@bitkyc08/opencodex 2.58.0 → 2.60.0

package/src/server/claude-messages.ts

@@ -29,7 +29,7 @@ import {
 } from "../claude/outbound";
 import { clearableDeadline, idleDeadline } from "../lib/abort";
 import { estimateTokens } from "../lib/token-estimate";
-import { NoEligiblePolicyCandidateError, UnknownRoutingPolicyError, routeModel } from "../router";
+import { captureRouteStaticPolicy, NoEligiblePolicyCandidateError, UnknownRoutingPolicyError, routeModel } from "../router";
 import { evidenceFromBody } from "../routing/request-evidence";
 import { resolveWireProtocolOverride } from "./adapter-resolve";
 import type { OcxConfig } from "../types";
@@ -420,7 +420,7 @@ async function anthropicNativePassthrough(
   // count_tokens too — counts must match what the real send will contain, and the 32MB
   // body cap applies to it equally. Non-message bodies pass through untouched.
   if (Array.isArray(body.messages)) {
-    await normalizeAnthropicImages(body.messages);
+    await normalizeAnthropicImages(body.messages, { abortSignal: req.signal });
     enforceAnthropicImageLimits(body.messages);
   }
   const headers = new Headers();
@@ -790,6 +790,22 @@ async function handleClaudeMessagesWithBudget(
 
   if (!requestedModel) requestedModel = (anthropicBody as Rec).model as string;
   const stream = internalBody.stream === true;
+  /**
+   * This proxy's count of the prompt it is about to forward, computed at most once.
+   *
+   * Two readers want it and they want it under different rules. The usage log takes it as a
+   * floor only for estimated-usage adapters, because its merge is `max(reported, estimate)` and
+   * would otherwise overwrite real usage. `message_start` takes it whenever the upstream sent
+   * no confirmed usage before the first frame, where nothing is merged and the terminal
+   * `message_delta` still corrects it (#4857).
+   */
+  let requestTokenFloor: number | undefined;
+  const claudeRequestTokenFloor = (): number => {
+    if (requestTokenFloor === undefined) {
+      requestTokenFloor = estimateClaudeRequestTokens(anthropicBody as Rec, requestedModel);
+    }
+    return requestTokenFloor;
+  };
   // Routed adapters only support streamed turns; always stream internally and fold
   // the translated Anthropic SSE into a message JSON for non-streaming clients.
   internalBody.stream = true;
@@ -801,7 +817,10 @@ async function handleClaudeMessagesWithBudget(
     const route = routeModel(config, internalBody.model as string, evidenceFromBody(internalBody));
     // Settle the wire once so the sampling decision below reads the effective
     // adapter rather than the provider-wide default (#404).
-    route.provider = resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, "anthropic");
+    route.staticPolicy = captureRouteStaticPolicy(
+      route.providerName, route.modelId, route.provider, route.staticPolicy.effectiveAlias, "anthropic",
+    );
+    route.provider = resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, "anthropic", route.staticPolicy);
     logCtx.routeDecision = route.routeDecision;
     if (route.provider.adapter === "openai-responses") {
       delete internalBody.max_output_tokens;
@@ -815,7 +834,7 @@ async function handleClaudeMessagesWithBudget(
     // accurate-usage adapters — the request-log merge is max(reported, estimate) and
     // would overwrite real usage (audit 133 R1#7).
     if (route.provider.adapter === "cursor" || route.provider.adapter === "kiro") {
-      logCtx.usageLogInputTokens = estimateClaudeRequestTokens(anthropicBody as Rec, requestedModel);
+      logCtx.usageLogInputTokens = claudeRequestTokenFloor();
     }
     // Effort safety valve (devlog 136 B6, audit 139 R2#2): opus-shaped aliases make
     // every routed model look like a reasoning model to Claude clients, so a forced
@@ -988,7 +1007,13 @@ async function handleClaudeMessagesWithBudget(
 
   const contentType = response.headers.get("content-type") ?? "";
   if (contentType.includes("text/event-stream") && response.body) {
-    const anthropicSse = responsesSseToAnthropicSse(response.body, requestedModel, { translatorBudget });
+    const anthropicSse = responsesSseToAnthropicSse(response.body, requestedModel, {
+      translatorBudget,
+      // Only a floor, and only for the first frame: an upstream that reports usage early wins
+      // over it inside the translator, and the terminal `message_delta` carries the
+      // authoritative count either way (#4857).
+      inputTokenFloor: claudeRequestTokenFloor(),
+    });
     if (stream) {
       return new Response(anthropicSse, {
         status: 200,

package/src/server/effort-row.ts

@@ -30,7 +30,9 @@ export interface EffortRowOptions {
 }
 
 export function isKnownId(knownIds: EffortRowKnownIds | undefined, id: string): boolean {
-  return typeof knownIds === "function" ? knownIds(id) : knownIds?.has(id) === true;
+  return typeof knownIds === "function"
+    ? knownIds(id)
+    : knownIds?.has(id) === true || knownIds?.has(id.toLowerCase()) === true;
 }
 
 export function effortRowId(baseId: string, effort: string): string {
@@ -43,6 +45,12 @@ export function effortRowId(baseId: string, effort: string): string {
  */
 export function knownEffortRowIds(config: OcxConfig): Set<string> {
   const ids = new Set<string>();
+  const addAlias = (id: string): void => {
+    ids.add(id);
+    // Model aliases are resolved case-insensitively. Preserve that contract here so an
+    // alias cannot be mistaken for a synthetic effort row before ordinary routing runs.
+    ids.add(id.toLowerCase());
+  };
   for (const [providerName, provider] of Object.entries(config.providers)) {
     const known = knownModelIdsForProvider(providerName, provider, config);
     const namespaces = [providerName, provider.alias].filter((value): value is string => (
@@ -54,8 +62,8 @@ export function knownEffortRowIds(config: OcxConfig): Set<string> {
       for (const namespace of namespaces) ids.add(`${namespace}/${id}`);
     }
     for (const alias of Object.values(provider.modelAliases ?? {})) {
-      ids.add(alias);
-      for (const namespace of namespaces) ids.add(`${namespace}/${alias}`);
+      addAlias(alias);
+      for (const namespace of namespaces) addAlias(`${namespace}/${alias}`);
     }
   }
   for (const [id, combo] of Object.entries(config.combos ?? {})) {

package/src/server/grok-responses-control-frame.ts

@@ -1,10 +1,137 @@
-import { sseDataPayload, type SseBlockRewrite } from "./sse-payload-rewrite";
+import { replaceSseDataPayload, sseDataPayload, type SseBlockRewrite } from "./sse-payload-rewrite";
 
 const GROK_CONTROL_FRAME_TYPES: Record<string, true> = {
   "codex.rate_limits": true,
   "codex.response.metadata": true,
 };
 
+const GROK_RESPONSE_INTEGER_TIMESTAMP_FIELDS = ["created_at", "completed_at"] as const;
+
+type JsonRange = { start: number; end: number };
+
+function skipJsonWhitespace(payload: string, index: number): number {
+  while (index < payload.length && /[\t\n\r ]/.test(payload[index] ?? "")) index += 1;
+  return index;
+}
+
+function findJsonStringEnd(payload: string, start: number): number | undefined {
+  for (let index = start + 1; index < payload.length; index += 1) {
+    if (payload[index] === "\\") index += 1;
+    else if (payload[index] === '"') return index + 1;
+  }
+  return undefined;
+}
+
+function findJsonValueEnd(payload: string, start: number): number | undefined {
+  if (payload[start] === '"') return findJsonStringEnd(payload, start);
+  if (payload[start] !== "{" && payload[start] !== "[") {
+    let index = start;
+    while (index < payload.length && !",}]".includes(payload[index] ?? "")) index += 1;
+    return index;
+  }
+
+  let depth = 0;
+  let inString = false;
+  for (let index = start; index < payload.length; index += 1) {
+    const char = payload[index];
+    if (inString) {
+      if (char === "\\") index += 1;
+      else if (char === '"') inString = false;
+      continue;
+    }
+    if (char === '"') inString = true;
+    else if (char === "{" || char === "[") depth += 1;
+    else if (char === "}" || char === "]") {
+      depth -= 1;
+      if (depth === 0) return index + 1;
+    }
+  }
+  return undefined;
+}
+
+function findResponseObjectRange(payload: string): JsonRange | null {
+  let cursor = skipJsonWhitespace(payload, 0);
+  if (payload[cursor] !== "{") return null;
+  cursor += 1;
+  let responseRange: JsonRange | null = null;
+
+  while (cursor < payload.length) {
+    cursor = skipJsonWhitespace(payload, cursor);
+    if (payload[cursor] === "}") return responseRange;
+    if (payload[cursor] !== '"') return null;
+    const keyEnd = findJsonStringEnd(payload, cursor);
+    if (keyEnd === undefined) return null;
+    let key: unknown;
+    try {
+      key = JSON.parse(payload.slice(cursor, keyEnd));
+    } catch {
+      return null;
+    }
+
+    cursor = skipJsonWhitespace(payload, keyEnd);
+    if (payload[cursor] !== ":") return null;
+    const valueStart = skipJsonWhitespace(payload, cursor + 1);
+    const valueEnd = findJsonValueEnd(payload, valueStart);
+    if (valueEnd === undefined) return null;
+    if (key === "response" && payload[valueStart] === "{") {
+      responseRange = { start: valueStart, end: valueEnd };
+    }
+
+    cursor = skipJsonWhitespace(payload, valueEnd);
+    if (payload[cursor] === "}") return responseRange;
+    if (payload[cursor] !== ",") return null;
+    cursor += 1;
+  }
+  return null;
+}
+
+function rewriteIntegralTimestamp(payload: string, field: string, value: number, event: unknown): string | null {
+  const responseRange = findResponseObjectRange(payload);
+  if (responseRange === null) return null;
+  let cursor = responseRange.start + 1;
+  let candidate: { start: number; length: number } | null = null;
+  while (cursor < responseRange.end) {
+    cursor = skipJsonWhitespace(payload, cursor);
+    if (payload[cursor] === "}") break;
+    if (payload[cursor] !== '"') return null;
+    const keyEnd = findJsonStringEnd(payload, cursor);
+    if (keyEnd === undefined) return null;
+    let key: unknown;
+    try {
+      key = JSON.parse(payload.slice(cursor, keyEnd));
+    } catch {
+      return null;
+    }
+    cursor = skipJsonWhitespace(payload, keyEnd);
+    if (payload[cursor] !== ":") return null;
+    const valueStart = skipJsonWhitespace(payload, cursor + 1);
+    const valueEnd = findJsonValueEnd(payload, valueStart);
+    if (valueEnd === undefined || valueEnd > responseRange.end) return null;
+    const valueToken = payload.slice(valueStart, valueEnd).trimEnd();
+    if (
+      key === field &&
+      /^-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?$/.test(valueToken) &&
+      valueToken !== String(value) &&
+      Number(valueToken) === value
+    ) {
+      if (candidate !== null) return null;
+      candidate = { start: valueStart, length: valueToken.length };
+    }
+    cursor = skipJsonWhitespace(payload, valueEnd);
+    if (payload[cursor] === "}") break;
+    if (payload[cursor] !== ",") return null;
+    cursor += 1;
+  }
+  if (candidate === null) return payload;
+
+  const rewritten = `${payload.slice(0, candidate.start)}${value}${payload.slice(candidate.start + candidate.length)}`;
+  try {
+    return JSON.stringify(JSON.parse(rewritten)) === JSON.stringify(event) ? rewritten : null;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Hide Codex-only control frames from Grok's strict Responses decoder.
  *
@@ -41,3 +168,35 @@ export function createGrokResponsesControlFrameBlockRewrite(): SseBlockRewrite {
       : [block];
   };
 }
+
+/** Normalize safe integer response timestamps for Grok's strict Responses decoder. */
+export function createGrokResponsesTimestampBlockRewrite(): SseBlockRewrite {
+  return (block) => {
+    const payload = sseDataPayload(block);
+    if (payload === null || payload === "[DONE]") return [block];
+
+    let event: unknown;
+    try {
+      event = JSON.parse(payload);
+    } catch {
+      return [block];
+    }
+    if (!event || typeof event !== "object" || Array.isArray(event)) return [block];
+    const eventRecord = event as Record<string, unknown>;
+    if (typeof eventRecord.type !== "string" || !eventRecord.type.startsWith("response.")) return [block];
+    if (!eventRecord.response || typeof eventRecord.response !== "object" || Array.isArray(eventRecord.response)) {
+      return [block];
+    }
+    const response = eventRecord.response as Record<string, unknown>;
+    let rewrittenPayload = payload;
+    for (const field of GROK_RESPONSE_INTEGER_TIMESTAMP_FIELDS) {
+      const value = response[field];
+      if (value === undefined) continue;
+      if (typeof value !== "number" || value < 0 || !Number.isSafeInteger(value)) return [block];
+      const rewritten = rewriteIntegralTimestamp(rewrittenPayload, field, value, event);
+      if (rewritten === null) return [block];
+      rewrittenPayload = rewritten;
+    }
+    return rewrittenPayload === payload ? [block] : [replaceSseDataPayload(block, rewrittenPayload)];
+  };
+}

package/src/server/gui-static.ts

@@ -1,5 +1,5 @@
 import { existsSync, readFileSync, statSync } from "node:fs";
-import { extname, isAbsolute, join, relative, resolve } from "node:path";
+import { basename, extname, isAbsolute, join, relative, resolve } from "node:path";
 import { browserSecurityHeaders } from "./auth-cors";
 import type { GuiSessionBootstrap } from "./gui-session";
 
@@ -18,6 +18,12 @@ const MIME_TYPES: Record<string, string> = {
   ".ico": "image/x-icon",
 };
 
+/**
+ * Matches Vite's content-hashed bundle filenames (e.g. `index-B5r7LNHN.js` or `style-D5SiRo8X.css`).
+ * Unhashed static assets (e.g. `runtime-config.js` or unversioned icons) must not be cached immutably.
+ */
+const HASHED_ASSET_PATTERN = /-[a-zA-Z0-9_-]{8,}\.[a-zA-Z0-9]+$/;
+
 function findGuiDist(): string | null {
   const candidates = [
     join(import.meta.dir, "..", "..", "gui", "dist"),
@@ -146,6 +152,14 @@ export function serveSessionBootstrap(session: GuiSessionBootstrap): Response {
   return htmlDocumentResponse(html);
 }
 
+/**
+ * Serves a GUI static file from the distribution directory.
+ * Returns a Response with MIME type and appropriate Cache-Control headers:
+ * - HTML files receive `no-store` to guarantee immediate bootstrap updates.
+ * - Content-hashed bundles under `assets/` receive 1-year `immutable` caching.
+ * - Non-hashed static files (e.g. favicon, unhashed assets) receive `no-cache` for prompt revalidation.
+ * Returns null if the file cannot be found or resolved.
+ */
 export function serveGuiFile(
   pathname: string,
   guiDist = findGuiDist(),
@@ -170,11 +184,31 @@ export function serveGuiFile(
   const ext = extname(filePath);
   const contentType = MIME_TYPES[ext] || "application/octet-stream";
   if (ext === ".html") return htmlResponse(filePath, session, runtimeRole, managementAuthRequired);
+
+  const root = resolve(guiDist);
+  // "assets/" matches Vite's default assetsDir (gui/vite.config.ts). If that value is
+  // ever changed, update this prefix to match. filePath is already resolve()-normalized
+  // by resolveGuiFilePath, so rel cannot contain ".." fragments.
+  //
+  // Immutable 1-year caching is only applied when the file is under assets/ AND its basename
+  // matches Vite's content-hash pattern (e.g. index-B5r7LNHN.js). Any unhashed asset under
+  // assets/ (e.g. runtime-config.js) or elsewhere falls back to no-cache so clients revalidate,
+  // whereas index.html uses no-store above to avoid storing any bootstrap state.
+  const rel = relative(root, filePath).replace(/\\/g, "/");
+  const isHashedAsset = rel.startsWith("assets/") && HASHED_ASSET_PATTERN.test(basename(filePath));
+  const cacheControl = isHashedAsset
+    ? "public, max-age=31536000, immutable"
+    : "no-cache";
+
   // Snapshot bytes before returning the response. Bun.file is lazy: if gui/dist is replaced
   // after Bun frames the response but before the stream finishes, its Content-Length can
   // describe the old file while the body comes from the new one (#2792).
   return new Response(readFileSync(filePath), {
-    headers: { "Content-Type": contentType, ...browserSecurityHeaders() },
+    headers: {
+      "Content-Type": contentType,
+      "Cache-Control": cacheControl,
+      ...browserSecurityHeaders(),
+    },
   });
 }
 

package/src/server/inbound-body-admission.ts

@@ -0,0 +1,187 @@
+import {
+  MAX_CONFIGURABLE_INBOUND_BODY_BYTES,
+  MAX_DECOMPRESSED_BODY_BYTES,
+  resolveInboundBodyLimitBytes,
+} from "./request-decompress";
+import { withCors, type RequestPolicyView } from "./auth-cors";
+import { codexCompatibleUrl } from "../codex/context-compat";
+import { addFinalRequestLog, markLocalRequestLogRefusal } from "./request-log";
+import type { WorkflowRefusalLog } from "./workflow-refusal";
+
+/** Admission units, not a bound on process RSS or the size of parsed object graphs. */
+export const MAX_CONCURRENT_INBOUND_BODY_BYTES = MAX_CONFIGURABLE_INBOUND_BODY_BYTES;
+let reservedInboundBodyBytes = 0;
+
+// Match the HTTP routes whose JSON readers use maxInboundBodyBytes. Keep the
+// current image/search/count_tokens support; management, audio, context relay,
+// and WebSocket frames have separate limits and are not part of this gate.
+// Exported so the contract tests classify the dispatcher's own route list
+// instead of copying it: a new loopback route has to land in one of these two
+// sets, or `tests/server/server-request-body-size.test.ts` fails.
+export const CONFIGURABLE_JSON_BODY_ROUTES: ReadonlySet<string> = new Set([
+  "/v1/responses",
+  "/v1/responses/compact",
+  "/v1/chat/completions",
+  "/v1/messages",
+  "/v1/messages/count_tokens",
+  "/v1/images/generations",
+  "/v1/images/edits",
+  "/v1/alpha/search",
+]);
+
+/**
+ * Loopback routes deliberately outside this gate. Audio uploads, realtime/live
+ * control and the model list do not read JSON under `maxInboundBodyBytes`, so
+ * reserving that allowance for them would refuse traffic the limit never covered.
+ */
+export const UNGATED_LOOPBACK_ROUTES: ReadonlySet<string> = new Set([
+  "/v1/audio/transcriptions",
+  "/v1/audio/transcriptions/stream",
+  "/v1/models",
+  "/v1/realtime",
+  "/v1/realtime/calls",
+  "/v1/live",
+]);
+
+export class InboundBodyCapacityError extends Error {
+  constructor() {
+    super("OpenCodex inbound request body capacity is temporarily exhausted. Retry after the current request completes.");
+    this.name = "InboundBodyCapacityError";
+  }
+}
+
+function cancelUnreadBody(req: Request, reason: unknown): void {
+  if (!req.body || req.body.locked) return;
+  try {
+    // A tee's cancellation can wait for the other branch. Refusal must not wait
+    // for a peer that has not finished uploading, or for an unconsumed clone.
+    void req.body.cancel(reason).catch(() => undefined);
+  } catch { /* Non-standard streams may throw synchronously. */ }
+}
+
+function capacityResponse(pathname: string, error: InboundBodyCapacityError): Response {
+  const anthropic = pathname === "/v1/messages" || pathname === "/v1/messages/count_tokens";
+  return Response.json({
+    ...(anthropic ? { type: "error" } : {}),
+    error: {
+      type: anthropic ? "overloaded_error" : "server_error",
+      code: "server_busy",
+      message: error.message,
+    },
+  }, { status: 503, headers: { "Retry-After": "1" } });
+}
+
+function retainUntilResponseSettles(response: Response, release: () => void): Response {
+  if (!response.body) {
+    release();
+    return response;
+  }
+  const reader = response.body.getReader();
+  let cancelling = false;
+  let finalized = false;
+  const finalize = (): void => {
+    if (finalized) return;
+    finalized = true;
+    try { reader.releaseLock(); } finally { release(); }
+  };
+  const body = new ReadableStream<Uint8Array>({
+    async pull(controller) {
+      try {
+        const result = await reader.read();
+        // cancel() can resolve a pending read as EOF before the producer's
+        // asynchronous cancellation completes. Only cancel owns release then.
+        if (cancelling) return;
+        if (result.done) {
+          finalize();
+          controller.close();
+        } else {
+          controller.enqueue(result.value);
+        }
+      } catch (error) {
+        if (cancelling) return;
+        finalize();
+        controller.error(error);
+      }
+    },
+    async cancel(reason) {
+      cancelling = true;
+      try { await reader.cancel(reason); } finally { finalize(); }
+    },
+  }, { highWaterMark: 0 });
+  // This is the outermost HTTP wrapper, after protocol conversion, relay
+  // preflight and request logging; no internal relay marker is consumed later.
+  return new Response(body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: response.headers,
+  });
+}
+
+/**
+ * Own one raised-limit HTTP request from before body reading through response
+ * EOF/error or settled cancellation. Call only at the admitted HTTP boundary,
+ * after auth/origin checks, not from readers or internal combo/translation hops.
+ * pathname is the same canonical pathname used by the server's dispatcher.
+ */
+export async function withRaisedInboundBodyAdmission(
+  req: Request,
+  pathname: string,
+  configuredLimit: number | undefined,
+  work: () => Promise<Response>,
+  onRefusal: (response: Response) => Response = response => response,
+): Promise<Response> {
+  const maxBytes = resolveInboundBodyLimitBytes(configuredLimit);
+  if (req.method !== "POST" || !CONFIGURABLE_JSON_BODY_ROUTES.has(pathname)
+    || maxBytes <= MAX_DECOMPRESSED_BODY_BYTES || req.signal.aborted) {
+    return work();
+  }
+  const declared = req.headers.get("content-length");
+  const declaredBytes = declared === null || declared.trim() === "" ? NaN : Number(declared);
+  if (Number.isFinite(declaredBytes) && declaredBytes > maxBytes) {
+    // The existing bounded reader rejects this before allocating. Let its
+    // protocol-specific 413 win over temporary capacity refusal, unchanged.
+    return work();
+  }
+  if (maxBytes > MAX_CONCURRENT_INBOUND_BODY_BYTES - reservedInboundBodyBytes) {
+    const error = new InboundBodyCapacityError();
+    cancelUnreadBody(req, error);
+    return onRefusal(capacityResponse(pathname, error));
+  }
+  reservedInboundBodyBytes += maxBytes;
+  let released = false;
+  const release = (): void => {
+    if (released) return;
+    released = true;
+    reservedInboundBodyBytes -= maxBytes;
+  };
+  try {
+    return retainUntilResponseSettles(await work(), release);
+  } catch (error) {
+    release();
+    throw error;
+  }
+}
+
+/**
+ * The admitted HTTP call site. Refusal is recorded as a local terminal and
+ * carries the receiving listener's CORS headers, so a browser dashboard can
+ * read it. No request content is read or logged on this path.
+ */
+export function runAdmittedBodyWork(
+  req: Request,
+  policy: RequestPolicyView,
+  configuredLimit: number | undefined,
+  work: () => Promise<Response>,
+  refusalLog?: WorkflowRefusalLog,
+): Promise<Response> {
+  return withRaisedInboundBodyAdmission(req, codexCompatibleUrl(req.url).pathname, configuredLimit, work, refused => {
+    if (refusalLog) {
+      markLocalRequestLogRefusal(refusalLog.logCtx, "server_busy");
+      refusalLog.logCtx.errorCode = "server_busy";
+      addFinalRequestLog(refusalLog.requestId, refusalLog.start, refusalLog.logCtx, refused.status, {
+        closeReason: "terminal",
+      });
+    }
+    return withCors(refused, req, policy);
+  });
+}