@bitkyc08/opencodex 2.7.21 → 2.7.23

package/src/responses/parser.ts

@@ -228,6 +228,20 @@ export function parseRequest(body: unknown): OcxParsedRequest {
   const now = Date.now();
   const messages: OcxMessage[] = [];
   const systemPrompt: string[] = [];
+  // Responses reasoning siblings belong to the following assistant, including across call items.
+  // Keep them off the message list until that assistant arrives; turn boundaries clear the array.
+  const pendingReasoning: Array<{ part: OcxThinkingContent; envelopeSigned: boolean }> = [];
+  // Assistant placeholder that first folds any pending reasoning into the same turn (official
+  // grok-build preserves reasoning across call items; Anthropic replay requires thinking to
+  // precede tool_use inside one assistant message).
+  const assistantHolderWithReasoning = (): OcxAssistantMessage => {
+    const holder = ensureAssistantPlaceholder(messages, data.model, now);
+    if (pendingReasoning.length > 0) {
+      holder.content.push(...pendingReasoning.map(entry => entry.part));
+      pendingReasoning.length = 0;
+    }
+    return holder;
+  };
   // Tool specs surfaced by a prior tool_search (deferred tools, e.g. subagents). Codex does not
   // re-list these in `tools`, but chat models can only call listed tools — so we re-inject them.
   const loadedToolSpecs: unknown[] = [];
@@ -270,6 +284,7 @@ export function parseRequest(body: unknown): OcxParsedRequest {
         // is dropped silently. It must NOT flag _compactionRequest.
         const encrypted = (item as { encrypted_content?: unknown }).encrypted_content;
         if (effectiveType === "context_compaction" && typeof encrypted !== "string") continue;
+        pendingReasoning.length = 0;
         messages.push({
           role: "user",
           content: compactionItemToText(typeof encrypted === "string" ? encrypted : undefined),
@@ -297,6 +312,7 @@ export function parseRequest(body: unknown): OcxParsedRequest {
         // An agent_message is external input delivered to the parent agent.
         // Preserve it as a user-role turn so signed Anthropic thinking blocks
         // on either side are never merged into one modified assistant response.
+        pendingReasoning.length = 0;
         messages.push({
           role: "user",
           content: hasContent ? content : "(sub-agent message received)",
@@ -310,6 +326,7 @@ export function parseRequest(body: unknown): OcxParsedRequest {
         const msg = item as { role?: string; content?: unknown };
         switch (msg.role) {
           case "system": {
+            pendingReasoning.length = 0;
             const text = inputContentParts(msg.content as unknown[] | string | undefined);
             const flat = typeof text === "string" ? text : text.map(p => (p.type === "text" ? p.text : "")).join("");
             if (flat.length > 0) systemPrompt.push(flat);
@@ -317,13 +334,22 @@ export function parseRequest(body: unknown): OcxParsedRequest {
           }
           case "user":
           case "developer": {
+            pendingReasoning.length = 0;
             const content = inputContentParts(msg.content as unknown[] | string | undefined);
             messages.push({ role: msg.role, content, timestamp: now });
             break;
           }
           case "assistant": {
             const parts = outputTextOf(msg.content as unknown[] | string | undefined);
-            messages.push({ role: "assistant", content: parts, model: data.model, timestamp: now });
+            messages.push({
+              role: "assistant",
+              content: pendingReasoning.length > 0
+                ? [...pendingReasoning.map(entry => entry.part), ...parts]
+                : parts,
+              model: data.model,
+              timestamp: now,
+            });
+            pendingReasoning.length = 0;
             break;
           }
         }
@@ -334,20 +360,33 @@ export function parseRequest(body: unknown): OcxParsedRequest {
         const reasoning = item as { id?: string; summary?: { text: string }[]; content?: { text: string }[]; encrypted_content?: string };
         const fromSummary = (reasoning.summary ?? []).map(c => c.text).join("");
         const text = fromSummary || (reasoning.content ?? []).map(c => c.text).join("");
-        // ocxr1 envelope: the REAL Anthropic signature (+ redacted blocks, + hidden signed text)
-        // captured by the bridge. Native OpenAI-encrypted blobs decode to null and keep today's
-        // placeholder signature (which the anthropic adapter correctly rejects on replay).
         const envelope = typeof reasoning.encrypted_content === "string"
           ? decodeReasoningEnvelope(reasoning.encrypted_content)
           : null;
-        const thinking: OcxThinkingContent = {
-          type: "thinking",
-          thinking: envelope?.txt || text,
-          signature: envelope?.sig ?? JSON.stringify(reasoning),
-          ...(envelope?.red ? { redacted: envelope.red } : {}),
-          ...(reasoning.id ? { itemId: reasoning.id } : {}),
-        };
-        ensureAssistantPlaceholder(messages, data.model, now).content.push(thinking);
+        const thinkingText = envelope?.txt || text;
+
+        // Native/non-ocxr1 encrypted-only reasoning is opaque here. Do not create a detached
+        // assistant turn or invent replayable plaintext/signatures from the encrypted payload.
+        if (thinkingText.length > 0) {
+          const part: OcxThinkingContent = {
+            type: "thinking",
+            thinking: thinkingText,
+            signature: envelope?.sig ?? JSON.stringify(reasoning),
+            ...(envelope?.red ? { redacted: envelope.red } : {}),
+            ...(reasoning.id ? { itemId: reasoning.id } : {}),
+          };
+          const envelopeSigned = typeof envelope?.sig === "string";
+          const previous = pendingReasoning[pendingReasoning.length - 1];
+
+          if (!envelopeSigned && previous && !previous.envelopeSigned) {
+            previous.part = {
+              ...part,
+              thinking: `${previous.part.thinking}\n${part.thinking}`,
+            };
+          } else {
+            pendingReasoning.push({ part, envelopeSigned });
+          }
+        }
         continue;
       }
 
@@ -370,7 +409,7 @@ export function parseRequest(body: unknown): OcxParsedRequest {
           ...(call.id ? { thoughtSignature: call.id } : {}),
           ...(call.namespace ? { namespace: call.namespace } : {}),
         };
-        ensureAssistantPlaceholder(messages, data.model, now).content.push(toolCall);
+        assistantHolderWithReasoning().content.push(toolCall);
         continue;
       }
 
@@ -382,7 +421,7 @@ export function parseRequest(body: unknown): OcxParsedRequest {
           customWireName: call.name,
           ...(call.id ? { thoughtSignature: call.id } : {}),
         };
-        ensureAssistantPlaceholder(messages, data.model, now).content.push(toolCall);
+        assistantHolderWithReasoning().content.push(toolCall);
         continue;
       }
 
@@ -393,7 +432,7 @@ export function parseRequest(body: unknown): OcxParsedRequest {
         const callId = call.call_id ?? call.id;
         if (callId) {
           const command = Array.isArray(call.action?.command) ? call.action.command : [];
-          ensureAssistantPlaceholder(messages, data.model, now).content.push({
+          assistantHolderWithReasoning().content.push({
             type: "toolCall", id: callId, name: "shell",
             arguments: command.length > 0 ? { command } : {},
           });
@@ -406,7 +445,7 @@ export function parseRequest(body: unknown): OcxParsedRequest {
         // knows the search already ran (prevents re-search loops); there is no output to pair.
         const call = item as { action?: { type?: string; query?: string } };
         const query = typeof call.action?.query === "string" ? call.action.query : "";
-        ensureAssistantPlaceholder(messages, data.model, now).content.push({
+        assistantHolderWithReasoning().content.push({
           type: "text", text: query ? `[web search performed: ${query}]` : "[web search performed]",
         });
         continue;
@@ -417,7 +456,7 @@ export function parseRequest(body: unknown): OcxParsedRequest {
         // history stays complete (otherwise the model re-issues tool_search forever).
         const call = item as { id?: string; call_id?: string; arguments?: unknown };
         const callId = call.call_id ?? call.id ?? "";
-        ensureAssistantPlaceholder(messages, data.model, now).content.push({
+        assistantHolderWithReasoning().content.push({
           type: "toolCall", id: callId, name: "tool_search",
           arguments: isObj(call.arguments) ? call.arguments : {},
         });
@@ -425,6 +464,7 @@ export function parseRequest(body: unknown): OcxParsedRequest {
       }
 
       if (effectiveType === "tool_search_output") {
+        pendingReasoning.length = 0;
         // Pair the tool_search call with its result so the model sees what was loaded.
         const out = item as { call_id?: string; status?: string; tools?: unknown[] };
         const specs = Array.isArray(out.tools) ? (out.tools as Record<string, unknown>[]) : [];
@@ -455,6 +495,7 @@ export function parseRequest(body: unknown): OcxParsedRequest {
       }
 
       if (effectiveType === "function_call_output") {
+        pendingReasoning.length = 0;
         const output = item as { call_id: string; output?: string | unknown[] };
         const toolInfo = findToolById(messages, output.call_id);
         messages.push({
@@ -466,6 +507,7 @@ export function parseRequest(body: unknown): OcxParsedRequest {
       }
 
       if (effectiveType === "custom_tool_call_output") {
+        pendingReasoning.length = 0;
         const output = item as { call_id: string; output: string | unknown[] };
         const toolInfo = findToolById(messages, output.call_id);
         messages.push({

package/src/server/claude-messages.ts

@@ -12,6 +12,7 @@ import { normalizeAnthropicImages } from "../adapters/anthropic-image-normalize"
 import { AnthropicRequestError, anthropicToResponsesTranslation, extractOcxRouteDirective, resolveInboundModel, type ClaudeCacheKeySource } from "../claude/inbound";
 import { stripOneMillionMarker } from "../claude/context-windows";
 import { captureClaudeInbound } from "../claude/inbound-debug";
+import { isTransientUpstreamStatus } from "../lib/upstream-retry";
 import {
   anthropicErrorBody,
   anthropicErrorResponse,
@@ -19,7 +20,7 @@ import {
   responsesJsonToAnthropicMessage,
   responsesSseToAnthropicSse,
 } from "../claude/outbound";
-import { clearableDeadline } from "../lib/abort";
+import { clearableDeadline, idleDeadline } from "../lib/abort";
 import { estimateTokens } from "../lib/token-estimate";
 import { routeModel } from "../router";
 import type { OcxConfig } from "../types";
@@ -117,13 +118,35 @@ function anthropicUsageToOcx(usage: Rec | undefined): { inputTokens: number; out
   };
 }
 
-/** Tap an Anthropic-vocabulary SSE stream for the request log (usage + terminal). */
-function tapAnthropicSseForLog(
+/** Body-occupancy guard for the native passthrough (devlog 260716_passthrough_followups/010). */
+export interface PassthroughBodyGuard {
+  /** Idle window in ms — raw upstream-byte inactivity while a read is pending. 0 disables. */
+  stallMs: number;
+  /** Cumulative body byte cap. 0 disables. */
+  maxBytes: number;
+  /** Client request signal for deterministic cancel classification. */
+  reqSignal?: AbortSignal;
+}
+
+type PassthroughCloseReason = "terminal" | "client_cancel" | "body_stall" | "body_overflow";
+
+/**
+ * Tap an Anthropic-vocabulary SSE stream for the request log (usage + terminal),
+ * bounding body occupancy: idle (silence-only, timed ONLY while a reader.read() is
+ * pending so downstream backpressure never counts as upstream inactivity) and a
+ * cumulative byte cap. On stall/overflow it appends a protocol-compatible Anthropic
+ * `event: error` terminal frame after a blank-line boundary, closes, and cancels the
+ * upstream reader — never a total-wall-clock bound (slow-but-alive streams live).
+ * Exported for deterministic unit tests.
+ */
+export function tapAnthropicSseForLog(
   upstream: ReadableStream<Uint8Array>,
   logCtx: RequestLogContext,
-  finalize: (status: number, meta: { closeReason: "terminal" | "client_cancel" }) => void,
+  finalize: (status: number, meta: { closeReason: PassthroughCloseReason }) => void,
+  guard?: PassthroughBodyGuard,
 ): ReadableStream<Uint8Array> {
   const decoder = new TextDecoder();
+  const encoder = new TextEncoder();
   let buffer = "";
   let usageAcc: Rec = {};
   const inspect = (chunk: Uint8Array) => {
@@ -145,25 +168,110 @@ function tapAnthropicSseForLog(
     }
   };
   const reader = upstream.getReader();
+  let settled = false;
+  let bodyBytes = 0;
+  let tapController: ReadableStreamDefaultController<Uint8Array> | undefined;
+
+  const recordUsage = () => {
+    logCtx.usage = anthropicUsageToOcx(Object.keys(usageAcc).length > 0 ? usageAcc : undefined);
+  };
+  const failBody = (closeReason: "body_stall" | "body_overflow", errType: string, message: string) => {
+    if (settled) return;
+    settled = true;
+    idle.cancel();
+    detachAbort();
+    recordUsage();
+    finalize(200, { closeReason });
+    const payload = JSON.stringify({ type: "error", error: { type: errType, message } });
+    try {
+      // Leading blank line terminates any partial SSE block so the frame parses cleanly
+      // (relaySseWithFailedTail policy, Anthropic wire shape).
+      tapController?.enqueue(encoder.encode(`\n\nevent: error\ndata: ${payload}\n\n`));
+      tapController?.close();
+    } catch { /* client already torn down */ }
+    reader.cancel(new DOMException(message, closeReason === "body_stall" ? "TimeoutError" : "QuotaExceededError")).catch(() => {});
+  };
+  const idle = idleDeadline(guard?.stallMs ?? 0, () => {
+    failBody(
+      "body_stall",
+      "timeout_error",
+      `anthropic passthrough body stalled: no upstream bytes for ${Math.round((guard?.stallMs ?? 0) / 1000)}s`,
+    );
+  });
+  // Deterministic client-cancel classification: Bun may surface a client abort as a
+  // reader.read() rejection OR a resolved done (src/lib/abort.ts cancelBodyOnAbort
+  // rationale), so the listener performs first-wins settlement itself instead of
+  // relying on which shape the read takes.
+  const onClientAbort = () => {
+    if (settled) return;
+    settled = true;
+    idle.cancel();
+    detachAbort();
+    finalize(499, { closeReason: "client_cancel" });
+    try { tapController?.close(); } catch { /* downstream already torn down */ }
+    reader.cancel(guard?.reqSignal?.reason).catch(() => {});
+  };
+  const detachAbort = (() => {
+    const signal = guard?.reqSignal;
+    if (!signal) return () => {};
+    if (signal.aborted) {
+      queueMicrotask(onClientAbort);
+      return () => {};
+    }
+    signal.addEventListener("abort", onClientAbort, { once: true });
+    return () => signal.removeEventListener("abort", onClientAbort);
+  })();
+
   return new ReadableStream<Uint8Array>({
+    start(controller) {
+      tapController = controller;
+    },
     async pull(controller) {
+      if (settled) return;
       try {
+        idle.reset();
         const { done, value } = await reader.read();
+        idle.pause();
+        if (settled) return; // stall/overflow/abort won the race while we awaited
         if (done) {
-          logCtx.usage = anthropicUsageToOcx(Object.keys(usageAcc).length > 0 ? usageAcc : undefined);
+          settled = true;
+          idle.cancel();
+          detachAbort();
+          recordUsage();
           finalize(200, { closeReason: "terminal" });
           controller.close();
           return;
         }
+        if (value.byteLength > 0) {
+          bodyBytes += value.byteLength;
+          if (guard && guard.maxBytes > 0 && bodyBytes > guard.maxBytes) {
+            failBody(
+              "body_overflow",
+              "api_error",
+              `anthropic passthrough body exceeded ${guard.maxBytes} bytes`,
+            );
+            return;
+          }
+        }
         inspect(value);
         controller.enqueue(value);
       } catch (err) {
+        if (settled) return;
+        settled = true;
+        idle.cancel();
+        detachAbort();
+        recordUsage();
         finalize(200, { closeReason: "terminal" });
         try { controller.error(err); } catch { /* torn down */ }
       }
     },
     cancel(reason) {
-      finalize(499, { closeReason: "client_cancel" });
+      if (!settled) {
+        settled = true;
+        idle.cancel();
+        detachAbort();
+        finalize(499, { closeReason: "client_cancel" });
+      }
       reader.cancel(reason).catch(() => {});
     },
   });
@@ -182,7 +290,7 @@ async function anthropicNativePassthrough(
   logCtx.provider = "anthropic-native";
   logCtx.requestedModel = model;
   let logged = false;
-  const finalize = (status: number, meta: { closeReason: "terminal" | "client_cancel" | "non_stream" }) => {
+  const finalize = (status: number, meta: { closeReason: PassthroughCloseReason | "non_stream" }) => {
     if (!logIds || logged) return;
     logged = true;
     addFinalRequestLog(logIds.requestId, logIds.start, logCtx, status, meta);
@@ -208,7 +316,7 @@ async function anthropicNativePassthrough(
   const result = await fetchWithHeaderDeadline(
     `${base}${pathname}${search}`,
     { method: "POST", headers, body: JSON.stringify(body) },
-    config.connectTimeoutMs ?? 120_000,
+    config.connectTimeoutMs ?? 200_000,
     req.signal,
   );
   if (result.kind === "timeout") {
@@ -223,8 +331,9 @@ async function anthropicNativePassthrough(
   const upstream = result.upstream;
 
   const contentType = upstream.headers.get("content-type") ?? "application/json";
+  const bodyGuard = resolvePassthroughBodyGuard(config, req.signal);
   if (upstream.ok && contentType.includes("text/event-stream") && upstream.body) {
-    return new Response(tapAnthropicSseForLog(upstream.body, logCtx, finalize), {
+    return new Response(tapAnthropicSseForLog(upstream.body, logCtx, finalize, bodyGuard), {
       status: upstream.status,
       headers: {
         "Content-Type": contentType,
@@ -233,8 +342,22 @@ async function anthropicNativePassthrough(
       },
     });
   }
-  // Non-stream (count_tokens, errors, stream:false): relay verbatim, log on the spot.
-  const text = await upstream.text();
+  // Non-stream (count_tokens, errors, stream:false): relay verbatim under the same
+  // idle/size bounds — headers are NOT yet sent here, so real statuses are available.
+  const bodyResult = await readBoundedPassthroughBody(upstream, bodyGuard);
+  if (bodyResult.kind === "client_cancel") {
+    finalize(499, { closeReason: "client_cancel" });
+    return anthropicErrorResponse(499, "client closed request during anthropic passthrough", "api_error");
+  }
+  if (bodyResult.kind === "stall") {
+    finalize(504, { closeReason: "body_stall" });
+    return anthropicErrorResponse(504, `anthropic passthrough body stalled: no upstream bytes for ${Math.round(bodyGuard.stallMs / 1000)}s`, "timeout_error");
+  }
+  if (bodyResult.kind === "overflow") {
+    finalize(502, { closeReason: "body_overflow" });
+    return anthropicErrorResponse(502, `anthropic passthrough body exceeded ${bodyGuard.maxBytes} bytes`, "api_error");
+  }
+  const text = bodyResult.text;
   if (upstream.ok) {
     try {
       const parsed = JSON.parse(text) as { usage?: Rec };
@@ -249,6 +372,99 @@ async function anthropicNativePassthrough(
   });
 }
 
+const DEFAULT_BODY_STALL_SEC = 90;
+const DEFAULT_BODY_MAX_BYTES = 64 * 1024 * 1024;
+
+/**
+ * Normalize the claudeCode body-guard config (devlog 260716_passthrough_followups/010).
+ * Policy: exactly 0 disables; finite positive values are honored (stall clamped to
+ * min 1s); negative/non-finite/absent values fall back to the defaults.
+ */
+export function resolvePassthroughBodyGuard(config: OcxConfig, reqSignal?: AbortSignal): PassthroughBodyGuard {
+  const rawSec = config.claudeCode?.bodyStallSec;
+  const stallSec = rawSec === 0
+    ? 0
+    : typeof rawSec === "number" && Number.isFinite(rawSec) && rawSec > 0
+      ? Math.max(1, rawSec)
+      : DEFAULT_BODY_STALL_SEC;
+  const rawBytes = config.claudeCode?.bodyMaxBytes;
+  const maxBytes = rawBytes === 0
+    ? 0
+    : typeof rawBytes === "number" && Number.isFinite(rawBytes) && rawBytes > 0
+      ? Math.floor(rawBytes)
+      : DEFAULT_BODY_MAX_BYTES;
+  return { stallMs: stallSec * 1000, maxBytes, ...(reqSignal ? { reqSignal } : {}) };
+}
+
+type BoundedPassthroughBody =
+  | { kind: "ok"; text: string }
+  | { kind: "stall" }
+  | { kind: "overflow" }
+  | { kind: "client_cancel" };
+
+/**
+ * Bounded replacement for `await upstream.text()` on the non-stream passthrough
+ * branch: same idle-only + size-cap semantics as the SSE tap. NOTE: reader.cancel()
+ * resolves a pending read as done rather than rejecting, so the stalled flag is
+ * re-checked after every read settlement (audit round 3).
+ */
+export async function readBoundedPassthroughBody(
+  upstream: Response,
+  guard: PassthroughBodyGuard,
+): Promise<BoundedPassthroughBody> {
+  if (!upstream.body) return { kind: "ok", text: await upstream.text() };
+  const reader = upstream.body.getReader();
+  const decoder = new TextDecoder();
+  let text = "";
+  let bytes = 0;
+  let stalled = false;
+  let aborted = false;
+  const idle = idleDeadline(guard.stallMs, () => {
+    stalled = true;
+    reader.cancel(new DOMException("anthropic passthrough body stalled", "TimeoutError")).catch(() => {});
+  });
+  // Deterministic client-abort classification (audit round 4): Bun may surface the
+  // abort as a read rejection OR a resolved done, so we cancel the reader ourselves
+  // and classify via the flag rather than the read's settlement shape.
+  const signal = guard.reqSignal;
+  const onAbort = () => {
+    aborted = true;
+    reader.cancel(signal?.reason).catch(() => {});
+  };
+  if (signal?.aborted) onAbort();
+  else signal?.addEventListener("abort", onAbort, { once: true });
+  try {
+    while (true) {
+      idle.reset();
+      let result: Awaited<ReturnType<typeof reader.read>>;
+      try {
+        result = await reader.read();
+      } catch (err) {
+        if (aborted) return { kind: "client_cancel" };
+        if (stalled) return { kind: "stall" };
+        throw err;
+      } finally {
+        idle.pause();
+      }
+      if (aborted) return { kind: "client_cancel" };
+      if (stalled) return { kind: "stall" };
+      if (result.done) break;
+      if (result.value.byteLength === 0) continue;
+      bytes += result.value.byteLength;
+      if (guard.maxBytes > 0 && bytes > guard.maxBytes) {
+        reader.cancel(new DOMException("anthropic passthrough body exceeded byte cap", "QuotaExceededError")).catch(() => {});
+        return { kind: "overflow" };
+      }
+      text += decoder.decode(result.value, { stream: true });
+    }
+    text += decoder.decode();
+    return { kind: "ok", text };
+  } finally {
+    idle.cancel();
+    signal?.removeEventListener("abort", onAbort);
+  }
+}
+
 /**
  * Header-phase fetch guarded by a clearable deadline (PR #136 follow-up hardening).
  *
@@ -461,9 +677,19 @@ export async function handleClaudeMessages(
       }
     } catch { /* keep fallback message */ }
     const retryAfter = response.headers.get("retry-after");
-    const out = new Response(JSON.stringify(anthropicErrorBody(response.status, message)), {
-      status: response.status,
-      headers: { "Content-Type": "application/json", ...(retryAfter ? { "Retry-After": retryAfter } : {}) },
+    // Transient upstream 5xx (already retried pre-stream, 010): reclassify as Anthropic
+    // 529 overloaded_error so the Claude Code client applies its built-in backoff retry
+    // instead of dying on a fatal api_error (260716 sol-builder incident). The request
+    // log keeps the upstream status (captured in the deferred-log closure before this
+    // rewrite): log = upstream truth, client = retry signal.
+    const transient = isTransientUpstreamStatus(response.status);
+    const outStatus = transient ? 529 : response.status;
+    const out = new Response(JSON.stringify(anthropicErrorBody(outStatus, message)), {
+      status: outStatus,
+      headers: {
+        "Content-Type": "application/json",
+        ...(retryAfter ? { "Retry-After": retryAfter } : (transient ? { "Retry-After": "2" } : {})),
+      },
     });
     return out;
   }

package/src/server/management-api.ts

@@ -1071,7 +1071,7 @@ export async function handleManagementAPI(req: Request, url: URL, config: OcxCon
   if (url.pathname === "/api/oauth/logout" && req.method === "POST") {
     const provider = (url.searchParams.get("provider") ?? "").trim().toLowerCase();
     if (!isOAuthProvider(provider)) return jsonResponse({ error: "unknown oauth provider" }, 400);
-    removeCredential(provider);
+    await removeCredential(provider);
     clearLoginState(provider);
     return jsonResponse({ success: true });
   }
@@ -1090,7 +1090,7 @@ export async function handleManagementAPI(req: Request, url: URL, config: OcxCon
     if (!isOAuthProvider(provider)) return jsonResponse({ error: "unknown oauth provider" }, 400);
     if (!body.accountId) return jsonResponse({ error: "missing accountId" }, 400);
     const { setActiveAccount } = await import("../oauth/store");
-    if (!setActiveAccount(provider, body.accountId)) return jsonResponse({ error: "account not found" }, 404);
+    if (!(await setActiveAccount(provider, body.accountId))) return jsonResponse({ error: "account not found" }, 404);
     const { clearProviderQuotaCache } = await import("../providers/quota");
     clearProviderQuotaCache();
     return jsonResponse({ ok: true, provider, activeAccountId: body.accountId });
@@ -1101,7 +1101,7 @@ export async function handleManagementAPI(req: Request, url: URL, config: OcxCon
     if (!isOAuthProvider(provider)) return jsonResponse({ error: "unknown oauth provider" }, 400);
     if (!id) return jsonResponse({ error: "missing id" }, 400);
     const { removeAccount, getAccountSet } = await import("../oauth/store");
-    if (!removeAccount(provider, id)) return jsonResponse({ error: "account not found" }, 404);
+    if (!(await removeAccount(provider, id))) return jsonResponse({ error: "account not found" }, 404);
     if (!getAccountSet(provider)) clearLoginState(provider);
     const { clearProviderQuotaCache } = await import("../providers/quota");
     clearProviderQuotaCache();

package/src/server/request-log.ts

@@ -68,7 +68,7 @@ export interface RequestLogEntry {
   durationMs: number;
   errorCode?: string;
   terminalStatus?: ResponsesTerminalStatus;
-  closeReason?: "terminal" | "client_cancel" | "non_stream";
+  closeReason?: "terminal" | "client_cancel" | "non_stream" | "body_stall" | "body_overflow";
   /** Secret-redacted upstream error reason, surfaced in /api/logs and the GUI detail modal. */
   upstreamError?: string;
   usageStatus: UsageStatus;
@@ -84,6 +84,17 @@ export function addRequestLog(entry: RequestLogEntry) {
   requestLog.push(entry);
   if (requestLog.length > MAX_LOG_SIZE) requestLog.shift();
   try {
+    // Failure diagnostics survive the 200-entry ring buffer by riding the persisted
+    // usage entry (devlog/_plan/260716_claudecode_hardening/030). Success rows stay
+    // in their existing shape; the >=400 gate deliberately includes 499 client-cancels.
+    const failureDiagnostics = entry.status >= 400 || (entry.terminalStatus && entry.terminalStatus !== "completed")
+      ? {
+        ...(entry.errorCode ? { errorCode: entry.errorCode } : {}),
+        ...(entry.terminalStatus ? { terminalStatus: entry.terminalStatus } : {}),
+        ...(entry.closeReason ? { closeReason: entry.closeReason } : {}),
+        ...(entry.upstreamError ? { upstreamError: entry.upstreamError } : {}),
+      }
+      : {};
     appendUsageEntry({
       requestId: entry.requestId,
       timestamp: entry.timestamp,
@@ -96,6 +107,7 @@ export function addRequestLog(entry: RequestLogEntry) {
       usageStatus: entry.usageStatus,
       ...(entry.usage ? { usage: entry.usage } : {}),
       ...(entry.totalTokens !== undefined ? { totalTokens: entry.totalTokens } : {}),
+      ...failureDiagnostics,
     });
   } catch {
     /* request logging must never fail a user request */