@iislee/opencodex 2.11.0 → 2.31.0

package/src/server/background-lifecycle.ts

@@ -0,0 +1,182 @@
+import type { StorageCleanupPolicy } from "../types";
+import { startStateStoreSweeper } from "../lib/state-store-sweeper";
+import {
+  abortStorageCleanupPolicyJobAsync,
+  setStorageCleanupPolicyJobLiveApply,
+} from "../storage/policy-job";
+import { setStorageCleanupPolicyLiveSink } from "../storage/policy";
+import {
+  scheduleStorageCleanupStartupRun,
+  startStorageCleanupScheduler,
+  stopStorageCleanupScheduler,
+} from "../storage/policy-scheduler";
+import {
+  cancelQueuedStorageWorkerSpawns,
+  drainStorageWorkers,
+} from "../storage/worker-lifecycle";
+import {
+  acquireServerResourceOwner,
+  type ServerResourceOwnerLease,
+} from "../lib/server-resource-ownership";
+import {
+  startMemoryWatchdog,
+  type MemoryWatchdog,
+} from "./memory-watchdog";
+
+type PolicyApply = (policy: StorageCleanupPolicy) => void;
+
+type ProcessLoops = {
+  memoryWatchdog: MemoryWatchdog;
+  stateStoreSweeper: ReturnType<typeof startStateStoreSweeper>;
+};
+
+type LeaseOwner = {
+  token: symbol;
+  applyPolicy: PolicyApply;
+  resources: ServerResourceOwnerLease;
+};
+
+export type ServerBackgroundLifecycleLease = {
+  scheduleStartupRun(): void;
+  release(): Promise<void>;
+  releaseAfterFailedStart(): void;
+};
+
+const owners: LeaseOwner[] = [];
+let processLoops: ProcessLoops | null = null;
+let cleanupInProgress = false;
+
+function setLivePolicyOwner(applyPolicy: PolicyApply | null): void {
+  setStorageCleanupPolicyLiveSink(applyPolicy);
+  setStorageCleanupPolicyJobLiveApply(applyPolicy);
+}
+
+function startProcessLoops(applyPolicy: PolicyApply): ProcessLoops {
+  let memoryWatchdog: MemoryWatchdog | null = null;
+  let stateStoreSweeper: ReturnType<typeof startStateStoreSweeper> | null = null;
+  try {
+    memoryWatchdog = startMemoryWatchdog();
+    stateStoreSweeper = startStateStoreSweeper();
+    setLivePolicyOwner(applyPolicy);
+    startStorageCleanupScheduler();
+    return { memoryWatchdog, stateStoreSweeper };
+  } catch (error) {
+    memoryWatchdog?.stop();
+    stateStoreSweeper?.stop();
+    stopStorageCleanupScheduler();
+    setLivePolicyOwner(null);
+    throw error;
+  }
+}
+
+function stopProcessLoops(): void {
+  const loops = processLoops;
+  processLoops = null;
+  loops?.memoryWatchdog.stop();
+  loops?.stateStoreSweeper.stop();
+  stopStorageCleanupScheduler();
+  setLivePolicyOwner(null);
+}
+
+async function stopStoragePolicyWorker(): Promise<void> {
+  cancelQueuedStorageWorkerSpawns();
+  const abortResult = await Promise.allSettled([abortStorageCleanupPolicyJobAsync()]);
+  if (abortResult[0]?.status === "rejected") {
+    console.warn(
+      "[storage] policy worker abort during server stop failed:",
+      abortResult[0].reason instanceof Error
+        ? abortResult[0].reason.message
+        : abortResult[0].reason,
+    );
+  }
+  try {
+    await drainStorageWorkers();
+  } catch (error) {
+    console.warn(
+      "[storage] worker drain during server stop failed:",
+      error instanceof Error ? error.message : error,
+    );
+  }
+}
+
+function removeOwner(owner: LeaseOwner): boolean {
+  const index = owners.findIndex(candidate => candidate.token === owner.token);
+  if (index === -1) return false;
+  owners.splice(index, 1);
+  return true;
+}
+
+function releaseOwnerSynchronously(owner: LeaseOwner): "inactive" | "shared" | "last" {
+  if (!removeOwner(owner)) return "inactive";
+  owner.resources.release();
+  const nextOwner = owners.at(-1);
+  if (nextOwner) {
+    setLivePolicyOwner(nextOwner.applyPolicy);
+    return "shared";
+  }
+  stopProcessLoops();
+  return "last";
+}
+
+/**
+ * Acquire one server's lease on process-wide singleton loops.
+ *
+ * The first live server starts the loops. Later servers only add a reference and
+ * become the current policy sink; out-of-order release restores the newest
+ * remaining sink. The final release owns timer and Worker teardown. Resources
+ * registered while this server starts are released with this exact lease.
+ */
+export function acquireServerBackgroundLifecycle(
+  applyPolicy: PolicyApply,
+): ServerBackgroundLifecycleLease {
+  if (cleanupInProgress) {
+    throw new Error("server background lifecycle cleanup is still in progress");
+  }
+
+  const owner: LeaseOwner = {
+    token: Symbol("server-background-lifecycle"),
+    applyPolicy,
+    resources: acquireServerResourceOwner(),
+  };
+  try {
+    if (!processLoops) {
+      processLoops = startProcessLoops(applyPolicy);
+    } else {
+      setLivePolicyOwner(applyPolicy);
+    }
+    owners.push(owner);
+  } catch (error) {
+    owner.resources.release();
+    throw error;
+  }
+
+  let releaseFlight: Promise<void> | null = null;
+  return {
+    scheduleStartupRun() {
+      if (owners.some(candidate => candidate.token === owner.token)) {
+        scheduleStorageCleanupStartupRun();
+      }
+    },
+    release() {
+      if (releaseFlight) return releaseFlight;
+      const outcome = releaseOwnerSynchronously(owner);
+      if (outcome !== "last") {
+        releaseFlight = Promise.resolve();
+        return releaseFlight;
+      }
+      cleanupInProgress = true;
+      releaseFlight = stopStoragePolicyWorker().finally(() => {
+        cleanupInProgress = false;
+      });
+      return releaseFlight;
+    },
+    releaseAfterFailedStart() {
+      if (releaseFlight) return;
+      // Startup evaluation is scheduled only after both listeners bind, so a
+      // failed start cannot have spawned a Worker for this lease. Keep rollback
+      // synchronous so a caller may immediately retry a different port.
+      releaseOwnerSynchronously(owner);
+      releaseFlight = Promise.resolve();
+    },
+  };
+}

package/src/server/chat-completions.ts

@@ -2,11 +2,15 @@
  * OpenAI Chat Completions inbound (/v1/chat/completions) for GitHub Copilot App
  * and other OpenAI-compatible clients.
  *
- * Translate-and-replay: Chat Completions body -> /v1/responses via handleResponses,
- * then bridge the Responses output back to Chat Completions SSE/JSON.
+ * Ordinary openai-chat routes send directly on the Chat Completions wire. Routes
+ * that need Responses-only behavior keep the Chat -> Responses -> Chat bridge.
  */
 import { FORWARD_HEADERS } from "../adapters/openai-responses";
-import { ChatCompletionsRequestError, chatCompletionsToResponsesBody } from "../chat/inbound";
+import {
+  assertChatCompletionsRoutingBody,
+  ChatCompletionsRequestError,
+  chatCompletionsToResponsesBody,
+} from "../chat/inbound";
 import {
   chatCompletionsErrorResponse,
   collectChatCompletion,
@@ -18,13 +22,14 @@ import { classifyError, CYBER_POLICY_ERROR_CODE, isCyberPolicyCode } from "../li
 import { redactSecretString } from "../lib/redact";
 import { resolveClientRetryAfter } from "../lib/retry-after";
 import { estimateTokens } from "../lib/token-estimate";
-import { routeModel } from "../router";
+import { NoEligiblePolicyCandidateError, routeModel } from "../router";
+import { evidenceFromBody } from "../routing/request-evidence";
 import { resolveWireProtocolOverride } from "./adapter-resolve";
 import type { OcxConfig } from "../types";
 import { readJsonRequestBody } from "./request-decompress";
 import {
   addFinalRequestLog,
-  httpStatusForTerminalStatus,
+  httpStatusForRequestLogTerminal,
   recordFirstOutput,
   type RequestLogContext,
   type RequestLogEntry,
@@ -32,12 +37,15 @@ import {
 import { responseWithDeferredRequestLog } from "./relay";
 import { handleResponses } from "./responses";
 import type { AdmissionLease } from "../lib/admission";
+import type { DataPlaneAdmission } from "./auth-cors";
+import { tryClaimNativeMainProfileForTurn } from "../codex/native-main-admission";
 import {
   createTranslatorBudget,
   finalizeTranslatorBudgetResponse,
   isTranslatorBudgetExceededError,
   type TranslatorBudget,
 } from "../lib/translator-budget";
+import { handleNativeChatCompletions, isNativeChatRouteEligible } from "./chat-native";
 
 type Rec = Record<string, unknown>;
 
@@ -57,7 +65,7 @@ export async function handleChatCompletions(
   req: Request,
   config: OcxConfig,
   logCtx: RequestLogContext,
-  logIds?: { requestId: string; start: number; turnAdmissionLease?: AdmissionLease },
+  logIds?: { requestId: string; start: number; turnAdmissionLease?: AdmissionLease; admission?: DataPlaneAdmission },
 ): Promise<Response> {
   const translatorBudget = createTranslatorBudget();
   try {
@@ -76,14 +84,13 @@ async function handleChatCompletionsWithBudget(
   config: OcxConfig,
   logCtx: RequestLogContext,
   translatorBudget: TranslatorBudget,
-  logIds?: { requestId: string; start: number; turnAdmissionLease?: AdmissionLease },
+  logIds?: { requestId: string; start: number; turnAdmissionLease?: AdmissionLease; admission?: DataPlaneAdmission },
 ): Promise<Response> {
-  let chatBody: unknown;
-  let internalBody: Rec;
+  let chatBody: Rec;
   try {
-    chatBody = await readChatBody(req, translatorBudget);
-    internalBody = chatCompletionsToResponsesBody(chatBody);
-    translatorBudget.chargeRetained(new TextEncoder().encode(JSON.stringify(internalBody)).byteLength, { kind: "request_copies" });
+    const rawBody = await readChatBody(req, translatorBudget);
+    assertChatCompletionsRoutingBody(rawBody);
+    chatBody = rawBody;
   } catch (err) {
     const overflow = isTranslatorBudgetExceededError(err);
     const status = overflow ? 413 : err instanceof ChatCompletionsRequestError ? 400 : 500;
@@ -96,20 +103,17 @@ async function handleChatCompletionsWithBudget(
     );
   }
 
-  const requestedModel = (chatBody as Rec).model as string;
-  const stream = internalBody.stream === true;
+  const requestedModel = chatBody.model as string;
+  const stream = chatBody.stream === true;
   // Best-effort Grok attribution: the managed fence stamps this header on every model
   // it registers (extra_headers, sent verbatim by upstream Grok). Dashboard usage
   // bucketing only — never an auth or billing signal.
   if (req.headers.get("x-opencodex-grok") === "1") logCtx.surface = "grok";
-  // Routed adapters only support streamed turns; always stream internally and fold
-  // for non-streaming clients.
-  internalBody.stream = true;
-
-  let nativeRoute = false;
   let directRoute = false;
+  let settledRoute: ReturnType<typeof routeModel> | null = null;
+  let chatNativeRoute: ReturnType<typeof routeModel> | null = null;
   try {
-    const route = routeModel(config, internalBody.model as string);
+    const route = routeModel(config, requestedModel, evidenceFromBody(chatBody));
     // Settle the wire once so every branch below reads the adapter this model will
     // actually use, not the provider-wide default (#404).
     route.provider = resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, "chat");
@@ -117,39 +121,79 @@ async function handleChatCompletionsWithBudget(
     logCtx.providerAdapter = route.provider.adapter;
     logCtx.requestedModel = requestedModel;
     logCtx.provider = route.providerName;
+    logCtx.routeDecision = route.routeDecision;
+    settledRoute = route;
     if (route.provider.adapter === "openai-responses") {
-      nativeRoute = true;
       directRoute = route.codexAccountMode === "direct";
-      // ChatGPT backend rejects store:true and unsupported sampling knobs.
-      internalBody.store = false;
-      delete internalBody.max_output_tokens;
-      delete internalBody.temperature;
-      delete internalBody.top_p;
-      delete internalBody.stop;
-      delete internalBody.user;
-    } else if (internalBody.store === undefined) {
-      internalBody.store = false;
-    }
-    if (route.provider.adapter === "openai-chat" && internalBody.text !== undefined) {
-      if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, 400, { closeReason: "non_stream" });
-      return chatCompletionsErrorResponse(400, "response_format is not supported for routed openai-chat models");
     }
     if (route.provider.adapter === "cursor" || route.provider.adapter === "kiro") {
-      const raw = chatBody as Rec;
       const parts: string[] = [];
-      if (raw.messages !== undefined) parts.push(JSON.stringify(raw.messages));
-      if (raw.tools !== undefined) parts.push(JSON.stringify(raw.tools));
+      if (chatBody.messages !== undefined) parts.push(JSON.stringify(chatBody.messages));
+      if (chatBody.tools !== undefined) parts.push(JSON.stringify(chatBody.tools));
       logCtx.usageLogInputTokens = Math.max(1, estimateTokens(parts.join("\n"), requestedModel));
     }
-    if (internalBody.reasoning !== undefined) {
-      const { supportedLadderFor } = await import("./effort-policy");
-      const ladder = supportedLadderFor({ provider: route.provider, modelId: route.modelId });
-      if (ladder !== undefined && ladder.length === 0) delete internalBody.reasoning;
+    if (isNativeChatRouteEligible(route, chatBody)) chatNativeRoute = route;
+  } catch (err) {
+    if (err instanceof NoEligiblePolicyCandidateError) {
+      logCtx.routeDecision = err.trace;
+      if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, 404, { closeReason: "non_stream" });
+      return chatCompletionsErrorResponse(404, err.message, "invalid_request_error");
     }
-  } catch {
     /* unknown model: let handleResponses shape the 404 */
   }
-  void nativeRoute;
+
+  if (chatNativeRoute) {
+    return handleNativeChatCompletions({
+      req,
+      config,
+      logCtx,
+      ...(logIds ? { logIds } : {}),
+      route: chatNativeRoute,
+      chatBody,
+      requestedModel,
+      requestedStream: stream,
+      translatorBudget,
+    });
+  }
+
+  let internalBody: Rec;
+  try {
+    // Validate the full Chat boundary after routing. Native Chat keeps `chatBody` as
+    // its wire source; this Responses projection is used only by the fallback path.
+    internalBody = chatCompletionsToResponsesBody(chatBody);
+  } catch (err) {
+    const overflow = isTranslatorBudgetExceededError(err);
+    const status = overflow ? 413 : err instanceof ChatCompletionsRequestError ? 400 : 500;
+    if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, status, { closeReason: "non_stream" });
+    return chatCompletionsErrorResponse(
+      status,
+      overflow ? "request translation buffer exceeded the safe limit" : err instanceof Error ? err.message : String(err),
+      overflow ? "request_too_large" : undefined,
+      overflow ? "translation_buffer_limit" : undefined,
+    );
+  }
+
+  // Routed adapters only support streamed turns; always stream internally and fold
+  // for non-streaming clients. Native Chat uses the caller's original stream bit.
+  internalBody.stream = true;
+  if (settledRoute?.provider.adapter === "openai-responses") {
+    // ChatGPT backend rejects store:true and unsupported sampling knobs.
+    internalBody.store = false;
+    delete internalBody.max_output_tokens;
+    delete internalBody.temperature;
+    delete internalBody.top_p;
+    delete internalBody.stop;
+    delete internalBody.user;
+  } else if (internalBody.store === undefined) {
+    internalBody.store = false;
+  }
+  if (settledRoute && internalBody.reasoning !== undefined) {
+    const { stripEmptyLadderEffort, supportedLadderFor } = await import("./effort-policy");
+    const ladder = supportedLadderFor({ provider: settledRoute.provider, modelId: settledRoute.modelId });
+    const next = stripEmptyLadderEffort(internalBody.reasoning, ladder);
+    if (next === undefined) delete internalBody.reasoning;
+    else internalBody.reasoning = next;
+  }
 
   const headers = new Headers({ "content-type": "application/json" });
   for (const name of FORWARD_HEADERS) {
@@ -158,19 +202,42 @@ async function handleChatCompletionsWithBudget(
     if (value) headers.set(name, value);
   }
   // Prefer main ChatGPT auth so OpenAI-backed sidecars remain reachable on routed turns.
-  if (!directRoute) try {
-    const { getMainAccountToken } = await import("../codex/main-account");
-    const token = getMainAccountToken();
-    if (token) {
-      headers.set("authorization", `Bearer ${token.accessToken}`);
-      headers.set("chatgpt-account-id", token.chatgptAccountId);
+  if (!directRoute) {
+    // This enrichment is optional for routed/non-main providers. If native main
+    // is fenced, omit it and let auth-context reject only a final physical-main
+    // selection while healthy pool/provider routes continue.
+    if (tryClaimNativeMainProfileForTurn(logIds?.turnAdmissionLease)) {
+      try {
+        const { getMainAccountToken } = await import("../codex/main-account");
+        const token = getMainAccountToken();
+        if (token) {
+          headers.set("authorization", `Bearer ${token.accessToken}`);
+          headers.set("chatgpt-account-id", token.chatgptAccountId);
+        }
+      } catch {
+        /* optional */
+      }
     }
-  } catch {
-    /* optional */
   }
 
-  const internalBodyJson = JSON.stringify(internalBody);
-  translatorBudget.chargeRetained(new TextEncoder().encode(internalBodyJson).byteLength, { kind: "request_copies" });
+  let internalBodyJson: string;
+  try {
+    internalBodyJson = JSON.stringify(internalBody);
+    translatorBudget.chargeRetained(
+      new TextEncoder().encode(internalBodyJson).byteLength,
+      { kind: "request_copies" },
+    );
+  } catch (err) {
+    const overflow = isTranslatorBudgetExceededError(err);
+    const status = overflow ? 413 : 500;
+    if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, status, { closeReason: "non_stream" });
+    return chatCompletionsErrorResponse(
+      status,
+      overflow ? "request translation buffer exceeded the safe limit" : err instanceof Error ? err.message : String(err),
+      overflow ? "request_too_large" : undefined,
+      overflow ? "translation_buffer_limit" : undefined,
+    );
+  }
   const internalReq = new Request("http://localhost/v1/responses", {
     method: "POST",
     headers,
@@ -185,12 +252,19 @@ async function handleChatCompletionsWithBudget(
   };
   const upstream = await handleResponses(internalReq, config, logCtx, {
     ...(logIds?.turnAdmissionLease ? { turnAdmissionLease: logIds.turnAdmissionLease } : {}),
+    // #1686: the Chat surface translates its body and replays here, so the admission fact has
+    // to ride along or a bearer-admitted Chat caller would still be refused by Direct.
+    ...(logIds?.admission ? { admission: logIds.admission } : {}),
     abortSignal: req.signal,
     // Body is Responses-shaped by now, but the client spoke Chat Completions.
     inboundWire: "chat",
+    // Terminal vision-describe marker (roadmap 180): the bridge rebuilds
+    // headers from the FORWARD_HEADERS allowlist, which would drop the raw
+    // header — so the fact is detected here and carried as an option flag.
+    ...(req.headers.get("x-opencodex-vision-describe") === "1" ? { visionDescribeTerminal: true } : {}),
     translatorBudget,
     ...(logIds ? { onFirstOutput: () => recordFirstOutput(logCtx, logIds.start) } : {}),
-    onNativePassthroughTerminal: status => finalizeNativeLog(httpStatusForTerminalStatus(status), { terminalStatus: status, closeReason: "terminal" }),
+    onNativePassthroughTerminal: status => finalizeNativeLog(httpStatusForRequestLogTerminal(status, logCtx), { terminalStatus: status, closeReason: "terminal" }),
     onNativePassthroughCancel: () => finalizeNativeLog(499, { closeReason: "client_cancel" }),
   });
 
@@ -316,7 +390,7 @@ async function handleChatCompletionsWithBudget(
     const classified = classifyError(502, error?.type ?? "server_error", message);
     if (error?.code === "translation_buffer_limit") {
       classified.code = "translation_buffer_limit";
-      classified.type = "invalid_request_error";
+      classified.type = "upstream_error";
     } else if (isCyberPolicyCode(error?.code)) {
       classified.code = CYBER_POLICY_ERROR_CODE;
       classified.type = "invalid_request_error";
@@ -327,7 +401,7 @@ async function handleChatCompletionsWithBudget(
     }
     return chatCompletionsErrorResponse(
       classified.code === "translation_buffer_limit"
-        ? 413
+        ? 502
         : isCyberPolicyCode(classified.code) ? 400 : 502,
       message,
       classified.type,