@coseung2/opencodex 2.8.0-cs.13 → 2.8.0-cs.15

package/src/codex/warmup.ts

@@ -1,19 +1,21 @@
+import { readBoundedResponseBody } from "../lib/bounded-body";
+
 export class CodexWarmupError extends Error {
-  code: "http_status" | "missing_body" | "stream_failed" | "stream_incomplete" | "stream_error" | "invalid_sse" | "no_terminal" | "transport";
+  code: "http_status" | "missing_body" | "stream_failed" | "stream_incomplete" | "stream_error" | "stream_too_large" | "invalid_sse" | "no_terminal" | "transport";
   status?: number;
-  /** Upstream error detail extracted from the response body (truncated to 512 chars). */
-  upstreamDetail?: string;
+  /** Internal-only classification used to preserve exhausted-account registration. */
+  quotaLike?: boolean;
 
   constructor(
     code: CodexWarmupError["code"],
     message = "Codex warmup failed",
-    options: { status?: number; cause?: unknown; upstreamDetail?: string } = {},
+    options: { status?: number; cause?: unknown; quotaLike?: boolean } = {},
   ) {
     super(message);
     this.name = "CodexWarmupError";
     this.code = code;
     this.status = options.status;
-    this.upstreamDetail = options.upstreamDetail;
+    this.quotaLike = options.quotaLike;
     if (options.cause !== undefined) this.cause = options.cause;
   }
 }
@@ -29,37 +31,42 @@ const CODEX_RESPONSES_URL = "https://chatgpt.com/backend-api/codex/responses";
 const DEFAULT_MODEL = "gpt-5.4-mini";
 const FALLBACK_MODELS = ["gpt-5.5"];
 const DEFAULT_TIMEOUT_MS = 30_000;
+const MAX_TIMEOUT_MS = 0x7fff_ffff;
 const MAX_ERROR_BODY_BYTES = 2048;
+const MAX_WARMUP_STREAM_BYTES = 1024 * 1024;
 
-/** Read the first MAX_ERROR_BODY_BYTES of a response body and extract an error message. */
-async function readErrorDetail(res: Response): Promise<string | undefined> {
+/** Classify a bounded structured error without retaining or exposing upstream text. */
+async function readErrorQuotaClassification(res: Response, signal: AbortSignal): Promise<boolean> {
   try {
-    const text = await res.text();
-    const trimmed = text.slice(0, MAX_ERROR_BODY_BYTES);
-    try {
-      const json = JSON.parse(trimmed) as Record<string, unknown>;
-      // ChatGPT backend error shape: { error: { message: "..." } } or { detail: "..." }
-      const nested = json.error;
-      if (nested && typeof nested === "object" && typeof (nested as Record<string, unknown>).message === "string") {
-        return ((nested as Record<string, unknown>).message as string).slice(0, 512);
-      }
-      if (typeof json.detail === "string") return json.detail.slice(0, 512);
-      if (typeof json.error === "string") return (json.error as string).slice(0, 512);
-      if (typeof json.message === "string") return json.message.slice(0, 512);
-    } catch {
-      // Non-JSON response body may contain sensitive data (tokens, credentials).
-      // Only surface structured error messages, never raw text.
+    const bounded = await readBoundedResponseBody(res, {
+      signal,
+      maxBytes: MAX_ERROR_BODY_BYTES,
+      fatalUtf8: true,
+    });
+    if (!bounded.displaySafe) return false;
+    const json = JSON.parse(bounded.text) as Record<string, unknown>;
+    const nested = json.error;
+    const detail = nested && typeof nested === "object" && typeof (nested as Record<string, unknown>).message === "string"
+      ? (nested as Record<string, unknown>).message
+      : typeof json.detail === "string"
+        ? json.detail
+        : typeof json.error === "string"
+          ? json.error
+          : typeof json.message === "string"
+            ? json.message
+            : "";
+    return /\b(?:quota|rate[\s_-]*limit|usage[\s_-]*limit)\b/i.test(String(detail));
+  } catch (error) {
+    if (signal.aborted) {
+      throw new CodexWarmupError("transport", "Codex warmup request failed", { cause: error });
     }
-    return undefined;
-  } catch {
-    return undefined;
+    return false;
   }
 }
 
 function safeWarmupReason(err: unknown): string {
   if (err instanceof CodexWarmupError) {
-    const base = err.status ? `${err.code}:${err.status}` : err.code;
-    return err.upstreamDetail ? `${base} — ${err.upstreamDetail}` : base;
+    return err.status ? `${err.code}:${err.status}` : err.code;
   }
   return "transport";
 }
@@ -77,9 +84,7 @@ export function codexWarmupFailureReason(err: unknown): string {
 export function isCodexWarmupQuotaFailure(err: unknown): boolean {
   if (!(err instanceof CodexWarmupError) || err.code !== "http_status") return false;
   if (err.status === 429) return true;
-  return err.status === 403
-    && typeof err.upstreamDetail === "string"
-    && /\b(?:quota|rate[\s_-]*limit|usage[\s_-]*limit)\b/i.test(err.upstreamDetail);
+  return err.status === 403 && err.quotaLike === true;
 }
 
 function eventTypeFromData(data: unknown): string | undefined {
@@ -103,83 +108,186 @@ function parseSseFrame(frame: string): unknown | null {
   }
 }
 
-async function drainWarmupSse(body: ReadableStream<Uint8Array>): Promise<void> {
+async function drainWarmupSse(body: ReadableStream<Uint8Array>, signal: AbortSignal): Promise<void> {
   const reader = body.getReader();
   const decoder = new TextDecoder();
-  let buffer = "";
+  let buffer = new Uint8Array(Math.min(MAX_WARMUP_STREAM_BYTES, 64 * 1024));
+  let bufferedBytes = 0;
+  let scanOffset = 0;
+  let bytesRead = 0;
+  const abortError = () => new CodexWarmupError("transport", "Codex warmup request failed", {
+    cause: signal.reason,
+  });
+  const cancelReader = () => {
+    try {
+      void reader.cancel(signal.reason).catch(() => {});
+    } catch {
+      // Custom streams may throw synchronously from cancel().
+    }
+  };
+  const readWithSignal = (): Promise<Awaited<ReturnType<typeof reader.read>>> => {
+    if (signal.aborted) {
+      cancelReader();
+      return Promise.reject(abortError());
+    }
+    const read = reader.read();
+    void read.catch(() => {});
+    return new Promise((resolve, reject) => {
+      let settled = false;
+      const finish = (action: () => void) => {
+        if (settled) return;
+        settled = true;
+        signal.removeEventListener("abort", onAbort);
+        action();
+      };
+      const onAbort = () => {
+        cancelReader();
+        finish(() => reject(abortError()));
+      };
+      signal.addEventListener("abort", onAbort, { once: true });
+      if (signal.aborted) {
+        onAbort();
+        return;
+      }
+      read.then(
+        result => finish(() => resolve(result)),
+        error => finish(() => reject(error)),
+      );
+    });
+  };
+  const ensureCapacity = (requiredBytes: number) => {
+    if (requiredBytes <= buffer.byteLength) return;
+    const grown = new Uint8Array(Math.min(
+      MAX_WARMUP_STREAM_BYTES,
+      Math.max(requiredBytes, buffer.byteLength * 2),
+    ));
+    grown.set(buffer.subarray(0, bufferedBytes));
+    buffer = grown;
+  };
+  const findFrameDelimiter = (start: number): { index: number; length: 2 | 3 | 4 } | undefined => {
+    for (let index = start; index < bufferedBytes - 1; index += 1) {
+      const firstLength = buffer[index] === 10
+        ? 1
+        : buffer[index] === 13 && buffer[index + 1] === 10 ? 2 : 0;
+      if (firstLength === 0) continue;
+      const secondStart = index + firstLength;
+      const secondLength = buffer[secondStart] === 10
+        ? 1
+        : buffer[secondStart] === 13 && buffer[secondStart + 1] === 10 ? 2 : 0;
+      if (secondLength > 0) return { index, length: (firstLength + secondLength) as 2 | 3 | 4 };
+    }
+    return undefined;
+  };
+  const acceptFrame = (frame: Uint8Array): boolean => {
+    const parsed = parseSseFrame(decoder.decode(frame));
+    const type = eventTypeFromData(parsed);
+    if (type === "response.completed") return true;
+    if (type === "response.failed") throw new CodexWarmupError("stream_failed");
+    if (type === "response.incomplete") throw new CodexWarmupError("stream_incomplete");
+    if (type === "error") throw new CodexWarmupError("stream_error");
+    return false;
+  };
 
   try {
+    if (signal.aborted) throw abortError();
     for (;;) {
-      const { done, value } = await reader.read();
+      const { done, value } = await readWithSignal();
+      if (signal.aborted) throw abortError();
       if (done) break;
-      buffer += decoder.decode(value, { stream: true });
+      if (value.byteLength > MAX_WARMUP_STREAM_BYTES - bytesRead) {
+        throw new CodexWarmupError("stream_too_large", "Codex warmup stream exceeded the size limit");
+      }
+      bytesRead += value.byteLength;
+      ensureCapacity(bufferedBytes + value.byteLength);
+      buffer.set(value, bufferedBytes);
+      bufferedBytes += value.byteLength;
 
+      let consumedBytes = 0;
       for (;;) {
-        const frameEnd = buffer.search(/\r?\n\r?\n/);
-        if (frameEnd < 0) break;
-        const frame = buffer.slice(0, frameEnd);
-        const delimiterLength = buffer[frameEnd] === "\r" ? 4 : 2;
-        buffer = buffer.slice(frameEnd + delimiterLength);
-        const parsed = parseSseFrame(frame);
-        const type = eventTypeFromData(parsed);
-        if (type === "response.completed") return;
-        if (type === "response.failed") throw new CodexWarmupError("stream_failed");
-        if (type === "response.incomplete") throw new CodexWarmupError("stream_incomplete");
-        if (type === "error") throw new CodexWarmupError("stream_error");
+        const delimiter = findFrameDelimiter(scanOffset);
+        if (!delimiter) {
+          scanOffset = Math.max(consumedBytes, bufferedBytes - 3);
+          break;
+        }
+        if (acceptFrame(buffer.subarray(consumedBytes, delimiter.index))) return;
+        consumedBytes = delimiter.index + delimiter.length;
+        scanOffset = consumedBytes;
+      }
+      if (consumedBytes > 0) {
+        buffer.copyWithin(0, consumedBytes, bufferedBytes);
+        bufferedBytes -= consumedBytes;
+        scanOffset = Math.max(0, scanOffset - consumedBytes);
       }
     }
 
-    if (buffer.trim()) {
-      const parsed = parseSseFrame(buffer);
-      const type = eventTypeFromData(parsed);
-      if (type === "response.completed") return;
-      if (type === "response.failed") throw new CodexWarmupError("stream_failed");
-      if (type === "response.incomplete") throw new CodexWarmupError("stream_incomplete");
-      if (type === "error") throw new CodexWarmupError("stream_error");
-    }
-
+    if (bufferedBytes > 0 && acceptFrame(buffer.subarray(0, bufferedBytes))) return;
     throw new CodexWarmupError("no_terminal", "Codex warmup ended before completion");
   } finally {
-    reader.releaseLock();
+    try {
+      reader.releaseLock();
+    } catch {
+      // A non-settling cancellation can keep the pending read locked briefly.
+    }
   }
 }
 
 async function tryWarmup(options: CodexWarmupOptions, model: string): Promise<void> {
-  let res: Response;
-  try {
-    res = await fetch(CODEX_RESPONSES_URL, {
-      method: "POST",
-      headers: {
-        Authorization: `Bearer ${options.accessToken}`,
-        "ChatGPT-Account-Id": options.chatgptAccountId,
-        "Content-Type": "application/json",
-      },
-      body: JSON.stringify({
-        model,
-        instructions: "Reply with OK.",
-        input: [{ type: "message", role: "user", content: [{ type: "input_text", text: "hi" }] }],
-        stream: true,
-        store: false,
-      }),
-      signal: AbortSignal.timeout(options.timeoutMs ?? DEFAULT_TIMEOUT_MS),
-    });
-  } catch (err) {
-    throw new CodexWarmupError("transport", "Codex warmup request failed", { cause: err });
-  }
-
-  if (!res.ok) {
-    const upstreamDetail = await readErrorDetail(res);
-    throw new CodexWarmupError("http_status", "Codex warmup was rejected", {
-      status: res.status,
-      upstreamDetail,
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 0 || timeoutMs > MAX_TIMEOUT_MS) {
+    throw new CodexWarmupError("transport", "Codex warmup request failed", {
+      cause: new RangeError("Codex warmup timeout is outside the supported range"),
     });
   }
-  if (!res.body) throw new CodexWarmupError("missing_body");
+  const deadline = new AbortController();
+  const signal = deadline.signal;
+  const timer = setTimeout(() => {
+    deadline.abort(new DOMException("Codex warmup timed out", "TimeoutError"));
+  }, timeoutMs);
 
   try {
-    await drainWarmupSse(res.body);
+    let res: Response;
+    try {
+      res = await fetch(CODEX_RESPONSES_URL, {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${options.accessToken}`,
+          "ChatGPT-Account-Id": options.chatgptAccountId,
+          "Content-Type": "application/json",
+        },
+        body: JSON.stringify({
+          model,
+          instructions: "Reply with OK.",
+          input: [{ type: "message", role: "user", content: [{ type: "input_text", text: "hi" }] }],
+          stream: true,
+          store: false,
+        }),
+        signal,
+      });
+    } catch (err) {
+      throw new CodexWarmupError("transport", "Codex warmup request failed", { cause: err });
+    }
+
+    if (!res.ok) {
+      const quotaLike = await readErrorQuotaClassification(res, signal);
+      throw new CodexWarmupError("http_status", "Codex warmup was rejected", {
+        status: res.status,
+        quotaLike,
+      });
+    }
+    const body = res.body;
+    if (!body) throw new CodexWarmupError("missing_body");
+
+    try {
+      await drainWarmupSse(body, signal);
+    } finally {
+      try {
+        void body.cancel().catch(() => {});
+      } catch {
+        // Some custom streams throw synchronously from cancel().
+      }
+    }
   } finally {
-    await res.body?.cancel().catch(() => {});
+    clearTimeout(timer);
   }
 }
 

package/src/config.ts

@@ -12,6 +12,8 @@ import {
   isValidCodexAccountNamespaceTarget,
   MAIN_CODEX_ACCOUNT_NAMESPACE_TARGET,
 } from "./codex/account-namespace-match";
+import { isCodexAccountPriorityKey } from "./codex/account-priority";
+import { parseAccountPriority } from "./codex/pool-rotation";
 import { COMBO_NAMESPACE, comboConfigIssues } from "./combos/types";
 import {
   forgetHardenedSecretPath,
@@ -712,6 +714,25 @@ const codexAccountNamespacesSchema = z.custom<Record<string, unknown>>(
   }
 }).pipe(z.record(z.string(), z.string()));
 
+const codexAccountPrioritiesSchema = z.custom<Record<string, unknown>>(
+  (value): value is Record<string, unknown> => !!value
+    && typeof value === "object"
+    && !Array.isArray(value)
+    && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null),
+  { error: "codexAccountPriorities must be a plain object mapping account ids to integers" },
+).superRefine((priorities, ctx) => {
+  for (const [accountId, priority] of Object.entries(priorities)) {
+    if (!isCodexAccountPriorityKey(accountId)) {
+      ctx.addIssue({ code: "custom", path: [accountId], message: "invalid Codex account id" });
+    }
+    if (parseAccountPriority(priority) === null) {
+      ctx.addIssue({ code: "custom", path: [accountId], message: "selection order must be an integer between -100 and 100" });
+    }
+  }
+}).pipe(z.record(z.string(), z.number().int()));
+
+const CODEX_ACCOUNT_PIN_PATTERN = /^[a-zA-Z0-9._-]{1,64}$/;
+
 /**
  * Deliberately permissive. A user's config is not ours to invalidate: a strict
  * entry fails the whole parse, and loadConfig's fallback then backs the file up
@@ -779,13 +800,18 @@ const configSchema = z.object({
   // hashes, UUIDs), so validate only length, never charset: a foreign id must not
   // drop the whole paused set on config load.
   pausedOauthAccountIds: z.record(z.string(), z.array(z.string().min(1).max(128))).optional(),
+  codexAccountPriorities: codexAccountPrioritiesSchema.optional().catch(undefined),
+  activeCodexAccountPinned: z.string().regex(CODEX_ACCOUNT_PIN_PATTERN).optional().catch(undefined),
   codexAccountNamespaces: codexAccountNamespacesSchema.optional(),
+  codexAccountPickerEnabled: z.boolean().optional().catch(false),
   // Model ids excluded from the Grok Build managed block (dashboard switches).
   grokExcludedModels: z.array(z.string()).optional(),
   // Invalid values degrade to undefined ("auto") instead of failing the whole
   // parse: a hand-edited typo must never trip the backup-and-defaults repair
   // path below and wipe providers/pool accounts. Warning emitted in loadConfig.
   streamMode: z.enum(["auto", "legacy-tee", "eager-relay"]).optional().catch(undefined),
+  // A retry can be billable, so absence and malformed hand edits both stay off.
+  emptyCompletionRetry: z.boolean().optional().catch(false),
   // Same degrade-don't-reject rationale as the fields above: a hand-edited
   // non-string must not trip the backup-and-defaults repair path. Unset then
   // takes the canonical sideband path (src/server/live.ts normalizeSidebandRoot).
@@ -1258,6 +1284,29 @@ function rawConfigRecord(rawParsed: unknown): Record<string, unknown> | null {
     : null;
 }
 
+function degradedCodexAccountRoutingWarnings(rawParsed: unknown, validated: OcxConfig): string[] {
+  const raw = rawConfigRecord(rawParsed);
+  if (!raw) return [];
+  const warnings: string[] = [];
+  if (raw.codexAccountPriorities !== undefined && validated.codexAccountPriorities === undefined) {
+    warnings.push("codexAccountPriorities ignored: expected account ids mapped to integers between -100 and 100");
+  }
+  if (raw.activeCodexAccountPinned !== undefined && validated.activeCodexAccountPinned === undefined) {
+    warnings.push("activeCodexAccountPinned ignored: expected a Codex account id");
+  }
+  if (raw.codexAccountPickerEnabled !== undefined
+    && typeof raw.codexAccountPickerEnabled !== "boolean") {
+    warnings.push("codexAccountPickerEnabled ignored: expected a boolean");
+  }
+  return warnings;
+}
+
+function warnDegradedCodexAccountRouting(rawParsed: unknown, validated: OcxConfig): void {
+  for (const warning of degradedCodexAccountRoutingWarnings(rawParsed, validated)) {
+    console.warn(`⚠️  config.json ${warning}. Other settings were preserved.`);
+  }
+}
+
 function malformedNativeSubagentFields(rawParsed: unknown): NativeSubagentPersistedField[] {
   const raw = rawConfigRecord(rawParsed);
   if (!raw) return [];
@@ -1325,6 +1374,7 @@ export function loadConfig(): OcxConfig {
       const config = normalizeApiKeyIds(result.data as OcxConfig);
       warnDegradedStreamMode(parsed, config);
       warnDegradedHostname(parsed, config);
+      warnDegradedCodexAccountRouting(parsed, config);
       warnDegradedApiKeys(parsed, config);
       warnDegradedClaudeSubagentEffort(parsed);
       warnDegradedNativeSubagentConfig(parsed, config);
@@ -1344,6 +1394,7 @@ export function loadConfig(): OcxConfig {
       warnConfigRepaired(configPath, result.error);
       const config = normalizeApiKeyIds(retryResult.data as OcxConfig);
       warnDegradedHostname(parsed, config);
+      warnDegradedCodexAccountRouting(parsed, config);
       warnDegradedApiKeys(parsed, config);
       warnDegradedClaudeSubagentEffort(parsed);
       warnDegradedNativeSubagentConfig(parsed, config);
@@ -1391,6 +1442,7 @@ function validFileConfigDiagnostics(config: OcxConfig, rawParsed: unknown): Conf
   const rawEffort = rawClaudeSubagentEffort(rawParsed);
   const normalized = normalizeClaudeSubagentEffort(normalizeNativeSubagentSync(config, rawParsed), rawParsed);
   const warnings = configPlaceholderWarnings(normalized);
+  warnings.push(...degradedCodexAccountRoutingWarnings(rawParsed, normalized));
   if (rawEffort !== undefined && !isClaudeSubagentEffort(rawEffort)) {
     warnings.push(`claudeCode.subagentEffort ignored: expected one of ${CLAUDE_SUBAGENT_EFFORTS.join(", ")}`);
   }
@@ -1472,12 +1524,42 @@ function googleAntigravityStaticCatalogVersionError(value: unknown): string | nu
   return "schema_invalid: googleAntigravityStaticCatalogVersion: must be 1 or omitted";
 }
 
+function codexAccountRoutingPreferenceError(value: unknown): string | null {
+  const raw = rawConfigRecord(value);
+  if (!raw) return null;
+  if (raw.codexAccountPriorities !== undefined) {
+    const parsed = codexAccountPrioritiesSchema.safeParse(raw.codexAccountPriorities);
+    if (!parsed.success) {
+      return schemaDiagnosticsError(parsed.error).replace("schema_invalid: ", "schema_invalid: codexAccountPriorities.");
+    }
+  }
+  const pin = raw.activeCodexAccountPinned;
+  if (pin !== undefined && (typeof pin !== "string" || !CODEX_ACCOUNT_PIN_PATTERN.test(pin))) {
+    return "schema_invalid: activeCodexAccountPinned: must be an account id";
+  }
+  const picker = raw.codexAccountPickerEnabled;
+  if (picker !== undefined && typeof picker !== "boolean") {
+    return "schema_invalid: codexAccountPickerEnabled: must be a boolean";
+  }
+  return null;
+}
+
+function emptyCompletionRetryError(value: unknown): string | null {
+  const raw = rawConfigRecord(value);
+  if (!raw || !Object.hasOwn(raw, "emptyCompletionRetry")) return null;
+  return raw.emptyCompletionRetry === undefined || typeof raw.emptyCompletionRetry === "boolean"
+    ? null
+    : "schema_invalid: emptyCompletionRetry: must be a boolean or omitted";
+}
+
 /** Validate an in-memory config candidate without touching disk. Used by headless CLI import/set. */
 export function validateConfigCandidate(value: unknown): { ok: true; config: OcxConfig } | { ok: false; error: string } {
   const boundaryError = blankHostnameError(value)
     ?? claudeSubagentEffortError(value)
     ?? appOwnedMemoryBudgetError(value)
-    ?? googleAntigravityStaticCatalogVersionError(value);
+    ?? googleAntigravityStaticCatalogVersionError(value)
+    ?? codexAccountRoutingPreferenceError(value)
+    ?? emptyCompletionRetryError(value);
   if (boundaryError) return { ok: false, error: boundaryError };
   const result = configSchema.safeParse(value);
   if (result.success) return { ok: true, config: normalizeApiKeyIds(result.data as OcxConfig) };
@@ -2009,6 +2091,7 @@ export function getDefaultConfig(): OcxConfig {
   // Adding extra providers (e.g. opencode-go) and switching defaultProvider is a user/runtime choice.
   return {
     port: 10100,
+    emptyCompletionRetry: false,
     managementUsageMaxReadBytes: 64 * 1024 * 1024,
     appOwnedMemoryBudgetMb: DEFAULT_APP_OWNED_MEMORY_BUDGET_BYTES / (1024 * 1024),
     // Fresh/re-initialized configs are already written in the current three-tier

package/src/lib/bounded-body.ts

@@ -7,10 +7,16 @@ export const BOUNDED_BODY_TIMEOUT_MS = 5_000;
 export interface BoundedBodyOptions {
 	/** Abort the read with this signal. Its reason is rethrown by identity. */
 	signal?: AbortSignal;
+	/** Reject malformed or truncated UTF-8 instead of replacing invalid bytes. */
+	fatalUtf8?: boolean;
+	/** Per-call retained byte ceiling. Defaults to BOUNDED_BODY_MAX_BYTES. */
+	maxBytes?: number;
 	/** Total wall-clock deadline. Exposed for focused tests. */
 	totalTimeoutMs?: number;
 	/** Deadline between non-empty raw chunks. Exposed for focused tests. */
 	inactivityTimeoutMs?: number;
+	/** Deadline for the first non-empty chunk. Defaults to inactivityTimeoutMs. */
+	firstByteTimeoutMs?: number;
 }
 
 export interface BoundedBodyResult {
@@ -56,8 +62,8 @@ function cancelWithoutWaiting(reader: ReadableStreamDefaultReader<Uint8Array>, r
 	}
 }
 
-function decodeUtf8(chunks: readonly Uint8Array[]): string {
-	const decoder = new TextDecoder();
+function decodeUtf8(chunks: readonly Uint8Array[], fatal: boolean): string {
+	const decoder = new TextDecoder("utf-8", { fatal });
 	let text = "";
 	for (const chunk of chunks) text += decoder.decode(chunk, { stream: true });
 	// Flush an incomplete trailing UTF-8 sequence deterministically.
@@ -93,13 +99,14 @@ export async function readBoundedResponseBody(
 	}
 
 	const reader = body.getReader();
+	const maxBytes = options.maxBytes ?? BOUNDED_BODY_MAX_BYTES;
 	const chunks: Uint8Array[] = [];
 	let retainedBytes = 0;
 	let mustCancel = false;
 	let cancelReason: unknown;
 	const total = timeoutPromise(options.totalTimeoutMs ?? BOUNDED_BODY_TIMEOUT_MS, TOTAL_TIMEOUT);
 	let inactivity = timeoutPromise(
-		options.inactivityTimeoutMs ?? BOUNDED_BODY_TIMEOUT_MS,
+		options.firstByteTimeoutMs ?? options.inactivityTimeoutMs ?? BOUNDED_BODY_TIMEOUT_MS,
 		INACTIVITY_TIMEOUT,
 	);
 
@@ -134,7 +141,7 @@ export async function readBoundedResponseBody(
 					"TimeoutError",
 				);
 				return {
-					text: decodeUtf8(chunks),
+					text: decodeUtf8(chunks, options.fatalUtf8 === true),
 					truncated: true,
 					timedOut: true,
 					totalTimedOut: outcome === TOTAL_TIMEOUT,
@@ -147,7 +154,7 @@ export async function readBoundedResponseBody(
 			const { value, done } = outcome as ReadableStreamReadResult<Uint8Array>;
 			if (done) {
 				return {
-					text: decodeUtf8(chunks),
+					text: decodeUtf8(chunks, options.fatalUtf8 === true),
 					truncated: false,
 					timedOut: false,
 					totalTimedOut: false,
@@ -165,7 +172,7 @@ export async function readBoundedResponseBody(
 				INACTIVITY_TIMEOUT,
 			);
 
-			if (value.byteLength > BOUNDED_BODY_MAX_BYTES - retainedBytes) {
+			if (value.byteLength > maxBytes - retainedBytes) {
 				mustCancel = true;
 				cancelReason = new DOMException("Error body size limit reached", "QuotaExceededError");
 				chunks.length = 0;

package/src/lib/bun-stream-caps.ts

@@ -3,9 +3,8 @@
  *
  * The eager bounded relay (src/server/relay-eager.ts) uses a JS async producer
  * loop — the exact shape of the Bun#32111 use-after-free (fixed upstream by Bun
- * PR #32120, merged 2026-06-21). No RELEASED Bun version is proven to carry
- * that fix yet, so `MIN_FIXED_BUN_VERSION` is null: every runtime is
- * "known-bad" until a bundle-bump commit sets it. Windows no-rewrite traffic
+ * PR #32120, merged 2026-06-21). Bun 1.4.0 is the first released version proven
+ * to carry that fix, so older runtimes remain "known-bad". Windows no-rewrite traffic
  * follows this runtime/config decision. Darwin no-rewrite traffic stays on tee
  * for `auto` regardless of runtime capability and reaches eager relay only via
  * explicit `streamMode: "eager-relay"` opt-in (see
@@ -18,10 +17,10 @@
  */
 
 /**
- * Bump in the SAME commit that bumps package.json's bundled Bun to a version
- * verified to include Bun PR #32120. null = no released version is known-fixed.
+ * Keep this in sync with the first bundled stable release verified to include
+ * Bun PR #32120. null = no released version is known-fixed.
  */
-export const MIN_FIXED_BUN_VERSION: string | null = null;
+export const MIN_FIXED_BUN_VERSION: string | null = "1.4.0";
 
 export type StreamMode = "auto" | "legacy-tee" | "eager-relay";
 

package/src/lib/redact.ts

@@ -38,6 +38,19 @@ export function redactSecretString(value: string): string {
   return redacted;
 }
 
+/** Shared bounded single-line representation for caller-controlled log metadata. */
+export function sanitizeLogMetadataString(value: unknown, maxLength = 64): string | undefined {
+  if (typeof value !== "string" || !Number.isInteger(maxLength) || maxLength < 1) return undefined;
+  // Replace record separators with spaces so two adjacent fragments cannot be
+  // concatenated into a token that evades boundary-aware secret redaction.
+  const filtered = value.trim()
+    .replace(/[\u0000-\u001f\u007f-\u009f\u2028\u2029]/g, " ")
+    .replace(/\s+/g, " ");
+  if (!filtered) return undefined;
+  const redacted = redactSecretString(filtered).trim();
+  return redacted ? redacted.slice(0, maxLength) : undefined;
+}
+
 export function redactSecrets(value: unknown): unknown {
   if (typeof value === "string") return redactSecretString(value);
   if (Array.isArray(value)) return value.map(item => redactSecrets(item));