@bitkyc08/opencodex 2.67.0 → 2.68.0-preview.20260927

package/src/server/responses/compaction-recovery-policy.ts

@@ -0,0 +1,116 @@
+/** Pure eligibility policy. The caller owns admission, buffering, dispatch and the shared budget. */
+export interface CompactionRecoveryConfig {
+  enabled: true;
+  model: string;
+  allowDevinInvalidArgument?: boolean;
+}
+
+/** Evidence must describe the failed attempt, never request text or a guessed error message. */
+export interface CompactionRecoveryEvidence {
+  requestKind: "ordinary" | "compaction-v1" | "compaction-v2";
+  recoveryAttempts: number;
+  cancelled: boolean;
+  nonReplayable: boolean;
+  /** Any semantic output observed, including output retained privately before delivery. */
+  partialOutput: boolean;
+  toolEffects: boolean;
+  remainingSends: number;
+  /** Canonical serving identities resolved by the caller, including provider/account identity. */
+  originalModel: string;
+  fallbackModel: string;
+  /** Actual serving adapter/provider, not a prefix inferred from the requested selector. */
+  provider: string;
+  httpStatus?: number;
+  /** A completed result is never retried. Output validation belongs to the caller. */
+  responseStatus: "completed" | "failed" | "incomplete" | "unknown";
+  errorCode?: string;
+  errorType?: string;
+  authenticationDenied: boolean;
+  policyDenied: boolean;
+  budgetDenied: boolean;
+  refusal: boolean;
+  upstreamFailure: boolean;
+}
+
+export type CompactionRecoveryDecision =
+  | { recover: true; model: string; reason: "context-overflow" | "compaction-output" | "upstream-unavailable" | "devin-invalid-argument" }
+  | { recover: false; reason: "disabled" | "invalid-evidence" | "ordinary-request" | "already-attempted" | "cancelled" | "unsafe-replay" | "protected-failure" | "budget-exhausted" | "same-model" | "succeeded" | "unclassified-failure" };
+
+const MODEL_LIMIT = 512;
+const safeName = (value: unknown, limit: number): value is string =>
+  typeof value === "string" && value.length > 0 && value.length <= limit
+  && value === value.trim() && !/[\u0000-\u0020\u007f-\u009f]/.test(value);
+
+/** Invalid persisted values disable recovery rather than widening it. No configurable retry count. */
+export function readCompactionRecoveryConfig(value: unknown): CompactionRecoveryConfig | null {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const raw = value as Record<string, unknown>;
+  if (Object.keys(raw).some(key => !["enabled", "model", "allowDevinInvalidArgument"].includes(key))
+    || raw.enabled !== true || !safeName(raw.model, MODEL_LIMIT)
+    || (raw.allowDevinInvalidArgument !== undefined && typeof raw.allowDevinInvalidArgument !== "boolean")) return null;
+  return {
+    enabled: true,
+    model: raw.model,
+    ...(raw.allowDevinInvalidArgument !== undefined ? { allowDevinInvalidArgument: raw.allowDevinInvalidArgument } : {}),
+  };
+}
+
+// Structured tokens only. The normalizer must also supply the explicit denial flags above.
+const PROTECTED_CODE = /(?:^|_)(?:auth|authentication|authorization|unauthenticated|unauthorized|permission|forbidden|policy|refusal|refused|budget|quota|billing|safety|content_filter|origin_rejected|admission|scope)(?:_|$)/;
+const CONTEXT_CODES = new Set(["context_length_exceeded", "context_window_exceeded", "input_too_long"]);
+const COMPACTION_CODES = new Set(["compaction_failed", "invalid_compaction_output", "empty_compaction_output"]);
+const SERVER_CODES = new Set(["upstream_error", "upstream_server_error", "server_is_overloaded", "internal", "internal_error", "server_error", "unavailable", "service_unavailable", "gateway_timeout"]);
+
+/** Decides eligibility only; returning true neither spends nor grants another send. */
+export function decideCompactionRecovery(
+  value: unknown,
+  evidence: CompactionRecoveryEvidence,
+): CompactionRecoveryDecision {
+  const config = readCompactionRecoveryConfig(value);
+  if (!config) return { recover: false, reason: "disabled" };
+  const flags = [evidence.cancelled, evidence.nonReplayable, evidence.partialOutput, evidence.toolEffects,
+    evidence.authenticationDenied, evidence.policyDenied, evidence.budgetDenied, evidence.refusal, evidence.upstreamFailure];
+  if (flags.some(flag => typeof flag !== "boolean")
+    || !Number.isSafeInteger(evidence.recoveryAttempts) || evidence.recoveryAttempts < 0
+    || !Number.isSafeInteger(evidence.remainingSends) || evidence.remainingSends < 0
+    || !safeName(evidence.originalModel, MODEL_LIMIT) || !safeName(evidence.fallbackModel, MODEL_LIMIT)
+    || !safeName(evidence.provider, 128)
+    || !["ordinary", "compaction-v1", "compaction-v2"].includes(evidence.requestKind)
+    || !["completed", "failed", "incomplete", "unknown"].includes(evidence.responseStatus)
+    || (evidence.httpStatus !== undefined && (!Number.isInteger(evidence.httpStatus) || evidence.httpStatus < 100 || evidence.httpStatus > 599))
+    || [evidence.errorCode, evidence.errorType].some(code => code !== undefined && !safeName(code, 128))) {
+    return { recover: false, reason: "invalid-evidence" };
+  }
+  if (evidence.requestKind === "ordinary") return { recover: false, reason: "ordinary-request" };
+  if (evidence.recoveryAttempts !== 0) return { recover: false, reason: "already-attempted" };
+  const status = evidence.httpStatus;
+  const codes = [evidence.errorCode, evidence.errorType].filter((code): code is string => code !== undefined);
+  if (evidence.cancelled || status === 499 || codes.some(code => code === "cancelled" || code === "canceled" || code === "client_cancelled")) {
+    return { recover: false, reason: "cancelled" };
+  }
+  if (evidence.nonReplayable || evidence.partialOutput || evidence.toolEffects) return { recover: false, reason: "unsafe-replay" };
+  if (evidence.authenticationDenied || evidence.policyDenied || evidence.budgetDenied || evidence.refusal
+    || status === 401 || status === 403 || status === 402 || status === 429
+    || codes.some(code => PROTECTED_CODE.test(code.toLowerCase()) || code === "failed_precondition")) {
+    return { recover: false, reason: "protected-failure" };
+  }
+  if (evidence.remainingSends === 0) return { recover: false, reason: "budget-exhausted" };
+  if (evidence.originalModel === evidence.fallbackModel) return { recover: false, reason: "same-model" };
+  if (evidence.responseStatus === "completed") return { recover: false, reason: "succeeded" };
+  const failedHttp = status !== undefined && status >= 400;
+  if (!evidence.upstreamFailure || (!failedHttp && evidence.responseStatus !== "failed")) {
+    return { recover: false, reason: "unclassified-failure" };
+  }
+  const code = evidence.errorCode;
+  const requestFailure = status === undefined || status === 200 || status === 400 || status === 413 || status === 422 || status >= 500;
+  if (requestFailure && code && CONTEXT_CODES.has(code)) return { recover: true, model: config.model, reason: "context-overflow" };
+  if (requestFailure && code && COMPACTION_CODES.has(code)) return { recover: true, model: config.model, reason: "compaction-output" };
+  if (config.allowDevinInvalidArgument === true && evidence.provider === "devin" && code === "invalid_argument"
+    && (evidence.responseStatus === "failed" || (status !== undefined && status >= 400 && status < 500))) {
+    return { recover: true, model: config.model, reason: "devin-invalid-argument" };
+  }
+  if (status !== undefined && status >= 500 && (code === undefined || SERVER_CODES.has(code))) {
+    return { recover: true, model: config.model, reason: "upstream-unavailable" };
+  }
+  return { recover: false, reason: "unclassified-failure" };
+}

package/src/server/responses/compaction-recovery.ts

@@ -0,0 +1,330 @@
+import type { AdapterEvent, OcxConfig } from "../../types";
+import { routeConcreteModel, type RouteResult } from "../../router";
+import { copyPlainData } from "../../lib/plain-data";
+import { jsonUtf8Bytes } from "../../lib/json-byte-size";
+import type { TranslatorBudget } from "../../lib/translator-budget";
+import { readBoundedResponseBytes } from "../../lib/bounded-body";
+import { isRequestExecutionBudget, type RequestExecutionBudget, type SingleUseDispatchPermit } from "../../lib/request-execution-budget";
+import { isNonReplayableResponse, isNonReplayableUpstreamCode, markResponseNonReplayable, TRANSIENT_RETRY_MAX_ATTEMPTS } from "../../lib/upstream-retry";
+import { isCyberPolicyCode, isTerminalRefusalCode } from "../../lib/errors";
+import { isCanonicalOpenAiForwardProvider, supportsNativeResponsesCompactEndpoint } from "../../providers/openai-tiers";
+import { bridgeToResponsesSSE, formatErrorResponse } from "../../bridge";
+import { buildCompactV1Output, decodeCompactionSummary, encodeCompactionSummary, extractCompactUserMessages } from "../../responses/compaction";
+import { finishRequestAttempt, usageFromResponsesPayload, type RequestLogContext } from "../request-log";
+import { linkRequestSessionLane } from "../request-log-conversation";
+import { isNativePassthroughSseResponse, markNativePassthroughSseResponse, isEagerRelaySseResponse, markEagerRelaySseResponse } from "../relay";
+import type { HandleResponsesOptions } from "./core-options";
+import { consumeComboFailure, createChildPassthroughCallbackGate } from "./core-combo-failure";
+import { preflightComboStreamResponse } from "./combo-stream-preflight";
+import { conversationCarriesUploadedFiles } from "./account-change-state";
+import { selfContainedResponsesBody } from "./reset-replay";
+import { decideCompactionRecovery, readCompactionRecoveryConfig } from "./compaction-recovery-policy";
+
+type Options = HandleResponsesOptions & { translatorBudget: TranslatorBudget };
+type Dispatch = (req: Request, config: OcxConfig, log: RequestLogContext, options: Options) => Promise<Response>;
+const MAX_BYTES = 32 * 1024 * 1024;
+const RETAINED_USER_CHARS = 80_000;
+const record = (value: unknown): value is Record<string, unknown> => !!value && typeof value === "object" && !Array.isArray(value);
+const token = (value: unknown): string | undefined => typeof value === "string" && /^[a-zA-Z0-9_-]{1,128}$/.test(value) ? value : undefined;
+
+function identity(route: RouteResult): string {
+  return JSON.stringify([route.providerName, route.modelId, route.codexAccountMode ?? "", route.codexAccountNamespace ?? ""]);
+}
+
+function physicalSends(log: RequestLogContext): number {
+  // activeAttempt normally also belongs to attempts: count each receipt exactly once.
+  const attempts = new Set([...(log.attempts ?? []), ...(log.activeAttempt ? [log.activeAttempt] : [])]);
+  return [...attempts].reduce((sum, attempt) => sum + Math.max(0, attempt.sendCount), 0);
+}
+
+/** Reconcile only this leg's physical receipts; never charge already-booked adapter sends again. */
+function settlePhysicalSends(log: RequestLogContext, budget: RequestExecutionBudget, beforeSends: number, beforeUsed: number, reported: number, permit?: SingleUseDispatchPermit): number {
+  const sent = Math.max(0, physicalSends(log) - beforeSends);
+  // A legacy fetch leg does not claim the hop through adapterDispatchBudget. Settle its
+  // prepaid booking explicitly; an adapter-owned leg already claimed it, making this a no-op.
+  if (sent > 0) permit?.assumeCharge();
+  else permit?.release();
+  // An external report may settle a prepaid booking without changing used. Its explicit
+  // receipt outranks the numeric delta, or the same source send would be charged twice.
+  const unreported = Math.max(0, sent - Math.max(reported, Math.max(0, budget.used - beforeUsed)));
+  if (unreported > 0) budget.used += unreported;
+  return sent;
+}
+
+function portableBody(body: Record<string, unknown>): boolean {
+  if (!Array.isArray(body.input) || body.store === true || conversationCarriesUploadedFiles(body)) return false;
+  // Native ciphertext cannot be summarized by another provider. Never silently replace it with a note.
+  if (body.input.some(item => record(item) && ["compaction", "compaction_summary", "context_compaction"].includes(String(item.type))
+    && typeof item.encrypted_content === "string" && !item.encrypted_content.startsWith("ocx1:"))) return false;
+  const input = body.input.filter(item => !record(item) || item.type !== "compaction_trigger");
+  return selfContainedResponsesBody({ ...body, store: false, input });
+}
+
+function routed(route: RouteResult): boolean {
+  return !route.combo && route.routeKind !== "policy" && route.routeReason !== "default-provider"
+    && !isCanonicalOpenAiForwardProvider(route.provider)
+    && !supportsNativeResponsesCompactEndpoint(route.providerName, route.provider);
+}
+
+/** One reader, bounded bytes, and an exact replacement body; never clone a live stream. */
+async function bufferedJson(response: Response, signal: AbortSignal): Promise<{ response: Response; json?: Record<string, unknown> }> {
+  const bytes = await readBoundedResponseBytes(response, { signal, maxBytes: MAX_BYTES, inactivityTimeoutMs: 300_000 });
+  if (bytes.oversized) return { response: formatErrorResponse(502, "translation_buffer_limit", "Compaction recovery response exceeded its byte limit") };
+  const headers = new Headers(response.headers);
+  headers.delete("content-length");
+  headers.delete("content-encoding");
+  const replacement = new Response(bytes.bytes, { status: response.status, statusText: response.statusText, headers });
+  if (isNonReplayableResponse(response)) markResponseNonReplayable(replacement);
+  try {
+    const json: unknown = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes.bytes));
+    return { response: replacement, ...(record(json) ? { json } : {}) };
+  } catch { return { response: replacement }; }
+}
+
+/**
+ * Opt-in recovery for routed compaction only. Native compact/ciphertext, stored continuations,
+ * policy/combo routes and hosted tools retain their original failure. This owns no credentials.
+ */
+export async function runWithCompactionRecovery(
+  req: Request, config: OcxConfig, logCtx: RequestLogContext, options: Options, dispatch: Dispatch,
+): Promise<Response> {
+  const recovery = readCompactionRecoveryConfig(config.compactionRecovery);
+  if (!recovery || options.compactionRecoveryAttempted || options.comboAttempt || (options.inboundWire && options.inboundWire !== "responses")) {
+    return dispatch(req, config, logCtx, options);
+  }
+  let snapshot: Record<string, unknown> | undefined;
+  let snapshotBytes = 0;
+  let sourceRoute: RouteResult | undefined;
+  let partialOutput = false;
+  let replayUnsafe = false;
+  let adapterError: Extract<AdapterEvent, { type: "error" }> | undefined;
+  let sourceFailure: Response | undefined;
+  let recoveryPermit: SingleUseDispatchPermit | undefined;
+  let restoreSourceLog: ((attemptStatus?: number) => void) | undefined;
+  let sourceReportedSends = 0;
+  const gate = createChildPassthroughCallbackGate(options);
+  const signal = options.abortSignal ?? req.signal;
+  const spentBefore = options.sendBudget?.used ?? 0;
+  const sendsBefore = physicalSends(logCtx);
+  const firstOptions: Options = {
+    ...options,
+    onCompactionRecoverySendsReported(count) {
+      sourceReportedSends += count;
+      options.onCompactionRecoverySendsReported?.(count);
+    },
+    onRequestBodyParsed(body) {
+      options.onRequestBodyParsed?.(body);
+      if (!record(body) || !Array.isArray(body.input) || typeof body.model !== "string"
+        || !body.input.some(item => record(item) && item.type === "compaction_trigger") || !portableBody(body)) return;
+      const users = extractCompactUserMessages(body.input);
+      if ((users.at(-1)?.length ?? 0) > RETAINED_USER_CHARS) return;
+      try {
+        const bytes = jsonUtf8Bytes(body, MAX_BYTES);
+        const reservation = options.translatorBudget.reserveTransient(bytes, { kind: "request_copies" });
+        try {
+          const copy = copyPlainData(body);
+          if (!copy.ok) return;
+          snapshot = copy.value;
+          snapshotBytes = bytes;
+          reservation.commitRetained();
+        } finally { reservation.release(); }
+      } catch { /* Optional recovery cannot reject an otherwise valid original request. */ }
+    },
+    onCompactionRecoveryRoute(route) {
+      options.onCompactionRecoveryRoute?.(route);
+      if (snapshot && routed(route)) sourceRoute = { ...route };
+    },
+    onCompactionRecoveryAdapterEvent(event) {
+      options.onCompactionRecoveryAdapterEvent?.(event);
+      if (!snapshot) return;
+      if (event.type === "heartbeat") replayUnsafe ||= event.replayUnsafe === true;
+      else if (event.type === "error") adapterError = event;
+      else if (event.type !== "done") partialOutput = true;
+    },
+    onResponseComplete: model => snapshot ? gate.onResponseComplete(model) : options.onResponseComplete?.(model),
+    onNativePassthroughTerminal: status => snapshot ? gate.onTerminal(status) : options.onNativePassthroughTerminal?.(status),
+    onNativePassthroughCancel: () => snapshot ? gate.onCancel() : options.onNativePassthroughCancel?.(),
+  };
+  try {
+    let response = await dispatch(req, config, logCtx, firstOptions);
+    const keep = (value: Response) => { gate.commit(); return value; };
+    if (!snapshot || !sourceRoute || signal.aborted || req.signal.aborted || isNonReplayableResponse(response)) return keep(response);
+    let target: RouteResult;
+    try { target = routeConcreteModel(config, recovery.model); } catch { return keep(response); }
+    if (!routed(target) || identity(sourceRoute) === identity(target)) return keep(response);
+    const originalModel = firstOptions.compactionRoutingOverride?.sourceModel ?? String(snapshot.model);
+    // Use the established protocol commit boundary. For runTurn streams the direct event
+    // observer additionally preserves side-effect heartbeats that the bridge does not publish.
+    if (response.ok && response.headers.get("content-type")?.includes("text/event-stream")) {
+      const native = isNativePassthroughSseResponse(response);
+      const eager = isEagerRelaySseResponse(response);
+      const preflight = await preflightComboStreamResponse(response, logCtx);
+      response = preflight.response;
+      if (preflight.kind !== "failed") {
+        if (native) markNativePassthroughSseResponse(response);
+        if (eager) markEagerRelaySseResponse(response);
+        return keep(response);
+      }
+    } else if (response.ok) {
+      const buffered = await bufferedJson(response, signal);
+      response = buffered.response;
+      const json = buffered.json;
+      if (!json || json.status !== "failed" || (Array.isArray(json.output) && json.output.length > 0)) return keep(response);
+      // HTTP 200 can carry a failed terminal. The original structured error remains intact.
+      response = Response.json({ error: json.error, response: json }, { status: adapterError?.status ?? 502 });
+    }
+    if (response.ok || replayUnsafe || partialOutput || signal.aborted || req.signal.aborted) {
+      if (replayUnsafe) markResponseNonReplayable(response);
+      return keep(response);
+    }
+    const failure = await consumeComboFailure(response, signal);
+    response = failure.response;
+    const code = token(adapterError?.code) ?? token(failure.upstreamCode);
+    const errorType = token(adapterError?.errorType) ?? token(failure.upstreamType);
+    const budget = options.sendBudget;
+    // Reset-only fetch legs report their physical receipt but historically leave used alone.
+    // Reconcile only a failed, eligible compaction; successful/disabled requests stay unchanged.
+    const sourceSends = budget && isRequestExecutionBudget(budget)
+      ? settlePhysicalSends(logCtx, budget, sendsBefore, spentBefore, sourceReportedSends) : 0;
+    const decision = decideCompactionRecovery(recovery, {
+      requestKind: options.compactionRecoveryKind ?? "compaction-v2", recoveryAttempts: 0,
+      cancelled: signal.aborted || req.signal.aborted, nonReplayable: !!failure.nonReplayable || isNonReplayableUpstreamCode(code),
+      partialOutput, toolEffects: replayUnsafe,
+      remainingSends: budget && isRequestExecutionBudget(budget) ? budget.remainingBaseSends(TRANSIENT_RETRY_MAX_ATTEMPTS) : 0,
+      originalModel: identity(sourceRoute), fallbackModel: identity(target), provider: sourceRoute.provider.adapter,
+      httpStatus: adapterError?.status ?? response.status, responseStatus: "failed", errorCode: code, errorType,
+      authenticationDenied: response.status === 401 || response.status === 403,
+      policyDenied: isCyberPolicyCode(code), budgetDenied: code === "translation_buffer_limit",
+      refusal: isTerminalRefusalCode(code), upstreamFailure: sourceSends > 0,
+    });
+    if (!decision.recover || !budget || !isRequestExecutionBudget(budget)) return keep(response);
+    const fallbackBeforeSends = physicalSends(logCtx);
+    const fallbackBeforeUsed = budget.used;
+    const reservation = budget.reserveDispatch({ sendClass: "combo-failover", targetKey: `compaction:${identity(target)}`, countedExternally: true, replaySafe: true });
+    if (!reservation.allowed) return keep(response);
+    recoveryPermit = reservation.permit;
+    sourceFailure = response;
+    gate.discard();
+    // Finish the first physical attempt while retaining its receipt in attempts[].
+    if (logCtx.activeAttempt) finishRequestAttempt(logCtx.activeAttempt, response.status,
+      Math.max(0, Date.now() - (logCtx.activeAttemptStartedAt ?? Date.now())), logCtx.activeAttempt.usage ?? logCtx.usage);
+    // Snapshot the original log fields before the fallback rewrites them: a failed fallback
+    // returns the original failure, so the log must keep describing that failure, not the
+    // fallback's model, provider, route decision or terminal error.
+    const SOURCE_LOG_FIELDS = [
+      "model", "provider", "providerAdapter", "requestedAlias", "servedModel", "wireModel",
+      "resolvedModel", "routeDecision", "tierOutcome", "activeTierMetadata", "usage",
+      "usageFromBridge", "upstreamError", "terminalHttpStatus", "terminalErrorCode",
+      "terminalIncompleteReason", "errorCode",
+    ] as const;
+    const sourceLog: Partial<Record<keyof RequestLogContext, unknown>> = {};
+    const logFields = logCtx as unknown as Record<string, unknown>;
+    for (const field of SOURCE_LOG_FIELDS) sourceLog[field] = logCtx[field];
+    restoreSourceLog = (attemptStatus?: number) => {
+      if (logCtx.activeAttempt) finishRequestAttempt(logCtx.activeAttempt, attemptStatus ?? sourceFailure!.status,
+        Math.max(0, Date.now() - (logCtx.activeAttemptStartedAt ?? Date.now())), logCtx.activeAttempt.usage ?? logCtx.usage);
+      delete logCtx.activeAttempt;
+      delete logCtx.activeAttemptStartedAt;
+      for (const field of SOURCE_LOG_FIELDS) {
+        if (sourceLog[field] === undefined) delete logFields[field];
+        else logFields[field] = sourceLog[field];
+      }
+    };
+    delete logCtx.activeAttempt;
+    delete logCtx.activeAttemptStartedAt;
+    delete logCtx.usage;
+    delete logCtx.usageFromBridge;
+    delete logCtx.upstreamError;
+    delete logCtx.terminalHttpStatus;
+    delete logCtx.terminalErrorCode;
+    delete logCtx.terminalIncompleteReason;
+    const headers = new Headers(req.headers);
+    headers.delete("authorization");
+    headers.delete("chatgpt-account-id");
+    headers.delete("content-length");
+    headers.delete("content-encoding");
+    headers.set("content-type", "application/json");
+    const nextBody = { ...snapshot, model: decision.model, stream: false, store: false };
+    const bytes = jsonUtf8Bytes(nextBody, MAX_BYTES);
+    const serialization = options.translatorBudget.reserveTransient(bytes, { kind: "request_copies" });
+    let fallback: Response;
+    let fallbackReportedSends = 0;
+    try {
+      const child = new Request(req.url, { method: "POST", headers, body: JSON.stringify(nextBody), signal: req.signal });
+      linkRequestSessionLane(req, child);
+      // The source send is finished. The child reuses this account-load holder and may
+      // select the same Kiro account, so return its lease before child admission can
+      // acquire and replace the holder's reference.
+      if (options.accountLoad?.lease) {
+        options.accountLoad.lease.release();
+        options.accountLoad.lease = null;
+      }
+      fallback = await dispatch(child, config, logCtx, {
+        ...options, compactionRecoveryAttempted: true, compactionRecoveryPermit: recoveryPermit,
+        compactionRoutingOverride: { sourceModel: originalModel },
+        onRequestBodyRead: undefined, onRequestBodyParsed: undefined,
+        onCompactionRecoveryRoute: undefined, onCompactionRecoveryAdapterEvent: undefined,
+        onCompactionRecoverySendsReported: count => {
+          fallbackReportedSends += count;
+          options.onCompactionRecoverySendsReported?.(count);
+        },
+        onResponseComplete: undefined, onNativePassthroughTerminal: undefined, onNativePassthroughCancel: undefined,
+      });
+    } finally {
+      settlePhysicalSends(logCtx, budget, fallbackBeforeSends, fallbackBeforeUsed, fallbackReportedSends, recoveryPermit);
+      serialization.release();
+    }
+    if (signal.aborted || req.signal.aborted) {
+      void fallback.body?.cancel().catch(() => undefined);
+      return formatErrorResponse(499, "client_cancelled", "Client cancelled compact request");
+    }
+    if (!fallback.ok) {
+      void fallback.body?.cancel().catch(() => undefined);
+      restoreSourceLog?.(fallback.status);
+      return response;
+    }
+    const completed = await bufferedJson(fallback, signal);
+    const json = completed.json;
+    const items = json && Array.isArray(json.output) ? json.output : [];
+    const compactions = items.filter(value => record(value) && value.type === "compaction");
+    const permitted = items.every(value => record(value) && (value.type === "compaction" || value.type === "reasoning"));
+    const item = permitted && compactions.length === 1 ? compactions[0] as Record<string, unknown> : undefined;
+    const summary = item && typeof item.encrypted_content === "string" ? decodeCompactionSummary(item.encrypted_content) : null;
+    if (json?.status !== "completed" || !summary?.trim()) {
+      void completed.response.body?.cancel().catch(() => undefined);
+      restoreSourceLog?.(completed.response.status);
+      return response;
+    }
+    // v1 unpacks this text through buildCompactV1Output, which already re-adds retained user
+    // messages as items; embedding them here too would duplicate the same text in the output.
+    const preserved = options.compactionRecoveryKind === "compaction-v1" ? summary : (() => {
+      const retained = buildCompactV1Output(extractCompactUserMessages(snapshot.input), summary).slice(0, -1);
+      const userText = extractCompactUserMessages(retained).map((text, index) => `User message ${index + 1}:\n${text}`).join("\n\n");
+      return `${summary}\n\nRetained original user messages (verbatim; preserve their goals and constraints):\n${userText}`;
+    })();
+    item!.encrypted_content = encodeCompactionSummary(preserved);
+    json.model = originalModel;
+    void completed.response.body?.cancel().catch(() => undefined);
+    void response.body?.cancel().catch(() => undefined);
+    if (snapshot.stream === true) {
+      const usage = usageFromResponsesPayload(json.usage);
+      async function* events(): AsyncGenerator<AdapterEvent> {
+        yield { type: "text_delta", text: preserved };
+        yield { type: "done", ...(usage ? { usage } : {}) };
+      }
+      return new Response(bridgeToResponsesSSE(events(), originalModel, undefined, undefined, undefined, undefined, 2_000,
+        { compaction: true, translatorBudget: options.translatorBudget, onCompletedResponse: () => options.onResponseComplete?.(originalModel) }), { headers: { "content-type": "text/event-stream" } });
+    }
+    options.onResponseComplete?.(originalModel);
+    return Response.json(json);
+  } catch (error) {
+    gate.discard();
+    if (signal.aborted || req.signal.aborted) return formatErrorResponse(499, "client_cancelled", "Client cancelled compact request");
+    if (sourceFailure) { restoreSourceLog?.(); return sourceFailure; }
+    throw error;
+  } finally {
+    if (snapshotBytes) options.translatorBudget.releaseRetained(snapshotBytes, { kind: "request_copies" });
+    recoveryPermit?.release();
+    snapshot = undefined;
+  }
+}

package/src/server/responses/core-combo-failure.ts

@@ -117,6 +117,7 @@ export async function consumeComboFailure(
     ...(nonReplayable ? { nonReplayable: true } : {}),
     classificationText,
     ...(normalizedUpstreamCode !== undefined ? { upstreamCode: normalizedUpstreamCode } : {}),
+    ...(upstreamType !== undefined ? { upstreamType } : {}),
     ...(!cyberFailure && cooldownRetryAfter !== undefined ? { retryAfter: cooldownRetryAfter } : {}),
     // The EFFECTIVE classification decides, not the raw status. An upstream that wraps a quota
     // refusal in a 5xx still carries `x-codex-*-reset-at`, and gating on 402/429 alone threw

package/src/server/responses/core-combo.ts

@@ -667,7 +667,11 @@ export async function executeComboResponses(
     const attempt = beginRequestAttempt(
       (logCtx.attempts?.length ?? 0) + 1,
       pick.target.provider,
-      pick.target.model,
+      // The id the child wire will actually send, not the selector the combo named. A target may
+      // be an alias, and `routeConcreteModel` above is where it becomes the provider's native id;
+      // recording the alias here would describe a request that never left (the adapter resolves
+      // the id before it reads any per-model list).
+      targetRoute.modelId,
       config.providers[pick.target.provider]!.adapter,
     );
     childLog.activeAttempt = attempt;

package/src/server/responses/core-lifetime.ts

@@ -80,6 +80,28 @@ export function finalizeOwnedTranslatorBudget(response: Response, budget: Transl
   return finalizedResponse;
 }
 
+/** Release a serving-account slot when the client body ends, errors or is cancelled. */
+export function finalizeAccountLease(response: Response, release: () => void): Response {
+  if (!response.body) { release(); return response; }
+  const reader = response.body.getReader();
+  let done = false;
+  const finish = () => { if (!done) { done = true; release(); } };
+  const body = new ReadableStream<Uint8Array>({
+    async pull(controller) {
+      try {
+        const next = await reader.read();
+        if (next.done) { finish(); controller.close(); }
+        else controller.enqueue(next.value);
+      } catch (error) { finish(); controller.error(error); }
+    },
+    async cancel(reason) { try { await reader.cancel(reason); } finally { finish(); } },
+  });
+  const wrapped = new Response(body, { status: response.status, statusText: response.statusText, headers: response.headers });
+  if (isNativePassthroughSseResponse(response)) markNativePassthroughSseResponse(wrapped);
+  if (isEagerRelaySseResponse(response)) markEagerRelaySseResponse(wrapped);
+  return wrapped;
+}
+
 
 
 

package/src/server/responses/core-options.ts

@@ -1,5 +1,7 @@
 import type { NativeResponseControl } from "./native-response-control";
-import type { OcxUsage, OcxProviderContinuationState, OcxConfig } from "../../types";
+import type { AdapterEvent, OcxUsage, OcxProviderContinuationState, OcxConfig } from "../../types";
+import type { RouteResult } from "../../router";
+import type { SingleUseDispatchPermit } from "../../lib/request-execution-budget";
 import type { CodexAuthPolicyConfig, CodexAuthContext } from "../../codex/auth-context";
 import type { AdmissionLease } from "../../lib/admission";
 import type { DataPlaneAdmission } from "../auth-cors";
@@ -16,12 +18,15 @@ import type { TranslatorBudget } from "../../lib/translator-budget";
 import type { TransientSendBudget } from "../../lib/upstream-retry";
 import type { RequestLogContext } from "../request-log";
 import type { UpstreamHostAdmissionLease } from "../../codex/upstream-host-health";
+import type { AccountLease } from "../../oauth/kiro-account-load";
 
 export interface ConsumedComboFailure {
   response: Response;
   classificationText: string;
   /** Structured upstream `error.code` when present in the failure body. */
   upstreamCode?: string;
+  /** Complete structured provider type, retained for conservative recovery classification. */
+  upstreamType?: string;
   /** Valid numeric/date value used only for cooldown calculation. */
   retryAfter?: string;
   /** Upstream Codex quota-window reset timestamps used for combo cooldowns. */
@@ -52,6 +57,16 @@ export interface ClientEncoderOption {
 }
 
 export interface HandleResponsesOptions {
+  /** Internal routed-compaction recovery: one logical request, one emergency target. */
+  compactionRecoveryAttempted?: boolean;
+  compactionRecoveryPermit?: SingleUseDispatchPermit;
+  compactionRecoveryKind?: "compaction-v1" | "compaction-v2";
+  onCompactionRecoveryRoute?: (route: RouteResult) => void;
+  onCompactionRecoveryAdapterEvent?: (event: AdapterEvent) => void;
+  /** Physical-send reports already delivered to the shared used setter, including booking settlement. */
+  onCompactionRecoverySendsReported?: (count: number) => void;
+  /** Private holder for the Kiro serving-account lease. */
+  accountLoad?: { lease: AccountLease | null };
   /** Internal Claude replay identity; consumed only by the final canonical Go transport. */
   claudeGoAffinity?: { sessionLane?: string };
   /** Validated Claude metadata identity; projected only into final canonical attempt headers. */

package/src/server/responses/core.ts

@@ -10,7 +10,7 @@ import { createTranslatorBudget } from "../../lib/translator-budget";
 import { captureExplicitOpenAiCallerAuth } from "../../providers/openai-sidecar";
 import { captureCallerDirectAuth } from "../../providers/caller-authorization";
 import { createInferenceSendBudget } from "../inference/context";
-import { finalizeOwnedTranslatorBudget } from "./core-lifetime";
+import { finalizeOwnedTranslatorBudget, finalizeAccountLease } from "./core-lifetime";
 import type { TranslatorBudget } from "../../lib/translator-budget";
 import { executeComboResponses } from "./core-combo";
 import { prepareResponsesRequest } from "./request-prepare";
@@ -27,6 +27,7 @@ import { createAdapterContinuations } from "./adapter-continuation";
 import { deliverAdapterResponse } from "./adapter-delivery";
 import { releaseUpstreamHostAdmission } from "../../codex/upstream-host-health";
 import { releaseCodexAuthContextProbeLease } from "../../codex/auth-context";
+import { runWithCompactionRecovery } from "./compaction-recovery";
 
 /** Public Responses entry and compatibility exports. Implementations live with their owners. */
 
@@ -42,8 +43,12 @@ export async function handleResponses(
 ): Promise<Response> {
   const ownsBudget = options.translatorBudget === undefined;
   const translatorBudget = options.translatorBudget ?? createTranslatorBudget();
+  const accountLoad = { lease: null as import("../../oauth/kiro-account-load").AccountLease | null };
+  const abortSignal = options.abortSignal ?? req.signal;
+  const release = () => { accountLoad.lease?.release(); accountLoad.lease = null; abortSignal.removeEventListener("abort", release); };
+  abortSignal.addEventListener("abort", release, { once: true });
   try {
-    const response = await handleResponsesInner(req, config, logCtx, {
+    const response = await runWithCompactionRecovery(req, config, logCtx, {
       ...options,
       openAiSidecarAuth: options.openAiSidecarAuth === undefined
         ? captureExplicitOpenAiCallerAuth(req.headers, config) : options.openAiSidecarAuth,
@@ -55,11 +60,15 @@ export async function handleResponses(
       visionDescribeTerminal: options.visionDescribeTerminal === true
         || req.headers.get("x-opencodex-vision-describe") === "1",
       translatorBudget,
+      accountLoad,
       // Once at ingress, spend observer included: a combo child inherits the parent's holder.
       sendBudget: options.sendBudget ?? createInferenceSendBudget(req, logCtx),
-    });
-    return ownsBudget ? finalizeOwnedTranslatorBudget(response, translatorBudget) : response;
+    }, handleResponsesInner);
+    const finalResponse = ownsBudget ? finalizeOwnedTranslatorBudget(response, translatorBudget) : response;
+    if (!accountLoad.lease) { release(); return finalResponse; }
+    return finalizeAccountLease(finalResponse, release);
   } catch (error) {
+    release();
     if (ownsBudget) translatorBudget.dispose();
     throw error;
   }
@@ -101,6 +110,7 @@ async function handleResponsesInner(
     if (requestState instanceof Response) return requestState;
     const transportState = await prepareResponsesTransport(requestContext, admissionState, requestState);
     if (transportState instanceof Response) return transportState;
+    options.onCompactionRecoveryRoute?.(requestState.route);
     const sidecarState = await prepareResponsesSidecarAuth(requestContext, requestState, transportState);
     if (sidecarState instanceof Response) return sidecarState;
     const responseEffects = createResponsesEffects(

package/src/server/responses/empty-completion-guard.ts

@@ -173,6 +173,7 @@ export function mergeUsage(
   const cacheReadInputTokens = sumOptional("cacheReadInputTokens");
   const cacheCreationInputTokens = sumOptional("cacheCreationInputTokens");
   const reasoningOutputTokens = sumOptional("reasoningOutputTokens");
+  const providerCredits = sumOptional("providerCredits");
   const contextTotalTokens = second.contextTotalTokens ?? first.contextTotalTokens;
   const inputTokens = first.inputTokens + second.inputTokens;
   const outputTokens = first.outputTokens + second.outputTokens;
@@ -188,6 +189,7 @@ export function mergeUsage(
     ...(cacheReadInputTokens !== undefined ? { cacheReadInputTokens } : {}),
     ...(cacheCreationInputTokens !== undefined ? { cacheCreationInputTokens } : {}),
     ...(reasoningOutputTokens !== undefined ? { reasoningOutputTokens } : {}),
+    ...(providerCredits !== undefined ? { providerCredits } : {}),
     ...(first.estimated || second.estimated ? { estimated: true } : {}),
     ...(rawUsage !== undefined ? { rawUsage } : {}),
   };