidance>A</opencodex_subagent_guidance>"; + const metadataB = "<opencodex_subagent_guidance>B</opencodex_subagent_guidance>"; + const current = { type: "message", role: "user", content: "current turn" }; + const rawInput = [generatedItem(metadataA), generatedItem(metadataB), current]; + const parsed = parseRequest({ model: "gpt-5.5", input: rawInput, previous_response_id: "resp_1" }); + parsed._replayPrefixLen = 2; + parsed._continuationConversationMessageIndex = 2; + + injectDeveloperMessage(parsed, metadataA); + + expect(rawInput).toEqual([generatedItem(metadataA), generatedItem(metadataB), generatedItem(metadataA), current]); + expect(parsed.context.messages.map(message => message.content)).toEqual([metadataA, metadataB, metadataA, "current turn"]); + }); + + test("proxy guidance dedup preserves intervening native mode changes", () => { + const nativeA = "<multi_agent_mode>Native policy A</multi_agent_mode>"; + const nativeB = "<multi_agent_mode>Native policy B</multi_agent_mode>"; + const metadata = "<opencodex_subagent_guidance>Routing metadata</opencodex_subagent_guidance>"; + const rawInput = [generatedItem(nativeA), generatedItem(metadata), generatedItem(nativeB), { role: "user", content: "work" }]; + const before = structuredClone(rawInput); + const parsed = parseRequest({ model: "gpt-5.5", input: rawInput }); + parsed._replayPrefixLen = 3; + + injectDeveloperMessage(parsed, metadata); + + expect(rawInput).toEqual(before); + expect(parsed.context.messages.map(message => message.content)).toEqual([nativeA, metadata, nativeB, "work"]); + }); + + test("native mode dedup ignores later proxy guidance", () => { + const native = "<multi_agent_mode>Native policy</multi_agent_mode>"; + const metadata = "<opencodex_subagent_guidance>Routing metadata</opencodex_subagent_guidance>"; + const rawInput = [generatedItem(native), generatedItem(metadata), { role: "user", content: "work" }]; + const before = structuredClone(rawInput); + const parsed = parseRequest({ model: "gpt-5.5", input: rawInput }); + parsed._replayPrefixLen = 2; + + injectDeveloperMessage(parsed, native); + + expect(rawInput).toEqual(before); + expect(countExact(rawInput, native)).toBe(1); + }); + + test("restores default v2 guidance after a custom prompt without changing the custom body", async () => { + const dir = codexHomeFixture(V2_ON); + catalogFixture(dir, [{ slug: "gpt-5.6-terra", efforts: ["high", "max"], multiAgentVersion: "v2" }]); + const fixture = parsedFixture({ tools: [{ name: "spawn_agent" }] }); + const options = { injectionModel: "gpt-5.6-terra", injectionEffort: "high" }; + const metadata = await multiAgentGuidanceText(fixture, options); + const custom = await multiAgentGuidanceText(fixture, { + ...options, + injectionPrompt: "Custom {{model}} effort={{effort}}\nKeep {{unknown}}.", + }); + expect(metadata).not.toBeNull(); + const current = { type: "message", role: "user", content: "current turn" }; + const rawInput = [generatedItem(metadata!), generatedItem(custom!), current]; + const parsed = parseRequest({ model: "gpt-5.5", input: rawInput, previous_response_id: "resp_1" }); + parsed._replayPrefixLen = 2; + parsed._continuationConversationMessageIndex = 2; + + injectDeveloperMessage(parsed, (await multiAgentGuidanceText(fixture, options))!); + + expect(rawInput).toEqual([generatedItem(metadata!), generatedItem(custom!), generatedItem(metadata!), current]); + expect(parsed.context.messages.map(message => message.content)).toEqual([metadata, custom, metadata, "current turn"]); + expect(custom).toBe("<opencodex_subagent_guidance>Custom gpt-5.6-terra effort=high\nKeep {{unknown}}.</opencodex_subagent_guidance>"); + }); + + const legacyBuiltIn = '<multi_agent_mode>When the active spawn_agent tool supports optional "model" or "reasoning_effort" overrides, ' + + 'use only models listed for this collaboration surface. When setting either override, set fork_turns to "none" ' + + '(or a positive turn count such as "3"; full-history forks reject overrides) and make the task message self-contained.' + + ' Preferred sub-agent: model "gpt-5.6-terra", reasoning_effort "high" — use it unless the user names another.</multi_agent_mode>'; + test.each([ + ["built-in", legacyBuiltIn], + ["custom", "<multi_agent_mode>Operator-authored legacy prompt.</multi_agent_mode>"], + ])("preserves legacy %s and native policy when first injecting new proxy guidance", (_kind, legacy) => { + const native = "<multi_agent_mode>Native delegation policy</multi_agent_mode>"; + const metadata = "<opencodex_subagent_guidance>Routing metadata</opencodex_subagent_guidance>"; + const current = { type: "message", role: "user", content: "work" }; + const prefix = [generatedItem(legacy), generatedItem(native)]; + const rawInput = [...prefix, current]; + const parsed = parseRequest({ model: "gpt-5.5", input: rawInput }); + parsed._replayPrefixLen = prefix.length; + + injectDeveloperMessage(parsed, metadata); + + expect(rawInput).toEqual([...prefix, generatedItem(metadata), current]); + expect(parsed.context.messages.map(message => message.content)).toEqual([legacy, native, metadata, "work"]); + }); + test("exact-guidance predicate rejects every near-match replay-prefix shape (#326)", () => { const nearMatches: Array<[string, unknown]> = [ ["non-record item", null], diff --git a/tests/config/config-mutation-lock.test.ts b/tests/config/config-mutation-lock.test.ts index 06a18dd99d..56a4d74659 100644 --- a/tests/config/config-mutation-lock.test.ts +++ b/tests/config/config-mutation-lock.test.ts @@ -230,22 +230,38 @@ test("exclusive temp collision does not remove or modify somebody else's file", test("failed hardening occurs before candidate bytes are written", () => { let wrote = false; - expect(() => initializePersistedConfigIfMissing(config(), { - harden(_fd, temp) { - expect(readFileSync(temp, "utf8")).toBe(""); - throw new Error("ACL denied"); - }, - write() { wrote = true; }, - })).toThrow(InitialConfigPublicationError); + let linked = false; + let failure: unknown; + try { + initializePersistedConfigIfMissing(config(), { + harden(_fd, temp) { + expect(readFileSync(temp, "utf8")).toBe(""); + throw new Error("private ACL failure detail"); + }, + write() { wrote = true; }, + link() { linked = true; }, + }); + } catch (error) { failure = error; } + expect(failure).toBeInstanceOf(InitialConfigPublicationError); + expect((failure as Error).message).toContain("permissions could not be secured"); + expect((failure as Error).message).toContain("OPENCODEX_HOME"); + expect((failure as Error).message).not.toContain("private ACL failure detail"); + expect(failure).toMatchObject({ publication: "not-published", hardLinkUnavailable: false, residualTemp: false }); expect(wrote).toBe(false); + expect(linked).toBe(false); expect(existsSync(getConfigPath())).toBe(false); expect(initTemps()).toEqual([]); }); test("partial write failure removes only the unpublished temporary name", () => { - expect(() => initializePersistedConfigIfMissing(config(), { - write(fd, bytes) { writeFileSync(fd, bytes.slice(0, 10)); throw new Error("disk full"); }, - })).toThrow(InitialConfigPublicationError); + let failure: unknown; + try { + initializePersistedConfigIfMissing(config(), { + write(fd, bytes) { writeFileSync(fd, bytes.slice(0, 10)); throw new Error("disk full"); }, + }); + } catch (error) { failure = error; } + expect(failure).toBeInstanceOf(InitialConfigPublicationError); + expect((failure as Error).message).toBe("Initial config publication did not finish."); expect(existsSync(getConfigPath())).toBe(false); expect(initTemps()).toEqual([]); }); @@ -259,6 +275,10 @@ test.each(["EOPNOTSUPP", "ENOTSUP", "ENOSYS", "EXDEV", "EPERM"])("unsupported/de } catch (error) { expect(error).toBeInstanceOf(InitialConfigPublicationError); expect((error as InitialConfigPublicationError).hardLinkUnavailable).toBe(true); + expect((error as Error).message).toContain("OPENCODEX_HOME"); + expect((error as Error).message).toContain("private file permissions"); + expect((error as Error).message).not.toContain("do not print raw error"); + expect((error as Error).message).not.toContain("permissions could not be secured"); } expect(existsSync(getConfigPath())).toBe(false); expect(initTemps()).toEqual([]); diff --git a/tests/fixtures/test-layout-expected.json b/tests/fixtures/test-layout-expected.json index 02c2062062..2aafc9c654 100644 --- a/tests/fixtures/test-layout-expected.json +++ b/tests/fixtures/test-layout-expected.json @@ -749,7 +749,6 @@ "openai-responses-passthrough.test.ts": "responses", "opencode-cli.test.ts": "providers", "opencode-free-provider.test.ts": "providers", - "opencode-go-agent-messages.test.ts": "providers", "opencode-go-deepseek.test.ts": "providers", "opencode-go-grok46-responses.test.ts": "providers", "opencode-go-luna-wire.test.ts": "providers", @@ -907,6 +906,7 @@ "retry-after-429.test.ts": "server", "route-decision-trace.test.ts": "server", "route-explainability.test.ts": "cli", + "routed-agent-messages.test.ts": "adapters", "router-combo-failover-classification.test.ts": "routing", "router-discarded-baseurl-warning.test.ts": "routing", "router-template-baseurl.test.ts": "routing", diff --git a/tests/oauth/state-store-sweeper.test.ts b/tests/oauth/state-store-sweeper.test.ts index 36ede716d4..b162e2214b 100644 --- a/tests/oauth/state-store-sweeper.test.ts +++ b/tests/oauth/state-store-sweeper.test.ts @@ -22,7 +22,8 @@ import { setOcxStartProcessProbeForTests, sweepDeadOcxStartProcessCache, } from "../../src/config"; -import { STATE_STORE_REGISTRATIONS } from "../../src/lib/state-store-registrations"; +import { STATE_STORE_REGISTRATIONS, setLiveStateStoreConfig, reconcileLiveStateStores } from "../../src/lib/state-store-registrations"; +import { clearComboRecallForTests, recallComboForLane, rememberComboForLane } from "../../src/server/responses/combo-session-recall"; import { getAccountSet, saveCredential } from "../../src/oauth/store"; import { clearAccountQuotaCache, @@ -78,12 +79,14 @@ beforeEach(() => { sweeperHome = mkdtempSync(join(tmpdir(), "ocx-sweeper-home-")); process.env.OPENCODEX_HOME = sweeperHome; resetStateStoreSweeperForTests(); + clearComboRecallForTests(); resetAppOwnedMemoryForTests(); clearResponseStateMemoryForTests(); __resetAntigravityReplayCache(); }); afterEach(() => { resetStateStoreSweeperForTests(); + clearComboRecallForTests(); resetAppOwnedMemoryForTests(); clearResponseStateMemoryForTests(); __resetAntigravityReplayCache(); @@ -147,6 +150,7 @@ describe("state-store sweeper", () => { "model-cache-history", "pool-rotation", "combo-rotation", + "combo-session-recall", "guardian-backoff", "codex-reauth", "oauth-reauth", @@ -157,6 +161,59 @@ describe("state-store sweeper", () => { ]); }); + test("registered combo recall cleanup rejects an old completion after delete and recreate while retaining another owner", () => { + registerStateStore(STATE_STORE_REGISTRATIONS.find(row => row.name === "combo-session-recall")!); + const config: OcxConfig = { + port: 0, defaultProvider: "a", + providers: { a: { adapter: "openai-chat", baseUrl: "https://a.example/v1" } }, + combos: { + first: { targets: [{ provider: "a", model: "m1" }] }, + other: { targets: [{ provider: "a", model: "m2" }] }, + }, + }; + setLiveStateStoreConfig(config); + const staleGeneration = captureConfigGeneration(); + rememberComboForLane("first-lane", "first", { provider: "a", model: "m1" }, "visible-first", staleGeneration); + rememberComboForLane("other-lane", "other", { provider: "a", model: "m2" }, "visible-other", staleGeneration); + delete config.combos!.first; + expect(reconcileLiveStateStores()).toEqual({ storesVisited: 1, rowsRemoved: 1 }); + config.combos!.first = { targets: [{ provider: "a", model: "m1" }] }; + expect(reconcileLiveStateStores()).toEqual({ storesVisited: 1, rowsRemoved: 0 }); + rememberComboForLane("first-lane", "first", { provider: "a", model: "m1" }, "visible-first", staleGeneration); + expect(recallComboForLane(config, "first-lane", "visible-first")).toBeUndefined(); + expect(recallComboForLane(config, "other-lane", "visible-other")).toBe("other"); + rememberComboForLane("first-lane", "first", { provider: "a", model: "m1" }, "visible-new", captureConfigGeneration()); + expect(recallComboForLane(config, "first-lane", "visible-new")).toBe("first"); + delete config.providers.a; + expect(reconcileLiveStateStores()).toEqual({ storesVisited: 1, rowsRemoved: 2 }); + }); + + test("combo recall watermark rejects writers after a partially failed generation", () => { + registerStateStore(STATE_STORE_REGISTRATIONS.find(row => row.name === "combo-session-recall")!); + const warning = spyOn(console, "warn").mockImplementation(() => {}); + const unregisterFailure = registerStateStore({ name: "failed-owner", reconcileGeneration: () => { throw new Error("retry"); } }); + const owners = context(0, { + comboIds: new Set(["first"]), comboTargets: new Set(["first::a/m1"]), providerNames: new Set(["a"]), + }); + const config: OcxConfig = { + port: 0, defaultProvider: "a", providers: { a: { adapter: "openai-chat", baseUrl: "https://a.example/v1" } }, + combos: { first: { targets: [{ provider: "a", model: "m1" }] } }, + }; + try { + reconcileStateGeneration(owners); + expect(captureConfigGeneration()).toBe(0); + rememberComboForLane("lane", "first", { provider: "a", model: "m1" }, "m1", 0); + expect(recallComboForLane(config, "lane", "m1")).toBeUndefined(); + unregisterFailure(); + reconcileStateGeneration(owners); + rememberComboForLane("lane", "first", { provider: "a", model: "m1" }, "m1", captureConfigGeneration()); + expect(recallComboForLane(config, "lane", "m1")).toBe("first"); + } finally { + unregisterFailure(); + warning.mockRestore(); + } + }); + test("a sweeper tick expires continuation and Antigravity rows without store traffic", () => { rememberResponseState({ input: "old" }, { id: "resp_sweeper_ttl", output: [], status: "completed" }); observeAntigravityReplay("gemini-3-pro", "session-old", [{ diff --git a/tests/providers/cursor/cursor-stream-health.test.ts b/tests/providers/cursor/cursor-stream-health.test.ts index dc7b572bf1..27a6cdac43 100644 --- a/tests/providers/cursor/cursor-stream-health.test.ts +++ b/tests/providers/cursor/cursor-stream-health.test.ts @@ -12,6 +12,7 @@ import { import { encodeConnectFrame } from "../../../src/adapters/cursor/framing"; import { createLiveCursorTransport } from "../../../src/adapters/cursor/live-transport"; import { createTestTranslatorBudget } from "../../helpers/translator-budget"; +import { isolationBudgetMs, watchdogMs } from "../../helpers/ci-watchdog"; import type { CursorRunRequest, CursorServerMessage } from "../../../src/adapters/cursor/types"; /** @@ -99,7 +100,11 @@ function runRequest(): CursorRunRequest { } as CursorRunRequest; } -async function drain(baseUrl: string, knobs: { streamSilenceFailMs?: number; streamHeartbeatOnlyFailMs?: number }): Promise<{ +async function drain( + baseUrl: string, + knobs: { streamSilenceFailMs?: number; streamHeartbeatOnlyFailMs?: number }, + onFirstText?: () => void, +): Promise<{ messages: CursorServerMessage[]; failure?: Error; }> { @@ -112,7 +117,14 @@ async function drain(baseUrl: string, knobs: { streamSilenceFailMs?: number; str const messages: CursorServerMessage[] = []; let failure: Error | undefined; try { - for await (const message of transport.run(runRequest())) messages.push(message); + for await (const message of transport.run(runRequest())) { + messages.push(message); + if (message.type === "text" && onFirstText) { + const notify = onFirstText; + onFirstText = undefined; + notify(); + } + } } catch (err) { failure = err instanceof Error ? err : new Error(String(err)); } finally { @@ -122,6 +134,15 @@ async function drain(baseUrl: string, knobs: { streamSilenceFailMs?: number; str } describe("Cursor inbound stream-health watchdog (T04)", () => { + // Scale once: the load helper applies a floor, so scaling each deadline separately + // would collapse the two clocks to the same value in CI. + const silenceMs = isolationBudgetMs(1_000); + const heartbeatOnlyMs = 2 * silenceMs; + const progressDurationMs = 3 * silenceMs; + // Include the existing two-second first-frame allowance and leave time for cleanup. + const fixtureLimitMs = 4 * silenceMs + 2_000; + const timeoutMs = Math.max(watchdogMs(15_000), fixtureLimitMs + silenceMs); + test("silence after the first frame fails the turn with the stall error", async () => { await withH2Server(stream => { stream.on("error", () => {}); @@ -140,27 +161,24 @@ describe("Cursor inbound stream-health watchdog (T04)", () => { stream.on("error", () => {}); stream.respond({ ":status": 200, "content-type": "application/connect+proto" }); stream.write(Buffer.from(textDeltaFrame("hi"))); - // 40ms, not 100ms. - // - // The silence clock below is 400ms, so a 100ms ping left a margin of four - // ticks: miss three in a row and the SILENCE watchdog fires first, which - // is a different error and a green-looking bug report. That is exactly what - // happened on the v2.41.0 macOS runner -- the assertion wanted - // "heartbeat-only" and got "no inbound frames for 1s before turnEnded". - // - // Nothing about the behaviour under test needs a slow ping: the point is - // that heartbeats reset the silence clock and do NOT reset the - // heartbeat-only clock. A tighter interval tests the same two clocks with - // ten ticks of margin instead of four. + // Frequent heartbeats/checkpoints keep the silence clock fresh while the + // longer heartbeat-only clock must still expire under a loaded test runner. const ping = setInterval(() => { try { stream.write(Buffer.from(heartbeatFrame())); stream.write(Buffer.from(checkpointFrame())); } catch { clearInterval(ping); } }, 40); - stream.on("close", () => clearInterval(ping)); + const limit = setTimeout(() => stream.close(), fixtureLimitMs); + stream.on("close", () => { + clearInterval(ping); + clearTimeout(limit); + }); }, async baseUrl => { - const { failure } = await drain(baseUrl, { streamSilenceFailMs: 400, streamHeartbeatOnlyFailMs: 900 }); + const { failure } = await drain(baseUrl, { + streamSilenceFailMs: silenceMs, + streamHeartbeatOnlyFailMs: heartbeatOnlyMs, + }); expect(failure).toBeDefined(); // Assert on the message, and say which watchdog won when the wrong one does. // A bare toContain here reported only the expected substring, which reads as @@ -168,35 +186,50 @@ describe("Cursor inbound stream-health watchdog (T04)", () => { // silence watchdog fired first on a loaded runner. expect(failure!.message).toContain("heartbeat-only"); }); - }, 15_000); + }, timeoutMs); test("meaningful frames keep resetting both clocks; turnEnded finishes cleanly", async () => { + let firstTextReceivedAt: number | undefined; + let completedProgressSpan = false; await withH2Server(stream => { stream.on("error", () => {}); stream.respond({ ":status": 200, "content-type": "application/connect+proto" }); + stream.write(Buffer.from(textDeltaFrame("part-0"))); + const latestEndAt = performance.now() + fixtureLimitMs; let count = 0; const tick = setInterval(() => { count += 1; try { - if (count < 6) { - stream.write(Buffer.from(textDeltaFrame(`part-${count}`))); - } else { + const now = performance.now(); + const progressComplete = firstTextReceivedAt !== undefined + && now - firstTextReceivedAt >= progressDurationMs; + if (progressComplete || now >= latestEndAt) { + completedProgressSpan = progressComplete; stream.write(Buffer.from(turnEndedFrame())); stream.end(); clearInterval(tick); + } else { + stream.write(Buffer.from(textDeltaFrame(`part-${count}`))); } - } catch { clearInterval(tick); } - }, 150); + } catch { + clearInterval(tick); + stream.destroy(); + } + }, 100); stream.on("close", () => clearInterval(tick)); }, async baseUrl => { - // Each 150ms text delta must reset the 400ms silence clock: six ticks ≈ 900ms total, - // far past a NON-resetting 400ms deadline. - const { messages, failure } = await drain(baseUrl, { streamSilenceFailMs: 400, streamHeartbeatOnlyFailMs: 10_000 }); + // Observe progress for 3S after receipt: both non-resetting deadlines (S and 2S) + // would expire before turnEnded, even when the first text reaches us late. + const { messages, failure } = await drain(baseUrl, { + streamSilenceFailMs: silenceMs, + streamHeartbeatOnlyFailMs: heartbeatOnlyMs, + }, () => { firstTextReceivedAt = performance.now(); }); expect(failure).toBeUndefined(); + expect(completedProgressSpan).toBe(true); expect(messages.some(message => message.type === "text")).toBe(true); expect(messages.some(message => message.type === "done")).toBe(true); }); - }, 15_000); + }, timeoutMs); test("turnEnded disarms the watchdog even when the server holds the stream open", async () => { await withH2Server(stream => { diff --git a/tests/providers/muse-spark-web-search-compat.test.ts b/tests/providers/muse-spark-web-search-compat.test.ts index ed22b4e036..062a42ebcd 100644 --- a/tests/providers/muse-spark-web-search-compat.test.ts +++ b/tests/providers/muse-spark-web-search-compat.test.ts @@ -158,6 +158,47 @@ describe("#2617/#3378 Muse Spark web_search compatibility", () => { expect(Object.hasOwn(nested, "indexed_web_access")).toBe(false); }); + /** + * The Contributor Free tiers ride the same Zen Responses wire with the same + * gateway contract, so a Codex `web_search` + refused-field body 400s for them + * exactly like the paid tiers. + */ + test("Contributor Free tiers get the same web_search sanitization", () => { + for (const modelId of ["muse-spark-1.2-contributor-free", "muse-spark-1.3-contributor-free"]) { + const body = build(modelId, { tools: [webSearchTool()] }); + const tool = toolsOf(body)[0]!; + expect(tool.type).toBe("web_search"); + expect(tool.search_context_size).toBe("medium"); + expect(Object.hasOwn(tool, "search_content_types")).toBe(false); + expect(Object.hasOwn(tool, "indexed_web_access")).toBe(false); + } + }); + + test("a nested additional_tools declaration is sanitized for the Free tiers too", () => { + for (const modelId of ["muse-spark-1.2-contributor-free", "muse-spark-1.3-contributor-free"]) { + const body = build(modelId, { + input: [{ type: "additional_tools", tools: [webSearchTool()] }], + }); + const item = (body.input as Array<Record<string, unknown>>)[0]!; + const nested = (item.tools as Array<Record<string, unknown>>)[0]!; + expect(nested.type).toBe("web_search"); + expect(Object.hasOwn(nested, "search_content_types")).toBe(false); + expect(Object.hasOwn(nested, "indexed_web_access")).toBe(false); + } + }); + + test("the Free tiers keep the field on web_search_preview, where the gateway accepts it", () => { + for (const modelId of ["muse-spark-1.2-contributor-free", "muse-spark-1.3-contributor-free"]) { + const body = build(modelId, { + tools: [{ ...webSearchTool(), type: "web_search_preview" }], + }); + const tool = toolsOf(body)[0]!; + expect(tool.type).toBe("web_search_preview"); + expect(tool.search_content_types).toEqual(["text", "image"]); + expect(tool.indexed_web_access).toBe(true); + } + }); + test("OpenCode Go applies the same Muse compatibility guard", () => { const body = buildForProvider(ZEN_GO_PROVIDER, "muse-spark-1.3-contributor", { tools: [webSearchTool()], diff --git a/tests/providers/opencode-go-grok46-responses.test.ts b/tests/providers/opencode-go-grok46-responses.test.ts index 19c2addd46..d35fa6cf8c 100644 --- a/tests/providers/opencode-go-grok46-responses.test.ts +++ b/tests/providers/opencode-go-grok46-responses.test.ts @@ -5,6 +5,7 @@ import { getProviderRegistryEntry } from "../../src/providers/registry"; import { resolveWireProtocolOverride } from "../../src/server/adapter-resolve"; import type { OcxProviderConfig } from "../../src/types"; import { withTestTranslatorBudget } from "../helpers/translator-budget"; +import { normalizeOpenCodeGoAdditionalTools } from "../../src/adapters/opencode-go-additional-tools"; const createResponsesPassthroughAdapter = (...args: Parameters<typeof createResponsesPassthroughAdapterProduction>) => withTestTranslatorBudget(createResponsesPassthroughAdapterProduction(...args)); @@ -21,18 +22,22 @@ function provider(baseUrl = "https://opencode.ai/zen/go/v1"): OcxProviderConfig } as OcxProviderConfig; } -function build( +function buildRequest( modelId: string, rawBody: Record<string, unknown>, configuredProvider = provider(), -): Record<string, unknown> { - const request = createResponsesPassthroughAdapter(configuredProvider).buildRequest({ +) { + return createResponsesPassthroughAdapter(configuredProvider).buildRequest({ modelId, context: { messages: [] }, stream: true, options: {}, _rawBody: { model: modelId, input: "ping", ...rawBody }, }, { headers: new Headers() }); +} + +function build(modelId: string, rawBody: Record<string, unknown>, configuredProvider = provider()): Record<string, unknown> { + const request = buildRequest(modelId, rawBody, configuredProvider); return JSON.parse(request.body) as Record<string, unknown>; } @@ -68,7 +73,7 @@ describe("OpenCode Go Grok 4.6 Responses compatibility", () => { expect(body.tools).toEqual([functionTool]); }); - test("drops hosted search from an additional_tools-only request", () => { + test("promotes additional_tools-only declarations before dropping refused hosted search", () => { const functionTool = { type: "function", name: "lookup", parameters: { type: "object" } }; const body = build("grok-4.6", { input: [{ @@ -77,7 +82,8 @@ describe("OpenCode Go Grok 4.6 Responses compatibility", () => { }], }); - expect(body.input).toEqual([{ type: "additional_tools", tools: [functionTool] }]); + expect(body.input).toEqual([]); + expect(body.tools).toEqual([functionTool]); }); test("disables an explicit choice for a removed hosted tool", () => { @@ -133,3 +139,157 @@ describe("OpenCode Go Grok 4.6 Responses compatibility", () => { expect(body.tools).toEqual([{ type: "web_search" }]); }); }); + +describe("OpenCode Go additional_tools placement", () => { + const lookup = { type: "function", name: "lookup", parameters: { type: "object" } }; + const group = (name: string, tools: unknown[]) => ({ type: "namespace", name, tools }); + + test("preserves the canonical namespace dedupe and distinct response aliases", () => { + const raw = { + tools: [lookup, lookup], + input: [ + { type: "additional_tools", tools: [group("functions", [lookup, lookup]), group("alpha", [lookup])] }, + { type: "additional_tools", tools: [group("alpha", [lookup]), group("beta", [lookup])] }, + ], + }; + const original = structuredClone(raw); + const request = buildRequest("gpt-5.6-luna", raw); + const sent = JSON.parse(request.body); + expect(sent.input).toEqual([]); + expect(sent.tools).toEqual([lookup, { ...lookup, name: "alpha__lookup" }, { ...lookup, name: "beta__lookup" }]); + expect(request.convertedRoutedNamespaceToolAliases?.get("alpha__lookup")) + .toEqual({ namespace: "alpha", name: "lookup", kind: "function" }); + expect(request.convertedRoutedNamespaceToolAliases?.get("beta__lookup")) + .toEqual({ namespace: "beta", name: "lookup", kind: "function" }); + expect(raw).toEqual(original); + }); + + test.each(["none", "allowed"])("preserves custom/function lowering and %s authorization", choice => { + const request = buildRequest("gpt-5.6-luna", { + input: [{ type: "additional_tools", tools: [ + group("alpha", [lookup, { type: "custom", name: "custom_probe", description: "Freeform input" }]), + ] }], + tool_choice: choice === "none" ? "none" : { + type: "allowed_tools", mode: "auto", tools: [{ type: "function", namespace: "alpha", name: "lookup" }], + }, + }, { ...provider(), supportsResponsesCustomTools: false }); + const sent = JSON.parse(request.body); + expect(sent.input).toEqual([]); + expect(sent.tools).toEqual(expect.arrayContaining([ + expect.objectContaining({ type: "function", name: "alpha__lookup" }), + expect.objectContaining({ type: "function", name: "alpha__custom_probe" }), + ])); + expect(request.convertedRoutedNamespaceToolAliases?.has("alpha__custom_probe")).toBe(false); + expect(request.convertedRoutedNamespaceToolAliases?.has("alpha__lookup")).toBe(choice === "allowed"); + expect(sent.tool_choice).toEqual(choice === "none" ? "none" : { + type: "allowed_tools", mode: "auto", tools: [{ type: "function", name: "alpha__lookup" }], + }); + }); + + test("keeps nameless hosted tools for Luna and prunes Go Grok selectors after promotion", () => { + const web = { type: "web_search" }; + const raw = { input: [{ type: "additional_tools", tools: [web, lookup] }], tool_choice: { + type: "allowed_tools", mode: "required", tools: [web, { type: "function", name: "lookup" }], + } }; + expect(build("gpt-5.6-luna", raw).tools).toEqual([web, lookup]); + const grok = build("grok-4.6", raw); + expect(grok.tools).toEqual([lookup]); + expect(grok.tool_choice).toEqual({ + type: "allowed_tools", mode: "required", tools: [{ type: "function", name: "lookup" }], + }); + expect(build("grok-4.6", { input: [{ type: "additional_tools", tools: [web] }], tool_choice: "required" })) + .toMatchObject({ input: [], tools: [], tool_choice: "none" }); + }); + + test("activates tools loaded by tool search before moving their catalog", () => { + const sent = build("gpt-5.6-luna", { input: [ + { type: "additional_tools", tools: [{ ...lookup, defer_loading: true }] }, + { type: "tool_search_output", id: "tso_loaded", call_id: "call_search", tools: [lookup] }, + ] }); + expect(sent.tools).toEqual([lookup]); + expect((sent.input as Array<{ type: string }>).some(item => item.type === "additional_tools")).toBe(false); + }); + + test.each(["https://opencode.ai/zen/go/v1/responses", "https://opencode.ai:443/zen/go/v1/responses"])( + "promotes only wrappers on %s without mutating frozen caller data", responseUrl => { + const message = Object.freeze({ type: "message", role: "user", content: "keep" }); + const tools = Object.freeze([lookup]); + const raw = Object.freeze({ input: Object.freeze([message, Object.freeze({ type: "additional_tools", tools })]) }); + const result = normalizeOpenCodeGoAdditionalTools(raw, responseUrl) as { input: unknown[]; tools: unknown[] }; + expect(result).not.toBe(raw); + expect(result.input).toEqual([message]); + expect(result.input[0]).toBe(message); + expect(result.tools).toEqual([lookup]); + expect(result.tools[0]).toBe(lookup); + expect(raw.input).toHaveLength(2); + }, + ); + + test.each([ + { baseUrl: "https://opencode.ai/zen/go/v1" }, + { baseUrl: "https://opencode.ai:443/zen/go/v1/" }, + { baseUrl: "https://opencode.ai/zen/go/v1//" }, + { baseUrl: "https://opencode.ai/zen/go/v1/responses" }, + { baseUrl: "https://opencode.ai", responsesPath: "/zen/go/v1/responses" }, + ])("promotes on the final Go endpoint for $baseUrl", destination => { + const raw = { input: [{ type: "additional_tools", tools: [lookup] }] }; + const request = buildRequest("gpt-5.6-luna", raw, { ...provider(), ...destination }); + expect(new URL(request.url).href).toBe("https://opencode.ai/zen/go/v1/responses"); + expect(JSON.parse(request.body)).toMatchObject({ input: [], tools: [lookup] }); + }); + + test("a custom path overriding a Go base does not inherit Go placement", () => { + const raw = { input: [{ type: "additional_tools", tools: [lookup] }] }; + const request = buildRequest("gpt-5.6-luna", raw, { ...provider(), responsesPath: "/../../v1/responses" }); + expect(new URL(request.url).href).toBe("https://opencode.ai/zen/v1/responses"); + expect(JSON.parse(request.body).input).toEqual(raw.input); + }); + + test.each([ + "https://opencode.ai/zen/go/v1", "https://opencode.ai/zen/go/v1/responses/", + "https://opencode.ai/zen/go/v1//responses", + ])("leaves a noncanonical final resource %s unchanged", responseUrl => { + const raw = { input: [{ type: "additional_tools", tools: [lookup] }] }; + expect(normalizeOpenCodeGoAdditionalTools(raw, responseUrl)).toBe(raw); + }); + + test.each([ + "https://opencode.ai/zen/v1", "https://opencode.ai.evil.test/zen/go/v1", + "http://opencode.ai/zen/go/v1", "https://opencode.ai:444/zen/go/v1", + "https://opencode.ai/zen/go/v10", + (() => { + const url = new URL("https://opencode.ai/zen/go/v1"); + url.username = "fixture-user"; + url.password = "synthetic-password"; + return url.href; + })(), "https://opencode.ai/zen/go/v1?tenant=test", + "https://opencode.ai/zen/go/v1?", "https://opencode.ai/zen/go/v1#", + "https://opencode.ai/zen/go/v1#fragment", "https://example.test/v1", + ])("does not promote for unapproved destination %s", baseUrl => { + const raw = { input: [{ type: "additional_tools", tools: [lookup] }] }; + const request = buildRequest("gpt-5.6-luna", raw, provider(baseUrl)); + expect(normalizeOpenCodeGoAdditionalTools(raw, request.url)).toBe(raw); + expect(JSON.parse(request.body).input).toEqual(raw.input); + }); + + test("keeps forward wrappers and mixed ciphertext unchanged", () => { + const mixed = { type: "agent_message", content: [ + { type: "input_text", text: "Routing header" }, { type: "encrypted_content", encrypted_content: "opaque" }, + ] }; + const raw = { input: [mixed, { type: "additional_tools", tools: [lookup] }] }; + expect(build("gpt-5.6-luna", raw, { ...provider(), authMode: "forward" }).input).toEqual(raw.input); + expect(build("gpt-5.6-luna", raw).input).toEqual([mixed]); + }); + + test("keeps malformed wrappers and no-op bodies; removes a valid empty wrapper", () => { + const valid = { input: [{ type: "additional_tools", tools: [lookup] }] }; + expect(normalizeOpenCodeGoAdditionalTools(valid, "not a URL")).toBe(valid); + for (const raw of [null, [], { input: "ping" }, { input: [] }, + { input: [{ type: "additional_tools", tools: null }] }, + { tools: null, input: [{ type: "additional_tools", tools: [lookup] }] }, + ]) expect(normalizeOpenCodeGoAdditionalTools(raw, "https://opencode.ai/zen/go/v1/responses")).toBe(raw); + const malformed = { type: "additional_tools", tools: null }; + expect(build("gpt-5.6-luna", { input: [malformed, { type: "additional_tools", tools: [] }] })) + .toMatchObject({ input: [malformed], tools: [] }); + }); +}); diff --git a/tests/providers/opencode-go-luna-wire.test.ts b/tests/providers/opencode-go-luna-wire.test.ts index 152783b9bd..c0afb15553 100644 --- a/tests/providers/opencode-go-luna-wire.test.ts +++ b/tests/providers/opencode-go-luna-wire.test.ts @@ -5,13 +5,17 @@ * boundary that lets operators opt out if the upstream changes. */ import { afterEach, describe, expect, test } from "bun:test"; -import { providerConfigSeed } from "../../src/providers/derive"; +import { enrichProviderFromRegistry, providerConfigSeed } from "../../src/providers/derive"; import { getProviderRegistryEntry } from "../../src/providers/registry"; import { resolveWireProtocolOverride } from "../../src/server/adapter-resolve"; import { handleResponses } from "../../src/server/responses/core"; import type { OcxConfig, OcxProviderConfig } from "../../src/types"; +import { createResponsesPassthroughAdapter } from "../../src/adapters/openai-responses"; +import { parseRequest } from "../../src/responses/parser"; +import { withTestTranslatorBudget } from "../helpers/translator-budget"; const MODEL = "gpt-5.6-luna"; +const GO_RESPONSES_MODELS = [MODEL, "grok-4.6", "muse-spark-1.3-contributor"]; function opencodeGo(overrides: Partial<OcxProviderConfig> = {}): OcxProviderConfig { const entry = getProviderRegistryEntry("opencode-go"); @@ -43,6 +47,174 @@ describe("OpenCode Go GPT 5.6 Luna wire selection (#1482)", () => { }); }); +describe("OpenCode Go stateless Responses", () => { + test("seeds and backfills the canonical preset while preserving explicit false and custom names", () => { + expect(opencodeGo().statelessResponses).toBe(true); + const stale = opencodeGo(); + delete stale.statelessResponses; + enrichProviderFromRegistry("opencode-go", stale); + expect(stale.statelessResponses).toBe(true); + const overridden = opencodeGo({ statelessResponses: false }); + enrichProviderFromRegistry("opencode-go", overridden); + expect(overridden.statelessResponses).toBe(false); + const renamed = opencodeGo(); + delete renamed.statelessResponses; + enrichProviderFromRegistry("my-go", renamed); + expect(renamed.statelessResponses).toBeUndefined(); + expect(providerConfigSeed(getProviderRegistryEntry("cerebras")!).statelessResponses).toBeUndefined(); + }); + + test.each(GO_RESPONSES_MODELS)("%s repairs orphan calls/results and preserves paired results", model => { + const input = [ + { type: "function_call", call_id: "call_done", name: "probe", arguments: "{}" }, + { type: "function_call", call_id: "call_missing", name: "probe", arguments: "{}" }, + { type: "function_call_output", call_id: "call_done", output: "actual result" }, + { type: "function_call_output", call_id: "call_unknown", output: "orphan result" }, + ]; + const raw = { model, input, previous_response_id: "resp_unrecorded_go", stream: true }; + const original = structuredClone(raw); + for (const expanded of [false, true]) { + const parsed = parseRequest(raw); + parsed._previousResponseInputExpanded = expanded; + const adapter = withTestTranslatorBudget(createResponsesPassthroughAdapter({ + ...opencodeGo(), adapter: "openai-responses", + })); + const sent = JSON.parse(adapter.buildRequest(parsed).body); + expect(sent.previous_response_id).toBeUndefined(); + expect(sent.store).toBe(false); + expect(sent.input).toEqual([ + input[0], input[1], input[2], + expect.objectContaining({ type: "function_call_output", call_id: "call_missing", output: expect.stringContaining("no tool result was recorded") }), + expect.objectContaining({ type: "message", role: "user", content: expect.any(Array) }), + ]); + expect(JSON.stringify(sent.input[4])).toContain("orphan result"); + expect(raw).toEqual(original); + } + const stateful = withTestTranslatorBudget(createResponsesPassthroughAdapter({ + ...opencodeGo({ statelessResponses: false }), adapter: "openai-responses", + })); + const sent = JSON.parse(stateful.buildRequest(parseRequest(raw)).body); + expect(sent.previous_response_id).toBe("resp_unrecorded_go"); + expect(sent.store).not.toBe(false); + expect(sent.input).toEqual(input); + }); +}); + +describe("OpenCode Go stateless reasoning and continuation routes", () => { + const originalFetch = globalThis.fetch; + afterEach(() => { globalThis.fetch = originalFetch; }); + + const continuations = [ + { id: "full", name: "full history", fullHistory: true, summary: "auto" }, + { id: "delta", name: "delta", fullHistory: false, summary: "auto" }, + { id: "hidden", name: "hidden-summary full history", fullHistory: true, summary: "none" }, + ]; + for (const model of GO_RESPONSES_MODELS) for (const streaming of [true, false]) for (const continuation of continuations) { + test(`${model} preserves ${continuation.name} across two ${streaming ? "SSE" : "JSON"} turns`, async () => { + const requests: Array<{ url: string; body: Record<string, unknown> }> = []; + // Opaque synthetic provider state, never a real credential or decrypted task. + const blob = "provider-minted-go-reasoning-state"; + const prefix = `${model.replaceAll(".", "_")}_${streaming ? "sse" : "json"}_${continuation.id}`; + const reasoning = [ + { type: "reasoning", id: `rs_${prefix}_summary`, status: "completed", summary: [{ type: "summary_text", text: "Already summarized" }] }, + { type: "reasoning", id: `rs_${prefix}_content`, status: "completed", content: [{ type: "reasoning_text", text: "Visible thinking" }], summary: [] }, + { type: "reasoning", id: `rs_${prefix}_blob`, status: "completed", content: [{ type: "reasoning_text", text: "Opaque item trace" }], summary: [], encrypted_content: blob }, + ]; + const call = { type: "function_call", id: `fc_${prefix}`, status: "completed", call_id: `call_${prefix}`, name: "probe", arguments: "{}" }; + const priorMessage = { type: "message", id: `msg_${prefix}_prior`, status: "completed", role: "assistant", + content: [{ type: "output_text", text: "Probe requested", annotations: [] }], + }; + globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => { + requests.push({ url: String(input), body: JSON.parse(String(init?.body ?? "{}")) }); + const output = requests.length === 1 ? [...reasoning, call, priorMessage] : [{ + type: "message", id: `msg_${prefix}`, status: "completed", role: "assistant", + content: [{ type: "output_text", text: "Continuation accepted", annotations: [] }], + }]; + const response = { id: `resp_${prefix}_${requests.length}`, object: "response", status: "completed", model, output }; + if (!streaming) return Response.json(response); + const payloads: Record<string, unknown>[] = [{ type: "response.created", response: { ...response, status: "in_progress", output: [] } }]; + for (const [index, item] of output.entries()) { + payloads.push({ type: "response.output_item.added", output_index: index, item }); + if (requests.length === 1 && index === 1) payloads.push({ + type: "response.reasoning_text.delta", item_id: item.id, output_index: index, content_index: 0, delta: "Visible thinking", + }); + payloads.push({ type: "response.output_item.done", output_index: index, item }); + } + payloads.push({ type: "response.completed", response }); + return new Response(payloads.map((payload, sequence_number) => + `data: ${JSON.stringify({ ...payload, sequence_number })}\n\n` + ).join("") + "data: [DONE]\n\n", { headers: { "content-type": "text/event-stream" } }); + }) as typeof fetch; + const config = { providers: { "opencode-go": opencodeGo() } } as unknown as OcxConfig; + const drive = async (body: Record<string, unknown>) => { + const response = await handleResponses(new Request("http://localhost/v1/responses", { + method: "POST", headers: { "content-type": "application/json" }, + body: JSON.stringify({ model: `opencode-go/${model}`, stream: streaming, reasoning: { summary: continuation.summary }, + tools: [{ type: "function", name: "probe", parameters: { type: "object" } }], ...body }), + }), config, { model: "", provider: "" }, { inboundWire: "responses" }); + expect(response.status).toBe(200); + const text = await response.text(); + if (!streaming) return { document: JSON.parse(text), text }; + const events = text.split("\n").filter(line => line.startsWith("data: {")).map(line => JSON.parse(line.slice(6))); + const terminal = events.find(event => event.type === "response.completed"); + expect(terminal).toBeDefined(); + return { document: terminal.response, text }; + }; + const initial = { type: "message", role: "user", content: [{ type: "input_text", text: "Run probe" }] }; + const first = await drive({ input: [initial] }); + expect(first.document.output[0]).toEqual(reasoning[0]); + expect(first.document.output[1]).toEqual(continuation.summary === "auto" ? { + type: "reasoning", id: `rs_${prefix}_content`, status: "completed", summary: [{ type: "summary_text", text: "Visible thinking" }], + } : reasoning[1]); + expect(first.document.output[2]).toEqual(reasoning[2]); + expect(first.document.output[3]).toMatchObject(call); + expect(first.document.output[4]).toEqual(priorMessage); + if (streaming) { + const channel = continuation.summary === "auto" ? "reasoning_summary_text" : "reasoning_text"; + expect(first.text).toContain(`"type":"response.${channel}.delta"`); + } + const result = { type: "function_call_output", call_id: call.call_id, output: "probe succeeded" }; + // Echo exactly the client-visible history through handleResponses. An upstream-shape + // cache would prepend it again after the content-to-summary rewrite (F1). + const nextBody = { + input: continuation.fullHistory ? [initial, ...first.document.output, result] : [result], + previous_response_id: first.document.id, store: true, + conversation: "conversation_fixture", background: true, metadata: { fixture: "go" }, prompt: { id: "prompt_fixture" }, + }; + const originalHistory = structuredClone(nextBody); + const second = await drive(nextBody); + for (const field of ["previous_response_id", "conversation", "background", "metadata", "prompt"]) { + expect(requests[1]!.body[field]).toBeUndefined(); + } + expect(nextBody).toEqual(originalHistory); + expect(second.text).toContain("Continuation accepted"); + expect(requests).toHaveLength(2); + for (const request of requests) { + expect(request.url).toBe("https://opencode.ai/zen/go/v1/responses"); + expect(request.body.previous_response_id).toBeUndefined(); + expect(request.body.store).toBe(false); + expect(request.body.stream).toBe(streaming); + } + const replay = requests[1]!.body.input as Array<Record<string, unknown>>; + expect(replay.filter(item => item.type === "function_call")).toEqual([ + expect.objectContaining({ call_id: call.call_id, name: "probe", arguments: "{}" }), + ]); + expect(replay.filter(item => item.type === "function_call_output")).toEqual([result]); + expect(replay.filter(item => item.type === "message" && item.role === "user")).toEqual([initial]); + expect(replay.filter(item => item.type === "message" && item.role === "assistant")).toEqual([ + expect.objectContaining({ role: "assistant", content: priorMessage.content }), + ]); + expect(replay.filter(item => item.type === "reasoning")).toHaveLength(3); + expect(replay).toContainEqual(expect.objectContaining({ type: "reasoning", encrypted_content: blob })); + expect(JSON.stringify(replay)).toContain("Already summarized"); + if (continuation.summary === "auto") expect(replay).toContainEqual(expect.objectContaining({ + type: "reasoning", summary: [{ type: "summary_text", text: "Visible thinking" }], + })); + expect(JSON.stringify(replay)).not.toContain("no tool result was recorded"); + }); + } +}); + describe("OpenCode Go Luna Responses route (#1482)", () => { const originalFetch = globalThis.fetch; afterEach(() => { globalThis.fetch = originalFetch; }); diff --git a/tests/providers/opencode-go-session-header.test.ts b/tests/providers/opencode-go-session-header.test.ts index ab28c8475f..c176dc703e 100644 --- a/tests/providers/opencode-go-session-header.test.ts +++ b/tests/providers/opencode-go-session-header.test.ts @@ -4,6 +4,7 @@ import { resolveOpenCodeGoTransport } from "../../src/providers/opencode-go-tran import { getProviderRegistryEntry } from "../../src/providers/registry"; import { handleResponses } from "../../src/server/responses/core"; import { handleChatCompletions } from "../../src/server/chat-completions"; +import { handleClaudeMessages } from "../../src/server/claude-messages"; import type { OcxConfig, OcxProviderConfig } from "../../src/types"; const MUSE_MODEL = "muse-spark-1.3-contributor"; @@ -25,7 +26,14 @@ function codexHeaders(child = "child-thread-a"): Record<string, string> { }; } -function upstreamResponse(url: string): Response { +function upstreamResponse(url: string, stream = false): Response { + if (stream && url.endsWith("/chat/completions")) { + return new Response([ + `data: ${JSON.stringify({ choices: [{ index: 0, delta: { role: "assistant", content: "ok" } }] })}\n\n`, + `data: ${JSON.stringify({ choices: [{ index: 0, delta: {}, finish_reason: "stop" }], usage: { prompt_tokens: 1, completion_tokens: 1 } })}\n\n`, + "data: [DONE]\n\n", + ].join(""), { headers: { "content-type": "text/event-stream" } }); + } if (url.endsWith("/responses")) { return Response.json({ id: "resp_opencode_go_session", @@ -54,6 +62,8 @@ async function captureRequest(input: { child?: string; provider?: OcxProviderConfig; nativeChat?: boolean; + claude?: boolean; + metadataUserId?: string; headers?: Record<string, string>; } = {}): Promise<{ url: string; headers: Headers }> { const providerName = input.providerName ?? "opencode-go"; @@ -62,13 +72,26 @@ async function captureRequest(input: { globalThis.fetch = (async (requestInput: RequestInfo | URL, init?: RequestInit) => { const url = String(requestInput); requests.push({ url, headers: new Headers(init?.headers) }); - return upstreamResponse(url); + return upstreamResponse(url, input.claude); }) as typeof fetch; const config = { providers: { [providerName]: input.provider ?? opencodeGo() }, } as unknown as OcxConfig; - const response = input.nativeChat ? await handleChatCompletions( + const response = input.claude ? await handleClaudeMessages( + new Request("http://localhost/v1/messages", { + method: "POST", + headers: input.headers ?? { "content-type": "application/json" }, + body: JSON.stringify({ + model: `${providerName}/${model}`, max_tokens: 64, stream: false, + system: "A shared system prompt is not a conversation identifier.", + messages: [{ role: "user", content: "ping" }], + ...(input.metadataUserId !== undefined ? { metadata: { user_id: input.metadataUserId } } : {}), + }), + }), + config, + { model: "", provider: "" }, + ) : input.nativeChat ? await handleChatCompletions( new Request("http://localhost/v1/chat/completions", { method: "POST", headers: input.headers ?? codexHeaders(input.child), @@ -97,6 +120,118 @@ describe("OpenCode Go session affinity (#3344)", () => { const originalFetch = globalThis.fetch; afterEach(() => { globalThis.fetch = originalFetch; }); + test("Claude metadata gives stable Go affinity across turns and distinct conversations", async () => { + const input = { claude: true, model: CHAT_MODEL, metadataUserId: "user_test_account__session_conversation-a" }; + const first = await captureRequest(input); + const continued = await captureRequest(input); + const next = await captureRequest({ ...input, metadataUserId: "user_test_account__session_conversation-b" }); + expect(first.url).toBe("https://opencode.ai/zen/go/v1/chat/completions"); + // Fixed SHA-256 vectors calculated independently of the production helpers. + expect(first.headers.get(SESSION_HEADER)).toBe("ocx_a89540229ef781fd5f7adf92a711b436"); + expect(continued.headers.get(SESSION_HEADER)).toBe("ocx_a89540229ef781fd5f7adf92a711b436"); + expect(next.headers.get(SESSION_HEADER)).toBe("ocx_55fec02e7f2c7f9358958ab6d1589530"); + expect(first.headers.get(SESSION_HEADER)).not.toContain("conversation-a"); + }); + + test("Claude recognizes renamed canonical Go destinations and omits shared system affinity", async () => { + const input = { claude: true, model: CHAT_MODEL, providerName: "renamed-go" }; + const metadata = await captureRequest({ ...input, metadataUserId: "user_test_account__session_conversation-a" }); + const desktop = await captureRequest(input); + expect(metadata.headers.get(SESSION_HEADER)).toBe("ocx_a89540229ef781fd5f7adf92a711b436"); + expect(desktop.headers.has(SESSION_HEADER)).toBe(false); + }); + + test("Claude explicit Go header precedes metadata and matches native Chat affinity", async () => { + const headers = { "content-type": "application/json", [SESSION_HEADER]: "client-session-a" }; + const claude = await captureRequest({ claude: true, model: CHAT_MODEL, headers, metadataUserId: "different-metadata-session" }); + const chat = await captureRequest({ nativeChat: true, model: CHAT_MODEL, headers }); + expect(claude.headers.get(SESSION_HEADER)).toBe("ocx_516d593899f34b7baca2db37c7b0c8c5"); + expect(chat.headers.get(SESSION_HEADER)).toBe("ocx_516d593899f34b7baca2db37c7b0c8c5"); + }); + + test("Claude affinity survives per-model Responses wire selection", async () => { + const input = { claude: true, metadataUserId: "user_test_account__session_conversation-a" }; + const chat = await captureRequest({ ...input, model: CHAT_MODEL }); + const responses = await captureRequest({ ...input, model: MUSE_MODEL }); + expect(responses.url).toBe("https://opencode.ai/zen/go/v1/responses"); + expect(chat.headers.get(SESSION_HEADER)).toBe("ocx_a89540229ef781fd5f7adf92a711b436"); + expect(responses.headers.get(SESSION_HEADER)).toBe("ocx_a89540229ef781fd5f7adf92a711b436"); + const explicit = await captureRequest({ + ...input, model: MUSE_MODEL, + headers: { "content-type": "application/json", [SESSION_HEADER]: "client-session-a" }, + }); + expect(explicit.headers.get(SESSION_HEADER)).toBe("ocx_516d593899f34b7baca2db37c7b0c8c5"); + }); + + for (const [model, url] of [ + [CHAT_MODEL, "https://opencode.ai/zen/go/v1/chat/completions"], + [MUSE_MODEL, "https://opencode.ai/zen/go/v1/responses"], + ] as const) { + test(`Claude ${model} falls back to valid metadata after invalid explicit Go identity`, async () => { + // Interior tab is constructible in HTTP Headers but rejected by the identity owner. + for (const session of ["", " ", "invalid\tidentity", "x".repeat(4097)]) { + const captured = await captureRequest({ + claude: true, model, metadataUserId: "user_test_account__session_conversation-a", + headers: { "content-type": "application/json", [SESSION_HEADER]: session }, + }); + expect(captured.url).toBe(url); + expect(captured.headers.get(SESSION_HEADER)).toBe("ocx_a89540229ef781fd5f7adf92a711b436"); + const invalidLane = await captureRequest({ + claude: true, model, metadataUserId: "user_test_account__session_conversation-a", + headers: { "content-type": "application/json", session_id: session }, + }); + expect(invalidLane.url).toBe(url); + expect(invalidLane.headers.get(SESSION_HEADER)).toBe("ocx_a89540229ef781fd5f7adf92a711b436"); + } + }); + + test(`Claude ${model} omits Go affinity without usable metadata identity`, async () => { + for (const metadataUserId of [undefined, "", " \t\n ", "invalid\u0000identity", "x".repeat(4097)]) { + const captured = await captureRequest({ claude: true, model, metadataUserId }); + expect(captured.url).toBe(url); + expect(captured.headers.has(SESSION_HEADER)).toBe(false); + expect(captured.headers.has("session_id")).toBe(false); + } + }); + + test(`Claude ${model} keeps explicit and operator identity with empty metadata`, async () => { + const input = { + claude: true, model, metadataUserId: "", + headers: { "content-type": "application/json", [SESSION_HEADER]: " client-session-a " }, + }; + const explicit = await captureRequest(input); + expect(explicit.url).toBe(url); + expect(explicit.headers.get(SESSION_HEADER)).toBe("ocx_516d593899f34b7baca2db37c7b0c8c5"); + const operator = await captureRequest({ ...input, provider: opencodeGo({ headers: { "X-OpenCode-Session": "operator-session" } }) }); + expect(operator.url).toBe(url); + expect(operator.headers.get(SESSION_HEADER)).toBe("operator-session"); + }); + + test(`Claude ${model} preserves explicit session lanes and operator header precedence`, async () => { + for (const laneHeader of ["session_id", "session-id", "thread-id", "x-codex-parent-thread-id"]) { + const headers = { "content-type": "application/json", [laneHeader]: "native-client-session", [SESSION_HEADER]: "different-fallback" }; + const input = { claude: true, model, headers, metadataUserId: "different-metadata-session" }; + const claude = await captureRequest(input); + expect(claude.url).toBe(url); + expect(claude.headers.get(SESSION_HEADER)).toBe("ocx_a197dbb87311c29a5fbe51140e3845ce"); + const operator = await captureRequest({ ...input, provider: opencodeGo({ headers: { "X-OpenCode-Session": "operator-session" } }) }); + expect(operator.url).toBe(url); + expect(operator.headers.get(SESSION_HEADER)).toBe("operator-session"); + } + }); + } + + test("Claude does not add Go affinity to custom or lookalike destinations", async () => { + for (const baseUrl of ["https://custom.example/v1", "https://opencode.ai.evil.test/zen/go/v1"]) { + const captured = await captureRequest({ + claude: true, model: CHAT_MODEL, providerName: "custom-go", + provider: opencodeGo({ baseUrl }), metadataUserId: "user_test_account__session_conversation-a", + headers: { "content-type": "application/json", [SESSION_HEADER]: "client-session-a" }, + }); + expect(captured.headers.has(SESSION_HEADER)).toBe(false); + } + }); + test("native Chat ingress preserves stable Go affinity and separates conversations", async () => { const provider = opencodeGo(); const input = { nativeChat: true, model: "omen-alpha", provider }; diff --git a/tests/providers/provider-connection-test.test.ts b/tests/providers/provider-connection-test.test.ts index aefcad49c9..0a9af797fd 100644 --- a/tests/providers/provider-connection-test.test.ts +++ b/tests/providers/provider-connection-test.test.ts @@ -316,6 +316,40 @@ describe("POST /api/providers/test (WP040 connectivity probe)", () => { }); }); + test("Nous probe accepts 390 synthetic paid/free rows above 256 KiB (#3939)", async () => { + const payload = JSON.stringify({ + data: Array.from({ length: 390 }, (_, index) => ({ + id: index === 0 ? "tencent/hy3:free" : `vendor/model-${index}`, + metadata: { description: "x".repeat(1_400) }, + })), + }); + const bytes = new TextEncoder().encode(payload).byteLength; + expect(bytes).toBeGreaterThan(262_144); + expect(bytes).toBeLessThan(1_048_576); + let fetches = 0; + globalThis.fetch = (async (input, init) => { + fetches += 1; + expect(String(input)).toBe("https://inference-api.nousresearch.com/v1/models"); + expect(init?.method ?? "GET").toBe("GET"); + expect(new Headers(init?.headers).get("authorization")).toBe("Bearer access-token-nous-probe-fixture"); + return new Response(payload, { headers: { "content-type": "application/json" } }); + }) as typeof fetch; + await saveCredential("nous", { + access: "access-token-nous-probe-fixture", + refresh: "nous-probe-fixture-refresh", + expires: Date.now() + 3_600_000, + }); + const config = baseConfig({ + nous: { ...structuredClone(OAUTH_PROVIDERS.nous!.providerConfig) }, + }); + + const { status, body } = await probe(config, "nous"); + + expect(status).toBe(200); + expect(fetches).toBe(1); + expect(body).toMatchObject({ ok: true, models: 390 }); + }); + test("Google's models-array response shape is accepted (x-goog-api-key path)", async () => { let requestedUrl = ""; globalThis.fetch = (async (input: RequestInfo | URL) => { diff --git a/tests/providers/provider-model-aliases.test.ts b/tests/providers/provider-model-aliases.test.ts index d326a8562e..5ba8b5981e 100644 --- a/tests/providers/provider-model-aliases.test.ts +++ b/tests/providers/provider-model-aliases.test.ts @@ -217,6 +217,50 @@ describe("provider and model aliases", () => { routeReason: "explicit-provider-namespace", }); }); + test.each(["agy", "AgY"])("canonical provider name %s suppresses a colliding built-in alias", async canonicalName => { + const c = { + port: 10100, + defaultProvider: "google-antigravity", + providers: { + [canonicalName]: { + adapter: "openai-chat", + baseUrl: "https://custom.test/v1", + models: ["gemini-3.8-flash"], + liveModels: false, + }, + "google-antigravity": { + adapter: "google", + baseUrl: "https://daily-cloudcode-pa.googleapis.com", + authMode: "oauth", + models: ["gemini-3.8-flash"], + liveModels: false, + }, + }, + } as unknown as OcxConfig; + + const models = await gatherRoutedModels(c); + const googleModel = models.find(m => m.provider === "google-antigravity" && m.id === "gemini-3.8-flash")!; + expect(googleModel.providerAlias).toBeNull(); + + const [googleEntry] = buildCatalogEntries(null, [], [googleModel]); + expect(googleEntry!.display_name).toBe("google-antigravity/gemini-3.8-flash"); + expect(routeModel(c, googleEntry!.display_name)).toMatchObject({ + providerName: "google-antigravity", + modelId: "gemini-3.8-flash", + }); + expect(routeModel(c, `${canonicalName}/gemini-3.8-flash`)).toMatchObject({ + providerName: canonicalName, + modelId: "gemini-3.8-flash", + }); + + // Canonical names stay case-sensitive. A case variant must not activate the + // claimed registry alias; preserve the unknown slash-id default fallback. + expect(routeModel({ ...c, defaultProvider: canonicalName }, "AGY/gemini-3.8-flash")).toMatchObject({ + providerName: canonicalName, + modelId: "AGY/gemini-3.8-flash", + routeReason: "default-provider", + }); + }); test("static gather (liveModels: false) suppresses agy when other provider explicitly owns it", async () => { const c = { port: 10100, diff --git a/tests/providers/provider-model-discovery-contract.test.ts b/tests/providers/provider-model-discovery-contract.test.ts index b55cbcd32e..4687594379 100644 --- a/tests/providers/provider-model-discovery-contract.test.ts +++ b/tests/providers/provider-model-discovery-contract.test.ts @@ -1,10 +1,12 @@ -import { afterEach, describe, expect, spyOn, test } from "bun:test"; -import { readFileSync } from "node:fs"; +import { afterEach, beforeEach, describe, expect, spyOn, test } from "bun:test"; +import { mkdtempSync, readFileSync } from "node:fs"; +import { tmpdir } from "node:os"; import { join } from "node:path"; import { gatherRoutedModels } from "../../src/codex/catalog"; import { catalogHintsFromModelsApiItem } from "../../src/codex/catalog/provider-fetch"; -import { clearModelCache, getFreshCached, setCached } from "../../src/codex/model-cache"; +import { clearModelCache, getFreshCached, getProviderDiscoveryStatus, getProviderLiveModelCount, setCached } from "../../src/codex/model-cache"; import { buildModelsRequest } from "../../src/oauth"; +import { saveCredential } from "../../src/oauth/store"; import { KEY_LOGIN_PROVIDERS, validateApiKey } from "../../src/oauth/key-providers"; import { deriveKeyLoginMap, providerConfigSeed } from "../../src/providers/derive"; import { @@ -25,6 +27,7 @@ import type { OcxConfig, OcxProviderConfig } from "../../src/types"; import { withStubbedProviderFetch } from "../helpers/catalog-provider-fetch"; import { withRegistryDiscovery } from "../helpers/provider-registry-discovery"; import { fixturePath } from "../helpers/repo-root"; +import { removeTreeWithRetry } from "../helpers/remove-tree"; const FIXTURE = readFileSync(fixturePath("provider-model-discovery.json"), "utf8"); const originalFetch = globalThis.fetch; @@ -428,6 +431,79 @@ describe("registry-owned provider model discovery", () => { expect(cancelled).toBe(true); }); + describe("Nous native catalog response cap (#3939)", () => { + let previousHome: string | undefined; + let credentialHome: string; + + beforeEach(async () => { + previousHome = process.env.OPENCODEX_HOME; + credentialHome = mkdtempSync(join(tmpdir(), "ocx-nous-discovery-")); + process.env.OPENCODEX_HOME = credentialHome; + clearModelCache("nous"); + await saveCredential("nous", { + access: "access-token-nous-discovery-fixture", + refresh: "nous-discovery-fixture-refresh", + expires: Date.now() + 3_600_000, + }); + }); + + afterEach(() => { + clearModelCache("nous"); + if (previousHome === undefined) delete process.env.OPENCODEX_HOME; + else process.env.OPENCODEX_HOME = previousHome; + removeTreeWithRetry(credentialHome); + }); + + test("gathers and caches 390 synthetic paid/free rows above 256 KiB", async () => { + const entry = PROVIDER_REGISTRY.find(row => row.id === "nous"); + if (!entry) throw new Error("missing nous registry entry"); + const payload = JSON.stringify({ + data: Array.from({ length: 390 }, (_, index) => ({ + id: index === 0 ? "tencent/hy3:free" : `vendor/model-${index}`, + metadata: { description: "x".repeat(1_400) }, + })), + }); + const bytes = new TextEncoder().encode(payload).byteLength; + expect(bytes).toBeGreaterThan(262_144); + expect(bytes).toBeLessThan(1_048_576); + + let fetches = 0; + globalThis.fetch = (async (input, init) => { + fetches += 1; + expect(String(input)).toBe("https://inference-api.nousresearch.com/v1/models"); + expect(init?.method ?? "GET").toBe("GET"); + expect(new Headers(init?.headers).get("authorization")).toBe("Bearer access-token-nous-discovery-fixture"); + return new Response(payload, { headers: { "content-type": "application/json" } }); + }) as typeof fetch; + const config = withStubbedProviderFetch<OcxConfig>({ + defaultProvider: "nous", + providers: { nous: { ...providerConfigSeed(entry), models: ["safe-fallback"] } }, + }); + const discovery = resolveProviderModelDiscovery("nous", config.providers.nous!); + expect(discovery.maxResponseBytes).toBe(1_048_576); + expect(discovery.maxModels).toBe(512); + const warning = spyOn(console, "warn").mockImplementation(() => {}); + try { + const models = (await gatherRoutedModels(config)).filter(model => model.provider === "nous"); + expect(fetches).toBe(1); + expect(models).toHaveLength(390); + const ids = models.map(model => model.id); + expect(ids).toContain("tencent/hy3:free"); + expect(ids).toContain("vendor/model-1"); + expect(ids).toContain("vendor/model-389"); + expect(ids).not.toContain("safe-fallback"); + // Gather sorts its published rows; the cache retains upstream order. + expect(getFreshCached("nous", 60_000)?.map(model => model.id).sort()).toEqual([...ids].sort()); + expect(getProviderLiveModelCount("nous")).toBe(390); + expect(getProviderDiscoveryStatus("nous")).toEqual({ status: "ok" }); + expect((await gatherRoutedModels(config)).filter(model => model.provider === "nous")).toEqual(models); + expect(fetches).toBe(1); + } finally { + warning.mockRestore(); + } + }); + }); + test("rejects invalid UTF-8 before JSON parsing", async () => { const invalidUtf8Json = new Uint8Array([ 0x7b, 0x22, 0x78, 0x22, 0x3a, 0x22, 0xc3, 0x28, 0x22, 0x7d, diff --git a/tests/responses/passthrough-abort.test.ts b/tests/responses/passthrough-abort.test.ts index 6fdc468b1b..46100c6902 100644 --- a/tests/responses/passthrough-abort.test.ts +++ b/tests/responses/passthrough-abort.test.ts @@ -79,7 +79,7 @@ describe("passthrough relayWithAbort (RC2, passthrough path)", () => { expect(sseBranch).toContain("rewriteBlocks: clientBlockRewrite"); // Elsewhere the failed-tail relay converts mid-stream resets into a clean response.failed. expect(sseBranch).toMatch( - /relaySseWithFailedTail\(\s*rewrittenBody,\s*upstream,\s*reason\s*=>\s*clientGone\.abort\(reason\),\s*\{\s*upstreamError:\s*logCtx\.upstreamError\s*\},\s*\)/, + /relaySseWithFailedTail\(\s*rewrittenBody,\s*upstream,\s*reason\s*=>\s*\{\s*responseCompletionCancelled\s*=\s*true;\s*clientGone\.abort\(reason\);\s*\},\s*\{\s*upstreamError:\s*logCtx\.upstreamError\s*\},\s*\)/, ); expect(sseBranch).toContain("new Response(clientBody"); expect(sseBranch).toContain("markNativePassthroughSseResponse"); diff --git a/tests/responses/responses-account-label.test.ts b/tests/responses/responses-account-label.test.ts index b7be5c8d7f..e96c4556d9 100644 --- a/tests/responses/responses-account-label.test.ts +++ b/tests/responses/responses-account-label.test.ts @@ -190,6 +190,65 @@ describe("Responses account usage attribution", () => { } }); + test("late WS quota from a replaced pool credential cannot repopulate cleared state", async () => { + const originalWebSocket = globalThis.WebSocket; + let releaseFinalQuota!: () => void; + const finalQuotaAllowed = new Promise<void>(resolve => { releaseFinalQuota = resolve; }); + try { + await withPoolHome(async () => { + savePoolCredential("pool-ws-replaced"); + class MetadataSocket { + listeners = new Map<string, Array<(event: unknown) => void>>(); + constructor() { queueMicrotask(() => this.emit("open", {})); } + addEventListener(type: string, listener: (event: unknown) => void) { + this.listeners.set(type, [...(this.listeners.get(type) ?? []), listener]); + } + removeEventListener(type: string, listener: (event: unknown) => void) { + this.listeners.set(type, (this.listeners.get(type) ?? []).filter(value => value !== listener)); + } + emit(type: string, event: unknown) { + for (const listener of this.listeners.get(type) ?? []) listener(event); + } + send() { + const payload = (value: unknown) => this.emit("message", { data: JSON.stringify(value) }); + queueMicrotask(() => { + payload({ type: "codex.rate_limits", rate_limits: { + primary: { used_percent: 10, window_minutes: 10080 }, + } }); + payload({ type: "response.created", response: { id: "quota-response" } }); + void finalQuotaAllowed.then(() => { + payload({ type: "codex.rate_limits", rate_limits: { + primary: { used_percent: 100, window_minutes: 10080 }, + } }); + payload({ type: "response.completed", response: { id: "quota-response", status: "completed", output: [] } }); + }); + }); + } + close() { this.emit("close", {}); } + } + globalThis.WebSocket = MetadataSocket as unknown as typeof WebSocket; + globalThis.fetch = (async () => { throw new Error("unexpected HTTP request"); }) as typeof fetch; + const response = await handleResponses(new Request("http://localhost/v1/responses", { + method: "POST", headers: { "content-type": "application/json" }, + body: JSON.stringify({ model: "gpt-5.5", input: "hello", stream: true }), + }), poolConfig(["pool-ws-replaced"]), { model: "", provider: "" }, { + codexWsRuntimeIdentity: "1.4.0", + }); + expect(getAccountQuota("pool-ws-replaced")?.weeklyPercent).toBe(10); + + savePoolCredential("pool-ws-replaced"); + clearAccountQuota("pool-ws-replaced"); + releaseFinalQuota(); + await response.text(); + + expect(getAccountQuota("pool-ws-replaced")).toBeNull(); + }); + } finally { + releaseFinalQuota(); + globalThis.WebSocket = originalWebSocket; + } + }); + test("main-pool and legacy added accounts carry their effective labels", async () => { await withPoolHome(async home => { writeFileSync(join(home, "auth.json"), JSON.stringify({ diff --git a/tests/responses/responses-compaction-routing.test.ts b/tests/responses/responses-compaction-routing.test.ts index 2a1f69be1e..fafbbd6806 100644 --- a/tests/responses/responses-compaction-routing.test.ts +++ b/tests/responses/responses-compaction-routing.test.ts @@ -1,3 +1,5 @@ +import { clearComboSelectionState, clearComboTargetCooldowns } from "../../src/combos"; +import { sessionLaneIdFromRequest } from "../../src/server/request-log-conversation"; /** * Issue #422: a Responses-shaped wire does not imply support for Codex's private * `compaction_trigger` item. Only the canonical ChatGPT backend speaks that @@ -35,6 +37,8 @@ import { supportsNativeResponsesCompactEndpoint } from "../../src/providers/open import type { RequestLogContext } from "../../src/server/request-log"; import { acquireNativeMainProfileDrain, tryAdmitTurn } from "../../src/server/lifecycle"; import type { OcxConfig, OcxProviderConfig } from "../../src/types"; +import { clearComboRecallForTests, recallComboForLane, rememberComboForLane } from "../../src/server/responses/combo-session-recall"; +import { captureConfigGeneration } from "../../src/lib/state-store-sweeper"; import { removeTreeWithRetry } from "../helpers/remove-tree"; const originalFetch = globalThis.fetch; @@ -949,6 +953,90 @@ describe("compact alternate-account attempt (#913)", () => { }); } + for (const version of ["v1", "v2"] as const) { + test(`${version} recalled native combo reselects the current account and respects admission refusal`, async () => { + await withPoolEnv("ocx-combo-recall-account-", async config => { + clearComboRecallForTests(); + clearComboSelectionState(); + clearComboTargetCooldowns(); + config.combos = { native: { targets: [{ provider: "openai", model: "gpt-5.5" }] } }; + config.codexAccountNamespaces = { side: "pool-a" }; + const headers = { session_id: "account-recall" }; + const accounts: Array<string | null> = []; + // Fix the selected account deterministically while retaining the real credential + // and admission owner; an explicit namespace still owns its account selection. + const resolver = authContextModule.resolveCodexAuthContext; + const authSpy = spyOn(authContextModule, "resolveCodexAuthContext").mockImplementation( + (incoming, liveConfig, mode, options = {}) => resolver(incoming, liveConfig, mode, { + ...options, accountId: options.accountId ?? liveConfig.activeCodexAccountId, + }), + ); + globalThis.fetch = (async (input: string | URL | Request, init?: RequestInit) => { + const request = new Request(input, init); + accounts.push(request.headers.get("chatgpt-account-id")); + const body = await request.json() as { input?: Array<{ type?: string }> }; + if (request.url.endsWith("/responses/compact")) { + return jsonResponse({ output: [{ type: "compaction", encrypted_content: "native-recall-ciphertext" }] }); + } + const compact = Array.isArray(body.input) && body.input.some(item => item.type === "compaction_trigger"); + return sseResponse([{ type: "response.completed", response: { + ...completedPayload("native answer"), model: "gpt-5.5", + ...(compact ? { output: [{ type: "compaction", encrypted_content: "native-recall-ciphertext" }] } : {}), + } }]); + }) as typeof fetch; + const client = new AbortController(); + let completionTimer: ReturnType<typeof setTimeout> | undefined; + try { + let complete!: () => void; + const completed = new Promise<void>(resolve => { complete = resolve; }); + const seedWork = (async () => { + const seed = await handleResponses(compactionRequest({ model: "combo/native", stream: true, input: "hello" }, client.signal, headers), + config, { model: "", provider: "" }, { onResponseComplete: complete, abortSignal: client.signal }); + expect(seed.status).toBe(200); + await seed.text(); + await completed; + })(); + await Promise.race([ + seedWork, + new Promise<never>((_, reject) => { + completionTimer = setTimeout(() => reject(new Error("native combo seed did not complete")), 10_000); + }), + ]); + clearTimeout(completionTimer); + completionTimer = undefined; + expect(recallComboForLane(config, sessionLaneIdFromRequest(new Headers({ session_id: "account-recall" })), "gpt-5.5")).toBe("native"); + config.activeCodexAccountId = "pool-b"; + const compact = version === "v1" ? handleResponsesCompact : handleResponses; + const log: RequestLogContext = { model: "", provider: "" }; + const response = await compact(compactionRequest(baseCompactionBody({ model: "gpt-5.5", stream: true }), client.signal, headers), config, log); + expect(response.status).toBe(200); + await response.text(); + expect(log.comboId).toBe("native"); + expect(accounts).toEqual(["pool_acc_a", "pool_acc_b"]); + + const explicitLog: RequestLogContext = { model: "", provider: "" }; + const explicit = await compact(compactionRequest(baseCompactionBody({ model: "side/gpt-5.5", stream: true }), client.signal, headers), config, explicitLog); + expect(explicit.status).toBe(200); + await explicit.text(); + expect(explicitLog.comboId).toBeUndefined(); + expect(accounts.at(-1)).toBe("pool_acc_a"); + const sends = accounts.length; + authSpy.mockRejectedValue(new authContextModule.CodexMainProfileDrainingError()); + const refused = await compact(compactionRequest(baseCompactionBody({ model: "gpt-5.5", stream: true }), client.signal, headers), config, { model: "", provider: "" }); + expect(refused.status).toBe(503); + expect(accounts).toHaveLength(sends); + } finally { + if (completionTimer !== undefined) clearTimeout(completionTimer); + client.abort(); + authSpy.mockRestore(); + clearComboRecallForTests(); + clearComboSelectionState(); + clearComboTargetCooldowns(); + } + }); + }); + } + for (const [model, account] of [["gpt-5.5", "pool-a"], ["side/gpt-5.5", "pool-b"]] as const) { test(`native 404 falls back to canonical SSE with ${model} account and session identity`, async () => { await withPoolEnv("ocx-compact-404-canonical-", async config => { @@ -1693,6 +1781,419 @@ describe("compact alternate-account attempt (#913)", () => { }); }); +describe("compaction combo recall after combo switch (#3891)", () => { + afterEach(() => clearComboRecallForTests()); + + function comboTestConfig(): OcxConfig { + return { + defaultProvider: "gw", + providers: { + gw: { + adapter: "openai-chat", + baseUrl: "https://gw-primary.example/v1", + authMode: "key", + apiKey: "key-gw", + models: ["gpt-5.6-terra"], + }, + alt: { + adapter: "openai-chat", + baseUrl: "https://gw-alt.example/v1", + authMode: "key", + apiKey: "key-alt", + models: ["gpt-5.6-luna"], + }, + }, + combos: { + terra: { strategy: "failover", targets: [{ provider: "gw", model: "gpt-5.6-terra" }] }, + }, + } as unknown as OcxConfig; + } + + function chatCompletionPayload(text: string): Record<string, unknown> { + return { + choices: [{ index: 0, message: { role: "assistant", content: text }, finish_reason: "stop" }], + usage: { prompt_tokens: 10, completion_tokens: 5 }, + }; + } + + // The routed compact turn dispatches combo children as SSE (stream is forced + // when route.combo is set), so streaming-capable mocks answer the chat wire. + function chatStreamResponse(text: string): Response { + return new Response([ + `data: ${JSON.stringify({ choices: [{ index: 0, delta: { content: text }, finish_reason: null }] })}\n\n`, + `data: ${JSON.stringify({ choices: [{ index: 0, delta: {}, finish_reason: "stop" }] })}\n\n`, + "data: [DONE]\n\n", + ].join(""), { headers: { "content-type": "text/event-stream" } }); + } + + test("bare native model after combo switch routes through the remembered combo", async () => { + const calls: Array<{ url: string; body: Record<string, unknown> }> = []; + globalThis.fetch = (async (url: unknown, init?: RequestInit) => { + calls.push({ url: String(url), body: JSON.parse(String(init?.body ?? "{}")) as Record<string, unknown> }); + return jsonResponse(chatCompletionPayload("handoff summary")); + }) as typeof fetch; + + const config = comboTestConfig(); + const laneHeaders = { "session_id": "lane-combo-recall" }; + + // Step 1: an ordinary combo turn succeeds, populating the recall map. + const comboRes = await handleResponses( + compactionRequest({ model: "combo/terra", stream: false, input: "hello" }, undefined, laneHeaders), + config, + { model: "", provider: "" }, + ); + expect(comboRes.status).toBe(200); + + // Step 2: compaction arrives with the bare native model on the same lane. + const logCtx: RequestLogContext = { model: "", provider: "" }; + const res = await handleResponses( + compactionRequest(baseCompactionBody({ model: "gpt-5.6-terra" }), undefined, laneHeaders), + config, + logCtx, + ); + + expect(res.status).toBe(200); + expect(logCtx.provider).toBe("combo"); + expect(logCtx.comboId).toBe("terra"); + expect(logCtx.requestedModel).toBe("combo/terra"); + const json = await res.json() as { output?: Array<{ type?: string }> }; + expect((json.output ?? []).filter(item => item.type === "compaction").length).toBe(1); + }); + + test("v1 /responses/compact takes the same recall path", async () => { + globalThis.fetch = (async (input: string | URL | Request, init?: RequestInit) => { + const request = new Request(input, init); + const body = await request.json() as { stream?: boolean }; + return body.stream === true + ? chatStreamResponse("handoff summary") + : jsonResponse(chatCompletionPayload("handoff summary")); + }) as typeof fetch; + + const config = comboTestConfig(); + const laneHeaders = { "session_id": "lane-compact-recall" }; + + const comboRes = await handleResponses( + compactionRequest({ model: "combo/terra", stream: false, input: "hello" }, undefined, laneHeaders), + config, + { model: "", provider: "" }, + ); + expect(comboRes.status).toBe(200); + + const logCtx: RequestLogContext = { model: "", provider: "" }; + const compactRes = await handleResponsesCompact( + compactionRequest(baseCompactionBody({ model: "gpt-5.6-terra" }), undefined, laneHeaders), + config, + logCtx, + ); + + expect(compactRes.status).toBe(200); + expect(logCtx.provider).toBe("combo"); + }); + + test("a different lane does not borrow the remembered combo", async () => { + globalThis.fetch = (async () => jsonResponse(chatCompletionPayload("handoff summary"))) as typeof fetch; + + const config = comboTestConfig(); + + // Populate recall on lane A. + await handleResponses( + compactionRequest({ model: "combo/terra", stream: false, input: "hello" }, undefined, { "session_id": "lane-A" }), + config, + { model: "", provider: "" }, + ); + + // Compaction on lane B: the bare model should NOT be rewritten to the combo. + // It falls through to the compaction default-provider fallback (#2901) and lands on gw. + const logCtx: RequestLogContext = { model: "", provider: "" }; + const res = await handleResponses( + compactionRequest(baseCompactionBody({ model: "gpt-5.6-terra" }), undefined, { "session_id": "lane-B" }), + config, + logCtx, + ); + + expect(res.status).toBe(200); + expect(logCtx.provider).toBe("gw"); + expect(logCtx.comboId).toBeUndefined(); + }); + + test("a non-matching bare model is not rewritten", async () => { + globalThis.fetch = (async () => jsonResponse(chatCompletionPayload("handoff summary"))) as typeof fetch; + + const config = comboTestConfig(); + const laneHeaders = { "session_id": "lane-no-match" }; + + await handleResponses( + compactionRequest({ model: "combo/terra", stream: false, input: "hello" }, undefined, laneHeaders), + config, + { model: "", provider: "" }, + ); + + // Bare model "gpt-5.6-luna" does not match terra combo target "gpt-5.6-terra". + const logCtx: RequestLogContext = { model: "", provider: "" }; + const res = await handleResponses( + compactionRequest(baseCompactionBody({ model: "gpt-5.6-luna" }), undefined, laneHeaders), + config, + logCtx, + ); + + expect(res.status).toBe(200); + expect(logCtx.provider).toBe("gw"); + expect(logCtx.comboId).toBeUndefined(); + }); + + test("recall routes before the bare model can 404 without an openai provider", async () => { + // Maintainer review: with no canonical openai row, the bare model dies in + // routeCompactionModel before any combo logic unless the recall rewrite + // also reaches the routed identity, not only the raw body model. + const config = { + defaultProvider: "openai", + providers: { + gw: { + adapter: "openai-chat", + baseUrl: "https://gw-primary.example/v1", + authMode: "key", + apiKey: "key-gw", + models: ["gpt-5.6-terra"], + }, + }, + combos: { + terra: { strategy: "failover", targets: [{ provider: "gw", model: "gpt-5.6-terra" }] }, + }, + } as unknown as OcxConfig; + const bodies: Array<Record<string, unknown>> = []; + globalThis.fetch = (async (input: string | URL | Request, init?: RequestInit) => { + const request = new Request(input, init); + const body = await request.json() as Record<string, unknown>; + bodies.push(body); + return body.stream === true + ? chatStreamResponse("handoff summary") + : jsonResponse(chatCompletionPayload("handoff summary")); + }) as typeof fetch; + + const laneHeaders = { "session_id": "lane-recall-404" }; + const comboRes = await handleResponses( + compactionRequest({ model: "combo/terra", stream: false, input: "hello" }, undefined, laneHeaders), + config, + { model: "", provider: "" }, + ); + expect(comboRes.status).toBe(200); + + const logCtx: RequestLogContext = { model: "", provider: "" }; + const res = await handleResponsesCompact( + compactionRequest(baseCompactionBody({ model: "gpt-5.6-terra" }), undefined, laneHeaders), + config, + logCtx, + ); + + expect(res.status).toBe(200); + expect(logCtx.provider).toBe("combo"); + expect(logCtx.comboId).toBe("terra"); + // The internal combo turn goes out streaming through the combo dispatch. + expect(bodies[1]!.stream).toBe(true); + await res.text(); + }); + + test("recall keeps a native-compact target on the combo /responses path", async () => { + // CodeRabbit review: the recalled target itself can live on a provider + // that supports the native /responses/compact endpoint. Without the + // routed identity sync, the bare model would go straight to the native + // compact endpoint and bypass combo dispatch entirely. + const config = { + defaultProvider: "openai-apikey", + providers: { + "openai-apikey": { + adapter: "openai-responses", + baseUrl: "https://api.openai.com/v1", + authMode: "key", + apiKey: "test-key", + }, + }, + combos: { + terra: { strategy: "failover", targets: [{ provider: "openai-apikey", model: "gpt-5.6-terra" }] }, + }, + } as unknown as OcxConfig; + const calls: Array<{ url: string; body: Record<string, unknown> }> = []; + globalThis.fetch = (async (input: string | URL | Request, init?: RequestInit) => { + const request = new Request(input, init); + if (request.url.endsWith("/responses/compact")) { + return Response.json({ detail: "Not Found" }, { status: 404 }); + } + calls.push({ url: request.url, body: await request.json() as Record<string, unknown> }); + return calls.at(-1)!.body.stream === true + ? sseResponse([{ type: "response.completed", response: { ...completedPayload("handoff summary"), model: "gpt-5.6-terra" } }]) + : jsonResponse({ ...completedPayload("handoff summary"), model: "gpt-5.6-terra" }); + }) as typeof fetch; + + const laneHeaders = { "session_id": "lane-recall-native" }; + const comboRes = await handleResponses( + compactionRequest({ model: "combo/terra", stream: false, input: "hello" }, undefined, laneHeaders), + config, + { model: "", provider: "" }, + ); + expect(comboRes.status).toBe(200); + + const logCtx: RequestLogContext = { model: "", provider: "" }; + const res = await handleResponsesCompact( + compactionRequest(baseCompactionBody({ model: "gpt-5.6-terra" }), undefined, laneHeaders), + config, + logCtx, + ); + + expect(res.status).toBe(200); + expect(logCtx.provider).toBe("combo"); + expect(logCtx.comboId).toBe("terra"); + // Both upstream calls take the plain /responses path; the native compact + // endpoint (which this provider supports) must never be hit. + expect(calls.map(call => call.url)).toEqual([ + "https://api.openai.com/v1/responses", + "https://api.openai.com/v1/responses", + ]); + expect(calls[1]!.body.stream).toBe(true); + await res.text(); + }); + + function installRecallChatFixture(): void { + globalThis.fetch = (async (input: string | URL | Request, init?: RequestInit) => { + const body = await new Request(input, init).json() as { stream?: boolean }; + return body.stream ? chatStreamResponse("summary") : jsonResponse(chatCompletionPayload("answer")); + }) as typeof fetch; + } + + async function seedRecall(config: OcxConfig, lane: string | undefined = "recall-lane"): Promise<void> { + const response = await handleResponses(compactionRequest( + { model: "combo/terra", stream: false, input: "hello" }, undefined, + lane ? { session_id: lane } : {}, + ), config, { model: "", provider: "" }); + expect(response.status).toBe(200); + expect(await response.json()).toMatchObject({ status: "completed", model: "gpt-5.6-terra" }); + } + + for (const version of ["v1", "v2"] as const) { + const compact = version === "v1" ? handleResponsesCompact : handleResponses; + const dispatch = async (config: OcxConfig, model: string, lane: string | undefined = "recall-lane") => { + const log: RequestLogContext = { model: "", provider: "" }; + const response = await compact(compactionRequest(baseCompactionBody({ model }), undefined, + lane ? { session_id: lane } : {}), config, log); + expect(response.status).toBe(200); + await response.text(); + return log; + }; + + test(`${version} explicit bare nativeAlias beats a different remembered combo`, async () => { + installRecallChatFixture(); + const config = comboTestConfig(); + config.combos!.explicit = { + alias: "gpt-5.6-terra", nativeAlias: true, + targets: [{ provider: "alt", model: "gpt-5.6-luna" }], + }; + await seedRecall(config); + expect(recallComboForLane(config, sessionLaneIdFromRequest(new Headers({ session_id: "recall-lane" })), "gpt-5.6-terra")).toBe("terra"); + const log = await dispatch(config, "gpt-5.6-terra"); + expect(log.comboId).toBe("explicit"); + expect(log.resolvedModel).toBe("gpt-5.6-luna"); + }); + + test(`${version} explicit provider and combo selectors beat recall`, async () => { + installRecallChatFixture(); + const config = comboTestConfig(); + config.combos!.explicit = { targets: [{ provider: "alt", model: "gpt-5.6-luna" }] }; + await seedRecall(config); + expect((await dispatch(config, "alt/gpt-5.6-luna")).provider).toBe("alt"); + expect((await dispatch(config, "combo/explicit")).comboId).toBe("explicit"); + }); + + for (const mutation of ["delete", "rename", "replace-target", "delete-provider", "disable-provider"] as const) { + test(`${version} ${mutation} invalidates remembered ownership before fallback`, async () => { + installRecallChatFixture(); + const config = comboTestConfig(); + await seedRecall(config); + // The default is distinct from the original target and remains usable. + config.defaultProvider = "alt"; + if (mutation === "rename") config.combos!.renamed = config.combos!.terra!; + if (mutation === "delete" || mutation === "rename") delete config.combos!.terra; + if (mutation === "replace-target") config.combos!.terra!.targets = [{ provider: "alt", model: "gpt-5.6-luna" }]; + if (mutation === "delete-provider") delete config.providers.gw; + if (mutation === "disable-provider") config.providers.gw!.disabled = true; + const log = await dispatch(config, "gpt-5.6-terra"); + expect(log.comboId).toBeUndefined(); + expect(log.provider).toBe("alt"); + }); + } + + test(`${version} missing and sibling lanes cannot borrow a completed selection`, async () => { + installRecallChatFixture(); + const config = comboTestConfig(); + await seedRecall(config); + expect((await dispatch(config, "gpt-5.6-terra", "sibling")).comboId).toBeUndefined(); + // Empty lane explicitly omits the header (undefined would use the helper default). + expect((await dispatch(config, "gpt-5.6-terra", "")).comboId).toBeUndefined(); + clearComboRecallForTests(); + await seedRecall(config, ""); + expect((await dispatch(config, "gpt-5.6-terra")).comboId).toBeUndefined(); + }); + + test(`${version} recall expires at thirty minutes and evicts the oldest of 257 lanes`, async () => { + installRecallChatFixture(); + const config = comboTestConfig(); + let now = 100_000; + const clock = spyOn(Date, "now").mockImplementation(() => now); + try { + await seedRecall(config); + now += 30 * 60 * 1000 - 1; + expect(recallComboForLane(config, sessionLaneIdFromRequest(new Headers({ session_id: "recall-lane" })), "gpt-5.6-terra")).toBe("terra"); + now += 1; + expect((await dispatch(config, "gpt-5.6-terra")).comboId).toBeUndefined(); + const target = { provider: "gw", model: "gpt-5.6-terra" }; + for (let index = 0; index < 257; index += 1) { + rememberComboForLane(sessionLaneIdFromRequest(new Headers({ session_id: `lane-${index}` })), "terra", target, "gpt-5.6-terra", captureConfigGeneration()); + } + expect((await dispatch(config, "gpt-5.6-terra", "lane-0")).comboId).toBeUndefined(); + expect((await dispatch(config, "gpt-5.6-terra", "lane-1")).comboId).toBe("terra"); + expect((await dispatch(config, "gpt-5.6-terra", "lane-256")).comboId).toBe("terra"); + } finally { + clock.mockRestore(); + } + }); + + test(`${version} virtual Pro target recalls the emitted base model`, async () => { + const config = comboTestConfig(); + config.providers["openai-apikey"] = { + adapter: "openai-responses", baseUrl: "https://api.openai.com/v1", authMode: "key", apiKey: "test-key", + }; + config.combos!.terra!.targets = [{ provider: "openai-apikey", model: "gpt-5.6-terra-pro" }]; + const calls: Array<{ url: string; body: Record<string, unknown> }> = []; + globalThis.fetch = (async (input: string | URL | Request, init?: RequestInit) => { + const request = new Request(input, init); + const body = await request.json() as Record<string, unknown>; + calls.push({ url: request.url, body }); + const completed = { ...completedPayload("summary"), model: "gpt-5.6-terra" }; + return body.stream ? sseResponse([{ type: "response.completed", response: completed }]) : jsonResponse(completed); + }) as typeof fetch; + await seedRecall(config); + expect(calls[0]!.body).toMatchObject({ model: "gpt-5.6-terra", reasoning: { mode: "pro" } }); + expect(recallComboForLane(config, sessionLaneIdFromRequest(new Headers({ session_id: "recall-lane" })), "gpt-5.6-terra-pro")).toBeUndefined(); + expect((await dispatch(config, "gpt-5.6-terra")).comboId).toBe("terra"); + expect(calls.every(call => call.url.endsWith("/responses"))).toBe(true); + }); + + test(`${version} recalled combo resolves the current key rather than retaining a credential`, async () => { + const config = comboTestConfig(); + const auth: Array<string | null> = []; + globalThis.fetch = (async (input: string | URL | Request, init?: RequestInit) => { + const request = new Request(input, init); + auth.push(request.headers.get("authorization")); + const body = await request.json() as { stream?: boolean }; + return body.stream ? chatStreamResponse("summary") : jsonResponse(chatCompletionPayload("answer")); + }) as typeof fetch; + await seedRecall(config); + config.providers.gw!.apiKey = "key-current"; + expect((await dispatch(config, "gpt-5.6-terra")).comboId).toBe("terra"); + expect(auth).toEqual(["Bearer key-gw", "Bearer key-current"]); + }); + } + +}); + test("a no-eligible policy compact request persists the evaluation trace", async () => { const config = { ...keyProviderConfig(), diff --git a/tests/responses/responses-opaque-blob-recovery.test.ts b/tests/responses/responses-opaque-blob-recovery.test.ts index cf26431381..87eb74f923 100644 --- a/tests/responses/responses-opaque-blob-recovery.test.ts +++ b/tests/responses/responses-opaque-blob-recovery.test.ts @@ -154,6 +154,23 @@ function serializedOutboundWithEncryptedAgentMessage(): string { return JSON.stringify({ model: "model-a", input: agentMessageReplayInput() }); } +/** + * What a routed destination receives on the retry: recovery has replaced the undecryptable + * part with an omission marker, which leaves the item entirely plaintext, so the adapter + * converts it into the public user message a routed Responses schema can accept. + */ +function recoveredAgentMessage(): Record<string, unknown> { + return { + type: "message", + role: "user", + content: [ + { type: "input_text", text: 'Agent message {"author":"/root/child_task","recipient":"/root"}' }, + { type: "input_text", text: "Message Type: MESSAGE\nTask name: /root\nSender: /root/child_task\nPayload:" }, + { type: "input_text", text: "[encrypted content omitted]" }, + ], + }; +} + function config(): OcxConfig { return { defaultProvider: "first", @@ -550,15 +567,7 @@ describe("opaque blob recovery through /v1/responses", () => { expect(outbound).toHaveLength(4); const retriedInput = outbound.at(3)?.input as Array<Record<string, unknown>> | undefined; - expect(retriedInput?.at(0)).toEqual({ - type: "agent_message", - author: "/root/child_task", - recipient: "/root", - content: [ - { type: "input_text", text: "Message Type: MESSAGE\nTask name: /root\nSender: /root/child_task\nPayload:" }, - { type: "input_text", text: "[encrypted content omitted]" }, - ], - }); + expect(retriedInput?.at(0)).toEqual(recoveredAgentMessage()); expect(retriedInput?.at(1)).toEqual(agentMessageReplayInput().at(1)); expect(logCtx.activeAttempt?.recoveryKinds).toEqual(["transient-5xx", "opaque-blob-rejection"]); }); @@ -580,15 +589,7 @@ describe("opaque blob recovery through /v1/responses", () => { expect(body).not.toContain(FUNCTION_OUTPUT_DECRYPT_MESSAGE); expect(outbound).toHaveLength(2); const retriedInput = outbound.at(1)?.input as Array<Record<string, unknown>> | undefined; - expect(retriedInput?.at(0)).toEqual({ - type: "agent_message", - author: "/root/child_task", - recipient: "/root", - content: [ - { type: "input_text", text: "Message Type: MESSAGE\nTask name: /root\nSender: /root/child_task\nPayload:" }, - { type: "input_text", text: "[encrypted content omitted]" }, - ], - }); + expect(retriedInput?.at(0)).toEqual(recoveredAgentMessage()); }); test("recovers a zero-output error-event decrypt failure before client relay", async () => { @@ -608,15 +609,7 @@ describe("opaque blob recovery through /v1/responses", () => { expect(body).not.toContain(FUNCTION_OUTPUT_DECRYPT_MESSAGE); expect(outbound).toHaveLength(2); const retriedInput = outbound.at(1)?.input as Array<Record<string, unknown>> | undefined; - expect(retriedInput?.at(0)).toEqual({ - type: "agent_message", - author: "/root/child_task", - recipient: "/root", - content: [ - { type: "input_text", text: "Message Type: MESSAGE\nTask name: /root\nSender: /root/child_task\nPayload:" }, - { type: "input_text", text: "[encrypted content omitted]" }, - ], - }); + expect(retriedInput?.at(0)).toEqual(recoveredAgentMessage()); }); for (const streamMode of ["legacy-tee", "eager-relay"] as const) { @@ -751,15 +744,7 @@ describe("opaque blob recovery through /v1/responses", () => { expect(body).not.toContain(FUNCTION_OUTPUT_DECRYPT_MESSAGE); expect(outbound).toHaveLength(2); const retriedInput = outbound.at(1)?.input as Array<Record<string, unknown>> | undefined; - expect(retriedInput?.at(0)).toEqual({ - type: "agent_message", - author: "/root/child_task", - recipient: "/root", - content: [ - { type: "input_text", text: "Message Type: MESSAGE\nTask name: /root\nSender: /root/child_task\nPayload:" }, - { type: "input_text", text: "[encrypted content omitted]" }, - ], - }); + expect(retriedInput?.at(0)).toEqual(recoveredAgentMessage()); }); test("absent Content-Type decrypt stream does not recover a non-stream request", async () => { diff --git a/tests/responses/responses-state.test.ts b/tests/responses/responses-state.test.ts index 464642cda7..1906d6b1e1 100644 --- a/tests/responses/responses-state.test.ts +++ b/tests/responses/responses-state.test.ts @@ -3019,21 +3019,26 @@ describe("Responses previous_response_id state", () => { // Two proxies sharing one config dir race every tick. Reporting the loser's ENOENT as a // failure would tell an operator a file is "in use or locked" when nobody holds it. const old = new Date(Date.now() - 60 * 60 * 1_000); - const path = join(home, "responses-state.json.ocx.9104.1.tmp"); + const deadPid = findDeadPid(); + expect(deadPid).not.toBe(process.pid); + const path = join(home, `responses-state.json.ocx.${deadPid}.1.tmp`); writeFileSync(path, "private state"); utimesSync(path, old, old); + const unlinked: string[] = []; const result = recoverStaleResponseStateTemps(home, { isProcessAlive: () => false, bootTime: () => 0, - unlink: () => { + unlink: target => { + unlinked.push(target); const error = new Error("gone") as NodeJS.ErrnoException; error.code = "ENOENT"; throw error; }, }); - expect(result).toMatchObject({ matched: 1, removed: 1, failed: 0 }); + expect(result).toMatchObject({ matched: 1, eligible: 1, removed: 1, failed: 0 }); + expect(unlinked).toEqual([path]); }); test("a dry run reports exactly what a reclaim then removes", () => { diff --git a/tests/server/server-combo-failover-e2e.test.ts b/tests/server/server-combo-failover-e2e.test.ts index e4523aabb3..c08c706bac 100644 --- a/tests/server/server-combo-failover-e2e.test.ts +++ b/tests/server/server-combo-failover-e2e.test.ts @@ -1,3 +1,4 @@ +import { sessionLaneIdFromRequest } from "../../src/server/request-log-conversation"; import { afterEach, beforeEach, describe, expect, mock, setDefaultTimeout, test } from "bun:test"; import { logsFromApiBody } from "../helpers/logs-api"; import { managementFetch as fetch, ManagementRequest as Request } from "../helpers/management-auth"; @@ -38,7 +39,9 @@ import { import { clearCursorThreadContinuityForTests } from "../../src/adapters/cursor/thread-continuity"; import { COMPACT_PROMPT, encodeCompactionSummary } from "../../src/responses/compaction"; import { clearKeyCooldowns } from "../../src/providers/key-failover"; -import { consumeComboFailure } from "../../src/server/responses/core"; +import { consumeComboFailure, createChildPassthroughCallbackGate } from "../../src/server/responses/core"; +import { clearComboRecallForTests, recallComboForLane, reconcileComboRecall } from "../../src/server/responses/combo-session-recall"; +import { captureConfigGeneration } from "../../src/lib/state-store-sweeper"; // Full-suite Windows load: startServer + combo rename/delete management flows exceed the // default 5s per-test budget (same flake class as 810fa115 / claude-management-api). @@ -139,6 +142,7 @@ beforeEach(() => { testDir = mkdtempSync(join(tmpdir(), "ocx-combo-030-")); process.env.OPENCODEX_HOME = testDir; clearComboSelectionState(); + clearComboRecallForTests(); clearComboTargetCooldowns(); clearKeyCooldowns(); clearCodexUpstreamHealth(); @@ -171,6 +175,7 @@ afterEach(async () => { isolatedCodexHome = null; if (testDir) removeTreeWithRetry(testDir); clearComboSelectionState(); + clearComboRecallForTests(); clearComboTargetCooldowns(); clearKeyCooldowns(); clearCodexUpstreamHealth(); @@ -432,6 +437,289 @@ function heldNativeTerminal(payload: Record<string, unknown>) { } describe("server combo failover 030 activation matrix", () => { + test("recall completion has an independent gate slot and publishes once only on commit", () => { + const calls: string[] = []; + const gate = createChildPassthroughCallbackGate({ + onNativePassthroughTerminal: status => calls.push(status), + onResponseComplete: model => calls.push(model), + }); + gate.onTerminal("completed"); + gate.onResponseComplete("final-model"); + expect(calls).toEqual([]); + gate.commit(); + gate.commit(); + gate.onResponseComplete("duplicate-model"); + expect(calls).toEqual(["completed", "final-model"]); + }); + + for (const rejection of ["discard", "failed", "incomplete", "cancel"] as const) { + test(`recall gate drops pre-commit completion on ${rejection}`, () => { + const models: string[] = []; + const gate = createChildPassthroughCallbackGate({ onResponseComplete: model => models.push(model) }); + gate.onResponseComplete("unaccepted-model"); + if (rejection === "discard") gate.discard(); + else if (rejection === "cancel") gate.onCancel(); + else gate.onTerminal(rejection); + gate.commit(); + gate.onResponseComplete("late-model"); + expect(models).toEqual([]); + }); + } + + for (const wire of ["native", "chat", "runTurn"] as const) { + for (const stream of [false, true]) { + for (const terminal of ["completed", "failed", "incomplete"] as const) { + test(`${wire} ${stream ? "SSE" : "JSON"} ${terminal} B replaces A only after completed response`, async () => { + const encode = (events: Array<Record<string, unknown>>) => events.map(event => + `event: ${event.type}\ndata: ${JSON.stringify(event)}\n\n`).join(""); + const upstream = serve(async request => { + const body = await request.json() as { model: string; stream?: boolean }; + if (body.model === "m1") return Response.json(responsesSuccess("A", "m1")); + if (wire === "native") { + const response = { ...responsesSuccess("B output", "final-b"), status: terminal }; + return stream ? new Response(encode([ + { type: "response.output_text.delta", delta: "B output", item_id: "msg_b", output_index: 0, content_index: 0 }, + { type: `response.${terminal}`, response }, + ]), { headers: { "content-type": "text/event-stream" } }) : Response.json(response); + } + if (stream) { + if (terminal === "failed") return chatErrorStream("failed after output", "B output"); + return new Response([ + `data: ${JSON.stringify({ choices: [{ index: 0, delta: { content: "B output" }, finish_reason: null }] })}\n\n`, + `data: ${JSON.stringify({ choices: [{ index: 0, delta: {}, finish_reason: terminal === "incomplete" ? "length" : "stop" }] })}\n\n`, + "data: [DONE]\n\n", + ].join(""), { headers: { "content-type": "text/event-stream" } }); + } + if (terminal === "failed") return Response.json({ error: { message: "failed B" } }); + return Response.json({ choices: [{ index: 0, message: { role: "assistant", content: "B output" }, finish_reason: terminal === "incomplete" ? "length" : "stop" }] }); + }); + customRunTurn = async (_parsed, _incoming, emit) => { + emit({ type: "text_delta", text: "B output" }); + if (terminal === "failed") emit({ type: "error", message: "failed after output" }); + else emit({ type: "done", ...(terminal === "incomplete" ? { stopReason: "length" } : {}) }); + }; + const config = comboConfig({ + a: provider("openai-responses", baseUrl(upstream), "key-a"), + b: provider(wire === "native" ? "openai-responses" : wire === "chat" ? "openai-chat" : "test-run-turn", baseUrl(upstream), "key-b"), + }); + config.combos = { + alpha: { targets: [{ provider: "a", model: "m1" }] }, + beta: { targets: [{ provider: "b", model: "m2" }] }, + }; + const headers = { session_id: "terminal-recall" }; + const a = await post(config, { model: "combo/alpha" }, {}, headers); + expect(await a.json()).toMatchObject({ status: "completed", model: "m1" }); + expect(recallComboForLane(config, sessionLaneIdFromRequest(new Headers({ session_id: "terminal-recall" })), "m1")).toBe("alpha"); + const models: string[] = []; + const completed = deferred(); + const b = await post(config, { model: "combo/beta", stream }, { + onResponseComplete: model => { models.push(model); completed.resolve(); }, + }, headers); + const body = await b.text(); + if (terminal === "completed") { + await within(completed.promise); + const expected = wire === "native" ? "final-b" : "m2"; + expect(body).toContain(`"model":"${expected}"`); + expect(models).toEqual([expected]); + expect(recallComboForLane(config, sessionLaneIdFromRequest(new Headers({ session_id: "terminal-recall" })), expected)).toBe("beta"); + expect(recallComboForLane(config, sessionLaneIdFromRequest(new Headers({ session_id: "terminal-recall" })), "m1")).toBeUndefined(); + } else { + expect(models).toEqual([]); + expect(recallComboForLane(config, sessionLaneIdFromRequest(new Headers({ session_id: "terminal-recall" })), "m1")).toBe("alpha"); + } + }); + } + } + } + + for (const recordTerminalOutcomes of [true, false]) { + for (const scenario of ["completed", "missing-model", "empty-model", "failed-first", "incomplete-first", "undeclared-tool"] as const) { + test(`native SSE recall ${scenario} with terminal recording ${recordTerminalOutcomes}`, async () => { + const upstream = serve(() => { + const response = responsesSuccess("B", "final-b"); + if (scenario === "missing-model") delete response.model; + if (scenario === "empty-model") response.model = ""; + const events: Array<Record<string, unknown>> = [{ type: "response.output_text.delta", delta: "B", item_id: "msg_b", output_index: 0, content_index: 0 }]; + if (scenario === "failed-first" || scenario === "incomplete-first") { + const status = scenario === "failed-first" ? "failed" : "incomplete"; + events.push({ type: `response.${status}`, response: { ...response, status } }); + } + if (scenario === "undeclared-tool") events.push({ + type: "response.output_item.added", output_index: 0, + item: { type: "function_call", id: "fc_bad", call_id: "bad", name: "not_declared", arguments: "{}" }, + }); + // Empty terminal output cannot erase an earlier rejected tool call. + events.push({ type: "response.completed", response: { ...response, output: [] } }); + return new Response(events.map(event => `event: ${event.type}\ndata: ${JSON.stringify(event)}\n\n`).join(""), { + headers: { "content-type": "text/event-stream" }, + }); + }); + const seed = serve(() => Response.json(responsesSuccess("A", "m1"))); + const config = comboConfig({ + a: provider("openai-responses", baseUrl(seed), "key-a"), + b: provider("openai-responses", baseUrl(upstream), "key-b"), + }); + config.combos = { + alpha: { targets: [{ provider: "a", model: "m1" }] }, + beta: { targets: [{ provider: "b", model: "m2" }] }, + }; + const headers = { session_id: "native-sticky" }; + await (await post(config, { model: "combo/alpha" }, {}, headers)).text(); + const completed = deferred(); + const models: string[] = []; + const response = await post(config, { model: "combo/beta", stream: true, tools: [] }, { + recordTerminalOutcomes, + onResponseComplete: model => { models.push(model); completed.resolve(); }, + }, headers); + await response.text(); + if (scenario === "completed") { + await within(completed.promise); + expect(models).toEqual(["final-b"]); + expect(recallComboForLane(config, sessionLaneIdFromRequest(new Headers({ session_id: "native-sticky" })), "final-b")).toBe("beta"); + } else { + expect(models).toEqual([]); + expect(recallComboForLane(config, sessionLaneIdFromRequest(new Headers({ session_id: "native-sticky" })), "m1")).toBe("alpha"); + } + }); + } + } + + for (const streamMode of ["legacy-tee", "eager-relay"] as const) { + for (const recordTerminalOutcomes of [true, false]) { + for (const firstModel of [undefined, "", "missing-response", "null-response"] as const) { + test(`native ${streamMode} ignores hidden completion after ${firstModel === undefined ? "missing-model" : firstModel || "empty-model"} with recording ${recordTerminalOutcomes}`, async () => { + const seed = serve(() => Response.json(responsesSuccess("A", "m1"))); + const upstream = serve(() => { + const first = responsesSuccess("first", "ignored"); + if (firstModel === undefined) delete first.model; + else if (firstModel === "") first.model = firstModel; + const firstEvent: Record<string, unknown> = { type: "response.completed", response: first }; + if (firstModel === "missing-response") delete firstEvent.response; + else if (firstModel === "null-response") firstEvent.response = null; + const events = [ + { type: "response.output_text.delta", delta: "B", item_id: "msg_b", output_index: 0, content_index: 0 }, + firstEvent, + { type: "response.completed", response: responsesSuccess("hidden", "final-b") }, + ]; + return new Response(events.map(event => `event: ${event.type}\ndata: ${JSON.stringify(event)}\n\n`).join(""), { + headers: { "content-type": "text/event-stream" }, + }); + }); + const config = comboConfig({ + a: provider("openai-responses", baseUrl(seed), "key-a"), + b: provider("openai-responses", baseUrl(upstream), "key-b"), + }); + config.streamMode = streamMode; + config.combos = { + alpha: { targets: [{ provider: "a", model: "m1" }] }, + beta: { targets: [{ provider: "b", model: "m2" }] }, + }; + const headers = { session_id: "first-terminal-recall" }; + const lane = sessionLaneIdFromRequest(new Headers(headers)); + await (await post(config, { model: "combo/alpha" }, {}, headers)).text(); + expect(recallComboForLane(config, lane, "m1")).toBe("alpha"); + const completedModels: string[] = []; + const response = await post(config, { model: "combo/beta", stream: true }, { + recordTerminalOutcomes, onResponseComplete: model => { completedModels.push(model); }, + }, headers); + const wire = await response.text(); + expect(wire).not.toContain("final-b"); + expect(completedModels).toEqual([]); + expect(recallComboForLane(config, lane, "m1")).toBe("alpha"); + expect(recallComboForLane(config, lane, "final-b")).toBeUndefined(); + }); + } + } + } + + test("native output before cancellation preserves A and cannot record late B completion", async () => { + const seed = serve(() => Response.json(responsesSuccess("A", "m1"))); + const held = heldNativeTerminal({ type: "response.completed", response: responsesSuccess("B", "final-b") }); + const config = comboConfig({ + a: provider("openai-responses", baseUrl(seed), "key-a"), + b: provider("openai-responses", baseUrl(held.upstream), "key-b"), + }); + config.combos = { + alpha: { targets: [{ provider: "a", model: "m1" }] }, + beta: { targets: [{ provider: "b", model: "m2" }] }, + }; + const headers = { session_id: "cancel-recall" }; + await (await post(config, { model: "combo/alpha" }, {}, headers)).text(); + const abort = new AbortController(); + const models: string[] = []; + const response = await post(config, { model: "combo/beta", stream: true }, { + abortSignal: abort.signal, onResponseComplete: model => models.push(model), + }, headers); + expect(recallComboForLane(config, sessionLaneIdFromRequest(new Headers({ session_id: "cancel-recall" })), "m1")).toBe("alpha"); + abort.abort(); + held.release(); + await response.text().catch(() => undefined); + expect(models).toEqual([]); + expect(recallComboForLane(config, sessionLaneIdFromRequest(new Headers({ session_id: "cancel-recall" })), "m1")).toBe("alpha"); + }); + + test("a held completed response cannot resurrect recall across combo delete and recreate", async () => { + const seed = serve(() => Response.json(responsesSuccess("A", "m1"))); + const held = heldNativeTerminal({ type: "response.completed", response: responsesSuccess("B", "final-b") }); + const config = comboConfig({ + a: provider("openai-responses", baseUrl(seed), "key-a"), + b: provider("openai-responses", baseUrl(held.upstream), "key-b"), + }); + config.combos = { + alpha: { targets: [{ provider: "a", model: "m1" }] }, + beta: { targets: [{ provider: "b", model: "m2" }] }, + }; + const headers = { session_id: "recreated-recall" }; + await (await post(config, { model: "combo/alpha" }, {}, headers)).text(); + const completed = deferred(); + const response = await post(config, { model: "combo/beta", stream: true }, { + onResponseComplete: () => completed.resolve(), + }, headers); + const generation = captureConfigGeneration(); + delete config.combos.beta; + const owners = { + generation: generation + 1, + providerNames: new Set(["a", "b"]), comboIds: new Set(["alpha"]), comboTargets: new Set(["alpha::a/m1"]), + codexAccountIds: new Set<string>(), oauthAccountKeys: new Set<string>(), configRoots: new Set<string>(), + }; + reconcileComboRecall(owners); + config.combos.beta = { targets: [{ provider: "b", model: "m2" }] }; + reconcileComboRecall({ + ...owners, generation: generation + 2, + comboIds: new Set(["alpha", "beta"]), comboTargets: new Set(["alpha::a/m1", "beta::b/m2"]), + }); + held.release(); + await response.text(); + await within(completed.promise); + expect(recallComboForLane(config, sessionLaneIdFromRequest(new Headers({ session_id: "recreated-recall" })), "m1")).toBe("alpha"); + expect(recallComboForLane(config, sessionLaneIdFromRequest(new Headers({ session_id: "recreated-recall" })), "final-b")).toBeUndefined(); + }); + + for (const media of ["image", "video"] as const) { + test(`${media} bridge completion records the final response model`, async () => { + const tools: string[] = []; + const routed = serve(async request => { + const body = await request.json() as { tools?: Array<{ function?: { name?: string } }> }; + tools.push(...(body.tools ?? []).map(tool => tool.function?.name ?? "")); + return chatStream("media bridge answer"); + }); + const config = comboConfig({ + a: provider("openai-chat", baseUrl(routed), "key-a"), + xai: provider("openai-chat", "https://api.x.ai/v1", "synthetic-xai-key"), + }, [{ provider: "a", model: "m1" }]); + config.images = media === "image" ? { bridgeEnabled: true } : { videoBridgeEnabled: true }; + const models: string[] = []; + const response = await post(config, { + stream: true, ...(media === "image" ? { tools: [{ type: "image_generation" }] } : {}), + }, { onResponseComplete: model => models.push(model) }, { session_id: "media-recall" }); + const frames = await collectSse(response); + expect(tools).toContain(media === "image" ? "image_gen" : "video_gen"); + expect(frames.some(frame => frame.event === "response.completed")).toBe(true); + expect(models).toEqual(["m1"]); + expect(recallComboForLane(config, sessionLaneIdFromRequest(new Headers({ session_id: "media-recall" })), "m1")).toBe("free"); + }); + } + test("dispatches a selected concrete target despite a shadowing combo alias", async () => { const hits: string[] = []; const a = serve(async request => { @@ -1596,10 +1884,12 @@ describe("server combo failover 030 activation matrix", () => { { provider: "b", model: "m2" }, ]); config.webSearchSidecar = { enabled: true, backend: "openai" }; + const models: string[] = []; const response = await post(config, { stream: true, tools: [{ type: "web_search" }], - }, {}, { + }, { onResponseComplete: model => models.push(model) }, { + session_id: "web-search-recall", authorization: `Bearer ${fakeChatGptJwt({ chatgpt_account_id: "acct-combo-search" })}`, "chatgpt-account-id": "acct-combo-search", }); @@ -1607,6 +1897,8 @@ describe("server combo failover 030 activation matrix", () => { expect(JSON.stringify(await collectSse(response))).toContain("web loop backup"); expect(modelHits.map(hit => hit.model)).toEqual(["m1", "m2"]); expect(modelHits.every(hit => hit.hasWebTool)).toBe(true); + expect(models).toEqual(["m2"]); + expect(recallComboForLane(config, sessionLaneIdFromRequest(new Headers({ session_id: "web-search-recall" })), "m2")).toBe("free"); }); test("context 400 stops while exhausted retryable targets return the sanitized last status", async () => { @@ -2881,7 +3173,7 @@ describe("server combo failover 030 activation matrix", () => { const terminalFrame = (status: "failed" | "completed") => [ `event: response.${status}`, `data: ${JSON.stringify({ type: `response.${status}`, response: { - id: `resp_${status}`, status, output: [], + id: `resp_${status}`, status, model: status === "completed" ? "final-b" : "failed-a", output: [], ...(status === "failed" ? { error: { code: "rate_limit_exceeded", message: "discarded quota failure" } } : {}), } })}`, "", @@ -2900,13 +3192,16 @@ describe("server combo failover 030 activation matrix", () => { }); const finalized = deferred(); const statuses: string[] = []; + const models: string[] = []; + const completed = deferred(); let cancels = 0; const parent: RequestLogContext = { model: "", provider: "" }; const snapshots: RequestLogContext[] = []; const response = await handleResponses(new Request("http://localhost/v1/responses", { - method: "POST", headers: { "content-type": "application/json" }, + method: "POST", headers: { "content-type": "application/json", session_id: "hop-recall" }, body: JSON.stringify({ model: "combo/free", input: "hello", stream: true }), }), config, parent, { + onResponseComplete: model => { models.push(model); completed.resolve(); }, onNativePassthroughTerminal: status => { statuses.push(status); snapshots.push({ ...parent }); @@ -2917,10 +3212,14 @@ describe("server combo failover 030 activation matrix", () => { expect(response.status).toBe(200); await response.text(); await within(finalized.promise); + await within(completed.promise); + expect(models).toEqual(["final-b"]); + expect(recallComboForLane(config, sessionLaneIdFromRequest(new Headers({ session_id: "hop-recall" })), "final-b")).toBe("free"); + expect(recallComboForLane(config, sessionLaneIdFromRequest(new Headers({ session_id: "hop-recall" })), "m1")).toBeUndefined(); expect(statuses).toEqual(["completed"]); expect(cancels).toBe(0); expect(snapshots).toHaveLength(1); - expect(snapshots[0]).toMatchObject({ provider: "combo", model: "combo/free", resolvedModel: "m2" }); + expect(snapshots[0]).toMatchObject({ provider: "combo", model: "combo/free", resolvedModel: "final-b" }); for (const field of ["terminalHttpStatus", "terminalIncompleteReason", "terminalErrorCode", "upstreamError"] as const) { expect(snapshots[0]![field]).toBeUndefined(); } diff --git a/tests/server/server-live.test.ts b/tests/server/server-live.test.ts index 16ee4c7946..f6d4da8916 100644 --- a/tests/server/server-live.test.ts +++ b/tests/server/server-live.test.ts @@ -1237,10 +1237,12 @@ test("sideband relay preserves multibyte UTF-8 frames byte-identically in both d // The env-gated frame forensic log (OCX_LIVE_FRAME_LOG) records per-frame metadata and // U+FFFD presence without writing full payloads — the attribution tool for multibyte // transcript corruption reports. -test("sideband frame log records direction, kind, and U+FFFD context without full payloads", async () => { +test("sideband frame log preserves delivery without recording damaged or clean text", async () => { const frameLogPath = join(TEST_DIR, "frames.jsonl"); + const previousFrameLog = process.env.OCX_LIVE_FRAME_LOG; process.env.OCX_LIVE_FRAME_LOG = frameLogPath; const FFFD_TEXT = "가볍게 ��기핼봐요"; + const received: string[] = []; const upstream = Bun.serve({ port: 0, @@ -1293,7 +1295,8 @@ test("sideband frame log records direction, kind, and U+FFFD context without ful client.addEventListener("open", () => { client.send("clean-frame"); }); - client.addEventListener("message", () => { + client.addEventListener("message", event => { + received.push(String(event.data)); acks += 1; if (acks >= 2) { clearTimeout(timer); @@ -1316,23 +1319,70 @@ test("sideband frame log records direction, kind, and U+FFFD context without ful expect(u2cFffd).toBeDefined(); expect(u2cFffd.kind).toBe("text"); expect(u2cFffd.bytes).toBeGreaterThan(0); - expect(u2cFffd.context).toContain("�"); + expect(received).toContain(FFFD_TEXT); expect(c2uClean).toBeDefined(); expect(c2uClean.fffd).toBe(false); - // Full payloads must never be logged — only short FFFD context excerpts. + // Even a short damaged transcript must not be persisted as diagnostic context. for (const line of lines) { + expect(Object.keys(line).sort()).toEqual(["bytes", "dir", "fffd", "kind", "ts"]); expect(JSON.stringify(line)).not.toContain("clean-frame"); + expect(JSON.stringify(line)).not.toContain(FFFD_TEXT); } client.close(); } finally { - delete process.env.OCX_LIVE_FRAME_LOG; + if (previousFrameLog === undefined) delete process.env.OCX_LIVE_FRAME_LOG; + else process.env.OCX_LIVE_FRAME_LOG = previousFrameLog; globalThis.WebSocket = RealWebSocket; await server.stop(true); await upstream.stop(true); } }); +test("frame diagnostics retain only metadata for text, binary, and bounded views", async () => { + const { logLiveSidebandFrame } = await import("../../src/server/live"); + const previousFrameLog = process.env.OCX_LIVE_FRAME_LOG; + const frameLogPath = join(TEST_DIR, "frame-metadata.jsonl"); + const damagedText = "private-voice-�"; + const encoded = new TextEncoder().encode(damagedText); + const padded = new TextEncoder().encode("�safe�"); + const frames: Array<{ data: unknown; kind: string; bytes: number; fffd: boolean }> = [ + { data: damagedText, kind: "text", bytes: 17, fffd: true }, + { data: encoded.buffer, kind: "binary", bytes: 17, fffd: true }, + { data: Buffer.from(encoded), kind: "binary", bytes: 17, fffd: true }, + // Replacement characters outside this view must not affect the flag or byte count. + { data: new Uint8Array(padded.buffer, 3, 4), kind: "binary", bytes: 4, fffd: false }, + { data: new DataView(padded.buffer, 3, 4), kind: "binary", bytes: 4, fffd: false }, + { data: "한글", kind: "text", bytes: 6, fffd: false }, + { data: new Uint8Array([0xff]), kind: "binary", bytes: 1, fffd: true }, + ]; + try { + process.env.OCX_LIVE_FRAME_LOG = frameLogPath; + for (const frame of frames) logLiveSidebandFrame("u2c", frame.data); + logLiveSidebandFrame("c2u", { privateText: damagedText }); + const raw = readFileSync(frameLogPath, "utf8"); + const records = raw.trim().split("\n").map(line => JSON.parse(line)); + expect(records).toHaveLength(frames.length); + records.forEach((record, index) => { + const expected = frames[index]!; + expect(record).toEqual({ + ts: expect.any(String), dir: "u2c", kind: expected.kind, + bytes: expected.bytes, fffd: expected.fffd, + }); + expect(Number.isNaN(Date.parse(record.ts))).toBe(false); + }); + for (const content of [damagedText, "safe", "한글", "�"]) expect(raw).not.toContain(content); + delete process.env.OCX_LIVE_FRAME_LOG; + logLiveSidebandFrame("c2u", damagedText); + expect(readFileSync(frameLogPath, "utf8")).toBe(raw); + process.env.OCX_LIVE_FRAME_LOG = TEST_DIR; + expect(() => logLiveSidebandFrame("c2u", damagedText)).not.toThrow(); + } finally { + if (previousFrameLog === undefined) delete process.env.OCX_LIVE_FRAME_LOG; + else process.env.OCX_LIVE_FRAME_LOG = previousFrameLog; + } +}); + // ── /readyz: per-server readiness gate ──────────────────────────────────────── // /healthz remains the immediate liveness signal (with only bounded capability // metadata); /readyz is the stricter gate that reflects the post-startup Codex sync diff --git a/tests/server/server-xai-responses-streaming.test.ts b/tests/server/server-xai-responses-streaming.test.ts index ef0f1e5313..316ee56b91 100644 --- a/tests/server/server-xai-responses-streaming.test.ts +++ b/tests/server/server-xai-responses-streaming.test.ts @@ -72,6 +72,99 @@ function sse(payload: unknown): Uint8Array { } describe("xAI OAuth Responses streaming opt-in", () => { + test.each([true, false])("continues a routed parent after a string child result (stream=%s)", async stream => { + const captured: Array<Record<string, unknown>> = []; + let privateItemRejections = 0; + const childText = " Synthetic worker result\nAll requested observations returned.\n "; + const call = { type: "function_call", id: "fc_parent_probe", status: "completed", + call_id: "call_parent_probe", name: "probe", arguments: "{}", + }; + globalThis.fetch = (async (input, init) => { + const url = input instanceof Request ? input.url : String(input); + // The fixture never falls through to a real OAuth or inference endpoint. + if (url !== RESPONSES_ENDPOINT) throw new Error(`Unexpected fixture destination: ${url}`); + const body = JSON.parse(String(init?.body)) as Record<string, unknown>; + captured.push(body); + const items = body.input as Array<{ type?: string }>; + if (items.some(item => item.type === "agent_message")) { + privateItemRejections += 1; + return Response.json({ error: 'unknown item type "agent_message"' }, { status: 422 }); + } + const output = captured.length === 1 ? [call] : [{ + type: "message", id: `msg_child_result_${captured.length}`, status: "completed", role: "assistant", + content: [{ type: "output_text", text: captured.length === 2 ? childText : "Parent continued", annotations: [] }], + }]; + const response = { id: `resp_child_result_${captured.length}`, object: "response", status: "completed", + model: "grok-4.6", output, + }; + if (!stream) return Response.json(response); + return new Response(new ReadableStream<Uint8Array>({ + start(controller) { + controller.enqueue(sse({ type: "response.created", sequence_number: 0, + response: { ...response, status: "in_progress", output: [] }, + })); + controller.enqueue(sse({ type: "response.output_item.added", sequence_number: 1, output_index: 0, item: output[0] })); + controller.enqueue(sse({ type: "response.output_item.done", sequence_number: 2, output_index: 0, item: output[0] })); + controller.enqueue(sse({ type: "response.completed", sequence_number: 3, response })); + controller.close(); + }, + }), { headers: { "content-type": "text/event-stream" } }); + }) as typeof fetch; + + saveConfig({ ...config(), multiAgentMode: "v2" }); + const server = startServer(0); + const send = async (session: string, input: unknown[], parentSession?: string) => { + const response = await originalFetch(new URL("/v1/responses", server.url), { + method: "POST", headers: { "content-type": "application/json", "session-id": session, + ...(parentSession ? { "x-codex-parent-thread-id": parentSession } : {}), + }, + body: JSON.stringify({ model: "xai/grok-4.6", stream, store: false, input, + tools: [{ type: "function", name: "probe", parameters: { type: "object", properties: {} } }], + }), + }); + expect(response.status).toBe(200); + if (!stream) return await response.json() as { output: Array<Record<string, unknown>> }; + const text = await response.text(); + const events = text.split(/\r?\n/).filter(line => line.startsWith("data: ") && line !== "data: [DONE]") + .map(line => JSON.parse(line.slice(6))); + const terminal = events.find(event => event.type === "response.completed"); + expect(terminal).toBeDefined(); + return terminal.response as { output: Array<Record<string, unknown>> }; + }; + try { + const initial = { type: "message", role: "user", content: [{ type: "input_text", text: "Collect a worker result" }] }; + const parent = await send("fixture-parent", [initial]); + expect(parent.output[0]).toMatchObject(call); + const child = await send("fixture-worker", [ + { type: "message", role: "user", content: [{ type: "input_text", text: "Return the synthetic observations" }] }, + ], "fixture-parent"); + const childContent = child.output[0]!.content as Array<{ type: string; text: string }>; + expect(childContent[0]).toMatchObject({ type: "output_text", text: childText }); + // Codex-client envelope simulation only: no scheduler or real child process is run. + const toolResult = { type: "function_call_output", call_id: call.call_id, output: "Probe completed" }; + const agentMessage = { type: "agent_message", id: "amsg_worker_result", author: "/root/worker", recipient: "/root", + content: childContent[0]!.text, + }; + const resumed = await send("fixture-parent", [initial, ...parent.output, toolResult, agentMessage]); + expect(resumed.output[0]).toMatchObject({ type: "message", content: [{ type: "output_text", text: "Parent continued" }] }); + expect(privateItemRejections).toBe(0); + expect(captured).toHaveLength(3); + const input = captured[2]!.input as Array<Record<string, unknown>>; + expect(input.some(item => item.type === "agent_message")).toBe(false); + expect(input.filter(item => item.type === "function_call")).toEqual([ + expect.objectContaining({ call_id: call.call_id, name: "probe", arguments: "{}" }), + ]); + expect(input.filter(item => item.type === "function_call_output")).toEqual([toolResult]); + expect(input).toContainEqual({ type: "message", role: "user", content: [ + { type: "input_text", text: 'Agent message {"author":"/root/worker","recipient":"/root"}' }, + { type: "input_text", text: childText }, + ] }); + expect(agentMessage.content).toBe(childText); + } finally { + await server.stop(true); + } + }, 10_000); + test("uses the native Responses wire and relays the first delta before completion", async () => { let releaseCompletion!: () => void; const completionGate = new Promise<void>(resolve => { releaseCompletion = resolve; }); diff --git a/tests/service/init-eof.test.ts b/tests/service/init-eof.test.ts index e098e5c56c..df863f13af 100644 --- a/tests/service/init-eof.test.ts +++ b/tests/service/init-eof.test.ts @@ -173,6 +173,55 @@ describe("ocx init piped stdin (#754)", () => { } finally { await stop(proc); } }, 30_000); + test.each(["permissions", "link", "link-residue"])("publication recovery guidance reaches the CLI (%s)", async failure => { + const home = makeHome(); + const backup = join(home, "config.json.pre-openai-tiers-v2.bak"); + writeFileSync(backup, "preserve backup on publication failure"); + const bootstrap = ` + import { mock } from "bun:test"; + const configApi = { ...await import("./src/config.ts") }; + const failure = ${JSON.stringify(failure)}; + const io = failure === "permissions" + ? { harden() { throw new Error("private permission detail"); } } + : { + link() { throw Object.assign(new Error("private link detail"), { code: "EPERM" }); }, + ...(failure === "link-residue" ? { unlink() { throw new Error("private cleanup detail"); } } : {}), + }; + mock.module("./src/config.ts", () => ({ + ...configApi, + initializePersistedConfigIfMissing(config) { + return configApi.initializePersistedConfigIfMissing(config, io); + }, + })); + const { runInit } = await import("./src/cli/init.ts"); + await runInit(); + `; + const proc = launch(home, "init", bootstrap); + const stderr = new Response(proc.stderr).text(); + try { + await reachPortPrompt(proc); + proc.stdin.write("21001\n"); + await proc.stdin.flush(); + const stdout = remainingOutput(proc.stdout); + expect(await proc.exited).toBe(1); + const diagnostic = await stderr; + expect(diagnostic).toContain("OPENCODEX_HOME"); + expect(diagnostic).toContain("ocx init"); + expect(diagnostic).not.toMatch(/fixture-init-key|private (permission|link|cleanup) detail/); + if (failure === "permissions") { + expect(diagnostic).toContain("permissions could not be secured"); + expect(diagnostic).not.toContain("Config may already exist"); + } else { + expect(diagnostic).toContain("hard-link publication"); + expect(diagnostic).toContain("Config may already exist; inspect it before retrying"); + } + expect(diagnostic.includes("A temporary file could not be removed")).toBe(failure === "link-residue"); + expect(await stdout).not.toMatch(/Inject into|autostart shim|Setup complete/); + expect(existsSync(join(home, "config.json"))).toBe(false); + expect(readFileSync(backup, "utf8")).toBe("preserve backup on publication failure"); + } finally { await stop(proc); } + }, 30_000); + // Windows process.kill does not deliver a POSIX SIGINT to readline. test.skipIf(process.platform === "win32")("SIGINT settles a pending prompt without creating config", async () => { const home = makeHome(); diff --git a/tests/storage/storage-mutation-race.test.ts b/tests/storage/storage-mutation-race.test.ts index fb89dd9215..24a410e86f 100644 --- a/tests/storage/storage-mutation-race.test.ts +++ b/tests/storage/storage-mutation-race.test.ts @@ -265,27 +265,40 @@ describe("storage mutation coordinator", () => { test("policy run is rejected while manual cleanup holds the shared mutation slot", async () => { const home = isolatedCodexHome!.path; - setArchivedCleanupJobTestHooks({ blockMs: 1200 }); + const cleanupReadyPath = join(testDir, "policy-cleanup-slot.ready"); + const releaseCleanupPath = join(testDir, "policy-cleanup-release"); + setArchivedCleanupJobTestHooks({ + pauseAfterAcquire: { + kind: "cleanup", + readyPath: cleanupReadyPath, + releasePath: releaseCleanupPath, + }, + }); seedArchivedPair(home); const server = startServer(0); + let cleanupPromise: Promise<Response> | null = null; try { const preview = await previewDigest(server.url, 50); - const cleanupPromise = fetch(new URL("/api/storage/cleanup", server.url), { + cleanupPromise = fetch(new URL("/api/storage/cleanup", server.url), { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ percent: 50, mode: "quarantine", digest: preview.digest }), }); - await Bun.sleep(80); + await waitForCondition("cleanup slot before policy admission", () => existsSync(cleanupReadyPath)); + expect(getActiveStorageMutation(home)?.kind).toBe("cleanup"); const { startedAt } = await enablePolicyAndRun(server.url); const done = await waitForPolicyJob(server.url, startedAt); expect(done.job.lastOutcome?.ok).toBe(false); expect(done.job.lastOutcome?.error).toBe("storage_mutation_busy"); + writeFileSync(releaseCleanupPath, "release\n"); const cleanupRes = await cleanupPromise; expect(cleanupRes.status).toBe(200); } finally { + writeFileSync(releaseCleanupPath, "release\n"); + if (cleanupPromise) await cleanupPromise.catch(() => undefined); await stopRaceServer(server); } }, { timeout: 30_000 }); diff --git a/tests/windows/windows-secret-acl.test.ts b/tests/windows/windows-secret-acl.test.ts index aa011bb516..29d1b7bc3f 100644 --- a/tests/windows/windows-secret-acl.test.ts +++ b/tests/windows/windows-secret-acl.test.ts @@ -632,6 +632,30 @@ describe("icacls executable authority", () => { }); }); +describe("atomic secret temp writer portability", () => { + test("sync and async secret temp writers use Bun-portable exclusive creation", async () => { + // Bun on Windows misinterpreted the equivalent numeric O_* combination as + // ENOENT, so every pid/config/oauth temp write failed during ocx start + // and on management-API config saves. Keep both writers on the portable + // exclusive-write spelling ("wx" keeps O_EXCL; 0o600 keeps the private + // mode) so the O_CREAT bit can never be dropped again. + const src = readFileSync(repoPath("src", "config", "atomic-write.ts"), "utf8"); + expect(src.match(/openSync\(path, "wx", 0o600\)/g)).toHaveLength(2); + }); +}); + +describe("initial config temp writer portability", () => { + test("initial config publication uses Bun-portable exclusive creation", () => { + // publishInitialConfigNoReplace carries the same Bun/Windows exposure as the + // atomic writers above: the numeric O_* combination lost its creation bit, so + // first-run `ocx init` failed before it could publish config.json. Exclusive + // creation is what makes the added O_TRUNC harmless — an existing temp name + // (or a symlink planted at one) fails the open instead of being truncated. + const src = readFileSync(repoPath("src", "config", "initialize.ts"), "utf8"); + expect(src.match(/openSync\(temp, "wx", 0o600\)/g)).toHaveLength(1); + }); +}); + describe("diagnostics sanitization contract", () => { test("HardenResult diagnostics field is a plain string when present", () => { const filePath = join(testDir, "diag-test.json");