@bitkyc08/opencodex 2.49.0 → 2.50.0

package/src/server/management/provider-routes.ts

@@ -54,6 +54,7 @@ import {
   readBoundedDiscoveryJson,
   resolveProviderModelDiscovery,
 } from "../../providers/model-discovery";
+import { extractGoogleAiStudioModelItems } from "../../providers/google-ai-studio-model-discovery";
 import { routedSlug, slugEquals } from "../../providers/slug-codec";
 import { clearAccountQuotaCache, clearProviderQuotaCache, fetchProviderQuotaReports } from "../../providers/quota";
 import { clearKeyCooldowns } from "../../providers/key-failover";
@@ -1428,13 +1429,19 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
         return jsonResponse({ ok: false, latencyMs, error: "upstream CCA model discovery returned an unexpected shape" });
       }
       // OpenAI-style lists (and Together top-level arrays) use the same validation/dedupe/filter
-      // as catalog discovery. Google's /v1beta/models uses `models[].name` and remains a
-      // connectivity-only count because it is not an authoritative catalog source.
+      // as catalog discovery. Google AI Studio parses the native `models[]` envelope and filters to
+      // `generateContent`, while other providers fall back to generic envelope rows if they return `models[]`.
       const record = bounded.value !== null && typeof bounded.value === "object" && !Array.isArray(bounded.value)
         ? bounded.value as Record<string, unknown>
         : undefined;
+      const isAiStudio = effectiveGoogleMode(name, prov) === "ai-studio";
+      const googleAiStudio = !ccaModels && isAiStudio
+        ? extractGoogleAiStudioModelItems(bounded.value, discovery.maxModels)
+        : undefined;
       const extracted = ccaModels
         ? undefined
+        : googleAiStudio?.ok
+        ? googleAiStudio
         : Array.isArray(bounded.value) || Array.isArray(record?.data)
         ? extractProviderModelItems(bounded.value, discovery)
         : extractModelEnvelopeRows(bounded.value, discovery.maxModels, ["models"]);

package/src/server/management/request-history-routes.ts

@@ -106,7 +106,9 @@ export async function handleRequestHistoryRoutes(ctx: ManagementContext): Promis
         to,
       }, cursor, limit);
       return jsonResponse({
-        entries: page.rows.map(row => requestLogDto(requestLogEntryFromPersistedUsage(row))),
+        // The decode rate is a Logs-page metric; this endpoint shares the DTO but not its
+        // contract, so it opts out rather than silently widening its own response shape (#4038).
+        entries: page.rows.map(row => requestLogDto(requestLogEntryFromPersistedUsage(row), { includeDecodeRate: false })),
         ...(page.nextCursor ? { nextCursor: page.nextCursor } : {}),
         hasMore: page.hasMore,
         index: {
@@ -184,7 +186,7 @@ export async function handleRequestHistoryRoutes(ctx: ManagementContext): Promis
     if (!entry) {
       return jsonResponse({ error: { code: "not_found", message: "unknown request" } }, 404, req, config);
     }
-    return jsonResponse(requestLogDto(requestLogEntryFromPersistedUsage(entry)), 200, req, config);
+    return jsonResponse(requestLogDto(requestLogEntryFromPersistedUsage(entry), { includeDecodeRate: false }), 200, req, config);
   }
 
   return null;

package/src/server/management/route-registry.ts

@@ -95,6 +95,7 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "PATCH", path: "/api/codex-auth/pool-strategy", module: "codex/auth-api", mutates: true },
   { method: "POST", path: "/api/codex-auth/accounts", module: "codex/auth-api", mutates: true },
   { method: "POST", path: "/api/codex-auth/accounts/clear-cooldown", module: "codex/auth-api", mutates: true },
+  { method: "POST", path: "/api/codex-auth/accounts/refresh", module: "codex/auth-api", mutates: true },
   { method: "POST", path: "/api/codex-auth/login", module: "codex/auth-api", mutates: true },
   { method: "POST", path: "/api/codex-auth/login/cancel", module: "codex/auth-api", mutates: true },
   { method: "POST", path: "/api/codex-auth/login/code", module: "codex/auth-api", mutates: true },
@@ -148,9 +149,9 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "GET", path: "/api/client-integrations/aside/profiles/{profileId}", module: "server/management/aside-profile-routes", mutates: false, mechanism: "prefix-decode" },
   { method: "PUT", path: "/api/client-integrations/aside/profiles/{profileId}", module: "server/management/aside-profile-routes", mutates: true, mechanism: "prefix-decode" },
   { method: "GET", path: "/api/client-integrations/aside/profiles/journal", module: "server/management/aside-profile-routes", mutates: false, mechanism: "prefix-decode" },
-  { method: "DELETE", path: "/api/client-integrations/aside/profiles/journal", module: "server/management/aside-profile-routes", mutates: true, mechanism: "prefix-decode", exempt: { reason: "deferred-verb", why: "Aside history deletion uses the dashboard journal cleanup; the CLI has history and restore but no deletion verb yet.", owner: "260904_priority65_closeout WP7", ownerDoc: "devlog/_plan/260904_priority65_closeout/060_wp7_rollback_journal_crud.md" } },
+  { method: "DELETE", path: "/api/client-integrations/aside/profiles/journal", module: "server/management/aside-profile-routes", mutates: true, mechanism: "prefix-decode", exempt: { reason: "deferred-verb", why: "Aside history deletion uses the dashboard journal cleanup; the CLI has history and restore but no deletion verb yet.", owner: "260904_priority65_closeout WP7", ownerDoc: "devlog/_fin/260904_priority65_closeout/060_wp7_rollback_journal_crud.md" } },
   { method: "GET", path: "/api/client-integrations/aside/profiles/{profileId}/journal", module: "server/management/aside-profile-routes", mutates: false, mechanism: "prefix-decode" },
-  { method: "DELETE", path: "/api/client-integrations/aside/profiles/{profileId}/journal", module: "server/management/aside-profile-routes", mutates: true, mechanism: "prefix-decode", exempt: { reason: "deferred-verb", why: "Aside profile history deletion uses the dashboard journal cleanup; the CLI has scoped history and restore but no deletion verb yet.", owner: "260904_priority65_closeout WP7", ownerDoc: "devlog/_plan/260904_priority65_closeout/060_wp7_rollback_journal_crud.md" } },
+  { method: "DELETE", path: "/api/client-integrations/aside/profiles/{profileId}/journal", module: "server/management/aside-profile-routes", mutates: true, mechanism: "prefix-decode", exempt: { reason: "deferred-verb", why: "Aside profile history deletion uses the dashboard journal cleanup; the CLI has scoped history and restore but no deletion verb yet.", owner: "260904_priority65_closeout WP7", ownerDoc: "devlog/_fin/260904_priority65_closeout/060_wp7_rollback_journal_crud.md" } },
   { method: "POST", path: "/api/client-integrations/aside/profiles/{profileId}/restore", module: "server/management/aside-profile-routes", mutates: true, mechanism: "prefix-decode" },
   // server/management/codex-prompt-routes
   { method: "GET", path: "/api/codex-prompt", module: "server/management/codex-prompt-routes", mutates: false },
@@ -186,7 +187,7 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   // server/management/integration-routes
   { method: "GET", path: "/api/client-integrations", module: "server/management/integration-routes", mutates: false },
   { method: "GET", path: "/api/client-integrations/journal", module: "server/management/integration-routes", mutates: false },
-  { method: "DELETE", path: "/api/client-integrations/journal", module: "server/management/integration-routes", mutates: true, exempt: { reason: "deferred-verb", why: "Retiring one rollback row is a dashboard-local cleanup; the CLI verb that would drive it is owed by a later work-phase and is not implemented here.", owner: "260904_priority65_closeout WP7", ownerDoc: "devlog/_plan/260904_priority65_closeout/060_wp7_rollback_journal_crud.md" } },
+  { method: "DELETE", path: "/api/client-integrations/journal", module: "server/management/integration-routes", mutates: true, exempt: { reason: "deferred-verb", why: "Retiring one rollback row is a dashboard-local cleanup; the CLI verb that would drive it is owed by a later work-phase and is not implemented here.", owner: "260904_priority65_closeout WP7", ownerDoc: "devlog/_fin/260904_priority65_closeout/060_wp7_rollback_journal_crud.md" } },
   { method: "POST", path: "/api/client-integrations/restore", module: "server/management/integration-routes", mutates: true },
   // server/management/lab-automation-routes
   { method: "GET", path: "/api/lab/automation", module: "server/management/lab-automation-routes", mutates: false, exempt: { reason: "local-transport", why: "ocx lab reads the same rows from the local SQLite projection; src/cli/lab.ts imports ../lab/query directly and never fetches /api/lab." } },
@@ -292,7 +293,7 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "PATCH", path: "/api/providers", module: "server/management/provider-routes", mutates: true },
   { method: "POST", path: "/api/providers", module: "server/management/provider-routes", mutates: true },
   { method: "POST", path: "/api/providers/test", module: "server/management/provider-routes", mutates: true },
-  { method: "PUT", path: "/api/providers", module: "server/management/provider-routes", mutates: true, exempt: { reason: "deferred-verb", why: "Issue #3280 scopes this atomic batch endpoint to the GUI JSON editor; a matching CLI verb is outside wp5 and remains owed.", owner: "wp5-followup", ownerDoc: "devlog/_plan/260903_bug_drawdown_bcda/050_phase5.md" } },
+  { method: "PUT", path: "/api/providers", module: "server/management/provider-routes", mutates: true, exempt: { reason: "deferred-verb", why: "Issue #3280 scopes this atomic batch endpoint to the GUI JSON editor; a matching CLI verb is outside wp5 and remains owed.", owner: "wp5-followup", ownerDoc: "devlog/_fin/260903_bug_drawdown_bcda/050_phase5.md" } },
   { method: "PUT", path: "/api/provider-context-caps", module: "server/management/provider-routes", mutates: true },
   // server/management/quota-reset-routes
   { method: "GET", path: "/api/quota-resets", module: "server/management/quota-reset-routes", mutates: false, mechanism: "negated-guard" },

package/src/server/management/shared.ts

@@ -79,7 +79,8 @@ export function parseDebugLogQuery(url: URL): { after: number; limit: number } {
 export type MetricUnavailableReason =
   | "usage_missing" | "usage_unsupported" | "output_missing" | "invalid_duration"
   | "price_unmatched" | "invalid_cache_breakdown"
-  | "invalid_usage" | "combo_attempt_unavailable";
+  | "invalid_usage" | "combo_attempt_unavailable"
+  | "ttft_missing" | "decode_window_too_short";
 
 export type TokPerSecondResult =
   | { kind: "value"; value: number; estimated: boolean }
@@ -96,7 +97,7 @@ export type CostResult =
   | { kind: "value"; estimate: NonNullable<ReturnType<typeof estimateRequestCost>>; estimateReasons: CostEstimateReason[] }
   | { kind: "unavailable"; reason: MetricUnavailableReason };
 
-export type MetricSource = Pick<RequestLogEntry, "provider" | "model" | "durationMs" | "usageStatus" | "usage" | "requestedServiceTier" | "configuredServiceTier" | "responseServiceTier" | "tierOutcome" | "routeDecision"> & {
+export type MetricSource = Pick<RequestLogEntry, "provider" | "model" | "durationMs" | "firstOutputMs" | "usageStatus" | "usage" | "requestedServiceTier" | "configuredServiceTier" | "responseServiceTier" | "tierOutcome" | "routeDecision"> & {
   attempts?: readonly PersistedUsageAttempt[];
 };
 
@@ -113,6 +114,51 @@ export function tokPerSecondResult(entry: Pick<MetricSource, "durationMs" | "usa
   return { kind: "value", value, estimated: entry.usageStatus === "estimated" || entry.usage.estimated === true };
 }
 
+/**
+ * Shortest post-TTFT window that can carry a decode-rate estimate (#4038).
+ *
+ * Below one second the window is dominated by things that are not decoding: TTFT jitter, the
+ * proxy's own buffering, and the granularity of the timestamps themselves. A 240-token response
+ * whose first token arrived 50 ms before the last one is not a 4800 tok/s model, and printing
+ * that number is worse than printing nothing — which is precisely why the earlier attempt at
+ * this metric (#4040) was closed as an unreliable estimate.
+ */
+export const MIN_DECODE_WINDOW_MS = 1_000;
+
+/**
+ * Estimated DECODE throughput: output tokens over the window after the first token (#4038).
+ *
+ * Strictly additive. `tokensPerSecond`, `tokPerSecondResult`, `RequestLogEntry` and
+ * `usage.jsonl` are untouched, and the end-to-end rate beside it keeps meaning exactly what it
+ * has always meant — it is documented as end-to-end, so this is a missing metric rather than a
+ * miscalculated one.
+ *
+ * Always `estimated: true`. The proxy's TTFT is when the FIRST BYTE reached the proxy, which is
+ * not the provider's own generation start, so this can never be more than an estimate no matter
+ * how long the window is. Saying so in the payload is the honest half of the answer to #4040;
+ * MIN_DECODE_WINDOW_MS is the other half.
+ */
+export function decodeTokPerSecondResult(
+  entry: Pick<MetricSource, "durationMs" | "firstOutputMs" | "usageStatus" | "usage">,
+): TokPerSecondResult {
+  if (!entry.usage) return { kind: "unavailable", reason: "usage_missing" };
+  if (entry.usageStatus === "unsupported") return { kind: "unavailable", reason: "usage_unsupported" };
+  if (entry.usage.outputTokens <= 0) return { kind: "unavailable", reason: "output_missing" };
+  // A row that predates TTFT capture, or a non-streaming turn that never recorded one, has no
+  // window to measure. That is a different fact from a bad duration, so it gets its own reason.
+  if (entry.firstOutputMs === undefined) return { kind: "unavailable", reason: "ttft_missing" };
+  if (!Number.isFinite(entry.firstOutputMs) || entry.firstOutputMs < 0 || !Number.isFinite(entry.durationMs)) {
+    return { kind: "unavailable", reason: "invalid_duration" };
+  }
+  const windowMs = entry.durationMs - entry.firstOutputMs;
+  // TTFT at or past the total duration means the two clocks disagree; there is no window.
+  if (windowMs <= 0) return { kind: "unavailable", reason: "invalid_duration" };
+  if (windowMs < MIN_DECODE_WINDOW_MS) return { kind: "unavailable", reason: "decode_window_too_short" };
+  const value = tokensPerSecond(entry.usage.outputTokens, windowMs);
+  if (value === null) return { kind: "unavailable", reason: "invalid_duration" };
+  return { kind: "value", value, estimated: true };
+}
+
 export function unavailableCostReason(entry: MetricSource): MetricUnavailableReason {
   // Normalizer-first classification: the landed normalizer recovers legacy
   // cachedInputTokens=read+write rows via retry, so a raw read+write>input
@@ -152,11 +198,26 @@ export function costResult(entry: MetricSource): CostResult {
   return { kind: "value", estimate, estimateReasons };
 }
 
-export function requestLogDto(entry: RequestLogEntry): Record<string, unknown> {
+/**
+ * `/api/logs` row projection.
+ *
+ * `includeDecodeRate` exists because `/api/request-history` shares this DTO but not its
+ * contract (#4038). The value would be meaningful there — `firstOutputMs` does survive into a
+ * persisted-usage row — so this is a scope decision, not a correctness one: the decode rate is
+ * a Logs-page metric, and widening a separate endpoint's response shape is not this change's
+ * business. Flipping it on later is one argument.
+ */
+export function requestLogDto(
+  entry: RequestLogEntry,
+  { includeDecodeRate = true }: { includeDecodeRate?: boolean } = {},
+): Record<string, unknown> {
   return {
     ...entry,
     displayMetrics: {
       tokPerSecond: tokPerSecondResult(entry),
+      // The parent uses the REQUEST's own TTFT. A combo parent must not borrow an attempt's,
+      // which would measure a window the parent never had.
+      ...(includeDecodeRate ? { decodeTokPerSecond: decodeTokPerSecondResult(entry) } : {}),
       cost: costResult(entry),
     },
     ...(entry.attempts?.length
@@ -165,6 +226,8 @@ export function requestLogDto(entry: RequestLogEntry): Record<string, unknown> {
           ...attempt,
           displayMetrics: {
             tokPerSecond: tokPerSecondResult(attempt),
+            // Each attempt measures its own attempt-relative TTFT.
+            ...(includeDecodeRate ? { decodeTokPerSecond: decodeTokPerSecondResult(attempt) } : {}),
             cost: costResult({ ...attempt, attempts: undefined, routeDecision: entry.routeDecision, requestedServiceTier: entry.requestedServiceTier, configuredServiceTier: entry.configuredServiceTier, responseServiceTier: entry.responseServiceTier }),
           },
         })),

package/src/server/management-api.ts

@@ -385,7 +385,7 @@ export async function handleManagementAPI(
     const { ConfigMutationLockError } = await import("../config");
     const { CodexCredentialRefreshLockTimeoutError } = await import("../codex/account-store");
     try {
-      return await handleCodexAuthAPI(req, url, config, convergeCodexCatalog);
+      return await handleCodexAuthAPI(req, url, config, convergeCodexCatalog, principal);
     } catch (error) {
       // Credential writers remap ConfigMutationLockError to CodexCredentialRefreshLockTimeoutError;
       // treat both as the same retryable busy response.

package/src/server/request-decompress.ts

@@ -21,6 +21,58 @@ import type { TranslatorBudget } from "../lib/translator-budget";
  */
 export const MAX_DECOMPRESSED_BODY_BYTES = 256 * 1024 * 1024;
 
+/**
+ * Hard ceiling on the opt-in `maxInboundBodyBytes` (#3573).
+ *
+ * The opt-in exists because a 922k-token session serializes past the 256 MiB default, and the
+ * request that crosses it is the compaction request itself — so the session can no longer
+ * shrink and is stuck. An UNBOUNDED inbound cap is not an acceptable answer: this admission
+ * limit is the only thing standing between one request and the process heap, and
+ * `readBoundedJsonRequestBody` materializes the body several times over (retained wire bytes,
+ * decoded bytes, the decoded string, the re-encoded measurement copies, and the parsed object
+ * graph), so peak RSS is a MULTIPLE of whatever is admitted here. 512 MiB is the largest value
+ * that keeps that multiple survivable on an ordinary machine, and it is what #3573 asked for.
+ */
+export const MAX_CONFIGURABLE_INBOUND_BODY_BYTES = 512 * 1024 * 1024;
+
+/** Floor for the opt-in. Below this an ordinary multi-image turn cannot be admitted at all. */
+export const MIN_CONFIGURABLE_INBOUND_BODY_BYTES = 1024 * 1024;
+
+/**
+ * Resolve the configured inbound admission limit, clamped to the supported range.
+ *
+ * Pure and total on purpose: the schema in `src/config.ts` degrades an invalid hand edit to
+ * `undefined` rather than failing the parse, so the schema cannot be the place the ceiling is
+ * enforced. Every caller resolves through here, which makes this the single auditable bound
+ * regardless of how the config object was produced.
+ *
+ * Omitted, zero, or non-finite = the 256 MiB default, so an unconfigured proxy admits exactly
+ * what it admits today.
+ */
+export function resolveInboundBodyLimitBytes(configured: number | undefined): number {
+  if (configured === undefined || !Number.isFinite(configured) || configured <= 0) {
+    return MAX_DECOMPRESSED_BODY_BYTES;
+  }
+  return Math.min(
+    Math.max(Math.floor(configured), MIN_CONFIGURABLE_INBOUND_BODY_BYTES),
+    MAX_CONFIGURABLE_INBOUND_BODY_BYTES,
+  );
+}
+
+/**
+ * Render a byte count, or nothing at all. `DecompressedBodyTooLargeError` accepts non-finite
+ * and untyped values from legacy callers and deliberately keeps them out of its own message;
+ * the client-facing message inherits that rule rather than printing `NaN MB`.
+ */
+function megabytes(bytes: number): string | null {
+  return Number.isFinite(bytes) && bytes >= 0 && bytes <= Number.MAX_SAFE_INTEGER
+    ? (bytes / (1024 * 1024)).toFixed(1)
+    : null;
+}
+
+const INBOUND_CEILING_MB = (MAX_CONFIGURABLE_INBOUND_BODY_BYTES / (1024 * 1024)).toFixed(1);
+
+
 export class UnsupportedContentEncodingError extends Error {
   constructor(readonly encoding: string) {
     super(`Unsupported content-encoding: ${encoding}`);
@@ -54,6 +106,33 @@ export class DecompressedBodyTooLargeError extends Error {
   }
 }
 
+/**
+ * Name OpenCodex as the refuser, and name the lever.
+ *
+ * #4112 gave the UPSTREAM context refusal on `/v1/responses` its own HTTP 413 with
+ * `context_length_exceeded`. That makes the two 413s on this surface look alike to a client
+ * while having opposite remedies: the upstream one means the provider will not take the turn,
+ * this one means the proxy never read it and a config key would have let it through. The
+ * wording deliberately avoids "context window"/"context length", which `classifyError` treats
+ * as evidence of an upstream context verdict.
+ */
+export function describeInboundBodyRefusal(error: DecompressedBodyTooLargeError): string {
+  // A lower-bound measurement stopped counting at the cap; reporting it as exact would be a lie.
+  const approximate = error.measurement === "declared_wire" || error.measurement === "decoded_exact"
+    ? "" : "at least ";
+  const observed = megabytes(error.bytes);
+  const limit = megabytes(error.limit);
+  const sizes = limit === null
+    ? "the body is above the inbound admission limit"
+    : observed === null
+      ? `the body is above the ${limit} MB inbound admission limit`
+      : `the body is ${approximate}${observed} MB, above the ${limit} MB inbound admission limit`;
+  return `OpenCodex refused this request before reading it: ${sizes}. `
+    + "This is a local proxy limit, not a provider refusal. Raise \"maxInboundBodyBytes\" in "
+    + `config.json (ceiling ${INBOUND_CEILING_MB} MB) and restart the proxy, or compact the `
+    + "conversation earlier.";
+}
+
 function assertBodySizeWithinLimit(
   body: Uint8Array,
   maxBytes: number,
@@ -259,7 +338,16 @@ export async function readBoundedJsonRequestBody(
   }
 }
 
-/** Parse a JSON data-plane body using the shared 256 MiB admission cap. */
-export function readJsonRequestBody(req: Request, budget?: TranslatorBudget): Promise<unknown> {
-  return readBoundedJsonRequestBody(req, MAX_DECOMPRESSED_BODY_BYTES, budget);
+/**
+ * Parse a JSON data-plane body using the shared admission cap.
+ *
+ * `maxBytes` is the resolved per-deployment limit from `resolveInboundBodyLimitBytes()`;
+ * omitting it keeps the 256 MiB default for callers with no config in scope.
+ */
+export function readJsonRequestBody(
+  req: Request,
+  budget?: TranslatorBudget,
+  maxBytes: number = MAX_DECOMPRESSED_BODY_BYTES,
+): Promise<unknown> {
+  return readBoundedJsonRequestBody(req, maxBytes, budget);
 }

package/src/server/request-log.ts

@@ -1119,6 +1119,16 @@ export function filterRequestLogs(logs: RequestLogEntry[], params: URLSearchPara
     filtered = filtered.filter(entry => entry.model === model
       || entry.attempts?.some(attempt => attempt.model === model));
   }
+  // #4057: "which account served this request" is the first question asked when one provider
+  // holds several accounts, and until now the only way to answer it was to grep usage.jsonl by
+  // hand. Attempts are matched for the same reason `provider` and `model` match them: when a
+  // request failed over between pool accounts, a search for the account that finally served it
+  // has to find that request, not only the account that first refused it.
+  const account = params.get("account")?.trim();
+  if (account) {
+    filtered = filtered.filter(entry => entry.accountLogLabel === account
+      || entry.attempts?.some(attempt => attempt.accountLogLabel === account));
+  }
   const status = params.get("status")?.trim().toLowerCase();
   if (status) {
     filtered = /^[1-5]xx$/.test(status)

package/src/server/responses/codex-ws-wire.ts

@@ -2,7 +2,7 @@ import { MAX_CLIENT_SSE_FRAME_BYTES } from "../sse-frame-buffer";
 // If the 101 never arrives (network black hole), give SSE a chance well before
 // the caller's connect timeout (default 200s) would fire.
 export const UPGRADE_DEADLINE_MS = 10_000;
-export const CODEX_WS_RESPONSE_PRELUDE_TIMEOUT_MS = 30_000;
+export const CODEX_WS_RESPONSE_PRELUDE_TIMEOUT_MS = 90_000;
 // Keep the push-based WS transport inside the same memory envelope as the
 // bounded SSE relays that consume this response. Unlike fetch response bodies,
 // a WebSocket cannot be paused when a ReadableStream applies backpressure, so

package/src/server/responses/compact.ts

@@ -104,7 +104,12 @@ import { fastPolicyForModel } from "../../providers/service-tier";
 import { parseFastOnlyRowId } from "../fast-row";
 import { applyOpenAiVirtualModel, resolveOpenAiCompactModel } from "../../providers/openai-virtual-models";
 import { isUsageDebugEnabled } from "../../usage/debug";
-import { readJsonRequestBody, DecompressedBodyTooLargeError, UnsupportedContentEncodingError } from "../request-decompress";
+import {
+  readJsonRequestBody,
+  resolveInboundBodyLimitBytes,
+  DecompressedBodyTooLargeError,
+  UnsupportedContentEncodingError,
+} from "../request-decompress";
 import { resolveAdapter, resolveWireProtocolOverride } from "../adapter-resolve";
 import { hasKeyPoolFailover, rotateProviderTransportOn429 } from "../../providers/key-failover";
 import { shouldAttemptImageTierRetry } from "../image-retry";
@@ -522,7 +527,7 @@ export async function handleResponsesCompact(
 ): Promise<Response> {
   let body: unknown;
   try {
-    body = await readJsonRequestBody(req);
+    body = await readJsonRequestBody(req, undefined, resolveInboundBodyLimitBytes(config.maxInboundBodyBytes));
   } catch (err) {
     return decodeRequestErrorResponse(err, "responses-compact");
   }
@@ -1015,6 +1020,7 @@ export async function handleResponsesCompact(
             upstream.headers,
             authCtx.writerGeneration,
             authCtx.kind === "main-pool" ? authCtx.mainQuotaWriter : undefined,
+            { modelId: route.modelId },
           );
         }
         recordCompactPoolOutcome(authCtx, upstream.status, {

package/src/server/responses/context-overflow.ts

@@ -5,6 +5,17 @@ import type { AdapterEvent } from "../../types";
 export const PROVIDER_INPUT_TOO_LARGE_MESSAGE =
   "The provider rejected this turn because its input exceeds the provider size or context limit. Reduce the current input or compact the conversation before retrying.";
 
+/** Preserve non-streaming HTTP failure semantics without exposing an upstream body. */
+export function jsonContextOverflowResponse(): Response {
+  return Response.json({
+    error: {
+      message: PROVIDER_INPUT_TOO_LARGE_MESSAGE,
+      type: "invalid_request_error",
+      code: "context_length_exceeded",
+    },
+  }, { status: 413, headers: { "Cache-Control": "no-store" } });
+}
+
 async function* contextOverflowEvents(): AsyncGenerator<AdapterEvent> {
   yield {
     type: "error",