@pure01fx/dsh-openai-codex-auth 0.10.1 → 0.11.1

package/lib/cloud-vision.js

@@ -10,8 +10,8 @@ export function parseCloudVisionArgs(value) {
     const row = value;
     if (Object.keys(row).some(key => !['prompt', 'images', 'model', 'detail', 'reasoning_effort'].includes(key)))
         throw new Error('Unknown vision argument');
-    if (typeof row.prompt !== 'string' || !row.prompt.trim() || Buffer.byteLength(row.prompt) > 32_000)
-        throw new Error('Vision prompt must be a nonempty bounded string');
+    if (typeof row.prompt !== 'string' || !row.prompt.trim())
+        throw new Error('Vision prompt must be a nonempty string');
     const selection = validateImageSelection(row);
     if (!selection.images)
         throw new Error('Vision requires explicit images');
@@ -73,21 +73,13 @@ export async function inspectCloudImages(args, deps) {
                 ...(model.instructionsTemplate === undefined ? {} : { instructionsTemplate: model.instructionsTemplate }),
             } } : {}) });
     const texts = new Map();
-    let visibleBytes = 0;
     let usage;
     let finished = false;
     for await (const chunk of chunks) {
         if (chunk.type === 'tool-call-delta' || (chunk.type === 'block-start' && chunk.blockType === 'tool-call'))
             throw new LlmError('Image inspection returned an unexpected tool call', 'UNSUPPORTED');
-        if (chunk.type === 'text-delta') {
-            visibleBytes += Buffer.byteLength(chunk.text);
-            if (visibleBytes > 128 * 1024)
-                throw new LlmError('Image inspection output exceeded limit', 'RESPONSE_TOO_LARGE');
-        }
         if (chunk.type === 'block-end' && chunk.block.type === 'text') {
             texts.set(chunk.index, chunk.block.text);
-            if ([...texts.values()].reduce((bytes, text) => bytes + Buffer.byteLength(text), 0) > 128 * 1024)
-                throw new LlmError('Image inspection output exceeded limit', 'RESPONSE_TOO_LARGE');
         }
         if (chunk.type === 'usage')
             usage = chunk.usage;

package/lib/cloud-web-tool.js

@@ -22,7 +22,7 @@ const operations = {
     response_length: enumeration('short', 'medium', 'long'),
 };
 const parameters = object({
-    commands: { ...object(operations), description: 'One or more nonempty command arrays; at most 100 operations total. Dependent actions require separate calls. screenshot only supports zero-indexed PDF pages.' },
+    commands: { ...object(operations), description: 'One or more nonempty command arrays. Dependent actions require separate calls. screenshot only supports zero-indexed PDF pages.' },
     model: { ...str, description: 'Explicit Codex catalog model; otherwise cloudTools.searchModel, then current openai-codex model. No guessed fallback.' },
     context: { ...str, description: 'Optional explicit text. Default includes last two visible human texts and at most 1000 UTF-8 bytes of visible assistant text.' },
     mode: enumeration('cached', 'indexed', 'live'), search_context_size: enumeration('low', 'medium', 'high'),
@@ -51,12 +51,8 @@ function inputImage(value) {
 async function admitSearchImages(body, attachments, signal) {
     const images = [];
     const notes = new Set();
-    let seen = 0;
-    let bytes = 0;
-    const visit = async (item, depth) => {
+    const visit = async (item) => {
         signal.throwIfAborted();
-        if (depth > 8)
-            return item;
         if (inputImage(item)) {
             if (publicUrl(item.image_url)) {
                 notes.add('Remote image unavailable: the public DSH web boundary has no binary image retrieval. Image and source links are preserved.');
@@ -69,12 +65,9 @@ async function admitSearchImages(body, attachments, signal) {
             try {
                 if (!attachments)
                     throw new Error('Attachment service unavailable');
-                if (++seen > 4 || match[2].length > 12 * 1024 * 1024)
-                    throw new Error('Image count or byte limit');
                 const data = Buffer.from(match[2], 'base64');
-                bytes += data.length;
-                if (!data.length || bytes > 8 * 1024 * 1024 || data.toString('base64') !== match[2])
-                    throw new Error('Invalid or oversized inline image');
+                if (!data.length || data.toString('base64') !== match[2])
+                    throw new Error('Invalid inline image');
                 signal.throwIfAborted();
                 ref = await attachments.saveImage({ data, mediaType: match[1] });
                 signal.throwIfAborted();
@@ -87,26 +80,23 @@ async function admitSearchImages(body, attachments, signal) {
             // Binary transfer data must not become historical text; unknown fields remain opaque.
             return { ...item, image_url: ref ? '[DSH attachment ' + ref.attachmentId + ']' : '[inline image unavailable]' };
         }
-        // Bounded structural walk permits known content blocks nested in evolving result DTOs.
+        // Visit known content blocks while keeping unknown object fields opaque.
         if (Array.isArray(item)) {
-            if (item.length > 100)
-                return item; // Unknown large arrays stay opaque for bounded parsing.
             const result = [];
             for (const value of item)
-                result.push(await visit(value, depth + 1));
+                result.push(await visit(value));
             return result;
         }
-        if (record(item) && Array.isArray(item.content) && item.content.length <= 100) {
-            return { ...item, content: await visit(item.content, depth + 1) };
+        if (record(item) && Array.isArray(item.content)) {
+            return { ...item, content: await visit(item.content) };
         }
         return item;
     };
     if (!record(body) || !Array.isArray(body.results))
         return { body, images, notes };
-    // Leave excess entries for the response parser to mark explicitly as truncated.
     const results = [];
-    for (let i = 0; i < body.results.length; i++)
-        results.push(i < 100 ? await visit(body.results[i], 0) : body.results[i]);
+    for (const item of body.results)
+        results.push(await visit(item));
     return { body: { ...body, results }, images, notes };
 }
 const markerPrefix = '[codex_web context: ';
@@ -208,7 +198,7 @@ export function registerCodexWeb(ctx, deps) {
             checkReferences(args, messages, id, recent);
             const response = await deps.client.post('alpha/search', body, { credential, signal: exec.signal });
             // Validate the envelope before any attachment write; image bytes are replaced
-            // before the final bounded result projection so large valid images can attach.
+            // before the final result projection so inline images become attachments.
             if (!record(response.body) || typeof response.body.output !== 'string' || (response.body.results != null && !Array.isArray(response.body.results)))
                 throw new LlmError('Invalid Codex search response', 'CODEX_CLOUD_FAILED');
             const media = await admitSearchImages(response.body, agent.ctx.attachments, exec.signal);

package/lib/index.d.ts

@@ -200,6 +200,7 @@ export declare class OpenAICodexAuth extends Service {
     private sendText;
     private trustedManagementRequest;
     private requireCsrf;
+    private handleNetwork;
     private handleStatus;
     private handleAccountUsage;
     private handleDeviceStart;

package/lib/index.js

@@ -18,6 +18,7 @@ import { NativeCodexCloudClient } from './cloud-http.js';
 import { registerCodexImageTools } from './cloud-tools.js';
 import { registerCodexWeb } from './cloud-web-tool.js';
 import { mergeDirectUsage, normalizeUsage } from './usage.js';
+import { networkTelemetry } from './network-telemetry.js';
 export { normalizeUsage } from './usage.js';
 export { CODEX_CLIENT_VERSION, TRACKED_CODEX_COMMIT, TRACKED_CODEX_RELEASE, TRACKED_CODEX_REPOSITORY, } from './upstream.js';
 const CLIENT_ID = 'app_EMoamEEZ73f0CkXaXp7hrann';
@@ -829,6 +830,7 @@ export class OpenAICodexAuth extends Service {
                     disposers.push(ctx.webServer.register({ kind: 'exact', path, handler }));
                 };
                 register('/openai-codex/status', (req, res) => this.handleStatus(req, res));
+                register('/openai-codex/network', (req, res) => this.handleNetwork(req, res));
                 register('/openai-codex/device/start', (req, res) => this.handleDeviceStart(req, res));
                 register('/openai-codex/browser/start', (req, res) => this.handleBrowserStart(req, res));
                 register('/openai-codex/browser/prepare', (req, res) => this.handleBrowserPrepare(req, res));
@@ -2013,6 +2015,15 @@ export class OpenAICodexAuth extends Service {
         this.sendJson(res, 403, { error: 'Invalid CSRF token.' });
         return false;
     }
+    handleNetwork(req, res) {
+        if (!this.trustedManagementRequest(req, res))
+            return;
+        if (req.method !== 'GET') {
+            this.sendJson(res, 405, { error: 'GET only' }, { allow: 'GET' });
+            return;
+        }
+        this.sendJson(res, 200, networkTelemetry.snapshot());
+    }
     async handleStatus(req, res) {
         if (!this.trustedManagementRequest(req, res))
             return;

package/lib/native-http.d.ts

@@ -1,3 +1,4 @@
+import { type NetworkTelemetry, type NetworkRequestHandle } from './network-telemetry.js';
 import { type ContentBlock, type GenerateOptions, type StreamChunk } from '@deepseek-ai/dsh-llm';
 import { type NativeCodexCredential } from './catalog.js';
 import { type NativeCodexTransportMode } from './native-adapter.js';
@@ -16,15 +17,14 @@ export interface NativeCodexHttpOptions {
     resolveCredential(signal?: AbortSignal): Promise<NativeCodexCredential>;
     recoverCredential?(previous: NativeCodexCredential, signal?: AbortSignal): Promise<boolean>;
     readImage?(attachment: ImageBlock['attachment'], signal?: AbortSignal): Promise<NativeCodexImageRead>;
+    telemetry?: NetworkTelemetry;
     fetch?: typeof fetch;
     endpoint?: string;
     requestTimeoutMs?: number;
     streamIdleTimeoutMs?: number;
-    maxSseEventBytes?: number;
     maxTransientRetries?: number;
     initialRetryDelayMs?: number;
     maxRetryDelayMs?: number;
-    maxRequestBodyBytes?: number;
     random?: () => number;
     sleep?: (delayMs: number, signal?: AbortSignal) => Promise<void>;
     createRequestId?: () => string;
@@ -37,7 +37,6 @@ export interface NativeCodexPreparedRequest {
     generation: GenerateOptions;
     mode: NativeCodexTransportMode;
     request: Record<string, unknown>;
-    body: string;
     routingId: string;
     routingHint: string;
 }
@@ -51,13 +50,13 @@ export declare class NativeCodexHttpTransport {
     private readonly maxRetries;
     private readonly initialDelayMs;
     private readonly maxDelayMs;
-    private readonly maxBodyBytes;
     constructor(options: NativeCodexHttpOptions);
     private retryDelay;
     private wait;
     private waitForConnection;
     endpointUrl(): string;
     prepare(generation: GenerateOptions, mode?: NativeCodexTransportMode): Promise<NativeCodexPreparedRequest>;
-    stream(generation: GenerateOptions, mode?: NativeCodexTransportMode): AsyncIterable<StreamChunk>;
+    stream(generation: GenerateOptions, mode?: NativeCodexTransportMode, telemetry?: NetworkRequestHandle): AsyncIterable<StreamChunk>;
+    private streamTracked;
 }
 export {};

package/lib/native-http.js

@@ -1,5 +1,6 @@
 /** Native ChatGPT Codex HTTP/SSE transport with safe pre-output retries. */
 import { createHash, randomUUID } from 'node:crypto';
+import { networkTelemetry, trackNetwork, observeNetworkOutput } from './network-telemetry.js';
 import { CONTEXT_WINDOW_EXCEEDED_CODE, EMPTY_RESPONSE_CODE, isContextWindowExceededError, isQuotaExceededError, LlmError, ProviderRequestId, QUOTA_EXCEEDED_CODE, attributionHeaders, } from '@deepseek-ai/dsh-llm';
 import { nativeCodexAuthorityHash } from './catalog.js';
 import { nativeCodexEndpoint } from './endpoint.js';
@@ -16,7 +17,6 @@ const DEFAULT_INITIAL_RETRY_DELAY_MS = 200;
 const DEFAULT_MAX_RETRY_DELAY_MS = 10_000;
 const INITIAL_CONNECTION_RETRY_DELAY_MS = 5_000;
 const MAX_CONNECTION_RETRY_DELAY_MS = 60_000;
-const DEFAULT_MAX_REQUEST_BODY_BYTES = 24 * 1024 * 1024;
 const MAX_ERROR_BODY_BYTES = 64 * 1024;
 function aborted(message = 'native Codex request was aborted') {
     return new LlmError(message, 'ABORTED');
@@ -199,7 +199,7 @@ async function resolveMessages(generation, options) {
     }
     return messages;
 }
-async function boundedError(response, signal) {
+async function boundedError(response, signal, telemetry) {
     if (response.body === null)
         return {};
     const reader = response.body.getReader();
@@ -223,6 +223,7 @@ async function boundedError(response, signal) {
                 return {};
             if (done)
                 break;
+            telemetry.activity(value.byteLength);
             total += value.byteLength;
             if (total > MAX_ERROR_BODY_BYTES) {
                 await reader.cancel().catch(() => { });
@@ -276,8 +277,8 @@ function errorFacts(response, maxDelayMs) {
             : { requestId: ProviderRequestId(requestId) },
     };
 }
-async function httpFailure(response, maxDelayMs, signal) {
-    const detail = await boundedError(response, signal);
+async function httpFailure(response, maxDelayMs, signal, telemetry) {
+    const detail = await boundedError(response, signal, telemetry);
     const facts = errorFacts(response, maxDelayMs);
     const classification = `${detail.code ?? ''} ${detail.message ?? ''}`;
     if (response.status === 401 || response.status === 403) {
@@ -357,7 +358,6 @@ export class NativeCodexHttpTransport {
     maxRetries;
     initialDelayMs;
     maxDelayMs;
-    maxBodyBytes;
     constructor(options) {
         this.options = options;
         this.fetchImpl = options.fetch ?? fetch;
@@ -367,7 +367,6 @@ export class NativeCodexHttpTransport {
         this.maxRetries = safeRetryCount(options.maxTransientRetries);
         this.initialDelayMs = safePositiveInteger(options.initialRetryDelayMs, DEFAULT_INITIAL_RETRY_DELAY_MS, 'initial retry delay');
         this.maxDelayMs = safePositiveInteger(options.maxRetryDelayMs, DEFAULT_MAX_RETRY_DELAY_MS, 'maximum retry delay');
-        this.maxBodyBytes = safePositiveInteger(options.maxRequestBodyBytes, DEFAULT_MAX_REQUEST_BODY_BYTES, 'request body limit');
     }
     retryDelay(retry, providerDelay) {
         if (providerDelay !== undefined)
@@ -377,11 +376,13 @@ export class NativeCodexHttpTransport {
         const jitter = 0.9 + Math.max(0, Math.min(1, random)) * 0.2;
         return Math.max(1, Math.round(exponential * jitter));
     }
-    async wait(retry, error, signal) {
+    async wait(retry, error, signal, telemetry) {
         const delay = this.retryDelay(retry, error.failure.providerRetryAfterMs);
+        telemetry.retry(delay);
         await (this.options.sleep ?? sleep)(delay, signal);
     }
-    async waitForConnection(delayMs, signal) {
+    async waitForConnection(delayMs, signal, telemetry) {
+        telemetry.retry(delayMs, 'connection');
         this.options.warn?.(`native Codex network is unavailable; reconnecting in ${delayMs}ms`);
         await (this.options.sleep ?? sleep)(delayMs, signal);
     }
@@ -410,24 +411,36 @@ export class NativeCodexHttpTransport {
                 sessionId: stablePromptCacheKey(sessionId),
             };
         let request;
-        let body;
         try {
             request = codexRequestBody(wireOptions, messages, mode);
-            body = JSON.stringify(request);
         }
         catch (error) {
             if (error instanceof LlmError)
                 throw error;
             throw fixedFailure('native Codex request could not be encoded', 'INVALID_ARGS', { cause: error });
         }
-        if (Buffer.byteLength(body) > this.maxBodyBytes) {
-            throw fixedFailure('native Codex request exceeded the size limit', 'REQUEST_TOO_LARGE');
+        // WebSocket chooses a full request or an incremental suffix after preparation.
+        // Serialize only in the selected transport.
+        return { generation, mode, request, routingId, routingHint };
+    }
+    async *stream(generation, mode = {}, telemetry) {
+        if (telemetry !== undefined) {
+            yield* this.streamTracked(generation, mode, telemetry);
+            return;
         }
-        return { generation, mode, request, body, routingId, routingHint };
+        yield* trackNetwork(this.options.telemetry ?? networkTelemetry, 'http', generation.signal, handle => this.streamTracked(generation, mode, handle));
     }
-    async *stream(generation, mode = {}) {
+    async *streamTracked(generation, mode, telemetry) {
+        telemetry.state('preparing');
         const prepared = await this.prepare(generation, mode);
-        const { body, routingId, routingHint } = prepared;
+        const { request, routingId, routingHint } = prepared;
+        let body;
+        try {
+            body = JSON.stringify(request);
+        }
+        catch (error) {
+            throw fixedFailure('native Codex request could not be encoded', 'INVALID_ARGS', { cause: error });
+        }
         let activeTurnState = mode.turnState;
         if (activeTurnState !== undefined
             && (activeTurnState.length === 0 || Buffer.byteLength(activeTurnState) > 4096
@@ -440,6 +453,7 @@ export class NativeCodexHttpTransport {
         let pinnedAccountId = mode.pinnedAccountId;
         while (true) {
             throwIfAborted(generation.signal);
+            telemetry.state('preparing');
             const watchdog = attemptWatchdog(generation.signal, this.requestTimeoutMs, this.idleTimeoutMs);
             let response;
             let credential;
@@ -458,6 +472,7 @@ export class NativeCodexHttpTransport {
                     throw fixedFailure('native Codex Fast capability authority changed before request', 'FAST_CAPABILITY_UNAVAILABLE');
                 }
                 fetching = true;
+                telemetry.attempt('http');
                 response = await this.fetchImpl(this.endpoint, {
                     method: 'POST',
                     redirect: 'error',
@@ -490,16 +505,18 @@ export class NativeCodexHttpTransport {
                     : connection ?? mappedFailure(error, watchdog, generation.signal);
                 watchdog.stop();
                 if (connection !== undefined) {
-                    await this.waitForConnection(connectionRetryDelayMs, generation.signal);
+                    await this.waitForConnection(connectionRetryDelayMs, generation.signal, telemetry);
                     connectionRetryDelayMs = Math.min(connectionRetryDelayMs * 2, MAX_CONNECTION_RETRY_DELAY_MS);
                     continue;
                 }
                 if (retryable(failure) && transientRetries < this.maxRetries) {
-                    await this.wait(transientRetries++, failure, generation.signal);
+                    await this.wait(transientRetries++, failure, generation.signal, telemetry);
                     continue;
                 }
                 throw failure;
             }
+            telemetry.activity();
+            telemetry.state('waiting');
             publishCodexRateLimits(credential.accountId, parseCodexRateLimitHeaders(response.headers), this.options.onRateLimits, this.options.warn);
             if (activeTurnState === undefined) {
                 const headerTurnState = boundedCodexTurnState(response.headers.get('x-codex-turn-state'));
@@ -514,8 +531,10 @@ export class NativeCodexHttpTransport {
                     const changed = await this.options.recoverCredential(credential, watchdog.signal);
                     recovered = true;
                     watchdog.stop();
-                    if (changed)
+                    if (changed) {
+                        telemetry.retry(0);
                         continue;
+                    }
                     throw fixedFailure('native Codex rejected the configured credential', 'AUTH', errorFacts(response, this.maxDelayMs));
                 }
                 catch (error) {
@@ -523,7 +542,7 @@ export class NativeCodexHttpTransport {
                     const failure = connection ?? mappedFailure(error, watchdog, generation.signal);
                     watchdog.stop();
                     if (connection !== undefined) {
-                        await this.waitForConnection(connectionRetryDelayMs, generation.signal);
+                        await this.waitForConnection(connectionRetryDelayMs, generation.signal, telemetry);
                         connectionRetryDelayMs = Math.min(connectionRetryDelayMs * 2, MAX_CONNECTION_RETRY_DELAY_MS);
                         continue;
                     }
@@ -531,13 +550,13 @@ export class NativeCodexHttpTransport {
                 }
             }
             if (!response.ok) {
-                let failure = await httpFailure(response, this.maxDelayMs, watchdog.signal);
+                let failure = await httpFailure(response, this.maxDelayMs, watchdog.signal, telemetry);
                 if (generation.signal?.aborted || watchdog.timedOut()) {
                     failure = mappedFailure(failure, watchdog, generation.signal);
                 }
                 watchdog.stop();
                 if (retryable(failure) && transientRetries < this.maxRetries) {
-                    await this.wait(transientRetries++, failure, generation.signal);
+                    await this.wait(transientRetries++, failure, generation.signal, telemetry);
                     continue;
                 }
                 throw failure;
@@ -553,9 +572,7 @@ export class NativeCodexHttpTransport {
                 for await (const chunk of streamResponses(response.body, {
                     signal: watchdog.signal,
                     onActivity: watchdog.pulse,
-                    ...this.options.maxSseEventBytes === undefined
-                        ? {}
-                        : { maxEventBytes: this.options.maxSseEventBytes },
+                    onBytes: bytes => telemetry.activity(bytes),
                     onMalformedEvent: () => {
                         this.options.warn?.('native Codex ignored a malformed SSE event');
                     },
@@ -578,6 +595,7 @@ export class NativeCodexHttpTransport {
                     },
                 })) {
                     emitted = true;
+                    observeNetworkOutput(telemetry, chunk);
                     if (chunk.type === 'finish'
                         && ['stop', 'tool-calls', 'max-tokens'].includes(chunk.reason.kind))
                         completed = true;
@@ -596,7 +614,7 @@ export class NativeCodexHttpTransport {
             catch (error) {
                 const failure = mappedFailure(error, watchdog, generation.signal);
                 if (!emitted && retryable(failure) && transientRetries < this.maxRetries) {
-                    await this.wait(transientRetries++, failure, generation.signal);
+                    await this.wait(transientRetries++, failure, generation.signal, telemetry);
                     continue;
                 }
                 if (emitted && retryable(failure))

package/lib/native-websocket-session.js

@@ -1,7 +1,6 @@
 /** Pure WebSocket v2 previous-response and incremental suffix state. */
 import { createHash } from 'node:crypto';
 import { LlmError } from '@deepseek-ai/dsh-llm';
-const MAX_RESPONSE_ID_BYTES = 256;
 const IGNORED_REUSE_FIELDS = new Set([
     'input', 'previous_response_id', 'generate', 'client_metadata',
     'stream_options', 'access_programs',
@@ -84,8 +83,7 @@ export class NativeCodexWebSocketSessionState {
         return { ...plan, payload: { ...plan.payload, generate: false } };
     }
     complete(responseId, outputItems) {
-        if (this.pending === undefined || responseId.length === 0
-            || Buffer.byteLength(responseId) > MAX_RESPONSE_ID_BYTES) {
+        if (this.pending === undefined || responseId.length === 0) {
             this.reset();
             throw failure('native Codex WebSocket completion identity is invalid');
         }

package/lib/native-websocket-socket.d.ts

@@ -10,6 +10,8 @@ export interface NativeCodexWebSocket {
     readonly responseHeaders: Readonly<Record<string, string>>;
     send(text: string, signal?: AbortSignal): Promise<void>;
     receive(signal?: AbortSignal): Promise<NativeCodexWebSocketFrame>;
+    /** Observe incoming payload bytes while a logical inference owns the socket. */
+    observeActivity?(observer: (bytes: number) => void): () => void;
     close(): void;
 }
 export interface NativeCodexWebSocketConnectOptions {
@@ -17,7 +19,6 @@ export interface NativeCodexWebSocketConnectOptions {
     headers: Record<string, string>;
     signal?: AbortSignal;
     connectTimeoutMs?: number;
-    maxFrameBytes?: number;
 }
 export interface NativeCodexWebSocketFactory {
     connect(options: NativeCodexWebSocketConnectOptions): Promise<NativeCodexWebSocket>;

package/lib/native-websocket-socket.js

@@ -1,4 +1,4 @@
-/** Bounded Node WebSocket client seam with injectable deterministic factories. */
+/** Node WebSocket client seam with injectable deterministic factories. */
 import { LlmError, ProviderRequestId } from '@deepseek-ai/dsh-llm';
 import { HttpsProxyAgent } from 'https-proxy-agent';
 import { getProxyForUrl } from 'proxy-from-env';
@@ -6,8 +6,6 @@ import { nativeCodexEndpoint } from './endpoint.js';
 import { NATIVE_CODEX_CONNECTION_FAILED_CODE, isNativeCodexConnectionFailure, } from './native-adapter.js';
 import WebSocket from 'ws';
 const DEFAULT_CONNECT_TIMEOUT_MS = 10_000;
-const DEFAULT_MAX_FRAME_BYTES = 64 * 1024 * 1024;
-const MAX_QUEUED_BYTES = 64 * 1024 * 1024;
 function failure(message, code, cause) {
     return new LlmError(message, code, cause === undefined ? undefined : { cause });
 }
@@ -54,29 +52,29 @@ export function nativeCodexWebSocketUrl(endpoint) {
 class NodeNativeCodexWebSocket {
     socket;
     responseHeaders;
-    maxFrameBytes;
     queue = [];
-    queuedBytes = 0;
     waiters = [];
     ended = false;
-    constructor(socket, responseHeaders, maxFrameBytes) {
+    activityObserver;
+    observeActivity(observer) {
+        this.activityObserver = observer;
+        return () => { if (this.activityObserver === observer)
+            this.activityObserver = undefined; };
+    }
+    constructor(socket, responseHeaders) {
         this.socket = socket;
         this.responseHeaders = responseHeaders;
-        this.maxFrameBytes = maxFrameBytes;
+        socket.on('ping', data => { this.activityObserver?.(data.byteLength); });
+        socket.on('pong', data => { this.activityObserver?.(data.byteLength); });
         socket.on('message', (data, isBinary) => {
+            this.activityObserver?.(Array.isArray(data) ? data.reduce((sum, part) => sum + part.byteLength, 0) : data.byteLength);
             if (isBinary) {
                 this.fail(failure('native Codex WebSocket returned a binary frame', 'WS_PROTOCOL_ERROR'));
                 return;
             }
-            const bytes = Array.isArray(data)
-                ? data.reduce((total, chunk) => total + chunk.byteLength, 0) : data.byteLength;
-            if (bytes > maxFrameBytes) {
-                this.fail(failure('native Codex WebSocket frame exceeded the size limit', 'WS_FRAME_TOO_LARGE'));
-                return;
-            }
-            const buffer = Array.isArray(data) ? Buffer.concat(data, bytes)
+            const buffer = Array.isArray(data) ? Buffer.concat(data)
                 : Buffer.isBuffer(data) ? data : Buffer.from(data);
-            this.push({ type: 'text', text: buffer.toString('utf8') }, bytes);
+            this.push({ type: 'text', text: buffer.toString('utf8') });
         });
         socket.on('close', (code, reason) => {
             this.ended = true;
@@ -86,7 +84,7 @@ class NodeNativeCodexWebSocket {
             this.fail(failure('native Codex WebSocket transport failed', 'WS_RETRYABLE', error));
         });
     }
-    push(value, bytes = 0) {
+    push(value) {
         const waiter = this.waiters.shift();
         if (waiter !== undefined) {
             if (value instanceof LlmError)
@@ -95,12 +93,7 @@ class NodeNativeCodexWebSocket {
                 waiter.resolve(value);
             return;
         }
-        if (this.queuedBytes + bytes > MAX_QUEUED_BYTES) {
-            this.fail(failure('native Codex WebSocket queued too much response data', 'WS_RESPONSE_TOO_LARGE'));
-            return;
-        }
-        this.queue.push({ value, bytes });
-        this.queuedBytes += bytes;
+        this.queue.push(value);
     }
     fail(error) {
         if (!this.ended)
@@ -110,9 +103,8 @@ class NodeNativeCodexWebSocket {
         for (const waiter of waiters)
             waiter.reject(error);
         this.queue.length = 0;
-        this.queuedBytes = 0;
         if (waiters.length === 0)
-            this.queue.push({ value: error, bytes: 0 });
+            this.queue.push(error);
     }
     async send(text, signal) {
         if (signal?.aborted)
@@ -140,10 +132,9 @@ class NodeNativeCodexWebSocket {
             throw abortFailure(signal);
         const queued = this.queue.shift();
         if (queued !== undefined) {
-            this.queuedBytes -= queued.bytes;
-            if (queued.value instanceof LlmError)
-                throw queued.value;
-            return queued.value;
+            if (queued instanceof LlmError)
+                throw queued;
+            return queued;
         }
         return new Promise((resolve, reject) => {
             let waiter;
@@ -173,7 +164,6 @@ class NodeNativeCodexWebSocket {
 export class NodeNativeCodexWebSocketFactory {
     async connect(options) {
         const timeout = positive(options.connectTimeoutMs, DEFAULT_CONNECT_TIMEOUT_MS, 'connect timeout');
-        const maximum = positive(options.maxFrameBytes, DEFAULT_MAX_FRAME_BYTES, 'frame limit');
         if (options.signal?.aborted)
             throw abortFailure(options.signal);
         return new Promise((resolve, reject) => {
@@ -184,7 +174,8 @@ export class NodeNativeCodexWebSocketFactory {
                 headers: options.headers,
                 ...(agent === undefined ? {} : { agent }),
                 handshakeTimeout: timeout,
-                maxPayload: maximum,
+                // ws uses zero to disable its default message-size ceiling.
+                maxPayload: 0,
                 perMessageDeflate: true,
             });
             const abort = () => {
@@ -215,7 +206,7 @@ export class NodeNativeCodexWebSocketFactory {
             });
             socket.on('open', () => {
                 options.signal?.removeEventListener('abort', abort);
-                resolve(new NodeNativeCodexWebSocket(socket, responseHeaders, maximum));
+                resolve(new NodeNativeCodexWebSocket(socket, responseHeaders));
             });
             socket.on('error', (error) => {
                 options.signal?.removeEventListener('abort', abort);

package/lib/native-websocket.d.ts

@@ -6,7 +6,6 @@ export interface NativeCodexWebSocketTransportOptions extends NativeCodexHttpOpt
     webSocketFactory?: NativeCodexWebSocketFactory;
     webSocketConnectTimeoutMs?: number;
     webSocketIdleTimeoutMs?: number;
-    maxWebSocketFrameBytes?: number;
     maxWebSocketSessions?: number;
     webSocketSessionIdleMs?: number;
     maxWebSocketReconnects?: number;
@@ -19,7 +18,6 @@ export declare class NativeCodexWebSocketTransport implements NativeCodexTranspo
     private readonly sessions;
     private readonly connectTimeoutMs;
     private readonly idleTimeoutMs;
-    private readonly maxFrameBytes;
     private readonly maxSessions;
     private readonly sessionIdleMs;
     private readonly maxReconnects;
@@ -42,5 +40,6 @@ export declare class NativeCodexWebSocketTransport implements NativeCodexTranspo
     private exchange;
     private attempt;
     stream(generation: GenerateOptions, mode?: NativeCodexTransportMode): AsyncIterable<StreamChunk>;
+    private streamTracked;
     dispose(): void;
 }