@gajae-code/ai 0.11.0 → 0.11.1

package/CHANGELOG.md

@@ -13,6 +13,8 @@
 
 - Closed the remaining `Request blocked (code=invalid_prompt)` wedge on gpt-5.6 caused by header-form leaked Harmony markers. The reserved-control-token sanitizer only matched the simple `<|ident|>` shape, so a header-form marker carrying a recipient (e.g. `<|assistant to=functions.bash|>`) survived every sanitizer path (replay, request boundary, compaction) and kept re-poisoning history even after the earlier fixes. The pattern now also matches the scoped header grammar — a known Harmony role (`system`/`developer`/`user`/`assistant`/`tool`) plus a `to=<recipient>` assignment with unbounded recipient length — while leaving ordinary delimiter/pipe text untouched (arbitrary `<|foo bar=baz|>`, F# `value <| f |> g`, compact `sum<|a+b|>c`, and multi-line bodies never match). The simple branch remains a strict superset of the prior identifier-only pattern (#2267).
 
+- Made the `Request blocked (code=invalid_prompt)` classification explicit and shared across transports (#2282). `invalid_prompt` was only non-retryable by omission — it appeared in neither the codex retryable nor non-retryable event set, and the plain OpenAI Responses transport surfaced it as a generic error with no durable marker. It is now in the codex `CODEX_NON_RETRYABLE_EVENT_CODES` set (code and message forms), the Responses error path tags `transportFailure.providerCode = "invalid_prompt"`, and a new exported `isInvalidPromptError` predicate is the single contract both transports and the session-level circuit breaker key on. Ordinary control-token / pipe text (F# `value <| f |> g`, `sum<|a+b|>c`, `<|foo bar=baz|>`) is unaffected; genuinely transient errors (`server_error`, `model_error`) stay retryable.
+
 ## [0.10.2] - 2026-07-14
 
 ### Fixed

package/dist/types/model-cache.d.ts

@@ -12,6 +12,8 @@ interface CacheEntry<TApi extends Api = Api> {
      */
     staticFingerprint: string;
 }
+/** Close the shared cache only when it owns the exact requested database path. */
+export declare function closeModelCache(dbPath?: string): boolean;
 export declare function readModelCache<TApi extends Api>(providerId: string, ttlMs: number, now: () => number, dbPath?: string): CacheEntry<TApi> | null;
 export declare function writeModelCache<TApi extends Api>(providerId: string, updatedAt: number, models: Model<TApi>[], authoritative: boolean, staticFingerprint: string, dbPath?: string): void;
 export {};

package/dist/types/providers/openai-codex-responses.d.ts

@@ -45,8 +45,8 @@ export declare function getOpenAICodexTransportDetails(model: Model<"openai-code
     providerSessionState?: Map<string, ProviderSessionState>;
 }): OpenAICodexTransportDetails;
 declare function convertMessages(model: Model<"openai-codex-responses">, context: Context): ResponseInput;
-/** @internal Exported for tests. */
-export { convertMessages as convertCodexResponsesMessages };
+/** @internal Exported for tests. `classifyCodexFailureEventRetryable` is the retry classification of a Codex failure event. */
+export { convertMessages as convertCodexResponsesMessages, isRetryableCodexFailureEvent as classifyCodexFailureEventRetryable, };
 type CodexToolPayload = {
     type: "function";
     name: string;
@@ -65,3 +65,4 @@ type CodexToolPayload = {
 };
 /** @internal Exported for tests. */
 export declare function convertOpenAICodexResponsesTools(tools: Tool[], model: Model<"openai-codex-responses">): CodexToolPayload[];
+declare function isRetryableCodexFailureEvent(rawEvent: Record<string, unknown>): boolean;

package/dist/types/utils.d.ts

@@ -47,6 +47,18 @@ export declare function sanitizeOpenAIResponsesHistoryItemsForReplay(items: Arra
  * every marker the old regex caught still matches.
  */
 export declare function neutralizeReservedControlTokens(text: string): string;
+/**
+ * Shape-tolerant classifier for the poisoned-history rejection that wedges
+ * gpt-5.6 sessions: `Request blocked (code=invalid_prompt)`. Accepts a raw
+ * provider error, an assistant message, or any object carrying a
+ * `providerCode` / `transportFailure` / `errorMessage` field, and returns true
+ * when the failure is the deterministic `invalid_prompt` content fault rather
+ * than a transient upstream error. This is the single shared contract the
+ * provider transports and the session-level circuit breaker key on so the
+ * classification is explicit (not inferred from a catch-all bucket) and
+ * uniformly testable across transports.
+ */
+export declare function isInvalidPromptError(input: unknown): boolean;
 /**
  * Neutralize leaked reserved control tokens across every string in an outgoing
  * Responses `input` array. This is the request-boundary complement to the

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/ai",
-	"version": "0.11.0",
+	"version": "0.11.1",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -40,7 +40,7 @@
 	"dependencies": {
 		"@anthropic-ai/sdk": "^0.94.0",
 		"@bufbuild/protobuf": "^2.12.0",
-		"@gajae-code/utils": "0.11.0",
+		"@gajae-code/utils": "0.11.1",
 		"openai": "^6.36.0",
 		"partial-json": "^0.1.7",
 		"zod": "4.4.3"

package/src/model-cache.ts

@@ -66,6 +66,16 @@ function getDb(dbPath?: string): Database {
 	return db;
 }
 
+/** Close the shared cache only when it owns the exact requested database path. */
+export function closeModelCache(dbPath?: string): boolean {
+	const resolvedPath = dbPath ?? getModelDbPath();
+	if (!sharedDb || sharedDbPath !== resolvedPath) return false;
+	sharedDb.close();
+	sharedDb = null;
+	sharedDbPath = null;
+	return true;
+}
+
 function migrateCacheSchema(db: Database): void {
 	const columns = db.prepare("PRAGMA table_info(model_cache)").all() as TableInfoRow[];
 	if (!columns.some(column => column.name === "static_fingerprint")) {

package/src/providers/openai-codex-responses.ts

@@ -113,9 +113,15 @@ const CODEX_NON_RETRYABLE_EVENT_CODES = new Set([
 	"invalid_request_error",
 	"invalid_schema",
 	"invalid_tool_schema",
+	// A poisoned-history rejection (`Request blocked (code=invalid_prompt)`) is a
+	// deterministic content fault, not a transient upstream failure: retrying the
+	// same request re-sends the same offending item and re-triggers the block, so
+	// classify it as explicitly non-retryable instead of relying on omission
+	// (the request-boundary sanitizer, not a provider retry, is the recovery path).
+	"invalid_prompt",
 ]);
 const CODEX_NON_RETRYABLE_EVENT_MESSAGE =
-	/invalid[_ -]function[_ -]parameters|invalid schema for function|invalid[_ -]tool[_ -]schema|schema must have type ["']?object["']?/i;
+	/invalid[_ -]function[_ -]parameters|invalid schema for function|invalid[_ -]tool[_ -]schema|schema must have type ["']?object["']?|request blocked[^\n]*invalid[_ -]prompt|code=invalid[_ -]prompt/i;
 const CODEX_RETRYABLE_EVENT_MESSAGE =
 	/processing your request|retry your request|temporar(?:y|ily)|overloaded|service.?unavailable|internal error|server error/i;
 const CODEX_PROVIDER_SESSION_STATE_KEY = "openai-codex-responses";
@@ -2650,8 +2656,11 @@ function normalizeInputMessageContent(
 	return convertResponsesInputContent(content, model.input.includes("image")) ?? [];
 }
 
-/** @internal Exported for tests. */
-export { convertMessages as convertCodexResponsesMessages };
+/** @internal Exported for tests. `classifyCodexFailureEventRetryable` is the retry classification of a Codex failure event. */
+export {
+	convertMessages as convertCodexResponsesMessages,
+	isRetryableCodexFailureEvent as classifyCodexFailureEventRetryable,
+};
 
 /**
  * Whether this OpenAI code backend-backend model should get the custom-tool grammar

package/src/providers/openai-responses.ts

@@ -33,6 +33,7 @@ import {
 	createOpenAIResponsesHistoryPayload,
 	getOpenAIResponsesHistoryItems,
 	getOpenAIResponsesHistoryPayload,
+	isInvalidPromptError,
 	neutralizeResponsesInputControlTokens,
 	normalizeSystemPrompts,
 	resolveCacheRetention,
@@ -387,6 +388,22 @@ export const streamOpenAIResponses: StreamFunction<"openai-responses"> = (
 			output.transportFailure = transportFailureFacts(error);
 			output.errorMessage = firstEventTimeoutError?.message ?? (await finalizeErrorMessage(error, rawRequestDump));
 			output.errorMessage = rewriteCopilotError(output.errorMessage, error, model.provider);
+			// Explicitly mark the poisoned-history rejection so the shared
+			// `invalid_prompt` contract is present even when the SDK error surfaces
+			// only a message (no structured code). This keeps the responses
+			// transport's classification uniform with the codex transport's
+			// non-retryable event set and lets the session-level circuit breaker
+			// key on one durable marker instead of per-transport string matching.
+			if (
+				output.stopReason === "error" &&
+				!output.transportFailure?.providerCode &&
+				(isInvalidPromptError(error) || isInvalidPromptError(output.errorMessage))
+			) {
+				output.transportFailure = {
+					...(output.transportFailure ?? { kind: "transport" }),
+					providerCode: "invalid_prompt",
+				};
+			}
 			output.duration = Date.now() - startTime;
 			if (firstTokenTime) output.ttft = firstTokenTime - startTime;
 			stream.push({ type: "error", reason: output.stopReason, error: output });

package/src/utils.ts

@@ -154,6 +154,51 @@ export function neutralizeReservedControlTokens(text: string): string {
 	return text.replace(RESERVED_CONTROL_TOKEN_RE, "<\u200b|");
 }
 
+/**
+ * Shape-tolerant classifier for the poisoned-history rejection that wedges
+ * gpt-5.6 sessions: `Request blocked (code=invalid_prompt)`. Accepts a raw
+ * provider error, an assistant message, or any object carrying a
+ * `providerCode` / `transportFailure` / `errorMessage` field, and returns true
+ * when the failure is the deterministic `invalid_prompt` content fault rather
+ * than a transient upstream error. This is the single shared contract the
+ * provider transports and the session-level circuit breaker key on so the
+ * classification is explicit (not inferred from a catch-all bucket) and
+ * uniformly testable across transports.
+ */
+export function isInvalidPromptError(input: unknown): boolean {
+	if (!input) return false;
+	if (typeof input === "string") return INVALID_PROMPT_MESSAGE_RE.test(input);
+	if (typeof input !== "object") return false;
+	const value = input as {
+		providerCode?: unknown;
+		code?: unknown;
+		errorMessage?: unknown;
+		message?: unknown;
+		transportFailure?: { providerCode?: unknown; code?: unknown };
+		error?: { code?: unknown };
+	};
+	const code =
+		asLowerString(value.providerCode) ??
+		asLowerString(value.code) ??
+		asLowerString(value.transportFailure?.providerCode) ??
+		asLowerString(value.transportFailure?.code) ??
+		asLowerString(value.error?.code);
+	if (code === "invalid_prompt") return true;
+	const message =
+		typeof value.errorMessage === "string"
+			? value.errorMessage
+			: typeof value.message === "string"
+				? value.message
+				: undefined;
+	return message !== undefined && INVALID_PROMPT_MESSAGE_RE.test(message);
+}
+
+const INVALID_PROMPT_MESSAGE_RE = /code=invalid[_ -]prompt|request blocked[^\n]*invalid[_ -]prompt/i;
+
+function asLowerString(value: unknown): string | undefined {
+	return typeof value === "string" ? value.toLowerCase() : undefined;
+}
+
 /**
  * Neutralize leaked reserved control tokens across every string in an outgoing
  * Responses `input` array. This is the request-boundary complement to the