@bitkyc08/opencodex 2.89.0 → 2.90.0

package/src/server/responses/deepseek-image-files.ts

@@ -0,0 +1,121 @@
+import type { TranslatorBudget } from "../../lib/translator-budget";
+import type { AdapterRequest } from "../../adapters/base";
+import { readBoundedResponseBody } from "../../lib/bounded-body";
+
+// DeepSeek's image-token accounting does not include the inline base64 wire cost.
+// https://api-docs.deepseek.com/guides/vision/ documents a separate 48 MiB body cap.
+const INLINE_THRESHOLD = 40 * 1024 * 1024;
+const TARGET_BYTES = 32 * 1024 * 1024;
+const MAX_FILE_BYTES = 64 * 1024 * 1024;
+const MAX_REPAIR_BYTES = 128 * 1024 * 1024;
+const MAX_CACHE_ENTRIES = 512;
+const CACHE_MS = 50 * 60 * 1000;
+let activeRepairs = 0;
+const files = new Map<string, { id: string; until: number }>();
+
+/** Narrow parsed JSON objects without treating arrays as image or message records. */
+function record(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+/** Only the first-party Responses image contract, never a similarly named gateway. */
+export function needsDeepSeekImageFiles(request: AdapterRequest): boolean {
+  const url = new URL(request.url);
+  return url.origin === "https://api.deepseek.com"
+    && (url.pathname === "/responses" || url.pathname === "/v1/responses")
+    && request.method === "POST"
+    && Buffer.byteLength(request.body, "utf8") > INLINE_THRESHOLD;
+}
+
+/**
+ * Replace older inline images with same-account, expiring file references. The client history
+ * and images stay intact; provider token usage and Codex's compaction policy remain truthful.
+ * The caller owns the provider's transport, cancellation and credential-selection fence.
+ */
+export async function deepSeekImageFileBody(
+  request: AdapterRequest,
+  execute: typeof globalThis.fetch,
+  abortSignal?: AbortSignal,
+  options?: { allowedModels: readonly string[]; budget?: TranslatorBudget },
+): Promise<string | undefined> {
+  if (!options?.allowedModels.length || !needsDeepSeekImageFiles(request)) return undefined;
+  const requestBytes = Buffer.byteLength(request.body, "utf8");
+  if (requestBytes > MAX_REPAIR_BYTES) throw new Error("DeepSeek image replay exceeds the 128 MiB repair limit; compact the request.");
+  if (activeRepairs >= 2) throw new Error("DeepSeek image replay preparation is busy; retry after an active request completes.");
+  activeRepairs++;
+  const releaseCopy = options.budget?.observeAcceptedRequestCopy(requestBytes * 2);
+  try {
+    abortSignal?.throwIfAborted();
+    const body: unknown = JSON.parse(request.body);
+    if (!record(body) || !options.allowedModels.includes(String(body.model))
+      || !Array.isArray(body.input)) return undefined;
+    const auth = new Headers(request.headers).get("authorization");
+    if (!auth) return undefined;
+    const scope = new Bun.CryptoHasher("sha256").update(auth).digest("hex");
+    const signal = AbortSignal.any([...(abortSignal ? [abortSignal] : []), AbortSignal.timeout(60_000)]);
+    let bytes = Buffer.byteLength(request.body, "utf8");
+    let changed = false;
+    for (const item of body.input) {
+      if (!record(item)) continue;
+      const parts = item.type === "function_call_output" || item.type === "custom_tool_call_output"
+        ? item.output : item.role === "user" || item.role === "developer" ? item.content : undefined; // DeepSeek rejects other roles' images.
+      if (!Array.isArray(parts)) continue;
+      for (const part of parts) {
+        if (bytes <= TARGET_BYTES) break;
+        // file_id ignores detail; keep explicit low-resolution requests inline.
+        if (!record(part) || part.type !== "input_image" || part.file_id !== undefined
+          || part.detail === "low" || typeof part.image_url !== "string") continue;
+        const match = /^data:(image\/(?:png|jpeg|webp|gif));base64,/.exec(part.image_url);
+        if (!match) continue;
+        signal.throwIfAborted();
+        const data = part.image_url.slice(match[0].length);
+        if (data.length > Math.ceil(MAX_FILE_BYTES / 3) * 4) continue;
+        const hash = new Bun.CryptoHasher("sha256").update(part.image_url).digest("hex");
+        const key = `${scope}:${hash}`;
+        let entry = files.get(key);
+        if (entry && entry.until <= Date.now()) { files.delete(key); entry = undefined; }
+        if (!entry) {
+          // Conservative peak: UTF-16 base64 slice/re-encoding, decoded buffer, Blob and multipart.
+          const releaseUpload = options.budget?.observeExternallyCapped("provider_image_upload", data.length * 4 + Math.ceil(data.length * 3 / 4) * 3 + 65_536);
+          try {
+            const image = Buffer.from(data, "base64");
+            if (image.length > MAX_FILE_BYTES || image.toString("base64") !== data) continue;
+            const form = new FormData();
+            form.set("purpose", "user_data");
+            form.set("expires_after[anchor]", "created_at");
+            form.set("expires_after[seconds]", "3600");
+            form.set("file", new Blob([image], { type: match[1] }), "image");
+            // Never follow a redirect with credentials or copy request-specific Content-Length.
+            const response = await execute("https://api.deepseek.com/files", {
+              method: "POST", headers: { authorization: auth }, body: form, signal, redirect: "manual",
+            });
+            if (!response.ok) {
+              await response.body?.cancel();
+              throw new Error(`DeepSeek image upload failed (HTTP ${response.status}); conversation images were preserved.`);
+            }
+            const result = await readBoundedResponseBody(response, { signal, maxBytes: 65_536 });
+            let uploaded: unknown;
+            try { uploaded = JSON.parse(result.text); } catch { /* Safe, fixed error below. */ }
+            if (result.truncated || !record(uploaded) || typeof uploaded.id !== "string"
+              || !/^file-api-[A-Za-z0-9_-]{1,200}$/.test(uploaded.id)) {
+              throw new Error("DeepSeek image upload returned an invalid file reference; conversation images were preserved.");
+            }
+            // Cache only opaque ids and hashes, not image bytes or plaintext credentials.
+            entry = { id: uploaded.id, until: Date.now() + CACHE_MS };
+            if (typeof uploaded.expires_at === "number") entry.until = Math.min(entry.until, uploaded.expires_at * 1000 - 60_000);
+            while (files.size >= MAX_CACHE_ENTRIES) files.delete(files.keys().next().value!);
+            files.set(key, entry);
+          } finally { releaseUpload?.(); }
+        }
+        const removedBytes = part.image_url.length + "image_url".length;
+        delete part.image_url;
+        part.file_id = entry.id;
+        bytes += entry.id.length + "file_id".length - removedBytes;
+        changed = true;
+      }
+    }
+    if (!changed) return undefined;
+    const releaseSerialization = options.budget?.observeExternallyCapped("passthrough_serialization", requestBytes * 2);
+    try { return JSON.stringify(body); } finally { releaseSerialization?.(); }
+  } finally { releaseCopy?.(); activeRepairs--; }
+}

package/src/server/responses/empty-completion-guard.ts

@@ -243,6 +243,11 @@ export async function* guardEmptyCompletionEventStream(
     heldBytes = 0;
     return released;
   };
+  // Held events from a discarded attempt are released with the retry's output, so a boundary
+  // keeps the retry's reasoning from being appended to the discarded attempt's reasoning item.
+  const markRetryBoundary = () => {
+    if (held.length > 0 && held.at(-1)?.type !== "assistant_boundary") held.push({ type: "assistant_boundary" });
+  };
 
   while (true) {
     let terminalSeen = false;
@@ -279,6 +284,7 @@ export async function* guardEmptyCompletionEventStream(
         if (retries < maxRetries) {
           // Suppress the terminal: the client must never see a completed event
           // for a turn that produced nothing. Retry the identical turn.
+          markRetryBoundary();
           retries += 1;
           try {
             source = await options.continuation();
@@ -300,6 +306,7 @@ export async function* guardEmptyCompletionEventStream(
           // malformed function call). Nothing actionable reached the client, so this is the same
           // replay-safe shape as an empty completion: retry the identical turn once.
           usage = mergeUsage(usage, event.usage);
+          markRetryBoundary();
           retries += 1;
           try {
             source = await options.continuation();
@@ -351,6 +358,7 @@ export async function* guardEmptyCompletionEventStream(
       // actionable reached the client. Retry once, then surface a stated error
       // instead of letting the bridge reduce the turn to adapter_eof.
       if (!sawContent && !passthrough && retries < maxRetries) {
+        markRetryBoundary();
         retries += 1;
         try {
           source = await options.continuation();

package/src/server/responses/fetch-helpers.ts

@@ -1,4 +1,5 @@
 import type { NativeResponseControl } from "./native-response-control";
+import { PROVIDER_HEADER_DEADLINE as HEADER_DEADLINE, type ProviderHeaderDeadline as HeaderDeadline } from "../../lib/provider-admission-wait";
 import type { CodexWsPreOutputRefusalHold } from "./codex-ws-wire";
 import type { Server } from "bun";
 import {
@@ -62,9 +63,6 @@ export function physicalSendObserverInit(observer: AccountAutoPauseObserver | un
 }
 // One WS attempt and its HTTP fallback are one logical physical-send receipt.
 const WS_FALLBACK_RECEIPT = Symbol.for("opencodex.ws-fallback-receipt");
-// Replacement admission waits on the client signal, outside the response-header deadline.
-const HEADER_DEADLINE = Symbol("header-deadline");
-type HeaderDeadline = { clientSignal: AbortSignal; pause(): void; resume(): void };
 
 /**
  * Announce once, per provider, that an explicit egress route moved this provider off the
@@ -248,6 +246,20 @@ export function sendWithConnectionPolicy(
   });
 }
 
+interface CodexWsExecutor { provider: OcxProviderConfig; http: typeof globalThis.fetch }
+const codexWsExecutors = new WeakMap<object, CodexWsExecutor>();
+const codexWsExecutor = (send: (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit) => Promise<Response>, binding: CodexWsExecutor) => {
+  codexWsExecutors.set(send, binding);
+  return send as typeof globalThis.fetch;
+};
+/**
+ * Set for the executor a `dispatchOverride` receives on the WS branch: it must not get HTTP-only
+ * send policy. `provider` is the one WS eligibility was checked against; a dispatch-time
+ * replacement was not, so it sends through `http` (the same fallback) instead.
+ */
+export const codexWsExecutorBinding = (execute: unknown): CodexWsExecutor | undefined =>
+  typeof execute === "function" ? codexWsExecutors.get(execute) : undefined;
+
 export interface ProviderFetchOptions {
   accountAutoPause?: (name: string, provider: OcxProviderConfig, headers: Headers) => AccountAutoPauseObserver | undefined;
   /**
@@ -330,7 +342,9 @@ export function providerFetch(
   ) as typeof globalThis.fetch);
   const httpFetch = Object.assign(
     async (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit,
-      reacquirePacing?: (provider: OcxProviderConfig, modelId?: string) => Promise<void>) => {
+      reacquirePacing?: (provider: OcxProviderConfig, modelId?: string) => Promise<void>,
+      // False only for the HTTP fallback of a WS send the override already wrapped: one logical send.
+      override: ProviderFetchOptions["dispatchOverride"] | null = options.dispatchOverride) => {
       // Refuse before any dispatch side effect where that is sound. `beforeDispatch` commits
       // attempt accounting and consumes admission state, so a refusal firing after it would
       // charge an attempt for a send that never happens, and a throwing hook would mask the
@@ -340,7 +354,7 @@ export function providerFetch(
       // full decision can be made now. With an override, only the configured value is checked:
       // the override may rebuild against a different host and select a different transport, and
       // refusing on this destination would reject a request whose real route is fine.
-      if (options.dispatchOverride) egressFor(input);
+      if (override) egressFor(input);
       else providerEgressSendInit(egressBinding, transport, input);
       // The hook inspects the outgoing headers and refuses the send by throwing; it is not a
       // mutator, and the copy it receives is deliberately not threaded onward. `Connection`
@@ -357,8 +371,8 @@ export function providerFetch(
           else if (!notified) { options.onPhysicalDispatch!(); notified = true; }
         } } : {}),
       };
-      return options.dispatchOverride
-        ? options.dispatchOverride(input, dispatchInit, dispatch, reacquirePacing)
+      return override
+        ? override(input, dispatchInit, dispatch, reacquirePacing)
         : dispatch(input, dispatchInit);
     },
     { preconnect },
@@ -397,9 +411,15 @@ export function providerFetch(
         options.onPhysicalDispatch?.();
       };
       const fallback = ((url: Parameters<typeof globalThis.fetch>[0], fallbackInit?: RequestInit) =>
-        httpFetch(url, { ...fallbackInit, [WS_FALLBACK_RECEIPT]: notifyOnce } as RequestInit, reacquirePacing)) as typeof globalThis.fetch;
-      return codexWsUpstreamFetch(input, init, fallback, runtime, options.onCodexWsQuota, options.beforeDispatch, options.nativeControl,
-        async () => { (await waitForPacing(init.signal ?? undefined))?.release(); }, notifyOnce, options.preOutputRefusalHold);
+        httpFetch(url, { ...fallbackInit, [WS_FALLBACK_RECEIPT]: notifyOnce } as RequestInit, reacquirePacing, null)) as typeof globalThis.fetch;
+      const wsSend = codexWsExecutor((url: Parameters<typeof globalThis.fetch>[0], wsInit?: RequestInit) => codexWsUpstreamFetch(String(url), wsInit ?? init,
+        fallback, runtime, options.onCodexWsQuota, options.beforeDispatch, options.nativeControl,
+        async () => { (await waitForPacing(init.signal ?? undefined))?.release(); }, notifyOnce, options.preOutputRefusalHold),
+        { provider, http: markEgressTransparentExecutor(fallback) });
+      // A WS frame is a physical send like any other, so it runs the same override: that is where a
+      // key-auth send is committed to its attempt row and the send budget is rebound to the
+      // credential that left. Without it a key-auth WS turn logged `sendCount: 0`.
+      return options.dispatchOverride ? options.dispatchOverride(input, init, wsSend, reacquirePacing) : wsSend(input, init);
     }
     return httpFetch(input, init, reacquirePacing);
   };

package/src/server/responses/input-admission.ts

@@ -55,6 +55,9 @@ const REMOTE_IMAGE_TOKENS = 850;
 /** Decoded image bytes per token. Coarse tile-count proxy, not a provider formula. */
 const IMAGE_BYTES_PER_TOKEN = 750;
 
+/** Compressed-audio bytes per token. More conservative than the image proxy. */
+const AUDIO_BYTES_PER_TOKEN = 256;
+
 export interface InputAdmissionResult {
   admitted: boolean;
   estimatedTokens: number;
@@ -85,6 +88,7 @@ function imageTokens(imageUrl: string): number {
 function contentPartTokens(part: OcxContentPart, modelId: string): number {
   if (part.type === "image") return imageTokens(part.imageUrl);
   if (part.type === "video") return imageTokens(part.videoUrl);
+  if (part.type === "audio") return base64PayloadTokens(part.data, AUDIO_BYTES_PER_TOKEN);
   // An inline document is a base64 payload, not a sentence: estimating it from its marker would
   // admit a request whose real input is orders of magnitude larger. Counted arithmetically —
   // rebuilding the data URL here would materialize a second request-sized string just to measure it.
@@ -92,10 +96,10 @@ function contentPartTokens(part: OcxContentPart, modelId: string): number {
   return estimateTokens(part.text, modelId);
 }
 
-function base64PayloadTokens(base64: string): number {
+function base64PayloadTokens(base64: string, bytesPerToken = IMAGE_BYTES_PER_TOKEN): number {
   if (base64.length === 0) return 0;
   const decoded = Math.floor((base64.length * 3) / 4);
-  return Math.max(1, Math.ceil(decoded / IMAGE_BYTES_PER_TOKEN));
+  return Math.max(1, Math.ceil(decoded / bytesPerToken));
 }
 
 function contentTokens(content: string | readonly OcxContentPart[], modelId: string): number {

package/src/server/responses/main-hard-lock-routing.ts

@@ -1,6 +1,8 @@
 import type { OcxConfig } from "../../types";
 import { resolveComboId } from "../../combos";
-import { isBareOpenAiFamilyModel } from "../../router";
+import { isBareOpenAiFamilyModel, previewRouteModel } from "../../router";
+import { resolveChosenTarget } from "./shadow-target-availability";
+import { getRoutingProfile, resolvePolicyProfileId } from "../../routing/profile";
 import { NATIVE_RESERVE_MODEL } from "../../codex/catalog/native-models";
 import {
   getMainAccountHardLockStatus,
@@ -10,6 +12,8 @@ import { codexQuotaScopeForModel } from "../../codex/routing/health-store";
 import { getEligiblePoolAccounts } from "../../codex/routing/selection";
 import { OPENAI_CODEX_PROVIDER_ID, isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
 import { providerCodexAccountMode } from "../../providers/registry";
+/** Resolves to a synchronous ownership proof, or null when the caller does not own the locked main. */
+export type MainHardLockCallerCheck = (sourceModel: string) => Promise<(() => boolean) | null>;
 
 function isConfiguredComboSelector(config: OcxConfig, modelId: string): boolean {
   const comboId = resolveComboId(config, modelId);
@@ -72,11 +76,12 @@ function rawModelOf(body: unknown): { raw: Record<string, unknown>; model: strin
  * - Luna Reserve keeps its own admission policy (`assertReserveAdmission`); its helper
  *   traffic is not operator chat and must not silently change models.
  */
-export function applyMainHardLockFallbackOverride(
+export async function applyMainHardLockFallbackOverride(
   body: unknown,
   config: OcxConfig,
-  now = Date.now(),
-): MainHardLockFallbackOverride | null {
+  now?: number,
+  callerCheck?: MainHardLockCallerCheck,
+): Promise<MainHardLockFallbackOverride | null> {
   const parsed = rawModelOf(body);
   if (!parsed) return null;
   const fallback = resolveMainAccountHardLockFallback(config);
@@ -85,14 +90,34 @@ export function applyMainHardLockFallbackOverride(
   if (!isBareOpenAiFamilyModel(parsed.model)
     || parsed.model === NATIVE_RESERVE_MODEL
     || isConfiguredComboSelector(config, parsed.model)) return null;
-  if (getMainAccountHardLockStatus(config, now).state !== "blocked") return null;
   const accountMode = providerCodexAccountMode(
     OPENAI_CODEX_PROVIDER_ID,
     config.providers?.[OPENAI_CODEX_PROVIDER_ID],
   );
-  if (accountMode !== "direct"
-    && getEligiblePoolAccounts(config, undefined, now, codexQuotaScopeForModel(parsed.model)).length > 0) {
-    return null;
+  if (accountMode === "direct") {
+    // Direct may forward a different caller's healthy credential. Only stored-main substitution
+    // or an observed-main match owes this lock. Recheck usage after the startup binding wait.
+    const stillOwnsLockedMain = callerCheck ? await callerCheck(parsed.model) : null;
+    // Everything from here to the rewrite is synchronous, so this proof cannot go stale before it.
+    if (!stillOwnsLockedMain?.()) return null;
+    if (getMainAccountHardLockStatus(config, now ?? Date.now()).state !== "blocked") return null;
+  } else {
+    if (getMainAccountHardLockStatus(config, now ?? Date.now()).state !== "blocked") return null;
+    if (getEligiblePoolAccounts(config, undefined, now ?? Date.now(), codexQuotaScopeForModel(parsed.model)).length > 0) return null;
+  }
+
+  // Combos and policies keep their own dispatch admission and declared failover/evidence.
+  // Other chosen targets must resolve now; a removed qualifier cannot become a default send.
+  const policyId = resolvePolicyProfileId(config, fallback.model);
+  if (!isConfiguredComboSelector(config, fallback.model)
+    && !(policyId && getRoutingProfile(config, policyId))) {
+    try {
+      const target = resolveChosenTarget(fallback.model, model => previewRouteModel(config, model));
+      if ("unavailable" in target) return null;
+    } catch {
+      // An unavailable target keeps the source lock's refusal without touching the body.
+      return null;
+    }
   }
 
   parsed.raw.model = fallback.model;

package/src/server/responses/opengateway-completion-guard.ts

@@ -0,0 +1,232 @@
+import { guardResponseBodyInactivity } from "../../lib/response-body-inactivity";
+import { isNonReplayableResponse } from "../../lib/upstream-retry";
+import { isPlainObject } from "../responses-snapshot-codec";
+import { BoundedSseFrameBuffer, joinSseFrameBytes } from "../sse-frame-buffer";
+import { sseDataPayload } from "../sse-payload-rewrite";
+import { EMPTY_COMPLETION_MAX_BUFFERED_BYTES, EMPTY_COMPLETION_MAX_BUFFERED_EVENTS, EMPTY_COMPLETION_RETRY_ENV } from "./empty-completion-guard";
+import { selfContainedResponsesBody } from "./reset-replay";
+import { carryResponseToolOwnership } from "./response-tool-ownership";
+
+const MAX_BYTES = EMPTY_COMPLETION_MAX_BUFFERED_BYTES;
+const MAX_EVENTS = EMPTY_COMPLETION_MAX_BUFFERED_EVENTS;
+const MAX_HOLD_MS = 30_000;
+const decoder = new TextDecoder();
+const reasoningEvents = new Set([
+  "response.reasoning_summary_part.added", "response.reasoning_summary_part.done",
+  "response.reasoning_summary_text.delta", "response.reasoning_summary_text.done",
+  "response.reasoning_text.delta", "response.reasoning_text.done",
+]);
+type RecordValue = Record<string, unknown>;
+
+function partCommits(part: unknown): boolean {
+  return !isPlainObject(part) || part.type !== "output_text" || part.text !== ""
+    || (part.annotations !== undefined && (!Array.isArray(part.annotations) || part.annotations.length > 0));
+}
+function outputCommits(output: unknown): boolean {
+  if (output === undefined) return false;
+  return !Array.isArray(output) || output.some(item => !isPlainObject(item)
+    || (item.type !== "reasoning" && (item.type !== "message" || !Array.isArray(item.content) || item.content.some(partCommits))));
+}
+function wellFormedEmpty(snapshot: unknown): snapshot is RecordValue {
+  return isPlainObject(snapshot) && typeof snapshot.id === "string" && snapshot.id.trim().length > 0
+    && snapshot.object === "response" && snapshot.status === "completed" && Array.isArray(snapshot.output)
+    && snapshot.error == null && snapshot.incomplete_details == null
+    && snapshot.output.every(item => isPlainObject(item) && typeof item.id === "string" && item.id.length > 0
+      && (item.type === "reasoning" || (item.type === "message" && item.role === "assistant"
+        && item.status === "completed" && Array.isArray(item.content) && !item.content.some(partCommits))));
+}
+function eventCommits(event: RecordValue): boolean {
+  if (event.replayUnsafe === true) return true;
+  switch (event.type) {
+    case "response.created": case "response.in_progress": case "response.queued": case "response.heartbeat":
+      return isPlainObject(event.response) && outputCommits(event.response.output);
+    case "response.output_item.added": case "response.output_item.done": return outputCommits([event.item]);
+    case "response.content_part.added": case "response.content_part.done": return partCommits(event.part);
+    case "response.output_text.delta": return event.delta !== "";
+    case "response.output_text.done": return event.text !== "";
+    default: return !reasoningEvents.has(String(event.type));
+  }
+}
+
+export interface OpenGatewayCompletionGuardOptions {
+  readonly url: string;
+  readonly body: unknown;
+  readonly signal: AbortSignal;
+  readonly retry: () => Promise<Response>;
+  readonly recordUsage: (usage: unknown) => void;
+  readonly retryEnabled?: boolean;
+  readonly stallTimeoutMs?: number;
+  /** Expiry releases original bytes; it never aborts a healthy upstream. */
+  readonly holdTimeoutMs?: number;
+}
+
+type Inspection = { kind: "pass"; response: Response }
+  | { kind: "empty" | "invalid"; snapshot: RecordValue; streaming: boolean };
+
+async function inspect(response: Response, options: OpenGatewayCompletionGuardOptions): Promise<Inspection> {
+  const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
+  const streaming = contentType.includes("text/event-stream")
+    || (!contentType && isPlainObject(options.body) && options.body.stream === true);
+  if (!response.body || (!streaming && !contentType.includes("application/json"))) return { kind: "pass", response };
+  const guarded = guardResponseBodyInactivity(response, options.signal, streaming ? options.stallTimeoutMs ?? 0 : 0);
+  const reader = guarded.response.body?.getReader();
+  if (!reader) return { kind: "pass", response };
+  const framer = new BoundedSseFrameBuffer(MAX_BYTES);
+  const held: Array<Uint8Array | undefined> = [];
+  let bytes = 0, events = 0, transferred = false, cleaned = false;
+  let pending: ReturnType<typeof reader.read> | undefined;
+  const holdMs = options.holdTimeoutMs ?? MAX_HOLD_MS;
+  const deadline = performance.now() + holdMs;
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const expired = new Promise<"expired">(resolve => { timer = setTimeout(() => resolve("expired"), holdMs); });
+  const dropHeld = (): void => {
+    for (let index = 0; index < held.length; index += 1) held[index] = undefined;
+  };
+  const finishOwned = (): void => {
+    if (cleaned) return;
+    cleaned = true;
+    guarded.dispose();
+    try { reader.releaseLock(); }
+    catch (error) { if (!(error instanceof TypeError)) throw error; }
+  };
+  const cancelOwned = (reason?: unknown): void => {
+    if (cleaned) return;
+    cleaned = true;
+    dropHeld();
+    try { void reader.cancel(reason).catch(() => {}); }
+    catch (error) { if (!(error instanceof TypeError)) throw error; }
+    guarded.dispose();
+    try { reader.releaseLock(); }
+    catch (error) { if (!(error instanceof TypeError)) throw error; }
+  };
+  const pass = (): Inspection => {
+    transferred = true;
+    let index = 0;
+    const body = new ReadableStream<Uint8Array>({
+      async pull(controller) {
+        if (index < held.length) {
+          const chunk = held[index];
+          held[index] = undefined;
+          index += 1;
+          if (chunk) controller.enqueue(chunk);
+          return;
+        }
+        try {
+          const next = await (pending ?? reader.read());
+          pending = undefined;
+          if (next.done) { finishOwned(); controller.close(); }
+          else controller.enqueue(next.value);
+        } catch (error) { cancelOwned(error); controller.error(error); }
+      },
+      cancel(reason) { dropHeld(); cancelOwned(reason); },
+    }, { highWaterMark: 0 });
+    return { kind: "pass", response: carryResponseToolOwnership(response, new Response(body, {
+      status: response.status, statusText: response.statusText, headers: response.headers,
+    })) };
+  };
+  const terminal = (snapshot: unknown): Inspection => ({
+    kind: wellFormedEmpty(snapshot) ? "empty" : "invalid",
+    snapshot: isPlainObject(snapshot) ? snapshot : {}, streaming,
+  });
+  try {
+    for (;;) {
+      if (performance.now() >= deadline) return pass();
+      pending = reader.read();
+      let next: Awaited<typeof pending> | "expired";
+      try { next = await Promise.race([pending, expired]); }
+      catch { return pass(); }
+      if (next === "expired") return pass();
+      pending = undefined;
+      if (!next.done) {
+        if (bytes + next.value.byteLength > MAX_BYTES || held.length >= MAX_EVENTS) {
+          held.push(next.value);
+          return pass();
+        }
+        held.push(next.value.slice());
+        bytes += next.value.byteLength;
+      }
+      if (!streaming) {
+        if (!next.done) continue;
+        let snapshot: unknown;
+        try { snapshot = JSON.parse(decoder.decode(joinSseFrameBytes(held.flatMap(chunk => chunk ? [chunk] : [])))); }
+        catch { return terminal(undefined); }
+        if (isPlainObject(snapshot) && (outputCommits(snapshot.output)
+          || snapshot.error != null || ["failed", "incomplete", "queued", "in_progress"].includes(String(snapshot.status)))) return pass();
+        return terminal(snapshot);
+      }
+      let frames;
+      try { frames = next.done ? [{ block: framer.finish() }] : framer.feed(next.value); }
+      catch { return pass(); }
+      for (const raw of frames) {
+        if (raw.block.byteLength === 0) continue;
+        if (++events >= MAX_EVENTS) return pass();
+        const block = decoder.decode(raw.block), data = sseDataPayload(block);
+        if (data === null) { if (/^event:/m.test(block)) return pass(); continue; }
+        let event: unknown;
+        try { event = JSON.parse(data); } catch { return pass(); }
+        if (!isPlainObject(event)) return pass();
+        if (event.replayUnsafe === true) return pass();
+        if (event.type === "response.completed") {
+          if (isPlainObject(event.response) && outputCommits(event.response.output)) return pass();
+          return terminal(event.response);
+        }
+        if (eventCommits(event)) return pass();
+      }
+      if (next.done) return pass();
+    }
+  } finally {
+    clearTimeout(timer); framer.dispose();
+    if (!transferred) cancelOwned();
+  }
+}
+
+function terminalResponse(source: Response, inspection: Exclude<Inspection, { kind: "pass" }>, reason: string): Response {
+  const incomplete = reason === "max_output_tokens";
+  const snapshot: RecordValue = { ...inspection.snapshot, status: incomplete ? "incomplete" : "failed" };
+  if (incomplete) {
+    snapshot.incomplete_details = { reason };
+    delete snapshot.error;
+  } else {
+    snapshot.error = {
+      type: "upstream_error", code: reason, message: "OpenGateway returned no usable completion before output.",
+    };
+    delete snapshot.incomplete_details;
+  }
+  const headers = new Headers(source.headers);
+  headers.delete("content-length"); headers.delete("content-encoding");
+  if (inspection.streaming) headers.set("content-type", "text/event-stream");
+  const text = inspection.streaming
+    ? `event: response.${snapshot.status}\ndata: ${JSON.stringify({ type: `response.${snapshot.status}`, response: snapshot })}\n\n`
+    : JSON.stringify(snapshot);
+  return carryResponseToolOwnership(source, new Response(text, {
+    status: inspection.streaming || incomplete ? 200 : 502, headers,
+  }));
+}
+
+export async function guardOpenGatewayCompletion(response: Response, options: OpenGatewayCompletionGuardOptions): Promise<Response> {
+  if (options.url !== "https://apis.opengateway.ai/v1/responses" || response.status !== 200) return response;
+  let body: unknown;
+  try { body = typeof options.body === "string" ? JSON.parse(options.body) : options.body; }
+  catch { return response; }
+  if (!isPlainObject(body)) return response;
+  const canReplay = options.retryEnabled !== false && process.env[EMPTY_COMPLETION_RETRY_ENV] !== "0"
+    && selfContainedResponsesBody(body) && !isNonReplayableResponse(response);
+  let selected = response;
+  for (let attempt = 0; ; attempt++) {
+    const inspected = await inspect(selected, options);
+    if (inspected.kind === "pass") return inspected.response;
+    const usage = inspected.snapshot.usage;
+    options.recordUsage(usage);
+    if (inspected.kind === "invalid") return terminalResponse(selected, inspected, "invalid_completion");
+    if (typeof body.max_output_tokens === "number" && body.max_output_tokens > 0
+      && isPlainObject(usage) && typeof usage.output_tokens === "number" && usage.output_tokens >= body.max_output_tokens) {
+      return terminalResponse(selected, inspected, "max_output_tokens");
+    }
+    if (attempt > 0 || !canReplay || options.signal.aborted) {
+      return terminalResponse(selected, inspected, attempt > 0
+        ? "empty_completion_retry_failed" : "empty_completion");
+    }
+    selected = await options.retry();
+    if (selected.status !== 200) return selected;
+  }
+}

package/src/server/responses/passthrough-completion.ts

@@ -0,0 +1,41 @@
+import type { AdapterRequest } from "../../adapters/base";
+import { formatErrorResponse } from "../../bridge";
+import { resolveStallTimeoutMs } from "../../stall-timeout";
+import type { OcxConfig } from "../../types";
+import { recordKeyWireAttemptUsage, usageFromResponsesPayload, type RequestLogContext } from "../request-log";
+import { isPlainObject } from "../responses-snapshot-codec";
+import { guardOpenGatewayCompletion } from "./opengateway-completion-guard";
+
+export function parseOutboundRequestBody(bodyText: string): Record<string, unknown> | undefined {
+  try {
+    const body: unknown = JSON.parse(bodyText);
+    return isPlainObject(body) ? body : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+export function guardPassthroughCompletion(
+  response: Response,
+  request: AdapterRequest,
+  config: Pick<OcxConfig, "emptyCompletionRetry" | "stallTimeoutSec">,
+  signal: AbortSignal,
+  logCtx: RequestLogContext,
+  rebuildAndRefetch: (kind: "empty-completion") => Promise<Response | { failed: Response | { kind: "adapter-handoff" } }>,
+): Promise<Response> {
+  if (request.url !== "https://apis.opengateway.ai/v1/responses") return Promise.resolve(response);
+  return guardOpenGatewayCompletion(response, {
+    url: request.url,
+    body: parseOutboundRequestBody(request.body),
+    signal,
+    retryEnabled: config.emptyCompletionRetry,
+    stallTimeoutMs: resolveStallTimeoutMs(config.stallTimeoutSec),
+    recordUsage: usage => { recordKeyWireAttemptUsage(logCtx, usageFromResponsesPayload(usage)); },
+    retry: async () => {
+      const result = await rebuildAndRefetch("empty-completion");
+      if (!("failed" in result)) return result;
+      return result.failed instanceof Response ? result.failed
+        : formatErrorResponse(502, "upstream_error", "Native recovery changed the provider wire");
+    },
+  });
+}

package/src/server/responses/passthrough-delivery.ts

@@ -37,6 +37,7 @@ import type { ResponsesTerminalStatus } from "../../bridge";
 import { isCodexWsQuotaObservedResponse, isCodexWsUpstreamResponse, isCodexWsPreludeProjection } from "./ws-upstream";
 import { recordSubagentQuotaFailureForThreadSpawn } from "../../codex/subagent-model-fallback";
 import { recordCodexUpstreamOutcome } from "../../codex/routing";
+import { codexFailureWindowOutcomeMeta } from "../../codex/routing/failure-window";
 import { codexProbeLeaseId, codexProbeQuotaScope, codexTransientProbeGrant, releaseCodexAuthContextProbeLease } from "../../codex/auth-context";
 import { consumeComboFailure } from "./core-combo-failure";
 import { clientCancelledResponse, readDisplaySafeErrorText } from "./core-errors";
@@ -535,6 +536,7 @@ export async function deliverPassthroughResponse(
         // request. The sibling recorders on this path already decline: the terminal recorder
         // needs an ok streaming body, and the quota-header snapshot finds no quota headers.
         recordCodexUpstreamOutcome(config, admissionState.authCtx.accountId, upstreamResponse.status, {
+          ...codexFailureWindowOutcomeMeta(admissionState.authCtx),
           ...quotaMeta,
           threadId: admissionState.authCtx.affinityKey,
           fixedAccount: admissionState.authCtx.fixedAccount,