@bitkyc08/opencodex 2.76.0 → 2.78.0-preview.20261005

package/src/server/responses/core-combo-native.ts

@@ -34,6 +34,7 @@ import {
 import { captureRouteStaticPolicy, routeConcreteModel } from "../../router";
 import { comboDefaultEffort, concreteComboRequestBody, getCombo } from "../../combos";
 import { supportedLadderFor } from "../effort-policy";
+import { applyDroidReasoningDefault } from "../droid-reasoning-default";
 import { resolveWireProtocolOverride } from "../adapter-resolve";
 import { resolveOpenCodeGoTransport } from "../../providers/opencode-go-transport";
 import { getOrAllocateRequestSessionLane } from "../request-log-conversation";
@@ -105,10 +106,11 @@ export function createComboProtocolLanes(input: {
   config: OcxConfig;
   logCtx: RequestLogContext;
   admission: DataPlaneAdmission | undefined;
+  droidDefaultEffort?: string;
   comboId: string;
   targets: readonly ComboTarget[];
 }): ComboProtocolLanes | undefined {
-  const { source, req, config, logCtx, admission, comboId, targets } = input;
+  const { source, req, config, logCtx, admission, droidDefaultEffort, comboId, targets } = input;
   if (!source) return undefined;
   const envelope = source.envelope;
   const reject = resolveProtocolSettings(config).unrepresentable === "reject";
@@ -207,6 +209,10 @@ export function createComboProtocolLanes(input: {
       const route = settle(target, targetRoute);
       const body = nativeBody(target, route);
       if (!route || !body) return undefined;
+      applyDroidReasoningDefault(body, droidDefaultEffort, {
+        provider: targetRoute.provider,
+        modelId: targetRoute.modelId,
+      });
       applyComboEffort(body, config, comboId, target, targetRoute);
       return { route, body, sendBudget: targetSendBudget };
     },

package/src/server/responses/core-combo.ts

@@ -1,8 +1,10 @@
+import type { CodexAccountModelRefusal } from "../../combos/failover";
 import {
   isCodexReasoningEffort,
   isDeclaredReasoningEffort,
   resolveEffortAtOrBelow,
 } from "../../reasoning-effort";
+import { resolveAdmissionModelScope, routeAllowedByScope } from "../admission-model-scope";
 import { recordAttemptRequestedEffort } from "../request-log";
 import {
   CODEX_TEXT_GUARDED_BUDGET_POLICY,
@@ -26,6 +28,7 @@ import {
   concreteComboRequestBody,
   comboDefaultEffort,
   isComboTargetInCooldown,
+  snapshotComboQuotaCooldowns,
   noteComboSuccess,
   comboFailureDecision,
   advanceComboAfterFailure,
@@ -65,9 +68,12 @@ import {
   recoverEncryptedAgentTaskWithResult,
 } from "./agent-task-recovery";
 import { isThreadSpawnRequest, supportedLadderFor } from "../effort-policy";
+import { applyDroidResponsesReasoningDefault } from "../droid-reasoning-default";
+import { isPlainObject } from "../../lib/plain-data";
 import {
   clientCancelledResponse,
   comboUnavailable,
+  comboUnavailableResponse,
   targetIncompatibleResponse,
   unreadableEncryptedAgentTaskResponse,
 } from "./core-errors";
@@ -327,6 +333,7 @@ export async function executeComboResponses(
     config,
     logCtx,
     admission: options.admission,
+    droidDefaultEffort: options.droidDefaultEffort,
     comboId,
     targets: combo.targets,
   });
@@ -407,8 +414,8 @@ export async function executeComboResponses(
     }
   };
   const adoptFailedChildLog = (childLog: RequestLogContext): void => {
-    // Attempts remain the complete physical history; the logical row mirrors the most recent
-    // failed target so an exhausted combo still has useful top-level reasoning diagnostics.
+    // Attempts remain the complete physical history; the logical row mirrors the failed
+    // target whose response is returned, including an earlier quota refusal on exhaustion.
     Object.assign(logCtx, childLog, {
       requestedModel,
       model: requestedModel,
@@ -572,6 +579,9 @@ export async function executeComboResponses(
         candidates: choices.map(choice => choice.candidate),
         fallback,
         config,
+        isDestinationAllowed: (providerName, modelId) => routeAllowedByScope(
+          resolveAdmissionModelScope(config, options.admission), { providerName, modelId },
+        ),
         ...(combo.decisionProvider ? { decisionProvider: combo.decisionProvider } : {}),
         ...(combo.decisionModel
           ? {
@@ -668,6 +678,41 @@ export async function executeComboResponses(
   // is gone, so carry the loop's own classification decision instead of re-deriving a
   // weaker one from the status alone (#4149).
   let lastFailureClassifiesOverflow = false;
+  // The first quota/rate-limit refusal of the ladder. A fallback that then refuses its own
+  // credential or plan (401/403, or a 400 the ladder hopped past) says nothing about why the
+  // request failed: the primary target ran out. Returning that fallback refusal told clients
+  // "OpenAI account pool has no usable account credential" while every Claude account was spent.
+  let quotaFailure: Response | undefined;
+  let quotaFailedChildLog: RequestLogContext | undefined;
+  // Snapshotted before dispatch: a 401/403 inside this ladder cools its own provider, and that
+  // fresh cooldown is not a reason the request found no target.
+  const quotaCooldownSnapshot = snapshotComboQuotaCooldowns(config, comboId);
+  const exhaustedFailure = (): Response => {
+    const returnsQuota = lastFailure && [400, 401, 403].includes(lastFailure.status) && quotaFailure;
+    const failedChildLog = returnsQuota ? quotaFailedChildLog : lastFailedChildLog;
+    if (failedChildLog) adoptFailedChildLog(failedChildLog);
+    if (!lastFailure || ![400, 401, 403].includes(lastFailure.status)) return lastFailure!;
+    if (quotaFailure) return quotaFailure;
+    // The quota-refused target was cooled before this request picked, so the ladder never saw
+    // its refusal. The cooldown, with its Retry-After, is still the honest answer.
+    let quotaCooldownUntil: number | undefined;
+    const now = Date.now();
+    for (const { target, cooldownUntil } of quotaCooldownSnapshot) {
+      if (cooldownUntil <= now) continue;
+      try {
+        if (!targetEligible(target)) continue;
+      } catch {
+        // An eligibility check can exhaust the translator budget; it is not quota evidence.
+        continue;
+      }
+      quotaCooldownUntil = Math.min(quotaCooldownUntil ?? cooldownUntil, cooldownUntil);
+    }
+    const remainingQuotaCooldownMs = quotaCooldownUntil === undefined ? 0 : quotaCooldownUntil - Date.now();
+    return remainingQuotaCooldownMs > 0
+      ? comboUnavailableResponse(`No available targets for combo: ${comboId}`, {
+        retryAfter: String(Math.max(1, Math.ceil(remainingQuotaCooldownMs / 1000))),
+      }) : lastFailure;
+  };
   while (pick) {
     if (options.abortSignal?.aborted) return clientCancelledResponse();
     const firstComboTarget = comboTargetsDispatched === 0;
@@ -690,8 +735,7 @@ export async function executeComboResponses(
       // return the last real upstream answer with its status, headers and any quota body
       // intact rather than to mint a synthetic error, and a later target only exists because
       // an earlier one already recorded one.
-      if (lastFailedChildLog) adoptFailedChildLog(lastFailedChildLog);
-      return lastFailure!;
+      return exhaustedFailure();
     }
     const targetSendBudget = comboSendScope
       ? comboTargetSendBudget(comboSendScope, combo.targets.length - 1 - comboTargetsDispatched)
@@ -709,8 +753,13 @@ export async function executeComboResponses(
       modelId: targetRoute.modelId,
     });
     const initialJevDecision = firstComboTarget ? jevDecision : undefined;
+    const childInput = options.droidDefaultEffort && isPlainObject(body) ? { ...body } : body;
+    applyDroidResponsesReasoningDefault(childInput, options.droidDefaultEffort, {
+      provider: targetRoute.provider,
+      modelId: targetRoute.modelId,
+    });
     const childBody = concreteComboRequestBody(
-      body,
+      childInput,
       pick.target,
       initialJevDecision ? initialJevDecision.effort : comboDefaultEffort(config, comboId),
       initialJevDecision?.effort === null ? [] : targetReasoningEfforts,
@@ -773,6 +822,7 @@ export async function executeComboResponses(
     const completedTarget = { provider: pick.target.provider, model: pick.target.model };
     const writerGeneration = pick.writerGeneration;
     let consumedChildFailure: ConsumedComboFailure | undefined;
+    let preflightModelRefusal: CodexAccountModelRefusal | undefined;
     const callbackGate = createChildPassthroughCallbackGate({
       ...options,
       onResponseComplete: model => {
@@ -895,6 +945,7 @@ export async function executeComboResponses(
         callbackGate.discard();
         terminalRecorder?.("failed", preflight.response.status);
         response = preflight.response;
+        preflightModelRefusal = preflight.codexModelRefusal;
       } else {
         response = preflight.response;
         if (nativePassthrough) markNativePassthroughSseResponse(response);
@@ -937,6 +988,7 @@ export async function executeComboResponses(
     try {
       failure = consumedChildFailure
         ?? await consumeComboFailure(response, options.abortSignal);
+      if (preflightModelRefusal !== undefined) failure = { ...failure, codexModelRefusal: preflightModelRefusal };
     } catch (error) {
       if (options.abortSignal?.aborted) {
         retainCancelledAttempt();
@@ -963,6 +1015,10 @@ export async function executeComboResponses(
     );
     attemptRetained = true;
     lastFailure = failure.response;
+    if (!quotaFailure && (lastFailure.status === 429 || lastFailure.status === 402)) {
+      quotaFailure = lastFailure;
+      quotaFailedChildLog = childLog;
+    }
     lastFailedChildLog = childLog;
     // A replacement that answers 200 is unmarked, and its zero-output failure only exists once
     // preflight has rebuilt the stream as a fresh Response. A spent grant never hops: a status the
@@ -981,6 +1037,7 @@ export async function executeComboResponses(
       ? "stop"
       : comboFailureDecision(failure.response.status, failure.classificationText, {
         code: failure.upstreamCode,
+        codexModelRefusal: failure.codexModelRefusal,
       });
     const wantsStream = (rawBody as { stream?: unknown } | null)?.stream === true;
     // Local byte admission has its own diagnostic; do not relabel it as an upstream refusal.
@@ -1124,9 +1181,9 @@ export async function executeComboResponses(
       }
       // Waiting or recovery may have observed cancellation after the check above.
       if (options.abortSignal?.aborted) return clientCancelledResponse();
-      adoptFailedChildLog(childLog);
     }
   }
+  const failure = exhaustedFailure();
   if (
     lastFailure?.status === 413
     && lastFailureClassifiesOverflow
@@ -1135,5 +1192,5 @@ export async function executeComboResponses(
       ? streamingContextOverflowResponse(requestedModel, options.translatorBudget)
       : jsonContextOverflowResponse();
   }
-  return lastFailure!;
+  return failure;
 }

package/src/server/responses/core-normalize.ts

@@ -38,6 +38,7 @@ import { isInjectionDebugEnabled } from "../../lib/debug-settings";
 import { injectionDebugLog } from "../../lib/injection-debug-log";
 import { recordAttemptRequestedEffort } from "../request-log";
 import type { ResolvedFastPolicy } from "../../providers/fastwire";
+import { applyDroidResponsesReasoningDefault } from "../droid-reasoning-default";
 import { applyXaiOauthFastModel, xaiOauthFastModelForDecision } from "../../providers/xai-fast-model";
 
 /** Preview the billed xAI lane without mutating request state or resolving credentials. */
@@ -140,9 +141,15 @@ export async function applyFinalRouteRequestNormalization(args: {
   inboundWire: InboundWire;
   inboundTransport?: "websocket";
   claudeGoAffinity?: HandleResponsesOptions["claudeGoAffinity"];
+  droidDefaultEffort?: HandleResponsesOptions["droidDefaultEffort"];
 }): Promise<void> {
   const { parsed, route, config, req, logCtx, inboundWire, inboundTransport } = args;
   const effortSelector = prepareEffortNormalization(parsed, route);
+  if (applyDroidResponsesReasoningDefault(
+    parsed._rawBody,
+    args.droidDefaultEffort,
+    { provider: route.provider, modelId: route.modelId },
+  )) parsed.options.reasoning = args.droidDefaultEffort;
 
   // Only Anthropic message routes retain the Codex-facing selector. Other providers must keep
   // their existing response.model contract even when their public and wire model ids differ.

package/src/server/responses/core-options.ts

@@ -1,3 +1,4 @@
+import type { CodexAccountModelRefusal } from "../../combos/failover";
 import type { NativeResponseControl } from "./native-response-control";
 import type { AdapterEvent, OcxUsage, OcxProviderContinuationState, OcxConfig } from "../../types";
 import type { RouteResult } from "../../router";
@@ -24,6 +25,8 @@ import type { PolicyRequestScope } from "./policy-request-scope";
 export interface ConsumedComboFailure {
   response: Response;
   classificationText: string;
+  /** Complete bounded-envelope evidence captured before display truncation; never serialized. */
+  codexModelRefusal?: CodexAccountModelRefusal;
   /** Structured upstream `error.code` when present in the failure body. */
   upstreamCode?: string;
   /** Complete structured provider type, retained for conservative recovery classification. */
@@ -131,6 +134,8 @@ export interface HandleResponsesOptions {
    * it. Omitted means a genuine Responses inbound.
    */
   inboundWire?: InboundWire;
+  /** Droid's per-request effort default; each concrete combo or policy target applies it only if its ladder allows it. */
+  droidDefaultEffort?: string;
   /** PF-07: the Chat source a combo child may send natively; set only by the Chat ingress. */
   protocolSource?: import("./core-combo-native").ComboProtocolSource;
   /** Internal transport identity for route-scoped upstream compatibility policy. */

package/src/server/responses/fetch-helpers.ts

@@ -192,8 +192,17 @@ export function sendWithConnectionPolicy(
   const egressInit = redirectedToLoopback
     ? { proxy: false as const }
     : decide ? providerEgressSendInit(egress, physicalFetch, input) : {};
+  // Bun can reset large native Codex string uploads before receiving headers while
+  // the identical UTF-8 buffer succeeds. Convert only at the final HTTP send so
+  // WebSocket selection still sees the serialized string and no retry is added.
+  const target = input instanceof Request ? input.url : String(input);
+  const body = init?.body;
+  const largeCodexBody = typeof body === "string"
+    && /^https:\/\/chatgpt\.com\/backend-api\/codex\/responses(?:\/compact)?$/.test(target)
+    && Buffer.byteLength(body, "utf8") >= 1024 * 1024;
   return physicalFetch(input, {
     ...init,
+    ...(largeCodexBody ? { body: Buffer.from(body, "utf8") } : {}),
     headers,
     redirect: "manual",
     ...(fresh ? { keepalive: false } : {}),

package/src/server/responses/passthrough-delivery.ts

@@ -1329,7 +1329,7 @@ export async function deliverPassthroughResponse(
           clientJson = imageDisplay.json(clientJson);
         } catch (error) {
           if (error instanceof RangeError) {
-            return formatErrorResponse(502, "upstream_error", "hosted image result count exceeds local display limit");
+            return formatErrorResponse(502, "upstream_error", "hosted image result exceeds local display limits");
           }
           throw error;
         } finally { imageDisplay.dispose?.(); }

package/src/server/responses/policy-fallback.ts

@@ -111,7 +111,7 @@ async function shouldHopPolicyCandidate(response: Response, signal?: AbortSignal
   if (isPolicyCandidateRefusal(response)) return true;
   try {
     const inspected = await readBoundedResponseBody(response.clone(), { signal });
-    const text = inspected.displaySafe ? inspected.text : "";
+    const text = inspected.displaySafe && !inspected.truncated ? inspected.text : "";
     return comboFailureDecision(response.status, text, { code: errorCodeFromText(text) }) === "hop";
   } catch {
     return false;

package/src/server/responses/request-prepare.ts

@@ -676,6 +676,7 @@ export async function prepareResponsesRequest(
     route,
     options,
     credentialDomainWasRewritten,
+    config,
   );
   // Does the CALLER own the credential this request will authenticate with? Validated exactly
   // the way final auth validates it: the route ownership predicate AND the caller-bearer check
@@ -736,6 +737,7 @@ export async function prepareResponsesRequest(
     // recovery or a profile drain fences the physical identity, final auth drops main and preview
     // has to drop it too. A hardcoded `true` would be wrong in the second case and `false` in
     // the first.
+    requestOwnedMainCredential: previewRequestScopedMainCredential,
     isMainAccountTokenLive: previewRequestScopedMainCredential
       ? () => previewRequestOwnedMainCredentialLive
       : undefined,
@@ -962,6 +964,7 @@ export async function prepareResponsesRequest(
                 route,
                 options,
                 credentialDomainWasRewritten,
+                config,
               );
               const recoveryRequestScopedMainCredential = codexRouteCredentialOwnership(
                 recoveryAuthHeaders,
@@ -993,6 +996,7 @@ export async function prepareResponsesRequest(
               const recoverySelectionOptions = {
                 nativeMainSelectionOnly: !recoveryNativeMainBlocked
                   && recoverySelectionAdmission?.mainProfileDraining === true,
+                requestOwnedMainCredential: recoveryRequestScopedMainCredential,
                 isMainAccountTokenLive: recoveryRequestScopedMainCredential
                   ? () => recoveryRequestOwnedMainCredentialLive
                   : undefined,
@@ -1222,6 +1226,7 @@ export async function prepareResponsesRequest(
     inboundWire,
     inboundTransport: options.inboundTransport,
     claudeGoAffinity: options.claudeGoAffinity,
+    droidDefaultEffort: options.droidDefaultEffort,
   });
   try {
     assertPolicyNormalizedRoute(policyScope, admittedPolicyRoute, route);

package/src/server/responses/request-spend.ts

@@ -1,9 +1,9 @@
 import { randomUUID } from "node:crypto";
 import type { RequestSendObserver } from "../../lib/request-execution-budget";
-import { sharedSpendLedger, type SpendReservationLedger } from "../../lib/spend-reservation-ledger";
+import { sharedSpendLedger, type SpendReservationLedger, type SpendScopes } from "../../lib/spend-reservation-ledger";
 import { SpendLedgerOwnerError } from "../../lib/spend-ledger-owner";
 import { markLocalRequestLogRefusal, type RequestLogContext } from "../request-log";
-import { recordWorkflowRefusalEvent, workflowDenialSummary } from "../../lib/workflow-budget";
+import { recordWorkflowRefusalEvent, workflowDenialSummary, type WorkflowDenial } from "../../lib/workflow-budget";
 
 /** The terminal usage a request reported, in the only two fields the ledger books. */
 export interface TerminalSpendUsage {
@@ -81,44 +81,44 @@ export function createRequestSpendTracker(
       // short of its limit forever and refuse nothing.
       const alreadySent = options?.alreadySent === true;
       const sendId = randomUUID();
-      const decision = ledger().reserve({
+      const bookedLedger = ledger();
+      const scopes: SpendScopes = {
+        ...(rootId !== undefined ? { rootId } : {}),
+        // The existing privacy-safe log label is aliased again by the ledger.
+        ...(logCtx.accountLogLabel !== undefined ? { identityId: logCtx.accountLogLabel } : {}),
+        ...(logCtx.provider !== undefined ? { poolId: logCtx.provider } : {}),
+      };
+      const policy = bookedLedger.policy;
+      const enforced = (scopes.rootId !== undefined && policy.root.maxTokens !== undefined)
+        || (scopes.identityId !== undefined && policy.identity.maxTokens !== undefined)
+        || (scopes.poolId !== undefined && policy.pool.maxTokens !== undefined);
+      const decision = bookedLedger.reserve({
         sendId,
-        scopes: {
-          ...(rootId !== undefined ? { rootId } : {}),
-          // Already the privacy-safe label the request log uses, and the ledger aliases it
-          // again on the way to disk. A raw credential never reaches either.
-          ...(logCtx.accountLogLabel !== undefined ? { identityId: logCtx.accountLogLabel } : {}),
-          ...(logCtx.provider !== undefined ? { poolId: logCtx.provider } : {}),
-        },
+        scopes,
         inputTokens: logCtx.spendInputEstimateTokens ?? logCtx.usageLogInputTokens ?? 0,
         outputCeilingTokens: logCtx.spendOutputCeilingTokens ?? 0,
         ...(alreadySent ? { alreadySent: true } : {}),
       });
       if (!decision.reserved) {
+        // An applicable ceiling cannot authorize an unbooked send, including when tracking
+        // capacity is full. Unconfigured/nonapplicable requests remain observe-only, and a
+        // physical send reported after dispatch cannot be refused retroactively.
+        if (alreadySent || !enforced) return true;
         refusals += 1;
         const denial = decision.denial;
-        // A ceiling refuses, and so does a ledger that cannot make the reservation durable
-        // under one. That second case is the whole reason this store is on disk: admitting a
-        // send whose record a restart would forget is how an exhausted budget comes back with
-        // a fresh allowance, and the ledger raises those two denials ONLY when a limit is
-        // configured -- so an install that configured nothing is still never refused here.
-        // Capacity and a duplicate send id stay permissive: they say the ledger cannot account
-        // for this send, which is a degradation to report, not an outage to cause.
-        if (denial.reason === "reserve-not-durable" || denial.reason === "journal-corrupt") {
-          return alreadySent;
-        }
-        if (denial.reason !== "spend-limit-exceeded") return true;
-        // This send is refused, and the dispatch path that asked will report an exhausted send
-        // budget -- from there, that is all it can see. The row is where an operator actually
-        // looks, so the ceiling is named on it here: a locally assigned code wins in
-        // addFinalRequestLog, so the request that CROSSED the ceiling reads as a spend refusal
-        // rather than as the ordinary budget exhaustion it would otherwise be indistinguishable
-        // from. The event ring gets the same pair so /api/workflow-budget agrees with the row.
-        const detail = { scope: denial.scope, limit: denial.limit, projected: denial.projected };
-        const summary = workflowDenialSummary("workflow-spend-exhausted", detail);
+        const reason: WorkflowDenial = denial.reason === "duplicate-send-id"
+          ? "workflow-send-replayed"
+          : denial.reason === "reserve-not-durable" || denial.reason === "journal-corrupt"
+            ? "workflow-spend-undurable"
+            : denial.reason === "tracking-capacity-exhausted"
+              ? "workflow-tracking-exhausted"
+              : "workflow-spend-exhausted";
+        const detail = denial.reason === "spend-limit-exceeded"
+          ? { scope: denial.scope, limit: denial.limit, projected: denial.projected } : undefined;
+        const summary = workflowDenialSummary(reason, detail);
         markLocalRequestLogRefusal(logCtx, summary.code);
         logCtx.errorCode = summary.code;
-        recordWorkflowRefusalEvent(rootId, "workflow-spend-exhausted", Date.now(), detail);
+        recordWorkflowRefusalEvent(rootId, reason, Date.now(), detail);
         return false;
       }
       live.push(sendId);

package/src/server/responses-custom-tool-repair.ts

@@ -13,6 +13,7 @@ import {
 } from "../responses/custom-tool-compat";
 import {
   replaceSseDataPayload,
+  splitSseBlock,
   sseDataPayload,
   type SseBlockRewrite,
 } from "./sse-payload-rewrite";
@@ -22,8 +23,7 @@ function isPlainObject(value: unknown): value is Record<string, unknown> {
 }
 
 function replaceSseEventName(block: string, type: string): string {
-  const newline = block.includes("\r\n") ? "\r\n" : "\n";
-  const lines = block.split(/\r?\n/);
+  const { newline, lines } = splitSseBlock(block);
   let replaced = false;
   const next = lines.map(line => {
     if (!replaced && line.startsWith("event:")) {

package/src/server/responses-hosted-image-display.ts

@@ -2,6 +2,8 @@ import { mkdirSync, writeFileSync, unlinkSync } from "node:fs";
 import { createHash, randomUUID } from "node:crypto";
 import { join, posix } from "node:path";
 import { getConfigDir } from "../config";
+import { jsonUtf8Bytes } from "../lib/json-byte-size";
+import { TRANSLATOR_MAX_TURN_BYTES } from "../lib/translator-budget";
 import { recordOwnedConfigPath } from "../lib/config-ownership";
 import {
   chargeImageBudget, createImageBudget, decodeValidatedImageBase64,
@@ -12,6 +14,16 @@ import { sseDataPayload, replaceSseDataPayload, type SseBlockRewrite } from "./s
 type Row = Record<string, any>;
 const object = (v: unknown): v is Row => !!v && typeof v === "object" && !Array.isArray(v);
 const originators = new Set(["codex_cli_rs", "Codex Desktop", "codex_app", "codex_work_desktop"]);
+const MAX_DISPLAY_ITEMS = 128;
+const MAX_ITEM_METADATA_BYTES = 64 * 1024;
+const MAX_RETAINED_METADATA_BYTES = 1024 * 1024;
+const displayKey = (item: Row, index: number) => typeof item.id === "string" ? "id:" + item.id : "index:" + index;
+
+function displayBytes(value: unknown, limit: number): number {
+  try { return jsonUtf8Bytes(value, limit); }
+  catch { throw new RangeError("hosted image result exceeds local display limits"); }
+}
+
 const generatedName = /^img-codex-[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\.(png|jpg|webp|gif)$/;
 
 /** One spelling per local path: file URL or plain, either separator, dot segments, folded case. */
@@ -71,13 +83,20 @@ export function createHostedImageDisplayRewrite(): SseBlockRewrite & { json(text
   const states = new Map<string, { message: Row; added: boolean; done: boolean }>();
   let extraSequence = 0;
   let wroteArtifact = false;
+  let retainedMetadataBytes = 0;
 
   function stateFor(item: Row, index: number) {
-    const key = typeof item.id === "string" ? item.id : "index:" + index;
+    // Validate every occurrence, including repeats whose state is already complete.
+    const metadataBytes = displayBytes({ id: item.id,
+      metadata: item.internal_chat_message_metadata_passthrough }, MAX_ITEM_METADATA_BYTES);
+    const key = displayKey(item, index);
     let state = states.get(key);
     if (state) return state;
-    // Bound metadata independently of the existing 100 MiB decoded-image budget.
-    if (states.size >= 128) throw new RangeError("hosted image result count exceeds local display limit");
+    if (states.size >= MAX_DISPLAY_ITEMS) throw new RangeError("hosted image result count exceeds local display limit");
+    if (metadataBytes > MAX_RETAINED_METADATA_BYTES - retainedMetadataBytes) {
+      throw new RangeError("hosted image result exceeds local display limits");
+    }
+    retainedMetadataBytes += metadataBytes;
     const id = "msg_ocx_img_" + createHash("sha256").update(key).digest("hex").slice(0, 32);
     state = { added: false, done: false, message: {
       // Persist image results outside the client's collapsible progress messages.
@@ -147,15 +166,51 @@ export function createHostedImageDisplayRewrite(): SseBlockRewrite & { json(text
     return events;
   }
 
-  function snapshot(response: Row, terminal: boolean, events?: Row[]): Row {
+  function projectedMessage(message: Row): Row {
+    if (message.status !== "in_progress") return message;
+    // Longest possible local filename and JSON text size, without decoding or writing an image.
+    const pathText = "![Generated image](<" + join(getArtifactsDir(), "img-codex-" + "0".repeat(36) + ".webp") + ">)";
+    const fallback = "The completed image result has no supported image data for local display.";
+    const text = displayBytes(pathText, TRANSLATOR_MAX_TURN_BYTES) > displayBytes(fallback, TRANSLATOR_MAX_TURN_BYTES)
+      ? pathText : fallback;
+    return { ...message, status: "incomplete", content: [{ type: "output_text", text, annotations: [] }] };
+  }
+
+  function lifecycleBytes(message: Row): number {
+    // At most two item copies and four text copies, plus fixed event fields, ids and numeric indices.
+    return 2 * displayBytes(message, TRANSLATOR_MAX_TURN_BYTES)
+      + 4 * displayBytes(message.content[0].text, TRANSLATOR_MAX_TURN_BYTES) + 2048;
+  }
+
+  function snapshot(response: Row, terminal: boolean, events?: Row[], envelope?: Row): Row {
     if (!Array.isArray(response.output)) return response;
-    // Reject oversized snapshots before saving artifacts that cannot be delivered.
-    const keys = new Set(states.keys());
+    // Preflight the complete snapshot before any artifact writes or expanded serialization.
+    const keys = new Set<string>();
+    const ids = new Set<string>();
     for (const [index, item] of response.output.entries()) {
       if (!object(item) || item.type !== "image_generation_call") continue;
-      keys.add(typeof item.id === "string" ? item.id : "index:" + index);
-      if (keys.size > 128) throw new RangeError("hosted image result count exceeds local display limit");
+      const key = displayKey(item, index);
+      if (keys.has(key)) throw new RangeError("duplicate hosted image identity in local display snapshot");
+      keys.add(key);
+      if (typeof item.id === "string") ids.add(item.id);
+      stateFor(item, index);
+    }
+    if (keys.size === 0) return response;
+    const seen = new Set<string>();
+    for (const item of response.output) {
+      if (!object(item) || !ids.has(item.id)) continue;
+      if (seen.has(item.id)) throw new RangeError("conflicting hosted image identity in local display snapshot");
+      seen.add(item.id);
     }
+    let extraBytes = 32; // Sequence-number growth on a rewritten SSE envelope.
+    const preview = { ...response, output: response.output.map((item: unknown, index: number) => {
+      if (!object(item) || item.type !== "image_generation_call") return item;
+      const state = stateFor(item, index);
+      const message = terminal ? projectedMessage(state.message) : state.message;
+      if (events && terminal && !state.done) extraBytes += lifecycleBytes(message);
+      return message;
+    }) };
+    displayBytes(envelope ? { ...envelope, response: preview } : preview, TRANSLATOR_MAX_TURN_BYTES - extraBytes);
     let changed = false;
     const output = response.output.map((item: unknown, index: number) => {
       if (!object(item) || item.type !== "image_generation_call") return item;
@@ -182,9 +237,14 @@ export function createHostedImageDisplayRewrite(): SseBlockRewrite & { json(text
       && (hasIndex || typeof event.item.id === "string")) {
       if (event.type === "response.output_item.added") {
         const state = stateFor(event.item, index);
+        if (!state.added) displayBytes({ ...event, item: state.message }, TRANSLATOR_MAX_TURN_BYTES - 32);
         result = state.added ? [] : [{ ...event, item: state.message }];
         state.added = true;
       } else if (event.type === "response.output_item.done") {
+        const state = stateFor(event.item, index);
+        if (!state.done && lifecycleBytes(projectedMessage(state.message)) > TRANSLATOR_MAX_TURN_BYTES) {
+          throw new RangeError("hosted image result exceeds local display limits");
+        }
         result = doneEvents(event.item, index);
       }
     } else if (typeof event.type === "string" && event.type.startsWith("response.image_generation_call.")) {
@@ -193,7 +253,7 @@ export function createHostedImageDisplayRewrite(): SseBlockRewrite & { json(text
     } else if (object(event.response)) {
       const terminal = ["response.completed", "response.incomplete", "response.failed"].includes(event.type);
       const injected: Row[] = [];
-      const response = snapshot(event.response, terminal, injected);
+      const response = snapshot(event.response, terminal, injected, event);
       if (response !== event.response) result = [...injected, { ...event, response }];
     }
     const sequence = Number.isSafeInteger(event.sequence_number) ? event.sequence_number + extraSequence : undefined;
@@ -216,6 +276,7 @@ export function createHostedImageDisplayRewrite(): SseBlockRewrite & { json(text
   };
   rewrite.dispose = () => {
     states.clear();
+    retainedMetadataBytes = 0;
     if (wroteArtifact) {
       wroteArtifact = false;
       pruneArtifacts();

package/src/server/responses-terminal-repair.ts

@@ -91,6 +91,7 @@ export function relayResponsesSseWithTerminalRepair(
   let maxSequence = -1;
   let buffer = "";
   let bufferBytes = 0;
+  let pendingLineFeed = false;
   let timer: unknown;
   let timerGeneration = 0;
   let realTerminalSeen = false;
@@ -284,6 +285,7 @@ export function relayResponsesSseWithTerminalRepair(
     let emitted = false;
     while ((next = nextSseBlock(buffer))) {
       replaceBuffer(next.rest);
+      pendingLineFeed = next.delimiter.endsWith("\r") && buffer.length === 0;
       const kind = inspectPayload(sseDataPayload(next.block));
       if (kind === "done" && !realTerminalSeen) {
         emitSynthetic(completeCandidate() ? "completed" : "incomplete", controller);
@@ -327,9 +329,20 @@ export function relayResponsesSseWithTerminalRepair(
           controller.close();
           return;
         }
-        appendBuffer(decoder.decode(value, { stream: true }));
+        let fragment = decoder.decode(value, { stream: true });
+        let continuedDelimiter = false;
+        if (pendingLineFeed && fragment.length > 0) {
+          pendingLineFeed = false;
+          if (fragment.startsWith("\n")) {
+            // This byte completes an already-forwarded CR delimiter, not a new EOF suffix.
+            controller.enqueue(encoder.encode("\n"));
+            fragment = fragment.slice(1);
+            continuedDelimiter = true;
+          }
+        }
+        appendBuffer(fragment);
         const result = emitBlocks(controller);
-        if (result.closed || result.emitted) return;
+        if (result.closed || result.emitted || continuedDelimiter) return;
       }
     } catch (error) {
       if (disposed) return;