@bitkyc08/opencodex 2.7.21 → 2.7.22

package/src/server/claude-messages.ts

@@ -12,6 +12,7 @@ import { normalizeAnthropicImages } from "../adapters/anthropic-image-normalize"
 import { AnthropicRequestError, anthropicToResponsesTranslation, extractOcxRouteDirective, resolveInboundModel, type ClaudeCacheKeySource } from "../claude/inbound";
 import { stripOneMillionMarker } from "../claude/context-windows";
 import { captureClaudeInbound } from "../claude/inbound-debug";
+import { isTransientUpstreamStatus } from "../lib/upstream-retry";
 import {
   anthropicErrorBody,
   anthropicErrorResponse,
@@ -19,7 +20,7 @@ import {
   responsesJsonToAnthropicMessage,
   responsesSseToAnthropicSse,
 } from "../claude/outbound";
-import { clearableDeadline } from "../lib/abort";
+import { clearableDeadline, idleDeadline } from "../lib/abort";
 import { estimateTokens } from "../lib/token-estimate";
 import { routeModel } from "../router";
 import type { OcxConfig } from "../types";
@@ -117,13 +118,35 @@ function anthropicUsageToOcx(usage: Rec | undefined): { inputTokens: number; out
   };
 }
 
-/** Tap an Anthropic-vocabulary SSE stream for the request log (usage + terminal). */
-function tapAnthropicSseForLog(
+/** Body-occupancy guard for the native passthrough (devlog 260716_passthrough_followups/010). */
+export interface PassthroughBodyGuard {
+  /** Idle window in ms — raw upstream-byte inactivity while a read is pending. 0 disables. */
+  stallMs: number;
+  /** Cumulative body byte cap. 0 disables. */
+  maxBytes: number;
+  /** Client request signal for deterministic cancel classification. */
+  reqSignal?: AbortSignal;
+}
+
+type PassthroughCloseReason = "terminal" | "client_cancel" | "body_stall" | "body_overflow";
+
+/**
+ * Tap an Anthropic-vocabulary SSE stream for the request log (usage + terminal),
+ * bounding body occupancy: idle (silence-only, timed ONLY while a reader.read() is
+ * pending so downstream backpressure never counts as upstream inactivity) and a
+ * cumulative byte cap. On stall/overflow it appends a protocol-compatible Anthropic
+ * `event: error` terminal frame after a blank-line boundary, closes, and cancels the
+ * upstream reader — never a total-wall-clock bound (slow-but-alive streams live).
+ * Exported for deterministic unit tests.
+ */
+export function tapAnthropicSseForLog(
   upstream: ReadableStream<Uint8Array>,
   logCtx: RequestLogContext,
-  finalize: (status: number, meta: { closeReason: "terminal" | "client_cancel" }) => void,
+  finalize: (status: number, meta: { closeReason: PassthroughCloseReason }) => void,
+  guard?: PassthroughBodyGuard,
 ): ReadableStream<Uint8Array> {
   const decoder = new TextDecoder();
+  const encoder = new TextEncoder();
   let buffer = "";
   let usageAcc: Rec = {};
   const inspect = (chunk: Uint8Array) => {
@@ -145,25 +168,110 @@ function tapAnthropicSseForLog(
     }
   };
   const reader = upstream.getReader();
+  let settled = false;
+  let bodyBytes = 0;
+  let tapController: ReadableStreamDefaultController<Uint8Array> | undefined;
+
+  const recordUsage = () => {
+    logCtx.usage = anthropicUsageToOcx(Object.keys(usageAcc).length > 0 ? usageAcc : undefined);
+  };
+  const failBody = (closeReason: "body_stall" | "body_overflow", errType: string, message: string) => {
+    if (settled) return;
+    settled = true;
+    idle.cancel();
+    detachAbort();
+    recordUsage();
+    finalize(200, { closeReason });
+    const payload = JSON.stringify({ type: "error", error: { type: errType, message } });
+    try {
+      // Leading blank line terminates any partial SSE block so the frame parses cleanly
+      // (relaySseWithFailedTail policy, Anthropic wire shape).
+      tapController?.enqueue(encoder.encode(`\n\nevent: error\ndata: ${payload}\n\n`));
+      tapController?.close();
+    } catch { /* client already torn down */ }
+    reader.cancel(new DOMException(message, closeReason === "body_stall" ? "TimeoutError" : "QuotaExceededError")).catch(() => {});
+  };
+  const idle = idleDeadline(guard?.stallMs ?? 0, () => {
+    failBody(
+      "body_stall",
+      "timeout_error",
+      `anthropic passthrough body stalled: no upstream bytes for ${Math.round((guard?.stallMs ?? 0) / 1000)}s`,
+    );
+  });
+  // Deterministic client-cancel classification: Bun may surface a client abort as a
+  // reader.read() rejection OR a resolved done (src/lib/abort.ts cancelBodyOnAbort
+  // rationale), so the listener performs first-wins settlement itself instead of
+  // relying on which shape the read takes.
+  const onClientAbort = () => {
+    if (settled) return;
+    settled = true;
+    idle.cancel();
+    detachAbort();
+    finalize(499, { closeReason: "client_cancel" });
+    try { tapController?.close(); } catch { /* downstream already torn down */ }
+    reader.cancel(guard?.reqSignal?.reason).catch(() => {});
+  };
+  const detachAbort = (() => {
+    const signal = guard?.reqSignal;
+    if (!signal) return () => {};
+    if (signal.aborted) {
+      queueMicrotask(onClientAbort);
+      return () => {};
+    }
+    signal.addEventListener("abort", onClientAbort, { once: true });
+    return () => signal.removeEventListener("abort", onClientAbort);
+  })();
+
   return new ReadableStream<Uint8Array>({
+    start(controller) {
+      tapController = controller;
+    },
     async pull(controller) {
+      if (settled) return;
       try {
+        idle.reset();
         const { done, value } = await reader.read();
+        idle.pause();
+        if (settled) return; // stall/overflow/abort won the race while we awaited
         if (done) {
-          logCtx.usage = anthropicUsageToOcx(Object.keys(usageAcc).length > 0 ? usageAcc : undefined);
+          settled = true;
+          idle.cancel();
+          detachAbort();
+          recordUsage();
           finalize(200, { closeReason: "terminal" });
           controller.close();
           return;
         }
+        if (value.byteLength > 0) {
+          bodyBytes += value.byteLength;
+          if (guard && guard.maxBytes > 0 && bodyBytes > guard.maxBytes) {
+            failBody(
+              "body_overflow",
+              "api_error",
+              `anthropic passthrough body exceeded ${guard.maxBytes} bytes`,
+            );
+            return;
+          }
+        }
         inspect(value);
         controller.enqueue(value);
       } catch (err) {
+        if (settled) return;
+        settled = true;
+        idle.cancel();
+        detachAbort();
+        recordUsage();
         finalize(200, { closeReason: "terminal" });
         try { controller.error(err); } catch { /* torn down */ }
       }
     },
     cancel(reason) {
-      finalize(499, { closeReason: "client_cancel" });
+      if (!settled) {
+        settled = true;
+        idle.cancel();
+        detachAbort();
+        finalize(499, { closeReason: "client_cancel" });
+      }
       reader.cancel(reason).catch(() => {});
     },
   });
@@ -182,7 +290,7 @@ async function anthropicNativePassthrough(
   logCtx.provider = "anthropic-native";
   logCtx.requestedModel = model;
   let logged = false;
-  const finalize = (status: number, meta: { closeReason: "terminal" | "client_cancel" | "non_stream" }) => {
+  const finalize = (status: number, meta: { closeReason: PassthroughCloseReason | "non_stream" }) => {
     if (!logIds || logged) return;
     logged = true;
     addFinalRequestLog(logIds.requestId, logIds.start, logCtx, status, meta);
@@ -208,7 +316,7 @@ async function anthropicNativePassthrough(
   const result = await fetchWithHeaderDeadline(
     `${base}${pathname}${search}`,
     { method: "POST", headers, body: JSON.stringify(body) },
-    config.connectTimeoutMs ?? 120_000,
+    config.connectTimeoutMs ?? 200_000,
     req.signal,
   );
   if (result.kind === "timeout") {
@@ -223,8 +331,9 @@ async function anthropicNativePassthrough(
   const upstream = result.upstream;
 
   const contentType = upstream.headers.get("content-type") ?? "application/json";
+  const bodyGuard = resolvePassthroughBodyGuard(config, req.signal);
   if (upstream.ok && contentType.includes("text/event-stream") && upstream.body) {
-    return new Response(tapAnthropicSseForLog(upstream.body, logCtx, finalize), {
+    return new Response(tapAnthropicSseForLog(upstream.body, logCtx, finalize, bodyGuard), {
       status: upstream.status,
       headers: {
         "Content-Type": contentType,
@@ -233,8 +342,22 @@ async function anthropicNativePassthrough(
       },
     });
   }
-  // Non-stream (count_tokens, errors, stream:false): relay verbatim, log on the spot.
-  const text = await upstream.text();
+  // Non-stream (count_tokens, errors, stream:false): relay verbatim under the same
+  // idle/size bounds — headers are NOT yet sent here, so real statuses are available.
+  const bodyResult = await readBoundedPassthroughBody(upstream, bodyGuard);
+  if (bodyResult.kind === "client_cancel") {
+    finalize(499, { closeReason: "client_cancel" });
+    return anthropicErrorResponse(499, "client closed request during anthropic passthrough", "api_error");
+  }
+  if (bodyResult.kind === "stall") {
+    finalize(504, { closeReason: "body_stall" });
+    return anthropicErrorResponse(504, `anthropic passthrough body stalled: no upstream bytes for ${Math.round(bodyGuard.stallMs / 1000)}s`, "timeout_error");
+  }
+  if (bodyResult.kind === "overflow") {
+    finalize(502, { closeReason: "body_overflow" });
+    return anthropicErrorResponse(502, `anthropic passthrough body exceeded ${bodyGuard.maxBytes} bytes`, "api_error");
+  }
+  const text = bodyResult.text;
   if (upstream.ok) {
     try {
       const parsed = JSON.parse(text) as { usage?: Rec };
@@ -249,6 +372,99 @@ async function anthropicNativePassthrough(
   });
 }
 
+const DEFAULT_BODY_STALL_SEC = 90;
+const DEFAULT_BODY_MAX_BYTES = 64 * 1024 * 1024;
+
+/**
+ * Normalize the claudeCode body-guard config (devlog 260716_passthrough_followups/010).
+ * Policy: exactly 0 disables; finite positive values are honored (stall clamped to
+ * min 1s); negative/non-finite/absent values fall back to the defaults.
+ */
+export function resolvePassthroughBodyGuard(config: OcxConfig, reqSignal?: AbortSignal): PassthroughBodyGuard {
+  const rawSec = config.claudeCode?.bodyStallSec;
+  const stallSec = rawSec === 0
+    ? 0
+    : typeof rawSec === "number" && Number.isFinite(rawSec) && rawSec > 0
+      ? Math.max(1, rawSec)
+      : DEFAULT_BODY_STALL_SEC;
+  const rawBytes = config.claudeCode?.bodyMaxBytes;
+  const maxBytes = rawBytes === 0
+    ? 0
+    : typeof rawBytes === "number" && Number.isFinite(rawBytes) && rawBytes > 0
+      ? Math.floor(rawBytes)
+      : DEFAULT_BODY_MAX_BYTES;
+  return { stallMs: stallSec * 1000, maxBytes, ...(reqSignal ? { reqSignal } : {}) };
+}
+
+type BoundedPassthroughBody =
+  | { kind: "ok"; text: string }
+  | { kind: "stall" }
+  | { kind: "overflow" }
+  | { kind: "client_cancel" };
+
+/**
+ * Bounded replacement for `await upstream.text()` on the non-stream passthrough
+ * branch: same idle-only + size-cap semantics as the SSE tap. NOTE: reader.cancel()
+ * resolves a pending read as done rather than rejecting, so the stalled flag is
+ * re-checked after every read settlement (audit round 3).
+ */
+export async function readBoundedPassthroughBody(
+  upstream: Response,
+  guard: PassthroughBodyGuard,
+): Promise<BoundedPassthroughBody> {
+  if (!upstream.body) return { kind: "ok", text: await upstream.text() };
+  const reader = upstream.body.getReader();
+  const decoder = new TextDecoder();
+  let text = "";
+  let bytes = 0;
+  let stalled = false;
+  let aborted = false;
+  const idle = idleDeadline(guard.stallMs, () => {
+    stalled = true;
+    reader.cancel(new DOMException("anthropic passthrough body stalled", "TimeoutError")).catch(() => {});
+  });
+  // Deterministic client-abort classification (audit round 4): Bun may surface the
+  // abort as a read rejection OR a resolved done, so we cancel the reader ourselves
+  // and classify via the flag rather than the read's settlement shape.
+  const signal = guard.reqSignal;
+  const onAbort = () => {
+    aborted = true;
+    reader.cancel(signal?.reason).catch(() => {});
+  };
+  if (signal?.aborted) onAbort();
+  else signal?.addEventListener("abort", onAbort, { once: true });
+  try {
+    while (true) {
+      idle.reset();
+      let result: Awaited<ReturnType<typeof reader.read>>;
+      try {
+        result = await reader.read();
+      } catch (err) {
+        if (aborted) return { kind: "client_cancel" };
+        if (stalled) return { kind: "stall" };
+        throw err;
+      } finally {
+        idle.pause();
+      }
+      if (aborted) return { kind: "client_cancel" };
+      if (stalled) return { kind: "stall" };
+      if (result.done) break;
+      if (result.value.byteLength === 0) continue;
+      bytes += result.value.byteLength;
+      if (guard.maxBytes > 0 && bytes > guard.maxBytes) {
+        reader.cancel(new DOMException("anthropic passthrough body exceeded byte cap", "QuotaExceededError")).catch(() => {});
+        return { kind: "overflow" };
+      }
+      text += decoder.decode(result.value, { stream: true });
+    }
+    text += decoder.decode();
+    return { kind: "ok", text };
+  } finally {
+    idle.cancel();
+    signal?.removeEventListener("abort", onAbort);
+  }
+}
+
 /**
  * Header-phase fetch guarded by a clearable deadline (PR #136 follow-up hardening).
  *
@@ -461,9 +677,19 @@ export async function handleClaudeMessages(
       }
     } catch { /* keep fallback message */ }
     const retryAfter = response.headers.get("retry-after");
-    const out = new Response(JSON.stringify(anthropicErrorBody(response.status, message)), {
-      status: response.status,
-      headers: { "Content-Type": "application/json", ...(retryAfter ? { "Retry-After": retryAfter } : {}) },
+    // Transient upstream 5xx (already retried pre-stream, 010): reclassify as Anthropic
+    // 529 overloaded_error so the Claude Code client applies its built-in backoff retry
+    // instead of dying on a fatal api_error (260716 sol-builder incident). The request
+    // log keeps the upstream status (captured in the deferred-log closure before this
+    // rewrite): log = upstream truth, client = retry signal.
+    const transient = isTransientUpstreamStatus(response.status);
+    const outStatus = transient ? 529 : response.status;
+    const out = new Response(JSON.stringify(anthropicErrorBody(outStatus, message)), {
+      status: outStatus,
+      headers: {
+        "Content-Type": "application/json",
+        ...(retryAfter ? { "Retry-After": retryAfter } : (transient ? { "Retry-After": "2" } : {})),
+      },
     });
     return out;
   }

package/src/server/management-api.ts

@@ -1071,7 +1071,7 @@ export async function handleManagementAPI(req: Request, url: URL, config: OcxCon
   if (url.pathname === "/api/oauth/logout" && req.method === "POST") {
     const provider = (url.searchParams.get("provider") ?? "").trim().toLowerCase();
     if (!isOAuthProvider(provider)) return jsonResponse({ error: "unknown oauth provider" }, 400);
-    removeCredential(provider);
+    await removeCredential(provider);
     clearLoginState(provider);
     return jsonResponse({ success: true });
   }
@@ -1090,7 +1090,7 @@ export async function handleManagementAPI(req: Request, url: URL, config: OcxCon
     if (!isOAuthProvider(provider)) return jsonResponse({ error: "unknown oauth provider" }, 400);
     if (!body.accountId) return jsonResponse({ error: "missing accountId" }, 400);
     const { setActiveAccount } = await import("../oauth/store");
-    if (!setActiveAccount(provider, body.accountId)) return jsonResponse({ error: "account not found" }, 404);
+    if (!(await setActiveAccount(provider, body.accountId))) return jsonResponse({ error: "account not found" }, 404);
     const { clearProviderQuotaCache } = await import("../providers/quota");
     clearProviderQuotaCache();
     return jsonResponse({ ok: true, provider, activeAccountId: body.accountId });
@@ -1101,7 +1101,7 @@ export async function handleManagementAPI(req: Request, url: URL, config: OcxCon
     if (!isOAuthProvider(provider)) return jsonResponse({ error: "unknown oauth provider" }, 400);
     if (!id) return jsonResponse({ error: "missing id" }, 400);
     const { removeAccount, getAccountSet } = await import("../oauth/store");
-    if (!removeAccount(provider, id)) return jsonResponse({ error: "account not found" }, 404);
+    if (!(await removeAccount(provider, id))) return jsonResponse({ error: "account not found" }, 404);
     if (!getAccountSet(provider)) clearLoginState(provider);
     const { clearProviderQuotaCache } = await import("../providers/quota");
     clearProviderQuotaCache();

package/src/server/request-log.ts

@@ -68,7 +68,7 @@ export interface RequestLogEntry {
   durationMs: number;
   errorCode?: string;
   terminalStatus?: ResponsesTerminalStatus;
-  closeReason?: "terminal" | "client_cancel" | "non_stream";
+  closeReason?: "terminal" | "client_cancel" | "non_stream" | "body_stall" | "body_overflow";
   /** Secret-redacted upstream error reason, surfaced in /api/logs and the GUI detail modal. */
   upstreamError?: string;
   usageStatus: UsageStatus;
@@ -84,6 +84,17 @@ export function addRequestLog(entry: RequestLogEntry) {
   requestLog.push(entry);
   if (requestLog.length > MAX_LOG_SIZE) requestLog.shift();
   try {
+    // Failure diagnostics survive the 200-entry ring buffer by riding the persisted
+    // usage entry (devlog/_plan/260716_claudecode_hardening/030). Success rows stay
+    // in their existing shape; the >=400 gate deliberately includes 499 client-cancels.
+    const failureDiagnostics = entry.status >= 400 || (entry.terminalStatus && entry.terminalStatus !== "completed")
+      ? {
+        ...(entry.errorCode ? { errorCode: entry.errorCode } : {}),
+        ...(entry.terminalStatus ? { terminalStatus: entry.terminalStatus } : {}),
+        ...(entry.closeReason ? { closeReason: entry.closeReason } : {}),
+        ...(entry.upstreamError ? { upstreamError: entry.upstreamError } : {}),
+      }
+      : {};
     appendUsageEntry({
       requestId: entry.requestId,
       timestamp: entry.timestamp,
@@ -96,6 +107,7 @@ export function addRequestLog(entry: RequestLogEntry) {
       usageStatus: entry.usageStatus,
       ...(entry.usage ? { usage: entry.usage } : {}),
       ...(entry.totalTokens !== undefined ? { totalTokens: entry.totalTokens } : {}),
+      ...failureDiagnostics,
     });
   } catch {
     /* request logging must never fail a user request */

package/src/server/responses.ts

@@ -14,8 +14,10 @@ import { injectionDebugLog } from "../lib/injection-debug-log";
 import { modelInList, namespacedToolName } from "../types";
 import type { AdapterEvent, OcxConfig, OcxParsedRequest, OcxProviderConfig } from "../types";
 import {
+  forceRefreshOAuthAccessSnapshot,
   getOAuthCredentialProjectId,
-  getValidAccessToken,
+  getValidAccessTokenSnapshot,
+  type OAuthAccessSnapshot,
   UnsupportedOAuthProviderError,
 } from "../oauth";
 import { buildWebSearchTool, planWebSearch, runWithWebSearch } from "../web-search";
@@ -36,7 +38,7 @@ import {
   recordCodexUpstreamOutcome,
   type CodexUpstreamOutcome,
 } from "../codex/routing";
-import { fetchWithResetRetry } from "../lib/upstream-retry";
+import { fetchWithResetRetry, fetchWithTransientRetry } from "../lib/upstream-retry";
 import { isUsageDebugEnabled } from "../usage/debug";
 import { readJsonRequestBody, DecompressedBodyTooLargeError, UnsupportedContentEncodingError } from "./request-decompress";
 import { resolveAdapter, resolveWireProtocolOverride } from "./adapter-resolve";
@@ -611,9 +613,13 @@ export async function handleResponses(
 
   // OAuth providers: swap in a fresh access token (auto-refreshed) as the Bearer key, so the
   // existing openai-chat / anthropic adapters authenticate with no change.
+  const isXaiOAuthRequest = route.providerName === "xai" && route.provider.authMode === "oauth";
+  let sentOAuthSnapshot: OAuthAccessSnapshot | undefined;
   if (route.provider.authMode === "oauth") {
     try {
-      route.provider = { ...route.provider, apiKey: await getValidAccessToken(route.providerName) };
+      const resolved = await getValidAccessTokenSnapshot(route.providerName);
+      if (isXaiOAuthRequest) sentOAuthSnapshot = resolved;
+      route.provider = { ...route.provider, apiKey: resolved.accessToken };
       // Antigravity (cloud-code-assist) needs the discovered Cloud Code Assist project id in the
       // CCA envelope; the server injects only the bare token, so pull project from the credential.
       if (route.provider.googleMode === "cloud-code-assist" && !route.provider.project) {
@@ -694,12 +700,15 @@ export async function handleResponses(
     const connectMs = config.connectTimeoutMs ?? 200_000;
     let upstreamResponse: Response;
     try {
-      upstreamResponse = await fetchWithResetRetry(
+      // Transient-5xx pre-stream retry (devlog/_plan/260716_claudecode_hardening/010):
+      // the ChatGPT backend emits transient 502/520s that an immediate retry absorbs.
+      // Body is a replayable string; nothing has streamed to the client yet.
+      upstreamResponse = await fetchWithTransientRetry(
         () => fetchWithHeaderTimeout(request.url, {
           method: request.method,
           headers: request.headers,
           body: request.body,
-        }, upstream.signal, connectMs, parsed.stream),
+        }, upstream.signal, connectMs, parsed.stream, providerFetch(route.provider)),
         { abortSignal: upstream.signal, label: safeHostLabel(request.url) },
       );
     } catch (err) {
@@ -726,22 +735,24 @@ export async function handleResponses(
     const terminalRecorder = codexForwardTerminalOutcomeRecorder(config, authCtx, route.provider);
     const terminalBodyWillRecord = !!terminalRecorder && upstreamResponse.ok && isEventStream;
     // Capture quota from upstream response for multi-account tracking
-    if (usesCodexForwardPoolAuth(authCtx, route.provider)) {
-      const weeklyRaw = upstreamResponse.headers.get("x-codex-secondary-used-percent");
-      const fiveHourRaw = upstreamResponse.headers.get("x-codex-primary-used-percent");
+   if (usesCodexForwardPoolAuth(authCtx, route.provider)) {
+      // primary was the 5h window; it now carries weekly data for GPT plans.
+      // Prefer primary when present, fall back to secondary for compatibility.
+      const primaryRaw = upstreamResponse.headers.get("x-codex-primary-used-percent");
+      const secondaryRaw = upstreamResponse.headers.get("x-codex-secondary-used-percent");
+      const weeklyRaw = primaryRaw ?? secondaryRaw;
       const monthlyRaw = upstreamResponse.headers.get("x-codex-tertiary-used-percent");
-      const weeklyResetRaw = upstreamResponse.headers.get("x-codex-secondary-reset-at");
-      const fiveHourResetRaw = upstreamResponse.headers.get("x-codex-primary-reset-at");
+      const primaryResetRaw = upstreamResponse.headers.get("x-codex-primary-reset-at");
+      const secondaryResetRaw = upstreamResponse.headers.get("x-codex-secondary-reset-at");
+      const weeklyResetRaw = primaryRaw ? primaryResetRaw : secondaryResetRaw;
       const monthlyResetRaw = upstreamResponse.headers.get("x-codex-tertiary-reset-at");
       const retryAfterRaw = upstreamResponse.headers.get("retry-after");
-      if (weeklyRaw || fiveHourRaw || monthlyRaw) {
+      if (weeklyRaw || monthlyRaw) {
         const { updateAccountQuota } = await import("../codex/auth-api");
         updateAccountQuota(
           authCtx.accountId,
           weeklyRaw,
-          fiveHourRaw,
           weeklyResetRaw,
-          fiveHourResetRaw,
           monthlyRaw,
           monthlyResetRaw,
         );
@@ -753,8 +764,8 @@ export async function handleResponses(
         });
       } else {
         recordCodexUpstreamOutcome(config, authCtx.accountId, upstreamResponse.status, {
-          retryAfter: retryAfterRaw,
-          resetAt: [fiveHourResetRaw, weeklyResetRaw, monthlyResetRaw],
+        retryAfter: retryAfterRaw,
+         resetAt: [primaryResetRaw, secondaryResetRaw, monthlyResetRaw].filter(Boolean),
         });
       }
     }
@@ -945,7 +956,7 @@ export async function handleResponses(
       : await fetchWithResetRetry(
           () => fetchWithHeaderTimeout(request.url, {
             method: request.method, headers: request.headers, body: request.body,
-          }, upstream.signal, connectMs, parsed.stream),
+          }, upstream.signal, connectMs, parsed.stream, providerFetch(route.provider)),
           { abortSignal: upstream.signal, label: safeHostLabel(request.url) },
         );
   } catch (err) {
@@ -966,6 +977,7 @@ export async function handleResponses(
     let activeAdapter = adapter;
     let imageTierBias = 0;
     let imageRetryAttempted = false;
+    let oauth401ReplayAttempted = false;
     const rebuildAndRefetch = async (): Promise<Response | { failed: Response }> => {
       const retryRequest = await activeAdapter.buildRequest(parsed, {
         headers: selectedForwardHeaders,
@@ -976,7 +988,7 @@ export async function handleResponses(
           ? await activeAdapter.fetchResponse(retryRequest, { abortSignal: upstream.signal, timeoutMs: connectMs, stream: parsed.stream })
           : await fetchWithHeaderTimeout(retryRequest.url, {
               method: retryRequest.method, headers: retryRequest.headers, body: retryRequest.body,
-            }, upstream.signal, connectMs, parsed.stream);
+            }, upstream.signal, connectMs, parsed.stream, providerFetch(route.provider));
       } catch (err) {
         cleanupUpstreamAbort();
         upstream.abort();
@@ -987,6 +999,38 @@ export async function handleResponses(
       }
     };
     recovery: for (;;) {
+      if (
+        upstreamResponse.status === 401
+        && isXaiOAuthRequest
+        && sentOAuthSnapshot
+        && !oauth401ReplayAttempted
+      ) {
+        oauth401ReplayAttempted = true;
+        try { void upstreamResponse.body?.cancel().catch(() => {}); } catch { /* already consumed/closed */ }
+        let refreshed: OAuthAccessSnapshot;
+        try {
+          refreshed = await forceRefreshOAuthAccessSnapshot(sentOAuthSnapshot);
+        } catch (err) {
+          cleanupUpstreamAbort();
+          return formatErrorResponse(401, "authentication_error", err instanceof Error ? err.message : String(err));
+        }
+        sentOAuthSnapshot = refreshed;
+        const refreshedProvider = resolveProviderTransport(
+          route.providerName,
+          { ...route.provider, apiKey: refreshed.accessToken },
+          parsed.options.promptCacheKey,
+        );
+        route.provider = refreshedProvider;
+        activeAdapter = resolveAdapter(
+          resolveWireProtocolOverride(route.providerName, route.modelId, refreshedProvider),
+          config.cacheRetention,
+        );
+        const result = await rebuildAndRefetch();
+        if ("failed" in result) return result.failed;
+        upstreamResponse = result;
+        continue recovery;
+      }
+
       // Multi-key 429 failover: rotate to the next pool key (cooldown-aware) and retry the
       // SAME request once per remaining key. OAuth/forward providers and single-key pools
       // return null immediately, so this stays a no-op for them (src/providers/key-failover.ts).
@@ -1222,12 +1266,17 @@ export function safeHostLabel(url: string): string {
   }
 }
 
+function providerFetch(provider: OcxProviderConfig): typeof globalThis.fetch {
+  return (provider as OcxProviderConfig & { fetch?: typeof globalThis.fetch }).fetch ?? globalThis.fetch;
+}
+
 export async function fetchWithHeaderTimeout(
   url: string,
   init: Omit<RequestInit, "signal">,
   abortSignal: AbortSignal,
   timeoutMs: number,
   preferIdentityEncoding = false,
+  executor: typeof globalThis.fetch = globalThis.fetch,
 ): Promise<Response> {
   const timeout = new AbortController();
   const timer = setTimeout(() => {
@@ -1240,7 +1289,7 @@ export async function fetchWithHeaderTimeout(
     headers.set("accept-encoding", "identity");
   }
   try {
-    return await fetch(url, {
+    return await executor(url, {
       ...init,
       headers,
       signal: AbortSignal.any([abortSignal, timeout.signal]),

package/src/types.ts

@@ -258,6 +258,19 @@ export interface OcxClaudeCodeConfig {
   nativePassthrough?: boolean;
   /** Upstream for the native passthrough (tests/enterprise gateways). Default: https://api.anthropic.com */
   anthropicBaseUrl?: string;
+  /**
+   * Native passthrough body inactivity budget in SECONDS — raw upstream-byte silence
+   * while a read is pending, NOT total duration (slow-but-alive streams never trip it;
+   * devlog 260716_passthrough_followups/010). Default 90. Min 1. Exactly 0 disables;
+   * negative/non-finite values fall back to the default.
+   */
+  bodyStallSec?: number;
+  /**
+   * Native passthrough cumulative body byte cap (streamed SSE and buffered non-stream
+   * alike) — an OOM/occupancy guard, not a correctness limit. Default 67108864 (64 MiB).
+   * Exactly 0 disables; negative/non-finite values fall back to the default.
+   */
+  bodyMaxBytes?: number;
   /** Default model slot injected as ANTHROPIC_MODEL by `ocx claude`. */
   model?: string;
   /** Haiku/small-fast slot injected as ANTHROPIC_DEFAULT_HAIKU_MODEL (+ legacy SMALL_FAST). */

package/src/usage/log.ts

@@ -18,6 +18,13 @@ export interface PersistedUsageEntry {
   usageStatus: UsageStatus;
   usage?: OcxUsage;
   totalTokens?: number;
+  // Failure diagnostics (devlog/_plan/260716_claudecode_hardening/030): persisted for
+  // status>=400 or non-completed terminals so incidents survive the in-memory ring buffer.
+  errorCode?: string;
+  terminalStatus?: string;
+  closeReason?: "terminal" | "client_cancel" | "non_stream" | "body_stall" | "body_overflow";
+  /** Already redacted + capped at capture (request-log.ts redactSecretString().slice(0,500)). */
+  upstreamError?: string;
 }
 
 export function usageLogPath(): string {
@@ -76,6 +83,10 @@ function normalizeUsageEntry(entry: PersistedUsageEntry): PersistedUsageEntry {
     usageStatus: entry.usageStatus,
     ...(entry.usage ? { usage: normalizeUsageValue(entry.usage) } : {}),
     ...(typeof entry.totalTokens === "number" ? { totalTokens: entry.totalTokens } : {}),
+    ...(entry.errorCode ? { errorCode: entry.errorCode } : {}),
+    ...(entry.terminalStatus ? { terminalStatus: entry.terminalStatus } : {}),
+    ...(entry.closeReason ? { closeReason: entry.closeReason } : {}),
+    ...(entry.upstreamError ? { upstreamError: entry.upstreamError } : {}),
   };
 }