@bitkyc08/opencodex 2.55.0 → 2.57.0

package/src/web-search/parse.ts

@@ -12,7 +12,7 @@ export type WebSearchSource = SafeWebSearchSource;
 export interface WebSearchResult {
   text: string;
   sources: WebSearchSource[];
-  /** Set only when the stream surfaced an error AND produced no usable answer text. */
+  /** Set when the stream failed, including when partial text was decoded before failure. */
   error?: string;
 }
 
@@ -31,9 +31,12 @@ interface OutputItem {
   content?: OutputTextBlock[];
 }
 
-// ChatGPT's Codex backend does not accept `max_output_tokens` on sidecar requests. Bound the raw
-// streamed response here, before decoded text and authoritative/delta copies can accumulate.
+// Keep this compatibility export for non-Responses sidecar executors and bounded error bodies.
 export const MAX_SIDECAR_RESPONSE_BYTES = 64 * 1024;
+// Responses SSE can spend far more wire bytes on JSON framing than on useful model output. Keep a
+// larger finite wire ceiling while separately bounding the decoded text copies accumulated below.
+export const MAX_SIDECAR_STREAM_BYTES = MAX_SIDECAR_RESPONSE_BYTES * 16;
+export const MAX_SIDECAR_DECODED_CHARS = 64 * 1024;
 
 /** Push a `url_citation` annotation as a source, de-duplicated by URL. */
 function collectAnnotation(ann: AnnotationLike | undefined, sources: WebSearchSource[], seen: Set<string>): void {
@@ -208,10 +211,11 @@ export function cancelReaderWithoutWaiting(
  * `response.output_text.done` text; falls back to accumulated `response.output_text.delta`. Sources are
  * collected from EVERY shape they arrive in — `response.output_text.annotation.added` events (the
  * streaming path, which earlier testing missed → empty citations), `done`-block `annotations[]`, and
- * the final output[]. `response.failed`/`error` events surface as `error` when no answer text was produced.
+ * the final output[]. A terminal failure, a safety bound, or EOF before a terminal event surfaces as
+ * `error` even when partial answer text was decoded.
  */
 export async function parseSidecarSSE(response: Response): Promise<WebSearchResult> {
-  if (!response.body) return { text: "", sources: [] };
+  if (!response.body) return { text: "", sources: [], error: "sidecar stream returned no response body" };
   const reader = response.body.getReader();
   const decoder = new TextDecoder();
   let buffer = "";
@@ -224,10 +228,37 @@ export async function parseSidecarSSE(response: Response): Promise<WebSearchResu
     final: WebSearchResult | null;
     streamSources: WebSearchSource[];
     error: string | null;
-  } = { deltaText: "", doneText: "", final: null, streamSources: [], error: null };
+    decodedChars: number;
+    terminalEvent: boolean;
+    limitReached: boolean;
+  } = {
+    deltaText: "",
+    doneText: "",
+    final: null,
+    streamSources: [],
+    error: null,
+    decodedChars: 0,
+    terminalEvent: false,
+    limitReached: false,
+  };
+
+  const acceptDecodedChars = (count: number): boolean => {
+    if (count > MAX_SIDECAR_DECODED_CHARS - acc.decodedChars) {
+      acc.error = "sidecar response decoded text limit reached";
+      acc.limitReached = true;
+      return false;
+    }
+    acc.decodedChars += count;
+    return true;
+  };
 
   const handle = (payload: string): void => {
-    if (!payload || payload === "[DONE]") return;
+    if (!payload) return;
+    if (payload === "[DONE]") {
+      acc.terminalEvent = true;
+      return;
+    }
+    if (acc.limitReached) return;
     // Neither warning below copies the frame's content. An upstream SSE payload can carry model
     // output or credential material, and a malformed frame is exactly the case where the content
     // is least trustworthy. Length plus a classification separates the two failure modes in a log
@@ -247,19 +278,27 @@ export async function parseSidecarSSE(response: Response): Promise<WebSearchResu
     const data = parsed as Record<string, unknown>;
     const type = data.type as string | undefined;
     if (type === "response.output_text.delta" && typeof data.delta === "string") {
-      acc.deltaText += data.delta;
+      if (acceptDecodedChars(data.delta.length)) acc.deltaText += data.delta;
     } else if (type === "response.output_text.done" && typeof data.text === "string") {
       // The `done` event carries the full, authoritative text for one content part.
-      acc.doneText += data.text;
+      if (acceptDecodedChars(data.text.length)) acc.doneText += data.text;
     } else if (type === "response.completed" || type === "response.done") {
+      acc.terminalEvent = true;
       const resp = data.response as { output?: OutputItem[] } | undefined;
-      if (resp?.output) acc.final = fromOutputArray(resp.output, seen);
+      if (resp?.output) {
+        const final = fromOutputArray(resp.output, seen);
+        if (acceptDecodedChars(final.text.length)) acc.final = final;
+      }
     } else if (type === "response.failed" || type === "response.incomplete" || type === "error") {
+      acc.terminalEvent = true;
       const resp = data.response as { error?: { message?: string } } | undefined;
       const msg = resp?.error?.message
         ?? (data.error as { message?: string } | undefined)?.message
         ?? (typeof data.message === "string" ? data.message : undefined);
-      if (msg) acc.error = msg;
+      acc.error = msg ?? `sidecar stream ended with ${type}`;
+    } else if (type?.includes("reasoning") && typeof data.delta === "string") {
+      // Reasoning is not returned, but it is still decoded payload retained transiently by JSON.parse.
+      acceptDecodedChars(data.delta.length);
     }
     // Citations stream as a dedicated `response.output_text.annotation.added` event (singular
     // `annotation`); capture it regardless of the exact event name so they aren't lost.
@@ -270,7 +309,7 @@ export async function parseSidecarSSE(response: Response): Promise<WebSearchResu
     while (true) {
       const { done, value } = await reader.read();
       if (done) break;
-      const remaining = MAX_SIDECAR_RESPONSE_BYTES - responseBytes;
+      const remaining = MAX_SIDECAR_STREAM_BYTES - responseBytes;
       const accepted = value.byteLength <= remaining ? value : value.subarray(0, remaining);
       responseBytes += accepted.byteLength;
       buffer += decoder.decode(accepted, { stream: true });
@@ -280,11 +319,24 @@ export async function parseSidecarSSE(response: Response): Promise<WebSearchResu
         const data = sseFieldValue(line, "data");
         if (data !== null) handle(data.trim());
       }
-      if (responseBytes >= MAX_SIDECAR_RESPONSE_BYTES) {
+      if (acc.limitReached) {
+        cancelReaderWithoutWaiting(reader, "sidecar response decoded text limit reached");
+        buffer = "";
+        break;
+      }
+      if (acc.terminalEvent) {
+        cancelReaderWithoutWaiting(reader, "sidecar terminal event received");
+        buffer = "";
+        break;
+      }
+      if (responseBytes >= MAX_SIDECAR_STREAM_BYTES) {
         // Preserve complete events accepted up to the cap, but discard any unterminated line and
         // TextDecoder carry. Do not let a rejecting/hung cancel turn bounded partial output into
         // an error or keep this parser waiting on upstream teardown.
         cancelReaderWithoutWaiting(reader, "sidecar response byte limit reached");
+        acc.error = "sidecar response byte limit reached before terminal event";
+        acc.limitReached = true;
+        buffer = "";
         break;
       }
     }
@@ -310,6 +362,7 @@ export async function parseSidecarSSE(response: Response): Promise<WebSearchResu
     appendSafeWebSearchSource(sources, s);
   }
   const finalText = stripped ? body : (typeof text === "string" ? text : "");
-  if (!finalText.trim() && acc.error) return { text: "", sources, error: acc.error };
+  const error = acc.error ?? (!acc.terminalEvent ? "sidecar stream ended before terminal event" : null);
+  if (error) return { text: finalText, sources, error };
   return { text: finalText, sources };
 }

package/src/web-search/passthrough-bridge.ts

@@ -128,6 +128,22 @@ const MAX_QUERIES_PER_CALL = 3;
 const MAX_RETAINED_OUTPUT_ITEMS = 500;
 /** Refuse to buffer an unbounded partial SSE event from a misbehaving upstream. */
 const MAX_SSE_BUFFER_CHARS = 8 * 1024 * 1024;
+/** UTF-16 code units in SSE data payloads, not a byte or total-heap measurement. */
+const MAX_HELD_CALL_CHARS = 8 * 1024 * 1024;
+/**
+ * Derived from MAX_HELD_CALL_CHARS rather than picked, so the two bounds bind at the same
+ * scale. The character budget is the real memory guard; this count only adds the per-event
+ * object overhead the character budget cannot see. A fine-grained argument delta serializes
+ * to roughly 128 code units -- an envelope of about 110 characters carrying the item id and
+ * output index, plus a token-sized fragment -- so 8 MiB of them is 65,536 events. The count
+ * therefore bites only for events smaller than that average. A flat 1,000 discarded a
+ * legitimate client-executed tool call: a sizeable apply_patch streamed as fine-grained
+ * deltas is ordinary, not exotic, and failing its leg trades one failure for another.
+ */
+export const MAX_HELD_CALL_EVENTS = MAX_HELD_CALL_CHARS / 128;
+
+/** A proxy-side admission bound, never an upstream transport failure. */
+class HeldCallBudgetExceededError extends Error {}
 
 /**
  * Retained for importers that pinned the first slice's contract: a leg mixing the search with
@@ -488,6 +504,7 @@ class BridgeStreamState {
    * failing the turn would let Codex start running a tool for a turn that never completes.
    */
   private heldCalls: HeldCallEvent[] = [];
+  private heldCallChars = 0;
   private heldIndexes = new Set<number>();
   private heldItemIds = new Set<string>();
   private terminalPayload: Record<string, unknown> | undefined;
@@ -497,9 +514,7 @@ class BridgeStreamState {
     this.suppressedSearches = new Map();
     this.suppressedItemIds = new Map();
     this.searches = [];
-    this.heldCalls = [];
-    this.heldIndexes = new Set();
-    this.heldItemIds = new Set();
+    this.dropHeldCalls();
     this.terminalPayload = undefined;
   }
 
@@ -507,6 +522,17 @@ class BridgeStreamState {
     return this.heldCalls.length > 0;
   }
 
+  private holdCall(payload: Record<string, unknown>, dataChars: number, upstreamIndex?: number): void {
+    if (this.heldCalls.length >= MAX_HELD_CALL_EVENTS
+      || dataChars > MAX_HELD_CALL_CHARS - this.heldCallChars) {
+      throw new HeldCallBudgetExceededError(
+        "web-search bridge withheld more client tool events than its per-leg buffer bound allows",
+      );
+    }
+    this.heldCalls.push({ payload, ...(upstreamIndex === undefined ? {} : { upstreamIndex }) });
+    this.heldCallChars += dataChars;
+  }
+
   private clientIndexFor(upstreamIndex: number): number {
     const existing = this.indexMap.get(upstreamIndex);
     if (existing !== undefined) return existing;
@@ -626,7 +652,7 @@ class BridgeStreamState {
       if (isClientExecutedItem(item)) {
         if (upstreamIndex !== undefined) this.heldIndexes.add(upstreamIndex);
         if (typeof item.id === "string") this.heldItemIds.add(item.id);
-        this.heldCalls.push({ payload, ...(upstreamIndex === undefined ? {} : { upstreamIndex }) });
+        this.holdCall(payload, data.length, upstreamIndex);
         return [];
       }
     }
@@ -648,7 +674,7 @@ class BridgeStreamState {
 
     if ((upstreamIndex !== undefined && this.heldIndexes.has(upstreamIndex))
       || (itemId !== undefined && this.heldItemIds.has(itemId))) {
-      this.heldCalls.push({ payload, ...(upstreamIndex === undefined ? {} : { upstreamIndex }) });
+      this.holdCall(payload, data.length, upstreamIndex);
       return [];
     }
 
@@ -658,19 +684,20 @@ class BridgeStreamState {
     return [this.render(payload.type, rewritten)];
   }
 
-  /** Release the withheld client tool calls once the turn is known to end here. */
-  flushHeldCalls(): string[] {
-    const blocks: string[] = [];
-    for (const held of this.heldCalls) {
-      const rewritten: Record<string, unknown> = { ...held.payload };
-      if (held.upstreamIndex !== undefined) {
-        rewritten.output_index = this.clientIndexFor(held.upstreamIndex);
+  /** Release lazily so flushing does not allocate a second full set of serialized events. */
+  *flushHeldCalls(): Generator<string> {
+    try {
+      for (const held of this.heldCalls) {
+        const rewritten: Record<string, unknown> = { ...held.payload };
+        if (held.upstreamIndex !== undefined) {
+          rewritten.output_index = this.clientIndexFor(held.upstreamIndex);
+        }
+        if (held.payload.type === "response.output_item.done") this.retain(held.payload.item);
+        yield this.render(String(held.payload.type), rewritten);
       }
-      if (held.payload.type === "response.output_item.done") this.retain(held.payload.item);
-      blocks.push(this.render(String(held.payload.type), rewritten));
+    } finally {
+      this.dropHeldCalls();
     }
-    this.heldCalls = [];
-    return blocks;
   }
 
   /**
@@ -680,6 +707,18 @@ class BridgeStreamState {
    */
   dropHeldCalls(): void {
     this.heldCalls = [];
+    this.heldCallChars = 0;
+    this.heldIndexes.clear();
+    this.heldItemIds.clear();
+  }
+
+  /** Fail before executing this leg's searches, closing every cell already shown to the client. */
+  *failLegFrames(code: string, message: string): Generator<string> {
+    this.dropHeldCalls();
+    for (const call of this.searches) {
+      yield* this.searchEndFrames(call, [], { text: "", sources: [], error: message });
+    }
+    yield* this.failureFrames(code, message);
   }
 
   /** Decide what the leg's terminal means once the whole leg has been read. */
@@ -979,7 +1018,7 @@ async function* bridgeStreamBlocks(
   // One continuation leg per allowed search, plus one final leg for the answer itself.
   let legsRemaining = options.plan.maxSearches + 1;
 
-  const emit = function* (blocks: readonly string[]): Generator<string> {
+  const emit = function* (blocks: Iterable<string>): Generator<string> {
     for (const block of blocks) yield block + "\n\n";
   };
 
@@ -991,10 +1030,15 @@ async function* bridgeStreamBlocks(
         if (aborted()) return;
       }
     } catch (error) {
+      if (aborted()) return;
       const message = error instanceof Error ? error.message : String(error);
-      yield* emit(state.failureFrames(
+      // A held-event overflow is this proxy's own bound. Attributing it to an upstream read
+      // failure would blame the provider for a refusal the bridge made.
+      yield* emit(state.failLegFrames(
         WEB_SEARCH_BRIDGE_ERROR_CODE,
-        "web-search bridge upstream read failed: " + message,
+        error instanceof HeldCallBudgetExceededError
+          ? message
+          : "web-search bridge upstream read failed: " + message,
       ));
       return;
     }
@@ -1003,18 +1047,7 @@ async function* bridgeStreamBlocks(
 
     const decision = state.decide(legsRemaining);
     if (decision.kind === "fail") {
-      // Close any cell this leg opened, or Codex keeps a "Searching the web" spinner running
-      // under a failed turn (the same reason src/bridge.ts closes a dangling search on teardown).
-      for (const call of decision.searches) {
-        yield* emit(state.searchEndFrames(call, [], {
-          text: "",
-          sources: [],
-          error: decision.message!,
-        }));
-      }
-      // The withheld client call is deliberately dropped: the turn is ending as failed, and
-      // releasing a tool call Codex would start executing is exactly what must not happen.
-      yield* emit(state.failureFrames(decision.code!, decision.message!));
+      yield* emit(state.failLegFrames(decision.code!, decision.message!));
       return;
     }
     if (decision.kind === "end") {

package/src/web-search/xai-executor.ts

@@ -110,7 +110,7 @@ export async function runXaiWebSearch(
         // Credential-bearing: never follow a redirect off the pinned origin.
         redirect: "manual",
       }, recovery)),
-      { abortSignal: linkedSignal.signal, label: "xai-web-search-sidecar" },
+      { replaySafe: true, abortSignal: linkedSignal.signal, label: "xai-web-search-sidecar" },
     );
     const detachBodyGuard = cancelBodyOnAbort(res.body, linkedSignal.signal);
     if (!res.ok) {