@bitkyc08/opencodex 2.84.0 → 2.87.0

package/src/server/responses/advisor-slot.ts

@@ -0,0 +1,368 @@
+import { assistantReplayContent } from "../../responses/assistant-replay";
+/**
+ * Core-owned registration slot for the optional advisor subsystem (src/advisor).
+ *
+ * This file is the ONLY thing the core Responses path knows about the advisor. It holds the
+ * structural plan interface and the event-stream guard — pure protocol machinery over
+ * src/types — and imports nothing from src/advisor at runtime. The optional subsystem registers
+ * a factory through advisor-plan-slot at host activation; an advisor-disabled install therefore executes no advisor
+ * code and imports no advisor module (same seam discipline as src/lab).
+ *
+ * Guard semantics (mirrors guardTerminalEventStream):
+ * - synthetic `advisor` tool-call events are HELD — the Codex client never sees the tool, the
+ *   call, or its arguments;
+ * - on a clean `done`, each held call is consulted through the plan, the advice is appended as a
+ *   paired assistant-toolCall + toolResult message pair, and the worker is re-dispatched via the
+ *   SAME continuation machinery the terminal guard uses;
+ * - real (non-advisor) tool calls end interception for the leg: the turn belongs to the client;
+ * - usage from intercepted legs is merged into the final terminal event so worker accounting
+ *   stays complete; the advisor's own usage is a separate loopback request and never merges here;
+ * - consultations and worker continuations have separate hard per-request bounds. Exhaustion
+ *   removes the tool; one final limit-result continuation is allowed, then a typed error ends it.
+ */
+import type {
+  AdapterEvent,
+  OcxAssistantContentPart,
+  OcxAssistantMessage,
+  OcxMessage,
+  OcxParsedRequest,
+  OcxToolResultMessage,
+  OcxUsage,
+} from "../../types";
+import { jsonStringPartsUtf8Bytes, jsonUtf8Bytes } from "../../lib/json-byte-size";
+import { isTranslatorBudgetExceededError, TRANSLATOR_MAX_CALL_ARGUMENT_BYTES, TranslatorBudgetExceededError, type TranslatorBudget } from "../../lib/translator-budget";
+import { AdvisorRetention } from "./advisor-retention";
+
+export const ADVISOR_TOOL_NAME = "advisor";
+
+/** Hard bound on advisor consultations per worker request (recursion guard). */
+export const MAX_ADVISOR_CONSULTATIONS_PER_REQUEST = 3;
+/** At most one final worker continuation after consultation exhaustion. */
+export const MAX_ADVISOR_CONTINUATIONS_PER_REQUEST = MAX_ADVISOR_CONSULTATIONS_PER_REQUEST + 1;
+
+/** Per-leg retention caps for rebuilding the assistant message (see terminal-guard's bounded retention). */
+const MAX_LEG_TEXT_CHARS = 16 * 1_024;
+const MAX_LEG_THINKING_CHARS = 16 * 1_024;
+
+/** Outcome of one consultation, as the plan reports it to the guard. */
+export interface AdvisorConsultOutcome {
+  ok: boolean;
+  /** Formatted, wrapper-marked advice text ready to hand to the worker. */
+  content: string;
+  isError: boolean;
+  /** The consultation was cancelled by the caller (client abort) — not a provider failure. */
+  cancelled?: boolean;
+  /**
+   * Operator config blocked the consultation before any outbound call. Not a provider
+   * failure: preflight must release a claim instead of recording a cooldown.
+   */
+  blocked?: "consent" | "settings" | "budget" | "limit";
+}
+
+/** The structural plan the optional advisor subsystem registers per request. */
+export interface AdvisorPlan {
+  /**
+   * Run one consultation for the current conversation state. Implementations own dedup,
+   * logging, and usage accounting; the guard only consumes the outcome.
+   */
+  consult(
+    parsed: OcxParsedRequest,
+    reason: "manual",
+    question: string | undefined,
+  ): Promise<AdvisorConsultOutcome>;
+  /**
+   * Runtime-owned text for a failed or limited consultation. The guard never composes failure
+   * prose itself: the implementation neutralizes untrusted text so no guard path can emit
+   * something the provenance detector would read as genuine advice.
+   */
+  formatUnavailable(kind: "manual" | "limit", error: string): string;
+}
+
+interface HeldAdvisorCall {
+  id: string;
+  name: string;
+  args: string[];
+  argumentBytes: number;
+  question?: string;
+  closed: boolean;
+  providerMetadata?: import("../../types").OcxProviderOpaqueToolCallMetadata;
+}
+
+function parseAdvisorArgs(call: HeldAdvisorCall, retention: AdvisorRetention): { question?: string } {
+  // Reserve both the joined input and parsed JSON before either is materialized.
+  return retention.copy(call.argumentBytes * 2 + 4, () => parseArgs(call.args.join("")));
+}
+
+function parseArgs(argsBuf: string): { question?: string } {
+  if (argsBuf.trim() === "") return {};
+  try {
+    const parsed: unknown = JSON.parse(argsBuf);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      const question = (parsed as { question?: unknown }).question;
+      if (typeof question === "string" && question.trim() !== "") return { question: question.slice(0, 2_000) };
+    }
+  } catch { /* malformed args → no focus question */ }
+  return {};
+}
+
+function assistantMessageFromLeg(
+  events: readonly AdapterEvent[],
+  held: readonly HeldAdvisorCall[],
+  timestamp: number,
+  retention: AdvisorRetention,
+): OcxAssistantMessage | undefined {
+  const content = assistantReplayContent(events);
+  for (const call of held) {
+    if (!call.closed) continue;
+    const args = parseAdvisorArgs(call, retention);
+    call.question = args.question;
+    content.push({
+      type: "toolCall",
+      id: call.id,
+      name: call.name,
+      arguments: args,
+      ...(call.providerMetadata ? { providerMetadata: call.providerMetadata } : {}),
+    });
+  }
+  if (content.length === 0) return undefined;
+  return { role: "assistant", content, timestamp };
+}
+
+function advisorToolResult(
+  call: HeldAdvisorCall,
+  outcome: AdvisorConsultOutcome,
+  timestamp: number,
+): OcxToolResultMessage {
+  return {
+    role: "toolResult",
+    toolCallId: call.id,
+    toolName: ADVISOR_TOOL_NAME,
+    content: outcome.content,
+    isError: outcome.isError,
+    timestamp,
+  };
+}
+
+export interface AdvisorGuardOptions {
+  parsed: OcxParsedRequest;
+  plan: AdvisorPlan;
+  firstEvents: AsyncIterable<AdapterEvent>;
+  /** Independent guard ownership within the optional shared request budget. */
+  translatorBudget?: TranslatorBudget;
+  /** One bounded worker continuation re-dispatch (same machinery as the terminal guard). */
+  continuation: (parsed: OcxParsedRequest) => AsyncIterable<AdapterEvent> | Promise<AsyncIterable<AdapterEvent>>;
+}
+
+/**
+ * Wrap a worker event stream with advisor interception. Registered on the parsed request as
+ * `_advisorGuard` by the sidecar planner; adapter delivery applies it when present.
+ */
+export function createAdvisorStreamGuard(options: AdvisorGuardOptions): AsyncGenerator<AdapterEvent> {
+  const guard = createAdvisorGuard(options.plan);
+  return guard(options);
+}
+export function createAdvisorGuard(plan: AdvisorPlan): NonNullable<OcxParsedRequest["_advisorGuard"]> {
+  // Shared across invocations of this request's guard, including an empty-completion retry.
+  let consultations = 0;
+  let continuations = 0;
+  let finalContinuationUsed = false;
+  return async function* guardAdvisorStream(options: Omit<AdvisorGuardOptions, "plan">): AsyncGenerator<AdapterEvent> {
+    const maxConsultations = MAX_ADVISOR_CONSULTATIONS_PER_REQUEST;
+    let parsed = options.parsed;
+    let accumulatedUsage: OcxUsage | undefined;
+    let source: AsyncIterable<AdapterEvent> = options.firstEvents;
+    const retention = new AdvisorRetention(options.translatorBudget);
+    try {
+    while (true) {
+      const held: HeldAdvisorCall[] = [];
+      const legEvents: AdapterEvent[] = [];
+      let legTextChars = 0;
+      let legThinkingChars = 0;
+      let pending: HeldAdvisorCall | null = null;
+      // While a tool call is open, its delta/end events belong to that call. Advisor calls are
+      // held from the output; real calls pass through untouched.
+      let holdingCurrent = false;
+      let hasRealToolCall = false;
+      let terminalConsumed = false;
+      let terminalEvent: Extract<AdapterEvent, { type: "done" }> | undefined;
+
+      for await (const event of source) {
+        if (event.type === "tool_call_start") {
+          if (pending) { held.push(pending); pending = null; }
+          holdingCurrent = event.name === ADVISOR_TOOL_NAME;
+          if (!holdingCurrent) {
+            hasRealToolCall = true;
+            // No continuation can use this leg. Real-tool arguments are never copied.
+            held.length = legEvents.length = 0;
+            retention.releaseLeg();
+          } else {
+            if (!hasRealToolCall) {
+              retention.retain(event, true);
+              pending = { id: event.id, name: event.name, args: [], argumentBytes: 0, closed: false, ...(event.providerMetadata ? { providerMetadata: event.providerMetadata } : {}) };
+            }
+            continue;
+          }
+        } else if (event.type === "tool_call_delta") {
+          if (pending) {
+            const bytes = jsonStringPartsUtf8Bytes([event.arguments], TRANSLATOR_MAX_CALL_ARGUMENT_BYTES + 2) - 2;
+            if (bytes > TRANSLATOR_MAX_CALL_ARGUMENT_BYTES - pending.argumentBytes) {
+              throw new TranslatorBudgetExceededError("tool_args", TRANSLATOR_MAX_CALL_ARGUMENT_BYTES);
+            }
+            retention.retain(event);
+            pending.argumentBytes += bytes;
+            pending.args.push(event.arguments);
+          }
+          if (holdingCurrent) continue;
+        } else if (event.type === "tool_call_end") {
+          if (pending) {
+            retention.retain(event);
+            pending.closed = true;
+            if (pending.name === ADVISOR_TOOL_NAME) held.push(pending);
+            pending = null;
+          }
+          if (holdingCurrent) {
+            holdingCurrent = false;
+            continue;
+          }
+        } else if (event.type === "done") {
+          if (!hasRealToolCall) retention.retain(event);
+          if (pending) { held.push(pending); pending = null; }
+          terminalEvent = event;
+          terminalConsumed = true;
+          break;
+        } else if (event.type === "incomplete" || event.type === "error") {
+          // A broken leg cannot safely anchor a continuation: surface the terminal as-is.
+          if (pending) { pending = null; }
+          accumulatedUsage = retention.usage(accumulatedUsage, event.usage);
+          yield accumulatedUsage ? { ...event, usage: accumulatedUsage } : event;
+          return;
+        } else {
+          // Retain (bounded) the leg's visible content so the rebuilt assistant message is complete.
+          if (event.type === "text_delta") {
+            legTextChars += event.text.length;
+            // Empty deltas add nothing to the rebuilt message; non-empty ones are bounded by the cap.
+            if (!hasRealToolCall && event.text !== "" && legTextChars <= MAX_LEG_TEXT_CHARS) { retention.retain(event, false, false); legEvents.push(event); }
+          } else if (event.type === "thinking_delta") {
+            legThinkingChars += event.thinking.length;
+            if (!hasRealToolCall && event.thinking !== "" && legThinkingChars <= MAX_LEG_THINKING_CHARS) { retention.retain(event, false, false); legEvents.push(event); }
+          } else if (
+            event.type === "thinking_signature"
+            || event.type === "redacted_thinking"
+          ) {
+            if (!hasRealToolCall) { retention.retain(event); legEvents.push(event); }
+          }
+        }
+        yield event;
+      }
+
+      const advisorCalls = held.filter(call => call.name === ADVISOR_TOOL_NAME && call.closed);
+      const shouldIntercept = terminalConsumed
+        && terminalEvent?.stopReason !== "max_tokens"
+        && terminalEvent?.stopReason !== "content_filter"
+        && advisorCalls.length > 0
+        && !hasRealToolCall;
+
+      if (!shouldIntercept) {
+        // Plain leg: surface the terminal with merged usage from any earlier intercepted legs.
+        if (terminalEvent) {
+          accumulatedUsage = retention.usage(accumulatedUsage, terminalEvent.usage);
+          yield accumulatedUsage ? { ...terminalEvent, usage: accumulatedUsage } : terminalEvent;
+        }
+        return;
+      }
+
+      // Consume this leg's done — the continuation replaces it.
+      accumulatedUsage = retention.usage(accumulatedUsage, terminalEvent?.usage);
+      if (continuations >= MAX_ADVISOR_CONTINUATIONS_PER_REQUEST || finalContinuationUsed) {
+        yield {
+          type: "error",
+          status: 502,
+          errorType: "advisor_continuation_limit",
+          message: "Advisor worker continuation limit reached; no further worker calls were sent.",
+          ...(accumulatedUsage ? { usage: accumulatedUsage } : {}),
+        };
+        return;
+      }
+      // A repeated call after tool removal gets one last paired limit result, never a loop.
+      const isFinalContinuation = consultations >= maxConsultations;
+      // Reserve before any consultation await, so simultaneous guard entries share the bound.
+      continuations += 1;
+      finalContinuationUsed ||= isFinalContinuation;
+      const timestamp = Date.now();
+      const assistant = retention.history(retention.replayReservation(), () => assistantMessageFromLeg(legEvents, advisorCalls, timestamp, retention));
+      const messages: OcxMessage[] = [...parsed.context.messages];
+      if (assistant) messages.push(assistant);
+
+      for (const call of advisorCalls) {
+        if (consultations >= maxConsultations) {
+          // Runtime-owned limit text: not advice, and never a genuine advice wrapper.
+          const outcome = {
+            ok: false,
+            isError: true,
+            content: plan.formatUnavailable("limit", "consultation limit reached for this request"),
+          };
+          messages.push(retention.history(jsonUtf8Bytes(outcome) + jsonUtf8Bytes(call.id) + 256, () => advisorToolResult(call, outcome, timestamp))!);
+          continue;
+        }
+        consultations += 1;
+        // Later calls in the same leg must see what came before them: the rebuilt worker turn
+        // and every earlier advisor result in this leg's accumulated messages.
+        const consultParsed: OcxParsedRequest = {
+          ...parsed,
+          context: { ...parsed.context, messages },
+        };
+        let outcome: AdvisorConsultOutcome;
+        try {
+          outcome = await plan.consult(consultParsed, "manual", call.question);
+        } catch (error) {
+          if (isTranslatorBudgetExceededError(error)) throw error;
+          // Runtime-owned failure text only: the implementation neutralizes untrusted exception
+          // text so it can never forge a genuine advice wrapper.
+          outcome = {
+            ok: false,
+            isError: true,
+            content: plan.formatUnavailable("manual", error instanceof Error ? error.message : String(error)),
+          };
+        }
+        messages.push(retention.history(jsonUtf8Bytes(outcome) + jsonUtf8Bytes(call.id) + 256, () => advisorToolResult(call, outcome, timestamp))!);
+      }
+
+      const exhausted = consultations >= maxConsultations;
+      const tools = exhausted
+        ? parsed.context.tools?.filter(tool => !tool.advisor && tool.name !== ADVISOR_TOOL_NAME)
+        : parsed.context.tools;
+      const choice = parsed.options.toolChoice;
+      const nextParsed: OcxParsedRequest = {
+        ...parsed,
+        context: { ...parsed.context, messages, tools },
+        options: exhausted && ((typeof choice === "object" && choice !== null && "name" in choice && choice.name === ADVISOR_TOOL_NAME)
+          || (choice === "required" && !tools?.length))
+          ? { ...parsed.options, toolChoice: "auto" }
+          : parsed.options,
+      };
+      parsed = nextParsed;
+      // All replay owners were admitted while the raw leg was still live.
+      held.length = legEvents.length = advisorCalls.length = 0;
+      pending = null;
+      terminalEvent = undefined;
+      retention.releaseLeg();
+      yield { type: "assistant_boundary" };
+      try {
+        source = await options.continuation(parsed);
+      } catch (error) {
+        if (isTranslatorBudgetExceededError(error)) throw error;
+        yield {
+          type: "error",
+          message: error instanceof Error ? error.message : String(error),
+          ...(accumulatedUsage ? { usage: accumulatedUsage } : {}),
+        };
+        return;
+      }
+    }
+    } catch (error) {
+      if (!isTranslatorBudgetExceededError(error)) throw error;
+      yield { type: "error", status: 502, errorType: "upstream_error", code: "translation_buffer_limit",
+        message: "upstream translation buffer exceeded the safe limit", ...(accumulatedUsage ? { usage: accumulatedUsage } : {}) };
+    } finally { retention.release(); }
+  };
+}

package/src/server/responses/code-mode-collab-surface.ts

@@ -77,13 +77,104 @@ interface RenderedTool { name: string; raw: string }
 /** The declaration fence codex-rs opens: three backticks and "ts". */
 const DECLARATION_FENCE_SHAPE: Fence = { char: "`", length: 3 };
 
-/** A complete declaration as render_code_mode_sample emits it, single- or multi-line. */
-function isCompleteDeclaration(body: readonly string[], name: string): boolean {
+const DECLARATION_PREFIX = "declare const tools: { ";
+const PROMISE_SEPARATOR = "): Promise<";
+const DECLARATION_SUFFIX = ">; };";
+// Bounds keep a caller-controlled description linear work: a rendered listing is a heading, a
+// description, and a small declaration per tool, so anything this large cannot be the codex-rs
+// shape this parser exists to recognize.
+const MAX_DESCRIPTION_LENGTH = 1 << 20;
+const MAX_DECLARATION_LENGTH = 64 * 1024;
+
+const isSpace = (ch: string | undefined): boolean => ch === undefined || /\s/.test(ch);
+
+/**
+ * The declared tool name when body is a complete declaration as render_code_mode_sample emits it,
+ * single- or multi-line, else undefined. Fixed boundaries plus one forward scan that balances the
+ * parameter list's brackets and the return type's generics: no backtracking, so a fence body full
+ * of candidate separators stays linear work.
+ */
+function completeDeclarationName(body: readonly string[]): string | undefined {
   const text = body.join("\n");
-  const prefix = "declare const tools: { " + name + "(";
-  if (!text.startsWith(prefix)) return false;
+  if (text.length > MAX_DECLARATION_LENGTH) return undefined;
+  if (!text.startsWith(DECLARATION_PREFIX) || !text.endsWith(DECLARATION_SUFFIX)) return undefined;
+  const signature = text.slice(DECLARATION_PREFIX.length, -DECLARATION_SUFFIX.length);
+  const openParen = signature.indexOf("(");
+  const name = openParen > 0 ? signature.slice(0, openParen) : "";
+  if (!/^[A-Za-z_$][\w$]*$/.test(name)) return undefined;
   // A named, typed parameter (`args` for functions, `input` for freeform) and a non-empty return type.
-  return /^(?:args|input): \S[\s\S]*\): Promise<[^>\s][\s\S]*>; \};$/.test(text.slice(prefix.length));
+  const rest = signature.slice(openParen + 1);
+  const typed = rest.startsWith("args: ") ? 6 : rest.startsWith("input: ") ? 7 : -1;
+  if (typed < 0 || isSpace(rest[typed])) return undefined;
+  // Quoted text and comments are opaque to delimiter matching. Each skip advances
+  // past its text once; an unterminated region cannot contain a closing declaration.
+  const isOpaqueTypeText = (at: number): boolean => {
+    const ch = rest[at];
+    return ch === '"' || ch === "'" || ch === "`"
+      || ch === "/" && (rest[at + 1] === "/" || rest[at + 1] === "*");
+  };
+  const skipTypeText = (at: number): number | undefined => {
+    const quote = rest[at]!;
+    if (quote === "/" && rest[at + 1] === "/") {
+      let i = at + 2;
+      while (i < rest.length && rest[i] !== "\n" && rest[i] !== "\r"
+        && rest[i] !== "\u2028" && rest[i] !== "\u2029") i += 1;
+      return i < rest.length ? i : undefined;
+    }
+    if (quote === "/" && rest[at + 1] === "*") {
+      const end = rest.indexOf("*/", at + 2);
+      return end < 0 ? undefined : end + 1;
+    }
+    let i = at + 1;
+    while (i < rest.length) {
+      const ch = rest[i]!;
+      if (ch === "\\") i += 2;
+      else if (ch === quote) return i;
+      else i += 1;
+    }
+    return undefined;
+  };
+  // The parameter list ends at the ')' that balances the opening '(': a ')' nested inside the
+  // parameter's own type (e.g. `args: (a: string) => Promise<void>`) cannot pose as the separator.
+  // The type must also say something before that ')': `args: )` or `args: /* note */)` names no type.
+  let depth = 1;
+  let close = -1;
+  let typeContent = false;
+  for (let at = typed; at < rest.length; at += 1) {
+    const ch = rest[at]!;
+    if (isOpaqueTypeText(at)) {
+      if (ch !== "/") typeContent = true; // a quoted literal is a type, a comment is not
+      const end = skipTypeText(at);
+      if (end === undefined) return undefined;
+      at = end;
+      continue;
+    }
+    if (ch === "(" || ch === "[" || ch === "{") depth += 1;
+    else if (ch === ")" || ch === "]" || ch === "}") depth -= 1;
+    if (depth === 0) { close = at; break; }
+    if (!isSpace(ch)) typeContent = true;
+  }
+  if (close < 0 || !typeContent || !rest.startsWith(PROMISE_SEPARATOR, close)) return undefined;
+  const head = rest[close + PROMISE_SEPARATOR.length];
+  if (head === ">" || isSpace(head)) return undefined;
+  // The return type runs to the stripped suffix, which already supplied exactly one '>' for the
+  // Promise's '<': generic depth must stay positive to the end and land at exactly 1 — a '>' that
+  // reaches zero ('Promise<unknown>; garbage') is surplus text, a depth left above 1
+  // ('Promise<Map<string, unknown') never closed its own generic, and a '=>' arrow never counts.
+  let generic = 1;
+  for (let at = close + PROMISE_SEPARATOR.length; at < rest.length; at += 1) {
+    const ch = rest[at]!;
+    if (isOpaqueTypeText(at)) {
+      const end = skipTypeText(at);
+      if (end === undefined) return undefined;
+      at = end;
+      continue;
+    }
+    if (ch === "<") generic += 1;
+    else if (ch === ">" && rest[at - 1] !== "=") generic -= 1;
+    if (generic === 0) return undefined;
+  }
+  return generic === 1 ? name : undefined;
 }
 
 /** codex-rs normalize_code_mode_identifier: invalid identifier characters become `_`. */
@@ -114,9 +205,21 @@ function renderedHeading(match: RegExpExecArray): RenderedTool | undefined {
  * alone. Lines inside a quoted fence can neither open a section nor declare a tool.
  */
 function renderedNestedTools(description: string): RenderedTool[] {
+  if (description.length > MAX_DESCRIPTION_LENGTH) return [];
   const lines = description.split("\n");
   const rendered: RenderedTool[] = [];
   const pending: RenderedTool[] = [];
+  // Ascending indexes into `pending` per name, so a declaration finds its owner in one lookup
+  // instead of rescanning every pending heading.
+  const pendingByName = new Map<string, number[]>();
+  const dropPendingTo = (length: number): void => {
+    while (pending.length > length) {
+      const removed = pending.pop()!;
+      const indexes = pendingByName.get(removed.name)!;
+      indexes.pop();
+      if (indexes.length === 0) pendingByName.delete(removed.name);
+    }
+  };
   let fence: Fence | undefined;
   for (let i = 0; i < lines.length; i += 1) {
     const line = lines[i]!;
@@ -127,7 +230,11 @@ function renderedNestedTools(description: string): RenderedTool[] {
     const match = TOOL_HEADING.exec(line);
     if (match) {
       const heading = renderedHeading(match);
-      if (heading) pending.push(heading);
+      if (heading) {
+        const indexes = pendingByName.get(heading.name);
+        if (indexes) indexes.push(pending.length); else pendingByName.set(heading.name, [pending.length]);
+        pending.push(heading);
+      }
       continue;
     }
     if (line === DECLARATION_LEAD && lines[i + 1] === DECLARATION_FENCE) {
@@ -137,10 +244,11 @@ function renderedNestedTools(description: string): RenderedTool[] {
       const body = lines.slice(i + 2, close);
       // The outermost pending heading with the declared name owns it, so a same-name heading quoted
       // inside the tool's own description cannot take over the genuine section.
-      const owner = pending.findIndex(tool => isCompleteDeclaration(body, tool.name));
+      const declared = completeDeclarationName(body);
+      const owner = declared === undefined ? -1 : pendingByName.get(declared)?.[0] ?? -1;
       if (owner >= 0) {
         rendered.push(pending[owner]!);
-        pending.length = owner;
+        dropPendingTo(owner);
       }
       i = close;
       continue;

package/src/server/responses/codex-ws-wire.ts

@@ -1,3 +1,4 @@
+import { normalizeResponsesIncompleteReason } from "../../responses/incomplete-reason";
 import { MAX_CLIENT_SSE_FRAME_BYTES } from "../sse-frame-buffer";
 import {
   isTransientUpstreamStatus,
@@ -8,6 +9,7 @@ import {
 import { isRateLimitOrQuotaFailureMessage, recognizedUpstreamError } from "../../lib/errors";
 import type { RequestFailureCause, RequestFailureStage } from "../../lib/request-failure-model";
 import { packageVersion } from "../../lib/package-version";
+import { registerProviderResponseProvenance } from "../../providers/request-pacing";
 // If the 101 never arrives (network black hole), give SSE a chance well before
 // the caller's connect timeout (default 200s) would fire.
 export const UPGRADE_DEADLINE_MS = 10_000;
@@ -49,9 +51,12 @@ export const CODEX_WS_CREATE_FRAME_LIMIT_BYTES =
 /** Close code the backend uses for an oversized message (RFC 6455 "message too big"). */
 const WS_CLOSE_MESSAGE_TOO_BIG = 1009;
 
-const codexWsUpstreamResponses = new WeakSet<Response>();
-const quotaObservedResponses = new WeakSet<Response>();
-const codexWsPreludeProjections = new WeakSet<Response>();
+const codexWsUpstreamResponses = new WeakMap<Response, true>();
+const quotaObservedResponses = new WeakMap<Response, true>();
+const codexWsPreludeProjections = new WeakMap<Response, true>();
+registerProviderResponseProvenance(codexWsUpstreamResponses);
+registerProviderResponseProvenance(quotaObservedResponses);
+registerProviderResponseProvenance(codexWsPreludeProjections);
 
 /** Quota arrived directly at its captured account; do not replay old HTTP prelude headers. */
 export function isCodexWsQuotaObservedResponse(response: Response): boolean {
@@ -65,7 +70,7 @@ export function isCodexWsUpstreamResponse(response: Response): boolean {
 
 /** Pre-response projection; its headers retain the exchange's prelude snapshot. */
 export function markCodexWsPreludeProjection(response: Response): void {
-  codexWsPreludeProjections.add(response);
+  codexWsPreludeProjections.set(response, true);
 }
 
 export function isCodexWsPreludeProjection(response: Response): boolean {
@@ -73,8 +78,8 @@ export function isCodexWsPreludeProjection(response: Response): boolean {
 }
 
 export function markCodexWsResponse(response: Response, observed: boolean): void {
-  codexWsUpstreamResponses.add(response);
-  if (observed) quotaObservedResponses.add(response);
+  codexWsUpstreamResponses.set(response, true);
+  if (observed) quotaObservedResponses.set(response, true);
 }
 
 /**
@@ -313,6 +318,7 @@ export function restoreCodexWsPreOutputRefusal(response: Response): Response {
 }
 
 const codexWsStageByResponse = new WeakMap<Response, CodexWsStageRecord>();
+registerProviderResponseProvenance(codexWsStageByResponse);
 
 export function markCodexWsStage(response: Response, record: CodexWsStageRecord): void {
   const current = codexWsStageByResponse.get(response);
@@ -457,6 +463,7 @@ export function projectCodexWsFailure(
 }
 
 const socketDeathStages = new WeakMap<Response, RequestFailureStage>();
+registerProviderResponseProvenance(socketDeathStages);
 
 /**
  * Record that a pre-response settle came from the socket closing or failing under the send (#4191),
@@ -517,12 +524,12 @@ export function normalizeResponsesWsRelayEvent(text: string): ResponsesWsRelayEv
     return null;
   }
   if (!payload || typeof payload !== "object" || Array.isArray(payload)) return null;
-  const record = payload as Record<string, unknown>;
+  const record = normalizeResponsesIncompleteReason(payload as Record<string, unknown>);
   if (typeof record.type !== "string") return null;
   // A native error may be pretty-printed JSON. SSE prefixes one data line;
   // embedded physical newlines would otherwise truncate the JSON for readers.
   if (record.type !== "response.done") return {
-    type: record.type, text: /[\r\n]/.test(text) ? JSON.stringify(record) : text, payload: record,
+    type: record.type, text: record !== payload || /[\r\n]/.test(text) ? JSON.stringify(record) : text, payload: record,
   };
 
   const response = record.response;