@bitkyc08/opencodex 2.54.0-preview.20260914 → 2.55.0-preview.20260914

package/src/server/chat-native.ts

@@ -1,4 +1,5 @@
 import { buildOpenAIChatPassthroughRequest, createOpenAIChatAdapter } from "../adapters/openai-chat";
+import { chatBodyCarriesImage, chatBodyCarriesToolResultImage } from "../chat/image-parts";
 import type { AdapterRequest, ProviderAdapter } from "../adapters/base";
 import {
   chatCompletionsErrorBody,
@@ -19,7 +20,7 @@ import type { AdmissionLease } from "../lib/admission";
 import { readBoundedResponseBody } from "../lib/bounded-body";
 import { redactSecretString } from "../lib/redact";
 import { resolveClientRetryAfter } from "../lib/retry-after";
-import { isModelTextOnly } from "../vision";
+import { isModelTextOnly, requiresVisionPreprocessing } from "../vision";
 import {
   applyUpstreamRecoveryInit,
   fetchWithResetRetry,
@@ -138,7 +139,7 @@ function isRec(value: unknown): value is Rec {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 
-export function isNativeChatRouteEligible(route: RouteResult, rawBody: Rec): boolean {
+export function isNativeChatRouteEligible(route: RouteResult, rawBody: Rec, config?: OcxConfig): boolean {
   const provider = route.provider;
   if (provider.adapter !== "openai-chat") return false;
   if (provider.authMode !== undefined && provider.authMode !== "key" && provider.authMode !== "local") return false;
@@ -147,12 +148,24 @@ export function isNativeChatRouteEligible(route: RouteResult, rawBody: Rec): boo
   if (rawBody.store === true || rawBody.background === true) return false;
   if (typeof rawBody.previous_response_id === "string" && rawBody.previous_response_id.length > 0) return false;
   if (rawBody.compaction_trigger !== undefined) return false;
+  // A standard Chat tool message accepts a string or text parts, not image_url, so
+  // normalizing a Pi/Anthropic tool image into image_url is not enough on its own —
+  // the part is still inside a tool message. The translated adapter already places
+  // tool-result images in a following user carrier after the complete paired batch
+  // (flushToolResultImages), so divert these requests there. Ordinary user images and
+  // text-only tool results keep the native fast path.
+  if (chatBodyCarriesToolResultImage(rawBody)) return false;
   // Vision sidecar coverage (roadmap 180): a text-only routed model with an
   // image-bearing body must go through the Responses pipeline, whose plan
   // site describes or strips the image. The native fast path has no vision
   // handling, so letting it keep such a request forwards raw pixels to a
   // model the operator declared blind.
-  if (isModelTextOnly(provider, route.modelId) && chatBodyCarriesImage(rawBody)) return false;
+  if (chatBodyCarriesImage(rawBody)) {
+    const needsVision = config
+      ? requiresVisionPreprocessing(config, provider, route.modelId, route.providerName)
+      : isModelTextOnly(provider, route.modelId);
+    if (needsVision) return false;
+  }
   if (Array.isArray(rawBody.tools)) {
     for (const tool of rawBody.tools) {
       if (!isRec(tool)) continue;
@@ -164,19 +177,6 @@ export function isNativeChatRouteEligible(route: RouteResult, rawBody: Rec): boo
   return true;
 }
 
-/** Any messages[].content[] part of type image_url. */
-function chatBodyCarriesImage(rawBody: Rec): boolean {
-  const messages = rawBody.messages;
-  if (!Array.isArray(messages)) return false;
-  for (const message of messages) {
-    if (!isRec(message) || !Array.isArray(message.content)) continue;
-    for (const part of message.content) {
-      if (isRec(part) && part.type === "image_url") return true;
-    }
-  }
-  return false;
-}
-
 function chatCompletionJson(value: unknown): Rec | null {
   if (!isRec(value) || !Array.isArray(value.choices) || value.choices.length === 0) return null;
   return value;
@@ -326,7 +326,7 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
               dispatchOverride: async (_input, init, execute) => {
                 if (!providerApiKeySelectionIsCurrent(config, route.providerName, activeProvider)) {
                   const current = resolveCurrentProviderApiKeyTransport(config, route.providerName, activeProvider);
-                  if (!current || !isNativeChatRouteEligible({ ...route, provider: current }, options.chatBody)) {
+                  if (!current || !isNativeChatRouteEligible({ ...route, provider: current }, options.chatBody, config)) {
                     throw new Error("Provider key selection is no longer available for native Chat");
                   }
                   activeProvider = current;

package/src/server/index.ts

@@ -134,6 +134,7 @@ import {
   type RequestLogEntry,
 } from "./request-log";
 import { sessionLaneIdFromRequest } from "./request-log-conversation";
+import { admitWorkflowTurn, type WorkflowLane } from "../lib/workflow-budget";
 export {
   addFinalRequestLog,
   filterRequestLogs,
@@ -1292,13 +1293,36 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
   ): Promise<Response> {
     const lease = tryAdmitTurn(sessionLaneIdFromRequest(req.headers));
     if (!lease) return serverBusyResponse(req, "active turns", policy);
+    // A fan-out shares the conversation it serves. Without a reserve, a worker burst takes every
+    // slot under its own root and the interactive turn that started it waits behind its own
+    // children. A request that names a parent is treated as that fan-out; a top-level request is
+    // the conversation and may use the reserved slots.
+    const workflowRootId = req.headers.get("x-codex-parent-thread-id")?.trim() || undefined;
+    const workflowThreadId = req.headers.get("thread-id")?.trim() || undefined;
+    const workflowLane: WorkflowLane = workflowRootId !== undefined
+      && workflowThreadId !== undefined
+      && workflowThreadId !== workflowRootId
+      ? "worker"
+      : "interactive";
+    const workflow = admitWorkflowTurn(workflowRootId, workflowLane, undefined, workflowThreadId);
+    if (workflow && !workflow.admitted) {
+      lease.release();
+      return formatErrorResponse(
+        429,
+        workflow.reason === "workflow-sends-exhausted" ? "workflow_budget_exhausted" : "queue_capacity_exceeded",
+        "This task has reached its concurrent-work limit, so no further upstream request was made. Work already in flight settles as it finishes.",
+      );
+    }
+    const releaseWorkflow = (): void => { if (workflow?.admitted) workflow.lease.release(); };
     let response: Response;
     try {
       response = await work(lease);
     } catch (error) {
+      releaseWorkflow();
       lease.release();
       throw error;
     }
+    releaseWorkflow();
     if (!lease.isTransferred()) {
       lease.release();
     }

package/src/server/management/request-history-routes.ts

@@ -151,6 +151,11 @@ export async function handleRequestHistoryRoutes(ctx: ManagementContext): Promis
       return jsonResponse({
         requestId,
         routeDecision: trace,
+        // The account decision belongs in the why-this-route answer: a rebound with its cause is
+        // the difference between "the pool moved this conversation" and "this is a new session".
+        affinity: entry.affinity
+          ? { move: entry.affinity, reason: entry.affinityReason ?? null }
+          : null,
         attemptSequence: entry.attempts ?? [],
         outcome: {
           status: entry.status,

package/src/server/request-log.ts

@@ -12,6 +12,7 @@ import {
   upstreamErrorMessageFromPayload,
 } from "../lib/errors";
 import { CODEX_CONFIG_PATH, readRootTomlString } from "../codex/paths";
+import type { CodexAffinityMove, CodexAffinityReason } from "../codex/routing";
 import { readCodexCatalogPath } from "../codex/catalog";
 import type { AttemptTierOutcome, OcxProviderConfig, OcxUsage } from "../types";
 import { normalizeRouteDecisionTrace, type RouteDecisionTraceV1 } from "../routing/trace";
@@ -139,7 +140,9 @@ export interface RequestLogContext {
   errorCode?: string;
   /** Structured reason from `response.incomplete`; internal-only input to log classification. */
   terminalIncompleteReason?: string;
-  affinity?: "reused" | "new_bind" | "rebound" | "cleared";
+  affinity?: CodexAffinityMove;
+  /** Why the binding was kept, moved, or released (#4546). */
+  affinityReason?: CodexAffinityReason;
   transportPhase?: "pre_headers" | "mid_stream" | "terminal_sse";
   terminalSource?: "upstream" | "synthetic";
   /** Bounded route-decision trace (RI-01); never contains secrets. */
@@ -204,7 +207,9 @@ export interface RequestLogEntry {
   totalTokens?: number;
   attempts?: PersistedUsageAttempt[];
   /** Codex pool affinity decision for this request (diagnostics for #186). */
-  affinity?: "reused" | "new_bind" | "rebound" | "cleared";
+  affinity?: CodexAffinityMove;
+  /** Why that decision was made (#4546): a move is the expensive event, so it names its cause. */
+  affinityReason?: CodexAffinityReason;
   /** Where the upstream terminal/failure was observed. */
   transportPhase?: "pre_headers" | "mid_stream" | "terminal_sse";
   /** Whether the terminal came from a real upstream SSE event or a proxy synthetic tail. */
@@ -1080,6 +1085,7 @@ export function addFinalRequestLog(
     ...(totalTokens !== undefined ? { totalTokens } : {}),
     ...(attempts !== undefined ? { attempts } : {}),
     ...(logCtx.affinity ? { affinity: logCtx.affinity } : {}),
+    ...(logCtx.affinityReason ? { affinityReason: logCtx.affinityReason } : {}),
     ...(logCtx.transportPhase ? { transportPhase: logCtx.transportPhase } : {}),
     ...(logCtx.terminalSource ? { terminalSource: logCtx.terminalSource } : {}),
     ...(logCtx.routeDecision ? { routeDecision: logCtx.routeDecision } : {}),

package/src/server/responses/compact.ts

@@ -76,8 +76,14 @@ import {
   fetchWithResetRetry,
   fetchWithTransientRetry,
   applyUpstreamRecoveryInit,
+  SendBudgetExhaustedError,
+  TRANSIENT_RETRY_MAX_ATTEMPTS,
   type UpstreamSendRecovery,
 } from "../../lib/upstream-retry";
+import {
+  createRequestExecutionBudget,
+  type RequestExecutionBudget,
+} from "../../lib/request-execution-budget";
 import { classifyTransportFailureKind, transportErrorCode } from "../../lib/upstream-reachability";
 import {
   acquireUpstreamHostAdmission,
@@ -224,6 +230,14 @@ export interface HandleResponsesCompactOptions {
   nativeMainRefreshDependencies?: NativeMainRefreshDependencies;
   /** Release the listener's idle guard only after the complete request body is accepted. */
   onRequestBodyRead?: () => void;
+  /**
+   * The logical request's send budget (#4546). Compact used to hold its own: the normal send
+   * took a fresh transient allowance of three, the 401 replay and the 429 alternate each added
+   * one -- and the guard that was supposed to make those two mutually exclusive keys on
+   * `kind === "pool"`, so a main-pool credential could spend all five. The recursive handoff
+   * child then started over, so one compact could reach ten.
+   */
+  sendBudget?: RequestExecutionBudget;
 }
 
 export function compactResponseTooLargeError(): Response {
@@ -760,6 +774,10 @@ export async function handleResponsesCompact(
     // so routed-model reasoning items (reasoning_text content) don't 400 the ChatGPT backend.
     const compactBody = sanitizeReasoningInputContent(compactBodyRaw) as typeof compactBodyRaw;
     const compactUrl = `${base}/responses/compact`;
+    // One holder for this logical compact, inherited by the handoff child so a second model
+    // does not start over with a fresh four.
+    const sendBudget: RequestExecutionBudget = options.sendBudget ?? createRequestExecutionBudget();
+    const compactTargetKey = `${route.providerName}|${route.modelId}|compact`;
     const actualCompactHostKey = upstreamHostHealthKey(
       route.providerName,
       safeOriginLabel(compactUrl),
@@ -834,6 +852,27 @@ export async function handleResponsesCompact(
     // wrapping reset retry — because those retries happen before any alternate is even
     // considered. The alternate is one bounded send: a second ladder would multiply the
     // work an already-rejecting pool is doing.
+    //
+    // Both modes now draw one shared budget. The comment below used to say the 401 replay
+    // spends the account budget so the 429 alternate is skipped, but that guard is keyed on
+    // `kind === "pool"` and a main-pool credential left it false -- so 401 then 429 really did
+    // reach five. The single sends spend the base allowance first and then the one shared
+    // final-recovery reserve, which is the same rule the Responses path follows.
+    const sendSingleCompactAttempt = (
+      doFetch: () => Promise<Response>,
+    ): Promise<Response> => {
+      if (sendBudget.remainingBaseSends(TRANSIENT_RETRY_MAX_ATTEMPTS) > 0) {
+        sendBudget.used += 1;
+        return doFetch();
+      }
+      const decision = sendBudget.reserveDispatch({
+        sendClass: "auth-recovery",
+        targetKey: compactTargetKey,
+      });
+      if (!decision.allowed) return Promise.reject(new SendBudgetExhaustedError(safeHostLabel(compactUrl)));
+      if (!decision.permit.use()) return Promise.reject(new SendBudgetExhaustedError(safeHostLabel(compactUrl)));
+      return doFetch();
+    };
     const sendCompactAttempt = (
       sendProvider: OcxProviderConfig,
       sendHeaders: Headers,
@@ -866,8 +905,15 @@ export async function handleResponsesCompact(
         return res;
       });
       return recovery === "single"
-        ? doFetch()
-        : fetchWithTransientRetry(doFetch, { abortSignal: req.signal, label: safeHostLabel(compactUrl) });
+        ? sendSingleCompactAttempt(doFetch)
+        : fetchWithTransientRetry(doFetch, {
+          abortSignal: req.signal,
+          label: safeHostLabel(compactUrl),
+          // Draws the shared remainder instead of a fresh three. Compact is a native endpoint
+          // of the same logical turn, so its sends belong to the same cap.
+          attempts: sendBudget.remainingBaseSends(TRANSIENT_RETRY_MAX_ATTEMPTS),
+          onSendsConsumed: (used: number) => { sendBudget.used += Math.max(0, used); },
+        });
     };
 
     // The account each outcome belongs to. Reassigned only when the alternate send below
@@ -1133,7 +1179,9 @@ export async function handleResponsesCompact(
             logCtx,
             turnAdmissionLease,
             admission,
-            options,
+            // The handoff child is the same logical compact on a second model, so it inherits
+            // the holder. Forwarding `options` alone was not enough: the child minted its own.
+            { ...options, sendBudget },
           );
           if (fallback.ok || fallback.status === 499) return fallback;
           await fallback.body?.cancel().catch(() => undefined);