@bitkyc08/opencodex 2.59.0 → 2.61.0-preview.20260922

package/src/server/responses/fetch-helpers.ts

@@ -12,9 +12,57 @@ import { waitForProviderRequestSlot } from "../../providers/request-pacing";
 import { withUpstreamHttpVersion } from "../../lib/upstream-http-version";
 import type { CodexWsQuotaObserver } from "./codex-ws-metadata";
 import { configuredOutboundFetch } from "../../lib/proxy-env";
+import {
+  describeProviderEgressForLog,
+  markEgressTransparentExecutor,
+  providerEgressSendInit,
+  providerEgressIsExplicit,
+  resolveProviderEgress,
+  type ProviderEgressBinding,
+} from "../../lib/provider-egress";
+import { redactSecretString } from "../../lib/redact";
 
 export { withUpstreamHttpVersion };
 
+const egressWebsocketDowngradeWarned = new Set<string>();
+/** A provider name is configuration-controlled, so the notice set is bounded like any cache. */
+const EGRESS_DOWNGRADE_NOTICE_LIMIT = 64;
+/**
+ * Marks an init whose provider egress route an outer physical-send boundary already decided.
+ *
+ * Own symbol keys survive object spread, so the mark travels through the rebuild a
+ * `dispatchOverride` performs, and an unknown symbol on a `RequestInit` is inert at the wire.
+ */
+const EGRESS_DECIDED = Symbol.for("opencodex.provider-egress.decided");
+
+/**
+ * Announce once, per provider, that an explicit egress route moved this provider off the
+ * WebSocket fast lane.
+ *
+ * The WebSocket upstream selects its proxy from the process environment when it dials, so it
+ * cannot carry a per-provider route. Serving the turn over HTTP/SSE honours the operator's
+ * egress choice, which is the one that has to win — but a transport change the operator did
+ * not ask for is exactly the kind of substitution this batch refuses to make silently, so it
+ * is stated rather than merely done.
+ */
+function warnEgressWebsocketDowngradeOnce(providerName: string, egress: string): void {
+  if (egressWebsocketDowngradeWarned.has(providerName)) return;
+  if (egressWebsocketDowngradeWarned.size >= EGRESS_DOWNGRADE_NOTICE_LIMIT) return;
+  egressWebsocketDowngradeWarned.add(providerName);
+  console.warn(
+    // The name is caller-controlled and can be token-shaped, so it is redacted and JSON-escaped
+    // before it reaches a log, exactly as at the management error boundary.
+    `[opencodex] provider ${JSON.stringify(redactSecretString(providerName))} declares egress ${egress}; the WebSocket upstream `
+    + "selects its proxy from the process environment and cannot carry a per-provider route, "
+    + "so these turns are served over HTTP/SSE.",
+  );
+}
+
+/** Test seam: the downgrade notice is once per provider per process, not once per request. */
+export function __resetEgressWebsocketDowngradeNotices(): void {
+  egressWebsocketDowngradeWarned.clear();
+}
+
 export function disableResponsesRequestTimeout(req: Request, server: Pick<Server<WsData>, "timeout"> | undefined): boolean {
   if (!server) return false;
   try {
@@ -97,21 +145,43 @@ export function sendWithConnectionPolicy(
   physicalFetch: typeof globalThis.fetch,
   input: Parameters<typeof globalThis.fetch>[0],
   init?: RequestInit,
+  egress?: ProviderEgressBinding,
 ): Promise<Response> {
   const headers = new Headers(init?.headers ?? (input instanceof Request ? input.headers : undefined));
   const fresh = wantsFreshConnection(input);
   if (fresh) {
     headers.set("Connection", "close");
   }
+  // Decided here, against the destination this send is actually going to, and around whichever
+  // executor was just selected. A `dispatchOverride` that rebuilds a queued request can change
+  // both the upstream host and the provider transport after the wrapper was constructed, so a
+  // route resolved at construction could be applied to a different host than it was decided for.
+  // These calls nest: an override decides with its own binding and then hands the send to the
+  // executor `providerFetch` supplied, which is another one of these. The outermost caller holds
+  // the reselected provider and the rebuilt destination, so it decides and marks the init; the
+  // inner pass honours that mark rather than recomputing from a stale closure.
+  const alreadyDecided = (init as Record<symbol, unknown> | undefined)?.[EGRESS_DECIDED] === true;
+  const decide = egress !== undefined && !alreadyDecided;
+  const egressInit = decide ? providerEgressSendInit(egress, physicalFetch, input) : {};
   return physicalFetch(input, {
     ...init,
     headers,
     redirect: "manual",
     ...(fresh ? { keepalive: false } : {}),
+    ...egressInit,
+    ...(decide ? { [EGRESS_DECIDED]: true } : {}),
   });
 }
 
 export interface ProviderFetchOptions {
+  /**
+   * Keep this send on HTTP even where the WebSocket upstream would normally be selected.
+   *
+   * Set by a caller replacing an HTTP stream that already failed: a WS create frame is a
+   * different send on a different transport, and the replacement has to be the same kind of
+   * exchange the client is already reading.
+   */
+  httpOnly?: boolean;
   nativeControl?: NativeResponseControl;
   providerName?: string;
   modelId?: string;
@@ -130,28 +200,63 @@ export function providerFetch(
   runtime: BunRuntimeGateInput = currentBunRuntimeIdentity(),
   options: ProviderFetchOptions = {},
 ): ProviderFetch {
-  const configuredFetch = Object.assign(
+  const providerName = options.providerName ?? "<unnamed provider>";
+  const customExecutor = (provider as OcxProviderConfig & { fetch?: typeof globalThis.fetch }).fetch;
+  // The route is applied at the physical send (see `sendWithConnectionPolicy`). This binding is
+  // only what that boundary needs to decide it.
+  const egressBinding: ProviderEgressBinding = { providerName, provider };
+  // Resolved per request, not once per wrapper: `providers.<name>.noProxy` is evaluated against
+  // the destination, so two requests through the same executor can legitimately take different
+  // routes. A malformed value throws and rejects the request rather than degrading to the
+  // global proxy or to direct, either of which would read as success at the call site.
+  const egressFor = (input: Parameters<typeof globalThis.fetch>[0]) => resolveProviderEgress({
+    providerName,
+    provider,
+    url: typeof input === "string" ? input : input instanceof URL ? input : input.url,
+  });
+  // The built-in executor forwards its init to a transport that honours the proxy option.
+  const configuredFetch = markEgressTransparentExecutor(Object.assign(
     (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit) => configuredOutboundFetch(input, init),
     { preconnect: globalThis.fetch.preconnect?.bind(globalThis.fetch) },
-  ) as typeof globalThis.fetch;
-  const base = (provider as OcxProviderConfig & { fetch?: typeof globalThis.fetch }).fetch ?? configuredFetch;
+  ) as typeof globalThis.fetch);
+  const base = customExecutor ?? configuredFetch;
   const preconnect = (...args: Parameters<typeof globalThis.fetch.preconnect>): void => {
     base.preconnect?.(...args);
   };
   // Rebuilt dispatches must use the same physical-send boundary as ordinary HTTP sends.
   // Return the original 3xx so the response owner retains its retry/health/relay contract.
-  const dispatch = Object.assign(
+  //
+  // Marked transparent because it forwards its init to a transport that honours the proxy
+  // option. Leaving it unmarked would make an ordinary configured provider refuse its own route
+  // on every overridden path, after the attempt had already been recorded — an override selects
+  // `provider.fetch ?? execute`, and `execute` is this wrapper. It still carries the binding, so
+  // an override that simply calls it gets the route decided rather than dropped; an override
+  // that decided for itself has already marked the init and this pass defers to that decision.
+  const dispatch = markEgressTransparentExecutor(Object.assign(
     (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit) =>
-      sendWithConnectionPolicy(base, input, init),
+      sendWithConnectionPolicy(base, input, init, egressBinding),
     { preconnect },
-  ) as typeof globalThis.fetch;
+  ) as typeof globalThis.fetch);
   const httpFetch = Object.assign(
     async (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit) => {
+      // Refuse before any dispatch side effect where that is sound. `beforeDispatch` commits
+      // attempt accounting and consumes admission state, so a refusal firing after it would
+      // charge an attempt for a send that never happens, and a throwing hook would mask the
+      // egress error with an unrelated one.
+      //
+      // With no override, this input and `base` ARE the final destination and executor, so the
+      // full decision can be made now. With an override, only the configured value is checked:
+      // the override may rebuild against a different host and select a different transport, and
+      // refusing on this destination would reject a request whose real route is fine.
+      if (options.dispatchOverride) egressFor(input);
+      else providerEgressSendInit(egressBinding, base, input);
       // The hook inspects the outgoing headers and refuses the send by throwing; it is not a
       // mutator, and the copy it receives is deliberately not threaded onward. `Connection`
       // is decided inside `dispatch`, which runs after this, so the fresh-connection policy
       // wins regardless of what any caller or hook put in the header.
       options.beforeDispatch?.(new Headers(init?.headers ?? (input instanceof Request ? input.headers : undefined)));
+      // No proxy option is attached here: a `dispatchOverride` may rebuild this request against
+      // a different destination, so the route is decided at the physical send instead.
       const dispatchInit = { ...withUpstreamHttpVersion(input, init, provider), timeout: 0 };
       return options.dispatchOverride
         ? options.dispatchOverride(input, dispatchInit, dispatch)
@@ -164,7 +269,13 @@ export function providerFetch(
   // else keeps the provider's HTTP fetch. See ws-upstream.ts for the details.
   const unpaced = async (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit) => {
     const upstreamWebsocket = provider.upstreamWebsocket === true;
-    if (typeof input === "string" && init && shouldUseCodexWsUpstream(input, init, runtime, upstreamWebsocket)) {
+    if (!options.httpOnly && typeof input === "string" && init
+      && shouldUseCodexWsUpstream(input, init, runtime, upstreamWebsocket)) {
+      const egress = egressFor(input);
+      if (providerEgressIsExplicit(egress)) {
+        warnEgressWebsocketDowngradeOnce(providerName, describeProviderEgressForLog(egress));
+        return httpFetch(input, init);
+      }
       // The fallback has to be the same HTTP fetch the non-WS branch would have
       // used, protocol pin included: a WS turn that falls back is serving the
       // request over HTTP, and dropping the provider's `upstreamHttpVersion`
@@ -188,11 +299,16 @@ export function providerFetch(
     await waitForPacing(init?.signal ?? undefined);
     return unpaced(input, init);
   };
-  return Object.assign(wrapped, {
+  // The returned wrapper forwards its init down to `dispatch`, which applies the route at the
+  // physical send. Adapters that hand this executor back as `provider.fetch` (Cursor does)
+  // therefore still carry a per-provider route instead of being refused as opaque.
+  const paceAware = Object.assign(wrapped, {
     preconnect,
     waitForPacing,
     unpacedFetch: Object.assign(unpaced, { preconnect }),
   });
+  markEgressTransparentExecutor(paceAware as unknown as typeof globalThis.fetch);
+  return paceAware;
 }
 
 

package/src/server/responses/input-admission.ts

@@ -85,9 +85,19 @@ function imageTokens(imageUrl: string): number {
 function contentPartTokens(part: OcxContentPart, modelId: string): number {
   if (part.type === "image") return imageTokens(part.imageUrl);
   if (part.type === "video") return imageTokens(part.videoUrl);
+  // An inline document is a base64 payload, not a sentence: estimating it from its marker would
+  // admit a request whose real input is orders of magnitude larger. Counted arithmetically —
+  // rebuilding the data URL here would materialize a second request-sized string just to measure it.
+  if (part.type === "document") return base64PayloadTokens(part.data);
   return estimateTokens(part.text, modelId);
 }
 
+function base64PayloadTokens(base64: string): number {
+  if (base64.length === 0) return 0;
+  const decoded = Math.floor((base64.length * 3) / 4);
+  return Math.max(1, Math.ceil(decoded / IMAGE_BYTES_PER_TOKEN));
+}
+
 function contentTokens(content: string | readonly OcxContentPart[], modelId: string): number {
   if (typeof content === "string") return estimateTokens(content, modelId);
   let total = 0;

package/src/server/responses/passthrough-delivery.ts

@@ -35,10 +35,6 @@ import { consumeComboFailure } from "./core-combo-failure";
 import { readDisplaySafeErrorText } from "./core-errors";
 import { streamingContextOverflowResponse, jsonContextOverflowResponse } from "./context-overflow";
 import { formatPassthroughUpstreamError } from "./passthrough-error";
-import {
-  providerModelResponsesTerminalRepair,
-  providerModelResponsesUpstreamStreaming,
-} from "../../providers/registry";
 import {
   resolvePassthroughWebSearchBridgeAuth,
   planPassthroughWebSearchBridge,
@@ -83,7 +79,10 @@ import {
 import { createRoutedCustomToolRestoreBlockRewrite } from "../responses-custom-tool-repair";
 import { createRoutedToolSearchRestoreBlockRewrite } from "../responses-tool-search-repair";
 import { createGithubCopilotResponsesBlockRewrite } from "../github-copilot-responses-repair";
-import { createGrokResponsesControlFrameBlockRewrite } from "../grok-responses-control-frame";
+import {
+  createGrokResponsesControlFrameBlockRewrite,
+  createGrokResponsesTimestampBlockRewrite,
+} from "../grok-responses-control-frame";
 import { createGrokResponsesSparseTerminalBlockRewrite } from "../grok-responses-snapshot-repair";
 import {
   createPlaintextV2AgentMessageCallRestoreRewrite,
@@ -94,11 +93,30 @@ import { createResponsesFieldBackfillBlockRewrite } from "./responses-field-back
 import { createResponsesFunctionToolRepairBlockRewrite } from "../responses-function-tool-repair";
 import {
   createUndeclaredToolCallGuardBlockRewrite,
+  currentTurnWireToolCatalogBody,
   undeclaredToolCallNameInResponse,
   undeclaredToolCallMessage,
   normalizeDefaultNamespaceInJson,
 } from "../responses-undeclared-tool-guard";
 import { isWin32EagerRewrite, selectEagerPath } from "../../lib/bun-stream-caps";
+
+/**
+ * Platform override for the two relay-path policy calls below. Tests only.
+ *
+ * The eager relay is reachable only on win32 and darwin, so a Linux shard cannot exercise it
+ * without claiming to be one of them. Overwriting `process.platform` globally does that, and a
+ * great deal more: every filesystem, ACL and state-directory decision in the process follows it,
+ * and the spend-ledger owner lowercases its home on win32, which on a case-sensitive filesystem
+ * names a DIFFERENT directory. A row that did that stopped being able to reserve its send and
+ * delivered no terminal at all, reporting as a relay defect. This narrows the claim to the two
+ * calls that actually choose the relay path.
+ */
+let relayPlatformForTests: NodeJS.Platform | undefined;
+
+/** Internal test contract, not operator configuration: no config key reaches this. */
+export function setRelayPlatformForTests(platform: NodeJS.Platform | undefined): void {
+  relayPlatformForTests = platform;
+}
 import { linkAbortSignal, UPSTREAM_JSON_BODY_READ_OPTIONS } from "./core-lifetime";
 import { registerTurn, unregisterTurn, trackStreamLifetime } from "../lifecycle";
 import { relaySseEagerBounded } from "../relay-eager";
@@ -340,11 +358,7 @@ export async function deliverPassthroughResponse(
       // before relay starts. Waiting for SSE completion would retain request state across the whole
       // stream; a later body failure does not undo that this destination accepted and served the turn.
       commitReasoningReplayServingRoute(nativeExchange.request.headers);
-      const terminalRepairPolicy = providerModelResponsesTerminalRepair(
-        route.providerName,
-        route.provider,
-        route.modelId,
-      );
+      const terminalRepairPolicy = route.staticPolicy.model.responsesTerminalRepair;
       // #3761: opt-in hosted-web-search bridge. Codex always declares the hosted web_search tool,
       // and this branch relays that declaration on the assumption the destination executes it.
       // A KEY-auth gateway that does not (Ollama Cloud GLM) answers with a function_call named
@@ -499,7 +513,22 @@ export async function deliverPassthroughResponse(
           ? createGrokResponsesControlFrameBlockRewrite()
           : undefined,
         grokClientCompatibilityEnabled
-          ? createGrokResponsesSparseTerminalBlockRewrite(translatorBudget)
+          ? createGrokResponsesTimestampBlockRewrite()
+          : undefined,
+        grokClientCompatibilityEnabled
+          ? createGrokResponsesSparseTerminalBlockRewrite(
+            translatorBudget,
+            nativeExchange.outboundRequestBody,
+            {
+              clientToolAuthorizationBody: currentTurnWireToolCatalogBody(
+                parsed._rawBody,
+                parsed._replayPrefixLen ?? 0,
+              ),
+              routedNamespaceToolAliases: responseEffects.routedNamespaceToolAliases,
+              routedMuseToolNameAliases: responseEffects.routedMuseToolNameAliases,
+              convertedRoutedCustomToolNames: routedCustomToolNames,
+            },
+          )
           : undefined,
         snapshotRepairEnabled
           ? createResponsesSnapshotBlockRewrite(nativeExchange.outboundRequestBody, translatorBudget)
@@ -529,12 +558,13 @@ export async function deliverPassthroughResponse(
         ? composeSseBlockRewrites(...blockRewrites)
         : undefined;
       const needsClientRewrite = clientBlockRewrite !== undefined;
+      const relayPlatform = relayPlatformForTests ?? process.platform;
       // #864: win32 rewrite traffic must never enter the tee()+JS-pull chain
       // (Bun#32111 JS-sink segfault — text frames pass, the terminal block is
       // lost). The eager single reader applies the same rewrites inline.
-      const win32EagerRewrite = isWin32EagerRewrite(process.platform, needsClientRewrite);
+      const win32EagerRewrite = isWin32EagerRewrite(relayPlatform, needsClientRewrite);
       const eagerPath = selectEagerPath(
-        process.platform,
+        relayPlatform,
         needsClientRewrite,
         config.streamMode ?? "auto",
       );
@@ -805,7 +835,7 @@ export async function deliverPassthroughResponse(
       // stream that never closes. Non-streaming clients keep the plain JSON.
       if (clientRequestedStream === true
         && options.inboundTransport !== "websocket"
-        && providerModelResponsesUpstreamStreaming(route.providerName, route.provider, route.modelId) === false
+        && route.staticPolicy.model.responsesUpstreamStreaming === false
         && route.provider.adapter === "openai-responses") {
         let completed: Record<string, unknown> | undefined;
         try {
@@ -852,7 +882,7 @@ export async function deliverPassthroughResponse(
       // WS turns reframe this JSON into events in the bridge, which is the
       // other relay-free path — normalize ids so both bounded-JSON paths agree.
       const outboundJson = options.inboundTransport === "websocket"
-        && providerModelResponsesUpstreamStreaming(route.providerName, route.provider, route.modelId) === false
+        && route.staticPolicy.model.responsesUpstreamStreaming === false
         && hasResponsesItemIdRepair(route.provider.responsesItemIdRepair)
         ? (() => {
           try {