merge(dev): integrate provider outbound hardening

Author: olddonkey

.github/ISSUE_TEMPLATE/config.yml

@@ -1,5 +1,8 @@
 blank_issues_enabled: false
 contact_links:
+  - name: Report a security vulnerability (private)
+    url: https://github.com/lidge-jun/opencodex/security/advisories/new
+    about: Report undisclosed vulnerabilities privately to the maintainers. Do not open a public issue.
   - name: Security policy
     url: https://github.com/lidge-jun/opencodex/blob/main/SECURITY.md
     about: Read the supported-version and reporting guidance before sharing security-sensitive details.

README.md

@@ -509,6 +509,9 @@ The public docs — install, providers, routing, sidecars, Codex integration, Co
 Maintainer source-of-truth notes live under [`structure/`](./structure). Historical investigations remain under [`docs/`](./docs).
 Contributor setup lives in [`CONTRIBUTING.md`](./CONTRIBUTING.md), and security reporting guidance
 lives in [`SECURITY.md`](./SECURITY.md).
+Report undisclosed vulnerabilities privately through
+[GitHub private vulnerability reporting](https://github.com/lidge-jun/opencodex/security/advisories/new),
+not a public issue.
 
 ## Development
 

SECURITY.md

@@ -17,13 +17,19 @@ or the latest published package before triage continues.
 
 Please avoid posting undisclosed vulnerabilities as public GitHub issues.
 
-- Prefer this repository's GitHub private vulnerability reporting or GitHub Security Advisory flow
-  when that option is available in the repository UI.
-- If no private reporting option is available, do not include exploit details, secrets, or live
-  targets in a public issue. Open a minimal issue that asks maintainers for a safe coordination path.
-- Include affected versions, reproduction steps, impact, and any required configuration details.
+Report privately through GitHub private vulnerability reporting, which is enabled on this
+repository:
 
-The project does not publish a dedicated private security email in this repository.
+**<https://github.com/lidge-jun/opencodex/security/advisories/new>**
+
+The same form is reachable from the repository's **Security** tab under **Report a vulnerability**.
+It is private between you and the maintainers, and it is the only channel this project offers for
+undisclosed vulnerabilities — there is no dedicated private security email.
+
+Include affected versions, reproduction steps, impact, and any required configuration details.
+
+If the form is ever unreachable for you, open a minimal public issue that asks maintainers for a
+safe coordination path. Do not include exploit details, secrets, or live targets in that issue.
 
 ## Response Expectations
 

bin/ocx.mjs

@@ -14,6 +14,7 @@ import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { npmInvocation } from "../src/update/npm-invocation.mjs";
 import { handoffWindowsTrayForUpdate, planWindowsTrayUpdate } from "../src/update/tray-update-plan.mjs";
 
 const PKG = "@bitkyc08/opencodex";
@@ -29,10 +30,6 @@ function isBunGlobalInstall() {
   return /[\\/]\.bun[\\/]/.test(here);
 }
 
-function npmBin() {
-  return process.platform === "win32" ? "npm.cmd" : "npm";
-}
-
 function currentPackageVersion() {
   try {
     return JSON.parse(readFileSync(join(here, "..", "package.json"), "utf8")).version ?? "?";
@@ -115,15 +112,17 @@ function runTrayLifecycle(launcher, action) {
 function runNpmSelfUpdate() {
   const current = currentPackageVersion();
   const tag = updateTag(current);
-  const npm = npmBin();
-  // Node ≥18.20/20.12 refuses to spawn .cmd/.bat without a shell (CVE-2024-27980
-  // hardening) — spawning "npm.cmd" shell-less throws EINVAL on Windows.
-  const winShell = process.platform === "win32";
-  const latestResult = spawnSync(npm, ["view", `${PKG}@${tag}`, "version"], {
+  const latestInvocation = npmInvocation(["view", `${PKG}@${tag}`, "version"]);
+  const installInvocation = npmInvocation(["install", "-g", `${PKG}@${tag}`]);
+  if (!latestInvocation || !installInvocation) {
+    console.error("opencodex: could not resolve npm from a trusted absolute PATH entry; aborting before stopping the proxy.");
+    process.exit(1);
+  }
+  const latestResult = spawnSync(latestInvocation.file, latestInvocation.args, {
     encoding: "utf8",
     timeout: 12000,
     windowsHide: true,
-    shell: winShell,
+    ...latestInvocation.options,
   });
   const latest = latestResult.status === 0 ? latestResult.stdout.trim() : "";
 
@@ -221,12 +220,12 @@ function runNpmSelfUpdate() {
     }
   }
 
-  console.log(`Updating${latest ? ` to v${latest}` : ""}...\n$ ${npm} install -g ${PKG}@${tag}`);
-  const res = spawnSync(npm, ["install", "-g", `${PKG}@${tag}`], {
+  console.log(`Updating${latest ? ` to v${latest}` : ""}...\n$ npm install -g ${PKG}@${tag}`);
+  const res = spawnSync(installInvocation.file, installInvocation.args, {
     stdio: "inherit",
     timeout: 180000,
     windowsHide: true,
-    shell: winShell,
+    ...installInvocation.options,
   });
   if (res.status === 0) {
     console.log(`\nUpdated${latest ? ` to v${latest}` : ""}.`);
@@ -278,7 +277,7 @@ function runNpmSelfUpdate() {
     process.exit(0);
   }
   if (trayBeforeUpdate.restoreOnFailure) runTrayLifecycle(launcher, "start");
-  console.error(`\nUpdate failed (${npm} exit ${res.status ?? "?"}). Try manually:  ${npm} install -g ${PKG}@${tag}`);
+  console.error(`\nUpdate failed (npm exit ${res.status ?? "?"}). Try manually:  npm install -g ${PKG}@${tag}`);
   process.exit(1);
 }
 

docs-site/src/content/docs/ja/reference/cli.md

@@ -360,6 +360,15 @@ ocx service status
 ocx service uninstall
 ```
 
+Windows でタスク スケジューラのエントリを作成するには昇格が必要です。認識できるローカライズ
+済みのアクセス拒否テキストは、既存の案内経路をそのまま使用します。そのテキストが読めない場合、
+コマンド形状が `/create /tn opencodex-proxy /xml <空でないパス> /f` と正確に一致し、終了 status
+が 1 で、現在のトークンが未昇格と確認できたときだけ、言語に依存しないフォールバックが働きます。
+その場合、ダッシュボードの Startup Safety アクションが UAC を自動的に要求できます。フォール
+バックでトークン状態を確認できない場合は、元のスケジューラエラーを保持します。他のタスクや操作
+は自動昇格 marker を生成できません。ダッシュボードの UAC を承認するか、管理者 PowerShell で
+`ocx service install` を再実行してください。
+
 ### `ocx codex-shim <subcommand>`
 
 PATH 上のスクリプトベース `codex` ランチャーを軽量な自動起動スクリプトで包みます。実際の `codex.exe`

docs-site/src/content/docs/ko/reference/cli.md

@@ -379,6 +379,14 @@ ocx service status
 ocx service uninstall
 ```
 
+Windows에서 작업 스케줄러 항목을 만들려면 권한 상승이 필요합니다. 인식 가능한 현지화 권한 거부
+문자열은 기존 안내 경로를 그대로 사용합니다. 문자열을 읽을 수 없을 때는 명령 모양이
+`/create /tn opencodex-proxy /xml <비어 있지 않은 경로> /f`와 정확히 일치하고, 종료 상태가 1이며,
+현재 토큰이 권한 상승되지 않았음이 확인돼야만 언어 독립 fallback이 작동합니다. 이때 대시보드의
+Startup Safety 작업이 UAC를 자동 요청할 수 있습니다. fallback에서 토큰 상태를 확인할 수 없으면 원래
+스케줄러 오류를 유지합니다. 다른 작업과 동작은 자동 권한 상승 marker를 만들 수 없습니다. 대시보드의
+UAC를 승인하거나 관리자 PowerShell에서 `ocx service install`을 다시 실행하세요.
+
 ### `ocx codex-shim <subcommand>`
 
 PATH에 있는 스크립트 기반 `codex` 런처를 가벼운 자동 시작 스크립트로 감쌉니다. 실제 `codex.exe`

docs-site/src/content/docs/reference/cli.md

@@ -439,6 +439,14 @@ ocx service status
 ocx service uninstall
 ```
 
+On Windows, creating the Task Scheduler entry requires elevation. Recognized localized
+access-denied text keeps the existing guidance path. If that text is unreadable, the fallback
+requires the owned command shape `/create /tn opencodex-proxy /xml <non-empty-path> /f`, status 1,
+and a confirmed non-elevated token; the dashboard's Startup Safety action can then request UAC
+automatically. If that fallback cannot determine the token state, it retains the original scheduler
+error. Foreign tasks and operations can never emit the automatic-elevation marker. Approve the
+dashboard UAC prompt or rerun `ocx service install` in an elevated PowerShell window.
+
 ### `ocx codex-shim <subcommand>`
 
 Wrap a script-based `codex` launcher on PATH with a lightweight autostart script. Real `codex.exe`

docs-site/src/content/docs/reference/configuration.md

@@ -86,6 +86,33 @@ inert: it does not create model-picker entries, pin sessions, or alter Pool or D
 `max_concurrent_threads_per_session` value under `[features.multi_agent_v2]` in Codex's
 `$CODEX_HOME/config.toml`; enable v2 first so that table exists.
 
+## Provider diagnostic outbound safety
+
+The dashboard provider connection test and live model discovery use a bounded GET-only outbound
+transport. Without an outbound proxy, opencodex resolves the provider hostname once and connects
+only to that validated address. HTTPS keeps the original hostname for Host, SNI, and certificate
+verification; certificate verification cannot be disabled by provider config.
+
+When `HTTP_PROXY`, `HTTPS_PROXY`, or `ALL_PROXY` applies, these two operations keep Bun's native fetch
+so existing proxy behavior is not silently bypassed. URL/literal checks still run. Successful local DNS answers
+are classified, but a local DNS failure is allowed through because proxy-only networks commonly
+delegate name resolution to the proxy. The proxy chooses the final route, DNS answer, and peer, so
+opencodex logs that this path cannot pin or verify the proxy-selected peer. This is an explicit
+security limitation, not equivalent protection against DNS rebinding.
+
+Private/local provider destinations require both `allowPrivateNetwork: true` and a matching
+`NO_PROXY` entry whenever an outbound proxy is configured. Loopback entries are added to `NO_PROXY`
+automatically. A LAN provider such as `192.168.1.50` must be added explicitly; otherwise connection
+tests and model discovery reject it with an actionable message instead of sending it to the proxy.
+Metadata and link-local destinations remain blocked even when `allowPrivateNetwork` is enabled.
+The safety guard accepts exact hosts, domain suffixes, optional ports, bracketed IPv6, and `*` in
+`NO_PROXY`; it does not interpret CIDR entries, so list each private provider host or address explicitly.
+
+Both direct and proxied diagnostic paths reject redirects and report a credential-stripped target;
+configure the final provider URL directly. Ordinary provider requests, streaming responses, and
+retry paths are not migrated in this phase. Their redirect handling and per-hop destination review
+remain deferred, so this phase does not close the main-request redirect finding.
+
 ## Combos (`config.combos`)
 
 Failover / round-robin aliases live under `combos.<id>` with `targets` (provider + model), optional
@@ -179,6 +206,7 @@ body-occupancy guard):
 | `claudeCode.bodyMaxBytes?` | `number` | `67108864` | Native passthrough cumulative body byte cap (streamed SSE and buffered non-stream). Exactly `0` disables. |
 | `claudeCode.authMode?` | `"proxy" \| "subscription"` | unset (auto) | How `ANTHROPIC_AUTH_TOKEN` is handled at launch. Unset means auto: opencodex detects Claude auth on every launch and picks subscription when it finds any, proxy when it finds none, and subscription with a warning when it cannot tell. An explicit value is never overridden by detection. See [Claude Code](/guides/claude-code/#auth-mode). |
 | `claudeCode.authModeMigratedAt?` | `string` | unset | Internal one-time marker. Written once when an upgrade pins a pre-`auto` config to `subscription`, so a deliberate subscriber is not silently moved onto the proxy. Do not set by hand. |
+| `claudeCode.subagentEffort?` | `"low" \| "medium" \| "high" \| "xhigh" \| "max"` | unset (inherit) | Effort written to every generated `~/.claude/agents/ocx-*.md` definition. Unset lets each subagent inherit the parent Claude Code session effort. This controls Claude Code custom-agent frontmatter; it is separate from Codex `injectionEffort` guidance and proxy-side effort caps. Regenerate the definitions by starting through `ocx claude` after changing it. |
 
 ### Managed record shapes
 

docs-site/src/content/docs/ru/reference/cli.md

@@ -401,6 +401,15 @@ ocx service status
 ocx service uninstall
 ```
 
+В Windows для создания задания Планировщика требуется повышение прав. Распознанный локализованный
+текст об отказе в доступе продолжает использовать прежний путь подсказки. Если текст нечитаем,
+независимый от языка fallback требует точную форму команды
+`/create /tn opencodex-proxy /xml <непустой-путь> /f`, статус 1 и подтверждённый неповышенный токен;
+тогда Startup Safety может автоматически запросить UAC. Если fallback не может определить состояние
+токена, сохраняется исходная ошибка Планировщика. Другие задания и операции не могут создать marker
+автоматического повышения. Подтвердите UAC в панели или повторите `ocx service install` в PowerShell
+от имени администратора.
+
 ### `ocx codex-shim <subcommand>`
 
 Оборачивает скриптовый лаунчер `codex` в PATH лёгким скриптом автозапуска. Настоящие цели

docs-site/src/content/docs/ru/reference/configuration.md

@@ -120,6 +120,7 @@ body-occupancy):
 | --- | --- | --- | --- |
 | `claudeCode.bodyStallSec?` | `number` | `90` | Бюджет неактивности тела нативного passthrough в секундах — тишина по сырым байтам от вышестоящей стороны, пока ожидается чтение, а не общая длительность. Минимум 1. Ровно `0` отключает. |
 | `claudeCode.bodyMaxBytes?` | `number` | `67108864` | Ограничение суммарного размера тела нативного passthrough в байтах (потоковый SSE и буферизованный непотоковый ответ). Ровно `0` отключает. |
+| `claudeCode.subagentEffort?` | `"low" \| "medium" \| "high" \| "xhigh" \| "max"` | не задано (наследуется) | Уровень effort, записываемый во все сгенерированные определения `~/.claude/agents/ocx-*.md`. Если значение не задано, subagent наследует effort родительской сессии Claude Code. Это поле управляет frontmatter пользовательского агента Claude Code и не связано с Codex `injectionEffort` или ограничениями effort на стороне proxy. После изменения запустите через `ocx claude`, чтобы пересоздать определения. |
 
 ### Управляемые формы записей