@bitkyc08/opencodex 2.82.0 → 2.83.0

package/src/server/responses/request-transport.ts

@@ -53,6 +53,9 @@ import { classifyModelFamilyForQuota } from "../../oauth/account-quota-rank";
 import { expandInferenceOAuthSendBudget } from "../inference/context";
 import { stampOAuthAccountLabel, usesApiKeyAccount } from "../../providers/label";
 import { resolveProviderTransport } from "../../providers/xai-transport";
+import { captureRouteStaticPolicy } from "../../router";
+import { CopilotAutoHttpError, resolveCopilotAuto } from "../../providers/github-copilot-auto";
+import { renameRoutedIdentityInContext } from "../../adapters/identity";
 import { resolveCopilotApiBaseUrl } from "../../oauth/github-copilot";
 import {
   providerApiKeySelectionIsCurrent,
@@ -87,6 +90,13 @@ import { resolvePassiveRouteSubjectId } from "../passive-route-linker";
 import { clientCancelledResponse } from "./core-errors";
 import { acquireAccountLease, KIRO_ACCOUNT_WAIT_MS } from "../../oauth/kiro-account-load";
 
+/** Return a renewed Chat wire to the native owner before sending inference. */
+export class CopilotAutoAdapterHandoff extends Error {
+  constructor(readonly adapter: ProviderAdapter) {
+    super("Copilot Auto dispatch requires the Chat adapter");
+  }
+}
+
 /** Owns live credential selection and adapter bindings for one request. */
 export async function prepareResponsesTransport(
   requestContext: Pick<ResponsesRequestContext, "config" | "logCtx" | "options" | "req">,
@@ -160,6 +170,8 @@ export async function prepareResponsesTransport(
     || route.providerName === "devin"
   ) && route.provider.authMode === "oauth";
   let sentOAuthSnapshot: OAuthAccessSnapshot | undefined;
+  // One inference-401 replay belongs to this request, even when Auto changes exchange wire.
+  let oauth401ReplayAttempted = false;
   let replayOAuthCredentialSnapshot: Pick<OAuthAccessSnapshot, "accountId" | "generation"> | undefined;
   let anthropicPoolAccountId: string | null = null;
   let anthropicPoolFailovers = 0;
@@ -281,6 +293,84 @@ export async function prepareResponsesTransport(
    * the case the fence exists for. Stays 0 for every provider without a passive quota.
    */
   let passiveQuotaWriterGeneration = 0;
+  const copilotRequestedModel = route.modelId;
+  /** Project only bounded Copilot refusal metadata; upstream bodies and session tokens never reach the client. */
+  const copilotRefusalResponse = (error: unknown): Response | undefined => {
+    if (!(error instanceof CopilotAutoHttpError) || ![401, 403, 429].includes(error.status)) return;
+    const response = formatErrorResponse(error.status, error.status === 429 ? "rate_limit_error" : "authentication_error",
+      error.message);
+    if (error.retryAfter) response.headers.set("retry-after", error.retryAfter);
+    return response;
+  };
+  let copilotSessionExpiresAt = Infinity;
+  let copilotNegotiationRefreshed = false;
+  let copilotAutoAdapter: OcxProviderConfig["adapter"] | undefined;
+  /** The operator-configured wire, captured before the first Auto negotiation can rewrite route.provider. */
+  let copilotConfiguredWire: { adapter: OcxProviderConfig["adapter"]; responsesPath?: string;
+    chatCompletionsPath?: string; apiVersion?: string } | undefined;
+  /** Start every negotiation from the configured wire, so a previous credential's Auto adapter,
+   *  endpoint and session headers never carry over to a credential that keeps the named model. */
+  const copilotNegotiationBase = (provider: OcxProviderConfig): OcxProviderConfig => {
+    if (!copilotConfiguredWire) return provider;
+    const headers = new Headers(provider.headers);
+    headers.delete("Copilot-Session-Token");
+    if (copilotConfiguredWire.apiVersion === undefined) headers.delete("X-GitHub-Api-Version");
+    else headers.set("X-GitHub-Api-Version", copilotConfiguredWire.apiVersion);
+    const base: OcxProviderConfig = { ...provider, adapter: copilotConfiguredWire.adapter,
+      headers: Object.fromEntries(headers) };
+    if (copilotConfiguredWire.responsesPath === undefined) delete base.responsesPath;
+    else base.responsesPath = copilotConfiguredWire.responsesPath;
+    if (copilotConfiguredWire.chatCompletionsPath === undefined) delete base.chatCompletionsPath;
+    else base.chatCompletionsPath = copilotConfiguredWire.chatCompletionsPath;
+    return base;
+  };
+  /** Resolve the request's ephemeral wire selection and recover at most one OAuth negotiation 401. */
+  const resolveCopilotSelection = async (requestParsed: OcxParsedRequest, insideDispatch = false): Promise<void> => {
+    if (route.providerName !== "github-copilot" || route.provider.authMode === "forward") return;
+    copilotConfiguredWire ??= {
+      adapter: route.provider.adapter,
+      responsesPath: route.provider.responsesPath,
+      chatCompletionsPath: route.provider.chatCompletionsPath,
+      apiVersion: new Headers(route.provider.headers).get("X-GitHub-Api-Version") ?? undefined,
+    };
+    /** Fence control-plane sends to the captured credential; reuse an already-held dispatch concurrency lease. */
+    const negotiate = () => {
+      const binding: DispatchBinding | undefined = oauthSelection && servingOAuthSnapshot
+        ? { kind: "oauth", selection: { ...oauthSelection }, snapshot: servingOAuthSnapshot }
+        : { kind: "api-key", provider: { ...route.provider } };
+      return resolveCopilotAuto(copilotNegotiationBase(route.provider), copilotRequestedModel, requestParsed,
+        options.abortSignal ?? req.signal, /** Fence each negotiation send against the captured credential binding before touching the network. */
+          () => selectionIsCurrent(binding), !insideDispatch);
+    };
+    let selected: Awaited<ReturnType<typeof resolveCopilotAuto>>;
+    try { selected = await negotiate(); }
+    catch (error) {
+      if (!(error instanceof CopilotAutoHttpError) || error.status !== 401 || copilotNegotiationRefreshed
+        || oauth401ReplayAttempted || route.provider.authMode !== "oauth" || !servingOAuthSnapshot) throw error;
+      copilotNegotiationRefreshed = true;
+      const refreshed = await refreshResolvedOAuthSelection(servingOAuthSnapshot);
+      route.provider = resolveProviderTransport(route.providerName,
+        { ...route.provider, apiKey: refreshed.accessToken }, parsed.options.promptCacheKey,
+        resolveCopilotApiBaseUrl(refreshed.apiBaseUrl));
+      sentOAuthSnapshot = refreshed;
+      replayOAuthCredentialSnapshot = { accountId: refreshed.accountId, generation: refreshed.generation };
+      selected = await negotiate();
+    }
+    copilotSessionExpiresAt = selected.expiresAt ?? Infinity;
+    route.provider = selected.provider;
+    route.modelId = selected.modelId;
+    route.staticPolicy = captureRouteStaticPolicy(route.providerName, route.modelId, route.provider,
+      route.staticPolicy.effectiveAlias, inboundWire);
+    copilotAutoAdapter = selected.auto ? selected.provider.adapter : undefined;
+    for (const target of new Set([parsed, requestParsed])) {
+      target.modelId = selected.modelId;
+      if (target._rawBody && typeof target._rawBody === "object")
+        (target._rawBody as { model?: string }).model = selected.modelId;
+      target.context = renameRoutedIdentityInContext(target.context, selected.modelId);
+    }
+    logCtx.model = selected.modelId;
+    if (logCtx.activeAttempt) logCtx.activeAttempt.model = selected.modelId;
+  };
   /**
    * Apply a rotated account's FULL credential snapshot to the live route (#2568d).
    *
@@ -306,6 +396,7 @@ export async function prepareResponsesTransport(
   const applyFailoverSnapshot = async (
     snapshot: OAuthAccessSnapshot,
     retryParsed: OcxParsedRequest = parsed,
+    insideDispatch = false,
   ): Promise<OAuthAccessSnapshot | null> => {
     requireAnthropicAdmission();
     if (snapshot.provider !== route.providerName) return null;
@@ -342,6 +433,9 @@ export async function prepareResponsesTransport(
     }
     if (snapshot.projectId) rotatedProvider = { ...rotatedProvider, project: snapshot.projectId };
     route.provider = rotatedProvider;
+    await resolveCopilotSelection(retryParsed, insideDispatch);
+    // Negotiation itself may have recovered a 401 with a newer committed credential.
+    if (route.providerName === "github-copilot" && servingOAuthSnapshot) snapshot = servingOAuthSnapshot;
     if (route.providerName === "kiro") {
       const kiroContext = { ...(snapshot.kiro ?? {}) };
       // Terminal-guard continuations are rebuilt from a shallow clone. Updating only the
@@ -411,7 +505,9 @@ export async function prepareResponsesTransport(
       && (anthropicInstance === undefined || !anthropicRouting!.getAnthropicAccountHealthSnapshot(binding.snapshot.accountId) && !anthropicRatePolicy!.anthropicRatePauseUntil(binding.snapshot.accountId) && !anthropicQuota!.anthropicFamilyRejected(binding.snapshot.accountId, route.modelId))
       && credentialGeneration(row.credential) === binding.snapshot.generation;
   };
+  /** Bind the negotiated wire adapter and its built requests to the serving credential's authority. */
   const resolveSelectionAdapter = (provider: OcxProviderConfig, retention = config.cacheRetention): ProviderAdapter => {
+    if (copilotAutoAdapter) provider = { ...provider, adapter: copilotAutoAdapter };
     const resolved = resolveAdapter(provider, retention, route.providerName);
     if (route.provider.authMode === "forward") return resolved;
     const binding: DispatchBinding | undefined = route.provider.authMode === "oauth"
@@ -468,6 +564,7 @@ export async function prepareResponsesTransport(
     }
     return resolved;
   };
+  /** Rebuild a stale queued selection while retaining the caller's dispatch lease and renewing Auto metadata. */
   const refreshDispatchAdapter = async (requestParsed: OcxParsedRequest): Promise<ProviderAdapter> => {
     requireAnthropicAdmission();
     if (route.provider.authMode === "oauth") {
@@ -479,7 +576,7 @@ export async function prepareResponsesTransport(
         const accountId = await anthropicRouting!.resolveAnthropicDispatchAccountId(config, anthropicSessionKey, anthropicRouteDecision, route.modelId);
         candidate = await anthropicRouting!.getAnthropicPoolAccessSnapshot(accountId);
       }
-      if (!candidate || !await applyFailoverSnapshot(candidate, requestParsed)) {
+      if (!candidate || !await applyFailoverSnapshot(candidate, requestParsed, true)) {
         if (anthropicInstance !== undefined) await anthropicRouting!.resolveAnthropicDispatchAccountId(config, anthropicSessionKey, anthropicRouteDecision, route.modelId);
         throw new Error("OAuth account selection changed before dispatch");
       }
@@ -487,6 +584,7 @@ export async function prepareResponsesTransport(
       const current = resolveCurrentProviderApiKeyTransport(config, route.providerName, route.provider);
       if (!current) throw new Error("API key selection is unavailable before dispatch");
       route.provider = current;
+      await resolveCopilotSelection(requestParsed, true);
     }
     adapter = activeAdapter = runTurnAdapter = resolveSelectionAdapter(
       resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire, route.staticPolicy),
@@ -552,13 +650,14 @@ export async function prepareResponsesTransport(
     throw new Error("Account selection changed repeatedly before turn dispatch");
     } finally { producer?.close(); }
   };
-  const oauthDispatch = (wireRequest: AdapterRequest, requestParsed = parsed): ProviderFetchOptions["dispatchOverride"] => {
+  /** Fence the physical send, with bounded credential/session rebuilds and safe negotiated refusals. */
+  const oauthDispatch = (wireRequest: AdapterRequest, requestParsed = parsed, owner: "adapter" | "passthrough" = "adapter"): ProviderFetchOptions["dispatchOverride"] => {
     if (route.provider.authMode === "forward") return undefined;
-    return async (input, init, execute) => {
+    return /** Dispatch with the current binding and session, rebuilding at most three times before returning a safe refusal. */ async (input, init, execute) => {
       let destination = input;
       let dispatchInit = init;
       for (let attempt = 0; attempt < 3; attempt++) {
-        if (selectionIsCurrent(requestBindings.get(wireRequest))) {
+        if (selectionIsCurrent(requestBindings.get(wireRequest)) && copilotSessionExpiresAt > Date.now() + 1000) {
           const fetchImpl = (route.provider as OcxProviderConfig & { fetch?: typeof globalThis.fetch }).fetch ?? execute;
           const binding = requestBindings.get(wireRequest);
           const snapshot = anthropicInstance !== undefined && binding?.kind === "oauth"
@@ -622,7 +721,16 @@ export async function prepareResponsesTransport(
           if (!response.ok) await recordKeyAttemptFailure(logCtx, response, dispatchInit.signal ?? options.abortSignal);
           return response;
         }
-        const nextAdapter = await refreshDispatchAdapter(requestParsed);
+        let nextAdapter: ProviderAdapter;
+        try { nextAdapter = await refreshDispatchAdapter(requestParsed); }
+        catch (error) {
+          const refusal = copilotRefusalResponse(error);
+          if (refusal) return refusal;
+          throw error;
+        }
+        if (owner === "passthrough" && route.providerName === "github-copilot" && nextAdapter.name === "openai-chat") {
+          throw new CopilotAutoAdapterHandoff(nextAdapter);
+        }
         // Rebind before rebuilding: the rebuild's bridged-search restore and continuation
         // restore key on the serving identity, which must be the refreshed route's, not the
         // credential whose selection just lapsed.
@@ -876,7 +984,15 @@ export async function prepareResponsesTransport(
       ? resolveCopilotApiBaseUrl(sentOAuthSnapshot?.apiBaseUrl)
       : undefined,
   );
+  try { await resolveCopilotSelection(parsed); }
+  catch (error) {
+    if ((options.abortSignal ?? req.signal).aborted) return clientCancelledResponse();
+    const refusal = copilotRefusalResponse(error);
+    if (refusal) return refusal;
+    return formatErrorResponse(502, "provider_error", "GitHub Copilot Auto negotiation failed; retry or check your Copilot account permissions.");
+  }
   let adapterProvider = resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire, route.staticPolicy);
+  if (copilotAutoAdapter) adapterProvider = { ...adapterProvider, adapter: copilotAutoAdapter };
   const stripClaudeMainAuth = options.stripClaudeMainAuthForNoncanonicalForward === true
     && !isCanonicalOpenAiForwardProvider(adapterProvider)
     && ((adapterProvider.adapter === "openai-responses" && adapterProvider.authMode === "forward")
@@ -1008,6 +1124,8 @@ export async function prepareResponsesTransport(
     set genericFailovers(value: typeof genericFailovers) {
       genericFailovers = value;
     },
+    get oauth401ReplayAttempted(): boolean { return oauth401ReplayAttempted; },
+    set oauth401ReplayAttempted(value: boolean) { oauth401ReplayAttempted = value; },
     get adapter(): ProviderAdapter {
       return adapter;
     },
@@ -1065,6 +1183,8 @@ export async function prepareResponsesTransport(
     applyFailoverSnapshot,
     selectionIsCurrent,
     resolveSelectionAdapter,
+    resolveCopilotSelection,
+    copilotRefusalResponse,
     refreshRunTurnAdapter,
     oauthDispatch,
     noteRoutedAttemptSend,

package/src/server/responses/run-turn-execution.ts

@@ -1,3 +1,4 @@
+import { mapSpendLedgerStorageError } from "./spend-storage-error";
 import type { ResponsesRequestContext, ResponsesAdmissionState } from "./core-options";
 import type { PreparedResponsesRequest } from "./request-prepare";
 import type { ResponsesTransport } from "./request-transport";
@@ -20,7 +21,7 @@ import type { AttemptRecoveryKind } from "../../usage/log";
 import { providerFetch } from "./fetch-helpers";
 import { normalizeLogConversationId } from "../request-log-conversation";
 import { normalizeDeclaredToolName, type AdapterEvent, type OcxProviderContinuationState } from "../../types";
-import { adapterFailureFromMessage, SEND_BUDGET_EXHAUSTED_CODE } from "../../lib/errors";
+import { adapterFailureFromMessage, SEND_BUDGET_EXHAUSTED_CODE, SPEND_LEDGER_STORAGE_UNAVAILABLE_CODE, type OcxErrorPayload } from "../../lib/errors";
 import { SendBudgetExhaustedError, markResponseNonReplayable } from "../../lib/upstream-retry";
 import {
   hasEligibleGenericOAuthFailoverTarget,
@@ -315,7 +316,8 @@ export async function executeResponsesRunTurn(
           Object.assign(parsed, routeState);
         }
       } catch (err) {
-        emit(err instanceof RequestPacingQueueOverloadError
+        const storageRefusal = mapSpendLedgerStorageError(err, logCtx);
+        emit(storageRefusal ? { type: "error", ...storageRefusal } : err instanceof RequestPacingQueueOverloadError
           ? {
               type: "error",
               status: 429,
@@ -713,7 +715,8 @@ export async function executeResponsesRunTurn(
           runTurnAbort.abort();
           queue.close();
           const message = preflight.error?.message ?? "Adapter ended before producing a response";
-          const failure = formatErrorResponse(502, "upstream_error", redactSecretString(message));
+          const failure = formatErrorResponse(preflight.error?.code === SPEND_LEDGER_STORAGE_UNAVAILABLE_CODE ? 503 : 502,
+            preflight.error?.code === SPEND_LEDGER_STORAGE_UNAVAILABLE_CODE ? SPEND_LEDGER_STORAGE_UNAVAILABLE_CODE : "upstream_error", redactSecretString(message));
           // A replay-unsafe heartbeat means the adapter already ran a local side effect, so the
           // combo must not send this turn to another target: the failure stays with this child.
           if (preflight.replayUnsafe) markResponseNonReplayable(failure);
@@ -912,7 +915,9 @@ export async function executeResponsesRunTurn(
           const message = classifiedError?.message ?? (firstMeaningful?.type === "error"
             ? firstMeaningful.message
             : "Adapter ended before producing a response");
-          const failure = formatErrorResponse(502, "upstream_error", redactSecretString(message));
+          const storageRefusal = firstMeaningful?.type === "error" && firstMeaningful.code === SPEND_LEDGER_STORAGE_UNAVAILABLE_CODE;
+          const failure = formatErrorResponse(storageRefusal ? 503 : 502,
+            storageRefusal ? SPEND_LEDGER_STORAGE_UNAVAILABLE_CODE : "upstream_error", redactSecretString(message));
           if (replayUnsafe) markResponseNonReplayable(failure);
           return failure;
         }
@@ -956,7 +961,10 @@ export async function executeResponsesRunTurn(
         commitReasoningReplayServingRoute();
       }
       notifyResponseComplete(json);
-      return new Response(JSON.stringify(json), { headers: { "Content-Type": "application/json" } });
+      return new Response(JSON.stringify(json), {
+        status: (json.error as OcxErrorPayload | undefined)?.code === SPEND_LEDGER_STORAGE_UNAVAILABLE_CODE ? 503 : 200,
+        headers: { "Content-Type": "application/json" },
+      });
     } catch (error) {
       if (!isTranslatorBudgetExceededError(error)) throw error;
       runTurnAbort.abort();

package/src/server/responses/sidecar-execution.ts

@@ -79,6 +79,7 @@ export async function executeResponsesSidecars(
     | "anthropicSessionKey"
     | "commitResolvedOAuthSelection"
     | "resolveSelectionAdapter"
+    | "resolveCopilotSelection"
     | "oauthDispatch"
     | "noteRoutedAttemptSend"
     | "bindKeyUsageFromBridge"
@@ -103,6 +104,7 @@ export async function executeResponsesSidecars(
     anthropicSessionKey,
     commitResolvedOAuthSelection,
     resolveSelectionAdapter,
+    resolveCopilotSelection,
     oauthDispatch,
   } = transportState;
   const {
@@ -196,6 +198,7 @@ export async function executeResponsesSidecars(
   // A single request may rotate once for a verification refusal. Keep this separate from the
   // broader OAuth failover count: a sidecar turn can also spend that count on rate-limit recovery.
   let antigravityValidationRotationAttempted = false;
+  /** Admit a replacement credential, or leave the loop's original refusal authoritative. */
   const rotateSidecarProviderOn429 = async (
     retryAfter: string | null,
     responseHeaders?: Headers,
@@ -280,6 +283,8 @@ export async function executeResponsesSidecars(
       // `applyFailoverSnapshot` has already rebound the route to the sibling identity/project.
     } else if (rotated) {
       route.provider = rotated;
+      try { await resolveCopilotSelection(retryParsed ?? parsed); }
+      catch { return null; } // Keep the sidecar's original refusal when replacement negotiation fails.
     } else if (
       // A POSITIVE gate, not an early return. An early `return null` here made every later arm
       // unreachable: Anthropic never has a genericFailoverAccountId (isGenericFailoverProvider

package/src/server/responses/spend-storage-error.ts

@@ -0,0 +1,33 @@
+import { formatErrorResponse } from "../../bridge";
+import { SPEND_LEDGER_STORAGE_UNAVAILABLE_CODE } from "../../lib/errors";
+import { markLocalRequestLogRefusal, type RequestLogContext } from "../request-log";
+import { SpendLedgerFileRefusedError } from "../../lib/spend-reservation-ledger";
+
+type StorageRefusalLog = Pick<RequestLogContext, "localTerminalReason" | "terminalSource" | "errorCode">;
+
+/** Local storage refusal, including retry wrappers: never provider-health evidence. */
+export function mapSpendLedgerStorageError(error: unknown, logCtx?: StorageRefusalLog) {
+  const seen = new Set<unknown>();
+  while (error instanceof Error && !seen.has(error)) {
+    if (error instanceof SpendLedgerFileRefusedError) {
+      if (logCtx) {
+        markLocalRequestLogRefusal(logCtx, SPEND_LEDGER_STORAGE_UNAVAILABLE_CODE);
+        logCtx.errorCode = SPEND_LEDGER_STORAGE_UNAVAILABLE_CODE;
+      }
+      return {
+        status: 503,
+        errorType: "server_error",
+        code: SPEND_LEDGER_STORAGE_UNAVAILABLE_CODE,
+        message: error.message,
+      } as const;
+    }
+    seen.add(error);
+    error = error.cause;
+  }
+  return undefined;
+}
+
+export function spendLedgerStorageErrorResponse(error: unknown, logCtx?: StorageRefusalLog): Response | undefined {
+  const refusal = mapSpendLedgerStorageError(error, logCtx);
+  return refusal && formatErrorResponse(refusal.status, refusal.code, refusal.message);
+}

package/src/types/request.ts

@@ -442,6 +442,11 @@ export type AdapterEvent =
       errorType?: string;
       code?: string;
       retryable?: boolean;
+      /**
+       * Proxy-internal, never serialized: the upstream failed the turn before producing text or a
+       * tool call, so the opt-in empty-completion guard may replay the identical request once.
+       */
+      replaySafeBeforeOutput?: boolean;
     };
 
 /**

package/src/usage/expected-prices.ts

@@ -835,7 +835,7 @@ export const CONTEXT_TIERS: readonly ContextTier[] = [
   {
     // xAI documents the same whole-request >=200k band for grok-4.7;
     // priority stacking remains a lower bound. See
-    // devlog/_plan/260923_grok47_parity/010_probe-evidence.md.
+    // devlog/_fin/260923_grok47_parity/010_probe-evidence.md.
     provider: "xai",
     modelId: "grok-4.7",
     thresholdInputTokens: 200_000,