@bitkyc08/opencodex 2.52.0 → 2.53.0

package/src/server/chat-native.ts

@@ -105,19 +105,27 @@ function normalizePinnedChatEffort(options: HandleNativeChatOptions): void {
   const from = typeof chatBody.reasoning_effort === "string" ? chatBody.reasoning_effort : undefined;
   logCtx.requestedEffort = from;
   // Compaction is normally excluded by native-route eligibility; preserve that boundary here too.
-  const pinned = chatBody.compaction_trigger === undefined
+  const compaction = chatBody.compaction_trigger !== undefined;
+  const pinned = !compaction
     ? resolvePinnedEffort(route, selector, config)
     : undefined;
+  let normalizeForWire = false;
   if (pinned !== undefined) {
     logCtx.requestedEffort = from ? `${from}->${pinned}` : pinned;
     if (pinned === "none") delete chatBody.reasoning_effort;
     else chatBody.reasoning_effort = pinned;
-    // The native lane historically passes caller effort through, including with caps set.
-    // Only a newly operator-pinned value enters the cap and provider-mapping pipeline.
-    if (effortCapAppliesTo(chatCollabSurface(chatBody), req.headers, config)) {
-      const capped = applyChatEffortCap(chatBody, req.headers, config, supportedLadderFor(route));
-      if (capped) logCtx.requestedEffort = `${logCtx.requestedEffort}->${capped.to}`;
+    normalizeForWire = true;
+  }
+  // A qualifying turn's ceiling is independent of whether an operator pin resolved.
+  if (effortCapAppliesTo(chatCollabSurface(chatBody), req.headers, config, compaction)) {
+    const capped = applyChatEffortCap(chatBody, req.headers, config, supportedLadderFor(route));
+    if (capped) {
+      logCtx.requestedEffort = `${logCtx.requestedEffort ?? capped.from}->${capped.to}`;
+      normalizeForWire = true;
     }
+  }
+  // Normalize operator-pinned values and cap rewrites; otherwise preserve caller spelling.
+  if (normalizeForWire) {
     const effort = typeof chatBody.reasoning_effort === "string" ? chatBody.reasoning_effort : undefined;
     const wireEffort = mapReasoningEffort(route.provider, route.modelId, effort);
     if (wireEffort === undefined) delete chatBody.reasoning_effort;
@@ -254,7 +262,7 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
     retainedRequestBytes = 0;
   };
   const retainRequest = (request: AdapterRequest) => {
-    const bytes = new TextEncoder().encode(request.body).byteLength;
+    const bytes = Buffer.byteLength(request.body);
     translatorBudget.chargeRetained(bytes, { kind: "request_copies" });
     retainedRequestBytes = bytes;
   };
@@ -493,24 +501,29 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
   const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
   if (contentType.includes("text/event-stream") && response.body) {
     if (requestedStream) transferTurnToStream();
+    let terminalStatus: number | undefined;
     const stream = nativeChatSse(response.body, {
       requestedModel,
       translatorBudget,
       signal: upstream.signal,
+      stallTimeoutSec: config.stallTimeoutSec,
       onFirstOutput: logIds ? () => recordFirstOutput(logCtx, logIds.start) : undefined,
       onUsage: usage => {
         logCtx.usage = usage;
         attempt.usage = usage;
       },
+      onTerminal: (status: number, message?: string) => {
+        terminalStatus = status;
+        if (!requestedStream) return;
+        try {
+          cleanupAbort();
+          finishLog(status, message, "terminal");
+          if (status >= 400) upstream.abort();
+        } finally {
+          releaseStreamTurn();
+        }
+      },
       ...(requestedStream ? {
-        onTerminal: (status: number, message?: string) => {
-          try {
-            cleanupAbort();
-            finishLog(status, message, "terminal");
-          } finally {
-            releaseStreamTurn();
-          }
-        },
         onCancel: () => {
           try {
             cleanupAbort();
@@ -535,11 +548,20 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
     try {
       const completion = await collectChatCompletion(stream, requestedModel, translatorBudget);
       cleanupAbort();
+      // A cancelled native relay closes its downstream body. EOF alone must not
+      // promote the buffered prefix to a successful Chat completion. A terminal
+      // already accepted by the relay retains precedence over a later abort.
+      if (req.signal.aborted && terminalStatus === undefined) {
+        return fail(499, "Client cancelled request", "client_cancelled");
+      }
       finishLog(200);
       return Response.json(completion);
     } catch (error) {
       cleanupAbort();
       upstream.abort();
+      if (req.signal.aborted && terminalStatus === undefined) {
+        return fail(499, "Client cancelled request", "client_cancelled");
+      }
       if (isChatCompletionsStreamError(error)) {
         return fail(error.status, error.message, error.type, error.code);
       }

package/src/server/hub-usage.ts

@@ -0,0 +1,57 @@
+import type { OcxConfig } from "../types";
+import { MAX_HUB_USAGE_BYTES, parseHubUsage } from "../remote/hub-usage";
+import { parseRange, parseUsageSurface, USAGE_RANGES, USAGE_SURFACES } from "../usage/summary";
+import { parseUsageTimeWindow } from "../usage/time-range";
+import { getFilteredUsageAggregate } from "./management/usage-aggregate-cache";
+import { isAllowedRequestOrigin, resolveDataPlaneAdmissionSecret, withCors, type RequestPolicyView } from "./auth-cors";
+
+/** Read only the ledger rows belonging to an explicitly authenticated configured key. */
+export async function handleHubUsage(req: Request, config: OcxConfig, policy: RequestPolicyView): Promise<Response> {
+  const reply = (body: unknown, status = 200) => withCors(Response.json(body, {
+    status, headers: { "cache-control": "no-store" },
+  }), req, policy);
+  const error = (code: string, message: string, status: number) => reply({ error: { code, message } }, status);
+  const token = req.headers.get("x-opencodex-api-key") ?? "";
+  const admission = resolveDataPlaneAdmissionSecret(token, config);
+  if (admission?.kind !== "configured") return error("hub_usage_unauthorized", "A configured client data key is required", 401);
+  if (!isAllowedRequestOrigin(req, policy)) return error("origin_rejected", "Cross-origin request blocked", 403);
+  if (config.runtimeRole !== "hub") return error("hub_usage_not_a_hub", "Usage is served here only by a hub", 404);
+  const keyId = admission.keyId;
+  // The existing aggregate filter trims IDs. Never let that normalization turn
+  // this authenticated identity into another configured key (or no filter).
+  if (!keyId || keyId.trim() !== keyId) return error("hub_usage_key_id_invalid", "Client key identity needs repair on the hub", 403);
+  const query = new URL(req.url).searchParams;
+  const allowed = new Set(["range", "surface", "provider", "model", "since", "until"]);
+  for (const key of query.keys()) {
+    if (!allowed.has(key) || query.getAll(key).length !== 1) return error("hub_usage_query_invalid", "Unknown or repeated usage option", 400);
+  }
+  const rangeInput = query.get("range") ?? "30d";
+  const surfaceInput = query.get("surface") ?? "all";
+  if (!(rangeInput === "1d" || (USAGE_RANGES as readonly string[]).includes(rangeInput))
+    || !(USAGE_SURFACES as readonly string[]).includes(surfaceInput)) {
+    return error("hub_usage_query_invalid", "Invalid usage range or surface", 400);
+  }
+  let window;
+  try { window = parseUsageTimeWindow(query.get("since"), query.get("until")); }
+  catch { return error("hub_usage_query_invalid", "Invalid usage time window", 400); }
+  try {
+    const aggregate = await getFilteredUsageAggregate({
+      apiKeyId: keyId, provider: query.get("provider"), model: query.get("model"),
+    }, window);
+    const current = resolveDataPlaneAdmissionSecret(token, config);
+    if (current?.kind !== "configured" || current.keyId !== keyId) {
+      return error("hub_usage_unauthorized", "The client key changed during the read", 401);
+    }
+    const summary = aggregate.accumulator.summarize(parseRange(rangeInput), Date.now(), parseUsageSurface(surfaceInput));
+    const body = parseHubUsage({ ...summary, schemaVersion: 1, source: "hub", scope: "client",
+      ...(aggregate.usageIncomplete ? { usageIncomplete: true, usageIncompleteReason: "oversized_rows" } : {}),
+    });
+    if (!body) return error("hub_usage_unavailable", "Usage could not be represented; narrow the requested range", 503);
+    if (Buffer.byteLength(JSON.stringify(body), "utf8") > MAX_HUB_USAGE_BYTES) {
+      return error("hub_usage_too_large", "Usage exceeds the response bound; narrow the requested range", 507);
+    }
+    return reply(body);
+  } catch {
+    return error("hub_usage_read_failed", "Hub usage could not be read", 503);
+  }
+}

package/src/server/images.ts

@@ -19,6 +19,7 @@ import {
   cooldownErrorResponse,
   CodexAuthContextError,
   CodexMainProfileDrainingError,
+  CodexModelAvailabilityError,
   CodexPoolAuthenticationError,
   CodexThreadAffinityExpiredError,
 } from "../codex/auth-context";
@@ -49,6 +50,7 @@ import { findXaiProvider, resolveXaiImageAuthToken } from "../images/plan";
 import { callXaiImages } from "../images/xai-client";
 import type { AdmissionLease } from "../lib/admission";
 import { codexAccountSelectionForTurn } from "./lifecycle";
+import { codexModelAvailabilityErrorResponse } from "./responses/codex-auth-error";
 
 export type ImagesEndpoint = "generations" | "edits";
 
@@ -674,6 +676,8 @@ export async function handleImages(
         const safeAccountLabel = formatCodexProviderForLog("openai", err.accountId, config);
         console.error(`[images] Pool account ${safeAccountLabel} token failed; reauthentication required`);
         forwardAuthError = formatErrorResponse(401, "authentication_error", "Selected Codex account needs reauthentication");
+      } else if (err instanceof CodexModelAvailabilityError) {
+        forwardAuthError = codexModelAvailabilityErrorResponse(err);
       } else if (err instanceof CodexPoolAuthenticationError) {
         forwardAuthError = formatErrorResponse(401, "authentication_error", err.message);
       } else {