@bitkyc08/opencodex 2.18.2 → 2.20.0

package/src/server/responses/empty-completion-guard.ts

@@ -0,0 +1,276 @@
+import type { AdapterEvent, OcxConfig, OcxUsage } from "../../types";
+
+/**
+ * Empty-completion guard for Responses turns (port of codex-router's
+ * empty-completion-guard + single retry, PR #145).
+ *
+ * Failure mode: the upstream answers 200 and completes the turn but never
+ * produced output text or a tool call (a reasoning-only stream that ends with
+ * nothing is the canonical shape). The client has no code path for "the model
+ * said nothing", so it silently records the turn as done — the "random stop"
+ * nobody can explain. The guard holds pre-content events (reasoning deltas
+ * are deliberately NOT content), and when a terminal event arrives with no
+ * content it suppresses the terminal and retries the IDENTICAL turn once
+ * (same request bytes, same headers). If the retry is also empty — or fails
+ * upstream — the client sees a stated failure instead of a second silent
+ * success.
+ *
+ * The retry is explicitly enabled by top-level config. The environment switch
+ * is a disable-only emergency override: OCX_EMPTY_COMPLETION_RETRY=0 restores
+ * the previous relay behavior without editing the persisted config.
+ */
+export const EMPTY_COMPLETION_RETRY_ENV = "OCX_EMPTY_COMPLETION_RETRY";
+
+/** Retained pre-content events are bounded independently by count and encoded size. */
+export const EMPTY_COMPLETION_MAX_BUFFERED_EVENTS = 1_024;
+export const EMPTY_COMPLETION_MAX_BUFFERED_BYTES = 1_048_576;
+
+export function emptyCompletionRetryEnabled(
+  config: Pick<OcxConfig, "emptyCompletionRetry">,
+  env: Record<string, string | undefined> = process.env,
+): boolean {
+  return config.emptyCompletionRetry === true && env[EMPTY_COMPLETION_RETRY_ENV] !== "0";
+}
+
+/** Surfaced when the single retry was also empty or failed upstream. */
+export const EMPTY_COMPLETION_RETRY_FAILED_CODE = "empty_completion_retry_failed";
+
+/**
+ * Terminal stop reasons the bridge renders as a visible `response.incomplete`
+ * (max_tokens / content_filter). Those are already a stated failure, not the
+ * silent empty success this guard exists to catch, and retrying the identical
+ * request would burn tokens for the same truncated result.
+ */
+const VISIBLE_INCOMPLETE_STOP_REASONS = new Set(["max_tokens", "content_filter"]);
+const UTF8_ENCODER = new TextEncoder();
+
+function retainedEventBytes(event: AdapterEvent): number {
+  return UTF8_ENCODER.encode(JSON.stringify(event)).byteLength;
+}
+
+function isReasoningEvent(event: AdapterEvent): boolean {
+  return event.type === "thinking_delta"
+    || event.type === "thinking_signature"
+    || event.type === "redacted_thinking"
+    || event.type === "kiro_redacted_reasoning"
+    || event.type === "reasoning_raw_delta";
+}
+
+function isTerminalEvent(
+  event: AdapterEvent,
+): event is Extract<AdapterEvent, { type: "done" | "incomplete" | "error" }> {
+  return event.type === "done" || event.type === "incomplete" || event.type === "error";
+}
+
+/**
+ * Content means something the client can act on: output text or a tool call
+ * (web-search cells included). Reasoning deltas are deliberately not content —
+ * a turn that streams only reasoning and then completes with nothing is
+ * exactly the empty completion this guard exists to catch. Empty text deltas
+ * (some batch adapters always carry `""`) are not content either.
+ */
+export function isContentEvent(event: AdapterEvent): boolean {
+  switch (event.type) {
+    case "text_delta":
+      return event.text.length > 0;
+    case "tool_call_start":
+    case "tool_call_delta":
+    case "tool_call_end":
+    case "web_search_call_begin":
+    case "web_search_call_end":
+      return true;
+    default:
+      return false;
+  }
+}
+
+export function emptyCompletionRetryFailedEvent(
+  usage?: OcxUsage,
+  retryFailedUpstream = false,
+): Extract<AdapterEvent, { type: "error" }> {
+  return {
+    type: "error",
+    status: 502,
+    errorType: "upstream_error",
+    code: EMPTY_COMPLETION_RETRY_FAILED_CODE,
+    message: retryFailedUpstream
+      ? "The model returned an empty completion and the retry failed upstream."
+      : "The model returned an empty completion. opencodex retried once and the completion was empty again.",
+    ...(usage ? { usage } : {}),
+  };
+}
+
+/**
+ * Sum two usage snapshots. Same semantics as terminal-guard's mergeUsage and
+ * request-log's aggregateAttemptUsage: token totals add across the attempts;
+ * `estimated` wins when either attempt only estimated.
+ */
+export function mergeUsage(
+  first: OcxUsage | undefined,
+  second: OcxUsage | undefined,
+): OcxUsage | undefined {
+  if (!first) return second;
+  if (!second) return first;
+  const sumOptional = (key: keyof OcxUsage): number | undefined => {
+    const left = first[key];
+    const right = second[key];
+    return typeof left === "number" || typeof right === "number"
+      ? (typeof left === "number" ? left : 0) + (typeof right === "number" ? right : 0)
+      : undefined;
+  };
+  const cachedInputTokens = sumOptional("cachedInputTokens");
+  const cacheReadInputTokens = sumOptional("cacheReadInputTokens");
+  const cacheCreationInputTokens = sumOptional("cacheCreationInputTokens");
+  const reasoningOutputTokens = sumOptional("reasoningOutputTokens");
+  const contextTotalTokens = second.contextTotalTokens ?? first.contextTotalTokens;
+  const inputTokens = first.inputTokens + second.inputTokens;
+  const outputTokens = first.outputTokens + second.outputTokens;
+  return {
+    inputTokens,
+    outputTokens,
+    totalTokens: inputTokens + outputTokens,
+    ...(contextTotalTokens !== undefined ? { contextTotalTokens } : {}),
+    ...(cachedInputTokens !== undefined ? { cachedInputTokens } : {}),
+    ...(cacheReadInputTokens !== undefined ? { cacheReadInputTokens } : {}),
+    ...(cacheCreationInputTokens !== undefined ? { cacheCreationInputTokens } : {}),
+    ...(reasoningOutputTokens !== undefined ? { reasoningOutputTokens } : {}),
+    ...(first.estimated || second.estimated ? { estimated: true } : {}),
+  };
+}
+
+export interface EmptyCompletionGuardOptions {
+  firstEvents: AsyncIterable<AdapterEvent>;
+  /**
+   * Re-run the IDENTICAL turn: same request body, same headers, same signal.
+   * Receives no arguments — the request must not be modified between attempts.
+   */
+  continuation: () => AsyncIterable<AdapterEvent> | Promise<AsyncIterable<AdapterEvent>>;
+  /** How many times an empty completion is retried; default 1 (the router's single retry). */
+  maxRetries?: number;
+}
+
+/**
+ * Watch an adapter event stream for the empty-completion failure mode. Events
+ * are held until the turn produces content or ends: reasoning and other
+ * pre-content events stay buffered (released in order on first content), the
+ * terminal is withheld, and an empty terminal triggers one identical-turn
+ * retry through `continuation`. Usage is merged across attempts so the bridge
+ * and request log meter the whole turn, not just the attempt that succeeded.
+ *
+ * Heartbeats always pass through untouched: they feed the bridge's stall
+ * watchdog, so holding them behind the content gate would trip false
+ * upstream_stall_timeout failures on slow reasoning-only turns.
+ */
+export async function* guardEmptyCompletionEventStream(
+  options: EmptyCompletionGuardOptions,
+): AsyncGenerator<AdapterEvent> {
+  const maxRetries = Math.max(0, Math.floor(options.maxRetries ?? 1));
+  let source = options.firstEvents;
+  let held: AdapterEvent[] = [];
+  let heldBytes = 0;
+  let sawContent = false;
+  let passthrough = false;
+  let retries = 0;
+  let usage: OcxUsage | undefined;
+
+  const withUsage = (event: AdapterEvent & { usage?: OcxUsage }): AdapterEvent => {
+    const merged = mergeUsage(usage, event.usage);
+    return merged ? { ...event, ...(merged ? { usage: merged } : {}) } : event;
+  };
+  const releaseHeld = (): AdapterEvent[] => {
+    const released = held;
+    held = [];
+    heldBytes = 0;
+    return released;
+  };
+
+  while (true) {
+    let terminalSeen = false;
+    for await (const event of source) {
+      if (event.type === "heartbeat") {
+        yield event;
+        continue;
+      }
+      if (sawContent || passthrough) {
+        // Buffered content is already flowing; everything downstream passes
+        // through. Every terminal carries usage merged across every attempt.
+        yield isTerminalEvent(event) ? withUsage(event) : event;
+        continue;
+      }
+      if (isContentEvent(event)) {
+        sawContent = true;
+        yield* releaseHeld();
+        yield event;
+        continue;
+      }
+      if (event.type === "done") {
+        usage = mergeUsage(usage, event.usage);
+        if (event.stopReason !== undefined && VISIBLE_INCOMPLETE_STOP_REASONS.has(event.stopReason)) {
+          // Rendered as response.incomplete: a stated failure, not the silent
+          // empty success this guard exists to catch.
+          yield* releaseHeld();
+          yield { ...event, ...(usage ? { usage } : {}) };
+          return;
+        }
+        if (retries < maxRetries) {
+          // Suppress the terminal: the client must never see a completed event
+          // for a turn that produced nothing. Retry the identical turn.
+          retries += 1;
+          try {
+            source = await options.continuation();
+          } catch {
+            yield emptyCompletionRetryFailedEvent(usage, true);
+            return;
+          }
+          terminalSeen = true;
+          break;
+        }
+        // The retry was also empty: a stated failure, not a second silent
+        // success.
+        yield emptyCompletionRetryFailedEvent(usage);
+        return;
+      }
+      if (event.type === "error") {
+        if (retries > 0 && event.status !== 499) {
+          // The retry failed upstream. Its body cannot reach the client (the
+          // 200 head went out with the first attempt), so state the failure in
+          // the stream's own error framing — same move as the router's
+          // empty_completion_retry_failed. Client cancels (499) pass through.
+          yield emptyCompletionRetryFailedEvent(mergeUsage(usage, event.usage), true);
+          return;
+        }
+        yield* releaseHeld();
+        yield withUsage(event);
+        return;
+      }
+      if (event.type === "incomplete") {
+        // A structured incomplete is already a visible failure; never convert
+        // it into an empty completion.
+        yield* releaseHeld();
+        yield withUsage(event);
+        return;
+      }
+      const eventBytes = retainedEventBytes(event);
+      if (held.length + 1 > EMPTY_COMPLETION_MAX_BUFFERED_EVENTS
+        || heldBytes + eventBytes > EMPTY_COMPLETION_MAX_BUFFERED_BYTES) {
+        // Preserve data rather than retaining without bound: release the prefix,
+        // emit this event, and stop attempting an empty-completion retry for the turn.
+        yield* releaseHeld();
+        yield event;
+        passthrough = true;
+        continue;
+      }
+      held.push(event);
+      heldBytes += eventBytes;
+      // The bridge watchdog sees only yielded events. Feed it while reasoning is
+      // held so a long reasoning-only prefix remains live without exposing it early.
+      if (isReasoningEvent(event)) yield { type: "heartbeat" };
+    }
+    if (!terminalSeen) {
+      // The source ended without a terminal event (truncated stream). Release
+      // what was held so the bridge can mark the stream incomplete.
+      yield* releaseHeld();
+      return;
+    }
+  }
+}

package/src/server/responses/fetch-helpers.ts

@@ -102,6 +102,7 @@ import {
 } from "../relay";
 import { hasResponsesItemIdRepair, relaySseWithResponsesItemIdRepair } from "../responses-item-id-repair";
 import type { EffectiveSubagentRoster, SpawnAgentSurface } from "../../codex/catalog";
+import { waitForProviderRequestSlot } from "../../providers/request-pacing";
 
 
 export function disableResponsesRequestTimeout(req: Request, server: Pick<Server<WsData>, "timeout"> | undefined): boolean {
@@ -136,21 +137,48 @@ export function safeOriginLabel(url: string): string {
 
 
 
+export interface PaceAwareFetch {
+  waitForPacing?: (signal?: AbortSignal) => Promise<void>;
+  unpacedFetch?: typeof globalThis.fetch;
+}
+
+export type ProviderFetch = typeof globalThis.fetch & PaceAwareFetch;
+
+export interface ProviderFetchOptions {
+  providerName?: string;
+  modelId?: string;
+}
+
 export function providerFetch(
   provider: OcxProviderConfig,
   runtime: BunRuntimeGateInput = currentBunRuntimeIdentity(),
-): typeof globalThis.fetch {
+  options: ProviderFetchOptions = {},
+): ProviderFetch {
   const base = (provider as OcxProviderConfig & { fetch?: typeof globalThis.fetch }).fetch ?? globalThis.fetch;
   // ChatGPT Codex backend: streaming turns ride the responses_websockets
   // transport (measured ~3s faster TTFT than the SSE POST queue); everything
   // else keeps the provider's HTTP fetch. See ws-upstream.ts for the details.
-  const wrapped = (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit) => {
+  const unpaced = async (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit) => {
     if (typeof input === "string" && init && shouldUseCodexWsUpstream(input, init, runtime)) {
       return codexWsUpstreamFetch(input, init, base, runtime);
     }
     return base(input, init);
   };
-  return wrapped as typeof globalThis.fetch;
+  const waitForPacing = (signal?: AbortSignal) => options.providerName
+    ? waitForProviderRequestSlot(options.providerName, provider, options.modelId, signal)
+    : Promise.resolve();
+  const wrapped = async (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit) => {
+    await waitForPacing(init?.signal ?? undefined);
+    return unpaced(input, init);
+  };
+  const preconnect = (...args: Parameters<typeof globalThis.fetch.preconnect>): void => {
+    base.preconnect?.(...args);
+  };
+  return Object.assign(wrapped, {
+    preconnect,
+    waitForPacing,
+    unpacedFetch: Object.assign(unpaced, { preconnect }),
+  });
 }
 
 
@@ -164,6 +192,9 @@ export async function fetchWithHeaderTimeout(
   executor: typeof globalThis.fetch = globalThis.fetch,
   manualRedirect = false,
 ): Promise<Response> {
+  const pacing = executor as ProviderFetch;
+  await pacing.waitForPacing?.(abortSignal);
+  const fetchExecutor = pacing.unpacedFetch ?? executor;
   const timeout = new AbortController();
   const timer = setTimeout(() => {
     if (!timeout.signal.aborted) timeout.abort(new DOMException("Timeout elapsed", "TimeoutError"));
@@ -175,7 +206,7 @@ export async function fetchWithHeaderTimeout(
     headers.set("accept-encoding", "identity");
   }
   try {
-    return await executor(url, {
+    return await fetchExecutor(url, {
       ...init,
       headers,
       // Credential-bearing sends opt into manual redirects so a 3xx is relayed

package/src/server/responses/input-admission.ts

@@ -0,0 +1,169 @@
+/**
+ * Pre-dispatch input admission (#1412).
+ *
+ * Refuses a turn whose estimated input cannot plausibly fit the model context window,
+ * BEFORE auth resolution, circuit admission, or any upstream I/O. #1412 reported ~127k of
+ * real context compounding to 1.3M-1.6M tokens and crashing the proxy; the provider would
+ * reject such a turn anyway, so paying for the round trip buys nothing.
+ *
+ * Deliberately narrow. This is not a context manager and not a compaction trigger: it
+ * catches the pathological case and stays out of the way otherwise. Every uncertainty
+ * resolves toward admitting.
+ */
+import { nativeOpenAiContextWindow } from "../../codex/catalog/metadata";
+import { estimateTokens } from "../../lib/token-estimate";
+import { isCanonicalOpenAiForwardProvider, OPENAI_CODEX_PROVIDER_ID } from "../../providers/openai-tiers";
+import type { OcxContentPart, OcxParsedRequest, OcxProviderConfig } from "../../types";
+
+/**
+ * Multiplier applied to the ceiling before refusing.
+ *
+ * 2.5, not something tighter, because `estimateTokens` can overshoot by 1.6x on its own.
+ * `cjkRatio` samples every `stride`-th character, so a payload of fixed-width records whose
+ * length aligns with the stride samples as 100% CJK while being ~1.6% CJK, firing the
+ * 2.5-chars/token clamp instead of the 4.0 default. Measured on Bun 1.3.14: 126,046 chars,
+ * true CJK ratio 0.0161, sampled ratio 1.0, estimate inflated 1.6x. Since 4.0 / 2.5 = 1.6
+ * is that branch maximum divergence, a threshold at or under 1.6 would convert the
+ * estimator error bar into false 413s.
+ *
+ * 2.5 sits above it with room for the ~10% model-family ratio spread, and still refuses the
+ * #1412 shape (10x) four times over.
+ */
+export const ADMISSION_TOLERANCE = 2.5;
+
+/**
+ * Token cost charged for a remote image URL. The bytes are not in this request — the
+ * provider fetches them — so the URL own length is not the cost. A small flat charge
+ * acknowledges the tiles the image will occupy without pretending to know its dimensions.
+ */
+const REMOTE_IMAGE_TOKENS = 850;
+
+/** Decoded image bytes per token. Coarse tile-count proxy, not a provider formula. */
+const IMAGE_BYTES_PER_TOKEN = 750;
+
+export interface InputAdmissionResult {
+  admitted: boolean;
+  estimatedTokens: number;
+  /** Resolved ceiling, or null when nothing could be resolved (=> always admitted). */
+  ceiling: number | null;
+}
+
+function positive(value: unknown): number | null {
+  return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : null;
+}
+
+/**
+ * Charge a `data:` URL by its DECODED size rather than its character length: base64 inflates
+ * by 4/3, so charging the string would overcount by a third. A remote URL is charged flat.
+ */
+function imageTokens(imageUrl: string): number {
+  if (!imageUrl.startsWith("data:")) return REMOTE_IMAGE_TOKENS;
+  const comma = imageUrl.indexOf(",");
+  if (comma < 0) return REMOTE_IMAGE_TOKENS;
+  const payload = imageUrl.length - comma - 1;
+  if (payload <= 0) return 0;
+  const decoded = Math.floor((payload * 3) / 4);
+  return Math.max(1, Math.ceil(decoded / IMAGE_BYTES_PER_TOKEN));
+}
+
+function contentPartTokens(part: OcxContentPart, modelId: string): number {
+  return part.type === "image" ? imageTokens(part.imageUrl) : estimateTokens(part.text, modelId);
+}
+
+function contentTokens(content: string | readonly OcxContentPart[], modelId: string): number {
+  if (typeof content === "string") return estimateTokens(content, modelId);
+  let total = 0;
+  for (const part of content) total += contentPartTokens(part, modelId);
+  return total;
+}
+
+/**
+ * Estimate the input tokens of a parsed request.
+ *
+ * Walks the whole `OcxMessage` union rather than user text alone. Assistant turns carry
+ * their content as `OcxAssistantContentPart[]` — text, thinking blocks, and tool calls whose
+ * JSON arguments are frequently the largest single item in an agent conversation. A walk
+ * that counted only `{type:"text"}` would undercount exactly the turns that trigger this
+ * gate.
+ */
+export function estimateInputTokens(parsed: OcxParsedRequest, modelId: string): number {
+  const { context } = parsed;
+  let total = 0;
+
+  for (const prompt of context.systemPrompt ?? []) total += estimateTokens(prompt, modelId);
+
+  for (const message of context.messages) {
+    if (message.role === "assistant") {
+      for (const part of message.content) {
+        if (part.type === "text") total += estimateTokens(part.text, modelId);
+        else if (part.type === "thinking") total += estimateTokens(part.thinking, modelId);
+        else total += estimateTokens(part.name, modelId) + estimateTokens(JSON.stringify(part.arguments), modelId);
+      }
+      // Opaque provider blob replayed verbatim upstream, so it costs real input tokens.
+      if (message.kiroRedactedReasoning) total += estimateTokens(message.kiroRedactedReasoning, modelId);
+      continue;
+    }
+    total += contentTokens(message.content, modelId);
+  }
+
+  // Tool schemas ride every turn: name, description, and the JSON parameter schema all
+  // reach the upstream, and a large MCP catalog can dominate a short conversation.
+  for (const tool of context.tools ?? []) {
+    total += estimateTokens(tool.name, modelId)
+      + estimateTokens(tool.description, modelId)
+      + estimateTokens(JSON.stringify(tool.parameters), modelId);
+  }
+
+  return total;
+}
+
+/**
+ * Resolve the admission ceiling. Pure: no filesystem, no catalog, no registry scan.
+ *
+ * `provider` must be the ROUTED config (`route.provider`), which `routedProviderConfig`
+ * has already transport-guarded and merged. Re-deriving from `config.providers[name]` would
+ * reject a user-defined provider that merely shares a built-in name using limits that
+ * belong to a different service.
+ */
+export function resolveInputCeiling(
+  provider: OcxProviderConfig,
+  providerName: string,
+  modelId: string,
+): number | null {
+  const configured = positive(provider.modelContextWindows?.[modelId]) ?? positive(provider.contextWindow);
+
+  // The canonical `openai` registry entry declares no context fields, so without this the
+  // gate would be inert on the default Codex route. All three clauses are load-bearing: a
+  // transport-mismatched custom provider named "openai" is preserved verbatim by routing
+  // and must not inherit built-in native limits, and a routed `provider/model` id is not a
+  // native slug. Static maps only — no catalog read.
+  const native = configured === null
+    && providerName === OPENAI_CODEX_PROVIDER_ID
+    && isCanonicalOpenAiForwardProvider(provider)
+    && !modelId.includes("/")
+    ? positive(nativeOpenAiContextWindow(modelId))
+    : null;
+
+  const window = configured ?? native;
+  // modelMaxInputTokens is an input-only cap, so it can only tighten the window.
+  const maxInput = positive(provider.modelMaxInputTokens?.[modelId]);
+  if (window === null) return maxInput;
+  return maxInput === null ? window : Math.min(window, maxInput);
+}
+
+/**
+ * Fail-open when no ceiling is known; refuse only past `ceiling * ADMISSION_TOLERANCE`.
+ *
+ * The caller is responsible for skipping compaction turns — see the call site in core.ts.
+ */
+export function checkInputAdmission(
+  parsed: OcxParsedRequest,
+  provider: OcxProviderConfig,
+  providerName: string,
+  modelId: string,
+): InputAdmissionResult {
+  const ceiling = resolveInputCeiling(provider, providerName, modelId);
+  if (ceiling === null) return { admitted: true, estimatedTokens: 0, ceiling: null };
+  const estimatedTokens = estimateInputTokens(parsed, modelId);
+  return { admitted: estimatedTokens <= ceiling * ADMISSION_TOLERANCE, estimatedTokens, ceiling };
+}

package/src/server/responses/pacing-overload.ts

@@ -0,0 +1,13 @@
+import { formatErrorResponse } from "../../bridge";
+import { RequestPacingQueueOverloadError } from "../../providers/request-pacing";
+
+/** Convert local request-pacing admission failures into a retryable HTTP response. */
+export function requestPacingOverloadResponse(error: unknown): Response | undefined {
+  if (!(error instanceof RequestPacingQueueOverloadError)) return undefined;
+  return formatErrorResponse(
+    429,
+    "rate_limit_error",
+    error.message,
+    { retryAfter: String(error.retryAfterSeconds) },
+  );
+}

package/src/server/responses/policy-fallback.ts

@@ -5,6 +5,7 @@ import { finishRequestAttempt, type RequestLogContext } from "../request-log";
 import type { OcxConfig } from "../../types";
 import type { RouteCandidateTrace, RouteDecisionTraceV1 } from "../../routing/trace";
 import { handleResponses as handleResponsesCore } from "./core";
+import { requestPacingOverloadResponse } from "./pacing-overload";
 
 type CoreHandler = typeof handleResponsesCore;
 type CoreOptions = Parameters<CoreHandler>[3];
@@ -133,7 +134,14 @@ export async function handleResponsesWithPolicyFallback(
     // Core owns the client-facing parse/decompression error.
   }
 
-  let response = await runCore(req, config, logCtx, coreOptions);
+  let response: Response;
+  try {
+    response = await runCore(req, config, logCtx, coreOptions);
+  } catch (error) {
+    const overload = requestPacingOverloadResponse(error);
+    if (overload) return overload;
+    throw error;
+  }
   const initialTrace = logCtx.routeDecision;
   const initialRequestedModel = logCtx.requestedModel;
   if (!rawBody || !isPolicyDecision(initialTrace)) return response;
@@ -151,7 +159,13 @@ export async function handleResponsesWithPolicyFallback(
     finishFailedPolicyAttempt(logCtx, response.status);
     const retryRequest = requestWithCandidate(req, rawBody, next);
     try {
-      response = await runCore(retryRequest, config, logCtx, coreOptions);
+      try {
+        response = await runCore(retryRequest, config, logCtx, coreOptions);
+      } catch (error) {
+        const overload = requestPacingOverloadResponse(error);
+        if (overload) return overload;
+        throw error;
+      }
     } finally {
       logCtx.requestedModel = initialRequestedModel;
       logCtx.routeDecision = initialTrace;

package/src/server/responses/terminal-guard.ts

@@ -195,7 +195,7 @@ export async function* guardTerminalEventStream(options: GuardedEventStreamOptio
     for await (const event of source) {
       if (event.type === "done") {
         terminalSeen = true;
-        const analysis = options.adapterName === "anthropic"
+        const analysis = (options.adapterName === "anthropic" || options.adapterName === "openai-chat")
           ? analyzeTerminalTurn(parsed, seen)
           : { decision: "pass" as const };
         const normalStop = event.stopReason !== "max_tokens" && event.stopReason !== "content_filter";

package/src/server/responses/upstream-error.ts

@@ -5,7 +5,12 @@
  * #553 looking for an adapter URL bug that does not exist. Name the likely cause and the
  * command that settles it.
  */
+import { RequestPacingQueueOverloadError } from "../../providers/request-pacing";
+
 export function describeUpstreamConnectFailure(err: unknown, connectMs: number): string {
+  // Local pacing admission is not a transport failure. Let the outer response boundary
+  // preserve its retryable 429 identity instead of laundering it into a 502.
+  if (err instanceof RequestPacingQueueOverloadError) throw err;
   if (err instanceof Error && err.name === "TimeoutError") {
     return `Provider connect timeout after ${connectMs}ms`;
   }

package/src/server/responses.ts

@@ -1,10 +1,25 @@
 // AUTO-SPLIT facade: original responses.ts body moved into ./responses/* modules.
 // Public surface preserved exactly; importers keep using "src/server/responses".
+import { handleResponsesCompact as handleResponsesCompactImpl } from "./responses/compact";
+import { requestPacingOverloadResponse } from "./responses/pacing-overload";
+
 export { buildToolBridgeMaps, isV1CollabSurface, collabSurface, multiAgentGuidanceText, V2_GUIDANCE_CHAR_BUDGET, injectDeveloperMessage } from "./responses/collaboration";
 export type { MultiAgentGuidanceOptions, MultiAgentGuidanceDeps } from "./responses/collaboration";
 export { hasUnreadableEncryptedAgentTask, sanitizeEncryptedContentInPlace } from "./responses/encrypted-payload";
-export { COMPACT_RESPONSE_MAX_BYTES, bufferCompactResponse, handleResponsesCompact } from "./responses/compact";
+export { COMPACT_RESPONSE_MAX_BYTES, bufferCompactResponse } from "./responses/compact";
 export { disableResponsesRequestTimeout, safeHostLabel, fetchWithHeaderTimeout } from "./responses/fetch-helpers";
 export { sidecarOutcomeRecorder, isShadowSourceModel, codexLogAccountId, usesCodexForwardPoolAuth, codexForwardTerminalOutcomeRecorder, decodeRequestErrorResponse, buildComboChildHeaders, linkAbortSignal } from "./responses/core";
 export { handleResponses, handleResponsesWithPolicyFallback, rankPolicyFallbackCandidates } from "./responses/policy-fallback";
-export { adapterNeedsForcedContinuation } from "./responses/core";
+export { adapterNeedsForcedContinuation } from "./responses/core";
+
+export async function handleResponsesCompact(
+  ...args: Parameters<typeof handleResponsesCompactImpl>
+): Promise<Response> {
+  try {
+    return await handleResponsesCompactImpl(...args);
+  } catch (error) {
+    const overload = requestPacingOverloadResponse(error);
+    if (overload) return overload;
+    throw error;
+  }
+}

package/src/service-manager-probe.ts

@@ -264,9 +264,8 @@ function inspectSystemd(deps: Required<Pick<ProbeDeps, "run" | "home">>): Servic
     "--user", "show", TASK,
     "-p", "LoadState", "-p", "ActiveState", "-p", "FragmentPath", "-p", "NeedDaemonReload",
   ]);
-  if (shown.spawnFailed || shown.timedOut) {
-    return unknown(`systemctl could not be asked: ${shown.timedOut ? "timed out" : shown.stderr.trim()}`);
-  }
+  if (shown.spawnFailed) return { kind: "absent" };
+  if (shown.timedOut) return unknown("systemctl could not be asked: timed out");
   if (shown.status !== 0) {
     // A missing unit still exits ZERO and says not-found; a non-zero status means
     // the question never reached the bus.