@bitkyc08/opencodex 2.11.1 → 2.12.0

package/src/routing/profile.ts

@@ -9,6 +9,7 @@ import type {
   OcxConfig,
   OcxRoutingProfileConfig,
   OcxRoutingUnknownEvidenceMode,
+  OcxRoutingUnknownCostCapMode,
 } from "../types";
 import { codexAccountNamespaceEntries } from "../codex/account-namespaces";
 import { listComboIds, resolveComboId } from "../combos";
@@ -60,7 +61,7 @@ export interface NormalizedRoutingProfile {
   candidates: Array<{ provider: string; model: string }>;
   require: NormalizedRoutingProfileRequirements;
   optimize: { latency: number; health: number; cost: number; quota: number };
-  limits: { maxEstimatedCostUsd?: number };
+  limits: { maxEstimatedCostUsd?: number; onUnknownCost?: OcxRoutingUnknownCostCapMode };
   unknownEvidence: Record<"capability" | "health" | "quota" | "cost", OcxRoutingUnknownEvidenceMode>;
   revision: string;
 }
@@ -317,6 +318,11 @@ export function routingProfileIssues(
           || limits.maxEstimatedCostUsd < 0)) {
         issues.push({ path: ["limits", "maxEstimatedCostUsd"], message: "maxEstimatedCostUsd must be a non-negative number" });
       }
+      if (limits.onUnknownCost !== undefined
+        && limits.onUnknownCost !== "allow"
+        && limits.onUnknownCost !== "exclude") {
+        issues.push({ path: ["limits", "onUnknownCost"], message: 'onUnknownCost must be "allow" or "exclude"' });
+      }
     }
   }
 
@@ -402,6 +408,9 @@ export function normalizeRoutingProfile(id: string, raw: OcxRoutingProfileConfig
       ...(raw.limits?.maxEstimatedCostUsd !== undefined
         ? { maxEstimatedCostUsd: raw.limits.maxEstimatedCostUsd }
         : {}),
+      ...(raw.limits?.onUnknownCost !== undefined
+        ? { onUnknownCost: raw.limits.onUnknownCost }
+        : {}),
     },
     unknownEvidence: normalizedUnknownEvidence(raw),
   };

package/src/routing/trace.ts

@@ -77,12 +77,29 @@ export interface RouteQuotaEvidence {
   source?: string;
 }
 
+/**
+ * Stable wire outcome for `limits.maxEstimatedCostUsd` against this candidate's
+ * cost evidence. Present only when a cap is configured. Non-excluding outcomes
+ * (`satisfied`, `unknown-allowed`) must not be mirrored into `exclusions`.
+ */
+export type RouteCostCapOutcome =
+  | "satisfied"
+  | "exceeded"
+  | "unknown-allowed"
+  | "unknown-excluded";
+
 export interface RouteCostEvidence {
   estimatedUsd?: number;
   /** Stable wire code for the price source (e.g. "registry" | "expected"). */
   priceSource?: string;
   incomplete?: boolean;
   limitUsd?: number;
+  /**
+   * Cap evaluation outcome when `limitUsd` / profile `maxEstimatedCostUsd` is set.
+   * Distinguishes "known under the cap" from "unknown cost allowed by policy"
+   * without treating the latter as an exclusion.
+   */
+  capOutcome?: RouteCostCapOutcome;
 }
 
 export interface RouteScoreEvidence {
@@ -465,13 +482,20 @@ function parseCapability(raw: unknown, caps: ParseCaps): RouteCapabilityEvidence
   if (image !== undefined) out.image = image;
   const structuredOutput = unknownable(raw.structuredOutput);
   if (structuredOutput !== undefined) out.structuredOutput = structuredOutput;
-  if (Array.isArray(raw.reasoningEfforts)
-    && raw.reasoningEfforts.slice(0, 8).every((value): value is string => typeof value === "string")) {
-    if (raw.reasoningEfforts.some((value: unknown) => typeof value === "string"
+  const rawReasoningEfforts = Array.isArray(raw.reasoningEfforts)
+    ? raw.reasoningEfforts
+    : undefined;
+  const reasoningEfforts = rawReasoningEfforts
+    ? Array.from(
+      { length: Math.min(rawReasoningEfforts.length, 8) },
+      (_, index) => rawReasoningEfforts[index],
+    )
+    : undefined;
+  if (reasoningEfforts
+    && reasoningEfforts.every((value): value is string => typeof value === "string")) {
+    if (reasoningEfforts.some((value: unknown) => typeof value === "string"
       && value.length > MAX_TRACE_STRING)) caps.strings = true;
-    out.reasoningEfforts = raw.reasoningEfforts
-      .slice(0, 8)
-      .map(value => value.slice(0, MAX_TRACE_STRING));
+    out.reasoningEfforts = reasoningEfforts.map(value => value.slice(0, MAX_TRACE_STRING));
   }
   if (raw.serviceTier === "unknown") {
     out.serviceTier = "unknown";
@@ -521,6 +545,13 @@ function parseQuota(raw: unknown, caps: ParseCaps): RouteQuotaEvidence | undefin
   return out;
 }
 
+const COST_CAP_OUTCOMES = new Set<RouteCostCapOutcome>([
+  "satisfied",
+  "exceeded",
+  "unknown-allowed",
+  "unknown-excluded",
+]);
+
 /** Whitelisted cost-evidence parse. */
 function parseCost(raw: unknown, caps: ParseCaps): RouteCostEvidence | undefined {
   if (!isPlainRecord(raw)) return undefined;
@@ -532,6 +563,11 @@ function parseCost(raw: unknown, caps: ParseCaps): RouteCostEvidence | undefined
   }
   if (typeof raw.incomplete === "boolean") out.incomplete = raw.incomplete;
   if (finiteNumber(raw.limitUsd)) out.limitUsd = raw.limitUsd;
+  if (out.limitUsd !== undefined
+    && typeof raw.capOutcome === "string"
+    && COST_CAP_OUTCOMES.has(raw.capOutcome as RouteCostCapOutcome)) {
+    out.capOutcome = raw.capOutcome as RouteCostCapOutcome;
+  }
   return Object.keys(out).length > 0 ? out : undefined;
 }
 

package/src/server/auth-cors.ts

@@ -10,8 +10,10 @@ import {
   positiveIntegerRecordConfigError,
   providerBaseUrlConfigError,
   providerHeadersConfigError,
+  providerModelCostsConfigError,
   reasoningSummaryDeliveryRecordConfigError,
   retryOn429PolicyConfigError,
+  sanitizeModelCostsForDisplay,
 } from "../config";
 import { providerDestinationConfigError } from "../lib/destination-policy";
 import { redactSecretString } from "../lib/redact";
@@ -447,6 +449,9 @@ export function providerManagementConfigError(name: unknown, provider: unknown):
     if (seed) seed.codexAccountMode = raw.codexAccountMode;
     const canonicalCandidate = { ...raw };
     delete canonicalCandidate.responsesSnapshotRepair;
+    // modelCosts is a user-owned display overlay, not part of the canonical
+    // forward seed; it is validated separately below (providerModelCostsConfigError).
+    delete canonicalCandidate.modelCosts;
     const canonical = seed && sameCanonicalProviderSeed(canonicalCandidate, seed);
     if (!canonical) {
       return `provider ${name} must equal the canonical built-in provider seed`;
@@ -471,6 +476,12 @@ export function providerManagementConfigError(name: unknown, provider: unknown):
     // it before it reaches the management API response.
     return `provider ${JSON.stringify(redactSecretString(name))} ${retryOn429Error}`;
   }
+  const modelCostsError = providerModelCostsConfigError(raw.modelCosts);
+  if (modelCostsError) {
+    // The provider name is caller-controlled and can be token-shaped; redact and JSON-escape
+    // it before it reaches the management API response (same rule as retryOn429 above).
+    return `provider ${JSON.stringify(redactSecretString(name))} ${modelCostsError}`;
+  }
   const apiKeyTransportError = apiKeyTransportConfigError(typed);
   if (apiKeyTransportError) return `provider ${name} ${apiKeyTransportError}`;
   const maxInputError = positiveIntegerRecordConfigError(raw.modelMaxInputTokens, "modelMaxInputTokens");
@@ -544,6 +555,7 @@ export function copyIfDefined<K extends keyof OcxProviderConfig>(
   if (value !== undefined) out[key as string] = value as unknown;
 }
 
+/** Public dashboard DTO for config.json: provider entries with secrets stripped and documented fields exposed (including `modelCosts`). */
 export function safeConfigDTO(config: OcxConfig): unknown {
   const providers: Record<string, Record<string, unknown>> = {};
   for (const [name, provider] of Object.entries(config.providers)) {
@@ -579,10 +591,13 @@ export function safeConfigDTO(config: OcxConfig): unknown {
       "noPenaltyModels",
       "autoToolChoiceOnlyModels",
       "preserveReasoningContentModels",
+      "requiresReasoningPlaceholderModels",
       "escapeBuiltinToolNames",
     ] as const) {
       copyIfDefined(dto, provider, key);
     }
+    const modelCosts = sanitizeModelCostsForDisplay(provider.modelCosts);
+    if (modelCosts) dto.modelCosts = modelCosts;
     // Resolve the note by DESTINATION, not by name. A preset saved under a custom name is
     // still pointed at the same vendor route, and a usage restriction the user needs to see
     // must not disappear because the row was renamed. Prefer the same-name entry so an

package/src/server/background-lifecycle.ts

@@ -0,0 +1,169 @@
+import type { StorageCleanupPolicy } from "../types";
+import { startStateStoreSweeper } from "../lib/state-store-sweeper";
+import {
+  abortStorageCleanupPolicyJobAsync,
+  setStorageCleanupPolicyJobLiveApply,
+} from "../storage/policy-job";
+import { setStorageCleanupPolicyLiveSink } from "../storage/policy";
+import {
+  scheduleStorageCleanupStartupRun,
+  startStorageCleanupScheduler,
+  stopStorageCleanupScheduler,
+} from "../storage/policy-scheduler";
+import {
+  cancelQueuedStorageWorkerSpawns,
+  drainStorageWorkers,
+} from "../storage/worker-lifecycle";
+import {
+  startMemoryWatchdog,
+  type MemoryWatchdog,
+} from "./memory-watchdog";
+
+type PolicyApply = (policy: StorageCleanupPolicy) => void;
+
+type ProcessLoops = {
+  memoryWatchdog: MemoryWatchdog;
+  stateStoreSweeper: ReturnType<typeof startStateStoreSweeper>;
+};
+
+type LeaseOwner = {
+  token: symbol;
+  applyPolicy: PolicyApply;
+};
+
+export type ServerBackgroundLifecycleLease = {
+  scheduleStartupRun(): void;
+  release(): Promise<void>;
+  releaseAfterFailedStart(): void;
+};
+
+const owners: LeaseOwner[] = [];
+let processLoops: ProcessLoops | null = null;
+let cleanupInProgress = false;
+
+function setLivePolicyOwner(applyPolicy: PolicyApply | null): void {
+  setStorageCleanupPolicyLiveSink(applyPolicy);
+  setStorageCleanupPolicyJobLiveApply(applyPolicy);
+}
+
+function startProcessLoops(applyPolicy: PolicyApply): ProcessLoops {
+  let memoryWatchdog: MemoryWatchdog | null = null;
+  let stateStoreSweeper: ReturnType<typeof startStateStoreSweeper> | null = null;
+  try {
+    memoryWatchdog = startMemoryWatchdog();
+    stateStoreSweeper = startStateStoreSweeper();
+    setLivePolicyOwner(applyPolicy);
+    startStorageCleanupScheduler();
+    return { memoryWatchdog, stateStoreSweeper };
+  } catch (error) {
+    memoryWatchdog?.stop();
+    stateStoreSweeper?.stop();
+    stopStorageCleanupScheduler();
+    setLivePolicyOwner(null);
+    throw error;
+  }
+}
+
+function stopProcessLoops(): void {
+  const loops = processLoops;
+  processLoops = null;
+  loops?.memoryWatchdog.stop();
+  loops?.stateStoreSweeper.stop();
+  stopStorageCleanupScheduler();
+  setLivePolicyOwner(null);
+}
+
+async function stopStoragePolicyWorker(): Promise<void> {
+  cancelQueuedStorageWorkerSpawns();
+  const abortResult = await Promise.allSettled([abortStorageCleanupPolicyJobAsync()]);
+  if (abortResult[0]?.status === "rejected") {
+    console.warn(
+      "[storage] policy worker abort during server stop failed:",
+      abortResult[0].reason instanceof Error
+        ? abortResult[0].reason.message
+        : abortResult[0].reason,
+    );
+  }
+  try {
+    await drainStorageWorkers();
+  } catch (error) {
+    console.warn(
+      "[storage] worker drain during server stop failed:",
+      error instanceof Error ? error.message : error,
+    );
+  }
+}
+
+function removeOwner(owner: LeaseOwner): boolean {
+  const index = owners.findIndex(candidate => candidate.token === owner.token);
+  if (index === -1) return false;
+  owners.splice(index, 1);
+  return true;
+}
+
+function releaseOwnerSynchronously(owner: LeaseOwner): "inactive" | "shared" | "last" {
+  if (!removeOwner(owner)) return "inactive";
+  const nextOwner = owners.at(-1);
+  if (nextOwner) {
+    setLivePolicyOwner(nextOwner.applyPolicy);
+    return "shared";
+  }
+  stopProcessLoops();
+  return "last";
+}
+
+/**
+ * Acquire one server's lease on process-wide singleton loops.
+ *
+ * The first live server starts the loops. Later servers only add a reference and
+ * become the current policy sink; out-of-order release restores the newest
+ * remaining sink. The final release owns timer and Worker teardown.
+ */
+export function acquireServerBackgroundLifecycle(
+  applyPolicy: PolicyApply,
+): ServerBackgroundLifecycleLease {
+  if (cleanupInProgress) {
+    throw new Error("server background lifecycle cleanup is still in progress");
+  }
+
+  const owner: LeaseOwner = {
+    token: Symbol("server-background-lifecycle"),
+    applyPolicy,
+  };
+  if (!processLoops) {
+    processLoops = startProcessLoops(applyPolicy);
+  } else {
+    setLivePolicyOwner(applyPolicy);
+  }
+  owners.push(owner);
+
+  let releaseFlight: Promise<void> | null = null;
+  return {
+    scheduleStartupRun() {
+      if (owners.some(candidate => candidate.token === owner.token)) {
+        scheduleStorageCleanupStartupRun();
+      }
+    },
+    release() {
+      if (releaseFlight) return releaseFlight;
+      const outcome = releaseOwnerSynchronously(owner);
+      if (outcome !== "last") {
+        releaseFlight = Promise.resolve();
+        return releaseFlight;
+      }
+      cleanupInProgress = true;
+      releaseFlight = stopStoragePolicyWorker().finally(() => {
+        cleanupInProgress = false;
+      });
+      return releaseFlight;
+    },
+    releaseAfterFailedStart() {
+      if (releaseFlight) return;
+      // Startup evaluation is scheduled only after both listeners bind, so a
+      // failed start cannot have spawned a Worker for this lease. Keep rollback
+      // synchronous so a caller may immediately retry a different port.
+      releaseOwnerSynchronously(owner);
+      releaseFlight = Promise.resolve();
+    },
+  };
+}

package/src/server/chat-completions.ts

@@ -85,7 +85,6 @@ async function handleChatCompletionsWithBudget(
   try {
     chatBody = await readChatBody(req, translatorBudget);
     internalBody = chatCompletionsToResponsesBody(chatBody);
-    translatorBudget.chargeRetained(new TextEncoder().encode(JSON.stringify(internalBody)).byteLength, { kind: "request_copies" });
   } catch (err) {
     const overflow = isTranslatorBudgetExceededError(err);
     const status = overflow ? 413 : err instanceof ChatCompletionsRequestError ? 400 : 500;
@@ -180,8 +179,24 @@ async function handleChatCompletionsWithBudget(
     }
   }
 
-  const internalBodyJson = JSON.stringify(internalBody);
-  translatorBudget.chargeRetained(new TextEncoder().encode(internalBodyJson).byteLength, { kind: "request_copies" });
+  let internalBodyJson: string;
+  try {
+    internalBodyJson = JSON.stringify(internalBody);
+    translatorBudget.chargeRetained(
+      new TextEncoder().encode(internalBodyJson).byteLength,
+      { kind: "request_copies" },
+    );
+  } catch (err) {
+    const overflow = isTranslatorBudgetExceededError(err);
+    const status = overflow ? 413 : 500;
+    if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, status, { closeReason: "non_stream" });
+    return chatCompletionsErrorResponse(
+      status,
+      overflow ? "request translation buffer exceeded the safe limit" : err instanceof Error ? err.message : String(err),
+      overflow ? "request_too_large" : undefined,
+      overflow ? "translation_buffer_limit" : undefined,
+    );
+  }
   const internalReq = new Request("http://localhost/v1/responses", {
     method: "POST",
     headers,

package/src/server/claude-messages.ts

@@ -732,6 +732,7 @@ async function handleClaudeMessagesWithBudget(
     // Without this the replay would look native and a Responses-scoped wire default
     // would fire, disagreeing with the pre-flight decision above.
     inboundWire: "anthropic",
+    stripClaudeMainAuthForNoncanonicalForward: true,
     translatorBudget,
     ...(logIds ? { onFirstOutput: () => recordFirstOutput(logCtx, logIds.start) } : {}),
     onNativePassthroughTerminal: status => finalizeNativeLog(httpStatusForTerminalStatus(status), { terminalStatus: status, closeReason: "terminal" }),

package/src/server/images.ts

@@ -24,6 +24,7 @@ import {
 } from "../codex/auth-context";
 import { formatCodexProviderForLog } from "../codex/routing";
 import { signalWithTimeout } from "../lib/abort";
+import { readBoundedResponseBytes, type BoundedBytesResult } from "../lib/bounded-body";
 import { sidecarEnter } from "../lib/sidecar-tracker";
 import type { OcxConfig } from "../types";
 import { resolveFirstUsableOpenAiSidecar, selectImagesProvider } from "../providers/openai-sidecar";
@@ -50,7 +51,56 @@ const IMAGES_UPSTREAM_TIMEOUT_MS = 300_000;
  * containing base64-encoded images — typically a few MB. This prevents an oversized or malicious
  * response from exhausting process memory.
  */
-const IMAGES_RESPONSE_MAX_BYTES = 100 * 1024 * 1024;
+export const IMAGES_RESPONSE_MAX_BYTES = 100 * 1024 * 1024;
+
+interface ImageResponseBytesOptions {
+  signal?: AbortSignal;
+  /** Smaller values are used only by focused reader tests. */
+  maxBytes?: number;
+}
+
+function cancelUnlockedResponseBody(response: Response | undefined, reason?: unknown): void {
+  const body = response?.body;
+  if (!body || body.locked) return;
+  try {
+    void body.cancel(reason).catch(() => undefined);
+  } catch {
+    // A broken stream can throw synchronously from cancel().
+  }
+}
+
+/**
+ * Read one image relay response as exact raw bytes under the same cap used by
+ * the public handler. A trustworthy Content-Length can reject obvious excess
+ * before attaching a reader; the streaming reader remains authoritative when
+ * the header is absent or understated.
+ */
+export async function readImageResponseBytes(
+  response: Response,
+  options: ImageResponseBytesOptions = {},
+): Promise<BoundedBytesResult> {
+  const signal = options.signal;
+  if (signal?.aborted) {
+    cancelUnlockedResponseBody(response, signal.reason);
+    throw signal.reason;
+  }
+  if (response.body === null) {
+    return { bytes: new Uint8Array(0), oversized: false };
+  }
+
+  const maxBytes = options.maxBytes ?? IMAGES_RESPONSE_MAX_BYTES;
+  const contentLength = response.headers.get("content-length");
+  const declaredBytes = contentLength === null ? Number.NaN : Number(contentLength);
+  if (Number.isSafeInteger(declaredBytes) && declaredBytes > maxBytes) {
+    cancelUnlockedResponseBody(
+      response,
+      new DOMException("Response body size limit reached", "QuotaExceededError"),
+    );
+    return { bytes: new Uint8Array(0), oversized: true };
+  }
+
+  return readBoundedResponseBytes(response, { maxBytes, signal });
+}
 
 const CCA_IMAGE_MODEL = "gemini-3.1-flash-image";
 
@@ -440,34 +490,47 @@ export async function handleImages(
   const timeoutMs = config.images?.timeoutMs ?? IMAGES_UPSTREAM_TIMEOUT_MS;
   const linkedSignal = signalWithTimeout(timeoutMs, req.signal);
   const sidecarExit = sidecarEnter("images");
+  let upstreamResponse: Response | undefined;
   try {
     // Images POSTs create paid, non-idempotent work. One fetch only: no reset retry without a
     // source-proven idempotency contract.
-    const upstreamResponse = await fetch(url, {
+    upstreamResponse = await fetch(url, {
       method: "POST",
       headers,
       body: JSON.stringify(body),
       signal: linkedSignal.signal,
     });
-    // Buffer rather than stream: the payload is one JSON document (base64 image, typically a few
-    // MB), and buffering keeps the timeout window covering the whole exchange. Cap the size to
-    // prevent an oversized response from exhausting process memory.
-    const payload = await upstreamResponse.arrayBuffer();
-    if (payload.byteLength > IMAGES_RESPONSE_MAX_BYTES) {
-      return formatErrorResponse(502, "upstream_error", `image ${endpoint} response too large (${payload.byteLength} bytes)`);
+    const observed = await readImageResponseBytes(upstreamResponse, {
+      maxBytes: IMAGES_RESPONSE_MAX_BYTES,
+      signal: linkedSignal.signal,
+    });
+    if (observed.oversized) {
+      forward?.recordOutcome?.(upstreamResponse.status);
+      return formatErrorResponse(
+        502,
+        "upstream_error",
+        `image ${endpoint} response too large (exceeded ${IMAGES_RESPONSE_MAX_BYTES} bytes)`,
+      );
     }
-    forward?.recordOutcome?.(upstreamResponse.status);
     const relayHeaders: Record<string, string> = {};
     const contentType = upstreamResponse.headers.get("content-type");
     if (contentType) relayHeaders["content-type"] = contentType;
-    return new Response(payload, { status: upstreamResponse.status, headers: relayHeaders });
+    // Fetch represents 204/205/304 responses with a null body. Preserve that
+    // invariant: constructing those statuses with even an empty Uint8Array throws.
+    const relayBody = upstreamResponse.body === null ? null : observed.bytes;
+    const relayResponse = new Response(relayBody, {
+      status: upstreamResponse.status,
+      headers: relayHeaders,
+    });
+    forward?.recordOutcome?.(upstreamResponse.status);
+    return relayResponse;
   } catch (err) {
     // Client cancel first: it aborts the linked signal too, and must not be logged as an
     // upstream failure (499 maps to client_closed_request in the request log).
     if (req.signal.aborted) {
       return formatErrorResponse(499, "client_closed_request", `image ${endpoint} request canceled by client`);
     }
-    if (err instanceof Error && err.name === "TimeoutError") {
+    if (linkedSignal.signal.aborted || (err instanceof Error && err.name === "TimeoutError")) {
       forward?.recordOutcome?.("timeout");
       // codex retries 5xx up to 4 more times; a retried 504 is acceptable for a transient hang.
       return formatErrorResponse(504, "upstream_error", `image ${endpoint} upstream timed out`);
@@ -481,5 +544,9 @@ export async function handleImages(
   } finally {
     sidecarExit();
     linkedSignal.cleanup();
+    // If cancellation won before readImageResponseBytes attached its reader, the
+    // response still owns an upstream body/socket. Consumed or locked bodies are
+    // already owned by the reader and need no second cancellation.
+    cancelUnlockedResponseBody(upstreamResponse);
   }
 }