fix: integrate twelve open bug and compatibility PRs (sweep 260926)

bin/ocx.mjs

@@ -591,17 +591,30 @@ function runPackageManagerSelfUpdate(manager) {
     let stopAttempted = false;
 
     function recoverStoppedRuntimeAfterFailure(reason) {
-      const recoveryOwnership = readOwnership();
-      const recoveryLiveness = currentPackageRuntimeLiveness();
-      const recovery = planStoppedRuntimeRecovery({
-        stopAttempted,
-        ...recoveryOwnership,
-        sameOwner: ownershipIdentity(recoveryOwnership) === stoppedOwnershipIdentity,
-        liveness: recoveryLiveness,
-        serviceInstalled: serviceWasInstalled,
-        launcherUsable: postUpdateLauncherUsable,
-        hadRuntimeState: hasRuntimeState,
-      });
+      const planRecovery = () => {
+        const recoveryOwnership = readOwnership();
+        const liveness = currentPackageRuntimeLiveness();
+        return {
+          liveness,
+          plan: planStoppedRuntimeRecovery({
+            stopAttempted,
+            ...recoveryOwnership,
+            sameOwner: ownershipIdentity(recoveryOwnership) === stoppedOwnershipIdentity,
+            liveness,
+            serviceInstalled: serviceWasInstalled,
+            launcherUsable: postUpdateLauncherUsable,
+            hadRuntimeState: hasRuntimeState,
+          }),
+        };
+      };
+      let { liveness: recoveryLiveness, plan: recovery } = planRecovery();
+      if (recovery.action === "service") {
+        // The service manager starts the proxy outside this process tree, so it cannot join this
+        // lease, and holding the lease through the repair's health wait keeps that proxy from
+        // starting (#5760). Release it as the successful path does, then decide again.
+        releaseUpdateLease();
+        ({ liveness: recoveryLiveness, plan: recovery } = planRecovery());
+      }
       if (recovery.reason === "ownership-unknown") {
         console.error(`opencodex: ${reason}; runtime ownership is unknown, so automatic recovery was refused. Run 'ocx status --json' and repair the service-state record before retrying.`);
       } else if (recovery.reason === "ownership-transferred") {

docs-site/src/content/docs/guides/integrations.md

@@ -28,6 +28,13 @@ Generated catalogs include only enabled models from each provider selection. Thi
 downloads and managed integrations, including Pi and Aside. The management model list still shows
 the full roster so you can enable additional models.
 
+`ocx uninstall` disables recorded integrations, including all owned Aside profiles, before deleting
+OpenCodex's recovery state. Unreadable ownership, missing profile registration or a conflicting edit
+stops that deletion. Cleanup is sequential: earlier successful disables are not undone when a later
+one fails. If compensation also fails, a client file may be left in an intermediate state. Inspect
+the reported client files and retained recovery snapshots before retrying; retained state does not
+mean every client was restored or left unchanged.
+
 For Gajae built-in presets, keep the routing choice in `~/.gjc/agent/config.yml`:
 
 ```yaml

docs-site/src/content/docs/guides/remote-workspace.md

@@ -27,6 +27,16 @@ lifecycle owner can retain cleanup authority through cancellation. Missing comma
 falls back to executing on the Hub.
 :::
 
+## RPC compatibility and timeouts
+
+Remote Workspace uses encrypted RPC v2. The Hub and every Executor must support v2; RPC v1 peers
+fail closed instead of falling back to immediate execution, so upgrade the Hub and Executors
+together.
+
+A timeout requests executor cancellation but does not confirm it. A grant may already be in transit,
+or its operation may already be running. The default RPC timeout is 65 seconds, and `timeoutMs`
+accepts inclusive values from 1 through 120,000 milliseconds.
+
 ## Set up the Hub
 
 Computer 1 owns every coding-agent login and model session. Install and log in to whichever agents

scripts/build-standalone.ts

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { cpSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { join, resolve } from "node:path";
+import { join, resolve, basename } from "node:path";
 import { isStandaloneTarget, standaloneExecutableName } from "./standalone-targets";
 
 function hostTarget(): string {
@@ -28,17 +28,61 @@ if (!existsSync(join(guiDist, "index.html"))) {
 const output = resolve(argumentValue("--out") ?? join(repoRoot, "dist", "standalone", target));
 mkdirSync(output, { recursive: true });
 const executable = join(output, standaloneExecutableName(target));
-const result = Bun.spawnSync([
-  process.execPath,
-  "build",
-  "--compile",
-  "--target",
-  target,
-  join(repoRoot, "src", "cli", "index.ts"),
-  "--outfile",
-  executable,
-], { stdout: "inherit", stderr: "inherit" });
-if (result.exitCode !== 0) process.exit(result.exitCode);
+
+// Pre-bundle worker entrypoints so compiled binaries can spawn them from Blob
+// URLs: oven-sh/bun#29124 breaks nested worker entrypoints resolved from
+// $bunfs, so `new Worker(new URL(...))` dies with ModuleNotFound otherwise.
+const WORKER_ENTRIES: Record<string, string> = {
+  "policy-worker": join(repoRoot, "src", "storage", "policy-worker.ts"),
+  "restore-worker": join(repoRoot, "src", "storage", "restore-worker.ts"),
+  "history-worker": join(repoRoot, "src", "codex", "history-worker.ts"),
+};
+const GEN_FILE = join(repoRoot, "src", "generated", "worker-bundles.gen.ts");
+const GEN_PLACEHOLDER = `// Generated by scripts/build-standalone.ts — do not edit by hand.\n// Placeholder for source checkouts; standalone builds overwrite this file\n// with pre-bundled worker sources before compiling.\nexport const WORKER_BUNDLES: Record<string, string> = {};\n`;
+const bundleLines: string[] = [];
+const workerOut = join(output, ".worker-bundles");
+for (const [key, entry] of Object.entries(WORKER_ENTRIES)) {
+  const bundled = Bun.spawnSync([process.execPath, "build", entry, "--target", "bun", "--outdir", workerOut], {
+    stdout: "inherit",
+    stderr: "inherit",
+  });
+  if (bundled.exitCode !== 0) process.exit(bundled.exitCode ?? 1);
+  const name = `${basename(entry, ".ts")}.js`;
+  bundleLines.push(`  ${JSON.stringify(key)}: ${JSON.stringify(readFileSync(join(workerOut, name), "utf8"))},`);
+}
+writeFileSync(
+  GEN_FILE,
+  `// Generated by scripts/build-standalone.ts — do not edit by hand.\nexport const WORKER_BUNDLES: Record<string, string> = {\n${bundleLines.join("\n")}\n};\n`,
+);
+
+// The generated bundles only exist while the compile below consumes them.
+// Always restore the empty placeholder afterwards — success or failure — so
+// source-checkout runs and tests keep spawning workers from source files
+// instead of a stale committed bundle.
+function restoreGenPlaceholder(): void {
+  writeFileSync(GEN_FILE, GEN_PLACEHOLDER);
+}
+
+const compileArgs = [process.execPath, "build", "--compile"];
+// Cross-compiling to the host target produces a binary the kernel kills on
+// launch; only pass --target when it differs from the host.
+if (target !== hostTarget()) compileArgs.push("--target", target);
+compileArgs.push(join(repoRoot, "src", "cli", "index.ts"), "--outfile", executable);
+// process.exit() skips `finally`, so exit only after the placeholder is back.
+let compileExitCode: number;
+try {
+  compileExitCode = Bun.spawnSync(compileArgs, { stdout: "inherit", stderr: "inherit" }).exitCode ?? 1;
+} finally {
+  restoreGenPlaceholder();
+}
+if (compileExitCode !== 0) process.exit(compileExitCode);
+
+// bun's ad-hoc linker signature does not always cover the embedded payload;
+// macOS kills the executable on launch (SIGKILL) unless it is re-signed.
+if (process.platform === "darwin") {
+  const sign = Bun.spawnSync(["codesign", "--force", "--sign", "-", executable], { stdout: "inherit", stderr: "inherit" });
+  if (sign.exitCode !== 0) process.exit(sign.exitCode ?? 1);
+}
 
 cpSync(guiDist, join(output, "gui", "dist"), { recursive: true });
 const digest = createHash("sha256").update(readFileSync(executable)).digest("hex");

scripts/test-layout/layout.json

@@ -177,6 +177,8 @@
     "standalone-build-script.test.ts": "gui",
     "standalone-service.test.ts": "service",
     "standalone.test.ts": "lib",
+    "worker-embed.test.ts": "lib",
+    "worker-embed-coverage.test.ts": "lib",
     "server-combo-held-response.test.ts": "server",
     "key-attribution.test.ts": "usage",
     "jev-stats.test.ts": "usage",
@@ -1828,6 +1830,9 @@
     "warmup-registration.test.ts": "ci-workflows",
     "warmup.test.ts": "codex-integration",
     "web-search-anthropic.test.ts": "web-search",
+    "devin-web-search.test.ts": "web-search",
+    "web-search-recovery-kind.test.ts": "web-search",
+    "chat-legacy-functions-combo.test.ts": "responses",
     "web-search-backend-union.test.ts": "web-search",
     "web-search-bridge-replay.test.ts": "web-search",
     "web-search-candidates.test.ts": "web-search",

src/chat/inbound.ts

@@ -211,6 +211,27 @@ function toolCallsToItems(
   }
 }
 
+function legacyFunctionCallToItem(
+  value: unknown,
+  input: Rec[],
+  knownNameByCallId: Map<string, string>,
+  awaitingToolResult: Set<string>,
+  sequence: number,
+): { callId: string; name: string } | null {
+  if (value === undefined) return null;
+  if (!isRec(value) || typeof value.name !== "string" || value.name.length === 0) {
+    throw new ChatCompletionsRequestError("assistant function_call requires a name");
+  }
+  const args = typeof value.arguments === "string"
+    ? value.arguments
+    : JSON.stringify(value.arguments ?? {});
+  const callId = `call_legacy_${String(sequence).padStart(4, "0")}`;
+  knownNameByCallId.set(callId, value.name);
+  awaitingToolResult.add(callId);
+  input.push({ type: "function_call", call_id: callId, name: value.name, arguments: args });
+  return { callId, name: value.name };
+}
+
 function toolsToResponses(tools: unknown): Rec[] | undefined {
   if (!Array.isArray(tools) || tools.length === 0) return undefined;
   const out: Rec[] = [];
@@ -243,6 +264,24 @@ function toolsToResponses(tools: unknown): Rec[] | undefined {
   return out.length > 0 ? out : undefined;
 }
 
+function legacyFunctionsToResponses(functions: unknown): Rec[] | undefined {
+  if (functions === undefined) return undefined;
+  if (!Array.isArray(functions)) throw new ChatCompletionsRequestError("functions must be an array");
+  const out: Rec[] = [];
+  for (const raw of functions) {
+    if (!isRec(raw) || typeof raw.name !== "string" || raw.name.length === 0) {
+      throw new ChatCompletionsRequestError("functions entries require a name");
+    }
+    out.push({
+      type: "function",
+      name: raw.name,
+      ...(typeof raw.description === "string" ? { description: raw.description } : {}),
+      ...(isRec(raw.parameters) ? { parameters: raw.parameters } : {}),
+    });
+  }
+  return out.length > 0 ? out : undefined;
+}
+
 function toolChoiceToResponses(choice: unknown, body: Rec): void {
   if (choice === undefined || choice === null) return;
   if (choice === "auto" || choice === "none" || choice === "required") {
@@ -269,6 +308,18 @@ function toolChoiceToResponses(choice: unknown, body: Rec): void {
   }
 }
 
+function legacyFunctionChoiceToResponses(choice: unknown, body: Rec): void {
+  if (choice === undefined || choice === null) return;
+  if (choice === "auto" || choice === "none") {
+    body.tool_choice = choice;
+    return;
+  }
+  if (!isRec(choice) || typeof choice.name !== "string" || choice.name.length === 0) {
+    throw new ChatCompletionsRequestError("function_call requires auto, none, or a function name");
+  }
+  body.tool_choice = { type: "function", name: choice.name };
+}
+
 /**
  * Chat Completions nests the subset under `allowed_tools`, Responses carries `mode`/`tools`
  * on the choice itself, and each entry names its tool under a member keyed by its own type
@@ -389,6 +440,8 @@ export function chatCompletionsToResponsesBody(raw: unknown): Rec {
   // Recover replace-style tool calls incrementally instead of rebuilding the
   // call-id index from the entire translated transcript for every message.
   const knownNameByCallId = new Map<string, string>();
+  const legacyAwaiting: Array<{ callId: string; name: string }> = [];
+  let legacyCallSequence = 0;
   // Tool calls whose result has not arrived yet. Several adapters need a call and its output
   // to stay adjacent — Kiro refuses an interrupted pair (src/adapters/kiro/payload.ts) and the
   // Anthropic and Google mappers synthesize a missing result — so an instruction that arrives
@@ -405,6 +458,7 @@ export function chatCompletionsToResponsesBody(raw: unknown): Rec {
   const beginConversationTurn = (): void => {
     releaseHeldInstructions();
     awaitingToolResult.clear();
+    legacyAwaiting.length = 0;
   };
 
   for (const msg of raw.messages) {
@@ -462,6 +516,16 @@ export function chatCompletionsToResponsesBody(raw: unknown): Rec {
         if (msg.tool_calls !== undefined) {
           toolCallsToItems(msg.tool_calls, input, knownNameByCallId, awaitingToolResult);
         }
+        if (msg.function_call !== undefined && msg.function_call !== null) {
+          const call = legacyFunctionCallToItem(
+            msg.function_call,
+            input,
+            knownNameByCallId,
+            awaitingToolResult,
+            ++legacyCallSequence,
+          );
+          if (call) legacyAwaiting.push(call);
+        }
         break;
       }
       case "function": {
@@ -472,6 +536,17 @@ export function chatCompletionsToResponsesBody(raw: unknown): Rec {
             "Legacy function-result image translation is not implemented. Use tool_calls and role:tool with tool_call_id.",
           );
         }
+        const name = typeof msg.name === "string" ? msg.name : "";
+        if (!name) throw new ChatCompletionsRequestError("function messages require a name");
+        const pendingIndex = legacyAwaiting.findIndex(call => call.name === name);
+        if (pendingIndex < 0) {
+          throw new ChatCompletionsRequestError(`function result has no pending call named ${name}`);
+        }
+        const [call] = legacyAwaiting.splice(pendingIndex, 1);
+        const output = contentToText(msg.content);
+        input.push({ type: "function_call_output", call_id: call!.callId, output });
+        awaitingToolResult.delete(call!.callId);
+        if (awaitingToolResult.size === 0) releaseHeldInstructions();
         break;
       }
       case "tool": {
@@ -507,9 +582,13 @@ export function chatCompletionsToResponsesBody(raw: unknown): Rec {
 
   if (systemParts.length > 0) body.instructions = systemParts.join("\n\n");
 
-  const tools = toolsToResponses(raw.tools);
-  if (tools) body.tools = tools;
-  toolChoiceToResponses(raw.tool_choice, body);
+  const tools = [
+    ...(toolsToResponses(raw.tools) ?? []),
+    ...(legacyFunctionsToResponses(raw.functions) ?? []),
+  ];
+  if (tools.length > 0) body.tools = tools;
+  if (raw.tool_choice !== undefined) toolChoiceToResponses(raw.tool_choice, body);
+  else legacyFunctionChoiceToResponses(raw.function_call, body);
 
   const maxTokens = typeof raw.max_completion_tokens === "number"
     ? raw.max_completion_tokens

src/chat/outbound.ts

@@ -154,9 +154,11 @@ function appendedUtf8Bytes(previous: string, previousBytes: number, fragment: st
   const fragmentFirst = fragment.charCodeAt(0);
   if (previousLast >= 0xd800 && previousLast <= 0xdbff
     && fragmentFirst >= 0xdc00 && fragmentFirst <= 0xdfff) {
-    // Buffer.byteLength() replaces each isolated surrogate with three bytes, while the joined
-    // pair is one four-byte scalar. Preserve full-string sizing without re-encoding the prefix.
-    nextBytes -= 2;
+    // Buffer implementations disagree on the encoded size of an isolated surrogate. Measure
+    // the join delta so incremental accounting equals the completed scalar on every runtime.
+    const tail = previous[previous.length - 1]!;
+    const head = fragment[0]!;
+    nextBytes += Buffer.byteLength(tail + head) - Buffer.byteLength(tail) - Buffer.byteLength(head);
   }
   return nextBytes;
 }

src/cli/uninstall-client-state.ts

@@ -6,13 +6,15 @@ import { inspectRemoteDesktopCleanup, readDesktopDisconnectReceipt } from "../cl
 import { removeOwnedConfigState, type ConfigRemovalResult } from "../lib/config-ownership";
 import { windowsSecretAclReapPendingAtOrBelow } from "../lib/windows-secret-acl";
 import { sharedTeardownAuthorized, type UninstallObservation } from "./uninstall-plan";
+import { cleanupOwnedIntegrationsBeforeUninstall } from "./uninstall-integrations";
 
 export interface UninstallClientStateDeps {
   readConnection: typeof readClientConnectionState;
   inspectDesktop: typeof inspectRemoteDesktopCleanup;
   readReceipt: typeof readDesktopDisconnectReceipt;
   disconnect: (options?: Parameters<typeof disconnectClient>[0]) => Promise<unknown>;
   withLifecycle: typeof withClientLifecycle;
+  cleanupIntegrations: typeof cleanupOwnedIntegrationsBeforeUninstall;
   remove: () => ConfigRemovalResult;
   /** True while a timed-out icacls child still owns a path at or below the config directory. */
   aclReapPending: (rootPath: string) => boolean;
@@ -24,6 +26,7 @@ const defaults: UninstallClientStateDeps = {
   readReceipt: readDesktopDisconnectReceipt,
   disconnect: options => disconnectClient(options),
   withLifecycle: withClientLifecycle,
+  cleanupIntegrations: cleanupOwnedIntegrationsBeforeUninstall,
   remove: () => removeOwnedConfigState(getConfigDir()),
   aclReapPending: rootPath => windowsSecretAclReapPendingAtOrBelow(rootPath),
 };
@@ -85,6 +88,9 @@ export async function removeOwnedConfigAfterDesktopCleanup(
     if (deps.aclReapPending(getConfigDir())) {
       throw new Error("Client cleanup refused: ACL hardening still owns a path under the config directory.");
     }
+    // Integration records are the authority that permits removing only OpenCodex-owned fragments
+    // from third-party files. Delete them only after every recorded contribution is retired.
+    await deps.cleanupIntegrations();
     return deps.remove();
   });
 }