@bitkyc08/opencodex 2.86.0 → 2.88.0

package/src/server/auth-cors.ts

@@ -30,6 +30,7 @@ import {
   providerForwardClientHeadersConfigError,
   reasoningSummaryDeliveryRecordConfigError,
   upstreamHttpVersionConfigError,
+  credentialPinnedProviderConfigError,
 } from "../config/provider-validation";
 import { providerDestinationConfigError } from "../lib/destination-policy";
 import { providerEgressConfigError } from "../lib/provider-egress";
@@ -784,6 +785,8 @@ export function providerManagementConfigError(
     delete canonicalCandidate.pinnedReasoningEffort;
     delete canonicalCandidate.modelPinnedReasoningEfforts;
     delete canonicalCandidate.responsesSnapshotRepair;
+    // Explicit history-loss opt-in changes request content, never auth or transport identity.
+    delete canonicalCandidate.projectResponsesLiteHostedSearchHistory;
     // modelCosts is a user-owned display overlay, not part of the canonical
     // forward seed; it is validated separately below (providerModelCostsConfigError).
     delete canonicalCandidate.modelCosts;
@@ -912,6 +915,8 @@ export function providerManagementConfigError(
   if (reasoningSummaryDeliveryError) return `provider ${name} ${reasoningSummaryDeliveryError}`;
   const modelAdaptersError = modelAdapterRecordConfigError(raw.modelAdapters, "modelAdapters", name, typed);
   if (modelAdaptersError) return `provider ${name} ${modelAdaptersError}`;
+  const credentialPinError = credentialPinnedProviderConfigError(name, typed);
+  if (credentialPinError) return `provider ${name} ${credentialPinError}`;
   const preferHostedToolsError = modelPreferHostedToolsConfigError(
     raw.modelPreferHostedTools,
     "modelPreferHostedTools",
@@ -919,6 +924,9 @@ export function providerManagementConfigError(
     typed,
   );
   if (preferHostedToolsError) return `provider ${name} ${preferHostedToolsError}`;
+  if (raw.projectResponsesLiteHostedSearchHistory !== undefined && typeof raw.projectResponsesLiteHostedSearchHistory !== "boolean") {
+    return `provider ${name} projectResponsesLiteHostedSearchHistory must be a boolean`;
+  }
   if (raw.responsesSnapshotRepair !== undefined && typeof raw.responsesSnapshotRepair !== "boolean") {
     return `provider ${name} responsesSnapshotRepair must be a boolean`;
   }
@@ -1053,9 +1061,12 @@ const PROVIDER_CONFIG_FIELD_POLICY = {
   preserveResponsesReasoningContent: "editor",
   preserveResponsesInputItemIds: "editor",
   preserveResponsesMessageMetadata: "editor",
+  projectResponsesLiteHostedSearchHistory: "editor",
   dropResponsesReasoningItems: "editor",
   modelReasoningEffortsAuthoritative: "editor",
   decodesNativeCompactionBlobs: "editor",
+  supportsNativeCompactionTrigger: "editor",
+  supportsNativeCompactEndpoint: "editor",
   allowEncryptedV2AgentTasks: "editor",
   allowPrivateNetwork: "editor",
   // A proxy URL routinely embeds `user:password@`, so it never reaches the dashboard DTO and

package/src/server/chat-completions.ts

@@ -54,6 +54,7 @@ import {
 } from "./request-log";
 import { createFinalRequestLog } from "./inference/final-log";
 import { clientWireLogOf, clientWireOf } from "./inference/client-wire";
+import { attachAdvisorReasoning } from "./inference/advisor-diagnostics";
 import { directEncodersApply } from "./inference/client-encoder-delivery";
 import { responseWithDeferredRequestLog } from "./relay";
 import { handleResponses } from "./responses";
@@ -114,8 +115,10 @@ export async function handleChatCompletions(
 ): Promise<Response> {
   const translatorBudget = createTranslatorBudget();
   try {
+    let response = await handleChatCompletionsWithBudget(req, config, logCtx, translatorBudget, logIds);
+    if (isInternalCallCapability(req.headers.get(ADVISOR_INTERNAL_CAPABILITY_HEADER))) response = attachAdvisorReasoning(response, logCtx);
     return finalizeTranslatorBudgetResponse(
-      await handleChatCompletionsWithBudget(req, config, logCtx, translatorBudget, logIds),
+      response,
       translatorBudget,
       req.signal,
     );
@@ -601,6 +604,9 @@ async function handleChatCompletionsWithBudget(
       // below could never restore this one -- the translated client was told the provider
       // throttled the turn, and handed a two-second wait to send it again.
       classified.code = UPSTREAM_RESET_REPLAY_REFUSED_CODE;
+    } else if (upstreamCode === "claude_subscription_cooldown") {
+      classified.code = "claude_subscription_cooldown";
+      classified.type = "rate_limit_error";
     } else if (upstreamCode === "model_not_found") {
       // Structured model_not_found must win over classifyError's generic remaps.
       classified.code = "model_not_found";

package/src/server/chat-native-reasoning.ts

@@ -0,0 +1,123 @@
+import type { OcxProviderConfig, OcxReasoningReplayScopeRef } from "../types";
+import type { TranslatorBudget } from "../lib/translator-budget";
+import { chatReasoningReplayPolicy, isChatRecord } from "../adapters/openai-chat/reasoning-replay";
+import { bindReasoningReplayScope, reasoningReplayDestinationIdentity,
+  reasoningReplayKeyCredentialIdentity, rememberReasoningForCall } from "../responses/reasoning-replay-cache";
+import { reasoningReplayConversationIdFromResponsesRequest, sessionIdHeaderFromRequest } from "./request-log-conversation";
+
+type Rec = Record<string, unknown>;
+
+export function nativeChatReplayScope(headers: Headers): OcxReasoningReplayScopeRef | undefined {
+  const clientThreadId = reasoningReplayConversationIdFromResponsesRequest({
+    threadIdHeader: headers.get("thread-id"), sessionIdHeader: sessionIdHeaderFromRequest(headers),
+  });
+  return clientThreadId ? { clientThreadId } : undefined;
+}
+
+/** Rebind before EVERY build: a key rotation must not retrieve another credential's reasoning. */
+export function bindNativeChatReplayScope(
+  scope: OcxReasoningReplayScopeRef | undefined,
+  provider: OcxProviderConfig,
+  providerName: string,
+  modelId: string,
+): void {
+  const providerDestinationIdentity = reasoningReplayDestinationIdentity(provider.baseUrl);
+  const credentialIdentity = reasoningReplayKeyCredentialIdentity(provider);
+  bindReasoningReplayScope(scope, providerDestinationIdentity && credentialIdentity ? {
+    providerName, modelId, adapterName: "openai-chat",
+    providerDestinationIdentity, credentialIdentity,
+  } : undefined);
+}
+
+/** Observe the native wire, never translate it or retain tool arguments/content. */
+export function nativeChatReasoningCapture(
+  provider: OcxProviderConfig,
+  modelId: string,
+  scope: OcxReasoningReplayScopeRef | undefined,
+  budget: TranslatorBudget,
+) {
+  const choices = new Map<number, { text: string; calls: Map<number, string> }>();
+  const accounting = { kind: "retained_collectors" as const };
+  // This optional fallback cannot retain more than the cache it feeds (256 KiB / 64 calls).
+  const maxBytes = 256 * 1024;
+  let bytes = 0;
+  let callCount = 0;
+  let disabled = !scope?.current || !chatReasoningReplayPolicy(provider, modelId).preserve;
+  const discard = () => {
+    budget.releaseRetained(bytes, accounting);
+    bytes = 0;
+    choices.clear();
+    disabled = true;
+  };
+  const remember = (text: string, calls: Iterable<string>) => {
+    for (const id of calls) rememberReasoningForCall(id, text, scope);
+  };
+  const observe = (value: Rec) => {
+    if (disabled || !Array.isArray(value.choices)) return;
+    for (const [ordinal, raw] of value.choices.entries()) {
+      if (!isChatRecord(raw) || !isChatRecord(raw.delta)) continue;
+      const index = typeof raw.index === "number" ? raw.index : ordinal;
+      if (!choices.has(index)) {
+        if (choices.size >= 64) { discard(); return; }
+        choices.set(index, { text: "", calls: new Map() });
+      }
+      const state = choices.get(index)!;
+      const delta = raw.delta;
+      const append = (previous: string, fragment: string): string | undefined => {
+        const added = Buffer.byteLength(fragment) * 2;
+        if (bytes + added > maxBytes) { discard(); return undefined; }
+        // Account the new retained fragment before concatenation; the transient reservation
+        // covers the old string while its replacement is allocated.
+        const reservation = budget.reserveTransient(Buffer.byteLength(previous) * 2, accounting);
+        try {
+          budget.chargeRetained(added, accounting);
+          bytes += added;
+          return previous + fragment;
+        } finally { reservation.release(); }
+      };
+      if (typeof delta.reasoning_content === "string" && delta.reasoning_content.length > 0) {
+        const text = append(state.text, delta.reasoning_content);
+        if (text === undefined) return;
+        state.text = text;
+      }
+      if (Array.isArray(delta.tool_calls)) {
+        for (const [toolOrdinal, tool] of delta.tool_calls.entries()) {
+          if (!isChatRecord(tool) || typeof tool.id !== "string" || tool.id.length === 0) continue;
+          const toolIndex = typeof tool.index === "number" ? tool.index : toolOrdinal;
+          if (!state.calls.has(toolIndex)) {
+            if (callCount >= 64) { discard(); return; }
+            callCount += 1;
+          }
+          const previous = state.calls.get(toolIndex) ?? "";
+          if (previous === tool.id) continue;
+          const id = append(previous, tool.id);
+          if (id === undefined) return;
+          state.calls.set(toolIndex, id);
+        }
+      }
+      // The completed choice is valid even if a caller dispatches its tool before [DONE].
+      if (typeof raw.finish_reason === "string" && raw.finish_reason.length > 0) {
+        remember(state.text, state.calls.values());
+      }
+    }
+  };
+  return {
+    observe,
+    finish(success: boolean) {
+      if (success && !disabled) {
+        for (const state of choices.values()) remember(state.text, state.calls.values());
+      }
+      discard();
+    },
+    json(value: Rec) {
+      if (disabled || !Array.isArray(value.choices)) return;
+      for (const choice of value.choices) {
+        if (!isChatRecord(choice) || !isChatRecord(choice.message)) continue;
+        const message = choice.message;
+        if (typeof message.reasoning_content !== "string" || !Array.isArray(message.tool_calls)) continue;
+        remember(message.reasoning_content, message.tool_calls.filter(isChatRecord)
+          .flatMap(tool => typeof tool.id === "string" ? [tool.id] : []));
+      }
+    },
+  };
+}

package/src/server/chat-native-sse.ts

@@ -1,5 +1,5 @@
 import { chatCompletionsErrorBody } from "../chat/outbound";
-import { classifyError, cyberPolicyErrorType, CYBER_POLICY_ERROR_CODE, isCyberPolicyCode } from "../lib/errors";
+import { classifyError, cyberPolicyErrorType, CYBER_POLICY_ERROR_CODE, isCyberPolicyCode, UNDECLARED_TOOL_CALL_ERROR_CODE } from "../lib/errors";
 import { redactSecretString } from "../lib/redact";
 import {
   isTranslatorBudgetExceededError,
@@ -16,6 +16,39 @@ function isRec(value: unknown): value is Rec {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 
+export const UNDECLARED_CHAT_TOOL_MESSAGE = "Upstream emitted a client tool call outside this request's declared tool catalog.";
+
+function* chatToolCalls(value: Rec): Generator<{ key: string; name: string; snapshot: boolean; invalid?: boolean }> {
+  const choices = Array.isArray(value.choices) ? value.choices : [];
+  for (const [position, choice] of choices.entries()) {
+    if (!isRec(choice)) continue;
+    const choiceIndex = typeof choice.index === "number" ? choice.index : position;
+    for (const [payload, snapshot] of [[choice.delta, false], [choice.message, true]] as const) {
+      if (!isRec(payload)) continue;
+      const tools = Array.isArray(payload.tool_calls) ? payload.tool_calls : [];
+      for (const [index, tool] of tools.entries()) {
+        const fn = isRec(tool) && isRec(tool.function) ? tool.function : {};
+        const toolIndex = isRec(tool) && typeof tool.index === "number" ? tool.index : index;
+        yield {
+          key: `${choiceIndex}:tool:${toolIndex}`, name: typeof fn.name === "string" ? fn.name : "", snapshot,
+          invalid: !isRec(tool) || (tool.type !== undefined && tool.type !== "function"),
+        };
+      }
+      if (payload.function_call !== undefined && payload.function_call !== null) {
+        const fn = isRec(payload.function_call) ? payload.function_call : {};
+        yield { key: `${choiceIndex}:legacy`, name: typeof fn.name === "string" ? fn.name : "", snapshot };
+      }
+    }
+  }
+}
+
+export function chatResponseHasUndeclaredToolCalls(value: Rec, declared: ReadonlySet<string>): boolean {
+  for (const call of chatToolCalls(value)) {
+    if (call.invalid || !declared.has(call.name)) return true;
+  }
+  return false;
+}
+
 export function usageFromChat(value: unknown): OcxUsage | undefined {
   if (!isRec(value)) return undefined;
   const prompt = typeof value.prompt_tokens === "number" ? value.prompt_tokens : undefined;
@@ -134,8 +167,11 @@ interface NativeChatSseOptions {
    * `stallTimeoutSec` then resolves to disabled so a slow local model is not cut mid-turn.
    */
   localUpstream?: boolean;
+  clientDeclaredEmptyToolCatalog?: boolean;
+  declaredLegacyFunctionNames?: ReadonlySet<string>;
   onFirstOutput?: () => void;
   onUsage: (usage: OcxUsage) => void;
+  onChunk?: (value: Rec) => void;
   onTerminal?: (status: number, message?: string) => void;
   onCancel?: () => void;
 }
@@ -154,6 +190,29 @@ export function nativeChatSse(
     }
   });
   let queuedBytes = 0;
+  const declared = options.declaredLegacyFunctionNames ?? new Set<string>();
+  const toolNames = new Map<string, string>();
+  const pendingToolNames = new Set<string>();
+  const heldFrames: string[] = [];
+  let heldBytes = 0;
+  let toolNameBytes = 0;
+  const hasPendingToolName = () => pendingToolNames.size > 0;
+  const inspectToolCalls = (value: Rec): boolean => {
+    for (const call of chatToolCalls(value)) {
+      if (call.invalid) return false;
+      const previous = toolNames.get(call.key);
+      const name = call.snapshot ? call.name : (previous ?? "") + call.name;
+      if (!declared.has(name) && ![...declared].some(allowed => allowed.startsWith(name))) return false;
+      const bytes = previous === undefined ? 128 + Buffer.byteLength(call.key) * 2 + Buffer.byteLength(name) * 2
+        : Math.max(0, Buffer.byteLength(name) - Buffer.byteLength(previous)) * 2;
+      options.translatorBudget.chargeRetained(bytes, scope);
+      toolNameBytes += bytes;
+      toolNames.set(call.key, name);
+      if (declared.has(name)) pendingToolNames.delete(call.key);
+      else pendingToolNames.add(call.key);
+    }
+    return true;
+  };
   let sawFinish = false;
   let sawDone = false;
   let firstOutput = false;
@@ -191,7 +250,31 @@ export function nativeChatSse(
       throw error;
     }
   };
-  const releaseBuffer = () => buffer.clear();
+  const releaseHeld = () => {
+    options.translatorBudget.releaseRetained(heldBytes, scope);
+    heldBytes = 0;
+    heldFrames.length = 0;
+  };
+  const relay = (controller: ReadableStreamDefaultController<Uint8Array>, text: string) => {
+    if (hasPendingToolName()) {
+      const bytes = Buffer.byteLength(text) * 2;
+      options.translatorBudget.chargeRetained(bytes, scope);
+      heldBytes += bytes;
+      heldFrames.push(text);
+      return;
+    }
+    for (const frame of heldFrames) enqueue(controller, frame);
+    releaseHeld();
+    enqueue(controller, text);
+  };
+  const releaseBuffer = () => {
+    buffer.clear();
+    releaseHeld();
+    options.translatorBudget.releaseRetained(toolNameBytes, scope);
+    toolNameBytes = 0;
+    toolNames.clear();
+    pendingToolNames.clear();
+  };
   const settle = (status: number, message?: string) => {
     if (settled) return;
     settled = true;
@@ -206,12 +289,12 @@ export function nativeChatSse(
     type = "upstream_error",
   ) => {
     const safeMessage = redactSecretString(message);
+    releaseBuffer();
     try {
       const frame = `data: ${JSON.stringify(chatCompletionsErrorBody(status, safeMessage, type, code))}\n\n`;
       if (code === "translation_buffer_limit") controller.enqueue(encoder.encode(frame));
       else enqueue(controller, frame);
     } catch { /* controller may already be closed */ }
-    releaseBuffer();
     settle(status, safeMessage);
     try { void reader.cancel(new Error(safeMessage)).catch(() => {}); } catch { /* already closed */ }
     try { controller.close(); } catch { /* already closed */ }
@@ -224,16 +307,20 @@ export function nativeChatSse(
     const payload = sseDataPayload(block);
     if (payload === null) {
       if (performance.now() >= pullDeadline) throw stalled;
-      enqueue(controller, block + delimiter);
+      relay(controller, block + delimiter);
       return;
     }
     const trimmed = payload.trim();
     if (trimmed === "") {
       if (performance.now() >= pullDeadline) throw stalled;
-      enqueue(controller, block + delimiter);
+      relay(controller, block + delimiter);
       return;
     }
     if (trimmed === "[DONE]") {
+      if (hasPendingToolName()) {
+        fail(controller, UNDECLARED_CHAT_TOOL_MESSAGE, UNDECLARED_TOOL_CALL_ERROR_CODE);
+        return;
+      }
       sawDone = true;
       enqueue(controller, replaceSseDataPayload(block, "[DONE]") + delimiter);
       releaseBuffer();
@@ -272,9 +359,20 @@ export function nativeChatSse(
       return;
     }
     const usage = usageFromChat(parsed.usage);
+    options.onChunk?.(parsed);
     if (usage) options.onUsage(usage);
+    if (options.clientDeclaredEmptyToolCatalog && !inspectToolCalls(parsed)) {
+      fail(controller, UNDECLARED_CHAT_TOOL_MESSAGE, UNDECLARED_TOOL_CALL_ERROR_CODE);
+      return;
+    }
     const choices = Array.isArray(parsed.choices) ? parsed.choices : [];
     const finished = choices.some(choice => isRec(choice) && typeof choice.finish_reason === "string" && choice.finish_reason.length > 0);
+    if (hasPendingToolName() && choices.some((choice, position) => isRec(choice)
+      && typeof choice.finish_reason === "string" && choice.finish_reason.length > 0
+      && [...pendingToolNames].some(key => key.startsWith(`${typeof choice.index === "number" ? choice.index : position}:`)))) {
+      fail(controller, UNDECLARED_CHAT_TOOL_MESSAGE, UNDECLARED_TOOL_CALL_ERROR_CODE);
+      return;
+    }
     if (finished) sawFinish = true;
     const hasText = choices.some(choice => {
       if (!isRec(choice) || !isRec(choice.delta)) return false;
@@ -302,11 +400,11 @@ export function nativeChatSse(
     const hasProgress = hasText || hasTool;
     if (hasProgress || finished) pullDeadline = performance.now() + stallMs;
     else if (performance.now() >= pullDeadline) throw stalled;
-    if (!firstOutput && hasProgress) {
+    if (!firstOutput && hasProgress && !hasPendingToolName()) {
       firstOutput = true;
       options.onFirstOutput?.();
     }
-    enqueue(controller, replaceSseDataPayload(block, JSON.stringify(normalizedChunk(parsed, options.requestedModel))) + delimiter);
+    relay(controller, replaceSseDataPayload(block, JSON.stringify(normalizedChunk(parsed, options.requestedModel))) + delimiter);
   };
 
   function onAbort() {
@@ -336,6 +434,7 @@ export function nativeChatSse(
           if (next) {
             buffer.compact();
             processBlock(controller, next.block, next.delimiter);
+            if (heldFrames.length > 0 && !settled) continue;
             return;
           }
           if (performance.now() >= pullDeadline) throw stalled;
@@ -370,6 +469,10 @@ export function nativeChatSse(
             continue;
           }
           buffer.append(decoder.decode());
+          if (hasPendingToolName()) {
+            fail(controller, UNDECLARED_CHAT_TOOL_MESSAGE, UNDECLARED_TOOL_CALL_ERROR_CODE);
+            return;
+          }
           if (buffer.tail().trim().length > 0) {
             fail(controller, "upstream SSE ended with an unterminated event", "upstream_sse_unterminated");
             return;