@bitkyc08/opencodex 2.56.0 → 2.57.0

package/src/server/response-log-body.ts

@@ -0,0 +1,153 @@
+/** Bounds diagnostic retention, never the bytes delivered to the caller. */
+export const MAX_RESPONSE_LOG_INSPECTION_BYTES = 32 * 1024 * 1024;
+export const MAX_NON_JSON_ERROR_INSPECTION_BYTES = 8 * 1024;
+const INSPECTION_BLOCK_BYTES = 64 * 1024;
+
+export type ResponseLogBodyEnd = "eof" | "read_error" | "cancel";
+
+export interface ResponseLogBodyOptions {
+  json: boolean;
+  inspect: (text: string) => void;
+  finalize: (reason: ResponseLogBodyEnd) => void;
+  /** Internal test seam; this is not a provider-controlled limit. */
+  maxInspectionBytes?: number;
+}
+
+/** Fixed-size blocks bound both retained bytes and per-chunk bookkeeping. */
+class ResponseLogInspection {
+  private blocks: Uint8Array[] = [];
+  private bytes = 0;
+  private overflowed = false;
+
+  constructor(private readonly json: boolean, private readonly limit: number) {}
+
+  append(chunk: Uint8Array): void {
+    if (this.overflowed || chunk.byteLength === 0) return;
+    if (this.json && chunk.byteLength > this.limit - this.bytes) {
+      // A JSON prefix is not an authoritative response. Drop it immediately,
+      // without either truncating the delivery stream or retaining later bytes.
+      this.overflowed = true;
+      this.dispose();
+      return;
+    }
+    let remaining = Math.min(chunk.byteLength, this.limit - this.bytes);
+    let offset = 0;
+    while (remaining > 0) {
+      const blockOffset = this.bytes % INSPECTION_BLOCK_BYTES;
+      if (blockOffset === 0) {
+        this.blocks.push(new Uint8Array(Math.min(INSPECTION_BLOCK_BYTES, this.limit - this.bytes)));
+      }
+      const block = this.blocks[this.blocks.length - 1]!;
+      const length = Math.min(remaining, block.byteLength - blockOffset);
+      block.set(chunk.subarray(offset, offset + length), blockOffset);
+      this.bytes += length;
+      offset += length;
+      remaining -= length;
+    }
+  }
+
+  text(reason: ResponseLogBodyEnd): string | undefined {
+    // Even a syntactically valid JSON prefix must not update usage/model
+    // metadata when the transport did not reach EOF.
+    if (this.json && (reason !== "eof" || this.overflowed)) return undefined;
+    const combined = new Uint8Array(this.bytes);
+    let offset = 0;
+    for (const block of this.blocks) {
+      const length = Math.min(block.byteLength, this.bytes - offset);
+      combined.set(block.subarray(0, length), offset);
+      offset += length;
+    }
+    return new TextDecoder().decode(combined);
+  }
+
+  dispose(): void {
+    this.blocks.length = 0;
+    this.bytes = 0;
+  }
+}
+
+/** Optional diagnostics must not change the response's transport outcome. */
+function bestEffort(callback: () => void): void {
+  try {
+    callback();
+  } catch {
+    return;
+  }
+}
+
+/**
+ * Forward one upstream read per downstream pull, with bounded side inspection.
+ * EOF, read failure and cancellation each finalize at most once. Cancellation
+ * does not await the upstream cancel promise: one branch of a tee can otherwise
+ * wait for a sibling that the same caller intends to consume or cancel later.
+ */
+export function createBoundedResponseLogBody(
+  body: ReadableStream<Uint8Array>,
+  options: ResponseLogBodyOptions,
+): ReadableStream<Uint8Array> {
+  const limit = options.maxInspectionBytes ?? (options.json
+    ? MAX_RESPONSE_LOG_INSPECTION_BYTES
+    : MAX_NON_JSON_ERROR_INSPECTION_BYTES);
+  if (!Number.isSafeInteger(limit) || limit < 0) {
+    throw new RangeError("Response log inspection limit must be a non-negative safe integer");
+  }
+  const inspection = new ResponseLogInspection(options.json, limit);
+  const reader = body.getReader();
+  let ended = false;
+  let inspectionFailed = false;
+
+  const release = () => bestEffort(() => reader.releaseLock());
+  const finish = (reason: ResponseLogBodyEnd) => {
+    if (ended) return;
+    ended = true; // Set before callbacks or a pending read resumes.
+    try {
+      if (!inspectionFailed) {
+        bestEffort(() => {
+          const text = inspection.text(reason);
+          if (text !== undefined) options.inspect(text);
+        });
+      }
+    } finally {
+      inspection.dispose();
+      bestEffort(() => options.finalize(reason));
+    }
+  };
+
+  return new ReadableStream<Uint8Array>({
+    async pull(controller) {
+      if (ended) return;
+      let result: Awaited<ReturnType<typeof reader.read>>;
+      try {
+        result = await reader.read();
+      } catch (error) {
+        if (ended) return; // Cancellation owns its pending-read settlement.
+        finish("read_error");
+        release();
+        controller.error(error);
+        return;
+      }
+      if (ended) return;
+      if (result.done) {
+        finish("eof");
+        release();
+        controller.close();
+        return;
+      }
+      if (!inspectionFailed) {
+        try {
+          inspection.append(result.value);
+        } catch {
+          inspectionFailed = true;
+          inspection.dispose();
+        }
+      }
+      // Do not decode/re-encode transport bytes, including malformed UTF-8.
+      controller.enqueue(result.value);
+    },
+    cancel(reason) {
+      finish("cancel");
+      bestEffort(() => { void reader.cancel(reason).catch(() => undefined); });
+      release();
+    },
+  }, { highWaterMark: 0 });
+}

package/src/server/responses/account-change-state.ts

@@ -17,9 +17,32 @@ import {
 } from "../../codex/routing";
 import type { OcxParsedRequest } from "../../types";
 import type { RequestLogContext } from "../request-log";
+import { formatErrorResponse } from "../../bridge/errors";
 
 export type ConversationStateScrubReason = "account-change";
 
+/**
+ * Cause AND remedy, because this refusal does not clear itself.
+ *
+ * Dropping a `previous_response_id` costs one cold turn and the conversation continues. This is
+ * not that. The file reference lives in the conversation's history, so once pool rotation has
+ * moved a conversation carrying an attachment, every following turn presents the same reference
+ * and is refused the same way. A caller told only that the reference is invalid will send the
+ * same request back and watch the conversation appear dead, which is the one outcome a refusal
+ * is supposed to prevent. So the text says what happened, that it will keep happening, and the
+ * two things that actually end it.
+ *
+ * Names no account id, no file id, and no conversation id.
+ */
+export const ACCOUNT_CHANGE_FILE_SCOPE_MESSAGE =
+  "This conversation is now being served by a different account than the one its uploaded files "
+  + "were sent to, and an uploaded file can only be read by the account that received it. The "
+  + "request was not sent upstream, and no file was removed from it. Because the references stay "
+  + "in this conversation's history, later turns will be refused the same way until this is "
+  + "resolved: re-upload the files so they are issued by the account now serving this "
+  + "conversation, or start a new conversation for them. Sending the same request again "
+  + "unchanged will not clear it.";
+
 export type PortabilityDenial =
   | "previous-response-id"
   | "provider-conversation-id"
@@ -144,6 +167,21 @@ export function collectConversationStateCarriers(body: unknown): ConversationSta
   };
 }
 
+/**
+ * Does this body reference an uploaded file?
+ *
+ * Answerable from the body alone, which is what lets an alternate-account path ask BEFORE it
+ * resolves an alternate: the answer cannot depend on which account is chosen, because an
+ * uploaded file is readable only by the account it was sent to (#4710).
+ *
+ * `fileIds` is optional on the carrier type, so the emptiness test lives here rather than being
+ * rewritten at each caller. One of those rewrites already dereferenced it directly.
+ */
+export function conversationCarriesUploadedFiles(body: unknown): boolean {
+  const fileIds = collectConversationStateCarriers(body).fileIds;
+  return fileIds !== undefined && fileIds.length > 0;
+}
+
 
 /**
  * Drop account-bound continuation from a request body in place. Readable user
@@ -231,3 +269,39 @@ export function applyAccountChangeConversationStateScrub(
   }
   return true;
 }
+
+/**
+ * Refuse an account change that would carry an uploaded-file reference to an account that
+ * cannot read it (#4710).
+ *
+ * The classifier has always called `file_id` account-bound, and the scrubber has always removed
+ * only `previous_response_id` and `conversation`. A body whose ONLY account-bound state was an
+ * uploaded file therefore reported nothing scrubbed and was replayed unchanged against the new
+ * account, which is the one case the safety fix was supposed to cover.
+ *
+ * Deleting the references is not the fix. A file reference is not continuation state the model
+ * can do without: it is content the caller attached, and silently dropping it answers a
+ * different question than the one that was asked, with no way for the caller to tell. Pinning
+ * the request to the issuing account is not available either — every call site resolves and
+ * materialises its credential before reaching here, and the retry sites are reached precisely
+ * because the issuing account just refused the request.
+ *
+ * So the move is refused, before dispatch, and the caller is told exactly what to do about it.
+ * A 400 rather than a 409: re-uploading is required, and a retryable status would invite the
+ * same request back unchanged.
+ */
+export function accountChangeFileReferenceRefusal(
+  args: Pick<ApplyAccountChangeConversationStateScrubArgs, "body" | "bindingKey" | "servingAccountId" | "priorAccountId">,
+): Response | undefined {
+  const { body, bindingKey, servingAccountId, priorAccountId } = args;
+  if (!servingAccountId || !bindingKey) return undefined;
+  const issuer = peekConversationStateIssuer(bindingKey);
+  const accountChanged = (issuer != null && issuer !== servingAccountId)
+    || (priorAccountId != null && priorAccountId !== servingAccountId);
+  if (!accountChanged) return undefined;
+  // Checked against the carriers directly rather than through the portability verdict: that
+  // verdict reports the FIRST reason it finds, so a body carrying both a previous response id
+  // and a file reference reports only the former and the file would slip through the scrub.
+  if (!conversationCarriesUploadedFiles(body)) return undefined;
+  return formatErrorResponse(400, "invalid_request_error", ACCOUNT_CHANGE_FILE_SCOPE_MESSAGE);
+}

package/src/server/responses/adapter-continuation.ts

@@ -10,7 +10,6 @@ import type { AdapterRequest } from "../../adapters/base";
 import {
   recordAdapterReasoning,
   recordAdapterTier,
-  noteAttemptSend,
   sealRequestAttemptIdentity,
   recordAttemptCredentialSource,
 } from "../request-log";
@@ -26,6 +25,7 @@ import {
   fetchWithTransientRetry,
   fetchWithResetRetry,
   applyUpstreamRecoveryInit,
+  isNonReplayableResponse,
   prepareSameTarget429Wait,
 } from "../../lib/upstream-retry";
 import { redactSecretString } from "../../lib/redact";
@@ -78,15 +78,18 @@ export function createAdapterContinuations(
     | "genericFailoverAccountId"
     | "genericFailovers"
     | "applyFailoverSnapshot"
+    | "noteRoutedAttemptSend"
   >,
   sidecarState: Pick<ResponsesSidecarAuth, "routedCompaction">,
   sendBudgetState: Pick<
     ResponsesSendBudget,
-    | "adapterSendBudget"
+    | "adapterDispatchBudget"
     | "noteAdapterPhysicalSend"
     | "remainingTransientSendBudget"
     | "noteTransientSends"
     | "reserveCredentialHop"
+    | "pendingHopPermit"
+    | "sendBudgetExhausted"
   >,
   adapterExchange: Pick<
     AdapterExchange,
@@ -110,11 +113,12 @@ export function createAdapterContinuations(
   const { routedCompaction } = sidecarState;
   const { upstream, connectMs, rateLimitPolicy, stallTimeoutMs } = adapterExchange;
   const {
-    adapterSendBudget,
+    adapterDispatchBudget,
     noteAdapterPhysicalSend,
     remainingTransientSendBudget,
     noteTransientSends,
     reserveCredentialHop,
+    sendBudgetExhausted,
   } = sendBudgetState;
 
 
@@ -182,15 +186,16 @@ export function createAdapterContinuations(
       const replayKind: AttemptRecoveryKind | undefined = recoveryKind;
       try {
         if (transportState.activeAdapter.fetchResponse) {
-          noteAttemptSend(logCtx.activeAttempt, continuationEstimate, replayKind);
+          transportState.noteRoutedAttemptSend(continuationEstimate, replayKind);
           await waitForProviderRequestSlot(route.providerName, route.provider, nextParsed.modelId, upstream.signal);
           return await transportState.activeAdapter.fetchResponse(builtContinuationRequest, {
             abortSignal: upstream.signal,
             timeoutMs: connectMs,
-              sendBudget: adapterSendBudget,
+              sendBudget: adapterDispatchBudget,
             onPhysicalSend: send => noteAdapterPhysicalSend(continuationEstimate, send),
             stream: nextParsed.stream,
             executor: providerFetch(route.provider, options.codexWsRuntimeIdentity, {
+              pacingSlotAcquired: true,
               dispatchOverride: oauthDispatch(builtContinuationRequest, nextParsed),
               providerName: route.providerName,
               modelId: nextParsed.modelId,
@@ -205,7 +210,7 @@ export function createAdapterContinuations(
           : fetchWithResetRetry;
         return await fetchContinuationWithRetryPolicy(
           recovery => {
-            noteAttemptSend(logCtx.activeAttempt, continuationEstimate, recovery ?? replayKind);
+            transportState.noteRoutedAttemptSend(continuationEstimate, recovery ?? replayKind);
             return fetchWithHeaderTimeout(
               builtContinuationRequest.url,
               applyUpstreamRecoveryInit({
@@ -260,8 +265,16 @@ export function createAdapterContinuations(
       // loop; only after the attempts are exhausted does the continuation fail over.
       while (
         response.status === 429
+        // A synthesized replay refusal is not a rate limit; replaying the continuation on
+        // it would re-send a turn whose first send may already have been processed.
+        && !isNonReplayableResponse(response)
         && rateLimitPolicy !== null
         && adapterExchange.rateLimitRetries < rateLimitPolicy.attempts
+        // The main recovery loop and the passthrough ladder both consult the shared remainder
+        // here; this loop did not, so a request whose budget was already spent could still
+        // same-key replay on a live stream. Checked BEFORE the wait below cancels the body, so
+        // a refusal keeps the real upstream 429 -- status, Retry-After, quota evidence -- intact.
+        && !sendBudgetExhausted()
       ) {
         adapterExchange.rateLimitRetries += 1;
         // Release unread body + heartbeat-fed wait via the shared same-target helper.
@@ -302,7 +315,7 @@ export function createAdapterContinuations(
         }
       }
 
-      if (response.status === 429 && hasKeyPoolFailover(route.provider)) {
+      if (response.status === 429 && !isNonReplayableResponse(response) && hasKeyPoolFailover(route.provider)) {
         const rotated = rotateProviderTransportOn429(config, route.providerName, route.provider, {
           retryAfter: response.headers.get("retry-after"),
           now: Date.now(),
@@ -337,6 +350,7 @@ export function createAdapterContinuations(
       }
       if (
         response.status === 429
+        && !isNonReplayableResponse(response)
         && transportState.anthropicPoolAccountId
         && transportState.anthropicPoolFailovers < ANTHROPIC_POOL_MAX_FAILOVERS_PER_REQUEST
       ) {
@@ -378,6 +392,7 @@ export function createAdapterContinuations(
       // the per-request bound cannot be silently re-armed by reaching a different loop.
       if (
         response.status === 429
+        && !isNonReplayableResponse(response)
         && transportState.genericFailoverAccountId
         && transportState.genericFailovers < GENERIC_OAUTH_MAX_FAILOVERS_PER_REQUEST
         && isGenericOAuthFailoverEnabled(config, route.providerName)
@@ -385,9 +400,15 @@ export function createAdapterContinuations(
         // Intersection with the shared request budget. The continuation loop re-sends the
         // turn, so without this the per-request bound could be re-armed simply by reaching a
         // different loop -- which is the divergence the comment above already warns about.
+        //
+        // Who settles the reservation depends on who sends the replay (#4709). An adapter that
+        // owns its ladder reserves once per physical send and would charge this replay twice;
+        // the helper path reports it back instead, which is what `countedExternally` names.
+        const adapterOwnsDispatch = transportState.activeAdapter.fetchResponse !== undefined;
         const hop = reserveCredentialHop(
           "auth-recovery",
           `${route.providerName}|${route.modelId}|continuation-oauth-429`,
+          !adapterOwnsDispatch && transientRetryPolicyFor(route.provider) !== null,
         );
         const nextAccountId = hop.allowed
           ? rotateGenericOAuthAccountOn429(
@@ -417,6 +438,11 @@ export function createAdapterContinuations(
               );
               sealRequestAttemptIdentity(logCtx.activeAttempt, logCtx.provider, transportState.activeAdapter.name, logCtx.accountLogLabel);
               recordAttemptCredentialSource(logCtx.activeAttempt, route.providerName, route.provider, transportState.activeAdapter.name);
+              // The replay goes out on the next iteration. An adapter that owns its ladder
+              // reserves for that send itself, so hand this reservation down rather than let it
+              // take a second one for the same replay. A helper-routed replay needs no handoff:
+              // its reporter settles the booking made above.
+              if (adapterOwnsDispatch) sendBudgetState.pendingHopPermit = hop.permit;
               nextContinuationRecoveryKind = "oauth-account-429";
               continue;
             }

package/src/server/responses/adapter-delivery.ts

@@ -26,7 +26,7 @@ export async function deliverAdapterResponse(
     | "rememberKiroDeliveredFinalAnswer"
     | "responseStateOptions"
   >,
-  transportState: Pick<ResponsesTransport, "activeAdapter">,
+  transportState: Pick<ResponsesTransport, "activeAdapter" | "bindKeyUsageFromBridge">,
   sidecarState: Pick<ResponsesSidecarAuth, "routedCompaction">,
   responseEffects: Pick<
     ResponsesEffects,
@@ -99,6 +99,7 @@ export async function deliverAdapterResponse(
         stallTimeoutSec: config.stallTimeoutSec,
         hideThinkingSummary: parsed.options.hideThinkingSummary,
         declaredToolNames,
+        enforceDeclaredToolNames: options.inboundWire !== "chat" && options.inboundWire !== "anthropic",
       toolParameterSchemas,
         ...(options.onFirstOutput ? { onFirstOutput: options.onFirstOutput } : {}),
         ...(routedCompaction ? { compaction: true } : {}),
@@ -106,11 +107,7 @@ export async function deliverAdapterResponse(
         ...(logCtx.surface === "grok" ? { heartbeatStyle: "comment" as const } : {}),
         onUsage: usage => {
           // Raw adapter usage, pre wire-normalization (see the runTurn branch above).
-          logCtx.usageFromBridge = true;
-          if (usage) {
-            logCtx.usage = usage;
-            if (logCtx.activeAttempt) logCtx.activeAttempt.usage = usage;
-          }
+          transportState.bindKeyUsageFromBridge(usage);
         },
         onCompletedResponse: (response: Record<string, unknown>, providerState?: OcxProviderContinuationState) => {
           commitReasoningReplayServingRoute();
@@ -178,17 +175,14 @@ export async function deliverAdapterResponse(
       hideThinkingSummary: parsed.options.hideThinkingSummary,
       toolNsMap,
       declaredToolNames,
+      enforceDeclaredToolNames: options.inboundWire !== "chat" && options.inboundWire !== "anthropic",
       toolParameterSchemas,
       freeformToolNames,
       toolSearchToolNames,
       ...(routedCompaction ? { compaction: true } : {}),
       onProviderState: state => { providerState = state; },
       onUsage: usage => {
-        logCtx.usageFromBridge = true;
-        if (usage) {
-          logCtx.usage = usage;
-          if (logCtx.activeAttempt) logCtx.activeAttempt.usage = usage;
-        }
+        transportState.bindKeyUsageFromBridge(usage);
       },
     });
     // See the streaming branch: compaction turns skip the continuation cache.