@bitkyc08/opencodex 2.42.0 → 2.43.0

package/src/server/responses/collaboration.ts

@@ -28,7 +28,7 @@ import {
 } from "../../combos";
 import { isInjectionDebugEnabled } from "../../lib/debug-settings";
 import { injectionDebugLog } from "../../lib/injection-debug-log";
-import { modelInList, namespacedToolName, toolChoiceToolPredicate } from "../../types";
+import { dottedToolName, modelInList, namespacedToolName, toolChoiceToolPredicate } from "../../types";
 import type { AdapterEvent, OcxConfig, OcxParsedRequest, OcxProviderConfig, OcxProviderContinuationState, OcxUsage } from "../../types";
 import {
   forceRefreshOAuthAccessSnapshot,
@@ -122,6 +122,34 @@ export function buildToolBridgeMaps(parsed: OcxParsedRequest, budget?: Translato
   const requestedTools = parsed.context.tools ?? [];
   const toolAllowed = toolChoiceToolPredicate(parsed.options.toolChoice, requestedTools);
   const authorizedTools = requestedTools.filter(toolAllowed);
+  // A dotted alias is only safe while it names ONE tool. Namespaces and names both come from
+  // the caller's tool catalog and may contain dots, so `{ns: "a", name: "b.c"}` and
+  // `{ns: "a.b", name: "c"}` flatten to the same "a.b.c". Registering both would let a dotted
+  // provider echo restore against whichever was inserted last, which is a dispatch decision made
+  // by declaration order. Resolve ownership across the whole catalog FIRST so the outcome does
+  // not depend on that order, then register only the aliases that stayed unambiguous.
+  const dottedAliasOwners = new Map<string, string | null>();
+  for (const t of authorizedTools) {
+    if (!t.namespace) continue;
+    const alias = dottedToolName(t.namespace, t.name);
+    const identity = JSON.stringify([t.namespace, t.name]);
+    const owner = dottedAliasOwners.get(alias);
+    if (owner === undefined) dottedAliasOwners.set(alias, identity);
+    else if (owner !== identity) dottedAliasOwners.set(alias, null);
+  }
+  // A dotted alias that shadows a canonical `ns__name` or a bare declaration is the same
+  // confusion wearing a different spelling, so those lose the alias too.
+  for (const t of authorizedTools) {
+    const canonical = namespacedToolName(t.namespace, t.name);
+    const owner = dottedAliasOwners.get(canonical);
+    if (owner !== undefined && owner !== JSON.stringify([t.namespace, t.name])) {
+      dottedAliasOwners.set(canonical, null);
+    }
+    const bare = dottedAliasOwners.get(t.name);
+    if (bare !== undefined && bare !== JSON.stringify([t.namespace, t.name])) {
+      dottedAliasOwners.set(t.name, null);
+    }
+  }
   for (const t of authorizedTools) {
     // Upstream output is untrusted: only restore calls for tools the caller authorized.
     const wireName = namespacedToolName(t.namespace, t.name);
@@ -133,6 +161,18 @@ export function buildToolBridgeMaps(parsed: OcxParsedRequest, budget?: Translato
     if (t.namespace) {
       budget?.chargeRetained(new TextEncoder().encode(JSON.stringify([wireName, t.namespace, t.name])).byteLength, { kind: "retained_collectors" });
       toolNsMap.set(wireName, { namespace: t.namespace, name: t.name, ...(t.freeform ? { freeform: true } : {}) });
+      // Dotted echo alias (`ns.name`, #3402): same tool identity as the flattened wire name,
+      // so a provider that echoes the dotted spelling still restores against this entry.
+      const dottedName = dottedToolName(t.namespace, t.name);
+      // Ambiguous aliases were resolved to null above; skipping them falls back to the
+      // unambiguous `ns__name` form, which every provider can still echo.
+      if (dottedAliasOwners.get(dottedName) !== null && dottedName !== wireName) {
+        budget?.chargeRetained(new TextEncoder().encode(dottedName).byteLength, { kind: "retained_collectors" });
+        declaredToolNames.add(dottedName);
+        budget?.chargeRetained(new TextEncoder().encode(JSON.stringify([dottedName, t.namespace, t.name])).byteLength, { kind: "retained_collectors" });
+        toolNsMap.set(dottedName, { namespace: t.namespace, name: t.name, ...(t.freeform ? { freeform: true } : {}) });
+        if (t.parameters && typeof t.parameters === "object") toolParameterSchemas.set(dottedName, t.parameters);
+      }
     }
     if (t.freeform) {
       budget?.chargeRetained(new TextEncoder().encode(t.name).byteLength, { kind: "retained_collectors" });

package/src/server/responses/compact.ts

@@ -42,6 +42,8 @@ import { describeImagesInPlace, planVisionSidecar, shouldResolveOpenAiVisionSide
 import { createAdapterEventQueue, preflightAdapterEvents } from "../../adapters/run-turn-queue";
 import {
   applyCodexAuthContextToProvider,
+  createCodexReserveDispatchGuard,
+  unwrapUpstreamRetryEvidenceError,
   CodexMainProfileDrainingError,
   headersForCodexAuthContext,
   materializeCodexUpstreamAuthAsync,
@@ -93,7 +95,12 @@ import {
 import type { DataPlaneAdmission } from "../auth-cors";
 import { listOpenAiForwardSidecarCandidates, resolveFirstUsableOpenAiSidecar, type ResolvedOpenAiForwardSidecar } from "../../providers/openai-sidecar";
 import { CODEX_FORWARD_BASE_URL, isCanonicalOpenAiForwardProvider, supportsNativeResponsesCompactEndpoint } from "../../providers/openai-tiers";
+import { NATIVE_RESERVE_MODEL } from "../../codex/catalog/native-models";
+import { isCodexReserveRequestEligible } from "../../codex/loopback-target";
 import { slugsEquivalent } from "../../providers/slug-codec";
+import { decideTier, tierValueAfterDecision } from "../../providers/fastwire";
+import { fastPolicyForModel } from "../../providers/service-tier";
+import { parseFastOnlyRowId } from "../fast-row";
 import { applyOpenAiVirtualModel, resolveOpenAiCompactModel } from "../../providers/openai-virtual-models";
 import { isUsageDebugEnabled } from "../../usage/debug";
 import { readJsonRequestBody, DecompressedBodyTooLargeError, UnsupportedContentEncodingError } from "../request-decompress";
@@ -219,6 +226,9 @@ export function compactResponseTooLargeError(): Response {
 
 async function refreshNativeMainCompactContext(args: {
   req: Request;
+  config: OcxConfig;
+  modelId?: string;
+  admission?: DataPlaneAdmission;
   authCtx: CodexAuthContext;
   provider: OcxProviderConfig;
   codexAccountMode?: CodexAccountMode;
@@ -228,7 +238,7 @@ async function refreshNativeMainCompactContext(args: {
   | { ok: true; authCtx: CodexAuthContext; provider: OcxProviderConfig; headers: Headers }
   | { ok: false; response: Response }
 > {
-  const { req, authCtx, provider, codexAccountMode, substituteMainCredential, options } = args;
+  const { req, config, authCtx, provider, codexAccountMode, substituteMainCredential, options } = args;
   if (authCtx.kind !== "main-pool") {
     return { ok: false, response: formatErrorResponse(401, "authentication_error", "No native main credential to refresh") };
   }
@@ -252,6 +262,9 @@ async function refreshNativeMainCompactContext(args: {
     );
     const headers = new Headers({ "content-type": "application/json" });
     const selected = await materializeCodexUpstreamAuthAsync(req.headers, refreshedAuthCtx, {
+      admission: args.admission,
+      config,
+      modelId: args.modelId,
       substituteMainCredential,
       signal: req.signal,
       nativeMainRefreshDependencies: options.nativeMainRefreshDependencies,
@@ -270,7 +283,9 @@ async function refreshNativeMainCompactContext(args: {
     if (req.signal.aborted) {
       return { ok: false, response: formatErrorResponse(499, "client_cancelled", "Client cancelled compact request") };
     }
-    return { ok: false, response: nativeMainRefreshFailureResponse(error) };
+    return { ok: false, response: mapCodexAuthContextErrorToResponse(error, {
+      now: Date.now(),
+    }) ?? nativeMainRefreshFailureResponse(error) };
   }
 }
 
@@ -286,6 +301,9 @@ function isTerminalCompactPoolRefreshFailure(error: unknown): boolean {
  */
 async function refreshPoolCompactContext(args: {
   req: Request;
+  config: OcxConfig;
+  modelId?: string;
+  admission?: DataPlaneAdmission;
   authCtx: CodexAuthContext & { kind: "pool" };
   provider: OcxProviderConfig;
   codexAccountMode?: CodexAccountMode;
@@ -295,7 +313,7 @@ async function refreshPoolCompactContext(args: {
   | { ok: true; authCtx: CodexAuthContext; provider: OcxProviderConfig; headers: Headers }
   | { ok: false; response: Response; quarantine: boolean; quarantineGeneration?: number }
 > {
-  const { req, authCtx, provider, codexAccountMode, substituteMainCredential, options } = args;
+  const { req, config, authCtx, provider, codexAccountMode, substituteMainCredential, options } = args;
   const reauthResponse = () => formatErrorResponse(
     401,
     "authentication_error",
@@ -328,6 +346,9 @@ async function refreshPoolCompactContext(args: {
     );
     const headers = new Headers({ "content-type": "application/json" });
     const selected = await materializeCodexUpstreamAuthAsync(req.headers, refreshedAuthCtx, {
+      admission: args.admission,
+      config,
+      modelId: args.modelId,
       substituteMainCredential,
       signal: req.signal,
       nativeMainRefreshDependencies: options.nativeMainRefreshDependencies,
@@ -375,11 +396,13 @@ async function resolveAlternateCompactContext(args: {
   selectedModelId: string | undefined;
   excludeAccountId: string | null;
   turnAdmissionLease?: AdmissionLease;
+  admission?: DataPlaneAdmission;
 }): Promise<{ authCtx: CodexAuthContext; provider: OcxProviderConfig; headers: Headers } | null> {
   const { req, config, route, selectedModelId, excludeAccountId, turnAdmissionLease } = args;
   if (!route.codexAccountMode || !excludeAccountId) return null;
   try {
     const authCtx = await resolveCodexAuthContext(req.headers, config, route.codexAccountMode, {
+      admission: args.admission,
       ...(selectedModelId ? { modelId: selectedModelId } : {}),
       excludeAccountId,
       requestScopedMainCredential: hasForwardableCodexBearer(req.headers, config),
@@ -391,7 +414,7 @@ async function resolveAlternateCompactContext(args: {
     if (authCtx.accountId === excludeAccountId) return null;
     const provider = applyCodexAuthContextToProvider(route.provider, authCtx, route.codexAccountMode);
     const headers = new Headers({ "content-type": "application/json" });
-    const selected = headersForCodexAuthContext(req.headers, authCtx);
+    const selected = headersForCodexAuthContext(req.headers, authCtx, config, selectedModelId, args.admission);
     for (const name of FORWARD_HEADERS) {
       const value = selected.get(name);
       if (value) headers.set(name, value);
@@ -503,6 +526,16 @@ export async function handleResponsesCompact(
   if (typeof raw.model !== "string" || raw.model.length === 0) {
     return formatErrorResponse(400, "invalid_request_error", "compaction request requires a model");
   }
+  // Correct the IDENTITY before routing, or the synthetic id does not route at all. Held in
+  // a local rather than written back to `raw.model`: assigning to the property widens it out
+  // of the `string` narrowing the guard above just established.
+  const compactFastRow = parseFastOnlyRowId(config, () => raw.model as string);
+  const compactModel = compactFastRow ? compactFastRow.baseId : raw.model;
+  if (compactFastRow) (raw as Record<string, unknown>).model = compactModel;
+  // The client's own selector, kept for the request log: `raw.model` is rewritten to the
+  // base id above, and logCtx.requestedModel is assigned from it further down, so without
+  // this the log would lose which id the client actually asked for.
+  const compactRequestedModel = compactFastRow ? compactFastRow.baseId + "--fast" : raw.model;
 
   let route;
   try {
@@ -512,7 +545,7 @@ export async function handleResponsesCompact(
     // Codex selects a bare native model for compaction even when the operator
     // routes ordinary turns elsewhere (#2901); the compaction-scoped router
     // may land that on the configured default provider instead of 404.
-    route = routeCompactionModel(config, raw.model, evidenceFromBody(raw));
+    route = routeCompactionModel(config, compactModel, evidenceFromBody(raw));
   } catch (err) {
     if (err instanceof NoEligiblePolicyCandidateError) {
       // Persist the evaluation trace (per-candidate exclusions + the
@@ -529,7 +562,7 @@ export async function handleResponsesCompact(
   // exactly the selector form back down the native compact endpoint this guard exists to avoid.
   // `route.modelId` is the same value `applyCodexAccountGatedWireNormalization` uses in core.ts.
   const accountGatedCompactWireModel = codexAccountGatedCanonicalWireModel(selectedModelId);
-  logCtx.requestedModel = raw.model;
+  logCtx.requestedModel = compactRequestedModel;
   logCtx.model = selectedModelId;
   logCtx.routeDecision = route.routeDecision;
   logCtx.provider = route.codexAccountNamespace
@@ -544,13 +577,40 @@ export async function handleResponsesCompact(
   } else {
     logCtx.resolvedModel = route.modelId;
   }
+  if (compactFastRow) {
+    // Resolved AFTER the virtual-model rewrite above, and against `route.modelId`, which is
+    // now the WIRE model: `resolveOpenAiCompactModel` maps an alias like `gpt-5.6-sol-pro`
+    // onto a different wire id, and capability overrides are keyed by exact model id, so
+    // deciding before the rewrite could set `priority` on a wire model that does not support
+    // it. `capabilityProvider` is passed for the same reason core.ts:2103 passes it.
+    const decision = decideTier(
+      fastPolicyForModel(
+        route.provider,
+        route.modelId,
+        route.providerName,
+        "responses",
+        config.providers[route.providerName],
+      ),
+      config.fastMode,
+      "priority",
+    );
+    // The WHOLE decision: native compact spreads `raw` into the forwarded body, so on a drop
+    // a caller's pre-existing service_tier must be REMOVED rather than left to ride along
+    // past the suppression.
+    const serviceTier = tierValueAfterDecision(decision, "priority");
+    if (serviceTier === undefined) delete (raw as Record<string, unknown>).service_tier;
+    else (raw as Record<string, unknown>).service_tier = serviceTier;
+  }
 
   // #1686: a bearer-presented admission secret is one of ours, so the stored main credential
   // is substituted below instead of the caller bearer being forwarded.
   // #2132: and only when the route is a native Codex one, which is the only route that can
   // consume that credential. See the longer note in core.ts resolveResponsesCodexAuth.
+  const customReserveForward = selectedModelId === NATIVE_RESERVE_MODEL
+    && isCodexReserveRequestEligible(config, admission)
+    && isCanonicalOpenAiForwardProvider(route.provider);
   const substituteMainCredential = admission?.source === "bearer"
-    && route.codexAccountMode !== undefined;
+    && (route.codexAccountMode !== undefined || customReserveForward);
   const requestScopedMainCredential = route.codexAccountMode !== undefined
     && !substituteMainCredential
     && hasForwardableCodexBearer(req.headers, config);
@@ -598,8 +658,9 @@ export async function handleResponsesCompact(
     let compactProvider = route.provider;
     let headers = new Headers({ "content-type": "application/json" });
     try {
-      if (route.codexAccountMode) {
-        authCtx = await resolveCodexAuthContext(req.headers, config, route.codexAccountMode, {
+      if (route.codexAccountMode || customReserveForward) {
+        if (route.codexAccountMode) authCtx = await resolveCodexAuthContext(req.headers, config, route.codexAccountMode, {
+          admission,
           accountId: route.codexAccountId,
           modelId: selectedModelId,
           substituteMainCredentialForDirect: substituteMainCredential,
@@ -610,6 +671,10 @@ export async function handleResponsesCompact(
         });
         logCtx.accountLogLabel = codexAuthContextLogLabel(authCtx, config);
         const selected = await materializeCodexUpstreamAuthAsync(req.headers, authCtx, {
+          admission,
+          config: isCanonicalOpenAiForwardProvider(route.provider) ? config : undefined,
+          modelId: selectedModelId,
+          beginCodexAccountSelection: codexAccountSelectionForTurn(turnAdmissionLease),
           substituteMainCredential,
           signal: req.signal,
           nativeMainRefreshDependencies: options.nativeMainRefreshDependencies,
@@ -726,6 +791,7 @@ export async function handleResponsesCompact(
       sendProvider: OcxProviderConfig,
       sendHeaders: Headers,
       recovery: "normal" | "single",
+      sendAuthCtx: CodexAuthContext,
     ): Promise<Response> => {
       const doFetch = (upstreamRecovery?: UpstreamSendRecovery) => fetchWithHeaderTimeout(
         compactUrl,
@@ -740,6 +806,8 @@ export async function handleResponsesCompact(
         providerFetch(sendProvider, undefined, {
           providerName: route.providerName,
           modelId: route.modelId,
+          beforeDispatch: isCanonicalOpenAiForwardProvider(sendProvider)
+            ? createCodexReserveDispatchGuard(sendAuthCtx, config, selectedModelId, admission) : undefined,
         }),
         // Every credential-bearing forward send gets manual redirects, not only
         // pool sends: direct mode carries the caller's credential too (#914).
@@ -758,17 +826,30 @@ export async function handleResponsesCompact(
     // The account each outcome belongs to. Reassigned only when the alternate send below
     // actually happens, so every recorder call names the context that produced it.
     let outcomeCtx = authCtx;
+    const localDispatchRefusal = (error: unknown): Response | undefined => {
+      const response = mapCodexAuthContextErrorToResponse(unwrapUpstreamRetryEvidenceError(error), {
+        now: Date.now(), accountSelector: route.codexAccountNamespace,
+      });
+      if (response) {
+        releaseUpstreamHostAdmission(compactHostAdmissionLease);
+        compactHostAdmissionLease = null;
+        releaseCodexAuthContextProbeLease(outcomeCtx);
+      }
+      return response;
+    };
     let upstream: Response;
     let storedPool401ReplayAttempted = false;
     try {
       // Same connect timeout + keep-alive reset + transient-5xx recovery as /v1/responses —
       // compact hits the same ChatGPT host and must soft-avoid / clear affinity (#186).
-      upstream = await sendCompactAttempt(compactProvider, headers, "normal");
+      upstream = await sendCompactAttempt(compactProvider, headers, "normal", authCtx);
     } catch (err) {
       if (req.signal.aborted) {
         recordCompactPoolOutcome(outcomeCtx, 499);
         return formatErrorResponse(499, "client_cancelled", "Client cancelled compact request");
       }
+      const localRefusal = localDispatchRefusal(err);
+      if (localRefusal) return localRefusal;
       const outcome = classifyTransportFailureKind(err);
       // Host-level evidence stands regardless of pool membership (#914 review).
       if (outcome === "connect_neutral") {
@@ -801,6 +882,9 @@ export async function handleResponsesCompact(
       const poolReplay = poolAuthCtx
         ? await refreshPoolCompactContext({
           req,
+          admission,
+          config,
+          modelId: selectedModelId,
           authCtx: poolAuthCtx,
           provider: compactProvider,
           codexAccountMode: route.codexAccountMode,
@@ -811,6 +895,9 @@ export async function handleResponsesCompact(
       const replay = poolReplay
         ?? await refreshNativeMainCompactContext({
           req,
+          admission,
+          config,
+          modelId: selectedModelId,
           authCtx,
           provider: compactProvider,
           codexAccountMode: route.codexAccountMode,
@@ -841,12 +928,14 @@ export async function handleResponsesCompact(
       headers = replay.headers;
       logCtx.accountLogLabel = codexAuthContextLogLabel(replay.authCtx, config);
       try {
-        upstream = await sendCompactAttempt(compactProvider, headers, "single");
+        upstream = await sendCompactAttempt(compactProvider, headers, "single", authCtx);
       } catch (err) {
         if (req.signal.aborted) {
           recordCompactPoolOutcome(outcomeCtx, 499);
           return formatErrorResponse(499, "client_cancelled", "Client cancelled compact request");
         }
+        const localRefusal = localDispatchRefusal(err);
+        if (localRefusal) return localRefusal;
         recordCompactPoolOutcome(outcomeCtx, classifyTransportFailureKind(err));
         return formatErrorResponse(502, "upstream_error", "Failed to connect to compact upstream");
       }
@@ -874,6 +963,7 @@ export async function handleResponsesCompact(
       // throws, the first rejection is still intact and can be returned to the client.
       const alternate = await resolveAlternateCompactContext({
         req,
+        admission,
         config,
         route,
         selectedModelId,
@@ -900,6 +990,7 @@ export async function handleResponsesCompact(
             authCtx.accountId,
             upstream.headers,
             authCtx.writerGeneration,
+            authCtx.kind === "main-pool" ? authCtx.mainQuotaWriter : undefined,
           );
         }
         recordCompactPoolOutcome(authCtx, upstream.status, {
@@ -911,12 +1002,14 @@ export async function handleResponsesCompact(
         outcomeCtx = alternate.authCtx;
         logCtx.accountLogLabel = codexAuthContextLogLabel(alternate.authCtx, config);
         try {
-          upstream = await sendCompactAttempt(alternate.provider, alternate.headers, "single");
+          upstream = await sendCompactAttempt(alternate.provider, alternate.headers, "single", alternate.authCtx);
         } catch (err) {
           if (req.signal.aborted) {
             recordCompactPoolOutcome(outcomeCtx, 499);
             return formatErrorResponse(499, "client_cancelled", "Client cancelled compact request");
           }
+          const localRefusal = localDispatchRefusal(err);
+          if (localRefusal) return localRefusal;
           const outcome = classifyTransportFailureKind(err);
           // Host-level evidence stands regardless of pool membership (#914 review).
           if (outcome === "connect_neutral") {