@bitkyc08/opencodex 2.56.0 → 2.57.0

package/src/server/responses/input-admission.ts

@@ -10,7 +10,13 @@
  * catches the pathological case and stays out of the way otherwise. Every uncertainty
  * resolves toward admitting.
  */
-import { nativeOpenAiContextWindow, nativeOpenAiMaxInputTokens, type NativeContextLimitsInput } from "../../codex/catalog/metadata";
+import {
+  nativeOpenAiContextWindow,
+  nativeOpenAiMaxInputTokens,
+  nativeOpenAiMaxOutputTokens,
+  type NativeContextLimitsInput,
+} from "../../codex/catalog/metadata";
+import { getModelMetadata } from "../../generated/model-metadata";
 import { estimateTokens } from "../../lib/token-estimate";
 import { isCanonicalOpenAiForwardProvider, OPENAI_CODEX_PROVIDER_ID } from "../../providers/openai-tiers";
 import { modelRecordValue } from "../../reasoning-effort";
@@ -54,6 +60,8 @@ export interface InputAdmissionResult {
   estimatedTokens: number;
   /** Resolved ceiling, or null when nothing could be resolved (=> always admitted). */
   ceiling: number | null;
+  /** Output space reserved by the combo preflight; absent on the loose direct gate. */
+  requiredOutputHeadroom?: number;
 }
 
 function positive(value: unknown): number | null {
@@ -135,14 +143,19 @@ export function estimateInputTokens(parsed: OcxParsedRequest, modelId: string):
  * reject a user-defined provider that merely shares a built-in name using limits that
  * belong to a different service.
  */
-export function resolveInputCeiling(
+interface ResolvedContextLimits {
+  /** The target's total context window: input and output share it. */
+  window: number | null;
+  /** Largest admissible input, which input-only caps may tighten below the window. */
+  ceiling: number | null;
+}
+
+function resolveContextLimits(
   provider: OcxProviderConfig,
   providerName: string,
   modelId: string,
-  // Operator cap for the canonical native provider. Passed in rather than read from a
-  // config here so this stays pure: no filesystem, no catalog, no registry scan.
   nativeContextCap?: NativeContextLimitsInput,
-): number | null {
+): ResolvedContextLimits {
   // `modelRecordValue`, not a bare lookup: the catalog resolves these same two maps that
   // way, so a `gpt-oss` entry covers `gpt-oss:120b`. Reading raw here made the gate fall
   // back to the provider-wide window and refuse turns the model can plainly hold.
@@ -168,13 +181,120 @@ export function resolveInputCeiling(
     : null;
   const nativeMaxInput = canonicalNativeBare ? positive(nativeOpenAiMaxInputTokens(modelId, nativeLimits)) : null;
 
-  const window = canonicalNativeBare ? native : configured;
+  const window = canonicalNativeBare ? (native ?? generatedNativeWindow(modelId, configured, nativeContextCap)) : configured;
   // modelMaxInputTokens is an input-only cap, so it can only tighten the window.
   const configuredMaxInput = positive(modelRecordValue(provider.modelMaxInputTokens, modelId));
   const limits = [window, configuredMaxInput, nativeMaxInput].filter((v): v is number => v !== null);
+  return { window, ceiling: limits.length === 0 ? null : Math.min(...limits) };
+}
+
+/**
+ * Generated-catalog keys, not routing provider names. `OPENAI_CODEX_PROVIDER_ID` is the string
+ * `"openai"` -- the canonical Codex forward route -- so using it to index the generated bundle
+ * would silently skip the native Codex rows and read the public API rows instead.
+ */
+const NATIVE_METADATA_CATALOGS = ["openai-codex", "openai"] as const;
+
+/**
+ * Static in-tree metadata for a canonical native slug the narrower override and pinned-native
+ * tables do not carry. Falling through to null made input admission completely blind for
+ * exactly those models, which is how a 128k target accepted a turn it could not finish.
+ *
+ * This deliberately covers slugs that are no longer offered in the picker: a retired slug is
+ * still dispatchable when an operator names it explicitly in a combo target, and that is the
+ * configuration where the gate was inert. This is a generated bundle compiled into the binary,
+ * not a live catalog read, so it adds no I/O. Explicit provider and operator caps may only
+ * narrow the result, never widen it.
+ */
+function generatedNativeWindow(
+  modelId: string,
+  configured: number | null,
+  nativeContextCap: NativeContextLimitsInput | undefined,
+): number | null {
+  let generated: number | null = null;
+  for (const catalog of NATIVE_METADATA_CATALOGS) {
+    generated = positive(getModelMetadata(catalog, modelId)?.contextWindow);
+    if (generated !== null) break;
+  }
+  if (generated === null) return null;
+  const cap = typeof nativeContextCap === "number"
+    ? positive(nativeContextCap)
+    : positive(nativeContextCap?.cap);
+  return Math.min(generated, configured ?? generated, cap ?? generated);
+}
+
+export function resolveInputCeiling(
+  provider: OcxProviderConfig,
+  providerName: string,
+  modelId: string,
+  // Operator cap for the canonical native provider. Passed in rather than read from a
+  // config here so this stays pure: no filesystem, no catalog, no registry scan.
+  nativeContextCap?: NativeContextLimitsInput,
+): number | null {
+  return resolveContextLimits(provider, providerName, modelId, nativeContextCap).ceiling;
+}
+
+/**
+ * Largest output the concrete target can emit. Used only to avoid reserving MORE than the
+ * target could ever produce when a client asks for a bigger allowance than the model has.
+ * Unknown stays unknown rather than inventing a capability.
+ */
+export function resolveOutputCeiling(
+  provider: OcxProviderConfig,
+  providerName: string,
+  modelId: string,
+): number | null {
+  const configured = positive(modelRecordValue(provider.modelMaxOutputTokens, modelId))
+    ?? positive(provider.defaultMaxOutputTokens);
+  const canonicalNativeBare = providerName === OPENAI_CODEX_PROVIDER_ID
+    && isCanonicalOpenAiForwardProvider(provider)
+    && !modelId.includes("/");
+  const native = canonicalNativeBare ? positive(nativeOpenAiMaxOutputTokens(modelId)) : null;
+  const limits = [configured, native].filter((v): v is number => v !== null);
   return limits.length === 0 ? null : Math.min(...limits);
 }
 
+/**
+ * Combo-only admission. A fallback must be able to satisfy the caller's declared output
+ * allowance inside its OWN context window. Otherwise it returns 200, emits a few hundred
+ * tokens, and terminates on `finish_reason: length` — which the Anthropic surface renders as
+ * "response exceeded the output token maximum" even though the real cause was the total
+ * window. By then the next target cannot be tried, because output has already committed.
+ *
+ * Two budgets are checked separately so the reserve is counted exactly once. `ceiling` is an
+ * input-only budget once `modelMaxInputTokens` tightens it below the window, so the output
+ * reserve belongs against `window`, not against `ceiling`.
+ *
+ * Direct and single-target requests keep the deliberately loose 2.5x pathological-input gate.
+ * This stricter rule applies only to synthetic combo children, where skipping one known-small
+ * target is safe and the ladder continues before any upstream bytes are sent. Unknown context
+ * stays fail-open, and a caller that declared no output allowance is unaffected.
+ */
+export function checkComboTargetInputAdmission(
+  parsed: OcxParsedRequest,
+  provider: OcxProviderConfig,
+  providerName: string,
+  modelId: string,
+  nativeContextCap?: NativeContextLimitsInput,
+): InputAdmissionResult {
+  const { window, ceiling } = resolveContextLimits(provider, providerName, modelId, nativeContextCap);
+  const requestedOutput = positive(parsed.options.maxOutputTokens);
+  if (window === null || ceiling === null || requestedOutput === null) {
+    return checkInputAdmission(parsed, provider, providerName, modelId, nativeContextCap);
+  }
+  const targetOutput = resolveOutputCeiling(provider, providerName, modelId);
+  const requiredOutputHeadroom = targetOutput === null
+    ? requestedOutput
+    : Math.min(requestedOutput, targetOutput);
+  const estimatedTokens = estimateInputTokens(parsed, modelId);
+  return {
+    admitted: estimatedTokens <= ceiling && estimatedTokens + requiredOutputHeadroom <= window,
+    estimatedTokens,
+    ceiling,
+    requiredOutputHeadroom,
+  };
+}
+
 /**
  * Fail-open when no ceiling is known; refuse only past `ceiling * ADMISSION_TOLERANCE`.
  *

package/src/server/responses/passthrough-delivery.ts

@@ -15,6 +15,8 @@ import {
   relayWithAbort,
 } from "../relay";
 import { isUsageDebugEnabled } from "../../usage/debug";
+import { isReplayRefusalResponse } from "../../lib/upstream-retry";
+import { teeWithBoundedInspection } from "../inspection-tee";
 import {
   codexForwardTerminalOutcomeRecorder,
   usesCodexForwardPoolAuth,
@@ -27,7 +29,7 @@ import type { ResponsesTerminalStatus } from "../../bridge";
 import { isCodexWsQuotaObservedResponse, isCodexWsUpstreamResponse } from "./ws-upstream";
 import { recordSubagentQuotaFailureForThreadSpawn } from "../../codex/subagent-model-fallback";
 import { recordCodexUpstreamOutcome } from "../../codex/routing";
-import { codexProbeLeaseId, codexProbeQuotaScope } from "../../codex/auth-context";
+import { codexProbeLeaseId, codexProbeQuotaScope, codexTransientProbeGrant } from "../../codex/auth-context";
 import { consumeComboFailure } from "./core-combo-failure";
 import { readDisplaySafeErrorText } from "./core-errors";
 import { streamingContextOverflowResponse, jsonContextOverflowResponse } from "./context-overflow";
@@ -243,7 +245,12 @@ export async function deliverPassthroughResponse(
       } else if (!shouldDeferCodexResetDerivedCooldown(
         upstreamResponse,
         options.deferCodexResetDerivedCooldown,
-      )) {
+      ) && !isReplayRefusalResponse(upstreamResponse)) {
+        // A refusal this proxy made is not evidence about the account. Recording it would
+        // classify the synthetic 429 as quota exhaustion and write a default cooldown against
+        // a credential the request may never have reached, and that false signal outlives the
+        // request. The sibling recorders on this path already decline: the terminal recorder
+        // needs an ok streaming body, and the quota-header snapshot finds no quota headers.
         recordCodexUpstreamOutcome(config, admissionState.authCtx.accountId, upstreamResponse.status, {
           ...quotaMeta,
           threadId: admissionState.authCtx.affinityKey,
@@ -251,6 +258,7 @@ export async function deliverPassthroughResponse(
           modelId: route.modelId,
           probeLeaseId: codexProbeLeaseId(admissionState.authCtx),
           probeQuotaScope: codexProbeQuotaScope(admissionState.authCtx),
+          transientProbe: codexTransientProbeGrant(admissionState.authCtx),
           writerGeneration: admissionState.authCtx.writerGeneration,
           // Includes a replay's second 401, which is the case that actually retires the
           // account — fence it on the credential the request was holding.
@@ -298,6 +306,9 @@ export async function deliverPassthroughResponse(
       return formatPassthroughUpstreamError(upstreamResponse.status, errorText, {
         statusText: upstreamResponse.statusText,
         headers,
+        // Provenance, not inference: `errorText` is empty when the bounded read finds nothing
+        // display-safe, and an empty body is exactly what the retryable-429 default fires on.
+        replayRefusal: isReplayRefusalResponse(upstreamResponse),
       });
     }
 
@@ -593,16 +604,18 @@ export async function deliverPassthroughResponse(
           })),
         );
       }
-      const [nativeBody, inspectBody] = passthroughSseBody.tee();
       const turnAc = new AbortController();
       const clientGone = new AbortController();
+      const clientGoneSignal = options.abortSignal
+        ? AbortSignal.any([clientGone.signal, options.abortSignal])
+        : clientGone.signal;
+      // Pace against raw bytes before rewrites, without detaching terminal ownership.
+      const [nativeBody, inspectBody] = teeWithBoundedInspection(passthroughSseBody, { clientGoneSignal });
       linkAbortSignal(upstream, turnAc.signal);
       registerTurn(turnAc, options.turnAdmissionLease);
       const inspectionConsumerOptions = {
         // Request abort can reject the fetch body before the response cancel hook runs.
-        clientGoneSignal: options.abortSignal
-          ? AbortSignal.any([clientGone.signal, options.abortSignal])
-          : clientGone.signal,
+        clientGoneSignal,
         drainBounds: { ms: 15_000, bytes: 32 * 1024 * 1024 },
         upstream,
         pinCompletedResponseIdToFirstSeen: githubCopilotRepairEnabled,

package/src/server/responses/passthrough-dispatch.ts

@@ -29,6 +29,7 @@ import {
   unwrapUpstreamRetryEvidenceError,
   codexProbeLeaseId,
   codexProbeQuotaScope,
+  codexTransientProbeGrant,
   createCodexReserveDispatchGuard,
 } from "../../codex/auth-context";
 import {
@@ -60,7 +61,6 @@ import { restorePlaintextV2AgentMessageCalls } from "../../responses/plaintext-v
 import {
   recordAdapterReasoning,
   recordAdapterTier,
-  noteAttemptSend,
   sealRequestAttemptIdentity,
   recordAttemptCredentialSource,
 } from "../request-log";
@@ -80,6 +80,7 @@ import {
   safeHostLabel,
   storedPoolReplayDispatchNotifier,
 } from "./fetch-helpers";
+import { classifyPoolRecoveryDispatch } from "../../routing/probe-lease";
 import { clientCancelledResponse } from "./core-errors";
 import {
   upstreamHostCircuitOpenResponse,
@@ -101,6 +102,7 @@ import {
   fetchWithTransientRetry,
   applyUpstreamRecoveryInit,
   TRANSIENT_RETRY_MAX_ATTEMPTS,
+  isNonReplayableResponse,
   prepareSameTarget429Wait,
   sleepWithAbort,
 } from "../../lib/upstream-retry";
@@ -171,6 +173,7 @@ export async function preparePassthroughExchange(
     | "replayOAuthCredentialSnapshot"
     | "genericFailovers"
     | "applyFailoverSnapshot"
+    | "noteRoutedAttemptSend"
   >,
   responseEffects: Pick<
     ResponsesEffects,
@@ -346,10 +349,13 @@ export async function preparePassthroughExchange(
     const declaredWireToolNames = new Set<string>();
     const declaredBareWireToolNames = new Set<string>();
     const declaredNamelessClientCallTypes = new Set<string>();
-    // `buildToolBridgeMaps` creates a bare alias only when the caller selected exactly one
-    // namespaced tool through a bare tool_choice. Restore that request-bounded identity before
-    // authorization checks instead of admitting the bare name into the declared set: for `exec`,
-    // the latter would also authorize the unrelated code-mode helper names.
+    // `buildToolBridgeMaps` adds each eligible bare alias to `declaredToolNames` and `toolNsMap`
+    // (one authorized identity claims the bare name). `refreshUndeclaredToolGuard` normally copies
+    // those entries into `declaredWireToolNames`, but passthrough restoration runs before the
+    // undeclared-tool guard, so restore that request-bounded identity here, before authorization
+    // checks. `exec` uses separate handling: its bridge alias is copied into the declared set only
+    // when the client itself declared bare `exec`, because otherwise code-mode normalization could
+    // authorize the unrelated code-mode helper names.
     const authorizedBareNamespaceToolAliases: RoutedNamespaceToolAliases = new Map(
       [...toolBridgeMaps.toolNsMap].flatMap(([alias, identity]) =>
         alias === identity.name
@@ -736,6 +742,7 @@ export async function preparePassthroughExchange(
           modelId: route.modelId,
           probeLeaseId: codexProbeLeaseId(admissionState.authCtx),
           probeQuotaScope: codexProbeQuotaScope(admissionState.authCtx),
+          transientProbe: codexTransientProbeGrant(admissionState.authCtx),
           writerGeneration: admissionState.authCtx.writerGeneration,
         });
       }
@@ -752,7 +759,13 @@ export async function preparePassthroughExchange(
       // Body is a replayable string; nothing has streamed to the client yet.
       upstreamResponse = await fetchWithTransientRetry(
         recovery => {
-          noteAttemptSend(logCtx.activeAttempt, passthroughEstimate, recovery);
+          // The pool-wide recovery window measures recovery traffic against observed demand,
+          // and this is where demand is observed: `recovery === undefined` is a new request's
+          // first send, everything after it is the same request trying again. Without this the
+          // ratio has no denominator and the window collapses to its quiet-pool floor, which
+          // would throttle recovery on a busy proxy exactly as hard as on an idle one (#4701).
+          if (recovery === undefined) classifyPoolRecoveryDispatch("initial");
+          transportState.noteRoutedAttemptSend(passthroughEstimate, recovery);
           return fetchWithHeaderTimeout(request.url, applyUpstreamRecoveryInit({
             method: request.method,
             headers: request.headers,
@@ -848,7 +861,7 @@ export async function preparePassthroughExchange(
             if (allowance.permit && !allowance.permit.use()) {
               throw new SendBudgetExhaustedError(safeHostLabel(request.url));
             }
-            noteAttemptSend(logCtx.activeAttempt, passthroughEstimate, innerRecovery ?? recovery);
+            transportState.noteRoutedAttemptSend(passthroughEstimate, innerRecovery ?? recovery);
             return fetchWithHeaderTimeout(request.url, applyUpstreamRecoveryInit({
               method: request.method,
               headers: request.headers,
@@ -946,7 +959,7 @@ export async function preparePassthroughExchange(
         // every other build site; a replay is exactly when a grown payload reappears.
         const replayBodyRefusal = refuseOversizedOutboundBody(request);
         if (replayBodyRefusal) return replayBodyRefusal;
-        noteAttemptSend(logCtx.activeAttempt, passthroughEstimate, "oauth-401");
+        transportState.noteRoutedAttemptSend(passthroughEstimate, "oauth-401");
         upstreamResponse = await fetchWithHeaderTimeout(
           request.url,
           { method: request.method, headers: request.headers, body: request.body },
@@ -1075,7 +1088,7 @@ export async function preparePassthroughExchange(
       try {
         upstreamResponse = await fetchWithTransientRetry(
           recovery => {
-            noteAttemptSend(logCtx.activeAttempt, passthroughEstimate, recovery ?? "oauth-401");
+            transportState.noteRoutedAttemptSend(passthroughEstimate, recovery ?? "oauth-401");
             return fetchWithHeaderTimeout(request.url, applyUpstreamRecoveryInit({
               method: request.method,
               headers: request.headers,
@@ -1105,6 +1118,10 @@ export async function preparePassthroughExchange(
     // the same quorum, cooldown and request budget here, before any client bytes flow.
     if (
       upstreamResponse.status === 429
+      // Not a provider rate limit when this proxy synthesized it for a refused reset
+      // replay; rotating accounts on it would re-send an inference that may already
+      // have run and would cool down an account that refused nothing.
+      && !isNonReplayableResponse(upstreamResponse)
       && transportState.genericFailoverAccountId
       && transportState.genericFailovers < GENERIC_OAUTH_MAX_FAILOVERS_PER_REQUEST
       && isGenericOAuthFailoverEnabled(config, route.providerName)
@@ -1159,6 +1176,7 @@ export async function preparePassthroughExchange(
     // keep their pool logic below (rateLimitRetryPolicyFor returns null for them).
     while (
       upstreamResponse.status === 429
+      && !isNonReplayableResponse(upstreamResponse)
       && rateLimitPolicy !== null
       && rateLimitRetries < rateLimitPolicy.attempts
       // Checked here rather than inside the helper: prepareSameTarget429Wait releases the 429
@@ -1192,7 +1210,7 @@ export async function preparePassthroughExchange(
           recovery => {
             // The first send of every replay is itself a rate-limit retry; inner transient-5xx
             // recoveries keep their own label (recovery is provided for those).
-            noteAttemptSend(logCtx.activeAttempt, passthroughEstimate, recovery ?? "rate-limit-429");
+            transportState.noteRoutedAttemptSend(passthroughEstimate, recovery ?? "rate-limit-429");
             return fetchWithHeaderTimeout(request.url, applyUpstreamRecoveryInit({
               method: request.method,
               headers: request.headers,

package/src/server/responses/passthrough-error.ts

@@ -1,5 +1,6 @@
 import { formatErrorResponse } from "../../bridge";
 import { isCyberPolicyCode, isCyberPolicyMessage } from "../../lib/errors";
+import { isReplayRefusalCode, UPSTREAM_RESET_REPLAY_REFUSED_CODE } from "../../lib/upstream-retry";
 import {
   resolveClientRetryAfter,
   validateClientRetryAfterHeader,
@@ -24,6 +25,26 @@ function isCyberPolicyBody(body: string): boolean {
   return false;
 }
 
+/**
+ * True for a body this proxy wrote to refuse replaying an ambiguous pre-header reset.
+ *
+ * It is read off the body rather than a marker because this formatter is handed bytes, not
+ * the response they came from, and the refusal reaches it after the original body was read.
+ * The code is this proxy's own, so an upstream echoing it is not a case worth widening for.
+ */
+function isReplayRefusalBody(body: string): boolean {
+  if (!body.includes(UPSTREAM_RESET_REPLAY_REFUSED_CODE)) return false;
+  try {
+    const parsed = JSON.parse(body) as Record<string, unknown>;
+    const error = parsed.error && typeof parsed.error === "object" && !Array.isArray(parsed.error)
+      ? parsed.error as Record<string, unknown>
+      : undefined;
+    return isReplayRefusalCode(error?.code) || isReplayRefusalCode(parsed.code);
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Passthrough adapters historically relayed upstream non-2xx bodies verbatim.
  * Codex maps an *empty* body to the literal client string "Unknown error"
@@ -38,6 +59,9 @@ function isCyberPolicyBody(body: string): boolean {
  * - missing/malformed values are replaced when resolveClientRetryAfter yields a value
  * - malformed/expired values are removed when the resolver returns undefined
  *   (e.g. quota-exhausted 429s must not keep junk headers or get the synthetic "2")
+ * - a replay refusal this proxy wrote gets none and keeps none: the whole point of the
+ *   refusal is that the turn may already be running, and the synthetic default for a
+ *   retryable 429 is a direct instruction to the client to send it a second time
  */
 export function formatPassthroughUpstreamError(
   status: number,
@@ -46,6 +70,13 @@ export function formatPassthroughUpstreamError(
     statusText?: string;
     headers?: Headers;
     now?: number;
+    /**
+     * Provenance from the caller that still holds the response: this body is a refusal this
+     * proxy synthesized. The body check below is the fallback for a re-wrapped body, and it
+     * cannot answer at all when the bounded read returned nothing display-safe -- which is
+     * precisely when the empty-body branch would invent the retryable-429 default.
+     */
+    replayRefusal?: boolean;
   },
 ): Response {
   const trimmed = bodyText.trim();
@@ -53,7 +84,12 @@ export function formatPassthroughUpstreamError(
   const upstreamRetryAfter = options?.headers?.get("retry-after")?.trim() || undefined;
   const originalValid = validateClientRetryAfterHeader(upstreamRetryAfter, now);
   const cyberPolicyFailure = isCyberPolicyBody(trimmed);
-  const resolved = cyberPolicyFailure
+  // Two different reasons to answer with no wait at all, handled the same way: a hard policy
+  // block will not become servable, and a refusal we made was never a rate limit.
+  const suppressRetryAfter = cyberPolicyFailure
+    || options?.replayRefusal === true
+    || isReplayRefusalBody(trimmed);
+  const resolved = suppressRetryAfter
     ? undefined
     : resolveClientRetryAfter({
       status,
@@ -64,7 +100,7 @@ export function formatPassthroughUpstreamError(
 
   if (trimmed) {
     const needsSet = resolved !== undefined && upstreamRetryAfter !== resolved;
-    const needsDelete = (cyberPolicyFailure && upstreamRetryAfter !== undefined)
+    const needsDelete = (suppressRetryAfter && upstreamRetryAfter !== undefined)
       || (resolved === undefined
         && upstreamRetryAfter !== undefined
         && originalValid === undefined);