@bitkyc08/opencodex 2.48.0 → 2.50.0

package/src/server/port-reclaim.ts

@@ -2,11 +2,9 @@
  * Reclaim a listen port after stop/update so restart can stay on the configured
  * port instead of hopping to an ephemeral one (Windows CLOSE_WAIT / leftover ocx).
  *
- * Killing is never the default. A process may be killed only when the caller
- * sets `killOcxHolders` and either supplies a non-empty `onlyKillPids` allowlist
- * (trusted teardown PIDs, including allowlisted holders that fail ocx revalidate)
- * or enables `killAllOcxOnPort` for revalidated ocx listeners. Unknown foreign
- * (non-ocx, non-allowlisted) processes are never killed.
+ * Killing is never the default. It requires `killOcxHolders`, an allowed PID or
+ * `killAllOcxOnPort`, and successful ocx verification. A historical PID allowlist
+ * never overrides a rejected verifier result; rejected live holders stay protected.
  */
 import { execFileSync } from "node:child_process";
 import { verifyPidIdentity } from "../config/process-state";
@@ -29,6 +27,9 @@ export type ReclaimListenPortOptions = WaitForPortOptions & {
   /**
    * Explicit PIDs the caller just stopped / hard-killed. An omitted or empty
    * list means no process may be killed — unless {@link killAllOcxOnPort} is set.
+   * The allowlist only narrows kill candidates: every candidate, allowlisted or
+   * not, still requires verifier acceptance (`verifyOcxFn(pid) === pid`) on each
+   * scan, and a rejected live holder is never killed or TCP-row dropped.
    */
   onlyKillPids?: number[];
   /**
@@ -36,8 +37,7 @@ export type ReclaimListenPortOptions = WaitForPortOptions & {
    * killed (re-checked each scan). Used by post-update restart so a Windows
    * service wrapper that respawns a *new* bun PID mid-reclaim cannot stay
    * protected just because it was absent from the pre-wait allowlist snapshot.
-   * Never kills foreign (non-ocx) processes — only allowlisted teardown PIDs
-   * and revalidated ocx listeners.
+   * Every candidate still requires ocx verifier acceptance before termination.
    */
   killAllOcxOnPort?: boolean;
   /**
@@ -174,8 +174,8 @@ export function listListenPids(port: number): number[] {
  * Never kills a process unless `killOcxHolders === true` and either
  * `onlyKillPids` is a non-empty allowlist or `killAllOcxOnPort` is set — then
  * revalidates immediately before each kill.
- * Never kills foreign processes. Never drops TCP rows while a live foreign or
- * protected ocx listener owns the port, or when the listener scan failed.
+ * Never overrides a rejected ocx verifier result. Never drops TCP rows while a
+ * rejected live or protected ocx listener owns the port, or when the scan failed.
  */
 export async function reclaimListenPort(
   port: number,
@@ -231,24 +231,9 @@ export async function reclaimListenPort(
         }
         const isOcx = verifyOcxFn(pid) === pid;
         const allowlisted = allowedKillPids.has(pid);
-        // Pre-update PIDs can fail verify while still LISTENing (dead owner still
-        // listed, or cmdline probe raced). Allowlisted teardown PIDs may be killed;
-        // unknown foreign claimants must remain fail-closed.
         if (!isOcx) {
-          if (mayKill && allowlisted) {
-            if (!killed.has(pid)) {
-              try {
-                killFn(pid);
-                killed.add(pid);
-              } catch {
-                // Kill failed: never SetTcpEntry while the process may still own the port.
-                protectedOcxListener = true;
-              }
-            }
-            if (!isAliveFn(pid)) killed.delete(pid);
-            else protectedOcxListener = true;
-            continue;
-          }
+          // A saved PID narrows eligible candidates; it cannot override verifier rejection.
+          // Dead ghost owners have already been skipped by the liveness check above.
           foreignLive = true;
           continue;
         }

package/src/server/request-decompress.ts

@@ -21,6 +21,58 @@ import type { TranslatorBudget } from "../lib/translator-budget";
  */
 export const MAX_DECOMPRESSED_BODY_BYTES = 256 * 1024 * 1024;
 
+/**
+ * Hard ceiling on the opt-in `maxInboundBodyBytes` (#3573).
+ *
+ * The opt-in exists because a 922k-token session serializes past the 256 MiB default, and the
+ * request that crosses it is the compaction request itself — so the session can no longer
+ * shrink and is stuck. An UNBOUNDED inbound cap is not an acceptable answer: this admission
+ * limit is the only thing standing between one request and the process heap, and
+ * `readBoundedJsonRequestBody` materializes the body several times over (retained wire bytes,
+ * decoded bytes, the decoded string, the re-encoded measurement copies, and the parsed object
+ * graph), so peak RSS is a MULTIPLE of whatever is admitted here. 512 MiB is the largest value
+ * that keeps that multiple survivable on an ordinary machine, and it is what #3573 asked for.
+ */
+export const MAX_CONFIGURABLE_INBOUND_BODY_BYTES = 512 * 1024 * 1024;
+
+/** Floor for the opt-in. Below this an ordinary multi-image turn cannot be admitted at all. */
+export const MIN_CONFIGURABLE_INBOUND_BODY_BYTES = 1024 * 1024;
+
+/**
+ * Resolve the configured inbound admission limit, clamped to the supported range.
+ *
+ * Pure and total on purpose: the schema in `src/config.ts` degrades an invalid hand edit to
+ * `undefined` rather than failing the parse, so the schema cannot be the place the ceiling is
+ * enforced. Every caller resolves through here, which makes this the single auditable bound
+ * regardless of how the config object was produced.
+ *
+ * Omitted, zero, or non-finite = the 256 MiB default, so an unconfigured proxy admits exactly
+ * what it admits today.
+ */
+export function resolveInboundBodyLimitBytes(configured: number | undefined): number {
+  if (configured === undefined || !Number.isFinite(configured) || configured <= 0) {
+    return MAX_DECOMPRESSED_BODY_BYTES;
+  }
+  return Math.min(
+    Math.max(Math.floor(configured), MIN_CONFIGURABLE_INBOUND_BODY_BYTES),
+    MAX_CONFIGURABLE_INBOUND_BODY_BYTES,
+  );
+}
+
+/**
+ * Render a byte count, or nothing at all. `DecompressedBodyTooLargeError` accepts non-finite
+ * and untyped values from legacy callers and deliberately keeps them out of its own message;
+ * the client-facing message inherits that rule rather than printing `NaN MB`.
+ */
+function megabytes(bytes: number): string | null {
+  return Number.isFinite(bytes) && bytes >= 0 && bytes <= Number.MAX_SAFE_INTEGER
+    ? (bytes / (1024 * 1024)).toFixed(1)
+    : null;
+}
+
+const INBOUND_CEILING_MB = (MAX_CONFIGURABLE_INBOUND_BODY_BYTES / (1024 * 1024)).toFixed(1);
+
+
 export class UnsupportedContentEncodingError extends Error {
   constructor(readonly encoding: string) {
     super(`Unsupported content-encoding: ${encoding}`);
@@ -54,6 +106,33 @@ export class DecompressedBodyTooLargeError extends Error {
   }
 }
 
+/**
+ * Name OpenCodex as the refuser, and name the lever.
+ *
+ * #4112 gave the UPSTREAM context refusal on `/v1/responses` its own HTTP 413 with
+ * `context_length_exceeded`. That makes the two 413s on this surface look alike to a client
+ * while having opposite remedies: the upstream one means the provider will not take the turn,
+ * this one means the proxy never read it and a config key would have let it through. The
+ * wording deliberately avoids "context window"/"context length", which `classifyError` treats
+ * as evidence of an upstream context verdict.
+ */
+export function describeInboundBodyRefusal(error: DecompressedBodyTooLargeError): string {
+  // A lower-bound measurement stopped counting at the cap; reporting it as exact would be a lie.
+  const approximate = error.measurement === "declared_wire" || error.measurement === "decoded_exact"
+    ? "" : "at least ";
+  const observed = megabytes(error.bytes);
+  const limit = megabytes(error.limit);
+  const sizes = limit === null
+    ? "the body is above the inbound admission limit"
+    : observed === null
+      ? `the body is above the ${limit} MB inbound admission limit`
+      : `the body is ${approximate}${observed} MB, above the ${limit} MB inbound admission limit`;
+  return `OpenCodex refused this request before reading it: ${sizes}. `
+    + "This is a local proxy limit, not a provider refusal. Raise \"maxInboundBodyBytes\" in "
+    + `config.json (ceiling ${INBOUND_CEILING_MB} MB) and restart the proxy, or compact the `
+    + "conversation earlier.";
+}
+
 function assertBodySizeWithinLimit(
   body: Uint8Array,
   maxBytes: number,
@@ -259,7 +338,16 @@ export async function readBoundedJsonRequestBody(
   }
 }
 
-/** Parse a JSON data-plane body using the shared 256 MiB admission cap. */
-export function readJsonRequestBody(req: Request, budget?: TranslatorBudget): Promise<unknown> {
-  return readBoundedJsonRequestBody(req, MAX_DECOMPRESSED_BODY_BYTES, budget);
+/**
+ * Parse a JSON data-plane body using the shared admission cap.
+ *
+ * `maxBytes` is the resolved per-deployment limit from `resolveInboundBodyLimitBytes()`;
+ * omitting it keeps the 256 MiB default for callers with no config in scope.
+ */
+export function readJsonRequestBody(
+  req: Request,
+  budget?: TranslatorBudget,
+  maxBytes: number = MAX_DECOMPRESSED_BODY_BYTES,
+): Promise<unknown> {
+  return readBoundedJsonRequestBody(req, maxBytes, budget);
 }

package/src/server/request-log.ts

@@ -22,6 +22,8 @@ import {
   appendUsageEntry,
   isKnownAdmissionKind,
   isKnownInboundProtocol,
+  isKnownTerminalSource,
+  isKnownTransportPhase,
   isKnownUsageSurface,
   isCodexUsageAccountLogLabel,
   isValidReasoningWireValue,
@@ -320,6 +322,8 @@ export function requestLogEntryFromPersistedUsage(entry: PersistedUsageEntry): R
     ...(entry.usage ? { usage: entry.usage } : {}),
     ...(entry.totalTokens !== undefined ? { totalTokens: entry.totalTokens } : {}),
     ...(entry.attempts !== undefined ? { attempts: entry.attempts } : {}),
+    ...(isKnownTransportPhase(entry.transportPhase) ? { transportPhase: entry.transportPhase } : {}),
+    ...(isKnownTerminalSource(entry.terminalSource) ? { terminalSource: entry.terminalSource } : {}),
     ...(routeDecision ? { routeDecision } : {}),
     ...(claudeCompatibility ? { claudeCompatibility } : {}),
   };
@@ -441,6 +445,8 @@ export function addRequestLog(entry: RequestLogEntry) {
       ...(entry.usage ? { usage: entry.usage } : {}),
       ...(entry.totalTokens !== undefined ? { totalTokens: entry.totalTokens } : {}),
       ...(entry.attempts !== undefined ? { attempts: entry.attempts } : {}),
+      ...(isKnownTransportPhase(entry.transportPhase) ? { transportPhase: entry.transportPhase } : {}),
+      ...(isKnownTerminalSource(entry.terminalSource) ? { terminalSource: entry.terminalSource } : {}),
       ...failureDiagnostics,
       ...(entry.routeDecision ? { routeDecision: entry.routeDecision } : {}),
       ...(entry.claudeCompatibility ? { claudeCompatibility: entry.claudeCompatibility } : {}),
@@ -1113,6 +1119,16 @@ export function filterRequestLogs(logs: RequestLogEntry[], params: URLSearchPara
     filtered = filtered.filter(entry => entry.model === model
       || entry.attempts?.some(attempt => attempt.model === model));
   }
+  // #4057: "which account served this request" is the first question asked when one provider
+  // holds several accounts, and until now the only way to answer it was to grep usage.jsonl by
+  // hand. Attempts are matched for the same reason `provider` and `model` match them: when a
+  // request failed over between pool accounts, a search for the account that finally served it
+  // has to find that request, not only the account that first refused it.
+  const account = params.get("account")?.trim();
+  if (account) {
+    filtered = filtered.filter(entry => entry.accountLogLabel === account
+      || entry.attempts?.some(attempt => attempt.accountLogLabel === account));
+  }
   const status = params.get("status")?.trim().toLowerCase();
   if (status) {
     filtered = /^[1-5]xx$/.test(status)

package/src/server/responses/codex-ws-wire.ts

@@ -2,7 +2,7 @@ import { MAX_CLIENT_SSE_FRAME_BYTES } from "../sse-frame-buffer";
 // If the 101 never arrives (network black hole), give SSE a chance well before
 // the caller's connect timeout (default 200s) would fire.
 export const UPGRADE_DEADLINE_MS = 10_000;
-export const CODEX_WS_RESPONSE_PRELUDE_TIMEOUT_MS = 30_000;
+export const CODEX_WS_RESPONSE_PRELUDE_TIMEOUT_MS = 90_000;
 // Keep the push-based WS transport inside the same memory envelope as the
 // bounded SSE relays that consume this response. Unlike fetch response bodies,
 // a WebSocket cannot be paused when a ReadableStream applies backpressure, so

package/src/server/responses/collaboration.ts

@@ -8,6 +8,7 @@ import {
 } from "../../config";
 import { parseRequest } from "../../responses/parser";
 import { externalTaskInputContent } from "../../responses/task-input";
+import { MULTI_AGENT_MODE_HINT_RECOMMENDATION } from "../../codex/multi-agent-mode-policy";
 import { buildCompactV1Output, COMPACT_PROMPT, decodeCompactionSummary, extractCompactUserMessages } from "../../responses/compaction";
 import { FORWARD_HEADERS, sanitizeReasoningInputContent } from "../../adapters/openai-responses";
 import { expandPreviousResponseInput, previousResponseProviderState, rememberResponseState } from "../../responses/state";
@@ -233,13 +234,7 @@ export function buildToolBridgeMaps(parsed: OcxParsedRequest, budget?: Translato
 
 
 
-export const PROACTIVE_MULTI_AGENT_MODE_TEXT = [
-  "Proactive multi-agent delegation is active.",
-  "Any earlier instruction requiring an explicit user request before spawning sub-agents no longer applies.",
-  "Delegate independent sub-tasks to sub-agents whenever parallel work would materially improve speed or quality — do not serialize work that can run concurrently.",
-  "Each sub-agent runs in its own context and can use all available tools; prefer spawning specialists over doing everything yourself.",
-  "This mode remains active until a later multi-agent mode developer message changes it.",
-].join(" ");
+export const PROACTIVE_MULTI_AGENT_MODE_TEXT = MULTI_AGENT_MODE_HINT_RECOMMENDATION.text;
 
 const OPENCODEX_SUBAGENT_GUIDANCE_OPEN_TAG = "<opencodex_subagent_guidance>";
 const OPENCODEX_SUBAGENT_GUIDANCE_CLOSE_TAG = "</opencodex_subagent_guidance>";
@@ -491,8 +486,8 @@ export async function multiAgentGuidanceText(
   }
 
   const effort = parsed.options.reasoning;
-  // v1 keeps only the upstream-parity behavior: Proactive text at the top tier
-  // (ultra arrives as max on the wire). No designation/roster payload here.
+  // v1 changes only the delegation trigger at the top tier; other rules still apply.
+  // Ultra arrives as max on the wire. No designation/roster payload here.
   if (effort !== "max" && effort !== "ultra") return null;
   return `<multi_agent_mode>${PROACTIVE_MULTI_AGENT_MODE_TEXT}</multi_agent_mode>`;
 }

package/src/server/responses/compact.ts

@@ -104,7 +104,12 @@ import { fastPolicyForModel } from "../../providers/service-tier";
 import { parseFastOnlyRowId } from "../fast-row";
 import { applyOpenAiVirtualModel, resolveOpenAiCompactModel } from "../../providers/openai-virtual-models";
 import { isUsageDebugEnabled } from "../../usage/debug";
-import { readJsonRequestBody, DecompressedBodyTooLargeError, UnsupportedContentEncodingError } from "../request-decompress";
+import {
+  readJsonRequestBody,
+  resolveInboundBodyLimitBytes,
+  DecompressedBodyTooLargeError,
+  UnsupportedContentEncodingError,
+} from "../request-decompress";
 import { resolveAdapter, resolveWireProtocolOverride } from "../adapter-resolve";
 import { hasKeyPoolFailover, rotateProviderTransportOn429 } from "../../providers/key-failover";
 import { shouldAttemptImageTierRetry } from "../image-retry";
@@ -522,7 +527,7 @@ export async function handleResponsesCompact(
 ): Promise<Response> {
   let body: unknown;
   try {
-    body = await readJsonRequestBody(req);
+    body = await readJsonRequestBody(req, undefined, resolveInboundBodyLimitBytes(config.maxInboundBodyBytes));
   } catch (err) {
     return decodeRequestErrorResponse(err, "responses-compact");
   }
@@ -1015,6 +1020,7 @@ export async function handleResponsesCompact(
             upstream.headers,
             authCtx.writerGeneration,
             authCtx.kind === "main-pool" ? authCtx.mainQuotaWriter : undefined,
+            { modelId: route.modelId },
           );
         }
         recordCompactPoolOutcome(authCtx, upstream.status, {

package/src/server/responses/context-overflow.ts

@@ -5,6 +5,17 @@ import type { AdapterEvent } from "../../types";
 export const PROVIDER_INPUT_TOO_LARGE_MESSAGE =
   "The provider rejected this turn because its input exceeds the provider size or context limit. Reduce the current input or compact the conversation before retrying.";
 
+/** Preserve non-streaming HTTP failure semantics without exposing an upstream body. */
+export function jsonContextOverflowResponse(): Response {
+  return Response.json({
+    error: {
+      message: PROVIDER_INPUT_TOO_LARGE_MESSAGE,
+      type: "invalid_request_error",
+      code: "context_length_exceeded",
+    },
+  }, { status: 413, headers: { "Cache-Control": "no-store" } });
+}
+
 async function* contextOverflowEvents(): AsyncGenerator<AdapterEvent> {
   yield {
     type: "error",