@bitkyc08/opencodex 2.7.4 → 2.7.6

package/src/lib/bounded-body.ts

@@ -0,0 +1,202 @@
+/** Maximum number of response-body bytes that may be retained for an error. */
+export const BOUNDED_BODY_MAX_BYTES = 65_536;
+
+/** Default wall-clock and continuous-silence deadlines. */
+export const BOUNDED_BODY_TIMEOUT_MS = 5_000;
+
+export interface BoundedBodyOptions {
+	/** Abort the read with this signal. Its reason is rethrown by identity. */
+	signal?: AbortSignal;
+	/** Total wall-clock deadline. Exposed for focused tests. */
+	totalTimeoutMs?: number;
+	/** Deadline between non-empty raw chunks. Exposed for focused tests. */
+	inactivityTimeoutMs?: number;
+}
+
+export interface BoundedBodyResult {
+	/** UTF-8 text retained from the response. Empty when the size limit was exceeded. */
+	text: string;
+	/** True when EOF was not observed. */
+	truncated: boolean;
+	/** True for either total-deadline or inactivity-deadline expiry. */
+	timedOut: boolean;
+	/** Distinguishes the wall-clock deadline from an inactivity deadline. */
+	totalTimedOut: boolean;
+	/** True only when continuous inactivity caused the timeout. */
+	inactivityTimedOut: boolean;
+	/** True when the body was observed to exceed the byte cap. */
+	oversized: boolean;
+	/** False means callers should use a status-only fallback, not `text`. */
+	displaySafe: boolean;
+}
+
+const TOTAL_TIMEOUT = Symbol("bounded body total timeout");
+const INACTIVITY_TIMEOUT = Symbol("bounded body inactivity timeout");
+
+function timeoutPromise(ms: number, value: symbol): { promise: Promise<symbol>; clear: () => void } {
+	let timer: ReturnType<typeof setTimeout> | undefined;
+	const promise = new Promise<symbol>((resolve) => {
+		timer = setTimeout(() => resolve(value), Math.max(0, ms));
+	});
+	return {
+		promise,
+		clear: () => {
+			if (timer !== undefined) clearTimeout(timer);
+		},
+	};
+}
+
+function cancelWithoutWaiting(reader: ReadableStreamDefaultReader<Uint8Array>, reason?: unknown): void {
+	// A hostile/broken stream may reject or never settle cancel(). Neither should
+	// escape as an unhandled rejection or extend this primitive's own deadline.
+	try {
+		void reader.cancel(reason).catch(() => undefined);
+	} catch {
+		// Some stream implementations throw synchronously from cancel().
+	}
+}
+
+function decodeUtf8(chunks: readonly Uint8Array[]): string {
+	const decoder = new TextDecoder();
+	let text = "";
+	for (const chunk of chunks) text += decoder.decode(chunk, { stream: true });
+	// Flush an incomplete trailing UTF-8 sequence deterministically.
+	text += decoder.decode();
+	return text;
+}
+
+/**
+ * Consume the original response body under strict memory and time bounds.
+ *
+ * This deliberately calls `getReader()` on `response.body`: it never clones or
+ * tees the response. Once an over-limit byte is observed, all retained raw data
+ * is discarded so an untrusted prefix can never become a client-facing error.
+ */
+export async function readBoundedResponseBody(
+	response: Response,
+	options: BoundedBodyOptions = {},
+): Promise<BoundedBodyResult> {
+	const signal = options.signal;
+	if (signal?.aborted) throw signal.reason;
+
+	const body = response.body;
+	if (!body) {
+		return {
+			text: "",
+			truncated: false,
+			timedOut: false,
+			totalTimedOut: false,
+			inactivityTimedOut: false,
+			oversized: false,
+			displaySafe: true,
+		};
+	}
+
+	const reader = body.getReader();
+	const chunks: Uint8Array[] = [];
+	let retainedBytes = 0;
+	let mustCancel = false;
+	let cancelReason: unknown;
+	const total = timeoutPromise(options.totalTimeoutMs ?? BOUNDED_BODY_TIMEOUT_MS, TOTAL_TIMEOUT);
+	let inactivity = timeoutPromise(
+		options.inactivityTimeoutMs ?? BOUNDED_BODY_TIMEOUT_MS,
+		INACTIVITY_TIMEOUT,
+	);
+
+	let rejectForAbort: ((reason: unknown) => void) | undefined;
+	const aborted = new Promise<never>((_resolve, reject) => {
+		rejectForAbort = reject;
+	});
+	const onAbort = () => rejectForAbort?.(signal?.reason);
+	signal?.addEventListener("abort", onAbort, { once: true });
+	// Close the narrow race between the preflight check and listener install.
+	if (signal?.aborted) onAbort();
+
+	try {
+		while (true) {
+			// Attach a rejection handler before racing. If a deadline wins and
+			// cancellation later rejects this read, it remains observed.
+			const read = reader.read();
+			void read.catch(() => undefined);
+			const outcome = await Promise.race([read, total.promise, inactivity.promise, aborted]);
+			// Cancellation owns the body lifetime even when EOF/readability settles in
+			// the same turn. Promise.race otherwise lets array order hide the abort.
+			if (signal?.aborted) {
+				mustCancel = true;
+				cancelReason = signal.reason;
+				throw signal.reason;
+			}
+
+			if (outcome === TOTAL_TIMEOUT || outcome === INACTIVITY_TIMEOUT) {
+				mustCancel = true;
+				cancelReason = new DOMException(
+					outcome === TOTAL_TIMEOUT ? "Error body total timeout" : "Error body inactivity timeout",
+					"TimeoutError",
+				);
+				return {
+					text: decodeUtf8(chunks),
+					truncated: true,
+					timedOut: true,
+					totalTimedOut: outcome === TOTAL_TIMEOUT,
+					inactivityTimedOut: outcome === INACTIVITY_TIMEOUT,
+					oversized: false,
+					displaySafe: false,
+				};
+			}
+
+			const { value, done } = outcome as ReadableStreamReadResult<Uint8Array>;
+			if (done) {
+				return {
+					text: decodeUtf8(chunks),
+					truncated: false,
+					timedOut: false,
+					totalTimedOut: false,
+					inactivityTimedOut: false,
+					oversized: false,
+					displaySafe: true,
+				};
+			}
+
+			if (!value || value.byteLength === 0) continue;
+
+			inactivity.clear();
+			inactivity = timeoutPromise(
+				options.inactivityTimeoutMs ?? BOUNDED_BODY_TIMEOUT_MS,
+				INACTIVITY_TIMEOUT,
+			);
+
+			if (value.byteLength > BOUNDED_BODY_MAX_BYTES - retainedBytes) {
+				mustCancel = true;
+				cancelReason = new DOMException("Error body size limit reached", "QuotaExceededError");
+				chunks.length = 0;
+				retainedBytes = 0;
+				return {
+					text: "",
+					truncated: true,
+					timedOut: false,
+					totalTimedOut: false,
+					inactivityTimedOut: false,
+					oversized: true,
+					displaySafe: false,
+				};
+			}
+
+			chunks.push(value);
+			retainedBytes += value.byteLength;
+		}
+	} catch (error) {
+		mustCancel = true;
+		cancelReason = error;
+		throw error;
+	} finally {
+		total.clear();
+		inactivity.clear();
+		signal?.removeEventListener("abort", onAbort);
+		if (mustCancel) cancelWithoutWaiting(reader, cancelReason);
+		try {
+			reader.releaseLock();
+		} catch {
+			// A pending read can keep the lock briefly while cancel settles.
+		}
+	}
+}

package/src/providers/registry.ts

@@ -348,11 +348,13 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
       "kimi-k2.7-code-highspeed": [],
       ...Object.fromEntries(OPENCODE_GO_THINKING_TOGGLE_MODELS.map(id => [id, THINKING_TOGGLE_EFFORTS])),
       ...Object.fromEntries(OPENCODE_GO_THINKING_BUDGET_MODELS.map(id => [id, THINKING_BUDGET_EFFORTS])),
+      ...Object.fromEntries(DEEPSEEK_THINKING_MODELS.map(id => [id, DEEPSEEK_THINKING_EFFORTS])),
     },
     // glm-5.2 uses identity labels now that `max` is a native Codex level (no alias map);
     // the thinking-toggle map is a REAL wire alias (effort -> enabled/disabled) and stays.
     modelReasoningEffortMap: {
       ...Object.fromEntries(OPENCODE_GO_THINKING_TOGGLE_MODELS.map(id => [id, THINKING_TOGGLE_MAP])),
+      ...Object.fromEntries(DEEPSEEK_THINKING_MODELS.map(id => [id, DEEPSEEK_THINKING_REASONING_MAP])),
     },
     thinkingToggleModels: OPENCODE_GO_THINKING_TOGGLE_MODELS,
     thinkingBudgetModels: THINKING_BUDGET_MODELS,
@@ -371,7 +373,8 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     noTopPModels: ["kimi-k2.7-code", "kimi-k2.7-code-highspeed"],
     noPenaltyModels: ["kimi-k2.7-code", "kimi-k2.7-code-highspeed"],
     autoToolChoiceOnlyModels: ["kimi-k2.7-code", "kimi-k2.7-code-highspeed"],
-    preserveReasoningContentModels: ["glm-5.2", "kimi-k2.7-code", "kimi-k2.7-code-highspeed"],
+    // Issue #78: DeepSeek V4 thinking mode requires reasoning_content replay on tool-call turns.
+    preserveReasoningContentModels: ["glm-5.2", "kimi-k2.7-code", "kimi-k2.7-code-highspeed", ...DEEPSEEK_THINKING_MODELS],
   },
   {
     id: "neuralwatt",

package/src/server/auth-cors.ts

@@ -117,31 +117,34 @@ export function assertServerAuthConfig(config: OcxConfig): void {
   }
 }
 
-export function hasValidApiAuth(req: Request, config: OcxConfig): boolean {
-  if (!isApiAuthRequired(config)) return true;
-  const actual = req.headers.get("x-opencodex-api-key")?.trim()
-    || req.headers.get("authorization")?.replace(/^Bearer\s+/i, "").trim();
+/** Whether `token` is one of the proxy's own admission secrets (env token or config API keys). */
+export function isProxyAdmissionSecret(token: string, config: OcxConfig): boolean {
+  const actual = token.trim();
   if (!actual) return false;
+  const enc = new TextEncoder();
+  const actualBytes = enc.encode(actual);
   // Check env-based token
   const expected = configuredApiAuthToken(config);
   if (expected) {
-    const enc = new TextEncoder();
     const expectedBytes = enc.encode(expected);
-    const actualBytes = enc.encode(actual);
     if (expectedBytes.length === actualBytes.length && timingSafeEqual(actualBytes, expectedBytes)) return true;
   }
   // Check config-based API keys
-  if (config.apiKeys?.length) {
-    const enc = new TextEncoder();
-    const actualBytes = enc.encode(actual);
-    for (const k of config.apiKeys) {
-      const keyBytes = enc.encode(k.key);
-      if (keyBytes.length === actualBytes.length && timingSafeEqual(actualBytes, keyBytes)) return true;
-    }
+  for (const k of config.apiKeys ?? []) {
+    const keyBytes = enc.encode(k.key);
+    if (keyBytes.length === actualBytes.length && timingSafeEqual(actualBytes, keyBytes)) return true;
   }
   return false;
 }
 
+export function hasValidApiAuth(req: Request, config: OcxConfig): boolean {
+  if (!isApiAuthRequired(config)) return true;
+  const actual = req.headers.get("x-opencodex-api-key")?.trim()
+    || req.headers.get("authorization")?.replace(/^Bearer\s+/i, "").trim();
+  if (!actual) return false;
+  return isProxyAdmissionSecret(actual, config);
+}
+
 export function requireApiAuth(req: Request, config: OcxConfig, kind: "management" | "data-plane"): Response | null {
   if (hasValidApiAuth(req, config)) return null;
   if (kind === "management") return jsonResponse({ error: "opencodex API key required" }, 401);

package/src/server/images.ts

@@ -0,0 +1,218 @@
+/**
+ * /v1/images/{generations,edits} relay (issue #83).
+ *
+ * codex-rs's standalone image_gen extension executes CLIENT-SIDE: it POSTs
+ * `{base_url}/images/generations` (edits when reference images are attached) with the same
+ * ChatGPT bearer auth it uses for chat. Under Design B injection base_url IS this proxy, so
+ * without a route the tool died on the /v1/* JSON-404 guard. Only an OpenAI-family upstream
+ * can serve these endpoints — routed providers (Cursor, Kiro, Gemini, …) have no image
+ * generation surface — so the handler relays the body verbatim to the ChatGPT forward
+ * provider (or an OpenAI API-key provider) and passes the response through untouched:
+ * codex's images client parses `{created, data:[{b64_json}]}` strictly and Debug-prints
+ * error bodies into the model-visible failure, so upstream errors must stay legible.
+ */
+import { formatErrorResponse } from "../bridge";
+import {
+  CodexAccountCooldownError,
+  CodexAuthContextError,
+  CodexThreadAffinityExpiredError,
+  headersForCodexAuthContext,
+  isCodexAuthContextUsable,
+  resolveCodexAuthContext,
+} from "../codex/auth-context";
+import { formatCodexProviderForLog } from "../codex/routing";
+import { resolveEnvValue } from "../config";
+import { signalWithTimeout } from "../lib/abort";
+import { sidecarEnter } from "../lib/sidecar-tracker";
+import type { OcxConfig, OcxProviderConfig } from "../types";
+import { isProxyAdmissionSecret } from "./auth-cors";
+import { readJsonRequestBody } from "./request-decompress";
+import type { RequestLogContext } from "./request-log";
+import { codexLogAccountId, decodeRequestErrorResponse, sidecarOutcomeRecorder } from "./responses";
+
+export type ImagesEndpoint = "generations" | "edits";
+
+/** Image generation is slow (tens of seconds); bound a hung upstream, not a working one. */
+const IMAGES_UPSTREAM_TIMEOUT_MS = 300_000;
+
+/**
+ * Cap for the buffered upstream response body (100 MiB). Images responses are JSON documents
+ * containing base64-encoded images — typically a few MB. This prevents an oversized or malicious
+ * response from exhausting process memory.
+ */
+const IMAGES_RESPONSE_MAX_BYTES = 100 * 1024 * 1024;
+
+interface NamedProvider {
+  name: string;
+  provider: OcxProviderConfig;
+}
+
+interface ImagesUpstreamCandidates {
+  /** ChatGPT passthrough — the backend codex itself would have called absent the base_url override. */
+  forward?: NamedProvider;
+  /** Keyed openai-responses provider (e.g. api.openai.com), whose /v1/images/* is the platform Images API. */
+  keyed?: NamedProvider & { apiKey: string };
+}
+
+/**
+ * Collect the upstreams that can serve /images/*. The forward provider is preferred (same
+ * precedence as the vision/web-search sidecars) but only usable when the request actually
+ * carries relayable ChatGPT auth — startServer auto-upserts a `chatgpt` forward entry into
+ * every config, so its mere presence proves nothing about credentials.
+ */
+function findImagesUpstreams(config: OcxConfig): ImagesUpstreamCandidates {
+  const candidates: ImagesUpstreamCandidates = {};
+  for (const [name, provider] of Object.entries(config.providers)) {
+    if (provider.disabled === true) continue;
+    if (provider.authMode === "forward") {
+      candidates.forward ??= { name, provider };
+      continue;
+    }
+    if (candidates.keyed || provider.adapter !== "openai-responses" || provider.authMode === "oauth") continue;
+    const apiKey = resolveEnvValue(provider.apiKey);
+    if (apiKey) candidates.keyed = { name, provider, apiKey };
+  }
+  return candidates;
+}
+
+export async function handleImages(
+  req: Request,
+  config: OcxConfig,
+  endpoint: ImagesEndpoint,
+  logCtx: RequestLogContext,
+): Promise<Response> {
+  let body: unknown;
+  try {
+    body = await readJsonRequestBody(req);
+  } catch (err) {
+    return decodeRequestErrorResponse(err, "images");
+  }
+  const model = (body as { model?: unknown } | null)?.model;
+  if (typeof model === "string" && model) logCtx.model = model;
+
+  const candidates = findImagesUpstreams(config);
+  if (!candidates.forward && !candidates.keyed) {
+    // 400, not 5xx: codex retries every 5xx up to 5 total attempts, and this is a permanent
+    // configuration state that must surface on the first attempt.
+    return formatErrorResponse(
+      400,
+      "invalid_request_error",
+      "Built-in image generation needs an OpenAI upstream (ChatGPT login or an OpenAI API-key provider), "
+      + "but none is configured in opencodex. Routed providers cannot serve /v1/images/* — "
+      + "add an OpenAI provider or disable the tool with `codex features disable image_generation`.",
+    );
+  }
+
+  // Resolve forward auth first; failures are captured, not returned, so a configured keyed
+  // provider can still serve the request (e.g. every pool account cooling down must not
+  // 429 image_gen while api.openai.com sits idle).
+  let forwardAuthHeaders: Headers | undefined;
+  let forwardAuthError: Response | undefined;
+  let recordOutcome: ReturnType<typeof sidecarOutcomeRecorder>;
+  if (candidates.forward) {
+    try {
+      const authCtx = await resolveCodexAuthContext(req.headers, config);
+      if (!isCodexAuthContextUsable(authCtx, config)) {
+        forwardAuthError = formatErrorResponse(401, "authentication_error", "Selected Codex account needs reauthentication");
+      } else {
+        // Forwarded caller auth, overridden by the routed pool account's token when one is selected.
+        const authHeaders = headersForCodexAuthContext(req.headers, authCtx);
+        const bearer = authHeaders.get("authorization")?.replace(/^Bearer\s+/i, "") ?? "";
+        // A caller may authenticate to the proxy itself with `Authorization: Bearer <admission
+        // token>` (non-loopback binds); that secret must never be relayed to chatgpt.com.
+        if (bearer && isProxyAdmissionSecret(bearer, config)) authHeaders.delete("authorization");
+        // Only relay through the ChatGPT backend when there is a bearer to relay: startServer
+        // auto-upserts the `chatgpt` provider, so an unauthenticated request must not be bounced
+        // off chatgpt.com when a keyed OpenAI provider (or an honest error) serves it better.
+        if (authHeaders.get("authorization")) {
+          forwardAuthHeaders = authHeaders;
+          recordOutcome = sidecarOutcomeRecorder(config, authCtx);
+          logCtx.provider = formatCodexProviderForLog(candidates.forward.name, codexLogAccountId(authCtx), config);
+        }
+      }
+    } catch (err) {
+      if (err instanceof CodexAccountCooldownError) {
+        forwardAuthError = formatErrorResponse(429, "rate_limit_error", "Selected Codex account is cooling down");
+      } else if (err instanceof CodexThreadAffinityExpiredError) {
+        forwardAuthError = formatErrorResponse(409, "invalid_request_error", "Codex thread account affinity expired; start a new session");
+      } else if (err instanceof CodexAuthContextError) {
+        const safeAccountLabel = formatCodexProviderForLog(candidates.forward.name, err.accountId, config);
+        console.error(`[images] Pool account ${safeAccountLabel} token failed; reauthentication required`);
+        forwardAuthError = formatErrorResponse(401, "authentication_error", "Selected Codex account needs reauthentication");
+      } else {
+        throw err;
+      }
+    }
+  }
+
+  const headers: Record<string, string> = { "content-type": "application/json" };
+  let url: string;
+  if (forwardAuthHeaders && candidates.forward) {
+    const { provider } = candidates.forward;
+    if (provider.headers) Object.assign(headers, provider.headers);
+    for (const [name, value] of forwardAuthHeaders) headers[name] = value;
+    // The ChatGPT codex backend takes bare paths (matches the adapter's `${baseUrl}/responses`).
+    url = `${provider.baseUrl}/images/${endpoint}`;
+  } else if (candidates.keyed) {
+    const { provider, apiKey, name } = candidates.keyed;
+    if (provider.headers) Object.assign(headers, provider.headers);
+    headers["authorization"] = `Bearer ${apiKey}`;
+    logCtx.provider = name;
+    // Keyed providers tolerate baseUrl with or without /v1 (mirrors openai-responses.ts).
+    url = `${provider.baseUrl.replace(/\/v1\/?$/, "")}/v1/images/${endpoint}`;
+  } else if (forwardAuthError) {
+    return forwardAuthError;
+  } else {
+    return formatErrorResponse(
+      401,
+      "authentication_error",
+      "image generation relay needs ChatGPT auth (Authorization header) or an OpenAI API-key provider",
+    );
+  }
+
+  const timeoutMs = config.images?.timeoutMs ?? IMAGES_UPSTREAM_TIMEOUT_MS;
+  const linkedSignal = signalWithTimeout(timeoutMs, req.signal);
+  const sidecarExit = sidecarEnter("images");
+  try {
+    // Images POSTs create paid, non-idempotent work. One fetch only: no reset retry without a
+    // source-proven idempotency contract.
+    const upstreamResponse = await fetch(url, {
+      method: "POST",
+      headers,
+      body: JSON.stringify(body),
+      signal: linkedSignal.signal,
+    });
+    // Buffer rather than stream: the payload is one JSON document (base64 image, typically a few
+    // MB), and buffering keeps the timeout window covering the whole exchange. Cap the size to
+    // prevent an oversized response from exhausting process memory.
+    const payload = await upstreamResponse.arrayBuffer();
+    if (payload.byteLength > IMAGES_RESPONSE_MAX_BYTES) {
+      return formatErrorResponse(502, "upstream_error", `image ${endpoint} response too large (${payload.byteLength} bytes)`);
+    }
+    recordOutcome?.(upstreamResponse.status);
+    const relayHeaders: Record<string, string> = {};
+    const contentType = upstreamResponse.headers.get("content-type");
+    if (contentType) relayHeaders["content-type"] = contentType;
+    return new Response(payload, { status: upstreamResponse.status, headers: relayHeaders });
+  } catch (err) {
+    // Client cancel first: it aborts the linked signal too, and must not be logged as an
+    // upstream failure (499 maps to client_closed_request in the request log).
+    if (req.signal.aborted) {
+      return formatErrorResponse(499, "client_closed_request", `image ${endpoint} request canceled by client`);
+    }
+    if (err instanceof Error && err.name === "TimeoutError") {
+      recordOutcome?.("timeout");
+      // codex retries 5xx up to 4 more times; a retried 504 is acceptable for a transient hang.
+      return formatErrorResponse(504, "upstream_error", `image ${endpoint} upstream timed out`);
+    }
+    recordOutcome?.("connect_error");
+    return formatErrorResponse(
+      502,
+      "upstream_error",
+      `image ${endpoint} relay failed: ${err instanceof Error ? err.message : String(err)}`,
+    );
+  } finally {
+    sidecarExit();
+    linkedSignal.cleanup();
+  }
+}

package/src/server/index.ts

@@ -59,6 +59,7 @@ export {
 } from "./lifecycle";
 import {
   addFinalRequestLog,
+  httpStatusForRequestLogTerminal,
   httpStatusForTerminalStatus,
   inspectResponseLogSsePayload,
   nextRequestLogId,
@@ -116,6 +117,7 @@ export {
 } from "./auth-cors";
 import { disableResponsesRequestTimeout, handleResponses, handleResponsesCompact } from "./responses";
 export { disableResponsesRequestTimeout, linkAbortSignal } from "./responses";
+import { handleImages } from "./images";
 import { fetchAllModels, handleManagementAPI, VERSION } from "./management-api";
 
 const MAX_WS_FRAME_BYTES = 50 * 1024 * 1024;
@@ -304,6 +306,31 @@ export function startServer(port?: number) {
         return withCors(await handleResponsesCompact(req, config), req, config);
       }
 
+      if (
+        req.method === "POST"
+        && (url.pathname === "/v1/images/generations" || url.pathname === "/v1/images/edits")
+      ) {
+        disableResponsesRequestTimeout(req, requestServer);
+        if (isDraining()) {
+          return new Response("Service shutting down", {
+            status: 503,
+            headers: { ...corsHeaders(req, config), "Retry-After": "5" },
+          });
+        }
+        const apiAuthError = requireApiAuth(req, config, "data-plane");
+        if (apiAuthError) return withCors(apiAuthError, req, config);
+        if (!isAllowedRequestOrigin(req, config)) {
+          return withCors(formatErrorResponse(403, "origin_rejected", "cross-origin data-plane request blocked"), req, config);
+        }
+        const start = Date.now();
+        const requestId = nextRequestLogId(start);
+        const logCtx: RequestLogContext = { model: "image_gen", provider: "unknown" };
+        const endpoint = url.pathname.endsWith("/edits") ? "edits" as const : "generations" as const;
+        const response = await handleImages(req, config, endpoint, logCtx);
+        addFinalRequestLog(requestId, start, logCtx, response.status, response.status === 499 ? { closeReason: "client_cancel" } : undefined);
+        return withCors(response, req, config);
+      }
+
       if (url.pathname === "/v1/responses" && req.method === "POST") {
         disableResponsesRequestTimeout(req, requestServer);
         if (isDraining()) {
@@ -343,7 +370,7 @@ export function startServer(port?: number) {
 
       // Data-plane guard: unknown /v1/* paths must fail with JSON 404, never fall through to the
       // GUI static handler (extensionless paths would get index.html with HTTP 200 and codex-rs
-      // endpoint clients — alpha/search, images/*, memories/*, realtime/* — would surface confusing
+      // endpoint clients — alpha/search, memories/*, realtime/* — would surface confusing
       // serde decode errors instead of a clean not-found).
       if (url.pathname.startsWith("/v1/")) {
         return withCors(formatErrorResponse(404, "not_found", `Unknown endpoint: ${req.method} ${url.pathname}`), req, config);
@@ -485,7 +512,7 @@ export function startServer(port?: number) {
               onSsePayload: payload => inspectResponseLogSsePayload(logCtx, payload),
               onTerminal: status => {
                 terminalRecorder?.(status);
-                finalizeLog(httpStatusForTerminalStatus(status), {
+                finalizeLog(httpStatusForRequestLogTerminal(status, logCtx), {
                   terminalStatus: status,
                   closeReason: "terminal",
                 });

package/src/server/responses.ts

@@ -374,7 +374,7 @@ export function codexForwardTerminalOutcomeRecorder(
  * zstd-compressed screenshot history exceeds the limit), or a genuine JSON syntax error (400). The
  * real decode error was previously swallowed, so log it before returning the generic 400.
  */
-function decodeRequestErrorResponse(err: unknown, label: string): Response {
+export function decodeRequestErrorResponse(err: unknown, label: string): Response {
   if (err instanceof UnsupportedContentEncodingError) {
     return formatErrorResponse(415, "invalid_request_error", err.message);
   }
@@ -810,6 +810,7 @@ export async function handleResponses(
       abortSignal: options.abortSignal,
       recordSidecarOutcome,
       connectTimeoutMs: config.connectTimeoutMs ?? 200_000,
+      routedModelStallTimeoutMs: wsPlan.routedModelStallTimeoutMs,
       stallTimeoutSec: wsPlan.stallTimeoutSec,
       on429: retryAfter => {
         const rotated = rotateKeyOn429(config, route.providerName, retryAfter, Date.now(), route.provider.apiKey);

package/src/types.ts

@@ -312,6 +312,8 @@ export interface OcxConfig {
   webSearchSidecar?: OcxWebSearchSidecarConfig;
   /** Vision sidecar: describe images via a gpt vision model so text-only models can "see" them. */
   visionSidecar?: OcxVisionSidecarConfig;
+  /** /v1/images relay for codex's built-in image_gen tool. */
+  images?: OcxImagesConfig;
   /** Codex multi-account pool. */
   codexAccounts?: CodexAccount[];
   /** Active pool account id for next session. undefined = main (passthrough as-is). */
@@ -357,6 +359,11 @@ export interface OcxTokenGuardianConfig {
   codexWarmupModel?: string;
 }
 
+export interface OcxImagesConfig {
+  /** Upstream timeout (ms) for one /v1/images relay. Default 300000 — generation is slow. */
+  timeoutMs?: number;
+}
+
 export interface OcxVisionSidecarConfig {
   /** Master switch. Default: enabled when a forward (ChatGPT) provider exists and the caller is logged in. */
   enabled?: boolean;
@@ -377,6 +384,11 @@ export interface OcxWebSearchSidecarConfig {
   maxSearchesPerTurn?: number;
   /** Sidecar fetch timeout (ms). */
   timeoutMs?: number;
+  /**
+   * Config-file-only deadline (ms) for continuous routed-model response-body raw-byte inactivity
+   * during a web-search turn. Default 200000. Must be an integer from 1 through 2147483647.
+   */
+  routedModelStallTimeoutMs?: number;
 }
 
 export interface OcxProviderConfig {