merge(dev): sync #751 onto tip; keep DeepInfra + Hyperbolic

Resolve registry/docs conflicts by retaining both presets and bumping published totals to 62 (51 key).

Author: Wibias

.github/scripts/enforce-pr-target.test.cjs

@@ -65,6 +65,7 @@ describe("enforce-pr-target workflow", () => {
     assert.match(workflow, /stackedBase/);
     assert.match(workflow, /github\.rest\.pulls\.list/);
     assert.match(workflow, /treating as stacked/);
+    assert.match(workflow, /other\.base\?\.repo\?\.owner/);
     const qualityCall = workflow.match(
       /collectPrQualityFailures\(\{([\s\S]*?)\}\);/,
     );

.github/workflows/enforce-pr-target.yml

@@ -299,8 +299,8 @@ jobs:
                   other =>
                     other.number !== pull_number &&
                     other.head?.ref === pr.base.ref &&
-                    (other.head?.repo?.owner?.login ?? owner) === baseOwner &&
-                    (other.head?.repo?.name ?? repo) === baseName
+                    (other.base?.repo?.owner?.login ?? owner) === baseOwner &&
+                    (other.base?.repo?.name ?? repo) === baseName
                 );
                 if (stackedBase) {
                   core.info(

.gitignore

@@ -4,10 +4,19 @@ dist/
 *.log
 .DS_Store
 
-# Maintainer-only planning notes. `devlog` is a private submodule
-# (lidge-jun/opencodex-internal) pinned by gitlink; its contents are never
-# tracked here. Commit inside the submodule, then bump the pointer separately.
-devlog/
+# Maintainer planning notes are TRACKED in this repository (`devlog/`). Security
+# material is not: see the "Security working notes" section of AGENTS.md.
+#
+# These exclusions were previously enforced by devlog's own .gitignore, which stops
+# applying now that devlog is not a separate repository. Reference clones are
+# third-party source with their own licenses and must never enter this history.
+devlog/_chase/_cca/
+devlog/_chase/_litellm/
+devlog/_fin/opencode-cursor/
+devlog/_plan/*/_ref_*/
+devlog/**/*-security-redaction/
+devlog/**/*_security_findings/
+devlog/**/security-advisory-draft*
 
 # Scratch space. Security working notes — unreleased findings, draft advisories,
 # exploit reasoning, pre-disclosure patch plans — belong here or in a

.gitmodules

@@ -22,42 +22,39 @@ Bun-native TypeScript with no separate server compile step.
   changing shared subsystems.
 - `scripts/` — release and maintenance tooling; `scripts/release.ts` is the
   release authority.
-- `devlog/` — maintainer-only planning and investigation notes. This is a
-  **private submodule** (`lidge-jun/opencodex-internal`), not a directory of
-  this repository. See "The `devlog` submodule" below.
+- `devlog/` — planning and investigation notes, tracked in this repository. See
+  "The `devlog` directory" below for what may and may not go there.
 
 Read the nearest nested `AGENTS.md` before changing files in a scoped
 directory (`src/`, `gui/`, `docs-site/`, `scripts/`, `.github/`).
 
-## The `devlog` submodule
-
-Planning notes, triage matrices, and investigation artifacts live in the private
-`lidge-jun/opencodex-internal` repository, wired in as the `devlog` submodule.
-They quote live infrastructure state, provider behaviour, unfixed defects, and
-internal triage reasoning, so a public clone should carry the runtime and its
-docs and nothing else.
-
-The pointer is deliberately **loose**, so a missing or stale `devlog` can never
-fail a check:
-
-- `.gitmodules` declares `ignore = dirty`, `update = none`, and `shallow = true`.
-  A dirty or moved submodule working tree does not show up in `git status` on
-  the parent, and `git submodule update` will not touch it unless asked
-  explicitly.
-- No workflow checks it out. `actions/checkout` runs without `submodules:`, so
-  CI clones the public tree only and the private URL is never resolved.
-- Nothing in the build, test, typecheck, or privacy-scan path reads from
-  `devlog/`. Contributors without access see an empty directory and every gate
-  still passes.
-- `devlog/` stays listed in `.gitignore` for the working tree; the submodule
-  gitlink is tracked, its contents are not.
-
-Two rules keep it that way. Never commit anything under `devlog/` to *this*
-repository — commit inside the submodule, then update the pointer here as a
-separate commit. And never nest a git repository inside the submodule: a
-`160000` gitlink in a tree that CI does not initialize breaks
-`actions/checkout` for every contributor, which is exactly what happened before
-this split.
+## The `devlog` directory
+
+Planning notes, triage matrices, and investigation artifacts live in `devlog/`,
+tracked like any other documentation. There is no submodule and no private
+mirror. It was a private submodule until the pointer churn outgrew its value:
+1723 commits touched the gitlink, and `dev`, `preview`, and `main` each carried a
+different pointer, so every branch move and promotion dragged a diff.
+
+- `devlog/_plan/` — units still open, one directory per unit, decade-numbered
+  docs.
+- `devlog/_fin/` — closed units, moved here once a terminal outcome is recorded.
+  A `_fin` unit is a record of work already visible in public git history.
+- `devlog/_chase/` — external reference material for parity comparisons.
+  Reference *clones* are gitignored: they are third-party source carrying their
+  own licenses and have no business in this repository's history.
+
+Nothing in the build, typecheck, or test path reads from `devlog/`, so a
+contributor who ignores it entirely still passes every gate. `privacy:scan` does
+read it — that is deliberate, and it is what makes a public devlog safe rather
+than merely visible.
+
+Two mechanical guards in `tests/repo-hygiene.test.ts` back this up: no `160000`
+gitlink may be tracked anywhere, and neither the vendored reference clones nor
+the security triage excised before publication may reappear in the index. Both
+were driven red once to prove they are not vacuous. The gitlink assertion exists
+because a gitlink in a tree CI does not initialize breaks `actions/checkout` for
+every contributor, which happened twice.
 
 ## Security working notes
 
@@ -67,9 +64,23 @@ or bypass reasoning, reproduction steps for an unfixed defect, and
 pre-disclosure patch plans.
 
 Use `.tmp/` in the working tree (already gitignored) or a `mktemp -d` path.
-`devlog/` is **not** an acceptable location, and neither is a private
-repository: both get cloned across machines and CI, both outlive the embargo,
-and neither history is practical to purge afterwards.
+`devlog/` is **not** an acceptable location — it is a public directory in a
+public repository, so anything committed there is disclosed the moment it is
+pushed, and the history is not practical to purge afterwards. A private
+repository is not acceptable either: it gets cloned across machines and CI and
+outlives the embargo.
+
+**This binds maintainers exactly as it binds contributors and agents.** The rule
+has been violated by maintainer-authored triage before: two units of open
+security review accumulated under `devlog/_plan/` and had to be excised before
+this directory could be published. Seniority is not an exemption, and "it is
+only in the private half" is no longer a thing that exists.
+
+The test to apply before writing a security note into `devlog/`: **is there
+already a public diff that reveals this weakness?** If the fix has shipped, the
+writeup discloses nothing new and belongs in `_fin/`. If it has not, the note is
+pre-disclosure material and goes to scratch. That distinction is why closed
+hardening records stay in the tree while open triage does not.
 
 Only the published outcome reaches a repository — the fix itself, its
 regression test, the release note, the advisory once it is public. Draft the

AGENTS.md

@@ -10,10 +10,11 @@
  */
 import { spawn, spawnSync } from "node:child_process";
 import { createRequire } from "node:module";
-import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { isRealBunBinary } from "../src/lib/bun-binary-validator.mjs";
 import { npmInvocation } from "../src/update/npm-invocation.mjs";
 import { handoffWindowsTrayForUpdate, planWindowsTrayUpdate } from "../src/update/tray-update-plan.mjs";
 
@@ -287,18 +288,14 @@ function bunBinDir() {
   return dirname(require.resolve("bun/package.json"));
 }
 
-// The `bun` package ships a tiny ASCII placeholder at bin/bun.exe until its
-// postinstall downloads the real ~60MB binary. --ignore-scripts / pnpm leave
-// the ~450-byte stub in place, which is NOT executable (ENOEXEC). A size gate
-// cleanly distinguishes the stub from a real binary on every platform.
-const REAL_BUN_MIN_BYTES = 1_000_000;
+const BUN_OVERRIDE_ENV = "OPENCODEX_BUN_PATH";
 
 function findBunBinary(bunDir) {
   // The npm `bun` package ships the binary as bin/bun.exe on every platform;
   // probe bin/bun too for forward compatibility.
   for (const name of ["bun.exe", "bun"]) {
     const p = join(bunDir, "bin", name);
-    if (existsSync(p) && statSync(p).size >= REAL_BUN_MIN_BYTES) return p;
+    if (isRealBunBinary(p)) return p;
   }
   return null;
 }
@@ -317,6 +314,17 @@ function fail(msg) {
 }
 
 function resolveBun() {
+  // Keep direct npm-launcher starts aligned with durable service/shim installs:
+  // a valid explicit runtime must win even when the bundled dependency exists.
+  const override = process.env[BUN_OVERRIDE_ENV]?.trim();
+  if (override) {
+    const overridePath = resolve(override);
+    if (isRealBunBinary(overridePath)) return overridePath;
+    console.error(
+      `opencodex: ${BUN_OVERRIDE_ENV} is missing, unreadable, or not a complete Bun binary; falling back to the bundled runtime.`,
+    );
+  }
+
   let bunDir;
   try {
     bunDir = bunBinDir();

bin/ocx.mjs

@@ -8,3 +8,8 @@
 # The npm script already uses `bun test ./tests/`; this makes a bare `bun test` behave the same.
 [test]
 root = "tests"
+# Sandboxes HOME/OPENCODEX_HOME/CODEX_HOME and arms the real-home write guard for EVERY
+# invocation, including a bare `bun test <file>` that skips `scripts/test.ts`. A test
+# once overwrote a real user config through that unwrapped path; see
+# devlog/_plan/260730_codex_rs_upstream_v2_live_handoff/070.
+preload = ["./tests/preload.ts"]

bunfig.toml

@@ -0,0 +1,14 @@
+# Reference repos are cloned for analysis, never tracked. A nested .git becomes a
+# 160000 gitlink in the parent index and breaks actions/checkout downstream.
+_chase/_cca/
+_chase/_litellm/
+_fin/opencode-cursor/
+_plan/*/_ref_*/
+
+# Security working notes never belong in a repository, not even a private one.
+# Use .tmp/ in the public tree or a mktemp -d path instead. See README.md.
+*-security-redaction/
+*_security_findings/
+**/security-advisory-draft*
+
+.DS_Store

devlog

@@ -0,0 +1 @@
+probe