merge(dev): resolve openai-chat EOF conflict for #793

Keep the restored #773 finish-less EOF rules (answer text required;
pending tool calls fail closed before flush) while taking tip's clearer
mid-tool-call truncation message.

Author: Wibias

.gitignore

@@ -4,10 +4,19 @@ dist/
 *.log
 .DS_Store
 
-# Maintainer-only planning notes. `devlog` is a private submodule
-# (lidge-jun/opencodex-internal) pinned by gitlink; its contents are never
-# tracked here. Commit inside the submodule, then bump the pointer separately.
-devlog/
+# Maintainer planning notes are TRACKED in this repository (`devlog/`). Security
+# material is not: see the "Security working notes" section of AGENTS.md.
+#
+# These exclusions were previously enforced by devlog's own .gitignore, which stops
+# applying now that devlog is not a separate repository. Reference clones are
+# third-party source with their own licenses and must never enter this history.
+devlog/_chase/_cca/
+devlog/_chase/_litellm/
+devlog/_fin/opencode-cursor/
+devlog/_plan/*/_ref_*/
+devlog/**/*-security-redaction/
+devlog/**/*_security_findings/
+devlog/**/security-advisory-draft*
 
 # Scratch space. Security working notes — unreleased findings, draft advisories,
 # exploit reasoning, pre-disclosure patch plans — belong here or in a

.gitmodules

@@ -22,42 +22,39 @@ Bun-native TypeScript with no separate server compile step.
   changing shared subsystems.
 - `scripts/` — release and maintenance tooling; `scripts/release.ts` is the
   release authority.
-- `devlog/` — maintainer-only planning and investigation notes. This is a
-  **private submodule** (`lidge-jun/opencodex-internal`), not a directory of
-  this repository. See "The `devlog` submodule" below.
+- `devlog/` — planning and investigation notes, tracked in this repository. See
+  "The `devlog` directory" below for what may and may not go there.
 
 Read the nearest nested `AGENTS.md` before changing files in a scoped
 directory (`src/`, `gui/`, `docs-site/`, `scripts/`, `.github/`).
 
-## The `devlog` submodule
-
-Planning notes, triage matrices, and investigation artifacts live in the private
-`lidge-jun/opencodex-internal` repository, wired in as the `devlog` submodule.
-They quote live infrastructure state, provider behaviour, unfixed defects, and
-internal triage reasoning, so a public clone should carry the runtime and its
-docs and nothing else.
-
-The pointer is deliberately **loose**, so a missing or stale `devlog` can never
-fail a check:
-
-- `.gitmodules` declares `ignore = dirty`, `update = none`, and `shallow = true`.
-  A dirty or moved submodule working tree does not show up in `git status` on
-  the parent, and `git submodule update` will not touch it unless asked
-  explicitly.
-- No workflow checks it out. `actions/checkout` runs without `submodules:`, so
-  CI clones the public tree only and the private URL is never resolved.
-- Nothing in the build, test, typecheck, or privacy-scan path reads from
-  `devlog/`. Contributors without access see an empty directory and every gate
-  still passes.
-- `devlog/` stays listed in `.gitignore` for the working tree; the submodule
-  gitlink is tracked, its contents are not.
-
-Two rules keep it that way. Never commit anything under `devlog/` to *this*
-repository — commit inside the submodule, then update the pointer here as a
-separate commit. And never nest a git repository inside the submodule: a
-`160000` gitlink in a tree that CI does not initialize breaks
-`actions/checkout` for every contributor, which is exactly what happened before
-this split.
+## The `devlog` directory
+
+Planning notes, triage matrices, and investigation artifacts live in `devlog/`,
+tracked like any other documentation. There is no submodule and no private
+mirror. It was a private submodule until the pointer churn outgrew its value:
+1723 commits touched the gitlink, and `dev`, `preview`, and `main` each carried a
+different pointer, so every branch move and promotion dragged a diff.
+
+- `devlog/_plan/` — units still open, one directory per unit, decade-numbered
+  docs.
+- `devlog/_fin/` — closed units, moved here once a terminal outcome is recorded.
+  A `_fin` unit is a record of work already visible in public git history.
+- `devlog/_chase/` — external reference material for parity comparisons.
+  Reference *clones* are gitignored: they are third-party source carrying their
+  own licenses and have no business in this repository's history.
+
+Nothing in the build, typecheck, or test path reads from `devlog/`, so a
+contributor who ignores it entirely still passes every gate. `privacy:scan` does
+read it — that is deliberate, and it is what makes a public devlog safe rather
+than merely visible.
+
+Two mechanical guards in `tests/repo-hygiene.test.ts` back this up: no `160000`
+gitlink may be tracked anywhere, and neither the vendored reference clones nor
+the security triage excised before publication may reappear in the index. Both
+were driven red once to prove they are not vacuous. The gitlink assertion exists
+because a gitlink in a tree CI does not initialize breaks `actions/checkout` for
+every contributor, which happened twice.
 
 ## Security working notes
 
@@ -67,9 +64,23 @@ or bypass reasoning, reproduction steps for an unfixed defect, and
 pre-disclosure patch plans.
 
 Use `.tmp/` in the working tree (already gitignored) or a `mktemp -d` path.
-`devlog/` is **not** an acceptable location, and neither is a private
-repository: both get cloned across machines and CI, both outlive the embargo,
-and neither history is practical to purge afterwards.
+`devlog/` is **not** an acceptable location — it is a public directory in a
+public repository, so anything committed there is disclosed the moment it is
+pushed, and the history is not practical to purge afterwards. A private
+repository is not acceptable either: it gets cloned across machines and CI and
+outlives the embargo.
+
+**This binds maintainers exactly as it binds contributors and agents.** The rule
+has been violated by maintainer-authored triage before: two units of open
+security review accumulated under `devlog/_plan/` and had to be excised before
+this directory could be published. Seniority is not an exemption, and "it is
+only in the private half" is no longer a thing that exists.
+
+The test to apply before writing a security note into `devlog/`: **is there
+already a public diff that reveals this weakness?** If the fix has shipped, the
+writeup discloses nothing new and belongs in `_fin/`. If it has not, the note is
+pre-disclosure material and goes to scratch. That distinction is why closed
+hardening records stay in the tree while open triage does not.
 
 Only the published outcome reaches a repository — the fix itself, its
 regression test, the release note, the advisory once it is public. Draft the

AGENTS.md

@@ -10,10 +10,11 @@
  */
 import { spawn, spawnSync } from "node:child_process";
 import { createRequire } from "node:module";
-import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { isRealBunBinary } from "../src/lib/bun-binary-validator.mjs";
 import { npmInvocation } from "../src/update/npm-invocation.mjs";
 import { handoffWindowsTrayForUpdate, planWindowsTrayUpdate } from "../src/update/tray-update-plan.mjs";
 
@@ -287,18 +288,14 @@ function bunBinDir() {
   return dirname(require.resolve("bun/package.json"));
 }
 
-// The `bun` package ships a tiny ASCII placeholder at bin/bun.exe until its
-// postinstall downloads the real ~60MB binary. --ignore-scripts / pnpm leave
-// the ~450-byte stub in place, which is NOT executable (ENOEXEC). A size gate
-// cleanly distinguishes the stub from a real binary on every platform.
-const REAL_BUN_MIN_BYTES = 1_000_000;
+const BUN_OVERRIDE_ENV = "OPENCODEX_BUN_PATH";
 
 function findBunBinary(bunDir) {
   // The npm `bun` package ships the binary as bin/bun.exe on every platform;
   // probe bin/bun too for forward compatibility.
   for (const name of ["bun.exe", "bun"]) {
     const p = join(bunDir, "bin", name);
-    if (existsSync(p) && statSync(p).size >= REAL_BUN_MIN_BYTES) return p;
+    if (isRealBunBinary(p)) return p;
   }
   return null;
 }
@@ -317,6 +314,17 @@ function fail(msg) {
 }
 
 function resolveBun() {
+  // Keep direct npm-launcher starts aligned with durable service/shim installs:
+  // a valid explicit runtime must win even when the bundled dependency exists.
+  const override = process.env[BUN_OVERRIDE_ENV]?.trim();
+  if (override) {
+    const overridePath = resolve(override);
+    if (isRealBunBinary(overridePath)) return overridePath;
+    console.error(
+      `opencodex: ${BUN_OVERRIDE_ENV} is missing, unreadable, or not a complete Bun binary; falling back to the bundled runtime.`,
+    );
+  }
+
   let bunDir;
   try {
     bunDir = bunBinDir();

bin/ocx.mjs

@@ -8,3 +8,8 @@
 # The npm script already uses `bun test ./tests/`; this makes a bare `bun test` behave the same.
 [test]
 root = "tests"
+# Sandboxes HOME/OPENCODEX_HOME/CODEX_HOME and arms the real-home write guard for EVERY
+# invocation, including a bare `bun test <file>` that skips `scripts/test.ts`. A test
+# once overwrote a real user config through that unwrapped path; see
+# devlog/_plan/260730_codex_rs_upstream_v2_live_handoff/070.
+preload = ["./tests/preload.ts"]

bunfig.toml

@@ -0,0 +1,14 @@
+# Reference repos are cloned for analysis, never tracked. A nested .git becomes a
+# 160000 gitlink in the parent index and breaks actions/checkout downstream.
+_chase/_cca/
+_chase/_litellm/
+_fin/opencode-cursor/
+_plan/*/_ref_*/
+
+# Security working notes never belong in a repository, not even a private one.
+# Use .tmp/ in the public tree or a mktemp -d path instead. See README.md.
+*-security-redaction/
+*_security_findings/
+**/security-advisory-draft*
+
+.DS_Store

devlog

@@ -0,0 +1 @@
+probe

devlog/.gitignore

@@ -0,0 +1,60 @@
+# devlog
+
+Planning and investigation notes for
+[lidge-jun/opencodex](https://github.com/lidge-jun/opencodex), tracked in that
+repository. Public.
+
+## Why these are public
+
+These notes were a private submodule until the bookkeeping outgrew the benefit:
+1723 commits touched the gitlink, and `dev`, `preview`, and `main` each held a
+different pointer, so every branch move and promotion dragged a diff. The
+privacy was doing one job — keeping pre-disclosure security material out of
+public view — and that job is now done by a rule plus a check instead, which is
+cheaper and does not tax every ordinary commit.
+
+What that trade requires is stated below and is not optional.
+
+## What belongs here
+
+Closed records: plans, audits, measurements, and post-mortems for work that has
+shipped. A `_fin/` unit documents something already visible in public git
+history, so publishing the writeup discloses nothing the diff does not.
+
+## Layout
+
+- `_plan/` — units still open. One directory per unit, decade-numbered docs.
+- `_fin/` — closed units. A unit moves here once its terminal outcome is
+  recorded (`DONE`, `NOOP`, `BLOCKED`, or `NEEDS_HUMAN` with the reason).
+- `_chase/` — external reference material captured for parity comparisons.
+
+## Security working notes do not live here
+
+**Never commit unreleased security findings, draft advisories, exploit paths, or
+pre-disclosure patch plans here.** This directory is public, so a commit is a
+disclosure the moment it is pushed, and the history is impractical to purge. A
+private repository is no better: it is cloned across machines and CI and
+outlives the embargo.
+
+**This binds maintainers.** It has been violated by maintainer-authored triage
+before — two units of open security review accumulated under `_plan/` and had to
+be excised before this directory could be published.
+
+The deciding question before writing a security note here: **is there already a
+public diff that reveals this weakness?** If yes, it is a closed record and
+belongs in `_fin/`. If no, it is pre-disclosure material and belongs in scratch.
+
+Security work happens in an untracked scratch directory (`.tmp/` in the public
+working tree, or a `mktemp -d` path), and only the published outcome — release
+notes, advisory text, the fix itself — reaches any repository. See the
+"Security working notes" section of the public [`AGENTS.md`](https://github.com/lidge-jun/opencodex/blob/dev/AGENTS.md)
+for the full rule.
+
+## Submodule hygiene
+
+The public repository pins this repository by commit and declares
+`ignore = dirty`, `update = none`, `shallow = true`. Public CI never checks it
+out and nothing in the build or test path reads from it, so an unavailable or
+stale pointer cannot fail a public check. Do not add embedded git repositories
+here; a nested `.git` becomes a `160000` gitlink in the parent index and breaks
+`actions/checkout` for everyone.

devlog/.patchprobe

@@ -0,0 +1,36 @@
+# parity 분석 인덱스 (3 upstream)
+
+opencodex 프록시 레이어가 따라잡는 세 upstream의 parity 스냅샷. 각 문서는
+분석 시점의 upstream HEAD를 박아둔다. 재분석 시 HEAD를 갱신하고 delta만 본다.
+
+## 분석 baseline HEAD (2026-07-01 분석)
+
+| slug | repo | 분석 HEAD | 날짜 | 문서 |
+|---|---|---|---|---|
+| jawcode (gjc) | `lidge-jun/jawcode` | `27311f6` | 2026-07-01 04:35 | `10_jawcode.md` |
+| cli-proxy-api (cca) | `router-for-me/CLIProxyAPI` | `00114be` | 2026-06-29 18:59 | `20_cli-proxy-api.md` |
+| litellm | `BerriAI/litellm` | `be4d0d8` | 2026-06-30 12:25 | `30_litellm.md` |
+
+> jawcode 로컬 HEAD는 분석 직후 `a06f814`(docs-only, `docs(chase): close 10.062 → _fin`)로
+> 한 커밋 앞섰다. 코드 변경 없음 — 분석 baseline은 마지막 코드 커밋 `27311f6`이 정확하다.
+
+opencodex baseline (분석 시): registry provider **48개**, adapter 종류 6
+(`openai-chat`×37, `anthropic`×4, `google`×3, `openai-responses`×2, `kiro`×1, `azure-openai`×1).
+
+## 세 upstream의 성격이 다르다 (parity 축도 다름)
+
+| upstream | 성격 | opencodex와의 관계 | parity 축 |
+|---|---|---|---|
+| jawcode | TS 멀티-프로바이더 AI 패키지 (47 provider 모듈) | **직접 포팅 출처** (1차 SOT) | provider-by-provider wire/auth 1:1 대조 |
+| cli-proxy-api | Go OAuth IDE 프록시 (antigravity/codex/claude/kimi/vertex/xai) | wire/auth/quirks **외부 교차검증** (2차) | executor/translator/signature 동작 대조 |
+| litellm | Python 범용 SDK (130 provider 폴더, 모델가격 맵) | 모델 카탈로그/커버리지 폭 **참조** (3차) | provider·model 커버리지 폭, 컨텍스트 윈도우 |
+
+## 분석 방법
+
+- jawcode: 로컬 `/Users/jun/Developer/new/700_projects/jawcode` (clone 불필요)
+- cca: `devlog/_chase/_cca/` (shallow clone, gitignored)
+- litellm: `devlog/_chase/_litellm/` (shallow clone, gitignored)
+
+클론 디렉터리는 `devlog/` 통째 gitignore로 자동 무시. 노트(`*.md`)만 `git add -f`.
+
+세부는 각 문서 참조.