@yansigit/opencodex 2.31.3 → 2.33.0

package/src/server/responses/codex-auth-error.ts

@@ -0,0 +1,55 @@
+import { formatErrorResponse } from "../../bridge";
+import {
+  CodexAccountCooldownError,
+  codexMainProfileDrainingResponse,
+  cooldownErrorResponse,
+  CodexAuthContextError,
+  CodexDirectAuthenticationError,
+  CodexMainProfileDrainingError,
+  CodexMainSubstitutionUnavailableError,
+  CodexPoolAuthenticationError,
+  CodexThreadAffinityExpiredError,
+} from "../../codex/auth-context";
+
+export interface CodexAuthContextErrorResponseOptions {
+  accountSelector?: string;
+  now: number;
+}
+
+/** Shared HTTP contract for Codex auth-context failures on Responses surfaces. */
+export function mapCodexAuthContextErrorToResponse(
+  error: unknown,
+  options: CodexAuthContextErrorResponseOptions,
+): Response | undefined {
+  if (error instanceof CodexAccountCooldownError) {
+    return cooldownErrorResponse(error, options.now, options.accountSelector);
+  }
+  if (error instanceof CodexMainProfileDrainingError) {
+    return codexMainProfileDrainingResponse();
+  }
+  if (error instanceof CodexThreadAffinityExpiredError) {
+    return formatErrorResponse(
+      409,
+      "invalid_request_error",
+      "Codex thread account affinity expired; start a new session",
+    );
+  }
+  if (error instanceof CodexAuthContextError) {
+    return formatErrorResponse(
+      401,
+      "authentication_error",
+      "Selected Codex account needs reauthentication",
+    );
+  }
+  if (error instanceof CodexPoolAuthenticationError || error instanceof CodexDirectAuthenticationError) {
+    return formatErrorResponse(401, "authentication_error", error.message);
+  }
+  if (error instanceof CodexMainSubstitutionUnavailableError) {
+    return formatErrorResponse(
+      401,
+      "authentication_error",
+      "No usable Codex main credential to serve this request",
+    );
+  }
+  return undefined;
+}

package/src/server/responses/combo-stream-preflight.ts

@@ -0,0 +1,171 @@
+import type { ResponsesTerminalStatus } from "../../bridge";
+import type { RequestLogContext } from "../request-log";
+import { createSseInspector } from "../relay";
+import { MAX_CLIENT_SSE_FRAME_BYTES } from "../sse-frame-buffer";
+
+const COMBO_STREAM_PREFLIGHT_MAX_BYTES = MAX_CLIENT_SSE_FRAME_BYTES;
+
+const PRE_OUTPUT_CONTROL_EVENTS = new Set([
+  "response.created",
+  "response.in_progress",
+  "response.queued",
+  "response.heartbeat",
+]);
+
+const TERMINAL_EVENTS = new Set([
+  "response.completed",
+  "response.failed",
+  "response.incomplete",
+]);
+
+/**
+ * Decide when replaying the request on another combo target would risk duplicating
+ * client-visible output or a tool-side effect. Unknown event types commit the child
+ * conservatively; only the small Responses lifecycle preamble remains replayable.
+ */
+export function comboStreamPayloadCommitsOutput(payload: unknown): boolean {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return true;
+  const type = (payload as { type?: unknown }).type;
+  if (typeof type !== "string") return true;
+  return !PRE_OUTPUT_CONTROL_EVENTS.has(type) && !TERMINAL_EVENTS.has(type);
+}
+
+function replayBufferedResponse(
+  response: Response,
+  reader: ReadableStreamDefaultReader<Uint8Array>,
+  buffered: Uint8Array[],
+): Response {
+  let index = 0;
+  const body = new ReadableStream<Uint8Array>({
+    async pull(controller) {
+      if (index < buffered.length) {
+        controller.enqueue(buffered[index++]!);
+        return;
+      }
+      try {
+        const next = await reader.read();
+        if (next.done) controller.close();
+        else controller.enqueue(next.value);
+      } catch (error) {
+        try { controller.error(error); } catch { /* consumer already closed */ }
+      }
+    },
+    cancel(reason) {
+      reader.cancel(reason).catch(() => undefined);
+    },
+  });
+  return new Response(body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: response.headers,
+  });
+}
+
+function failedTerminalResponse(
+  response: Response,
+  terminalPayload: Record<string, unknown>,
+  logCtx: RequestLogContext,
+): Response {
+  const nested = terminalPayload.response;
+  const terminalResponse = nested && typeof nested === "object" && !Array.isArray(nested)
+    ? nested as Record<string, unknown>
+    : {};
+  const nestedError = terminalResponse.error;
+  const error = nestedError && typeof nestedError === "object" && !Array.isArray(nestedError)
+    ? nestedError as Record<string, unknown>
+    : {
+      type: "upstream_error",
+      code: "upstream_server_error",
+      message: logCtx.upstreamError ?? "Provider stream failed before producing output",
+    };
+  const headers = new Headers(response.headers);
+  headers.set("content-type", "application/json");
+  headers.delete("content-length");
+  headers.delete("content-encoding");
+  const usage = terminalResponse.usage;
+  return new Response(JSON.stringify({
+    error,
+    // The combo classifier needs only the error and optional usage. Do not carry
+    // response ids, provider metadata, or future terminal fields into the client
+    // error envelope merely because they shared the terminal snapshot.
+    response: {
+      error,
+      ...(usage && typeof usage === "object" && !Array.isArray(usage) ? { usage } : {}),
+    },
+  }), {
+    status: logCtx.terminalHttpStatus ?? 502,
+    headers,
+  });
+}
+
+export type ComboStreamPreflightResult =
+  | { kind: "accepted"; response: Response }
+  | { kind: "failed"; response: Response };
+
+/**
+ * Buffer a combo child's downstream SSE only until the request becomes unsafe to
+ * replay or reaches a terminal. This owns exactly one body reader. The aggregate
+ * buffer is capped; hitting the cap commits the current target instead of growing
+ * memory or guessing that replay is safe.
+ */
+export async function preflightComboStreamResponse(
+  response: Response,
+  logCtx: RequestLogContext,
+): Promise<ComboStreamPreflightResult> {
+  const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
+  if (!response.ok || !response.body || !contentType.includes("text/event-stream")) {
+    return { kind: "accepted", response };
+  }
+
+  const reader = response.body.getReader();
+  const buffered: Uint8Array[] = [];
+  let bufferedBytes = 0;
+  let outputCommitted = false;
+  let terminalStatus: ResponsesTerminalStatus | undefined;
+  let failedPayload: Record<string, unknown> | undefined;
+  const inspector = createSseInspector({
+    logCtx,
+    onParsedPayload: payload => {
+      if (comboStreamPayloadCommitsOutput(payload)) outputCommitted = true;
+      if (!payload || typeof payload !== "object" || Array.isArray(payload)) return;
+      if ((payload as { type?: unknown }).type === "response.failed") {
+        failedPayload = payload as Record<string, unknown>;
+      }
+    },
+    onTerminal: status => { terminalStatus = status; },
+  });
+
+  try {
+    for (;;) {
+      const next = await reader.read();
+      if (next.done) {
+        inspector.finish();
+      } else {
+        if (bufferedBytes + next.value.byteLength > COMBO_STREAM_PREFLIGHT_MAX_BYTES) {
+          // Keep the cap about memory the preflight allocates. The upstream chunk already exists;
+          // copying it before committing would transiently exceed the boundary for no
+          // replay benefit. Preserve it unsliced behind the already-bounded prefix.
+          return {
+            kind: "accepted",
+            response: replayBufferedResponse(response, reader, [...buffered, next.value]),
+          };
+        }
+        const retained = next.value.slice();
+        buffered.push(retained);
+        bufferedBytes += retained.byteLength;
+        inspector.feed(retained);
+      }
+
+      if (terminalStatus === "failed" && !outputCommitted && failedPayload) {
+        await reader.cancel("retrying zero-output combo stream failure").catch(() => undefined);
+        return { kind: "failed", response: failedTerminalResponse(response, failedPayload, logCtx) };
+      }
+      if (next.done || terminalStatus !== undefined || outputCommitted
+        || bufferedBytes >= COMBO_STREAM_PREFLIGHT_MAX_BYTES) {
+        return { kind: "accepted", response: replayBufferedResponse(response, reader, buffered) };
+      }
+    }
+  } finally {
+    inspector.dispose();
+  }
+}

package/src/server/responses/compact.ts

@@ -42,17 +42,9 @@ import { describeImagesInPlace, planVisionSidecar, shouldResolveOpenAiVisionSide
 import { createAdapterEventQueue, preflightAdapterEvents } from "../../adapters/run-turn-queue";
 import {
   applyCodexAuthContextToProvider,
-  CodexAccountCooldownError,
-  codexMainProfileDrainingResponse,
-  cooldownErrorResponse,
-  CodexAuthContextError,
-  CodexDirectAuthenticationError,
   CodexMainProfileDrainingError,
-  CodexPoolAuthenticationError,
-  CodexThreadAffinityExpiredError,
   headersForCodexAuthContext,
   materializeCodexUpstreamAuth,
-  CodexMainSubstitutionUnavailableError,
   isCodexAuthContextUsable,
   resolveCodexAuthContext,
   codexProbeLeaseId,
@@ -134,6 +126,8 @@ import {
   usesCodexForwardPoolAuth,
 } from "./core";
 import { fetchWithHeaderTimeout, providerFetch, safeHostLabel, safeOriginLabel } from "./fetch-helpers";
+import { mapCodexAuthContextErrorToResponse } from "./codex-auth-error";
+import { decideV2NativeParentOverride } from "./v2-native-parent-override";
 
 export const COMPACT_RESPONSE_MAX_BYTES = 32 * 1024 * 1024;
 
@@ -304,6 +298,31 @@ export async function handleResponsesCompact(
     }
     return formatErrorResponse(404, "invalid_request_error", err instanceof Error ? err.message : String(err));
   }
+  const requestedModel = raw.model;
+  // Populate source-route identity before the opt-in decision can fail closed. This keeps
+  // malformed/unavailable targets observable as the caller's route without exposing any new data.
+  logCtx.requestedModel = requestedModel;
+  logCtx.model = route.modelId;
+  logCtx.routeDecision = route.routeDecision;
+  logCtx.provider = route.codexAccountNamespace
+    ? `${route.providerName}-${route.codexAccountNamespace}`
+    : route.providerName;
+  logCtx.providerAdapter = route.provider.adapter;
+  const parentOverride = decideV2NativeParentOverride({
+    kind: "compact",
+    config,
+    headers: req.headers,
+    sourceRoute: route,
+    targetEvidence: evidenceFromBody(raw),
+  });
+  if (parentOverride.kind === "reject") {
+    if (parentOverride.trace) logCtx.routeDecision = parentOverride.trace as typeof logCtx.routeDecision;
+    return formatErrorResponse(404, "invalid_request_error", parentOverride.message);
+  }
+  if (parentOverride.kind === "override") {
+    route = parentOverride.route;
+    raw.model = route.modelId;
+  }
   const selectedModelId = route.modelId;
   // Derive from the RESOLVED route model, not the caller's raw string. An account-qualified
   // selector like `side/gpt-daybreak-blue-latest` does not match the gated map — `slugsEquivalent`
@@ -311,7 +330,7 @@ export async function handleResponsesCompact(
   // exactly the selector form back down the native compact endpoint this guard exists to avoid.
   // `route.modelId` is the same value `applyCodexAccountGatedWireNormalization` uses in core.ts.
   const accountGatedCompactWireModel = codexAccountGatedCanonicalWireModel(selectedModelId);
-  logCtx.requestedModel = raw.model;
+  logCtx.requestedModel = requestedModel;
   logCtx.model = selectedModelId;
   logCtx.routeDecision = route.routeDecision;
   logCtx.provider = route.codexAccountNamespace
@@ -395,19 +414,11 @@ export async function handleResponsesCompact(
         }
       }
     } catch (err) {
-      if (err instanceof CodexAccountCooldownError) {
-        return cooldownErrorResponse(err, Date.now(), route.codexAccountNamespace);
-      }
-      if (err instanceof CodexMainProfileDrainingError) return codexMainProfileDrainingResponse();
-      if (err instanceof CodexThreadAffinityExpiredError) {
-        return formatErrorResponse(409, "invalid_request_error", "Codex thread account affinity expired; start a new session");
-      }
-      if (err instanceof CodexAuthContextError) {
-        return formatErrorResponse(401, "authentication_error", "Selected Codex account needs reauthentication");
-      }
-      if (err instanceof CodexPoolAuthenticationError || err instanceof CodexDirectAuthenticationError) {
-        return formatErrorResponse(401, "authentication_error", err.message);
-      }
+      const response = mapCodexAuthContextErrorToResponse(err, {
+        accountSelector: route.codexAccountNamespace,
+        now: Date.now(),
+      });
+      if (response) return response;
       throw err;
     }
     const base = isCanonicalOpenAiForwardProvider(compactProvider)
@@ -692,6 +703,9 @@ export async function handleResponsesCompact(
     body: JSON.stringify(internalBody),
   });
   const response = await handleResponses(internalReq, config, logCtx, { abortSignal: req.signal, turnAdmissionLease, ...(admission ? { admission } : {}) });
+  // The internal summarizer is a routed Responses turn, but compact logs retain the
+  // caller's selector just like the native compact branch above.
+  logCtx.requestedModel = requestedModel;
   if (!response.ok) return response;
   let json: { output?: unknown[]; status?: unknown; error?: unknown };
   if (response.headers.get("content-type")?.includes("text/event-stream")) {