@bitkyc08/opencodex 2.10.2 → 2.11.0

package/src/server/chat-completions.ts

@@ -133,10 +133,6 @@ async function handleChatCompletionsWithBudget(
     } else if (internalBody.store === undefined) {
       internalBody.store = false;
     }
-    if (route.provider.adapter === "openai-chat" && internalBody.text !== undefined) {
-      if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, 400, { closeReason: "non_stream" });
-      return chatCompletionsErrorResponse(400, "response_format is not supported for routed openai-chat models");
-    }
     if (route.provider.adapter === "cursor" || route.provider.adapter === "kiro") {
       const raw = chatBody as Rec;
       const parts: string[] = [];

package/src/server/claude-messages.ts

@@ -7,7 +7,8 @@
  * unchanged. The Responses output (SSE or JSON) is converted back to Anthropic shape.
  */
 import { FORWARD_HEADERS } from "../adapters/openai-responses";
-import { enforceAnthropicImageLimits } from "../adapters/anthropic-image-guard";
+import { sseFieldValue } from "../lib/sse-decoder";
+import { enforceAnthropicImageLimits, sniffImageDimensions } from "../adapters/anthropic-image-guard";
 import { normalizeAnthropicImages } from "../adapters/anthropic-image-normalize";
 import { AnthropicRequestError, anthropicToResponsesTranslation, extractOcxEffortDirective, extractOcxRouteDirective, resolveInboundModel, type ClaudeCacheKeySource } from "../claude/inbound";
 import { resolveDesktop3pAlias } from "../claude/desktop-3p";
@@ -36,6 +37,7 @@ import { responseWithDeferredRequestLog } from "./relay";
 import { handleResponses } from "./responses";
 import type { AdmissionLease } from "../lib/admission";
 import { tryClaimNativeMainProfileForTurn } from "../codex/native-main-admission";
+import { CODEX_MAIN_PROFILE_MAINTENANCE_MESSAGE } from "../codex/auth-context";
 import {
   createTranslatorBudget,
   finalizeTranslatorBudgetResponse,
@@ -170,7 +172,11 @@ export function tapAnthropicSseForLog(
     while ((sep = buffer.indexOf("\n\n")) !== -1) {
       const frame = buffer.slice(0, sep);
       buffer = buffer.slice(sep + 2);
-      const dataLine = frame.split("\n").filter(l => l.startsWith("data: ")).map(l => l.slice(6)).join("");
+      const dataLine = frame
+        .split("\n")
+        .map(l => sseFieldValue(l, "data"))
+        .filter((v): v is string => v !== null)
+        .join("");
       if (!dataLine) continue;
       let data: unknown;
       try { data = JSON.parse(dataLine); } catch { continue; }
@@ -647,12 +653,7 @@ async function handleClaudeMessagesWithBudget(
     // accurate-usage adapters — the request-log merge is max(reported, estimate) and
     // would overwrite real usage (audit 133 R1#7).
     if (route.provider.adapter === "cursor" || route.provider.adapter === "kiro") {
-      const raw = anthropicBody as Rec;
-      const parts: string[] = [];
-      if (raw.system !== undefined) parts.push(typeof raw.system === "string" ? raw.system : JSON.stringify(raw.system));
-      if (raw.messages !== undefined) parts.push(JSON.stringify(raw.messages));
-      if (raw.tools !== undefined) parts.push(JSON.stringify(raw.tools));
-      logCtx.usageLogInputTokens = Math.max(1, estimateTokens(parts.join("\n"), requestedModel));
+      logCtx.usageLogInputTokens = estimateClaudeRequestTokens(anthropicBody as Rec, requestedModel);
     }
     // Effort safety valve (devlog 136 B6, audit 139 R2#2): opus-shaped aliases make
     // every routed model look like a reasoning model to Claude clients, so a forced
@@ -770,7 +771,7 @@ async function handleClaudeMessagesWithBudget(
     // share a backoff hint when the upstream omitted the header.
     const nativeMainFence = response.status === 503
       && upstreamRetryAfter?.trim() === "1"
-      && message === "Native Codex main profile is switching; retry this request";
+      && message === CODEX_MAIN_PROFILE_MAINTENANCE_MESSAGE;
     const transient = !nativeMainFence && isTransientUpstreamStatus(response.status);
     const outStatus = nativeMainFence ? 503 : transient ? 529 : response.status;
     const out = new Response(JSON.stringify(anthropicErrorBody(outStatus, message)), {
@@ -873,7 +874,68 @@ async function handleClaudeMessagesWithBudget(
   });
 }
 
-/** Documented approximation: serialize system+messages+tools, run the char estimator. */
+/** Per-attachment token estimate for a base64 payload: real image dimensions when the
+ * header is sniffable (Anthropic prices images at ~pixels/750), else decoded bytes/512,
+ * min 256 — the same shape as the Kiro usage estimator (estimateKiroImageTokens). */
+function estimateBase64AttachmentTokens(data: string): number {
+  const dims = sniffImageDimensions(data);
+  if (dims) return Math.max(256, Math.ceil((dims.width * dims.height) / 750));
+  const unpadded = data.endsWith("==") ? data.length - 2 : data.endsWith("=") ? data.length - 1 : data.length;
+  return Math.max(256, Math.ceil(Math.floor((unpadded * 3) / 4) / 512));
+}
+
+/**
+ * Char-based token estimate for an Anthropic-shaped request body. Base64 attachment
+ * payloads (image/document blocks in message content, including blocks nested in
+ * tool_result.content) are counted as a bounded per-attachment estimate instead of raw
+ * characters: one 2MB screenshot is ~2.7M base64 chars, which the plain chars/token
+ * divide reports as hundreds of thousands of tokens versus a real cost around 1.6k.
+ * That breaks the >2x drift bound the estimator is held to (devlog 260711_claude_inbound
+ * 040 §3). Text and url sources are left in place and counted as characters, as is
+ * anything outside protocol content positions (tool_use.input, tool schemas).
+ */
+export function estimateClaudeRequestTokens(
+  raw: { system?: unknown; messages?: unknown; tools?: unknown },
+  modelId: string | undefined,
+): number {
+  let attachmentTokens = 0;
+  // Blank base64 payloads ONLY in protocol content positions: message content blocks and
+  // blocks nested in tool_result.content. tool_use.input and tool schemas can legitimately
+  // contain attachment-shaped JSON, and those bytes ARE serialized into function_call
+  // arguments / tool definitions for routed providers, so they must keep counting as text.
+  // system is text-only per the Anthropic protocol (no attachment sources), so it is
+  // stringified as-is.
+  const sanitizeBlock = (block: unknown): unknown => {
+    if (!block || typeof block !== "object") return block;
+    const b = block as Record<string, unknown>;
+    if (b.type === "image" || b.type === "document") {
+      const source = b.source as { type?: unknown; data?: unknown } | undefined;
+      if (source && typeof source === "object" && source.type === "base64" && typeof source.data === "string") {
+        attachmentTokens += estimateBase64AttachmentTokens(source.data);
+        return { ...b, source: { ...(source as Record<string, unknown>), data: "" } };
+      }
+      return block;
+    }
+    if (b.type === "tool_result" && Array.isArray(b.content)) {
+      return { ...b, content: (b.content as unknown[]).map(sanitizeBlock) };
+    }
+    return block;
+  };
+  const sanitizedMessages = (messages: unknown): unknown =>
+    Array.isArray(messages)
+      ? messages.map(message => {
+          if (!message || typeof message !== "object") return message;
+          const m = message as Record<string, unknown>;
+          return Array.isArray(m.content) ? { ...m, content: (m.content as unknown[]).map(sanitizeBlock) } : message;
+        })
+      : messages;
+  const parts: string[] = [];
+  if (raw.system !== undefined) parts.push(typeof raw.system === "string" ? raw.system : JSON.stringify(raw.system));
+  if (raw.messages !== undefined) parts.push(JSON.stringify(sanitizedMessages(raw.messages)));
+  if (raw.tools !== undefined) parts.push(JSON.stringify(raw.tools));
+  return Math.max(1, estimateTokens(parts.join("\n"), modelId) + attachmentTokens);
+}
+
 export async function handleClaudeCountTokens(req: Request, config: OcxConfig): Promise<Response> {
   const disabled = claudeInboundDisabled(config);
   if (disabled) return disabled;
@@ -910,11 +972,7 @@ export async function handleClaudeCountTokens(req: Request, config: OcxConfig):
   if (wantsNativePassthrough(req, config, model)) {
     return await anthropicNativePassthrough(req, config, { model, provider: "anthropic-native", surface: "claude" }, undefined, raw, "/v1/messages/count_tokens");
   }
-  const parts: string[] = [];
-  if (raw.system !== undefined) parts.push(typeof raw.system === "string" ? raw.system : JSON.stringify(raw.system));
-  if (raw.messages !== undefined) parts.push(JSON.stringify(raw.messages));
-  if (raw.tools !== undefined) parts.push(JSON.stringify(raw.tools));
-  const inputTokens = Math.max(1, estimateTokens(parts.join("\n"), model));
+  const inputTokens = estimateClaudeRequestTokens(raw, model);
   return new Response(JSON.stringify({ input_tokens: inputTokens }), {
     status: 200,
     headers: { "Content-Type": "application/json" },

package/src/server/github-copilot-responses-repair.ts

@@ -0,0 +1,338 @@
+/**
+ * Client-facing repair for GitHub Copilot's `vscode-chat` Responses stream.
+ *
+ * Copilot can rotate opaque response/item ids between lifecycle events, expose
+ * provider-private reasoning ciphertext, and attach per-delta obfuscation
+ * padding while the authoritative complete tool input arrives on `.done`.
+ * Stock Responses clients cannot reconcile that dialect. This stateful block
+ * rewrite emits one coherent Responses SSE stream while the inspection branch
+ * keeps the raw upstream snapshot for provider replay.
+ */
+import {
+  TranslatorBudgetExceededError,
+  type TranslatorBudget,
+} from "../lib/translator-budget";
+import {
+  replaceSseDataPayload,
+  sseDataPayload,
+  type SseBlockRewrite,
+} from "./sse-payload-rewrite";
+
+const MAX_TRACKED_ITEMS = 256;
+const MAX_TRACKED_DEFERRED_CALLS = 256;
+const RETAINED_STATE_LIMIT_BYTES = 256 * 1024;
+
+type JsonRecord = Record<string, unknown>;
+
+type TrackedItem = {
+  id: string;
+  type?: string;
+  encryptedReasoning: boolean;
+};
+
+type DeferredCallKind = "function" | "custom";
+
+function isRecord(value: unknown): value is JsonRecord {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function outputIndexOf(value: unknown): number | undefined {
+  return typeof value === "number" && Number.isInteger(value) && value >= 0
+    ? value
+    : undefined;
+}
+
+function byteLength(value: unknown): number {
+  return Buffer.byteLength(JSON.stringify(value), "utf8");
+}
+
+function blockNewline(block: string): "\r\n" | "\n" {
+  return block.includes("\r\n") ? "\r\n" : "\n";
+}
+
+/** Keep a named SSE block's `event:` field aligned with its JSON `type`. */
+function withEventName(block: string, eventName: string): string {
+  const newline = blockNewline(block);
+  const lines = block.split(/\r?\n/);
+  let replaced = false;
+  const rewritten = lines.flatMap((line) => {
+    if (!line.startsWith("event:")) return [line];
+    if (replaced) return [];
+    replaced = true;
+    return [`event: ${eventName}`];
+  });
+  if (!replaced) {
+    const dataIndex = rewritten.findIndex(line => line.startsWith("data:"));
+    rewritten.splice(dataIndex >= 0 ? dataIndex : 0, 0, `event: ${eventName}`);
+  }
+  return rewritten.join(newline);
+}
+
+function rewriteJsonBlock(block: string, event: JsonRecord): string {
+  const type = typeof event.type === "string" ? event.type : "message";
+  return withEventName(replaceSseDataPayload(block, JSON.stringify(event)), type);
+}
+
+function syntheticJsonBlock(template: string, event: JsonRecord): string {
+  const newline = blockNewline(template);
+  const type = typeof event.type === "string" ? event.type : "message";
+  return `event: ${type}${newline}data: ${JSON.stringify(event)}`;
+}
+
+function callKindForDelta(type: unknown): DeferredCallKind | undefined {
+  if (type === "response.function_call_arguments.delta") return "function";
+  if (type === "response.custom_tool_call_input.delta") return "custom";
+  return undefined;
+}
+
+function callKindForDone(type: unknown): DeferredCallKind | undefined {
+  if (type === "response.function_call_arguments.done") return "function";
+  if (type === "response.custom_tool_call_input.done") return "custom";
+  return undefined;
+}
+
+function callKey(kind: DeferredCallKind, outputIndex: number): string {
+  return `${kind}:${outputIndex}`;
+}
+
+function deltaTypeFor(kind: DeferredCallKind): string {
+  return kind === "function"
+    ? "response.function_call_arguments.delta"
+    : "response.custom_tool_call_input.delta";
+}
+
+function completeValueFor(kind: DeferredCallKind, event: JsonRecord): string {
+  const value = kind === "function" ? event.arguments : event.input;
+  return typeof value === "string" ? value : "";
+}
+
+/**
+ * Create one provider-scoped block rewrite per upstream response.
+ *
+ * Retained ids and pending-call markers are charged to the request translator
+ * budget and hard-capped. `dispose` releases them on terminal, EOF, cancel, or
+ * relay failure through the shared block-rewrite lifecycle.
+ */
+export function createGithubCopilotResponsesBlockRewrite(
+  budget?: TranslatorBudget,
+): SseBlockRewrite {
+  const items = new Map<number, TrackedItem>();
+  const deferredCalls = new Map<string, number>();
+  let responseId: string | undefined;
+  let itemStateBytes = 0;
+  let callStateBytes = 0;
+  let nextSequenceNumber = 0;
+  let itemTrackingTainted = false;
+  let disposed = false;
+
+  const ensureStateLimit = (nextBytes: number): void => {
+    if (itemStateBytes + callStateBytes + nextBytes > RETAINED_STATE_LIMIT_BYTES) {
+      throw new TranslatorBudgetExceededError("item_ids", RETAINED_STATE_LIMIT_BYTES);
+    }
+  };
+
+  const chargeItemState = (bytes: number): void => {
+    ensureStateLimit(bytes);
+    budget?.chargeRetained(bytes, { kind: "item_ids" });
+    itemStateBytes += bytes;
+  };
+
+  const chargeCallState = (bytes: number): void => {
+    ensureStateLimit(bytes);
+    budget?.chargeRetained(bytes, { kind: "retained_collectors" });
+    callStateBytes += bytes;
+  };
+
+  const releaseDeferredCall = (key: string): boolean => {
+    const bytes = deferredCalls.get(key);
+    if (bytes === undefined) return false;
+    deferredCalls.delete(key);
+    callStateBytes -= bytes;
+    budget?.releaseRetained(bytes, { kind: "retained_collectors" });
+    return true;
+  };
+
+  const rememberResponseId = (candidate: string): string => {
+    if (responseId !== undefined) return responseId;
+    const bytes = byteLength(candidate);
+    chargeItemState(bytes);
+    responseId = candidate;
+    return candidate;
+  };
+
+  const rememberItem = (
+    outputIndex: number,
+    candidateId: string,
+    itemType?: string,
+    encryptedReasoning = false,
+  ): TrackedItem => {
+    const existing = items.get(outputIndex);
+    if (existing) {
+      if (existing.type === undefined && itemType !== undefined) {
+        const extra = byteLength(itemType);
+        chargeItemState(extra);
+        existing.type = itemType;
+      }
+      existing.encryptedReasoning ||= encryptedReasoning;
+      return existing;
+    }
+    if (itemTrackingTainted || items.size >= MAX_TRACKED_ITEMS) {
+      // Keep relaying client-visible events after the count cap, but stop
+      // retaining new output-index mappings. The current event still receives
+      // the provider id, while earlier retained mappings remain available for
+      // stable ids. Byte-budget failures stay hard failures.
+      itemTrackingTainted = true;
+      return { id: candidateId, type: itemType, encryptedReasoning };
+    }
+    chargeItemState(byteLength([outputIndex, candidateId, itemType ?? null]));
+    const tracked = { id: candidateId, type: itemType, encryptedReasoning };
+    items.set(outputIndex, tracked);
+    return tracked;
+  };
+
+  const rememberDeferredCall = (key: string): void => {
+    if (deferredCalls.has(key)) return;
+    if (deferredCalls.size >= MAX_TRACKED_DEFERRED_CALLS) {
+      throw new TranslatorBudgetExceededError("retained_collectors", RETAINED_STATE_LIMIT_BYTES);
+    }
+    const bytes = byteLength(key);
+    chargeCallState(bytes);
+    deferredCalls.set(key, bytes);
+  };
+
+  const sanitizeReasoningItem = (
+    item: JsonRecord,
+    tracked: TrackedItem,
+  ): void => {
+    if (item.type !== "reasoning") return;
+    const encrypted = typeof item.encrypted_content === "string";
+    tracked.encryptedReasoning ||= encrypted;
+    if (encrypted) delete item.encrypted_content;
+    if (tracked.encryptedReasoning) {
+      const summary = Array.isArray(item.summary) ? item.summary : [];
+      const hasPlaintextSummary = summary.some(part =>
+        isRecord(part)
+        && part.type === "summary_text"
+        && typeof part.text === "string"
+        && part.text.length > 0);
+      if (!hasPlaintextSummary) item.summary = [{ type: "summary_text", text: "" }];
+      if (!Array.isArray(item.content)) item.content = [];
+    }
+  };
+
+  const normalizeNestedItem = (item: JsonRecord, outputIndex: number): void => {
+    const candidateId = typeof item.id === "string" ? item.id : undefined;
+    if (candidateId === undefined) return;
+    const itemType = typeof item.type === "string" ? item.type : undefined;
+    const tracked = rememberItem(
+      outputIndex,
+      candidateId,
+      itemType,
+      itemType === "reasoning" && typeof item.encrypted_content === "string",
+    );
+    item.id = tracked.id;
+    sanitizeReasoningItem(item, tracked);
+  };
+
+  const normalizeSequence = (event: JsonRecord): void => {
+    if (typeof event.sequence_number !== "number" || !Number.isFinite(event.sequence_number)) return;
+    event.sequence_number = nextSequenceNumber++;
+  };
+
+  const dispose = (): void => {
+    if (disposed) return;
+    disposed = true;
+    if (itemStateBytes > 0) budget?.releaseRetained(itemStateBytes, { kind: "item_ids" });
+    if (callStateBytes > 0) budget?.releaseRetained(callStateBytes, { kind: "retained_collectors" });
+    items.clear();
+    deferredCalls.clear();
+    responseId = undefined;
+    itemStateBytes = 0;
+    callStateBytes = 0;
+    itemTrackingTainted = false;
+  };
+
+  const rewrite: SseBlockRewrite = (block) => {
+    const payload = sseDataPayload(block);
+    if (payload === null || payload === "[DONE]") return [block];
+
+    let event: unknown;
+    try {
+      event = JSON.parse(payload);
+    } catch {
+      return [block];
+    }
+    if (!isRecord(event)) return [block];
+
+    if (typeof event.obfuscation === "string") delete event.obfuscation;
+
+    const type = event.type;
+    const outputIndex = outputIndexOf(event.output_index);
+    const deltaKind = callKindForDelta(type);
+    const deferToolDelta = deltaKind !== undefined
+      && outputIndex !== undefined;
+
+    if (isRecord(event.response) && typeof event.response.id === "string") {
+      event.response.id = rememberResponseId(event.response.id);
+    }
+
+    if (outputIndex !== undefined && isRecord(event.item)) {
+      normalizeNestedItem(event.item, outputIndex);
+    }
+    // A deferred delta is not client-visible, so it must not establish the
+    // public item id if a malformed provider sends it before output_item.added.
+    if (!deferToolDelta && outputIndex !== undefined && typeof event.item_id === "string") {
+      const tracked = rememberItem(outputIndex, event.item_id);
+      event.item_id = tracked.id;
+    }
+
+    if (type === "response.completed" && isRecord(event.response) && Array.isArray(event.response.output)) {
+      event.response.output.forEach((item, index) => {
+        if (isRecord(item)) normalizeNestedItem(item, index);
+      });
+    }
+
+    if (typeof type === "string" && type.startsWith("response.reasoning")) {
+      if (typeof event.encrypted_content === "string") delete event.encrypted_content;
+      // `encrypted_content` is opaque replay state; summary delta/text fields
+      // are a separate, potentially readable part of the public Responses
+      // contract and must survive when Copilot provides them.
+    }
+
+    if (deferToolDelta) {
+      rememberDeferredCall(callKey(deltaKind, outputIndex));
+      // The OpenAI `obfuscation` field is padding, not a decryption key. Defer
+      // every Copilot tool fragment anyway: mixed padded/unpadded fragments and
+      // rotating ids cannot then produce duplicate or irreconcilable input.
+      // `.done` carries the authoritative complete value, which is emitted as
+      // one canonical delta immediately before the original `.done` event.
+      return [];
+    }
+
+    const emitted: Array<{ event: JsonRecord; synthetic: boolean }> = [];
+    const doneKind = callKindForDone(type);
+    if (doneKind !== undefined && outputIndex !== undefined) {
+      const key = callKey(doneKind, outputIndex);
+      if (releaseDeferredCall(key)) {
+        emitted.push({
+          synthetic: true,
+          event: {
+            type: deltaTypeFor(doneKind),
+            output_index: outputIndex,
+            ...(typeof event.item_id === "string" ? { item_id: event.item_id } : {}),
+            ...(typeof event.sequence_number === "number" ? { sequence_number: event.sequence_number } : {}),
+            delta: completeValueFor(doneKind, event),
+          },
+        });
+      }
+    }
+    emitted.push({ event, synthetic: false });
+
+    for (const entry of emitted) normalizeSequence(entry.event);
+    return emitted.map(entry => entry.synthetic
+      ? syntheticJsonBlock(block, entry.event)
+      : rewriteJsonBlock(block, entry.event));
+  };
+  rewrite.dispose = dispose;
+  return rewrite;
+}