@bitkyc08/opencodex 2.25.0 → 2.26.0

package/src/usage/log.ts

@@ -4,8 +4,9 @@ import { join } from "node:path";
 import { getConfigDir } from "../config";
 import { enforceAppOwnedMemoryBudget } from "../lib/app-owned-memory";
 import { recordOwnedConfigPath } from "../lib/config-ownership";
+import { sanitizeLogMetadataString } from "../lib/redact";
 import { usageDisplayTotalTokens } from "./totals";
-import type { OcxUsage } from "../types";
+import type { AttemptTierOutcome, OcxUsage } from "../types";
 import { normalizeRouteDecisionTrace, type RouteDecisionTraceV1 } from "../routing/trace";
 import { CODEX_ACCOUNT_LOG_LABEL_RE } from "../codex/account-label";
 
@@ -61,6 +62,8 @@ export interface PersistedUsageAttempt {
   effectiveEffort?: string;
   reasoningWireField?: string;
   reasoningWireValue?: string | number | boolean;
+  /** Adapter-produced tier fact for this physical attempt; absent on pre-B0 rows. */
+  tierOutcome?: AttemptTierOutcome;
 }
 
 export interface PersistedUsageEntry {
@@ -87,12 +90,16 @@ export interface PersistedUsageEntry {
   effectiveEffort?: string;
   reasoningWireField?: string;
   reasoningWireValue?: string | number | boolean;
+  /** Raw caller tier captured before routing, sanitized and bounded for durable logs. */
+  callerServiceTier?: string;
   requestedServiceTier?: string;
   requestedSpeedLabel?: string;
   configuredServiceTier?: string;
   configuredSpeedLabel?: string;
   modelSupportsServiceTier?: boolean;
   responseServiceTier?: string;
+  /** Summary of the final physical attempt for dashboard consumers. */
+  tierOutcome?: AttemptTierOutcome;
   status: number;
   durationMs: number;
   /** TTFT relative to the request start (WP4); unset for non-streaming/tool-only. */
@@ -218,6 +225,15 @@ const USAGE_STATUSES = new Set<UsageStatus>([
   "estimated",
 ]);
 const LAB_ROUTE_SUBJECT_ID_RE = /^[0-9a-f]{64}$/;
+const FAST_OUTCOMES = new Set<AttemptTierOutcome["fastOutcome"]>([
+  "not-requested", "applied", "downgraded", "unknown",
+]);
+const TIER_CONFIRMATIONS = new Set<AttemptTierOutcome["confirmation"]>([
+  "confirmed", "assumed", "downgraded", "unknown",
+]);
+const FAST_DOWNGRADE_REASONS = new Set<NonNullable<AttemptTierOutcome["fastDowngradeReason"]>>([
+  "route-unsupported", "wire-unavailable", "response-declined",
+]);
 
 export function isLabRouteSubjectId(value: unknown): value is string {
   return typeof value === "string" && LAB_ROUTE_SUBJECT_ID_RE.test(value);
@@ -246,6 +262,53 @@ function normalizeAttemptUsage(raw: unknown): OcxUsage | null {
   return normalizeUsageValue(usage as unknown as OcxUsage) ?? null;
 }
 
+function normalizeAttemptTierOutcome(raw: unknown): AttemptTierOutcome | null {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+  const outcome = raw as Record<string, unknown>;
+  if (typeof outcome.fastOutcome !== "string"
+    || !FAST_OUTCOMES.has(outcome.fastOutcome as AttemptTierOutcome["fastOutcome"])
+    || typeof outcome.confirmation !== "string"
+    || !TIER_CONFIRMATIONS.has(outcome.confirmation as AttemptTierOutcome["confirmation"])) {
+    return null;
+  }
+  if ("canonical" in outcome && outcome.canonical !== "priority") return null;
+  if ("wireKind" in outcome
+    && outcome.wireKind !== null
+    && outcome.wireKind !== "service-tier"
+    && outcome.wireKind !== "anthropic-speed") return null;
+  if ("wireValue" in outcome && outcome.wireValue !== null && typeof outcome.wireValue !== "string") return null;
+  if ("fastDowngradeReason" in outcome
+    && (typeof outcome.fastDowngradeReason !== "string"
+      || !FAST_DOWNGRADE_REASONS.has(outcome.fastDowngradeReason as NonNullable<AttemptTierOutcome["fastDowngradeReason"]>))) {
+    return null;
+  }
+  if ("callerTierDropped" in outcome && typeof outcome.callerTierDropped !== "boolean") return null;
+  if ("callerFastSuppressedByConfig" in outcome
+    && typeof outcome.callerFastSuppressedByConfig !== "boolean") return null;
+  if ("responseServiceTier" in outcome && typeof outcome.responseServiceTier !== "string") return null;
+  const wireValue = sanitizeLogMetadataString(outcome.wireValue);
+  const responseServiceTier = sanitizeLogMetadataString(outcome.responseServiceTier);
+  return {
+    ...(outcome.canonical === "priority" ? { canonical: "priority" as const } : {}),
+    ...(outcome.wireKind === null || outcome.wireKind === "service-tier" || outcome.wireKind === "anthropic-speed"
+      ? { wireKind: outcome.wireKind }
+      : {}),
+    ...(outcome.wireValue === null
+      ? { wireValue: null }
+      : wireValue ? { wireValue } : {}),
+    fastOutcome: outcome.fastOutcome as AttemptTierOutcome["fastOutcome"],
+    ...(typeof outcome.fastDowngradeReason === "string"
+      ? { fastDowngradeReason: outcome.fastDowngradeReason as NonNullable<AttemptTierOutcome["fastDowngradeReason"]> }
+      : {}),
+    ...(typeof outcome.callerTierDropped === "boolean" ? { callerTierDropped: outcome.callerTierDropped } : {}),
+    ...(typeof outcome.callerFastSuppressedByConfig === "boolean"
+      ? { callerFastSuppressedByConfig: outcome.callerFastSuppressedByConfig }
+      : {}),
+    confirmation: outcome.confirmation as AttemptTierOutcome["confirmation"],
+    ...(responseServiceTier ? { responseServiceTier } : {}),
+  };
+}
+
 function normalizeUsageAttempt(raw: unknown): PersistedUsageAttempt | null {
   if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
   const attempt = raw as Record<string, unknown>;
@@ -272,6 +335,9 @@ function normalizeUsageAttempt(raw: unknown): PersistedUsageAttempt | null {
     && !isNonNegativeFiniteNumber(attempt.totalTokens)) return null;
   const usage = "usage" in attempt ? normalizeAttemptUsage(attempt.usage) : undefined;
   if ("usage" in attempt && usage === null) return null;
+  const tierOutcome = "tierOutcome" in attempt
+    ? normalizeAttemptTierOutcome(attempt.tierOutcome)
+    : undefined;
   const recoveryKinds = Array.isArray(attempt.recoveryKinds)
     ? [...new Set(attempt.recoveryKinds.filter(
       (value): value is AttemptRecoveryKind => typeof value === "string"
@@ -321,6 +387,7 @@ function normalizeUsageAttempt(raw: unknown): PersistedUsageAttempt | null {
         ? { reasoningWireValue: capMetadataString(attempt.reasoningWireValue) }
         : { reasoningWireValue: attempt.reasoningWireValue }
       : {}),
+    ...(tierOutcome ? { tierOutcome } : {}),
   };
 }
 
@@ -357,6 +424,9 @@ export function normalizeUsageEntryForTest(entry: PersistedUsageEntry): Persiste
 
 function normalizeUsageEntry(entry: PersistedUsageEntry): PersistedUsageEntry {
   const attempts = normalizedAttempts(entry.attempts);
+  const tierOutcome = entry.tierOutcome ? normalizeAttemptTierOutcome(entry.tierOutcome) : undefined;
+  const callerServiceTier = sanitizeLogMetadataString(entry.callerServiceTier);
+  const responseServiceTier = sanitizeLogMetadataString(entry.responseServiceTier);
   const routeDecision = entry.routeDecision
     ? normalizeRouteDecisionTrace(entry.routeDecision)
     : undefined;
@@ -397,6 +467,7 @@ function normalizeUsageEntry(entry: PersistedUsageEntry): PersistedUsageEntry {
         ? { reasoningWireValue: capMetadataString(entry.reasoningWireValue) }
         : { reasoningWireValue: entry.reasoningWireValue }
       : {}),
+    ...(callerServiceTier ? { callerServiceTier } : {}),
     ...(typeof entry.requestedServiceTier === "string" && entry.requestedServiceTier
       ? { requestedServiceTier: capMetadataString(entry.requestedServiceTier) }
       : {}),
@@ -412,9 +483,8 @@ function normalizeUsageEntry(entry: PersistedUsageEntry): PersistedUsageEntry {
     ...(typeof entry.modelSupportsServiceTier === "boolean"
       ? { modelSupportsServiceTier: entry.modelSupportsServiceTier }
       : {}),
-    ...(typeof entry.responseServiceTier === "string" && entry.responseServiceTier
-      ? { responseServiceTier: capMetadataString(entry.responseServiceTier) }
-      : {}),
+    ...(responseServiceTier ? { responseServiceTier } : {}),
+    ...(tierOutcome ? { tierOutcome } : {}),
     status: entry.status,
     durationMs: entry.durationMs,
     ...(isNonNegativeFiniteNumber(entry.firstOutputMs)

package/src/vision/anthropic-describe.ts

@@ -3,7 +3,7 @@ import { CLAUDE_CODE_HEADERS, claudeCodeSessionId } from "../adapters/client-fin
 import { signalWithTimeout, cancelBodyOnAbort } from "../lib/abort";
 import { sidecarEnter } from "../lib/sidecar-tracker";
 import { fetchWithResetRetry } from "../lib/upstream-retry";
-import { getValidAccessToken } from "../oauth";
+import { getValidAccessToken, publicOAuthAuthenticationErrorMessage } from "../oauth";
 import { ANTHROPIC_OAUTH_BETA, CLAUDE_CODE_SYSTEM_INSTRUCTION } from "../oauth/anthropic";
 import type { DescribeOutcome, VisionSettings } from "./describe";
 
@@ -67,8 +67,8 @@ export async function parseAnthropicVisionSSE(res: Response): Promise<DescribeOu
       const delta = isRecord(data.delta) ? data.delta : {};
       if (delta.type === "text_delta" && typeof delta.text === "string") text += delta.text;
     } else if (data.type === "error") {
-      const error = isRecord(data.error) ? data.error : {};
-      terminalError = typeof error.message === "string" ? error.message : "anthropic vision sidecar stream error";
+      // Provider-authored stream errors can contain credentials, paths, or response bodies.
+      terminalError = "anthropic vision sidecar stream error";
     }
   };
 
@@ -116,7 +116,7 @@ export async function describeImageAnthropic(
   try {
     token = await getValidAccessToken(providerName);
   } catch (error) {
-    return { text: "", error: `anthropic vision sidecar auth failed: ${error instanceof Error ? error.message : String(error)}` };
+    return { text: "", error: `anthropic vision sidecar auth failed: ${publicOAuthAuthenticationErrorMessage(error)}` };
   }
 
   const headers: Record<string, string> = {
@@ -166,7 +166,11 @@ export async function describeImageAnthropic(
     if (!res.ok) {
       const responseText = await res.text().catch(() => "");
       console.warn(`[vision] anthropic sidecar HTTP ${res.status} (${Date.now() - startedAt}ms)`);
-      return { text: "", error: `anthropic vision sidecar HTTP ${res.status}: ${responseText.slice(0, 200)}` };
+      if (res.status === 401) {
+        return { text: "", error: `anthropic vision sidecar auth failed: ${publicOAuthAuthenticationErrorMessage(new Error(responseText))}` };
+      }
+      // Upstream bodies are untrusted and may contain credentials, paths, or provider diagnostics.
+      return { text: "", error: `anthropic vision sidecar HTTP ${res.status}` };
     }
     const detachBodyGuard = cancelBodyOnAbort(res.body, linkedSignal.signal);
     try {
@@ -177,7 +181,7 @@ export async function describeImageAnthropic(
   } catch (error) {
     const kind = error instanceof Error && error.name === "TimeoutError" ? "timeout" : "connect_error";
     console.warn(`[vision] anthropic sidecar ${kind} (${Date.now() - startedAt}ms)`);
-    return { text: "", error: error instanceof Error ? error.message : String(error) };
+    return { text: "", error: `anthropic vision sidecar ${kind}` };
   } finally {
     sidecarExit();
     linkedSignal.cleanup();

package/src/web-search/anthropic-executor.ts

@@ -1,9 +1,8 @@
 import type { OcxProviderConfig } from "../types";
-import { getValidAccessToken } from "../oauth";
+import { getValidAccessToken, publicOAuthAuthenticationErrorMessage } from "../oauth";
 import { ANTHROPIC_OAUTH_BETA, CLAUDE_CODE_SYSTEM_INSTRUCTION } from "../oauth/anthropic";
 import { CLAUDE_CODE_HEADERS, claudeCodeSessionId } from "../adapters/client-fingerprint";
 import { signalWithTimeout, cancelBodyOnAbort } from "../lib/abort";
-import { redactSecretString } from "../lib/redact";
 import { sidecarEnter } from "../lib/sidecar-tracker";
 import { fetchWithResetRetry } from "../lib/upstream-retry";
 import type { WebSearchSource } from "./parse";
@@ -127,7 +126,7 @@ export async function runAnthropicWebSearch(
   try {
     token = await getValidAccessToken(providerName);
   } catch (e) {
-    return { text: "", sources: [], error: `anthropic sidecar auth failed: ${e instanceof Error ? e.message : String(e)}` };
+    return { text: "", sources: [], error: `anthropic sidecar auth failed: ${publicOAuthAuthenticationErrorMessage(e)}` };
   }
   const headers: Record<string, string> = {
     "Content-Type": "application/json",
@@ -174,8 +173,11 @@ export async function runAnthropicWebSearch(
       const t = await res.text().catch(() => "");
       detachBodyGuard();
       console.warn(`[web-search] anthropic sidecar HTTP ${res.status} for query "${query.slice(0, 80)}" (${Date.now() - t0}ms)`);
-      // Redact before surfacing: the body can echo auth headers/tokens (#398 review).
-      return { text: "", sources: [], error: `sidecar HTTP ${res.status}: ${redactSecretString(t.slice(0, 200))}` };
+      if (res.status === 401) {
+        return { text: "", sources: [], error: `anthropic sidecar auth failed: ${publicOAuthAuthenticationErrorMessage(new Error(t))}` };
+      }
+      // Upstream bodies are untrusted and may contain credentials, paths, or provider diagnostics.
+      return { text: "", sources: [], error: `sidecar HTTP ${res.status}` };
     }
     try {
       return await parseAnthropicSidecarSSE(res);
@@ -185,7 +187,7 @@ export async function runAnthropicWebSearch(
   } catch (e) {
     const kind = e instanceof Error && e.name === "TimeoutError" ? "timeout" : "connect_error";
     console.warn(`[web-search] anthropic sidecar ${kind} for query "${query.slice(0, 80)}" (${Date.now() - t0}ms)`);
-    return { text: "", sources: [], error: e instanceof Error ? e.message : String(e) };
+    return { text: "", sources: [], error: `anthropic sidecar ${kind}` };
   } finally {
     sidecarExit();
     linkedSignal.cleanup();