@remodex/rmx 1.0.2

package/src/server/search.ts

@@ -0,0 +1,181 @@
+/**
+ * /v1/alpha/search relay.
+ *
+ * codex-rs's built-in search client executes CLIENT-SIDE: it POSTs `alpha/search` against the
+ * configured base_url with the same ChatGPT bearer auth used for model requests. Under Design B
+ * injection base_url is this proxy, so the request otherwise dies on the /v1/* JSON-404 guard.
+ * The endpoint is private to the ChatGPT Codex backend, so routed providers and OpenAI API-key
+ * providers cannot serve it. Relay the JSON request and response verbatim through the configured
+ * ChatGPT forward provider.
+ */
+import { formatErrorResponse } from "../bridge";
+import {
+  CodexAccountCooldownError,
+  codexMainProfileDrainingResponse,
+  cooldownErrorResponse,
+  CodexAuthContextError,
+  CodexMainProfileDrainingError,
+  CodexPoolAuthenticationError,
+  CodexThreadAffinityExpiredError,
+} from "../codex/auth-context";
+import { codexAccountNamespaceForModel } from "../codex/account-namespace-match";
+import { formatCodexProviderForLog } from "../codex/routing";
+import { signalWithTimeout } from "../lib/abort";
+import { sidecarEnter } from "../lib/sidecar-tracker";
+import type { OcxConfig } from "../types";
+import {
+  listOpenAiForwardSidecarCandidates,
+  resolveFirstUsableOpenAiSidecar,
+  type ExactOpenAiSidecarAccount,
+} from "../providers/openai-sidecar";
+import { routeModel } from "../router";
+import { readJsonRequestBody } from "./request-decompress";
+import { ForwardAdmissionCredentialError, validateForwardAdmissionCredential } from "./auth-cors";
+import type { RequestLogContext } from "./request-log";
+import { codexLogAccountId, decodeRequestErrorResponse } from "./responses";
+import type { AdmissionLease } from "../lib/admission";
+import { codexAccountSelectionForTurn } from "./lifecycle";
+
+/**
+ * Default TOTAL deadline for one search relay. alpha/search is non-streaming JSON — response
+ * headers arrive only when the search finishes — so the budget must cover the whole request.
+ * Overridable via config.search.timeoutMs; never config.connectTimeoutMs, whose documented
+ * contract is the DNS/TCP/TLS/header-arrival budget (a 10s connect budget would kill every
+ * long-running search).
+ */
+const SEARCH_UPSTREAM_TIMEOUT_MS = 200_000;
+const SEARCH_RESPONSE_MAX_BYTES = 16 * 1024 * 1024;
+
+export async function handleSearch(
+  req: Request,
+  config: OcxConfig,
+  logCtx: RequestLogContext,
+  turnAdmissionLease?: AdmissionLease,
+): Promise<Response> {
+  try { validateForwardAdmissionCredential(req.headers, config); }
+  catch (err) {
+    if (err instanceof ForwardAdmissionCredentialError) return formatErrorResponse(401, "authentication_error", err.message);
+    throw err;
+  }
+  let body: unknown;
+  try {
+    body = await readJsonRequestBody(req);
+  } catch (err) {
+    return decodeRequestErrorResponse(err, "search");
+  }
+  const model = (body as { model?: unknown } | null)?.model;
+  if (typeof model === "string" && model) logCtx.model = model;
+
+  let exactAccount: ExactOpenAiSidecarAccount | undefined;
+  let relayBody = body;
+  const accountNamespace = typeof model === "string"
+    ? codexAccountNamespaceForModel(config.codexAccountNamespaces, model)
+    : undefined;
+  if (accountNamespace && typeof model === "string") {
+    try {
+      const route = routeModel(config, model);
+      if (!route.codexAccountId || route.codexAccountNamespace !== accountNamespace) {
+        return formatErrorResponse(400, "invalid_request_error", "Invalid Codex account-qualified search model");
+      }
+      exactAccount = { accountId: route.codexAccountId, modelId: route.modelId };
+      logCtx.provider = `${route.providerName}-${accountNamespace}`;
+      logCtx.routeDecision = route.routeDecision;
+      // The ChatGPT search endpoint only understands the native model slug. The
+      // account namespace is proxy routing syntax and must not cross the wire.
+      relayBody = { ...(body as Record<string, unknown>), model: route.modelId };
+    } catch (err) {
+      return formatErrorResponse(
+        400,
+        "invalid_request_error",
+        err instanceof Error ? err.message : "Invalid Codex account-qualified search model",
+      );
+    }
+  }
+
+  const candidates = listOpenAiForwardSidecarCandidates(config);
+  if (candidates.length === 0) {
+    return formatErrorResponse(
+      400,
+      "invalid_request_error",
+      "Built-in web search needs a ChatGPT forward provider, but none is configured in Remodex. "
+      + "Routed and OpenAI API-key providers cannot serve /v1/alpha/search.",
+    );
+  }
+
+  let upstream: Awaited<ReturnType<typeof resolveFirstUsableOpenAiSidecar>>;
+  try {
+    upstream = await resolveFirstUsableOpenAiSidecar(candidates, req.headers, config, {
+      exactAccount,
+      beginCodexAccountSelection: codexAccountSelectionForTurn(turnAdmissionLease),
+    });
+    if (!upstream) {
+      return formatErrorResponse(
+        401,
+        "authentication_error",
+        "web search relay needs ChatGPT auth (Authorization header)",
+      );
+    }
+    logCtx.provider = accountNamespace
+      ? `${upstream.providerName}-${accountNamespace}`
+      : formatCodexProviderForLog(upstream.providerName, codexLogAccountId(upstream.authContext), config);
+  } catch (err) {
+    if (err instanceof CodexAccountCooldownError) {
+      return cooldownErrorResponse(err, Date.now(), accountNamespace);
+    }
+    if (err instanceof CodexMainProfileDrainingError) return codexMainProfileDrainingResponse();
+    if (err instanceof CodexThreadAffinityExpiredError) {
+      return formatErrorResponse(409, "invalid_request_error", "Codex thread account affinity expired; start a new session");
+    }
+    if (err instanceof CodexAuthContextError) {
+      const safeAccountLabel = accountNamespace
+        ? `openai-${accountNamespace}`
+        : formatCodexProviderForLog("openai", err.accountId, config);
+      console.error(`[search] Pool account ${safeAccountLabel} token failed; reauthentication required`);
+      return formatErrorResponse(401, "authentication_error", "Selected Codex account needs reauthentication");
+    }
+    if (err instanceof CodexPoolAuthenticationError) return formatErrorResponse(401, "authentication_error", err.message);
+    throw err;
+  }
+
+  const headers: Record<string, string> = { "content-type": "application/json" };
+  if (upstream.provider.headers) Object.assign(headers, upstream.provider.headers);
+  for (const [name, value] of upstream.headers) headers[name] = value;
+  const url = `${upstream.provider.baseUrl}/alpha/search`;
+  const timeoutMs = config.search?.timeoutMs ?? SEARCH_UPSTREAM_TIMEOUT_MS;
+  const linkedSignal = signalWithTimeout(timeoutMs, req.signal);
+  const sidecarExit = sidecarEnter("search");
+  try {
+    const upstreamResponse = await fetch(url, {
+      method: "POST",
+      headers,
+      body: JSON.stringify(relayBody),
+      signal: linkedSignal.signal,
+    });
+    const payload = await upstreamResponse.arrayBuffer();
+    if (payload.byteLength > SEARCH_RESPONSE_MAX_BYTES) {
+      return formatErrorResponse(502, "upstream_error", `search response too large (${payload.byteLength} bytes)`);
+    }
+    upstream.recordOutcome?.(upstreamResponse.status);
+    const relayHeaders: Record<string, string> = {};
+    const contentType = upstreamResponse.headers.get("content-type");
+    if (contentType) relayHeaders["content-type"] = contentType;
+    return new Response(payload, { status: upstreamResponse.status, headers: relayHeaders });
+  } catch (err) {
+    if (req.signal.aborted) {
+      return formatErrorResponse(499, "client_closed_request", "search request canceled by client");
+    }
+    if (err instanceof Error && err.name === "TimeoutError") {
+      upstream.recordOutcome?.("timeout");
+      return formatErrorResponse(504, "upstream_error", "search upstream timed out");
+    }
+    upstream.recordOutcome?.("connect_error");
+    return formatErrorResponse(
+      502,
+      "upstream_error",
+      `search relay failed: ${err instanceof Error ? err.message : String(err)}`,
+    );
+  } finally {
+    sidecarExit();
+    linkedSignal.cleanup();
+  }
+}

package/src/server/sse-frame-buffer.ts

@@ -0,0 +1,292 @@
+export const MAX_CLIENT_SSE_FRAME_BYTES = 4 * 1024 * 1024;
+
+const LF_LF = Uint8Array.of(10, 10);
+const LF_CR_LF = Uint8Array.of(10, 13, 10);
+const CR_LF_LF = Uint8Array.of(13, 10, 10);
+const CR_LF_CR_LF = Uint8Array.of(13, 10, 13, 10);
+
+export class SseFrameTooLargeError extends Error {
+  readonly maxBytes: number;
+
+  constructor(maxBytes: number) {
+    super(`upstream SSE frame exceeded ${maxBytes} bytes`);
+    this.name = "SseFrameTooLargeError";
+    this.maxBytes = maxBytes;
+  }
+}
+
+export class SseFrameCountLimitError extends Error {
+  readonly maxFrames: number;
+
+  constructor(maxFrames: number) {
+    super(`upstream SSE chunk exceeded ${maxFrames} frame limit`);
+    this.name = "SseFrameCountLimitError";
+    this.maxFrames = maxFrames;
+  }
+}
+
+export type BoundedSseFrame = {
+  block: Uint8Array;
+  delimiter: Uint8Array;
+};
+
+/**
+ * Classify the bytes at `index` as an SSE block delimiter.
+ *
+ * Returns the delimiter length in bytes, `0` when `index` does not start a
+ * delimiter, and `undefined` when more bytes are required to decide.
+ */
+function delimiterLengthAt(
+  index: number,
+  length: number,
+  byteAt: (index: number) => number,
+): number | undefined {
+  const first = byteAt(index);
+  if (first === 10) {
+    if (index + 1 >= length) return undefined;
+    const second = byteAt(index + 1);
+    if (second === 10) return 2;
+    if (second !== 13) return 0;
+    if (index + 2 >= length) return undefined;
+    return byteAt(index + 2) === 10 ? 3 : 0;
+  }
+  if (first !== 13) return 0;
+  if (index + 1 >= length) return undefined;
+  if (byteAt(index + 1) !== 10) return 0;
+  if (index + 2 >= length) return undefined;
+  const third = byteAt(index + 2);
+  if (third === 10) return 3;
+  if (third !== 13) return 0;
+  if (index + 3 >= length) return undefined;
+  return byteAt(index + 3) === 10 ? 4 : 0;
+}
+
+function delimiterBytesAt(
+  index: number,
+  delimiterLength: number,
+  byteAt: (index: number) => number,
+): Uint8Array {
+  if (delimiterLength === 2) return LF_LF;
+  if (delimiterLength === 4) return CR_LF_CR_LF;
+  return byteAt(index) === 10 ? LF_CR_LF : CR_LF_LF;
+}
+
+function copyRange(
+  start: number,
+  end: number,
+  tailLength: number,
+  previousTail: Uint8Array,
+  chunk: Uint8Array,
+): Uint8Array {
+  const out = new Uint8Array(end - start);
+  for (let index = start; index < end; index += 1) {
+    out[index - start] = index < tailLength
+      ? previousTail[index]!
+      : chunk[index - tailLength]!;
+  }
+  return out;
+}
+
+/**
+ * True when a complete SSE block already commits a Responses terminal event.
+ *
+ * Framing errors in bytes *after* such a block must not retroactively turn an
+ * already-completed/failed/incomplete model turn into a transport failure. This
+ * helper is used only on the exceptional path, so decoding/JSON parsing has no
+ * cost on ordinary framing.
+ */
+function isResponsesTerminalFrame(block: Uint8Array): boolean {
+  const data: string[] = [];
+  for (const line of new TextDecoder().decode(block).split(/\r?\n/)) {
+    if (!line.startsWith("data:")) continue;
+    const value = line.slice(5);
+    data.push(value.startsWith(" ") ? value.slice(1) : value);
+  }
+  if (data.length === 0) return false;
+  const payload = data.join("\n");
+  if (payload === "[DONE]") return false;
+  try {
+    const parsed = JSON.parse(payload) as { type?: unknown };
+    return parsed.type === "response.completed"
+      || parsed.type === "response.failed"
+      || parsed.type === "response.incomplete";
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Byte-bounded SSE block framer for client-facing protocol paths.
+ *
+ * The delimiter scanner works on raw bytes, so fragmented UTF-8 cannot change
+ * accounting and a hostile upstream cannot grow an unterminated JS string
+ * without limit. Candidate bytes live in one geometrically grown buffer rather
+ * than one allocation per upstream chunk, bounding both bytes and object count.
+ * Complete blocks are returned without their delimiter; the exact delimiter
+ * bytes are returned separately so callers can relay bytes unchanged.
+ */
+export class BoundedSseFrameBuffer {
+  private readonly maxFrameBytes: number;
+  private readonly maxFramesPerFeed: number;
+  private delimiterTail: Uint8Array = new Uint8Array(0);
+  private candidate: Uint8Array = new Uint8Array(0);
+  private candidateBytes = 0;
+  private disposed = false;
+
+  constructor(maxFrameBytes = MAX_CLIENT_SSE_FRAME_BYTES) {
+    if (!Number.isSafeInteger(maxFrameBytes) || maxFrameBytes <= 0) {
+      throw new RangeError("maxFrameBytes must be a positive safe integer");
+    }
+    this.maxFrameBytes = maxFrameBytes;
+    // Delimiter-only input otherwise creates an object-amplification path that
+    // is independent of candidate bytes. Keep frame count proportional to the
+    // configured byte budget while leaving ample room for real Responses events.
+    this.maxFramesPerFeed = Math.max(1, Math.ceil(maxFrameBytes / 1024));
+  }
+
+  private clear(): void {
+    this.delimiterTail = new Uint8Array(0);
+    this.candidate = new Uint8Array(0);
+    this.candidateBytes = 0;
+  }
+
+  private ensureCapacity(requiredBytes: number): void {
+    if (this.candidate.byteLength >= requiredBytes) return;
+    if (requiredBytes > this.maxFrameBytes) {
+      throw new SseFrameTooLargeError(this.maxFrameBytes);
+    }
+    let capacity = this.candidate.byteLength === 0
+      ? Math.min(this.maxFrameBytes, Math.max(requiredBytes, 4096))
+      : this.candidate.byteLength;
+    while (capacity < requiredBytes) {
+      capacity = Math.min(this.maxFrameBytes, Math.max(requiredBytes, capacity * 2));
+    }
+    const grown = new Uint8Array(capacity);
+    if (this.candidateBytes > 0) {
+      grown.set(this.candidate.subarray(0, this.candidateBytes));
+    }
+    this.candidate = grown;
+  }
+
+  private retain(slice: Uint8Array): void {
+    if (slice.byteLength === 0) return;
+    const nextBytes = this.candidateBytes + slice.byteLength;
+    if (nextBytes > this.maxFrameBytes) {
+      this.clear();
+      this.disposed = true;
+      throw new SseFrameTooLargeError(this.maxFrameBytes);
+    }
+    this.ensureCapacity(nextBytes);
+    this.candidate.set(slice, this.candidateBytes);
+    this.candidateBytes = nextBytes;
+  }
+
+  private takeCandidate(): Uint8Array {
+    if (this.candidateBytes === 0) return new Uint8Array(0);
+    const block = this.candidate.slice(0, this.candidateBytes);
+    // Release the working allocation after each complete frame. This avoids
+    // retaining a rare multi-MiB frame allocation for the rest of a long-lived
+    // stream; normal small-frame allocation remains bounded by feed's frame cap.
+    this.candidate = new Uint8Array(0);
+    this.candidateBytes = 0;
+    return block;
+  }
+
+  feed(chunk: Uint8Array): BoundedSseFrame[] {
+    if (this.disposed) return [];
+    if (chunk.byteLength === 0) return [];
+
+    const frames: BoundedSseFrame[] = [];
+    const previousTail = this.delimiterTail;
+    this.delimiterTail = new Uint8Array(0);
+    const tailLength = previousTail.byteLength;
+    const totalLength = tailLength + chunk.byteLength;
+    const byteAt = (index: number): number => index < tailLength
+      ? previousTail[index]!
+      : chunk[index - tailLength]!;
+    const retainRange = (start: number, end: number): void => {
+      if (end <= start) return;
+      if (start < tailLength) {
+        this.retain(previousTail.subarray(start, Math.min(end, tailLength)));
+      }
+      if (end > tailLength) {
+        this.retain(chunk.subarray(Math.max(0, start - tailLength), end - tailLength));
+      }
+    };
+
+    try {
+      let index = 0;
+      let retainedThrough = 0;
+      while (index < totalLength) {
+        const delimiterLength = delimiterLengthAt(index, totalLength, byteAt);
+        if (delimiterLength === undefined) break;
+        if (delimiterLength > 0) {
+          if (frames.length >= this.maxFramesPerFeed) {
+            this.clear();
+            this.disposed = true;
+            throw new SseFrameCountLimitError(this.maxFramesPerFeed);
+          }
+          retainRange(retainedThrough, index);
+          const block = this.takeCandidate();
+          const delimiter = delimiterBytesAt(index, delimiterLength, byteAt);
+          frames.push({ block, delimiter });
+          index += delimiterLength;
+          retainedThrough = index;
+          continue;
+        }
+        index += 1;
+      }
+
+      retainRange(retainedThrough, index);
+      if (index < totalLength) {
+        this.delimiterTail = copyRange(index, totalLength, tailLength, previousTail, chunk);
+      }
+      return frames;
+    } catch (err) {
+      const framingError = err instanceof SseFrameTooLargeError
+        || err instanceof SseFrameCountLimitError;
+      if (framingError && frames.some(frame => isResponsesTerminalFrame(frame.block))) {
+        // A terminal frame is the Responses protocol boundary. Ignore malformed
+        // or oversized bytes that occur later in the same upstream chunk rather
+        // than retroactively replacing the committed terminal with a 502.
+        this.clear();
+        this.disposed = true;
+        return frames;
+      }
+      throw err;
+    }
+  }
+
+  /** Return the final unterminated block bytes and release all retained state. */
+  finish(): Uint8Array {
+    if (this.disposed) return new Uint8Array(0);
+    try {
+      this.retain(this.delimiterTail);
+      this.delimiterTail = new Uint8Array(0);
+      return this.takeCandidate();
+    } finally {
+      this.clear();
+      this.disposed = true;
+    }
+  }
+
+  dispose(): void {
+    if (this.disposed) return;
+    this.clear();
+    this.disposed = true;
+  }
+}
+
+export function joinSseFrameBytes(parts: readonly Uint8Array[]): Uint8Array {
+  let byteLength = 0;
+  for (const part of parts) byteLength += part.byteLength;
+  if (byteLength === 0) return new Uint8Array(0);
+  if (parts.length === 1 && parts[0]!.byteLength === byteLength) return parts[0]!;
+  const joined = new Uint8Array(byteLength);
+  let offset = 0;
+  for (const part of parts) {
+    joined.set(part, offset);
+    offset += part.byteLength;
+  }
+  return joined;
+}