@bitkyc08/opencodex 2.55.0 → 2.57.0

package/src/codex/warmup.ts

@@ -44,7 +44,7 @@ async function drainErrorBody(res: Response, signal: AbortSignal): Promise<void>
       fatalUtf8: true,
     });
   } catch (error) {
-    if (signal.aborted) {
+    if (signal.aborted && res.status !== 429) {
       throw new CodexWarmupError("transport", "Codex warmup request failed", {
         cause: error,
       });

package/src/combos/failover.ts

@@ -401,11 +401,15 @@ export function comboFailureCooldownScope(
 ): ComboFailureCooldownScope {
   const code = normalizedFailureCode(options?.code);
   // Request-shape refusals first: an oversized request must not cool a healthy target.
+  // A native transport can surface a zero-output model overflow as a generic
+  // upstream_server_error carrying precise context-window prose, so consult the bounded
+  // message classifier too: that target is healthy, the turn was simply too large for it.
   if (
     status === 413
     || REQUEST_SHAPE_FAILURE_CODES.has(code)
     || isRequestLocalFreePromptCap(status, message, options?.code)
     || isProviderTargetContextOverflow(status, message, options?.code)
+    || isDefiniteContextOverflow(status, message)
     || isRequestLocalTargetIncompatibility(status, message, options?.code)
   ) return "none";
   if (isProviderScopedQuotaCap(status, message, options?.code)) return "provider";
@@ -451,6 +455,74 @@ function isProviderTargetContextOverflow(
     && /\bprompt\s+\d+\s*>\s*\d+\s+maximum context length\b/i.test(message);
 }
 
+/** A status can carry a verdict about the REQUEST; 401/403/429 speak about the credential. */
+const CONTEXT_VERDICT_STATUSES: ReadonlySet<number> = new Set([400, 413, 422]);
+
+/**
+ * Phrases a provider emits when the INPUT does not fit this model's context window. Matched
+ * against the innermost provider message only, so an unrelated refusal that merely quotes one
+ * of these tokens in a code field cannot authorize a replay.
+ */
+const DEFINITE_CONTEXT_OVERFLOW_PHRASES = [
+  "exceeds the context window",
+  "exceed the context window",
+  "context window exceeded",
+  "context length exceeded",
+  "maximum context length",
+  "maximum context window",
+  "too many tokens",
+];
+
+/** Wrapper envelopes unwrapped before the leaf message is read. */
+const MAX_CONTEXT_OVERFLOW_ENVELOPES = 4;
+
+function isDefiniteContextOverflowMessage(text: string): boolean {
+  const normalized = text.toLowerCase();
+  return normalized === "context_length_exceeded"
+    || DEFINITE_CONTEXT_OVERFLOW_PHRASES.some(phrase => normalized.includes(phrase));
+}
+
+/**
+ * Confirm a context overflow from the provider MESSAGE rather than from a code token that
+ * merely appears somewhere in the envelope. An upstream controls both fields and can emit a
+ * contradictory pair -- `context_length_exceeded` beside `Unsupported parameter: user` -- and
+ * that is not evidence the turn is too large for this model. `classifyError` reads the whole
+ * blob, which is exactly the looseness this must not inherit.
+ *
+ * A JSON-shaped body that fails to parse is truncated or corrupt, not prose: `classificationText`
+ * is capped at 500 characters by `normalizeUpstreamErrorText` before it reaches this function, so
+ * a long envelope arrives here as a JSON prefix. Reading that prefix as plain text would let an
+ * arbitrary field that happens to sit in the first 500 bytes authorize a hop, so it fails closed.
+ *
+ * Only the exact proxy wrapper is unwrapped, within a fixed envelope budget and 16,384 characters.
+ */
+function isDefiniteContextOverflow(status: number, message: string): boolean {
+  if (!CONTEXT_VERDICT_STATUSES.has(status) && status < 500) return false;
+  if (message.length > 16_384) return false;
+  let text = message.trim();
+  // One pass per unwrapped envelope, plus one for the leaf the last envelope yields.
+  for (let unwrapped = 0; unwrapped <= MAX_CONTEXT_OVERFLOW_ENVELOPES; unwrapped += 1) {
+    const providerPrefix = /^Provider error \d{3}:\s*/.exec(text);
+    if (providerPrefix) text = text.slice(providerPrefix[0].length).trim();
+    if (!text.startsWith("{")) return isDefiniteContextOverflowMessage(text);
+    if (unwrapped === MAX_CONTEXT_OVERFLOW_ENVELOPES) return false;
+    let payload: unknown;
+    try { payload = JSON.parse(text); } catch { return false; }
+    if (!payload || typeof payload !== "object" || Array.isArray(payload)) return false;
+    const record = payload as Record<string, unknown>;
+    const response = record.response && typeof record.response === "object" && !Array.isArray(record.response)
+      ? record.response as Record<string, unknown>
+      : undefined;
+    const source = [record.error, response?.error, response?.last_error, record.last_error, record]
+      .find((candidate): candidate is Record<string, unknown> =>
+        !!candidate && typeof candidate === "object" && !Array.isArray(candidate)
+        && typeof (candidate as Record<string, unknown>).message === "string");
+    if (!source) return false;
+    text = (source.message as string).trim();
+  }
+  return false;
+}
+
 export function comboFailureDecision(
   status: number,
   message: string,
@@ -458,6 +530,10 @@ export function comboFailureDecision(
 ): ComboFailureDecision {
   if (status === 499) return "stop";
   if (message.toLowerCase().includes("origin_rejected")) return "stop";
+  // Structured form of the same hard refusal. The prose test above misses it when the origin
+  // reports the code out of band, and every hop rule below -- including the context-overflow
+  // one -- must stay subordinate to it.
+  if (normalizedFailureCode(options?.code) === "origin_rejected") return "stop";
   // The origin may already be executing this turn (the Codex WebSocket relay sent the create
   // frame and never saw a response event). Hopping would send the same request to a second
   // target while the first may still be generating; the honest status goes to the client.
@@ -476,6 +552,15 @@ export function comboFailureDecision(
   // (for example 5059 + invalid_request_prompt_too_long). That is evidence that this
   // target is too small, not that every later combo target is incapable of serving it.
   if (isProviderTargetContextOverflow(status, message, options?.code)) return "hop";
+  // A definite context-window refusal is target-local inside a heterogeneous combo: this model
+  // cannot hold the turn, but a later target may have a larger window. Two boundaries keep this
+  // safe. It is reached only after cancellation, structured origin/cyber refusals and
+  // non-replayable post-send codes have already stopped. And it only ever classifies a failure
+  // the combo stream preflight already proved emitted no output: `comboStreamPayloadCommitsOutput`
+  // commits the child on any text, tool call or unknown event, and only a zero-output terminal
+  // becomes a failure response at all, so a turn whose text the client already saw is never
+  // reclassified here.
+  if (isDefiniteContextOverflow(status, message)) return "hop";
   // A local input-admission refusal (#1524) says "this candidate cannot fit the request",
   // not "the request is impossible": the next candidate may have a larger context window.
   //

package/src/combos/request.ts

@@ -1,5 +1,5 @@
-import type { OcxComboDefaultEffort, OcxComboReasoningEffortMode, OcxComboTarget, OcxConfig } from "../types";
-import { resolveEffortAtOrBelow } from "../reasoning-effort";
+import type { OcxComboDefaultEffort, OcxComboDefaultEffortMode, OcxComboReasoningEffortMode, OcxComboTarget, OcxConfig } from "../types";
+import { isCodexReasoningEffort, resolveEffortAtOrBelow } from "../reasoning-effort";
 import { resolveComboId } from "./types";
 
 const warnedUnsupportedDefaults = new Set<string>();
@@ -60,22 +60,29 @@ export function concreteComboRequestBody(
   defaultEffort: OcxComboDefaultEffort | null,
   targetReasoningEfforts: readonly string[] | undefined,
   reasoningEffortMode: OcxComboReasoningEffortMode = "strict",
+  defaultEffortMode: OcxComboDefaultEffortMode = "fallback",
 ): Record<string, unknown> {
   const clone = structuredClone(body) as Record<string, unknown>;
   clone.model = `${target.provider}/${target.model}`;
+  if (defaultEffortMode === "force" && (!defaultEffort || !isCodexReasoningEffort(defaultEffort))) {
+    throw new Error("force combo default effort requires a valid defaultEffort");
+  }
   if (targetReasoningEfforts?.length === 0
     || (reasoningEffortMode === "adaptive" && targetReasoningEfforts === undefined)) {
     stripUnsupportedReasoningControls(clone);
   }
-  if (!defaultEffort) return clone;
+  if (!defaultEffort || !isCodexReasoningEffort(defaultEffort)) return clone;
   const reasoning = clone.reasoning;
-  const needsDefault = reasoning === undefined || (
-    reasoning
-    && typeof reasoning === "object"
-    && !Array.isArray(reasoning)
-    && !Object.prototype.hasOwnProperty.call(reasoning, "effort")
-  );
-  if (!needsDefault) return clone;
+  const reasoningRecord = reasoning && typeof reasoning === "object" && !Array.isArray(reasoning)
+    ? reasoning as Record<string, unknown>
+    : undefined;
+  const hasEffort = reasoningRecord !== undefined
+    && Object.prototype.hasOwnProperty.call(reasoningRecord, "effort");
+  const callerEffort = reasoningRecord?.effort;
+  const validCallerEffort = typeof callerEffort === "string" && isCodexReasoningEffort(callerEffort);
+  const needsDefault = reasoning === undefined || (reasoningRecord !== undefined && !hasEffort);
+  const shouldForce = defaultEffortMode === "force" && validCallerEffort;
+  if (!needsDefault && !shouldForce) return clone;
   // Picker availability treats an unknown ladder as a wildcard, but runtime
   // injection stays fail-closed until this concrete target advertises support.
   //

package/src/combos/types.ts

@@ -1,6 +1,6 @@
 import { isCodexReasoningEffort } from "../reasoning-effort";
 import { SUPPORTED_NATIVE_OPENAI_SLUGS } from "../codex/catalog/native-models";
-import type { OcxComboConfig, OcxComboDefaultEffort, OcxComboReasoningEffortMode, OcxComboStrategy, OcxComboTarget, OcxProviderConfig } from "../types";
+import type { OcxComboConfig, OcxComboDefaultEffort, OcxComboDefaultEffortMode, OcxComboReasoningEffortMode, OcxComboStrategy, OcxComboTarget, OcxProviderConfig } from "../types";
 import { COMBO_NAMESPACE, isValidComboId, targetKey } from "./identifiers";
 
 export const COMBO_DEFAULT_WAIT_FOR_COOLDOWN_MS = 0;
@@ -26,6 +26,8 @@ export interface NormalizedComboConfig {
   cooldownMs?: number;
   waitForCooldownMs: number;
   defaultEffort: OcxComboDefaultEffort | null;
+  /** Client-precedence policy; `fallback` preserves legacy behavior. */
+  defaultEffortMode: OcxComboDefaultEffortMode;
   /** Picker-ladder derivation policy; `strict` preserves the legacy intersection rule. */
   reasoningEffortMode: OcxComboReasoningEffortMode;
   /** Disable image input; `auto` preserves the intersection derived from all targets. */
@@ -167,6 +169,21 @@ export function comboConfigIssues(
       message: "defaultEffort must be one of: low, medium, high, xhigh, max, ultra",
     });
   }
+  if (body.defaultEffortMode !== undefined
+    && body.defaultEffortMode !== "fallback"
+    && body.defaultEffortMode !== "force") {
+    issues.push({
+      path: ["defaultEffortMode"],
+      message: 'defaultEffortMode must be "fallback" or "force"',
+    });
+  }
+  if (body.defaultEffortMode === "force"
+    && (typeof body.defaultEffort !== "string" || !isCodexReasoningEffort(body.defaultEffort))) {
+    issues.push({
+      path: ["defaultEffort"],
+      message: "defaultEffort is required when defaultEffortMode is force",
+    });
+  }
   if (body.imageInput !== undefined && body.imageInput !== "auto" && body.imageInput !== "disabled") {
     issues.push({ path: ["imageInput"], message: 'imageInput must be "auto" or "disabled"' });
   }
@@ -293,12 +310,16 @@ export function comboConfigError(
 export function normalizeComboConfig(raw: OcxComboConfig): NormalizedComboConfig {
   const alias = typeof raw.alias === "string" ? raw.alias.trim() : "";
   const displayName = typeof raw.displayName === "string" ? raw.displayName.trim() : "";
+  const defaultEffort = typeof raw.defaultEffort === "string" && isCodexReasoningEffort(raw.defaultEffort)
+    ? raw.defaultEffort
+    : null;
   return {
     strategy: raw.strategy ?? "failover",
     stickyLimit: raw.stickyLimit ?? 1,
     cooldownMs: raw.cooldownMs,
     waitForCooldownMs: raw.waitForCooldownMs ?? COMBO_DEFAULT_WAIT_FOR_COOLDOWN_MS,
-    defaultEffort: raw.defaultEffort ?? null,
+    defaultEffort,
+    defaultEffortMode: raw.defaultEffortMode === "force" && defaultEffort !== null ? "force" : "fallback",
     reasoningEffortMode: raw.reasoningEffortMode === "adaptive" ? "adaptive" : "strict",
     imageInput: raw.imageInput === "disabled" ? "disabled" : "auto",
     alias: alias || null,