@bitkyc08/opencodex 2.7.40 → 2.7.41

package/src/adapters/openai-chat.ts

@@ -2,6 +2,9 @@ import type { ProviderAdapter } from "./base";
 import type { AdapterEvent, OcxAssistantMessage, OcxContentPart, OcxMessage, OcxParsedRequest, OcxProviderConfig, OcxTextContent, OcxThinkingContent, OcxToolCall, OcxUsage } from "../types";
 import { isAllowedToolChoice, modelInList, namespacedToolName, resolveToolChoiceWireName, toolAllowedByChoice } from "../types";
 import { mapReasoningEffort, modelRecordValue } from "../reasoning-effort";
+import { debugProviderDiagnostic } from "../lib/debug";
+import { isDebugEnabled } from "../lib/debug-settings";
+import { isCyberPolicyCode } from "../lib/errors";
 import { redactSecretString } from "../lib/redact";
 import { contentPartsToText } from "./image";
 import { neutralizeIdentity } from "./identity";
@@ -522,6 +525,7 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
         messages,
         stream: parsed.stream,
       };
+      if (modelInList(provider.reasoningSplitModels, parsed.modelId)) body.reasoning_split = true;
       const maxTokens = resolveMaxTokens(provider, parsed);
       const openRouterRouting = resolveOpenRouterRouting(provider, parsed.modelId);
       if (openRouterRouting) body.provider = openRouterProviderPayload(openRouterRouting);
@@ -545,9 +549,10 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
           const budget = thinkingBudgetForEffort(parsed, reasoningEffort, maxTokens);
           if (budget !== undefined) body.thinking_budget = budget;
         } else if (modelInList(provider.thinkingToggleModels, parsed.modelId)) {
-          // Vendor thinking-toggle wire (MiMo v2.x, GLM 5/5.1): the mapped value is the toggle
-          // state, sent as `thinking: {type}` — these models ignore/reject reasoning_effort.
-          if (reasoningEffort === "enabled" || reasoningEffort === "disabled") {
+          // Vendor thinking-toggle wire: the mapped value is sent as `thinking: {type}` because
+          // these models ignore/reject reasoning_effort. Most use enabled/disabled; MiniMax-M3
+          // uses adaptive/disabled.
+          if (reasoningEffort === "enabled" || reasoningEffort === "disabled" || reasoningEffort === "adaptive") {
             body.thinking = { type: reasoningEffort };
           }
         } else {
@@ -588,7 +593,24 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
       if (hasCredential) headers["Authorization"] = `Bearer ${provider.apiKey}`;
       if (provider.headers) Object.assign(headers, provider.headers);
 
-      return { url, method: "POST", headers, body: JSON.stringify(body) };
+      const bodyJson = JSON.stringify(body);
+      // Never log pathname/query — tenant-scoped hosts (e.g. Cloudflare
+      // /accounts/<account_id>/ai/v1) would otherwise leak account identifiers (#452).
+      if (isDebugEnabled()) {
+        let host = "upstream";
+        try { host = new URL(url).host; } catch { /* keep fallback */ }
+        debugProviderDiagnostic("openai-chat", "request", {
+          host,
+          model: body.model,
+          stream: parsed.stream,
+          messageCount: Array.isArray(messages) ? messages.length : 0,
+          toolCount: Array.isArray(tools) ? tools.length : 0,
+          hasCredential,
+          bodyBytes: new TextEncoder().encode(bodyJson).length,
+        });
+      }
+
+      return { url, method: "POST", headers, body: bodyJson };
     },
 
     async *parseStream(response: Response): AsyncGenerator<AdapterEvent> {
@@ -657,9 +679,21 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
         // instead of a clean [DONE]. Surface it as a terminal error so the bridge emits a
         // classified response.failed (bridge case "error") — never a truncated completion.
         if (chunk.error) {
-          const err = chunk.error as { message?: string } | undefined;
+          const err = chunk.error as { message?: string; code?: string; type?: string; status?: number } | undefined;
+          const message = err?.message ?? "upstream error";
+          debugProviderDiagnostic("openai-chat", "stream-error", { message });
           yield* flushToolCalls();
-          yield { type: "error", message: err?.message ?? "upstream error" };
+          yield {
+            type: "error",
+            message,
+            ...(typeof err?.code === "string" ? { code: err.code } : {}),
+            ...(typeof err?.type === "string" ? { errorType: err.type } : {}),
+            ...(isCyberPolicyCode(err?.code)
+              ? { status: 400 }
+              : typeof err?.status === "number" && Number.isInteger(err.status)
+                ? { status: err.status }
+                : {}),
+          };
           return "terminate";
         }
 
@@ -679,13 +713,12 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
         }
         const delta = choices[0].delta;
         if (delta) {
-          if (typeof delta.content === "string" && delta.content.length > 0) {
-            yield { type: "text_delta", text: delta.content };
-          }
-
           if (typeof delta.reasoning_content === "string" && delta.reasoning_content.length > 0) {
             yield { type: "reasoning_raw_delta", text: delta.reasoning_content };
           }
+          if (typeof delta.content === "string" && delta.content.length > 0) {
+            yield { type: "text_delta", text: delta.content };
+          }
 
           const toolCalls = delta.tool_calls as { index?: number; id?: string; function?: { name?: string; arguments?: string } }[] | undefined;
           if (toolCalls) {
@@ -748,6 +781,10 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
         // closed so the bridge emits a classified response.failed rather than a silent truncation.
         const sawFinish = finishReason !== undefined;
         if (!sawFinish && pendingUsage === undefined) {
+          debugProviderDiagnostic("openai-chat", "stream-truncated", {
+            finishReason: finishReason ?? null,
+            hadUsage: false,
+          });
           yield { type: "error", message: "upstream stream ended without a terminal signal ([DONE] or finish_reason) — possible truncation" };
           return;
         }
@@ -766,10 +803,21 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
     async parseResponse(response: Response): Promise<AdapterEvent[]> {
       const json = await response.json() as Record<string, unknown>;
       if (json.error) {
-        const upstreamError = json.error as { message?: unknown };
+        const upstreamError = json.error as { message?: unknown; code?: unknown; type?: unknown; status?: unknown };
+        const message = typeof upstreamError.message === "string" ? upstreamError.message : "upstream error";
+        const code = typeof upstreamError.code === "string" ? upstreamError.code : undefined;
+        const errorType = typeof upstreamError.type === "string" ? upstreamError.type : undefined;
+        const status = isCyberPolicyCode(code)
+          ? 400
+          : typeof upstreamError.status === "number" && Number.isInteger(upstreamError.status)
+            ? upstreamError.status
+            : undefined;
         return [{
           type: "error",
-          message: typeof upstreamError.message === "string" ? upstreamError.message : "upstream error",
+          message,
+          ...(code !== undefined ? { code } : {}),
+          ...(errorType !== undefined ? { errorType } : {}),
+          ...(status !== undefined ? { status } : {}),
         }];
       }
 
@@ -780,12 +828,12 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
       }
 
       const msg = choices[0].message;
-      if (typeof msg.content === "string") {
-        events.push({ type: "text_delta", text: msg.content });
-      }
       if (typeof msg.reasoning_content === "string" && msg.reasoning_content.length > 0) {
         events.push({ type: "reasoning_raw_delta", text: msg.reasoning_content });
       }
+      if (typeof msg.content === "string") {
+        events.push({ type: "text_delta", text: msg.content });
+      }
       const toolCalls = msg.tool_calls as { id: string; function: { name: string; arguments: string } }[] | undefined;
       if (toolCalls) {
         for (const tc of toolCalls) {

package/src/adapters/openai-responses.ts

@@ -461,6 +461,23 @@ function stripPreviousResponseId(body: unknown, strip: boolean): unknown {
   return rest;
 }
 
+/**
+ * Remove top-level parameters the ChatGPT backend (`authMode: "forward"`) rejects
+ * with `{"detail":"Unsupported parameter: …"}` (strict allowlist). Codex CLI never
+ * sends these — it controls output length via `reasoning.effort` — but third-party
+ * Responses API clients (GJC, SDK wrappers) include `max_output_tokens` per the
+ * public spec. `metadata` is likewise absent from the allowlist. No-op when the
+ * body carries neither field, keeping the common Codex path allocation-free.
+ */
+function stripUnsupportedForwardParams(body: unknown): unknown {
+  if (!isPlainObject(body)) return body;
+  const hasMot = Object.prototype.hasOwnProperty.call(body, "max_output_tokens");
+  const hasMeta = Object.prototype.hasOwnProperty.call(body, "metadata");
+  if (!hasMot && !hasMeta) return body;
+  const { max_output_tokens: _mot, metadata: _meta, ...rest } = body;
+  return rest;
+}
+
 /**
  * Hosted tool types whose server-side function names collide with the client tools Codex
  * declares for the matching app skill. Codex sends BOTH (e.g. hosted `image_generation` plus a
@@ -644,6 +661,7 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
       );
       if (forward) {
         outBody = repairOrphanedInputItems(outBody, unexpandedMiss);
+        outBody = stripUnsupportedForwardParams(outBody);
       }
       else outBody = stripConflictingHostedTools(outBody);
       if (forward || parsed._previousResponseInputExpanded === true) {

package/src/bridge.ts

@@ -1,5 +1,5 @@
 import type { AdapterEvent, OcxMessagePhase, OcxProviderContinuationState, OcxUsage } from "./types";
-import { adapterFailureFromMessage, classifyError, type OcxErrorPayload } from "./lib/errors";
+import { adapterFailureFromMessage, classifyError, CYBER_POLICY_ERROR_CODE, isCyberPolicyCode, type OcxErrorPayload } from "./lib/errors";
 import { encodeCompactionSummary } from "./responses/compaction";
 import { encodeReasoningEnvelope, type ReasoningEnvelope } from "./responses/reasoning-envelope";
 import { resolveStallTimeoutSec } from "./stall-timeout";
@@ -14,28 +14,48 @@ function sseEvent(name: string, data: Record<string, unknown>): string {
 }
 
 function responsesUsage(usage: OcxUsage | undefined): Record<string, unknown> {
-  if (!usage) return { input_tokens: 0, output_tokens: 0, total_tokens: 0 };
-  // inputTokens is already inclusive of cache read/write (types.ts convention).
-  const inputTokens = usage.inputTokens;
+  // input_tokens_details / output_tokens_details are ALWAYS emitted (zero defaults):
+  // strict Responses clients deserialize them as required fields — grok-build's pinned
+  // async-openai fork (rev 95b52ebd, response_usage.rs) has non-Option InputTokenDetails/
+  // OutputTokenDetails, so omitting them turns a successful turn into a hard exit after
+  // response.completed ("missing field `input_tokens_details`", verified live 2026-07-23).
+  if (!usage) {
+    return {
+      input_tokens: 0,
+      output_tokens: 0,
+      total_tokens: 0,
+      input_tokens_details: { cached_tokens: 0 },
+      output_tokens_details: { reasoning_tokens: 0 },
+    };
+  }
+  // inputTokens is already inclusive of cache read/write (types.ts convention). Stateful
+  // providers may report an absolute active-context checkpoint separately from their
+  // per-attempt usage. Split that checkpoint into input + output without adding output twice.
+  const inputTokens = usage.contextTotalTokens !== undefined
+    ? Math.max(0, usage.contextTotalTokens - usage.outputTokens)
+    : usage.inputTokens;
   const out: Record<string, unknown> = {
     input_tokens: inputTokens,
     output_tokens: usage.outputTokens,
-    total_tokens: usageDisplayTotalTokens(usage) ?? inputTokens + usage.outputTokens,
+    total_tokens: usage.contextTotalTokens !== undefined
+      ? usage.contextTotalTokens
+      : usageDisplayTotalTokens(usage) ?? inputTokens + usage.outputTokens,
+  };
+  // cached_tokens carries cache READS only, matching OpenAI semantics, and is always present
+  // (zero default) for strict clients. Clamp to inputTokens so a provider's absolute
+  // checkpoint can never report more cache reads than input.
+  const inputDetails: Record<string, number> = {
+    cached_tokens: Math.min(usage.cachedInputTokens ?? 0, inputTokens),
   };
-  const inputDetails: Record<string, number> = {};
-  if (usage.cachedInputTokens !== undefined) {
-    // cached_tokens carries cache READS only, matching OpenAI semantics.
-    inputDetails.cached_tokens = usage.cachedInputTokens;
-  }
   if (usage.cacheCreationInputTokens !== undefined) {
-    inputDetails.cache_write_tokens = usage.cacheCreationInputTokens;
-  }
-  if (Object.keys(inputDetails).length > 0) {
-    out.input_tokens_details = inputDetails;
-  }
-  if (usage.reasoningOutputTokens !== undefined) {
-    out.output_tokens_details = { reasoning_tokens: usage.reasoningOutputTokens };
+    const cacheRead = inputDetails.cached_tokens ?? 0;
+    inputDetails.cache_write_tokens = Math.min(
+      usage.cacheCreationInputTokens,
+      Math.max(0, inputTokens - cacheRead),
+    );
   }
+  out.input_tokens_details = inputDetails;
+  out.output_tokens_details = { reasoning_tokens: usage.reasoningOutputTokens ?? 0 };
   return out;
 }
 
@@ -48,10 +68,16 @@ function adapterFailureFromEvent(event: Extract<AdapterEvent, { type: "error" }>
     return adapterFailureFromMessage(event.message);
   }
   const fallback = adapterFailureFromMessage(event.message);
-  const httpStatus = event.status ?? fallback.httpStatus;
+  let httpStatus = event.status ?? fallback.httpStatus;
   const error = classifyError(httpStatus, event.errorType ?? fallback.error.type, event.message);
   if (event.errorType !== undefined) error.type = event.errorType;
   if (event.code !== undefined) error.code = event.code;
+  // Codex maps cyber_policy on HTTP 400 (body) or mid-stream code; never leave it as 502.
+  if (isCyberPolicyCode(error.code) || isCyberPolicyCode(event.code)) {
+    error.code = CYBER_POLICY_ERROR_CODE;
+    error.type = "invalid_request_error";
+    httpStatus = 400;
+  }
   return { httpStatus, error };
 }
 
@@ -98,6 +124,15 @@ export function bridgeToResponsesSSE(
     onFirstOutput?: () => void;
     onTerminal?: (status: ResponsesTerminalStatus) => void;
     onCompletedResponse?: (response: Record<string, unknown>, providerState?: OcxProviderContinuationState) => void;
+    /**
+     * Raw adapter-reported usage at the terminal event, BEFORE wire normalization.
+     * responsesUsage() always emits token-detail objects with zero defaults for strict
+     * clients (grok-build), which makes the wire unusable as a provenance source: the
+     * request log must not read synthetic zeros as measured cache/reasoning numbers
+     * (cache_detail_missing would be silently suppressed). Callers set logCtx.usage
+     * from this callback instead of re-parsing the bridged SSE.
+     */
+    onUsage?: (usage: OcxUsage | undefined) => void;
   },
 ): ReadableStream<Uint8Array> {
   // Freeform/custom tools (apply_patch) carry their body in `input`; the model is given a
@@ -672,11 +707,13 @@ export function bridgeToResponsesSSE(
                 // Cache max-output partials so previous_response_id replay can continue them;
                 // rememberResponseState rejects content-filtered incomplete responses.
                 options?.onCompletedResponse?.(response, event.providerState);
+                options?.onUsage?.(event.usage);
                 emit("response.incomplete", { response });
                 reportTerminal("incomplete");
               } else {
                 const response = { ...responseSnapshot("completed", finishedItems, event.endTurn), usage: responsesUsage(event.usage) };
                 options?.onCompletedResponse?.(response, event.providerState);
+                options?.onUsage?.(event.usage);
                 emit("response.completed", {
                   response,
                 });
@@ -693,6 +730,7 @@ export function bridgeToResponsesSSE(
               if (currentToolCall) closeCurrentToolCall();
               if (currentWebSearch) closeCurrentWebSearch("failed", []);
               flushHiddenReasoningEnvelope();
+              options?.onUsage?.(event.usage);
               emit("response.incomplete", {
                 response: {
                   ...responseSnapshot("incomplete", finishedItems, event.endTurn),
@@ -716,6 +754,7 @@ export function bridgeToResponsesSSE(
               if (currentToolCall) closeCurrentToolCall();
               if (currentWebSearch) closeCurrentWebSearch("failed", []);
               const failure = adapterFailureFromEvent(event);
+              if (event.usage) options?.onUsage?.(event.usage);
               emit("response.failed", {
                 response: {
                   ...responseSnapshot("failed", finishedItems),
@@ -773,6 +812,7 @@ export function bridgeToResponsesSSE(
         flushHiddenRawReasoning();
         if (currentToolCall) closeCurrentToolCall();
         if (currentWebSearch) closeCurrentWebSearch("failed", []);
+        options?.onUsage?.(undefined);
         emit("response.incomplete", {
           response: {
             ...responseSnapshot("incomplete", finishedItems),
@@ -867,6 +907,8 @@ export function buildResponseJSON(
     /** Remote compaction v2 turn — append one synthetic compaction output item (see bridgeToResponsesSSE). */
     compaction?: boolean;
     onProviderState?: (state: OcxProviderContinuationState) => void;
+    /** Raw adapter-reported usage before wire normalization (see bridgeToResponsesSSE onUsage). */
+    onUsage?: (usage: OcxUsage | undefined) => void;
   },
 ): Record<string, unknown> {
   const responseId = `resp_${uuid()}`;
@@ -1091,6 +1133,7 @@ export function buildResponseJSON(
     : incompleteEvent || stopReason === "max_tokens"
       ? "incomplete"
       : "completed";
+  options?.onUsage?.(incompleteEvent?.usage ?? usage);
   return {
     id: responseId, object: "response",
     created_at: Math.floor(Date.now() / 1000),
@@ -1112,8 +1155,20 @@ export function buildResponseJSON(
   };
 }
 
-export function formatErrorResponse(status: number, type: string, message: string): Response {
-  return new Response(JSON.stringify({ error: classifyError(status, type, message) }), {
-    status, headers: { "Content-Type": "application/json" },
+export function formatErrorResponse(
+  status: number,
+  type: string,
+  message: string,
+  options?: { code?: string | null },
+): Response {
+  const error = classifyError(status, type, message);
+  if (isCyberPolicyCode(options?.code)) {
+    error.code = CYBER_POLICY_ERROR_CODE;
+    error.type = "invalid_request_error";
+  }
+  const finalStatus = error.code === CYBER_POLICY_ERROR_CODE ? 400 : status;
+  return new Response(JSON.stringify({ error }), {
+    status: finalStatus,
+    headers: { "Content-Type": "application/json" },
   });
 }

package/src/chat/outbound.ts

@@ -8,6 +8,7 @@
 type Rec = Record<string, unknown>;
 
 import { decodeServerSentEvents } from "../lib/sse-decoder";
+import { classifyError, CYBER_POLICY_ERROR_CODE, isCyberPolicyCode, isCyberPolicyMessage } from "../lib/errors";
 
 function isRec(v: unknown): v is Rec {
   return !!v && typeof v === "object" && !Array.isArray(v);
@@ -27,39 +28,64 @@ export function chatCompletionsUsage(usage: unknown): Rec {
   const details = isRec(u.input_tokens_details) ? u.input_tokens_details : {};
   const prompt = typeof u.input_tokens === "number" ? u.input_tokens : 0;
   const completion = typeof u.output_tokens === "number" ? u.output_tokens : 0;
-  const cached = typeof details.cached_tokens === "number" ? details.cached_tokens : undefined;
+  const cached = typeof details.cached_tokens === "number" ? details.cached_tokens : 0;
   const out: Rec = {
     prompt_tokens: prompt,
     completion_tokens: completion,
     total_tokens: prompt + completion,
   };
-  if (cached !== undefined) {
-    out.prompt_tokens_details = { cached_tokens: cached };
-  }
+  // Detail objects are always emitted (zero defaults) so strict OpenAI-compatible
+  // clients that require them (see responsesUsage in src/bridge.ts) never fail on
+  // routed providers that report no cache/reasoning numbers.
+  out.prompt_tokens_details = { cached_tokens: cached };
   const outDetails = isRec(u.output_tokens_details) ? u.output_tokens_details : {};
-  if (typeof outDetails.reasoning_tokens === "number") {
-    out.completion_tokens_details = { reasoning_tokens: outDetails.reasoning_tokens };
-  }
+  const reasoning = typeof outDetails.reasoning_tokens === "number" ? outDetails.reasoning_tokens : 0;
+  out.completion_tokens_details = { reasoning_tokens: reasoning };
   return out;
 }
 
-export function chatCompletionsErrorBody(status: number, message: string, type = "invalid_request_error"): Rec {
+export function chatCompletionsErrorBody(
+  status: number,
+  message: string,
+  type = "invalid_request_error",
+  code?: string | null,
+): Rec {
+  if (isCyberPolicyCode(code) || isCyberPolicyMessage(message)) {
+    return {
+      error: {
+        message,
+        type: "invalid_request_error",
+        param: null,
+        code: CYBER_POLICY_ERROR_CODE,
+      },
+    };
+  }
   return {
     error: {
       message,
       type,
       param: null,
-      code: status === 401 ? "invalid_api_key"
-        : status === 404 ? "model_not_found"
-        : status === 429 ? "rate_limit_exceeded"
-        : null,
+      code: code !== undefined
+        ? code
+        : status === 401 ? "invalid_api_key"
+          : status === 404 ? "model_not_found"
+          : status === 429 ? "rate_limit_exceeded"
+          : null,
     },
   };
 }
 
-export function chatCompletionsErrorResponse(status: number, message: string, type?: string): Response {
-  return new Response(JSON.stringify(chatCompletionsErrorBody(status, message, type)), {
-    status,
+export function chatCompletionsErrorResponse(
+  status: number,
+  message: string,
+  type?: string,
+  code?: string | null,
+): Response {
+  const body = chatCompletionsErrorBody(status, message, type, code);
+  const err = body.error as { code?: string | null };
+  const finalStatus = err.code === CYBER_POLICY_ERROR_CODE ? 400 : status;
+  return new Response(JSON.stringify(body), {
+    status: finalStatus,
     headers: { "Content-Type": "application/json" },
   });
 }
@@ -85,6 +111,7 @@ export function isChatCompletionsStreamError(err: unknown): err is ChatCompletio
 
 function streamErrorStatus(message: string): number {
   const lower = message.toLowerCase();
+  if (isCyberPolicyMessage(lower)) return 400;
   if (lower.includes("truncated")) return 502;
   if (lower.includes("rate") || lower.includes("429")) return 429;
   if (lower.includes("unauthor") || lower.includes("401") || lower.includes("api key")) return 401;
@@ -93,13 +120,6 @@ function streamErrorStatus(message: string): number {
   return 502;
 }
 
-function streamErrorType(status: number): string {
-  if (status === 401) return "authentication_error";
-  if (status === 429) return "rate_limit_error";
-  if (status >= 500) return "server_error";
-  return "invalid_request_error";
-}
-
 function dataFrame(payload: Rec | "[DONE]"): string {
   if (payload === "[DONE]") return "data: [DONE]\n\n";
   return `data: ${JSON.stringify(payload)}\n\n`;
@@ -220,7 +240,7 @@ export function responsesSseToChatCompletionsSse(
         emit(frame);
         emit("[DONE]");
       };
-      const fail = (message: string) => {
+      const fail = (message: string, details?: { code?: string | null; type?: string; status?: number }) => {
         if (terminated) return;
         terminated = true;
         failed = true;
@@ -229,18 +249,21 @@ export function responsesSseToChatCompletionsSse(
         // Deliver the error frame then close the stream abnormally (no [DONE]).
         // Do not controller.error() — that can drop already-enqueued bytes from consumers
         // like response.text().
-        const status = streamErrorStatus(message);
-        const type = streamErrorType(status);
+        const statusHint = details?.status ?? streamErrorStatus(message);
+        const classified = classifyError(statusHint, details?.type ?? "upstream_error", message);
+        if (isCyberPolicyCode(details?.code) || classified.code === CYBER_POLICY_ERROR_CODE) {
+          classified.code = CYBER_POLICY_ERROR_CODE;
+          classified.type = "invalid_request_error";
+        } else if (details?.code !== undefined && details.code !== null && !classified.code) {
+          classified.code = details.code;
+        }
         try {
           controller.enqueue(encoder.encode(dataFrame({
             error: {
-              message,
-              type,
+              message: classified.message,
+              type: classified.type,
               param: null,
-              code: status === 401 ? "invalid_api_key"
-                : status === 404 ? "model_not_found"
-                : status === 429 ? "rate_limit_exceeded"
-                : null,
+              code: classified.code,
             },
           })));
           emittedFrames++;
@@ -373,7 +396,13 @@ export function responsesSseToChatCompletionsSse(
             const response = isRec(data.response) ? data.response : {};
             const error = isRec(response.error) ? response.error : {};
             const message = typeof error.message === "string" ? error.message : "upstream request failed";
-            fail(message);
+            const code = typeof error.code === "string" ? error.code : null;
+            const type = typeof error.type === "string" ? error.type : undefined;
+            fail(message, {
+              code,
+              type,
+              ...(code === CYBER_POLICY_ERROR_CODE ? { status: 400 } : {}),
+            });
             break;
           }
           default:
@@ -555,8 +584,11 @@ export async function collectChatCompletion(
               ? parsed.error.message
               : "upstream request failed";
             const type = typeof parsed.error.type === "string" ? parsed.error.type : "server_error";
-            const status = streamErrorStatus(message);
-            streamError = new ChatCompletionsStreamError(message, { status, type });
+            const code = typeof parsed.error.code === "string" ? parsed.error.code : null;
+            const status = code === CYBER_POLICY_ERROR_CODE || isCyberPolicyMessage(message)
+              ? 400
+              : streamErrorStatus(message);
+            streamError = new ChatCompletionsStreamError(message, { status, type, code });
             continue;
           }
           if (parsed.usage) usage = parsed.usage;