@bitkyc08/opencodex 2.79.0 → 2.81.0

package/src/web-search/header-deadline.ts

@@ -0,0 +1,67 @@
+import { clearableDeadline } from "../lib/abort";
+import { sendTrackingRequestSlot } from "../providers/request-pacing";
+import type { ProviderFetch } from "../server/responses/fetch-helpers";
+
+/** One iteration's cumulative header budget; only local pacing admission pauses its clock. */
+export function pacingHeaderDeadline(timeoutMs: number, parent: AbortSignal) {
+  const controller = new AbortController();
+  const signal = AbortSignal.any([parent, controller.signal]);
+  let remainingMs = timeoutMs;
+  let armedAt = performance.now();
+  let current = clearableDeadline(remainingMs, parent);
+  const timeoutReason = current.timeoutReason;
+  let pacingWaits = 0;
+  let cleared = false;
+  const relayExpiry = () => {
+    if (current.didExpire()) controller.abort(timeoutReason);
+  };
+  current.signal.addEventListener("abort", relayExpiry, { once: true });
+
+  const pause = () => {
+    if (cleared || pacingWaits++ > 0) return;
+    remainingMs = Math.max(0, remainingMs - (performance.now() - armedAt));
+    current.clear();
+    current.signal.removeEventListener("abort", relayExpiry);
+    // A delayed timer task must not let an already-spent budget escape into the queue.
+    if (remainingMs === 0 && !signal.aborted) controller.abort(timeoutReason);
+  };
+  const resume = () => {
+    if (cleared || --pacingWaits > 0 || signal.aborted) return;
+    armedAt = performance.now();
+    current = clearableDeadline(remainingMs, parent);
+    current.signal.addEventListener("abort", relayExpiry, { once: true });
+  };
+
+  return {
+    signal,
+    didExpire: () => signal.aborted && signal.reason === timeoutReason,
+    clear: () => {
+      cleared = true;
+      current.clear();
+      current.signal.removeEventListener("abort", relayExpiry);
+    },
+    /** Preserve the pacing seams used by adapter physical-send helpers, without double admission. */
+    pacedFetch(executor: typeof globalThis.fetch): typeof globalThis.fetch {
+      const pacing = executor as ProviderFetch;
+      if (!pacing.waitForPacing) return executor;
+      const waitForPacing: NonNullable<ProviderFetch["waitForPacing"]> = async (sendSignal) => {
+        pause();
+        try {
+          return await pacing.waitForPacing!(sendSignal ? AbortSignal.any([signal, sendSignal]) : signal);
+        } finally {
+          resume();
+        }
+      };
+      const unpacedFetch = pacing.unpacedFetch ?? executor;
+      const wrapped = async (input: Parameters<typeof fetch>[0], init?: RequestInit) => {
+        const slot = await waitForPacing(init?.signal ?? undefined);
+        return sendTrackingRequestSlot(slot, () => {
+          signal.throwIfAborted();
+          init?.signal?.throwIfAborted();
+          return unpacedFetch(input, init);
+        });
+      };
+      return Object.assign(wrapped, { preconnect: executor.preconnect, waitForPacing, unpacedFetch }) as ProviderFetch;
+    },
+  };
+}

package/src/web-search/index.ts

@@ -6,7 +6,7 @@ import type { CodexAuthPolicyConfig } from "../codex/auth-context";
 import { isCodexReserveRequestEligible } from "../codex/loopback-target";
 import type { DataPlaneAdmission } from "../server/auth-cors";
 import type { ResolvedOpenAiForwardSidecar } from "../providers/openai-sidecar";
-import { resolveSidecarAuth } from "../sidecar/auth";
+import { resolveSidecarAuth, resolveAnthropicHelperInstance, withAnthropicHelperRefusal } from "../sidecar/auth";
 import { validateXaiSearchOptions, type XaiSearchOptions } from "./xai-executor";
 import type { OcxWebSearchSidecarConfig } from "../types";
 import { DEFAULT_STALL_TIMEOUT_SEC } from "../stall-timeout";
@@ -168,11 +168,15 @@ export function planWebSearch(
   const connectTimeoutMs = config.connectTimeoutMs ?? 200_000;
   // Shared auth state (#2188): presence only — backend PREFERENCE stays with
   // resolveSidecarBackend's explicit-or-openai contract.
-  const auth = resolveSidecarAuth(config);
+  const backend = resolveSidecarBackend(cfg.backend);
+  // Only the anthropic backend can be refused; an unavailable selected pool means no plan, so the
+  // main request takes the normal path instead of failing or borrowing another pool.
+  const auth = withAnthropicHelperRefusal("web-search", () => resolveSidecarAuth(config, resolveAnthropicHelperInstance(config,
+    { backendFamily: backend, anthropicInstance: cfg.anthropicInstance, parentProviderName: options.providerName })));
+  if (!auth) return undefined;
   const anthropicSidecar = auth.isAnthropicAuth && auth.anthropicProviderName && auth.anthropicProvider
     ? { providerName: auth.anthropicProviderName, provider: auth.anthropicProvider, config }
     : undefined;
-  const backend = resolveSidecarBackend(cfg.backend);
   const maxSearches = cfg.maxSearchesPerTurn ?? DEFAULT_MAX_SEARCHES;
   const stallTimeoutSec = webSearchStallTimeoutSec(
     config.stallTimeoutSec,

package/src/web-search/loop.ts

@@ -1,6 +1,7 @@
 import type { AdapterRequest, IncomingMeta, ProviderAdapter } from "../adapters/base";
 import type { AdapterEvent, OcxConfig, OcxMessage, OcxParsedRequest, OcxProviderConfig, OcxProviderOpaqueToolCallMetadata, OcxThinkingContent, OcxUsage, RateLimitRetryPolicy } from "../types";
 import { namespacedToolName, toolChoiceToolPredicate } from "../types";
+import { isAnthropicInstanceId } from "../providers/anthropic-instance-id";
 import { cloneProviderOpaqueToolCallMetadata } from "../responses/provider-opaque-metadata";
 import type { AttemptRecoveryKind } from "../usage/log";
 import { isTruncatedStopReason } from "../responses/truncated-stop-reason";
@@ -11,7 +12,7 @@ import { runXaiWebSearch, type XaiSearchOptions } from "./xai-executor";
 import { runGeminiWebSearch } from "./gemini-executor";
 import { runExaWebSearch } from "./exa-executor";
 import type { WebSearchBackendId } from "./index";
-import { clearableDeadline } from "../lib/abort";
+import { pacingHeaderDeadline } from "./header-deadline";
 import { redactSecretString } from "../lib/redact";
 import { readBoundedResponseBody } from "../lib/bounded-body";
 import { applyUpstreamRecoveryInit, fetchWithResetRetry, prepareSameTarget429Wait } from "../lib/upstream-retry";
@@ -353,6 +354,8 @@ export interface WebSearchLoopDeps {
     | { adapter: ProviderAdapter; recoveryKind: AttemptRecoveryKind }
     | null
     | Promise<{ adapter: ProviderAdapter; recoveryKind: AttemptRecoveryKind } | null>;
+  /** Release a credential-hop permit if this iteration ended before the adapter used it. */
+  onIterationEnd?: () => void;
   /** Opt-in same-target 429 policy (key-auth providers). When present, 429 replays on the SAME key before on429 rotation. */
   retryOn429Policy?: Required<RateLimitRetryPolicy> | null;
   /** Called only when the final bridged Responses stream reaches completed or incomplete. */
@@ -455,10 +458,10 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
       ...(recoveringEmptyAnswer ? { options: { ...parsed.options, toolChoice: "none" as const } } : {}),
       context: { ...parsed.context, messages: iterMessages, tools: recoveringEmptyAnswer ? [] : allTools },
     };
-    // One cumulative header deadline spans every pool-key 429 rotation in this model iteration.
+    // One cumulative header deadline spans key rotations and reset sends, excluding local pacing.
     // clear() stops only its timer after final headers; the direct turn signal remains attached to
     // the returned response body through AbortSignal.any().
-    let headerDeadline = clearableDeadline(connectTimeoutMs, signal);
+    let headerDeadline = pacingHeaderDeadline(connectTimeoutMs, signal);
     try {
       /**
        * Build and fetch one web-search iteration on the given adapter, under the iteration
@@ -491,7 +494,7 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
           cachedRequest = request;
           cachedAdapter = requestAdapter;
         }
-        const requestFetch = deps.fetchForRequest?.(request, iterParsed) ?? routedProviderFetch;
+        const requestFetch = headerDeadline.pacedFetch(deps.fetchForRequest?.(request, iterParsed) ?? routedProviderFetch);
         let response: Response;
         try {
           if (requestAdapter.fetchResponse) {
@@ -501,6 +504,8 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
               timeoutMs: connectTimeoutMs,
               returnRawErrors: true,
               stream: true,
+              sendBudget: deps.incomingMeta.sendBudget,
+              onPhysicalSend: deps.incomingMeta.onPhysicalSend,
               executor: requestFetch,
             });
           } else {
@@ -563,7 +568,7 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
         // The deliberate backoff must not consume the cumulative response-header deadline:
         // start a fresh one so the replay gets a new connect budget (504 stays reserved for real
         // upstream latency).
-        headerDeadline = clearableDeadline(connectTimeoutMs, signal);
+        headerDeadline = pacingHeaderDeadline(connectTimeoutMs, signal);
         // Stall-watchdog seam between bounded retry fetches.
         yield { type: "heartbeat" };
         prepared = await fetchOnce(adapter, "rate-limit-429");
@@ -571,18 +576,34 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
       // 429 key-failover parity with the normal routed path: rotate pool keys until one responds
       // or the pool is exhausted (deps.on429 returns null — cooldown map guarantees termination).
       while ((prepared.response.status === 429
-        || (prepared.response.status === 403 && deps.incomingMeta?.providerName === "anthropic" && !accountRefusalOutputStarted)
+        || (prepared.response.status === 403
+          && (isAnthropicInstanceId(deps.incomingMeta?.providerName) || deps.incomingMeta?.providerName === "google-antigravity")
+          && !accountRefusalOutputStarted)
         || (iterParsed._kiroAuthContext && (prepared.response.status === 400 || prepared.response.status === 403))) && deps.on429) {
         const rotated = await deps.on429(prepared.response.headers.get("retry-after"), prepared.response.headers,
           iterParsed, prepared.response);
         if (!rotated) break;
-        // Never let a broken body's cancel promise outlive the cumulative header deadline. Observe
-        // it, but proceed immediately to the rotated fetch under the SAME deadline signal.
-        try { void prepared.response.body?.cancel().catch(() => {}); } catch { /* already closed */ }
+        const retainRefusal = prepared.response.status === 403
+          && deps.incomingMeta?.providerName === "google-antigravity" && rotated.recoveryKind === "oauth-account-403";
+        // Keep the bounded refusal readable until the sibling actually returns headers.
+        // Other rotation paths retain their existing cancellation boundary.
+        if (!retainRefusal) {
+          try { void prepared.response.body?.cancel().catch(() => {}); } catch { /* already closed */ }
+        }
         adapter = rotated.adapter;
         // Stall-watchdog seam between bounded retry fetches (audit 011 B3).
         yield { type: "heartbeat" };
-        prepared = await fetchOnce(adapter, rotated.recoveryKind);
+        let replacement: IterationResponse;
+        try {
+          replacement = await fetchOnce(adapter, rotated.recoveryKind);
+        } catch (error) {
+          if (!retainRefusal || signal.aborted || headerDeadline.didExpire() || isTranslatorBudgetExceededError(error)) throw error;
+          break; // Format the original 403 safely; replacement diagnostics are not client errors.
+        }
+        if (retainRefusal) {
+          try { void prepared.response.body?.cancel().catch(() => {}); } catch { /* already closed */ }
+        }
+        prepared = replacement;
       }
 
       // Final headers have arrived. Clear only the deadline timer before ANY body read.
@@ -623,6 +644,7 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
       throw new LoopError(502, `Provider unreachable: ${error instanceof Error ? error.message : String(error)}`);
     } finally {
       headerDeadline.clear();
+      deps.onIterationEnd?.();
     }
   };
 

package/src/web-search/passthrough-bridge.ts

@@ -76,6 +76,7 @@ import {
 import { providerDestinationConfigError } from "../lib/destination-policy";
 import { redactSecretString } from "../lib/redact";
 import { rememberBridgeSearchReplay } from "../responses/bridge-search-replay-cache";
+import { withAnthropicHelperRefusal } from "../sidecar/auth";
 
 /** Canonical Ollama Cloud origin. The only origin the "ollama" backend derives on its own. */
 export const OLLAMA_CLOUD_ORIGIN = "https://ollama.com";
@@ -246,12 +247,14 @@ export function resolvePassthroughWebSearchBridgeAuth(
   backend: ProviderWebSearchBridgeBackend | undefined,
   config: OcxConfig,
   openAiSidecar?: ResolvedOpenAiForwardSidecar,
+  parentProviderName?: string,
 ): PassthroughWebSearchBridgeAuth {
   switch (backend) {
     case "openai":
       return openAiSidecar ? { openAiSidecar } : {};
     case "anthropic": {
-      const anthropic = findAnthropicSidecarProvider(config);
+      // An unavailable selected pool leaves the bridge disarmed; it never fails the passthrough turn.
+      const anthropic = withAnthropicHelperRefusal("web-search", () => findAnthropicSidecarProvider(config, parentProviderName));
       return anthropic ? { anthropic } : {};
     }
     case "xai": {

package/src/web-search/sidecar-providers.ts

@@ -5,7 +5,7 @@
  * evaluating when the bridge asks for these names).
  */
 import type { OcxConfig, OcxProviderConfig, OcxWebSearchSidecarConfig } from "../types";
-import { resolveSidecarAuth } from "../sidecar/auth";
+import { resolveSidecarAuth, resolveAnthropicHelperInstance } from "../sidecar/auth";
 import { getAccountSet } from "../oauth/store";
 import type { XaiSearchOptions } from "./xai-executor";
 
@@ -46,8 +46,9 @@ export interface AnthropicSidecarProvider {
  * Delegates to the shared sidecar auth module (#2188) so web-search and vision
  * cannot drift on what "Anthropic auth present" means.
  */
-export function findAnthropicSidecarProvider(config: OcxConfig): AnthropicSidecarProvider | undefined {
-  const auth = resolveSidecarAuth(config);
+export function findAnthropicSidecarProvider(config: OcxConfig, parentProviderName?: string): AnthropicSidecarProvider | undefined {
+  const instance = resolveAnthropicHelperInstance(config, { backendFamily: "anthropic", anthropicInstance: config.webSearchSidecar?.anthropicInstance, parentProviderName });
+  const auth = resolveSidecarAuth(config, instance);
   if (!auth.isAnthropicAuth || !auth.anthropicProviderName || !auth.anthropicProvider) return undefined;
   return { providerName: auth.anthropicProviderName, provider: auth.anthropicProvider, config };
 }