@bitkyc08/opencodex 2.42.0 → 2.43.0

package/src/server/relay-eager.ts

@@ -71,6 +71,8 @@ export type EagerRelayHooks = {
 };
 
 export type EagerRelayOptions = {
+  /** Caller cancellation, independent of the turn/shutdown controller. */
+  clientGoneSignal?: AbortSignal;
   /** Bounded client queue in bytes; producer pauses above it. Default 8 MiB. */
   maxQueueBytes?: number;
   /** Transient-budget owner for the inline-rewrite frame buffer. */
@@ -103,6 +105,7 @@ export function relaySseEagerBounded(
   const drainMs = opts?.postCancelDrainMs ?? DEFAULT_DRAIN_MS;
   const drainBytes = opts?.postCancelDrainBytes ?? DEFAULT_DRAIN_BYTES;
   const now = opts?.now ?? Date.now;
+  const clientGoneSignal = opts?.clientGoneSignal;
 
   const reader = body.getReader();
   const terminalEncoder = new TextEncoder();
@@ -179,6 +182,8 @@ export function relaySseEagerBounded(
   let queuedBytes = 0;
   let cancelled = false;
   let done = false;
+  let drainedBytes = 0;
+  let drainDeadline = Number.POSITIVE_INFINITY;
   // Pause gate: resolved by client pull, client cancel, or upstream abort so a
   // paused producer ALWAYS resumes (audit blocker 2 — no deadlock; onDone and
   // turn unregistration stay reachable, drainAndShutdown never hangs).
@@ -202,6 +207,7 @@ export function relaySseEagerBounded(
   const fireDone = () => {
     if (doneFired) return;
     doneFired = true;
+    clientGoneSignal?.removeEventListener("abort", markClientGone);
     if (drainTimer) { clearTimeout(drainTimer); drainTimer = null; }
     try { hooks.onDone(); } catch { /* lifecycle callbacks must not break teardown */ }
   };
@@ -217,6 +223,20 @@ export function relaySseEagerBounded(
     (drainTimer as { unref?: () => void }).unref?.();
   };
 
+  const markClientGone = () => {
+    if (cancelled || doneFired) return;
+    cancelled = true;
+    drainDeadline = now() + drainMs;
+    armDrainTimer();
+    wakeUp();
+  };
+  const canDeliver = () => {
+    // A rejected fetch read can settle before every abort listener is dispatched.
+    // Also re-check after error serialization, which can re-enter caller abort.
+    if (clientGoneSignal?.aborted) markClientGone();
+    return !cancelled && !upstream.signal.aborted;
+  };
+
   const producer = async () => {
     let syntheticKind: "incomplete" | "failed" | null = null;
     let deliveryFallbackSent = false;
@@ -237,6 +257,7 @@ export function relaySseEagerBounded(
       for (;;) {
         const result = await reader.read();
         const { done: upstreamDone, value } = result;
+        if (clientGoneSignal?.aborted) markClientGone();
         // A chunk that already settled is INSPECTED before abort is honored. A read
         // can settle with a real chunk in the same tick the signal fires (post-cancel
         // drain: the terminal frame arrives, then the drain timer aborts upstream).
@@ -262,7 +283,7 @@ export function relaySseEagerBounded(
           }
           if (rewriteFailed) {
             const safeTail = encodeFailedTail(rewriteError);
-            if (safeTail && !cancelled && !upstream.signal.aborted) {
+            if (safeTail && canDeliver()) {
               if (!hooks.sawTerminal()) syntheticKind = "failed";
               queuedBytes += safeTail.byteLength;
               try { controllerRef?.enqueue(safeTail); } catch { /* client already torn down */ }
@@ -279,7 +300,7 @@ export function relaySseEagerBounded(
               queuedBytes += terminalSentinel.byteLength;
               try { controllerRef?.enqueue(terminalSentinel); } catch { /* client already gone */ }
             }
-          } else if (!hooks.sawTerminal() && !cancelled && !upstream.signal.aborted) {
+          } else if (!hooks.sawTerminal() && canDeliver()) {
             // A clean 200 EOF without a Responses terminal must be visible to
             // Codex as one incomplete turn, followed by the normal sentinel.
             queuedBytes += adapterEofFrame.byteLength + terminalSentinel.byteLength;
@@ -322,9 +343,7 @@ export function relaySseEagerBounded(
             controllerRef?.enqueue(outbound);
           } catch {
             // Controller already torn down (client went away without cancel()).
-            cancelled = true;
-            drainDeadline = now() + drainMs;
-            armDrainTimer();
+            markClientGone();
             continue;
           }
         }
@@ -339,11 +358,12 @@ export function relaySseEagerBounded(
           reader.cancel("Responses terminal event received").catch(() => {});
           break;
         }
-        while (queuedBytes > maxQueueBytes && !cancelled && !upstream.signal.aborted) {
+        while (queuedBytes > maxQueueBytes && canDeliver()) {
           await paused();
         }
       }
     } catch (err) {
+      if (clientGoneSignal?.aborted) markClientGone();
       // Upstream read failure. Distinguish genuine mid-stream reset from
       // abort-driven teardown (shutdown/cancel-expiry) — audit M3.
       // A read can fail after delivering an unterminated terminal block. Flush
@@ -379,36 +399,36 @@ export function relaySseEagerBounded(
           clientTail = new Uint8Array(0);
         }
       }
-      if (clientTail.byteLength > 0 && !cancelled && !upstream.signal.aborted) {
+      if (clientTail.byteLength > 0 && canDeliver()) {
         queuedBytes += clientTail.byteLength;
         try { controllerRef?.enqueue(clientTail); } catch { /* client already torn down */ }
       }
-      if (rewriteFailed && !cancelled && !upstream.signal.aborted) {
+      if (rewriteFailed && canDeliver()) {
         // Never bypass a client rewrite after it fails: boundedTail can contain
         // provider metadata or content that the active rewrite was required to
         // remove. Emit one safe failed envelope instead. When inspection has
         // already reported the real upstream terminal, this is a delivery
         // fallback only and must not create a second accounting outcome.
         const safeTail = encodeFailedTail(rewriteError ?? err);
-        if (safeTail && !cancelled && !upstream.signal.aborted) {
+        if (safeTail && canDeliver()) {
           if (!hooks.sawTerminal()) syntheticKind = "failed";
           deliveryFallbackSent = true;
           queuedBytes += safeTail.byteLength;
           try { controllerRef?.enqueue(safeTail); } catch { /* client already torn down */ }
           try { controllerRef?.close(); } catch { /* client already gone */ }
         }
-      } else if (tailTerminal && !cancelled && !upstream.signal.aborted) {
+      } else if (tailTerminal && canDeliver()) {
         if (!tailDone) {
           queuedBytes += terminalSentinel.byteLength;
           try { controllerRef?.enqueue(terminalSentinel); } catch { /* client already gone */ }
         }
-      } else if (!tailTerminal && !cancelled && !upstream.signal.aborted) {
+      } else if (!tailTerminal && canDeliver()) {
         // Serializing `err` can run user-defined accessors (Error.message
         // getters, toString) that re-entrantly cancel the client or abort the
         // upstream. Build the tail FIRST, then re-check eligibility before
         // committing to the synthetic terminal (adversarial review blocker).
         const tail = encodeFailedTail(err);
-        if (tail && !cancelled && !upstream.signal.aborted) {
+        if (tail && canDeliver()) {
           // Inspection and client framing have separate bounded parsers. If
           // inspection resynchronized after an oversized frame and observed a
           // later real terminal, it still must not suppress a terminal delivery
@@ -429,7 +449,7 @@ export function relaySseEagerBounded(
         frameBufferBytes = 0;
       }
       terminalBoundary.dispose();
-      if (syntheticKind) hooks.onSynthetic(syntheticKind);
+      if (syntheticKind && canDeliver()) hooks.onSynthetic(syntheticKind);
       if (cancelled && !hooks.sawTerminal()) {
         hooks.onClientCancel();
       }
@@ -437,21 +457,19 @@ export function relaySseEagerBounded(
         upstream.abort();
         reader.cancel().catch(() => {});
       }
-      if (!cancelled) {
-        try { controllerRef?.close(); } catch { /* already closed/errored */ }
-      }
+      // Signal-driven cancellation need not have invoked the body's cancel hook.
+      try { controllerRef?.close(); } catch { /* already closed/errored */ }
       try { hooks.disposeInspection?.(); } catch { /* inspection teardown must not block lifecycle cleanup */ }
       try { activeRewrite?.dispose?.(); } catch { /* rewrite teardown must not block lifecycle cleanup */ }
       fireDone();
     }
   };
 
-  let drainedBytes = 0;
-  let drainDeadline = Number.POSITIVE_INFINITY;
-
   return new ReadableStream<Uint8Array>({
     start(controller) {
       controllerRef = controller;
+      clientGoneSignal?.addEventListener("abort", markClientGone, { once: true });
+      if (clientGoneSignal?.aborted) markClientGone();
       void producer();
     },
     pull() {
@@ -462,10 +480,7 @@ export function relaySseEagerBounded(
       wakeUp();
     },
     cancel() {
-      cancelled = true;
-      drainDeadline = now() + drainMs;
-      armDrainTimer();
-      wakeUp();
+      markClientGone();
     },
   });
 }

package/src/server/relay.ts

@@ -1275,6 +1275,7 @@ function startBoundedInspectionPump(options: InspectionPumpOptions): void {
     try {
       for (;;) {
         const { done, value } = await reader.read();
+        if (clientGoneSignal?.aborted) markClientGone();
         if (drainStopped) {
           // stopDrain() cancelled the reader; the settled read is the wake-up.
           clientGoneWithoutTerminal = !inspector.terminalSeen();
@@ -1312,6 +1313,9 @@ function startBoundedInspectionPump(options: InspectionPumpOptions): void {
         }
       }
     } catch {
+      // Bun can settle a fetch body read before dispatching all abort listeners.
+      // Observe the signal itself before classifying that rejection as upstream.
+      if (clientGoneSignal?.aborted) markClientGone();
       // A read error can follow a final SSE block without its blank-line
       // delimiter. Flush that candidate before classifying the transport as a
       // synthetic reset; otherwise a real completed/failed/policy terminal is

package/src/server/request-log.ts

@@ -594,6 +594,12 @@ export function requestLogErrorCode(
 export function requestLogSpeedLabel(serviceTier: string | undefined): string | undefined {
   const normalized = serviceTier?.trim().toLowerCase();
   if (normalized === "priority" || normalized === "fast") return "fast";
+  // Ultra Fast is labelled even though nothing in the shipped catalog advertises it: the
+  // reporter on #3429 reached it by hand-editing their own catalog, the request completed,
+  // and the Logs column stayed empty because this returned undefined. A tier the proxy
+  // forwarded but refuses to name is an observability hole, not a feature gate — the flag
+  // decides whether the tier survives, not whether we admit to carrying it.
+  if (normalized === "ultrafast") return "ultrafast";
   return undefined;
 }
 

package/src/server/responses/codex-ws-correlation.ts

@@ -0,0 +1,65 @@
+export const CODEX_WS_ID_MAX_BYTES = 4096;
+export const CODEX_WS_MAX_TRACKED_ITEMS = 10_000;
+const MAX_TRACKED_ID_BYTES = 1024 * 1024;
+
+function record(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function id(value: unknown): value is string {
+  return typeof value === "string" && value.length > 0 && !/[\u0000-\u001f\u007f]/.test(value)
+    && Buffer.byteLength(value) <= CODEX_WS_ID_MAX_BYTES;
+}
+
+/** A cold incompatible response may finish one-shot; a reused socket cannot mix owners. */
+export class CodexWsCorrelation {
+  private responseId: string | null = null;
+  private reusable = true;
+  private readonly items = new Set<string>();
+  private itemBytes = 0;
+
+  constructor(private readonly strict: boolean, private readonly previouslyCompleted: (id: string) => boolean) {}
+
+  private mismatch(): void {
+    this.reusable = false;
+    if (this.strict) throw new Error("codex websocket response identity mismatch");
+  }
+
+  accept(event: Record<string, unknown>): void {
+    if (event.stream_id !== undefined) { this.mismatch(); return; }
+    if (event.type === "error") return;
+    const response = record(event.response) ? event.response : undefined;
+    if (event.type === "response.created") {
+      const next = response?.id;
+      if (!id(next) || this.responseId !== null || this.previouslyCompleted(next)) {
+        this.mismatch();
+        return;
+      }
+      this.responseId = next;
+      return;
+    }
+    if (!this.responseId) { this.mismatch(); return; }
+    if ((response && response.id !== this.responseId)
+      || (event.response_id !== undefined && event.response_id !== this.responseId)) this.mismatch();
+    const item = record(event.item) ? event.item : undefined;
+    if (event.type === "response.output_item.added") {
+      if (!id(item?.id) || this.items.has(item.id)) { this.mismatch(); return; }
+      this.itemBytes += Buffer.byteLength(item.id);
+      if (this.items.size >= CODEX_WS_MAX_TRACKED_ITEMS || this.itemBytes > MAX_TRACKED_ID_BYTES) {
+        throw new Error("codex websocket correlation exceeds its bounded item budget");
+      }
+      this.items.add(item.id);
+      return;
+    }
+    const itemId = event.item_id ?? item?.id;
+    if (itemId !== undefined && (!id(itemId) || !this.items.has(itemId))) this.mismatch();
+    if (typeof event.type === "string" && event.type.endsWith(".delta") && itemId === undefined) this.mismatch();
+  }
+
+  completed(event: Record<string, unknown>): string | null {
+    const response = record(event.response) ? event.response : undefined;
+    return this.reusable && event.type === "response.completed" && response?.status === "completed"
+      && response.id === this.responseId ? this.responseId : null;
+  }
+
+  finish(): void { this.items.clear(); this.itemBytes = 0; }
+}

package/src/server/responses/codex-ws-exchange.ts

@@ -0,0 +1,261 @@
+import { MAX_CLIENT_SSE_FRAME_BYTES } from "../sse-frame-buffer";
+import { CodexWsMetadata, type CodexWsQuotaObserver } from "./codex-ws-metadata";
+import { CODEX_RESPONSES_HTTP_URL, type PreparedCodexWsRequest } from "./codex-ws-request";
+import { CodexWsCorrelation } from "./codex-ws-correlation";
+import type { CodexWsSession } from "./codex-ws-session";
+import { UPGRADE_DEADLINE_MS, CODEX_WS_RESPONSE_PRELUDE_TIMEOUT_MS, MAX_CODEX_WS_FRAME_BYTES,
+  MAX_CODEX_WS_QUEUE_BYTES, markCodexWsResponse, normalizeResponsesWsRelayEvent, closedBeforeTerminalMessage } from "./codex-ws-wire";
+
+interface ExchangeOptions {
+  session: CodexWsSession;
+  url: string;
+  init: RequestInit;
+  prepared: PreparedCodexWsRequest;
+  sseFallback: typeof globalThis.fetch;
+  onQuota?: CodexWsQuotaObserver;
+  beforeDispatch?: (headers: Headers) => void;
+}
+
+/** The sole SSE exchange state machine for both one-shot and retained sockets. */
+export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
+  const { session, url, init, prepared, sseFallback, onQuota, beforeDispatch } = options;
+  const { frameText, headers } = prepared;
+  const signal = init.signal ?? undefined;
+  return new Promise<Response>((resolve, reject) => {
+    const ws = session.socket;
+
+    let opened = session.opened;
+    let settledPreOpen = false;
+    let sent = false;
+    let received = false;
+    let responseCommitted = false;
+    let terminal = false;
+    let controller: ReadableStreamDefaultController<Uint8Array> | null = null;
+    const encoder = new TextEncoder();
+    const metadata = url === CODEX_RESPONSES_HTTP_URL ? new CodexWsMetadata(onQuota) : null;
+    const correlation = session.retainable ? new CodexWsCorrelation(session.reused, id => session.hasCompleted(id)) : null;
+    let detachOwner = () => {};
+    let preludeTimer: ReturnType<typeof setTimeout> | undefined;
+    const stream = new ReadableStream<Uint8Array>({
+      start(c) { controller = c; },
+      cancel() {
+        if (terminal) return;
+        terminal = true;
+        cleanup();
+        session.dispose();
+      },
+    }, new ByteLengthQueuingStrategy({ highWaterMark: MAX_CODEX_WS_QUEUE_BYTES }));
+
+    const cleanup = () => {
+      clearTimeout(upgradeTimer);
+      clearTimeout(preludeTimer);
+      signal?.removeEventListener("abort", onAbort);
+      metadata?.finish();
+      correlation?.finish();
+      detachOwner();
+      ws.removeEventListener("open", onOpen);
+      ws.removeEventListener("message", onMessage);
+      ws.removeEventListener("close", onClose);
+      ws.removeEventListener("error", onError);
+    };
+
+    const commitResponse = () => {
+      if (responseCommitted) return;
+      responseCommitted = true;
+      clearTimeout(preludeTimer);
+      const responseHeaders = metadata?.snapshot() ?? new Headers();
+      responseHeaders.set("content-type", "text/event-stream; charset=utf-8");
+      const response = new Response(stream, { status: 200, headers: responseHeaders });
+      metadata?.commit();
+      markCodexWsResponse(response, Boolean(metadata && onQuota));
+      resolve(response);
+    };
+
+    const failStream = (error: unknown) => {
+      if (terminal) return;
+      terminal = true;
+      // A frame may already be executing upstream. Settle as a body failure,
+      // never a fetch rejection/5xx that the pre-stream wrapper could resend.
+      if (sent) commitResponse();
+      cleanup();
+      try { controller?.error(typeof error === "string" ? new Error(error) : error); } catch { /* stream already done */ }
+      session.dispose();
+    };
+
+    const upgradeTimer = setTimeout(() => {
+      if (opened || settledPreOpen) return;
+      settledPreOpen = true;
+      cleanup();
+      session.dispose();
+      resolve(sseFallback(url, init));
+    }, UPGRADE_DEADLINE_MS);
+
+    const cancelExchange = (reason: unknown) => {
+      if (terminal || settledPreOpen) return;
+      if (!sent) {
+        settledPreOpen = true;
+        terminal = true;
+        cleanup();
+        session.dispose();
+        reject(reason);
+        return;
+      }
+      failStream(reason);
+    };
+    const onAbort = () => cancelExchange(signal?.reason ?? new DOMException("The operation was aborted.", "AbortError"));
+    signal?.addEventListener("abort", onAbort, { once: true });
+
+    const onOpen = () => {
+      if (settledPreOpen) return;
+      clearTimeout(upgradeTimer);
+      opened = true;
+      try {
+        beforeDispatch?.(new Headers(headers));
+      } catch (error) {
+        // Settle and detach before close: a synchronous close event must not resend over SSE.
+        settledPreOpen = true;
+        terminal = true;
+        cleanup();
+        ws.removeEventListener("open", onOpen);
+        ws.removeEventListener("message", onMessage);
+        ws.removeEventListener("close", onClose);
+        ws.removeEventListener("error", onError);
+        session.dispose();
+        reject(error);
+        return;
+      }
+      if (terminal || settledPreOpen || signal?.aborted) return;
+      sent = true;
+      try {
+        ws.send(frameText);
+      } catch {
+        if (received || responseCommitted) {
+          if (terminal) session.dispose();
+          failStream("codex websocket send failed after response activity");
+          return;
+        }
+        // send() throwing means the frame never left, so no upstream turn
+        // started and the SSE resend cannot double-generate. Falling back
+        // (instead of erroring a synthetic 200 body) keeps the pre-stream
+        // HTTP error/refresh/failover machinery in charge.
+        settledPreOpen = true;
+        sent = false;
+        cleanup();
+        session.dispose();
+        resolve(sseFallback(url, init));
+        return;
+      }
+      if (!metadata) commitResponse();
+      else if (!responseCommitted && !terminal) {
+        preludeTimer = setTimeout(() => failStream("codex websocket response prelude timed out"), CODEX_WS_RESPONSE_PRELUDE_TIMEOUT_MS);
+      }
+    };
+
+    const onMessage = (event: MessageEvent) => {
+      if (!controller || terminal) return;
+      received = true;
+      const text = typeof event.data === "string" ? event.data : "";
+      if (!text) return;
+      // UTF-8 byte length is always at least the JS string length. Reject this
+      // cheap lower bound before parsing so an obviously oversized frame does
+      // not create another large object graph.
+      if (text.length > MAX_CODEX_WS_FRAME_BYTES) {
+        failStream("codex websocket frame exceeds the response size limit");
+        return;
+      }
+      const rawEncodedText = encoder.encode(text);
+      if (rawEncodedText.byteLength > MAX_CODEX_WS_FRAME_BYTES) {
+        failStream("codex websocket frame exceeds the response size limit");
+        return;
+      }
+      const normalized = normalizeResponsesWsRelayEvent(text);
+      if (!normalized) return;
+      const { type } = normalized;
+      let relayText = normalized.text;
+      let controlFrame = false;
+      if (metadata) {
+        try {
+          const sanitized = metadata.consume(normalized.payload, rawEncodedText.byteLength);
+          if (sanitized !== null) {
+            relayText = sanitized;
+            controlFrame = true;
+          }
+        } catch (error) {
+          failStream(error);
+          return;
+        }
+      }
+      const encodedText = relayText === text ? rawEncodedText : encoder.encode(relayText);
+      if (encodedText.byteLength > MAX_CODEX_WS_FRAME_BYTES) {
+        failStream("codex websocket frame exceeds the response size limit");
+        return;
+      }
+      if (!controlFrame && !type.startsWith("response.") && type !== "error") return;
+      if (!controlFrame) {
+        try { correlation?.accept(normalized.payload); } catch (error) { failStream(error); return; }
+        commitResponse();
+      }
+      const prefix = encoder.encode(`event: ${type}\ndata: `);
+      const suffix = encoder.encode("\n\n");
+      const frameBytes = prefix.byteLength + encodedText.byteLength + suffix.byteLength;
+      if (frameBytes > MAX_CLIENT_SSE_FRAME_BYTES) {
+        failStream("codex websocket frame exceeds the response size limit");
+        return;
+      }
+      const availableBytes = controller.desiredSize ?? 0;
+      if (frameBytes > availableBytes) {
+        failStream("codex websocket response exceeded the buffered queue limit");
+        return;
+      }
+      const sseFrame = new Uint8Array(frameBytes);
+      sseFrame.set(prefix);
+      sseFrame.set(encodedText, prefix.byteLength);
+      sseFrame.set(suffix, prefix.byteLength + encodedText.byteLength);
+      try {
+        controller.enqueue(sseFrame);
+      } catch {
+        failStream("codex websocket response stream closed while enqueueing");
+        return;
+      }
+      if (type === "response.completed" || type === "response.failed" || type === "response.incomplete" || type === "error") {
+        const completedId = correlation?.completed(normalized.payload) ?? null;
+        terminal = true;
+        cleanup();
+        try { controller.close(); } catch { /* already closed */ }
+        session.release(completedId);
+      }
+    };
+
+    const onClose = (event: unknown) => {
+      cleanup();
+      if (!opened) {
+        if (settledPreOpen) return;
+        settledPreOpen = true;
+        // Upgrade rejected (401/403/429/5xx). Retry over plain SSE so the real
+        // HTTP status reaches the existing refresh/rotation handlers. No turn
+        // started upstream, so the resend cannot double-generate.
+        resolve(sseFallback(url, init));
+        return;
+      }
+      if (sent && !terminal) failStream(closedBeforeTerminalMessage(event));
+    };
+
+    const onError = () => {
+      if (terminal || settledPreOpen) return;
+      if (!opened && !sent) {
+        settledPreOpen = true;
+        terminal = true;
+        cleanup();
+        session.dispose();
+        resolve(sseFallback(url, init));
+      } else failStream("codex websocket transport error");
+    };
+    detachOwner = session.bindOwner(reason => cancelExchange(reason));
+    ws.addEventListener("open", onOpen);
+    ws.addEventListener("message", onMessage);
+    ws.addEventListener("close", onClose);
+    ws.addEventListener("error", onError);
+    if (signal?.aborted) onAbort();
+    else if (session.opened) onOpen();
+  });
+}