sync: upstream v2.47.0 (decision-handoff resolved)

Dockerfile

@@ -18,18 +18,23 @@ RUN cd gui && bun install --frozen-lockfile
 
 COPY --chown=bun:bun src ./src
 COPY --chown=bun:bun scripts/model-metadata.source.json ./scripts/model-metadata.source.json
-COPY --chown=bun:bun docker/bootstrap-tls.ts docker/bootstrap-token.ts docker/config.json docker/healthcheck.ts docker/verify-compatibility.ts ./docker/
+COPY --chown=bun:bun docker ./docker
 COPY --chown=bun:bun gui ./gui
 RUN cd gui && bun run build
 
 FROM ${BUN_IMAGE} AS runtime
 WORKDIR /home/bun/app
 
+# Docker supervises this foreground process; retain routed state on stop/recreate.
+# This uses the existing service lifecycle mode and does not install a service manager.
 ENV NODE_ENV=production \
+    OCX_SERVICE=1 \
     OPENCODEX_HOME=/home/bun/.opencodex \
+    CODEX_HOME=/home/bun/.codex \
     OCX_API_TOKEN_FILE=/home/bun/.opencodex/service-api-token
 
-RUN install -d -m 0700 -o bun -g bun /home/bun/.opencodex
+# These homes have incompatible auth.json formats; persist them without combining them.
+RUN install -d -m 0700 -o bun -g bun /home/bun/.opencodex /home/bun/.codex
 COPY --chown=bun:bun --chmod=0600 docker/config.json /home/bun/.opencodex/config.json
 
 COPY --from=build --chown=bun:bun /home/bun/app/package.json ./package.json
@@ -44,13 +49,12 @@ COPY --from=build --chown=bun:bun /home/bun/app/docker ./docker
 COPY --from=build --chown=bun:bun /home/bun/app/gui/dist ./gui/dist
 
 USER bun
-RUN ["bun", "docker/verify-compatibility.ts", "--runtime"]
+RUN ["bun", "docker/verify-compatibility.ts"]
 RUN ["bun", "-e", "import { readOpenCodexCompatibilityVersion } from './src/routing/compatibility/version.ts'; if (!/^[0-9a-f]{64}$/.test(readOpenCodexCompatibilityVersion() ?? '')) throw new Error('Missing or invalid generated compatibility manifest');"]
-RUN ["/usr/bin/openssl", "version"]
-VOLUME ["/home/bun/.opencodex"]
+VOLUME ["/home/bun/.opencodex", "/home/bun/.codex"]
 EXPOSE 10100
 
 HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
-  CMD ["bun", "docker/healthcheck.ts"]
+  CMD ["bun", "-e", "const r=await fetch('http://127.0.0.1:10100/healthz');if(!r.ok)process.exit(1)"]
 
-CMD ["sh", "-c", "bun run docker/bootstrap-tls.ts && exec bun run src/cli/index.ts start --port 10100"]
+CMD ["bun", "run", "src/cli/index.ts", "start", "--port", "10100"]

README.md

@@ -99,6 +99,26 @@ account exclusion, affinity expiry, or 401/403 and 429 recovery can rebind them.
 selection order when one of them — usually your Codex Desktop login — should only be reached for
 once the others are drained.
 
+### Sponsors
+
+Sponsors keep opencodex maintained across every upstream protocol change. Interested?
+See [SPONSORS.md](./SPONSORS.md).
+
+<!-- sponsors:main — one banner, model developers only; empty until a Main sponsor signs -->
+
+<!-- sponsors:standard — one row per sponsor, in order of signing. Uncomment the table with the first row:
+<table>
+<tbody>
+<tr>
+<td width="180"><a href="SPONSOR_URL"><img src="https://raw.githubusercontent.com/lidge-jun/opencodex/main/assets/sponsors/SPONSOR.png" alt="SPONSOR" width="150"></a></td>
+<td>Thanks to SPONSOR for sponsoring this project! BLURB</td>
+</tr>
+</tbody>
+</table>
+-->
+
+---
+
 <details>
 <summary>Docker Compose</summary>
 
@@ -226,6 +246,7 @@ see the [installation docs](https://opencodex.me/getting-started/installation/).
 - **Sub-agents on any model** — feature routed models in Codex's sub-agent picker, with v1/v2
   surface control and fallback chains. See the
   [sub-agent guide](https://opencodex.me/guides/sub-agent-surface/).
+<!-- sponsors:main-first-mention -->
 - **Log in once, skip the API key** — OAuth for xAI, Anthropic, and Kimi; or forward
   `codex login`, paste a key, or use `${ENV_VAR}` references.
 - **Web search & vision sidecars** — non-OpenAI models get real web search and image understanding
@@ -278,6 +299,7 @@ full-slash form keeps working too. Details: [model routing docs](https://opencod
 
 ## Providers & adapters
 
+<!-- sponsors:main-first-mention -->
 OpenAI (ChatGPT login or API key), Anthropic, Google Gemini, xAI, Kimi, Azure OpenAI, Ollama
 (local + Cloud), Cursor (experimental), and every OpenAI-compatible endpoint — plus DeepSeek,
 Groq, OpenRouter, Together, Fireworks, Cerebras, Mistral, Hugging Face, NVIDIA NIM, MiniMax,

SPONSORS.md

@@ -0,0 +1,105 @@
+# Sponsors
+
+opencodex is an independent, MIT-licensed project maintained without company backing. Provider
+sponsorships fund maintenance and keep the proxy current with every upstream protocol change.
+This page is the public rule set: what a sponsor gets, who qualifies for which tier, and how to
+ask. It is written so that a sponsor, a contributor, and a user reading the README all see the
+same terms.
+
+"Sponsor" here means a paying provider sponsor. It is unrelated to the `maintainer-sponsored`
+label in [`MAINTAINERS.md`](./MAINTAINERS.md), which is about a maintainer vouching for a
+contributor's change to a restricted surface.
+
+Sponsorship buys placement and maintenance attention. It never buys a change in routing behavior,
+a default model, a weaker security default, or an exception to the review policy in
+[`MAINTAINERS.md`](./MAINTAINERS.md). A sponsored preset goes through the same registry
+pattern, typecheck, tests, and review as any other provider.
+
+## Tiers
+
+Two tiers, split by what the sponsor is.
+
+### Main — model developers
+
+Reserved for organizations that train or host their own foundation models (the OpenAI,
+Anthropic, Google, Moonshot, MiniMax class). API relays and gateways are never sold Main
+regardless of budget.
+
+Every model developer is supported as a first-class provider whether or not it sponsors; that
+part does not change. A Main sponsor additionally receives:
+
+- The single banner slot above the sponsor table in the README (one at a time; see
+  [Placement](#placement)).
+- First mention in the README login and provider lines (the "Log in once" OAuth paragraph and
+  the Providers & adapters summary, both marked with a `sponsors:main-first-mention` comment)
+  and priority ordering in the built-in provider picker.
+- Everything in the Standard tier below.
+
+### Standard — relays, gateways, and API resellers
+
+For OpenAI-compatible relays, routers, gateways, and other resellers of model access. A Standard
+sponsor receives:
+
+- One row in the sponsor table: logo (about 150px wide, linking to the sponsor URL), a
+  "Thanks to X for sponsoring this project!" line, and a blurb of up to about 80 English words
+  supplied by the sponsor and published verbatim. The maintainer may decline or require edits to
+  text that is false, misleading, disparages third parties, or breaches applicable law or GitHub
+  policy. A second-language blurb (for example Chinese) may run alongside the English one.
+- A built-in provider preset (`ocx provider select <id>`) shipped in a public npm release,
+  listed near the top of the provider picker in the dashboard and CLI and marked as a sponsor
+  there. (The registry field and picker ordering that back this land with the first sponsor
+  preset; today the picker follows registry order.)
+- A detailed entry on the [providers page](https://opencodex.me/guides/providers/) of the docs
+  site.
+- Maintenance: if a release breaks the preset or its adapter, the maintainer fixes it; issues
+  filed against that provider are triaged first. There is no response-time SLA.
+
+## Placement
+
+The README sponsor section sits directly under **Quick start**, before the Docker Compose
+details, so it is on screen before a first-time visitor scrolls. It carries one line of context
+and the placements themselves:
+
+1. One Main banner (empty until a Main sponsor signs).
+2. The Standard table, one row per sponsor, in order of signing date.
+
+The README says nothing else about sponsorship; tiers, pricing, and contact channels live only on
+this page.
+
+The translated READMEs under [`readme/`](./readme) carry one linking line right after their
+own quick-start block instead of duplicating the section, so a sponsor change is one edit in
+English.
+
+## Pricing
+
+Pricing is by inquiry; there is no public rate card. Sponsors who sign before the repository
+reaches 20,000 GitHub stars lock in their rate for the length of their agreement. Rates rise
+once that mark is passed.
+
+Agreements are integration-scoped: they name the deliverables above, anchor the term to the npm
+release that ships them, and carry no marketing obligations on either side. Both sides can walk
+away with a pro-rated refund of unused months if the integration cannot be delivered.
+
+## How to ask
+
+- X: DM [@claudeebum](https://x.com/claudeebum)
+- Discord: [discord.gg/JEaPEtkHwh](https://discord.gg/JEaPEtkHwh), channel `#sponsors`
+- Email: jun@lidgeai.com
+
+Send what you are (model developer or relay), the base URL and model list of your
+OpenAI-compatible endpoint, and the tier you want. The maintainer replies with terms and a
+draft agreement.
+
+## What sponsors do not get
+
+- No influence on routing defaults, failover order, quota policy, or which provider a user's
+  request reaches.
+- No relaxation of the [security review](./MAINTAINERS.md) that applies to authentication,
+  credentials, or workflow changes.
+- No access to user data, request logs, or telemetry; opencodex does not collect any.
+- No say over unrelated issues, pull requests, or the release schedule.
+
+## Current sponsors
+
+Listed in the README sponsor section. This page carries the rules; the README carries the
+names.

compose.yaml

@@ -9,13 +9,17 @@ services:
       target: runtime
     init: true
     read_only: true
+    environment:
+      # A custom CODEX_HOME also requires a matching writable volume target below.
+      CODEX_HOME: /home/bun/.codex
     ports:
       - "${OPENCODEX_BIND_ADDRESS:-127.0.0.1}:${OPENCODEX_PORT:-10100}:10100"
     environment:
       OCX_CONTAINER_PUBLIC_PORT: "${OPENCODEX_PORT:-10100}"
       OCX_CONTAINER_PUBLIC_ORIGIN: "${OPENCODEX_PUBLIC_ORIGIN:-}"
     volumes:
       - ocx-state:/home/bun/.opencodex
+      - codex-state:/home/bun/.codex
     tmpfs:
       - /tmp:size=64m,mode=1777
     security_opt:
@@ -27,3 +31,4 @@ services:
 
 volumes:
   ocx-state:
+  codex-state:

devlog/_fin/260905_always_on_429_failover/090_outcome.md

@@ -18,7 +18,7 @@ the tree rather than against the plan — the plan's own criteria were satisfied
 Two were defects the fix itself created (#3499, #3503), three were surfaces still describing the
 old contract (#3517, #3520, #3523), one closed the structural gap that let this unit ship two
 subset-rotator loops (#3512), and one cleaned up after a collision with concurrent maintainer
-work (#3526). All are recorded in `091`.
+work (#3526). The runtime post-merge findings and CI lessons are recorded in `091`.
 
 ## What changed
 

devlog/_fin/260905_always_on_429_failover/091_post_merge_audit.md

@@ -67,14 +67,37 @@ The post-merge run on `dev` then showed `ci failure`, which was a genuinely alar
 out. It turned out to be cancellation by the maintainer's next merge two minutes later, not a
 real failure — every job read `cancelled`, not `failure`.
 
-**Rule:** verify with the check-runs API and require zero `null` conclusions, not a pass count:
+**Rule:** use the exact head SHA, require every expected aggregate or policy gate by name, and
+also require zero non-terminal check runs. A missing check is not success. Paginate before treating
+the returned set as complete:
 
 ```bash
-gh api repos/<owner>/<repo>/commits/<sha>/check-runs \
-  --jq '[.check_runs[] | .conclusion] | group_by(.) | map({(.[0]//"null"): length}) | add'
+set -o pipefail
+gh api --paginate repos/<owner>/<repo>/commits/<sha>/check-runs \
+  | jq -se '
+      [.[].check_runs[]] as $runs
+      | ["ci", "enforce-target", "hygiene", "react-doctor"] as $expected
+      | ($expected - [
+          $runs[]
+          | select(.status == "completed" and .conclusion == "success")
+          | .name
+        ]) as $missing
+      | [
+          $runs[]
+          | select(.status != "completed" or .conclusion == null)
+          | .name
+        ] as $pending
+      | if ($missing | length) == 0 and ($pending | length) == 0
+        then {ready: true, expected: $expected}
+        else error("missing=\($missing) pending=\($pending)")
+        end'
 ```
 
-A clean result looks like `{"skipped":3,"success":24}` — no `null` key at all.
+A clean result is `{"ready":true,...}` with exit status 0. This does not replace review-policy
+checks such as confirming the approval belongs to the same head. Every `$expected` value is an
+exact Checks API `.check_runs[].name`, not a workflow title or workflow-run name. If those required
+check-run names change, update this list with the policy; silently accepting an absent name
+recreates the original bug.
 
 The near-miss paid for itself: sweeping `dev` afterwards found a real defect. #3511 and #3513
 landed concurrently, one moving `anthropic-quorum-cache.test.ts` into `tests/routing/` and the

devlog/_fin/260907_axis1_bugfixes/000_plan.md

@@ -0,0 +1,24 @@
+# Axis 1: measured bug fixes and failure diagnostics
+
+Completed: see [031_delivery_record.md](031_delivery_record.md) for merged commits, final CI, attribution and deferrals.
+
+Archetype: satisfy existing contracts. Trigger: owner assigned axis 1 (#3809, #3464, #3661). Goal: deliver reviewable fixes through a manual PR chain and merge the verified scope. Non-goals: new account/retry policy, auth defaults, multipart recovery, releases, native stacks, sibling edits. Stop: merged feasible scope plus explicit unresolved dispositions. Escalation: defer a policy-dependent or unreproducible slice; reclaim a worker slice after two failed packets. Evidence: this unit plus ignored `.tmp/axis1/` and `.codexclaw` receipts. Resources: task-owned worktree/branches and GitHub repository access; Astra high leaves within host capacity; no caller-specified token or wall-clock budget.
+
+Baseline: origin/dev 137d6a727; source PR #3809 at 4a1012359a522ddd6d7ff77203c9e5f3632d605c. Assigned 5cc8 checkout has pre-existing changes and remains untouched. Code lives in /tmp/ocx-axis1-20260907.
+
+## Cycle map
+1. wp0: docs-only scope, source audit and dependency roadmap; no runtime changes.
+2. wp1: bounded quota, version-guidance and recovery-diagnostic changes; independent source/security review and structural checks. Runtime verification deferred explicitly to wp2.
+3. wp2: publish ordinary PR chain, run final cumulative hosted CI, resolve findings, admin merge bottom-up and verify dev ancestry. Lower CI only if final CI fails.
+
+## Delivery contract
+The owner explicitly requests a manual delivery chain even where units are independent: quota -> CLI guidance -> recovery reasons, with each layer carrying its own tests and credit. This order is an integration order, not a fabricated runtime dependency. No native registration. Lower commits carry [skip ci] to defer duplicate workflow runs; final head does not. Skipped lower runs are never called passing. No local tests/typecheck/build suites and no hook-triggered suites; task pushes use --no-verify. Hosted ci.yml on the final head must cover all changed runtime/tests; lower-level runs are diagnostic only after final failure. Merge with --admin under the explicit owner exception; preserve original commits/trailers with merge commits, retarget each child to dev, and check integration trees against final evidence. Concurrent dev changes require fresh combined verification.
+
+## Work boundaries
+- Quota: src/providers/quota.ts, src/oauth/anthropic-routing.ts, src/oauth/health.ts, src/server/responses/core.ts, src/images/loop.ts, src/web-search/loop.ts, focused quota tests/layout, provider documentation.
+- CLI: src/cli/version-skew.ts and relevant status/doctor consumers, tests/cli/cli-version-skew.test.ts, troubleshooting documentation. No service restart or repair behavior changes.
+- Recovery: src/server/responses/agent-task-recovery.ts, agent-task-recovery-cache.ts, src/lib/bounded-body.ts and existing focused tests, Responses error projection if needed, recovery documentation. No expanded admission/retry.
+- Main owns shared core.ts integration and test-layout files. Workers must not touch each other's paths or git index.
+
+## Verification and acceptance
+No local suite commands are executed. Source mapping, git diff --check and documentation structural checks are local evidence only. Hosted Cross-platform CI at final head provides runtime/typecheck/privacy and affected platform proof; inspect jobs for skipped coverage. Build completion is provisional until that run and independent audit succeed. Original PR author(s) must be named in commit Co-authored-by trailers, sourced from original commits/API; report authors may also be acknowledged accurately. Source-of-truth sync uses relevant existing structure and docs-site pages.

devlog/_fin/260907_axis1_bugfixes/010_roadmap.md

@@ -0,0 +1,3 @@
+# wp0: scope roadmap
+
+Read current source, prior issue disposition and PR #3809 before choosing changes. Independent Astra high reviewers map each bounded issue. Confirm existing launcher behavior and bounded recovery reasons are already in dev; plan only residual fixes. Record exact file boundaries and acceptance scenarios in 020. Success: all three slices have verifiable requirements, main-owned shared files, original author anchors and explicit policy exclusions. Local evidence is documentation and source inspection; no runtime claim.

devlog/_fin/260907_axis1_bugfixes/011_audit.md

@@ -0,0 +1,5 @@
+# wp0 audit disposition
+
+Independent Astra high reviewer Hooke: VERDICT: GO-WITH-FIXES (blockers=1). Shared-flight failure propagation was the blocker. Accepted: 000/020 now assign cache and bounded-body ownership and define shared typed outcomes, success-only cache, caller-local cancellation and capacity semantics. Source scouts independently identified and confirmed these requirements. Fixed stale CLI test path. Windows runtime proof requires final workflow_dispatch, now explicit in 030.
+
+No runtime code changed. Documentation source/ownership inspection and git diff --check are the wp0 evidence. Runtime verification remains wp2.

devlog/_fin/260907_axis1_bugfixes/012_roadmap_lock.md

@@ -0,0 +1,5 @@
+# Roadmap lock
+
+The second independent audit returned VERDICT: PASS with no remaining blockers. The three accepted slices are ready for scoped implementation. Original quota author: Éverton Toffanetto (everton-dgn), commit identity from 4f3779c04753 and 3ef0ade296c3. Issue reporters: garysassano (10464497) and Hu9956 (282876394). Reporter acknowledgement is separate from code authorship.
+
+Preserve raw unequal version diagnostics. Detailed recovery outcomes must travel in the shared flight, not caller-local closures. Quota observations use immutable dispatch identity. Final verification is hosted workflow_dispatch for full Windows coverage; local suites remain prohibited.