@bitkyc08/opencodex 2.55.0 → 2.57.0

package/src/server/responses/encrypted-payload.ts

@@ -78,7 +78,6 @@ import {
   catalogModelSupportsServiceTier,
   finishRequestAttempt,
   inspectResponseLogJson,
-  noteAttemptSend,
   readConfiguredCodexServiceTier,
   requestLogSpeedLabel,
   sealRequestAttemptIdentity,

package/src/server/responses/input-admission.ts

@@ -10,7 +10,13 @@
  * catches the pathological case and stays out of the way otherwise. Every uncertainty
  * resolves toward admitting.
  */
-import { nativeOpenAiContextWindow, nativeOpenAiMaxInputTokens, type NativeContextLimitsInput } from "../../codex/catalog/metadata";
+import {
+  nativeOpenAiContextWindow,
+  nativeOpenAiMaxInputTokens,
+  nativeOpenAiMaxOutputTokens,
+  type NativeContextLimitsInput,
+} from "../../codex/catalog/metadata";
+import { getModelMetadata } from "../../generated/model-metadata";
 import { estimateTokens } from "../../lib/token-estimate";
 import { isCanonicalOpenAiForwardProvider, OPENAI_CODEX_PROVIDER_ID } from "../../providers/openai-tiers";
 import { modelRecordValue } from "../../reasoning-effort";
@@ -54,6 +60,8 @@ export interface InputAdmissionResult {
   estimatedTokens: number;
   /** Resolved ceiling, or null when nothing could be resolved (=> always admitted). */
   ceiling: number | null;
+  /** Output space reserved by the combo preflight; absent on the loose direct gate. */
+  requiredOutputHeadroom?: number;
 }
 
 function positive(value: unknown): number | null {
@@ -135,14 +143,19 @@ export function estimateInputTokens(parsed: OcxParsedRequest, modelId: string):
  * reject a user-defined provider that merely shares a built-in name using limits that
  * belong to a different service.
  */
-export function resolveInputCeiling(
+interface ResolvedContextLimits {
+  /** The target's total context window: input and output share it. */
+  window: number | null;
+  /** Largest admissible input, which input-only caps may tighten below the window. */
+  ceiling: number | null;
+}
+
+function resolveContextLimits(
   provider: OcxProviderConfig,
   providerName: string,
   modelId: string,
-  // Operator cap for the canonical native provider. Passed in rather than read from a
-  // config here so this stays pure: no filesystem, no catalog, no registry scan.
   nativeContextCap?: NativeContextLimitsInput,
-): number | null {
+): ResolvedContextLimits {
   // `modelRecordValue`, not a bare lookup: the catalog resolves these same two maps that
   // way, so a `gpt-oss` entry covers `gpt-oss:120b`. Reading raw here made the gate fall
   // back to the provider-wide window and refuse turns the model can plainly hold.
@@ -168,13 +181,120 @@ export function resolveInputCeiling(
     : null;
   const nativeMaxInput = canonicalNativeBare ? positive(nativeOpenAiMaxInputTokens(modelId, nativeLimits)) : null;
 
-  const window = canonicalNativeBare ? native : configured;
+  const window = canonicalNativeBare ? (native ?? generatedNativeWindow(modelId, configured, nativeContextCap)) : configured;
   // modelMaxInputTokens is an input-only cap, so it can only tighten the window.
   const configuredMaxInput = positive(modelRecordValue(provider.modelMaxInputTokens, modelId));
   const limits = [window, configuredMaxInput, nativeMaxInput].filter((v): v is number => v !== null);
+  return { window, ceiling: limits.length === 0 ? null : Math.min(...limits) };
+}
+
+/**
+ * Generated-catalog keys, not routing provider names. `OPENAI_CODEX_PROVIDER_ID` is the string
+ * `"openai"` -- the canonical Codex forward route -- so using it to index the generated bundle
+ * would silently skip the native Codex rows and read the public API rows instead.
+ */
+const NATIVE_METADATA_CATALOGS = ["openai-codex", "openai"] as const;
+
+/**
+ * Static in-tree metadata for a canonical native slug the narrower override and pinned-native
+ * tables do not carry. Falling through to null made input admission completely blind for
+ * exactly those models, which is how a 128k target accepted a turn it could not finish.
+ *
+ * This deliberately covers slugs that are no longer offered in the picker: a retired slug is
+ * still dispatchable when an operator names it explicitly in a combo target, and that is the
+ * configuration where the gate was inert. This is a generated bundle compiled into the binary,
+ * not a live catalog read, so it adds no I/O. Explicit provider and operator caps may only
+ * narrow the result, never widen it.
+ */
+function generatedNativeWindow(
+  modelId: string,
+  configured: number | null,
+  nativeContextCap: NativeContextLimitsInput | undefined,
+): number | null {
+  let generated: number | null = null;
+  for (const catalog of NATIVE_METADATA_CATALOGS) {
+    generated = positive(getModelMetadata(catalog, modelId)?.contextWindow);
+    if (generated !== null) break;
+  }
+  if (generated === null) return null;
+  const cap = typeof nativeContextCap === "number"
+    ? positive(nativeContextCap)
+    : positive(nativeContextCap?.cap);
+  return Math.min(generated, configured ?? generated, cap ?? generated);
+}
+
+export function resolveInputCeiling(
+  provider: OcxProviderConfig,
+  providerName: string,
+  modelId: string,
+  // Operator cap for the canonical native provider. Passed in rather than read from a
+  // config here so this stays pure: no filesystem, no catalog, no registry scan.
+  nativeContextCap?: NativeContextLimitsInput,
+): number | null {
+  return resolveContextLimits(provider, providerName, modelId, nativeContextCap).ceiling;
+}
+
+/**
+ * Largest output the concrete target can emit. Used only to avoid reserving MORE than the
+ * target could ever produce when a client asks for a bigger allowance than the model has.
+ * Unknown stays unknown rather than inventing a capability.
+ */
+export function resolveOutputCeiling(
+  provider: OcxProviderConfig,
+  providerName: string,
+  modelId: string,
+): number | null {
+  const configured = positive(modelRecordValue(provider.modelMaxOutputTokens, modelId))
+    ?? positive(provider.defaultMaxOutputTokens);
+  const canonicalNativeBare = providerName === OPENAI_CODEX_PROVIDER_ID
+    && isCanonicalOpenAiForwardProvider(provider)
+    && !modelId.includes("/");
+  const native = canonicalNativeBare ? positive(nativeOpenAiMaxOutputTokens(modelId)) : null;
+  const limits = [configured, native].filter((v): v is number => v !== null);
   return limits.length === 0 ? null : Math.min(...limits);
 }
 
+/**
+ * Combo-only admission. A fallback must be able to satisfy the caller's declared output
+ * allowance inside its OWN context window. Otherwise it returns 200, emits a few hundred
+ * tokens, and terminates on `finish_reason: length` — which the Anthropic surface renders as
+ * "response exceeded the output token maximum" even though the real cause was the total
+ * window. By then the next target cannot be tried, because output has already committed.
+ *
+ * Two budgets are checked separately so the reserve is counted exactly once. `ceiling` is an
+ * input-only budget once `modelMaxInputTokens` tightens it below the window, so the output
+ * reserve belongs against `window`, not against `ceiling`.
+ *
+ * Direct and single-target requests keep the deliberately loose 2.5x pathological-input gate.
+ * This stricter rule applies only to synthetic combo children, where skipping one known-small
+ * target is safe and the ladder continues before any upstream bytes are sent. Unknown context
+ * stays fail-open, and a caller that declared no output allowance is unaffected.
+ */
+export function checkComboTargetInputAdmission(
+  parsed: OcxParsedRequest,
+  provider: OcxProviderConfig,
+  providerName: string,
+  modelId: string,
+  nativeContextCap?: NativeContextLimitsInput,
+): InputAdmissionResult {
+  const { window, ceiling } = resolveContextLimits(provider, providerName, modelId, nativeContextCap);
+  const requestedOutput = positive(parsed.options.maxOutputTokens);
+  if (window === null || ceiling === null || requestedOutput === null) {
+    return checkInputAdmission(parsed, provider, providerName, modelId, nativeContextCap);
+  }
+  const targetOutput = resolveOutputCeiling(provider, providerName, modelId);
+  const requiredOutputHeadroom = targetOutput === null
+    ? requestedOutput
+    : Math.min(requestedOutput, targetOutput);
+  const estimatedTokens = estimateInputTokens(parsed, modelId);
+  return {
+    admitted: estimatedTokens <= ceiling && estimatedTokens + requiredOutputHeadroom <= window,
+    estimatedTokens,
+    ceiling,
+    requiredOutputHeadroom,
+  };
+}
+
 /**
  * Fail-open when no ceiling is known; refuse only past `ceiling * ADMISSION_TOLERANCE`.
  *