@bitkyc08/opencodex 2.76.0 → 2.77.0

package/src/server/management/route-registry.ts

@@ -147,7 +147,6 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "GET", path: "/api/injection-model", module: "server/management/agent-settings-routes", mutates: false },
   { method: "POST", path: "/api/injection-model/suggest", module: "server/management/agent-settings-routes", mutates: false },
   { method: "GET", path: "/api/subagent-model-fallback", module: "server/management/agent-settings-routes", mutates: false },
-  { method: "GET", path: "/api/subagent-models", module: "server/management/agent-settings-routes", mutates: false },
   { method: "GET", path: "/api/v2", module: "server/management/agent-settings-routes", mutates: false },
   { method: "POST", path: "/api/claude-desktop/apply", module: "server/management/agent-settings-routes", mutates: true },
   { method: "POST", path: "/api/grok/apply", module: "server/management/agent-settings-routes", mutates: true },
@@ -169,8 +168,10 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "PUT", path: "/api/grok/selection", module: "server/management/agent-settings-routes", mutates: true },
   { method: "PUT", path: "/api/injection-model", module: "server/management/agent-settings-routes", mutates: true },
   { method: "PUT", path: "/api/subagent-model-fallback", module: "server/management/agent-settings-routes", mutates: true },
-  { method: "PUT", path: "/api/subagent-models", module: "server/management/agent-settings-routes", mutates: true },
   { method: "PUT", path: "/api/v2", module: "server/management/agent-settings-routes", mutates: true },
+  // server/management/subagent-model-routes
+  { method: "GET", path: "/api/subagent-models", module: "server/management/subagent-model-routes", mutates: false },
+  { method: "PUT", path: "/api/subagent-models", module: "server/management/subagent-model-routes", mutates: true },
   // server/management/codex-agent-role-routes
   { method: "GET", path: "/api/codex-agent-roles", module: "server/management/codex-agent-role-routes", mutates: false },
   { method: "POST", path: "/api/codex-agent-roles/auto-assign", module: "server/management/codex-agent-role-routes", mutates: false, mechanism: "path-constant" },
@@ -388,7 +389,7 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "GET", path: "/api/link/candidates", module: "server/management/link-routes", mutates: false, exempt: { reason: "session-only", why: "SSH candidates are a dashboard surface: a paired session, or on a standalone runtime the current loopback dashboard session on trusted loopback ingress; admin-token and Tailscale identity sessions are refused." } },
   { method: "POST", path: "/api/link/probe", module: "server/management/link-routes", mutates: true, exempt: { reason: "session-only", why: "SSH probing and host-key presentation are part of the interactive dashboard consent flow (paired, or standalone loopback dashboard on trusted loopback ingress)." } },
   { method: "POST", path: "/api/link/confirm-host", module: "server/management/link-routes", mutates: true, exempt: { reason: "session-only", why: "Persisting a host key requires the dashboard session that saw the fingerprint (paired, or standalone loopback dashboard on trusted loopback ingress)." } },
-  { method: "POST", path: "/api/link/join", module: "server/management/link-routes", mutates: true, exempt: { reason: "session-only", why: "Joining a confirmed Home issues a link credential and restarts this standalone runtime as a client on its configured port, which briefly interrupts running Codex turns. It is the dashboard's turn-on flow with a pre-join notice (paired, or standalone loopback dashboard on trusted loopback ingress); admin-token and Tailscale identity sessions are refused." } },
+  { method: "POST", path: "/api/link/join", module: "server/management/link-routes", mutates: true, exempt: { reason: "session-only", why: "Joining a confirmed Home issues a link credential and restarts this standalone runtime as a client on its configured port, which briefly interrupts running Codex turns. It requires an operator-paired dashboard session and a pre-join notice; unpaired standalone loopback, admin-token and Tailscale identity sessions are refused." } },
   { method: "POST", path: "/api/link/apply", module: "server/management/link-routes", mutates: true, exempt: { reason: "session-only", why: "Applying a link issues a data key and starts a remote tunnel, so it requires a dashboard session (paired, or standalone loopback dashboard on trusted loopback ingress)." } },
   { method: "DELETE", path: "/api/link/{id}", module: "server/management/link-routes", mutates: true, mechanism: "regex" },
   { method: "POST", path: "/api/link/issue", module: "server/management/link-routes", mutates: true },

package/src/server/management/shared.ts

@@ -100,7 +100,7 @@ export type CostResult =
   | { kind: "value"; estimate: NonNullable<ReturnType<typeof estimateRequestCost>>; estimateReasons: CostEstimateReason[] }
   | { kind: "unavailable"; reason: MetricUnavailableReason };
 
-export type MetricSource = Pick<RequestLogEntry, "provider" | "model" | "durationMs" | "firstOutputMs" | "usageStatus" | "usage" | "requestedServiceTier" | "configuredServiceTier" | "responseServiceTier" | "tierOutcome" | "routeDecision" | "cacheProvenance"> & {
+export type MetricSource = Pick<RequestLogEntry, "provider" | "model" | "durationMs" | "firstOutputMs" | "genStartMs" | "lastOutputMs" | "usageStatus" | "usage" | "requestedServiceTier" | "configuredServiceTier" | "responseServiceTier" | "tierOutcome" | "routeDecision" | "cacheProvenance"> & {
   attempts?: readonly PersistedUsageAttempt[];
 };
 
@@ -129,10 +129,11 @@ export function tokPerSecondResult(entry: Pick<MetricSource, "durationMs" | "usa
 export const MIN_DECODE_WINDOW_MS = 1_000;
 
 /**
- * Estimated DECODE throughput: output tokens over the window after the first token (#4038).
+ * Estimated DECODE throughput: output tokens over the measured output window (#4038): the generation window when
+ * recorded, otherwise the window after the first token.
  *
- * Strictly additive. `tokensPerSecond`, `tokPerSecondResult`, `RequestLogEntry` and
- * `usage.jsonl` are untouched, and the end-to-end rate beside it keeps meaning exactly what it
+ * Strictly additive. `tokensPerSecond` and `tokPerSecondResult` are untouched, rows only gain the
+ * optional window pair, and the end-to-end rate beside it keeps meaning exactly what it
  * has always meant — it is documented as end-to-end, so this is a missing metric rather than a
  * miscalculated one.
  *
@@ -140,13 +141,26 @@ export const MIN_DECODE_WINDOW_MS = 1_000;
  * not the provider's own generation start, so this can never be more than an estimate no matter
  * how long the window is. Saying so in the payload is the honest half of the answer to #4040;
  * MIN_DECODE_WINDOW_MS is the other half.
+ *
+ * When the row carries the generation window (`genStartMs` / `lastOutputMs`, #6309) that window is
+ * used instead. `firstOutputMs` is the first VISIBLE delta, so on a reasoning model the post-TTFT
+ * window leaves out the reasoning phase while `outputTokens` still counts its tokens; the
+ * generation window spans both and stops at the last delta rather than at stream close.
  */
 export function decodeTokPerSecondResult(
-  entry: Pick<MetricSource, "durationMs" | "firstOutputMs" | "usageStatus" | "usage">,
+  entry: Pick<MetricSource, "durationMs" | "firstOutputMs" | "genStartMs" | "lastOutputMs" | "usageStatus" | "usage">,
 ): TokPerSecondResult {
   if (!entry.usage) return { kind: "unavailable", reason: "usage_missing" };
   if (entry.usageStatus === "unsupported") return { kind: "unavailable", reason: "usage_unsupported" };
   if (entry.usage.outputTokens <= 0) return { kind: "unavailable", reason: "output_missing" };
+  const { genStartMs, lastOutputMs } = entry;
+  if (genStartMs !== undefined && lastOutputMs !== undefined && Number.isFinite(genStartMs) && Number.isFinite(lastOutputMs)) {
+    const generationMs = lastOutputMs - genStartMs;
+    if (generationMs <= 0) return { kind: "unavailable", reason: "invalid_duration" };
+    if (generationMs < MIN_DECODE_WINDOW_MS) return { kind: "unavailable", reason: "decode_window_too_short" };
+    const value = tokensPerSecond(entry.usage.outputTokens, generationMs);
+    return value === null ? { kind: "unavailable", reason: "invalid_duration" } : { kind: "value", value, estimated: true };
+  }
   // A row that predates TTFT capture, or a non-streaming turn that never recorded one, has no
   // window to measure. That is a different fact from a bad duration, so it gets its own reason.
   if (entry.firstOutputMs === undefined) return { kind: "unavailable", reason: "ttft_missing" };

package/src/server/management/subagent-model-routes.ts

@@ -0,0 +1,214 @@
+import type { ManagementContext } from "./context";
+import { catalogModelSlug, filterCatalogVisibleModels, nativeModelRows, listCatalogNativeSlugs } from "../../codex/catalog";
+import { subagentSelectableModels } from "../../codex/subagent-selectable-models";
+import { saveConfigPreservingClaudeCode, deleteConfigTopLevelKey, mutatePersistedConfig, adoptPersistedClaudeCode, initializePersistedConfigIfMissing, observeInitialConfigState } from "../../config";
+import { captureConfigTopLevelRollback, parsedConfigRebaseDeletionKeys, projectConfigRebaseProvenance, deleteConfigObjectChildKey } from "../../config/rebase-provenance";
+import { InitialConfigPublicationError } from "../../config/initialize";
+import { ConfigWritePublishedError } from "../../config/persist-unlocked";
+import { commitClaudeCodeBlock } from "../../claude/claude-code-block";
+import { resolveSubagentForceModel, SAFE_AGENT_MODEL_ID } from "../../claude/subagent-model";
+import { inspectSubagentForceStatus } from "../../claude/subagent-force-status";
+import { jsonResponse } from "../auth-cors";
+import { isPlainRecord, fetchInitializedModels as fetchAllModels } from "./shared";
+import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
+
+export async function handleSubagentModelRoutes(ctx: ManagementContext, autoApplyDesktopBestEffort: () => Promise<void>): Promise<Response | null> {
+  const { req, url, config, deps, convergeCodexCatalog, syncClaudeAgentDefsBestEffort } = ctx;
+  // Featured roster and saved picker order are separate settings. Native Codex advertises
+  // the first five eligible visible rows by display priority; OCX guidance uses natural ranks.
+  if (url.pathname === "/api/subagent-models" && req.method === "GET") {
+    const models = await (deps.fetchAllModels ?? fetchAllModels)(config);
+    // Native gpt (passthrough) are also valid subagent picks — they're picker-visible models in the
+    // catalog, just buried by priority. List them first so the user can feature them over routed.
+    const chosen = config.subagentModels ?? [];
+    // A saved roster slot must stay representable even after its model is disabled
+    // elsewhere (Models page, provider allowlist, a provider row going away). The
+    // dashboard treats `available` as the set of rows it can render, so a chosen id
+    // missing from it disappears from the roster UI and the next Save — which PUTs
+    // exactly what the UI holds — silently truncates the persisted list. Losing a
+    // deliberate 5-model roster to an unrelated visibility toggle is data loss, not a
+    // filter. Same reasoning as `fetchGrokCandidateModels`, which deliberately lists a
+    // model the user already excluded so its switch remains reachable.
+    const available = subagentSelectableModels(config, models, listCatalogNativeSlugs());
+    // #857: let CLI/GUI show when a running Codex app-server keeps an older
+    // in-memory catalog than the one on disk. Bounded request-path read: the synchronous
+    // collector blocked the event loop for the whole Windows CIM walk (4-7s measured).
+    const {
+      collectCodexAppServerCatalogStateWithin,
+      DASHBOARD_CATALOG_STATE_DEADLINE_MS,
+    } = await import("../../codex/app-server-processes");
+    const catalogState = await collectCodexAppServerCatalogStateWithin(DASHBOARD_CATALOG_STATE_DEADLINE_MS);
+    const forceAvailable = subagentSelectableModels({ ...config, subagentModels: [] }, filterCatalogVisibleModels(models, config), listCatalogNativeSlugs());
+    return jsonResponse({
+      chosen, available, catalogState,
+      force: config.claudeCode?.subagentModelForce ?? null,
+      forceAvailable,
+      forceStatus: config.claudeCode?.subagentModelForce === undefined ? null : await inspectSubagentForceStatus(
+        resolveSubagentForceModel(config, {}, { entries: forceAvailable }) !== null,
+      ),
+      pickerAvailable: [...new Set(filterCatalogVisibleModels(models, config).map(catalogModelSlug).filter(slug => slug.includes("/")))],
+      pickerOrder: config.modelPickerOrder ?? [],
+      pickerOrderMode: config.modelPickerOrderMode ?? null,
+    });
+  }
+  if (url.pathname === "/api/subagent-models" && req.method === "PUT") {
+    // Observe before body/discovery awaits: disappearance of an existing config
+    // must never turn a scoped update into first-run initialization.
+    const initialConfigState = deps.saveConfigPreservingClaudeCode ? undefined : observeInitialConfigState();
+    let rawBody: unknown;
+    try { rawBody = await readManagementJsonBody(req); } catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid JSON body" }, 400); }
+    if (!isPlainRecord(rawBody)) return jsonResponse({ error: "JSON body must be an object" }, 400);
+    const body = rawBody as { models?: unknown; pickerOrder?: unknown; pickerOrderMode?: unknown; force?: unknown };
+    const updatesForce = Object.hasOwn(body, "force");
+    const updatesRoster = body.models !== undefined;
+    const updatesPicker = body.pickerOrder !== undefined;
+    if (!updatesRoster && !updatesPicker && !updatesForce) return jsonResponse({ error: "models, pickerOrder or force is required" }, 400);
+    let chosen: string[] | undefined;
+    if (updatesRoster) {
+      if (!Array.isArray(body.models) || body.models.some(model => typeof model !== "string")) {
+        return jsonResponse({ error: "models must be an array of strings" }, 400);
+      }
+      // Keep the original valid roster contract: no discovery validation, trimming or deduping.
+      chosen = body.models.slice(0, 5);
+    }
+    const mode = body.pickerOrderMode;
+    if (mode !== undefined && (!updatesPicker || (mode !== null
+      && mode !== "alphabetical" && mode !== "provider" && mode !== "most-used"))) {
+      return jsonResponse({ error: "pickerOrderMode requires pickerOrder and must be alphabetical, provider, most-used, or null" }, 400);
+    }
+    let pickerOrder: string[] | undefined;
+    if (updatesPicker) {
+      if (body.pickerOrder !== null && (!Array.isArray(body.pickerOrder)
+        || body.pickerOrder.some(model => typeof model !== "string" || model.trim() === ""))) {
+        return jsonResponse({ error: "pickerOrder must be an array of non-empty routed model ids, or null" }, 400);
+      }
+      pickerOrder = body.pickerOrder === null ? [] : (body.pickerOrder as string[]).map(model => model.trim());
+      if (new Set(pickerOrder).size !== pickerOrder.length) {
+        return jsonResponse({ error: "pickerOrder must not contain duplicate ids" }, 400);
+      }
+      if (pickerOrder.length > 0) {
+        const models = await (deps.fetchAllModels ?? fetchAllModels)(config);
+        // Evaluate visibility AFTER discovery: a concurrent visibility write may have completed.
+        const visible = new Set(filterCatalogVisibleModels(models, config).map(catalogModelSlug).filter(slug => slug.includes("/")));
+        // A bare native id orders the complete picker (docs: guides/model-ordering.md).
+        for (const row of nativeModelRows(config)) if (!row.disabled) visible.add(row.slug);
+        if (pickerOrder.some(model => !visible.has(model))) {
+          return jsonResponse({ error: "pickerOrder must contain visible routed or native model ids, each at most once" }, 400);
+        }
+      }
+    }
+
+    if (updatesForce && body.force !== null) {
+      if (typeof body.force !== "string" || !SAFE_AGENT_MODEL_ID.test(body.force)) {
+        return jsonResponse({ error: "force must be a safe exposed model id or null" }, 400);
+      }
+      const models = await (deps.fetchAllModels ?? fetchAllModels)(config);
+      const exposed = subagentSelectableModels({ ...config, subagentModels: [] }, filterCatalogVisibleModels(models, config), listCatalogNativeSlugs());
+      if (!resolveSubagentForceModel({ ...config, claudeCode: { ...config.claudeCode, subagentModelForce: body.force } }, {}, { entries: exposed })) {
+        return jsonResponse({ error: "force must resolve to an exposed model" }, 400);
+      }
+    }
+
+    if (updatesForce && initialConfigState === "invalid") {
+      return jsonResponse({ error: "force settings could not be persisted" }, 409);
+    }
+
+    // Everything above can await. From this snapshot through persistence there is no yield.
+    // Stage deletion intent before adopting the touched fields through the canonical
+    // live deletion owner. A failed save restores both fields and pending intent.
+    if ((updatesPicker || updatesForce) && config.configRebaseProvenance !== undefined
+      && parsedConfigRebaseDeletionKeys(config) === null) {
+      // A newer provenance format must not silently discard this clear's intent on rebase.
+      return jsonResponse({ error: "unsupported config deletion provenance" }, 409);
+    }
+    const draft = { ...projectConfigRebaseProvenance(config) };
+    if (chosen !== undefined) draft.subagentModels = chosen;
+    if (updatesForce) {
+      commitClaudeCodeBlock(draft, { ...config.claudeCode });
+      if (body.force === null) deleteConfigObjectChildKey(draft, "claudeCode", "subagentModelForce");
+      else draft.claudeCode!.subagentModelForce = body.force as string;
+    }
+    if (pickerOrder !== undefined) {
+      if (pickerOrder.length === 0) {
+        deleteConfigTopLevelKey(draft, "modelPickerOrder");
+        deleteConfigTopLevelKey(draft, "modelPickerOrderMode");
+      } else {
+        draft.modelPickerOrder = pickerOrder;
+        if (mode === "alphabetical" || mode === "provider" || mode === "most-used") draft.modelPickerOrderMode = mode;
+        else deleteConfigTopLevelKey(draft, "modelPickerOrderMode");
+      }
+    }
+    const projected = projectConfigRebaseProvenance(draft);
+    const touched = [
+      ...(updatesRoster ? ["subagentModels" as const] : []),
+      ...(updatesForce ? ["claudeCode" as const] : []),
+      ...(updatesPicker ? ["modelPickerOrder" as const, "modelPickerOrderMode" as const] : []),
+      "configRebaseProvenance" as const,
+    ];
+    const rollback = captureConfigTopLevelRollback(config, touched);
+    try {
+      for (const key of touched) {
+        if (Object.hasOwn(projected, key)) Object.defineProperty(config, key, {
+          value: projected[key], writable: true, enumerable: true, configurable: true,
+        });
+        else deleteConfigTopLevelKey(config, key);
+      }
+      if (updatesForce && body.force === null) deleteConfigObjectChildKey(config, "claudeCode", "subagentModelForce");
+      if (updatesForce && initialConfigState === "missing") {
+        // Create-only publication rechecks under the canonical lock and never
+        // replaces a file another writer supplied while discovery was pending.
+        if (initializePersistedConfigIfMissing(config) !== "created") {
+          rollback();
+          return jsonResponse({ error: "force settings could not be persisted" }, 409);
+        }
+        adoptPersistedClaudeCode(config, structuredClone(config.claudeCode));
+      } else if (updatesForce && !deps.saveConfigPreservingClaudeCode) {
+        const outcome = mutatePersistedConfig(persisted => {
+          commitClaudeCodeBlock(persisted, { ...persisted.claudeCode });
+          if (body.force === null) delete persisted.claudeCode!.subagentModelForce;
+          else persisted.claudeCode!.subagentModelForce = body.force as string;
+          if (updatesRoster) persisted.subagentModels = chosen!;
+          if (updatesPicker) {
+            if (pickerOrder!.length === 0) {
+              deleteConfigTopLevelKey(persisted, "modelPickerOrder");
+              deleteConfigTopLevelKey(persisted, "modelPickerOrderMode");
+            } else {
+              persisted.modelPickerOrder = pickerOrder;
+              if (mode === "alphabetical" || mode === "provider" || mode === "most-used") persisted.modelPickerOrderMode = mode;
+              else deleteConfigTopLevelKey(persisted, "modelPickerOrderMode");
+            }
+          }
+          return { changed: true, value: structuredClone(persisted.claudeCode) };
+        });
+        if (outcome.status === "unavailable") {
+          rollback();
+          return jsonResponse({ error: "force settings could not be persisted" }, 409);
+        }
+        adoptPersistedClaudeCode(config, outcome.value);
+      } else {
+        (deps.saveConfigPreservingClaudeCode ?? saveConfigPreservingClaudeCode)(config);
+      }
+    } catch (error) {
+      // Once publication succeeded (or cannot be ruled out), restoring only the
+      // live object would falsely report the old setting while disk may hold new bytes.
+      if (!(error instanceof ConfigWritePublishedError)
+        && !(error instanceof InitialConfigPublicationError && error.publication !== "not-published")) rollback();
+      throw error;
+    }
+    // Capture the result before convergence yields to another settings mutation.
+    const saved = {
+      applied: [...(config.subagentModels ?? [])],
+      force: config.claudeCode?.subagentModelForce ?? null,
+      pickerOrder: [...(config.modelPickerOrder ?? [])],
+      pickerOrderMode: config.modelPickerOrderMode ?? null,
+    };
+    const catalogRefresh = updatesRoster || updatesPicker ? await convergeCodexCatalog() : undefined;
+    if (updatesRoster) {
+      await syncClaudeAgentDefsBestEffort();
+      await autoApplyDesktopBestEffort();
+    }
+    return jsonResponse({ ok: true, ...saved, catalogRefresh });
+  }
+
+  return null;
+}

package/src/server/relay.ts

@@ -30,8 +30,9 @@ import {
   joinSseFrameBytes,
   MAX_CLIENT_SSE_FRAME_BYTES,
   SseFrameCountLimitError,
+  sseDelimiterLengthAt,
 } from "./sse-frame-buffer";
-import { replaceSseDataPayload, sseDataPayload } from "./sse-payload-rewrite";
+import { replaceSseDataPayload, splitSseBlock, sseDataPayload } from "./sse-payload-rewrite";
 import { createBoundedResponseLogBody } from "./response-log-body";
 import { clientWireLogOf } from "./inference/client-wire";
 import { recordClientWireRequestLog } from "./inference/client-wire-log";
@@ -355,10 +356,11 @@ export function createSseTerminalOutputBoundary(
     frames: ReturnType<BoundedSseFrameBuffer["feed"]>,
   ): Uint8Array => {
     if (disposed || terminal || frames.length === 0) return EMPTY_BYTES;
-    if (maxFrames !== undefined && frames.length > maxFrames - framesSeen) {
+    const completedFrames = frames.reduce((count, frame) => count + (frame.continuation ? 0 : 1), 0);
+    if (maxFrames !== undefined && completedFrames > maxFrames - framesSeen) {
       throw new SseFrameCountLimitError(maxFrames);
     }
-    framesSeen += frames.length;
+    framesSeen += completedFrames;
     const output: Uint8Array[] = [];
     const appendOutput = (...parts: Uint8Array[]): void => {
       for (const part of parts) {
@@ -596,17 +598,7 @@ export function relaySseWithFailedTail(
   });
 }
 
-export function nextSseBlock(buffer: string): { block: string; delimiter: string; rest: string } | null {
-  const match = buffer.match(/\r?\n\r?\n/);
-  if (!match || match.index === undefined) return null;
-  return {
-    block: buffer.slice(0, match.index),
-    delimiter: match[0],
-    rest: buffer.slice(match.index + match[0].length),
-  };
-}
-
-export { sseDataPayload } from "./sse-payload-rewrite";
+export { nextSseBlock, sseDataPayload } from "./sse-payload-rewrite";
 
 type JsonRecord = Record<string, unknown>;
 
@@ -698,9 +690,8 @@ function stripCodexSafetyBufferingField(block: string, parsed: unknown): string
 }
 
 function rewritePolicyTerminalBlock(block: string, payload: string): string {
-  const newline = block.includes("\r\n") ? "\r\n" : "\n";
   const rewritten = replaceSseDataPayload(block, payload);
-  const lines = rewritten.split(/\r?\n/);
+  const { newline, lines } = splitSseBlock(rewritten);
   let eventRewritten = false;
   const withEvent = lines.map(line => {
     if (!eventRewritten && line.startsWith("event:")) {
@@ -1156,31 +1147,6 @@ function outputBearingSseEvent(event: { type?: unknown; output_index?: unknown }
     .test(event.type);
 }
 
-function delimiterLengthAt(
-  index: number,
-  length: number,
-  byteAt: (index: number) => number,
-): number | 0 | undefined {
-  const first = byteAt(index);
-  if (first === 10) {
-    if (index + 1 >= length) return undefined;
-    const second = byteAt(index + 1);
-    if (second === 10) return 2;
-    if (second !== 13) return 0;
-    if (index + 2 >= length) return undefined;
-    return byteAt(index + 2) === 10 ? 3 : 0;
-  }
-  if (first !== 13) return 0;
-  if (index + 1 >= length) return undefined;
-  if (byteAt(index + 1) !== 10) return 0;
-  if (index + 2 >= length) return undefined;
-  const third = byteAt(index + 2);
-  if (third === 10) return 3;
-  if (third !== 13) return 0;
-  if (index + 3 >= length) return undefined;
-  return byteAt(index + 3) === 10 ? 4 : 0;
-}
-
 /**
  * Per-chunk SSE inspection state machine shared by consumeForInspection,
  * consumeForResponseLogMetadata, and the eager bounded relay (relay-eager.ts).
@@ -1202,6 +1168,7 @@ export function createSseInspector(handlers: SseInspectorHandlers): SseInspector
   let sawTerminal = false;
   let disposed = false;
   let delimiterTail: Uint8Array = EMPTY_BYTES;
+  let pendingLineFeed = false;
   let candidate: Uint8Array = EMPTY_BYTES;
   let candidateBytes = 0;
   let discardingOversizedFrame = false;
@@ -1228,6 +1195,7 @@ export function createSseInspector(handlers: SseInspectorHandlers): SseInspector
 
   const clearFrameState = (): void => {
     delimiterTail = EMPTY_BYTES;
+    pendingLineFeed = false;
     candidate = EMPTY_BYTES;
     candidateBytes = 0;
     discardingOversizedFrame = false;
@@ -1504,15 +1472,17 @@ export function createSseInspector(handlers: SseInspectorHandlers): SseInspector
         retainCandidateSlice(chunk.subarray(Math.max(0, start - tailLength), end - tailLength));
       }
     };
-    let index = 0;
-    let retainedThrough = 0;
+    let index = pendingLineFeed && byteAt(0) === 10 ? 1 : 0;
+    if (totalLength > 0) pendingLineFeed = false;
+    let retainedThrough = index;
     while (index < totalLength) {
-      const delimiterLength = delimiterLengthAt(index, totalLength, byteAt);
+      const delimiterLength = sseDelimiterLengthAt(index, totalLength, byteAt);
       if (delimiterLength === undefined) break;
       if (delimiterLength > 0) {
         retainRange(retainedThrough, index);
         completeCandidate();
         index += delimiterLength;
+        pendingLineFeed = index === totalLength && byteAt(index - 1) === 13;
         retainedThrough = index;
         continue;
       }

package/src/server/request-log-generation-window.ts

@@ -0,0 +1,38 @@
+import type { RequestLogContext } from "./request-log";
+
+/**
+ * Generation window for the decode-rate estimate (#4038, #6309).
+ *
+ * `firstOutputMs` marks the first VISIBLE output delta. For a reasoning model that is the end of
+ * the reasoning phase, yet `outputTokens` includes the reasoning tokens, so
+ * `outputTokens / (durationMs - firstOutputMs)` divides the whole output by only part of the time
+ * that produced it. The window recorded here starts when the model starts producing ANY output
+ * item (reasoning included) and ends at the last output delta, so trailing stream bookkeeping
+ * after the final token does not count either.
+ *
+ * Event vocabulary: Anthropic `content_block_start` / `content_block_delta`, and Responses
+ * `response.output_item.added` / `response.*.delta`. Anything else leaves the window untouched.
+ */
+export function recordGenerationEvent(logCtx: RequestLogContext, type: unknown, now = Date.now()): void {
+  if (typeof type !== "string" || !Number.isFinite(now)) return;
+  if (type === "content_block_start" || type === "response.output_item.added") {
+    logCtx.generationStartedAt ??= now;
+  } else if (type === "content_block_delta" || (type.startsWith("response.") && type.endsWith(".delta"))) {
+    logCtx.generationStartedAt ??= now;
+    logCtx.lastOutputAt = now;
+  }
+}
+
+/** Request-relative `genStartMs` / `lastOutputMs`, present only when both ends were observed. */
+export function generationWindowFields(
+  logCtx: Pick<RequestLogContext, "generationStartedAt" | "lastOutputAt">,
+  requestStartedAt: number,
+): { genStartMs?: number; lastOutputMs?: number } {
+  const startedAt = logCtx.generationStartedAt;
+  const lastAt = logCtx.lastOutputAt;
+  if (startedAt === undefined || lastAt === undefined || !Number.isFinite(requestStartedAt)) return {};
+  return {
+    genStartMs: Math.max(0, startedAt - requestStartedAt),
+    lastOutputMs: Math.max(0, lastAt - requestStartedAt),
+  };
+}

package/src/server/request-log.ts

@@ -85,6 +85,7 @@ import {
   normalizePersistedJevDecision,
   type PersistedJevDecisionV1,
 } from "../usage/jev-stats";
+import { generationWindowFields, recordGenerationEvent } from "./request-log-generation-window";
 import type { RequestMetricsRecorder } from "./request-metrics";
 import type {
   CacheDiagnosticDraft,
@@ -136,6 +137,9 @@ export interface RequestLogContext {
   affinityMoveReasons?: CodexAffinityReason[];
   /** TTFT: ms from request start to the first non-empty model output delta (WP4, devlog 040). */
   firstOutputMs?: number;
+  /** Epoch ms of the first output item and of the last output delta; see request-log-generation-window.ts. */
+  generationStartedAt?: number;
+  lastOutputAt?: number;
   /** Best-effort chat/session correlation for Logs grouping (#330). Opaque; omit when unknown. */
   conversationId?: string;
   surface?: "claude" | "claude-desktop" | "grok";
@@ -282,6 +286,9 @@ export interface RequestLogEntry {
   provider: string;
   /** TTFT: ms from request start to the first non-empty model output delta; unset for non-streaming/tool-only. */
   firstOutputMs?: number;
+  /** Request-relative generation window (#6309): first output item of any kind, then the last output delta. */
+  genStartMs?: number;
+  lastOutputMs?: number;
   surface?: "claude" | "claude-desktop" | "grok";
   /**
    * Set when the proxy answered this turn locally and sent nothing upstream. Without it a zero-send
@@ -453,6 +460,8 @@ export function requestLogEntryFromPersistedUsage(entry: PersistedUsageEntry): R
     model: entry.model,
     provider: entry.provider,
     ...(entry.firstOutputMs !== undefined ? { firstOutputMs: entry.firstOutputMs } : {}),
+    ...(entry.genStartMs !== undefined ? { genStartMs: entry.genStartMs } : {}),
+    ...(entry.lastOutputMs !== undefined ? { lastOutputMs: entry.lastOutputMs } : {}),
     ...(isKnownUsageSurface(entry.surface) ? { surface: entry.surface } : {}),
     ...(entry.conversationId ? { conversationId: entry.conversationId } : {}),
     ...(isCodexUsageAccountLogLabel(entry.accountLogLabel)
@@ -668,6 +677,8 @@ export function addRequestLog(entry: RequestLogEntry) {
       status: entry.status,
       durationMs: entry.durationMs,
       ...(entry.firstOutputMs !== undefined ? { firstOutputMs: entry.firstOutputMs } : {}),
+      ...(entry.genStartMs !== undefined ? { genStartMs: entry.genStartMs } : {}),
+      ...(entry.lastOutputMs !== undefined ? { lastOutputMs: entry.lastOutputMs } : {}),
       usageStatus: entry.usageStatus,
       ...(entry.usage ? { usage: entry.usage } : {}),
       ...(entry.totalTokens !== undefined ? { totalTokens: entry.totalTokens } : {}),
@@ -1056,6 +1067,7 @@ export function inspectResponseLogSsePayloadParsed(
   if (!payload || payload.trim() === "[DONE]") return;
   const debugEnabled = isUsageDebugEnabled();
   const sseAlreadyMarked = logCtx.usageDebugBodyKind === "sse";
+  if (parsed !== undefined) recordGenerationEvent(logCtx, (parsed as { type?: unknown } | null)?.type);
   if (parsed !== undefined) applyResponseLogMetadata(logCtx, parsed);
   else logCtx.activeTierMetadata?.markResponseUnparseable();
   captureUpstreamErrorParsed(logCtx, payload, parsed);
@@ -1571,6 +1583,7 @@ export function addFinalRequestLog(
     status: effectiveStatus,
     durationMs,
     ...(logCtx.firstOutputMs !== undefined ? { firstOutputMs: logCtx.firstOutputMs } : {}),
+    ...generationWindowFields(logCtx, start),
     ...(errorCode ? { errorCode } : {}),
     ...(meta?.terminalStatus ? { terminalStatus: meta.terminalStatus } : {}),
     ...(closeReason ? { closeReason } : {}),

package/src/server/responses/adapter-dispatch.ts

@@ -46,9 +46,10 @@ import type { OpaqueBlobRecoveryGuard } from "./core-opaque-recovery";
 import type { AttemptRecoveryKind } from "../../usage/log";
 import type { OAuthAccessSnapshot } from "../../oauth";
 import { OAuthAccountPausedError, OAuthLoginRequiredError, publicOAuthAuthenticationErrorMessage } from "../../oauth";
-import { getAccountSet } from "../../oauth/store";
+import { getAccountSet, markAccountNeedsReauthIfGeneration } from "../../oauth/store";
 import { tryKiroAlternateAfterTerminalRefresh } from "../../oauth/kiro-terminal-failover";
 import { classifyKiroRefusal } from "../../adapters/kiro-refusal";
+import { classifyAntigravityRefusal } from "../../adapters/antigravity-refusal";
 import { normalizeFinalKiroHttpError } from "../../adapters/kiro-retry";
 import { noteKiroMonthlyRefusal } from "../../providers/kiro-usage";
 import { persistKiroAccountState } from "../../providers/kiro-account-state-disk";
@@ -1243,6 +1244,104 @@ export async function prepareAdapterExchange(
           break;
         }
       }
+      // Antigravity verify-account quarantine: a 403 demanding account verification
+      // is terminal for THAT account — its grant still refreshes, so only a manual
+      // verification followed by a re-login clears it. Mark it needsReauth (durable,
+      // shown as `needs-reauth(verify)` in `ocx account list` with a `verify_account`
+      // health reason in the management API, excluded from the pool until re-login)
+      // and replay the same request on the next eligible account so the pool keeps
+      // serving.
+      while (
+        upstreamResponse.status === 403
+        && route.providerName === "google-antigravity"
+        && transportState.genericFailoverAccountId
+      ) {
+        const refusal = classifyAntigravityRefusal(upstreamResponse.status,
+          await readDisplaySafeErrorText(upstreamResponse.clone(), upstream.signal, ""));
+        if (refusal.kind === "other") break;
+        const sent = transportState.sentOAuthSnapshot;
+        const failedAccountId = transportState.genericFailoverAccountId;
+        // Fenced write: a 403 arriving after the credential rotated (refresh or
+        // re-login) must not quarantine the new login. Without the matching sent
+        // snapshot there is no owner for this write, so skip marking.
+        if (!sent || sent.accountId !== failedAccountId) break;
+        try {
+          await markAccountNeedsReauthIfGeneration(route.providerName, failedAccountId, sent.generation, undefined, "verify_account");
+        } catch {
+          // A failed quarantine write must preserve the refusal, not authorize another send.
+          break recovery;
+        }
+        if (!antigravityPoolActivated || transportState.genericFailovers >= transportState.genericFailoverLimit) break;
+        const adapterOwnsDispatch = transportState.activeAdapter.fetchResponse !== undefined;
+        const hop = reserveCredentialHop(
+          "auth-recovery",
+          `${route.providerName}|${route.modelId}|adapter-recovery-oauth-verify`,
+          !adapterOwnsDispatch && transientRetryPolicyFor(route.provider) !== null,
+        );
+        if (!hop.allowed) break;
+        // Auth-refusal rotation, not the rate-limit one: a verification refusal
+        // must not record rate-limit cooldown semantics against the account.
+        const nextAccountId = rotateAntigravityAccountOnAuthRefusal(
+          antigravityPoolActivated,
+          failedAccountId,
+          sent.generation,
+          route.modelId,
+        );
+        if (!nextAccountId) {
+          hop.permit?.release();
+          break;
+        }
+        // The refusal body stays alive until the replacement owns the outcome: it
+        // is also the preserveFailureResponse below, so cancelling it early would
+        // hand back a 403 with a destroyed body when the rebuild is refused.
+        const failedResponse = upstreamResponse;
+        try {
+          // The FULL snapshot, not just the bearer: Antigravity pairs an
+          // account-matched projectId with its token, so a token-only swap would mix
+          // one account's credential with another's routing data.
+          const snapshot = await failoverAccountSnapshot(route.providerName, nextAccountId);
+          if (!await applyFailoverSnapshot(snapshot)) {
+            hop.permit?.release();
+            break;
+          }
+          invalidateSameTargetRequest();
+          transportState.activeAdapter = resolveSelectionAdapter(
+            resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire, route.staticPolicy),
+            config.cacheRetention,
+          );
+          bindRouteReasoningReplayScope({
+            parsed,
+            providerName: route.providerName,
+            provider: route.provider,
+            adapterName: transportState.activeAdapter.name,
+            oauthCredentialSnapshot: transportState.replayOAuthCredentialSnapshot,
+          });
+          sealRequestAttemptIdentity(logCtx.activeAttempt, logCtx.provider, transportState.activeAdapter.name, logCtx.accountLogLabel);
+          recordAttemptCredentialSource(logCtx.activeAttempt, route.providerName, route.provider, transportState.activeAdapter.name);
+          sendBudgetState.pendingHopPermit = hop.permit;
+          let result: Response | { failed: Response };
+          try {
+            result = await rebuildAndRefetch("oauth-account-403", () => {
+              if (!adapterOwnsDispatch) hop.permit?.use();
+            }, failedResponse);
+          } finally {
+            sendBudgetState.pendingHopPermit = undefined;
+          }
+          if ("failed" in result) {
+            hop.permit?.release();
+            if (result.failed !== failedResponse) return result.failed;
+            // Preserve common redaction and combo consumption without another recovery send.
+            break recovery;
+          }
+          transportState.genericFailovers += 1;
+          try { void failedResponse.body?.cancel().catch(() => {}); } catch { /* already consumed/closed */ }
+          upstreamResponse = result;
+          if (isNonReplayableResponse(upstreamResponse)) continue recovery;
+        } catch {
+          hop.permit?.release();
+          break;
+        }
+      }
       }
       // Unknown provenance is deliberately fail-soft in pre-flight: after a restart, TTL expiry,
       // or LRU eviction, a valid same-backend blob must survive. A decoder's own 4xx identity is