@bitkyc08/opencodex 2.11.1 → 2.12.0

package/src/server/management/vision-sidecar-options.ts

@@ -0,0 +1,125 @@
+/**
+ * The one place that decides which models the management API offers as vision
+ * describers, and which it refuses to persist.
+ *
+ * Two routes write a vision sidecar model — `PUT /api/sidecar-settings` and the
+ * `visionSidecar` override in `PUT /api/claude-code`. They share this module so
+ * the policy cannot drift: a gate on one route and a stale copy on the other is
+ * the same as no gate at all.
+ */
+import type { OcxConfig } from "../../types";
+import { findAnthropicVisionProvider, type AnthropicVisionProvider } from "../../vision";
+import {
+  modelAcceptsImageInput,
+  visionEligibleModelOptions,
+  type VisionCandidateModel,
+  type VisionModelOption,
+  type VisionSidecarBackend,
+} from "../../vision/eligibility";
+import { listOpenAiForwardSidecarCandidates } from "../../providers/openai-sidecar";
+import { listManagementModelRows } from "./model-rows";
+
+/**
+ * Backends whose executor could actually run: openai forward, anthropic OAuth.
+ *
+ * `anthropicSidecar` is REQUIRED rather than defaulted. `findAnthropicVisionProvider`
+ * reads the OAuth account store from disk, and a default argument made every helper
+ * in this chain re-resolve it whenever a caller passed an explicit `undefined` —
+ * which is exactly the no-executor case. Passing it in keeps one read per request.
+ */
+export function enabledVisionBackends(
+  config: OcxConfig,
+  anthropicSidecar: AnthropicVisionProvider | undefined,
+): VisionSidecarBackend[] {
+  const backends: VisionSidecarBackend[] = [];
+  // The OpenAI describer needs a CANONICAL ChatGPT forward provider, not merely a
+  // provider keyed "openai" — same predicate the runtime sidecar resolver uses.
+  if (listOpenAiForwardSidecarCandidates(config).length > 0) backends.push("openai");
+  if (anthropicSidecar) backends.push("anthropic");
+  // Neither side resolvable (fresh install, no login): fall back to both so the
+  // picker is populated rather than empty, matching the permissive-unknown rule.
+  return backends.length > 0 ? backends : ["openai", "anthropic"];
+}
+
+/** Visible catalog rows in the shape the eligibility predicate consumes. */
+export async function visionCandidateRows(config: OcxConfig): Promise<VisionCandidateModel[]> {
+  let rows: Awaited<ReturnType<typeof listManagementModelRows>> = [];
+  // A catalog outage must not 500 the settings route nor reject a write; with []
+  // the option list degrades to the baselines, which is the intended floor.
+  try { rows = await listManagementModelRows(config); } catch { rows = []; }
+  return rows.filter(row => row.disabled !== true).map(row => ({
+    provider: row.provider,
+    id: row.id,
+    ...(row.inputModalities ? { inputModalities: row.inputModalities } : {}),
+    ...(row.native ? { native: true } : {}),
+  }));
+}
+
+export function visionModelOptionsFrom(
+  config: OcxConfig,
+  candidates: readonly VisionCandidateModel[],
+  anthropicSidecar: AnthropicVisionProvider | undefined,
+): VisionModelOption[] {
+  return visionEligibleModelOptions(
+    config,
+    candidates,
+    enabledVisionBackends(config, anthropicSidecar),
+    anthropicSidecar?.providerName,
+  );
+}
+
+/** Convenience for read paths that have no candidate list in hand yet. */
+export async function visionModelOptionsFor(
+  config: OcxConfig,
+  anthropicSidecar: AnthropicVisionProvider | undefined,
+): Promise<VisionModelOption[]> {
+  return visionModelOptionsFrom(config, await visionCandidateRows(config), anthropicSidecar);
+}
+
+/**
+ * Can we PROVE the requested describer is blind?
+ *
+ * Only a positive `false` rejects. An id no source knows stays allowed, because
+ * the runtime never required catalog membership and an operator may be ahead of
+ * our tables.
+ *
+ * When no catalog row matches, the caller's `backend` is only a HINT, never the
+ * authority. Trusting it let a client launder a known-blind OpenAI model past the
+ * gate by claiming `backend: "anthropic"`, since the id is absent from the
+ * Anthropic table and absence reads as "unknown". Both families are therefore
+ * consulted and any positive text-only verdict wins. That is safe precisely
+ * because the two vendor tables share no bare model id, so they can never
+ * disagree about one.
+ */
+export function visionDescriberIsProvablyBlind(
+  config: OcxConfig,
+  requested: string,
+  candidates: readonly VisionCandidateModel[],
+  backendHint: VisionSidecarBackend | undefined,
+): boolean {
+  // Catalog rows can carry operator-authored modalities. A positive claim from one
+  // must not hide another row or canonical metadata that proves this id is blind.
+  if (candidates.some(candidate => candidate.id === requested
+    && modelAcceptsImageInput(config, candidate) === false)) return true;
+
+  const hinted: VisionSidecarBackend = backendHint === "anthropic" ? "anthropic" : "openai";
+  const probed: VisionSidecarBackend[] = hinted === "anthropic"
+    ? ["anthropic", "openai"]
+    : ["openai", "anthropic"];
+  return probed.some(provider => modelAcceptsImageInput(config, { provider, id: requested }) === false);
+}
+
+/** The 400 body both routes return, so the two errors cannot diverge either. */
+export function visionDescriberRejection(
+  field: "vision.model" | "visionSidecar.model",
+  requested: string,
+  config: OcxConfig,
+  candidates: readonly VisionCandidateModel[],
+): { error: string; allowed: string[] } {
+  return {
+    error: `${field} "${requested}" cannot describe images: it has no image input support, or it is a model the vision sidecar describes FOR.`,
+    // The rejection path is not hot, so it resolves the executor itself rather than
+    // making every 400 caller thread one through.
+    allowed: visionModelOptionsFrom(config, candidates, findAnthropicVisionProvider(config)).map(option => option.value),
+  };
+}

package/src/server/management-api.ts

@@ -68,6 +68,7 @@ import { handleAgentSettingsRoutes } from "./management/agent-settings-routes";
 import { handleOauthAccountRoutes } from "./management/oauth-account-routes";
 import { handleComboRoutes } from "./management/combo-routes";
 import { handleSystemRoutes } from "./management/system-routes";
+import { handleLabRoutes } from "./management/lab-routes";
 import { handleSidebarRoutes } from "./management/sidebar-routes";
 import { handleIntegrationRoutes } from "./management/integration-routes";
 import { handleNativeIntegrationRoutes } from "./management/native-integration-routes";
@@ -187,6 +188,7 @@ export async function handleManagementAPI(
     ??     (await handleOauthAccountRoutes(ctx))
     ??     (await handleComboRoutes(ctx))
     ??     (await handleSystemRoutes(ctx))
+    ??     (await handleLabRoutes(ctx))
       ?? (await handleSidebarRoutes(ctx));
   } catch (error) {
     const tooLarge = managementBodyTooLargeResponse(error, req, config);

package/src/server/request-decompress.ts

@@ -45,6 +45,101 @@ function declaredBodyLength(req: Request): number | null {
   return Number.isFinite(length) && length >= 0 ? length : null;
 }
 
+function cancelStreamWithoutWaiting(stream: ReadableStream<Uint8Array> | null, reason: unknown): void {
+  if (!stream || stream.locked) return;
+  try {
+    void stream.cancel(reason).catch(() => undefined);
+  } catch {
+    // A non-standard stream may throw synchronously from cancel().
+  }
+}
+
+function cancelReaderWithoutWaiting(reader: ReadableStreamDefaultReader<Uint8Array>, reason: unknown): void {
+  // Request.clone() tees can leave cancel() pending until the other branch
+  // drains. Cancellation must never extend this reader's own admission bound.
+  try {
+    void reader.cancel(reason).catch(() => undefined);
+  } catch {
+    // A non-standard reader may throw synchronously from cancel().
+  }
+}
+
+async function readRequestBodyBytesCapped(
+  body: ReadableStream<Uint8Array> | null,
+  maxBytes: number,
+  signal?: AbortSignal,
+): Promise<Uint8Array> {
+  if (signal?.aborted) {
+    cancelStreamWithoutWaiting(body, signal.reason);
+    throw signal.reason;
+  }
+  if (!body) return new Uint8Array(0);
+
+  const reader = body.getReader();
+  // Keep one geometric buffer instead of one object per transport chunk. A
+  // hostile peer can fragment a bounded payload into arbitrarily many chunks.
+  let retained = new Uint8Array(Math.min(maxBytes, 64 * 1024));
+  let retainedBytes = 0;
+  let aborted = false;
+  let abortReason: unknown;
+  let cancellationStarted = false;
+  const cancel = (reason: unknown): void => {
+    if (cancellationStarted) return;
+    cancellationStarted = true;
+    cancelReaderWithoutWaiting(reader, reason);
+  };
+  const onAbort = (): void => {
+    aborted = true;
+    abortReason = signal?.reason;
+    cancel(abortReason);
+  };
+  signal?.addEventListener("abort", onAbort, { once: true });
+  // Close the narrow race between the preflight check and listener install.
+  if (signal?.aborted) onAbort();
+
+  try {
+    while (true) {
+      if (aborted) throw abortReason;
+      const { value, done } = await reader.read();
+      // cancel() can resolve a pending read as EOF. Preserve the caller's
+      // original abort reason instead of misclassifying that as a clean body.
+      if (aborted) throw abortReason;
+      if (done) {
+        return retainedBytes === retained.byteLength
+          ? retained
+          : retained.slice(0, retainedBytes);
+      }
+      if (!value || value.byteLength === 0) continue;
+
+      if (value.byteLength > maxBytes - retainedBytes) {
+        const error = new DecompressedBodyTooLargeError(retainedBytes + value.byteLength, maxBytes);
+        cancel(error);
+        throw error;
+      }
+
+      const required = retainedBytes + value.byteLength;
+      if (required > retained.byteLength) {
+        const grown = new Uint8Array(Math.min(maxBytes, Math.max(retained.byteLength * 2, required)));
+        grown.set(retained.subarray(0, retainedBytes));
+        retained = grown;
+      }
+      retained.set(value, retainedBytes);
+      retainedBytes = required;
+    }
+  } catch (error) {
+    const failure = aborted ? abortReason : error;
+    cancel(failure);
+    throw failure;
+  } finally {
+    signal?.removeEventListener("abort", onAbort);
+    try {
+      reader.releaseLock();
+    } catch {
+      // A pending cancellation can retain the lock briefly; never await it.
+    }
+  }
+}
+
 function inflateDeflateBody(compressed: Uint8Array<ArrayBuffer>, opts: { maxOutputLength: number }): Uint8Array {
   // HTTP "deflate" appears both zlib-wrapped and raw in the wild (Bun.deflateSync emits raw,
   // which the previous Bun.inflateSync accepted). Try zlib-wrapped first, fall back to raw —
@@ -90,24 +185,27 @@ export async function readBoundedJsonRequestBody(
   req: Request,
   maxBytes: number,
   budget?: TranslatorBudget,
+  options?: { emptyBodyFallback?: unknown },
 ): Promise<unknown> {
   const encoding = req.headers.get("content-encoding");
   const declaredLength = declaredBodyLength(req);
-  // Reject an honest oversized declaration before req.arrayBuffer() can allocate it.
-  // Missing, malformed, or dishonest declarations remain covered by decodeRequestBody's
-  // post-read cap below.
+  // Reject an honest oversized declaration before reading. Missing, malformed,
+  // and dishonest declarations remain bounded by the streaming reader below.
   if (declaredLength !== null && declaredLength > maxBytes) {
-    throw new DecompressedBodyTooLargeError(declaredLength, maxBytes);
+    const error = new DecompressedBodyTooLargeError(declaredLength, maxBytes);
+    cancelStreamWithoutWaiting(req.body, error);
+    throw error;
   }
   const releaseReservation = budget && declaredLength !== null && declaredLength > 0
     ? budget.observeAcceptedRequestCopy(declaredLength)
     : undefined;
   let raw: Uint8Array;
   try {
-    raw = new Uint8Array(await req.arrayBuffer());
+    raw = await readRequestBodyBytesCapped(req.body, maxBytes, req.signal);
   } finally {
     releaseReservation?.();
   }
+  assertBodySizeWithinLimit(raw, maxBytes);
   const releaseRaw = budget?.observeAcceptedRequestCopy(raw.byteLength);
   let releaseDecoded: (() => void) | undefined;
   let releaseText: (() => void) | undefined;
@@ -116,6 +214,9 @@ export async function readBoundedJsonRequestBody(
     releaseDecoded = decoded === raw ? undefined : budget?.observeAcceptedRequestCopy(decoded.byteLength);
     const text = new TextDecoder().decode(decoded);
     releaseText = budget?.observeAcceptedRequestCopy(new TextEncoder().encode(text).byteLength);
+    if (options && "emptyBodyFallback" in options && text.trim() === "") {
+      return options.emptyBodyFallback;
+    }
     const parsed = JSON.parse(text);
     budget?.observeAcceptedRequestCopy(new TextEncoder().encode(JSON.stringify(parsed)).byteLength);
     return parsed;

package/src/server/responses/collaboration.ts

@@ -26,7 +26,7 @@ import {
 } from "../../combos";
 import { isInjectionDebugEnabled } from "../../lib/debug-settings";
 import { injectionDebugLog } from "../../lib/injection-debug-log";
-import { modelInList, namespacedToolName } from "../../types";
+import { modelInList, namespacedToolName, toolChoiceToolPredicate } from "../../types";
 import type { AdapterEvent, OcxConfig, OcxParsedRequest, OcxProviderConfig, OcxProviderContinuationState, OcxUsage } from "../../types";
 import {
   forceRefreshOAuthAccessSnapshot,
@@ -108,7 +108,10 @@ export function buildToolBridgeMaps(parsed: OcxParsedRequest, budget?: Translato
   const toolNsMap = new Map<string, { namespace: string; name: string }>();
   const freeformToolNames = new Set<string>();
   const toolSearchToolNames = new Set<string>();
+  const toolAllowed = toolChoiceToolPredicate(parsed.options.toolChoice);
   for (const t of parsed.context.tools ?? []) {
+    // Upstream output is untrusted: only restore calls for tools the caller authorized.
+    if (!toolAllowed(t)) continue;
     if (t.namespace) {
       const wireName = namespacedToolName(t.namespace, t.name);
       budget?.chargeRetained(new TextEncoder().encode(JSON.stringify([wireName, t.namespace, t.name])).byteLength, { kind: "retained_collectors" });

package/src/server/responses/core.ts

@@ -16,7 +16,13 @@ import {
   previousResponseReplayFailure,
   rememberResponseState,
 } from "../../responses/state";
-import { comboRouteDecisionTrace, NoEligiblePolicyCandidateError, routeModel, type RouteResult } from "../../router";
+import {
+  comboRouteDecisionTrace,
+  NoEligiblePolicyCandidateError,
+  routeConcreteModel,
+  routeModel,
+  type RouteResult,
+} from "../../router";
 import { evidenceFromBody } from "../../routing/request-evidence";
 import {
   advanceComboAfterFailure,
@@ -35,6 +41,7 @@ import {
 import { isInjectionDebugEnabled } from "../../lib/debug-settings";
 import { injectionDebugLog } from "../../lib/injection-debug-log";
 import { resolveClientRetryAfter } from "../../lib/retry-after";
+import { enrichOpenCodeZenRateLimitMessage } from "../../providers/opencode-zen-rate-limit";
 import { modelInList, namespacedToolName } from "../../types";
 import type { AdapterEvent, OcxConfig, OcxParsedRequest, OcxProviderConfig, OcxProviderContinuationState, OcxUsage } from "../../types";
 import {
@@ -199,7 +206,7 @@ import {
   relaySseWithBlockRewrite,
 } from "../sse-payload-rewrite";
 import { createGithubCopilotResponsesBlockRewrite } from "../github-copilot-responses-repair";
-import { responsesJsonToSseBody } from "../responses-json-events";
+import { responsesJsonToSseStream } from "../responses-json-events";
 import { guardTerminalEventStream } from "./terminal-guard";
 
 /**
@@ -434,7 +441,11 @@ async function retryCodexPoolOnAlternateAccount(
       firstAuthCtx.writerGeneration,
     );
   }
-  if (!shouldDeferCodexResetDerivedCooldown(firstResponse, options.deferCodexResetDerivedCooldown)) {
+  const deferFirstOutcome = shouldDeferCodexResetDerivedCooldown(
+    firstResponse,
+    options.deferCodexResetDerivedCooldown,
+  );
+  const recordFirstOutcome = (): void => {
     recordCodexUpstreamOutcome(config, firstAuthCtx.accountId, outcomeStatus, {
       ...quotaMeta,
       threadId: req.headers.get("x-codex-parent-thread-id"),
@@ -445,8 +456,10 @@ async function retryCodexPoolOnAlternateAccount(
       // Retry already advanced the RR ring via excludeAccountId — reuse for promotion.
       ...(retryAuthCtx.accountId ? { promoteAccountId: retryAuthCtx.accountId } : {}),
     });
-  }
-
+  };
+  // Only a combo reset-derived outcome is deferred. Retry-After, defaults, and
+  // ordinary requests must block the first account before the alternate send.
+  if (!deferFirstOutcome) recordFirstOutcome();
   const retryHeaders = headersForCodexAuthContext(req.headers, retryAuthCtx);
   const retryProvider = applyCodexAuthContextToProvider(
     stripCodexRuntimeProviderFields(route.provider),
@@ -473,8 +486,9 @@ async function retryCodexPoolOnAlternateAccount(
   );
 
   noteAttemptSend(logCtx.activeAttempt, passthroughEstimate);
+  let upstreamResponse: Response;
   try {
-    const upstreamResponse = await fetchWithHeaderTimeout(
+    upstreamResponse = await fetchWithHeaderTimeout(
       request.url,
       {
         method: request.method,
@@ -489,26 +503,33 @@ async function retryCodexPoolOnAlternateAccount(
       // dead-host rejection after the credential was seen (#914).
       route.provider.authMode === "forward",
     );
-    // A real HTTP response proves the host was reached (#914).
-    const retryHostKey = upstreamHostHealthKey(route.providerName, safeOriginLabel(request.url));
-    if (normalizeUpstreamHostCircuitThreshold(config.upstreamHostCircuitThreshold) > 0) {
-      resetUpstreamHostHealth(retryHostKey, null);
-    } else {
-      resetUpstreamHostHealth(retryHostKey);
-    }
-    return {
-      kind: "retried",
-      authCtx: retryAuthCtx,
-      request,
-      upstreamResponse,
-      selectedForwardHeaders: retryHeaders,
-    };
   } catch (error) {
     // Attribute the transport failure to the alternate account (already selected).
     return { kind: "transport", error, authCtx: retryAuthCtx };
   } finally {
     request.releaseBodyObservation?.();
   }
+  // A real HTTP response proves the host was reached (#914).
+  const retryHostKey = upstreamHostHealthKey(route.providerName, safeOriginLabel(request.url));
+  if (normalizeUpstreamHostCircuitThreshold(config.upstreamHostCircuitThreshold) > 0) {
+    resetUpstreamHostHealth(retryHostKey, null);
+  } else {
+    resetUpstreamHostHealth(retryHostKey);
+  }
+  if (deferFirstOutcome && upstreamResponse.ok) {
+    // Deferral keeps the first account eligible for a later combo model while an
+    // alternate attempt is still fallible. Commit its quota outcome only once the
+    // alternate account returns a successful HTTP response; otherwise the combo may
+    // still need the first account for its next target.
+    recordFirstOutcome();
+  }
+  return {
+    kind: "retried",
+    authCtx: retryAuthCtx,
+    request,
+    upstreamResponse,
+    selectedForwardHeaders: retryHeaders,
+  };
 }
 
 
@@ -630,6 +651,12 @@ export interface HandleResponsesOptions {
   inboundWire?: InboundWire;
   /** Internal transport identity for route-scoped upstream compatibility policy. */
   inboundTransport?: "websocket";
+  /**
+   * Claude replay may add native-main auth so OpenAI sidecars remain available.
+   * Strip only that internal credential when the final route is a noncanonical
+   * forward destination; final routing can differ from Claude's preflight route.
+   */
+  stripClaudeMainAuthForNoncanonicalForward?: boolean;
   /** Internal recursion guard; callers outside this module must not set it. */
   comboAttempt?: boolean;
   /** Internal combo handoff: allow a later same-provider model after a reset-derived 429/402. */
@@ -961,6 +988,10 @@ async function applyFinalRouteRequestNormalization(args: {
     parsed.options.serviceTier = tier;
   }
   applyServiceTierGate(route.provider, parsed._rawBody, parsed.options);
+  if (route.provider.adapter === "openai-responses" && route.provider.supportsServiceTier === false) {
+    logCtx.requestedServiceTier = undefined;
+    logCtx.requestedSpeedLabel = undefined;
+  }
 
   {
     const guidance = await multiAgentGuidanceText(parsed, {
@@ -1062,7 +1093,7 @@ export async function handleComboResponses(
     const provider = config.providers[target.provider];
     if (!provider || provider.disabled === true) return false;
     try {
-      const route = routeModel(config, `${target.provider}/${target.model}`);
+      const route = routeConcreteModel(config, `${target.provider}/${target.model}`);
       return isCanonicalOpenAiForwardProvider(route.provider);
     } catch {
       return false;
@@ -1096,7 +1127,7 @@ export async function handleComboResponses(
       ...(logCtx.conversationId ? { conversationId: logCtx.conversationId } : {}),
       ...(logCtx.surface ? { surface: logCtx.surface } : {}),
     };
-    const targetRoute = routeModel(config, `${pick.target.provider}/${pick.target.model}`);
+    const targetRoute = routeConcreteModel(config, `${pick.target.provider}/${pick.target.model}`);
     const childBody = concreteComboRequestBody(
       rawBody,
       pick.target,
@@ -1462,7 +1493,9 @@ async function handleResponsesInner(
 
   let route: RouteResult;
   try {
-    route = routeModel(config, parsed.modelId, evidenceFromBody(parsed._rawBody));
+    route = options.comboAttempt
+      ? routeConcreteModel(config, parsed.modelId)
+      : routeModel(config, parsed.modelId, evidenceFromBody(parsed._rawBody));
     logCtx.routeDecision = route.routeDecision;
   } catch (err) {
     if (err instanceof NoAvailableComboTargetsError) {
@@ -1700,7 +1733,24 @@ async function handleResponsesInner(
     parsed.options.promptCacheKey,
     route.providerName === "github-copilot" ? getOAuthCredentialApiBaseUrl(route.providerName) : undefined,
   );
-  const adapterProvider = resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire);
+  let adapterProvider = resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire);
+  const stripClaudeMainAuth = options.stripClaudeMainAuthForNoncanonicalForward === true
+    && adapterProvider.adapter === "openai-responses"
+    && adapterProvider.authMode === "forward"
+    && !isCanonicalOpenAiForwardProvider(adapterProvider);
+  if (stripClaudeMainAuth) {
+    releaseCodexAuthContextProbeLease(authCtx);
+    authCtx = { kind: "main", accountId: null };
+    route.provider = stripCodexRuntimeProviderFields(route.provider);
+    adapterProvider = stripCodexRuntimeProviderFields(adapterProvider);
+    selectedForwardHeaders = new Headers(selectedForwardHeaders);
+    selectedForwardHeaders.delete("authorization");
+    selectedForwardHeaders.delete("chatgpt-account-id");
+    delete route.codexAccountMode;
+    delete route.codexAccountId;
+    delete route.codexAccountNamespace;
+    logCtx.provider = route.providerName;
+  }
   const adapter = resolveAdapter(adapterProvider, config.cacheRetention);
   logCtx.providerAdapter = adapter.name;
   // Ordinary requests receive one durable attempt only after their final initial
@@ -2437,25 +2487,46 @@ async function handleResponsesInner(
         && options.inboundTransport !== "websocket"
         && providerModelResponsesUpstreamStreaming(route.providerName, route.provider, route.modelId) === false
         && route.provider.adapter === "openai-responses") {
+        let completed: Record<string, unknown> | undefined;
         try {
-          let completed = JSON.parse(clientJson) as Record<string, unknown>;
+          const parsedCompleted = JSON.parse(clientJson) as unknown;
+          if (!parsedCompleted || typeof parsedCompleted !== "object" || Array.isArray(parsedCompleted)) {
+            throw new TypeError("bounded Responses JSON is not an object");
+          }
+          let candidate = parsedCompleted as Record<string, unknown>;
           // The bounded-JSON answer bypasses the SSE relay, so it also bypasses
           // the SSE item-id rewrite. Apply the same client-facing normalization
           // here or this policy would silently disable id repair for the very
           // providers that need it (raw record already happened above).
           if (hasResponsesItemIdRepair(route.provider.responsesItemIdRepair)) {
-            completed = repairResponsesJsonItemIds(completed, route.provider.responsesItemIdRepair!, translatorBudget);
+            candidate = repairResponsesJsonItemIds(candidate, route.provider.responsesItemIdRepair!, translatorBudget);
+          }
+          completed = candidate;
+        } catch {
+          // Non-JSON despite content-type: fall through to the plain relay.
+        }
+        if (completed) {
+          let stream: ReadableStream<Uint8Array>;
+          try {
+            stream = responsesJsonToSseStream(completed);
+          } catch (error) {
+            if (error instanceof RangeError) {
+              return formatErrorResponse(
+                502,
+                "upstream_error",
+                "upstream JSON response exceeded the synthesized SSE item limit",
+              );
+            }
+            throw error;
           }
           const sseHeaders = sanitizePassthroughHeaders(headers);
           sseHeaders.set("content-type", "text/event-stream");
           sseHeaders.set("cache-control", "no-store");
-          return new Response(responsesJsonToSseBody(completed), {
+          return new Response(stream, {
             status: upstreamResponse.status,
             statusText: upstreamResponse.statusText,
             headers: sseHeaders,
           });
-        } catch {
-          // Non-JSON despite content-type: fall through to the plain relay.
         }
       }
       // WS turns reframe this JSON into events in the bridge, which is the
@@ -3154,11 +3225,26 @@ async function handleResponsesInner(
       }
       // Upstreams occasionally echo request details in error bodies — scrub token-shaped
       // material before it reaches the client-facing error surface.
-      const message = `Provider error ${upstreamResponse.status}: ${redactSecretString(errorText.slice(0, 500))}`;
+      const upstreamRetryAfter = upstreamResponse.headers.get("retry-after");
+      const message = enrichOpenCodeZenRateLimitMessage(
+        `Provider error ${upstreamResponse.status}: ${redactSecretString(errorText.slice(0, 500))}`,
+        {
+          status: upstreamResponse.status,
+          providerName: route.providerName,
+          baseUrl: route.provider.baseUrl,
+          adapter: route.provider.adapter,
+          authMode: route.provider.authMode,
+          hasApiKey: Boolean(route.provider.apiKey?.trim()),
+          upstreamRetryAfter,
+          // This recovery path is the HTTP Responses wire; custom runTurn transports
+          // never reach enrichOpenCodeZenRateLimitMessage here.
+          supportsHttpSameKeyRetry: true,
+        },
+      );
       const retryAfter = resolveClientRetryAfter({
         status: upstreamResponse.status,
         message,
-        upstreamRetryAfter: upstreamResponse.headers.get("retry-after"),
+        upstreamRetryAfter,
       });
       return formatErrorResponse(upstreamResponse.status, "upstream_error", message, {
         ...(retryAfter !== undefined ? { retryAfter } : {}),

package/src/server/responses-json-events.ts

@@ -7,6 +7,8 @@
 
 export type ResponsesJsonEventFrame = Record<string, unknown>;
 
+export const MAX_SYNTHESIZED_OUTPUT_ITEMS = 10_000;
+
 /**
  * The canonical minimal sequence Codex commits: response.created (empty
  * output, in_progress) → one response.output_item.done per output item → a
@@ -16,26 +18,38 @@ export function responsesJsonEventSequence(
   response: Record<string, unknown>,
   rewritePayload?: (payload: Record<string, unknown>) => Record<string, unknown>,
 ): ResponsesJsonEventFrame[] {
+  return [...iterateResponsesJsonEvents(response, rewritePayload)];
+}
+
+function* iterateResponsesJsonEvents(
+  response: Record<string, unknown>,
+  rewritePayload?: (payload: Record<string, unknown>) => Record<string, unknown>,
+): Generator<ResponsesJsonEventFrame> {
   const rewrite = rewritePayload ?? ((payload: Record<string, unknown>) => payload);
   const output = Array.isArray(response.output) ? response.output : [];
+  if (output.length > MAX_SYNTHESIZED_OUTPUT_ITEMS) {
+    throw new RangeError(
+      `Responses JSON output contains ${output.length} items; maximum is ${MAX_SYNTHESIZED_OUTPUT_ITEMS}`,
+    );
+  }
   const finalStatus = response.status === "failed" || response.status === "incomplete"
     ? response.status
     : "completed";
-  return [
-    rewrite({
-      type: "response.created",
-      response: { ...response, status: "in_progress", output: [] },
-    }),
-    ...output.map((item, outputIndex) => rewrite({
+  yield rewrite({
+    type: "response.created",
+    response: { ...response, status: "in_progress", output: [] },
+  });
+  for (const [outputIndex, item] of output.entries()) {
+    yield rewrite({
       type: "response.output_item.done",
       output_index: outputIndex,
       item,
-    })),
-    rewrite({
-      type: `response.${finalStatus}`,
-      response: { ...response, status: finalStatus },
-    }),
-  ];
+    });
+  }
+  yield rewrite({
+    type: `response.${finalStatus}`,
+    response: { ...response, status: finalStatus },
+  });
 }
 
 /**
@@ -50,3 +64,27 @@ export function responsesJsonToSseBody(
     .map(frame => `data: ${JSON.stringify(frame)}\n\n`);
   return `${frames.join("")}data: [DONE]\n\n`;
 }
+
+/** Stream synthesized SSE frames without retaining the expanded body in memory. */
+export function responsesJsonToSseStream(
+  response: Record<string, unknown>,
+  rewritePayload?: (payload: Record<string, unknown>) => Record<string, unknown>,
+): ReadableStream<Uint8Array> {
+  const output = Array.isArray(response.output) ? response.output : [];
+  if (output.length > MAX_SYNTHESIZED_OUTPUT_ITEMS) {
+    throw new RangeError(
+      `Responses JSON output contains ${output.length} items; maximum is ${MAX_SYNTHESIZED_OUTPUT_ITEMS}`,
+    );
+  }
+  const frames = iterateResponsesJsonEvents(response, rewritePayload);
+  const encoder = new TextEncoder();
+  return new ReadableStream({
+    pull(controller) {
+      const next = frames.next();
+      controller.enqueue(encoder.encode(
+        next.done ? "data: [DONE]\n\n" : `data: ${JSON.stringify(next.value)}\n\n`,
+      ));
+      if (next.done) controller.close();
+    },
+  });
+}