@bitkyc08/opencodex 2.58.0 → 2.59.0

package/src/server/responses/compact.ts

@@ -107,6 +107,7 @@ import {
 } from "../../codex/upstream-host-health";
 import {
   ForwardAdmissionCredentialError,
+  contextPrincipalIdOf,
   hasForwardableCodexBearer,
   validateForwardAdmissionCredential,
 } from "../auth-cors";
@@ -114,7 +115,11 @@ import type { DataPlaneAdmission } from "../auth-cors";
 import { listOpenAiForwardSidecarCandidates, resolveFirstUsableOpenAiSidecar, type ResolvedOpenAiForwardSidecar } from "../../providers/openai-sidecar";
 import { CODEX_FORWARD_BASE_URL, isCanonicalOpenAiForwardProvider, supportsNativeResponsesCompactEndpoint } from "../../providers/openai-tiers";
 import { NATIVE_RESERVE_MODEL } from "../../codex/catalog/native-models";
-import { isCodexReserveRequestEligible } from "../../codex/loopback-target";
+import {
+  isCodexReserveOptInMissing,
+  isCodexReserveRequestEligible,
+  CODEX_RESERVE_OPT_IN_REQUIRED_MESSAGE,
+} from "../../codex/loopback-target";
 import { slugsEquivalent } from "../../providers/slug-codec";
 import { decideTier, tierValueAfterDecision } from "../../providers/fastwire";
 import { fastPolicyForModel } from "../../providers/service-tier";
@@ -210,8 +215,33 @@ function pruneCompactHandoffRoutes(now: number): void {
   }
 }
 
-function rememberCompactHandoffRoute(req: Request, model: string, now = Date.now()): void {
-  const key = sessionLaneIdFromRequest(req.headers);
+/**
+ * The handoff map is process-global, so a caller-controlled lane header alone
+ * cannot be the key: two authenticated clients sending the same lane header
+ * would share one fallback route. Namespace the lane by the admitted principal.
+ * A loopback or missing admission has no authenticated identity to bind this
+ * cross-request state to, so it is ineligible rather than trusted.
+ */
+function compactHandoffRouteKey(req: Request, admission: DataPlaneAdmission | undefined): string | null {
+  const lane = sessionLaneIdFromRequest(req.headers);
+  if (!lane || !admission || admission.kind === "loopback") return null;
+  // Fail closed rather than substituting a weaker identity. `keyId` survives a
+  // rotation and every identity-less environment admission would collapse into
+  // one bucket, which is the collision this key exists to prevent. Production
+  // admission always mints `contextPrincipalId` for configured and environment
+  // holders, so no real authenticated caller loses the route.
+  const principal = contextPrincipalIdOf(admission);
+  if (!principal) return null;
+  return `${principal}\u0000${lane}`;
+}
+
+function rememberCompactHandoffRoute(
+  req: Request,
+  admission: DataPlaneAdmission | undefined,
+  model: string,
+  now = Date.now(),
+): void {
+  const key = compactHandoffRouteKey(req, admission);
   if (!key || model.length > COMPACT_HANDOFF_MODEL_MAX_LENGTH) return;
   pruneCompactHandoffRoutes(now);
   compactHandoffRoutes.delete(key);
@@ -219,13 +249,18 @@ function rememberCompactHandoffRoute(req: Request, model: string, now = Date.now
   pruneCompactHandoffRoutes(now);
 }
 
-function forgetCompactHandoffRoute(req: Request): void {
-  const key = sessionLaneIdFromRequest(req.headers);
+function forgetCompactHandoffRoute(req: Request, admission?: DataPlaneAdmission): void {
+  const key = compactHandoffRouteKey(req, admission);
   if (key) compactHandoffRoutes.delete(key);
 }
 
-function compactHandoffRoute(req: Request, previousModel: string, now = Date.now()): string | null {
-  const key = sessionLaneIdFromRequest(req.headers);
+function compactHandoffRoute(
+  req: Request,
+  admission: DataPlaneAdmission | undefined,
+  previousModel: string,
+  now = Date.now(),
+): string | null {
+  const key = compactHandoffRouteKey(req, admission);
   if (!key) return null;
   pruneCompactHandoffRoutes(now);
   const entry = compactHandoffRoutes.get(key);
@@ -632,6 +667,20 @@ export async function handleResponsesCompact(
     ? `${route.providerName}-${route.codexAccountNamespace}`
     : route.providerName;
   logCtx.providerAdapter = route.provider.adapter;
+  // #4940, and the same refusal the ordinary Responses path makes in request-prepare.ts. Compact has
+  // to repeat it rather than inherit it: the native branch below dispatches straight to
+  // `/responses/compact` and only the routed fallback replays through handleResponses, so relying on
+  // that one seam would leave the native compact turn forwarding a Reserve model the opt-in has made
+  // unservable. Composed from the same three facts, in the same order, as `customReserveForward`
+  // further down, and placed before the virtual-model rewrite so it reads the model the caller
+  // actually selected -- and before auth, host-circuit admission, or any upstream byte.
+  //
+  // No terminal-helper or inbound-wire qualifier is needed here the way it is on the ordinary path:
+  // this endpoint is the native Codex compaction wire, and a vision/search helper never reaches it.
+  if (isCodexReserveOptInMissing(config, selectedModelId, admission)
+    && isCanonicalOpenAiForwardProvider(route.provider)) {
+    return formatErrorResponse(400, "invalid_request_error", CODEX_RESERVE_OPT_IN_REQUIRED_MESSAGE);
+  }
   const virtual = resolveOpenAiCompactModel(route.providerName, selectedModelId);
   if (virtual) {
     route.modelId = virtual.wireModelId;
@@ -1254,10 +1303,10 @@ export async function handleResponsesCompact(
     // synthetic buffer errors are not upstream bodies and stay uninspected.
     if (buffered.ok) {
       inspectResponseLogJson(logCtx, await buffered.clone().text());
-      forgetCompactHandoffRoute(req);
+      forgetCompactHandoffRoute(req, admission);
       rememberServingConversationStateIssuer(outcomeCtx, codexPoolAffinityKey(req.headers));
     } else if (quotaFailure && !storedPool401ReplayAttempted) {
-      const fallbackModel = compactHandoffRoute(req, raw.model);
+      const fallbackModel = compactHandoffRoute(req, admission, raw.model);
       if (fallbackModel && !req.signal.aborted) {
         const fallbackReq = new Request(req.url, {
           method: "POST",
@@ -1389,7 +1438,7 @@ export async function handleResponsesCompact(
     const result = new Response(JSON.stringify({ output: compactionItems }), {
       headers: { "Content-Type": "application/json" },
     });
-    rememberCompactHandoffRoute(req, raw.model);
+    rememberCompactHandoffRoute(req, admission, raw.model);
     return result;
   }
   const encrypted = compactionItems[0]!.encrypted_content;
@@ -1400,6 +1449,6 @@ export async function handleResponsesCompact(
   }
   const summary = decoded;
   const output = buildCompactV1Output(extractCompactUserMessages(inputItems), summary);
-  rememberCompactHandoffRoute(req, raw.model);
+  rememberCompactHandoffRoute(req, admission, raw.model);
   return new Response(JSON.stringify({ output }), { headers: { "Content-Type": "application/json" } });
 }

package/src/server/responses/core-codex-account.ts

@@ -32,6 +32,7 @@ import {
   resolveCodexModelEntitlements,
   invalidateCodexModelEntitlementsForAccount,
   entitledCodexAccountIdsForModel,
+  recordCodexModelDenialEvidence,
 } from "../../codex/model-entitlements";
 import type { TransientSendBudget } from "../../lib/upstream-retry";
 import { resolveAdapter, resolveWireProtocolOverride } from "../adapter-resolve";
@@ -161,43 +162,93 @@ export function normalizeCodexUnsupportedModelDetail(value: string): string {
 }
 
 
-export function isAllowListedCodexAccountModel400(
+/**
+ * The model id an authenticated Codex refusal names, or `undefined` when the body is not that
+ * refusal.
+ *
+ * Extracted rather than string-compared so the caller can learn WHICH model was refused. The
+ * route and the wire can legitimately disagree: `applyCodexAccountGatedWireNormalization`
+ * rewrites `gpt-daybreak-blue-latest` to `gpt-5.6-sol` before dispatch, so upstream names the
+ * model it was actually sent. Building the expected sentence from `route.modelId` alone made
+ * that comparison fail for the one model that is still account-gated, which silently disabled
+ * both the alternate-account retry and the same-account ladder built for exactly that case.
+ *
+ * The envelope is unchanged and stays exact: a top-level `detail` string, whitespace-collapsed
+ * and case-folded, matching the whole sentence with nothing before or after it. No prose is
+ * inferred and no other 400 shape is admitted, because a 400 is also what a malformed request
+ * earns and that must never read as an entitlement fact.
+ */
+export function codexUnsupportedModelFromDetail(
   status: number,
   bodyText: string,
-  modelId: string,
-): boolean {
-  if (status !== 400) return false;
+): string | undefined {
+  if (status !== 400) return undefined;
   try {
     const payload = JSON.parse(bodyText) as unknown;
-    if (!payload || typeof payload !== "object" || Array.isArray(payload)) return false;
+    if (!payload || typeof payload !== "object" || Array.isArray(payload)) return undefined;
     const detail = (payload as { detail?: unknown }).detail;
-    if (typeof detail !== "string") return false;
-    const expected = `The '${modelId}' model is not supported when using Codex with a ChatGPT account.`;
-    return normalizeCodexUnsupportedModelDetail(detail)
-      === normalizeCodexUnsupportedModelDetail(expected);
+    if (typeof detail !== "string") return undefined;
+    const matched = /^the '([^']{1,256})' model is not supported when using codex with a chatgpt account\.$/u
+      .exec(normalizeCodexUnsupportedModelDetail(detail));
+    return matched?.[1];
   } catch {
-    return false;
+    return undefined;
   }
 }
 
 
-export async function shouldRetryCodexPoolAccountModel400(
+/**
+ * The refused model id when this response is the exact unsupported-model refusal for this
+ * request, read from a bounded clone.
+ *
+ * Same admission rules {@link shouldRetryCodexPoolAccountModel400} always applied, which is now
+ * a predicate over this: a truncated or non-display-safe body proves nothing and is refused.
+ * Returning the id lets the caller record the denial against the model upstream actually named.
+ */
+export async function codexPoolAccountModel400Denial(
   response: Response,
   modelId: string,
   signal?: AbortSignal,
-): Promise<boolean> {
-  if (response.status !== 400) return false;
+  wireModelId?: string,
+): Promise<string | undefined> {
+  if (response.status !== 400) return undefined;
   try {
     const body = await readBoundedResponseBody(response.clone(), { signal });
-    return body.displaySafe
-      && !body.truncated
-      && isAllowListedCodexAccountModel400(response.status, body.text, modelId);
+    if (!body.displaySafe || body.truncated) return undefined;
+    return isAllowListedCodexAccountModel400(response.status, body.text, modelId, wireModelId)
+      ? codexUnsupportedModelFromDetail(response.status, body.text)
+      : undefined;
   } catch {
-    return false;
+    return undefined;
   }
 }
 
 
+export function isAllowListedCodexAccountModel400(
+  status: number,
+  bodyText: string,
+  modelId: string,
+  wireModelId?: string,
+): boolean {
+  const refused = codexUnsupportedModelFromDetail(status, bodyText);
+  if (refused === undefined) return false;
+  return [modelId, wireModelId].some(candidate => (
+    candidate !== undefined
+    && refused === normalizeCodexUnsupportedModelDetail(candidate)
+  ));
+}
+
+
+export async function shouldRetryCodexPoolAccountModel400(
+  response: Response,
+  modelId: string,
+  signal?: AbortSignal,
+  wireModelId?: string,
+): Promise<boolean> {
+  return await codexPoolAccountModel400Denial(response, modelId, signal, wireModelId) !== undefined;
+}
+
+
 /** Pre-stream quota/billing rejections that warrant one alternate-account attempt (#584). */
 export function codexQuotaFailureMessage(body: string): string | undefined {
   try {
@@ -778,15 +829,25 @@ export async function retryCodexPoolOnAlternateAccount(
       }
       retrySendCount += 1;
       args.onResponse?.(upstreamResponse, retryAuthCtx, request);
+      // The alternate account can refuse the same model, and that refusal is evidence about the
+      // account that produced it. Read BEFORE the ladder's own break, so the ordinary
+      // single-retry path -- every flagship model, which is the #4906 case -- records it too
+      // rather than only the gated ladder below. Without this the pool learns nothing from a
+      // refusal and the next request repeats the same selection.
+      const retryModelDenial = await codexPoolAccountModel400Denial(
+        upstreamResponse,
+        route.modelId,
+        options.abortSignal,
+        parsed.modelId,
+      );
+      if (retryModelDenial !== undefined) {
+        recordCodexModelDenialEvidence(retryAuthCtx.accountId, retryModelDenial);
+      }
       if (!retrySameConfirmedAccount || retrySendCount >= maxRetrySends) break;
       // Caller-owned main is an alternate-account replay and can never enter the bounded
       // same-stored-account 400 loop above. Keep that invariant explicit for the account-id reads.
       if (retryAuthCtx.kind === "main") break;
-      if (!await shouldRetryCodexPoolAccountModel400(
-        upstreamResponse,
-        route.modelId,
-        options.abortSignal,
-      )) break;
+      if (retryModelDenial === undefined) break;
       invalidateCodexModelEntitlementsForAccount(retryAuthCtx.accountId);
       let refreshed: Awaited<ReturnType<typeof resolveCodexModelEntitlements>>;
       try {

package/src/server/responses/core-normalize.ts

@@ -142,11 +142,18 @@ export async function applyFinalRouteRequestNormalization(args: {
     route.modelId,
   );
 
-  // Settle the wire once so logging, fast-mode, auth, and sidecars read the adapter
-  // this request will actually use (#404).
-  route.provider = resolveOpenCodeGoTransport(route.provider,
-    args.claudeGoAffinity ? args.claudeGoAffinity.sessionLane : getOrAllocateRequestSessionLane(req));
-  route.provider = resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire);
+  // Preserve the routed destination for Go recognition, then settle the wire before
+  // deriving protocol-scoped affinity. Recognition must not inspect the flipped adapter.
+  const routedProvider = route.provider;
+  const wireProvider = resolveWireProtocolOverride(
+    route.providerName,
+    route.modelId,
+    routedProvider,
+    inboundWire,
+  );
+  route.provider = resolveOpenCodeGoTransport(wireProvider,
+    args.claudeGoAffinity ? args.claudeGoAffinity.sessionLane : getOrAllocateRequestSessionLane(req),
+    routedProvider);
   parsed._plaintextV2AgentMessages = shouldPreparePlaintextV2AgentMessages({
     enabled: config.plaintextV2AgentMessages === true,
     inboundWire,

package/src/server/responses/fetch-helpers.ts

@@ -11,6 +11,7 @@ import type { WsData } from "../ws-bridge";
 import { waitForProviderRequestSlot } from "../../providers/request-pacing";
 import { withUpstreamHttpVersion } from "../../lib/upstream-http-version";
 import type { CodexWsQuotaObserver } from "./codex-ws-metadata";
+import { configuredOutboundFetch } from "../../lib/proxy-env";
 
 export { withUpstreamHttpVersion };
 
@@ -44,6 +45,31 @@ export function safeOriginLabel(url: string): string {
   }
 }
 
+/**
+ * Check whether a target host should bypass Bun's keep-alive pool reuse.
+ * Configured via the `OCX_FRESH_CONNECTION_HOSTS` environment variable (comma-separated).
+ */
+export function wantsFreshConnection(
+  input: Parameters<typeof globalThis.fetch>[0],
+  hostsEnv = process.env.OCX_FRESH_CONNECTION_HOSTS,
+): boolean {
+  if (!hostsEnv) return false;
+  try {
+    const rawUrl = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+    const host = new URL(rawUrl).hostname.toLowerCase();
+    const targets = hostsEnv
+      .split(",")
+      .map(h => h.trim().toLowerCase().replace(/^\.+/, ""))
+      .filter(Boolean);
+    for (const target of targets) {
+      if (host === target || host.endsWith(`.${target}`)) return true;
+    }
+  } catch {
+    /* unparseable target URL keeps default connection behavior */
+  }
+  return false;
+}
+
 
 
 export interface PaceAwareFetch {
@@ -53,6 +79,38 @@ export interface PaceAwareFetch {
 
 export type ProviderFetch = typeof globalThis.fetch & PaceAwareFetch;
 
+/**
+ * Apply the physical-send connection policy to whichever fetch actually performs the send.
+ *
+ * The executor `providerFetch` builds is not the only physical boundary. A `dispatchOverride`
+ * that revalidates credentials re-reads `route.provider.fetch` at send time -- reselection can
+ * install a different provider transport after this wrapper was constructed -- and then calls
+ * that fetch directly instead of the supplied executor. Keeping the policy inside the executor
+ * alone therefore left every provider-scoped transport reusing a pooled socket for a host the
+ * operator had named in `OCX_FRESH_CONNECTION_HOSTS` (#4992). The policy belongs around the
+ * selected fetch so it follows the selection rather than the construction.
+ *
+ * Idempotent on purpose: an override that hands the send back to the supplied executor passes
+ * through here twice, and both passes derive the same headers from the same wire URL.
+ */
+export function sendWithConnectionPolicy(
+  physicalFetch: typeof globalThis.fetch,
+  input: Parameters<typeof globalThis.fetch>[0],
+  init?: RequestInit,
+): Promise<Response> {
+  const headers = new Headers(init?.headers ?? (input instanceof Request ? input.headers : undefined));
+  const fresh = wantsFreshConnection(input);
+  if (fresh) {
+    headers.set("Connection", "close");
+  }
+  return physicalFetch(input, {
+    ...init,
+    headers,
+    redirect: "manual",
+    ...(fresh ? { keepalive: false } : {}),
+  });
+}
+
 export interface ProviderFetchOptions {
   nativeControl?: NativeResponseControl;
   providerName?: string;
@@ -72,7 +130,11 @@ export function providerFetch(
   runtime: BunRuntimeGateInput = currentBunRuntimeIdentity(),
   options: ProviderFetchOptions = {},
 ): ProviderFetch {
-  const base = (provider as OcxProviderConfig & { fetch?: typeof globalThis.fetch }).fetch ?? globalThis.fetch;
+  const configuredFetch = Object.assign(
+    (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit) => configuredOutboundFetch(input, init),
+    { preconnect: globalThis.fetch.preconnect?.bind(globalThis.fetch) },
+  ) as typeof globalThis.fetch;
+  const base = (provider as OcxProviderConfig & { fetch?: typeof globalThis.fetch }).fetch ?? configuredFetch;
   const preconnect = (...args: Parameters<typeof globalThis.fetch.preconnect>): void => {
     base.preconnect?.(...args);
   };
@@ -80,11 +142,15 @@ export function providerFetch(
   // Return the original 3xx so the response owner retains its retry/health/relay contract.
   const dispatch = Object.assign(
     (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit) =>
-      base(input, { ...init, redirect: "manual" }),
+      sendWithConnectionPolicy(base, input, init),
     { preconnect },
   ) as typeof globalThis.fetch;
   const httpFetch = Object.assign(
     async (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit) => {
+      // The hook inspects the outgoing headers and refuses the send by throwing; it is not a
+      // mutator, and the copy it receives is deliberately not threaded onward. `Connection`
+      // is decided inside `dispatch`, which runs after this, so the fresh-connection policy
+      // wins regardless of what any caller or hook put in the header.
       options.beforeDispatch?.(new Headers(init?.headers ?? (input instanceof Request ? input.headers : undefined)));
       const dispatchInit = { ...withUpstreamHttpVersion(input, init, provider), timeout: 0 };
       return options.dispatchOverride

package/src/server/responses/passthrough-delivery.ts

@@ -30,7 +30,7 @@ import type { ResponsesTerminalStatus } from "../../bridge";
 import { isCodexWsQuotaObservedResponse, isCodexWsUpstreamResponse } from "./ws-upstream";
 import { recordSubagentQuotaFailureForThreadSpawn } from "../../codex/subagent-model-fallback";
 import { recordCodexUpstreamOutcome } from "../../codex/routing";
-import { codexProbeLeaseId, codexProbeQuotaScope, codexTransientProbeGrant } from "../../codex/auth-context";
+import { codexProbeLeaseId, codexProbeQuotaScope, codexTransientProbeGrant, releaseCodexAuthContextProbeLease } from "../../codex/auth-context";
 import { consumeComboFailure } from "./core-combo-failure";
 import { readDisplaySafeErrorText } from "./core-errors";
 import { streamingContextOverflowResponse, jsonContextOverflowResponse } from "./context-overflow";
@@ -45,6 +45,7 @@ import {
   createPassthroughWebSearchBridgeStream,
   createPassthroughWebSearchBridgeExecutor,
 } from "../../web-search/passthrough-bridge";
+import { bridgeSearchReplayScope } from "../../responses/bridge-search-replay-cache";
 import { fetchWithHeaderTimeout, providerFetch } from "./fetch-helpers";
 import { providerApiKeySelectionIsCurrent } from "../../providers/api-key-selection";
 import { requiresVisionPreprocessing } from "../../vision";
@@ -402,12 +403,20 @@ export async function deliverPassthroughResponse(
             describeImages: requiresVisionPreprocessing(config, route.provider, route.modelId, route.providerName),
             sidecar: config.webSearchSidecar,
           }),
+          // Scope the executed-search memo to this exact upstream (#4587). The Responses adapter
+          // derives the same scope from the same base URL before the NEXT turn is dispatched, so
+          // a replayed hosted cell can be turned back into the destination's own call and result.
+          destinationScope: bridgeSearchReplayScope(route.provider.baseUrl),
           // Appending a search result can push the continuation past the ceiling the first leg
           // was admitted under, so the same limit is re-applied before every later send.
           checkOutboundBody: (continuationBody: string) => {
             const result = checkOutboundBodySize(continuationBody, config.maxUpstreamBodyBytes);
             return result.admitted ? undefined : describeOutboundBodyRefusal(result);
           },
+          // Resolution can acquire the account's sole cooldown-recovery probe before the routed
+          // provider reveals whether it will request search. Hand an unused lease back on every
+          // terminal path; after an executed search, the outcome recorder has already settled it.
+          onFinalize: () => releaseCodexAuthContextProbeLease(openAiSidecar?.authContext),
           signal: upstream.signal,
         })
         : upstreamResponse.body;