@bitkyc08/opencodex 2.76.0 → 2.78.0-preview.20261005

package/src/server/messages-native-oauth.ts

@@ -2,19 +2,15 @@
  * Anthropic OAuth on the managed native Messages lane (PF-10, behind
  * `protocols.rollout.managedMessagesNativeOAuth`).
  *
- * Credential. The account is the one the existing OAuth selection chooses for this request, by
- * the same steps the Responses pipeline's transport takes for an unpooled Anthropic OAuth route
- * (`prepareResponsesTransport`): capture the committed selection, resolve an eligible account's
- * access snapshot (including pause/cooldown recovery), and commit that
- * proposal against the captured selection so a concurrent manual switch wins. Nothing here picks
- * an account of its own, and nothing runs at planning time: the planner and eligibility read
- * config only, and this module is reached from the lane's dispatch alone.
+ * Credential. Shared Anthropic routing chooses the account for the session and model;
+ * the same generation-fenced selection commit as the Responses transport admits it. A lost
+ * commit re-evaluates routing so a concurrent manual switch or policy edit wins. Selection,
+ * token resolution and affinity binding run at dispatch only, never during planning.
  *
- * Pools. A pooled account set (the opt-in Anthropic account pool, or two or more usable accounts,
- * which turns on reactive 429 rotation) is declined before this lane is chosen
- * (`oauth-account-pool`). Should one appear between that decision and dispatch, resolution fails
- * closed rather than serve a pooled account without the pool's rotation and affinity. This
- * lane-change 409 is distinct from the shared local authentication/pause/cooldown refusals.
+ * Pools. Native Messages uses the OAuth owner's strategy, model allowlist, session affinity,
+ * pause and cooldown admission. Pre-output refusal recovery proposes a replacement account;
+ * this module admits and binds its exact generation before a rebuilt request may send.
+ * A lane-change 409 remains distinct from typed local authentication/pause/cooldown refusals.
  *
  * Tool names. An OAuth request carries client tool names under the Claude OAuth prefix, as the
  * adapter sends them; the answer's `tool_use` names are mapped back here, for exactly the names
@@ -25,12 +21,15 @@
 import type { OAuthAccessSnapshot } from "../oauth";
 import {
   commitAnthropicSelectionRouting,
+  captureAnthropicManualSelectionGeneration,
   getAnthropicPoolAccessSnapshot,
   getAnthropicAccountHealthSnapshot,
   resolveAnthropicDispatchAccountId,
-  hasAnthropicFailoverQuorum,
+  resolveAnthropicAccountForSession,
+  getEligibleAnthropicAccounts,
   isAnthropicAccountPoolEnabled,
 } from "../oauth/anthropic-routing";
+import { resolveAnthropicModelRoute, routeCandidates, type AnthropicRouteDecision } from "../oauth/anthropic-model-routes";
 import {
   captureOAuthAccountSelection,
   commitOAuthAccountSelection,
@@ -57,9 +56,14 @@ export interface NativeOAuthBinding {
   readonly snapshot: OAuthAccessSnapshot;
   /** Anthropic account UUID from the same stored generation, distinct from snapshot.accountId. */
   readonly providerAccountUuid?: string;
+  readonly routeDecision: AnthropicRouteDecision | null;
+  readonly sessionKey: string | null;
+  readonly model?: string;
+  readonly config: OcxConfig;
+  readonly manualSelectionGeneration: number;
 }
 
-/** The selection moved or became pooled while it was being resolved. Maps to a 409 retry. */
+/** The selection moved or became ineligible while resolving. Maps to a 409 retry. */
 export class NativeOAuthSelectionChangedError extends Error {
   constructor() {
     super("OAuth account selection changed; retry the request");
@@ -67,57 +71,100 @@ export class NativeOAuthSelectionChangedError extends Error {
   }
 }
 
-function pooled(config: OcxConfig): boolean {
-  return isAnthropicAccountPoolEnabled(config) || hasAnthropicFailoverQuorum();
+/** Invalid operator route configuration remains a request refusal, not an auth failure. */
+export class NativeOAuthModelRouteError extends Error {}
+
+function currentRoute(config: OcxConfig, model?: string): AnthropicRouteDecision | null {
+  const resolved = model ? resolveAnthropicModelRoute(config, model) : { decision: null };
+  if (resolved.error) throw new NativeOAuthModelRouteError(`Invalid Anthropic model routes: ${resolved.error}`);
+  return resolved.decision ? { ...resolved.decision, accounts: [...resolved.decision.accounts] } : null;
 }
 
-/**
- * Resolve and commit the account for one native request. Throws the OAuth owner's own errors
- * (login required, refresh failure) unchanged, and `NativeOAuthSelectionChangedError` when the
- * selection could not be committed.
- */
-export async function resolveNativeOAuthBinding(config: OcxConfig): Promise<NativeOAuthBinding> {
+function routeIsCurrent(config: OcxConfig, model: string | undefined, decision: AnthropicRouteDecision | null): boolean {
+  return JSON.stringify(currentRoute(config, model)) === JSON.stringify(decision);
+}
+
+export interface NativeOAuthBindingOptions {
+  sessionKey?: string | null;
+  model?: string;
+  /** An account proposed by the shared pre-output refusal recovery policy. */
+  candidateAccountId?: string;
+  /** Selection captured before asynchronous refusal classification or throttle wait. */
+  expectedRecoverySelection?: Selection | null;
+  expectedRecoveryRouteDecision?: AnthropicRouteDecision | null;
+}
+
+/** Resolve the shared pool selector and commit its exact credential generation for dispatch. */
+export async function resolveNativeOAuthBinding(
+  config: OcxConfig,
+  options: NativeOAuthBindingOptions = {},
+): Promise<NativeOAuthBinding> {
+  const sessionKey = options.sessionKey ?? null;
+  const model = options.model;
   for (let attempt = 0; attempt < MAX_SELECTION_ATTEMPTS; attempt++) {
+    const routeDecision = currentRoute(config, model);
+    const manualSelectionGeneration = captureAnthropicManualSelectionGeneration();
     const selection = captureOAuthAccountSelection(PROVIDER);
-    // Resolve eligibility before the lane guard: a local 401/403/429 must not turn
-    // into a generic lane-change 409 merely because it appeared during pacing.
-    const accountId = await resolveAnthropicDispatchAccountId(config);
-    if (pooled(config)) throw new NativeOAuthSelectionChangedError();
+    // Always ask admission first so pause/login/cooldown retains its typed local refusal.
+    const admittedId = await resolveAnthropicDispatchAccountId(config, sessionKey, routeDecision, model);
+    if (!routeIsCurrent(config, model, routeDecision)) continue;
+    const proposed = resolveAnthropicAccountForSession(sessionKey, config, Date.now(), routeDecision, model);
+    // A lost selection commit discards a recovery proposal: a newer manual/policy choice wins.
+    const recoverySelectionMatches = !!options.expectedRecoverySelection
+      && selection?.accountId === options.expectedRecoverySelection.accountId
+      && selection?.revision === options.expectedRecoverySelection.revision;
+    const recoveryRouteMatches = options.expectedRecoveryRouteDecision === undefined
+      || JSON.stringify(options.expectedRecoveryRouteDecision) === JSON.stringify(routeDecision);
+    const accountId = attempt === 0 && options.candidateAccountId && recoverySelectionMatches && recoveryRouteMatches
+      ? options.candidateAccountId : admittedId;
     if (!selection) continue;
+    if (!routeCandidates(getEligibleAnthropicAccounts(Date.now(), model), routeDecision).includes(accountId)) {
+      throw new NativeOAuthSelectionChangedError();
+    }
     const candidate = await getAnthropicPoolAccessSnapshot(accountId);
+    if (!routeIsCurrent(config, model, routeDecision)) continue;
     const committed = await commitOAuthAccountSelection(PROVIDER, candidate.accountId, {
       expectedSelection: selection,
       expectedCredentialGeneration: candidate.generation,
       requireUsableAccount: true,
     });
     if (committed) {
+      if (!routeIsCurrent(config, model, routeDecision)
+        || manualSelectionGeneration !== captureAnthropicManualSelectionGeneration()) continue;
       if (!commitAnthropicSelectionRouting(candidate.accountId, selection, committed, {
-        config,
-        sessionKey: null,
+        config, sessionKey, model, routeDecision,
+        reason: accountId === proposed.accountId ? proposed.reason : undefined,
         expectedCredentialGeneration: candidate.generation,
       })) continue;
-      if (pooled(config)) break;
       const row = getAccountCredentialWithStatus(PROVIDER, candidate.accountId);
       if (!row || credentialGeneration(row.credential) !== candidate.generation) continue;
-      const binding = { selection: committed, snapshot: candidate, providerAccountUuid: row.credential.accountId };
+      const binding = { selection: committed, snapshot: candidate, providerAccountUuid: row.credential.accountId, routeDecision, sessionKey, model, config, manualSelectionGeneration };
       if (nativeOAuthBindingIsCurrent(binding)) return binding;
     }
-    // Re-read after a lost commit or a health change during credential resolution.
   }
   throw new NativeOAuthSelectionChangedError();
 }
 
 /**
- * Whether a binding may still be sent: the same committed selection, and the same usable,
- * unexpired credential generation. Checked immediately before every physical send.
+ * Whether a binding may still be sent: a live pooled session affinity or the same committed
+ * selection, plus the same usable credential generation. Checked before every physical send.
  */
 export function nativeOAuthBindingIsCurrent(binding: NativeOAuthBinding): boolean {
+  if (binding.manualSelectionGeneration !== captureAnthropicManualSelectionGeneration()
+    || !routeIsCurrent(binding.config, binding.model, binding.routeDecision)) return false;
   const selected = captureOAuthAccountSelection(PROVIDER);
   const row = getAccountCredentialWithStatus(PROVIDER, binding.snapshot.accountId);
-  return selected?.accountId === binding.selection.accountId
-    && selected?.revision === binding.selection.revision
+  const sessionRoute = isAnthropicAccountPoolEnabled(binding.config) && binding.sessionKey
+    ? resolveAnthropicAccountForSession(binding.sessionKey, binding.config, Date.now(), binding.routeDecision, binding.model) : null;
+  // Another conversation may move the automatic active pointer without revoking this
+  // session's affinity. Manual selection clears affinity and precedes it in the selector.
+  const selectionCurrent = sessionRoute?.reason === "affinity"
+    && sessionRoute.accountId === binding.snapshot.accountId
+    || (selected?.accountId === binding.selection.accountId && selected?.revision === binding.selection.revision);
+  return selectionCurrent
     && !!row && !row.paused && !row.needsReauth && row.credential.expires > Date.now()
     && !getAnthropicAccountHealthSnapshot(binding.snapshot.accountId)
+    && routeCandidates(getEligibleAnthropicAccounts(Date.now(), binding.model), binding.routeDecision).includes(binding.snapshot.accountId)
     && credentialGeneration(row.credential) === binding.snapshot.generation
     && row.credential.accountId === binding.providerAccountUuid;
 }

package/src/server/messages-native.ts

@@ -4,7 +4,7 @@
  * A Messages request whose settled route is a proxy-managed key on the `anthropic` adapter is
  * sent as Messages: the source body (after the ingress's managed-client steps) cut to a field
  * allowlist, the wire model, and the provider's own key. With `managedMessagesNativeOAuth` on
- * (PF-10), an unpooled Anthropic OAuth account is sent the same way with the access token the
+ * (PF-10), an Anthropic OAuth account is sent the same way with the access token the
  * existing OAuth selection resolves at dispatch (`messages-native-oauth.ts`). Modelled on the native Chat lane and
  * built on the same shared pieces — attempt row, finish-once final log, spend tracker, proactive
  * key selection, key failover and 429 replay, connection policy — so nothing the Responses
@@ -17,6 +17,13 @@
  *
  * Loaded lazily by `claude-messages.ts` only when the switch is on and a route is eligible.
  */
+import { resolveAnthropicModelRoute } from "../oauth/anthropic-model-routes";
+import { bindAnthropicRefusalCredential, rotateAnthropicAccountOnResponse } from "../oauth/anthropic-account-refusal";
+import { claimAnthropicFamilyRevalidation } from "../oauth/anthropic-model-quota";
+import { captureConfigGeneration } from "../lib/state-store-sweeper";
+import { recordAnthropicAccountQuotaFromHeaders } from "../providers/quota";
+import { credentialGeneration, getAccountCredentialWithStatus } from "../oauth/store";
+import { ANTHROPIC_POOL_MAX_FAILOVERS_PER_REQUEST } from "../oauth/anthropic-routing";
 import { enforceAnthropicImageLimits } from "../adapters/anthropic-image-guard";
 import { normalizeAnthropicImages } from "../adapters/anthropic-image-normalize";
 import { formatAnthropicErrorBody } from "../adapters/anthropic";
@@ -84,6 +91,7 @@ import { nativeMessagesDeclineReason, type NativeMessagesSelector } from "./mess
 import {
   nativeOAuthBindingIsCurrent,
   NativeOAuthSelectionChangedError,
+  NativeOAuthModelRouteError,
   resolveNativeOAuthBinding,
   restoreOAuthToolNamesInMessage,
   restoreOAuthToolNamesInSse,
@@ -150,6 +158,7 @@ export interface HandleNativeMessagesOptions {
    */
   callerAnthropicBeta?: string | null;
   clientIdentity?: AnthropicClientIdentity;
+  sessionKey?: string | null;
 }
 
 type FinishLog = (status: number, message?: string, meta?: FinalRequestLogMeta) => void;
@@ -373,7 +382,7 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
   const oauthProvider = (binding: NativeOAuthBinding): OcxProviderConfig => ({ ...route.provider, apiKey: binding.snapshot.accessToken });
   if (route.provider.authMode === "oauth") {
     try {
-      oauthBinding = await resolveNativeOAuthBinding(config);
+      oauthBinding = await resolveNativeOAuthBinding(config, { sessionKey: options.sessionKey, model: route.modelId });
     } catch (error) {
       cleanupAbort();
       upstream.abort();
@@ -381,6 +390,7 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
       const localRefusal = localOAuthFailure(error);
       if (localRefusal) return localRefusal;
       if (error instanceof NativeOAuthSelectionChangedError) return fail(409, error.message, "api_error");
+      if (error instanceof NativeOAuthModelRouteError) return fail(400, error.message, "invalid_request_error");
       return fail(401, publicOAuthAuthenticationErrorMessage(error), "authentication_error");
     }
   } else {
@@ -455,7 +465,7 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
   const transientSendAvailable = (): boolean => remainingTransientSends() > 0;
   const selector: NativeMessagesSelector = options.selector ?? {};
 
-  const send = async (recovery?: "rate-limit-429" | "key-429" | "key-401"): Promise<Response> => {
+  const send = async (recovery?: "rate-limit-429" | "oauth-account-403" | "key-429" | "key-401"): Promise<Response> => {
     const remaining = remainingTransientSends();
     if (requestTransientPolicy && remaining <= 0) {
       throw new Error("native Messages transient send budget exhausted before recovery dispatch");
@@ -479,10 +489,10 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
               for (let attempt = 0; !nativeOAuthBindingIsCurrent(oauthBinding); attempt++) {
                 if (attempt >= 3) throw new NativeOAuthSelectionChangedError();
                 try {
-                  oauthBinding = await resolveNativeOAuthBinding(config);
+                  oauthBinding = await resolveNativeOAuthBinding(config, { sessionKey: options.sessionKey, model: route.modelId });
                 } catch (error) {
                   if (error instanceof OAuthAccountPausedError || error instanceof OAuthLoginRequiredError
-                    || error instanceof AnthropicAccountCooldownError) throw error;
+                    || error instanceof AnthropicAccountCooldownError || error instanceof NativeOAuthModelRouteError) throw error;
                   throw new NativeOAuthSelectionChangedError();
                 }
                 rebuildFor(oauthProvider(oauthBinding));
@@ -500,15 +510,34 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
             const headers = new Headers(wire.headers);
             const encoding = new Headers(init.headers).get("accept-encoding");
             if (!headers.has("accept-encoding") && encoding) headers.set("accept-encoding", encoding);
-            if (init.signal?.aborted) throw init.signal.reason;
-            if (!spendTracker.charge()) throw new NativeMessagesSpendRefusal();
-            noteProviderAttemptSend(logCtx, route.providerName, activeProvider, logCtx.usageLogInputTokens, transportRecovery ?? recovery);
-            const dispatched = await sendWithConnectionPolicy(
-              (activeProvider as OcxProviderTransport).fetch ?? execute,
-              wire.url,
-              applyUpstreamRecoveryInit({ ...init, method: "POST", headers, body: wire.body }, transportRecovery),
-              { providerName: route.providerName, provider: activeProvider },
-            );
+            const snapshot = oauthBinding?.snapshot;
+            const providerAccountUuid = oauthBinding?.providerAccountUuid;
+            const writerGeneration = snapshot ? captureConfigGeneration() : 0;
+            const ownsBearer = snapshot && headers.get("authorization") === `Bearer ${snapshot.accessToken}` && !headers.has("x-api-key");
+            const releaseFamily = snapshot ? claimAnthropicFamilyRevalidation(snapshot.accountId, route.modelId) : () => {};
+            if (!releaseFamily) throw new AnthropicAccountCooldownError(1);
+            let dispatched: Response;
+            try {
+              if (init.signal?.aborted) throw init.signal.reason;
+              if (!spendTracker.charge()) throw new NativeMessagesSpendRefusal();
+              noteProviderAttemptSend(logCtx, route.providerName, activeProvider, logCtx.usageLogInputTokens, transportRecovery ?? recovery);
+              dispatched = await sendWithConnectionPolicy(
+                (activeProvider as OcxProviderTransport).fetch ?? execute,
+                wire.url,
+                applyUpstreamRecoveryInit({ ...init, method: "POST", headers, body: wire.body }, transportRecovery),
+                { providerName: route.providerName, provider: activeProvider },
+              );
+            } finally { releaseFamily(); }
+            if (ownsBearer && snapshot) {
+              try {
+                const current = getAccountCredentialWithStatus("anthropic", snapshot.accountId);
+                if (current && !current.needsReauth && credentialGeneration(current.credential) === snapshot.generation
+                  && current.credential.accountId === providerAccountUuid) {
+                  bindAnthropicRefusalCredential(dispatched, snapshot, providerAccountUuid);
+                  recordAnthropicAccountQuotaFromHeaders(snapshot.accountId, dispatched.headers, writerGeneration, dispatched.status, route.modelId);
+                }
+              } catch { /* Passive observation must not fail the response. */ }
+            }
             if (!dispatched.ok) await recordKeyAttemptFailure(logCtx, dispatched, init.signal ?? upstream.signal);
             return dispatched;
           },
@@ -544,7 +573,7 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
       rebuildFor(rotated);
       response = await send("key-401");
     }
-    const retryPolicy = rateLimitRetryPolicyFor(activeProvider);
+    const retryPolicy = oauthBinding ? undefined : rateLimitRetryPolicyFor(activeProvider);
     let retries = 0;
     // A refusal this proxy synthesized for a reset replay is not a provider rate limit.
     while (
@@ -577,6 +606,37 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
       rebuildFor(rotated);
       response = await send("key-429");
     }
+    const oauthRetryKey = {};
+    const triedAccountIds = new Set<string>();
+    let oauthFailovers = 0;
+    while (oauthBinding && (response.status === 429 || response.status === 403)) {
+      const sendingBinding = oauthBinding;
+      const expectedRecoverySelection = sendingBinding.selection;
+      triedAccountIds.add(sendingBinding.snapshot.accountId);
+      const nextAccountId = await rotateAnthropicAccountOnResponse(response, {
+        config, accountId: sendingBinding.snapshot.accountId, model: route.modelId,
+        sessionKey: sendingBinding.sessionKey, decision: sendingBinding.routeDecision,
+        excludedAccountIds: triedAccountIds,
+        currentDecision: () => {
+          const resolved = resolveAnthropicModelRoute(config, route.modelId);
+          if (resolved.error) throw new NativeOAuthModelRouteError(`Invalid Anthropic model routes: ${resolved.error}`);
+          return resolved.decision;
+        },
+        signal: upstream.signal, requestKey: oauthRetryKey,
+        canRetry: transientSendAvailable() && oauthFailovers < ANTHROPIC_POOL_MAX_FAILOVERS_PER_REQUEST,
+      });
+      if (!nextAccountId) break;
+      const recovery = response.status === 403 ? "oauth-account-403" : "rate-limit-429";
+      discard(response);
+      oauthBinding = await resolveNativeOAuthBinding(config, {
+        sessionKey: options.sessionKey, model: route.modelId, candidateAccountId: nextAccountId,
+        expectedRecoverySelection, expectedRecoveryRouteDecision: sendingBinding.routeDecision,
+      });
+      oauthFailovers++;
+      rebuildFor(oauthProvider(oauthBinding));
+      logCtx.provider = formatAnthropicProviderForLog(route.providerName, oauthBinding.snapshot.accountId, config);
+      response = await send(recovery);
+    }
   } catch (error) {
     releaseRetainedRequest();
     cleanupAbort();
@@ -591,6 +651,7 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
     const localRefusal = localOAuthFailure(sendError);
     if (localRefusal) return localRefusal;
     if (sendError instanceof NativeOAuthSelectionChangedError) return fail(409, sendError.message, "api_error");
+    if (sendError instanceof NativeOAuthModelRouteError) return fail(400, sendError.message, "invalid_request_error");
     if (sendError instanceof NativeOpaqueStateRefusal) {
       logCtx.errorCode = "unsupported_feature";
       return fail(400, sendError.message, "invalid_request_error", "unsupported_feature");
@@ -791,6 +852,7 @@ export function nativeMessagesCountBody(
   cc: OcxConfig["claudeCode"],
   body: Rec,
   rows: Pick<NativeMessagesSelector, "effortRow" | "fastRow">,
+  clientIdentity?: AnthropicClientIdentity,
 ): Rec | undefined {
   if (typeof body.model !== "string") return undefined;
   try {
@@ -812,7 +874,7 @@ export function nativeMessagesCountBody(
     };
     if (nativeMessagesDeclineReason(route, body, config, selector) !== undefined) return undefined;
     // The body without a credential: counting never resolves or refreshes an OAuth account.
-    return anthropicMessagesNativeWireBody(route.provider, route.modelId, body).wireBody;
+    return anthropicMessagesNativeWireBody(route.provider, route.modelId, body, { clientIdentity }).wireBody;
   } catch {
     return undefined;
   }

package/src/server/relay.ts

@@ -30,8 +30,9 @@ import {
   joinSseFrameBytes,
   MAX_CLIENT_SSE_FRAME_BYTES,
   SseFrameCountLimitError,
+  sseDelimiterLengthAt,
 } from "./sse-frame-buffer";
-import { replaceSseDataPayload, sseDataPayload } from "./sse-payload-rewrite";
+import { replaceSseDataPayload, splitSseBlock, sseDataPayload } from "./sse-payload-rewrite";
 import { createBoundedResponseLogBody } from "./response-log-body";
 import { clientWireLogOf } from "./inference/client-wire";
 import { recordClientWireRequestLog } from "./inference/client-wire-log";
@@ -355,10 +356,11 @@ export function createSseTerminalOutputBoundary(
     frames: ReturnType<BoundedSseFrameBuffer["feed"]>,
   ): Uint8Array => {
     if (disposed || terminal || frames.length === 0) return EMPTY_BYTES;
-    if (maxFrames !== undefined && frames.length > maxFrames - framesSeen) {
+    const completedFrames = frames.reduce((count, frame) => count + (frame.continuation ? 0 : 1), 0);
+    if (maxFrames !== undefined && completedFrames > maxFrames - framesSeen) {
       throw new SseFrameCountLimitError(maxFrames);
     }
-    framesSeen += frames.length;
+    framesSeen += completedFrames;
     const output: Uint8Array[] = [];
     const appendOutput = (...parts: Uint8Array[]): void => {
       for (const part of parts) {
@@ -596,17 +598,7 @@ export function relaySseWithFailedTail(
   });
 }
 
-export function nextSseBlock(buffer: string): { block: string; delimiter: string; rest: string } | null {
-  const match = buffer.match(/\r?\n\r?\n/);
-  if (!match || match.index === undefined) return null;
-  return {
-    block: buffer.slice(0, match.index),
-    delimiter: match[0],
-    rest: buffer.slice(match.index + match[0].length),
-  };
-}
-
-export { sseDataPayload } from "./sse-payload-rewrite";
+export { nextSseBlock, sseDataPayload } from "./sse-payload-rewrite";
 
 type JsonRecord = Record<string, unknown>;
 
@@ -698,9 +690,8 @@ function stripCodexSafetyBufferingField(block: string, parsed: unknown): string
 }
 
 function rewritePolicyTerminalBlock(block: string, payload: string): string {
-  const newline = block.includes("\r\n") ? "\r\n" : "\n";
   const rewritten = replaceSseDataPayload(block, payload);
-  const lines = rewritten.split(/\r?\n/);
+  const { newline, lines } = splitSseBlock(rewritten);
   let eventRewritten = false;
   const withEvent = lines.map(line => {
     if (!eventRewritten && line.startsWith("event:")) {
@@ -1156,31 +1147,6 @@ function outputBearingSseEvent(event: { type?: unknown; output_index?: unknown }
     .test(event.type);
 }
 
-function delimiterLengthAt(
-  index: number,
-  length: number,
-  byteAt: (index: number) => number,
-): number | 0 | undefined {
-  const first = byteAt(index);
-  if (first === 10) {
-    if (index + 1 >= length) return undefined;
-    const second = byteAt(index + 1);
-    if (second === 10) return 2;
-    if (second !== 13) return 0;
-    if (index + 2 >= length) return undefined;
-    return byteAt(index + 2) === 10 ? 3 : 0;
-  }
-  if (first !== 13) return 0;
-  if (index + 1 >= length) return undefined;
-  if (byteAt(index + 1) !== 10) return 0;
-  if (index + 2 >= length) return undefined;
-  const third = byteAt(index + 2);
-  if (third === 10) return 3;
-  if (third !== 13) return 0;
-  if (index + 3 >= length) return undefined;
-  return byteAt(index + 3) === 10 ? 4 : 0;
-}
-
 /**
  * Per-chunk SSE inspection state machine shared by consumeForInspection,
  * consumeForResponseLogMetadata, and the eager bounded relay (relay-eager.ts).
@@ -1202,6 +1168,7 @@ export function createSseInspector(handlers: SseInspectorHandlers): SseInspector
   let sawTerminal = false;
   let disposed = false;
   let delimiterTail: Uint8Array = EMPTY_BYTES;
+  let pendingLineFeed = false;
   let candidate: Uint8Array = EMPTY_BYTES;
   let candidateBytes = 0;
   let discardingOversizedFrame = false;
@@ -1228,6 +1195,7 @@ export function createSseInspector(handlers: SseInspectorHandlers): SseInspector
 
   const clearFrameState = (): void => {
     delimiterTail = EMPTY_BYTES;
+    pendingLineFeed = false;
     candidate = EMPTY_BYTES;
     candidateBytes = 0;
     discardingOversizedFrame = false;
@@ -1504,15 +1472,17 @@ export function createSseInspector(handlers: SseInspectorHandlers): SseInspector
         retainCandidateSlice(chunk.subarray(Math.max(0, start - tailLength), end - tailLength));
       }
     };
-    let index = 0;
-    let retainedThrough = 0;
+    let index = pendingLineFeed && byteAt(0) === 10 ? 1 : 0;
+    if (totalLength > 0) pendingLineFeed = false;
+    let retainedThrough = index;
     while (index < totalLength) {
-      const delimiterLength = delimiterLengthAt(index, totalLength, byteAt);
+      const delimiterLength = sseDelimiterLengthAt(index, totalLength, byteAt);
       if (delimiterLength === undefined) break;
       if (delimiterLength > 0) {
         retainRange(retainedThrough, index);
         completeCandidate();
         index += delimiterLength;
+        pendingLineFeed = index === totalLength && byteAt(index - 1) === 13;
         retainedThrough = index;
         continue;
       }

package/src/server/request-log-generation-window.ts

@@ -0,0 +1,38 @@
+import type { RequestLogContext } from "./request-log";
+
+/**
+ * Generation window for the decode-rate estimate (#4038, #6309).
+ *
+ * `firstOutputMs` marks the first VISIBLE output delta. For a reasoning model that is the end of
+ * the reasoning phase, yet `outputTokens` includes the reasoning tokens, so
+ * `outputTokens / (durationMs - firstOutputMs)` divides the whole output by only part of the time
+ * that produced it. The window recorded here starts when the model starts producing ANY output
+ * item (reasoning included) and ends at the last output delta, so trailing stream bookkeeping
+ * after the final token does not count either.
+ *
+ * Event vocabulary: Anthropic `content_block_start` / `content_block_delta`, and Responses
+ * `response.output_item.added` / `response.*.delta`. Anything else leaves the window untouched.
+ */
+export function recordGenerationEvent(logCtx: RequestLogContext, type: unknown, now = Date.now()): void {
+  if (typeof type !== "string" || !Number.isFinite(now)) return;
+  if (type === "content_block_start" || type === "response.output_item.added") {
+    logCtx.generationStartedAt ??= now;
+  } else if (type === "content_block_delta" || (type.startsWith("response.") && type.endsWith(".delta"))) {
+    logCtx.generationStartedAt ??= now;
+    logCtx.lastOutputAt = now;
+  }
+}
+
+/** Request-relative `genStartMs` / `lastOutputMs`, present only when both ends were observed. */
+export function generationWindowFields(
+  logCtx: Pick<RequestLogContext, "generationStartedAt" | "lastOutputAt">,
+  requestStartedAt: number,
+): { genStartMs?: number; lastOutputMs?: number } {
+  const startedAt = logCtx.generationStartedAt;
+  const lastAt = logCtx.lastOutputAt;
+  if (startedAt === undefined || lastAt === undefined || !Number.isFinite(requestStartedAt)) return {};
+  return {
+    genStartMs: Math.max(0, startedAt - requestStartedAt),
+    lastOutputMs: Math.max(0, lastAt - requestStartedAt),
+  };
+}

package/src/server/request-log.ts

@@ -85,6 +85,7 @@ import {
   normalizePersistedJevDecision,
   type PersistedJevDecisionV1,
 } from "../usage/jev-stats";
+import { generationWindowFields, recordGenerationEvent } from "./request-log-generation-window";
 import type { RequestMetricsRecorder } from "./request-metrics";
 import type {
   CacheDiagnosticDraft,
@@ -136,6 +137,9 @@ export interface RequestLogContext {
   affinityMoveReasons?: CodexAffinityReason[];
   /** TTFT: ms from request start to the first non-empty model output delta (WP4, devlog 040). */
   firstOutputMs?: number;
+  /** Epoch ms of the first output item and of the last output delta; see request-log-generation-window.ts. */
+  generationStartedAt?: number;
+  lastOutputAt?: number;
   /** Best-effort chat/session correlation for Logs grouping (#330). Opaque; omit when unknown. */
   conversationId?: string;
   surface?: "claude" | "claude-desktop" | "grok";
@@ -282,6 +286,9 @@ export interface RequestLogEntry {
   provider: string;
   /** TTFT: ms from request start to the first non-empty model output delta; unset for non-streaming/tool-only. */
   firstOutputMs?: number;
+  /** Request-relative generation window (#6309): first output item of any kind, then the last output delta. */
+  genStartMs?: number;
+  lastOutputMs?: number;
   surface?: "claude" | "claude-desktop" | "grok";
   /**
    * Set when the proxy answered this turn locally and sent nothing upstream. Without it a zero-send
@@ -453,6 +460,8 @@ export function requestLogEntryFromPersistedUsage(entry: PersistedUsageEntry): R
     model: entry.model,
     provider: entry.provider,
     ...(entry.firstOutputMs !== undefined ? { firstOutputMs: entry.firstOutputMs } : {}),
+    ...(entry.genStartMs !== undefined ? { genStartMs: entry.genStartMs } : {}),
+    ...(entry.lastOutputMs !== undefined ? { lastOutputMs: entry.lastOutputMs } : {}),
     ...(isKnownUsageSurface(entry.surface) ? { surface: entry.surface } : {}),
     ...(entry.conversationId ? { conversationId: entry.conversationId } : {}),
     ...(isCodexUsageAccountLogLabel(entry.accountLogLabel)
@@ -668,6 +677,8 @@ export function addRequestLog(entry: RequestLogEntry) {
       status: entry.status,
       durationMs: entry.durationMs,
       ...(entry.firstOutputMs !== undefined ? { firstOutputMs: entry.firstOutputMs } : {}),
+      ...(entry.genStartMs !== undefined ? { genStartMs: entry.genStartMs } : {}),
+      ...(entry.lastOutputMs !== undefined ? { lastOutputMs: entry.lastOutputMs } : {}),
       usageStatus: entry.usageStatus,
       ...(entry.usage ? { usage: entry.usage } : {}),
       ...(entry.totalTokens !== undefined ? { totalTokens: entry.totalTokens } : {}),
@@ -1056,6 +1067,7 @@ export function inspectResponseLogSsePayloadParsed(
   if (!payload || payload.trim() === "[DONE]") return;
   const debugEnabled = isUsageDebugEnabled();
   const sseAlreadyMarked = logCtx.usageDebugBodyKind === "sse";
+  if (parsed !== undefined) recordGenerationEvent(logCtx, (parsed as { type?: unknown } | null)?.type);
   if (parsed !== undefined) applyResponseLogMetadata(logCtx, parsed);
   else logCtx.activeTierMetadata?.markResponseUnparseable();
   captureUpstreamErrorParsed(logCtx, payload, parsed);
@@ -1571,6 +1583,7 @@ export function addFinalRequestLog(
     status: effectiveStatus,
     durationMs,
     ...(logCtx.firstOutputMs !== undefined ? { firstOutputMs: logCtx.firstOutputMs } : {}),
+    ...generationWindowFields(logCtx, start),
     ...(errorCode ? { errorCode } : {}),
     ...(meta?.terminalStatus ? { terminalStatus: meta.terminalStatus } : {}),
     ...(closeReason ? { closeReason } : {}),