@bitkyc08/opencodex 2.19.0 → 2.20.0

package/src/server/chat-native.ts

@@ -0,0 +1,371 @@
+import { buildOpenAIChatPassthroughRequest, createOpenAIChatAdapter } from "../adapters/openai-chat";
+import type { AdapterRequest, ProviderAdapter } from "../adapters/base";
+import {
+  chatCompletionsErrorBody,
+  chatCompletionsErrorResponse,
+  collectChatCompletion,
+  isChatCompletionsStreamError,
+} from "../chat/outbound";
+import { classifyError, CYBER_POLICY_ERROR_CODE, isCyberPolicyCode } from "../lib/errors";
+import { readBoundedResponseBody } from "../lib/bounded-body";
+import { redactSecretString } from "../lib/redact";
+import { resolveClientRetryAfter } from "../lib/retry-after";
+import {
+  applyUpstreamRecoveryInit,
+  fetchWithResetRetry,
+  prepareSameTarget429Wait,
+  type UpstreamSendRecovery,
+} from "../lib/upstream-retry";
+import {
+  isTranslatorBudgetExceededError,
+  type TranslatorBudget,
+} from "../lib/translator-budget";
+import {
+  hasKeyPoolFailover,
+  rateLimitRetryDelayMs,
+  rateLimitRetryPolicyFor,
+  rotateProviderTransportOn429,
+} from "../providers/key-failover";
+import type { RouteResult } from "../router";
+import type { OcxConfig, OcxProviderConfig } from "../types";
+import { fetchWithHeaderTimeout, providerFetch, safeHostLabel } from "./responses/fetch-helpers";
+import { linkAbortSignal } from "./responses";
+import {
+  addFinalRequestLog,
+  beginRequestAttempt,
+  noteAttemptSend,
+  recordFirstOutput,
+  sealRequestAttemptIdentity,
+  type RequestLogContext,
+} from "./request-log";
+import { jsonCompletionSse, nativeChatSse, structuredError, usageFromChat } from "./chat-native-sse";
+
+type Rec = Record<string, unknown>;
+
+const MAX_NATIVE_CHAT_JSON_BYTES = 32 * 1024 * 1024;
+const MAX_NATIVE_CHAT_ERROR_BYTES = 64 * 1024;
+
+function isRec(value: unknown): value is Rec {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+export function isNativeChatRouteEligible(route: RouteResult, rawBody: Rec): boolean {
+  const provider = route.provider;
+  if (provider.adapter !== "openai-chat") return false;
+  if (provider.authMode !== undefined && provider.authMode !== "key" && provider.authMode !== "local") return false;
+  // Combo and policy execution own multi-candidate retries in the Responses pipeline.
+  if (route.combo || route.routeKind === "combo" || route.routeKind === "policy") return false;
+  if (rawBody.store === true || rawBody.background === true) return false;
+  if (typeof rawBody.previous_response_id === "string" && rawBody.previous_response_id.length > 0) return false;
+  if (rawBody.compaction_trigger !== undefined) return false;
+  if (Array.isArray(rawBody.tools)) {
+    for (const tool of rawBody.tools) {
+      if (!isRec(tool)) continue;
+      if (tool.type === "web_search" || tool.type === "web_search_preview" || tool.type === "image_generation") {
+        return false;
+      }
+    }
+  }
+  return true;
+}
+
+function chatCompletionJson(value: unknown): Rec | null {
+  if (!isRec(value) || !Array.isArray(value.choices) || value.choices.length === 0) return null;
+  return value;
+}
+
+interface HandleNativeChatOptions {
+  req: Request;
+  config: OcxConfig;
+  logCtx: RequestLogContext;
+  logIds?: { requestId: string; start: number };
+  route: RouteResult;
+  chatBody: Rec;
+  requestedModel: string;
+  requestedStream: boolean;
+  translatorBudget: TranslatorBudget;
+}
+
+export async function handleNativeChatCompletions(options: HandleNativeChatOptions): Promise<Response> {
+  const { req, config, logCtx, logIds, route, requestedModel, requestedStream, translatorBudget } = options;
+  logCtx.inboundProtocol = "chat";
+  const attempt = beginRequestAttempt(
+    (logCtx.attempts?.length ?? 0) + 1,
+    route.providerName,
+    route.modelId,
+    "openai-chat",
+  );
+  logCtx.activeAttempt = attempt;
+  logCtx.activeAttemptStartedAt = Date.now();
+  (logCtx.attempts ??= []).push(attempt);
+  sealRequestAttemptIdentity(attempt, route.providerName, "openai-chat", logCtx.accountLogLabel);
+
+  let logged = false;
+  const finishLog = (status: number, message?: string, closeReason: "non_stream" | "terminal" | "client_cancel" = "non_stream") => {
+    if (logged) return;
+    logged = true;
+    if (message) logCtx.upstreamError = redactSecretString(message).slice(0, 500);
+    if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, status, { closeReason });
+  };
+  const fail = (status: number, message: string, type?: string, code?: string | null): Response => {
+    const safeMessage = redactSecretString(message);
+    finishLog(status, safeMessage);
+    return chatCompletionsErrorResponse(status, safeMessage, type, code);
+  };
+
+  logCtx.requestedEffort = typeof options.chatBody.reasoning_effort === "string"
+    ? options.chatBody.reasoning_effort
+    : undefined;
+  logCtx.requestedServiceTier = typeof options.chatBody.service_tier === "string"
+    ? options.chatBody.service_tier
+    : undefined;
+
+  const upstream = new AbortController();
+  const cleanupAbort = linkAbortSignal(upstream, req.signal);
+  const connectMs = config.connectTimeoutMs ?? 200_000;
+  let activeProvider: OcxProviderConfig = route.provider;
+  let activeAdapter: ProviderAdapter = createOpenAIChatAdapter(activeProvider);
+  let activeRequest: AdapterRequest;
+  let retainedRequestBytes = 0;
+  const releaseRetainedRequest = () => {
+    if (retainedRequestBytes === 0) return;
+    translatorBudget.releaseRetained(retainedRequestBytes, { kind: "request_copies" });
+    retainedRequestBytes = 0;
+  };
+  const retainRequest = (request: AdapterRequest) => {
+    const bytes = new TextEncoder().encode(request.body).byteLength;
+    translatorBudget.chargeRetained(bytes, { kind: "request_copies" });
+    retainedRequestBytes = bytes;
+  };
+  try {
+    activeRequest = buildOpenAIChatPassthroughRequest(activeProvider, options.chatBody, route.modelId, requestedStream);
+    retainRequest(activeRequest);
+  } catch (error) {
+    releaseRetainedRequest();
+    cleanupAbort();
+    upstream.abort();
+    if (isTranslatorBudgetExceededError(error)) {
+      return fail(413, "request translation buffer exceeded the safe limit", "request_too_large", "translation_buffer_limit");
+    }
+    return fail(400, error instanceof Error ? error.message : String(error), "invalid_request_error");
+  }
+
+  const send = async (request: AdapterRequest, recovery?: "rate-limit-429" | "key-429"): Promise<Response> => {
+    try {
+      return await fetchWithResetRetry(
+        (transportRecovery?: UpstreamSendRecovery) => {
+          noteAttemptSend(attempt, logCtx.usageLogInputTokens, transportRecovery ?? recovery);
+          return fetchWithHeaderTimeout(
+            request.url,
+            applyUpstreamRecoveryInit({
+              method: request.method,
+              headers: request.headers,
+              body: request.body,
+            }, transportRecovery),
+            upstream.signal,
+            connectMs,
+            requestedStream,
+            providerFetch(activeProvider, undefined, {
+              providerName: route.providerName,
+              modelId: route.modelId,
+            }),
+          );
+        },
+        { abortSignal: upstream.signal, label: safeHostLabel(request.url) },
+      );
+    } finally {
+      request.releaseBodyObservation?.();
+    }
+  };
+
+  let response: Response;
+  try {
+    response = await send(activeRequest);
+    const retryPolicy = rateLimitRetryPolicyFor(activeProvider);
+    let retries = 0;
+    while (response.status === 429 && retryPolicy && retries < retryPolicy.attempts) {
+      retries += 1;
+      for await (const _ of prepareSameTarget429Wait({
+        body: response.body,
+        signal: upstream.signal,
+        delayMs: rateLimitRetryDelayMs(retryPolicy, response.headers.get("retry-after"), Date.now()),
+      })) { /* pre-stream wait */ }
+      if (upstream.signal.aborted) throw upstream.signal.reason;
+      response = await send(activeRequest, "rate-limit-429");
+    }
+    while (response.status === 429 && hasKeyPoolFailover(activeProvider)) {
+      const rotated = rotateProviderTransportOn429(config, route.providerName, activeProvider, {
+        retryAfter: response.headers.get("retry-after"),
+        now: Date.now(),
+        attemptedKey: activeProvider.apiKey,
+        promptCacheKey: typeof options.chatBody.prompt_cache_key === "string" ? options.chatBody.prompt_cache_key : undefined,
+      });
+      if (!rotated) break;
+      try { void response.body?.cancel().catch(() => {}); } catch { /* already closed */ }
+      activeProvider = rotated;
+      activeAdapter = createOpenAIChatAdapter(activeProvider);
+      releaseRetainedRequest();
+      activeRequest = buildOpenAIChatPassthroughRequest(activeProvider, options.chatBody, route.modelId, requestedStream);
+      retainRequest(activeRequest);
+      response = await send(activeRequest, "key-429");
+    }
+  } catch (error) {
+    releaseRetainedRequest();
+    cleanupAbort();
+    upstream.abort();
+    if (req.signal.aborted) return fail(499, "Client cancelled request", "client_cancelled");
+    return fail(502, error instanceof Error ? error.message : String(error), "server_error");
+  }
+  releaseRetainedRequest();
+
+  if (!response.ok) {
+    let bodyText = "";
+    try {
+      const body = await readBoundedResponseBody(response, {
+        signal: upstream.signal,
+        maxBytes: MAX_NATIVE_CHAT_ERROR_BYTES,
+      });
+      if (body.displaySafe) bodyText = body.text;
+    } catch { /* status-only fallback */ }
+    cleanupAbort();
+    if (req.signal.aborted) {
+      upstream.abort();
+      return fail(499, "Client cancelled request", "client_cancelled");
+    }
+    const detail = activeAdapter.formatErrorBody?.(response.status, response.headers, bodyText) ?? "";
+    let upstreamType: string | undefined;
+    let upstreamCode: string | null | undefined;
+    try {
+      const parsedError = JSON.parse(bodyText) as Rec;
+      const nested = isRec(parsedError.error) ? parsedError.error : undefined;
+      if (typeof nested?.type === "string") upstreamType = nested.type;
+      if (nested?.code === null || typeof nested?.code === "string") upstreamCode = nested.code;
+    } catch { /* keep generic classification */ }
+    const message = detail ? `Provider error ${response.status}: ${detail}` : `Provider error ${response.status}`;
+    const classified = classifyError(
+      response.status,
+      upstreamType ?? (response.status === 401 ? "authentication_error"
+        : response.status === 429 ? "rate_limit_error"
+          : response.status >= 500 ? "server_error" : "invalid_request_error"),
+      message,
+    );
+    if (isCyberPolicyCode(upstreamCode)) {
+      classified.code = CYBER_POLICY_ERROR_CODE;
+      classified.type = "invalid_request_error";
+    } else if (upstreamCode === "model_not_found") {
+      classified.code = "model_not_found";
+      classified.type = "invalid_request_error";
+    } else if (upstreamCode !== undefined && upstreamCode !== null && classified.code == null) {
+      classified.code = upstreamCode;
+    }
+    const status = isCyberPolicyCode(classified.code) ? 400 : response.status;
+    const retryAfter = resolveClientRetryAfter({
+      status: response.status,
+      message: classified.message,
+      upstreamRetryAfter: response.headers.get("retry-after"),
+    });
+    finishLog(status, classified.message);
+    return new Response(JSON.stringify(chatCompletionsErrorBody(status, classified.message, classified.type, classified.code)), {
+      status,
+      headers: {
+        "Content-Type": "application/json",
+        ...(retryAfter ? { "Retry-After": retryAfter } : {}),
+      },
+    });
+  }
+
+  const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
+  if (contentType.includes("text/event-stream") && response.body) {
+    const stream = nativeChatSse(response.body, {
+      requestedModel,
+      translatorBudget,
+      signal: upstream.signal,
+      onFirstOutput: logIds ? () => recordFirstOutput(logCtx, logIds.start) : undefined,
+      onUsage: usage => {
+        logCtx.usage = usage;
+        attempt.usage = usage;
+      },
+      ...(requestedStream ? {
+        onTerminal: (status: number, message?: string) => {
+          cleanupAbort();
+          finishLog(status, message, "terminal");
+        },
+        onCancel: () => {
+          cleanupAbort();
+          upstream.abort();
+          finishLog(499, undefined, "client_cancel");
+        },
+      } : {}),
+    });
+    if (requestedStream) {
+      return new Response(stream, {
+        status: 200,
+        headers: {
+          "Content-Type": "text/event-stream; charset=utf-8",
+          "Cache-Control": "no-cache",
+          Connection: "keep-alive",
+        },
+      });
+    }
+    try {
+      const completion = await collectChatCompletion(stream, requestedModel, translatorBudget);
+      cleanupAbort();
+      finishLog(200);
+      return Response.json(completion);
+    } catch (error) {
+      cleanupAbort();
+      upstream.abort();
+      if (isChatCompletionsStreamError(error)) {
+        return fail(error.status, error.message, error.type, error.code);
+      }
+      return fail(502, error instanceof Error ? error.message : String(error), "upstream_error");
+    }
+  }
+
+  let body;
+  try {
+    body = await readBoundedResponseBody(response, {
+      signal: upstream.signal,
+      maxBytes: MAX_NATIVE_CHAT_JSON_BYTES,
+      totalTimeoutMs: Math.max(connectMs, 5_000),
+      inactivityTimeoutMs: Math.max(connectMs, 5_000),
+    });
+  } catch (error) {
+    cleanupAbort();
+    upstream.abort();
+    if (req.signal.aborted) return fail(499, "Client cancelled request", "client_cancelled");
+    return fail(502, error instanceof Error ? error.message : String(error), "upstream_error");
+  }
+  cleanupAbort();
+  if (body.oversized) {
+    upstream.abort();
+    return fail(502, "upstream response exceeded the safe limit", "upstream_error", "translation_buffer_limit");
+  }
+  let parsedJson: unknown;
+  try {
+    parsedJson = JSON.parse(body.text);
+  } catch {
+    return fail(502, "upstream returned malformed Chat Completions JSON", "upstream_error");
+  }
+  const error = structuredError(parsedJson);
+  if (error) return fail(error.status ?? 502, error.message, error.type, error.code);
+  const completion = chatCompletionJson(parsedJson);
+  if (!completion) return fail(502, "upstream response contained no choices", "upstream_error");
+  const usage = usageFromChat(completion.usage);
+  if (usage) {
+    logCtx.usage = usage;
+    attempt.usage = usage;
+  }
+  if (logIds) recordFirstOutput(logCtx, logIds.start);
+  finishLog(200);
+  if (requestedStream) {
+    return new Response(jsonCompletionSse(completion, requestedModel), {
+      status: 200,
+      headers: { "Content-Type": "text/event-stream; charset=utf-8", "Cache-Control": "no-cache" },
+    });
+  }
+  return new Response(JSON.stringify(completion), {
+    status: 200,
+    headers: { "Content-Type": "application/json" },
+  });
+}

package/src/server/management/combo-routes.ts

@@ -65,6 +65,16 @@ import type { MetricUnavailableReason, TokPerSecondResult, CostEstimateReason, C
 import type { ManagementContext } from "./context";
 import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
 
+
+/** Management wire shape: omit default imageInput "auto" (persist/response sparse). */
+function sparseComboConfig<T extends { imageInput?: "auto" | "disabled" }>(combo: T): Omit<T, "imageInput"> & { imageInput?: "disabled" } {
+  const { imageInput, ...rest } = combo;
+  return {
+    ...rest,
+    ...(imageInput === "disabled" ? { imageInput: "disabled" as const } : {}),
+  };
+}
+
 export async function handleComboRoutes(ctx: ManagementContext): Promise<Response | null> {
   const { req, url, config, deps, convergeCodexCatalog, syncClaudeAgentDefsBestEffort } = ctx;
 
@@ -75,7 +85,7 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
       return {
         id,
         model: comboPublicModelId(id, combo),
-        ...combo,
+        ...sparseComboConfig(combo),
       };
     }) });
   }
@@ -124,10 +134,12 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
     });
     if (error) return jsonResponse({ error }, 400);
     const normalized = normalizeComboConfig(body.combo as import("../../types").OcxComboConfig);
+    // Persist only non-default identity/capability fields so config stays sparse.
     const {
       alias: normalizedAlias,
       nativeAlias: normalizedNativeAlias,
       displayName: normalizedDisplayName,
+      imageInput: normalizedImageInput,
       ...normalizedBase
     } = normalized;
     const stored: import("../../types").OcxComboConfig = {
@@ -135,6 +147,7 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
       ...(normalizedAlias ? { alias: normalizedAlias } : {}),
       ...(normalizedNativeAlias ? { nativeAlias: true } : {}),
       ...(normalizedDisplayName ? { displayName: normalizedDisplayName } : {}),
+      ...(normalizedImageInput === "disabled" ? { imageInput: "disabled" as const } : {}),
     };
     const sourceId = renameFrom ?? id;
     const previous = config.combos?.[sourceId];
@@ -221,7 +234,8 @@ export async function handleComboRoutes(ctx: ManagementContext): Promise<Respons
     }
     const catalogRefresh = await convergeCodexCatalog();
     if (shouldSyncClaudeAgentDefs) await syncClaudeAgentDefsBestEffort();
-    return jsonResponse({ success: true, id, model: newPublicModel, combo: stored, catalogRefresh });
+    // Wire shape matches persistence: omit default imageInput "auto".
+    return jsonResponse({ success: true, id, model: newPublicModel, combo: sparseComboConfig(stored), catalogRefresh });
   }
 
   if (url.pathname === "/api/combos" && req.method === "DELETE") {

package/src/server/management/config-routes.ts

@@ -85,6 +85,7 @@ import { filterRequestLogs, getRequestLogEntries, type RequestLogEntry } from ".
 import { estimateComboCost, estimateRequestCost, normalizeCostTokens, tokensPerSecond } from "../../usage/cost";
 import type { PersistedUsageAttempt } from "../../usage/log";
 import { isAllowedRequestOrigin, jsonResponse, providerManagementConfigError, publicProviderBaseUrl, safeConfigDTO } from "../auth-cors";
+import { withProviderServiceTierDTO } from "./provider-capability-config";
 import { applySystemEnvToggle } from "../system-env";
 import { getCachedStartupHealth, invalidateStartupHealthCache } from "../startup-health-cache";
 import { runWindowsTrayAction } from "../windows-tray-control";
@@ -134,8 +135,9 @@ function publicVisionSidecarSettings(
 
 export async function handleConfigRoutes(ctx: ManagementContext): Promise<Response | null> {
   const { req, url, config, deps, convergeCodexCatalog, syncClaudeAgentDefsBestEffort } = ctx;
+  const readStartupHealth = deps.getCachedStartupHealth ?? getCachedStartupHealth;
   if (url.pathname === "/api/config" && req.method === "GET") {
-    return jsonResponse(safeConfigDTO(config));
+    return jsonResponse(withProviderServiceTierDTO(safeConfigDTO(config), config));
   }
 
   if (url.pathname === "/api/config" && req.method === "PUT") {
@@ -189,7 +191,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       streamMode: config.streamMode ?? "auto",
       appOwnedMemoryBudgetMb: config.appOwnedMemoryBudgetMb ?? 256,
       codexAccountPickerEnabled: codexAccountPickerEnabled(config),
-      startupHealth: await getCachedStartupHealth(config),
+      startupHealth: await readStartupHealth(config),
       codexRuntime: {
         path: displayCodexRuntimePath(resolved.runtime.command),
         version: resolved.runtime.version,
@@ -211,7 +213,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
   }
 
   if (url.pathname === "/api/startup-health" && req.method === "GET") {
-    return jsonResponse(await getCachedStartupHealth(config));
+    return jsonResponse(await readStartupHealth(config));
   }
 
   if (url.pathname === "/api/startup-action" && req.method === "POST") {
@@ -368,7 +370,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       appOwnedMemoryBudgetMb: config.appOwnedMemoryBudgetMb ?? 256,
       codexAccountPickerEnabled: pickerIsEnabled,
       catalogRefreshPending,
-      startupHealth: await getCachedStartupHealth(config),
+      startupHealth: await readStartupHealth(config),
     });
   }
 

package/src/server/management/context.ts

@@ -1,5 +1,6 @@
 import type { OcxConfig } from "../../types";
 import type { NativeProfileApiDeps } from "../../codex/native-profile-api";
+import type { StartupHealth } from "../../codex/autostart-health";
 import type { StartupInstallAction } from "../startup-action-control";
 import type { ManagementPrincipal } from "../management-auth";
 import type { CatalogModel } from "../../codex/catalog";
@@ -7,11 +8,17 @@ import type { injectGrokConfig } from "../../grok/inject";
 import type { removeDesktop3pStandardPivot, writeDesktop3pConfig } from "../../claude/desktop-3p";
 import type { RuntimePortState } from "../../config";
 import type { CatalogDisposition, ConvergeCodex } from "../../codex/convergence-types";
+import type {
+  performCodexRestart,
+  readCodexAppServerState,
+} from "../../codex/app-server-restart-service";
 
 export interface ManagementApiDeps {
   toggleCodexMultiAgentV2?: (enabled: boolean) => void;
   toggleDefaultModeRequestUserInput?: (enabled: boolean) => void;
   createManagementConvergeCodex?: (config: Readonly<OcxConfig>) => ConvergeCodex;
+  /** Startup-health seam keeps route tests from launching platform probes. */
+  getCachedStartupHealth?: (config: Pick<OcxConfig, "codexAutoStart">) => Promise<StartupHealth>;
   /**
    * Persistence seam for route-level tests. Production leaves this unset and uses
    * `saveConfigPreservingClaudeCode`; tests that pass an in-memory fixture config
@@ -52,6 +59,16 @@ export interface ManagementApiDeps {
    * Native-main profile persistence seam for server-boundary tests. Production
    * leaves this unset, so the route creates its normal NativeProfileManager.
    */
+  /**
+   * Codex app-server restart seam (devlog/_plan/260815_gui_codex_restart).
+   * Grouped rather than three separate fields: the route is an adapter over one
+   * service, and a route test that could not stub it would really terminate the
+   * developer's own Codex app-servers.
+   */
+  codexRestartService?: {
+    readState: typeof readCodexAppServerState;
+    performRestart: typeof performCodexRestart;
+  };
   nativeProfileApi?: NativeProfileApiDeps;
 }