@bitkyc08/opencodex 2.55.0 → 2.57.0

package/src/server/responses/passthrough-error.ts

@@ -1,5 +1,6 @@
 import { formatErrorResponse } from "../../bridge";
 import { isCyberPolicyCode, isCyberPolicyMessage } from "../../lib/errors";
+import { isReplayRefusalCode, UPSTREAM_RESET_REPLAY_REFUSED_CODE } from "../../lib/upstream-retry";
 import {
   resolveClientRetryAfter,
   validateClientRetryAfterHeader,
@@ -24,6 +25,26 @@ function isCyberPolicyBody(body: string): boolean {
   return false;
 }
 
+/**
+ * True for a body this proxy wrote to refuse replaying an ambiguous pre-header reset.
+ *
+ * It is read off the body rather than a marker because this formatter is handed bytes, not
+ * the response they came from, and the refusal reaches it after the original body was read.
+ * The code is this proxy's own, so an upstream echoing it is not a case worth widening for.
+ */
+function isReplayRefusalBody(body: string): boolean {
+  if (!body.includes(UPSTREAM_RESET_REPLAY_REFUSED_CODE)) return false;
+  try {
+    const parsed = JSON.parse(body) as Record<string, unknown>;
+    const error = parsed.error && typeof parsed.error === "object" && !Array.isArray(parsed.error)
+      ? parsed.error as Record<string, unknown>
+      : undefined;
+    return isReplayRefusalCode(error?.code) || isReplayRefusalCode(parsed.code);
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Passthrough adapters historically relayed upstream non-2xx bodies verbatim.
  * Codex maps an *empty* body to the literal client string "Unknown error"
@@ -38,6 +59,9 @@ function isCyberPolicyBody(body: string): boolean {
  * - missing/malformed values are replaced when resolveClientRetryAfter yields a value
  * - malformed/expired values are removed when the resolver returns undefined
  *   (e.g. quota-exhausted 429s must not keep junk headers or get the synthetic "2")
+ * - a replay refusal this proxy wrote gets none and keeps none: the whole point of the
+ *   refusal is that the turn may already be running, and the synthetic default for a
+ *   retryable 429 is a direct instruction to the client to send it a second time
  */
 export function formatPassthroughUpstreamError(
   status: number,
@@ -46,6 +70,13 @@ export function formatPassthroughUpstreamError(
     statusText?: string;
     headers?: Headers;
     now?: number;
+    /**
+     * Provenance from the caller that still holds the response: this body is a refusal this
+     * proxy synthesized. The body check below is the fallback for a re-wrapped body, and it
+     * cannot answer at all when the bounded read returned nothing display-safe -- which is
+     * precisely when the empty-body branch would invent the retryable-429 default.
+     */
+    replayRefusal?: boolean;
   },
 ): Response {
   const trimmed = bodyText.trim();
@@ -53,7 +84,12 @@ export function formatPassthroughUpstreamError(
   const upstreamRetryAfter = options?.headers?.get("retry-after")?.trim() || undefined;
   const originalValid = validateClientRetryAfterHeader(upstreamRetryAfter, now);
   const cyberPolicyFailure = isCyberPolicyBody(trimmed);
-  const resolved = cyberPolicyFailure
+  // Two different reasons to answer with no wait at all, handled the same way: a hard policy
+  // block will not become servable, and a refusal we made was never a rate limit.
+  const suppressRetryAfter = cyberPolicyFailure
+    || options?.replayRefusal === true
+    || isReplayRefusalBody(trimmed);
+  const resolved = suppressRetryAfter
     ? undefined
     : resolveClientRetryAfter({
       status,
@@ -64,7 +100,7 @@ export function formatPassthroughUpstreamError(
 
   if (trimmed) {
     const needsSet = resolved !== undefined && upstreamRetryAfter !== resolved;
-    const needsDelete = (cyberPolicyFailure && upstreamRetryAfter !== undefined)
+    const needsDelete = (suppressRetryAfter && upstreamRetryAfter !== undefined)
       || (resolved === undefined
         && upstreamRetryAfter !== undefined
         && originalValid === undefined);

package/src/server/responses/passthrough-execution.ts

@@ -0,0 +1,54 @@
+import type {
+  ResponsesRequestContext,
+  ResponsesAdmissionState,
+  PassthroughAdmissionState,
+} from "./core-options";
+import type { PreparedResponsesRequest } from "./request-prepare";
+import type { ResponsesTransport } from "./request-transport";
+import type { ResponsesSidecarAuth } from "./request-sidecar-auth";
+import type { ResponsesEffects } from "./response-effects";
+import type { ResponsesSendBudget } from "./request-send-budget";
+import { preparePassthroughExchange } from "./passthrough-dispatch";
+import { deliverPassthroughResponse } from "./passthrough-delivery";
+import { releaseUpstreamHostAdmission } from "../../codex/upstream-host-health";
+import { releaseCodexAuthContextProbeLease } from "../../codex/auth-context";
+
+/** Owns the native host lease across dispatch, recovery, and response construction. */
+export async function executePassthroughResponse(
+  requestContext: ResponsesRequestContext,
+  admissionState: ResponsesAdmissionState,
+  requestState: PreparedResponsesRequest,
+  transportState: ResponsesTransport,
+  sidecarState: ResponsesSidecarAuth,
+  responseEffects: ResponsesEffects,
+  sendBudgetState: ResponsesSendBudget,
+): Promise<Response> {
+  const nativeHostState: PassthroughAdmissionState = { lease: admissionState.pendingHostAdmissionLease };
+  admissionState.pendingHostAdmissionLease = null;
+  try {
+    const nativeExchange = await preparePassthroughExchange(
+      requestContext,
+      admissionState,
+      nativeHostState,
+      requestState,
+      transportState,
+      responseEffects,
+      sendBudgetState,
+    );
+    if (nativeExchange instanceof Response) return nativeExchange;
+    return await deliverPassthroughResponse(
+      requestContext,
+      admissionState,
+      requestState,
+      transportState,
+      sidecarState,
+      responseEffects,
+      nativeExchange,
+    );
+  } finally {
+    if (nativeHostState.lease) {
+      releaseUpstreamHostAdmission(nativeHostState.lease);
+      releaseCodexAuthContextProbeLease(admissionState.authCtx);
+    }
+  }
+}